* [PATCH 5.10 000/406] 5.10.195-rc1 review
@ 2023-09-17 19:07 Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 001/406] erofs: ensure that the post-EOF tails are all zeroed Greg Kroah-Hartman
` (414 more replies)
0 siblings, 415 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
This is the start of the stable review cycle for the 5.10.195 release.
There are 406 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.10.195-rc1
Helge Deller <deller@gmx.de>
parisc: Drop loops_per_jiffy from per_cpu struct
Wesley Chalmers <wesley.chalmers@amd.com>
drm/amd/display: Fix a bug when searching for insert_above_mpcc
Kuniyuki Iwashima <kuniyu@amazon.com>
kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
Vadim Fedorenko <vadim.fedorenko@linux.dev>
ixgbe: fix timestamp configuration code
Eric Dumazet <edumazet@google.com>
ipv6: fix ip6_sock_set_addr_preferences() typo
Liu Jian <liujian56@huawei.com>
net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
Liming Sun <limings@nvidia.com>
platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
Liming Sun <limings@nvidia.com>
platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
Shigeru Yoshida <syoshida@redhat.com>
kcm: Fix memory leak in error path of kcm_sendmsg()
Hayes Wang <hayeswang@realtek.com>
r8152: check budget for r8152_poll()
Ziyang Xuan <william.xuanziyang@huawei.com>
hsr: Fix uninit-value access in fill_frame_info()
Hangyu Hua <hbh25y@gmail.com>
net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
Hangyu Hua <hbh25y@gmail.com>
net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
Guangguan Wang <guangguan.wang@linux.alibaba.com>
net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
Björn Töpel <bjorn@rivosinc.com>
kselftest/runner.sh: Propagate SIGTERM to runner child
SeongJae Park <sjpark@amazon.de>
selftests/kselftest/runner/run_one(): allow running non-executable files
Liu Jian <liujian56@huawei.com>
net: ipv4: fix one memleak in __inet_del_ifa()
Qiang Yu <quic_qianyu@quicinc.com>
bus: mhi: host: Skip MHI reset if device is in RDDM
Aleksey Nasibulin <alealexpro100@ya.ru>
ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
Paul Cercueil <paul@crapouillou.net>
ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Flush mailbox commands on chip reset
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Fix crash in PCIe error handling
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
Saurav Kashyap <skashyap@marvell.com>
scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
D Scott Phillips <scott@os.amperecomputing.com>
arm64: sdei: abort running SDEI handlers during crash
Shuai Xue <xueshuai@linux.alibaba.com>
ACPI: APEI: explicit init of HEST and GHES in apci_init()
Namhyung Kim <namhyung@kernel.org>
perf hists browser: Fix the number of entries for 'e' key
Namhyung Kim <namhyung@kernel.org>
perf tools: Handle old data in PERF_RECORD_ATTR
Namhyung Kim <namhyung@kernel.org>
perf hists browser: Fix hierarchy mode header
Hamza Mahfooz <hamza.mahfooz@amd.com>
drm/amd/display: prevent potential division by zero errors
William Zhang <william.zhang@broadcom.com>
mtd: rawnand: brcmnand: Fix potential false time out warning
William Zhang <william.zhang@broadcom.com>
mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
William Zhang <william.zhang@broadcom.com>
mtd: rawnand: brcmnand: Fix crash during the panic_write
Anand Jain <anand.jain@oracle.com>
btrfs: use the correct superblock to compare fsid in btrfs_validate_super
Filipe Manana <fdmanana@suse.com>
btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
ruanmeisi <ruan.meisi@zte.com.cn>
fuse: nlookup missing decrement in fuse_direntplus_link
Damien Le Moal <dlemoal@kernel.org>
ata: pata_ftide010: Add missing MODULE_DESCRIPTION
Damien Le Moal <dlemoal@kernel.org>
ata: sata_gemini: Add missing MODULE_DESCRIPTION
Wang Jianjian <wangjianjian0@foxmail.com>
ext4: add correct group descriptors and reserved GDT blocks to system zone
Petr Tesarik <petr.tesarik.ext@huawei.com>
sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
Yisen Zhuang <yisen.zhuang@huawei.com>
net: hns3: fix the port information display when sfp is absent
Wander Lairson Costa <wander@redhat.com>
netfilter: nfnetlink_osf: avoid OOB read
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
Vladimir Oltean <vladimir.oltean@nxp.com>
net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
Eric Dumazet <edumazet@google.com>
ip_tunnels: use DEV_STATS_INC()
Ariel Marcovitch <arielmarcovitch@gmail.com>
idr: fix param name in idr_alloc_cyclic() doc
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
s390/zcrypt: don't leak memory if dev_set_name() fails
Olga Zaborska <olga.zaborska@intel.com>
igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
Olga Zaborska <olga.zaborska@intel.com>
igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
Olga Zaborska <olga.zaborska@intel.com>
igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
Shigeru Yoshida <syoshida@redhat.com>
kcm: Destroy mutex in kcm_exit_net()
valis <sec@valis.email>
net: sched: sch_qfq: Fix UAF in qfq_dequeue()
Kuniyuki Iwashima <kuniyu@amazon.com>
af_unix: Fix data race around sk->sk_err.
Kuniyuki Iwashima <kuniyu@amazon.com>
af_unix: Fix data-races around sk->sk_shutdown.
Kuniyuki Iwashima <kuniyu@amazon.com>
af_unix: Fix data-race around unix_tot_inflight.
Kuniyuki Iwashima <kuniyu@amazon.com>
af_unix: Fix data-races around user->unix_inflight.
Alex Henrie <alexhenrie24@gmail.com>
net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
Liang Chen <liangchen.linux@gmail.com>
veth: Fixing transmit return status for dropped packets
Corinna Vinschen <vinschen@redhat.com>
igb: disable virtualization features on 82580
Sriram Yagnaraman <sriram.yagnaraman@est.tech>
ipv4: ignore dst hint for multipath routes
Sean Christopherson <seanjc@google.com>
drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
Colin Xu <colin.xu@intel.com>
drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
Eric Dumazet <edumazet@google.com>
net: read sk->sk_family once in sk_mc_loop()
Eric Dumazet <edumazet@google.com>
ipv4: annotate data-races around fi->fib_dead
Eric Dumazet <edumazet@google.com>
sctp: annotate data-races around sk->sk_wmem_queued
Eric Dumazet <edumazet@google.com>
net/sched: fq_pie: avoid stalls in fq_pie_timer()
Vladimir Zapolskiy <vz@mleia.com>
pwm: lpc32xx: Remove handling of PWM channels
Raag Jadav <raag.jadav@intel.com>
watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
Arnaldo Carvalho de Melo <acme@redhat.com>
perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
Sean Christopherson <seanjc@google.com>
x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
Arnaldo Carvalho de Melo <acme@redhat.com>
perf annotate bpf: Don't enclose non-debug code with an assert()
Ying Liu <victor.liu@nxp.com>
backlight: gpio_backlight: Drop output GPIO direction check for initial power state
Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
kconfig: fix possible buffer overflow
Fedor Pchelkin <pchelkin@ispras.ru>
NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
Trond Myklebust <trond.myklebust@hammerspace.com>
NFS: Fix a potential data corruption
Chris Lew <quic_clew@quicinc.com>
soc: qcom: qmi_encdec: Restrict string length in decode
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
Ahmad Fatoum <a.fatoum@pengutronix.de>
clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
dt-bindings: clock: xlnx,versal-clk: drop select:false
Raag Jadav <raag.jadav@intel.com>
pinctrl: cherryview: fix address_space_handler() argument
Helge Deller <deller@gmx.de>
parisc: led: Reduce CPU overhead for disk & lan LED computation
Helge Deller <deller@gmx.de>
parisc: led: Fix LAN receive and transmit LEDs
Andrew Donnellan <ajd@linux.ibm.com>
lib/test_meminit: allocate pages up to order MAX_ORDER
Thomas Zimmermann <tzimmermann@suse.de>
drm/ast: Fix DRAM init on AST2200
Thomas Zimmermann <tzimmermann@suse.de>
fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
Manish Rangankar <mrangankar@marvell.com>
scsi: qla2xxx: Remove unsupported ql2xenabledif option
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Turn off noisy message log
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Fix erroneous link up failure
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: fix inconsistent TMF timeout
Quinn Tran <qutran@marvell.com>
scsi: qla2xxx: Fix deletion race condition
Pavel Begunkov <asml.silence@gmail.com>
io_uring: break iopolling on signal
Pavel Begunkov <asml.silence@gmail.com>
io_uring: break out of iowq iopoll on teardown
Pavel Begunkov <asml.silence@gmail.com>
io_uring: always lock in io_apoll_task_func
Quan Tian <qtian@vmware.com>
net/ipv6: SKB symmetric hash should incorporate transport ports
Tom Rix <trix@redhat.com>
udf: initialize newblock to 0
Yu Kuai <yukuai3@huawei.com>
md/md-bitmap: remove unnecessary local variable in backlog_store()
Brian Foster <bfoster@redhat.com>
tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
Marco Felsch <m.felsch@pengutronix.de>
usb: typec: tcpci: clear the fault status bit
Alan Stern <stern@rowland.harvard.edu>
USB: core: Fix oversight in SuperSpeed initialization
Alan Stern <stern@rowland.harvard.edu>
USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
Alan Stern <stern@rowland.harvard.edu>
USB: core: Change usb_get_device_descriptor() API
Alan Stern <stern@rowland.harvard.edu>
USB: core: Unite old scheme and new scheme descriptor reads
RD Babiera <rdbabiera@google.com>
usb: typec: bus: verify partner exists in typec_altmode_attention
Gustavo A. R. Silva <gustavoars@kernel.org>
cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
Thomas Bourgoin <thomas.bourgoin@foss.st.com>
crypto: stm32 - fix loop iterating through scatterlist for DMA
Sven Schnelle <svens@linux.ibm.com>
s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
Enlin Mu <enlin.mu@unisoc.com>
pstore/ram: Check start of empty przs during init
Eric Biggers <ebiggers@google.com>
fsverity: skip PKCS#7 parser when keyring is empty
Nicolas Dichtel <nicolas.dichtel@6wind.com>
net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
Thore Sommer <public@thson.de>
X.509: if signature is unsupported skip validation
Jann Horn <jannh@google.com>
dccp: Fix out of bounds access in DCCP error handler
Alexander Aring <aahringo@redhat.com>
dlm: fix plock lookup when using multiple lockspaces
Yafang Shao <laoar.shao@gmail.com>
bpf: Fix issue in verifying allow_ptr_leaks
Helge Deller <deller@gmx.de>
parisc: Fix /proc/cpuinfo output for lscpu
Aleksa Sarai <cyphar@cyphar.com>
procfs: block chmod on /proc/thread-self/comm
Bjorn Helgaas <bhelgaas@google.com>
Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
Dave Jiang <dave.jiang@intel.com>
ntb: Fix calculation ntb_transport_tx_free_entry()
Dave Jiang <dave.jiang@intel.com>
ntb: Clean up tx tail index on link down
Dave Jiang <dave.jiang@intel.com>
ntb: Drop packets when qp link is down
Ranjan Kumar <ranjan.kumar@broadcom.com>
scsi: mpt3sas: Perform additional retries if doorbell read returns 0
Nilesh Javali <njavali@marvell.com>
Revert "scsi: qla2xxx: Fix buffer overrun"
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
media: dvb: symbol fixup for dvb_attach()
Will Deacon <will@kernel.org>
arm64: csum: Fix OoB access in IP checksum code for negative lengths
Max Filippov <jcmvbkbc@gmail.com>
xtensa: PMU: fix base address for the newer hardware
Thomas Zimmermann <tzimmermann@suse.de>
backlight/lv5207lp: Compare against struct fb_info.device
Thomas Zimmermann <tzimmermann@suse.de>
backlight/bd6107: Compare against struct fb_info.device
Thomas Zimmermann <tzimmermann@suse.de>
backlight/gpio_backlight: Compare against struct fb_info.device
Gustavo A. R. Silva <gustavoars@kernel.org>
ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
Yi Yang <yiyang13@huawei.com>
ipmi_si: fix a memleak in try_smi_init()
Bart Van Assche <bvanassche@acm.org>
scsi: core: Fix the scsi_set_resid() documentation
Kees Cook <keescook@chromium.org>
printk: ringbuffer: Fix truncating buffer size min_t cast
Takashi Iwai <tiwai@suse.de>
ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
Boris Brezillon <boris.brezillon@collabora.com>
PM / devfreq: Fix leak in devfreq_dev_release()
Radoslaw Tyl <radoslawx.tyl@intel.com>
igb: set max size RX buffer when store bad packet is enabled
Mohamed Khalfella <mkhalfella@purestorage.com>
skbuff: skb_segment, Call zero copy functions before using skbuff frags
Wander Lairson Costa <wander@redhat.com>
netfilter: xt_sctp: validate the flag_info count
Wander Lairson Costa <wander@redhat.com>
netfilter: xt_u32: validate user space input
Kyle Zeng <zengyhkyle@gmail.com>
netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
Eric Dumazet <edumazet@google.com>
igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
Yuan Yao <yuanyaogoog@chromium.org>
virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
Liao Chang <liaochang1@huawei.com>
cpufreq: Fix the race condition while updating the transition_task of policy
ruanjinjie <ruanjinjie@huawei.com>
dmaengine: ste_dma40: Add missing IRQ check in d40_probe
Randy Dunlap <rdunlap@infradead.org>
um: Fix hostaudio build errors
Yi Yang <yiyang13@huawei.com>
mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
Hsin-Yi Wang <hsinyi@chromium.org>
mtd: spi-nor: Check bus width while setting QE bit
Marek Behún <kabel@kernel.org>
leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
Jiasheng Jiang <jiasheng@iscas.ac.cn>
rpmsg: glink: Add check for kstrdup
Jonas Karlman <jonas@kwiboo.se>
phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
Zheng Yang <zhengyang@rock-chips.com>
phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
Jonas Karlman <jonas@kwiboo.se>
phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
William Zhang <william.zhang@broadcom.com>
mtd: rawnand: brcmnand: Fix mtd oobsize
Zheng Yejian <zhengyejian1@huawei.com>
tracing: Fix race issue between cpu buffer write and swap
Dave Hansen <dave.hansen@linux.intel.com>
x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
Rahul Rameshbabu <sergeantsagara@protonmail.com>
HID: multitouch: Correct devm device reference for hidinput input_dev name
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Correct wrong debug message
Guoqing Jiang <guoqing.jiang@linux.dev>
RDMA/siw: Balance the reference of cep->kref in the error path
Leon Romanovsky <leon@kernel.org>
Revert "IB/isert: Fix incorrect release of isert connection"
Peng Fan <peng.fan@nxp.com>
amba: bus: fix refcount leak
Yi Yang <yiyang13@huawei.com>
serial: tegra: handle clk prepare error in tegra_uart_hw_init()
Chengfeng Ye <dg573847474@gmail.com>
scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
Tony Battersby <tonyb@cybernetics.com>
scsi: core: Use 32-bit hostnum in scsi_host_lookup()
Lu Jialin <lujialin4@huawei.com>
cgroup:namespace: Remove unused cgroup_namespaces_init()
Hans de Goede <hdegoede@redhat.com>
media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
Hans de Goede <hdegoede@redhat.com>
media: ov2680: Fix vflip / hflip set functions
Hans de Goede <hdegoede@redhat.com>
media: ov2680: Fix ov2680_bayer_order()
Hans de Goede <hdegoede@redhat.com>
media: ov2680: Remove auto-gain and auto-exposure controls
Dave Stevenson <dave.stevenson@raspberrypi.com>
media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
Marek Vasut <marex@denx.de>
media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
Alan Stern <stern@rowland.harvard.edu>
USB: gadget: f_mass_storage: Fix unused variable warning
Colin Ian King <colin.i.king@gmail.com>
media: go7007: Remove redundant if statement
Yanfei Xu <yanfei.xu@intel.com>
iommu/vt-d: Fix to flush cache of PASID directory table
AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
iommu/qcom: Disable and reset context bank before programming
Eddie James <eajames@linux.ibm.com>
fsi: aspeed: Reset master errors after CFAM reset
Xiang Yang <xiangyang3@huawei.com>
IB/uverbs: Fix an potential error pointer dereference
Dan Carpenter <dan.carpenter@linaro.org>
driver core: test_async: fix an error code
Rob Clark <robdclark@chromium.org>
dma-buf/sync_file: Fix docs syntax
Ruidong Tian <tianruidong@linux.alibaba.com>
coresight: tmc: Explicit type conversions to prevent integer overflow
Oleksandr Natalenko <oleksandr@redhat.com>
scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
Oleksandr Natalenko <oleksandr@redhat.com>
scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
Oleksandr Natalenko <oleksandr@redhat.com>
scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
Randy Dunlap <rdunlap@infradead.org>
x86/APM: drop the duplicate APM_MINOR_DEV macro
Chunyan Zhang <chunyan.zhang@unisoc.com>
serial: sprd: Fix DMA buffer leak issue
Chunyan Zhang <chunyan.zhang@unisoc.com>
serial: sprd: Assign sprd_port after initialized to avoid wrong access
Lin Ma <linma@zju.edu.cn>
scsi: qla4xxx: Add length check when parsing nlattrs
Lin Ma <linma@zju.edu.cn>
scsi: be2iscsi: Add length check when parsing nlattrs
Lin Ma <linma@zju.edu.cn>
scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
Lin Ma <linma@zju.edu.cn>
scsi: iscsi: Add length check for nlattr payload
Wenchao Hao <haowenchao@huawei.com>
scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
Bart Van Assche <bvanassche@acm.org>
scsi: RDMA/srp: Fix residual handling
Xu Yang <xu.yang_2@nxp.com>
usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
Irui Wang <irui.wang@mediatek.com>
media: mediatek: vcodec: Return NULL if no vdec_fb is found
Benjamin Gaignard <benjamin.gaignard@collabora.com>
media: rkvdec: increase max supported height for H.264
Xingui Yang <yangxingui@huawei.com>
scsi: hisi_sas: Fix normally completed I/O analysed as failed
Xingui Yang <yangxingui@huawei.com>
scsi: hisi_sas: Fix warnings detected by sparse
Xingui Yang <yangxingui@huawei.com>
scsi: hisi_sas: Modify v3 HW SATA completion error processing
Xingui Yang <yangxingui@huawei.com>
scsi: hisi_sas: Modify v3 HW SSP underflow error processing
Bart Van Assche <bvanassche@acm.org>
scsi: libsas: Introduce more SAM status code aliases in enum exec_status
Luo Jiaxing <luojiaxing@huawei.com>
scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
Daniil Dulov <d.dulov@aladdin.ru>
media: cx24120: Add retval check for cx24120_message_send()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
Daniil Dulov <d.dulov@aladdin.ru>
media: dib7000p: Fix potential division by zero
Dongliang Mu <dzm91@hust.edu.cn>
drivers: usb: smsusb: fix error handling code in smsusb_init_device
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
Claudiu Beznea <claudiu.beznea@microchip.com>
media: i2c: tvp5150: check return value of devm_kasprintf()
Hans de Goede <hdegoede@redhat.com>
media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
Olga Kornievskaia <kolga@netapp.com>
NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
Benjamin Coddington <bcodding@redhat.com>
NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
Chuck Lever <chuck.lever@oracle.com>
NFSD: da_addr_body field missing in some GETDEVICEINFO replies
Su Hui <suhui@nfschina.com>
fs: lockd: avoid possible wrong NULL parameter
Alexei Filippov <halip0503@gmail.com>
jfs: validate max amount of blocks before allocation.
Russell Currey <ruscur@russell.cc>
powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
Dan Carpenter <dan.carpenter@linaro.org>
nfs/blocklayout: Use the passed in gfp flags
Russell Currey <ruscur@russell.cc>
powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
Michael Ellerman <mpe@ellerman.id.au>
powerpc: Don't include lppaca.h in paca.h
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
wifi: ath10k: Use RMW accessors for changing LNKCTL
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
net/mlx5: Use RMW accessors for changing LNKCTL
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
drm/radeon: Use RMW accessors for changing LNKCTL
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
drm/amdgpu: Use RMW accessors for changing LNKCTL
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/perf: Convert fsl_emb notifier to state machine callbacks
Sourabh Jain <sourabhjain@linux.ibm.com>
powerpc/fadump: reset dump area size if fadump memory reserve fails
Stefan Hajnoczi <stefanha@redhat.com>
vfio/type1: fix cap_migration information leak
Ahmad Fatoum <a.fatoum@pengutronix.de>
clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
Marco Felsch <m.felsch@pengutronix.de>
clk: imx8mp: fix sai4 clock
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI/ASPM: Use RMW accessors for changing LNKCTL
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
PCI: pciehp: Use RMW accessors for changing LNKCTL
Claudiu Beznea <claudiu.beznea@microchip.com>
pinctrl: mcp23s08: check return value of devm_kasprintf()
Wu Zongyong <wuzongyong@linux.alibaba.com>
PCI: Mark NVIDIA T4 GPUs to avoid bus reset
Konrad Dybcio <konrad.dybcio@linaro.org>
clk: qcom: reset: Use the correct type of sleep/delay based on length
Patrick Whewell <patrick.whewell@sightlineapplications.com>
clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
Kemeng Shi <shikemeng@huaweicloud.com>
ext4: correct grp validation in ext4_mb_good_group
David Wronek <davidwronek@gmail.com>
clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
Zhang Jianhua <chris.zjh@huawei.com>
clk: sunxi-ng: Modify mismatched function name
Minjie Du <duminjie@vivo.com>
drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
Corey Minyard <minyard@acm.org>
ipmi:ssif: Fix a memory leak when scanning for an adapter
Jiasheng Jiang <jiasheng@iscas.ac.cn>
ipmi:ssif: Add check for kstrdup
Su Hui <suhui@nfschina.com>
ALSA: ac97: Fix possible error value of *rac97
Geert Uytterhoeven <geert+renesas@glider.be>
of: unittest: Fix overlay type in apply/revert check
Tony Lindgren <tony@atomide.com>
bus: ti-sysc: Fix cast to enum warning
Sui Jingfeng <suijingfeng@loongson.cn>
drm/mediatek: Fix potential memory leak if vmap() fail
Tony Lindgren <tony@atomide.com>
bus: ti-sysc: Fix build warning for 64-bit build
Gaosheng Cui <cuigaosheng1@huawei.com>
audit: fix possible soft lockup in __audit_inode_child()
Fabio Estevam <festevam@denx.de>
drm/msm/a2xx: Call adreno_gpu_init() earlier
Yang Wang <kevinyang.wang@amd.com>
drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
Dan Carpenter <dan.carpenter@linaro.org>
smackfs: Prevent underflow in smk_set_cipso()
Zhang Shurong <zhang_shurong@foxmail.com>
firmware: meson_sm: fix to avoid potential NULL pointer dereference
Daniel Vetter <daniel.vetter@ffwll.ch>
drm/msm/mdp5: Don't leak some plane state
Jiasheng Jiang <jiasheng@iscas.ac.cn>
drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
Nayna Jain <nayna@linux.ibm.com>
ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
Marek Vasut <marex@denx.de>
drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
Geert Uytterhoeven <geert+renesas@glider.be>
drm/armada: Fix off-by-one error in armada_overlay_get_property()
Ruan Jinjie <ruanjinjie@huawei.com>
of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
Yangtao Li <frank.li@vivo.com>
drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
Tan Zhongjun <tanzhongjun@yulong.com>
drm/tegra: Remove superfluous error messages around platform_get_irq()
Yu Kuai <yukuai3@huawei.com>
md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
Guoqing Jiang <guoqing.jiang@linux.dev>
md/bitmap: don't set max_write_behind if there is no write mostly device
Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
Bogdan Togorean <bogdan.togorean@analog.com>
drm: adv7511: Fix low refresh rate register for ADV7533/5
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
Krzysztof Kozlowski <krzk@kernel.org>
ARM: dts: s5pv210: adjust node names to DT spec
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
ARM: dts: s3c64xx: align pinctrl with dtschema
Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
x86/mm: Fix PAT bit missing from page protection modify mask
Lucas Stach <l.stach@pengutronix.de>
drm/etnaviv: fix dumping of active MMU context
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Add cells sizes to PCIe node
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Drop nonexistent #usb-cells
Rafał Miłecki <rafal@milecki.pl>
ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
Serge Semin <Sergey.Semin@baikalelectronics.ru>
ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
Arnd Bergmann <arnd@arndb.de>
drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
Konrad Dybcio <konrad.dybcio@linaro.org>
arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
Luca Weiss <luca@z3ntu.xyz>
soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
Luca Weiss <luca@z3ntu.xyz>
soc: qcom: ocmem: Add OCMEM hardware version print
Randy Dunlap <rdunlap@infradead.org>
ASoC: stac9766: fix build errors with REGMAP_AC97
Baokun Li <libaokun1@huawei.com>
quota: fix dqput() to follow the guarantees dquot_srcu should provide
Baokun Li <libaokun1@huawei.com>
quota: add new helper dquot_active()
Baokun Li <libaokun1@huawei.com>
quota: rename dquot_active() to inode_quota_active()
Baokun Li <libaokun1@huawei.com>
quota: factor out dquot_write_dquot()
Marek Vasut <marex@denx.de>
drm/bridge: tc358764: Fix debug print parameter order
Kuniyuki Iwashima <kuniyu@amazon.com>
netrom: Deny concurrent connect().
Budimir Markovic <markovicbudimir@gmail.com>
net/sched: sch_hfsc: Ensure inner classes have fsc curve
Biju Das <biju.das.jz@bp.renesas.com>
hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
Vadim Pasternak <vadimp@nvidia.com>
mlxsw: i2c: Limit single transaction buffer size
Vadim Pasternak <vadimp@nvidia.com>
mlxsw: i2c: Fix chunk size setting in output mailbox buffer
Jinjie Ruan <ruanjinjie@huawei.com>
net: arcnet: Do not call kfree_skb() under local_irq_disable()
Wang Ming <machel@vivo.com>
wifi: ath9k: use IS_ERR() with debugfs_create_dir()
Jinjie Ruan <ruanjinjie@huawei.com>
Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
Dmitry Antipov <dmantipov@yandex.ru>
wifi: mwifiex: avoid possible NULL skb pointer dereference
Fedor Pchelkin <pchelkin@ispras.ru>
wifi: ath9k: protect WMI command response buffer replacement with a lock
Fedor Pchelkin <pchelkin@ispras.ru>
wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
Daniel T. Lee <danieltimlee@gmail.com>
samples/bpf: fix broken map lookup probe
Polaris Pi <pinkperfect2021@gmail.com>
wifi: mwifiex: Fix missed return in oob checks failed path
Dmitry Antipov <dmantipov@yandex.ru>
wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
Artem Chernyshev <artem.chernyshev@red-soft.ru>
fs: ocfs2: namei: check return value of ocfs2_add_entry()
Yan Zhai <yan@cloudflare.com>
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
Yan Zhai <yan@cloudflare.com>
lwt: Fix return values of BPF xmit ops
Florian Fainelli <florian.fainelli@broadcom.com>
hwrng: iproc-rng200 - Implement suspend and resume calls
Gaurav Jain <gaurav.jain@nxp.com>
crypto: caam - fix unchecked return value error
Przemek Kitszel <przemyslaw.kitszel@intel.com>
ice: ice_aq_check_events: fix off-by-one check when filling buffer
Yipeng Zou <zouyipeng@huawei.com>
selftests/bpf: Clean up fmod_ret in bench_rename test script
Menglong Dong <imagedong@tencent.com>
net: tcp: fix unexcepted socket die when snd_wnd is 0
Min Li <lm0963hack@gmail.com>
Bluetooth: Fix potential use-after-free when clear keys
Yuanjun Gong <ruc_gongyuanjun@163.com>
Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
Herbert Xu <herbert@gondor.apana.org.au>
crypto: api - Use work queue in crypto_destroy_instance
Eric Biggers <ebiggers@google.com>
crypto: blake2b - sync with blake2s implementation
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
crypto: stm32 - Properly handle pm_runtime_get failing
Alan Maguire <alan.maguire@oracle.com>
selftests/bpf: fix static assert compilation issue for test_cls_*.c
Dmitry Antipov <dmantipov@yandex.ru>
wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
Polaris Pi <pinkperfect2021@gmail.com>
wifi: mwifiex: Fix OOB and integer underflow when rx packets
Marc Kleine-Budde <mkl@pengutronix.de>
can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
Zhang Shurong <zhang_shurong@foxmail.com>
spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
Lin Ma <linma@zju.edu.cn>
wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
Lorenz Bauer <lmb@isovalent.com>
bpf: reject unhashed sockets in bpf_sk_assign
Lorenz Bauer <lmb@isovalent.com>
udp: re-score reuseport groups when connected sockets are present
Dan Carpenter <dan.carpenter@linaro.org>
regmap: rbtree: Use alloc_flags for memory allocations
Martin Kaiser <martin@kaiser.cx>
hwrng: nomadik - keep clock enabled while hwrng is registered
Eric Dumazet <edumazet@google.com>
tcp: tcp_enter_quickack_mode() should be static
Yafang Shao <laoar.shao@gmail.com>
bpf: Clear the probe_addr for uprobe
Alexander Lobakin <alobakin@pm.me>
bpftool: Use a local bpf_perf_event_value to fix accessing its fields
Liao Chang <liaochang1@huawei.com>
cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
Mikel Rychliski <mikel@mikelr.com>
x86/efistub: Fix PCI ROM preservation in mixed mode
Holger Dengler <dengler@linux.ibm.com>
s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
Holger Dengler <dengler@linux.ibm.com>
s390/pkey: fix/harmonize internal keyblob headers
Xu Yang <xu.yang_2@nxp.com>
perf/imx_ddr: don't enable counter0 if none of 4 counters are used
Ard Biesheuvel <ardb@kernel.org>
x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
selftests/resctrl: Close perf value read fd on errors
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
selftests/resctrl: Don't leak buffer in fill_cache()
Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
Waiman Long <longman@redhat.com>
refscale: Fix uninitalized use of wait_queue_head_t
Kees Cook <keescook@chromium.org>
selftests/harness: Actually report SKIP for signal tests
Christian Brauner <brauner@kernel.org>
tmpfs: verify {g,u}id mount options correctly
Wang Ming <machel@vivo.com>
fs: Fix error checking for d_hash_and_lookup()
Wen Yang <wenyang.linux@foxmail.com>
eventfd: prevent underflow for eventfd semaphores
David Woodhouse <dwmw@amazon.co.uk>
eventfd: Export eventfd_ctx_do_read()
Matthew Wilcox <willy@infradead.org>
reiserfs: Check the return value from __getblk()
Sabrina Dubroca <sd@queasysnail.net>
Revert "net: macsec: preserve ingress frame ordering"
Jan Kara <jack@suse.cz>
udf: Handle error when adding extent to a file
Vladislav Efanov <VEfanov@ispras.ru>
udf: Check consistency of Space Bitmap Descriptor
Jordan Rife <jrife@google.com>
net: Avoid address overwrite in kernel_connect
Shih-Yi Chen <shihyic@nvidia.com>
platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
Zheng Yejian <zhengyejian1@huawei.com>
tracing: Introduce pipe_cpumask to avoid race on trace_pipes
Takashi Iwai <tiwai@suse.de>
ALSA: seq: oss: Fix racy open/close of MIDI devices
Michael Kelley <mikelley@microsoft.com>
scsi: storvsc: Always set no_report_opcodes
Dan Carpenter <dan.carpenter@linaro.org>
sctp: handle invalid error codes without calling BUG()
David Christensen <drc@linux.vnet.ibm.com>
bnx2x: fix page fault following EEH recovery
Dmitry Mastykin <dmastykin@astralinux.ru>
netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
Chengfeng Ye <dg573847474@gmail.com>
scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
Baoquan He <bhe@redhat.com>
idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
Martin Kohn <m.kohn@welotec.com>
net: usb: qmi_wwan: add Quectel EM05GV2
Ani Sinha <anisinha@redhat.com>
vmbus_testing: fix wrong python syntax for integer value comparison
Baoquan He <bhe@redhat.com>
clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
Masami Hiramatsu (Google) <mhiramat@kernel.org>
kprobes: Prohibit probing on CFI preamble symbol
Christian Göttsche <cgzones@googlemail.com>
security: keys: perform capable check only on privileged operations
Minjie Du <duminjie@vivo.com>
ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
Eric Snowberg <eric.snowberg@oracle.com>
ovl: Always reevaluate the file signature for IMA
Leo Chen <sancchen@amd.com>
drm/amd/display: Exit idle optimizations before attempt to access PHY
Konstantin Shelekhin <k.shelekhin@ftml.net>
platform/x86: huawei-wmi: Silence ambient light sensor
Hans de Goede <hdegoede@redhat.com>
platform/x86: intel: hid: Always call BTNL ACPI method
Guiting Shen <aarongt.shen@gmail.com>
ASoC: atmel: Fix the 8K sample parameter in I2SC master
Edgar <ljijcj@163.com>
ASoc: codecs: ES8316: Fix DMIC config
Winston Wen <wentao@uniontech.com>
fs/nls: make load_nls() take a const parameter
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: fix hanging device after request requeue
Stefan Haberland <sth@linux.ibm.com>
s390/dasd: use correct number of retries for ERP requests
Ben Hutchings <benh@debian.org>
m68k: Fix invalid .section syntax
Jiri Benc <jbenc@redhat.com>
vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
Yuanjun Gong <ruc_gongyuanjun@163.com>
ethernet: atheros: fix return value check in atl1c_tso_csum()
Dmytro Maluka <dmy@semihalf.com>
ASoC: da7219: Check for failure reading AAD IRQ events
Dmytro Maluka <dmy@semihalf.com>
ASoC: da7219: Flush pending AAD IRQ when suspending
Dominique Martinet <asmadeus@codewreck.org>
9p: virtio: make sure 'offs' is initialized in zc_request
Nikolay Burykin <burikin@ivk.ru>
media: pci: cx23885: fix error handling for cx23885 ATSC boards
Dmitry Antipov <dmantipov@yandex.ru>
media: pulse8-cec: handle possible ping error
Adrien Thierry <athierry@redhat.com>
phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
Xiaolei Wang <xiaolei.wang@windriver.com>
ARM: dts: imx: Set default tuning step for imx7d usdhc
Stefan Wahren <stefan.wahren@i2se.com>
ARM: dts: imx: Adjust dma-apbh node name
Marek Vasut <marex@denx.de>
ARM: dts: imx7s: Drop dma-apb interrupt-names
Joy Zou <joy.zou@nxp.com>
ARM: dts: imx: update sdma node name format
Oder Chiou <oder_chiou@realtek.com>
ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
Mario Limonciello <mario.limonciello@amd.com>
pinctrl: amd: Don't show `Invalid config param` errors
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
Ryusuke Konishi <konishi.ryusuke@gmail.com>
nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
Juerg Haefliger <juerg.haefliger@canonical.com>
fsi: master-ast-cf: Add MODULE_FIRMWARE macro
Wang Ming <machel@vivo.com>
firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: fix bug when first setting GPIO direction
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: fix broken port 0 uart init
Johan Hovold <johan+linaro@kernel.org>
serial: qcom-geni: fix opp vote on shutdown
Sishuai Gong <sishuai@purdue.edu>
configfs: fix a race in configfs_lookup()
Zheng Wang <zyytlz.wz@163.com>
Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
Nam Cao <namcaov@gmail.com>
staging: rtl8712: fix race condition
Aaron Armstrong Skomra <aaron.skomra@wacom.com>
HID: wacom: remove the battery when the EKR is off
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
Luke Lu <luke.lu@libre.computer>
usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
Slark Xiao <slark_xiao@163.com>
USB: serial: option: add FOXCONN T99W368/T99W373 product
Martin Kohn <m.kohn@welotec.com>
USB: serial: option: add Quectel EM05G variant (0x030e)
Christoph Hellwig <hch@lst.de>
modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
Christoph Hellwig <hch@lst.de>
rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
Christoph Hellwig <hch@lst.de>
net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
Christoph Hellwig <hch@lst.de>
mmc: au1xmmc: force non-modular build and remove symbol_get usage
Arnd Bergmann <arnd@arndb.de>
ARM: pxa: remove use of symbol_get()
Gao Xiang <hsiangkao@linux.alibaba.com>
erofs: ensure that the post-EOF tails are all zeroed
-------------
Diffstat:
.../devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 -
Documentation/scsi/scsi_mid_low_api.rst | 4 +-
Makefile | 4 +-
arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 +-
arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +
arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +
arch/arm/boot/dts/bcm5301x.dtsi | 4 +-
arch/arm/boot/dts/bcm53573.dtsi | 27 +-
arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +-
arch/arm/boot/dts/exynos4210-i9100.dts | 4 +-
arch/arm/boot/dts/imx23.dtsi | 2 +-
arch/arm/boot/dts/imx25.dtsi | 2 +-
arch/arm/boot/dts/imx28.dtsi | 2 +-
arch/arm/boot/dts/imx31.dtsi | 2 +-
arch/arm/boot/dts/imx35.dtsi | 2 +-
arch/arm/boot/dts/imx50.dtsi | 2 +-
arch/arm/boot/dts/imx51.dtsi | 2 +-
arch/arm/boot/dts/imx53.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl.dtsi | 4 +-
arch/arm/boot/dts/imx6sl.dtsi | 2 +-
arch/arm/boot/dts/imx6sx.dtsi | 4 +-
arch/arm/boot/dts/imx6ul.dtsi | 4 +-
arch/arm/boot/dts/imx7s.dtsi | 11 +-
arch/arm/boot/dts/s3c6410-mini6410.dts | 6 +-
arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++-------
arch/arm/boot/dts/s5pv210-aquila.dts | 12 +-
arch/arm/boot/dts/s5pv210-aries.dtsi | 4 +-
arch/arm/boot/dts/s5pv210-goni.dts | 14 +-
arch/arm/boot/dts/s5pv210-smdkv210.dts | 30 +-
arch/arm/mach-omap2/powerdomain.c | 2 +-
arch/arm/mach-pxa/sharpsl_pm.c | 2 -
arch/arm/mach-pxa/spitz.c | 14 +-
arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +
arch/arm64/boot/dts/qcom/sdm845.dtsi | 3 +-
arch/arm64/include/asm/sdei.h | 6 +
arch/arm64/kernel/entry.S | 27 +-
arch/arm64/kernel/sdei.c | 3 +
arch/arm64/kernel/smp.c | 8 +-
arch/arm64/lib/csum.c | 2 +-
arch/m68k/fpsp040/skeleton.S | 4 +-
arch/m68k/ifpsp060/os.S | 4 +-
arch/m68k/kernel/relocate_kernel.S | 4 +-
arch/mips/alchemy/devboards/db1000.c | 8 +-
arch/mips/alchemy/devboards/db1200.c | 19 +-
arch/mips/alchemy/devboards/db1300.c | 10 +-
arch/parisc/include/asm/led.h | 4 +-
arch/parisc/include/asm/processor.h | 1 -
arch/parisc/kernel/processor.c | 18 +-
arch/powerpc/include/asm/lppaca.h | 13 +-
arch/powerpc/include/asm/paca.h | 6 +-
arch/powerpc/include/asm/paravirt.h | 1 +
arch/powerpc/include/asm/plpar_wrappers.h | 1 +
arch/powerpc/kernel/fadump.c | 1 +
arch/powerpc/kernel/iommu.c | 17 +-
arch/powerpc/kvm/book3s_hv_ras.c | 1 +
arch/powerpc/mm/book3s64/slb.c | 1 +
arch/powerpc/perf/core-fsl-emb.c | 8 +-
arch/powerpc/platforms/pseries/lpar.c | 10 +-
arch/powerpc/platforms/pseries/lparcfg.c | 4 +-
arch/powerpc/platforms/pseries/setup.c | 2 +-
arch/powerpc/xmon/xmon.c | 1 +
arch/s390/crypto/paes_s390.c | 2 +-
arch/s390/kernel/ipl.c | 2 +
arch/sh/boards/mach-ap325rxa/setup.c | 2 +-
arch/sh/boards/mach-ecovec24/setup.c | 6 +-
arch/sh/boards/mach-kfr2r09/setup.c | 2 +-
arch/sh/boards/mach-migor/setup.c | 2 +-
arch/sh/boards/mach-se/7724/setup.c | 6 +-
arch/um/configs/i386_defconfig | 1 +
arch/um/configs/x86_64_defconfig | 1 +
arch/um/drivers/Kconfig | 16 +-
arch/um/drivers/Makefile | 2 +-
arch/x86/boot/compressed/head_64.S | 30 +-
arch/x86/include/asm/pgtable_types.h | 11 +-
arch/x86/include/asm/virtext.h | 6 -
arch/x86/kernel/apm_32.c | 6 -
arch/x86/kernel/cpu/common.c | 8 +-
arch/xtensa/include/asm/core.h | 9 +
arch/xtensa/kernel/perf_event.c | 17 +-
crypto/algapi.c | 16 +-
crypto/asymmetric_keys/x509_public_key.c | 5 +
crypto/blake2b_generic.c | 226 +++----------
drivers/acpi/apei/ghes.c | 19 +-
drivers/acpi/bus.c | 2 +
drivers/acpi/pci_root.c | 3 -
drivers/amba/bus.c | 1 +
drivers/ata/pata_arasan_cf.c | 3 +-
drivers/ata/pata_ftide010.c | 1 +
drivers/ata/sata_gemini.c | 1 +
drivers/base/regmap/regcache-rbtree.c | 10 +-
drivers/base/test/test_async_driver_probe.c | 2 +-
drivers/bluetooth/btsdio.c | 1 +
drivers/bluetooth/btusb.c | 2 +-
drivers/bluetooth/hci_nokia.c | 6 +-
drivers/bus/mhi/host/pm.c | 5 +
drivers/bus/ti-sysc.c | 2 +-
drivers/char/hw_random/iproc-rng200.c | 25 ++
drivers/char/hw_random/nomadik-rng.c | 12 +-
drivers/char/ipmi/ipmi_si_intf.c | 5 +
drivers/char/ipmi/ipmi_ssif.c | 7 +-
drivers/clk/Kconfig | 1 +
drivers/clk/imx/clk-composite-8m.c | 12 +-
drivers/clk/imx/clk-imx8mp.c | 5 -
drivers/clk/imx/clk-pll14xx.c | 2 -
drivers/clk/keystone/pll.c | 2 +-
drivers/clk/qcom/gcc-mdm9615.c | 2 +-
drivers/clk/qcom/gcc-sc7180.c | 33 +-
drivers/clk/qcom/gcc-sm8250.c | 93 +++---
drivers/clk/qcom/reset.c | 3 +-
drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +-
drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +-
drivers/cpufreq/cpufreq.c | 2 +
drivers/cpufreq/powernow-k8.c | 3 +-
drivers/cpuidle/cpuidle-pseries.c | 8 +-
drivers/crypto/caam/caampkc.c | 4 +-
drivers/crypto/stm32/stm32-hash.c | 9 +-
drivers/devfreq/devfreq.c | 1 +
drivers/dma/Kconfig | 2 +
drivers/dma/ste_dma40.c | 4 +
drivers/firmware/Kconfig | 1 +
drivers/firmware/arm_sdei.c | 32 +-
drivers/firmware/efi/libstub/x86-stub.c | 2 +-
drivers/firmware/meson/meson_sm.c | 2 +
drivers/firmware/stratix10-svc.c | 2 +-
drivers/fsi/fsi-master-aspeed.c | 2 +
drivers/fsi/fsi-master-ast-cf.c | 1 +
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 14 +-
drivers/gpu/drm/amd/amdgpu/cik.c | 36 +--
drivers/gpu/drm/amd/amdgpu/si.c | 36 +--
.../amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 5 +-
.../drm/amd/display/modules/freesync/freesync.c | 9 +-
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 10 +-
drivers/gpu/drm/armada/armada_overlay.c | 6 +-
drivers/gpu/drm/ast/ast_post.c | 2 +-
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +-
drivers/gpu/drm/bridge/tc358764.c | 2 +-
drivers/gpu/drm/etnaviv/etnaviv_dump.c | 14 +-
drivers/gpu/drm/i915/gvt/gtt.c | 68 +++-
drivers/gpu/drm/i915/gvt/gtt.h | 5 +-
drivers/gpu/drm/i915/gvt/gvt.c | 9 +
drivers/gpu/drm/i915/gvt/gvt.h | 3 +
drivers/gpu/drm/i915/gvt/handlers.c | 44 ++-
drivers/gpu/drm/i915/gvt/mmio.h | 4 +
drivers/gpu/drm/i915/intel_gvt.c | 15 +
drivers/gpu/drm/i915/intel_gvt.h | 5 +
drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +-
drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 8 +-
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +-
drivers/gpu/drm/panel/panel-simple.c | 4 +-
drivers/gpu/drm/radeon/cik.c | 36 +--
drivers/gpu/drm/radeon/si.c | 37 +--
drivers/gpu/drm/tegra/dpaux.c | 6 +-
drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 4 +-
drivers/hid/hid-logitech-dj.c | 5 +-
drivers/hid/hid-multitouch.c | 13 +-
drivers/hid/wacom.h | 1 +
drivers/hid/wacom_sys.c | 25 +-
drivers/hid/wacom_wac.c | 1 +
drivers/hid/wacom_wac.h | 1 +
drivers/hwmon/tmp513.c | 2 +-
drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +-
drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +-
drivers/hwtracing/coresight/coresight-tmc.h | 2 +-
.../infiniband/core/uverbs_std_types_counters.c | 2 +
drivers/infiniband/sw/siw/siw_cm.c | 1 -
drivers/infiniband/sw/siw/siw_verbs.c | 2 +-
drivers/infiniband/ulp/isert/ib_isert.c | 2 +
drivers/infiniband/ulp/srp/ib_srp.c | 4 -
drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 +
drivers/iommu/intel/pasid.c | 2 +-
drivers/leds/led-core.c | 8 +-
drivers/md/md-bitmap.c | 28 +-
drivers/media/cec/usb/pulse8/pulse8-cec.c | 7 +-
drivers/media/dvb-frontends/ascot2e.c | 2 +-
drivers/media/dvb-frontends/atbm8830.c | 2 +-
drivers/media/dvb-frontends/au8522_dig.c | 2 +-
drivers/media/dvb-frontends/bcm3510.c | 2 +-
drivers/media/dvb-frontends/cx22700.c | 2 +-
drivers/media/dvb-frontends/cx22702.c | 2 +-
drivers/media/dvb-frontends/cx24110.c | 2 +-
drivers/media/dvb-frontends/cx24113.c | 2 +-
drivers/media/dvb-frontends/cx24116.c | 2 +-
drivers/media/dvb-frontends/cx24120.c | 6 +-
drivers/media/dvb-frontends/cx24123.c | 2 +-
drivers/media/dvb-frontends/cxd2820r_core.c | 2 +-
drivers/media/dvb-frontends/cxd2841er.c | 4 +-
drivers/media/dvb-frontends/cxd2880/cxd2880_top.c | 2 +-
drivers/media/dvb-frontends/dib0070.c | 2 +-
drivers/media/dvb-frontends/dib0090.c | 4 +-
drivers/media/dvb-frontends/dib3000mb.c | 2 +-
drivers/media/dvb-frontends/dib3000mc.c | 2 +-
drivers/media/dvb-frontends/dib7000m.c | 2 +-
drivers/media/dvb-frontends/dib7000p.c | 4 +-
drivers/media/dvb-frontends/dib8000.c | 2 +-
drivers/media/dvb-frontends/dib9000.c | 2 +-
drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 +-
drivers/media/dvb-frontends/drxd_hard.c | 2 +-
drivers/media/dvb-frontends/drxk_hard.c | 2 +-
drivers/media/dvb-frontends/ds3000.c | 2 +-
drivers/media/dvb-frontends/dvb-pll.c | 2 +-
drivers/media/dvb-frontends/ec100.c | 2 +-
drivers/media/dvb-frontends/helene.c | 4 +-
drivers/media/dvb-frontends/horus3a.c | 2 +-
drivers/media/dvb-frontends/isl6405.c | 2 +-
drivers/media/dvb-frontends/isl6421.c | 2 +-
drivers/media/dvb-frontends/isl6423.c | 2 +-
drivers/media/dvb-frontends/itd1000.c | 2 +-
drivers/media/dvb-frontends/ix2505v.c | 2 +-
drivers/media/dvb-frontends/l64781.c | 2 +-
drivers/media/dvb-frontends/lg2160.c | 2 +-
drivers/media/dvb-frontends/lgdt3305.c | 2 +-
drivers/media/dvb-frontends/lgdt3306a.c | 2 +-
drivers/media/dvb-frontends/lgdt330x.c | 2 +-
drivers/media/dvb-frontends/lgs8gxx.c | 2 +-
drivers/media/dvb-frontends/lnbh25.c | 2 +-
drivers/media/dvb-frontends/lnbp21.c | 4 +-
drivers/media/dvb-frontends/lnbp22.c | 2 +-
drivers/media/dvb-frontends/m88ds3103.c | 2 +-
drivers/media/dvb-frontends/m88rs2000.c | 2 +-
drivers/media/dvb-frontends/mb86a16.c | 2 +-
drivers/media/dvb-frontends/mb86a20s.c | 2 +-
drivers/media/dvb-frontends/mt312.c | 2 +-
drivers/media/dvb-frontends/mt352.c | 2 +-
drivers/media/dvb-frontends/nxt200x.c | 2 +-
drivers/media/dvb-frontends/nxt6000.c | 2 +-
drivers/media/dvb-frontends/or51132.c | 2 +-
drivers/media/dvb-frontends/or51211.c | 2 +-
drivers/media/dvb-frontends/s5h1409.c | 2 +-
drivers/media/dvb-frontends/s5h1411.c | 2 +-
drivers/media/dvb-frontends/s5h1420.c | 2 +-
drivers/media/dvb-frontends/s5h1432.c | 2 +-
drivers/media/dvb-frontends/s921.c | 2 +-
drivers/media/dvb-frontends/si21xx.c | 2 +-
drivers/media/dvb-frontends/sp887x.c | 2 +-
drivers/media/dvb-frontends/stb0899_drv.c | 2 +-
drivers/media/dvb-frontends/stb6000.c | 2 +-
drivers/media/dvb-frontends/stb6100.c | 2 +-
drivers/media/dvb-frontends/stv0288.c | 2 +-
drivers/media/dvb-frontends/stv0297.c | 2 +-
drivers/media/dvb-frontends/stv0299.c | 2 +-
drivers/media/dvb-frontends/stv0367.c | 6 +-
drivers/media/dvb-frontends/stv0900_core.c | 2 +-
drivers/media/dvb-frontends/stv090x.c | 2 +-
drivers/media/dvb-frontends/stv6110.c | 2 +-
drivers/media/dvb-frontends/stv6110x.c | 2 +-
drivers/media/dvb-frontends/tda10021.c | 2 +-
drivers/media/dvb-frontends/tda10023.c | 2 +-
drivers/media/dvb-frontends/tda10048.c | 2 +-
drivers/media/dvb-frontends/tda1004x.c | 4 +-
drivers/media/dvb-frontends/tda10086.c | 2 +-
drivers/media/dvb-frontends/tda665x.c | 2 +-
drivers/media/dvb-frontends/tda8083.c | 2 +-
drivers/media/dvb-frontends/tda8261.c | 2 +-
drivers/media/dvb-frontends/tda826x.c | 2 +-
drivers/media/dvb-frontends/ts2020.c | 2 +-
drivers/media/dvb-frontends/tua6100.c | 2 +-
drivers/media/dvb-frontends/ves1820.c | 2 +-
drivers/media/dvb-frontends/ves1x93.c | 2 +-
drivers/media/dvb-frontends/zl10036.c | 2 +-
drivers/media/dvb-frontends/zl10039.c | 2 +-
drivers/media/dvb-frontends/zl10353.c | 2 +-
drivers/media/i2c/ad5820.c | 2 -
drivers/media/i2c/ov2680.c | 246 +++------------
drivers/media/i2c/ov5640.c | 4 +-
drivers/media/i2c/tvp5150.c | 4 +
drivers/media/pci/bt8xx/dst.c | 2 +-
drivers/media/pci/bt8xx/dst_ca.c | 2 +-
drivers/media/pci/cx23885/cx23885-dvb.c | 12 -
drivers/media/pci/ddbridge/ddbridge-dummy-fe.c | 2 +-
.../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +-
drivers/media/tuners/fc0011.c | 2 +-
drivers/media/tuners/fc0012.c | 2 +-
drivers/media/tuners/fc0013.c | 2 +-
drivers/media/tuners/max2165.c | 2 +-
drivers/media/tuners/mc44s803.c | 2 +-
drivers/media/tuners/mt2060.c | 2 +-
drivers/media/tuners/mt2131.c | 2 +-
drivers/media/tuners/mt2266.c | 2 +-
drivers/media/tuners/mxl5005s.c | 2 +-
drivers/media/tuners/qt1010.c | 2 +-
drivers/media/tuners/tda18218.c | 2 +-
drivers/media/tuners/xc4000.c | 2 +-
drivers/media/tuners/xc5000.c | 2 +-
drivers/media/usb/dvb-usb/m920x.c | 5 +-
drivers/media/usb/go7007/go7007-i2c.c | 2 -
drivers/media/usb/siano/smsusb.c | 21 +-
drivers/media/v4l2-core/v4l2-fwnode.c | 18 +-
drivers/mmc/host/Kconfig | 5 +-
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 45 ++-
drivers/mtd/nand/raw/fsmc_nand.c | 7 +-
drivers/mtd/spi-nor/core.c | 19 +-
drivers/net/arcnet/arcnet.c | 2 +-
drivers/net/can/usb/gs_usb.c | 5 +-
drivers/net/dsa/sja1105/sja1105_main.c | 38 ++-
drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +-
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +-
drivers/net/ethernet/freescale/enetc/enetc_ptp.c | 2 +-
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 +-
drivers/net/ethernet/intel/ice/ice_main.c | 13 +-
drivers/net/ethernet/intel/igb/igb.h | 4 +-
drivers/net/ethernet/intel/igb/igb_main.c | 16 +-
drivers/net/ethernet/intel/igbvf/igbvf.h | 4 +-
drivers/net/ethernet/intel/igc/igc.h | 4 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 28 +-
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 +
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 +-
drivers/net/ethernet/mellanox/mlxsw/i2c.c | 5 +-
drivers/net/macsec.c | 3 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/net/usb/r8152.c | 3 +
drivers/net/veth.c | 4 +-
drivers/net/vxlan/vxlan_core.c | 58 ++--
drivers/net/wireless/ath/ath10k/pci.c | 9 +-
drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
drivers/net/wireless/ath/ath9k/wmi.c | 20 +-
drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +-
drivers/net/wireless/marvell/mwifiex/pcie.c | 25 +-
drivers/net/wireless/marvell/mwifiex/sta_rx.c | 12 +-
drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 30 +-
drivers/net/wireless/marvell/mwifiex/util.c | 10 +-
drivers/net/wireless/mediatek/mt76/testmode.c | 1 +
drivers/ntb/ntb_transport.c | 19 +-
drivers/of/unittest.c | 12 +-
drivers/opp/core.c | 2 +-
drivers/parisc/led.c | 4 +-
drivers/pci/hotplug/pciehp_hpc.c | 12 +-
drivers/pci/pcie/aspm.c | 30 +-
drivers/perf/fsl_imx8_ddr_perf.c | 24 +-
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 6 +-
drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 18 +-
drivers/pinctrl/intel/pinctrl-cherryview.c | 5 +-
drivers/pinctrl/pinctrl-amd.c | 4 +-
drivers/pinctrl/pinctrl-mcp23s08_spi.c | 10 +
drivers/platform/mellanox/mlxbf-tmfifo.c | 91 ++++--
drivers/platform/x86/huawei-wmi.c | 2 +
drivers/platform/x86/intel-hid.c | 21 +-
drivers/pwm/pwm-lpc32xx.c | 16 +-
drivers/rpmsg/qcom_glink_native.c | 4 +
drivers/rtc/rtc-ds1685.c | 2 +-
drivers/s390/block/dasd.c | 125 +++-----
drivers/s390/block/dasd_3990_erp.c | 2 +-
drivers/s390/crypto/pkey_api.c | 2 +-
drivers/s390/crypto/zcrypt_api.c | 1 +
drivers/s390/crypto/zcrypt_ep11misc.c | 4 +-
drivers/s390/crypto/zcrypt_ep11misc.h | 9 +-
drivers/scsi/aic94xx/aic94xx_task.c | 2 +-
drivers/scsi/be2iscsi/be_iscsi.c | 4 +
drivers/scsi/fcoe/fcoe_ctlr.c | 20 +-
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 8 +-
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 19 +-
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 62 ++--
drivers/scsi/hosts.c | 4 +-
drivers/scsi/isci/request.c | 10 +-
drivers/scsi/isci/task.c | 2 +-
drivers/scsi/libsas/sas_ata.c | 7 +-
drivers/scsi/libsas/sas_expander.c | 2 +-
drivers/scsi/libsas/sas_task.c | 4 +-
drivers/scsi/mpt3sas/mpt3sas_base.c | 46 ++-
drivers/scsi/mpt3sas/mpt3sas_base.h | 1 +
drivers/scsi/mvsas/mv_sas.c | 10 +-
drivers/scsi/pm8001/pm8001_hwi.c | 16 +-
drivers/scsi/pm8001/pm8001_sas.c | 4 +-
drivers/scsi/pm8001/pm80xx_hwi.c | 14 +-
drivers/scsi/qedf/qedf_dbg.h | 2 +
drivers/scsi/qedf/qedf_debugfs.c | 35 ++-
drivers/scsi/qedi/qedi_main.c | 5 +-
drivers/scsi/qla2xxx/qla_attr.c | 2 -
drivers/scsi/qla2xxx/qla_dbg.c | 18 +-
drivers/scsi/qla2xxx/qla_def.h | 12 +-
drivers/scsi/qla2xxx/qla_gbl.h | 3 +
drivers/scsi/qla2xxx/qla_init.c | 68 ++--
drivers/scsi/qla2xxx/qla_inline.h | 46 +++
drivers/scsi/qla2xxx/qla_iocb.c | 60 +++-
drivers/scsi/qla2xxx/qla_isr.c | 16 +-
drivers/scsi/qla2xxx/qla_mbx.c | 7 +-
drivers/scsi/qla2xxx/qla_nvme.c | 12 +-
drivers/scsi/qla2xxx/qla_os.c | 223 +++++++------
drivers/scsi/qla2xxx/qla_target.c | 14 +-
drivers/scsi/qla4xxx/ql4_os.c | 15 +
drivers/scsi/scsi_transport_iscsi.c | 80 +++--
drivers/scsi/storvsc_drv.c | 2 +
drivers/soc/qcom/ocmem.c | 14 +-
drivers/soc/qcom/qmi_encdec.c | 4 +-
drivers/spi/spi-tegra20-sflash.c | 6 +-
drivers/staging/media/rkvdec/rkvdec.c | 2 +-
drivers/staging/rtl8712/os_intfs.c | 1 +
drivers/staging/rtl8712/usb_intf.c | 1 -
drivers/tty/serial/qcom_geni_serial.c | 5 +
drivers/tty/serial/sc16is7xx.c | 17 +-
drivers/tty/serial/serial-tegra.c | 6 +-
drivers/tty/serial/sprd_serial.c | 30 +-
drivers/usb/chipidea/ci_hdrc_imx.c | 10 +-
drivers/usb/chipidea/usbmisc_imx.c | 6 +-
drivers/usb/core/hcd.c | 10 +-
drivers/usb/core/hub.c | 349 ++++++++++++---------
drivers/usb/core/message.c | 29 +-
drivers/usb/core/usb.h | 4 +-
drivers/usb/dwc3/dwc3-meson-g12a.c | 6 +
drivers/usb/gadget/function/f_mass_storage.c | 2 +-
drivers/usb/phy/phy-mxs-usb.c | 10 +-
drivers/usb/serial/option.c | 7 +
drivers/usb/typec/bus.c | 12 +-
drivers/usb/typec/tcpm/tcpci.c | 4 +
drivers/usb/typec/tcpm/tcpci.h | 1 +
drivers/usb/typec/tcpm/tcpm.c | 3 +-
drivers/vfio/vfio_iommu_type1.c | 2 +-
drivers/video/backlight/bd6107.c | 2 +-
drivers/video/backlight/gpio_backlight.c | 5 +-
drivers/video/backlight/lv5207lp.c | 2 +-
drivers/video/fbdev/ep93xx-fb.c | 1 -
drivers/virtio/virtio_ring.c | 2 +-
drivers/watchdog/intel-mid_wdt.c | 1 +
fs/btrfs/disk-io.c | 5 +-
fs/btrfs/transaction.c | 7 +-
fs/configfs/dir.c | 2 +
fs/dlm/plock.c | 6 +-
fs/erofs/zdata.c | 2 +
fs/eventfd.c | 7 +-
fs/ext4/balloc.c | 15 +-
fs/ext4/block_validity.c | 8 +-
fs/ext4/ext4.h | 2 +
fs/ext4/mballoc.c | 2 +-
fs/fuse/readdir.c | 10 +-
fs/jfs/jfs_extent.c | 5 +
fs/lockd/mon.c | 3 +
fs/namei.c | 2 +-
fs/nfs/blocklayout/dev.c | 4 +-
fs/nfs/direct.c | 20 +-
fs/nfs/nfs2xdr.c | 2 +-
fs/nfs/nfs3xdr.c | 2 +-
fs/nfs/nfs42proc.c | 5 +-
fs/nfs/pnfs_dev.c | 2 +-
fs/nfsd/blocklayoutxdr.c | 9 +
fs/nfsd/flexfilelayoutxdr.c | 9 +
fs/nfsd/nfs4xdr.c | 25 +-
fs/nilfs2/alloc.c | 3 +-
fs/nilfs2/inode.c | 7 +-
fs/nilfs2/segment.c | 5 +
fs/nls/nls_base.c | 4 +-
fs/ocfs2/namei.c | 4 +
fs/overlayfs/super.c | 2 +-
fs/proc/base.c | 3 +-
fs/pstore/ram_core.c | 2 +-
fs/quota/dquot.c | 174 ++++++----
fs/reiserfs/journal.c | 4 +-
fs/udf/balloc.c | 31 +-
fs/udf/inode.c | 45 ++-
fs/verity/signature.c | 16 +
include/acpi/apei.h | 4 +-
include/crypto/algapi.h | 3 +
include/crypto/blake2b.h | 67 ++++
include/crypto/internal/blake2b.h | 115 +++++++
include/linux/arm_sdei.h | 4 +
include/linux/eventfd.h | 6 +
include/linux/if_arp.h | 4 +
include/linux/nls.h | 2 +-
include/linux/trace_events.h | 3 +-
include/linux/usb/typec_altmode.h | 2 +-
include/net/ip.h | 1 +
include/net/ip_tunnels.h | 15 +-
include/net/ipv6.h | 2 +-
include/net/lwtunnel.h | 5 +-
include/net/tcp.h | 1 -
include/scsi/libsas.h | 12 +-
include/scsi/scsi_host.h | 2 +-
include/uapi/linux/sync_file.h | 2 +-
io_uring/io-wq.c | 10 +
io_uring/io-wq.h | 1 +
io_uring/io_uring.c | 9 +-
kernel/auditsc.c | 2 +
kernel/bpf/verifier.c | 17 +-
kernel/cgroup/namespace.c | 6 -
kernel/kprobes.c | 14 +-
kernel/module.c | 15 +-
kernel/printk/printk_ringbuffer.c | 2 +-
kernel/rcu/refscale.c | 3 +-
kernel/trace/bpf_trace.c | 2 +-
kernel/trace/trace.c | 72 ++++-
kernel/trace/trace.h | 2 +
kernel/trace/trace_uprobe.c | 3 +-
lib/idr.c | 2 +-
lib/test_meminit.c | 2 +-
mm/shmem.c | 28 +-
net/9p/trans_virtio.c | 2 +-
net/bluetooth/hci_core.c | 16 +-
net/core/filter.c | 2 +
net/core/flow_dissector.c | 3 +-
net/core/lwt_bpf.c | 7 +-
net/core/skbuff.c | 34 +-
net/core/sock.c | 9 +-
net/dccp/ipv4.c | 13 +-
net/dccp/ipv6.c | 15 +-
net/hsr/hsr_forward.c | 1 +
net/ipv4/devinet.c | 10 +-
net/ipv4/fib_semantics.c | 5 +-
net/ipv4/fib_trie.c | 3 +-
net/ipv4/igmp.c | 3 +-
net/ipv4/ip_input.c | 3 +-
net/ipv4/ip_output.c | 2 +-
net/ipv4/route.c | 1 +
net/ipv4/tcp_input.c | 3 +-
net/ipv4/tcp_timer.c | 18 +-
net/ipv4/udp.c | 20 +-
net/ipv6/addrconf.c | 2 +-
net/ipv6/ip6_output.c | 2 +-
net/ipv6/udp.c | 19 +-
net/kcm/kcmsock.c | 15 +-
net/netfilter/ipset/ip_set_hash_netportnet.c | 1 +
net/netfilter/nfnetlink_osf.c | 8 +
net/netfilter/xt_sctp.c | 2 +
net/netfilter/xt_u32.c | 21 ++
net/netlabel/netlabel_kapi.c | 3 +-
net/netrom/af_netrom.c | 5 +
net/sched/sch_fq_pie.c | 27 +-
net/sched/sch_hfsc.c | 4 +
net/sched/sch_plug.c | 2 +-
net/sched/sch_qfq.c | 22 +-
net/sctp/proc.c | 2 +-
net/sctp/sm_sideeffect.c | 5 +-
net/sctp/socket.c | 10 +-
net/smc/smc_core.c | 2 +
net/socket.c | 6 +-
net/tls/tls_sw.c | 4 +-
net/unix/af_unix.c | 2 +-
net/unix/scm.c | 6 +-
samples/bpf/tracex6_kern.c | 17 +-
scripts/kconfig/preprocess.c | 3 +
security/integrity/ima/Kconfig | 12 -
security/keys/keyctl.c | 11 +-
security/smack/smackfs.c | 2 +-
sound/Kconfig | 2 +-
sound/core/pcm_compat.c | 8 +-
sound/core/seq/oss/seq_oss_midi.c | 35 ++-
sound/pci/ac97/ac97_codec.c | 5 +-
sound/soc/atmel/atmel-i2s.c | 5 +-
sound/soc/codecs/Kconfig | 1 +
sound/soc/codecs/da7219-aad.c | 12 +-
sound/soc/codecs/es8316.c | 2 +-
sound/soc/codecs/rt5682-sdw.c | 7 +-
tools/bpf/bpftool/skeleton/profiler.bpf.c | 27 +-
tools/hv/vmbus_testing | 4 +-
tools/perf/builtin-top.c | 1 +
tools/perf/ui/browsers/hists.c | 60 ++--
tools/perf/util/annotate.c | 10 +-
tools/perf/util/header.c | 11 +-
.../selftests/bpf/benchs/run_bench_rename.sh | 2 +-
.../selftests/bpf/progs/test_cls_redirect.h | 9 +
tools/testing/selftests/kselftest/runner.sh | 29 +-
tools/testing/selftests/kselftest_harness.h | 11 +-
tools/testing/selftests/resctrl/cache.c | 18 +-
tools/testing/selftests/resctrl/fill_buf.c | 3 +-
tools/testing/selftests/resctrl/resctrl.h | 1 +
555 files changed, 3750 insertions(+), 2444 deletions(-)
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 001/406] erofs: ensure that the post-EOF tails are all zeroed
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 002/406] ARM: pxa: remove use of symbol_get() Greg Kroah-Hartman
` (413 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, keltargw, Gao Xiang
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gao Xiang <hsiangkao@linux.alibaba.com>
commit e4c1cf523d820730a86cae2c6d55924833b6f7ac upstream.
This was accidentally fixed up in commit e4c1cf523d82 but we can't
take the full change due to other dependancy issues, so here is just
the actual bugfix that is needed.
[Background]
keltargw reported an issue [1] that with mmaped I/Os, sometimes the
tail of the last page (after file ends) is not filled with zeroes.
The root cause is that such tail page could be wrongly selected for
inplace I/Os so the zeroed part will then be filled with compressed
data instead of zeroes.
A simple fix is to avoid doing inplace I/Os for such tail parts,
actually that was already fixed upstream in commit e4c1cf523d82
("erofs: tidy up z_erofs_do_read_page()") by accident.
[1] https://lore.kernel.org/r/3ad8b469-25db-a297-21f9-75db2d6ad224@linux.alibaba.com
Reported-by: keltargw <keltar.gw@gmail.com>
Fixes: 3883a79abd02 ("staging: erofs: introduce VLE decompression support")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/erofs/zdata.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/erofs/zdata.c
+++ b/fs/erofs/zdata.c
@@ -632,6 +632,8 @@ hitted:
cur = end - min_t(erofs_off_t, offset + end - map->m_la, end);
if (!(map->m_flags & EROFS_MAP_MAPPED)) {
zero_user_segment(page, cur, end);
+ ++spiltted;
+ tight = false;
goto next_part;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 002/406] ARM: pxa: remove use of symbol_get()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 001/406] erofs: ensure that the post-EOF tails are all zeroed Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 003/406] mmc: au1xmmc: force non-modular build and remove symbol_get usage Greg Kroah-Hartman
` (412 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Christoph Hellwig,
Luis Chamberlain
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 0faa29c4207e6e29cfc81b427df60e326c37083a upstream.
The spitz board file uses the obscure symbol_get() function
to optionally call a function from sharpsl_pm.c if that is
built. However, the two files are always built together
these days, and have been for a long time, so this can
be changed to a normal function call.
Link: https://lore.kernel.org/lkml/20230731162639.GA9441@lst.de/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-pxa/sharpsl_pm.c | 2 --
arch/arm/mach-pxa/spitz.c | 14 +-------------
2 files changed, 1 insertion(+), 15 deletions(-)
--- a/arch/arm/mach-pxa/sharpsl_pm.c
+++ b/arch/arm/mach-pxa/sharpsl_pm.c
@@ -220,8 +220,6 @@ void sharpsl_battery_kick(void)
{
schedule_delayed_work(&sharpsl_bat, msecs_to_jiffies(125));
}
-EXPORT_SYMBOL(sharpsl_battery_kick);
-
static void sharpsl_battery_thread(struct work_struct *private_)
{
--- a/arch/arm/mach-pxa/spitz.c
+++ b/arch/arm/mach-pxa/spitz.c
@@ -9,7 +9,6 @@
*/
#include <linux/kernel.h>
-#include <linux/module.h> /* symbol_get ; symbol_put */
#include <linux/platform_device.h>
#include <linux/delay.h>
#include <linux/gpio_keys.h>
@@ -514,17 +513,6 @@ static struct pxa2xx_spi_chip spitz_ads7
.gpio_cs = SPITZ_GPIO_ADS7846_CS,
};
-static void spitz_bl_kick_battery(void)
-{
- void (*kick_batt)(void);
-
- kick_batt = symbol_get(sharpsl_battery_kick);
- if (kick_batt) {
- kick_batt();
- symbol_put(sharpsl_battery_kick);
- }
-}
-
static struct gpiod_lookup_table spitz_lcdcon_gpio_table = {
.dev_id = "spi2.1",
.table = {
@@ -552,7 +540,7 @@ static struct corgi_lcd_platform_data sp
.max_intensity = 0x2f,
.default_intensity = 0x1f,
.limit_mask = 0x0b,
- .kick_battery = spitz_bl_kick_battery,
+ .kick_battery = sharpsl_battery_kick,
};
static struct pxa2xx_spi_chip spitz_lcdcon_chip = {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 003/406] mmc: au1xmmc: force non-modular build and remove symbol_get usage
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 001/406] erofs: ensure that the post-EOF tails are all zeroed Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 002/406] ARM: pxa: remove use of symbol_get() Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 004/406] net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index Greg Kroah-Hartman
` (411 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Manuel Lauss,
Arnd Bergmann, Luis Chamberlain
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit d4a5c59a955bba96b273ec1a5885bada24c56979 upstream.
au1xmmc is split somewhat awkwardly into the main mmc subsystem driver,
and callbacks in platform_data that sit under arch/mips/ and are
always built in. The latter than call mmc_detect_change through
symbol_get. Remove the use of symbol_get by requiring the driver
to be built in. In the future the interrupt handlers for card
insert/eject detection should probably be moved into the main driver,
and which point it can be built modular again.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Manuel Lauss <manuel.lauss@gmail.com>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
[mcgrof: squashed in depends on MMC=y suggested by Arnd]
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/alchemy/devboards/db1000.c | 8 +-------
arch/mips/alchemy/devboards/db1200.c | 19 ++-----------------
arch/mips/alchemy/devboards/db1300.c | 10 +---------
drivers/mmc/host/Kconfig | 5 +++--
4 files changed, 7 insertions(+), 35 deletions(-)
--- a/arch/mips/alchemy/devboards/db1000.c
+++ b/arch/mips/alchemy/devboards/db1000.c
@@ -14,7 +14,6 @@
#include <linux/interrupt.h>
#include <linux/leds.h>
#include <linux/mmc/host.h>
-#include <linux/module.h>
#include <linux/platform_device.h>
#include <linux/pm.h>
#include <linux/spi/spi.h>
@@ -167,12 +166,7 @@ static struct platform_device db1x00_aud
static irqreturn_t db1100_mmc_cd(int irq, void *ptr)
{
- void (*mmc_cd)(struct mmc_host *, unsigned long);
- /* link against CONFIG_MMC=m */
- mmc_cd = symbol_get(mmc_detect_change);
- mmc_cd(ptr, msecs_to_jiffies(500));
- symbol_put(mmc_detect_change);
-
+ mmc_detect_change(ptr, msecs_to_jiffies(500));
return IRQ_HANDLED;
}
--- a/arch/mips/alchemy/devboards/db1200.c
+++ b/arch/mips/alchemy/devboards/db1200.c
@@ -10,7 +10,6 @@
#include <linux/gpio.h>
#include <linux/i2c.h>
#include <linux/init.h>
-#include <linux/module.h>
#include <linux/interrupt.h>
#include <linux/io.h>
#include <linux/leds.h>
@@ -340,14 +339,7 @@ static irqreturn_t db1200_mmc_cd(int irq
static irqreturn_t db1200_mmc_cdfn(int irq, void *ptr)
{
- void (*mmc_cd)(struct mmc_host *, unsigned long);
-
- /* link against CONFIG_MMC=m */
- mmc_cd = symbol_get(mmc_detect_change);
- if (mmc_cd) {
- mmc_cd(ptr, msecs_to_jiffies(200));
- symbol_put(mmc_detect_change);
- }
+ mmc_detect_change(ptr, msecs_to_jiffies(200));
msleep(100); /* debounce */
if (irq == DB1200_SD0_INSERT_INT)
@@ -431,14 +423,7 @@ static irqreturn_t pb1200_mmc1_cd(int ir
static irqreturn_t pb1200_mmc1_cdfn(int irq, void *ptr)
{
- void (*mmc_cd)(struct mmc_host *, unsigned long);
-
- /* link against CONFIG_MMC=m */
- mmc_cd = symbol_get(mmc_detect_change);
- if (mmc_cd) {
- mmc_cd(ptr, msecs_to_jiffies(200));
- symbol_put(mmc_detect_change);
- }
+ mmc_detect_change(ptr, msecs_to_jiffies(200));
msleep(100); /* debounce */
if (irq == PB1200_SD1_INSERT_INT)
--- a/arch/mips/alchemy/devboards/db1300.c
+++ b/arch/mips/alchemy/devboards/db1300.c
@@ -17,7 +17,6 @@
#include <linux/interrupt.h>
#include <linux/ata_platform.h>
#include <linux/mmc/host.h>
-#include <linux/module.h>
#include <linux/mtd/mtd.h>
#include <linux/mtd/platnand.h>
#include <linux/platform_device.h>
@@ -459,14 +458,7 @@ static irqreturn_t db1300_mmc_cd(int irq
static irqreturn_t db1300_mmc_cdfn(int irq, void *ptr)
{
- void (*mmc_cd)(struct mmc_host *, unsigned long);
-
- /* link against CONFIG_MMC=m. We can only be called once MMC core has
- * initialized the controller, so symbol_get() should always succeed.
- */
- mmc_cd = symbol_get(mmc_detect_change);
- mmc_cd(ptr, msecs_to_jiffies(200));
- symbol_put(mmc_detect_change);
+ mmc_detect_change(ptr, msecs_to_jiffies(200));
msleep(100); /* debounce */
if (irq == DB1300_SD1_INSERT_INT)
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -520,11 +520,12 @@ config MMC_ALCOR
of Alcor Micro PCI-E card reader
config MMC_AU1X
- tristate "Alchemy AU1XX0 MMC Card Interface support"
+ bool "Alchemy AU1XX0 MMC Card Interface support"
depends on MIPS_ALCHEMY
+ depends on MMC=y
help
This selects the AMD Alchemy(R) Multimedia card interface.
- If you have a Alchemy platform with a MMC slot, say Y or M here.
+ If you have a Alchemy platform with a MMC slot, say Y here.
If unsure, say N.
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 004/406] net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 003/406] mmc: au1xmmc: force non-modular build and remove symbol_get usage Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 005/406] rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff Greg Kroah-Hartman
` (410 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jakub Kicinski,
Luis Chamberlain
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 569820befb16ffc755ab7af71f4f08cc5f68f0fe upstream.
enetc_phc_index is only used via symbol_get, which was only ever
intended for very internal symbols like this one. Use EXPORT_SYMBOL_GPL
for it so that symbol_get can enforce only being used on
EXPORT_SYMBOL_GPL symbols.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/enetc/enetc_ptp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/freescale/enetc/enetc_ptp.c
+++ b/drivers/net/ethernet/freescale/enetc/enetc_ptp.c
@@ -8,7 +8,7 @@
#include "enetc.h"
int enetc_phc_index = -1;
-EXPORT_SYMBOL(enetc_phc_index);
+EXPORT_SYMBOL_GPL(enetc_phc_index);
static struct ptp_clock_info enetc_ptp_caps = {
.owner = THIS_MODULE,
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 005/406] rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 004/406] net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 006/406] modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules Greg Kroah-Hartman
` (409 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Joshua Kinard,
Luis Chamberlain
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 95e7ebc6823170256a8ce19fad87912805bfa001 upstream.
ds1685_rtc_poweroff is only used externally via symbol_get, which was
only ever intended for very internal symbols like this one. Use
EXPORT_SYMBOL_GPL for it so that symbol_get can enforce only being used
on EXPORT_SYMBOL_GPL symbols.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: Joshua Kinard <kumba@gentoo.org>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/rtc/rtc-ds1685.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/rtc/rtc-ds1685.c
+++ b/drivers/rtc/rtc-ds1685.c
@@ -1441,7 +1441,7 @@ ds1685_rtc_poweroff(struct platform_devi
unreachable();
}
}
-EXPORT_SYMBOL(ds1685_rtc_poweroff);
+EXPORT_SYMBOL_GPL(ds1685_rtc_poweroff);
/* ----------------------------------------------------------------------- */
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 006/406] modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 005/406] rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 007/406] USB: serial: option: add Quectel EM05G variant (0x030e) Greg Kroah-Hartman
` (408 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Luis Chamberlain
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
commit 9011e49d54dcc7653ebb8a1e05b5badb5ecfa9f9 upstream.
It has recently come to my attention that nvidia is circumventing the
protection added in 262e6ae7081d ("modules: inherit
TAINT_PROPRIETARY_MODULE") by importing exports from their proprietary
modules into an allegedly GPL licensed module and then rexporting them.
Given that symbol_get was only ever intended for tightly cooperating
modules using very internal symbols it is logical to restrict it to
being used on EXPORT_SYMBOL_GPL and prevent nvidia from costly DMCA
Circumvention of Access Controls law suites.
All symbols except for four used through symbol_get were already exported
as EXPORT_SYMBOL_GPL, and the remaining four ones were switched over in
the preparation patches.
Fixes: 262e6ae7081d ("modules: inherit TAINT_PROPRIETARY_MODULE")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -2268,15 +2268,26 @@ static void free_module(struct module *m
void *__symbol_get(const char *symbol)
{
struct module *owner;
+ enum mod_license license;
const struct kernel_symbol *sym;
preempt_disable();
- sym = find_symbol(symbol, &owner, NULL, NULL, true, true);
- if (sym && strong_try_module_get(owner))
+ sym = find_symbol(symbol, &owner, NULL, &license, true, true);
+ if (!sym)
+ goto fail;
+ if (license != GPL_ONLY) {
+ pr_warn("failing symbol_get of non-GPLONLY symbol %s.\n",
+ symbol);
+ goto fail;
+ }
+ if (strong_try_module_get(owner))
sym = NULL;
preempt_enable();
return sym ? (void *)kernel_symbol_value(sym) : NULL;
+fail:
+ preempt_enable();
+ return NULL;
}
EXPORT_SYMBOL_GPL(__symbol_get);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 007/406] USB: serial: option: add Quectel EM05G variant (0x030e)
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 006/406] modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 008/406] USB: serial: option: add FOXCONN T99W368/T99W373 product Greg Kroah-Hartman
` (407 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin Kohn, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kohn <m.kohn@welotec.com>
commit 873854c02364ebb991fc06f7148c14dfb5419e1b upstream.
Add Quectel EM05G with product ID 0x030e.
Interface 4 is used for qmi.
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=030e Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Martin Kohn <m.kohn@welotec.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -259,6 +259,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_EM05G 0x030a
#define QUECTEL_PRODUCT_EM060K 0x030b
#define QUECTEL_PRODUCT_EM05G_CS 0x030c
+#define QUECTEL_PRODUCT_EM05GV2 0x030e
#define QUECTEL_PRODUCT_EM05CN_SG 0x0310
#define QUECTEL_PRODUCT_EM05G_SG 0x0311
#define QUECTEL_PRODUCT_EM05CN 0x0312
@@ -1190,6 +1191,8 @@ static const struct usb_device_id option
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_GR, 0xff),
.driver_info = RSVD(6) | ZLP },
+ { USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05GV2, 0xff),
+ .driver_info = RSVD(4) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_CS, 0xff),
.driver_info = RSVD(6) | ZLP },
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM05G_RS, 0xff),
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 008/406] USB: serial: option: add FOXCONN T99W368/T99W373 product
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 007/406] USB: serial: option: add Quectel EM05G variant (0x030e) Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 009/406] usb: dwc3: meson-g12a: do post init to fix broken usb after resumption Greg Kroah-Hartman
` (406 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Slark Xiao, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <slark_xiao@163.com>
commit 4d9488b294e1f8353bbcadc4c7172a7f7490199b upstream.
The difference of T99W368 and T99W373 is the chip solution.
T99W368 is designed based on Qualcomm SDX65 and T99W373 is SDX62.
Test evidence as below:
T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 7 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e0f0 Rev=05.04
S: Manufacturer=FII
S: Product=OLYMPIC USB WWAN Adapter
S: SerialNumber=78ada8c4
C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
T: Bus=01 Lev=02 Prnt=05 Port=00 Cnt=01 Dev#= 8 Spd=480 MxCh= 0
D: Ver= 2.10 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=0489 ProdID=e0ee Rev=05.04
S: Manufacturer=FII
S: Product=OLYMPIC USB WWAN Adapter
S: SerialNumber=78ada8d5
C: #Ifs= 6 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#=0x4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
Both of them share the same port configuration:
0&1: MBIM, 2: Modem, 3:GNSS, 4:NMEA, 5:Diag
GNSS port don't use serial driver.
Signed-off-by: Slark Xiao <slark_xiao@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2235,6 +2235,10 @@ static const struct usb_device_id option
.driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */
.driver_info = RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */
+ .driver_info = RSVD(3) },
+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0f0, 0xff), /* Foxconn T99W373 MBIM */
+ .driver_info = RSVD(3) },
{ USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */
.driver_info = RSVD(4) | RSVD(5) | RSVD(6) },
{ USB_DEVICE(0x1782, 0x4d10) }, /* Fibocom L610 (AT mode) */
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 009/406] usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 008/406] USB: serial: option: add FOXCONN T99W368/T99W373 product Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 010/406] usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 Greg Kroah-Hartman
` (405 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luke Lu, Neil Armstrong
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luke Lu <luke.lu@libre.computer>
commit 1fa206bb764f37d2ab4bf671e483153ef0659b34 upstream.
Device connected to usb otg port of GXL-based boards can not be
recognised after resumption, doesn't recover even if disconnect and
reconnect the device. dmesg shows it disconnects during resumption.
[ 41.492911] usb 1-2: USB disconnect, device number 3
[ 41.499346] usb 1-2: unregistering device
[ 41.511939] usb 1-2: unregistering interface 1-2:1.0
Calling usb_post_init() will fix this issue, and it's tested and
verified on libretech's aml-s905x-cc board.
Cc: stable@vger.kernel.org # v5.8+
Fixes: c99993376f72 ("usb: dwc3: Add Amlogic G12A DWC3 glue")
Signed-off-by: Luke Lu <luke.lu@libre.computer>
Acked-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230809212911.18903-1-luke.lu@libre.computer
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/dwc3-meson-g12a.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/dwc3/dwc3-meson-g12a.c
+++ b/drivers/usb/dwc3/dwc3-meson-g12a.c
@@ -931,6 +931,12 @@ static int __maybe_unused dwc3_meson_g12
return ret;
}
+ if (priv->drvdata->usb_post_init) {
+ ret = priv->drvdata->usb_post_init(priv);
+ if (ret)
+ return ret;
+ }
+
return 0;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 010/406] usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 009/406] usb: dwc3: meson-g12a: do post init to fix broken usb after resumption Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 011/406] HID: wacom: remove the battery when the EKR is off Greg Kroah-Hartman
` (404 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Peter Chen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit 36668515d56bf73f06765c71e08c8f7465f1e5c4 upstream.
In current driver, the value of tuning parameter will not take effect
if samsung,picophy-* is assigned as 0. Because 0 is also a valid value
acccording to the description of USB_PHY_CFG1 register, this will improve
the logic to let it work.
Fixes: 58a3cefb3840 ("usb: chipidea: imx: add two samsung picophy parameters tuning implementation")
cc: <stable@vger.kernel.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20230627112126.1882666-1-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/ci_hdrc_imx.c | 10 ++++++----
drivers/usb/chipidea/usbmisc_imx.c | 6 ++++--
2 files changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/usb/chipidea/ci_hdrc_imx.c
+++ b/drivers/usb/chipidea/ci_hdrc_imx.c
@@ -175,10 +175,12 @@ static struct imx_usbmisc_data *usbmisc_
if (of_usb_get_phy_mode(np) == USBPHY_INTERFACE_MODE_ULPI)
data->ulpi = 1;
- of_property_read_u32(np, "samsung,picophy-pre-emp-curr-control",
- &data->emp_curr_control);
- of_property_read_u32(np, "samsung,picophy-dc-vol-level-adjust",
- &data->dc_vol_level_adjust);
+ if (of_property_read_u32(np, "samsung,picophy-pre-emp-curr-control",
+ &data->emp_curr_control))
+ data->emp_curr_control = -1;
+ if (of_property_read_u32(np, "samsung,picophy-dc-vol-level-adjust",
+ &data->dc_vol_level_adjust))
+ data->dc_vol_level_adjust = -1;
return data;
}
--- a/drivers/usb/chipidea/usbmisc_imx.c
+++ b/drivers/usb/chipidea/usbmisc_imx.c
@@ -657,13 +657,15 @@ static int usbmisc_imx7d_init(struct imx
usbmisc->base + MX7D_USBNC_USB_CTRL2);
/* PHY tuning for signal quality */
reg = readl(usbmisc->base + MX7D_USB_OTG_PHY_CFG1);
- if (data->emp_curr_control && data->emp_curr_control <=
+ if (data->emp_curr_control >= 0 &&
+ data->emp_curr_control <=
(TXPREEMPAMPTUNE0_MASK >> TXPREEMPAMPTUNE0_BIT)) {
reg &= ~TXPREEMPAMPTUNE0_MASK;
reg |= (data->emp_curr_control << TXPREEMPAMPTUNE0_BIT);
}
- if (data->dc_vol_level_adjust && data->dc_vol_level_adjust <=
+ if (data->dc_vol_level_adjust >= 0 &&
+ data->dc_vol_level_adjust <=
(TXVREFTUNE0_MASK >> TXVREFTUNE0_BIT)) {
reg &= ~TXVREFTUNE0_MASK;
reg |= (data->dc_vol_level_adjust << TXVREFTUNE0_BIT);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 011/406] HID: wacom: remove the battery when the EKR is off
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 010/406] usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 012/406] staging: rtl8712: fix race condition Greg Kroah-Hartman
` (403 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aaron Skomra, Aaron Armstrong Skomra,
Jason Gerecke, Jiri Kosina
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
commit 9ac6678b95b0dd9458a7a6869f46e51cd55a1d84 upstream.
Currently the EKR battery remains even after we stop getting information
from the device. This can lead to a stale battery persisting indefinitely
in userspace.
The remote sends a heartbeat every 10 seconds. Delete the battery if we
miss two heartbeats (after 21 seconds). Restore the battery once we see
a heartbeat again.
Signed-off-by: Aaron Skomra <skomra@gmail.com>
Signed-off-by: Aaron Armstrong Skomra <aaron.skomra@wacom.com>
Reviewed-by: Jason Gerecke <jason.gerecke@wacom.com>
Fixes: 9f1015d45f62 ("HID: wacom: EKR: attach the power_supply on first connection")
CC: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom.h | 1 +
drivers/hid/wacom_sys.c | 25 +++++++++++++++++++++----
drivers/hid/wacom_wac.c | 1 +
drivers/hid/wacom_wac.h | 1 +
4 files changed, 24 insertions(+), 4 deletions(-)
--- a/drivers/hid/wacom.h
+++ b/drivers/hid/wacom.h
@@ -153,6 +153,7 @@ struct wacom_remote {
struct input_dev *input;
bool registered;
struct wacom_battery battery;
+ ktime_t active_time;
} remotes[WACOM_MAX_REMOTES];
};
--- a/drivers/hid/wacom_sys.c
+++ b/drivers/hid/wacom_sys.c
@@ -2529,6 +2529,18 @@ fail:
return;
}
+static void wacom_remote_destroy_battery(struct wacom *wacom, int index)
+{
+ struct wacom_remote *remote = wacom->remote;
+
+ if (remote->remotes[index].battery.battery) {
+ devres_release_group(&wacom->hdev->dev,
+ &remote->remotes[index].battery.bat_desc);
+ remote->remotes[index].battery.battery = NULL;
+ remote->remotes[index].active_time = 0;
+ }
+}
+
static void wacom_remote_destroy_one(struct wacom *wacom, unsigned int index)
{
struct wacom_remote *remote = wacom->remote;
@@ -2543,9 +2555,7 @@ static void wacom_remote_destroy_one(str
remote->remotes[i].registered = false;
spin_unlock_irqrestore(&remote->remote_lock, flags);
- if (remote->remotes[i].battery.battery)
- devres_release_group(&wacom->hdev->dev,
- &remote->remotes[i].battery.bat_desc);
+ wacom_remote_destroy_battery(wacom, i);
if (remote->remotes[i].group.name)
devres_release_group(&wacom->hdev->dev,
@@ -2553,7 +2563,6 @@ static void wacom_remote_destroy_one(str
remote->remotes[i].serial = 0;
remote->remotes[i].group.name = NULL;
- remote->remotes[i].battery.battery = NULL;
wacom->led.groups[i].select = WACOM_STATUS_UNKNOWN;
}
}
@@ -2638,6 +2647,9 @@ static int wacom_remote_attach_battery(s
if (remote->remotes[index].battery.battery)
return 0;
+ if (!remote->remotes[index].active_time)
+ return 0;
+
if (wacom->led.groups[index].select == WACOM_STATUS_UNKNOWN)
return 0;
@@ -2653,6 +2665,7 @@ static void wacom_remote_work(struct wor
{
struct wacom *wacom = container_of(work, struct wacom, remote_work);
struct wacom_remote *remote = wacom->remote;
+ ktime_t kt = ktime_get();
struct wacom_remote_data data;
unsigned long flags;
unsigned int count;
@@ -2679,6 +2692,10 @@ static void wacom_remote_work(struct wor
serial = data.remote[i].serial;
if (data.remote[i].connected) {
+ if (kt - remote->remotes[i].active_time > WACOM_REMOTE_BATTERY_TIMEOUT
+ && remote->remotes[i].active_time != 0)
+ wacom_remote_destroy_battery(wacom, i);
+
if (remote->remotes[i].serial == serial) {
wacom_remote_attach_battery(wacom, i);
continue;
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -1127,6 +1127,7 @@ static int wacom_remote_irq(struct wacom
if (index < 0 || !remote->remotes[index].registered)
goto out;
+ remote->remotes[i].active_time = ktime_get();
input = remote->remotes[index].input;
input_report_key(input, BTN_0, (data[9] & 0x01));
--- a/drivers/hid/wacom_wac.h
+++ b/drivers/hid/wacom_wac.h
@@ -15,6 +15,7 @@
#define WACOM_NAME_MAX 64
#define WACOM_MAX_REMOTES 5
#define WACOM_STATUS_UNKNOWN 255
+#define WACOM_REMOTE_BATTERY_TIMEOUT 21000000000ll
/* packet length for individual models */
#define WACOM_PKGLEN_BBFUN 9
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 012/406] staging: rtl8712: fix race condition
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 011/406] HID: wacom: remove the battery when the EKR is off Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 013/406] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to " Greg Kroah-Hartman
` (402 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b08315e8cf5a78eed03c, stable,
Nam Cao
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcaov@gmail.com>
commit 1422b526fba994cf05fd288a152106563b875fce upstream.
In probe function, request_firmware_nowait() is called to load firmware
asynchronously. At completion of firmware loading, register_netdev() is
called. However, a mutex needed by netdev is initialized after the call
to request_firmware_nowait(). Consequently, it can happen that
register_netdev() is called before the driver is ready.
Move the mutex initialization into r8712_init_drv_sw(), which is called
before request_firmware_nowait().
Reported-by: syzbot+b08315e8cf5a78eed03c@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-staging/000000000000d9d4560601b8e0d7@google.com/T/#u
Fixes: 8c213fa59199 ("staging: r8712u: Use asynchronous firmware loading")
Cc: stable <stable@kernel.org>
Signed-off-by: Nam Cao <namcaov@gmail.com>
Link: https://lore.kernel.org/r/20230731110620.116562-1-namcaov@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/staging/rtl8712/os_intfs.c | 1 +
drivers/staging/rtl8712/usb_intf.c | 1 -
2 files changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/staging/rtl8712/os_intfs.c
+++ b/drivers/staging/rtl8712/os_intfs.c
@@ -323,6 +323,7 @@ int r8712_init_drv_sw(struct _adapter *p
mp871xinit(padapter);
init_default_value(padapter);
r8712_InitSwLeds(padapter);
+ mutex_init(&padapter->mutex_start);
return ret;
}
--- a/drivers/staging/rtl8712/usb_intf.c
+++ b/drivers/staging/rtl8712/usb_intf.c
@@ -570,7 +570,6 @@ static int r871xu_drv_init(struct usb_in
if (rtl871x_load_fw(padapter))
goto deinit_drv_sw;
spin_lock_init(&padapter->lock_rx_ff0_filter);
- mutex_init(&padapter->mutex_start);
return 0;
deinit_drv_sw:
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 013/406] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 012/406] staging: rtl8712: fix race condition Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 014/406] configfs: fix a race in configfs_lookup() Greg Kroah-Hartman
` (401 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Wang, Luiz Augusto von Dentz,
Denis Efremov (Oracle)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Wang <zyytlz.wz@163.com>
commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 upstream.
In btsdio_probe, the data->work is bound with btsdio_work. It will be
started in btsdio_send_frame.
If the btsdio_remove runs with a unfinished work, there may be a race
condition that hdev is freed but used in btsdio_work. Fix it by
canceling the work before do cleanup in btsdio_remove.
Fixes: CVE-2023-1989
Fixes: ddbaf13e3609 ("[Bluetooth] Add generic driver for Bluetooth SDIO devices")
Cc: stable@vger.kernel.org
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Denis: Added CVE-2023-1989 and fixes tags. ]
Signed-off-by: Denis Efremov (Oracle) <efremov@linux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/btsdio.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -355,6 +355,7 @@ static void btsdio_remove(struct sdio_fu
if (!data)
return;
+ cancel_work_sync(&data->work);
hdev = data->hdev;
sdio_set_drvdata(func, NULL);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 014/406] configfs: fix a race in configfs_lookup()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 013/406] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to " Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 015/406] serial: qcom-geni: fix opp vote on shutdown Greg Kroah-Hartman
` (400 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sishuai Gong, Christoph Hellwig,
Kyle Zeng
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sishuai Gong <sishuai@purdue.edu>
commit c42dd069be8dfc9b2239a5c89e73bbd08ab35de0 upstream.
When configfs_lookup() is executing list_for_each_entry(),
it is possible that configfs_dir_lseek() is calling list_del().
Some unfortunate interleavings of them can cause a kernel NULL
pointer dereference error
Thread 1 Thread 2
//configfs_dir_lseek() //configfs_lookup()
list_del(&cursor->s_sibling);
list_for_each_entry(sd, ...)
Fix this by grabbing configfs_dirent_lock in configfs_lookup()
while iterating ->s_children.
Signed-off-by: Sishuai Gong <sishuai@purdue.edu>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/configfs/dir.c | 2 ++
1 file changed, 2 insertions(+)
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -479,6 +479,7 @@ static struct dentry * configfs_lookup(s
if (!configfs_dirent_is_ready(parent_sd))
goto out;
+ spin_lock(&configfs_dirent_lock);
list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
if (sd->s_type & CONFIGFS_NOT_PINNED) {
const unsigned char * name = configfs_get_name(sd);
@@ -491,6 +492,7 @@ static struct dentry * configfs_lookup(s
break;
}
}
+ spin_unlock(&configfs_dirent_lock);
if (!found) {
/*
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 015/406] serial: qcom-geni: fix opp vote on shutdown
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 014/406] configfs: fix a race in configfs_lookup() Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 016/406] serial: sc16is7xx: fix broken port 0 uart init Greg Kroah-Hartman
` (399 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajendra Nayak, Matthias Kaehlcke,
Johan Hovold, Konrad Dybcio
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan+linaro@kernel.org>
commit 8ece7b754bc34ffd7fcc8269ccb9128e72ca76d8 upstream.
The operating-performance-point vote needs to be dropped when shutting
down the port to avoid wasting power by keeping resources like power
domains in an unnecessarily high performance state (e.g. when a UART
connected Bluetooth controller is not in use).
Fixes: a5819b548af0 ("tty: serial: qcom_geni_serial: Use OPP API to set clk/perf state")
Cc: stable@vger.kernel.org # 5.9
Cc: Rajendra Nayak <quic_rjendra@quicinc.com>
Cc: Matthias Kaehlcke <mka@chromium.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Acked-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230714130214.14552-2-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/qcom_geni_serial.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/tty/serial/qcom_geni_serial.c
+++ b/drivers/tty/serial/qcom_geni_serial.c
@@ -125,6 +125,7 @@ struct qcom_geni_serial_port {
u32 tx_fifo_width;
u32 rx_fifo_depth;
bool setup;
+ unsigned long clk_rate;
int (*handle_rx)(struct uart_port *uport, u32 bytes, bool drop);
unsigned int baud;
void *rx_fifo;
@@ -1022,6 +1023,7 @@ static void qcom_geni_serial_set_termios
goto out_restart_rx;
uport->uartclk = clk_rate;
+ port->clk_rate = clk_rate;
dev_pm_opp_set_rate(uport->dev, clk_rate);
ser_clk_cfg = SER_CLK_EN;
ser_clk_cfg |= clk_div << CLK_DIV_SHFT;
@@ -1305,10 +1307,13 @@ static void qcom_geni_serial_pm(struct u
if (new_state == UART_PM_STATE_ON && old_state == UART_PM_STATE_OFF) {
geni_icc_enable(&port->se);
+ if (port->clk_rate)
+ dev_pm_opp_set_rate(uport->dev, port->clk_rate);
geni_se_resources_on(&port->se);
} else if (new_state == UART_PM_STATE_OFF &&
old_state == UART_PM_STATE_ON) {
geni_se_resources_off(&port->se);
+ dev_pm_opp_set_rate(uport->dev, 0);
geni_icc_disable(&port->se);
}
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 016/406] serial: sc16is7xx: fix broken port 0 uart init
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 015/406] serial: qcom-geni: fix opp vote on shutdown Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 017/406] serial: sc16is7xx: fix bug when first setting GPIO direction Greg Kroah-Hartman
` (398 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Villeneuve, Ilpo Järvinen,
Lech Perczak
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
commit 2861ed4d6e6d1a2c9de9bf5b0abd996c2dc673d0 upstream.
The sc16is7xx_config_rs485() function is called only for the second
port (index 1, channel B), causing initialization problems for the
first port.
For the sc16is7xx driver, port->membase and port->mapbase are not set,
and their default values are 0. And we set port->iobase to the device
index. This means that when the first device is registered using the
uart_add_one_port() function, the following values will be in the port
structure:
port->membase = 0
port->mapbase = 0
port->iobase = 0
Therefore, the function uart_configure_port() in serial_core.c will
exit early because of the following check:
/*
* If there isn't a port here, don't do anything further.
*/
if (!port->iobase && !port->mapbase && !port->membase)
return;
Typically, I2C and SPI drivers do not set port->membase and
port->mapbase.
The max310x driver sets port->membase to ~0 (all ones). By
implementing the same change in this driver, uart_configure_port() is
now correctly executed for all ports.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable@vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Lech Perczak <lech.perczak@camlingroup.com>
Tested-by: Lech Perczak <lech.perczak@camlingroup.com>
Link: https://lore.kernel.org/r/20230807214556.540627-2-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1256,6 +1256,12 @@ static int sc16is7xx_probe(struct device
s->p[i].port.fifosize = SC16IS7XX_FIFO_SIZE;
s->p[i].port.flags = UPF_FIXED_TYPE | UPF_LOW_LATENCY;
s->p[i].port.iobase = i;
+ /*
+ * Use all ones as membase to make sure uart_configure_port() in
+ * serial_core.c does not abort for SPI/I2C devices where the
+ * membase address is not applicable.
+ */
+ s->p[i].port.membase = (void __iomem *)~0;
s->p[i].port.iotype = UPIO_PORT;
s->p[i].port.uartclk = freq;
s->p[i].port.rs485_config = sc16is7xx_config_rs485;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 017/406] serial: sc16is7xx: fix bug when first setting GPIO direction
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 016/406] serial: sc16is7xx: fix broken port 0 uart init Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 018/406] firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe Greg Kroah-Hartman
` (397 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hugo Villeneuve, Lech Perczak
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
commit 9baeea723c0fb9c3ba9a336369f758ed9bc6831d upstream.
When configuring a pin as an output pin with a value of logic 0, we
end up as having a value of logic 1 on the output pin. Setting a
logic 0 a second time (or more) after that will correctly output a
logic 0 on the output pin.
By default, all GPIO pins are configured as inputs. When we enter
sc16is7xx_gpio_direction_output() for the first time, we first set the
desired value in IOSTATE, and then we configure the pin as an output.
The datasheet states that writing to IOSTATE register will trigger a
transfer of the value to the I/O pin configured as output, so if the
pin is configured as an input, nothing will be transferred.
Therefore, set the direction first in IODIR, and then set the desired
value in IOSTATE.
This is what is done in NXP application note AN10587.
Fixes: dfeae619d781 ("serial: sc16is7xx")
Cc: stable@vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Lech Perczak <lech.perczak@camlingroup.com>
Tested-by: Lech Perczak <lech.perczak@camlingroup.com>
Link: https://lore.kernel.org/r/20230807214556.540627-6-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -1170,9 +1170,18 @@ static int sc16is7xx_gpio_direction_outp
state |= BIT(offset);
else
state &= ~BIT(offset);
- sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
+
+ /*
+ * If we write IOSTATE first, and then IODIR, the output value is not
+ * transferred to the corresponding I/O pin.
+ * The datasheet states that each register bit will be transferred to
+ * the corresponding I/O pin programmed as output when writing to
+ * IOSTATE. Therefore, configure direction first with IODIR, and then
+ * set value after with IOSTATE.
+ */
sc16is7xx_port_update(port, SC16IS7XX_IODIR_REG, BIT(offset),
BIT(offset));
+ sc16is7xx_port_write(port, SC16IS7XX_IOSTATE_REG, state);
return 0;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 018/406] firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 017/406] serial: sc16is7xx: fix bug when first setting GPIO direction Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 019/406] fsi: master-ast-cf: Add MODULE_FIRMWARE macro Greg Kroah-Hartman
` (396 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wang Ming, Dinh Nguyen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Ming <machel@vivo.com>
commit dd218433f2b635d97e8fda3eed047151fd528ce4 upstream.
The devm_memremap() function returns error pointers.
It never returns NULL. Fix the check.
Fixes: 7ca5ce896524 ("firmware: add Intel Stratix10 service layer driver")
Cc: stable@vger.kernel.org
Signed-off-by: Wang Ming <machel@vivo.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Link: https://lore.kernel.org/r/20230727193750.983795-1-dinguyen@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/stratix10-svc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -623,7 +623,7 @@ svc_create_memory_pool(struct platform_d
paddr = begin;
size = end - begin;
va = devm_memremap(dev, paddr, size, MEMREMAP_WC);
- if (!va) {
+ if (IS_ERR(va)) {
dev_err(dev, "fail to remap shared memory\n");
return ERR_PTR(-EINVAL);
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 019/406] fsi: master-ast-cf: Add MODULE_FIRMWARE macro
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 018/406] firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 020/406] nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() Greg Kroah-Hartman
` (395 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Juerg Haefliger, Joel Stanley
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juerg Haefliger <juerg.haefliger@canonical.com>
commit 3a1d7aff6e65ad6e285e28abe55abbfd484997ee upstream.
The module loads firmware so add a MODULE_FIRMWARE macro to provide that
information via modinfo.
Fixes: 6a794a27daca ("fsi: master-ast-cf: Add new FSI master using Aspeed ColdFire")
Cc: stable@vger.kernel.org # 4.19+
Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
Link: https://lore.kernel.org/r/20230628095039.26218-1-juerg.haefliger@canonical.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/fsi/fsi-master-ast-cf.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/fsi/fsi-master-ast-cf.c
+++ b/drivers/fsi/fsi-master-ast-cf.c
@@ -1440,3 +1440,4 @@ static struct platform_driver fsi_master
module_platform_driver(fsi_master_acf);
MODULE_LICENSE("GPL");
+MODULE_FIRMWARE(FW_FILE_NAME);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 020/406] nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 019/406] fsi: master-ast-cf: Add MODULE_FIRMWARE macro Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 021/406] nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse Greg Kroah-Hartman
` (394 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi,
syzbot+0ad741797f4565e7e2d2, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit f83913f8c5b882a312e72b7669762f8a5c9385e4 upstream.
A syzbot stress test reported that create_empty_buffers() called from
nilfs_lookup_dirty_data_buffers() can cause a general protection fault.
Analysis using its reproducer revealed that the back reference "mapping"
from a page/folio has been changed to NULL after dirty page/folio gang
lookup in nilfs_lookup_dirty_data_buffers().
Fix this issue by excluding pages/folios from being collected if, after
acquiring a lock on each page/folio, its back reference "mapping" differs
from the pointer to the address space struct that held the page/folio.
Link: https://lkml.kernel.org/r/20230805132038.6435-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+0ad741797f4565e7e2d2@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/0000000000002930a705fc32b231@google.com
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/segment.c | 5 +++++
fs/nilfs2/segment.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c
@@ -730,6 +730,11 @@ static size_t nilfs_lookup_dirty_data_bu
struct page *page = pvec.pages[i];
lock_page(page);
+ if (unlikely(page->mapping != mapping)) {
+ /* Exclude pages removed from the address space */
+ unlock_page(page);
+ continue;
+ }
if (!page_has_buffers(page))
create_empty_buffers(page, i_blocksize(inode), 0);
unlock_page(page);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 021/406] nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 020/406] nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 022/406] pinctrl: amd: Dont show `Invalid config param` errors Greg Kroah-Hartman
` (393 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ryusuke Konishi,
syzbot+cdfcae656bac88ba0e2d, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ryusuke Konishi <konishi.ryusuke@gmail.com>
commit cdaac8e7e5a059f9b5e816cda257f08d0abffacd upstream.
A syzbot stress test using a corrupted disk image reported that
mark_buffer_dirty() called from __nilfs_mark_inode_dirty() or
nilfs_palloc_commit_alloc_entry() may output a kernel warning, and can
panic if the kernel is booted with panic_on_warn.
This is because nilfs2 keeps buffer pointers in local structures for some
metadata and reuses them, but such buffers may be forcibly discarded by
nilfs_clear_dirty_page() in some critical situations.
This issue is reported to appear after commit 28a65b49eb53 ("nilfs2: do
not write dirty data after degenerating to read-only"), but the issue has
potentially existed before.
Fix this issue by checking the uptodate flag when attempting to reuse an
internally held buffer, and reloading the metadata instead of reusing the
buffer if the flag was lost.
Link: https://lkml.kernel.org/r/20230818131804.7758-1-konishi.ryusuke@gmail.com
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Reported-by: syzbot+cdfcae656bac88ba0e2d@syzkaller.appspotmail.com
Closes: https://lkml.kernel.org/r/0000000000003da75f05fdeffd12@google.com
Fixes: 8c26c4e2694a ("nilfs2: fix issue with flush kernel thread after remount in RO mode because of driver's internal error or metadata corruption")
Tested-by: Ryusuke Konishi <konishi.ryusuke@gmail.com>
Cc: <stable@vger.kernel.org> # 3.10+
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/alloc.c | 3 ++-
fs/nilfs2/inode.c | 7 +++++--
2 files changed, 7 insertions(+), 3 deletions(-)
--- a/fs/nilfs2/alloc.c
+++ b/fs/nilfs2/alloc.c
@@ -205,7 +205,8 @@ static int nilfs_palloc_get_block(struct
int ret;
spin_lock(lock);
- if (prev->bh && blkoff == prev->blkoff) {
+ if (prev->bh && blkoff == prev->blkoff &&
+ likely(buffer_uptodate(prev->bh))) {
get_bh(prev->bh);
*bhp = prev->bh;
spin_unlock(lock);
--- a/fs/nilfs2/inode.c
+++ b/fs/nilfs2/inode.c
@@ -1027,7 +1027,7 @@ int nilfs_load_inode_block(struct inode
int err;
spin_lock(&nilfs->ns_inode_lock);
- if (ii->i_bh == NULL) {
+ if (ii->i_bh == NULL || unlikely(!buffer_uptodate(ii->i_bh))) {
spin_unlock(&nilfs->ns_inode_lock);
err = nilfs_ifile_get_inode_block(ii->i_root->ifile,
inode->i_ino, pbh);
@@ -1036,7 +1036,10 @@ int nilfs_load_inode_block(struct inode
spin_lock(&nilfs->ns_inode_lock);
if (ii->i_bh == NULL)
ii->i_bh = *pbh;
- else {
+ else if (unlikely(!buffer_uptodate(ii->i_bh))) {
+ __brelse(ii->i_bh);
+ ii->i_bh = *pbh;
+ } else {
brelse(*pbh);
*pbh = ii->i_bh;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 022/406] pinctrl: amd: Dont show `Invalid config param` errors
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 021/406] nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 023/406] ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire Greg Kroah-Hartman
` (392 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Linus Walleij
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 87b549efcb0f7934b0916d2a00607a878b6f1e0f upstream.
On some systems amd_pinconf_set() is called with parameters
0x8 (PIN_CONFIG_DRIVE_PUSH_PULL) or 0x14 (PIN_CONFIG_PERSIST_STATE)
which are not supported by pinctrl-amd.
Don't show an err message when called with an invalid parameter,
downgrade this to debug instead.
Cc: stable@vger.kernel.org # 6.1
Fixes: 635a750d958e1 ("pinctrl: amd: Use amd_pinconf_set() for all config options")
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Link: https://lore.kernel.org/r/20230717201652.17168-1-mario.limonciello@amd.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinctrl-amd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pinctrl/pinctrl-amd.c
+++ b/drivers/pinctrl/pinctrl-amd.c
@@ -653,7 +653,7 @@ static int amd_pinconf_get(struct pinctr
break;
default:
- dev_err(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
+ dev_dbg(&gpio_dev->pdev->dev, "Invalid config param %04x\n",
param);
return -ENOTSUPP;
}
@@ -706,7 +706,7 @@ static int amd_pinconf_set(struct pinctr
break;
default:
- dev_err(&gpio_dev->pdev->dev,
+ dev_dbg(&gpio_dev->pdev->dev,
"Invalid config param %04x\n", param);
ret = -ENOTSUPP;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 023/406] ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 022/406] pinctrl: amd: Dont show `Invalid config param` errors Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 024/406] ARM: dts: imx: update sdma node name format Greg Kroah-Hartman
` (391 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bard Liao, Oder Chiou,
Pierre-Louis Bossart, Mark Brown, Nobuhiro Iwamatsu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oder Chiou <oder_chiou@realtek.com>
commit 9266d95405ae0c078f188ec8bca3a004631be429 upstream.
The device checking error should be a jump to pm_runtime_put_autosuspend()
as done before returning value.
Fixes: 867f8d18df4f ('ASoC: rt5682: fix getting the wrong device id when the suspend_stress_test')
Reviewed-by: Bard Liao <bard.liao@intel.com>
Signed-off-by: Oder Chiou <oder_chiou@realtek.com>
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://lore.kernel.org/r/20210607222239.582139-13-pierre-louis.bossart@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Nobuhiro Iwamatsu <nobuhiro1.iwamatsu@toshiba.co.jp>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/rt5682-sdw.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/sound/soc/codecs/rt5682-sdw.c
+++ b/sound/soc/codecs/rt5682-sdw.c
@@ -413,9 +413,11 @@ static int rt5682_io_init(struct device
usleep_range(30000, 30005);
loop--;
}
+
if (val != DEVICE_ID) {
dev_err(dev, "Device with ID register %x is not rt5682\n", val);
- return -ENODEV;
+ ret = -ENODEV;
+ goto err_nodev;
}
rt5682_calibrate(rt5682);
@@ -486,10 +488,11 @@ reinit:
rt5682->hw_init = true;
rt5682->first_hw_init = true;
+err_nodev:
pm_runtime_mark_last_busy(&slave->dev);
pm_runtime_put_autosuspend(&slave->dev);
- dev_dbg(&slave->dev, "%s hw_init complete\n", __func__);
+ dev_dbg(&slave->dev, "%s hw_init complete: %d\n", __func__, ret);
return ret;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 024/406] ARM: dts: imx: update sdma node name format
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 023/406] ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 025/406] ARM: dts: imx7s: Drop dma-apb interrupt-names Greg Kroah-Hartman
` (390 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Joy Zou, Shawn Guo,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joy Zou <joy.zou@nxp.com>
[ Upstream commit 6769089ecb5073b0896addffe72c89a4d80258c9 ]
Node names should be generic, so change the sdma node name format 'sdma'
into 'dma-controller'.
Acked-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Joy Zou <joy.zou@nxp.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Stable-dep-of: be18293e47cb ("ARM: dts: imx: Set default tuning step for imx7d usdhc")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx25.dtsi | 2 +-
arch/arm/boot/dts/imx31.dtsi | 2 +-
arch/arm/boot/dts/imx35.dtsi | 2 +-
arch/arm/boot/dts/imx50.dtsi | 2 +-
arch/arm/boot/dts/imx51.dtsi | 2 +-
arch/arm/boot/dts/imx53.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl.dtsi | 2 +-
arch/arm/boot/dts/imx6sl.dtsi | 2 +-
arch/arm/boot/dts/imx6sx.dtsi | 2 +-
arch/arm/boot/dts/imx6ul.dtsi | 2 +-
arch/arm/boot/dts/imx7s.dtsi | 2 +-
11 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
index 1ab19f1268f81..d24b1da18766b 100644
--- a/arch/arm/boot/dts/imx25.dtsi
+++ b/arch/arm/boot/dts/imx25.dtsi
@@ -515,7 +515,7 @@
#interrupt-cells = <2>;
};
- sdma: sdma@53fd4000 {
+ sdma: dma-controller@53fd4000 {
compatible = "fsl,imx25-sdma";
reg = <0x53fd4000 0x4000>;
clocks = <&clks 112>, <&clks 68>;
diff --git a/arch/arm/boot/dts/imx31.dtsi b/arch/arm/boot/dts/imx31.dtsi
index 45333f7e10eaa..0ee7e5547beaf 100644
--- a/arch/arm/boot/dts/imx31.dtsi
+++ b/arch/arm/boot/dts/imx31.dtsi
@@ -297,7 +297,7 @@
#interrupt-cells = <2>;
};
- sdma: sdma@53fd4000 {
+ sdma: dma-controller@53fd4000 {
compatible = "fsl,imx31-sdma";
reg = <0x53fd4000 0x4000>;
interrupts = <34>;
diff --git a/arch/arm/boot/dts/imx35.dtsi b/arch/arm/boot/dts/imx35.dtsi
index aba16252faab4..e7c4803ef866e 100644
--- a/arch/arm/boot/dts/imx35.dtsi
+++ b/arch/arm/boot/dts/imx35.dtsi
@@ -284,7 +284,7 @@
#interrupt-cells = <2>;
};
- sdma: sdma@53fd4000 {
+ sdma: dma-controller@53fd4000 {
compatible = "fsl,imx35-sdma";
reg = <0x53fd4000 0x4000>;
clocks = <&clks 9>, <&clks 65>;
diff --git a/arch/arm/boot/dts/imx50.dtsi b/arch/arm/boot/dts/imx50.dtsi
index b6b2e6af9b966..ae51333c30b32 100644
--- a/arch/arm/boot/dts/imx50.dtsi
+++ b/arch/arm/boot/dts/imx50.dtsi
@@ -421,7 +421,7 @@
status = "disabled";
};
- sdma: sdma@63fb0000 {
+ sdma: dma-controller@63fb0000 {
compatible = "fsl,imx50-sdma", "fsl,imx35-sdma";
reg = <0x63fb0000 0x4000>;
interrupts = <6>;
diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi
index 985e1be03ad64..d80063560a657 100644
--- a/arch/arm/boot/dts/imx51.dtsi
+++ b/arch/arm/boot/dts/imx51.dtsi
@@ -498,7 +498,7 @@
status = "disabled";
};
- sdma: sdma@83fb0000 {
+ sdma: dma-controller@83fb0000 {
compatible = "fsl,imx51-sdma", "fsl,imx35-sdma";
reg = <0x83fb0000 0x4000>;
interrupts = <6>;
diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi
index 500eeaa3a27c5..f4e7f437ea506 100644
--- a/arch/arm/boot/dts/imx53.dtsi
+++ b/arch/arm/boot/dts/imx53.dtsi
@@ -710,7 +710,7 @@
status = "disabled";
};
- sdma: sdma@63fb0000 {
+ sdma: dma-controller@63fb0000 {
compatible = "fsl,imx53-sdma", "fsl,imx35-sdma";
reg = <0x63fb0000 0x4000>;
interrupts = <6>;
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index 7d81992dfafc6..e02dcf1bff165 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -927,7 +927,7 @@
interrupts = <0 125 IRQ_TYPE_LEVEL_HIGH>;
};
- sdma: sdma@20ec000 {
+ sdma: dma-controller@20ec000 {
compatible = "fsl,imx6q-sdma", "fsl,imx35-sdma";
reg = <0x020ec000 0x4000>;
interrupts = <0 2 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm/boot/dts/imx6sl.dtsi b/arch/arm/boot/dts/imx6sl.dtsi
index 5b4dfc62030e8..0e0139246ad21 100644
--- a/arch/arm/boot/dts/imx6sl.dtsi
+++ b/arch/arm/boot/dts/imx6sl.dtsi
@@ -752,7 +752,7 @@
interrupts = <0 6 IRQ_TYPE_LEVEL_HIGH>;
};
- sdma: sdma@20ec000 {
+ sdma: dma-controller@20ec000 {
compatible = "fsl,imx6sl-sdma", "fsl,imx6q-sdma";
reg = <0x020ec000 0x4000>;
interrupts = <0 2 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index 629c6a7432d9b..39c1d702210a1 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -848,7 +848,7 @@
reg = <0x020e4000 0x4000>;
};
- sdma: sdma@20ec000 {
+ sdma: dma-controller@20ec000 {
compatible = "fsl,imx6sx-sdma", "fsl,imx6q-sdma";
reg = <0x020ec000 0x4000>;
interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
index b40dd0c198028..44a6e8c0e4075 100644
--- a/arch/arm/boot/dts/imx6ul.dtsi
+++ b/arch/arm/boot/dts/imx6ul.dtsi
@@ -743,7 +743,7 @@
status = "disabled";
};
- sdma: sdma@20ec000 {
+ sdma: dma-controller@20ec000 {
compatible = "fsl,imx6ul-sdma", "fsl,imx6q-sdma",
"fsl,imx35-sdma";
reg = <0x020ec000 0x4000>;
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 334e781663cc2..d9685f586ac07 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -1177,7 +1177,7 @@
status = "disabled";
};
- sdma: sdma@30bd0000 {
+ sdma: dma-controller@30bd0000 {
compatible = "fsl,imx7d-sdma", "fsl,imx35-sdma";
reg = <0x30bd0000 0x10000>;
interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 025/406] ARM: dts: imx7s: Drop dma-apb interrupt-names
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 024/406] ARM: dts: imx: update sdma node name format Greg Kroah-Hartman
@ 2023-09-17 19:07 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 026/406] ARM: dts: imx: Adjust dma-apbh node name Greg Kroah-Hartman
` (389 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:07 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Shawn Guo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
[ Upstream commit 9928f0a9e7c0cee3360ca1442b4001d34ad67556 ]
Drop "interrupt-names" property, since it is broken. The drivers/dma/mxs-dma.c
in Linux kernel does not use it, the property contains duplicate array entries
in existing DTs, and even malformed entries (gmpi, should have been gpmi). Get
rid of that optional property altogether.
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Stable-dep-of: be18293e47cb ("ARM: dts: imx: Set default tuning step for imx7d usdhc")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx7s.dtsi | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index d9685f586ac07..a834fce6d795e 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -1217,7 +1217,6 @@
<GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
<GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>;
- interrupt-names = "gpmi0", "gpmi1", "gpmi2", "gpmi3";
#dma-cells = <1>;
dma-channels = <4>;
clocks = <&clks IMX7D_NAND_USDHC_BUS_RAWNAND_CLK>;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 026/406] ARM: dts: imx: Adjust dma-apbh node name
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-09-17 19:07 ` [PATCH 5.10 025/406] ARM: dts: imx7s: Drop dma-apb interrupt-names Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 027/406] ARM: dts: imx: Set default tuning step for imx7d usdhc Greg Kroah-Hartman
` (388 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Shawn Guo,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <stefan.wahren@i2se.com>
[ Upstream commit e9f5cd85f1f931bb7b64031492f7051187ccaac7 ]
Currently the dtbs_check generates warnings like this:
$nodename:0: 'dma-apbh@110000' does not match '^dma-controller(@.*)?$'
So fix all affected dma-apbh node names.
Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Stable-dep-of: be18293e47cb ("ARM: dts: imx: Set default tuning step for imx7d usdhc")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx23.dtsi | 2 +-
arch/arm/boot/dts/imx28.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl.dtsi | 2 +-
arch/arm/boot/dts/imx6sx.dtsi | 2 +-
arch/arm/boot/dts/imx6ul.dtsi | 2 +-
arch/arm/boot/dts/imx7s.dtsi | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/arm/boot/dts/imx23.dtsi b/arch/arm/boot/dts/imx23.dtsi
index 7f4c602454a5f..ce3d6360a7efb 100644
--- a/arch/arm/boot/dts/imx23.dtsi
+++ b/arch/arm/boot/dts/imx23.dtsi
@@ -59,7 +59,7 @@
reg = <0x80000000 0x2000>;
};
- dma_apbh: dma-apbh@80004000 {
+ dma_apbh: dma-controller@80004000 {
compatible = "fsl,imx23-dma-apbh";
reg = <0x80004000 0x2000>;
interrupts = <0 14 20 0
diff --git a/arch/arm/boot/dts/imx28.dtsi b/arch/arm/boot/dts/imx28.dtsi
index 94dfbf5b3f34a..6cab8b66db805 100644
--- a/arch/arm/boot/dts/imx28.dtsi
+++ b/arch/arm/boot/dts/imx28.dtsi
@@ -78,7 +78,7 @@
status = "disabled";
};
- dma_apbh: dma-apbh@80004000 {
+ dma_apbh: dma-controller@80004000 {
compatible = "fsl,imx28-dma-apbh";
reg = <0x80004000 0x2000>;
interrupts = <82 83 84 85
diff --git a/arch/arm/boot/dts/imx6qdl.dtsi b/arch/arm/boot/dts/imx6qdl.dtsi
index e02dcf1bff165..e67d8dffba35c 100644
--- a/arch/arm/boot/dts/imx6qdl.dtsi
+++ b/arch/arm/boot/dts/imx6qdl.dtsi
@@ -150,7 +150,7 @@
interrupt-parent = <&gpc>;
ranges;
- dma_apbh: dma-apbh@110000 {
+ dma_apbh: dma-controller@110000 {
compatible = "fsl,imx6q-dma-apbh", "fsl,imx28-dma-apbh";
reg = <0x00110000 0x2000>;
interrupts = <0 13 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi
index 39c1d702210a1..08332f70a8dc2 100644
--- a/arch/arm/boot/dts/imx6sx.dtsi
+++ b/arch/arm/boot/dts/imx6sx.dtsi
@@ -209,7 +209,7 @@
power-domains = <&pd_pu>;
};
- dma_apbh: dma-apbh@1804000 {
+ dma_apbh: dma-controller@1804000 {
compatible = "fsl,imx6sx-dma-apbh", "fsl,imx28-dma-apbh";
reg = <0x01804000 0x2000>;
interrupts = <GIC_SPI 13 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm/boot/dts/imx6ul.dtsi b/arch/arm/boot/dts/imx6ul.dtsi
index 44a6e8c0e4075..c374fe2a6f19e 100644
--- a/arch/arm/boot/dts/imx6ul.dtsi
+++ b/arch/arm/boot/dts/imx6ul.dtsi
@@ -164,7 +164,7 @@
<0x00a06000 0x2000>;
};
- dma_apbh: dma-apbh@1804000 {
+ dma_apbh: dma-controller@1804000 {
compatible = "fsl,imx6q-dma-apbh", "fsl,imx28-dma-apbh";
reg = <0x01804000 0x2000>;
interrupts = <0 13 IRQ_TYPE_LEVEL_HIGH>,
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index a834fce6d795e..2b664d457b461 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -1210,7 +1210,7 @@
};
};
- dma_apbh: dma-apbh@33000000 {
+ dma_apbh: dma-controller@33000000 {
compatible = "fsl,imx7d-dma-apbh", "fsl,imx28-dma-apbh";
reg = <0x33000000 0x2000>;
interrupts = <GIC_SPI 12 IRQ_TYPE_LEVEL_HIGH>,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 027/406] ARM: dts: imx: Set default tuning step for imx7d usdhc
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 026/406] ARM: dts: imx: Adjust dma-apbh node name Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 028/406] phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code Greg Kroah-Hartman
` (387 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiaolei Wang, Fabio Estevam,
Shawn Guo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiaolei Wang <xiaolei.wang@windriver.com>
[ Upstream commit be18293e47cbca7c6acee9231fc851601d69563a ]
If the tuning step is not set, the tuning step is set to 1.
For some sd cards, the following Tuning timeout will occur.
Tuning failed, falling back to fixed sampling clock
mmc0: Tuning failed, falling back to fixed sampling clock
So set the default tuning step. This refers to the NXP vendor's
commit below:
https://github.com/nxp-imx/linux-imx/blob/lf-6.1.y/
arch/arm/boot/dts/imx7s.dtsi#L1216-L1217
Fixes: 1e336aa0c025 ("mmc: sdhci-esdhc-imx: correct the tuning start tap and step setting")
Signed-off-by: Xiaolei Wang <xiaolei.wang@windriver.com>
Reviewed-by: Fabio Estevam <festevam@gmail.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/imx7s.dtsi | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/arm/boot/dts/imx7s.dtsi b/arch/arm/boot/dts/imx7s.dtsi
index 2b664d457b461..854c380cccea4 100644
--- a/arch/arm/boot/dts/imx7s.dtsi
+++ b/arch/arm/boot/dts/imx7s.dtsi
@@ -1137,6 +1137,8 @@
<&clks IMX7D_USDHC1_ROOT_CLK>;
clock-names = "ipg", "ahb", "per";
bus-width = <4>;
+ fsl,tuning-step = <2>;
+ fsl,tuning-start-tap = <20>;
status = "disabled";
};
@@ -1149,6 +1151,8 @@
<&clks IMX7D_USDHC2_ROOT_CLK>;
clock-names = "ipg", "ahb", "per";
bus-width = <4>;
+ fsl,tuning-step = <2>;
+ fsl,tuning-start-tap = <20>;
status = "disabled";
};
@@ -1161,6 +1165,8 @@
<&clks IMX7D_USDHC3_ROOT_CLK>;
clock-names = "ipg", "ahb", "per";
bus-width = <4>;
+ fsl,tuning-step = <2>;
+ fsl,tuning-start-tap = <20>;
status = "disabled";
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 028/406] phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 027/406] ARM: dts: imx: Set default tuning step for imx7d usdhc Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 029/406] media: pulse8-cec: handle possible ping error Greg Kroah-Hartman
` (386 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Adrien Thierry, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrien Thierry <athierry@redhat.com>
[ Upstream commit 8932089b566c24ea19b57e37704c492678de1420 ]
The return value from qcom_snps_hsphy_suspend/resume is not used. Make
sure qcom_snps_hsphy_runtime_suspend/resume return this value as well.
Signed-off-by: Adrien Thierry <athierry@redhat.com>
Link: https://lore.kernel.org/r/20230629144542.14906-4-athierry@redhat.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
index abb9264569336..173d166ed8295 100644
--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
+++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c
@@ -171,8 +171,7 @@ static int __maybe_unused qcom_snps_hsphy_runtime_suspend(struct device *dev)
if (!hsphy->phy_initialized)
return 0;
- qcom_snps_hsphy_suspend(hsphy);
- return 0;
+ return qcom_snps_hsphy_suspend(hsphy);
}
static int __maybe_unused qcom_snps_hsphy_runtime_resume(struct device *dev)
@@ -182,8 +181,7 @@ static int __maybe_unused qcom_snps_hsphy_runtime_resume(struct device *dev)
if (!hsphy->phy_initialized)
return 0;
- qcom_snps_hsphy_resume(hsphy);
- return 0;
+ return qcom_snps_hsphy_resume(hsphy);
}
static int qcom_snps_hsphy_set_mode(struct phy *phy, enum phy_mode mode,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 029/406] media: pulse8-cec: handle possible ping error
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 028/406] phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 030/406] media: pci: cx23885: fix error handling for cx23885 ATSC boards Greg Kroah-Hartman
` (385 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 92cbf865ea2e0f2997ff97815c6db182eb23df1b ]
Handle (and warn about) possible error waiting for MSGCODE_PING result.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/cec/usb/pulse8/pulse8-cec.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/cec/usb/pulse8/pulse8-cec.c b/drivers/media/cec/usb/pulse8/pulse8-cec.c
index 04b13cdc38d2c..ba67587bd43ec 100644
--- a/drivers/media/cec/usb/pulse8/pulse8-cec.c
+++ b/drivers/media/cec/usb/pulse8/pulse8-cec.c
@@ -809,8 +809,11 @@ static void pulse8_ping_eeprom_work_handler(struct work_struct *work)
mutex_lock(&pulse8->lock);
cmd = MSGCODE_PING;
- pulse8_send_and_wait(pulse8, &cmd, 1,
- MSGCODE_COMMAND_ACCEPTED, 0);
+ if (pulse8_send_and_wait(pulse8, &cmd, 1,
+ MSGCODE_COMMAND_ACCEPTED, 0)) {
+ dev_warn(pulse8->dev, "failed to ping EEPROM\n");
+ goto unlock;
+ }
if (pulse8->vers < 2)
goto unlock;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 030/406] media: pci: cx23885: fix error handling for cx23885 ATSC boards
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 029/406] media: pulse8-cec: handle possible ping error Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 031/406] 9p: virtio: make sure offs is initialized in zc_request Greg Kroah-Hartman
` (384 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikolay Burykin, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Burykin <burikin@ivk.ru>
[ Upstream commit 4aaa96b59df5fac41ba891969df6b092061ea9d7 ]
After having been assigned to NULL value at cx23885-dvb.c:1202,
pointer '0' is dereferenced at cx23885-dvb.c:2469.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Signed-off-by: Nikolay Burykin <burikin@ivk.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/cx23885/cx23885-dvb.c | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/drivers/media/pci/cx23885/cx23885-dvb.c b/drivers/media/pci/cx23885/cx23885-dvb.c
index 45c2f4afceb82..9b437faf2c3f6 100644
--- a/drivers/media/pci/cx23885/cx23885-dvb.c
+++ b/drivers/media/pci/cx23885/cx23885-dvb.c
@@ -2459,16 +2459,10 @@ static int dvb_register(struct cx23885_tsport *port)
request_module("%s", info.type);
client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info);
if (!i2c_client_has_driver(client_tuner)) {
- module_put(client_demod->dev.driver->owner);
- i2c_unregister_device(client_demod);
- port->i2c_client_demod = NULL;
goto frontend_detach;
}
if (!try_module_get(client_tuner->dev.driver->owner)) {
i2c_unregister_device(client_tuner);
- module_put(client_demod->dev.driver->owner);
- i2c_unregister_device(client_demod);
- port->i2c_client_demod = NULL;
goto frontend_detach;
}
port->i2c_client_tuner = client_tuner;
@@ -2505,16 +2499,10 @@ static int dvb_register(struct cx23885_tsport *port)
request_module("%s", info.type);
client_tuner = i2c_new_client_device(&dev->i2c_bus[1].i2c_adap, &info);
if (!i2c_client_has_driver(client_tuner)) {
- module_put(client_demod->dev.driver->owner);
- i2c_unregister_device(client_demod);
- port->i2c_client_demod = NULL;
goto frontend_detach;
}
if (!try_module_get(client_tuner->dev.driver->owner)) {
i2c_unregister_device(client_tuner);
- module_put(client_demod->dev.driver->owner);
- i2c_unregister_device(client_demod);
- port->i2c_client_demod = NULL;
goto frontend_detach;
}
port->i2c_client_tuner = client_tuner;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 031/406] 9p: virtio: make sure offs is initialized in zc_request
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 030/406] media: pci: cx23885: fix error handling for cx23885 ATSC boards Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 032/406] ASoC: da7219: Flush pending AAD IRQ when suspending Greg Kroah-Hartman
` (383 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, Dominique Martinet,
Eric Van Hensbergen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dominique Martinet <asmadeus@codewreck.org>
[ Upstream commit 4a73edab69d3a6623f03817fe950a2d9585f80e4 ]
Similarly to the previous patch: offs can be used in handle_rerrors
without initializing on small payloads; in this case handle_rerrors will
not use it because of the size check, but it doesn't hurt to make sure
it is zero to please scan-build.
This fixes the following warning:
net/9p/trans_virtio.c:539:3: warning: 3rd function call argument is an uninitialized value [core.CallAndMessage]
handle_rerror(req, in_hdr_len, offs, in_pages);
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Eric Van Hensbergen <ericvh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/9p/trans_virtio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index f582351d84ecb..36b5f72e2165c 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -394,7 +394,7 @@ p9_virtio_zc_request(struct p9_client *client, struct p9_req_t *req,
struct page **in_pages = NULL, **out_pages = NULL;
struct virtio_chan *chan = client->trans;
struct scatterlist *sgs[4];
- size_t offs;
+ size_t offs = 0;
int need_drop = 0;
int kicked = 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 032/406] ASoC: da7219: Flush pending AAD IRQ when suspending
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 031/406] 9p: virtio: make sure offs is initialized in zc_request Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 033/406] ASoC: da7219: Check for failure reading AAD IRQ events Greg Kroah-Hartman
` (382 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmytro Maluka, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Maluka <dmy@semihalf.com>
[ Upstream commit 91e292917dad64ab8d1d5ca2ab3069ad9dac6f72 ]
da7219_aad_suspend() disables jack detection, which should prevent
generating new interrupts by DA7219 while suspended. However, there is a
theoretical possibility that there is a pending interrupt generated just
before suspending DA7219 and not handled yet, so the IRQ handler may
still run after DA7219 is suspended. To prevent that, wait until the
pending IRQ handling is done.
This patch arose as an attempt to fix the following I2C failure
occurring sometimes during system suspend or resume:
[ 355.876211] i2c_designware i2c_designware.3: Transfer while suspended
[ 355.876245] WARNING: CPU: 2 PID: 3576 at drivers/i2c/busses/i2c-designware-master.c:570 i2c_dw_xfer+0x411/0x440
...
[ 355.876462] Call Trace:
[ 355.876468] <TASK>
[ 355.876475] ? update_load_avg+0x1b3/0x615
[ 355.876484] __i2c_transfer+0x101/0x1d8
[ 355.876494] i2c_transfer+0x74/0x10d
[ 355.876504] regmap_i2c_read+0x6a/0x9c
[ 355.876513] _regmap_raw_read+0x179/0x223
[ 355.876521] regmap_raw_read+0x1e1/0x28e
[ 355.876527] regmap_bulk_read+0x17d/0x1ba
[ 355.876532] ? __wake_up+0xed/0x1bb
[ 355.876542] da7219_aad_irq_thread+0x54/0x2c9 [snd_soc_da7219 5fb8ebb2179cf2fea29af090f3145d68ed8e2184]
[ 355.876556] irq_thread+0x13c/0x231
[ 355.876563] ? irq_forced_thread_fn+0x5f/0x5f
[ 355.876570] ? irq_thread_fn+0x4d/0x4d
[ 355.876576] kthread+0x13a/0x152
[ 355.876581] ? synchronize_irq+0xc3/0xc3
[ 355.876587] ? kthread_blkcg+0x31/0x31
[ 355.876592] ret_from_fork+0x1f/0x30
[ 355.876601] </TASK>
which indicates that the AAD IRQ handler is unexpectedly running when
DA7219 is suspended, and as a result, is trying to read data from DA7219
over I2C and is hitting the I2C driver "Transfer while suspended"
failure.
However, with this patch the above failure is still reproducible. So
this patch does not fix any real observed issue so far, but at least is
useful for confirming that the above issue is not caused by a pending
IRQ but rather looks like a DA7219 hardware issue with an IRQ
unexpectedly generated after jack detection is already disabled.
Signed-off-by: Dmytro Maluka <dmy@semihalf.com>
Link: https://lore.kernel.org/r/20230717193737.161784-2-dmy@semihalf.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/da7219-aad.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index 48081d71c22c9..7fbda445be8e8 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c
@@ -854,6 +854,8 @@ void da7219_aad_suspend(struct snd_soc_component *component)
}
}
}
+
+ synchronize_irq(da7219_aad->irq);
}
void da7219_aad_resume(struct snd_soc_component *component)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 033/406] ASoC: da7219: Check for failure reading AAD IRQ events
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 032/406] ASoC: da7219: Flush pending AAD IRQ when suspending Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 034/406] ethernet: atheros: fix return value check in atl1c_tso_csum() Greg Kroah-Hartman
` (381 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmytro Maluka, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmytro Maluka <dmy@semihalf.com>
[ Upstream commit f0691dc16206f21b13c464434366e2cd632b8ed7 ]
When handling an AAD interrupt, if IRQ events read failed (for example,
due to i2c "Transfer while suspended" failure, i.e. when attempting to
read it while DA7219 is suspended, which may happen due to a spurious
AAD interrupt), the events array contains garbage uninitialized values.
So instead of trying to interprete those values and doing any actions
based on them (potentially resulting in misbehavior, e.g. reporting
bogus events), refuse to handle the interrupt.
Signed-off-by: Dmytro Maluka <dmy@semihalf.com>
Link: https://lore.kernel.org/r/20230717193737.161784-3-dmy@semihalf.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/da7219-aad.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index 7fbda445be8e8..b316d613a7090 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c
@@ -347,11 +347,15 @@ static irqreturn_t da7219_aad_irq_thread(int irq, void *data)
struct da7219_priv *da7219 = snd_soc_component_get_drvdata(component);
u8 events[DA7219_AAD_IRQ_REG_MAX];
u8 statusa;
- int i, report = 0, mask = 0;
+ int i, ret, report = 0, mask = 0;
/* Read current IRQ events */
- regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A,
- events, DA7219_AAD_IRQ_REG_MAX);
+ ret = regmap_bulk_read(da7219->regmap, DA7219_ACCDET_IRQ_EVENT_A,
+ events, DA7219_AAD_IRQ_REG_MAX);
+ if (ret) {
+ dev_warn_ratelimited(component->dev, "Failed to read IRQ events: %d\n", ret);
+ return IRQ_NONE;
+ }
if (!events[DA7219_AAD_IRQ_REG_A] && !events[DA7219_AAD_IRQ_REG_B])
return IRQ_NONE;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 034/406] ethernet: atheros: fix return value check in atl1c_tso_csum()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 033/406] ASoC: da7219: Check for failure reading AAD IRQ events Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 035/406] vxlan: generalize vxlan_parse_gpe_hdr and remove unused args Greg Kroah-Hartman
` (380 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanjun Gong, Simon Horman,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <ruc_gongyuanjun@163.com>
[ Upstream commit 8d01da0a1db237c44c92859ce3612df7af8d3a53 ]
in atl1c_tso_csum, it should check the return value of pskb_trim(),
and return an error code if an unexpected value is returned
by pskb_trim().
Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 3f65f2b370c57..2c5af0d7666aa 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -1987,8 +1987,11 @@ static int atl1c_tso_csum(struct atl1c_adapter *adapter,
real_len = (((unsigned char *)ip_hdr(skb) - skb->data)
+ ntohs(ip_hdr(skb)->tot_len));
- if (real_len < skb->len)
- pskb_trim(skb, real_len);
+ if (real_len < skb->len) {
+ err = pskb_trim(skb, real_len);
+ if (err)
+ return err;
+ }
hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb));
if (unlikely(skb->len == hdr_len)) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 035/406] vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 034/406] ethernet: atheros: fix return value check in atl1c_tso_csum() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 036/406] m68k: Fix invalid .section syntax Greg Kroah-Hartman
` (379 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Benc, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Benc <jbenc@redhat.com>
[ Upstream commit 17a0a64448b568442a101de09575f81ffdc45d15 ]
The vxlan_parse_gpe_hdr function extracts the next protocol value from
the GPE header and marks GPE bits as parsed.
In order to be used in the next patch, split the function into protocol
extraction and bit marking. The bit marking is meaningful only in
vxlan_rcv; move it directly there.
Rename the function to vxlan_parse_gpe_proto to reflect what it now
does. Remove unused arguments skb and vxflags. Move the function earlier
in the file to allow it to be called from more places in the next patch.
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan/vxlan_core.c | 58 ++++++++++++++++------------------
1 file changed, 28 insertions(+), 30 deletions(-)
diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 1ac9de69bde65..3096769e718ed 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -729,6 +729,32 @@ static int vxlan_fdb_append(struct vxlan_fdb *f,
return 1;
}
+static bool vxlan_parse_gpe_proto(struct vxlanhdr *hdr, __be16 *protocol)
+{
+ struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)hdr;
+
+ /* Need to have Next Protocol set for interfaces in GPE mode. */
+ if (!gpe->np_applied)
+ return false;
+ /* "The initial version is 0. If a receiver does not support the
+ * version indicated it MUST drop the packet.
+ */
+ if (gpe->version != 0)
+ return false;
+ /* "When the O bit is set to 1, the packet is an OAM packet and OAM
+ * processing MUST occur." However, we don't implement OAM
+ * processing, thus drop the packet.
+ */
+ if (gpe->oam_flag)
+ return false;
+
+ *protocol = tun_p_to_eth_p(gpe->next_protocol);
+ if (!*protocol)
+ return false;
+
+ return true;
+}
+
static struct vxlanhdr *vxlan_gro_remcsum(struct sk_buff *skb,
unsigned int off,
struct vxlanhdr *vh, size_t hdrlen,
@@ -1737,35 +1763,6 @@ static void vxlan_parse_gbp_hdr(struct vxlanhdr *unparsed,
unparsed->vx_flags &= ~VXLAN_GBP_USED_BITS;
}
-static bool vxlan_parse_gpe_hdr(struct vxlanhdr *unparsed,
- __be16 *protocol,
- struct sk_buff *skb, u32 vxflags)
-{
- struct vxlanhdr_gpe *gpe = (struct vxlanhdr_gpe *)unparsed;
-
- /* Need to have Next Protocol set for interfaces in GPE mode. */
- if (!gpe->np_applied)
- return false;
- /* "The initial version is 0. If a receiver does not support the
- * version indicated it MUST drop the packet.
- */
- if (gpe->version != 0)
- return false;
- /* "When the O bit is set to 1, the packet is an OAM packet and OAM
- * processing MUST occur." However, we don't implement OAM
- * processing, thus drop the packet.
- */
- if (gpe->oam_flag)
- return false;
-
- *protocol = tun_p_to_eth_p(gpe->next_protocol);
- if (!*protocol)
- return false;
-
- unparsed->vx_flags &= ~VXLAN_GPE_USED_BITS;
- return true;
-}
-
static bool vxlan_set_mac(struct vxlan_dev *vxlan,
struct vxlan_sock *vs,
struct sk_buff *skb, __be32 vni)
@@ -1866,8 +1863,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
* used by VXLAN extensions if explicitly requested.
*/
if (vs->flags & VXLAN_F_GPE) {
- if (!vxlan_parse_gpe_hdr(&unparsed, &protocol, skb, vs->flags))
+ if (!vxlan_parse_gpe_proto(&unparsed, &protocol))
goto drop;
+ unparsed.vx_flags &= ~VXLAN_GPE_USED_BITS;
raw_proto = true;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 036/406] m68k: Fix invalid .section syntax
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 035/406] vxlan: generalize vxlan_parse_gpe_hdr and remove unused args Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 037/406] s390/dasd: use correct number of retries for ERP requests Greg Kroah-Hartman
` (378 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ben Hutchings, Jan-Benedict Glaw,
Geert Uytterhoeven, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ben Hutchings <benh@debian.org>
[ Upstream commit 922a9bd138101e3e5718f0f4d40dba68ef89bb43 ]
gas supports several different forms for .section for ELF targets,
including:
.section NAME [, "FLAGS"[, @TYPE[,FLAG_SPECIFIC_ARGUMENTS]]]
and:
.section "NAME"[, #FLAGS...]
In several places we use a mix of these two forms:
.section NAME, #FLAGS...
A current development snapshot of binutils (2.40.50.20230611) treats
this mixed syntax as an error.
Change to consistently use:
.section NAME, "FLAGS"
as is used elsewhere in the kernel.
Link: https://buildd.debian.org/status/fetch.php?pkg=linux&arch=m68k&ver=6.4%7Erc6-1%7Eexp1&stamp=1686907300&raw=1
Signed-off-by: Ben Hutchings <benh@debian.org>
Tested-by: Jan-Benedict Glaw <jbglaw@lug-owl.de>
Link: https://lore.kernel.org/r/ZIyBaueWT9jnTwRC@decadent.org.uk
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/m68k/fpsp040/skeleton.S | 4 ++--
arch/m68k/ifpsp060/os.S | 4 ++--
arch/m68k/kernel/relocate_kernel.S | 4 ++--
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/m68k/fpsp040/skeleton.S b/arch/m68k/fpsp040/skeleton.S
index a8f41615d94a7..31a9c634c81ed 100644
--- a/arch/m68k/fpsp040/skeleton.S
+++ b/arch/m68k/fpsp040/skeleton.S
@@ -499,12 +499,12 @@ in_ea:
dbf %d0,morein
rts
- .section .fixup,#alloc,#execinstr
+ .section .fixup,"ax"
.even
1:
jbra fpsp040_die
- .section __ex_table,#alloc
+ .section __ex_table,"a"
.align 4
.long in_ea,1b
diff --git a/arch/m68k/ifpsp060/os.S b/arch/m68k/ifpsp060/os.S
index 7a0d6e4280665..89e2ec224ab6c 100644
--- a/arch/m68k/ifpsp060/os.S
+++ b/arch/m68k/ifpsp060/os.S
@@ -379,11 +379,11 @@ _060_real_access:
| Execption handling for movs access to illegal memory
- .section .fixup,#alloc,#execinstr
+ .section .fixup,"ax"
.even
1: moveq #-1,%d1
rts
-.section __ex_table,#alloc
+.section __ex_table,"a"
.align 4
.long dmrbuae,1b
.long dmrwuae,1b
diff --git a/arch/m68k/kernel/relocate_kernel.S b/arch/m68k/kernel/relocate_kernel.S
index ab0f1e7d46535..f7667079e08e9 100644
--- a/arch/m68k/kernel/relocate_kernel.S
+++ b/arch/m68k/kernel/relocate_kernel.S
@@ -26,7 +26,7 @@ ENTRY(relocate_new_kernel)
lea %pc@(.Lcopy),%a4
2: addl #0x00000000,%a4 /* virt_to_phys() */
- .section ".m68k_fixup","aw"
+ .section .m68k_fixup,"aw"
.long M68K_FIXUP_MEMOFFSET, 2b+2
.previous
@@ -49,7 +49,7 @@ ENTRY(relocate_new_kernel)
lea %pc@(.Lcont040),%a4
5: addl #0x00000000,%a4 /* virt_to_phys() */
- .section ".m68k_fixup","aw"
+ .section .m68k_fixup,"aw"
.long M68K_FIXUP_MEMOFFSET, 5b+2
.previous
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 037/406] s390/dasd: use correct number of retries for ERP requests
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 036/406] m68k: Fix invalid .section syntax Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 038/406] s390/dasd: fix hanging device after request requeue Greg Kroah-Hartman
` (377 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Haberland, Jan Hoeppner,
Jens Axboe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <sth@linux.ibm.com>
[ Upstream commit acea28a6b74f458defda7417d2217b051ba7d444 ]
If a DASD request fails an error recovery procedure (ERP) request might
be built as a copy of the original request to do error recovery.
The ERP request gets a number of retries assigned.
This number is always 256 no matter what other value might have been set
for the original request. This is not what is expected when a user
specifies a certain amount of retries for the device via sysfs.
Correctly use the number of retries of the original request for ERP
requests.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20230721193647.3889634-3-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/block/dasd_3990_erp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c
index 4691a3c35d725..c2d4ea74e0d00 100644
--- a/drivers/s390/block/dasd_3990_erp.c
+++ b/drivers/s390/block/dasd_3990_erp.c
@@ -2436,7 +2436,7 @@ static struct dasd_ccw_req *dasd_3990_erp_add_erp(struct dasd_ccw_req *cqr)
erp->block = cqr->block;
erp->magic = cqr->magic;
erp->expires = cqr->expires;
- erp->retries = 256;
+ erp->retries = device->default_retries;
erp->buildclk = get_tod_clock();
erp->status = DASD_CQR_FILLED;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 038/406] s390/dasd: fix hanging device after request requeue
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 037/406] s390/dasd: use correct number of retries for ERP requests Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 039/406] fs/nls: make load_nls() take a const parameter Greg Kroah-Hartman
` (376 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Haberland, Jan Hoeppner,
Jens Axboe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Haberland <sth@linux.ibm.com>
[ Upstream commit 8a2278ce9c25048d999fe1a3561def75d963f471 ]
The DASD device driver has a function to requeue requests to the
blocklayer.
This function is used in various cases when basic settings for the device
have to be changed like High Performance Ficon related parameters or copy
pair settings.
The functions iterates over the device->ccw_queue and also removes the
requests from the block->ccw_queue.
In case the device is started on an alias device instead of the base
device it might be removed from the block->ccw_queue without having it
canceled properly before. This might lead to a hanging device since the
request is no longer on a queue and can not be handled properly.
Fix by iterating over the block->ccw_queue instead of the
device->ccw_queue. This will take care of all blocklayer related requests
and handle them on all associated DASD devices.
Signed-off-by: Stefan Haberland <sth@linux.ibm.com>
Reviewed-by: Jan Hoeppner <hoeppner@linux.ibm.com>
Link: https://lore.kernel.org/r/20230721193647.3889634-4-sth@linux.ibm.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/block/dasd.c | 125 +++++++++++++++-----------------------
1 file changed, 48 insertions(+), 77 deletions(-)
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index 792f8f5688085..09e932a7b17f4 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -2985,41 +2985,32 @@ static void _dasd_wake_block_flush_cb(struct dasd_ccw_req *cqr, void *data)
* Requeue a request back to the block request queue
* only works for block requests
*/
-static int _dasd_requeue_request(struct dasd_ccw_req *cqr)
+static void _dasd_requeue_request(struct dasd_ccw_req *cqr)
{
- struct dasd_block *block = cqr->block;
struct request *req;
- if (!block)
- return -EINVAL;
/*
* If the request is an ERP request there is nothing to requeue.
* This will be done with the remaining original request.
*/
if (cqr->refers)
- return 0;
+ return;
spin_lock_irq(&cqr->dq->lock);
req = (struct request *) cqr->callback_data;
blk_mq_requeue_request(req, true);
spin_unlock_irq(&cqr->dq->lock);
- return 0;
+ return;
}
-/*
- * Go through all request on the dasd_block request queue, cancel them
- * on the respective dasd_device, and return them to the generic
- * block layer.
- */
-static int dasd_flush_block_queue(struct dasd_block *block)
+static int _dasd_requests_to_flushqueue(struct dasd_block *block,
+ struct list_head *flush_queue)
{
struct dasd_ccw_req *cqr, *n;
- int rc, i;
- struct list_head flush_queue;
unsigned long flags;
+ int rc, i;
- INIT_LIST_HEAD(&flush_queue);
- spin_lock_bh(&block->queue_lock);
+ spin_lock_irqsave(&block->queue_lock, flags);
rc = 0;
restart:
list_for_each_entry_safe(cqr, n, &block->ccw_queue, blocklist) {
@@ -3034,13 +3025,32 @@ static int dasd_flush_block_queue(struct dasd_block *block)
* is returned from the dasd_device layer.
*/
cqr->callback = _dasd_wake_block_flush_cb;
- for (i = 0; cqr != NULL; cqr = cqr->refers, i++)
- list_move_tail(&cqr->blocklist, &flush_queue);
+ for (i = 0; cqr; cqr = cqr->refers, i++)
+ list_move_tail(&cqr->blocklist, flush_queue);
if (i > 1)
/* moved more than one request - need to restart */
goto restart;
}
- spin_unlock_bh(&block->queue_lock);
+ spin_unlock_irqrestore(&block->queue_lock, flags);
+
+ return rc;
+}
+
+/*
+ * Go through all request on the dasd_block request queue, cancel them
+ * on the respective dasd_device, and return them to the generic
+ * block layer.
+ */
+static int dasd_flush_block_queue(struct dasd_block *block)
+{
+ struct dasd_ccw_req *cqr, *n;
+ struct list_head flush_queue;
+ unsigned long flags;
+ int rc;
+
+ INIT_LIST_HEAD(&flush_queue);
+ rc = _dasd_requests_to_flushqueue(block, &flush_queue);
+
/* Now call the callback function of flushed requests */
restart_cb:
list_for_each_entry_safe(cqr, n, &flush_queue, blocklist) {
@@ -3977,75 +3987,36 @@ EXPORT_SYMBOL_GPL(dasd_generic_space_avail);
*/
static int dasd_generic_requeue_all_requests(struct dasd_device *device)
{
+ struct dasd_block *block = device->block;
struct list_head requeue_queue;
struct dasd_ccw_req *cqr, *n;
- struct dasd_ccw_req *refers;
int rc;
- INIT_LIST_HEAD(&requeue_queue);
- spin_lock_irq(get_ccwdev_lock(device->cdev));
- rc = 0;
- list_for_each_entry_safe(cqr, n, &device->ccw_queue, devlist) {
- /* Check status and move request to flush_queue */
- if (cqr->status == DASD_CQR_IN_IO) {
- rc = device->discipline->term_IO(cqr);
- if (rc) {
- /* unable to terminate requeust */
- dev_err(&device->cdev->dev,
- "Unable to terminate request %p "
- "on suspend\n", cqr);
- spin_unlock_irq(get_ccwdev_lock(device->cdev));
- dasd_put_device(device);
- return rc;
- }
- }
- list_move_tail(&cqr->devlist, &requeue_queue);
- }
- spin_unlock_irq(get_ccwdev_lock(device->cdev));
-
- list_for_each_entry_safe(cqr, n, &requeue_queue, devlist) {
- wait_event(dasd_flush_wq,
- (cqr->status != DASD_CQR_CLEAR_PENDING));
+ if (!block)
+ return 0;
- /*
- * requeue requests to blocklayer will only work
- * for block device requests
- */
- if (_dasd_requeue_request(cqr))
- continue;
+ INIT_LIST_HEAD(&requeue_queue);
+ rc = _dasd_requests_to_flushqueue(block, &requeue_queue);
- /* remove requests from device and block queue */
- list_del_init(&cqr->devlist);
- while (cqr->refers != NULL) {
- refers = cqr->refers;
- /* remove the request from the block queue */
- list_del(&cqr->blocklist);
- /* free the finished erp request */
- dasd_free_erp_request(cqr, cqr->memdev);
- cqr = refers;
+ /* Now call the callback function of flushed requests */
+restart_cb:
+ list_for_each_entry_safe(cqr, n, &requeue_queue, blocklist) {
+ wait_event(dasd_flush_wq, (cqr->status < DASD_CQR_QUEUED));
+ /* Process finished ERP request. */
+ if (cqr->refers) {
+ spin_lock_bh(&block->queue_lock);
+ __dasd_process_erp(block->base, cqr);
+ spin_unlock_bh(&block->queue_lock);
+ /* restart list_for_xx loop since dasd_process_erp
+ * might remove multiple elements
+ */
+ goto restart_cb;
}
-
- /*
- * _dasd_requeue_request already checked for a valid
- * blockdevice, no need to check again
- * all erp requests (cqr->refers) have a cqr->block
- * pointer copy from the original cqr
- */
+ _dasd_requeue_request(cqr);
list_del_init(&cqr->blocklist);
cqr->block->base->discipline->free_cp(
cqr, (struct request *) cqr->callback_data);
}
-
- /*
- * if requests remain then they are internal request
- * and go back to the device queue
- */
- if (!list_empty(&requeue_queue)) {
- /* move freeze_queue to start of the ccw_queue */
- spin_lock_irq(get_ccwdev_lock(device->cdev));
- list_splice_tail(&requeue_queue, &device->ccw_queue);
- spin_unlock_irq(get_ccwdev_lock(device->cdev));
- }
dasd_schedule_device_bh(device);
return rc;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 039/406] fs/nls: make load_nls() take a const parameter
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 038/406] s390/dasd: fix hanging device after request requeue Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 040/406] ASoc: codecs: ES8316: Fix DMIC config Greg Kroah-Hartman
` (375 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Rothwell, Winston Wen,
Paulo Alcantara, Christian Brauner, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Winston Wen <wentao@uniontech.com>
[ Upstream commit c1ed39ec116272935528ca9b348b8ee79b0791da ]
load_nls() take a char * parameter, use it to find nls module in list or
construct the module name to load it.
This change make load_nls() take a const parameter, so we don't need do
some cast like this:
ses->local_nls = load_nls((char *)ctx->local_nls->charset);
Suggested-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Winston Wen <wentao@uniontech.com>
Reviewed-by: Paulo Alcantara <pc@manguebit.com>
Reviewed-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nls/nls_base.c | 4 ++--
include/linux/nls.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/nls/nls_base.c b/fs/nls/nls_base.c
index 52ccd34b1e792..a026dbd3593f6 100644
--- a/fs/nls/nls_base.c
+++ b/fs/nls/nls_base.c
@@ -272,7 +272,7 @@ int unregister_nls(struct nls_table * nls)
return -EINVAL;
}
-static struct nls_table *find_nls(char *charset)
+static struct nls_table *find_nls(const char *charset)
{
struct nls_table *nls;
spin_lock(&nls_lock);
@@ -288,7 +288,7 @@ static struct nls_table *find_nls(char *charset)
return nls;
}
-struct nls_table *load_nls(char *charset)
+struct nls_table *load_nls(const char *charset)
{
return try_then_request_module(find_nls(charset), "nls_%s", charset);
}
diff --git a/include/linux/nls.h b/include/linux/nls.h
index 499e486b3722d..e0bf8367b274a 100644
--- a/include/linux/nls.h
+++ b/include/linux/nls.h
@@ -47,7 +47,7 @@ enum utf16_endian {
/* nls_base.c */
extern int __register_nls(struct nls_table *, struct module *);
extern int unregister_nls(struct nls_table *);
-extern struct nls_table *load_nls(char *);
+extern struct nls_table *load_nls(const char *charset);
extern void unload_nls(struct nls_table *);
extern struct nls_table *load_nls_default(void);
#define register_nls(nls) __register_nls((nls), THIS_MODULE)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 040/406] ASoc: codecs: ES8316: Fix DMIC config
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 039/406] fs/nls: make load_nls() take a const parameter Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 041/406] ASoC: atmel: Fix the 8K sample parameter in I2SC master Greg Kroah-Hartman
` (374 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Edgar, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edgar <ljijcj@163.com>
[ Upstream commit d20d35d1ad62c6cca36368c1e8f29335a068659e ]
According to the datasheet, the DMIC config should
be changed to { 0, 2 ,3 }
Signed-off-by: Edgar <ljijcj@163.com>
Link: https://lore.kernel.org/r/20230719054722.401954-1-ljijcj@163.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/es8316.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/es8316.c b/sound/soc/codecs/es8316.c
index 03ad34a275da2..dafbf73d4eede 100644
--- a/sound/soc/codecs/es8316.c
+++ b/sound/soc/codecs/es8316.c
@@ -153,7 +153,7 @@ static const char * const es8316_dmic_txt[] = {
"dmic data at high level",
"dmic data at low level",
};
-static const unsigned int es8316_dmic_values[] = { 0, 1, 2 };
+static const unsigned int es8316_dmic_values[] = { 0, 2, 3 };
static const struct soc_enum es8316_dmic_src_enum =
SOC_VALUE_ENUM_SINGLE(ES8316_ADC_DMIC, 0, 3,
ARRAY_SIZE(es8316_dmic_txt),
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 041/406] ASoC: atmel: Fix the 8K sample parameter in I2SC master
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 040/406] ASoc: codecs: ES8316: Fix DMIC config Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 042/406] platform/x86: intel: hid: Always call BTNL ACPI method Greg Kroah-Hartman
` (373 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guiting Shen, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guiting Shen <aarongt.shen@gmail.com>
[ Upstream commit f85739c0b2b0d98a32f5ca4fcc5501d2b76df4f6 ]
The 8K sample parameter of 12.288Mhz main system bus clock doesn't work
because the I2SC_MR.IMCKDIV must not be 0 according to the sama5d2
series datasheet(I2SC Mode Register of Register Summary).
So use the 6.144Mhz instead of 12.288Mhz to support 8K sample.
Signed-off-by: Guiting Shen <aarongt.shen@gmail.com>
Link: https://lore.kernel.org/r/20230715030620.62328-1-aarongt.shen@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/atmel/atmel-i2s.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/soc/atmel/atmel-i2s.c b/sound/soc/atmel/atmel-i2s.c
index d870f56c44cfc..0341b31197670 100644
--- a/sound/soc/atmel/atmel-i2s.c
+++ b/sound/soc/atmel/atmel-i2s.c
@@ -163,11 +163,14 @@ struct atmel_i2s_gck_param {
#define I2S_MCK_12M288 12288000UL
#define I2S_MCK_11M2896 11289600UL
+#define I2S_MCK_6M144 6144000UL
/* mck = (32 * (imckfs+1) / (imckdiv+1)) * fs */
static const struct atmel_i2s_gck_param gck_params[] = {
+ /* mck = 6.144Mhz */
+ { 8000, I2S_MCK_6M144, 1, 47}, /* mck = 768 fs */
+
/* mck = 12.288MHz */
- { 8000, I2S_MCK_12M288, 0, 47}, /* mck = 1536 fs */
{ 16000, I2S_MCK_12M288, 1, 47}, /* mck = 768 fs */
{ 24000, I2S_MCK_12M288, 3, 63}, /* mck = 512 fs */
{ 32000, I2S_MCK_12M288, 3, 47}, /* mck = 384 fs */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 042/406] platform/x86: intel: hid: Always call BTNL ACPI method
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 041/406] ASoC: atmel: Fix the 8K sample parameter in I2SC master Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 043/406] platform/x86: huawei-wmi: Silence ambient light sensor Greg Kroah-Hartman
` (372 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxim Mikityanskiy, Hans de Goede,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit e3ab18de2b09361d6f0e4aafb9cfd6d002ce43a1 ]
On a HP Elite Dragonfly G2 the 0xcc and 0xcd events for SW_TABLET_MODE
are only send after the BTNL ACPI method has been called.
Likely more devices need this, so make the BTNL ACPI method unconditional
instead of only doing it on devices with a 5 button array.
Note this also makes the intel_button_array_enable() call in probe()
unconditional, that function does its own priv->array check. This makes
the intel_button_array_enable() call in probe() consistent with the calls
done on suspend/resume which also rely on the priv->array check inside
the function.
Reported-by: Maxim Mikityanskiy <maxtram95@gmail.com>
Closes: https://lore.kernel.org/platform-driver-x86/20230712175023.31651-1-maxtram95@gmail.com/
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20230715181516.5173-1-hdegoede@redhat.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel-hid.c | 21 +++++++++------------
1 file changed, 9 insertions(+), 12 deletions(-)
diff --git a/drivers/platform/x86/intel-hid.c b/drivers/platform/x86/intel-hid.c
index cebddefba2f42..0b0602fc43601 100644
--- a/drivers/platform/x86/intel-hid.c
+++ b/drivers/platform/x86/intel-hid.c
@@ -458,7 +458,7 @@ static bool button_array_present(struct platform_device *device)
static int intel_hid_probe(struct platform_device *device)
{
acpi_handle handle = ACPI_HANDLE(&device->dev);
- unsigned long long mode;
+ unsigned long long mode, dummy;
struct intel_hid_priv *priv;
acpi_status status;
int err;
@@ -510,18 +510,15 @@ static int intel_hid_probe(struct platform_device *device)
if (err)
goto err_remove_notify;
- if (priv->array) {
- unsigned long long dummy;
+ intel_button_array_enable(&device->dev, true);
- intel_button_array_enable(&device->dev, true);
-
- /* Call button load method to enable HID power button */
- if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN,
- &dummy)) {
- dev_warn(&device->dev,
- "failed to enable HID power button\n");
- }
- }
+ /*
+ * Call button load method to enable HID power button
+ * Always do this since it activates events on some devices without
+ * a button array too.
+ */
+ if (!intel_hid_evaluate_method(handle, INTEL_HID_DSM_BTNL_FN, &dummy))
+ dev_warn(&device->dev, "failed to enable HID power button\n");
device_init_wakeup(&device->dev, true);
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 043/406] platform/x86: huawei-wmi: Silence ambient light sensor
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 042/406] platform/x86: intel: hid: Always call BTNL ACPI method Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 044/406] drm/amd/display: Exit idle optimizations before attempt to access PHY Greg Kroah-Hartman
` (371 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Shelekhin, Hans de Goede,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Shelekhin <k.shelekhin@ftml.net>
[ Upstream commit c21733754cd6ecbca346f2adf9b17d4cfa50504f ]
Currently huawei-wmi causes a lot of spam in dmesg on my
Huawei MateBook X Pro 2022:
...
[36409.328463] input input9: Unknown key pressed, code: 0x02c1
[36411.335104] input input9: Unknown key pressed, code: 0x02c1
[36412.338674] input input9: Unknown key pressed, code: 0x02c1
[36414.848564] input input9: Unknown key pressed, code: 0x02c1
[36416.858706] input input9: Unknown key pressed, code: 0x02c1
...
Fix that by ignoring events generated by ambient light sensor.
This issue was reported on GitHub and resolved with the following merge
request:
https://github.com/aymanbagabas/Huawei-WMI/pull/70
I've contacted the mainter of this repo and he gave me the "go ahead" to
send this patch to the maling list.
Signed-off-by: Konstantin Shelekhin <k.shelekhin@ftml.net>
Link: https://lore.kernel.org/r/20230722155922.173856-1-k.shelekhin@ftml.net
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/huawei-wmi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/platform/x86/huawei-wmi.c b/drivers/platform/x86/huawei-wmi.c
index 935562c870c3d..23ebd0c046e16 100644
--- a/drivers/platform/x86/huawei-wmi.c
+++ b/drivers/platform/x86/huawei-wmi.c
@@ -86,6 +86,8 @@ static const struct key_entry huawei_wmi_keymap[] = {
{ KE_IGNORE, 0x293, { KEY_KBDILLUMTOGGLE } },
{ KE_IGNORE, 0x294, { KEY_KBDILLUMUP } },
{ KE_IGNORE, 0x295, { KEY_KBDILLUMUP } },
+ // Ignore Ambient Light Sensoring
+ { KE_KEY, 0x2c1, { KEY_RESERVED } },
{ KE_END, 0 }
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 044/406] drm/amd/display: Exit idle optimizations before attempt to access PHY
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 043/406] platform/x86: huawei-wmi: Silence ambient light sensor Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 045/406] ovl: Always reevaluate the file signature for IMA Greg Kroah-Hartman
` (370 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Kazlauskas, Alex Hung,
Leo Chen, Daniel Wheeler, Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leo Chen <sancchen@amd.com>
[ Upstream commit de612738e9771bd66aeb20044486c457c512f684 ]
[Why & How]
DMUB may hang when powering down pixel clocks due to no dprefclk.
It is fixed by exiting idle optimization before the attempt to access PHY.
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Acked-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Leo Chen <sancchen@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
index e33fe0207b9e5..53e8defd34751 100644
--- a/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dce110/dce110_hw_sequencer.c
@@ -1682,10 +1682,13 @@ void dce110_enable_accelerated_mode(struct dc *dc, struct dc_state *context)
hws->funcs.edp_backlight_control(edp_link_with_sink, false);
}
/*resume from S3, no vbios posting, no need to power down again*/
+ clk_mgr_exit_optimized_pwr_state(dc, dc->clk_mgr);
+
power_down_all_hw_blocks(dc);
disable_vga_and_power_gate_all_controllers(dc);
if (edp_link_with_sink && !keep_edp_vdd_on)
dc->hwss.edp_power_control(edp_link_with_sink, false);
+ clk_mgr_optimize_pwr_state(dc, dc->clk_mgr);
}
bios_set_scratch_acc_mode_change(dc->ctx->dc_bios);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 045/406] ovl: Always reevaluate the file signature for IMA
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 044/406] drm/amd/display: Exit idle optimizations before attempt to access PHY Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 046/406] ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() Greg Kroah-Hartman
` (369 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Snowberg, Mimi Zohar,
Linus Torvalds, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Snowberg <eric.snowberg@oracle.com>
[ Upstream commit 18b44bc5a67275641fb26f2c54ba7eef80ac5950 ]
Commit db1d1e8b9867 ("IMA: use vfs_getattr_nosec to get the i_version")
partially closed an IMA integrity issue when directly modifying a file
on the lower filesystem. If the overlay file is first opened by a user
and later the lower backing file is modified by root, but the extended
attribute is NOT updated, the signature validation succeeds with the old
original signature.
Update the super_block s_iflags to SB_I_IMA_UNVERIFIABLE_SIGNATURE to
force signature reevaluation on every file access until a fine grained
solution can be found.
Signed-off-by: Eric Snowberg <eric.snowberg@oracle.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/overlayfs/super.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 5d7df839902df..e0384095ca960 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -2028,7 +2028,7 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
sb->s_xattr = ovl_xattr_handlers;
sb->s_fs_info = ofs;
sb->s_flags |= SB_POSIXACL;
- sb->s_iflags |= SB_I_SKIP_SYNC;
+ sb->s_iflags |= SB_I_SKIP_SYNC | SB_I_IMA_UNVERIFIABLE_SIGNATURE;
err = -ENOMEM;
root_dentry = ovl_get_root(sb, upperpath.dentry, oe);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 046/406] ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 045/406] ovl: Always reevaluate the file signature for IMA Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 047/406] security: keys: perform capable check only on privileged operations Greg Kroah-Hartman
` (368 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Minjie Du, Viresh Kumar,
Sergey Shtylyov, Damien Le Moal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjie Du <duminjie@vivo.com>
[ Upstream commit 4139f992c49356391fb086c0c8ce51f66c26d623 ]
It is possible for dma_request_chan() to return EPROBE_DEFER, which
means acdev->host->dev is not ready yet. At this point dev_err() will
have no output. Use dev_err_probe() instead.
Signed-off-by: Minjie Du <duminjie@vivo.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/pata_arasan_cf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/ata/pata_arasan_cf.c b/drivers/ata/pata_arasan_cf.c
index 63f39440a9b42..4ba02f082f962 100644
--- a/drivers/ata/pata_arasan_cf.c
+++ b/drivers/ata/pata_arasan_cf.c
@@ -528,7 +528,8 @@ static void data_xfer(struct work_struct *work)
/* dma_request_channel may sleep, so calling from process context */
acdev->dma_chan = dma_request_chan(acdev->host->dev, "data");
if (IS_ERR(acdev->dma_chan)) {
- dev_err(acdev->host->dev, "Unable to get dma_chan\n");
+ dev_err_probe(acdev->host->dev, PTR_ERR(acdev->dma_chan),
+ "Unable to get dma_chan\n");
acdev->dma_chan = NULL;
goto chan_request_fail;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 047/406] security: keys: perform capable check only on privileged operations
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 046/406] ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 048/406] kprobes: Prohibit probing on CFI preamble symbol Greg Kroah-Hartman
` (367 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Göttsche,
Jarkko Sakkinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Göttsche <cgzones@googlemail.com>
[ Upstream commit 2d7f105edbb3b2be5ffa4d833abbf9b6965e9ce7 ]
If the current task fails the check for the queried capability via
`capable(CAP_SYS_ADMIN)` LSMs like SELinux generate a denial message.
Issuing such denial messages unnecessarily can lead to a policy author
granting more privileges to a subject than needed to silence them.
Reorder CAP_SYS_ADMIN checks after the check whether the operation is
actually privileged.
Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/keys/keyctl.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 61a614c21b9b6..e3ffaf5ad6394 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -980,14 +980,19 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group)
ret = -EACCES;
down_write(&key->sem);
- if (!capable(CAP_SYS_ADMIN)) {
+ {
+ bool is_privileged_op = false;
+
/* only the sysadmin can chown a key to some other UID */
if (user != (uid_t) -1 && !uid_eq(key->uid, uid))
- goto error_put;
+ is_privileged_op = true;
/* only the sysadmin can set the key's GID to a group other
* than one of those that the current process subscribes to */
if (group != (gid_t) -1 && !gid_eq(gid, key->gid) && !in_group_p(gid))
+ is_privileged_op = true;
+
+ if (is_privileged_op && !capable(CAP_SYS_ADMIN))
goto error_put;
}
@@ -1088,7 +1093,7 @@ long keyctl_setperm_key(key_serial_t id, key_perm_t perm)
down_write(&key->sem);
/* if we're not the sysadmin, we can only change a key that we own */
- if (capable(CAP_SYS_ADMIN) || uid_eq(key->uid, current_fsuid())) {
+ if (uid_eq(key->uid, current_fsuid()) || capable(CAP_SYS_ADMIN)) {
key->perm = perm;
notify_key(key, NOTIFY_KEY_SETATTR, 0);
ret = 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 048/406] kprobes: Prohibit probing on CFI preamble symbol
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 047/406] security: keys: perform capable check only on privileged operations Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 049/406] clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM Greg Kroah-Hartman
` (366 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Steven Rostedt (Google), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
[ Upstream commit de02f2ac5d8cfb311f44f2bf144cc20002f1fbbd ]
Do not allow to probe on "__cfi_" or "__pfx_" started symbol, because those
are used for CFI and not executed. Probing it will break the CFI.
Link: https://lore.kernel.org/all/168904024679.116016.18089228029322008512.stgit@devnote2/
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/kprobes.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 86d71c49b4957..f1ea3123f3832 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -1628,6 +1628,17 @@ int __weak arch_check_ftrace_location(struct kprobe *p)
return 0;
}
+static bool is_cfi_preamble_symbol(unsigned long addr)
+{
+ char symbuf[KSYM_NAME_LEN];
+
+ if (lookup_symbol_name(addr, symbuf))
+ return false;
+
+ return str_has_prefix("__cfi_", symbuf) ||
+ str_has_prefix("__pfx_", symbuf);
+}
+
static int check_kprobe_address_safe(struct kprobe *p,
struct module **probed_mod)
{
@@ -1646,7 +1657,8 @@ static int check_kprobe_address_safe(struct kprobe *p,
within_kprobe_blacklist((unsigned long) p->addr) ||
jump_label_text_reserved(p->addr, p->addr) ||
static_call_text_reserved(p->addr, p->addr) ||
- find_bug((unsigned long)p->addr)) {
+ find_bug((unsigned long)p->addr) ||
+ is_cfi_preamble_symbol((unsigned long)p->addr)) {
ret = -EINVAL;
goto out;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 049/406] clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 048/406] kprobes: Prohibit probing on CFI preamble symbol Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 050/406] vmbus_testing: fix wrong python syntax for integer value comparison Greg Kroah-Hartman
` (365 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Baoquan He,
Michael Turquette, Stephen Boyd, linux-clk, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <bhe@redhat.com>
[ Upstream commit e7dd44f4f3166db45248414f5df8f615392de47a ]
On s390 systems (aka mainframes), it has classic channel devices for
networking and permanent storage that are currently even more common
than PCI devices. Hence it could have a fully functional s390 kernel
with CONFIG_PCI=n, then the relevant iomem mapping functions
[including ioremap(), devm_ioremap(), etc.] are not available.
Here let COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM so that it won't
be built to cause below compiling error if PCI is unset:
------
ld: drivers/clk/clk-fixed-mmio.o: in function `fixed_mmio_clk_setup':
clk-fixed-mmio.c:(.text+0x5e): undefined reference to `of_iomap'
ld: clk-fixed-mmio.c:(.text+0xba): undefined reference to `iounmap'
------
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/
Signed-off-by: Baoquan He <bhe@redhat.com>
Cc: Michael Turquette <mturquette@baylibre.com>
Cc: Stephen Boyd <sboyd@kernel.org>
Cc: linux-clk@vger.kernel.org
Link: https://lore.kernel.org/r/20230707135852.24292-8-bhe@redhat.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/Kconfig b/drivers/clk/Kconfig
index 4ae49eae45869..df739665f2063 100644
--- a/drivers/clk/Kconfig
+++ b/drivers/clk/Kconfig
@@ -356,6 +356,7 @@ config COMMON_CLK_BD718XX
config COMMON_CLK_FIXED_MMIO
bool "Clock driver for Memory Mapped Fixed values"
depends on COMMON_CLK && OF
+ depends on HAS_IOMEM
help
Support for Memory Mapped IO Fixed clocks
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 050/406] vmbus_testing: fix wrong python syntax for integer value comparison
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 049/406] clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 051/406] net: usb: qmi_wwan: add Quectel EM05GV2 Greg Kroah-Hartman
` (364 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ani Sinha, Wei Liu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ani Sinha <anisinha@redhat.com>
[ Upstream commit ed0cf84e9cc42e6310961c87709621f1825c2bb8 ]
It is incorrect in python to compare integer values using the "is" keyword.
The "is" keyword in python is used to compare references to two objects,
not their values. Newer version of python3 (version 3.8) throws a warning
when such incorrect comparison is made. For value comparison, "==" should
be used.
Fix this in the code and suppress the following warning:
/usr/sbin/vmbus_testing:167: SyntaxWarning: "is" with a literal. Did you mean "=="?
Signed-off-by: Ani Sinha <anisinha@redhat.com>
Link: https://lore.kernel.org/r/20230705134408.6302-1-anisinha@redhat.com
Signed-off-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/hv/vmbus_testing | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/hv/vmbus_testing b/tools/hv/vmbus_testing
index e7212903dd1d9..4467979d8f699 100755
--- a/tools/hv/vmbus_testing
+++ b/tools/hv/vmbus_testing
@@ -164,7 +164,7 @@ def recursive_file_lookup(path, file_map):
def get_all_devices_test_status(file_map):
for device in file_map:
- if (get_test_state(locate_state(device, file_map)) is 1):
+ if (get_test_state(locate_state(device, file_map)) == 1):
print("Testing = ON for: {}"
.format(device.split("/")[5]))
else:
@@ -203,7 +203,7 @@ def write_test_files(path, value):
def set_test_state(state_path, state_value, quiet):
write_test_files(state_path, state_value)
- if (get_test_state(state_path) is 1):
+ if (get_test_state(state_path) == 1):
if (not quiet):
print("Testing = ON for device: {}"
.format(state_path.split("/")[5]))
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 051/406] net: usb: qmi_wwan: add Quectel EM05GV2
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 050/406] vmbus_testing: fix wrong python syntax for integer value comparison Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 052/406] idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM Greg Kroah-Hartman
` (363 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kohn, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kohn <m.kohn@welotec.com>
[ Upstream commit d4480c9bb9258db9ddf2e632f6ef81e96b41089c ]
Add support for Quectel EM05GV2 (G=global) with vendor ID
0x2c7c and product ID 0x030e
Enabling DTR on this modem was necessary to ensure stable operation.
Patch for usb: serial: option: is also in progress.
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=030e Rev= 3.18
S: Manufacturer=Quectel
S: Product=Quectel EM05-G
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=500mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=89(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Martin Kohn <m.kohn@welotec.com>
Link: https://lore.kernel.org/r/AM0PR04MB57648219DE893EE04FA6CC759701A@AM0PR04MB5764.eurprd04.prod.outlook.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/qmi_wwan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index de6c561535346..5cf7f389bf4ef 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1351,6 +1351,7 @@ static const struct usb_device_id products[] = {
{QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
{QMI_QUIRK_SET_DTR(0x2c7c, 0x0195, 4)}, /* Quectel EG95 */
{QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x030e, 4)}, /* Quectel EM05GV2 */
{QMI_QUIRK_SET_DTR(0x2cb7, 0x0104, 4)}, /* Fibocom NL678 series */
{QMI_FIXED_INTF(0x0489, 0xe0b4, 0)}, /* Foxconn T77W968 LTE */
{QMI_FIXED_INTF(0x0489, 0xe0b5, 0)}, /* Foxconn T77W968 LTE with eSIM support*/
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 052/406] idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 051/406] net: usb: qmi_wwan: add Quectel EM05GV2 Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 053/406] scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock Greg Kroah-Hartman
` (362 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Baoquan He,
Vinod Koul, dmaengine, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baoquan He <bhe@redhat.com>
[ Upstream commit b1e213a9e31c20206f111ec664afcf31cbfe0dbb ]
On s390 systems (aka mainframes), it has classic channel devices for
networking and permanent storage that are currently even more common
than PCI devices. Hence it could have a fully functional s390 kernel
with CONFIG_PCI=n, then the relevant iomem mapping functions
[including ioremap(), devm_ioremap(), etc.] are not available.
Here let FSL_EDMA and INTEL_IDMA64 depend on HAS_IOMEM so that it
won't be built to cause below compiling error if PCI is unset.
--------
ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/fsl-edma.ko] undefined!
ERROR: modpost: "devm_platform_ioremap_resource" [drivers/dma/idma64.ko] undefined!
--------
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202306211329.ticOJCSv-lkp@intel.com/
Signed-off-by: Baoquan He <bhe@redhat.com>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: dmaengine@vger.kernel.org
Link: https://lore.kernel.org/r/20230707135852.24292-2-bhe@redhat.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/Kconfig | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/dma/Kconfig b/drivers/dma/Kconfig
index 08013345d1f24..7e1bd79fbee8f 100644
--- a/drivers/dma/Kconfig
+++ b/drivers/dma/Kconfig
@@ -208,6 +208,7 @@ config FSL_DMA
config FSL_EDMA
tristate "Freescale eDMA engine support"
depends on OF
+ depends on HAS_IOMEM
select DMA_ENGINE
select DMA_VIRTUAL_CHANNELS
help
@@ -277,6 +278,7 @@ config IMX_SDMA
config INTEL_IDMA64
tristate "Intel integrated DMA 64-bit support"
+ depends on HAS_IOMEM
select DMA_ENGINE
select DMA_VIRTUAL_CHANNELS
help
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 053/406] scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 052/406] idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 054/406] netlabel: fix shift wrapping bug in netlbl_catmap_setlong() Greg Kroah-Hartman
` (361 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Manish Rangankar,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <dg573847474@gmail.com>
[ Upstream commit dd64f80587190265ca8a0f4be6c64c2fda6d3ac2 ]
As &qedi_percpu->p_work_lock is acquired by hard IRQ qedi_msix_handler(),
other acquisitions of the same lock under process context should disable
IRQ, otherwise deadlock could happen if the IRQ preempts the execution
while the lock is held in process context on the same CPU.
qedi_cpu_offline() is one such function which acquires the lock in process
context.
[Deadlock Scenario]
qedi_cpu_offline()
->spin_lock(&p->p_work_lock)
<irq>
->qedi_msix_handler()
->edi_process_completions()
->spin_lock_irqsave(&p->p_work_lock, flags); (deadlock here)
This flaw was found by an experimental static analysis tool I am developing
for IRQ-related deadlocks.
The tentative patch fix the potential deadlock by spin_lock_irqsave()
under process context.
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Link: https://lore.kernel.org/r/20230726125655.4197-1-dg573847474@gmail.com
Acked-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qedi/qedi_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index cc2152c56d355..96e470746767a 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1981,8 +1981,9 @@ static int qedi_cpu_offline(unsigned int cpu)
struct qedi_percpu_s *p = this_cpu_ptr(&qedi_percpu);
struct qedi_work *work, *tmp;
struct task_struct *thread;
+ unsigned long flags;
- spin_lock_bh(&p->p_work_lock);
+ spin_lock_irqsave(&p->p_work_lock, flags);
thread = p->iothread;
p->iothread = NULL;
@@ -1993,7 +1994,7 @@ static int qedi_cpu_offline(unsigned int cpu)
kfree(work);
}
- spin_unlock_bh(&p->p_work_lock);
+ spin_unlock_irqrestore(&p->p_work_lock, flags);
if (thread)
kthread_stop(thread);
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 054/406] netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 053/406] scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 055/406] bnx2x: fix page fault following EEH recovery Greg Kroah-Hartman
` (360 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Mastykin, Paul Moore,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Mastykin <dmastykin@astralinux.ru>
[ Upstream commit b403643d154d15176b060b82f7fc605210033edd ]
There is a shift wrapping bug in this code on 32-bit architectures.
NETLBL_CATMAP_MAPTYPE is u64, bitmap is unsigned long.
Every second 32-bit word of catmap becomes corrupted.
Signed-off-by: Dmitry Mastykin <dmastykin@astralinux.ru>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netlabel/netlabel_kapi.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index 91b35b7c80d82..96059c99b915e 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -857,7 +857,8 @@ int netlbl_catmap_setlong(struct netlbl_lsm_catmap **catmap,
offset -= iter->startbit;
idx = offset / NETLBL_CATMAP_MAPSIZE;
- iter->bitmap[idx] |= bitmap << (offset % NETLBL_CATMAP_MAPSIZE);
+ iter->bitmap[idx] |= (NETLBL_CATMAP_MAPTYPE)bitmap
+ << (offset % NETLBL_CATMAP_MAPSIZE);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 055/406] bnx2x: fix page fault following EEH recovery
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 054/406] netlabel: fix shift wrapping bug in netlbl_catmap_setlong() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 056/406] sctp: handle invalid error codes without calling BUG() Greg Kroah-Hartman
` (359 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Christensen, Sridhar Samudrala,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Christensen <drc@linux.vnet.ibm.com>
[ Upstream commit 7ebe4eda4265642859507d1b3ca330d8c196cfe5 ]
In the last step of the EEH recovery process, the EEH driver calls into
bnx2x_io_resume() to re-initialize the NIC hardware via the function
bnx2x_nic_load(). If an error occurs during bnx2x_nic_load(), OS and
hardware resources are released and an error code is returned to the
caller. When called from bnx2x_io_resume(), the return code is ignored
and the network interface is brought up unconditionally. Later attempts
to send a packet via this interface result in a page fault due to a null
pointer reference.
This patch checks the return code of bnx2x_nic_load(), prints an error
message if necessary, and does not enable the interface.
Signed-off-by: David Christensen <drc@linux.vnet.ibm.com>
Reviewed-by: Sridhar Samudrala <sridhar.samudrala@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
index afb6d3ee1f564..c8cbf3ed128de 100644
--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
@@ -14372,11 +14372,16 @@ static void bnx2x_io_resume(struct pci_dev *pdev)
bp->fw_seq = SHMEM_RD(bp, func_mb[BP_FW_MB_IDX(bp)].drv_mb_header) &
DRV_MSG_SEQ_NUMBER_MASK;
- if (netif_running(dev))
- bnx2x_nic_load(bp, LOAD_NORMAL);
+ if (netif_running(dev)) {
+ if (bnx2x_nic_load(bp, LOAD_NORMAL)) {
+ netdev_err(bp->dev, "Error during driver initialization, try unloading/reloading the driver\n");
+ goto done;
+ }
+ }
netif_device_attach(dev);
+done:
rtnl_unlock();
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 056/406] sctp: handle invalid error codes without calling BUG()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 055/406] bnx2x: fix page fault following EEH recovery Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 057/406] scsi: storvsc: Always set no_report_opcodes Greg Kroah-Hartman
` (358 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit a0067dfcd9418fd3b0632bc59210d120d038a9c6 ]
The sctp_sf_eat_auth() function is supposed to return enum sctp_disposition
values but if the call to sctp_ulpevent_make_authkey() fails, it returns
-ENOMEM.
This results in calling BUG() inside the sctp_side_effects() function.
Calling BUG() is an over reaction and not helpful. Call WARN_ON_ONCE()
instead.
This code predates git.
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/sm_sideeffect.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index d4e5969771f0f..30e9914526337 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1241,7 +1241,10 @@ static int sctp_side_effects(enum sctp_event_type event_type,
default:
pr_err("impossible disposition %d in state %d, event_type %d, event_id %d\n",
status, state, event_type, subtype.chunk);
- BUG();
+ error = status;
+ if (error >= 0)
+ error = -EINVAL;
+ WARN_ON_ONCE(1);
break;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 057/406] scsi: storvsc: Always set no_report_opcodes
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 056/406] sctp: handle invalid error codes without calling BUG() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 058/406] ALSA: seq: oss: Fix racy open/close of MIDI devices Greg Kroah-Hartman
` (357 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Kelley, Martin K. Petersen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Kelley <mikelley@microsoft.com>
[ Upstream commit 31d16e712bdcaee769de4780f72ff8d6cd3f0589 ]
Hyper-V synthetic SCSI devices do not support the MAINTENANCE_IN SCSI
command, so scsi_report_opcode() always fails, resulting in messages like
this:
hv_storvsc <guid>: tag#205 cmd 0xa3 status: scsi 0x2 srb 0x86 hv 0xc0000001
The recently added support for command duration limits calls
scsi_report_opcode() four times as each device comes online, which
significantly increases the number of messages logged in a system with many
disks.
Fix the problem by always marking Hyper-V synthetic SCSI devices as not
supporting scsi_report_opcode(). With this setting, the MAINTENANCE_IN SCSI
command is not issued and no messages are logged.
Signed-off-by: Michael Kelley <mikelley@microsoft.com>
Link: https://lore.kernel.org/r/1686343101-18930-1-git-send-email-mikelley@microsoft.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/storvsc_drv.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
index 45d8549623442..37ad5f5256474 100644
--- a/drivers/scsi/storvsc_drv.c
+++ b/drivers/scsi/storvsc_drv.c
@@ -1537,6 +1537,8 @@ static int storvsc_device_configure(struct scsi_device *sdevice)
{
blk_queue_rq_timeout(sdevice->request_queue, (storvsc_timeout * HZ));
+ /* storvsc devices don't support MAINTENANCE_IN SCSI cmd */
+ sdevice->no_report_opcodes = 1;
sdevice->no_write_same = 1;
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 058/406] ALSA: seq: oss: Fix racy open/close of MIDI devices
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 057/406] scsi: storvsc: Always set no_report_opcodes Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 059/406] tracing: Introduce pipe_cpumask to avoid race on trace_pipes Greg Kroah-Hartman
` (356 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gong, Sishuai, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 297224fc0922e7385573a30c29ffdabb67f27b7d ]
Although snd_seq_oss_midi_open() and snd_seq_oss_midi_close() can be
called concurrently from different code paths, we have no proper data
protection against races. Introduce open_mutex to each seq_oss_midi
object for avoiding the races.
Reported-by: "Gong, Sishuai" <sishuai@purdue.edu>
Closes: https://lore.kernel.org/r/7DC9AF71-F481-4ABA-955F-76C535661E33@purdue.edu
Link: https://lore.kernel.org/r/20230612125533.27461-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/seq/oss/seq_oss_midi.c | 35 +++++++++++++++++++------------
1 file changed, 22 insertions(+), 13 deletions(-)
diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c
index f73ee0798aeab..be80ce72e0c72 100644
--- a/sound/core/seq/oss/seq_oss_midi.c
+++ b/sound/core/seq/oss/seq_oss_midi.c
@@ -37,6 +37,7 @@ struct seq_oss_midi {
struct snd_midi_event *coder; /* MIDI event coder */
struct seq_oss_devinfo *devinfo; /* assigned OSSseq device */
snd_use_lock_t use_lock;
+ struct mutex open_mutex;
};
@@ -171,6 +172,7 @@ snd_seq_oss_midi_check_new_port(struct snd_seq_port_info *pinfo)
mdev->flags = pinfo->capability;
mdev->opened = 0;
snd_use_lock_init(&mdev->use_lock);
+ mutex_init(&mdev->open_mutex);
/* copy and truncate the name of synth device */
strlcpy(mdev->name, pinfo->name, sizeof(mdev->name));
@@ -319,14 +321,16 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
int perm;
struct seq_oss_midi *mdev;
struct snd_seq_port_subscribe subs;
+ int err;
if ((mdev = get_mididev(dp, dev)) == NULL)
return -ENODEV;
+ mutex_lock(&mdev->open_mutex);
/* already used? */
if (mdev->opened && mdev->devinfo != dp) {
- snd_use_lock_free(&mdev->use_lock);
- return -EBUSY;
+ err = -EBUSY;
+ goto unlock;
}
perm = 0;
@@ -336,14 +340,14 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
perm |= PERM_READ;
perm &= mdev->flags;
if (perm == 0) {
- snd_use_lock_free(&mdev->use_lock);
- return -ENXIO;
+ err = -ENXIO;
+ goto unlock;
}
/* already opened? */
if ((mdev->opened & perm) == perm) {
- snd_use_lock_free(&mdev->use_lock);
- return 0;
+ err = 0;
+ goto unlock;
}
perm &= ~mdev->opened;
@@ -368,13 +372,17 @@ snd_seq_oss_midi_open(struct seq_oss_devinfo *dp, int dev, int fmode)
}
if (! mdev->opened) {
- snd_use_lock_free(&mdev->use_lock);
- return -ENXIO;
+ err = -ENXIO;
+ goto unlock;
}
mdev->devinfo = dp;
+ err = 0;
+
+ unlock:
+ mutex_unlock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock);
- return 0;
+ return err;
}
/*
@@ -388,10 +396,9 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
if ((mdev = get_mididev(dp, dev)) == NULL)
return -ENODEV;
- if (! mdev->opened || mdev->devinfo != dp) {
- snd_use_lock_free(&mdev->use_lock);
- return 0;
- }
+ mutex_lock(&mdev->open_mutex);
+ if (!mdev->opened || mdev->devinfo != dp)
+ goto unlock;
memset(&subs, 0, sizeof(subs));
if (mdev->opened & PERM_WRITE) {
@@ -410,6 +417,8 @@ snd_seq_oss_midi_close(struct seq_oss_devinfo *dp, int dev)
mdev->opened = 0;
mdev->devinfo = NULL;
+ unlock:
+ mutex_unlock(&mdev->open_mutex);
snd_use_lock_free(&mdev->use_lock);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 059/406] tracing: Introduce pipe_cpumask to avoid race on trace_pipes
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 058/406] ALSA: seq: oss: Fix racy open/close of MIDI devices Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 060/406] platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications Greg Kroah-Hartman
` (355 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Rostedt (Google),
Zheng Yejian, Masami Hiramatsu (Google), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <zhengyejian1@huawei.com>
[ Upstream commit c2489bb7e6be2e8cdced12c16c42fa128403ac03 ]
There is race issue when concurrently splice_read main trace_pipe and
per_cpu trace_pipes which will result in data read out being different
from what actually writen.
As suggested by Steven:
> I believe we should add a ref count to trace_pipe and the per_cpu
> trace_pipes, where if they are opened, nothing else can read it.
>
> Opening trace_pipe locks all per_cpu ref counts, if any of them are
> open, then the trace_pipe open will fail (and releases any ref counts
> it had taken).
>
> Opening a per_cpu trace_pipe will up the ref count for just that
> CPU buffer. This will allow multiple tasks to read different per_cpu
> trace_pipe files, but will prevent the main trace_pipe file from
> being opened.
But because we only need to know whether per_cpu trace_pipe is open or
not, using a cpumask instead of using ref count may be easier.
After this patch, users will find that:
- Main trace_pipe can be opened by only one user, and if it is
opened, all per_cpu trace_pipes cannot be opened;
- Per_cpu trace_pipes can be opened by multiple users, but each per_cpu
trace_pipe can only be opened by one user. And if one of them is
opened, main trace_pipe cannot be opened.
Link: https://lore.kernel.org/linux-trace-kernel/20230818022645.1948314-1-zhengyejian1@huawei.com
Suggested-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace.c | 55 ++++++++++++++++++++++++++++++++++++++------
kernel/trace/trace.h | 2 ++
2 files changed, 50 insertions(+), 7 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 597487a7f1bfb..2ded5012543bf 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -6255,10 +6255,36 @@ tracing_max_lat_write(struct file *filp, const char __user *ubuf,
#endif
+static int open_pipe_on_cpu(struct trace_array *tr, int cpu)
+{
+ if (cpu == RING_BUFFER_ALL_CPUS) {
+ if (cpumask_empty(tr->pipe_cpumask)) {
+ cpumask_setall(tr->pipe_cpumask);
+ return 0;
+ }
+ } else if (!cpumask_test_cpu(cpu, tr->pipe_cpumask)) {
+ cpumask_set_cpu(cpu, tr->pipe_cpumask);
+ return 0;
+ }
+ return -EBUSY;
+}
+
+static void close_pipe_on_cpu(struct trace_array *tr, int cpu)
+{
+ if (cpu == RING_BUFFER_ALL_CPUS) {
+ WARN_ON(!cpumask_full(tr->pipe_cpumask));
+ cpumask_clear(tr->pipe_cpumask);
+ } else {
+ WARN_ON(!cpumask_test_cpu(cpu, tr->pipe_cpumask));
+ cpumask_clear_cpu(cpu, tr->pipe_cpumask);
+ }
+}
+
static int tracing_open_pipe(struct inode *inode, struct file *filp)
{
struct trace_array *tr = inode->i_private;
struct trace_iterator *iter;
+ int cpu;
int ret;
ret = tracing_check_open_get_tr(tr);
@@ -6266,13 +6292,16 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
return ret;
mutex_lock(&trace_types_lock);
+ cpu = tracing_get_cpu(inode);
+ ret = open_pipe_on_cpu(tr, cpu);
+ if (ret)
+ goto fail_pipe_on_cpu;
/* create a buffer to store the information to pass to userspace */
iter = kzalloc(sizeof(*iter), GFP_KERNEL);
if (!iter) {
ret = -ENOMEM;
- __trace_array_put(tr);
- goto out;
+ goto fail_alloc_iter;
}
trace_seq_init(&iter->seq);
@@ -6295,7 +6324,7 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
iter->tr = tr;
iter->array_buffer = &tr->array_buffer;
- iter->cpu_file = tracing_get_cpu(inode);
+ iter->cpu_file = cpu;
mutex_init(&iter->mutex);
filp->private_data = iter;
@@ -6305,12 +6334,15 @@ static int tracing_open_pipe(struct inode *inode, struct file *filp)
nonseekable_open(inode, filp);
tr->trace_ref++;
-out:
+
mutex_unlock(&trace_types_lock);
return ret;
fail:
kfree(iter);
+fail_alloc_iter:
+ close_pipe_on_cpu(tr, cpu);
+fail_pipe_on_cpu:
__trace_array_put(tr);
mutex_unlock(&trace_types_lock);
return ret;
@@ -6327,7 +6359,7 @@ static int tracing_release_pipe(struct inode *inode, struct file *file)
if (iter->trace->pipe_close)
iter->trace->pipe_close(iter);
-
+ close_pipe_on_cpu(tr, iter->cpu_file);
mutex_unlock(&trace_types_lock);
free_cpumask_var(iter->started);
@@ -8851,6 +8883,9 @@ static struct trace_array *trace_array_create(const char *name)
if (!alloc_cpumask_var(&tr->tracing_cpumask, GFP_KERNEL))
goto out_free_tr;
+ if (!alloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL))
+ goto out_free_tr;
+
tr->trace_flags = global_trace.trace_flags & ~ZEROED_TRACE_FLAGS;
cpumask_copy(tr->tracing_cpumask, cpu_all_mask);
@@ -8892,6 +8927,7 @@ static struct trace_array *trace_array_create(const char *name)
out_free_tr:
ftrace_free_ftrace_ops(tr);
free_trace_buffers(tr);
+ free_cpumask_var(tr->pipe_cpumask);
free_cpumask_var(tr->tracing_cpumask);
kfree(tr->name);
kfree(tr);
@@ -8993,6 +9029,7 @@ static int __remove_instance(struct trace_array *tr)
}
kfree(tr->topts);
+ free_cpumask_var(tr->pipe_cpumask);
free_cpumask_var(tr->tracing_cpumask);
kfree(tr->name);
kfree(tr);
@@ -9692,12 +9729,14 @@ __init static int tracer_alloc_buffers(void)
if (trace_create_savedcmd() < 0)
goto out_free_temp_buffer;
+ if (!alloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL))
+ goto out_free_savedcmd;
+
/* TODO: make the number of buffers hot pluggable with CPUS */
if (allocate_trace_buffers(&global_trace, ring_buf_size) < 0) {
MEM_FAIL(1, "tracer: failed to allocate ring buffer!\n");
- goto out_free_savedcmd;
+ goto out_free_pipe_cpumask;
}
-
if (global_trace.buffer_disabled)
tracing_off();
@@ -9748,6 +9787,8 @@ __init static int tracer_alloc_buffers(void)
return 0;
+out_free_pipe_cpumask:
+ free_cpumask_var(global_trace.pipe_cpumask);
out_free_savedcmd:
free_saved_cmdlines_buffer(savedcmd);
out_free_temp_buffer:
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index 892b3d2f33b79..dfde855dafda7 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -356,6 +356,8 @@ struct trace_array {
struct list_head events;
struct trace_event_file *trace_marker_file;
cpumask_var_t tracing_cpumask; /* only trace on set CPUs */
+ /* one per_cpu trace_pipe can be opened by only one user */
+ cpumask_var_t pipe_cpumask;
int ref;
int trace_ref;
#ifdef CONFIG_FUNCTION_TRACER
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 060/406] platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 059/406] tracing: Introduce pipe_cpumask to avoid race on trace_pipes Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 061/406] net: Avoid address overwrite in kernel_connect Greg Kroah-Hartman
` (354 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shih-Yi Chen, Liming Sung,
David Thompson, Hans de Goede, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shih-Yi Chen <shihyic@nvidia.com>
[ Upstream commit 0848cab765c634597636810bf76d0934003cce28 ]
rshim console does not show all entries of dmesg.
Fixed by setting MLXBF_TM_TX_LWM_IRQ for every CONSOLE notification.
Signed-off-by: Shih-Yi Chen <shihyic@nvidia.com>
Reviewed-by: Liming Sung <limings@nvidia.com>
Reviewed-by: David Thompson <davthompson@nvidia.com>
Link: https://lore.kernel.org/r/20230821150627.26075-1-shihyic@nvidia.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/mellanox/mlxbf-tmfifo.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
index 38800e86ed8ad..64d22ecf3cddd 100644
--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
@@ -868,6 +868,7 @@ static bool mlxbf_tmfifo_virtio_notify(struct virtqueue *vq)
tm_vdev = fifo->vdev[VIRTIO_ID_CONSOLE];
mlxbf_tmfifo_console_output(tm_vdev, vring);
spin_unlock_irqrestore(&fifo->spin_lock[0], flags);
+ set_bit(MLXBF_TM_TX_LWM_IRQ, &fifo->pend_events);
} else if (test_and_set_bit(MLXBF_TM_TX_LWM_IRQ,
&fifo->pend_events)) {
return true;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 061/406] net: Avoid address overwrite in kernel_connect
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 060/406] platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 062/406] udf: Check consistency of Space Bitmap Descriptor Greg Kroah-Hartman
` (353 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jordan Rife, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <jrife@google.com>
commit 0bdf399342c5acbd817c9098b6c7ed21f1974312 upstream.
BPF programs that run on connect can rewrite the connect address. For
the connect system call this isn't a problem, because a copy of the address
is made when it is moved into kernel space. However, kernel_connect
simply passes through the address it is given, so the caller may observe
its address value unexpectedly change.
A practical example where this is problematic is where NFS is combined
with a system such as Cilium which implements BPF-based load balancing.
A common pattern in software-defined storage systems is to have an NFS
mount that connects to a persistent virtual IP which in turn maps to an
ephemeral server IP. This is usually done to achieve high availability:
if your server goes down you can quickly spin up a replacement and remap
the virtual IP to that endpoint. With BPF-based load balancing, mounts
will forget the virtual IP address when the address rewrite occurs
because a pointer to the only copy of that address is passed down the
stack. Server failover then breaks, because clients have forgotten the
virtual IP address. Reconnects fail and mounts remain broken. This patch
was tested by setting up a scenario like this and ensuring that NFS
reconnects worked after applying the patch.
Signed-off-by: Jordan Rife <jrife@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/socket.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/socket.c
+++ b/net/socket.c
@@ -3467,7 +3467,11 @@ EXPORT_SYMBOL(kernel_accept);
int kernel_connect(struct socket *sock, struct sockaddr *addr, int addrlen,
int flags)
{
- return sock->ops->connect(sock, addr, addrlen, flags);
+ struct sockaddr_storage address;
+
+ memcpy(&address, addr, addrlen);
+
+ return sock->ops->connect(sock, (struct sockaddr *)&address, addrlen, flags);
}
EXPORT_SYMBOL(kernel_connect);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 062/406] udf: Check consistency of Space Bitmap Descriptor
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 061/406] net: Avoid address overwrite in kernel_connect Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 063/406] udf: Handle error when adding extent to a file Greg Kroah-Hartman
` (352 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vladislav Efanov, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladislav Efanov <VEfanov@ispras.ru>
commit 1e0d4adf17e7ef03281d7b16555e7c1508c8ed2d upstream.
Bits, which are related to Bitmap Descriptor logical blocks,
are not reset when buffer headers are allocated for them. As the
result, these logical blocks can be treated as free and
be used for other blocks.This can cause usage of one buffer header
for several types of data. UDF issues WARNING in this situation:
WARNING: CPU: 0 PID: 2703 at fs/udf/inode.c:2014
__udf_add_aext+0x685/0x7d0 fs/udf/inode.c:2014
RIP: 0010:__udf_add_aext+0x685/0x7d0 fs/udf/inode.c:2014
Call Trace:
udf_setup_indirect_aext+0x573/0x880 fs/udf/inode.c:1980
udf_add_aext+0x208/0x2e0 fs/udf/inode.c:2067
udf_insert_aext fs/udf/inode.c:2233 [inline]
udf_update_extents fs/udf/inode.c:1181 [inline]
inode_getblk+0x1981/0x3b70 fs/udf/inode.c:885
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
[JK: Somewhat cleaned up the boundary checks]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/balloc.c | 31 +++++++++++++++++++++++++++----
1 file changed, 27 insertions(+), 4 deletions(-)
--- a/fs/udf/balloc.c
+++ b/fs/udf/balloc.c
@@ -36,18 +36,41 @@ static int read_block_bitmap(struct supe
unsigned long bitmap_nr)
{
struct buffer_head *bh = NULL;
- int retval = 0;
+ int i;
+ int max_bits, off, count;
struct kernel_lb_addr loc;
loc.logicalBlockNum = bitmap->s_extPosition;
loc.partitionReferenceNum = UDF_SB(sb)->s_partition;
bh = udf_tread(sb, udf_get_lb_pblock(sb, &loc, block));
+ bitmap->s_block_bitmap[bitmap_nr] = bh;
if (!bh)
- retval = -EIO;
+ return -EIO;
- bitmap->s_block_bitmap[bitmap_nr] = bh;
- return retval;
+ /* Check consistency of Space Bitmap buffer. */
+ max_bits = sb->s_blocksize * 8;
+ if (!bitmap_nr) {
+ off = sizeof(struct spaceBitmapDesc) << 3;
+ count = min(max_bits - off, bitmap->s_nr_groups);
+ } else {
+ /*
+ * Rough check if bitmap number is too big to have any bitmap
+ * blocks reserved.
+ */
+ if (bitmap_nr >
+ (bitmap->s_nr_groups >> (sb->s_blocksize_bits + 3)) + 2)
+ return 0;
+ off = 0;
+ count = bitmap->s_nr_groups - bitmap_nr * max_bits +
+ (sizeof(struct spaceBitmapDesc) << 3);
+ count = min(count, max_bits);
+ }
+
+ for (i = 0; i < count; i++)
+ if (udf_test_bit(i + off, bh->b_data))
+ return -EFSCORRUPTED;
+ return 0;
}
static int __load_block_bitmap(struct super_block *sb,
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 063/406] udf: Handle error when adding extent to a file
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 062/406] udf: Check consistency of Space Bitmap Descriptor Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 064/406] Revert "net: macsec: preserve ingress frame ordering" Greg Kroah-Hartman
` (351 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 19fd80de0a8b5170ef34704c8984cca920dffa59 upstream.
When adding extent to a file fails, so far we've silently squelshed the
error. Make sure to propagate it up properly.
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 41 +++++++++++++++++++++++++++--------------
1 file changed, 27 insertions(+), 14 deletions(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -57,15 +57,15 @@ static int udf_update_inode(struct inode
static int udf_sync_inode(struct inode *inode);
static int udf_alloc_i_data(struct inode *inode, size_t size);
static sector_t inode_getblk(struct inode *, sector_t, int *, int *);
-static int8_t udf_insert_aext(struct inode *, struct extent_position,
- struct kernel_lb_addr, uint32_t);
+static int udf_insert_aext(struct inode *, struct extent_position,
+ struct kernel_lb_addr, uint32_t);
static void udf_split_extents(struct inode *, int *, int, udf_pblk_t,
struct kernel_long_ad *, int *);
static void udf_prealloc_extents(struct inode *, int, int,
struct kernel_long_ad *, int *);
static void udf_merge_extents(struct inode *, struct kernel_long_ad *, int *);
-static void udf_update_extents(struct inode *, struct kernel_long_ad *, int,
- int, struct extent_position *);
+static int udf_update_extents(struct inode *, struct kernel_long_ad *, int,
+ int, struct extent_position *);
static int udf_get_block(struct inode *, sector_t, struct buffer_head *, int);
static void __udf_clear_extent_cache(struct inode *inode)
@@ -887,7 +887,9 @@ static sector_t inode_getblk(struct inod
/* write back the new extents, inserting new extents if the new number
* of extents is greater than the old number, and deleting extents if
* the new number of extents is less than the old number */
- udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
+ *err = udf_update_extents(inode, laarr, startnum, endnum, &prev_epos);
+ if (*err < 0)
+ goto out_free;
newblock = udf_get_pblock(inode->i_sb, newblocknum,
iinfo->i_location.partitionReferenceNum, 0);
@@ -1155,21 +1157,30 @@ static void udf_merge_extents(struct ino
}
}
-static void udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
- int startnum, int endnum,
- struct extent_position *epos)
+static int udf_update_extents(struct inode *inode, struct kernel_long_ad *laarr,
+ int startnum, int endnum,
+ struct extent_position *epos)
{
int start = 0, i;
struct kernel_lb_addr tmploc;
uint32_t tmplen;
+ int err;
if (startnum > endnum) {
for (i = 0; i < (startnum - endnum); i++)
udf_delete_aext(inode, *epos);
} else if (startnum < endnum) {
for (i = 0; i < (endnum - startnum); i++) {
- udf_insert_aext(inode, *epos, laarr[i].extLocation,
- laarr[i].extLength);
+ err = udf_insert_aext(inode, *epos,
+ laarr[i].extLocation,
+ laarr[i].extLength);
+ /*
+ * If we fail here, we are likely corrupting the extent
+ * list and leaking blocks. At least stop early to
+ * limit the damage.
+ */
+ if (err < 0)
+ return err;
udf_next_aext(inode, epos, &laarr[i].extLocation,
&laarr[i].extLength, 1);
start++;
@@ -1181,6 +1192,7 @@ static void udf_update_extents(struct in
udf_write_aext(inode, epos, &laarr[i].extLocation,
laarr[i].extLength, 1);
}
+ return 0;
}
struct buffer_head *udf_bread(struct inode *inode, udf_pblk_t block,
@@ -2215,12 +2227,13 @@ int8_t udf_current_aext(struct inode *in
return etype;
}
-static int8_t udf_insert_aext(struct inode *inode, struct extent_position epos,
- struct kernel_lb_addr neloc, uint32_t nelen)
+static int udf_insert_aext(struct inode *inode, struct extent_position epos,
+ struct kernel_lb_addr neloc, uint32_t nelen)
{
struct kernel_lb_addr oeloc;
uint32_t oelen;
int8_t etype;
+ int err;
if (epos.bh)
get_bh(epos.bh);
@@ -2230,10 +2243,10 @@ static int8_t udf_insert_aext(struct ino
neloc = oeloc;
nelen = (etype << 30) | oelen;
}
- udf_add_aext(inode, &epos, &neloc, nelen, 1);
+ err = udf_add_aext(inode, &epos, &neloc, nelen, 1);
brelse(epos.bh);
- return (nelen >> 30);
+ return err;
}
int8_t udf_delete_aext(struct inode *inode, struct extent_position epos)
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 064/406] Revert "net: macsec: preserve ingress frame ordering"
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 063/406] udf: Handle error when adding extent to a file Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 065/406] reiserfs: Check the return value from __getblk() Greg Kroah-Hartman
` (350 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sabrina Dubroca, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sabrina Dubroca <sd@queasysnail.net>
commit d3287e4038ca4f81e02067ab72d087af7224c68b upstream.
This reverts commit ab046a5d4be4c90a3952a0eae75617b49c0cb01b.
It was trying to work around an issue at the crypto layer by excluding
ASYNC implementations of gcm(aes), because a bug in the AESNI version
caused reordering when some requests bypassed the cryptd queue while
older requests were still pending on the queue.
This was fixed by commit 38b2f68b4264 ("crypto: aesni - Fix cryptd
reordering problem on gcm"), which pre-dates ab046a5d4be4.
Herbert Xu confirmed that all ASYNC implementations are expected to
maintain the ordering of completions wrt requests, so we can use them
in MACsec.
On my test machine, this restores the performance of a single netperf
instance, from 1.4Gbps to 4.4Gbps.
Link: https://lore.kernel.org/netdev/9328d206c5d9f9239cae27e62e74de40b258471d.1692279161.git.sd@queasysnail.net/T/
Link: https://lore.kernel.org/netdev/1b0cec71-d084-8153-2ba4-72ce71abeb65@byu.edu/
Link: https://lore.kernel.org/netdev/d335ddaa-18dc-f9f0-17ee-9783d3b2ca29@mailbox.tu-dresden.de/
Fixes: ab046a5d4be4 ("net: macsec: preserve ingress frame ordering")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/r/11c952469d114db6fb29242e1d9545e61f52f512.1693757159.git.sd@queasysnail.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/macsec.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -1347,8 +1347,7 @@ static struct crypto_aead *macsec_alloc_
struct crypto_aead *tfm;
int ret;
- /* Pick a sync gcm(aes) cipher to ensure order is preserved. */
- tfm = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);
+ tfm = crypto_alloc_aead("gcm(aes)", 0, 0);
if (IS_ERR(tfm))
return tfm;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 065/406] reiserfs: Check the return value from __getblk()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 064/406] Revert "net: macsec: preserve ingress frame ordering" Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 066/406] eventfd: Export eventfd_ctx_do_read() Greg Kroah-Hartman
` (349 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Wilcox (Oracle),
butt3rflyh4ck, Edward Shishkin, Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox <willy@infradead.org>
[ Upstream commit ba38980add7ffc9e674ada5b4ded4e7d14e76581 ]
__getblk() can return a NULL pointer if we run out of memory or if we
try to access beyond the end of the device; check it and handle it
appropriately.
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Link: https://lore.kernel.org/lkml/CAFcO6XOacq3hscbXevPQP7sXRoYFz34ZdKPYjmd6k5sZuhGFDw@mail.gmail.com/
Tested-by: butt3rflyh4ck <butterflyhuangxx@gmail.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") # probably introduced in 2002
Acked-by: Edward Shishkin <edward.shishkin@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/reiserfs/journal.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c
index df5fc12a6ceed..cfa4defbd0401 100644
--- a/fs/reiserfs/journal.c
+++ b/fs/reiserfs/journal.c
@@ -2325,7 +2325,7 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
int i, j;
bh = __getblk(dev, block, bufsize);
- if (buffer_uptodate(bh))
+ if (!bh || buffer_uptodate(bh))
return (bh);
if (block + BUFNR > max_block) {
@@ -2335,6 +2335,8 @@ static struct buffer_head *reiserfs_breada(struct block_device *dev,
j = 1;
for (i = 1; i < blocks; i++) {
bh = __getblk(dev, block + i, bufsize);
+ if (!bh)
+ break;
if (buffer_uptodate(bh)) {
brelse(bh);
break;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 066/406] eventfd: Export eventfd_ctx_do_read()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 065/406] reiserfs: Check the return value from __getblk() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 067/406] eventfd: prevent underflow for eventfd semaphores Greg Kroah-Hartman
` (348 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Woodhouse, Paolo Bonzini,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Woodhouse <dwmw@amazon.co.uk>
[ Upstream commit 28f1326710555bbe666f64452d08f2d7dd657cae ]
Where events are consumed in the kernel, for example by KVM's
irqfd_wakeup() and VFIO's virqfd_wakeup(), they currently lack a
mechanism to drain the eventfd's counter.
Since the wait queue is already locked while the wakeup functions are
invoked, all they really need to do is call eventfd_ctx_do_read().
Add a check for the lock, and export it for them.
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Message-Id: <20201027135523.646811-2-dwmw2@infradead.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Stable-dep-of: 758b49204781 ("eventfd: prevent underflow for eventfd semaphores")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/eventfd.c | 5 ++++-
include/linux/eventfd.h | 6 ++++++
2 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/fs/eventfd.c b/fs/eventfd.c
index 4a14295cffe0d..b8d38b970ce7f 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -187,11 +187,14 @@ static __poll_t eventfd_poll(struct file *file, poll_table *wait)
return events;
}
-static void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
+void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
{
+ lockdep_assert_held(&ctx->wqh.lock);
+
*cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
ctx->count -= *cnt;
}
+EXPORT_SYMBOL_GPL(eventfd_ctx_do_read);
/**
* eventfd_ctx_remove_wait_queue - Read the current counter and removes wait queue.
diff --git a/include/linux/eventfd.h b/include/linux/eventfd.h
index 6cd2a92daf205..c1bd4883e2faf 100644
--- a/include/linux/eventfd.h
+++ b/include/linux/eventfd.h
@@ -42,6 +42,7 @@ __u64 eventfd_signal(struct eventfd_ctx *ctx, __u64 n);
__u64 eventfd_signal_mask(struct eventfd_ctx *ctx, __u64 n, unsigned mask);
int eventfd_ctx_remove_wait_queue(struct eventfd_ctx *ctx, wait_queue_entry_t *wait,
__u64 *cnt);
+void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt);
DECLARE_PER_CPU(int, eventfd_wake_count);
@@ -89,6 +90,11 @@ static inline bool eventfd_signal_count(void)
return false;
}
+static inline void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
+{
+
+}
+
#endif
#endif /* _LINUX_EVENTFD_H */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 067/406] eventfd: prevent underflow for eventfd semaphores
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 066/406] eventfd: Export eventfd_ctx_do_read() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 068/406] fs: Fix error checking for d_hash_and_lookup() Greg Kroah-Hartman
` (347 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wen Yang, Alexander Viro, Jens Axboe,
Christian Brauner, Christoph Hellwig, Dylan Yudaken,
David Woodhouse, Matthew Wilcox, linux-fsdevel, linux-kernel,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Yang <wenyang.linux@foxmail.com>
[ Upstream commit 758b492047816a3158d027e9fca660bc5bcf20bf ]
For eventfd with flag EFD_SEMAPHORE, when its ctx->count is 0, calling
eventfd_ctx_do_read will cause ctx->count to overflow to ULLONG_MAX.
An underflow can happen with EFD_SEMAPHORE eventfds in at least the
following three subsystems:
(1) virt/kvm/eventfd.c
(2) drivers/vfio/virqfd.c
(3) drivers/virt/acrn/irqfd.c
where (2) and (3) are just modeled after (1). An eventfd must be
specified for use with the KVM_IRQFD ioctl(). This can also be an
EFD_SEMAPHORE eventfd. When the eventfd count is zero or has been
decremented to zero an underflow can be triggered when the irqfd is shut
down by raising the KVM_IRQFD_FLAG_DEASSIGN flag in the KVM_IRQFD
ioctl():
// ctx->count == 0
kvm_vm_ioctl()
-> kvm_irqfd()
-> kvm_irqfd_deassign()
-> irqfd_deactivate()
-> irqfd_shutdown()
-> eventfd_ctx_remove_wait_queue(&cnt)
-> eventfd_ctx_do_read(&cnt)
Userspace polling on the eventfd wouldn't notice the underflow because 1
is always returned as the value from eventfd_read() while ctx->count
would've underflowed. It's not a huge deal because this should only be
happening when the irqfd is shutdown but we should still fix it and
avoid the spurious wakeup.
Fixes: cb289d6244a3 ("eventfd - allow atomic read and waitqueue remove")
Signed-off-by: Wen Yang <wenyang.linux@foxmail.com>
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
Cc: Jens Axboe <axboe@kernel.dk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Dylan Yudaken <dylany@fb.com>
Cc: David Woodhouse <dwmw@amazon.co.uk>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: linux-fsdevel@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Message-Id: <tencent_7588DFD1F365950A757310D764517A14B306@qq.com>
[brauner: rewrite commit message and add explanation how this underflow can happen]
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/eventfd.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/eventfd.c b/fs/eventfd.c
index b8d38b970ce7f..3673eb8de0356 100644
--- a/fs/eventfd.c
+++ b/fs/eventfd.c
@@ -191,7 +191,7 @@ void eventfd_ctx_do_read(struct eventfd_ctx *ctx, __u64 *cnt)
{
lockdep_assert_held(&ctx->wqh.lock);
- *cnt = (ctx->flags & EFD_SEMAPHORE) ? 1 : ctx->count;
+ *cnt = ((ctx->flags & EFD_SEMAPHORE) && ctx->count) ? 1 : ctx->count;
ctx->count -= *cnt;
}
EXPORT_SYMBOL_GPL(eventfd_ctx_do_read);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 068/406] fs: Fix error checking for d_hash_and_lookup()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 067/406] eventfd: prevent underflow for eventfd semaphores Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 069/406] tmpfs: verify {g,u}id mount options correctly Greg Kroah-Hartman
` (346 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Ming, Christian Brauner,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Ming <machel@vivo.com>
[ Upstream commit 0d5a4f8f775ff990142cdc810a84eae078589d27 ]
The d_hash_and_lookup() function returns error pointers or NULL.
Most incorrect error checks were fixed, but the one in int path_pts()
was forgotten.
Fixes: eedf265aa003 ("devpts: Make each mount of devpts an independent filesystem.")
Signed-off-by: Wang Ming <machel@vivo.com>
Message-Id: <20230713120555.7025-1-machel@vivo.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namei.c b/fs/namei.c
index bc5e633a5954e..3ff954a2bbd1d 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -2640,7 +2640,7 @@ int path_pts(struct path *path)
dput(path->dentry);
path->dentry = parent;
child = d_hash_and_lookup(parent, &this);
- if (!child)
+ if (IS_ERR_OR_NULL(child))
return -ENOENT;
path->dentry = child;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 069/406] tmpfs: verify {g,u}id mount options correctly
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 068/406] fs: Fix error checking for d_hash_and_lookup() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 070/406] selftests/harness: Actually report SKIP for signal tests Greg Kroah-Hartman
` (345 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seth Forshee (DigitalOcean),
Seth Jenkins, Christian Brauner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit 0200679fc7953177941e41c2a4241d0b6c2c5de8 ]
A while ago we received the following report:
"The other outstanding issue I noticed comes from the fact that
fsconfig syscalls may occur in a different userns than that which
called fsopen. That means that resolving the uid/gid via
current_user_ns() can save a kuid that isn't mapped in the associated
namespace when the filesystem is finally mounted. This means that it
is possible for an unprivileged user to create files owned by any
group in a tmpfs mount (since we can set the SUID bit on the tmpfs
directory), or a tmpfs that is owned by any user, including the root
group/user."
The contract for {g,u}id mount options and {g,u}id values in general set
from userspace has always been that they are translated according to the
caller's idmapping. In so far, tmpfs has been doing the correct thing.
But since tmpfs is mountable in unprivileged contexts it is also
necessary to verify that the resulting {k,g}uid is representable in the
namespace of the superblock to avoid such bugs as above.
The new mount api's cross-namespace delegation abilities are already
widely used. After having talked to a bunch of userspace this is the
most faithful solution with minimal regression risks. I know of one
users - systemd - that makes use of the new mount api in this way and
they don't set unresolable {g,u}ids. So the regression risk is minimal.
Link: https://lore.kernel.org/lkml/CALxfFW4BXhEwxR0Q5LSkg-8Vb4r2MONKCcUCVioehXQKr35eHg@mail.gmail.com
Fixes: f32356261d44 ("vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API")
Reviewed-by: "Seth Forshee (DigitalOcean)" <sforshee@kernel.org>
Reported-by: Seth Jenkins <sethjenkins@google.com>
Message-Id: <20230801-vfs-fs_context-uidgid-v1-1-daf46a050bbf@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/shmem.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/mm/shmem.c b/mm/shmem.c
index cfa8f43cb3a62..e173d83b44481 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -3455,6 +3455,8 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param)
unsigned long long size;
char *rest;
int opt;
+ kuid_t kuid;
+ kgid_t kgid;
opt = fs_parse(fc, shmem_fs_parameters, param, &result);
if (opt < 0)
@@ -3490,14 +3492,32 @@ static int shmem_parse_one(struct fs_context *fc, struct fs_parameter *param)
ctx->mode = result.uint_32 & 07777;
break;
case Opt_uid:
- ctx->uid = make_kuid(current_user_ns(), result.uint_32);
- if (!uid_valid(ctx->uid))
+ kuid = make_kuid(current_user_ns(), result.uint_32);
+ if (!uid_valid(kuid))
goto bad_value;
+
+ /*
+ * The requested uid must be representable in the
+ * filesystem's idmapping.
+ */
+ if (!kuid_has_mapping(fc->user_ns, kuid))
+ goto bad_value;
+
+ ctx->uid = kuid;
break;
case Opt_gid:
- ctx->gid = make_kgid(current_user_ns(), result.uint_32);
- if (!gid_valid(ctx->gid))
+ kgid = make_kgid(current_user_ns(), result.uint_32);
+ if (!gid_valid(kgid))
goto bad_value;
+
+ /*
+ * The requested gid must be representable in the
+ * filesystem's idmapping.
+ */
+ if (!kgid_has_mapping(fc->user_ns, kgid))
+ goto bad_value;
+
+ ctx->gid = kgid;
break;
case Opt_huge:
ctx->huge = result.uint_32;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 070/406] selftests/harness: Actually report SKIP for signal tests
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 069/406] tmpfs: verify {g,u}id mount options correctly Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 071/406] refscale: Fix uninitalized use of wait_queue_head_t Greg Kroah-Hartman
` (344 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuah Khan, Andy Lutomirski,
Will Drewry, linux-kselftest, Kees Cook, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
[ Upstream commit b3d46e11fec0c5a8972e5061bb1462119ae5736d ]
Tests that were expecting a signal were not correctly checking for a
SKIP condition. Move the check before the signal checking when
processing test result.
Cc: Shuah Khan <shuah@kernel.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Will Drewry <wad@chromium.org>
Cc: linux-kselftest@vger.kernel.org
Fixes: 9847d24af95c ("selftests/harness: Refactor XFAIL into SKIP")
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/kselftest_harness.h | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
diff --git a/tools/testing/selftests/kselftest_harness.h b/tools/testing/selftests/kselftest_harness.h
index 3e7b2e521cde4..2fadc99d93619 100644
--- a/tools/testing/selftests/kselftest_harness.h
+++ b/tools/testing/selftests/kselftest_harness.h
@@ -910,7 +910,11 @@ void __wait_for_test(struct __test_metadata *t)
fprintf(TH_LOG_STREAM,
"# %s: Test terminated by timeout\n", t->name);
} else if (WIFEXITED(status)) {
- if (t->termsig != -1) {
+ if (WEXITSTATUS(status) == 255) {
+ /* SKIP */
+ t->passed = 1;
+ t->skip = 1;
+ } else if (t->termsig != -1) {
t->passed = 0;
fprintf(TH_LOG_STREAM,
"# %s: Test exited normally instead of by signal (code: %d)\n",
@@ -922,11 +926,6 @@ void __wait_for_test(struct __test_metadata *t)
case 0:
t->passed = 1;
break;
- /* SKIP */
- case 255:
- t->passed = 1;
- t->skip = 1;
- break;
/* Other failure, assume step report. */
default:
t->passed = 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 071/406] refscale: Fix uninitalized use of wait_queue_head_t
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 070/406] selftests/harness: Actually report SKIP for signal tests Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 072/406] OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() Greg Kroah-Hartman
` (343 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Waiman Long, Qiuxu Zhuo,
Davidlohr Bueso, Joel Fernandes (Google), Paul E. McKenney,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
[ Upstream commit f5063e8948dad7f31adb007284a5d5038ae31bb8 ]
Running the refscale test occasionally crashes the kernel with the
following error:
[ 8569.952896] BUG: unable to handle page fault for address: ffffffffffffffe8
[ 8569.952900] #PF: supervisor read access in kernel mode
[ 8569.952902] #PF: error_code(0x0000) - not-present page
[ 8569.952904] PGD c4b048067 P4D c4b049067 PUD c4b04b067 PMD 0
[ 8569.952910] Oops: 0000 [#1] PREEMPT_RT SMP NOPTI
[ 8569.952916] Hardware name: Dell Inc. PowerEdge R750/0WMWCR, BIOS 1.2.4 05/28/2021
[ 8569.952917] RIP: 0010:prepare_to_wait_event+0x101/0x190
:
[ 8569.952940] Call Trace:
[ 8569.952941] <TASK>
[ 8569.952944] ref_scale_reader+0x380/0x4a0 [refscale]
[ 8569.952959] kthread+0x10e/0x130
[ 8569.952966] ret_from_fork+0x1f/0x30
[ 8569.952973] </TASK>
The likely cause is that init_waitqueue_head() is called after the call to
the torture_create_kthread() function that creates the ref_scale_reader
kthread. Although this init_waitqueue_head() call will very likely
complete before this kthread is created and starts running, it is
possible that the calling kthread will be delayed between the calls to
torture_create_kthread() and init_waitqueue_head(). In this case, the
new kthread will use the waitqueue head before it is properly initialized,
which is not good for the kernel's health and well-being.
The above crash happened here:
static inline void __add_wait_queue(...)
{
:
if (!(wq->flags & WQ_FLAG_PRIORITY)) <=== Crash here
The offset of flags from list_head entry in wait_queue_entry is
-0x18. If reader_tasks[i].wq.head.next is NULL as allocated reader_task
structure is zero initialized, the instruction will try to access address
0xffffffffffffffe8, which is exactly the fault address listed above.
This commit therefore invokes init_waitqueue_head() before creating
the kthread.
Fixes: 653ed64b01dc ("refperf: Add a test to measure performance of read-side synchronization")
Signed-off-by: Waiman Long <longman@redhat.com>
Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/rcu/refscale.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/kernel/rcu/refscale.c b/kernel/rcu/refscale.c
index 4e419ca6d6114..dbd670376c42e 100644
--- a/kernel/rcu/refscale.c
+++ b/kernel/rcu/refscale.c
@@ -692,12 +692,11 @@ ref_scale_init(void)
VERBOSE_SCALEOUT("Starting %d reader threads\n", nreaders);
for (i = 0; i < nreaders; i++) {
+ init_waitqueue_head(&reader_tasks[i].wq);
firsterr = torture_create_kthread(ref_scale_reader, (void *)i,
reader_tasks[i].task);
if (firsterr)
goto unwind;
-
- init_waitqueue_head(&(reader_tasks[i].wq));
}
// Main Task
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 072/406] OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 071/406] refscale: Fix uninitalized use of wait_queue_head_t Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 073/406] selftests/resctrl: Dont leak buffer in fill_cache() Greg Kroah-Hartman
` (342 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, Viresh Kumar,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit d920920f85a82c1c806a4143871a0e8f534732f2 ]
If dev_pm_domain_attach_by_name() returns NULL, then 0 will be passed to
PTR_ERR() as reported by the smatch warning below:
drivers/opp/core.c:2456 _opp_attach_genpd() warn: passing zero to 'PTR_ERR'
Fix it by checking for the non-NULL virt_dev pointer before passing it to
PTR_ERR. Otherwise return -ENODEV.
Fixes: 4ea9496cbc95 ("opp: Fix error check in dev_pm_opp_attach_genpd()")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/opp/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/opp/core.c b/drivers/opp/core.c
index 7ed605ffb7171..7999baa075b0e 100644
--- a/drivers/opp/core.c
+++ b/drivers/opp/core.c
@@ -2053,7 +2053,7 @@ struct opp_table *dev_pm_opp_attach_genpd(struct device *dev,
virt_dev = dev_pm_domain_attach_by_name(dev, *name);
if (IS_ERR_OR_NULL(virt_dev)) {
- ret = PTR_ERR(virt_dev) ? : -ENODEV;
+ ret = virt_dev ? PTR_ERR(virt_dev) : -ENODEV;
dev_err(dev, "Couldn't attach to pm_domain: %d\n", ret);
goto err;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 073/406] selftests/resctrl: Dont leak buffer in fill_cache()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 072/406] OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 074/406] selftests/resctrl: Unmount resctrl FS if child fails to run benchmark Greg Kroah-Hartman
` (341 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Reinette Chatre,
Babu Moger, Shaopeng Tan (Fujitsu), Shuah Khan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 2d320b1029ee7329ee0638181be967789775b962 ]
The error path in fill_cache() does return before the allocated buffer
is freed leaking the buffer.
The leak was introduced when fill_cache_read() started to return errors
in commit c7b607fa9325 ("selftests/resctrl: Fix null pointer
dereference on open failed"), before that both fill functions always
returned 0.
Move free() earlier to prevent the mem leak.
Fixes: c7b607fa9325 ("selftests/resctrl: Fix null pointer dereference on open failed")
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Tested-by: Shaopeng Tan (Fujitsu) <tan.shaopeng@fujitsu.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/resctrl/fill_buf.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/resctrl/fill_buf.c b/tools/testing/selftests/resctrl/fill_buf.c
index c20d0a7ecbe63..ab1d91328d67b 100644
--- a/tools/testing/selftests/resctrl/fill_buf.c
+++ b/tools/testing/selftests/resctrl/fill_buf.c
@@ -184,12 +184,13 @@ fill_cache(unsigned long long buf_size, int malloc_and_init, int memflush,
else
ret = fill_cache_write(start_ptr, end_ptr, resctrl_val);
+ free(startptr);
+
if (ret) {
printf("\n Error in fill cache read/write...\n");
return -1;
}
- free(startptr);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 074/406] selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 073/406] selftests/resctrl: Dont leak buffer in fill_cache() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 075/406] selftests/resctrl: Close perf value read fd on errors Greg Kroah-Hartman
` (340 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Reinette Chatre,
Babu Moger, Shaopeng Tan (Fujitsu), Shuah Khan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit f99e413eb54652e2436cc56d081176bc9a34cd8d ]
A child calls PARENT_EXIT() when it fails to run a benchmark to kill
the parent process. PARENT_EXIT() lacks unmount for the resctrl FS and
the parent won't be there to unmount it either after it gets killed.
Add the resctrl FS unmount also to PARENT_EXIT().
Fixes: 591a6e8588fc ("selftests/resctrl: Add basic resctrl file system operations and data")
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Tested-by: Shaopeng Tan (Fujitsu) <tan.shaopeng@fujitsu.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/resctrl/resctrl.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/resctrl/resctrl.h b/tools/testing/selftests/resctrl/resctrl.h
index 36da6136af968..c38f2d58df927 100644
--- a/tools/testing/selftests/resctrl/resctrl.h
+++ b/tools/testing/selftests/resctrl/resctrl.h
@@ -33,6 +33,7 @@
do { \
perror(err_msg); \
kill(ppid, SIGKILL); \
+ umount_resctrlfs(); \
exit(EXIT_FAILURE); \
} while (0)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 075/406] selftests/resctrl: Close perf value read fd on errors
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 074/406] selftests/resctrl: Unmount resctrl FS if child fails to run benchmark Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 076/406] x86/decompressor: Dont rely on upper 32 bits of GPRs being preserved Greg Kroah-Hartman
` (339 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Babu Moger,
Shaopeng Tan (Fujitsu), Shuah Khan, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 51a0c3b7f028169e40db930575dd01fe81c3e765 ]
Perf event fd (fd_lm) is not closed when run_fill_buf() returns error.
Close fd_lm only in cat_val() to make it easier to track it is always
closed.
Fixes: 790bf585b0ee ("selftests/resctrl: Add Cache Allocation Technology (CAT) selftest")
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Tested-by: Babu Moger <babu.moger@amd.com>
Tested-by: Shaopeng Tan (Fujitsu) <tan.shaopeng@fujitsu.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/resctrl/cache.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/resctrl/cache.c b/tools/testing/selftests/resctrl/cache.c
index 5922cc1b03867..b3c0e858c4e07 100644
--- a/tools/testing/selftests/resctrl/cache.c
+++ b/tools/testing/selftests/resctrl/cache.c
@@ -89,21 +89,19 @@ static int reset_enable_llc_perf(pid_t pid, int cpu_no)
static int get_llc_perf(unsigned long *llc_perf_miss)
{
__u64 total_misses;
+ int ret;
/* Stop counters after one span to get miss rate */
ioctl(fd_lm, PERF_EVENT_IOC_DISABLE, 0);
- if (read(fd_lm, &rf_cqm, sizeof(struct read_format)) == -1) {
+ ret = read(fd_lm, &rf_cqm, sizeof(struct read_format));
+ if (ret == -1) {
perror("Could not get llc misses through perf");
-
return -1;
}
total_misses = rf_cqm.values[0].value;
-
- close(fd_lm);
-
*llc_perf_miss = total_misses;
return 0;
@@ -256,17 +254,23 @@ int cat_val(struct resctrl_val_param *param)
memflush, operation, resctrl_val)) {
fprintf(stderr, "Error-running fill buffer\n");
ret = -1;
- break;
+ goto pe_close;
}
sleep(1);
ret = measure_cache_vals(param, bm_pid);
if (ret)
- break;
+ goto pe_close;
+
+ close(fd_lm);
} else {
break;
}
}
return ret;
+
+pe_close:
+ close(fd_lm);
+ return ret;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 076/406] x86/decompressor: Dont rely on upper 32 bits of GPRs being preserved
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 075/406] selftests/resctrl: Close perf value read fd on errors Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 077/406] perf/imx_ddr: dont enable counter0 if none of 4 counters are used Greg Kroah-Hartman
` (338 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel,
Borislav Petkov (AMD), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 264b82fdb4989cf6a44a2bcd0c6ea05e8026b2ac ]
The 4-to-5 level mode switch trampoline disables long mode and paging in
order to be able to flick the LA57 bit. According to section 3.4.1.1 of
the x86 architecture manual [0], 64-bit GPRs might not retain the upper
32 bits of their contents across such a mode switch.
Given that RBP, RBX and RSI are live at this point, preserve them on the
stack, along with the return address that might be above 4G as well.
[0] Intel® 64 and IA-32 Architectures Software Developer’s Manual, Volume 1: Basic Architecture
"Because the upper 32 bits of 64-bit general-purpose registers are
undefined in 32-bit modes, the upper 32 bits of any general-purpose
register are not preserved when switching from 64-bit mode to a 32-bit
mode (to protected mode or compatibility mode). Software must not
depend on these bits to maintain a value after a 64-bit to 32-bit
mode switch."
Fixes: 194a9749c73d650c ("x86/boot/compressed/64: Handle 5-level paging boot if kernel is above 4G")
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/r/20230807162720.545787-2-ardb@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/boot/compressed/head_64.S | 30 +++++++++++++++++++++++-------
1 file changed, 23 insertions(+), 7 deletions(-)
diff --git a/arch/x86/boot/compressed/head_64.S b/arch/x86/boot/compressed/head_64.S
index b55e2007b30c6..473d84eb5dda9 100644
--- a/arch/x86/boot/compressed/head_64.S
+++ b/arch/x86/boot/compressed/head_64.S
@@ -454,11 +454,25 @@ SYM_CODE_START(startup_64)
/* Save the trampoline address in RCX */
movq %rax, %rcx
+ /* Set up 32-bit addressable stack */
+ leaq TRAMPOLINE_32BIT_STACK_END(%rcx), %rsp
+
+ /*
+ * Preserve live 64-bit registers on the stack: this is necessary
+ * because the architecture does not guarantee that GPRs will retain
+ * their full 64-bit values across a 32-bit mode switch.
+ */
+ pushq %rbp
+ pushq %rbx
+ pushq %rsi
+
/*
- * Load the address of trampoline_return() into RDI.
- * It will be used by the trampoline to return to the main code.
+ * Push the 64-bit address of trampoline_return() onto the new stack.
+ * It will be used by the trampoline to return to the main code. Due to
+ * the 32-bit mode switch, it cannot be kept it in a register either.
*/
leaq trampoline_return(%rip), %rdi
+ pushq %rdi
/* Switch to compatibility mode (CS.L = 0 CS.D = 1) via far return */
pushq $__KERNEL32_CS
@@ -466,6 +480,11 @@ SYM_CODE_START(startup_64)
pushq %rax
lretq
trampoline_return:
+ /* Restore live 64-bit registers */
+ popq %rsi
+ popq %rbx
+ popq %rbp
+
/* Restore the stack, the 32-bit trampoline uses its own stack */
leaq rva(boot_stack_end)(%rbx), %rsp
@@ -586,7 +605,7 @@ SYM_FUNC_END(.Lrelocated)
/*
* This is the 32-bit trampoline that will be copied over to low memory.
*
- * RDI contains the return address (might be above 4G).
+ * Return address is at the top of the stack (might be above 4G).
* ECX contains the base address of the trampoline memory.
* Non zero RDX means trampoline needs to enable 5-level paging.
*/
@@ -596,9 +615,6 @@ SYM_CODE_START(trampoline_32bit_src)
movl %eax, %ds
movl %eax, %ss
- /* Set up new stack */
- leal TRAMPOLINE_32BIT_STACK_END(%ecx), %esp
-
/* Disable paging */
movl %cr0, %eax
btrl $X86_CR0_PG_BIT, %eax
@@ -658,7 +674,7 @@ SYM_CODE_END(trampoline_32bit_src)
.code64
SYM_FUNC_START_LOCAL_NOALIGN(.Lpaging_enabled)
/* Return from the trampoline */
- jmp *%rdi
+ retq
SYM_FUNC_END(.Lpaging_enabled)
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 077/406] perf/imx_ddr: dont enable counter0 if none of 4 counters are used
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 076/406] x86/decompressor: Dont rely on upper 32 bits of GPRs being preserved Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 078/406] s390/pkey: fix/harmonize internal keyblob headers Greg Kroah-Hartman
` (337 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xu Yang, Frank Li, Will Deacon,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit f4e2bd91ddf5e8543cbe7ad80b3fba3d2dc63fa3 ]
In current driver, counter0 will be enabled after ddr_perf_pmu_enable()
is called even though none of the 4 counters are used. This will cause
counter0 continue to count until ddr_perf_pmu_disabled() is called. If
pmu is not disabled all the time, the pmu interrupt will be asserted
from time to time due to counter0 will overflow and irq handler will
clear it. It's not an expected behavior. This patch will not enable
counter0 if none of 4 counters are used.
Fixes: 9a66d36cc7ac ("drivers/perf: imx_ddr: Add DDR performance counter support to perf")
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20230811015438.1999307-2-xu.yang_2@nxp.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/fsl_imx8_ddr_perf.c | 24 +++++++++---------------
1 file changed, 9 insertions(+), 15 deletions(-)
diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_perf.c
index e09bbf3890c49..8dfb67530d6bc 100644
--- a/drivers/perf/fsl_imx8_ddr_perf.c
+++ b/drivers/perf/fsl_imx8_ddr_perf.c
@@ -82,6 +82,7 @@ struct ddr_pmu {
const struct fsl_ddr_devtype_data *devtype_data;
int irq;
int id;
+ int active_counter;
};
enum ddr_perf_filter_capabilities {
@@ -414,6 +415,10 @@ static void ddr_perf_event_start(struct perf_event *event, int flags)
ddr_perf_counter_enable(pmu, event->attr.config, counter, true);
+ if (!pmu->active_counter++)
+ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID,
+ EVENT_CYCLES_COUNTER, true);
+
hwc->state = 0;
}
@@ -468,6 +473,10 @@ static void ddr_perf_event_stop(struct perf_event *event, int flags)
ddr_perf_counter_enable(pmu, event->attr.config, counter, false);
ddr_perf_event_update(event);
+ if (!--pmu->active_counter)
+ ddr_perf_counter_enable(pmu, EVENT_CYCLES_ID,
+ EVENT_CYCLES_COUNTER, false);
+
hwc->state |= PERF_HES_STOPPED;
}
@@ -486,25 +495,10 @@ static void ddr_perf_event_del(struct perf_event *event, int flags)
static void ddr_perf_pmu_enable(struct pmu *pmu)
{
- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu);
-
- /* enable cycle counter if cycle is not active event list */
- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL)
- ddr_perf_counter_enable(ddr_pmu,
- EVENT_CYCLES_ID,
- EVENT_CYCLES_COUNTER,
- true);
}
static void ddr_perf_pmu_disable(struct pmu *pmu)
{
- struct ddr_pmu *ddr_pmu = to_ddr_pmu(pmu);
-
- if (ddr_pmu->events[EVENT_CYCLES_COUNTER] == NULL)
- ddr_perf_counter_enable(ddr_pmu,
- EVENT_CYCLES_ID,
- EVENT_CYCLES_COUNTER,
- false);
}
static int ddr_perf_init(struct ddr_pmu *pmu, void __iomem *base,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 078/406] s390/pkey: fix/harmonize internal keyblob headers
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 077/406] perf/imx_ddr: dont enable counter0 if none of 4 counters are used Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 079/406] s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs Greg Kroah-Hartman
` (336 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Holger Dengler, Ingo Franzki,
Heiko Carstens, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <dengler@linux.ibm.com>
[ Upstream commit 37a08f010b7c423b5e4c9ed3b187d21166553007 ]
Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC
private keys")' introduced PKEY_TYPE_EP11_AES as a supplement to
PKEY_TYPE_EP11. All pkeys have an internal header/payload structure,
which is opaque to the userspace. The header structures for
PKEY_TYPE_EP11 and PKEY_TYPE_EP11_AES are nearly identical and there
is no reason, why different structures are used. In preparation to fix
the keyversion handling in the broken PKEY IOCTLs, the same header
structure is used for PKEY_TYPE_EP11 and PKEY_TYPE_EP11_AES. This
reduces the number of different code paths and increases the
readability.
Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys")
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/pkey_api.c | 2 +-
drivers/s390/crypto/zcrypt_ep11misc.c | 4 ++--
drivers/s390/crypto/zcrypt_ep11misc.h | 9 +--------
3 files changed, 4 insertions(+), 11 deletions(-)
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 870e00effe439..69882ff4db107 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -735,7 +735,7 @@ static int pkey_verifykey2(const u8 *key, size_t keylen,
if (ktype)
*ktype = PKEY_TYPE_EP11;
if (ksize)
- *ksize = kb->head.keybitlen;
+ *ksize = kb->head.bitlen;
rc = ep11_findcard2(&_apqns, &_nr_apqns, *cardnr, *domain,
ZCRYPT_CEX7, EP11_API_V, kb->wkvp);
diff --git a/drivers/s390/crypto/zcrypt_ep11misc.c b/drivers/s390/crypto/zcrypt_ep11misc.c
index 9ce5a71da69b8..3daf259ba10e7 100644
--- a/drivers/s390/crypto/zcrypt_ep11misc.c
+++ b/drivers/s390/crypto/zcrypt_ep11misc.c
@@ -788,7 +788,7 @@ int ep11_genaeskey(u16 card, u16 domain, u32 keybitsize, u32 keygenflags,
kb->head.type = TOKTYPE_NON_CCA;
kb->head.len = rep_pl->data_len;
kb->head.version = TOKVER_EP11_AES;
- kb->head.keybitlen = keybitsize;
+ kb->head.bitlen = keybitsize;
out:
kfree(req);
@@ -1056,7 +1056,7 @@ static int ep11_unwrapkey(u16 card, u16 domain,
kb->head.type = TOKTYPE_NON_CCA;
kb->head.len = rep_pl->data_len;
kb->head.version = TOKVER_EP11_AES;
- kb->head.keybitlen = keybitsize;
+ kb->head.bitlen = keybitsize;
out:
kfree(req);
diff --git a/drivers/s390/crypto/zcrypt_ep11misc.h b/drivers/s390/crypto/zcrypt_ep11misc.h
index 1e02b197c0035..d424fa901f1b0 100644
--- a/drivers/s390/crypto/zcrypt_ep11misc.h
+++ b/drivers/s390/crypto/zcrypt_ep11misc.h
@@ -29,14 +29,7 @@ struct ep11keyblob {
union {
u8 session[32];
/* only used for PKEY_TYPE_EP11: */
- struct {
- u8 type; /* 0x00 (TOKTYPE_NON_CCA) */
- u8 res0; /* unused */
- u16 len; /* total length in bytes of this blob */
- u8 version; /* 0x03 (TOKVER_EP11_AES) */
- u8 res1; /* unused */
- u16 keybitlen; /* clear key bit len, 0 for unknown */
- } head;
+ struct ep11kblob_header head;
};
u8 wkvp[16]; /* wrapping key verification pattern */
u64 attr; /* boolean key attributes */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 079/406] s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 078/406] s390/pkey: fix/harmonize internal keyblob headers Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 080/406] x86/efistub: Fix PCI ROM preservation in mixed mode Greg Kroah-Hartman
` (335 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Holger Dengler, Ingo Franzki,
Heiko Carstens, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Holger Dengler <dengler@linux.ibm.com>
[ Upstream commit cba33db3fc4dbf2e54294b0e499d2335a3a00d78 ]
Commit 'fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC
private keys")' introduced PKEY_TYPE_EP11_AES securekey blobs as a
supplement to the PKEY_TYPE_EP11 (which won't work in environments
with session-bound keys). This new keyblobs has a different maximum
size, so fix paes crypto module to accept also these larger keyblobs.
Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC private keys")
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/crypto/paes_s390.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/crypto/paes_s390.c b/arch/s390/crypto/paes_s390.c
index f3caeb17c85b9..a6727ad58d65a 100644
--- a/arch/s390/crypto/paes_s390.c
+++ b/arch/s390/crypto/paes_s390.c
@@ -34,7 +34,7 @@
* and padding is also possible, the limits need to be generous.
*/
#define PAES_MIN_KEYSIZE 16
-#define PAES_MAX_KEYSIZE 320
+#define PAES_MAX_KEYSIZE MAXEP11AESKEYBLOBSIZE
static u8 *ctrblk;
static DEFINE_MUTEX(ctrblk_lock);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 080/406] x86/efistub: Fix PCI ROM preservation in mixed mode
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 079/406] s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 081/406] cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() Greg Kroah-Hartman
` (334 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mikel Rychliski, Ard Biesheuvel,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikel Rychliski <mikel@mikelr.com>
[ Upstream commit 8b94da92559f7e403dc7ab81937cc50f949ee2fd ]
preserve_pci_rom_image() was accessing the romsize field in
efi_pci_io_protocol_t directly instead of using the efi_table_attr()
helper. This prevents the ROM image from being saved correctly during a
mixed mode boot.
Fixes: 2c3625cb9fa2 ("efi/x86: Fold __setup_efi_pci32() and __setup_efi_pci64() into one function")
Signed-off-by: Mikel Rychliski <mikel@mikelr.com>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/efi/libstub/x86-stub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/firmware/efi/libstub/x86-stub.c b/drivers/firmware/efi/libstub/x86-stub.c
index 5d0f1b1966fc6..9f998e6bff957 100644
--- a/drivers/firmware/efi/libstub/x86-stub.c
+++ b/drivers/firmware/efi/libstub/x86-stub.c
@@ -60,7 +60,7 @@ preserve_pci_rom_image(efi_pci_io_protocol_t *pci, struct pci_setup_rom **__rom)
rom->data.type = SETUP_PCI;
rom->data.len = size - sizeof(struct setup_data);
rom->data.next = 0;
- rom->pcilen = pci->romsize;
+ rom->pcilen = romsize;
*__rom = rom;
status = efi_call_proto(pci, pci.read, EfiPciIoWidthUint16,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 081/406] cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 080/406] x86/efistub: Fix PCI ROM preservation in mixed mode Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 082/406] bpftool: Use a local bpf_perf_event_value to fix accessing its fields Greg Kroah-Hartman
` (333 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liao Chang, Viresh Kumar,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chang <liaochang1@huawei.com>
[ Upstream commit 03997da042dac73c69e60d91942c727c76828b65 ]
Since the 'cpus' field of policy structure will become empty in the
cpufreq core API, it is better to use 'related_cpus' in the exit()
callback of driver.
Fixes: c3274763bfc3 ("cpufreq: powernow-k8: Initialize per-cpu data-structures properly")
Signed-off-by: Liao Chang <liaochang1@huawei.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/powernow-k8.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c
index b9ccb6a3dad98..22d4c639d71db 100644
--- a/drivers/cpufreq/powernow-k8.c
+++ b/drivers/cpufreq/powernow-k8.c
@@ -1101,7 +1101,8 @@ static int powernowk8_cpu_exit(struct cpufreq_policy *pol)
kfree(data->powernow_table);
kfree(data);
- for_each_cpu(cpu, pol->cpus)
+ /* pol->cpus will be empty here, use related_cpus instead. */
+ for_each_cpu(cpu, pol->related_cpus)
per_cpu(powernow_data, cpu) = NULL;
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 082/406] bpftool: Use a local bpf_perf_event_value to fix accessing its fields
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 081/406] cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 083/406] bpf: Clear the probe_addr for uprobe Greg Kroah-Hartman
` (332 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Alexander Lobakin,
Quentin Monnet, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Lobakin <alobakin@pm.me>
[ Upstream commit 658ac06801315b739774a15796ff06913ef5cad5 ]
Fix the following error when building bpftool:
CLANG profiler.bpf.o
CLANG pid_iter.bpf.o
skeleton/profiler.bpf.c:18:21: error: invalid application of 'sizeof' to an incomplete type 'struct bpf_perf_event_value'
__uint(value_size, sizeof(struct bpf_perf_event_value));
^ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
tools/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helpers.h:13:39: note: expanded from macro '__uint'
tools/bpf/bpftool/bootstrap/libbpf/include/bpf/bpf_helper_defs.h:7:8: note: forward declaration of 'struct bpf_perf_event_value'
struct bpf_perf_event_value;
^
struct bpf_perf_event_value is being used in the kernel only when
CONFIG_BPF_EVENTS is enabled, so it misses a BTF entry then.
Define struct bpf_perf_event_value___local with the
`preserve_access_index` attribute inside the pid_iter BPF prog to
allow compiling on any configs. It is a full mirror of a UAPI
structure, so is compatible both with and w/o CO-RE.
bpf_perf_event_read_value() requires a pointer of the original type,
so a cast is needed.
Fixes: 47c09d6a9f67 ("bpftool: Introduce "prog profile" command")
Suggested-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Alexander Lobakin <alobakin@pm.me>
Signed-off-by: Quentin Monnet <quentin@isovalent.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20230707095425.168126-5-quentin@isovalent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/bpf/bpftool/skeleton/profiler.bpf.c | 27 ++++++++++++++---------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/tools/bpf/bpftool/skeleton/profiler.bpf.c b/tools/bpf/bpftool/skeleton/profiler.bpf.c
index ce5b65e07ab10..2f80edc682f11 100644
--- a/tools/bpf/bpftool/skeleton/profiler.bpf.c
+++ b/tools/bpf/bpftool/skeleton/profiler.bpf.c
@@ -4,6 +4,12 @@
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
+struct bpf_perf_event_value___local {
+ __u64 counter;
+ __u64 enabled;
+ __u64 running;
+} __attribute__((preserve_access_index));
+
/* map of perf event fds, num_cpu * num_metric entries */
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
@@ -15,14 +21,14 @@ struct {
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(key_size, sizeof(u32));
- __uint(value_size, sizeof(struct bpf_perf_event_value));
+ __uint(value_size, sizeof(struct bpf_perf_event_value___local));
} fentry_readings SEC(".maps");
/* accumulated readings */
struct {
__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
__uint(key_size, sizeof(u32));
- __uint(value_size, sizeof(struct bpf_perf_event_value));
+ __uint(value_size, sizeof(struct bpf_perf_event_value___local));
} accum_readings SEC(".maps");
/* sample counts, one per cpu */
@@ -39,7 +45,7 @@ const volatile __u32 num_metric = 1;
SEC("fentry/XXX")
int BPF_PROG(fentry_XXX)
{
- struct bpf_perf_event_value *ptrs[MAX_NUM_MATRICS];
+ struct bpf_perf_event_value___local *ptrs[MAX_NUM_MATRICS];
u32 key = bpf_get_smp_processor_id();
u32 i;
@@ -53,10 +59,10 @@ int BPF_PROG(fentry_XXX)
}
for (i = 0; i < num_metric && i < MAX_NUM_MATRICS; i++) {
- struct bpf_perf_event_value reading;
+ struct bpf_perf_event_value___local reading;
int err;
- err = bpf_perf_event_read_value(&events, key, &reading,
+ err = bpf_perf_event_read_value(&events, key, (void *)&reading,
sizeof(reading));
if (err)
return 0;
@@ -68,14 +74,14 @@ int BPF_PROG(fentry_XXX)
}
static inline void
-fexit_update_maps(u32 id, struct bpf_perf_event_value *after)
+fexit_update_maps(u32 id, struct bpf_perf_event_value___local *after)
{
- struct bpf_perf_event_value *before, diff;
+ struct bpf_perf_event_value___local *before, diff;
before = bpf_map_lookup_elem(&fentry_readings, &id);
/* only account samples with a valid fentry_reading */
if (before && before->counter) {
- struct bpf_perf_event_value *accum;
+ struct bpf_perf_event_value___local *accum;
diff.counter = after->counter - before->counter;
diff.enabled = after->enabled - before->enabled;
@@ -93,7 +99,7 @@ fexit_update_maps(u32 id, struct bpf_perf_event_value *after)
SEC("fexit/XXX")
int BPF_PROG(fexit_XXX)
{
- struct bpf_perf_event_value readings[MAX_NUM_MATRICS];
+ struct bpf_perf_event_value___local readings[MAX_NUM_MATRICS];
u32 cpu = bpf_get_smp_processor_id();
u32 i, zero = 0;
int err;
@@ -102,7 +108,8 @@ int BPF_PROG(fexit_XXX)
/* read all events before updating the maps, to reduce error */
for (i = 0; i < num_metric && i < MAX_NUM_MATRICS; i++) {
err = bpf_perf_event_read_value(&events, cpu + i * num_cpu,
- readings + i, sizeof(*readings));
+ (void *)(readings + i),
+ sizeof(*readings));
if (err)
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 083/406] bpf: Clear the probe_addr for uprobe
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 082/406] bpftool: Use a local bpf_perf_event_value to fix accessing its fields Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 084/406] tcp: tcp_enter_quickack_mode() should be static Greg Kroah-Hartman
` (331 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yafang Shao, Yonghong Song,
Jiri Olsa, Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <laoar.shao@gmail.com>
[ Upstream commit 5125e757e62f6c1d5478db4c2b61a744060ddf3f ]
To avoid returning uninitialized or random values when querying the file
descriptor (fd) and accessing probe_addr, it is necessary to clear the
variable prior to its use.
Fixes: 41bdc4b40ed6 ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY")
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Yonghong Song <yhs@fb.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20230709025630.3735-6-laoar.shao@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/trace_events.h | 3 ++-
kernel/trace/bpf_trace.c | 2 +-
kernel/trace/trace_uprobe.c | 3 ++-
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index e418065c2c909..6fb20722f49b7 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h
@@ -745,7 +745,8 @@ extern int perf_uprobe_init(struct perf_event *event,
extern void perf_uprobe_destroy(struct perf_event *event);
extern int bpf_get_uprobe_info(const struct perf_event *event,
u32 *fd_type, const char **filename,
- u64 *probe_offset, bool perf_type_tracepoint);
+ u64 *probe_offset, u64 *probe_addr,
+ bool perf_type_tracepoint);
#endif
extern int ftrace_profile_set_filter(struct perf_event *event, int event_id,
char *filter_str);
diff --git a/kernel/trace/bpf_trace.c b/kernel/trace/bpf_trace.c
index 1de9a6bf84711..71e0c1bc9759e 100644
--- a/kernel/trace/bpf_trace.c
+++ b/kernel/trace/bpf_trace.c
@@ -2174,7 +2174,7 @@ int bpf_get_perf_event_info(const struct perf_event *event, u32 *prog_id,
#ifdef CONFIG_UPROBE_EVENTS
if (flags & TRACE_EVENT_FL_UPROBE)
err = bpf_get_uprobe_info(event, fd_type, buf,
- probe_offset,
+ probe_offset, probe_addr,
event->attr.type == PERF_TYPE_TRACEPOINT);
#endif
}
diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
index f6c47361c154e..60ff36f5d7f9e 100644
--- a/kernel/trace/trace_uprobe.c
+++ b/kernel/trace/trace_uprobe.c
@@ -1422,7 +1422,7 @@ static void uretprobe_perf_func(struct trace_uprobe *tu, unsigned long func,
int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
const char **filename, u64 *probe_offset,
- bool perf_type_tracepoint)
+ u64 *probe_addr, bool perf_type_tracepoint)
{
const char *pevent = trace_event_name(event->tp_event);
const char *group = event->tp_event->class->system;
@@ -1439,6 +1439,7 @@ int bpf_get_uprobe_info(const struct perf_event *event, u32 *fd_type,
: BPF_FD_TYPE_UPROBE;
*filename = tu->filename;
*probe_offset = tu->offset;
+ *probe_addr = 0;
return 0;
}
#endif /* CONFIG_PERF_EVENTS */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 084/406] tcp: tcp_enter_quickack_mode() should be static
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 083/406] bpf: Clear the probe_addr for uprobe Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 085/406] hwrng: nomadik - keep clock enabled while hwrng is registered Greg Kroah-Hartman
` (330 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Yuchung Cheng,
Neal Cardwell, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 03b123debcbc8db987bda17ed8412cc011064c22 ]
After commit d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP"),
tcp_enter_quickack_mode() is only used from net/ipv4/tcp_input.c.
Fixes: d2ccd7bc8acd ("tcp: avoid resetting ACK timer in DCTCP")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Yuchung Cheng <ycheng@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Link: https://lore.kernel.org/r/20230718162049.1444938-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tcp.h | 1 -
net/ipv4/tcp_input.c | 3 +--
2 files changed, 1 insertion(+), 3 deletions(-)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index dcca41f3a2240..b56f346020351 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -337,7 +337,6 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos,
struct pipe_inode_info *pipe, size_t len,
unsigned int flags);
-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks);
static inline void tcp_dec_quickack_mode(struct sock *sk,
const unsigned int pkts)
{
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d6dfbb88dcf5b..b8d2c45edbe02 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -286,7 +286,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks)
icsk->icsk_ack.quick = quickacks;
}
-void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
{
struct inet_connection_sock *icsk = inet_csk(sk);
@@ -294,7 +294,6 @@ void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
inet_csk_exit_pingpong_mode(sk);
icsk->icsk_ack.ato = TCP_ATO_MIN;
}
-EXPORT_SYMBOL(tcp_enter_quickack_mode);
/* Send ACKs quickly, if "quick" count is not exhausted
* and the session is not interactive.
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 085/406] hwrng: nomadik - keep clock enabled while hwrng is registered
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 084/406] tcp: tcp_enter_quickack_mode() should be static Greg Kroah-Hartman
@ 2023-09-17 19:08 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 086/406] regmap: rbtree: Use alloc_flags for memory allocations Greg Kroah-Hartman
` (329 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:08 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin Kaiser, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kaiser <martin@kaiser.cx>
[ Upstream commit 039980de89dc9dd757418d6f296e4126cc3f86c3 ]
The nomadik driver uses devres to register itself with the hwrng core,
the driver will be unregistered from hwrng when its device goes out of
scope. This happens after the driver's remove function is called.
However, nomadik's clock is disabled in the remove function. There's a
short timeframe where nomadik is still registered with the hwrng core
although its clock is disabled. I suppose the clock must be active to
access the hardware and serve requests from the hwrng core.
Switch to devm_clk_get_enabled and let devres disable the clock and
unregister the hwrng. This avoids the race condition.
Fixes: 3e75241be808 ("hwrng: drivers - Use device-managed registration API")
Signed-off-by: Martin Kaiser <martin@kaiser.cx>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/nomadik-rng.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/char/hw_random/nomadik-rng.c b/drivers/char/hw_random/nomadik-rng.c
index e8f9621e79541..3774adf903a83 100644
--- a/drivers/char/hw_random/nomadik-rng.c
+++ b/drivers/char/hw_random/nomadik-rng.c
@@ -13,8 +13,6 @@
#include <linux/clk.h>
#include <linux/err.h>
-static struct clk *rng_clk;
-
static int nmk_rng_read(struct hwrng *rng, void *data, size_t max, bool wait)
{
void __iomem *base = (void __iomem *)rng->priv;
@@ -36,21 +34,20 @@ static struct hwrng nmk_rng = {
static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id)
{
+ struct clk *rng_clk;
void __iomem *base;
int ret;
- rng_clk = devm_clk_get(&dev->dev, NULL);
+ rng_clk = devm_clk_get_enabled(&dev->dev, NULL);
if (IS_ERR(rng_clk)) {
dev_err(&dev->dev, "could not get rng clock\n");
ret = PTR_ERR(rng_clk);
return ret;
}
- clk_prepare_enable(rng_clk);
-
ret = amba_request_regions(dev, dev->dev.init_name);
if (ret)
- goto out_clk;
+ return ret;
ret = -ENOMEM;
base = devm_ioremap(&dev->dev, dev->res.start,
resource_size(&dev->res));
@@ -64,15 +61,12 @@ static int nmk_rng_probe(struct amba_device *dev, const struct amba_id *id)
out_release:
amba_release_regions(dev);
-out_clk:
- clk_disable_unprepare(rng_clk);
return ret;
}
static void nmk_rng_remove(struct amba_device *dev)
{
amba_release_regions(dev);
- clk_disable_unprepare(rng_clk);
}
static const struct amba_id nmk_rng_ids[] = {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 086/406] regmap: rbtree: Use alloc_flags for memory allocations
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-09-17 19:08 ` [PATCH 5.10 085/406] hwrng: nomadik - keep clock enabled while hwrng is registered Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 087/406] udp: re-score reuseport groups when connected sockets are present Greg Kroah-Hartman
` (328 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Dan Carpenter,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 0c8b0bf42c8cef56f7cd9cd876fbb7ece9217064 ]
The kunit tests discovered a sleeping in atomic bug. The allocations
in the regcache-rbtree code should use the map->alloc_flags instead of
GFP_KERNEL.
[ 5.005510] BUG: sleeping function called from invalid context at include/linux/sched/mm.h:306
[ 5.005960] in_atomic(): 1, irqs_disabled(): 128, non_block: 0, pid: 117, name: kunit_try_catch
[ 5.006219] preempt_count: 1, expected: 0
[ 5.006414] 1 lock held by kunit_try_catch/117:
[ 5.006590] #0: 833b9010 (regmap_kunit:86:(config)->lock){....}-{2:2}, at: regmap_lock_spinlock+0x14/0x1c
[ 5.007493] irq event stamp: 162
[ 5.007627] hardirqs last enabled at (161): [<80786738>] crng_make_state+0x1a0/0x294
[ 5.007871] hardirqs last disabled at (162): [<80c531ec>] _raw_spin_lock_irqsave+0x7c/0x80
[ 5.008119] softirqs last enabled at (0): [<801110ac>] copy_process+0x810/0x2138
[ 5.008356] softirqs last disabled at (0): [<00000000>] 0x0
[ 5.008688] CPU: 0 PID: 117 Comm: kunit_try_catch Tainted: G N 6.4.4-rc3-g0e8d2fdfb188 #1
[ 5.009011] Hardware name: Generic DT based system
[ 5.009277] unwind_backtrace from show_stack+0x18/0x1c
[ 5.009497] show_stack from dump_stack_lvl+0x38/0x5c
[ 5.009676] dump_stack_lvl from __might_resched+0x188/0x2d0
[ 5.009860] __might_resched from __kmem_cache_alloc_node+0x1dc/0x25c
[ 5.010061] __kmem_cache_alloc_node from kmalloc_trace+0x30/0xc8
[ 5.010254] kmalloc_trace from regcache_rbtree_write+0x26c/0x468
[ 5.010446] regcache_rbtree_write from _regmap_write+0x88/0x140
[ 5.010634] _regmap_write from regmap_write+0x44/0x68
[ 5.010803] regmap_write from basic_read_write+0x8c/0x270
[ 5.010980] basic_read_write from kunit_try_run_case+0x48/0xa0
Fixes: 28644c809f44 ("regmap: Add the rbtree cache support")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/all/ee59d128-413c-48ad-a3aa-d9d350c80042@roeck-us.net/
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/58f12a07-5f4b-4a8f-ab84-0a42d1908cb9@moroto.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/regmap/regcache-rbtree.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
index fabf87058d80b..ae6b8788d5f3f 100644
--- a/drivers/base/regmap/regcache-rbtree.c
+++ b/drivers/base/regmap/regcache-rbtree.c
@@ -277,7 +277,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
blk = krealloc(rbnode->block,
blklen * map->cache_word_size,
- GFP_KERNEL);
+ map->alloc_flags);
if (!blk)
return -ENOMEM;
@@ -286,7 +286,7 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
present = krealloc(rbnode->cache_present,
BITS_TO_LONGS(blklen) * sizeof(*present),
- GFP_KERNEL);
+ map->alloc_flags);
if (!present)
return -ENOMEM;
@@ -320,7 +320,7 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
const struct regmap_range *range;
int i;
- rbnode = kzalloc(sizeof(*rbnode), GFP_KERNEL);
+ rbnode = kzalloc(sizeof(*rbnode), map->alloc_flags);
if (!rbnode)
return NULL;
@@ -346,13 +346,13 @@ regcache_rbtree_node_alloc(struct regmap *map, unsigned int reg)
}
rbnode->block = kmalloc_array(rbnode->blklen, map->cache_word_size,
- GFP_KERNEL);
+ map->alloc_flags);
if (!rbnode->block)
goto err_free;
rbnode->cache_present = kcalloc(BITS_TO_LONGS(rbnode->blklen),
sizeof(*rbnode->cache_present),
- GFP_KERNEL);
+ map->alloc_flags);
if (!rbnode->cache_present)
goto err_free_block;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 087/406] udp: re-score reuseport groups when connected sockets are present
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 086/406] regmap: rbtree: Use alloc_flags for memory allocations Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 088/406] bpf: reject unhashed sockets in bpf_sk_assign Greg Kroah-Hartman
` (327 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Lorenz Bauer,
Martin KaFai Lau, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenz Bauer <lmb@isovalent.com>
[ Upstream commit f0ea27e7bfe1c34e1f451a63eb68faa1d4c3a86d ]
Contrary to TCP, UDP reuseport groups can contain TCP_ESTABLISHED
sockets. To support these properly we remember whether a group has
a connected socket and skip the fast reuseport early-return. In
effect we continue scoring all reuseport sockets and then choose the
one with the highest score.
The current code fails to re-calculate the score for the result of
lookup_reuseport. According to Kuniyuki Iwashima:
1) SO_INCOMING_CPU is set
-> selected sk might have +1 score
2) BPF prog returns ESTABLISHED and/or SO_INCOMING_CPU sk
-> selected sk will have more than 8
Using the old score could trigger more lookups depending on the
order that sockets are created.
sk -> sk (SO_INCOMING_CPU) -> sk (ESTABLISHED)
| |
`-> select the next SO_INCOMING_CPU sk
|
`-> select itself (We should save this lookup)
Fixes: efc6b6f6c311 ("udp: Improve load balancing for SO_REUSEPORT.")
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-1-7021b683cdae@isovalent.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/udp.c | 20 +++++++++++++++-----
net/ipv6/udp.c | 19 ++++++++++++++-----
2 files changed, 29 insertions(+), 10 deletions(-)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f0db66e415bd6..913966e7703fc 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -443,14 +443,24 @@ static struct sock *udp4_lib_lookup2(struct net *net,
score = compute_score(sk, net, saddr, sport,
daddr, hnum, dif, sdif);
if (score > badness) {
- result = lookup_reuseport(net, sk, skb,
- saddr, sport, daddr, hnum);
+ badness = score;
+ result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum);
+ if (!result) {
+ result = sk;
+ continue;
+ }
+
/* Fall back to scoring if group has connections */
- if (result && !reuseport_has_conns(sk))
+ if (!reuseport_has_conns(sk))
return result;
- result = result ? : sk;
- badness = score;
+ /* Reuseport logic returned an error, keep original score. */
+ if (IS_ERR(result))
+ continue;
+
+ badness = compute_score(result, net, saddr, sport,
+ daddr, hnum, dif, sdif);
+
}
}
return result;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 788bb19f32e99..5385037209a6b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -189,14 +189,23 @@ static struct sock *udp6_lib_lookup2(struct net *net,
score = compute_score(sk, net, saddr, sport,
daddr, hnum, dif, sdif);
if (score > badness) {
- result = lookup_reuseport(net, sk, skb,
- saddr, sport, daddr, hnum);
+ badness = score;
+ result = lookup_reuseport(net, sk, skb, saddr, sport, daddr, hnum);
+ if (!result) {
+ result = sk;
+ continue;
+ }
+
/* Fall back to scoring if group has connections */
- if (result && !reuseport_has_conns(sk))
+ if (!reuseport_has_conns(sk))
return result;
- result = result ? : sk;
- badness = score;
+ /* Reuseport logic returned an error, keep original score. */
+ if (IS_ERR(result))
+ continue;
+
+ badness = compute_score(sk, net, saddr, sport,
+ daddr, hnum, dif, sdif);
}
}
return result;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 088/406] bpf: reject unhashed sockets in bpf_sk_assign
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 087/406] udp: re-score reuseport groups when connected sockets are present Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 089/406] wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH Greg Kroah-Hartman
` (326 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Stringer, Lorenz Bauer,
Kuniyuki Iwashima, Martin KaFai Lau, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenz Bauer <lmb@isovalent.com>
[ Upstream commit 67312adc96b5a585970d03b62412847afe2c6b01 ]
The semantics for bpf_sk_assign are as follows:
sk = some_lookup_func()
bpf_sk_assign(skb, sk)
bpf_sk_release(sk)
That is, the sk is not consumed by bpf_sk_assign. The function
therefore needs to make sure that sk lives long enough to be
consumed from __inet_lookup_skb. The path through the stack for a
TCPv4 packet is roughly:
netif_receive_skb_core: takes RCU read lock
__netif_receive_skb_core:
sch_handle_ingress:
tcf_classify:
bpf_sk_assign()
deliver_ptype_list_skb:
deliver_skb:
ip_packet_type->func == ip_rcv:
ip_rcv_core:
ip_rcv_finish_core:
dst_input:
ip_local_deliver:
ip_local_deliver_finish:
ip_protocol_deliver_rcu:
tcp_v4_rcv:
__inet_lookup_skb:
skb_steal_sock
The existing helper takes advantage of the fact that everything
happens in the same RCU critical section: for sockets with
SOCK_RCU_FREE set bpf_sk_assign never takes a reference.
skb_steal_sock then checks SOCK_RCU_FREE again and does sock_put
if necessary.
This approach assumes that SOCK_RCU_FREE is never set on a sk
between bpf_sk_assign and skb_steal_sock, but this invariant is
violated by unhashed UDP sockets. A new UDP socket is created
in TCP_CLOSE state but without SOCK_RCU_FREE set. That flag is only
added in udp_lib_get_port() which happens when a socket is bound.
When bpf_sk_assign was added it wasn't possible to access unhashed
UDP sockets from BPF, so this wasn't a problem. This changed
in commit 0c48eefae712 ("sock_map: Lift socket state restriction
for datagram sockets"), but the helper wasn't adjusted accordingly.
The following sequence of events will therefore lead to a refcount
leak:
1. Add socket(AF_INET, SOCK_DGRAM) to a sockmap.
2. Pull socket out of sockmap and bpf_sk_assign it. Since
SOCK_RCU_FREE is not set we increment the refcount.
3. bind() or connect() the socket, setting SOCK_RCU_FREE.
4. skb_steal_sock will now set refcounted = false due to
SOCK_RCU_FREE.
5. tcp_v4_rcv() skips sock_put().
Fix the problem by rejecting unhashed sockets in bpf_sk_assign().
This matches the behaviour of __inet_lookup_skb which is ultimately
the goal of bpf_sk_assign().
Fixes: cf7fbe660f2d ("bpf: Add socket assign support")
Cc: Joe Stringer <joe@cilium.io>
Signed-off-by: Lorenz Bauer <lmb@isovalent.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20230720-so-reuseport-v6-2-7021b683cdae@isovalent.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/filter.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/core/filter.c b/net/core/filter.c
index b9c954182b375..ea8ab9c704832 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -6661,6 +6661,8 @@ BPF_CALL_3(bpf_sk_assign, struct sk_buff *, skb, struct sock *, sk, u64, flags)
return -ENETUNREACH;
if (unlikely(sk_fullsock(sk) && sk->sk_reuseport))
return -ESOCKTNOSUPPORT;
+ if (sk_unhashed(sk))
+ return -EOPNOTSUPP;
if (sk_is_refcounted(sk) &&
unlikely(!refcount_inc_not_zero(&sk->sk_refcnt)))
return -ENOENT;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 089/406] wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 088/406] bpf: reject unhashed sockets in bpf_sk_assign Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 090/406] spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() Greg Kroah-Hartman
` (325 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lin Ma, Felix Fietkau, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 74f12d511625e603fac8c0c2b6872e687e56dd61 ]
It seems that the nla_policy in mt76_tm_policy is missed for attribute
MT76_TM_ATTR_TX_LENGTH. This patch adds the correct description to make
sure the
u32 val = nla_get_u32(tb[MT76_TM_ATTR_TX_LENGTH]);
in function mt76_testmode_cmd() is safe and will not result in
out-of-attribute read.
Fixes: f0efa8621550 ("mt76: add API for testmode support")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/mediatek/mt76/testmode.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/mediatek/mt76/testmode.c b/drivers/net/wireless/mediatek/mt76/testmode.c
index 883f59c7a7e4a..7ab99efb7f9b0 100644
--- a/drivers/net/wireless/mediatek/mt76/testmode.c
+++ b/drivers/net/wireless/mediatek/mt76/testmode.c
@@ -6,6 +6,7 @@ static const struct nla_policy mt76_tm_policy[NUM_MT76_TM_ATTRS] = {
[MT76_TM_ATTR_RESET] = { .type = NLA_FLAG },
[MT76_TM_ATTR_STATE] = { .type = NLA_U8 },
[MT76_TM_ATTR_TX_COUNT] = { .type = NLA_U32 },
+ [MT76_TM_ATTR_TX_LENGTH] = { .type = NLA_U32 },
[MT76_TM_ATTR_TX_RATE_MODE] = { .type = NLA_U8 },
[MT76_TM_ATTR_TX_RATE_NSS] = { .type = NLA_U8 },
[MT76_TM_ATTR_TX_RATE_IDX] = { .type = NLA_U8 },
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 090/406] spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 089/406] wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 091/406] can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM Greg Kroah-Hartman
` (324 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhang Shurong, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit 29a449e765ff70a5bd533be94babb6d36985d096 ]
The platform_get_irq might be failed and return a negative result. So
there should have an error handling code.
Fixed this by adding an error handling code.
Fixes: 8528547bcc33 ("spi: tegra: add spi driver for sflash controller")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Link: https://lore.kernel.org/r/tencent_71FC162D589E4788C2152AAC84CD8D5C6D06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-tegra20-sflash.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/spi-tegra20-sflash.c b/drivers/spi/spi-tegra20-sflash.c
index cfb7de7379376..62e50830b7f95 100644
--- a/drivers/spi/spi-tegra20-sflash.c
+++ b/drivers/spi/spi-tegra20-sflash.c
@@ -456,7 +456,11 @@ static int tegra_sflash_probe(struct platform_device *pdev)
goto exit_free_master;
}
- tsd->irq = platform_get_irq(pdev, 0);
+ ret = platform_get_irq(pdev, 0);
+ if (ret < 0)
+ goto exit_free_master;
+ tsd->irq = ret;
+
ret = request_irq(tsd->irq, tegra_sflash_isr, 0,
dev_name(&pdev->dev), tsd);
if (ret < 0) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 091/406] can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 090/406] spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 092/406] wifi: mwifiex: Fix OOB and integer underflow when rx packets Greg Kroah-Hartman
` (323 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
[ Upstream commit 6c8bc15f02b85bc8f47074110d8fd8caf7a1e42d ]
In case of an RX overflow error from the CAN controller and an OOM
where no skb can be allocated, the error counters are not incremented.
Fix this by first incrementing the error counters and then allocate
the skb.
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Link: https://lore.kernel.org/all/20230718-gs_usb-cleanups-v1-7-c3b9154ec605@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/gs_usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index 1f81293f137c9..864db200f45e5 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -381,6 +381,9 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
}
if (hf->flags & GS_CAN_FLAG_OVERFLOW) {
+ stats->rx_over_errors++;
+ stats->rx_errors++;
+
skb = alloc_can_err_skb(netdev, &cf);
if (!skb)
goto resubmit_urb;
@@ -388,8 +391,6 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
cf->can_id |= CAN_ERR_CRTL;
cf->can_dlc = CAN_ERR_DLC;
cf->data[1] = CAN_ERR_CRTL_RX_OVERFLOW;
- stats->rx_over_errors++;
- stats->rx_errors++;
netif_rx(skb);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 092/406] wifi: mwifiex: Fix OOB and integer underflow when rx packets
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 091/406] can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 093/406] wifi: mwifiex: fix error recovery in PCIE buffer descriptor management Greg Kroah-Hartman
` (322 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Polaris Pi, Matthew Wang,
Brian Norris, Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Polaris Pi <pinkperfect2021@gmail.com>
[ Upstream commit 11958528161731c58e105b501ed60b83a91ea941 ]
Make sure mwifiex_process_mgmt_packet,
mwifiex_process_sta_rx_packet and mwifiex_process_uap_rx_packet,
mwifiex_uap_queue_bridged_pkt and mwifiex_process_rx_packet
not out-of-bounds access the skb->data buffer.
Fixes: 2dbaf751b1de ("mwifiex: report received management frames to cfg80211")
Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
Reviewed-by: Matthew Wang <matthewmwang@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230723070741.1544662-1-pinkperfect2021@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/sta_rx.c | 11 ++++++++++-
.../net/wireless/marvell/mwifiex/uap_txrx.c | 19 +++++++++++++++++++
drivers/net/wireless/marvell/mwifiex/util.c | 10 +++++++---
3 files changed, 36 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
index 0d2adf8879005..685a5b6697046 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -98,6 +98,14 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
rx_pkt_len = le16_to_cpu(local_rx_pd->rx_pkt_length);
rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_off;
+ if (sizeof(*rx_pkt_hdr) + rx_pkt_off > skb->len) {
+ mwifiex_dbg(priv->adapter, ERROR,
+ "wrong rx packet offset: len=%d, rx_pkt_off=%d\n",
+ skb->len, rx_pkt_off);
+ priv->stats.rx_dropped++;
+ dev_kfree_skb_any(skb);
+ }
+
if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
sizeof(bridge_tunnel_header))) ||
(!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
@@ -206,7 +214,8 @@ int mwifiex_process_sta_rx_packet(struct mwifiex_private *priv,
rx_pkt_hdr = (void *)local_rx_pd + rx_pkt_offset;
- if ((rx_pkt_offset + rx_pkt_length) > (u16) skb->len) {
+ if ((rx_pkt_offset + rx_pkt_length) > skb->len ||
+ sizeof(rx_pkt_hdr->eth803_hdr) + rx_pkt_offset > skb->len) {
mwifiex_dbg(adapter, ERROR,
"wrong rx packet: len=%d, rx_pkt_offset=%d, rx_pkt_length=%d\n",
skb->len, rx_pkt_offset, rx_pkt_length);
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
index 9bbdb8dfce62a..f46afd7f1b6a4 100644
--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -115,6 +115,15 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
return;
}
+ if (sizeof(*rx_pkt_hdr) +
+ le16_to_cpu(uap_rx_pd->rx_pkt_offset) > skb->len) {
+ mwifiex_dbg(adapter, ERROR,
+ "wrong rx packet offset: len=%d,rx_pkt_offset=%d\n",
+ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
+ priv->stats.rx_dropped++;
+ dev_kfree_skb_any(skb);
+ }
+
if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
sizeof(bridge_tunnel_header))) ||
(!memcmp(&rx_pkt_hdr->rfc1042_hdr, rfc1042_header,
@@ -379,6 +388,16 @@ int mwifiex_process_uap_rx_packet(struct mwifiex_private *priv,
rx_pkt_type = le16_to_cpu(uap_rx_pd->rx_pkt_type);
rx_pkt_hdr = (void *)uap_rx_pd + le16_to_cpu(uap_rx_pd->rx_pkt_offset);
+ if (le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
+ sizeof(rx_pkt_hdr->eth803_hdr) > skb->len) {
+ mwifiex_dbg(adapter, ERROR,
+ "wrong rx packet for struct ethhdr: len=%d, offset=%d\n",
+ skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
+ priv->stats.rx_dropped++;
+ dev_kfree_skb_any(skb);
+ return 0;
+ }
+
ether_addr_copy(ta, rx_pkt_hdr->eth803_hdr.h_source);
if ((le16_to_cpu(uap_rx_pd->rx_pkt_offset) +
diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
index d583fa600a296..1f5a6dab9ce55 100644
--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -405,11 +405,15 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
}
rx_pd = (struct rxpd *)skb->data;
+ pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
+ if (pkt_len < sizeof(struct ieee80211_hdr) + sizeof(pkt_len)) {
+ mwifiex_dbg(priv->adapter, ERROR, "invalid rx_pkt_length");
+ return -1;
+ }
skb_pull(skb, le16_to_cpu(rx_pd->rx_pkt_offset));
skb_pull(skb, sizeof(pkt_len));
-
- pkt_len = le16_to_cpu(rx_pd->rx_pkt_length);
+ pkt_len -= sizeof(pkt_len);
ieee_hdr = (void *)skb->data;
if (ieee80211_is_mgmt(ieee_hdr->frame_control)) {
@@ -422,7 +426,7 @@ mwifiex_process_mgmt_packet(struct mwifiex_private *priv,
skb->data + sizeof(struct ieee80211_hdr),
pkt_len - sizeof(struct ieee80211_hdr));
- pkt_len -= ETH_ALEN + sizeof(pkt_len);
+ pkt_len -= ETH_ALEN;
rx_pd->rx_pkt_length = cpu_to_le16(pkt_len);
cfg80211_rx_mgmt(&priv->wdev, priv->roc_cfg.chan.center_freq,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 093/406] wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 092/406] wifi: mwifiex: Fix OOB and integer underflow when rx packets Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 094/406] selftests/bpf: fix static assert compilation issue for test_cls_*.c Greg Kroah-Hartman
` (321 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Antipov, Brian Norris,
Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 288c63d5cb4667a51a04668b3e2bb0ea499bc5f4 ]
Add missing 'kfree_skb()' in 'mwifiex_init_rxq_ring()' and never do
'kfree(card->rxbd_ring_vbase)' because this area is DMAed and should
be released with 'dma_free_coherent()'. The latter is performed in
'mwifiex_pcie_delete_rxbd_ring()', which is now called to recover
from possible errors in 'mwifiex_pcie_create_rxbd_ring()'. Likewise
for 'mwifiex_pcie_init_evt_ring()', 'kfree(card->evtbd_ring_vbase)'
'mwifiex_pcie_delete_evtbd_ring()' and 'mwifiex_pcie_create_rxbd_ring()'.
Fixes: d930faee141b ("mwifiex: add support for Marvell pcie8766 chipset")
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230731074334.56463-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/pcie.c | 25 ++++++++++++++-------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index 50c34630ca302..7cec6398da71c 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -200,6 +200,8 @@ static int mwifiex_pcie_probe_of(struct device *dev)
}
static void mwifiex_pcie_work(struct work_struct *work);
+static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter);
+static int mwifiex_pcie_delete_evtbd_ring(struct mwifiex_adapter *adapter);
static int
mwifiex_map_pci_memory(struct mwifiex_adapter *adapter, struct sk_buff *skb,
@@ -794,14 +796,15 @@ static int mwifiex_init_rxq_ring(struct mwifiex_adapter *adapter)
if (!skb) {
mwifiex_dbg(adapter, ERROR,
"Unable to allocate skb for RX ring.\n");
- kfree(card->rxbd_ring_vbase);
return -ENOMEM;
}
if (mwifiex_map_pci_memory(adapter, skb,
MWIFIEX_RX_DATA_BUF_SIZE,
- DMA_FROM_DEVICE))
- return -1;
+ DMA_FROM_DEVICE)) {
+ kfree_skb(skb);
+ return -ENOMEM;
+ }
buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
@@ -851,7 +854,6 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
if (!skb) {
mwifiex_dbg(adapter, ERROR,
"Unable to allocate skb for EVENT buf.\n");
- kfree(card->evtbd_ring_vbase);
return -ENOMEM;
}
skb_put(skb, MAX_EVENT_SIZE);
@@ -859,8 +861,7 @@ static int mwifiex_pcie_init_evt_ring(struct mwifiex_adapter *adapter)
if (mwifiex_map_pci_memory(adapter, skb, MAX_EVENT_SIZE,
DMA_FROM_DEVICE)) {
kfree_skb(skb);
- kfree(card->evtbd_ring_vbase);
- return -1;
+ return -ENOMEM;
}
buf_pa = MWIFIEX_SKB_DMA_ADDR(skb);
@@ -1060,6 +1061,7 @@ static int mwifiex_pcie_delete_txbd_ring(struct mwifiex_adapter *adapter)
*/
static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
{
+ int ret;
struct pcie_service_card *card = adapter->card;
const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
@@ -1098,7 +1100,10 @@ static int mwifiex_pcie_create_rxbd_ring(struct mwifiex_adapter *adapter)
(u32)((u64)card->rxbd_ring_pbase >> 32),
card->rxbd_ring_size);
- return mwifiex_init_rxq_ring(adapter);
+ ret = mwifiex_init_rxq_ring(adapter);
+ if (ret)
+ mwifiex_pcie_delete_rxbd_ring(adapter);
+ return ret;
}
/*
@@ -1129,6 +1134,7 @@ static int mwifiex_pcie_delete_rxbd_ring(struct mwifiex_adapter *adapter)
*/
static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
{
+ int ret;
struct pcie_service_card *card = adapter->card;
const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
@@ -1163,7 +1169,10 @@ static int mwifiex_pcie_create_evtbd_ring(struct mwifiex_adapter *adapter)
(u32)((u64)card->evtbd_ring_pbase >> 32),
card->evtbd_ring_size);
- return mwifiex_pcie_init_evt_ring(adapter);
+ ret = mwifiex_pcie_init_evt_ring(adapter);
+ if (ret)
+ mwifiex_pcie_delete_evtbd_ring(adapter);
+ return ret;
}
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 094/406] selftests/bpf: fix static assert compilation issue for test_cls_*.c
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 093/406] wifi: mwifiex: fix error recovery in PCIE buffer descriptor management Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 095/406] crypto: stm32 - Properly handle pm_runtime_get failing Greg Kroah-Hartman
` (320 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colm Harrington, Alan Maguire,
Yipeng Zou, Yonghong Song, Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <alan.maguire@oracle.com>
[ Upstream commit 416c6d01244ecbf0abfdb898fd091b50ef951b48 ]
commit bdeeed3498c7 ("libbpf: fix offsetof() and container_of() to work with CO-RE")
...was backported to stable trees such as 5.15. The problem is that with older
LLVM/clang (14/15) - which is often used for older kernels - we see compilation
failures in BPF selftests now:
In file included from progs/test_cls_redirect_subprogs.c:2:
progs/test_cls_redirect.c:90:2: error: static assertion expression is not an integral constant expression
sizeof(flow_ports_t) !=
^~~~~~~~~~~~~~~~~~~~~~~
progs/test_cls_redirect.c:91:3: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression
offsetofend(struct bpf_sock_tuple, ipv4.dport) -
^
progs/test_cls_redirect.c:32:3: note: expanded from macro 'offsetofend'
(offsetof(TYPE, MEMBER) + sizeof((((TYPE *)0)->MEMBER)))
^
tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:86:33: note: expanded from macro 'offsetof'
^
In file included from progs/test_cls_redirect_subprogs.c:2:
progs/test_cls_redirect.c:95:2: error: static assertion expression is not an integral constant expression
sizeof(flow_ports_t) !=
^~~~~~~~~~~~~~~~~~~~~~~
progs/test_cls_redirect.c:96:3: note: cast that performs the conversions of a reinterpret_cast is not allowed in a constant expression
offsetofend(struct bpf_sock_tuple, ipv6.dport) -
^
progs/test_cls_redirect.c:32:3: note: expanded from macro 'offsetofend'
(offsetof(TYPE, MEMBER) + sizeof((((TYPE *)0)->MEMBER)))
^
tools/testing/selftests/bpf/tools/include/bpf/bpf_helpers.h:86:33: note: expanded from macro 'offsetof'
^
2 errors generated.
make: *** [Makefile:594: tools/testing/selftests/bpf/test_cls_redirect_subprogs.bpf.o] Error 1
The problem is the new offsetof() does not play nice with static asserts.
Given that the context is a static assert (and CO-RE relocation is not
needed at compile time), offsetof() usage can be replaced by restoring
the original offsetof() definition as __builtin_offsetof().
Fixes: bdeeed3498c7 ("libbpf: fix offsetof() and container_of() to work with CO-RE")
Reported-by: Colm Harrington <colm.harrington@oracle.com>
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Tested-by: Yipeng Zou <zouyipeng@huawei.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/20230802073906.3197480-1-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/progs/test_cls_redirect.h | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/tools/testing/selftests/bpf/progs/test_cls_redirect.h b/tools/testing/selftests/bpf/progs/test_cls_redirect.h
index 76eab0aacba0c..233b089d1fbac 100644
--- a/tools/testing/selftests/bpf/progs/test_cls_redirect.h
+++ b/tools/testing/selftests/bpf/progs/test_cls_redirect.h
@@ -12,6 +12,15 @@
#include <linux/ipv6.h>
#include <linux/udp.h>
+/* offsetof() is used in static asserts, and the libbpf-redefined CO-RE
+ * friendly version breaks compilation for older clang versions <= 15
+ * when invoked in a static assert. Restore original here.
+ */
+#ifdef offsetof
+#undef offsetof
+#define offsetof(type, member) __builtin_offsetof(type, member)
+#endif
+
struct gre_base_hdr {
uint16_t flags;
uint16_t protocol;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 095/406] crypto: stm32 - Properly handle pm_runtime_get failing
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 094/406] selftests/bpf: fix static assert compilation issue for test_cls_*.c Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation Greg Kroah-Hartman
` (319 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit aec48805163338f8413118796c1dd035661b9140 ]
If pm_runtime_get() (disguised as pm_runtime_resume_and_get()) fails, this
means the clk wasn't prepared and enabled. Returning early in this case
however is wrong as then the following resource frees are skipped and this
is never catched up. So do all the cleanups but clk_disable_unprepare().
Also don't emit a warning, as stm32_hash_runtime_resume() already emitted
one.
Note that the return value of stm32_hash_remove() is mostly ignored by
the device core. The only effect of returning zero instead of an error
value is to suppress another warning in platform_remove(). So return 0
even if pm_runtime_resume_and_get() failed.
Fixes: 8b4d566de6a5 ("crypto: stm32/hash - Add power management support")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/stm32/stm32-hash.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index 16bb52836b28d..2f2a426a6cd5c 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -1565,9 +1565,7 @@ static int stm32_hash_remove(struct platform_device *pdev)
if (!hdev)
return -ENODEV;
- ret = pm_runtime_resume_and_get(hdev->dev);
- if (ret < 0)
- return ret;
+ ret = pm_runtime_get_sync(hdev->dev);
stm32_hash_unregister_algs(hdev);
@@ -1583,7 +1581,8 @@ static int stm32_hash_remove(struct platform_device *pdev)
pm_runtime_disable(hdev->dev);
pm_runtime_put_noidle(hdev->dev);
- clk_disable_unprepare(hdev->clk);
+ if (ret >= 0)
+ clk_disable_unprepare(hdev->clk);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 095/406] crypto: stm32 - Properly handle pm_runtime_get failing Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-18 2:53 ` Eric Biggers
2023-09-17 19:09 ` [PATCH 5.10 097/406] crypto: api - Use work queue in crypto_destroy_instance Greg Kroah-Hartman
` (318 subsequent siblings)
414 siblings, 1 reply; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Ard Biesheuvel,
Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
[ Upstream commit 28dcca4cc0c01e2467549a36b1b0eacfdb01236c ]
Sync the BLAKE2b code with the BLAKE2s code as much as possible:
- Move a lot of code into new headers <crypto/blake2b.h> and
<crypto/internal/blake2b.h>, and adjust it to be like the
corresponding BLAKE2s code, i.e. like <crypto/blake2s.h> and
<crypto/internal/blake2s.h>.
- Rename constants, e.g. BLAKE2B_*_DIGEST_SIZE => BLAKE2B_*_HASH_SIZE.
- Use a macro BLAKE2B_ALG() to define the shash_alg structs.
- Export blake2b_compress_generic() for use as a fallback.
This makes it much easier to add optimized implementations of BLAKE2b,
as optimized implementations can use the helper functions
crypto_blake2b_{setkey,init,update,final}() and
blake2b_compress_generic(). The ARM implementation will use these.
But this change is also helpful because it eliminates unnecessary
differences between the BLAKE2b and BLAKE2s code, so that the same
improvements can easily be made to both. (The two algorithms are
basically identical, except for the word size and constants.) It also
makes it straightforward to add a library API for BLAKE2b in the future
if/when it's needed.
This change does make the BLAKE2b code slightly more complicated than it
needs to be, as it doesn't actually provide a library API yet. For
example, __blake2b_update() doesn't really need to exist yet; it could
just be inlined into crypto_blake2b_update(). But I believe this is
outweighed by the benefits of keeping the code in sync.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: 9ae4577bc077 ("crypto: api - Use work queue in crypto_destroy_instance")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/blake2b_generic.c | 226 +++++++-----------------------
include/crypto/blake2b.h | 67 +++++++++
include/crypto/internal/blake2b.h | 115 +++++++++++++++
3 files changed, 230 insertions(+), 178 deletions(-)
create mode 100644 include/crypto/blake2b.h
create mode 100644 include/crypto/internal/blake2b.h
diff --git a/crypto/blake2b_generic.c b/crypto/blake2b_generic.c
index a2ffe60e06d34..963f7fe0e4ea8 100644
--- a/crypto/blake2b_generic.c
+++ b/crypto/blake2b_generic.c
@@ -20,36 +20,11 @@
#include <asm/unaligned.h>
#include <linux/module.h>
-#include <linux/string.h>
#include <linux/kernel.h>
#include <linux/bitops.h>
+#include <crypto/internal/blake2b.h>
#include <crypto/internal/hash.h>
-#define BLAKE2B_160_DIGEST_SIZE (160 / 8)
-#define BLAKE2B_256_DIGEST_SIZE (256 / 8)
-#define BLAKE2B_384_DIGEST_SIZE (384 / 8)
-#define BLAKE2B_512_DIGEST_SIZE (512 / 8)
-
-enum blake2b_constant {
- BLAKE2B_BLOCKBYTES = 128,
- BLAKE2B_KEYBYTES = 64,
-};
-
-struct blake2b_state {
- u64 h[8];
- u64 t[2];
- u64 f[2];
- u8 buf[BLAKE2B_BLOCKBYTES];
- size_t buflen;
-};
-
-static const u64 blake2b_IV[8] = {
- 0x6a09e667f3bcc908ULL, 0xbb67ae8584caa73bULL,
- 0x3c6ef372fe94f82bULL, 0xa54ff53a5f1d36f1ULL,
- 0x510e527fade682d1ULL, 0x9b05688c2b3e6c1fULL,
- 0x1f83d9abfb41bd6bULL, 0x5be0cd19137e2179ULL
-};
-
static const u8 blake2b_sigma[12][16] = {
{ 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 },
{ 14, 10, 4, 8, 9, 15, 13, 6, 1, 12, 0, 2, 11, 7, 5, 3 },
@@ -95,8 +70,8 @@ static void blake2b_increment_counter(struct blake2b_state *S, const u64 inc)
G(r,7,v[ 3],v[ 4],v[ 9],v[14]); \
} while (0)
-static void blake2b_compress(struct blake2b_state *S,
- const u8 block[BLAKE2B_BLOCKBYTES])
+static void blake2b_compress_one_generic(struct blake2b_state *S,
+ const u8 block[BLAKE2B_BLOCK_SIZE])
{
u64 m[16];
u64 v[16];
@@ -108,14 +83,14 @@ static void blake2b_compress(struct blake2b_state *S,
for (i = 0; i < 8; ++i)
v[i] = S->h[i];
- v[ 8] = blake2b_IV[0];
- v[ 9] = blake2b_IV[1];
- v[10] = blake2b_IV[2];
- v[11] = blake2b_IV[3];
- v[12] = blake2b_IV[4] ^ S->t[0];
- v[13] = blake2b_IV[5] ^ S->t[1];
- v[14] = blake2b_IV[6] ^ S->f[0];
- v[15] = blake2b_IV[7] ^ S->f[1];
+ v[ 8] = BLAKE2B_IV0;
+ v[ 9] = BLAKE2B_IV1;
+ v[10] = BLAKE2B_IV2;
+ v[11] = BLAKE2B_IV3;
+ v[12] = BLAKE2B_IV4 ^ S->t[0];
+ v[13] = BLAKE2B_IV5 ^ S->t[1];
+ v[14] = BLAKE2B_IV6 ^ S->f[0];
+ v[15] = BLAKE2B_IV7 ^ S->f[1];
ROUND(0);
ROUND(1);
@@ -139,159 +114,54 @@ static void blake2b_compress(struct blake2b_state *S,
#undef G
#undef ROUND
-struct blake2b_tfm_ctx {
- u8 key[BLAKE2B_KEYBYTES];
- unsigned int keylen;
-};
-
-static int blake2b_setkey(struct crypto_shash *tfm, const u8 *key,
- unsigned int keylen)
+void blake2b_compress_generic(struct blake2b_state *state,
+ const u8 *block, size_t nblocks, u32 inc)
{
- struct blake2b_tfm_ctx *tctx = crypto_shash_ctx(tfm);
-
- if (keylen == 0 || keylen > BLAKE2B_KEYBYTES)
- return -EINVAL;
-
- memcpy(tctx->key, key, keylen);
- tctx->keylen = keylen;
-
- return 0;
+ do {
+ blake2b_increment_counter(state, inc);
+ blake2b_compress_one_generic(state, block);
+ block += BLAKE2B_BLOCK_SIZE;
+ } while (--nblocks);
}
+EXPORT_SYMBOL(blake2b_compress_generic);
-static int blake2b_init(struct shash_desc *desc)
+static int crypto_blake2b_update_generic(struct shash_desc *desc,
+ const u8 *in, unsigned int inlen)
{
- struct blake2b_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
- struct blake2b_state *state = shash_desc_ctx(desc);
- const int digestsize = crypto_shash_digestsize(desc->tfm);
-
- memset(state, 0, sizeof(*state));
- memcpy(state->h, blake2b_IV, sizeof(state->h));
-
- /* Parameter block is all zeros except index 0, no xor for 1..7 */
- state->h[0] ^= 0x01010000 | tctx->keylen << 8 | digestsize;
-
- if (tctx->keylen) {
- /*
- * Prefill the buffer with the key, next call to _update or
- * _final will process it
- */
- memcpy(state->buf, tctx->key, tctx->keylen);
- state->buflen = BLAKE2B_BLOCKBYTES;
- }
- return 0;
+ return crypto_blake2b_update(desc, in, inlen, blake2b_compress_generic);
}
-static int blake2b_update(struct shash_desc *desc, const u8 *in,
- unsigned int inlen)
+static int crypto_blake2b_final_generic(struct shash_desc *desc, u8 *out)
{
- struct blake2b_state *state = shash_desc_ctx(desc);
- const size_t left = state->buflen;
- const size_t fill = BLAKE2B_BLOCKBYTES - left;
-
- if (!inlen)
- return 0;
-
- if (inlen > fill) {
- state->buflen = 0;
- /* Fill buffer */
- memcpy(state->buf + left, in, fill);
- blake2b_increment_counter(state, BLAKE2B_BLOCKBYTES);
- /* Compress */
- blake2b_compress(state, state->buf);
- in += fill;
- inlen -= fill;
- while (inlen > BLAKE2B_BLOCKBYTES) {
- blake2b_increment_counter(state, BLAKE2B_BLOCKBYTES);
- blake2b_compress(state, in);
- in += BLAKE2B_BLOCKBYTES;
- inlen -= BLAKE2B_BLOCKBYTES;
- }
- }
- memcpy(state->buf + state->buflen, in, inlen);
- state->buflen += inlen;
-
- return 0;
+ return crypto_blake2b_final(desc, out, blake2b_compress_generic);
}
-static int blake2b_final(struct shash_desc *desc, u8 *out)
-{
- struct blake2b_state *state = shash_desc_ctx(desc);
- const int digestsize = crypto_shash_digestsize(desc->tfm);
- size_t i;
-
- blake2b_increment_counter(state, state->buflen);
- /* Set last block */
- state->f[0] = (u64)-1;
- /* Padding */
- memset(state->buf + state->buflen, 0, BLAKE2B_BLOCKBYTES - state->buflen);
- blake2b_compress(state, state->buf);
-
- /* Avoid temporary buffer and switch the internal output to LE order */
- for (i = 0; i < ARRAY_SIZE(state->h); i++)
- __cpu_to_le64s(&state->h[i]);
-
- memcpy(out, state->h, digestsize);
- return 0;
-}
+#define BLAKE2B_ALG(name, driver_name, digest_size) \
+ { \
+ .base.cra_name = name, \
+ .base.cra_driver_name = driver_name, \
+ .base.cra_priority = 100, \
+ .base.cra_flags = CRYPTO_ALG_OPTIONAL_KEY, \
+ .base.cra_blocksize = BLAKE2B_BLOCK_SIZE, \
+ .base.cra_ctxsize = sizeof(struct blake2b_tfm_ctx), \
+ .base.cra_module = THIS_MODULE, \
+ .digestsize = digest_size, \
+ .setkey = crypto_blake2b_setkey, \
+ .init = crypto_blake2b_init, \
+ .update = crypto_blake2b_update_generic, \
+ .final = crypto_blake2b_final_generic, \
+ .descsize = sizeof(struct blake2b_state), \
+ }
static struct shash_alg blake2b_algs[] = {
- {
- .base.cra_name = "blake2b-160",
- .base.cra_driver_name = "blake2b-160-generic",
- .base.cra_priority = 100,
- .base.cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
- .base.cra_blocksize = BLAKE2B_BLOCKBYTES,
- .base.cra_ctxsize = sizeof(struct blake2b_tfm_ctx),
- .base.cra_module = THIS_MODULE,
- .digestsize = BLAKE2B_160_DIGEST_SIZE,
- .setkey = blake2b_setkey,
- .init = blake2b_init,
- .update = blake2b_update,
- .final = blake2b_final,
- .descsize = sizeof(struct blake2b_state),
- }, {
- .base.cra_name = "blake2b-256",
- .base.cra_driver_name = "blake2b-256-generic",
- .base.cra_priority = 100,
- .base.cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
- .base.cra_blocksize = BLAKE2B_BLOCKBYTES,
- .base.cra_ctxsize = sizeof(struct blake2b_tfm_ctx),
- .base.cra_module = THIS_MODULE,
- .digestsize = BLAKE2B_256_DIGEST_SIZE,
- .setkey = blake2b_setkey,
- .init = blake2b_init,
- .update = blake2b_update,
- .final = blake2b_final,
- .descsize = sizeof(struct blake2b_state),
- }, {
- .base.cra_name = "blake2b-384",
- .base.cra_driver_name = "blake2b-384-generic",
- .base.cra_priority = 100,
- .base.cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
- .base.cra_blocksize = BLAKE2B_BLOCKBYTES,
- .base.cra_ctxsize = sizeof(struct blake2b_tfm_ctx),
- .base.cra_module = THIS_MODULE,
- .digestsize = BLAKE2B_384_DIGEST_SIZE,
- .setkey = blake2b_setkey,
- .init = blake2b_init,
- .update = blake2b_update,
- .final = blake2b_final,
- .descsize = sizeof(struct blake2b_state),
- }, {
- .base.cra_name = "blake2b-512",
- .base.cra_driver_name = "blake2b-512-generic",
- .base.cra_priority = 100,
- .base.cra_flags = CRYPTO_ALG_OPTIONAL_KEY,
- .base.cra_blocksize = BLAKE2B_BLOCKBYTES,
- .base.cra_ctxsize = sizeof(struct blake2b_tfm_ctx),
- .base.cra_module = THIS_MODULE,
- .digestsize = BLAKE2B_512_DIGEST_SIZE,
- .setkey = blake2b_setkey,
- .init = blake2b_init,
- .update = blake2b_update,
- .final = blake2b_final,
- .descsize = sizeof(struct blake2b_state),
- }
+ BLAKE2B_ALG("blake2b-160", "blake2b-160-generic",
+ BLAKE2B_160_HASH_SIZE),
+ BLAKE2B_ALG("blake2b-256", "blake2b-256-generic",
+ BLAKE2B_256_HASH_SIZE),
+ BLAKE2B_ALG("blake2b-384", "blake2b-384-generic",
+ BLAKE2B_384_HASH_SIZE),
+ BLAKE2B_ALG("blake2b-512", "blake2b-512-generic",
+ BLAKE2B_512_HASH_SIZE),
};
static int __init blake2b_mod_init(void)
diff --git a/include/crypto/blake2b.h b/include/crypto/blake2b.h
new file mode 100644
index 0000000000000..18875f16f8cad
--- /dev/null
+++ b/include/crypto/blake2b.h
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+
+#ifndef _CRYPTO_BLAKE2B_H
+#define _CRYPTO_BLAKE2B_H
+
+#include <linux/bug.h>
+#include <linux/types.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+
+enum blake2b_lengths {
+ BLAKE2B_BLOCK_SIZE = 128,
+ BLAKE2B_HASH_SIZE = 64,
+ BLAKE2B_KEY_SIZE = 64,
+
+ BLAKE2B_160_HASH_SIZE = 20,
+ BLAKE2B_256_HASH_SIZE = 32,
+ BLAKE2B_384_HASH_SIZE = 48,
+ BLAKE2B_512_HASH_SIZE = 64,
+};
+
+struct blake2b_state {
+ /* 'h', 't', and 'f' are used in assembly code, so keep them as-is. */
+ u64 h[8];
+ u64 t[2];
+ u64 f[2];
+ u8 buf[BLAKE2B_BLOCK_SIZE];
+ unsigned int buflen;
+ unsigned int outlen;
+};
+
+enum blake2b_iv {
+ BLAKE2B_IV0 = 0x6A09E667F3BCC908ULL,
+ BLAKE2B_IV1 = 0xBB67AE8584CAA73BULL,
+ BLAKE2B_IV2 = 0x3C6EF372FE94F82BULL,
+ BLAKE2B_IV3 = 0xA54FF53A5F1D36F1ULL,
+ BLAKE2B_IV4 = 0x510E527FADE682D1ULL,
+ BLAKE2B_IV5 = 0x9B05688C2B3E6C1FULL,
+ BLAKE2B_IV6 = 0x1F83D9ABFB41BD6BULL,
+ BLAKE2B_IV7 = 0x5BE0CD19137E2179ULL,
+};
+
+static inline void __blake2b_init(struct blake2b_state *state, size_t outlen,
+ const void *key, size_t keylen)
+{
+ state->h[0] = BLAKE2B_IV0 ^ (0x01010000 | keylen << 8 | outlen);
+ state->h[1] = BLAKE2B_IV1;
+ state->h[2] = BLAKE2B_IV2;
+ state->h[3] = BLAKE2B_IV3;
+ state->h[4] = BLAKE2B_IV4;
+ state->h[5] = BLAKE2B_IV5;
+ state->h[6] = BLAKE2B_IV6;
+ state->h[7] = BLAKE2B_IV7;
+ state->t[0] = 0;
+ state->t[1] = 0;
+ state->f[0] = 0;
+ state->f[1] = 0;
+ state->buflen = 0;
+ state->outlen = outlen;
+ if (keylen) {
+ memcpy(state->buf, key, keylen);
+ memset(&state->buf[keylen], 0, BLAKE2B_BLOCK_SIZE - keylen);
+ state->buflen = BLAKE2B_BLOCK_SIZE;
+ }
+}
+
+#endif /* _CRYPTO_BLAKE2B_H */
diff --git a/include/crypto/internal/blake2b.h b/include/crypto/internal/blake2b.h
new file mode 100644
index 0000000000000..982fe5e8471cd
--- /dev/null
+++ b/include/crypto/internal/blake2b.h
@@ -0,0 +1,115 @@
+/* SPDX-License-Identifier: GPL-2.0 OR MIT */
+/*
+ * Helper functions for BLAKE2b implementations.
+ * Keep this in sync with the corresponding BLAKE2s header.
+ */
+
+#ifndef _CRYPTO_INTERNAL_BLAKE2B_H
+#define _CRYPTO_INTERNAL_BLAKE2B_H
+
+#include <crypto/blake2b.h>
+#include <crypto/internal/hash.h>
+#include <linux/string.h>
+
+void blake2b_compress_generic(struct blake2b_state *state,
+ const u8 *block, size_t nblocks, u32 inc);
+
+static inline void blake2b_set_lastblock(struct blake2b_state *state)
+{
+ state->f[0] = -1;
+}
+
+typedef void (*blake2b_compress_t)(struct blake2b_state *state,
+ const u8 *block, size_t nblocks, u32 inc);
+
+static inline void __blake2b_update(struct blake2b_state *state,
+ const u8 *in, size_t inlen,
+ blake2b_compress_t compress)
+{
+ const size_t fill = BLAKE2B_BLOCK_SIZE - state->buflen;
+
+ if (unlikely(!inlen))
+ return;
+ if (inlen > fill) {
+ memcpy(state->buf + state->buflen, in, fill);
+ (*compress)(state, state->buf, 1, BLAKE2B_BLOCK_SIZE);
+ state->buflen = 0;
+ in += fill;
+ inlen -= fill;
+ }
+ if (inlen > BLAKE2B_BLOCK_SIZE) {
+ const size_t nblocks = DIV_ROUND_UP(inlen, BLAKE2B_BLOCK_SIZE);
+ /* Hash one less (full) block than strictly possible */
+ (*compress)(state, in, nblocks - 1, BLAKE2B_BLOCK_SIZE);
+ in += BLAKE2B_BLOCK_SIZE * (nblocks - 1);
+ inlen -= BLAKE2B_BLOCK_SIZE * (nblocks - 1);
+ }
+ memcpy(state->buf + state->buflen, in, inlen);
+ state->buflen += inlen;
+}
+
+static inline void __blake2b_final(struct blake2b_state *state, u8 *out,
+ blake2b_compress_t compress)
+{
+ int i;
+
+ blake2b_set_lastblock(state);
+ memset(state->buf + state->buflen, 0,
+ BLAKE2B_BLOCK_SIZE - state->buflen); /* Padding */
+ (*compress)(state, state->buf, 1, state->buflen);
+ for (i = 0; i < ARRAY_SIZE(state->h); i++)
+ __cpu_to_le64s(&state->h[i]);
+ memcpy(out, state->h, state->outlen);
+}
+
+/* Helper functions for shash implementations of BLAKE2b */
+
+struct blake2b_tfm_ctx {
+ u8 key[BLAKE2B_KEY_SIZE];
+ unsigned int keylen;
+};
+
+static inline int crypto_blake2b_setkey(struct crypto_shash *tfm,
+ const u8 *key, unsigned int keylen)
+{
+ struct blake2b_tfm_ctx *tctx = crypto_shash_ctx(tfm);
+
+ if (keylen == 0 || keylen > BLAKE2B_KEY_SIZE)
+ return -EINVAL;
+
+ memcpy(tctx->key, key, keylen);
+ tctx->keylen = keylen;
+
+ return 0;
+}
+
+static inline int crypto_blake2b_init(struct shash_desc *desc)
+{
+ const struct blake2b_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm);
+ struct blake2b_state *state = shash_desc_ctx(desc);
+ unsigned int outlen = crypto_shash_digestsize(desc->tfm);
+
+ __blake2b_init(state, outlen, tctx->key, tctx->keylen);
+ return 0;
+}
+
+static inline int crypto_blake2b_update(struct shash_desc *desc,
+ const u8 *in, unsigned int inlen,
+ blake2b_compress_t compress)
+{
+ struct blake2b_state *state = shash_desc_ctx(desc);
+
+ __blake2b_update(state, in, inlen, compress);
+ return 0;
+}
+
+static inline int crypto_blake2b_final(struct shash_desc *desc, u8 *out,
+ blake2b_compress_t compress)
+{
+ struct blake2b_state *state = shash_desc_ctx(desc);
+
+ __blake2b_final(state, out, compress);
+ return 0;
+}
+
+#endif /* _CRYPTO_INTERNAL_BLAKE2B_H */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 097/406] crypto: api - Use work queue in crypto_destroy_instance
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 098/406] Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Greg Kroah-Hartman
` (317 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florent Revest,
syzbot+d769eed29cc42d75e2a3, syzbot+610ec0671f51e838436e,
Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 9ae4577bc077a7e32c3c7d442c95bc76865c0f17 ]
The function crypto_drop_spawn expects to be called in process
context. However, when an instance is unregistered while it still
has active users, the last user may cause the instance to be freed
in atomic context.
Fix this by delaying the freeing to a work queue.
Fixes: 6bfd48096ff8 ("[CRYPTO] api: Added spawns")
Reported-by: Florent Revest <revest@chromium.org>
Reported-by: syzbot+d769eed29cc42d75e2a3@syzkaller.appspotmail.com
Reported-by: syzbot+610ec0671f51e838436e@syzkaller.appspotmail.com
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Tested-by: Florent Revest <revest@chromium.org>
Acked-by: Florent Revest <revest@chromium.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/algapi.c | 16 ++++++++++++++--
include/crypto/algapi.h | 3 +++
2 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 42dca17dc2d97..5d422e725b267 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -16,6 +16,7 @@
#include <linux/rtnetlink.h>
#include <linux/slab.h>
#include <linux/string.h>
+#include <linux/workqueue.h>
#include "internal.h"
@@ -68,15 +69,26 @@ static void crypto_free_instance(struct crypto_instance *inst)
inst->alg.cra_type->free(inst);
}
-static void crypto_destroy_instance(struct crypto_alg *alg)
+static void crypto_destroy_instance_workfn(struct work_struct *w)
{
- struct crypto_instance *inst = (void *)alg;
+ struct crypto_instance *inst = container_of(w, struct crypto_instance,
+ free_work);
struct crypto_template *tmpl = inst->tmpl;
crypto_free_instance(inst);
crypto_tmpl_put(tmpl);
}
+static void crypto_destroy_instance(struct crypto_alg *alg)
+{
+ struct crypto_instance *inst = container_of(alg,
+ struct crypto_instance,
+ alg);
+
+ INIT_WORK(&inst->free_work, crypto_destroy_instance_workfn);
+ schedule_work(&inst->free_work);
+}
+
/*
* This function adds a spawn to the list secondary_spawns which
* will be used at the end of crypto_remove_spawns to unregister
diff --git a/include/crypto/algapi.h b/include/crypto/algapi.h
index 18dd7a4aaf7da..96dbd438cc700 100644
--- a/include/crypto/algapi.h
+++ b/include/crypto/algapi.h
@@ -10,6 +10,7 @@
#include <linux/crypto.h>
#include <linux/list.h>
#include <linux/kernel.h>
+#include <linux/workqueue.h>
/*
* Maximum values for blocksize and alignmask, used to allocate
@@ -55,6 +56,8 @@ struct crypto_instance {
struct crypto_spawn *spawns;
};
+ struct work_struct free_work;
+
void *__ctx[] CRYPTO_MINALIGN_ATTR;
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 098/406] Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 097/406] crypto: api - Use work queue in crypto_destroy_instance Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 099/406] Bluetooth: Fix potential use-after-free when clear keys Greg Kroah-Hartman
` (316 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuanjun Gong, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuanjun Gong <ruc_gongyuanjun@163.com>
[ Upstream commit e8b5aed31355072faac8092ead4938ddec3111fd ]
in nokia_bluetooth_serdev_probe(), check the return value of
clk_prepare_enable() and return the error code if
clk_prepare_enable() returns an unexpected value.
Fixes: 7bb318680e86 ("Bluetooth: add nokia driver")
Signed-off-by: Yuanjun Gong <ruc_gongyuanjun@163.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_nokia.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/bluetooth/hci_nokia.c b/drivers/bluetooth/hci_nokia.c
index 05f7f6de6863d..97da0b2bfd17e 100644
--- a/drivers/bluetooth/hci_nokia.c
+++ b/drivers/bluetooth/hci_nokia.c
@@ -734,7 +734,11 @@ static int nokia_bluetooth_serdev_probe(struct serdev_device *serdev)
return err;
}
- clk_prepare_enable(sysclk);
+ err = clk_prepare_enable(sysclk);
+ if (err) {
+ dev_err(dev, "could not enable sysclk: %d", err);
+ return err;
+ }
btdev->sysclk_speed = clk_get_rate(sysclk);
clk_disable_unprepare(sysclk);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 099/406] Bluetooth: Fix potential use-after-free when clear keys
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 098/406] Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 100/406] net: tcp: fix unexcepted socket die when snd_wnd is 0 Greg Kroah-Hartman
` (315 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Min Li, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Min Li <lm0963hack@gmail.com>
[ Upstream commit 3673952cf0c6cf81b06c66a0b788abeeb02ff3ae ]
Similar to commit c5d2b6fa26b5 ("Bluetooth: Fix use-after-free in
hci_remove_ltk/hci_remove_irk"). We can not access k after kfree_rcu()
call.
Fixes: d7d41682efc2 ("Bluetooth: Fix Suspicious RCU usage warnings")
Signed-off-by: Min Li <lm0963hack@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_core.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index bd6f20ef13f35..46e1e51ff28e3 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2343,9 +2343,9 @@ void hci_uuids_clear(struct hci_dev *hdev)
void hci_link_keys_clear(struct hci_dev *hdev)
{
- struct link_key *key;
+ struct link_key *key, *tmp;
- list_for_each_entry(key, &hdev->link_keys, list) {
+ list_for_each_entry_safe(key, tmp, &hdev->link_keys, list) {
list_del_rcu(&key->list);
kfree_rcu(key, rcu);
}
@@ -2353,9 +2353,9 @@ void hci_link_keys_clear(struct hci_dev *hdev)
void hci_smp_ltks_clear(struct hci_dev *hdev)
{
- struct smp_ltk *k;
+ struct smp_ltk *k, *tmp;
- list_for_each_entry(k, &hdev->long_term_keys, list) {
+ list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
list_del_rcu(&k->list);
kfree_rcu(k, rcu);
}
@@ -2363,9 +2363,9 @@ void hci_smp_ltks_clear(struct hci_dev *hdev)
void hci_smp_irks_clear(struct hci_dev *hdev)
{
- struct smp_irk *k;
+ struct smp_irk *k, *tmp;
- list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
+ list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
list_del_rcu(&k->list);
kfree_rcu(k, rcu);
}
@@ -2373,9 +2373,9 @@ void hci_smp_irks_clear(struct hci_dev *hdev)
void hci_blocked_keys_clear(struct hci_dev *hdev)
{
- struct blocked_key *b;
+ struct blocked_key *b, *tmp;
- list_for_each_entry(b, &hdev->blocked_keys, list) {
+ list_for_each_entry_safe(b, tmp, &hdev->blocked_keys, list) {
list_del_rcu(&b->list);
kfree_rcu(b, rcu);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 100/406] net: tcp: fix unexcepted socket die when snd_wnd is 0
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 099/406] Bluetooth: Fix potential use-after-free when clear keys Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 101/406] selftests/bpf: Clean up fmod_ret in bench_rename test script Greg Kroah-Hartman
` (314 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Menglong Dong, Eric Dumazet,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Menglong Dong <imagedong@tencent.com>
[ Upstream commit e89688e3e97868451a5d05b38a9d2633d6785cd4 ]
In tcp_retransmit_timer(), a window shrunk connection will be regarded
as timeout if 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX'. This is not
right all the time.
The retransmits will become zero-window probes in tcp_retransmit_timer()
if the 'snd_wnd==0'. Therefore, the icsk->icsk_rto will come up to
TCP_RTO_MAX sooner or later.
However, the timer can be delayed and be triggered after 122877ms, not
TCP_RTO_MAX, as I tested.
Therefore, 'tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX' is always true
once the RTO come up to TCP_RTO_MAX, and the socket will die.
Fix this by replacing the 'tcp_jiffies32' with '(u32)icsk->icsk_timeout',
which is exact the timestamp of the timeout.
However, "tp->rcv_tstamp" can restart from idle, then tp->rcv_tstamp
could already be a long time (minutes or hours) in the past even on the
first RTO. So we double check the timeout with the duration of the
retransmission.
Meanwhile, making "2 * TCP_RTO_MAX" as the timeout to avoid the socket
dying too soon.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Link: https://lore.kernel.org/netdev/CADxym3YyMiO+zMD4zj03YPM3FBi-1LHi6gSD2XT8pyAMM096pg@mail.gmail.com/
Signed-off-by: Menglong Dong <imagedong@tencent.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp_timer.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index d2e07bb30164c..5c7e10939dd90 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -437,6 +437,22 @@ static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)
TCP_TIMEOUT_INIT << req->num_timeout, TCP_RTO_MAX);
}
+static bool tcp_rtx_probe0_timed_out(const struct sock *sk,
+ const struct sk_buff *skb)
+{
+ const struct tcp_sock *tp = tcp_sk(sk);
+ const int timeout = TCP_RTO_MAX * 2;
+ u32 rcv_delta, rtx_delta;
+
+ rcv_delta = inet_csk(sk)->icsk_timeout - tp->rcv_tstamp;
+ if (rcv_delta <= timeout)
+ return false;
+
+ rtx_delta = (u32)msecs_to_jiffies(tcp_time_stamp(tp) -
+ (tp->retrans_stamp ?: tcp_skb_timestamp(skb)));
+
+ return rtx_delta > timeout;
+}
/**
* tcp_retransmit_timer() - The TCP retransmit timeout handler
@@ -502,7 +518,7 @@ void tcp_retransmit_timer(struct sock *sk)
tp->snd_una, tp->snd_nxt);
}
#endif
- if (tcp_jiffies32 - tp->rcv_tstamp > TCP_RTO_MAX) {
+ if (tcp_rtx_probe0_timed_out(sk, skb)) {
tcp_write_err(sk);
goto out;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 101/406] selftests/bpf: Clean up fmod_ret in bench_rename test script
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 100/406] net: tcp: fix unexcepted socket die when snd_wnd is 0 Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 102/406] ice: ice_aq_check_events: fix off-by-one check when filling buffer Greg Kroah-Hartman
` (313 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yipeng Zou, Daniel Borkmann,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yipeng Zou <zouyipeng@huawei.com>
[ Upstream commit 83a89c4b6ae93481d3f618aba6a29d89208d26ed ]
Running the bench_rename test script, the following error occurs:
# ./benchs/run_bench_rename.sh
base : 0.819 ± 0.012M/s
kprobe : 0.538 ± 0.009M/s
kretprobe : 0.503 ± 0.004M/s
rawtp : 0.779 ± 0.020M/s
fentry : 0.726 ± 0.007M/s
fexit : 0.691 ± 0.007M/s
benchmark 'rename-fmodret' not found
The bench_rename_fmodret has been removed in commit b000def2e052
("selftests: Remove fmod_ret from test_overhead"), thus remove it
from the runners in the test script.
Fixes: b000def2e052 ("selftests: Remove fmod_ret from test_overhead")
Signed-off-by: Yipeng Zou <zouyipeng@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/20230814030727.3010390-1-zouyipeng@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/benchs/run_bench_rename.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/benchs/run_bench_rename.sh b/tools/testing/selftests/bpf/benchs/run_bench_rename.sh
index 16f774b1cdbed..7b281dbe41656 100755
--- a/tools/testing/selftests/bpf/benchs/run_bench_rename.sh
+++ b/tools/testing/selftests/bpf/benchs/run_bench_rename.sh
@@ -2,7 +2,7 @@
set -eufo pipefail
-for i in base kprobe kretprobe rawtp fentry fexit fmodret
+for i in base kprobe kretprobe rawtp fentry fexit
do
summary=$(sudo ./bench -w2 -d5 -a rename-$i | tail -n1 | cut -d'(' -f1 | cut -d' ' -f3-)
printf "%-10s: %s\n" $i "$summary"
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 102/406] ice: ice_aq_check_events: fix off-by-one check when filling buffer
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 101/406] selftests/bpf: Clean up fmod_ret in bench_rename test script Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 103/406] crypto: caam - fix unchecked return value error Greg Kroah-Hartman
` (312 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Keller, Przemek Kitszel,
Simon Horman, Tony Nguyen, Sasha Levin, Pucha Himasekhar Reddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Przemek Kitszel <przemyslaw.kitszel@intel.com>
[ Upstream commit e1e8a142c43336e3d25bfa1cb3a4ae7d00875c48 ]
Allow task's event buffer to be filled also in the case that it's size
is exactly the size of the message.
Fixes: d69ea414c9b4 ("ice: implement device flash update via devlink")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethernet/intel/ice/ice_main.c
index 4f0d63fa5709b..d2ee760f92942 100644
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -1137,6 +1137,7 @@ int ice_aq_wait_for_event(struct ice_pf *pf, u16 opcode, unsigned long timeout,
static void ice_aq_check_events(struct ice_pf *pf, u16 opcode,
struct ice_rq_event_info *event)
{
+ struct ice_rq_event_info *task_ev;
struct ice_aq_task *task;
bool found = false;
@@ -1145,15 +1146,15 @@ static void ice_aq_check_events(struct ice_pf *pf, u16 opcode,
if (task->state || task->opcode != opcode)
continue;
- memcpy(&task->event->desc, &event->desc, sizeof(event->desc));
- task->event->msg_len = event->msg_len;
+ task_ev = task->event;
+ memcpy(&task_ev->desc, &event->desc, sizeof(event->desc));
+ task_ev->msg_len = event->msg_len;
/* Only copy the data buffer if a destination was set */
- if (task->event->msg_buf &&
- task->event->buf_len > event->buf_len) {
- memcpy(task->event->msg_buf, event->msg_buf,
+ if (task_ev->msg_buf && task_ev->buf_len >= event->buf_len) {
+ memcpy(task_ev->msg_buf, event->msg_buf,
event->buf_len);
- task->event->buf_len = event->buf_len;
+ task_ev->buf_len = event->buf_len;
}
task->state = ICE_AQ_TASK_COMPLETE;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 103/406] crypto: caam - fix unchecked return value error
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 102/406] ice: ice_aq_check_events: fix off-by-one check when filling buffer Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 104/406] hwrng: iproc-rng200 - Implement suspend and resume calls Greg Kroah-Hartman
` (311 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gaurav Jain, Meenakshi Aggarwal,
Herbert Xu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaurav Jain <gaurav.jain@nxp.com>
[ Upstream commit e30685204711a6be40dec2622606950ccd37dafe ]
error:
Unchecked return value (CHECKED_RETURN)
check_return: Calling sg_miter_next without checking return value
fix:
added check if(!sg_miter_next)
Fixes: 8a2a0dd35f2e ("crypto: caam - strip input zeros from RSA input buffer")
Signed-off-by: Gaurav Jain <gaurav.jain@nxp.com>
Signed-off-by: Meenakshi Aggarwal <meenakshi.aggarwal@nxp.com>
Reviewed-by: Gaurav Jain <gaurav.jain@nxp.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/caam/caampkc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c
index 3acc825da4cca..5bd70a59f4ce2 100644
--- a/drivers/crypto/caam/caampkc.c
+++ b/drivers/crypto/caam/caampkc.c
@@ -222,7 +222,9 @@ static int caam_rsa_count_leading_zeros(struct scatterlist *sgl,
if (len && *buff)
break;
- sg_miter_next(&miter);
+ if (!sg_miter_next(&miter))
+ break;
+
buff = miter.addr;
len = miter.length;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 104/406] hwrng: iproc-rng200 - Implement suspend and resume calls
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 103/406] crypto: caam - fix unchecked return value error Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 105/406] lwt: Fix return values of BPF xmit ops Greg Kroah-Hartman
` (310 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fainelli, Herbert Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fainelli <florian.fainelli@broadcom.com>
[ Upstream commit 8e03dd62e5be811efbf0cbeba47e79e793519105 ]
Chips such as BCM7278 support system wide suspend/resume which will
cause the HWRNG block to lose its state and reset to its power on reset
register values. We need to cleanup and re-initialize the HWRNG for it
to be functional coming out of a system suspend cycle.
Fixes: c3577f6100ca ("hwrng: iproc-rng200 - Add support for BCM7278")
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/hw_random/iproc-rng200.c | 25 +++++++++++++++++++++++++
1 file changed, 25 insertions(+)
diff --git a/drivers/char/hw_random/iproc-rng200.c b/drivers/char/hw_random/iproc-rng200.c
index 01583faf9893e..52c4aa66d8379 100644
--- a/drivers/char/hw_random/iproc-rng200.c
+++ b/drivers/char/hw_random/iproc-rng200.c
@@ -195,6 +195,8 @@ static int iproc_rng200_probe(struct platform_device *pdev)
return PTR_ERR(priv->base);
}
+ dev_set_drvdata(dev, priv);
+
priv->rng.name = "iproc-rng200";
priv->rng.read = iproc_rng200_read;
priv->rng.init = iproc_rng200_init;
@@ -212,6 +214,28 @@ static int iproc_rng200_probe(struct platform_device *pdev)
return 0;
}
+static int __maybe_unused iproc_rng200_suspend(struct device *dev)
+{
+ struct iproc_rng200_dev *priv = dev_get_drvdata(dev);
+
+ iproc_rng200_cleanup(&priv->rng);
+
+ return 0;
+}
+
+static int __maybe_unused iproc_rng200_resume(struct device *dev)
+{
+ struct iproc_rng200_dev *priv = dev_get_drvdata(dev);
+
+ iproc_rng200_init(&priv->rng);
+
+ return 0;
+}
+
+static const struct dev_pm_ops iproc_rng200_pm_ops = {
+ SET_SYSTEM_SLEEP_PM_OPS(iproc_rng200_suspend, iproc_rng200_resume)
+};
+
static const struct of_device_id iproc_rng200_of_match[] = {
{ .compatible = "brcm,bcm2711-rng200", },
{ .compatible = "brcm,bcm7211-rng200", },
@@ -225,6 +249,7 @@ static struct platform_driver iproc_rng200_driver = {
.driver = {
.name = "iproc-rng200",
.of_match_table = iproc_rng200_of_match,
+ .pm = &iproc_rng200_pm_ops,
},
.probe = iproc_rng200_probe,
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 105/406] lwt: Fix return values of BPF xmit ops
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 104/406] hwrng: iproc-rng200 - Implement suspend and resume calls Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 106/406] lwt: Check LWTUNNEL_XMIT_CONTINUE strictly Greg Kroah-Hartman
` (309 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan Griege, Martin KaFai Lau,
Stanislav Fomichev, Yan Zhai, Daniel Borkmann, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan Zhai <yan@cloudflare.com>
[ Upstream commit 29b22badb7a84b783e3a4fffca16f7768fb31205 ]
BPF encap ops can return different types of positive values, such like
NET_RX_DROP, NET_XMIT_CN, NETDEV_TX_BUSY, and so on, from function
skb_do_redirect and bpf_lwt_xmit_reroute. At the xmit hook, such return
values would be treated implicitly as LWTUNNEL_XMIT_CONTINUE in
ip(6)_finish_output2. When this happens, skbs that have been freed would
continue to the neighbor subsystem, causing use-after-free bug and
kernel crashes.
To fix the incorrect behavior, skb_do_redirect return values can be
simply discarded, the same as tc-egress behavior. On the other hand,
bpf_lwt_xmit_reroute returns useful errors to local senders, e.g. PMTU
information. Thus convert its return values to avoid the conflict with
LWTUNNEL_XMIT_CONTINUE.
Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
Reported-by: Jordan Griege <jgriege@cloudflare.com>
Suggested-by: Martin KaFai Lau <martin.lau@linux.dev>
Suggested-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/0d2b878186cfe215fec6b45769c1cd0591d3628d.1692326837.git.yan@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/lwt_bpf.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 3fd207fe1284a..f6c327c7badb4 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -59,9 +59,8 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
ret = BPF_OK;
} else {
skb_reset_mac_header(skb);
- ret = skb_do_redirect(skb);
- if (ret == 0)
- ret = BPF_REDIRECT;
+ skb_do_redirect(skb);
+ ret = BPF_REDIRECT;
}
break;
@@ -254,7 +253,7 @@ static int bpf_lwt_xmit_reroute(struct sk_buff *skb)
err = dst_output(dev_net(skb_dst(skb)->dev), skb->sk, skb);
if (unlikely(err))
- return err;
+ return net_xmit_errno(err);
/* ip[6]_finish_output2 understand LWTUNNEL_XMIT_DONE */
return LWTUNNEL_XMIT_DONE;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 106/406] lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 105/406] lwt: Fix return values of BPF xmit ops Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 107/406] fs: ocfs2: namei: check return value of ocfs2_add_entry() Greg Kroah-Hartman
` (308 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Yan Zhai,
Daniel Borkmann, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yan Zhai <yan@cloudflare.com>
[ Upstream commit a171fbec88a2c730b108c7147ac5e7b2f5a02b47 ]
LWTUNNEL_XMIT_CONTINUE is implicitly assumed in ip(6)_finish_output2,
such that any positive return value from a xmit hook could cause
unexpected continue behavior, despite that related skb may have been
freed. This could be error-prone for future xmit hook ops. One of the
possible errors is to return statuses of dst_output directly.
To make the code safer, redefine LWTUNNEL_XMIT_CONTINUE value to
distinguish from dst_output statuses and check the continue
condition explicitly.
Fixes: 3a0af8fd61f9 ("bpf: BPF for lightweight tunnel infrastructure")
Suggested-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Yan Zhai <yan@cloudflare.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://lore.kernel.org/bpf/96b939b85eda00e8df4f7c080f770970a4c5f698.1692326837.git.yan@cloudflare.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/lwtunnel.h | 5 ++++-
net/ipv4/ip_output.c | 2 +-
net/ipv6/ip6_output.c | 2 +-
3 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/include/net/lwtunnel.h b/include/net/lwtunnel.h
index 05cfd6ff65287..d4a90eca1921a 100644
--- a/include/net/lwtunnel.h
+++ b/include/net/lwtunnel.h
@@ -16,9 +16,12 @@
#define LWTUNNEL_STATE_INPUT_REDIRECT BIT(1)
#define LWTUNNEL_STATE_XMIT_REDIRECT BIT(2)
+/* LWTUNNEL_XMIT_CONTINUE should be distinguishable from dst_output return
+ * values (NET_XMIT_xxx and NETDEV_TX_xxx in linux/netdevice.h) for safety.
+ */
enum {
LWTUNNEL_XMIT_DONE,
- LWTUNNEL_XMIT_CONTINUE,
+ LWTUNNEL_XMIT_CONTINUE = 0x100,
};
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 6fd04f2f8b40c..a99c374101fc5 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -223,7 +223,7 @@ static int ip_finish_output2(struct net *net, struct sock *sk, struct sk_buff *s
if (lwtunnel_xmit_redirect(dst->lwtstate)) {
int res = lwtunnel_xmit(skb);
- if (res < 0 || res == LWTUNNEL_XMIT_DONE)
+ if (res != LWTUNNEL_XMIT_CONTINUE)
return res;
}
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index c62e44224bf84..58b5ab5fcdbf1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -131,7 +131,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
if (lwtunnel_xmit_redirect(dst->lwtstate)) {
int res = lwtunnel_xmit(skb);
- if (res < 0 || res == LWTUNNEL_XMIT_DONE)
+ if (res != LWTUNNEL_XMIT_CONTINUE)
return res;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 107/406] fs: ocfs2: namei: check return value of ocfs2_add_entry()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 106/406] lwt: Check LWTUNNEL_XMIT_CONTINUE strictly Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 108/406] wifi: mwifiex: fix memory leak in mwifiex_histogram_read() Greg Kroah-Hartman
` (307 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Artem Chernyshev, Joseph Qi,
Joel Becker, Kurt Hackel, Mark Fasheh, Junxiao Bi, Changwei Ge,
Gang He, Jun Piao, Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
[ Upstream commit 6b72e5f9e79360fce4f2be7fe81159fbdf4256a5 ]
Process result of ocfs2_add_entry() in case we have an error
value.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Link: https://lkml.kernel.org/r/20230803145417.177649-1-artem.chernyshev@red-soft.ru
Fixes: ccd979bdbce9 ("[PATCH] OCFS2: The Second Oracle Cluster Filesystem")
Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Kurt Hackel <kurt.hackel@oracle.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Junxiao Bi <junxiao.bi@oracle.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ocfs2/namei.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/fs/ocfs2/namei.c b/fs/ocfs2/namei.c
index d6a0e719b1ad9..5c98813b3dcaf 100644
--- a/fs/ocfs2/namei.c
+++ b/fs/ocfs2/namei.c
@@ -1532,6 +1532,10 @@ static int ocfs2_rename(struct inode *old_dir,
status = ocfs2_add_entry(handle, new_dentry, old_inode,
OCFS2_I(old_inode)->ip_blkno,
new_dir_bh, &target_insert);
+ if (status < 0) {
+ mlog_errno(status);
+ goto bail;
+ }
}
old_inode->i_ctime = current_time(old_inode);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 108/406] wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 107/406] fs: ocfs2: namei: check return value of ocfs2_add_entry() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 109/406] wifi: mwifiex: Fix missed return in oob checks failed path Greg Kroah-Hartman
` (306 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Norris, Dmitry Antipov,
Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 9c8fd72a5c2a031cbc680a2990107ecd958ffcdb ]
Always free the zeroed page on return from 'mwifiex_histogram_read()'.
Fixes: cbf6e05527a7 ("mwifiex: add rx histogram statistics support")
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230802160726.85545-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/debugfs.c b/drivers/net/wireless/marvell/mwifiex/debugfs.c
index dded92db1f373..1e7dc724c6a94 100644
--- a/drivers/net/wireless/marvell/mwifiex/debugfs.c
+++ b/drivers/net/wireless/marvell/mwifiex/debugfs.c
@@ -265,8 +265,11 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
if (!p)
return -ENOMEM;
- if (!priv || !priv->hist_data)
- return -EFAULT;
+ if (!priv || !priv->hist_data) {
+ ret = -EFAULT;
+ goto free_and_exit;
+ }
+
phist_data = priv->hist_data;
p += sprintf(p, "\n"
@@ -321,6 +324,8 @@ mwifiex_histogram_read(struct file *file, char __user *ubuf,
ret = simple_read_from_buffer(ubuf, count, ppos, (char *)page,
(unsigned long)p - page);
+free_and_exit:
+ free_page(page);
return ret;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 109/406] wifi: mwifiex: Fix missed return in oob checks failed path
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 108/406] wifi: mwifiex: fix memory leak in mwifiex_histogram_read() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 110/406] samples/bpf: fix broken map lookup probe Greg Kroah-Hartman
` (305 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Polaris Pi, Dmitry Antipov,
Brian Norris, Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Polaris Pi <pinkperfect2021@gmail.com>
[ Upstream commit 2785851c627f2db05f9271f7f63661b5dbd95c4c ]
Add missed return in mwifiex_uap_queue_bridged_pkt() and
mwifiex_process_rx_packet().
Fixes: 119585281617 ("wifi: mwifiex: Fix OOB and integer underflow when rx packets")
Signed-off-by: Polaris Pi <pinkperfect2021@gmail.com>
Reported-by: Dmitry Antipov <dmantipov@yandex.ru>
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230810083911.3725248-1-pinkperfect2021@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/sta_rx.c | 1 +
drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_rx.c b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
index 685a5b6697046..3c555946cb2cc 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_rx.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_rx.c
@@ -104,6 +104,7 @@ int mwifiex_process_rx_packet(struct mwifiex_private *priv,
skb->len, rx_pkt_off);
priv->stats.rx_dropped++;
dev_kfree_skb_any(skb);
+ return -1;
}
if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
index f46afd7f1b6a4..5c5beedd6aa7b 100644
--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -122,6 +122,7 @@ static void mwifiex_uap_queue_bridged_pkt(struct mwifiex_private *priv,
skb->len, le16_to_cpu(uap_rx_pd->rx_pkt_offset));
priv->stats.rx_dropped++;
dev_kfree_skb_any(skb);
+ return;
}
if ((!memcmp(&rx_pkt_hdr->rfc1042_hdr, bridge_tunnel_header,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 110/406] samples/bpf: fix broken map lookup probe
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 109/406] wifi: mwifiex: Fix missed return in oob checks failed path Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 111/406] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Greg Kroah-Hartman
` (304 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel T. Lee, Alexei Starovoitov,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel T. Lee <danieltimlee@gmail.com>
[ Upstream commit d93a7cf6ca2cfcd7de5d06f753ce8d5e863316ac ]
In the commit 7c4cd051add3 ("bpf: Fix syscall's stackmap lookup
potential deadlock"), a potential deadlock issue was addressed, which
resulted in *_map_lookup_elem not triggering BPF programs.
(prior to lookup, bpf_disable_instrumentation() is used)
To resolve the broken map lookup probe using "htab_map_lookup_elem",
this commit introduces an alternative approach. Instead, it utilize
"bpf_map_copy_value" and apply a filter specifically for the hash table
with map_type.
Signed-off-by: Daniel T. Lee <danieltimlee@gmail.com>
Fixes: 7c4cd051add3 ("bpf: Fix syscall's stackmap lookup potential deadlock")
Link: https://lore.kernel.org/r/20230818090119.477441-8-danieltimlee@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
samples/bpf/tracex6_kern.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/samples/bpf/tracex6_kern.c b/samples/bpf/tracex6_kern.c
index acad5712d8b4f..fd602c2774b8b 100644
--- a/samples/bpf/tracex6_kern.c
+++ b/samples/bpf/tracex6_kern.c
@@ -2,6 +2,8 @@
#include <linux/version.h>
#include <uapi/linux/bpf.h>
#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_tracing.h>
+#include <bpf/bpf_core_read.h>
struct {
__uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
@@ -45,13 +47,24 @@ int bpf_prog1(struct pt_regs *ctx)
return 0;
}
-SEC("kprobe/htab_map_lookup_elem")
-int bpf_prog2(struct pt_regs *ctx)
+/*
+ * Since *_map_lookup_elem can't be expected to trigger bpf programs
+ * due to potential deadlocks (bpf_disable_instrumentation), this bpf
+ * program will be attached to bpf_map_copy_value (which is called
+ * from map_lookup_elem) and will only filter the hashtable type.
+ */
+SEC("kprobe/bpf_map_copy_value")
+int BPF_KPROBE(bpf_prog2, struct bpf_map *map)
{
u32 key = bpf_get_smp_processor_id();
struct bpf_perf_event_value *val, buf;
+ enum bpf_map_type type;
int error;
+ type = BPF_CORE_READ(map, map_type);
+ if (type != BPF_MAP_TYPE_HASH)
+ return 0;
+
error = bpf_perf_event_read_value(&counters, key, &buf, sizeof(buf));
if (error)
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 111/406] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 110/406] samples/bpf: fix broken map lookup probe Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 112/406] wifi: ath9k: protect WMI command response buffer replacement with a lock Greg Kroah-Hartman
` (303 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit b674fb513e2e7a514fcde287c0f73915d393fdb6 ]
Currently, the synchronization between ath9k_wmi_cmd() and
ath9k_wmi_ctrl_rx() is exposed to a race condition which, although being
rather unlikely, can lead to invalid behaviour of ath9k_wmi_cmd().
Consider the following scenario:
CPU0 CPU1
ath9k_wmi_cmd(...)
mutex_lock(&wmi->op_mutex)
ath9k_wmi_cmd_issue(...)
wait_for_completion_timeout(...)
---
timeout
---
/* the callback is being processed
* before last_seq_id became zero
*/
ath9k_wmi_ctrl_rx(...)
spin_lock_irqsave(...)
/* wmi->last_seq_id check here
* doesn't detect timeout yet
*/
spin_unlock_irqrestore(...)
/* last_seq_id is zeroed to
* indicate there was a timeout
*/
wmi->last_seq_id = 0
mutex_unlock(&wmi->op_mutex)
return -ETIMEDOUT
ath9k_wmi_cmd(...)
mutex_lock(&wmi->op_mutex)
/* the buffer is replaced with
* another one
*/
wmi->cmd_rsp_buf = rsp_buf
wmi->cmd_rsp_len = rsp_len
ath9k_wmi_cmd_issue(...)
spin_lock_irqsave(...)
spin_unlock_irqrestore(...)
wait_for_completion_timeout(...)
/* the continuation of the
* callback left after the first
* ath9k_wmi_cmd call
*/
ath9k_wmi_rsp_callback(...)
/* copying data designated
* to already timeouted
* WMI command into an
* inappropriate wmi_cmd_buf
*/
memcpy(...)
complete(&wmi->cmd_wait)
/* awakened by the bogus callback
* => invalid return result
*/
mutex_unlock(&wmi->op_mutex)
return 0
To fix this, update last_seq_id on timeout path inside ath9k_wmi_cmd()
under the wmi_lock. Move ath9k_wmi_rsp_callback() under wmi_lock inside
ath9k_wmi_ctrl_rx() so that the wmi->cmd_wait can be completed only for
initially designated wmi_cmd call, otherwise the path would be rejected
with last_seq_id check.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230425192607.18015-1-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/wmi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index d652c647d56b5..04f363cb90fe5 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -242,10 +242,10 @@ static void ath9k_wmi_ctrl_rx(void *priv, struct sk_buff *skb,
spin_unlock_irqrestore(&wmi->wmi_lock, flags);
goto free_skb;
}
- spin_unlock_irqrestore(&wmi->wmi_lock, flags);
/* WMI command response */
ath9k_wmi_rsp_callback(wmi, skb);
+ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
free_skb:
kfree_skb(skb);
@@ -308,8 +308,8 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
struct ath_common *common = ath9k_hw_common(ah);
u16 headroom = sizeof(struct htc_frame_hdr) +
sizeof(struct wmi_cmd_hdr);
+ unsigned long time_left, flags;
struct sk_buff *skb;
- unsigned long time_left;
int ret = 0;
if (ah->ah_flags & AH_UNPLUGGED)
@@ -345,7 +345,9 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
if (!time_left) {
ath_dbg(common, WMI, "Timeout waiting for WMI command: %s\n",
wmi_cmd_to_name(cmd_id));
+ spin_lock_irqsave(&wmi->wmi_lock, flags);
wmi->last_seq_id = 0;
+ spin_unlock_irqrestore(&wmi->wmi_lock, flags);
mutex_unlock(&wmi->op_mutex);
return -ETIMEDOUT;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 112/406] wifi: ath9k: protect WMI command response buffer replacement with a lock
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 111/406] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 113/406] wifi: mwifiex: avoid possible NULL skb pointer dereference Greg Kroah-Hartman
` (302 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 454994cfa9e4c18b6df9f78b60db8eadc20a6c25 ]
If ath9k_wmi_cmd() has exited with a timeout, it is possible that during
next ath9k_wmi_cmd() call the wmi_rsp callback for previous wmi command
writes to new wmi->cmd_rsp_buf and makes a completion. This results in an
invalid ath9k_wmi_cmd() return value.
Move the replacement of WMI command response buffer and length under
wmi_lock. Note that last_seq_id value is updated there, too.
Thus, the buffer cannot be written to by a belated wmi_rsp callback
because that path is properly rejected by the last_seq_id check.
Found by Linux Verification Center (linuxtesting.org) with Syzkaller.
Fixes: fb9987d0f748 ("ath9k_htc: Support for AR9271 chipset.")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230425192607.18015-2-pchelkin@ispras.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/wmi.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/wmi.c b/drivers/net/wireless/ath/ath9k/wmi.c
index 04f363cb90fe5..1476b42b52a91 100644
--- a/drivers/net/wireless/ath/ath9k/wmi.c
+++ b/drivers/net/wireless/ath/ath9k/wmi.c
@@ -283,7 +283,8 @@ int ath9k_wmi_connect(struct htc_target *htc, struct wmi *wmi,
static int ath9k_wmi_cmd_issue(struct wmi *wmi,
struct sk_buff *skb,
- enum wmi_cmd_id cmd, u16 len)
+ enum wmi_cmd_id cmd, u16 len,
+ u8 *rsp_buf, u32 rsp_len)
{
struct wmi_cmd_hdr *hdr;
unsigned long flags;
@@ -293,6 +294,11 @@ static int ath9k_wmi_cmd_issue(struct wmi *wmi,
hdr->seq_no = cpu_to_be16(++wmi->tx_seq_id);
spin_lock_irqsave(&wmi->wmi_lock, flags);
+
+ /* record the rsp buffer and length */
+ wmi->cmd_rsp_buf = rsp_buf;
+ wmi->cmd_rsp_len = rsp_len;
+
wmi->last_seq_id = wmi->tx_seq_id;
spin_unlock_irqrestore(&wmi->wmi_lock, flags);
@@ -333,11 +339,7 @@ int ath9k_wmi_cmd(struct wmi *wmi, enum wmi_cmd_id cmd_id,
goto out;
}
- /* record the rsp buffer and length */
- wmi->cmd_rsp_buf = rsp_buf;
- wmi->cmd_rsp_len = rsp_len;
-
- ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len);
+ ret = ath9k_wmi_cmd_issue(wmi, skb, cmd_id, cmd_len, rsp_buf, rsp_len);
if (ret)
goto out;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 113/406] wifi: mwifiex: avoid possible NULL skb pointer dereference
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 112/406] wifi: ath9k: protect WMI command response buffer replacement with a lock Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 114/406] Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
` (301 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Norris, Dmitry Antipov,
Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Antipov <dmantipov@yandex.ru>
[ Upstream commit 35a7a1ce7c7d61664ee54f5239a1f120ab95a87e ]
In 'mwifiex_handle_uap_rx_forward()', always check the value
returned by 'skb_copy()' to avoid potential NULL pointer
dereference in 'mwifiex_uap_queue_bridged_pkt()', and drop
original skb in case of copying failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 838e4f449297 ("mwifiex: improve uAP RX handling")
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Dmitry Antipov <dmantipov@yandex.ru>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230814095041.16416-1-dmantipov@yandex.ru
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
index 5c5beedd6aa7b..780ea467471f6 100644
--- a/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_txrx.c
@@ -265,7 +265,15 @@ int mwifiex_handle_uap_rx_forward(struct mwifiex_private *priv,
if (is_multicast_ether_addr(ra)) {
skb_uap = skb_copy(skb, GFP_ATOMIC);
- mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
+ if (likely(skb_uap)) {
+ mwifiex_uap_queue_bridged_pkt(priv, skb_uap);
+ } else {
+ mwifiex_dbg(adapter, ERROR,
+ "failed to copy skb for uAP\n");
+ priv->stats.rx_dropped++;
+ dev_kfree_skb_any(skb);
+ return -1;
+ }
} else {
if (mwifiex_get_sta_entry(priv, ra)) {
/* Requeue Intra-BSS packet */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 114/406] Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 113/406] wifi: mwifiex: avoid possible NULL skb pointer dereference Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 115/406] wifi: ath9k: use IS_ERR() with debugfs_create_dir() Greg Kroah-Hartman
` (300 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
[ Upstream commit 2a05334d7f91ff189692089c05fc48cc1d8204de ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with hardware interrupts being disabled.
So replace kfree_skb() with dev_kfree_skb_irq() under
spin_lock_irqsave(). Compile tested only.
Fixes: baac6276c0a9 ("Bluetooth: btusb: handle mSBC audio over USB Endpoints")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index 49d5375b04f40..f99d190770204 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -1689,7 +1689,7 @@ static int btusb_switch_alt_setting(struct hci_dev *hdev, int new_alts)
* alternate setting.
*/
spin_lock_irqsave(&data->rxlock, flags);
- kfree_skb(data->sco_skb);
+ dev_kfree_skb_irq(data->sco_skb);
data->sco_skb = NULL;
spin_unlock_irqrestore(&data->rxlock, flags);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 115/406] wifi: ath9k: use IS_ERR() with debugfs_create_dir()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 114/406] Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 116/406] net: arcnet: Do not call kfree_skb() under local_irq_disable() Greg Kroah-Hartman
` (299 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wang Ming,
Toke Høiland-Jørgensen, Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Ming <machel@vivo.com>
[ Upstream commit 1e4134610d93271535ecf900a676e1f094e9944c ]
The debugfs_create_dir() function returns error pointers,
it never returns NULL. Most incorrect error checks were fixed,
but the one in ath9k_htc_init_debug() was forgotten.
Fix the remaining error check.
Fixes: e5facc75fa91 ("ath9k_htc: Cleanup HTC debugfs")
Signed-off-by: Wang Ming <machel@vivo.com>
Acked-by: Toke Høiland-Jørgensen <toke@toke.dk>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230713030358.12379-1-machel@vivo.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
index b3ed65e5c4da8..c55aab01fff5d 100644
--- a/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
+++ b/drivers/net/wireless/ath/ath9k/htc_drv_debug.c
@@ -491,7 +491,7 @@ int ath9k_htc_init_debug(struct ath_hw *ah)
priv->debug.debugfs_phy = debugfs_create_dir(KBUILD_MODNAME,
priv->hw->wiphy->debugfsdir);
- if (!priv->debug.debugfs_phy)
+ if (IS_ERR(priv->debug.debugfs_phy))
return -ENOMEM;
ath9k_cmn_spectral_init_debug(&priv->spec_priv, priv->debug.debugfs_phy);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 116/406] net: arcnet: Do not call kfree_skb() under local_irq_disable()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 115/406] wifi: ath9k: use IS_ERR() with debugfs_create_dir() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 117/406] mlxsw: i2c: Fix chunk size setting in output mailbox buffer Greg Kroah-Hartman
` (298 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
[ Upstream commit 786c96e92fb9e854cb8b0cb7399bb2fb28e15c4b ]
It is not allowed to call kfree_skb() from hardware interrupt
context or with hardware interrupts being disabled.
So replace kfree_skb() with dev_kfree_skb_irq() under
local_irq_disable(). Compile tested only.
Fixes: 05fcd31cc472 ("arcnet: add err_skb package for package status feedback")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/arcnet/arcnet.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
index d76dd7d14299e..a7899405a51a5 100644
--- a/drivers/net/arcnet/arcnet.c
+++ b/drivers/net/arcnet/arcnet.c
@@ -468,7 +468,7 @@ static void arcnet_reply_tasklet(unsigned long data)
ret = sock_queue_err_skb(sk, ackskb);
if (ret)
- kfree_skb(ackskb);
+ dev_kfree_skb_irq(ackskb);
local_irq_enable();
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 117/406] mlxsw: i2c: Fix chunk size setting in output mailbox buffer
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 116/406] net: arcnet: Do not call kfree_skb() under local_irq_disable() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 118/406] mlxsw: i2c: Limit single transaction buffer size Greg Kroah-Hartman
` (297 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Pasternak, Ido Schimmel,
Petr Machata, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Pasternak <vadimp@nvidia.com>
[ Upstream commit 146c7c330507c0384bf29d567186632bfe975927 ]
The driver reads commands output from the output mailbox. If the size
of the output mailbox is not a multiple of the transaction /
block size, then the driver will not issue enough read transactions
to read the entire output, which can result in driver initialization
errors.
Fix by determining the number of transactions using DIV_ROUND_UP().
Fixes: 3029a693beda ("mlxsw: i2c: Allow flexible setting of I2C transactions size")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/i2c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
index ce843ea914646..f20dca41424c9 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
@@ -428,7 +428,7 @@ mlxsw_i2c_cmd(struct device *dev, u16 opcode, u32 in_mod, size_t in_mbox_size,
} else {
/* No input mailbox is case of initialization query command. */
reg_size = MLXSW_I2C_MAX_DATA_SIZE;
- num = reg_size / mlxsw_i2c->block_size;
+ num = DIV_ROUND_UP(reg_size, mlxsw_i2c->block_size);
if (mutex_lock_interruptible(&mlxsw_i2c->cmd.lock) < 0) {
dev_err(&client->dev, "Could not acquire lock");
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 118/406] mlxsw: i2c: Limit single transaction buffer size
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 117/406] mlxsw: i2c: Fix chunk size setting in output mailbox buffer Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 119/406] hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() Greg Kroah-Hartman
` (296 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Pasternak, Petr Machata,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Pasternak <vadimp@nvidia.com>
[ Upstream commit d7248f1cc835bd80e936dc5b2d94b149bdd0077d ]
Maximum size of buffer is obtained from underlying I2C adapter and in
case adapter allows I2C transaction buffer size greater than 100 bytes,
transaction will fail due to firmware limitation.
As a result driver will fail initialization.
Limit the maximum size of transaction buffer by 100 bytes to fit to
firmware.
Remove unnecessary calculation:
max_t(u16, MLXSW_I2C_BLK_DEF, quirk_size).
This condition can not happened.
Fixes: 3029a693beda ("mlxsw: i2c: Allow flexible setting of I2C transactions size")
Signed-off-by: Vadim Pasternak <vadimp@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/i2c.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
index f20dca41424c9..61d2f621d65fc 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c
@@ -47,6 +47,7 @@
#define MLXSW_I2C_MBOX_SIZE_BITS 12
#define MLXSW_I2C_ADDR_BUF_SIZE 4
#define MLXSW_I2C_BLK_DEF 32
+#define MLXSW_I2C_BLK_MAX 100
#define MLXSW_I2C_RETRY 5
#define MLXSW_I2C_TIMEOUT_MSECS 5000
#define MLXSW_I2C_MAX_DATA_SIZE 256
@@ -576,7 +577,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client,
return -EOPNOTSUPP;
}
- mlxsw_i2c->block_size = max_t(u16, MLXSW_I2C_BLK_DEF,
+ mlxsw_i2c->block_size = min_t(u16, MLXSW_I2C_BLK_MAX,
min_t(u16, quirks->max_read_len,
quirks->max_write_len));
} else {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 119/406] hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 118/406] mlxsw: i2c: Limit single transaction buffer size Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 120/406] net/sched: sch_hfsc: Ensure inner classes have fsc curve Greg Kroah-Hartman
` (295 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Biju Das, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit d103337e38e7e64c3d915029e947b1cb0b512737 ]
The supported channels for this driver are {0..3}. Fix the incorrect
channel in tmp51x_is_visible().
Reported-by: Guenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/all/ea0eccc0-a29f-41e4-9049-a1a13f8b16f1@roeck-us.net/
Fixes: 59dfa75e5d82 ("hwmon: Add driver for Texas Instruments TMP512/513 sensor chips.")
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20230824204456.401580-2-biju.das.jz@bp.renesas.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/tmp513.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/hwmon/tmp513.c b/drivers/hwmon/tmp513.c
index 7d5f7441aceb1..b9a93ee9c2364 100644
--- a/drivers/hwmon/tmp513.c
+++ b/drivers/hwmon/tmp513.c
@@ -434,7 +434,7 @@ static umode_t tmp51x_is_visible(const void *_data,
switch (type) {
case hwmon_temp:
- if (data->id == tmp512 && channel == 4)
+ if (data->id == tmp512 && channel == 3)
return 0;
switch (attr) {
case hwmon_temp_input:
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 120/406] net/sched: sch_hfsc: Ensure inner classes have fsc curve
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 119/406] hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 121/406] netrom: Deny concurrent connect() Greg Kroah-Hartman
` (294 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Budimir Markovic, Jamal Hadi Salim,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Budimir Markovic <markovicbudimir@gmail.com>
[ Upstream commit b3d26c5702c7d6c45456326e56d2ccf3f103e60f ]
HFSC assumes that inner classes have an fsc curve, but it is currently
possible for classes without an fsc curve to become parents. This leads
to bugs including a use-after-free.
Don't allow non-root classes without HFSC_FSC to become parents.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Budimir Markovic <markovicbudimir@gmail.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230824084905.422-1-markovicbudimir@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_hfsc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index cdc43a06aa9bc..6076294a632c5 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1012,6 +1012,10 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
if (parent == NULL)
return -ENOENT;
}
+ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
+ NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
+ return -EINVAL;
+ }
if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
return -EINVAL;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 121/406] netrom: Deny concurrent connect().
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 120/406] net/sched: sch_hfsc: Ensure inner classes have fsc curve Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 122/406] drm/bridge: tc358764: Fix debug print parameter order Greg Kroah-Hartman
` (293 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+666c97e4686410e79649,
Kuniyuki Iwashima, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit c2f8fd7949603efb03908e05abbf7726748c8de3 ]
syzkaller reported null-ptr-deref [0] related to AF_NETROM.
This is another self-accept issue from the strace log. [1]
syz-executor creates an AF_NETROM socket and calls connect(), which
is blocked at that time. Then, sk->sk_state is TCP_SYN_SENT and
sock->state is SS_CONNECTING.
[pid 5059] socket(AF_NETROM, SOCK_SEQPACKET, 0) = 4
[pid 5059] connect(4, {sa_family=AF_NETROM, sa_data="..." <unfinished ...>
Another thread calls connect() concurrently, which finally fails
with -EINVAL. However, the problem here is the socket state is
reset even while the first connect() is blocked.
[pid 5060] connect(4, NULL, 0 <unfinished ...>
[pid 5060] <... connect resumed>) = -1 EINVAL (Invalid argument)
As sk->state is TCP_CLOSE and sock->state is SS_UNCONNECTED, the
following listen() succeeds. Then, the first connect() looks up
itself as a listener and puts skb into the queue with skb->sk itself.
As a result, the next accept() gets another FD of itself as 3, and
the first connect() finishes.
[pid 5060] listen(4, 0 <unfinished ...>
[pid 5060] <... listen resumed>) = 0
[pid 5060] accept(4, NULL, NULL <unfinished ...>
[pid 5060] <... accept resumed>) = 3
[pid 5059] <... connect resumed>) = 0
Then, accept4() is called but blocked, which causes the general protection
fault later.
[pid 5059] accept4(4, NULL, 0x20000400, SOCK_NONBLOCK <unfinished ...>
After that, another self-accept occurs by accept() and writev().
[pid 5060] accept(4, NULL, NULL <unfinished ...>
[pid 5061] writev(3, [{iov_base=...}] <unfinished ...>
[pid 5061] <... writev resumed>) = 99
[pid 5060] <... accept resumed>) = 6
Finally, the leader thread close()s all FDs. Since the three FDs
reference the same socket, nr_release() does the cleanup for it
three times, and the remaining accept4() causes the following fault.
[pid 5058] close(3) = 0
[pid 5058] close(4) = 0
[pid 5058] close(5) = -1 EBADF (Bad file descriptor)
[pid 5058] close(6) = 0
[pid 5058] <... exit_group resumed>) = ?
[ 83.456055][ T5059] general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
To avoid the issue, we need to return an error for connect() if
another connect() is in progress, as done in __inet_stream_connect().
[0]:
general protection fault, probably for non-canonical address 0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]
CPU: 0 PID: 5059 Comm: syz-executor.0 Not tainted 6.5.0-rc5-syzkaller-00194-gace0ab3a4b54 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:__lock_acquire+0x109/0x5de0 kernel/locking/lockdep.c:5012
Code: 45 85 c9 0f 84 cc 0e 00 00 44 8b 05 11 6e 23 0b 45 85 c0 0f 84 be 0d 00 00 48 ba 00 00 00 00 00 fc ff df 4c 89 d1 48 c1 e9 03 <80> 3c 11 00 0f 85 e8 40 00 00 49 81 3a a0 69 48 90 0f 84 96 0d 00
RSP: 0018:ffffc90003d6f9e0 EFLAGS: 00010006
RAX: ffff8880244c8000 RBX: 1ffff920007adf6c RCX: 0000000000000003
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 0000000000000018
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000018 R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 00007f51d519a6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f51d5158d58 CR3: 000000002943f000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
lock_acquire kernel/locking/lockdep.c:5761 [inline]
lock_acquire+0x1ae/0x510 kernel/locking/lockdep.c:5726
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0x3a/0x50 kernel/locking/spinlock.c:162
prepare_to_wait+0x47/0x380 kernel/sched/wait.c:269
nr_accept+0x20d/0x650 net/netrom/af_netrom.c:798
do_accept+0x3a6/0x570 net/socket.c:1872
__sys_accept4_file net/socket.c:1913 [inline]
__sys_accept4+0x99/0x120 net/socket.c:1943
__do_sys_accept4 net/socket.c:1954 [inline]
__se_sys_accept4 net/socket.c:1951 [inline]
__x64_sys_accept4+0x96/0x100 net/socket.c:1951
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f51d447cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f51d519a0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000120
RAX: ffffffffffffffda RBX: 00007f51d459bf80 RCX: 00007f51d447cae9
RDX: 0000000020000400 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 00007f51d44c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000800 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f51d459bf80 R15: 00007ffc25c34e48
</TASK>
Link: https://syzkaller.appspot.com/text?tag=CrashLog&x=152cdb63a80000 [1]
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+666c97e4686410e79649@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=666c97e4686410e79649
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netrom/af_netrom.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 5c04da4cfbad0..24747163122bb 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -660,6 +660,11 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
goto out_release;
}
+ if (sock->state == SS_CONNECTING) {
+ err = -EALREADY;
+ goto out_release;
+ }
+
sk->sk_state = TCP_CLOSE;
sock->state = SS_UNCONNECTED;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 122/406] drm/bridge: tc358764: Fix debug print parameter order
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 121/406] netrom: Deny concurrent connect() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 123/406] quota: factor out dquot_write_dquot() Greg Kroah-Hartman
` (292 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Robert Foss,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
[ Upstream commit 7f947be02aab5b154427cb5b0fffe858fc387b02 ]
The debug print parameters were swapped in the output and they were
printed as decimal values, both the hardware address and the value.
Update the debug print to print the parameters in correct order, and
use hexadecimal print for both address and value.
Fixes: f38b7cca6d0e ("drm/bridge: tc358764: Add DSI to LVDS bridge driver")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Robert Foss <rfoss@kernel.org>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230615152817.359420-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358764.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/tc358764.c b/drivers/gpu/drm/bridge/tc358764.c
index d89394bc5aa4d..ea1445e09e6f1 100644
--- a/drivers/gpu/drm/bridge/tc358764.c
+++ b/drivers/gpu/drm/bridge/tc358764.c
@@ -180,7 +180,7 @@ static void tc358764_read(struct tc358764 *ctx, u16 addr, u32 *val)
if (ret >= 0)
le32_to_cpus(val);
- dev_dbg(ctx->dev, "read: %d, addr: %d\n", addr, *val);
+ dev_dbg(ctx->dev, "read: addr=0x%04x data=0x%08x\n", addr, *val);
}
static void tc358764_write(struct tc358764 *ctx, u16 addr, u32 val)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 123/406] quota: factor out dquot_write_dquot()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 122/406] drm/bridge: tc358764: Fix debug print parameter order Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 124/406] quota: rename dquot_active() to inode_quota_active() Greg Kroah-Hartman
` (291 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 024128477809f8073d870307c8157b8826ebfd08 ]
Refactor out dquot_write_dquot() to reduce duplicate code.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230630110822.3881712-2-libaokun1@huawei.com>
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/quota/dquot.c | 39 ++++++++++++++++-----------------------
1 file changed, 16 insertions(+), 23 deletions(-)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 8d0cd68fc90a4..de4bebdc6e773 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -630,6 +630,18 @@ int dquot_scan_active(struct super_block *sb,
}
EXPORT_SYMBOL(dquot_scan_active);
+static inline int dquot_write_dquot(struct dquot *dquot)
+{
+ int ret = dquot->dq_sb->dq_op->write_dquot(dquot);
+ if (ret < 0) {
+ quota_error(dquot->dq_sb, "Can't write quota structure "
+ "(error %d). Quota may get out of sync!", ret);
+ /* Clear dirty bit anyway to avoid infinite loop. */
+ clear_dquot_dirty(dquot);
+ }
+ return ret;
+}
+
/* Write all dquot structures to quota files */
int dquot_writeback_dquots(struct super_block *sb, int type)
{
@@ -660,16 +672,9 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
* use count */
dqgrab(dquot);
spin_unlock(&dq_list_lock);
- err = sb->dq_op->write_dquot(dquot);
- if (err) {
- /*
- * Clear dirty bit anyway to avoid infinite
- * loop here.
- */
- clear_dquot_dirty(dquot);
- if (!ret)
- ret = err;
- }
+ err = dquot_write_dquot(dquot);
+ if (err && !ret)
+ ret = err;
dqput(dquot);
spin_lock(&dq_list_lock);
}
@@ -767,8 +772,6 @@ static struct shrinker dqcache_shrinker = {
*/
void dqput(struct dquot *dquot)
{
- int ret;
-
if (!dquot)
return;
#ifdef CONFIG_QUOTA_DEBUG
@@ -796,17 +799,7 @@ void dqput(struct dquot *dquot)
if (dquot_dirty(dquot)) {
spin_unlock(&dq_list_lock);
/* Commit dquot before releasing */
- ret = dquot->dq_sb->dq_op->write_dquot(dquot);
- if (ret < 0) {
- quota_error(dquot->dq_sb, "Can't write quota structure"
- " (error %d). Quota may get out of sync!",
- ret);
- /*
- * We clear dirty bit anyway, so that we avoid
- * infinite loop here
- */
- clear_dquot_dirty(dquot);
- }
+ dquot_write_dquot(dquot);
goto we_slept;
}
if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 124/406] quota: rename dquot_active() to inode_quota_active()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 123/406] quota: factor out dquot_write_dquot() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 125/406] quota: add new helper dquot_active() Greg Kroah-Hartman
` (290 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 4b9bdfa16535de8f49bf954aeed0f525ee2fc322 ]
Now we have a helper function dquot_dirty() to determine if dquot has
DQ_MOD_B bit. dquot_active() can easily be misunderstood as a helper
function to determine if dquot has DQ_ACTIVE_B bit. So we avoid this by
renaming it to inode_quota_active() and later on we will add the helper
function dquot_active() to determine if dquot has DQ_ACTIVE_B bit.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230630110822.3881712-3-libaokun1@huawei.com>
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/quota/dquot.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index de4bebdc6e773..bbe748bb9a0d5 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1420,7 +1420,7 @@ static int info_bdq_free(struct dquot *dquot, qsize_t space)
return QUOTA_NL_NOWARN;
}
-static int dquot_active(const struct inode *inode)
+static int inode_quota_active(const struct inode *inode)
{
struct super_block *sb = inode->i_sb;
@@ -1443,7 +1443,7 @@ static int __dquot_initialize(struct inode *inode, int type)
qsize_t rsv;
int ret = 0;
- if (!dquot_active(inode))
+ if (!inode_quota_active(inode))
return 0;
dquots = i_dquot(inode);
@@ -1551,7 +1551,7 @@ bool dquot_initialize_needed(struct inode *inode)
struct dquot **dquots;
int i;
- if (!dquot_active(inode))
+ if (!inode_quota_active(inode))
return false;
dquots = i_dquot(inode);
@@ -1662,7 +1662,7 @@ int __dquot_alloc_space(struct inode *inode, qsize_t number, int flags)
int reserve = flags & DQUOT_SPACE_RESERVE;
struct dquot **dquots;
- if (!dquot_active(inode)) {
+ if (!inode_quota_active(inode)) {
if (reserve) {
spin_lock(&inode->i_lock);
*inode_reserved_space(inode) += number;
@@ -1732,7 +1732,7 @@ int dquot_alloc_inode(struct inode *inode)
struct dquot_warn warn[MAXQUOTAS];
struct dquot * const *dquots;
- if (!dquot_active(inode))
+ if (!inode_quota_active(inode))
return 0;
for (cnt = 0; cnt < MAXQUOTAS; cnt++)
warn[cnt].w_type = QUOTA_NL_NOWARN;
@@ -1775,7 +1775,7 @@ int dquot_claim_space_nodirty(struct inode *inode, qsize_t number)
struct dquot **dquots;
int cnt, index;
- if (!dquot_active(inode)) {
+ if (!inode_quota_active(inode)) {
spin_lock(&inode->i_lock);
*inode_reserved_space(inode) -= number;
__inode_add_bytes(inode, number);
@@ -1817,7 +1817,7 @@ void dquot_reclaim_space_nodirty(struct inode *inode, qsize_t number)
struct dquot **dquots;
int cnt, index;
- if (!dquot_active(inode)) {
+ if (!inode_quota_active(inode)) {
spin_lock(&inode->i_lock);
*inode_reserved_space(inode) += number;
__inode_sub_bytes(inode, number);
@@ -1861,7 +1861,7 @@ void __dquot_free_space(struct inode *inode, qsize_t number, int flags)
struct dquot **dquots;
int reserve = flags & DQUOT_SPACE_RESERVE, index;
- if (!dquot_active(inode)) {
+ if (!inode_quota_active(inode)) {
if (reserve) {
spin_lock(&inode->i_lock);
*inode_reserved_space(inode) -= number;
@@ -1916,7 +1916,7 @@ void dquot_free_inode(struct inode *inode)
struct dquot * const *dquots;
int index;
- if (!dquot_active(inode))
+ if (!inode_quota_active(inode))
return;
dquots = i_dquot(inode);
@@ -2087,7 +2087,7 @@ int dquot_transfer(struct inode *inode, struct iattr *iattr)
struct super_block *sb = inode->i_sb;
int ret;
- if (!dquot_active(inode))
+ if (!inode_quota_active(inode))
return 0;
if (iattr->ia_valid & ATTR_UID && !uid_eq(iattr->ia_uid, inode->i_uid)){
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 125/406] quota: add new helper dquot_active()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 124/406] quota: rename dquot_active() to inode_quota_active() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 126/406] quota: fix dqput() to follow the guarantees dquot_srcu should provide Greg Kroah-Hartman
` (289 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Baokun Li, Jan Kara, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit 33bcfafc48cb186bc4bbcea247feaa396594229e ]
Add new helper function dquot_active() to make the code more concise.
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230630110822.3881712-4-libaokun1@huawei.com>
Stable-dep-of: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/quota/dquot.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index bbe748bb9a0d5..202d97c2c5cb2 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -338,6 +338,11 @@ static void wait_on_dquot(struct dquot *dquot)
mutex_unlock(&dquot->dq_lock);
}
+static inline int dquot_active(struct dquot *dquot)
+{
+ return test_bit(DQ_ACTIVE_B, &dquot->dq_flags);
+}
+
static inline int dquot_dirty(struct dquot *dquot)
{
return test_bit(DQ_MOD_B, &dquot->dq_flags);
@@ -353,14 +358,14 @@ int dquot_mark_dquot_dirty(struct dquot *dquot)
{
int ret = 1;
- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
+ if (!dquot_active(dquot))
return 0;
if (sb_dqopt(dquot->dq_sb)->flags & DQUOT_NOLIST_DIRTY)
return test_and_set_bit(DQ_MOD_B, &dquot->dq_flags);
/* If quota is dirty already, we don't have to acquire dq_list_lock */
- if (test_bit(DQ_MOD_B, &dquot->dq_flags))
+ if (dquot_dirty(dquot))
return 1;
spin_lock(&dq_list_lock);
@@ -442,7 +447,7 @@ int dquot_acquire(struct dquot *dquot)
smp_mb__before_atomic();
set_bit(DQ_READ_B, &dquot->dq_flags);
/* Instantiate dquot if needed */
- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags) && !dquot->dq_off) {
+ if (!dquot_active(dquot) && !dquot->dq_off) {
ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot);
/* Write the info if needed */
if (info_dirty(&dqopt->info[dquot->dq_id.type])) {
@@ -484,7 +489,7 @@ int dquot_commit(struct dquot *dquot)
goto out_lock;
/* Inactive dquot can be only if there was error during read/init
* => we have better not writing it */
- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
+ if (dquot_active(dquot))
ret = dqopt->ops[dquot->dq_id.type]->commit_dqblk(dquot);
else
ret = -EIO;
@@ -599,7 +604,7 @@ int dquot_scan_active(struct super_block *sb,
spin_lock(&dq_list_lock);
list_for_each_entry(dquot, &inuse_list, dq_inuse) {
- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags))
+ if (!dquot_active(dquot))
continue;
if (dquot->dq_sb != sb)
continue;
@@ -614,7 +619,7 @@ int dquot_scan_active(struct super_block *sb,
* outstanding call and recheck the DQ_ACTIVE_B after that.
*/
wait_on_dquot(dquot);
- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+ if (dquot_active(dquot)) {
ret = fn(dquot, priv);
if (ret < 0)
goto out;
@@ -665,7 +670,7 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
dquot = list_first_entry(&dirty, struct dquot,
dq_dirty);
- WARN_ON(!test_bit(DQ_ACTIVE_B, &dquot->dq_flags));
+ WARN_ON(!dquot_active(dquot));
/* Now we have active dquot from which someone is
* holding reference so we can safely just increase
@@ -802,7 +807,7 @@ void dqput(struct dquot *dquot)
dquot_write_dquot(dquot);
goto we_slept;
}
- if (test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+ if (dquot_active(dquot)) {
spin_unlock(&dq_list_lock);
dquot->dq_sb->dq_op->release_dquot(dquot);
goto we_slept;
@@ -903,7 +908,7 @@ struct dquot *dqget(struct super_block *sb, struct kqid qid)
* already finished or it will be canceled due to dq_count > 1 test */
wait_on_dquot(dquot);
/* Read the dquot / allocate space in quota file */
- if (!test_bit(DQ_ACTIVE_B, &dquot->dq_flags)) {
+ if (!dquot_active(dquot)) {
int err;
err = sb->dq_op->acquire_dquot(dquot);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 126/406] quota: fix dqput() to follow the guarantees dquot_srcu should provide
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 125/406] quota: add new helper dquot_active() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 127/406] ASoC: stac9766: fix build errors with REGMAP_AC97 Greg Kroah-Hartman
` (288 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jan Kara, Baokun Li, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Baokun Li <libaokun1@huawei.com>
[ Upstream commit dabc8b20756601b9e1cc85a81d47d3f98ed4d13a ]
The dquot_mark_dquot_dirty() using dquot references from the inode
should be protected by dquot_srcu. quota_off code takes care to call
synchronize_srcu(&dquot_srcu) to not drop dquot references while they
are used by other users. But dquot_transfer() breaks this assumption.
We call dquot_transfer() to drop the last reference of dquot and add
it to free_dquots, but there may still be other users using the dquot
at this time, as shown in the function graph below:
cpu1 cpu2
_________________|_________________
wb_do_writeback CHOWN(1)
...
ext4_da_update_reserve_space
dquot_claim_block
...
dquot_mark_dquot_dirty // try to dirty old quota
test_bit(DQ_ACTIVE_B, &dquot->dq_flags) // still ACTIVE
if (test_bit(DQ_MOD_B, &dquot->dq_flags))
// test no dirty, wait dq_list_lock
...
dquot_transfer
__dquot_transfer
dqput_all(transfer_from) // rls old dquot
dqput // last dqput
dquot_release
clear_bit(DQ_ACTIVE_B, &dquot->dq_flags)
atomic_dec(&dquot->dq_count)
put_dquot_last(dquot)
list_add_tail(&dquot->dq_free, &free_dquots)
// add the dquot to free_dquots
if (!test_and_set_bit(DQ_MOD_B, &dquot->dq_flags))
add dqi_dirty_list // add released dquot to dirty_list
This can cause various issues, such as dquot being destroyed by
dqcache_shrink_scan() after being added to free_dquots, which can trigger
a UAF in dquot_mark_dquot_dirty(); or after dquot is added to free_dquots
and then to dirty_list, it is added to free_dquots again after
dquot_writeback_dquots() is executed, which causes the free_dquots list to
be corrupted and triggers a UAF when dqcache_shrink_scan() is called for
freeing dquot twice.
As Honza said, we need to fix dquot_transfer() to follow the guarantees
dquot_srcu should provide. But calling synchronize_srcu() directly from
dquot_transfer() is too expensive (and mostly unnecessary). So we add
dquot whose last reference should be dropped to the new global dquot
list releasing_dquots, and then queue work item which would call
synchronize_srcu() and after that perform the final cleanup of all the
dquots on releasing_dquots.
Fixes: 4580b30ea887 ("quota: Do not dirty bad dquots")
Suggested-by: Jan Kara <jack@suse.cz>
Signed-off-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20230630110822.3881712-5-libaokun1@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/quota/dquot.c | 96 +++++++++++++++++++++++++++++++++++++++---------
1 file changed, 78 insertions(+), 18 deletions(-)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 202d97c2c5cb2..13a9a17d6a13b 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -225,13 +225,22 @@ static void put_quota_format(struct quota_format_type *fmt)
/*
* Dquot List Management:
- * The quota code uses four lists for dquot management: the inuse_list,
- * free_dquots, dqi_dirty_list, and dquot_hash[] array. A single dquot
- * structure may be on some of those lists, depending on its current state.
+ * The quota code uses five lists for dquot management: the inuse_list,
+ * releasing_dquots, free_dquots, dqi_dirty_list, and dquot_hash[] array.
+ * A single dquot structure may be on some of those lists, depending on
+ * its current state.
*
* All dquots are placed to the end of inuse_list when first created, and this
* list is used for invalidate operation, which must look at every dquot.
*
+ * When the last reference of a dquot will be dropped, the dquot will be
+ * added to releasing_dquots. We'd then queue work item which would call
+ * synchronize_srcu() and after that perform the final cleanup of all the
+ * dquots on the list. Both releasing_dquots and free_dquots use the
+ * dq_free list_head in the dquot struct. When a dquot is removed from
+ * releasing_dquots, a reference count is always subtracted, and if
+ * dq_count == 0 at that point, the dquot will be added to the free_dquots.
+ *
* Unused dquots (dq_count == 0) are added to the free_dquots list when freed,
* and this list is searched whenever we need an available dquot. Dquots are
* removed from the list as soon as they are used again, and
@@ -250,6 +259,7 @@ static void put_quota_format(struct quota_format_type *fmt)
static LIST_HEAD(inuse_list);
static LIST_HEAD(free_dquots);
+static LIST_HEAD(releasing_dquots);
static unsigned int dq_hash_bits, dq_hash_mask;
static struct hlist_head *dquot_hash;
@@ -260,6 +270,9 @@ static qsize_t inode_get_rsv_space(struct inode *inode);
static qsize_t __inode_get_rsv_space(struct inode *inode);
static int __dquot_initialize(struct inode *inode, int type);
+static void quota_release_workfn(struct work_struct *work);
+static DECLARE_DELAYED_WORK(quota_release_work, quota_release_workfn);
+
static inline unsigned int
hashfn(const struct super_block *sb, struct kqid qid)
{
@@ -307,12 +320,18 @@ static inline void put_dquot_last(struct dquot *dquot)
dqstats_inc(DQST_FREE_DQUOTS);
}
+static inline void put_releasing_dquots(struct dquot *dquot)
+{
+ list_add_tail(&dquot->dq_free, &releasing_dquots);
+}
+
static inline void remove_free_dquot(struct dquot *dquot)
{
if (list_empty(&dquot->dq_free))
return;
list_del_init(&dquot->dq_free);
- dqstats_dec(DQST_FREE_DQUOTS);
+ if (!atomic_read(&dquot->dq_count))
+ dqstats_dec(DQST_FREE_DQUOTS);
}
static inline void put_inuse(struct dquot *dquot)
@@ -554,6 +573,8 @@ static void invalidate_dquots(struct super_block *sb, int type)
struct dquot *dquot, *tmp;
restart:
+ flush_delayed_work("a_release_work);
+
spin_lock(&dq_list_lock);
list_for_each_entry_safe(dquot, tmp, &inuse_list, dq_inuse) {
if (dquot->dq_sb != sb)
@@ -562,6 +583,12 @@ static void invalidate_dquots(struct super_block *sb, int type)
continue;
/* Wait for dquot users */
if (atomic_read(&dquot->dq_count)) {
+ /* dquot in releasing_dquots, flush and retry */
+ if (!list_empty(&dquot->dq_free)) {
+ spin_unlock(&dq_list_lock);
+ goto restart;
+ }
+
atomic_inc(&dquot->dq_count);
spin_unlock(&dq_list_lock);
/*
@@ -772,6 +799,49 @@ static struct shrinker dqcache_shrinker = {
.seeks = DEFAULT_SEEKS,
};
+/*
+ * Safely release dquot and put reference to dquot.
+ */
+static void quota_release_workfn(struct work_struct *work)
+{
+ struct dquot *dquot;
+ struct list_head rls_head;
+
+ spin_lock(&dq_list_lock);
+ /* Exchange the list head to avoid livelock. */
+ list_replace_init(&releasing_dquots, &rls_head);
+ spin_unlock(&dq_list_lock);
+
+restart:
+ synchronize_srcu(&dquot_srcu);
+ spin_lock(&dq_list_lock);
+ while (!list_empty(&rls_head)) {
+ dquot = list_first_entry(&rls_head, struct dquot, dq_free);
+ /* Dquot got used again? */
+ if (atomic_read(&dquot->dq_count) > 1) {
+ remove_free_dquot(dquot);
+ atomic_dec(&dquot->dq_count);
+ continue;
+ }
+ if (dquot_dirty(dquot)) {
+ spin_unlock(&dq_list_lock);
+ /* Commit dquot before releasing */
+ dquot_write_dquot(dquot);
+ goto restart;
+ }
+ if (dquot_active(dquot)) {
+ spin_unlock(&dq_list_lock);
+ dquot->dq_sb->dq_op->release_dquot(dquot);
+ goto restart;
+ }
+ /* Dquot is inactive and clean, now move it to free list */
+ remove_free_dquot(dquot);
+ atomic_dec(&dquot->dq_count);
+ put_dquot_last(dquot);
+ }
+ spin_unlock(&dq_list_lock);
+}
+
/*
* Put reference to dquot
*/
@@ -788,7 +858,7 @@ void dqput(struct dquot *dquot)
}
#endif
dqstats_inc(DQST_DROPS);
-we_slept:
+
spin_lock(&dq_list_lock);
if (atomic_read(&dquot->dq_count) > 1) {
/* We have more than one user... nothing to do */
@@ -800,25 +870,15 @@ void dqput(struct dquot *dquot)
spin_unlock(&dq_list_lock);
return;
}
+
/* Need to release dquot? */
- if (dquot_dirty(dquot)) {
- spin_unlock(&dq_list_lock);
- /* Commit dquot before releasing */
- dquot_write_dquot(dquot);
- goto we_slept;
- }
- if (dquot_active(dquot)) {
- spin_unlock(&dq_list_lock);
- dquot->dq_sb->dq_op->release_dquot(dquot);
- goto we_slept;
- }
- atomic_dec(&dquot->dq_count);
#ifdef CONFIG_QUOTA_DEBUG
/* sanity check */
BUG_ON(!list_empty(&dquot->dq_free));
#endif
- put_dquot_last(dquot);
+ put_releasing_dquots(dquot);
spin_unlock(&dq_list_lock);
+ queue_delayed_work(system_unbound_wq, "a_release_work, 1);
}
EXPORT_SYMBOL(dqput);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 127/406] ASoC: stac9766: fix build errors with REGMAP_AC97
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 126/406] quota: fix dqput() to follow the guarantees dquot_srcu should provide Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 128/406] soc: qcom: ocmem: Add OCMEM hardware version print Greg Kroah-Hartman
` (287 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Lars-Peter Clausen,
Mark Brown, Liam Girdwood, alsa-devel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c70064b96f509daa78f57992aeabcf274fb2fed4 ]
Select REGMAP_AC97 to fix these build errors:
ERROR: modpost: "regmap_ac97_default_volatile" [sound/soc/codecs/snd-soc-stac9766.ko] undefined!
ERROR: modpost: "__regmap_init_ac97" [sound/soc/codecs/snd-soc-stac9766.ko] undefined!
Fixes: 6bbf787bb70c ("ASoC: stac9766: Convert to regmap")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Lars-Peter Clausen <lars@metafoo.de>
Cc: Mark Brown <broonie@kernel.org>
Cc: Liam Girdwood <lgirdwood@gmail.com>
Cc: alsa-devel@alsa-project.org
Link: https://lore.kernel.org/r/20230701044836.18789-1-rdunlap@infradead.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/sound/soc/codecs/Kconfig b/sound/soc/codecs/Kconfig
index f1c9e563994b2..04a7070c78e28 100644
--- a/sound/soc/codecs/Kconfig
+++ b/sound/soc/codecs/Kconfig
@@ -1295,6 +1295,7 @@ config SND_SOC_STA529
config SND_SOC_STAC9766
tristate
depends on SND_SOC_AC97_BUS
+ select REGMAP_AC97
config SND_SOC_STI_SAS
tristate "codec Audio support for STI SAS codec"
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 128/406] soc: qcom: ocmem: Add OCMEM hardware version print
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 127/406] ASoC: stac9766: fix build errors with REGMAP_AC97 Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 129/406] soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros Greg Kroah-Hartman
` (286 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca@z3ntu.xyz>
[ Upstream commit e81a16e77259294cd4ff0a9c1fbe5aa0e311a47d ]
It might be useful to know what hardware version of the OCMEM block the
SoC contains. Add a debug print for that.
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230509-ocmem-hwver-v3-1-e51f3488e0f4@z3ntu.xyz
Stable-dep-of: a7b484b1c933 ("soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/ocmem.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c
index 1dfdd0b9ba24d..ae023bef81b6f 100644
--- a/drivers/soc/qcom/ocmem.c
+++ b/drivers/soc/qcom/ocmem.c
@@ -76,6 +76,10 @@ struct ocmem {
#define OCMEM_REG_GFX_MPU_START 0x00001004
#define OCMEM_REG_GFX_MPU_END 0x00001008
+#define OCMEM_HW_VERSION_MAJOR(val) FIELD_GET(GENMASK(31, 28), val)
+#define OCMEM_HW_VERSION_MINOR(val) FIELD_GET(GENMASK(27, 16), val)
+#define OCMEM_HW_VERSION_STEP(val) FIELD_GET(GENMASK(15, 0), val)
+
#define OCMEM_HW_PROFILE_NUM_PORTS(val) FIELD_PREP(0x0000000f, (val))
#define OCMEM_HW_PROFILE_NUM_MACROS(val) FIELD_PREP(0x00003f00, (val))
@@ -357,6 +361,12 @@ static int ocmem_dev_probe(struct platform_device *pdev)
}
}
+ reg = ocmem_read(ocmem, OCMEM_REG_HW_VERSION);
+ dev_dbg(dev, "OCMEM hardware version: %lu.%lu.%lu\n",
+ OCMEM_HW_VERSION_MAJOR(reg),
+ OCMEM_HW_VERSION_MINOR(reg),
+ OCMEM_HW_VERSION_STEP(reg));
+
reg = ocmem_read(ocmem, OCMEM_REG_HW_PROFILE);
ocmem->num_ports = OCMEM_HW_PROFILE_NUM_PORTS(reg);
ocmem->num_macros = OCMEM_HW_PROFILE_NUM_MACROS(reg);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 129/406] soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 128/406] soc: qcom: ocmem: Add OCMEM hardware version print Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 130/406] arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller Greg Kroah-Hartman
` (285 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Caleb Connolly, Konrad Dybcio,
Luca Weiss, Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca@z3ntu.xyz>
[ Upstream commit a7b484b1c9332a1ee12e8799d62a11ee3f8e0801 ]
Since we're using these two macros to read a value from a register, we
need to use the FIELD_GET instead of the FIELD_PREP macro, otherwise
we're getting wrong values.
So instead of:
[ 3.111779] ocmem fdd00000.sram: 2 ports, 1 regions, 512 macros, not interleaved
we now get the correct value of:
[ 3.129672] ocmem fdd00000.sram: 2 ports, 1 regions, 2 macros, not interleaved
Fixes: 88c1e9404f1d ("soc: qcom: add OCMEM driver")
Reviewed-by: Caleb Connolly <caleb.connolly@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20230506-msm8226-ocmem-v3-1-79da95a2581f@z3ntu.xyz
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/ocmem.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/soc/qcom/ocmem.c b/drivers/soc/qcom/ocmem.c
index ae023bef81b6f..8b80c8e94c77a 100644
--- a/drivers/soc/qcom/ocmem.c
+++ b/drivers/soc/qcom/ocmem.c
@@ -80,8 +80,8 @@ struct ocmem {
#define OCMEM_HW_VERSION_MINOR(val) FIELD_GET(GENMASK(27, 16), val)
#define OCMEM_HW_VERSION_STEP(val) FIELD_GET(GENMASK(15, 0), val)
-#define OCMEM_HW_PROFILE_NUM_PORTS(val) FIELD_PREP(0x0000000f, (val))
-#define OCMEM_HW_PROFILE_NUM_MACROS(val) FIELD_PREP(0x00003f00, (val))
+#define OCMEM_HW_PROFILE_NUM_PORTS(val) FIELD_GET(0x0000000f, (val))
+#define OCMEM_HW_PROFILE_NUM_MACROS(val) FIELD_GET(0x00003f00, (val))
#define OCMEM_HW_PROFILE_LAST_REGN_HALFSIZE 0x00010000
#define OCMEM_HW_PROFILE_INTERLEAVING 0x00020000
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 130/406] arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 129/406] soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 131/406] drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() Greg Kroah-Hartman
` (284 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 36541089c4733355ed844c67eebd0c3936953454 ]
The interrupt line was previously not described. Take care of that.
Fixes: 1e39255ed29d ("arm64: dts: msm8996: Add device node for qcom,dwc3")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230627-topic-more_bindings-v1-11-6b4b6cd081e5@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi
index 73f7490911c92..0bc5fefb7a49b 100644
--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi
+++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi
@@ -1966,6 +1966,9 @@ usb2: usb@76f8800 {
#size-cells = <1>;
ranges;
+ interrupts = <GIC_SPI 352 IRQ_TYPE_LEVEL_HIGH>;
+ interrupt-names = "hs_phy_irq";
+
clocks = <&gcc GCC_PERIPH_NOC_USB20_AHB_CLK>,
<&gcc GCC_USB20_MASTER_CLK>,
<&gcc GCC_USB20_MOCK_UTMI_CLK>,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 131/406] drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 130/406] arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 132/406] ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name Greg Kroah-Hartman
` (283 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Arnd Bergmann,
Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 822130b5e8834ab30ad410cf19a582e5014b9a85 ]
On 32-bit architectures comparing a resource against a value larger than
U32_MAX can cause a warning:
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c:1344:18: error: result of comparison of constant 4294967296 with expression of type 'resource_size_t' (aka 'unsigned int') is always false [-Werror,-Wtautological-constant-out-of-range-compare]
res->start > 0x100000000ull)
~~~~~~~~~~ ^ ~~~~~~~~~~~~~~
As gcc does not warn about this in dead code, add an IS_ENABLED() check at
the start of the function. This will always return success but not actually resize
the BAR on 32-bit architectures without high memory, which is exactly what
we want here, as the driver can fall back to bank switching the VRAM
access.
Fixes: 31b8adab3247 ("drm/amdgpu: require a root bus window above 4GB for BAR resize")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 8bd887fb6e631..f0db9724ca85e 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -1091,6 +1091,9 @@ int amdgpu_device_resize_fb_bar(struct amdgpu_device *adev)
u16 cmd;
int r;
+ if (!IS_ENABLED(CONFIG_PHYS_ADDR_T_64BIT))
+ return 0;
+
/* Bypass for VF */
if (amdgpu_sriov_vf(adev))
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 132/406] ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 131/406] drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 133/406] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch Greg Kroah-Hartman
` (282 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge Semin, Florian Fainelli,
Krzysztof Kozlowski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <Sergey.Semin@baikalelectronics.ru>
[ Upstream commit 74abbfe99f43eb7466d26d9e48fbeb46b8f3d804 ]
In accordance with the Generic EHCI/OHCI bindings the corresponding node
name is suppose to comply with the Generic USB HCD DT schema, which
requires the USB nodes to have the name acceptable by the regexp:
"^usb(@.*)?" . Make sure the "generic-ehci" and "generic-ohci"-compatible
nodes are correctly named.
Signed-off-by: Serge Semin <Sergey.Semin@baikalelectronics.ru>
Acked-by: Florian Fainelli <f.fainelli@gmail.com>
Acked-by: Krzysztof Kozlowski <krzk@kernel.org>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Stable-dep-of: 05d2c3d552b8 ("ARM: dts: BCM53573: Drop nonexistent #usb-cells")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm5301x.dtsi | 4 ++--
arch/arm/boot/dts/bcm53573.dtsi | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi
index 4e9bb10f37d0f..9189a9489464b 100644
--- a/arch/arm/boot/dts/bcm5301x.dtsi
+++ b/arch/arm/boot/dts/bcm5301x.dtsi
@@ -267,7 +267,7 @@ usb2: usb2@21000 {
interrupt-parent = <&gic>;
- ehci: ehci@21000 {
+ ehci: usb@21000 {
#usb-cells = <0>;
compatible = "generic-ehci";
@@ -289,7 +289,7 @@ ehci_port2: port@2 {
};
};
- ohci: ohci@22000 {
+ ohci: usb@22000 {
#usb-cells = <0>;
compatible = "generic-ohci";
diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index 4af8e3293cff4..51546fccc6168 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -135,7 +135,7 @@ usb2: usb2@4000 {
#address-cells = <1>;
#size-cells = <1>;
- ehci: ehci@4000 {
+ ehci: usb@4000 {
compatible = "generic-ehci";
reg = <0x4000 0x1000>;
interrupt-parent = <&gic>;
@@ -155,7 +155,7 @@ ehci_port2: port@2 {
};
};
- ohci: ohci@d000 {
+ ohci: usb@d000 {
#usb-cells = <0>;
compatible = "generic-ohci";
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 133/406] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 132/406] ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 134/406] ARM: dts: BCM53573: Drop nonexistent #usb-cells Greg Kroah-Hartman
` (281 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 9fb90ae6cae7f8fe4fbf626945f32cd9da2c3892 ]
BCM53573 family SoC have Ethernet switch connected to the first Ethernet
controller (accessible over MDIO).
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
Stable-dep-of: 05d2c3d552b8 ("ARM: dts: BCM53573: Drop nonexistent #usb-cells")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm53573.dtsi | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index 51546fccc6168..3f03a381db0f2 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -180,6 +180,24 @@ ohci_port2: port@2 {
gmac0: ethernet@5000 {
reg = <0x5000 0x1000>;
+
+ mdio {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
+ switch: switch@1e {
+ compatible = "brcm,bcm53125";
+ reg = <0x1e>;
+
+ status = "disabled";
+
+ /* ports are defined in board DTS */
+ ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ };
+ };
+ };
};
gmac1: ethernet@b000 {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 134/406] ARM: dts: BCM53573: Drop nonexistent #usb-cells
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 133/406] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 135/406] ARM: dts: BCM53573: Add cells sizes to PCIe node Greg Kroah-Hartman
` (280 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 05d2c3d552b8c92fc397377d9d1112fc58e2cd59 ]
Such property simply doesn't exist (is not documented or used anywhere).
This fixes:
arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: usb@d000: Unevaluated properties are not allowed ('#usb-cells' was unexpected)
From schema: Documentation/devicetree/bindings/usb/generic-ohci.yaml
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230707114004.2740-2-zajec5@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm53573.dtsi | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index 3f03a381db0f2..3cb71829e8597 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -156,8 +156,6 @@ ehci_port2: port@2 {
};
ohci: usb@d000 {
- #usb-cells = <0>;
-
compatible = "generic-ohci";
reg = <0xd000 0x1000>;
interrupt-parent = <&gic>;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 135/406] ARM: dts: BCM53573: Add cells sizes to PCIe node
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 134/406] ARM: dts: BCM53573: Drop nonexistent #usb-cells Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 136/406] ARM: dts: BCM53573: Use updated "spi-gpio" binding properties Greg Kroah-Hartman
` (279 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 3392ef368d9b04622fe758b1079b512664b6110a ]
This fixes:
arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#address-cells' is a required property
From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml
arch/arm/boot/dts/broadcom/bcm47189-luxul-xap-1440.dtb: pcie@2000: '#size-cells' is a required property
From schema: /lib/python3.10/site-packages/dtschema/schemas/pci/pci-bus.yaml
Two properties that need to be added later are "device_type" and
"ranges". Adding "device_type" on its own causes a new warning and the
value of "ranges" needs to be determined yet.
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230707114004.2740-3-zajec5@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm53573.dtsi | 3 +++
1 file changed, 3 insertions(+)
diff --git a/arch/arm/boot/dts/bcm53573.dtsi b/arch/arm/boot/dts/bcm53573.dtsi
index 3cb71829e8597..eed1a6147f0bf 100644
--- a/arch/arm/boot/dts/bcm53573.dtsi
+++ b/arch/arm/boot/dts/bcm53573.dtsi
@@ -127,6 +127,9 @@ uart0: serial@300 {
pcie0: pcie@2000 {
reg = <0x00002000 0x1000>;
+
+ #address-cells = <3>;
+ #size-cells = <2>;
};
usb2: usb2@4000 {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 136/406] ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 135/406] ARM: dts: BCM53573: Add cells sizes to PCIe node Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 137/406] drm/etnaviv: fix dumping of active MMU context Greg Kroah-Hartman
` (278 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 2c0fd6b3d0778ceab40205315ccef74568490f17 ]
Switch away from deprecated properties.
This fixes:
arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-sck: False schema does not allow [[3, 21, 0]]
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-miso: False schema does not allow [[3, 22, 0]]
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: gpio-mosi: False schema does not allow [[3, 23, 0]]
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: 'sck-gpios' is a required property
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
arch/arm/boot/dts/broadcom/bcm947189acdbmr.dtb: spi: Unevaluated properties are not allowed ('gpio-miso', 'gpio-mosi', 'gpio-sck' were unexpected)
From schema: Documentation/devicetree/bindings/spi/spi-gpio.yaml
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230707114004.2740-4-zajec5@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arm/boot/dts/bcm947189acdbmr.dts b/arch/arm/boot/dts/bcm947189acdbmr.dts
index b0b8c774a37f9..1f0be30e54435 100644
--- a/arch/arm/boot/dts/bcm947189acdbmr.dts
+++ b/arch/arm/boot/dts/bcm947189acdbmr.dts
@@ -60,9 +60,9 @@ wps {
spi {
compatible = "spi-gpio";
num-chipselects = <1>;
- gpio-sck = <&chipcommon 21 0>;
- gpio-miso = <&chipcommon 22 0>;
- gpio-mosi = <&chipcommon 23 0>;
+ sck-gpios = <&chipcommon 21 0>;
+ miso-gpios = <&chipcommon 22 0>;
+ mosi-gpios = <&chipcommon 23 0>;
cs-gpios = <&chipcommon 24 0>;
#address-cells = <1>;
#size-cells = <0>;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 137/406] drm/etnaviv: fix dumping of active MMU context
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 136/406] ARM: dts: BCM53573: Use updated "spi-gpio" binding properties Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 138/406] x86/mm: Fix PAT bit missing from page protection modify mask Greg Kroah-Hartman
` (277 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Stach, Christian Gmeiner,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <l.stach@pengutronix.de>
[ Upstream commit 20faf2005ec85fa1a6acc9a74ff27de667f90576 ]
gpu->mmu_context is the MMU context of the last job in the HW queue, which
isn't necessarily the same as the context from the bad job. Dump the MMU
context from the scheduler determined bad submit to make it work as intended.
Fixes: 17e4660ae3d7 ("drm/etnaviv: implement per-process address spaces on MMUv2")
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Christian Gmeiner <christian.gmeiner@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/etnaviv/etnaviv_dump.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_dump.c b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
index 706af0304ca4c..7b57d01ba865b 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_dump.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_dump.c
@@ -125,9 +125,9 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)
return;
etnaviv_dump_core = false;
- mutex_lock(&gpu->mmu_context->lock);
+ mutex_lock(&submit->mmu_context->lock);
- mmu_size = etnaviv_iommu_dump_size(gpu->mmu_context);
+ mmu_size = etnaviv_iommu_dump_size(submit->mmu_context);
/* We always dump registers, mmu, ring, hanging cmdbuf and end marker */
n_obj = 5;
@@ -157,7 +157,7 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)
iter.start = __vmalloc(file_size, GFP_KERNEL | __GFP_NOWARN |
__GFP_NORETRY);
if (!iter.start) {
- mutex_unlock(&gpu->mmu_context->lock);
+ mutex_unlock(&submit->mmu_context->lock);
dev_warn(gpu->dev, "failed to allocate devcoredump file\n");
return;
}
@@ -169,18 +169,18 @@ void etnaviv_core_dump(struct etnaviv_gem_submit *submit)
memset(iter.hdr, 0, iter.data - iter.start);
etnaviv_core_dump_registers(&iter, gpu);
- etnaviv_core_dump_mmu(&iter, gpu->mmu_context, mmu_size);
+ etnaviv_core_dump_mmu(&iter, submit->mmu_context, mmu_size);
etnaviv_core_dump_mem(&iter, ETDUMP_BUF_RING, gpu->buffer.vaddr,
gpu->buffer.size,
etnaviv_cmdbuf_get_va(&gpu->buffer,
- &gpu->mmu_context->cmdbuf_mapping));
+ &submit->mmu_context->cmdbuf_mapping));
etnaviv_core_dump_mem(&iter, ETDUMP_BUF_CMD,
submit->cmdbuf.vaddr, submit->cmdbuf.size,
etnaviv_cmdbuf_get_va(&submit->cmdbuf,
- &gpu->mmu_context->cmdbuf_mapping));
+ &submit->mmu_context->cmdbuf_mapping));
- mutex_unlock(&gpu->mmu_context->lock);
+ mutex_unlock(&submit->mmu_context->lock);
/* Reserve space for the bomap */
if (n_bomap_pages) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 138/406] x86/mm: Fix PAT bit missing from page protection modify mask
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 137/406] drm/etnaviv: fix dumping of active MMU context Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 139/406] ARM: dts: s3c64xx: align pinctrl with dtschema Greg Kroah-Hartman
` (276 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Janusz Krzysztofik, Dave Hansen,
Andi Shyti, Juergen Gross, Marek Marczykowski-Górecki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
[ Upstream commit 548cb932051fb6232ac983ed6673dae7bdf3cf4c ]
Visible glitches have been observed when running graphics applications on
Linux under Xen hypervisor. Those observations have been confirmed with
failures from kms_pwrite_crc Intel GPU test that verifies data coherency
of DRM frame buffer objects using hardware CRC checksums calculated by
display controllers, exposed to userspace via debugfs. Affected
processing paths have then been identified with new IGT test variants that
mmap the objects using different methods and caching modes [1].
When running as a Xen PV guest, Linux uses Xen provided PAT configuration
which is different from its native one. In particular, Xen specific PTE
encoding of write-combining caching, likely used by graphics applications,
differs from the Linux default one found among statically defined minimal
set of supported modes. Since Xen defines PTE encoding of the WC mode as
_PAGE_PAT, it no longer belongs to the minimal set, depends on correct
handling of _PAGE_PAT bit, and can be mismatched with write-back caching.
When a user calls mmap() for a DRM buffer object, DRM device specific
.mmap file operation, called from mmap_region(), takes care of setting PTE
encoding bits in a vm_page_prot field of an associated virtual memory area
structure. Unfortunately, _PAGE_PAT bit is not preserved when the vma's
.vm_flags are then applied to .vm_page_prot via vm_set_page_prot(). Bits
to be preserved are determined with _PAGE_CHG_MASK symbol that doesn't
cover _PAGE_PAT. As a consequence, WB caching is requested instead of WC
when running under Xen (also, WP is silently changed to WT, and UC
downgraded to UC_MINUS). When running on bare metal, WC is not affected,
but WP and WT extra modes are unintentionally replaced with WC and UC,
respectively.
WP and WT modes, encoded with _PAGE_PAT bit set, were introduced by commit
281d4078bec3 ("x86: Make page cache mode a real type"). Care was taken
to extend _PAGE_CACHE_MASK symbol with that additional bit, but that
symbol has never been used for identification of bits preserved when
applying page protection flags. Support for all cache modes under Xen,
including the problematic WC mode, was then introduced by commit
47591df50512 ("xen: Support Xen pv-domains using PAT").
The issue needs to be fixed by including _PAGE_PAT bit into a bitmask used
by pgprot_modify() for selecting bits to be preserved. We can do that
either internally to pgprot_modify() (as initially proposed), or by making
_PAGE_PAT a part of _PAGE_CHG_MASK. If we go for the latter then, since
_PAGE_PAT is the same as _PAGE_PSE, we need to note that _HPAGE_CHG_MASK
-- a huge pmds' counterpart of _PAGE_CHG_MASK, introduced by commit
c489f1257b8c ("thp: add pmd_modify"), defined as (_PAGE_CHG_MASK |
_PAGE_PSE) -- will no longer differ from _PAGE_CHG_MASK. If such
modification of _PAGE_CHG_MASK was irrelevant to its users then one might
wonder why that new _HPAGE_CHG_MASK symbol was introduced instead of
reusing the existing one with that otherwise irrelevant bit (_PAGE_PSE in
that case) added.
Add _PAGE_PAT to _PAGE_CHG_MASK and _PAGE_PAT_LARGE to _HPAGE_CHG_MASK for
symmetry. Split out common bits from both symbols to a common symbol for
clarity.
[ dhansen: tweak the solution changelog description ]
[1] https://gitlab.freedesktop.org/drm/igt-gpu-tools/-/commit/0f0754413f14
Fixes: 281d4078bec3 ("x86: Make page cache mode a real type")
Signed-off-by: Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Tested-by: Marek Marczykowski-Górecki <marmarek@invisiblethingslab.com>
Link: https://gitlab.freedesktop.org/drm/intel/-/issues/7648
Link: https://lore.kernel.org/all/20230710073613.8006-2-janusz.krzysztofik%40linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/pgtable_types.h | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
index 394757ee030a6..85baa72cb8947 100644
--- a/arch/x86/include/asm/pgtable_types.h
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -125,11 +125,12 @@
* instance, and is *not* included in this mask since
* pte_modify() does modify it.
*/
-#define _PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \
- _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY | \
- _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC | \
- _PAGE_UFFD_WP)
-#define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE)
+#define _COMMON_PAGE_CHG_MASK (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT | \
+ _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY |\
+ _PAGE_SOFT_DIRTY | _PAGE_DEVMAP | _PAGE_ENC | \
+ _PAGE_UFFD_WP)
+#define _PAGE_CHG_MASK (_COMMON_PAGE_CHG_MASK | _PAGE_PAT)
+#define _HPAGE_CHG_MASK (_COMMON_PAGE_CHG_MASK | _PAGE_PSE | _PAGE_PAT_LARGE)
/*
* The cache modes defined here are used to translate between pure SW usage
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 139/406] ARM: dts: s3c64xx: align pinctrl with dtschema
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 138/406] x86/mm: Fix PAT bit missing from page protection modify mask Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 140/406] ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) Greg Kroah-Hartman
` (275 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
[ Upstream commit 9e47ccc01284aba7fe5fbf6ee2a7abc29bf2a740 ]
Align the pin controller related nodes with dtschema. No functional
change expected.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
Link: https://lore.kernel.org/r/20220111201722.327219-16-krzysztof.kozlowski@canonical.com
Stable-dep-of: cf0cb2af6a18 ("ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/s3c6410-mini6410.dts | 4 +-
arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++++++++-------------
2 files changed, 107 insertions(+), 107 deletions(-)
diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
index 285555b9ed943..17097da36f5ed 100644
--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
+++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
@@ -193,12 +193,12 @@ &uart3 {
};
&pinctrl0 {
- gpio_leds: gpio-leds {
+ gpio_leds: gpio-leds-pins {
samsung,pins = "gpk-4", "gpk-5", "gpk-6", "gpk-7";
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- gpio_keys: gpio-keys {
+ gpio_keys: gpio-keys-pins {
samsung,pins = "gpn-0", "gpn-1", "gpn-2", "gpn-3",
"gpn-4", "gpn-5", "gpl-11", "gpl-12";
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
diff --git a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
index 8e9594d64b579..0a3186d57cb56 100644
--- a/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
+++ b/arch/arm/boot/dts/s3c64xx-pinctrl.dtsi
@@ -16,111 +16,111 @@ &pinctrl0 {
* Pin banks
*/
- gpa: gpa {
+ gpa: gpa-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpb: gpb {
+ gpb: gpb-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpc: gpc {
+ gpc: gpc-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpd: gpd {
+ gpd: gpd-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpe: gpe {
+ gpe: gpe-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
};
- gpf: gpf {
+ gpf: gpf-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpg: gpg {
+ gpg: gpg-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gph: gph {
+ gph: gph-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpi: gpi {
+ gpi: gpi-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
};
- gpj: gpj {
+ gpj: gpj-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
};
- gpk: gpk {
+ gpk: gpk-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
};
- gpl: gpl {
+ gpl: gpl-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpm: gpm {
+ gpm: gpm-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpn: gpn {
+ gpn: gpn-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpo: gpo {
+ gpo: gpo-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpp: gpp {
+ gpp: gpp-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
#interrupt-cells = <2>;
};
- gpq: gpq {
+ gpq: gpq-gpio-bank {
gpio-controller;
#gpio-cells = <2>;
interrupt-controller;
@@ -131,225 +131,225 @@ gpq: gpq {
* Pin groups
*/
- uart0_data: uart0-data {
+ uart0_data: uart0-data-pins {
samsung,pins = "gpa-0", "gpa-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- uart0_fctl: uart0-fctl {
+ uart0_fctl: uart0-fctl-pins {
samsung,pins = "gpa-2", "gpa-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- uart1_data: uart1-data {
+ uart1_data: uart1-data-pins {
samsung,pins = "gpa-4", "gpa-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- uart1_fctl: uart1-fctl {
+ uart1_fctl: uart1-fctl-pins {
samsung,pins = "gpa-6", "gpa-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- uart2_data: uart2-data {
+ uart2_data: uart2-data-pins {
samsung,pins = "gpb-0", "gpb-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- uart3_data: uart3-data {
+ uart3_data: uart3-data-pins {
samsung,pins = "gpb-2", "gpb-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- ext_dma_0: ext-dma-0 {
+ ext_dma_0: ext-dma-0-pins {
samsung,pins = "gpb-0", "gpb-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- ext_dma_1: ext-dma-1 {
+ ext_dma_1: ext-dma-1-pins {
samsung,pins = "gpb-2", "gpb-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- irda_data_0: irda-data-0 {
+ irda_data_0: irda-data-0-pins {
samsung,pins = "gpb-0", "gpb-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- irda_data_1: irda-data-1 {
+ irda_data_1: irda-data-1-pins {
samsung,pins = "gpb-2", "gpb-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- irda_sdbw: irda-sdbw {
+ irda_sdbw: irda-sdbw-pins {
samsung,pins = "gpb-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2c0_bus: i2c0-bus {
+ i2c0_bus: i2c0-bus-pins {
samsung,pins = "gpb-5", "gpb-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
};
- i2c1_bus: i2c1-bus {
+ i2c1_bus: i2c1-bus-pins {
/* S3C6410-only */
samsung,pins = "gpb-2", "gpb-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_6>;
samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
};
- spi0_bus: spi0-bus {
+ spi0_bus: spi0-bus-pins {
samsung,pins = "gpc-0", "gpc-1", "gpc-2";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
};
- spi0_cs: spi0-cs {
+ spi0_cs: spi0-cs-pins {
samsung,pins = "gpc-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- spi1_bus: spi1-bus {
+ spi1_bus: spi1-bus-pins {
samsung,pins = "gpc-4", "gpc-5", "gpc-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
};
- spi1_cs: spi1-cs {
+ spi1_cs: spi1-cs-pins {
samsung,pins = "gpc-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd0_cmd: sd0-cmd {
+ sd0_cmd: sd0-cmd-pins {
samsung,pins = "gpg-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd0_clk: sd0-clk {
+ sd0_clk: sd0-clk-pins {
samsung,pins = "gpg-0";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd0_bus1: sd0-bus1 {
+ sd0_bus1: sd0-bus1-pins {
samsung,pins = "gpg-2";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd0_bus4: sd0-bus4 {
+ sd0_bus4: sd0-bus4-pins {
samsung,pins = "gpg-2", "gpg-3", "gpg-4", "gpg-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd0_cd: sd0-cd {
+ sd0_cd: sd0-cd-pins {
samsung,pins = "gpg-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
};
- sd1_cmd: sd1-cmd {
+ sd1_cmd: sd1-cmd-pins {
samsung,pins = "gph-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd1_clk: sd1-clk {
+ sd1_clk: sd1-clk-pins {
samsung,pins = "gph-0";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd1_bus1: sd1-bus1 {
+ sd1_bus1: sd1-bus1-pins {
samsung,pins = "gph-2";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd1_bus4: sd1-bus4 {
+ sd1_bus4: sd1-bus4-pins {
samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd1_bus8: sd1-bus8 {
+ sd1_bus8: sd1-bus8-pins {
samsung,pins = "gph-2", "gph-3", "gph-4", "gph-5",
"gph-6", "gph-7", "gph-8", "gph-9";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd1_cd: sd1-cd {
+ sd1_cd: sd1-cd-pins {
samsung,pins = "gpg-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_UP>;
};
- sd2_cmd: sd2-cmd {
+ sd2_cmd: sd2-cmd-pins {
samsung,pins = "gpc-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd2_clk: sd2-clk {
+ sd2_clk: sd2-clk-pins {
samsung,pins = "gpc-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd2_bus1: sd2-bus1 {
+ sd2_bus1: sd2-bus1-pins {
samsung,pins = "gph-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- sd2_bus4: sd2-bus4 {
+ sd2_bus4: sd2-bus4-pins {
samsung,pins = "gph-6", "gph-7", "gph-8", "gph-9";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2s0_bus: i2s0-bus {
+ i2s0_bus: i2s0-bus-pins {
samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2s0_cdclk: i2s0-cdclk {
+ i2s0_cdclk: i2s0-cdclk-pins {
samsung,pins = "gpd-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2s1_bus: i2s1-bus {
+ i2s1_bus: i2s1-bus-pins {
samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2s1_cdclk: i2s1-cdclk {
+ i2s1_cdclk: i2s1-cdclk-pins {
samsung,pins = "gpe-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2s2_bus: i2s2-bus {
+ i2s2_bus: i2s2-bus-pins {
/* S3C6410-only */
samsung,pins = "gpc-4", "gpc-5", "gpc-6", "gph-6",
"gph-8", "gph-9";
@@ -357,50 +357,50 @@ i2s2_bus: i2s2-bus {
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- i2s2_cdclk: i2s2-cdclk {
+ i2s2_cdclk: i2s2-cdclk-pins {
/* S3C6410-only */
samsung,pins = "gph-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_5>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pcm0_bus: pcm0-bus {
+ pcm0_bus: pcm0-bus-pins {
samsung,pins = "gpd-0", "gpd-2", "gpd-3", "gpd-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pcm0_extclk: pcm0-extclk {
+ pcm0_extclk: pcm0-extclk-pins {
samsung,pins = "gpd-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pcm1_bus: pcm1-bus {
+ pcm1_bus: pcm1-bus-pins {
samsung,pins = "gpe-0", "gpe-2", "gpe-3", "gpe-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pcm1_extclk: pcm1-extclk {
+ pcm1_extclk: pcm1-extclk-pins {
samsung,pins = "gpe-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- ac97_bus_0: ac97-bus-0 {
+ ac97_bus_0: ac97-bus-0-pins {
samsung,pins = "gpd-0", "gpd-1", "gpd-2", "gpd-3", "gpd-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- ac97_bus_1: ac97-bus-1 {
+ ac97_bus_1: ac97-bus-1-pins {
samsung,pins = "gpe-0", "gpe-1", "gpe-2", "gpe-3", "gpe-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- cam_port: cam-port {
+ cam_port: cam-port-pins {
samsung,pins = "gpf-0", "gpf-1", "gpf-2", "gpf-4",
"gpf-5", "gpf-6", "gpf-7", "gpf-8",
"gpf-9", "gpf-10", "gpf-11", "gpf-12";
@@ -408,242 +408,242 @@ cam_port: cam-port {
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- cam_rst: cam-rst {
+ cam_rst: cam-rst-pins {
samsung,pins = "gpf-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- cam_field: cam-field {
+ cam_field: cam-field-pins {
/* S3C6410-only */
samsung,pins = "gpb-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pwm_extclk: pwm-extclk {
+ pwm_extclk: pwm-extclk-pins {
samsung,pins = "gpf-13";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pwm0_out: pwm0-out {
+ pwm0_out: pwm0-out-pins {
samsung,pins = "gpf-14";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- pwm1_out: pwm1-out {
+ pwm1_out: pwm1-out-pins {
samsung,pins = "gpf-15";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- clkout0: clkout-0 {
+ clkout0: clkout-0-pins {
samsung,pins = "gpf-14";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col0_0: keypad-col0-0 {
+ keypad_col0_0: keypad-col0-0-pins {
samsung,pins = "gph-0";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col1_0: keypad-col1-0 {
+ keypad_col1_0: keypad-col1-0-pins {
samsung,pins = "gph-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col2_0: keypad-col2-0 {
+ keypad_col2_0: keypad-col2-0-pins {
samsung,pins = "gph-2";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col3_0: keypad-col3-0 {
+ keypad_col3_0: keypad-col3-0-pins {
samsung,pins = "gph-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col4_0: keypad-col4-0 {
+ keypad_col4_0: keypad-col4-0-pins {
samsung,pins = "gph-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col5_0: keypad-col5-0 {
+ keypad_col5_0: keypad-col5-0-pins {
samsung,pins = "gph-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col6_0: keypad-col6-0 {
+ keypad_col6_0: keypad-col6-0-pins {
samsung,pins = "gph-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col7_0: keypad-col7-0 {
+ keypad_col7_0: keypad-col7-0-pins {
samsung,pins = "gph-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_4>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col0_1: keypad-col0-1 {
+ keypad_col0_1: keypad-col0-1-pins {
samsung,pins = "gpl-0";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col1_1: keypad-col1-1 {
+ keypad_col1_1: keypad-col1-1-pins {
samsung,pins = "gpl-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col2_1: keypad-col2-1 {
+ keypad_col2_1: keypad-col2-1-pins {
samsung,pins = "gpl-2";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col3_1: keypad-col3-1 {
+ keypad_col3_1: keypad-col3-1-pins {
samsung,pins = "gpl-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col4_1: keypad-col4-1 {
+ keypad_col4_1: keypad-col4-1-pins {
samsung,pins = "gpl-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col5_1: keypad-col5-1 {
+ keypad_col5_1: keypad-col5-1-pins {
samsung,pins = "gpl-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col6_1: keypad-col6-1 {
+ keypad_col6_1: keypad-col6-1-pins {
samsung,pins = "gpl-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_col7_1: keypad-col7-1 {
+ keypad_col7_1: keypad-col7-1-pins {
samsung,pins = "gpl-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row0_0: keypad-row0-0 {
+ keypad_row0_0: keypad-row0-0-pins {
samsung,pins = "gpk-8";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row1_0: keypad-row1-0 {
+ keypad_row1_0: keypad-row1-0-pins {
samsung,pins = "gpk-9";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row2_0: keypad-row2-0 {
+ keypad_row2_0: keypad-row2-0-pins {
samsung,pins = "gpk-10";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row3_0: keypad-row3-0 {
+ keypad_row3_0: keypad-row3-0-pins {
samsung,pins = "gpk-11";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row4_0: keypad-row4-0 {
+ keypad_row4_0: keypad-row4-0-pins {
samsung,pins = "gpk-12";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row5_0: keypad-row5-0 {
+ keypad_row5_0: keypad-row5-0-pins {
samsung,pins = "gpk-13";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row6_0: keypad-row6-0 {
+ keypad_row6_0: keypad-row6-0-pins {
samsung,pins = "gpk-14";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row7_0: keypad-row7-0 {
+ keypad_row7_0: keypad-row7-0-pins {
samsung,pins = "gpk-15";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row0_1: keypad-row0-1 {
+ keypad_row0_1: keypad-row0-1-pins {
samsung,pins = "gpn-0";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row1_1: keypad-row1-1 {
+ keypad_row1_1: keypad-row1-1-pins {
samsung,pins = "gpn-1";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row2_1: keypad-row2-1 {
+ keypad_row2_1: keypad-row2-1-pins {
samsung,pins = "gpn-2";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row3_1: keypad-row3-1 {
+ keypad_row3_1: keypad-row3-1-pins {
samsung,pins = "gpn-3";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row4_1: keypad-row4-1 {
+ keypad_row4_1: keypad-row4-1-pins {
samsung,pins = "gpn-4";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row5_1: keypad-row5-1 {
+ keypad_row5_1: keypad-row5-1-pins {
samsung,pins = "gpn-5";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row6_1: keypad-row6-1 {
+ keypad_row6_1: keypad-row6-1-pins {
samsung,pins = "gpn-6";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- keypad_row7_1: keypad-row7-1 {
+ keypad_row7_1: keypad-row7-1-pins {
samsung,pins = "gpn-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- lcd_ctrl: lcd-ctrl {
+ lcd_ctrl: lcd-ctrl-pins {
samsung,pins = "gpj-8", "gpj-9", "gpj-10", "gpj-11";
samsung,pin-function = <EXYNOS_PIN_FUNC_2>;
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- lcd_data16: lcd-data-width16 {
+ lcd_data16: lcd-data-width16-pins {
samsung,pins = "gpi-3", "gpi-4", "gpi-5", "gpi-6",
"gpi-7", "gpi-10", "gpi-11", "gpi-12",
"gpi-13", "gpi-14", "gpi-15", "gpj-3",
@@ -652,7 +652,7 @@ lcd_data16: lcd-data-width16 {
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- lcd_data18: lcd-data-width18 {
+ lcd_data18: lcd-data-width18-pins {
samsung,pins = "gpi-2", "gpi-3", "gpi-4", "gpi-5",
"gpi-6", "gpi-7", "gpi-10", "gpi-11",
"gpi-12", "gpi-13", "gpi-14", "gpi-15",
@@ -662,7 +662,7 @@ lcd_data18: lcd-data-width18 {
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- lcd_data24: lcd-data-width24 {
+ lcd_data24: lcd-data-width24-pins {
samsung,pins = "gpi-0", "gpi-1", "gpi-2", "gpi-3",
"gpi-4", "gpi-5", "gpi-6", "gpi-7",
"gpi-8", "gpi-9", "gpi-10", "gpi-11",
@@ -673,7 +673,7 @@ lcd_data24: lcd-data-width24 {
samsung,pin-pud = <S3C64XX_PIN_PULL_NONE>;
};
- hsi_bus: hsi-bus {
+ hsi_bus: hsi-bus-pins {
samsung,pins = "gpk-0", "gpk-1", "gpk-2", "gpk-3",
"gpk-4", "gpk-5", "gpk-6", "gpk-7";
samsung,pin-function = <EXYNOS_PIN_FUNC_3>;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 140/406] ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 139/406] ARM: dts: s3c64xx: align pinctrl with dtschema Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 141/406] ARM: dts: s5pv210: adjust node names to DT spec Greg Kroah-Hartman
` (274 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alim Akhtar, Krzysztof Kozlowski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit cf0cb2af6a18f28b84f9f1416bff50ca60d6e98a ]
The davicom,dm9000 Ethernet Controller accepts two reg addresses.
Fixes: a43736deb47d ("ARM: dts: Add dts file for S3C6410-based Mini6410 board")
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Link: https://lore.kernel.org/r/20230713152926.82884-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/s3c6410-mini6410.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/s3c6410-mini6410.dts b/arch/arm/boot/dts/s3c6410-mini6410.dts
index 17097da36f5ed..0b07b3c319604 100644
--- a/arch/arm/boot/dts/s3c6410-mini6410.dts
+++ b/arch/arm/boot/dts/s3c6410-mini6410.dts
@@ -51,7 +51,7 @@ srom-cs1-bus@18000000 {
ethernet@18000000 {
compatible = "davicom,dm9000";
- reg = <0x18000000 0x2 0x18000004 0x2>;
+ reg = <0x18000000 0x2>, <0x18000004 0x2>;
interrupt-parent = <&gpn>;
interrupts = <7 IRQ_TYPE_LEVEL_HIGH>;
davicom,no-eeprom;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 141/406] ARM: dts: s5pv210: adjust node names to DT spec
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 140/406] ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 142/406] ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 Greg Kroah-Hartman
` (273 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzk@kernel.org>
[ Upstream commit b04544ac0d1f2a51e0f3234045343aa741d64e7b ]
The Devicetree specification expects device node names to have a generic
name, representing the class of a device. Also the convention for node
names is to use hyphens, not underscores.
No functional changes.
Signed-off-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20201027170947.132725-10-krzk@kernel.org
Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/s5pv210-aquila.dts | 12 ++++++------
arch/arm/boot/dts/s5pv210-aries.dtsi | 4 ++--
arch/arm/boot/dts/s5pv210-goni.dts | 14 +++++++-------
arch/arm/boot/dts/s5pv210-smdkv210.dts | 20 ++++++++++----------
4 files changed, 25 insertions(+), 25 deletions(-)
diff --git a/arch/arm/boot/dts/s5pv210-aquila.dts b/arch/arm/boot/dts/s5pv210-aquila.dts
index 8e57e5a1f0c51..6423348034b68 100644
--- a/arch/arm/boot/dts/s5pv210-aquila.dts
+++ b/arch/arm/boot/dts/s5pv210-aquila.dts
@@ -277,37 +277,37 @@ &keypad {
<&keypad_col0>, <&keypad_col1>, <&keypad_col2>;
status = "okay";
- key_1 {
+ key-1 {
keypad,row = <0>;
keypad,column = <1>;
linux,code = <KEY_CONNECT>;
};
- key_2 {
+ key-2 {
keypad,row = <0>;
keypad,column = <2>;
linux,code = <KEY_BACK>;
};
- key_3 {
+ key-3 {
keypad,row = <1>;
keypad,column = <1>;
linux,code = <KEY_CAMERA_FOCUS>;
};
- key_4 {
+ key-4 {
keypad,row = <1>;
keypad,column = <2>;
linux,code = <KEY_VOLUMEUP>;
};
- key_5 {
+ key-5 {
keypad,row = <2>;
keypad,column = <1>;
linux,code = <KEY_CAMERA>;
};
- key_6 {
+ key-6 {
keypad,row = <2>;
keypad,column = <2>;
linux,code = <KEY_VOLUMEDOWN>;
diff --git a/arch/arm/boot/dts/s5pv210-aries.dtsi b/arch/arm/boot/dts/s5pv210-aries.dtsi
index 984bc8dc5e4bd..8f7dcd7af0bc9 100644
--- a/arch/arm/boot/dts/s5pv210-aries.dtsi
+++ b/arch/arm/boot/dts/s5pv210-aries.dtsi
@@ -54,7 +54,7 @@ pmic_ap_clk: clock-0 {
clock-frequency = <32768>;
};
- bt_codec: bt_sco {
+ bt_codec: bt-sco {
compatible = "linux,bt-sco";
#sound-dai-cells = <0>;
};
@@ -113,7 +113,7 @@ i2c_sound: i2c-gpio-0 {
pinctrl-names = "default";
pinctrl-0 = <&sound_i2c_pins>;
- wm8994: wm8994@1a {
+ wm8994: audio-codec@1a {
compatible = "wlf,wm8994";
reg = <0x1a>;
diff --git a/arch/arm/boot/dts/s5pv210-goni.dts b/arch/arm/boot/dts/s5pv210-goni.dts
index ad8d5d2fa32d7..5c1e12d39747b 100644
--- a/arch/arm/boot/dts/s5pv210-goni.dts
+++ b/arch/arm/boot/dts/s5pv210-goni.dts
@@ -259,37 +259,37 @@ &keypad {
<&keypad_col0>, <&keypad_col1>, <&keypad_col2>;
status = "okay";
- key_1 {
+ key-1 {
keypad,row = <0>;
keypad,column = <1>;
linux,code = <KEY_CONNECT>;
};
- key_2 {
+ key-2 {
keypad,row = <0>;
keypad,column = <2>;
linux,code = <KEY_BACK>;
};
- key_3 {
+ key-3 {
keypad,row = <1>;
keypad,column = <1>;
linux,code = <KEY_CAMERA_FOCUS>;
};
- key_4 {
+ key-4 {
keypad,row = <1>;
keypad,column = <2>;
linux,code = <KEY_VOLUMEUP>;
};
- key_5 {
+ key-5 {
keypad,row = <2>;
keypad,column = <1>;
linux,code = <KEY_CAMERA>;
};
- key_6 {
+ key-6 {
keypad,row = <2>;
keypad,column = <2>;
linux,code = <KEY_VOLUMEDOWN>;
@@ -353,7 +353,7 @@ &i2c2 {
samsung,i2c-slave-addr = <0x10>;
status = "okay";
- tsp@4a {
+ touchscreen@4a {
compatible = "atmel,maxtouch";
reg = <0x4a>;
interrupt-parent = <&gpj0>;
diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
index 7459e41e8ef13..fbae768d65e27 100644
--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
+++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
@@ -76,61 +76,61 @@ &keypad {
<&keypad_col6>, <&keypad_col7>;
status = "okay";
- key_1 {
+ key-1 {
keypad,row = <0>;
keypad,column = <3>;
linux,code = <KEY_1>;
};
- key_2 {
+ key-2 {
keypad,row = <0>;
keypad,column = <4>;
linux,code = <KEY_2>;
};
- key_3 {
+ key-3 {
keypad,row = <0>;
keypad,column = <5>;
linux,code = <KEY_3>;
};
- key_4 {
+ key-4 {
keypad,row = <0>;
keypad,column = <6>;
linux,code = <KEY_4>;
};
- key_5 {
+ key-5 {
keypad,row = <0
>;
keypad,column = <7>;
linux,code = <KEY_5>;
};
- key_6 {
+ key-6 {
keypad,row = <1>;
keypad,column = <3>;
linux,code = <KEY_A>;
};
- key_7 {
+ key-7 {
keypad,row = <1>;
keypad,column = <4>;
linux,code = <KEY_B>;
};
- key_8 {
+ key-8 {
keypad,row = <1>;
keypad,column = <5>;
linux,code = <KEY_C>;
};
- key_9 {
+ key-9 {
keypad,row = <1>;
keypad,column = <6>;
linux,code = <KEY_D>;
};
- key_10 {
+ key-10 {
keypad,row = <1>;
keypad,column = <7>;
linux,code = <KEY_E>;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 142/406] ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 141/406] ARM: dts: s5pv210: adjust node names to DT spec Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 143/406] ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) Greg Kroah-Hartman
` (272 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit b77904ba177a9c67b6dbc3637fdf1faa22df6e5c ]
Backlight is supplied by DC5V regulator. The DTS has no PMIC node, so
just add a regulator-fixed to solve it and fix dtbs_check warning:
s5pv210-smdkv210.dtb: backlight: 'power-supply' is a required property
Link: https://lore.kernel.org/r/20230421095721.31857-4-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Stable-dep-of: 982655cb0e7f ("ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/s5pv210-smdkv210.dts | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
index fbae768d65e27..6e26c67e0a26e 100644
--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
+++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
@@ -55,6 +55,14 @@ backlight {
default-brightness-level = <6>;
pinctrl-names = "default";
pinctrl-0 = <&pwm3_out>;
+ power-supply = <&dc5v_reg>;
+ };
+
+ dc5v_reg: regulator-0 {
+ compatible = "regulator-fixed";
+ regulator-name = "DC5V";
+ regulator-min-microvolt = <5000000>;
+ regulator-max-microvolt = <5000000>;
};
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 143/406] ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 142/406] ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 144/406] drm: adv7511: Fix low refresh rate register for ADV7533/5 Greg Kroah-Hartman
` (271 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alim Akhtar, Krzysztof Kozlowski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 982655cb0e7f18934d7532c32366e574ad61dbd7 ]
The davicom,dm9000 Ethernet Controller accepts two reg addresses.
Fixes: b672b27d232e ("ARM: dts: Add Device tree for s5pc110/s5pv210 boards")
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Link: https://lore.kernel.org/r/20230713152926.82884-2-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/s5pv210-smdkv210.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/s5pv210-smdkv210.dts b/arch/arm/boot/dts/s5pv210-smdkv210.dts
index 6e26c67e0a26e..901e7197b1368 100644
--- a/arch/arm/boot/dts/s5pv210-smdkv210.dts
+++ b/arch/arm/boot/dts/s5pv210-smdkv210.dts
@@ -41,7 +41,7 @@ pmic_ap_clk: clock-0 {
ethernet@a8000000 {
compatible = "davicom,dm9000";
- reg = <0xA8000000 0x2 0xA8000002 0x2>;
+ reg = <0xa8000000 0x2>, <0xa8000002 0x2>;
interrupt-parent = <&gph1>;
interrupts = <1 IRQ_TYPE_LEVEL_HIGH>;
local-mac-address = [00 00 de ad be ef];
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 144/406] drm: adv7511: Fix low refresh rate register for ADV7533/5
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 143/406] ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 145/406] ARM: dts: BCM53573: Fix Ethernet info for Luxul devices Greg Kroah-Hartman
` (270 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Foss, Nuno Sa,
Bogdan Togorean, Alexandru Ardelean, Frieder Schrempf,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bogdan Togorean <bogdan.togorean@analog.com>
[ Upstream commit d281eeaa4de2636ff0c8e6ae387bb07b50e5fcbb ]
For ADV7533 and ADV7535 low refresh rate is selected using
bits [3:2] of 0x4a main register.
So depending on ADV model write 0xfb or 0x4a register.
Fixes: 2437e7cd88e8 ("drm/bridge: adv7533: Initial support for ADV7533")
Reviewed-by: Robert Foss <rfoss@kernel.org>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Signed-off-by: Bogdan Togorean <bogdan.togorean@analog.com>
Signed-off-by: Alexandru Ardelean <alex@shruggie.ro>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230719060143.63649-1-alex@shruggie.ro
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
index 6ba860a16e96c..e50c741cbfe72 100644
--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
@@ -786,8 +786,13 @@ static void adv7511_mode_set(struct adv7511 *adv7511,
else
low_refresh_rate = ADV7511_LOW_REFRESH_RATE_NONE;
- regmap_update_bits(adv7511->regmap, 0xfb,
- 0x6, low_refresh_rate << 1);
+ if (adv7511->type == ADV7511)
+ regmap_update_bits(adv7511->regmap, 0xfb,
+ 0x6, low_refresh_rate << 1);
+ else
+ regmap_update_bits(adv7511->regmap, 0x4a,
+ 0xc, low_refresh_rate << 2);
+
regmap_update_bits(adv7511->regmap, 0x17,
0x60, (vsync_polarity << 6) | (hsync_polarity << 5));
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 145/406] ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 144/406] drm: adv7511: Fix low refresh rate register for ADV7533/5 Greg Kroah-Hartman
@ 2023-09-17 19:09 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 146/406] arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC Greg Kroah-Hartman
` (269 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:09 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafał Miłecki,
Florian Fainelli, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
[ Upstream commit 44ad8207806973f4e4f7d870fff36cc01f494250 ]
Both Luxul's XAP devices (XAP-810 and XAP-1440) are access points that
use a non-default design. They don't include switch but have a single
Ethernet port and BCM54210E PHY connected to the Ethernet controller's
MDIO bus.
Support for those devices regressed due to two changes:
1. Describing MDIO bus with switch
After commit 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125
rev 4 switch") Linux stopped probing for MDIO devices.
2. Dropping hardcoded BCM54210E delays
In commit fea7fda7f50a ("net: phy: broadcom: Fix RGMII delays
configuration for BCM54210E") support for other PHY modes was added but
that requires a proper "phy-mode" value in DT.
Both above changes are correct (they don't need to be reverted or
anything) but they need this fix for DT data to be correct and for Linux
to work properly.
Fixes: 9fb90ae6cae7 ("ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch")
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230713111145.14864-1-zajec5@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +++++++++++++
arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +++++++++++++
2 files changed, 26 insertions(+)
diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
index 57ca1cfaecd8e..00e688b45d981 100644
--- a/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
+++ b/arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts
@@ -46,3 +46,16 @@ restart {
};
};
};
+
+&gmac0 {
+ phy-mode = "rgmii";
+ phy-handle = <&bcm54210e>;
+
+ mdio {
+ /delete-node/ switch@1e;
+
+ bcm54210e: ethernet-phy@0 {
+ reg = <0>;
+ };
+ };
+};
diff --git a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
index 2e1a7e382cb7a..78c80a5d3f4fa 100644
--- a/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
+++ b/arch/arm/boot/dts/bcm47189-luxul-xap-810.dts
@@ -83,3 +83,16 @@ pcie0_chipcommon: chipcommon@0 {
};
};
};
+
+&gmac0 {
+ phy-mode = "rgmii";
+ phy-handle = <&bcm54210e>;
+
+ mdio {
+ /delete-node/ switch@1e;
+
+ bcm54210e: ethernet-phy@0 {
+ reg = <0>;
+ };
+ };
+};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 146/406] arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-09-17 19:09 ` [PATCH 5.10 145/406] ARM: dts: BCM53573: Fix Ethernet info for Luxul devices Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 147/406] arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" Greg Kroah-Hartman
` (268 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Manivannan Sadhasivam, Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit 4b6ea15c0a1122422b44bf6c47a3c22fc8d46777 ]
GCC and it's GDSCs are under the RPMh CX power domain. So let's add the
missing RPMh power domain to the GCC node.
Fixes: 6d4cf750d03a ("arm64: dts: sdm845: Add minimal dts/dtsi files for sdm845 SoC and MTP")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Co-developed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20230720054100.9940-4-manivannan.sadhasivam@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 71e5b9fdc9e16..418356c3f89fb 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -1064,6 +1064,7 @@ gcc: clock-controller@100000 {
#clock-cells = <1>;
#reset-cells = <1>;
#power-domain-cells = <1>;
+ power-domains = <&rpmhpd SDM845_CX>;
};
qfprom@784000 {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 147/406] arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 146/406] arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 148/406] drm/amdgpu: Update min() to min_t() in amdgpu_info_ioctl Greg Kroah-Hartman
` (267 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[ Upstream commit bbbef6e24bc4493602df68b052f6f48d48e3184a ]
Minimum frequency of the "ice_core_clk" should be 75MHz as specified in the
downstream vendor devicetree. So fix it!
https://git.codelinaro.org/clo/la/kernel/msm-4.9/-/blob/LA.UM.7.3.r1-09300-sdm845.0/arch/arm64/boot/dts/qcom/sdm845.dtsi
Fixes: 433f9a57298f ("arm64: dts: sdm845: add Inline Crypto Engine registers and clock")
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20230720054100.9940-5-manivannan.sadhasivam@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 418356c3f89fb..5c696ebf5c20c 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -2109,7 +2109,7 @@ ufs_mem_hc: ufshc@1d84000 {
<0 0>,
<0 0>,
<0 0>,
- <0 300000000>;
+ <75000000 300000000>;
status = "disabled";
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 148/406] drm/amdgpu: Update min() to min_t() in amdgpu_info_ioctl
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 147/406] arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 149/406] md/bitmap: dont set max_write_behind if there is no write mostly device Greg Kroah-Hartman
` (266 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher,
Srinivasan Shanmugam, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
[ Upstream commit a0cc8e1512ad72c9f97cdcb76d42715730adaf62 ]
Fixes the following:
WARNING: min() should probably be min_t(size_t, size, sizeof(ip))
+ ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip)));
And other style fixes:
WARNING: Prefer 'unsigned int' to bare use of 'unsigned'
WARNING: Missing a blank line after declarations
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 917b94002f4b7..93a4b52f4a73b 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -505,6 +505,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
crtc = (struct drm_crtc *)minfo->crtcs[i];
if (crtc && crtc->base.id == info->mode_crtc.id) {
struct amdgpu_crtc *amdgpu_crtc = to_amdgpu_crtc(crtc);
+
ui32 = amdgpu_crtc->crtc_id;
found = 1;
break;
@@ -523,7 +524,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
if (ret)
return ret;
- ret = copy_to_user(out, &ip, min((size_t)size, sizeof(ip)));
+ ret = copy_to_user(out, &ip, min_t(size_t, size, sizeof(ip)));
return ret ? -EFAULT : 0;
}
case AMDGPU_INFO_HW_IP_COUNT: {
@@ -671,17 +672,18 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
? -EFAULT : 0;
}
case AMDGPU_INFO_READ_MMR_REG: {
- unsigned n, alloc_size;
+ unsigned int n, alloc_size;
uint32_t *regs;
- unsigned se_num = (info->read_mmr_reg.instance >>
+ unsigned int se_num = (info->read_mmr_reg.instance >>
AMDGPU_INFO_MMR_SE_INDEX_SHIFT) &
AMDGPU_INFO_MMR_SE_INDEX_MASK;
- unsigned sh_num = (info->read_mmr_reg.instance >>
+ unsigned int sh_num = (info->read_mmr_reg.instance >>
AMDGPU_INFO_MMR_SH_INDEX_SHIFT) &
AMDGPU_INFO_MMR_SH_INDEX_MASK;
/* set full masks if the userspace set all bits
- * in the bitfields */
+ * in the bitfields
+ */
if (se_num == AMDGPU_INFO_MMR_SE_INDEX_MASK)
se_num = 0xffffffff;
else if (se_num >= AMDGPU_GFX_MAX_SE)
@@ -799,7 +801,7 @@ static int amdgpu_info_ioctl(struct drm_device *dev, void *data, struct drm_file
min((size_t)size, sizeof(dev_info))) ? -EFAULT : 0;
}
case AMDGPU_INFO_VCE_CLOCK_TABLE: {
- unsigned i;
+ unsigned int i;
struct drm_amdgpu_info_vce_clock_table vce_clk_table = {};
struct amd_vce_state *vce_state;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 149/406] md/bitmap: dont set max_write_behind if there is no write mostly device
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 148/406] drm/amdgpu: Update min() to min_t() in amdgpu_info_ioctl Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 150/406] md/md-bitmap: hold reconfig_mutex in backlog_store() Greg Kroah-Hartman
` (265 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Song Liu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@linux.dev>
[ Upstream commit 8c13ab115b577bd09097b9d77916732e97e31b7b ]
We shouldn't set it since write behind IO should only happen to write
mostly device.
Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Signed-off-by: Song Liu <songliubraving@fb.com>
Stable-dep-of: 44abfa6a95df ("md/md-bitmap: hold 'reconfig_mutex' in backlog_store()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index f843ade442dec..eb8a2d5ba83f4 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2476,11 +2476,30 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
{
unsigned long backlog;
unsigned long old_mwb = mddev->bitmap_info.max_write_behind;
+ struct md_rdev *rdev;
+ bool has_write_mostly = false;
int rv = kstrtoul(buf, 10, &backlog);
if (rv)
return rv;
if (backlog > COUNTER_MAX)
return -EINVAL;
+
+ /*
+ * Without write mostly device, it doesn't make sense to set
+ * backlog for max_write_behind.
+ */
+ rdev_for_each(rdev, mddev) {
+ if (test_bit(WriteMostly, &rdev->flags)) {
+ has_write_mostly = true;
+ break;
+ }
+ }
+ if (!has_write_mostly) {
+ pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n",
+ mdname(mddev));
+ return -EINVAL;
+ }
+
mddev->bitmap_info.max_write_behind = backlog;
if (!backlog && mddev->serial_info_pool) {
/* serial_info_pool is not needed if backlog is zero */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 150/406] md/md-bitmap: hold reconfig_mutex in backlog_store()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 149/406] md/bitmap: dont set max_write_behind if there is no write mostly device Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 151/406] drm/tegra: Remove superfluous error messages around platform_get_irq() Greg Kroah-Hartman
` (264 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Song Liu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
[ Upstream commit 44abfa6a95df425c0660d56043020b67e6d93ab8 ]
Several reasons why 'reconfig_mutex' should be held:
1) rdev_for_each() is not safe to be called without the lock, because
rdev can be removed concurrently.
2) mddev_destroy_serial_pool() and mddev_create_serial_pool() should not
be called concurrently.
3) mddev_suspend() from mddev_destroy/create_serial_pool() should be
protected by the lock.
Fixes: 10c92fca636e ("md-bitmap: create and destroy wb_info_pool with the change of backlog")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20230706083727.608914-3-yukuai1@huaweicloud.com
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/md/md-bitmap.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c
index eb8a2d5ba83f4..d18ca119929e1 100644
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2484,6 +2484,10 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
if (backlog > COUNTER_MAX)
return -EINVAL;
+ rv = mddev_lock(mddev);
+ if (rv)
+ return rv;
+
/*
* Without write mostly device, it doesn't make sense to set
* backlog for max_write_behind.
@@ -2497,6 +2501,7 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
if (!has_write_mostly) {
pr_warn_ratelimited("%s: can't set backlog, no write mostly device available\n",
mdname(mddev));
+ mddev_unlock(mddev);
return -EINVAL;
}
@@ -2514,6 +2519,8 @@ backlog_store(struct mddev *mddev, const char *buf, size_t len)
}
if (old_mwb != backlog)
md_bitmap_update_sb(mddev->bitmap);
+
+ mddev_unlock(mddev);
return len;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 151/406] drm/tegra: Remove superfluous error messages around platform_get_irq()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 150/406] md/md-bitmap: hold reconfig_mutex in backlog_store() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 152/406] drm/tegra: dpaux: Fix incorrect return value of platform_get_irq Greg Kroah-Hartman
` (263 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tan Zhongjun, Thierry Reding,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tan Zhongjun <tanzhongjun@yulong.com>
[ Upstream commit d12919bb5da571ec50588ef97683d37e36dc2de5 ]
The platform_get_irq() prints error message telling that interrupt is
missing,hence there is no need to duplicated that message in the
drivers.
Signed-off-by: Tan Zhongjun <tanzhongjun@yulong.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Stable-dep-of: 2a1ca44b6543 ("drm/tegra: dpaux: Fix incorrect return value of platform_get_irq")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dpaux.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
index 105fb9cdbb3bd..044e5eeea86f3 100644
--- a/drivers/gpu/drm/tegra/dpaux.c
+++ b/drivers/gpu/drm/tegra/dpaux.c
@@ -467,10 +467,8 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
return PTR_ERR(dpaux->regs);
dpaux->irq = platform_get_irq(pdev, 0);
- if (dpaux->irq < 0) {
- dev_err(&pdev->dev, "failed to get IRQ\n");
+ if (dpaux->irq < 0)
return -ENXIO;
- }
if (!pdev->dev.pm_domain) {
dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux");
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 152/406] drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 151/406] drm/tegra: Remove superfluous error messages around platform_get_irq() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 153/406] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() Greg Kroah-Hartman
` (262 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yangtao Li, Thierry Reding,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yangtao Li <frank.li@vivo.com>
[ Upstream commit 2a1ca44b654346cadfc538c4fb32eecd8daf3140 ]
When platform_get_irq fails, we should return dpaux->irq
instead of -ENXIO.
Fixes: 6b6b604215c6 ("drm/tegra: Add eDP support")
Signed-off-by: Yangtao Li <frank.li@vivo.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230710032355.72914-13-frank.li@vivo.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tegra/dpaux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tegra/dpaux.c b/drivers/gpu/drm/tegra/dpaux.c
index 044e5eeea86f3..f8b8107368a02 100644
--- a/drivers/gpu/drm/tegra/dpaux.c
+++ b/drivers/gpu/drm/tegra/dpaux.c
@@ -468,7 +468,7 @@ static int tegra_dpaux_probe(struct platform_device *pdev)
dpaux->irq = platform_get_irq(pdev, 0);
if (dpaux->irq < 0)
- return -ENXIO;
+ return dpaux->irq;
if (!pdev->dev.pm_domain) {
dpaux->rst = devm_reset_control_get(&pdev->dev, "dpaux");
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 153/406] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 152/406] drm/tegra: dpaux: Fix incorrect return value of platform_get_irq Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 154/406] drm/armada: Fix off-by-one error in armada_overlay_get_property() Greg Kroah-Hartman
` (261 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ruan Jinjie, Rob Herring,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruan Jinjie <ruanjinjie@huawei.com>
[ Upstream commit d6ce4f0ea19c32f10867ed93d8386924326ab474 ]
when kmalloc() fail to allocate memory in kasprintf(), name
or full_name will be NULL, strcmp() will cause
null pointer dereference.
Fixes: 0d638a07d3a1 ("of: Convert to using %pOF instead of full_name")
Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20230727080246.519539-1-ruanjinjie@huawei.com
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/unittest.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 5407bbdb64395..1058e23eca7d2 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -69,7 +69,7 @@ static void __init of_unittest_find_node_by_name(void)
np = of_find_node_by_path("/testcase-data");
name = kasprintf(GFP_KERNEL, "%pOF", np);
- unittest(np && !strcmp("/testcase-data", name),
+ unittest(np && name && !strcmp("/testcase-data", name),
"find /testcase-data failed\n");
of_node_put(np);
kfree(name);
@@ -80,14 +80,14 @@ static void __init of_unittest_find_node_by_name(void)
np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a");
name = kasprintf(GFP_KERNEL, "%pOF", np);
- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
"find /testcase-data/phandle-tests/consumer-a failed\n");
of_node_put(np);
kfree(name);
np = of_find_node_by_path("testcase-alias");
name = kasprintf(GFP_KERNEL, "%pOF", np);
- unittest(np && !strcmp("/testcase-data", name),
+ unittest(np && name && !strcmp("/testcase-data", name),
"find testcase-alias failed\n");
of_node_put(np);
kfree(name);
@@ -98,7 +98,7 @@ static void __init of_unittest_find_node_by_name(void)
np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a");
name = kasprintf(GFP_KERNEL, "%pOF", np);
- unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
+ unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name),
"find testcase-alias/phandle-tests/consumer-a failed\n");
of_node_put(np);
kfree(name);
@@ -1376,6 +1376,8 @@ static void attach_node_and_children(struct device_node *np)
const char *full_name;
full_name = kasprintf(GFP_KERNEL, "%pOF", np);
+ if (!full_name)
+ return;
if (!strcmp(full_name, "/__local_fixups__") ||
!strcmp(full_name, "/__fixups__")) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 154/406] drm/armada: Fix off-by-one error in armada_overlay_get_property()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 153/406] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 155/406] drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 Greg Kroah-Hartman
` (260 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven,
Russell King (Oracle), Javier Martinez Canillas, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 5f0d984053f74983a287100a9519b2fabb785fb5 ]
As ffs() returns one more than the index of the first bit set (zero
means no bits set), the color key mode value is shifted one position too
much.
Fix this by using FIELD_GET() instead.
Fixes: c96103b6c49ff9a8 ("drm/armada: move colorkey properties into overlay plane state")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Javier Martinez Canillas <javierm@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/a4d779d954a7515ddbbf31cb0f0d8184c0e7c879.1689600265.git.geert+renesas@glider.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/armada/armada_overlay.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/armada/armada_overlay.c b/drivers/gpu/drm/armada/armada_overlay.c
index 30e01101f59ed..7ee4c90d4a2df 100644
--- a/drivers/gpu/drm/armada/armada_overlay.c
+++ b/drivers/gpu/drm/armada/armada_overlay.c
@@ -4,6 +4,8 @@
* Rewritten from the dovefb driver, and Armada510 manuals.
*/
+#include <linux/bitfield.h>
+
#include <drm/armada_drm.h>
#include <drm/drm_atomic.h>
#include <drm/drm_atomic_helper.h>
@@ -446,8 +448,8 @@ static int armada_overlay_get_property(struct drm_plane *plane,
drm_to_overlay_state(state)->colorkey_ug,
drm_to_overlay_state(state)->colorkey_vb, 0);
} else if (property == priv->colorkey_mode_prop) {
- *val = (drm_to_overlay_state(state)->colorkey_mode &
- CFG_CKMODE_MASK) >> ffs(CFG_CKMODE_MASK);
+ *val = FIELD_GET(CFG_CKMODE_MASK,
+ drm_to_overlay_state(state)->colorkey_mode);
} else if (property == priv->brightness_prop) {
*val = drm_to_overlay_state(state)->brightness + 256;
} else if (property == priv->contrast_prop) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 155/406] drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 154/406] drm/armada: Fix off-by-one error in armada_overlay_get_property() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 156/406] ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig Greg Kroah-Hartman
` (259 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Vasut, Sam Ravnborg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
[ Upstream commit 7a675a8fa598edb29a664a91adb80f0340649f6f ]
The connector type and pixel format are missing for this panel,
add them to prevent various drivers from failing to determine
either of those parameters.
Fixes: 7ee933a1d5c4 ("drm/panel: simple: Add support for AUO T215HVN01")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230709134914.449328-1-marex@denx.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-simple.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c
index e40321d798981..e90b518118881 100644
--- a/drivers/gpu/drm/panel/panel-simple.c
+++ b/drivers/gpu/drm/panel/panel-simple.c
@@ -1200,7 +1200,9 @@ static const struct panel_desc auo_t215hvn01 = {
.delay = {
.disable = 5,
.unprepare = 1000,
- }
+ },
+ .bus_format = MEDIA_BUS_FMT_RGB888_1X7X4_SPWG,
+ .connector_type = DRM_MODE_CONNECTOR_LVDS,
};
static const struct drm_display_mode avic_tm070ddh03_mode = {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 156/406] ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 155/406] drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 157/406] drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask Greg Kroah-Hartman
` (258 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nayna Jain, Mimi Zohar, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nayna Jain <nayna@linux.ibm.com>
[ Upstream commit 5087fd9e80e539d2163accd045b73da64de7de95 ]
Time to remove "IMA_TRUSTED_KEYRING".
Fixes: f4dc37785e9b ("integrity: define '.evm' as a builtin 'trusted' keyring") # v4.5+
Signed-off-by: Nayna Jain <nayna@linux.ibm.com>
Signed-off-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/integrity/ima/Kconfig | 12 ------------
1 file changed, 12 deletions(-)
diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
index 0a5ae1e8da47a..05b8f5bcc37ac 100644
--- a/security/integrity/ima/Kconfig
+++ b/security/integrity/ima/Kconfig
@@ -248,18 +248,6 @@ config IMA_APPRAISE_MODSIG
The modsig keyword can be used in the IMA policy to allow a hook
to accept such signatures.
-config IMA_TRUSTED_KEYRING
- bool "Require all keys on the .ima keyring be signed (deprecated)"
- depends on IMA_APPRAISE && SYSTEM_TRUSTED_KEYRING
- depends on INTEGRITY_ASYMMETRIC_KEYS
- select INTEGRITY_TRUSTED_KEYRING
- default y
- help
- This option requires that all keys added to the .ima
- keyring be signed by a key on the system trusted keyring.
-
- This option is deprecated in favor of INTEGRITY_TRUSTED_KEYRING
-
config IMA_KEYRINGS_PERMIT_SIGNED_BY_BUILTIN_OR_SECONDARY
bool "Permit keys validly signed by a built-in or secondary CA cert (EXPERIMENTAL)"
depends on SYSTEM_TRUSTED_KEYRING
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 157/406] drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 156/406] ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 158/406] drm/msm/mdp5: Dont leak some plane state Greg Kroah-Hartman
` (257 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Laurent Pinchart,
Tomi Valkeinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit 1832fba7f9780aff67c96ad30f397c2d76141833 ]
Add check for dma_set_mask() and return the error if it fails.
Fixes: d76271d22694 ("drm: xlnx: DRM/KMS driver for Xilinx ZynqMP DisplayPort Subsystem")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
index 8e69303aad3f7..5f6eea81f3cc8 100644
--- a/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_dpsub.c
@@ -214,7 +214,9 @@ static int zynqmp_dpsub_probe(struct platform_device *pdev)
dpsub->dev = &pdev->dev;
platform_set_drvdata(pdev, dpsub);
- dma_set_mask(dpsub->dev, DMA_BIT_MASK(ZYNQMP_DISP_MAX_DMA_BIT));
+ ret = dma_set_mask(dpsub->dev, DMA_BIT_MASK(ZYNQMP_DISP_MAX_DMA_BIT));
+ if (ret)
+ return ret;
/* Try the reserved memory. Proceed if there's none. */
of_reserved_mem_device_init(&pdev->dev);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 158/406] drm/msm/mdp5: Dont leak some plane state
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 157/406] drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 159/406] firmware: meson_sm: fix to avoid potential NULL pointer dereference Greg Kroah-Hartman
` (256 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maarten Lankhorst, Daniel Vetter,
Rob Clark, Abhinav Kumar, Dmitry Baryshkov, linux-arm-msm,
freedreno, dorum, Daniel Vetter, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Vetter <daniel.vetter@ffwll.ch>
[ Upstream commit fd0ad3b2365c1c58aa5a761c18efc4817193beb6 ]
Apparently no one noticed that mdp5 plane states leak like a sieve
ever since we introduced plane_state->commit refcount a few years ago
in 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too
early by tracking commits, v3.")
Fix it by using the right helpers.
Fixes: 21a01abbe32a ("drm/atomic: Fix freeing connector/plane state too early by tracking commits, v3.")
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
Cc: Rob Clark <robdclark@gmail.com>
Cc: Abhinav Kumar <quic_abhinavk@quicinc.com>
Cc: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Cc: linux-arm-msm@vger.kernel.org
Cc: freedreno@lists.freedesktop.org
Reported-and-tested-by: dorum@noisolation.com
Cc: dorum@noisolation.com
Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/551236/
Link: https://lore.kernel.org/r/20230803204521.928582-1-daniel.vetter@ffwll.ch
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
index 0dc23c86747e8..e1c1b4ad5ed04 100644
--- a/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
+++ b/drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c
@@ -221,8 +221,7 @@ static void mdp5_plane_destroy_state(struct drm_plane *plane,
{
struct mdp5_plane_state *pstate = to_mdp5_plane_state(state);
- if (state->fb)
- drm_framebuffer_put(state->fb);
+ __drm_atomic_helper_plane_destroy_state(state);
kfree(pstate);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 159/406] firmware: meson_sm: fix to avoid potential NULL pointer dereference
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 158/406] drm/msm/mdp5: Dont leak some plane state Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 160/406] smackfs: Prevent underflow in smk_set_cipso() Greg Kroah-Hartman
` (255 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Shurong, Neil Armstrong,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit f2ed165619c16577c02b703a114a1f6b52026df4 ]
of_match_device() may fail and returns a NULL pointer.
Fix this by checking the return value of of_match_device.
Fixes: 8cde3c2153e8 ("firmware: meson_sm: Rework driver as a proper platform driver")
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/tencent_AA08AAA6C4F34D53ADCE962E188A879B8206@qq.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/meson/meson_sm.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
index 2854b56f6e0bd..ed27ff2e503ef 100644
--- a/drivers/firmware/meson/meson_sm.c
+++ b/drivers/firmware/meson/meson_sm.c
@@ -292,6 +292,8 @@ static int __init meson_sm_probe(struct platform_device *pdev)
return -ENOMEM;
chip = of_match_device(meson_sm_ids, dev)->data;
+ if (!chip)
+ return -EINVAL;
if (chip->cmd_shmem_in_base) {
fw->sm_shmem_in_base = meson_sm_map_shmem(chip->cmd_shmem_in_base,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 160/406] smackfs: Prevent underflow in smk_set_cipso()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 159/406] firmware: meson_sm: fix to avoid potential NULL pointer dereference Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 161/406] drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() Greg Kroah-Hartman
` (254 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Casey Schaufler,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 3ad49d37cf5759c3b8b68d02e3563f633d9c1aee ]
There is a upper bound to "catlen" but no lower bound to prevent
negatives. I don't see that this necessarily causes a problem but we
may as well be safe.
Fixes: e114e473771c ("Smack: Simplified Mandatory Access Control Kernel")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/smack/smackfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
index 3eabcc469669e..8403c91a6b297 100644
--- a/security/smack/smackfs.c
+++ b/security/smack/smackfs.c
@@ -895,7 +895,7 @@ static ssize_t smk_set_cipso(struct file *file, const char __user *buf,
}
ret = sscanf(rule, "%d", &catlen);
- if (ret != 1 || catlen > SMACK_CIPSO_MAXCATNUM)
+ if (ret != 1 || catlen < 0 || catlen > SMACK_CIPSO_MAXCATNUM)
goto out;
if (format == SMK_FIXED24_FMT &&
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 161/406] drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 160/406] smackfs: Prevent underflow in smk_set_cipso() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 162/406] drm/msm/a2xx: Call adreno_gpu_init() earlier Greg Kroah-Hartman
` (253 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Yang Wang,
Kenneth Feng, Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <kevinyang.wang@amd.com>
[ Upstream commit 25e6373a5b8efc623443f2699d2b929bf3067d76 ]
- fix variable ('attr') dereferenced issue.
- using condition check instead of BUG_ON().
Fixes: 4e01847c38f7 ("drm/amdgpu: optimize amdgpu device attribute code")
Cc: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/amdgpu_pm.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/amdgpu_pm.c b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
index 5abb68017f6ed..d58a59cf4f853 100644
--- a/drivers/gpu/drm/amd/pm/amdgpu_pm.c
+++ b/drivers/gpu/drm/amd/pm/amdgpu_pm.c
@@ -2115,15 +2115,19 @@ static int amdgpu_device_attr_create(struct amdgpu_device *adev,
uint32_t mask, struct list_head *attr_list)
{
int ret = 0;
- struct device_attribute *dev_attr = &attr->dev_attr;
- const char *name = dev_attr->attr.name;
enum amdgpu_device_attr_states attr_states = ATTR_STATE_SUPPORTED;
struct amdgpu_device_attr_entry *attr_entry;
+ struct device_attribute *dev_attr;
+ const char *name;
int (*attr_update)(struct amdgpu_device *adev, struct amdgpu_device_attr *attr,
uint32_t mask, enum amdgpu_device_attr_states *states) = default_attr_update;
- BUG_ON(!attr);
+ if (!attr)
+ return -EINVAL;
+
+ dev_attr = &attr->dev_attr;
+ name = dev_attr->attr.name;
attr_update = attr->attr_update ? attr_update : default_attr_update;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 162/406] drm/msm/a2xx: Call adreno_gpu_init() earlier
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 161/406] drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 163/406] audit: fix possible soft lockup in __audit_inode_child() Greg Kroah-Hartman
` (252 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Estevam, Dmitry Baryshkov,
Rob Clark, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@denx.de>
[ Upstream commit db07ce5da8b26bfeaf437a676ae49bd3bb1eace6 ]
The adreno_is_a20x() and adreno_is_a225() functions rely on the
GPU revision, but such information is retrieved inside adreno_gpu_init(),
which is called afterwards.
Fix this problem by caling adreno_gpu_init() earlier, so that
the GPU information revision is available when adreno_is_a20x()
and adreno_is_a225() run.
Tested on a imx53-qsb board.
Fixes: 21af872cd8c6 ("drm/msm/adreno: add a2xx")
Signed-off-by: Fabio Estevam <festevam@denx.de>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/543456/
Signed-off-by: Rob Clark <robdclark@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
index 7e82c41a85f1a..64ee63dcdb7c9 100644
--- a/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
+++ b/drivers/gpu/drm/msm/adreno/a2xx_gpu.c
@@ -521,6 +521,10 @@ struct msm_gpu *a2xx_gpu_init(struct drm_device *dev)
gpu->perfcntrs = perfcntrs;
gpu->num_perfcntrs = ARRAY_SIZE(perfcntrs);
+ ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
+ if (ret)
+ goto fail;
+
if (adreno_is_a20x(adreno_gpu))
adreno_gpu->registers = a200_registers;
else if (adreno_is_a225(adreno_gpu))
@@ -528,10 +532,6 @@ struct msm_gpu *a2xx_gpu_init(struct drm_device *dev)
else
adreno_gpu->registers = a220_registers;
- ret = adreno_gpu_init(dev, pdev, adreno_gpu, &funcs, 1);
- if (ret)
- goto fail;
-
if (!gpu->aspace) {
dev_err(dev->dev, "No memory protection without MMU\n");
ret = -ENXIO;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 163/406] audit: fix possible soft lockup in __audit_inode_child()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 162/406] drm/msm/a2xx: Call adreno_gpu_init() earlier Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 164/406] bus: ti-sysc: Fix build warning for 64-bit build Greg Kroah-Hartman
` (251 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gaosheng Cui, Paul Moore,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <cuigaosheng1@huawei.com>
[ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ]
Tracefs or debugfs maybe cause hundreds to thousands of PATH records,
too many PATH records maybe cause soft lockup.
For example:
1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n
2. auditctl -a exit,always -S open -k key
3. sysctl -w kernel.watchdog_thresh=5
4. mkdir /sys/kernel/debug/tracing/instances/test
There may be a soft lockup as follows:
watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498]
Kernel panic - not syncing: softlockup: hung tasks
Call trace:
dump_backtrace+0x0/0x30c
show_stack+0x20/0x30
dump_stack+0x11c/0x174
panic+0x27c/0x494
watchdog_timer_fn+0x2bc/0x390
__run_hrtimer+0x148/0x4fc
__hrtimer_run_queues+0x154/0x210
hrtimer_interrupt+0x2c4/0x760
arch_timer_handler_phys+0x48/0x60
handle_percpu_devid_irq+0xe0/0x340
__handle_domain_irq+0xbc/0x130
gic_handle_irq+0x78/0x460
el1_irq+0xb8/0x140
__audit_inode_child+0x240/0x7bc
tracefs_create_file+0x1b8/0x2a0
trace_create_file+0x18/0x50
event_create_dir+0x204/0x30c
__trace_add_new_event+0xac/0x100
event_trace_add_tracer+0xa0/0x130
trace_array_create_dir+0x60/0x140
trace_array_create+0x1e0/0x370
instance_mkdir+0x90/0xd0
tracefs_syscall_mkdir+0x68/0xa0
vfs_mkdir+0x21c/0x34c
do_mkdirat+0x1b4/0x1d4
__arm64_sys_mkdirat+0x4c/0x60
el0_svc_common.constprop.0+0xa8/0x240
do_el0_svc+0x8c/0xc0
el0_svc+0x20/0x30
el0_sync_handler+0xb0/0xb4
el0_sync+0x160/0x180
Therefore, we add cond_resched() to __audit_inode_child() to fix it.
Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array")
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/auditsc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 07e2788bbbf12..57b982b44732e 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -2203,6 +2203,8 @@ void __audit_inode_child(struct inode *parent,
}
}
+ cond_resched();
+
/* is there a matching child entry? */
list_for_each_entry(n, &context->names_list, list) {
/* can only match entries that have a name */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 164/406] bus: ti-sysc: Fix build warning for 64-bit build
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 163/406] audit: fix possible soft lockup in __audit_inode_child() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 165/406] drm/mediatek: Fix potential memory leak if vmap() fail Greg Kroah-Hartman
` (250 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dhruva Gole, Nishanth Menon,
Tony Lindgren, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit e1e1e9bb9d943ec690670a609a5f660ca10eaf85 ]
Fix "warning: cast from pointer to integer of different size" on 64-bit
builds.
Note that this is a cosmetic fix at this point as the driver is not yet
used for 64-bit systems.
Fixes: feaa8baee82a ("bus: ti-sysc: Implement SoC revision handling")
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Reviewed-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index fcfe4d16cc149..fa7894cab2152 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -3041,7 +3041,7 @@ static int sysc_init_static_data(struct sysc *ddata)
match = soc_device_match(sysc_soc_match);
if (match && match->data)
- sysc_soc->soc = (int)match->data;
+ sysc_soc->soc = (enum sysc_soc)match->data;
/* Ignore devices that are not available on HS and EMU SoCs */
if (!sysc_soc->general_purpose) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 165/406] drm/mediatek: Fix potential memory leak if vmap() fail
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 164/406] bus: ti-sysc: Fix build warning for 64-bit build Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 166/406] bus: ti-sysc: Fix cast to enum warning Greg Kroah-Hartman
` (249 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthias Brugger, Alexandre Mergnat,
Sui Jingfeng, CK Hu, AngeloGioacchino Del Regno, Chun-Kuang Hu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sui Jingfeng <suijingfeng@loongson.cn>
[ Upstream commit 379091e0f6d179d1a084c65de90fa44583b14a70 ]
Also return -ENOMEM if such a failure happens, the implement should take
responsibility for the error handling.
Fixes: 3df64d7b0a4f ("drm/mediatek: Implement gem prime vmap/vunmap function")
Reviewed-by: Matthias Brugger <matthias.bgg@gmail.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Signed-off-by: Sui Jingfeng <suijingfeng@loongson.cn>
Reviewed-by: CK Hu <ck.hu@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20230706134000.130098-1-suijingfeng@loongson.cn/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index 29702dd8631d4..fe64bf2176f30 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
@@ -249,7 +249,11 @@ void *mtk_drm_gem_prime_vmap(struct drm_gem_object *obj)
mtk_gem->kvaddr = vmap(mtk_gem->pages, npages, VM_MAP,
pgprot_writecombine(PAGE_KERNEL));
-
+ if (!mtk_gem->kvaddr) {
+ kfree(sgt);
+ kfree(mtk_gem->pages);
+ return -ENOMEM;
+ }
out:
kfree(sgt);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 166/406] bus: ti-sysc: Fix cast to enum warning
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 165/406] drm/mediatek: Fix potential memory leak if vmap() fail Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 167/406] of: unittest: Fix overlay type in apply/revert check Greg Kroah-Hartman
` (248 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nishanth Menon, kernel test robot,
Tony Lindgren, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit de44bf2f7683347f75690ef6cf61a1d5ba8f0891 ]
Fix warning for "cast to smaller integer type 'enum sysc_soc' from 'const
void *'".
Cc: Nishanth Menon <nm@ti.com>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202308150723.ziuGCdM3-lkp@intel.com/
Fixes: e1e1e9bb9d94 ("bus: ti-sysc: Fix build warning for 64-bit build")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/ti-sysc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/bus/ti-sysc.c b/drivers/bus/ti-sysc.c
index fa7894cab2152..c8e0f8cb9aa32 100644
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -3041,7 +3041,7 @@ static int sysc_init_static_data(struct sysc *ddata)
match = soc_device_match(sysc_soc_match);
if (match && match->data)
- sysc_soc->soc = (enum sysc_soc)match->data;
+ sysc_soc->soc = (enum sysc_soc)(uintptr_t)match->data;
/* Ignore devices that are not available on HS and EMU SoCs */
if (!sysc_soc->general_purpose) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 167/406] of: unittest: Fix overlay type in apply/revert check
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 166/406] bus: ti-sysc: Fix cast to enum warning Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 168/406] ALSA: ac97: Fix possible error value of *rac97 Greg Kroah-Hartman
` (247 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Rob Herring,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 6becf8f845ae1f0b1cfed395bbeccbd23654162d ]
The removal check in of_unittest_apply_revert_overlay_check()
always uses the platform device overlay type, while it should use the
actual overlay type, as passed as a parameter to the function.
This has no impact on any current test, as all tests calling
of_unittest_apply_revert_overlay_check() use the platform device overlay
type.
Fixes: d5e75500ca401d31 ("of: unitest: Add I2C overlay unit tests.")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/ba0234c41ba808f10112094f88792beeb6dbaedf.1690533838.git.geert+renesas@glider.be
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/unittest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 1058e23eca7d2..412d7ddb3b8b2 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -2067,7 +2067,7 @@ static int __init of_unittest_apply_revert_overlay_check(int overlay_nr,
of_unittest_untrack_overlay(save_id);
/* unittest device must be again in before state */
- if (of_unittest_device_exists(unittest_nr, PDEV_OVERLAY) != before) {
+ if (of_unittest_device_exists(unittest_nr, ovtype) != before) {
unittest(0, "%s with device @\"%s\" %s\n",
overlay_name_from_nr(overlay_nr),
unittest_path(unittest_nr, ovtype),
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 168/406] ALSA: ac97: Fix possible error value of *rac97
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 167/406] of: unittest: Fix overlay type in apply/revert check Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 169/406] ipmi:ssif: Add check for kstrdup Greg Kroah-Hartman
` (246 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Su Hui,
Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 67de40c9df94037769967ba28c7d951afb45b7fb ]
Before committing 79597c8bf64c, *rac97 always be NULL if there is
an error. When error happens, make sure *rac97 is NULL is safer.
For examble, in snd_vortex_mixer():
err = snd_ac97_mixer(pbus, &ac97, &vortex->codec);
vortex->isquad = ((vortex->codec == NULL) ?
0 : (vortex->codec->ext_id&0x80));
If error happened but vortex->codec isn't NULL, this may cause some
problems.
Move the judgement order to be clearer and better.
Fixes: 79597c8bf64c ("ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer")
Suggested-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Acked-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20230823025212.1000961-1-suhui@nfschina.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/ac97/ac97_codec.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c
index e18572eae5e01..d894dcdf38f4c 100644
--- a/sound/pci/ac97/ac97_codec.c
+++ b/sound/pci/ac97/ac97_codec.c
@@ -2007,10 +2007,9 @@ int snd_ac97_mixer(struct snd_ac97_bus *bus, struct snd_ac97_template *template,
.dev_disconnect = snd_ac97_dev_disconnect,
};
- if (!rac97)
- return -EINVAL;
- if (snd_BUG_ON(!bus || !template))
+ if (snd_BUG_ON(!bus || !template || !rac97))
return -EINVAL;
+ *rac97 = NULL;
if (snd_BUG_ON(template->num >= 4))
return -EINVAL;
if (bus->codec[template->num])
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 169/406] ipmi:ssif: Add check for kstrdup
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 168/406] ALSA: ac97: Fix possible error value of *rac97 Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 170/406] ipmi:ssif: Fix a memory leak when scanning for an adapter Greg Kroah-Hartman
` (245 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Corey Minyard,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit c5586d0f711e9744d0cade39b0c4a2d116a333ca ]
Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.
Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Message-Id: <20230619092802.35384-1-jiasheng@iscas.ac.cn>
Signed-off-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/ipmi/ipmi_ssif.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index a3745fa643f3b..87aa12ab8c66f 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -1614,6 +1614,11 @@ static int ssif_add_infos(struct i2c_client *client)
info->addr_src = SI_ACPI;
info->client = client;
info->adapter_name = kstrdup(client->adapter->name, GFP_KERNEL);
+ if (!info->adapter_name) {
+ kfree(info);
+ return -ENOMEM;
+ }
+
info->binfo.addr = client->addr;
list_add_tail(&info->link, &ssif_infos);
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 170/406] ipmi:ssif: Fix a memory leak when scanning for an adapter
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 169/406] ipmi:ssif: Add check for kstrdup Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 171/406] drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() Greg Kroah-Hartman
` (244 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Corey Minyard, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corey Minyard <minyard@acm.org>
[ Upstream commit b8d72e32e1453d37ee5c8a219f24e7eeadc471ef ]
The adapter scan ssif_info_find() sets info->adapter_name if the adapter
info came from SMBIOS, as it's not set in that case. However, this
function can be called more than once, and it will leak the adapter name
if it had already been set. So check for NULL before setting it.
Fixes: c4436c9149c5 ("ipmi_ssif: avoid registering duplicate ssif interface")
Signed-off-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/ipmi/ipmi_ssif.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 87aa12ab8c66f..30f757249c5c0 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -1414,7 +1414,7 @@ static struct ssif_addr_info *ssif_info_find(unsigned short addr,
restart:
list_for_each_entry(info, &ssif_infos, link) {
if (info->binfo.addr == addr) {
- if (info->addr_src == SI_SMBIOS)
+ if (info->addr_src == SI_SMBIOS && !info->adapter_name)
info->adapter_name = kstrdup(adapter_name,
GFP_KERNEL);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 171/406] drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 170/406] ipmi:ssif: Fix a memory leak when scanning for an adapter Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 172/406] clk: sunxi-ng: Modify mismatched function name Greg Kroah-Hartman
` (243 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Minjie Du, Stephen Boyd, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minjie Du <duminjie@vivo.com>
[ Upstream commit a995c50db887ef97f3160775aef7d772635a6f6e ]
The function clk_register_pll() may return NULL or an ERR_PTR. Don't
treat an ERR_PTR as valid.
Signed-off-by: Minjie Du <duminjie@vivo.com>
Link: https://lore.kernel.org/r/20230712102246.10348-1-duminjie@vivo.com
Fixes: b9e0d40c0d83 ("clk: keystone: add Keystone PLL clock driver")
[sboyd@kernel.org: Reword commit text]
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/keystone/pll.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/keystone/pll.c b/drivers/clk/keystone/pll.c
index d59a7621bb204..ee5c72369334f 100644
--- a/drivers/clk/keystone/pll.c
+++ b/drivers/clk/keystone/pll.c
@@ -209,7 +209,7 @@ static void __init _of_pll_clk_init(struct device_node *node, bool pllctrl)
}
clk = clk_register_pll(NULL, node->name, parent_name, pll_data);
- if (clk) {
+ if (!IS_ERR_OR_NULL(clk)) {
of_clk_add_provider(node, of_clk_src_simple_get, clk);
return;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 172/406] clk: sunxi-ng: Modify mismatched function name
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 171/406] drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 173/406] clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents Greg Kroah-Hartman
` (242 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Jianhua, Randy Dunlap,
Jernej Skrabec, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Jianhua <chris.zjh@huawei.com>
[ Upstream commit 075d9ca5b4e17f84fd1c744a405e69ec743be7f0 ]
No functional modification involved.
drivers/clk/sunxi-ng/ccu_mmc_timing.c:54: warning: expecting prototype for sunxi_ccu_set_mmc_timing_mode(). Prototype was for sunxi_ccu_get_mmc_timing_mode() instead
Fixes: f6f64ed868d3 ("clk: sunxi-ng: Add interface to query or configure MMC timing modes.")
Signed-off-by: Zhang Jianhua <chris.zjh@huawei.com>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20230722153107.2078179-1-chris.zjh@huawei.com
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/sunxi-ng/ccu_mmc_timing.c b/drivers/clk/sunxi-ng/ccu_mmc_timing.c
index de33414fc5c28..c6a6ce98ca03a 100644
--- a/drivers/clk/sunxi-ng/ccu_mmc_timing.c
+++ b/drivers/clk/sunxi-ng/ccu_mmc_timing.c
@@ -43,7 +43,7 @@ int sunxi_ccu_set_mmc_timing_mode(struct clk *clk, bool new_mode)
EXPORT_SYMBOL_GPL(sunxi_ccu_set_mmc_timing_mode);
/**
- * sunxi_ccu_set_mmc_timing_mode: Get the current MMC clock timing mode
+ * sunxi_ccu_get_mmc_timing_mode: Get the current MMC clock timing mode
* @clk: clock to query
*
* Returns 0 if the clock is in old timing mode, > 0 if it is in
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 173/406] clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 172/406] clk: sunxi-ng: Modify mismatched function name Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 174/406] clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src Greg Kroah-Hartman
` (241 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephen Boyd,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit e957ca2a930ad42e47bf5c9ea2a7afa0960ec1d8 ]
Use ARRAY_SIZE() instead of manually specifying num_parents. This makes
adding/removing entries to/from parent_data easy and errorproof.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210405224743.590029-30-dmitry.baryshkov@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: fd0b5ba87ad5 ("clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-sc7180.c | 32 ++++++++++++++++----------------
1 file changed, 16 insertions(+), 16 deletions(-)
diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
index 7e80dbd4a3f9f..16f65f74cb8fd 100644
--- a/drivers/clk/qcom/gcc-sc7180.c
+++ b/drivers/clk/qcom/gcc-sc7180.c
@@ -285,7 +285,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_cpuss_ahb_clk_src",
.parent_data = gcc_parent_data_0_ao,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0_ao),
.flags = CLK_SET_RATE_PARENT,
.ops = &clk_rcg2_ops,
},
@@ -309,7 +309,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_gp1_clk_src",
.parent_data = gcc_parent_data_4,
- .num_parents = 5,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_4),
.ops = &clk_rcg2_ops,
},
};
@@ -323,7 +323,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_gp2_clk_src",
.parent_data = gcc_parent_data_4,
- .num_parents = 5,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_4),
.ops = &clk_rcg2_ops,
},
};
@@ -337,7 +337,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_gp3_clk_src",
.parent_data = gcc_parent_data_4,
- .num_parents = 5,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_4),
.ops = &clk_rcg2_ops,
},
};
@@ -357,7 +357,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_pdm2_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -378,7 +378,7 @@ static struct clk_rcg2 gcc_qspi_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_qspi_core_clk_src",
.parent_data = gcc_parent_data_2,
- .num_parents = 6,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_2),
.ops = &clk_rcg2_ops,
},
};
@@ -619,7 +619,7 @@ static struct clk_rcg2 gcc_sdcc1_apps_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc1_apps_clk_src",
.parent_data = gcc_parent_data_1,
- .num_parents = 5,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_floor_ops,
},
};
@@ -641,7 +641,7 @@ static struct clk_rcg2 gcc_sdcc1_ice_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc1_ice_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -665,7 +665,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc2_apps_clk_src",
.parent_data = gcc_parent_data_5,
- .num_parents = 5,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_5),
.ops = &clk_rcg2_floor_ops,
},
};
@@ -688,7 +688,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_axi_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -710,7 +710,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_ice_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -730,7 +730,7 @@ static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_phy_aux_clk_src",
.parent_data = gcc_parent_data_3,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_3),
.ops = &clk_rcg2_ops,
},
};
@@ -751,7 +751,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_unipro_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -773,7 +773,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_prim_master_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -793,7 +793,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_prim_mock_utmi_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -812,7 +812,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb3_prim_phy_aux_clk_src",
.parent_data = gcc_parent_data_6,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_6),
.ops = &clk_rcg2_ops,
},
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 174/406] clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 173/406] clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 175/406] ext4: correct grp validation in ext4_mb_good_group Greg Kroah-Hartman
` (240 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Wronek, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Wronek <davidwronek@gmail.com>
[ Upstream commit fd0b5ba87ad5709f0fd3d2bc4b7870494a75f96a ]
Set .flags = CLK_OPS_PARENT_ENABLE to fix "gcc_sdcc2_apps_clk_src: rcg
didn't update its configuration" error.
Fixes: 17269568f726 ("clk: qcom: Add Global Clock controller (GCC) driver for SC7180")
Signed-off-by: David Wronek <davidwronek@gmail.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230723190725.1619193-2-davidwronek@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-sc7180.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-sc7180.c b/drivers/clk/qcom/gcc-sc7180.c
index 16f65f74cb8fd..bebe317935238 100644
--- a/drivers/clk/qcom/gcc-sc7180.c
+++ b/drivers/clk/qcom/gcc-sc7180.c
@@ -666,6 +666,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
.name = "gcc_sdcc2_apps_clk_src",
.parent_data = gcc_parent_data_5,
.num_parents = ARRAY_SIZE(gcc_parent_data_5),
+ .flags = CLK_OPS_PARENT_ENABLE,
.ops = &clk_rcg2_floor_ops,
},
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 175/406] ext4: correct grp validation in ext4_mb_good_group
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 174/406] clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 176/406] clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents Greg Kroah-Hartman
` (239 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kemeng Shi, Ritesh Harjani (IBM),
Theodore Tso, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kemeng Shi <shikemeng@huaweicloud.com>
[ Upstream commit a9ce5993a0f5c0887c8a1b4ffa3b8046fbcfdc93 ]
Group corruption check will access memory of grp and will trigger kernel
crash if grp is NULL. So do NULL check before corruption check.
Fixes: 5354b2af3406 ("ext4: allow ext4_get_group_info() to fail")
Signed-off-by: Kemeng Shi <shikemeng@huaweicloud.com>
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>
Link: https://lore.kernel.org/r/20230801143204.2284343-2-shikemeng@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/mballoc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 3a71928846712..2f6ed59d81f02 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -2103,7 +2103,7 @@ static bool ext4_mb_good_group(struct ext4_allocation_context *ac,
BUG_ON(cr < 0 || cr >= 4);
- if (unlikely(EXT4_MB_GRP_BBITMAP_CORRUPT(grp) || !grp))
+ if (unlikely(!grp || EXT4_MB_GRP_BBITMAP_CORRUPT(grp)))
return false;
free = grp->bb_free;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 176/406] clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 175/406] ext4: correct grp validation in ext4_mb_good_group Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 177/406] clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src Greg Kroah-Hartman
` (238 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephen Boyd,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit c864cd5f506cf53b7f2290009fba6e933a34770d ]
Use ARRAY_SIZE() instead of manually specifying num_parents. This makes
adding/removing entries to/from parent_data easy and errorproof.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20210405224743.590029-33-dmitry.baryshkov@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 783cb693828c ("clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-sm8250.c | 92 +++++++++++++++++------------------
1 file changed, 46 insertions(+), 46 deletions(-)
diff --git a/drivers/clk/qcom/gcc-sm8250.c b/drivers/clk/qcom/gcc-sm8250.c
index 7ec11acc82984..68a31f208d904 100644
--- a/drivers/clk/qcom/gcc-sm8250.c
+++ b/drivers/clk/qcom/gcc-sm8250.c
@@ -200,7 +200,7 @@ static struct clk_rcg2 gcc_cpuss_ahb_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_cpuss_ahb_clk_src",
.parent_data = gcc_parent_data_0_ao,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0_ao),
.flags = CLK_SET_RATE_PARENT,
.ops = &clk_rcg2_ops,
},
@@ -224,7 +224,7 @@ static struct clk_rcg2 gcc_gp1_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_gp1_clk_src",
.parent_data = gcc_parent_data_1,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
},
};
@@ -238,7 +238,7 @@ static struct clk_rcg2 gcc_gp2_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_gp2_clk_src",
.parent_data = gcc_parent_data_1,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
},
};
@@ -252,7 +252,7 @@ static struct clk_rcg2 gcc_gp3_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_gp3_clk_src",
.parent_data = gcc_parent_data_1,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_1),
.ops = &clk_rcg2_ops,
},
};
@@ -272,7 +272,7 @@ static struct clk_rcg2 gcc_pcie_0_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_pcie_0_aux_clk_src",
.parent_data = gcc_parent_data_2,
- .num_parents = 2,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_2),
.ops = &clk_rcg2_ops,
},
};
@@ -286,7 +286,7 @@ static struct clk_rcg2 gcc_pcie_1_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_pcie_1_aux_clk_src",
.parent_data = gcc_parent_data_2,
- .num_parents = 2,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_2),
.ops = &clk_rcg2_ops,
},
};
@@ -300,7 +300,7 @@ static struct clk_rcg2 gcc_pcie_2_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_pcie_2_aux_clk_src",
.parent_data = gcc_parent_data_2,
- .num_parents = 2,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_2),
.ops = &clk_rcg2_ops,
},
};
@@ -320,7 +320,7 @@ static struct clk_rcg2 gcc_pcie_phy_refgen_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_pcie_phy_refgen_clk_src",
.parent_data = gcc_parent_data_0_ao,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0_ao),
.ops = &clk_rcg2_ops,
},
};
@@ -341,7 +341,7 @@ static struct clk_rcg2 gcc_pdm2_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_pdm2_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -369,7 +369,7 @@ static const struct freq_tbl ftbl_gcc_qupv3_wrap0_s0_clk_src[] = {
static struct clk_init_data gcc_qupv3_wrap0_s0_clk_src_init = {
.name = "gcc_qupv3_wrap0_s0_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -385,7 +385,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s0_clk_src = {
static struct clk_init_data gcc_qupv3_wrap0_s1_clk_src_init = {
.name = "gcc_qupv3_wrap0_s1_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -417,7 +417,7 @@ static const struct freq_tbl ftbl_gcc_qupv3_wrap0_s2_clk_src[] = {
static struct clk_init_data gcc_qupv3_wrap0_s2_clk_src_init = {
.name = "gcc_qupv3_wrap0_s2_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -433,7 +433,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s2_clk_src = {
static struct clk_init_data gcc_qupv3_wrap0_s3_clk_src_init = {
.name = "gcc_qupv3_wrap0_s3_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -449,7 +449,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s3_clk_src = {
static struct clk_init_data gcc_qupv3_wrap0_s4_clk_src_init = {
.name = "gcc_qupv3_wrap0_s4_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -465,7 +465,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s4_clk_src = {
static struct clk_init_data gcc_qupv3_wrap0_s5_clk_src_init = {
.name = "gcc_qupv3_wrap0_s5_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -481,7 +481,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s5_clk_src = {
static struct clk_init_data gcc_qupv3_wrap0_s6_clk_src_init = {
.name = "gcc_qupv3_wrap0_s6_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -497,7 +497,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s6_clk_src = {
static struct clk_init_data gcc_qupv3_wrap0_s7_clk_src_init = {
.name = "gcc_qupv3_wrap0_s7_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -513,7 +513,7 @@ static struct clk_rcg2 gcc_qupv3_wrap0_s7_clk_src = {
static struct clk_init_data gcc_qupv3_wrap1_s0_clk_src_init = {
.name = "gcc_qupv3_wrap1_s0_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -529,7 +529,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s0_clk_src = {
static struct clk_init_data gcc_qupv3_wrap1_s1_clk_src_init = {
.name = "gcc_qupv3_wrap1_s1_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -545,7 +545,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s1_clk_src = {
static struct clk_init_data gcc_qupv3_wrap1_s2_clk_src_init = {
.name = "gcc_qupv3_wrap1_s2_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -561,7 +561,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s2_clk_src = {
static struct clk_init_data gcc_qupv3_wrap1_s3_clk_src_init = {
.name = "gcc_qupv3_wrap1_s3_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -577,7 +577,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s3_clk_src = {
static struct clk_init_data gcc_qupv3_wrap1_s4_clk_src_init = {
.name = "gcc_qupv3_wrap1_s4_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -593,7 +593,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s4_clk_src = {
static struct clk_init_data gcc_qupv3_wrap1_s5_clk_src_init = {
.name = "gcc_qupv3_wrap1_s5_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -609,7 +609,7 @@ static struct clk_rcg2 gcc_qupv3_wrap1_s5_clk_src = {
static struct clk_init_data gcc_qupv3_wrap2_s0_clk_src_init = {
.name = "gcc_qupv3_wrap2_s0_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -625,7 +625,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s0_clk_src = {
static struct clk_init_data gcc_qupv3_wrap2_s1_clk_src_init = {
.name = "gcc_qupv3_wrap2_s1_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -641,7 +641,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s1_clk_src = {
static struct clk_init_data gcc_qupv3_wrap2_s2_clk_src_init = {
.name = "gcc_qupv3_wrap2_s2_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -657,7 +657,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s2_clk_src = {
static struct clk_init_data gcc_qupv3_wrap2_s3_clk_src_init = {
.name = "gcc_qupv3_wrap2_s3_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -673,7 +673,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s3_clk_src = {
static struct clk_init_data gcc_qupv3_wrap2_s4_clk_src_init = {
.name = "gcc_qupv3_wrap2_s4_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -689,7 +689,7 @@ static struct clk_rcg2 gcc_qupv3_wrap2_s4_clk_src = {
static struct clk_init_data gcc_qupv3_wrap2_s5_clk_src_init = {
.name = "gcc_qupv3_wrap2_s5_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
};
@@ -721,7 +721,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc2_apps_clk_src",
.parent_data = gcc_parent_data_4,
- .num_parents = 5,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_4),
.ops = &clk_rcg2_floor_ops,
},
};
@@ -744,7 +744,7 @@ static struct clk_rcg2 gcc_sdcc4_apps_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_sdcc4_apps_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_floor_ops,
},
};
@@ -763,7 +763,7 @@ static struct clk_rcg2 gcc_tsif_ref_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_tsif_ref_clk_src",
.parent_data = gcc_parent_data_5,
- .num_parents = 4,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_5),
.ops = &clk_rcg2_ops,
},
};
@@ -785,7 +785,7 @@ static struct clk_rcg2 gcc_ufs_card_axi_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_card_axi_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -807,7 +807,7 @@ static struct clk_rcg2 gcc_ufs_card_ice_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_card_ice_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -826,7 +826,7 @@ static struct clk_rcg2 gcc_ufs_card_phy_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_card_phy_aux_clk_src",
.parent_data = gcc_parent_data_3,
- .num_parents = 1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_3),
.ops = &clk_rcg2_ops,
},
};
@@ -847,7 +847,7 @@ static struct clk_rcg2 gcc_ufs_card_unipro_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_card_unipro_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -870,7 +870,7 @@ static struct clk_rcg2 gcc_ufs_phy_axi_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_axi_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -884,7 +884,7 @@ static struct clk_rcg2 gcc_ufs_phy_ice_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_ice_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -898,7 +898,7 @@ static struct clk_rcg2 gcc_ufs_phy_phy_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_phy_aux_clk_src",
.parent_data = gcc_parent_data_3,
- .num_parents = 1,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_3),
.ops = &clk_rcg2_ops,
},
};
@@ -912,7 +912,7 @@ static struct clk_rcg2 gcc_ufs_phy_unipro_core_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_ufs_phy_unipro_core_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -935,7 +935,7 @@ static struct clk_rcg2 gcc_usb30_prim_master_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_prim_master_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -949,7 +949,7 @@ static struct clk_rcg2 gcc_usb30_prim_mock_utmi_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_prim_mock_utmi_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -963,7 +963,7 @@ static struct clk_rcg2 gcc_usb30_sec_master_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_sec_master_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -977,7 +977,7 @@ static struct clk_rcg2 gcc_usb30_sec_mock_utmi_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb30_sec_mock_utmi_clk_src",
.parent_data = gcc_parent_data_0,
- .num_parents = 3,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_0),
.ops = &clk_rcg2_ops,
},
};
@@ -991,7 +991,7 @@ static struct clk_rcg2 gcc_usb3_prim_phy_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb3_prim_phy_aux_clk_src",
.parent_data = gcc_parent_data_2,
- .num_parents = 2,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_2),
.ops = &clk_rcg2_ops,
},
};
@@ -1005,7 +1005,7 @@ static struct clk_rcg2 gcc_usb3_sec_phy_aux_clk_src = {
.clkr.hw.init = &(struct clk_init_data){
.name = "gcc_usb3_sec_phy_aux_clk_src",
.parent_data = gcc_parent_data_2,
- .num_parents = 2,
+ .num_parents = ARRAY_SIZE(gcc_parent_data_2),
.ops = &clk_rcg2_ops,
},
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 177/406] clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 176/406] clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 178/406] clk: qcom: reset: Use the correct type of sleep/delay based on length Greg Kroah-Hartman
` (237 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bryan ODonoghue,
Patrick Whewell, Vinod Koul, Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Whewell <patrick.whewell@sightlineapplications.com>
[ Upstream commit 783cb693828ce487cf0bc6ad16cbcf2caae6f8d9 ]
GPLL9 is not on by default, which causes a "gcc_sdcc2_apps_clk_src: rcg
didn't update its configuration" error when booting. Set .flags =
CLK_OPS_PARENT_ENABLE to fix the error.
Fixes: 3e5770921a88 ("clk: qcom: gcc: Add global clock controller driver for SM8250")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Patrick Whewell <patrick.whewell@sightlineapplications.com>
Reviewed-by: Vinod Koul <vkoul@kernel.org>
Link: https://lore.kernel.org/r/20230802210359.408-1-patrick.whewell@sightlineapplications.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gcc-sm8250.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/gcc-sm8250.c b/drivers/clk/qcom/gcc-sm8250.c
index 68a31f208d904..70723e4dab008 100644
--- a/drivers/clk/qcom/gcc-sm8250.c
+++ b/drivers/clk/qcom/gcc-sm8250.c
@@ -722,6 +722,7 @@ static struct clk_rcg2 gcc_sdcc2_apps_clk_src = {
.name = "gcc_sdcc2_apps_clk_src",
.parent_data = gcc_parent_data_4,
.num_parents = ARRAY_SIZE(gcc_parent_data_4),
+ .flags = CLK_OPS_PARENT_ENABLE,
.ops = &clk_rcg2_floor_ops,
},
};
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 178/406] clk: qcom: reset: Use the correct type of sleep/delay based on length
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 177/406] clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 179/406] PCI: Mark NVIDIA T4 GPUs to avoid bus reset Greg Kroah-Hartman
` (236 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 181b66ee7cdd824797fc99b53bec29cf5630a04f ]
Use the fsleep() helper that (based on the length of the delay, see: [1])
chooses the correct sleep/delay functions.
[1] https://www.kernel.org/doc/Documentation/timers/timers-howto.txt
Fixes: 2cb8a39b6781 ("clk: qcom: reset: Allow specifying custom reset delay")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230726-topic-qcom_reset-v3-1-5958facd5db2@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/reset.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/clk/qcom/reset.c b/drivers/clk/qcom/reset.c
index 0e914ec7aeae1..e45e32804d2c7 100644
--- a/drivers/clk/qcom/reset.c
+++ b/drivers/clk/qcom/reset.c
@@ -16,7 +16,8 @@ static int qcom_reset(struct reset_controller_dev *rcdev, unsigned long id)
struct qcom_reset_controller *rst = to_qcom_reset_controller(rcdev);
rcdev->ops->assert(rcdev, id);
- udelay(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */
+ fsleep(rst->reset_map[id].udelay ?: 1); /* use 1 us as default */
+
rcdev->ops->deassert(rcdev, id);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 179/406] PCI: Mark NVIDIA T4 GPUs to avoid bus reset
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 178/406] clk: qcom: reset: Use the correct type of sleep/delay based on length Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 180/406] pinctrl: mcp23s08: check return value of devm_kasprintf() Greg Kroah-Hartman
` (235 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wu Zongyong, Bjorn Helgaas,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wu Zongyong <wuzongyong@linux.alibaba.com>
[ Upstream commit d5af729dc2071273f14cbb94abbc60608142fd83 ]
NVIDIA T4 GPUs do not work with SBR. This problem is found when the T4 card
is direct attached to a Root Port only. Avoid bus reset by marking T4 GPUs
PCI_DEV_FLAGS_NO_BUS_RESET.
Fixes: 4c207e7121fa ("PCI: Mark some NVIDIA GPUs to avoid bus reset")
Link: https://lore.kernel.org/r/2dcebea53a6eb9bd212ec6d8974af2e5e0333ef6.1681129861.git.wuzongyong@linux.alibaba.com
Signed-off-by: Wu Zongyong <wuzongyong@linux.alibaba.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index c0d1134811915..1193c81f88964 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3578,7 +3578,7 @@ static void quirk_no_bus_reset(struct pci_dev *dev)
*/
static void quirk_nvidia_no_bus_reset(struct pci_dev *dev)
{
- if ((dev->device & 0xffc0) == 0x2340)
+ if ((dev->device & 0xffc0) == 0x2340 || dev->device == 0x1eb8)
quirk_no_bus_reset(dev);
}
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 180/406] pinctrl: mcp23s08: check return value of devm_kasprintf()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 179/406] PCI: Mark NVIDIA T4 GPUs to avoid bus reset Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 181/406] PCI: pciehp: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
` (234 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Andy Shevchenko,
Linus Walleij, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit f941714a7c7698eadb59bc27d34d6d6f38982705 ]
devm_kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 0f04a81784fe ("pinctrl: mcp23s08: Split to three parts: core, I²C, SPI")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230621100409.1608395-1-claudiu.beznea@microchip.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-mcp23s08_spi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-mcp23s08_spi.c b/drivers/pinctrl/pinctrl-mcp23s08_spi.c
index 9ae10318f6f35..ea059b9c5542e 100644
--- a/drivers/pinctrl/pinctrl-mcp23s08_spi.c
+++ b/drivers/pinctrl/pinctrl-mcp23s08_spi.c
@@ -91,18 +91,28 @@ static int mcp23s08_spi_regmap_init(struct mcp23s08 *mcp, struct device *dev,
mcp->reg_shift = 0;
mcp->chip.ngpio = 8;
mcp->chip.label = devm_kasprintf(dev, GFP_KERNEL, "mcp23s08.%d", addr);
+ if (!mcp->chip.label)
+ return -ENOMEM;
config = &mcp23x08_regmap;
name = devm_kasprintf(dev, GFP_KERNEL, "%d", addr);
+ if (!name)
+ return -ENOMEM;
+
break;
case MCP_TYPE_S17:
mcp->reg_shift = 1;
mcp->chip.ngpio = 16;
mcp->chip.label = devm_kasprintf(dev, GFP_KERNEL, "mcp23s17.%d", addr);
+ if (!mcp->chip.label)
+ return -ENOMEM;
config = &mcp23x17_regmap;
name = devm_kasprintf(dev, GFP_KERNEL, "%d", addr);
+ if (!name)
+ return -ENOMEM;
+
break;
case MCP_TYPE_S18:
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 181/406] PCI: pciehp: Use RMW accessors for changing LNKCTL
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 180/406] pinctrl: mcp23s08: check return value of devm_kasprintf() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 182/406] PCI/ASPM: " Greg Kroah-Hartman
` (233 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Ilpo Järvinen,
Bjorn Helgaas, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 5f75f96c61039151c193775d776fde42477eace1 ]
As hotplug is not the only driver touching LNKCTL, use the RMW capability
accessor which handles concurrent changes correctly.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Fixes: 7f822999e12a ("PCI: pciehp: Add Disable/enable link functions")
Link: https://lore.kernel.org/r/20230717120503.15276-4-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: "Rafael J. Wysocki" <rafael@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/hotplug/pciehp_hpc.c | 12 +++---------
1 file changed, 3 insertions(+), 9 deletions(-)
diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c
index dda9523577472..75c6c72ec32ac 100644
--- a/drivers/pci/hotplug/pciehp_hpc.c
+++ b/drivers/pci/hotplug/pciehp_hpc.c
@@ -332,17 +332,11 @@ int pciehp_check_link_status(struct controller *ctrl)
static int __pciehp_link_set(struct controller *ctrl, bool enable)
{
struct pci_dev *pdev = ctrl_dev(ctrl);
- u16 lnk_ctrl;
- pcie_capability_read_word(pdev, PCI_EXP_LNKCTL, &lnk_ctrl);
+ pcie_capability_clear_and_set_word(pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_LD,
+ enable ? 0 : PCI_EXP_LNKCTL_LD);
- if (enable)
- lnk_ctrl &= ~PCI_EXP_LNKCTL_LD;
- else
- lnk_ctrl |= PCI_EXP_LNKCTL_LD;
-
- pcie_capability_write_word(pdev, PCI_EXP_LNKCTL, lnk_ctrl);
- ctrl_dbg(ctrl, "%s: lnk_ctrl = %x\n", __func__, lnk_ctrl);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 182/406] PCI/ASPM: Use RMW accessors for changing LNKCTL
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 181/406] PCI: pciehp: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 183/406] clk: imx8mp: fix sai4 clock Greg Kroah-Hartman
` (232 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Ilpo Järvinen,
Bjorn Helgaas, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit e09060b3b6b4661278ff8e1b7b81a37d5ea86eae ]
Don't assume that the device is fully under the control of ASPM and use RMW
capability accessors which do proper locking to avoid losing concurrent
updates to the register values.
If configuration fails in pcie_aspm_configure_common_clock(), the
function attempts to restore the old PCI_EXP_LNKCTL_CCC settings. Store
only the old PCI_EXP_LNKCTL_CCC bit for the relevant devices rather
than the content of the whole LNKCTL registers. It aligns better with
how pcie_lnkctl_clear_and_set() expects its parameter and makes the
code more obvious to understand.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Fixes: 2a42d9dba784 ("PCIe: ASPM: Break out of endless loop waiting for PCI config bits to switch")
Fixes: 7d715a6c1ae5 ("PCI: add PCI Express ASPM support")
Link: https://lore.kernel.org/r/20230717120503.15276-5-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: "Rafael J. Wysocki" <rafael@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/pcie/aspm.c | 30 +++++++++++++-----------------
1 file changed, 13 insertions(+), 17 deletions(-)
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 7a3cf8aaec256..ef6f0ceb92f9f 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -249,7 +249,7 @@ static int pcie_retrain_link(struct pcie_link_state *link)
static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
{
int same_clock = 1;
- u16 reg16, parent_reg, child_reg[8];
+ u16 reg16, ccc, parent_old_ccc, child_old_ccc[8];
struct pci_dev *child, *parent = link->pdev;
struct pci_bus *linkbus = parent->subordinate;
/*
@@ -271,6 +271,7 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
/* Port might be already in common clock mode */
pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
+ parent_old_ccc = reg16 & PCI_EXP_LNKCTL_CCC;
if (same_clock && (reg16 & PCI_EXP_LNKCTL_CCC)) {
bool consistent = true;
@@ -287,34 +288,29 @@ static void pcie_aspm_configure_common_clock(struct pcie_link_state *link)
pci_info(parent, "ASPM: current common clock configuration is inconsistent, reconfiguring\n");
}
+ ccc = same_clock ? PCI_EXP_LNKCTL_CCC : 0;
/* Configure downstream component, all functions */
list_for_each_entry(child, &linkbus->devices, bus_list) {
pcie_capability_read_word(child, PCI_EXP_LNKCTL, ®16);
- child_reg[PCI_FUNC(child->devfn)] = reg16;
- if (same_clock)
- reg16 |= PCI_EXP_LNKCTL_CCC;
- else
- reg16 &= ~PCI_EXP_LNKCTL_CCC;
- pcie_capability_write_word(child, PCI_EXP_LNKCTL, reg16);
+ child_old_ccc[PCI_FUNC(child->devfn)] = reg16 & PCI_EXP_LNKCTL_CCC;
+ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_CCC, ccc);
}
/* Configure upstream component */
- pcie_capability_read_word(parent, PCI_EXP_LNKCTL, ®16);
- parent_reg = reg16;
- if (same_clock)
- reg16 |= PCI_EXP_LNKCTL_CCC;
- else
- reg16 &= ~PCI_EXP_LNKCTL_CCC;
- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_CCC, ccc);
if (pcie_retrain_link(link)) {
/* Training failed. Restore common clock configurations */
pci_err(parent, "ASPM: Could not configure common clock\n");
list_for_each_entry(child, &linkbus->devices, bus_list)
- pcie_capability_write_word(child, PCI_EXP_LNKCTL,
- child_reg[PCI_FUNC(child->devfn)]);
- pcie_capability_write_word(parent, PCI_EXP_LNKCTL, parent_reg);
+ pcie_capability_clear_and_set_word(child, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_CCC,
+ child_old_ccc[PCI_FUNC(child->devfn)]);
+ pcie_capability_clear_and_set_word(parent, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_CCC, parent_old_ccc);
}
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 183/406] clk: imx8mp: fix sai4 clock
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 182/406] PCI/ASPM: " Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 184/406] clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op Greg Kroah-Hartman
` (231 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Boyd, Marco Felsch,
Abel Vesa, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <m.felsch@pengutronix.de>
[ Upstream commit c30f600f1f41dcf5ef0fb02e9a201f9b2e8f31bd ]
The reference manual don't mention a SAI4 hardware block. This would be
clock slice 78 which is skipped (TRM, page 237). Remove any reference to
this clock to align the driver with the reality.
Fixes: 9c140d992676 ("clk: imx: Add support for i.MX8MP clock driver")
Acked-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Link: https://lore.kernel.org/r/20230731142150.3186650-1-m.felsch@pengutronix.de
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-imx8mp.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/clk/imx/clk-imx8mp.c b/drivers/clk/imx/clk-imx8mp.c
index 98a4711ef38d0..148572852e70f 100644
--- a/drivers/clk/imx/clk-imx8mp.c
+++ b/drivers/clk/imx/clk-imx8mp.c
@@ -181,10 +181,6 @@ static const char * const imx8mp_sai3_sels[] = {"osc_24m", "audio_pll1_out", "au
"video_pll1_out", "sys_pll1_133m", "osc_hdmi",
"clk_ext3", "clk_ext4", };
-static const char * const imx8mp_sai4_sels[] = {"osc_24m", "audio_pll1_out", "audio_pll2_out",
- "video_pll1_out", "sys_pll1_133m", "osc_hdmi",
- "clk_ext1", "clk_ext2", };
-
static const char * const imx8mp_sai5_sels[] = {"osc_24m", "audio_pll1_out", "audio_pll2_out",
"video_pll1_out", "sys_pll1_133m", "osc_hdmi",
"clk_ext2", "clk_ext3", };
@@ -596,7 +592,6 @@ static int imx8mp_clocks_probe(struct platform_device *pdev)
hws[IMX8MP_CLK_SAI1] = imx8m_clk_hw_composite("sai1", imx8mp_sai1_sels, ccm_base + 0xa580);
hws[IMX8MP_CLK_SAI2] = imx8m_clk_hw_composite("sai2", imx8mp_sai2_sels, ccm_base + 0xa600);
hws[IMX8MP_CLK_SAI3] = imx8m_clk_hw_composite("sai3", imx8mp_sai3_sels, ccm_base + 0xa680);
- hws[IMX8MP_CLK_SAI4] = imx8m_clk_hw_composite("sai4", imx8mp_sai4_sels, ccm_base + 0xa700);
hws[IMX8MP_CLK_SAI5] = imx8m_clk_hw_composite("sai5", imx8mp_sai5_sels, ccm_base + 0xa780);
hws[IMX8MP_CLK_SAI6] = imx8m_clk_hw_composite("sai6", imx8mp_sai6_sels, ccm_base + 0xa800);
hws[IMX8MP_CLK_ENET_QOS] = imx8m_clk_hw_composite("enet_qos", imx8mp_enet_qos_sels, ccm_base + 0xa880);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 184/406] clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 183/406] clk: imx8mp: fix sai4 clock Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 185/406] vfio/type1: fix cap_migration information leak Greg Kroah-Hartman
` (230 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ahmad Fatoum, Peng Fan, Abel Vesa,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
[ Upstream commit 4dd432d985ef258e3bc436e568fba4b987b59171 ]
Reconfiguring the clock divider to the exact same value is observed
on an i.MX8MN to often cause a longer than usual clock pause, probably
because the divider restarts counting whenever the register is rewritten.
This issue doesn't show up normally, because the clock framework will
take care to not call set_rate when the clock rate is the same.
However, when we reconfigure an upstream clock, the common code will
call set_rate with the newly calculated rate on all children, e.g.:
- sai5 is running normally and divides Audio PLL out by 16.
- Audio PLL rate is increased by 32Hz (glitch-free kdiv change)
- rates for children are recalculated and rates are set recursively
- imx8m_clk_composite_divider_set_rate(sai5) is called with
32/16 = 2Hz more
- imx8m_clk_composite_divider_set_rate computes same divider as before
- divider register is written, so it restarts counting from zero and
MCLK is briefly paused, so instead of e.g. 40ns, MCLK is low for 120ns.
Some external clock consumers can be upset by such unexpected clock pauses,
so let's make sure we only rewrite the divider value when the value to be
written is actually different.
Fixes: d3ff9728134e ("clk: imx: Add imx composite clock")
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Link: https://lore.kernel.org/r/20230807082201.2332746-1-a.fatoum@pengutronix.de
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/imx/clk-composite-8m.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/clk/imx/clk-composite-8m.c b/drivers/clk/imx/clk-composite-8m.c
index 04e728538cefe..75e05582cb24f 100644
--- a/drivers/clk/imx/clk-composite-8m.c
+++ b/drivers/clk/imx/clk-composite-8m.c
@@ -97,7 +97,7 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw,
int prediv_value;
int div_value;
int ret;
- u32 val;
+ u32 orig, val;
ret = imx8m_clk_composite_compute_dividers(rate, parent_rate,
&prediv_value, &div_value);
@@ -106,13 +106,15 @@ static int imx8m_clk_composite_divider_set_rate(struct clk_hw *hw,
spin_lock_irqsave(divider->lock, flags);
- val = readl(divider->reg);
- val &= ~((clk_div_mask(divider->width) << divider->shift) |
- (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT));
+ orig = readl(divider->reg);
+ val = orig & ~((clk_div_mask(divider->width) << divider->shift) |
+ (clk_div_mask(PCG_DIV_WIDTH) << PCG_DIV_SHIFT));
val |= (u32)(prediv_value - 1) << divider->shift;
val |= (u32)(div_value - 1) << PCG_DIV_SHIFT;
- writel(val, divider->reg);
+
+ if (val != orig)
+ writel(val, divider->reg);
spin_unlock_irqrestore(divider->lock, flags);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 185/406] vfio/type1: fix cap_migration information leak
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 184/406] clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 186/406] powerpc/fadump: reset dump area size if fadump memory reserve fails Greg Kroah-Hartman
` (229 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Hajnoczi, Kevin Tian,
Alex Williamson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Hajnoczi <stefanha@redhat.com>
[ Upstream commit cd24e2a60af633f157d7e59c0a6dba64f131c0b1 ]
Fix an information leak where an uninitialized hole in struct
vfio_iommu_type1_info_cap_migration on the stack is exposed to userspace.
The definition of struct vfio_iommu_type1_info_cap_migration contains a hole as
shown in this pahole(1) output:
struct vfio_iommu_type1_info_cap_migration {
struct vfio_info_cap_header header; /* 0 8 */
__u32 flags; /* 8 4 */
/* XXX 4 bytes hole, try to pack */
__u64 pgsize_bitmap; /* 16 8 */
__u64 max_dirty_bitmap_size; /* 24 8 */
/* size: 32, cachelines: 1, members: 4 */
/* sum members: 28, holes: 1, sum holes: 4 */
/* last cacheline: 32 bytes */
};
The cap_mig variable is filled in without initializing the hole:
static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu,
struct vfio_info_cap *caps)
{
struct vfio_iommu_type1_info_cap_migration cap_mig;
cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION;
cap_mig.header.version = 1;
cap_mig.flags = 0;
/* support minimum pgsize */
cap_mig.pgsize_bitmap = (size_t)1 << __ffs(iommu->pgsize_bitmap);
cap_mig.max_dirty_bitmap_size = DIRTY_BITMAP_SIZE_MAX;
return vfio_info_add_capability(caps, &cap_mig.header, sizeof(cap_mig));
}
The structure is then copied to a temporary location on the heap. At this point
it's already too late and ioctl(VFIO_IOMMU_GET_INFO) copies it to userspace
later:
int vfio_info_add_capability(struct vfio_info_cap *caps,
struct vfio_info_cap_header *cap, size_t size)
{
struct vfio_info_cap_header *header;
header = vfio_info_cap_add(caps, size, cap->id, cap->version);
if (IS_ERR(header))
return PTR_ERR(header);
memcpy(header + 1, cap + 1, size - sizeof(*header));
return 0;
}
This issue was found by code inspection.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Fixes: ad721705d09c ("vfio iommu: Add migration capability to report supported features")
Link: https://lore.kernel.org/r/20230801155352.1391945-1-stefanha@redhat.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/vfio/vfio_iommu_type1.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index ec1428dbdf9d9..9b01f88ae4762 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -2659,7 +2659,7 @@ static int vfio_iommu_iova_build_caps(struct vfio_iommu *iommu,
static int vfio_iommu_migration_build_caps(struct vfio_iommu *iommu,
struct vfio_info_cap *caps)
{
- struct vfio_iommu_type1_info_cap_migration cap_mig;
+ struct vfio_iommu_type1_info_cap_migration cap_mig = {};
cap_mig.header.id = VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION;
cap_mig.header.version = 1;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 186/406] powerpc/fadump: reset dump area size if fadump memory reserve fails
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 185/406] vfio/type1: fix cap_migration information leak Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 187/406] powerpc/perf: Convert fsl_emb notifier to state machine callbacks Greg Kroah-Hartman
` (228 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sourabh Jain, Mahesh Salgaonkar,
Michael Ellerman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sourabh Jain <sourabhjain@linux.ibm.com>
[ Upstream commit d1eb75e0dfed80d2d85b664e28a39f65b290ab55 ]
In case fadump_reserve_mem() fails to reserve memory, the
reserve_dump_area_size variable will retain the reserve area size. This
will lead to /sys/kernel/fadump/mem_reserved node displaying an incorrect
memory reserved by fadump.
To fix this problem, reserve dump area size variable is set to 0 if fadump
failed to reserve memory.
Fixes: 8255da95e545 ("powerpc/fadump: release all the memory above boot memory size")
Signed-off-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230704050715.203581-1-sourabhjain@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/fadump.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c
index 1a5ba26aab156..935ce1bec43fa 100644
--- a/arch/powerpc/kernel/fadump.c
+++ b/arch/powerpc/kernel/fadump.c
@@ -642,6 +642,7 @@ int __init fadump_reserve_mem(void)
return ret;
error_out:
fw_dump.fadump_enabled = 0;
+ fw_dump.reserve_dump_area_size = 0;
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 187/406] powerpc/perf: Convert fsl_emb notifier to state machine callbacks
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 186/406] powerpc/fadump: reset dump area size if fadump memory reserve fails Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 188/406] drm/amdgpu: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
` (227 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Michael Ellerman,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 34daf445f82bd3a4df852bb5f1dffd792ac830a0 ]
CC arch/powerpc/perf/core-fsl-emb.o
arch/powerpc/perf/core-fsl-emb.c:675:6: error: no previous prototype for 'hw_perf_event_setup' [-Werror=missing-prototypes]
675 | void hw_perf_event_setup(int cpu)
| ^~~~~~~~~~~~~~~~~~~
Looks like fsl_emb was completely missed by commit 3f6da3905398 ("perf:
Rework and fix the arch CPU-hotplug hooks")
So, apply same changes as commit 3f6da3905398 ("perf: Rework and fix
the arch CPU-hotplug hooks") then commit 57ecde42cc74 ("powerpc/perf:
Convert book3s notifier to state machine callbacks")
While at it, also fix following error:
arch/powerpc/perf/core-fsl-emb.c: In function 'perf_event_interrupt':
arch/powerpc/perf/core-fsl-emb.c:648:13: error: variable 'found' set but not used [-Werror=unused-but-set-variable]
648 | int found = 0;
| ^~~~~
Fixes: 3f6da3905398 ("perf: Rework and fix the arch CPU-hotplug hooks")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/603e1facb32608f88f40b7d7b9094adc50e7b2dc.1692349125.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/core-fsl-emb.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/perf/core-fsl-emb.c b/arch/powerpc/perf/core-fsl-emb.c
index ee721f420a7ba..1a53ab08447cb 100644
--- a/arch/powerpc/perf/core-fsl-emb.c
+++ b/arch/powerpc/perf/core-fsl-emb.c
@@ -645,7 +645,6 @@ static void perf_event_interrupt(struct pt_regs *regs)
struct cpu_hw_events *cpuhw = this_cpu_ptr(&cpu_hw_events);
struct perf_event *event;
unsigned long val;
- int found = 0;
for (i = 0; i < ppmu->n_counter; ++i) {
event = cpuhw->event[i];
@@ -654,7 +653,6 @@ static void perf_event_interrupt(struct pt_regs *regs)
if ((int)val < 0) {
if (event) {
/* event has overflowed */
- found = 1;
record_and_restart(event, val, regs);
} else {
/*
@@ -672,11 +670,13 @@ static void perf_event_interrupt(struct pt_regs *regs)
isync();
}
-void hw_perf_event_setup(int cpu)
+static int fsl_emb_pmu_prepare_cpu(unsigned int cpu)
{
struct cpu_hw_events *cpuhw = &per_cpu(cpu_hw_events, cpu);
memset(cpuhw, 0, sizeof(*cpuhw));
+
+ return 0;
}
int register_fsl_emb_pmu(struct fsl_emb_pmu *pmu)
@@ -689,6 +689,8 @@ int register_fsl_emb_pmu(struct fsl_emb_pmu *pmu)
pmu->name);
perf_pmu_register(&fsl_emb_pmu, "cpu", PERF_TYPE_RAW);
+ cpuhp_setup_state(CPUHP_PERF_POWER, "perf/powerpc:prepare",
+ fsl_emb_pmu_prepare_cpu, NULL);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 188/406] drm/amdgpu: Use RMW accessors for changing LNKCTL
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 187/406] powerpc/perf: Convert fsl_emb notifier to state machine callbacks Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 189/406] drm/radeon: " Greg Kroah-Hartman
` (226 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Ilpo Järvinen,
Bjorn Helgaas, Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit ce7d88110b9ed5f33fe79ea6d4ed049fb0e57bce ]
Don't assume that only the driver would be accessing LNKCTL. ASPM policy
changes can trigger write to LNKCTL outside of driver's control. And in
the case of upstream bridge, the driver does not even own the device it's
changing the registers for.
Use RMW capability accessors which do proper locking to avoid losing
concurrent updates to the register value.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
Fixes: 62a37553414a ("drm/amdgpu: add si implementation v10")
Link: https://lore.kernel.org/r/20230717120503.15276-6-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/cik.c | 36 +++++++++-----------------------
drivers/gpu/drm/amd/amdgpu/si.c | 36 +++++++++-----------------------
2 files changed, 20 insertions(+), 52 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/cik.c b/drivers/gpu/drm/amd/amdgpu/cik.c
index 5442df0941024..453464914f353 100644
--- a/drivers/gpu/drm/amd/amdgpu/cik.c
+++ b/drivers/gpu/drm/amd/amdgpu/cik.c
@@ -1509,17 +1509,8 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
u16 bridge_cfg2, gpu_cfg2;
u32 max_lw, current_lw, tmp;
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &bridge_cfg);
- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL,
- &gpu_cfg);
-
- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
-
- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
tmp = RREG32_PCIE(ixPCIE_LC_STATUS1);
max_lw = (tmp & PCIE_LC_STATUS1__LC_DETECTED_LINK_WIDTH_MASK) >>
@@ -1572,21 +1563,14 @@ static void cik_pcie_gen3_enable(struct amdgpu_device *adev)
msleep(100);
/* linkctl */
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(root, PCI_EXP_LNKCTL,
- tmp16);
-
- pcie_capability_read_word(adev->pdev,
- PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(adev->pdev,
- PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ bridge_cfg &
+ PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ gpu_cfg &
+ PCI_EXP_LNKCTL_HAWD);
/* linkctl2 */
pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c
index e5e336fd9e941..b7e1201d46f97 100644
--- a/drivers/gpu/drm/amd/amdgpu/si.c
+++ b/drivers/gpu/drm/amd/amdgpu/si.c
@@ -2159,17 +2159,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
u16 bridge_cfg2, gpu_cfg2;
u32 max_lw, current_lw, tmp;
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &bridge_cfg);
- pcie_capability_read_word(adev->pdev, PCI_EXP_LNKCTL,
- &gpu_cfg);
-
- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
-
- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(adev->pdev, PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_set_word(adev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
tmp = RREG32_PCIE(PCIE_LC_STATUS1);
max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
@@ -2214,21 +2205,14 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev)
mdelay(100);
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(root, PCI_EXP_LNKCTL,
- tmp16);
-
- pcie_capability_read_word(adev->pdev,
- PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(adev->pdev,
- PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ bridge_cfg &
+ PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_clear_and_set_word(adev->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ gpu_cfg &
+ PCI_EXP_LNKCTL_HAWD);
pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
&tmp16);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 189/406] drm/radeon: Use RMW accessors for changing LNKCTL
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 188/406] drm/amdgpu: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 190/406] net/mlx5: " Greg Kroah-Hartman
` (225 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Ilpo Järvinen,
Bjorn Helgaas, Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 7189576e8a829130192b33c5b64e8a475369c776 ]
Don't assume that only the driver would be accessing LNKCTL. ASPM policy
changes can trigger write to LNKCTL outside of driver's control. And in
the case of upstream bridge, the driver does not even own the device it's
changing the registers for.
Use RMW capability accessors which do proper locking to avoid losing
concurrent updates to the register value.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Fixes: 8a7cd27679d0 ("drm/radeon/cik: add support for pcie gen1/2/3 switching")
Fixes: b9d305dfb66c ("drm/radeon: implement pcie gen2/3 support for SI")
Link: https://lore.kernel.org/r/20230717120503.15276-7-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/cik.c | 36 ++++++++++-------------------------
drivers/gpu/drm/radeon/si.c | 37 ++++++++++--------------------------
2 files changed, 20 insertions(+), 53 deletions(-)
diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
index 5c42877fd6fbf..13f25ec1fe25c 100644
--- a/drivers/gpu/drm/radeon/cik.c
+++ b/drivers/gpu/drm/radeon/cik.c
@@ -9551,17 +9551,8 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
u16 bridge_cfg2, gpu_cfg2;
u32 max_lw, current_lw, tmp;
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &bridge_cfg);
- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL,
- &gpu_cfg);
-
- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
-
- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
tmp = RREG32_PCIE_PORT(PCIE_LC_STATUS1);
max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
@@ -9608,21 +9599,14 @@ static void cik_pcie_gen3_enable(struct radeon_device *rdev)
msleep(100);
/* linkctl */
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(root, PCI_EXP_LNKCTL,
- tmp16);
-
- pcie_capability_read_word(rdev->pdev,
- PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(rdev->pdev,
- PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ bridge_cfg &
+ PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ gpu_cfg &
+ PCI_EXP_LNKCTL_HAWD);
/* linkctl2 */
pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 93dcab548a835..31e2c1083b089 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -7138,17 +7138,8 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
u16 bridge_cfg2, gpu_cfg2;
u32 max_lw, current_lw, tmp;
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &bridge_cfg);
- pcie_capability_read_word(rdev->pdev, PCI_EXP_LNKCTL,
- &gpu_cfg);
-
- tmp16 = bridge_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(root, PCI_EXP_LNKCTL, tmp16);
-
- tmp16 = gpu_cfg | PCI_EXP_LNKCTL_HAWD;
- pcie_capability_write_word(rdev->pdev, PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_set_word(root, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_set_word(rdev->pdev, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_HAWD);
tmp = RREG32_PCIE(PCIE_LC_STATUS1);
max_lw = (tmp & LC_DETECTED_LINK_WIDTH_MASK) >> LC_DETECTED_LINK_WIDTH_SHIFT;
@@ -7195,22 +7186,14 @@ static void si_pcie_gen3_enable(struct radeon_device *rdev)
msleep(100);
/* linkctl */
- pcie_capability_read_word(root, PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (bridge_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(root,
- PCI_EXP_LNKCTL,
- tmp16);
-
- pcie_capability_read_word(rdev->pdev,
- PCI_EXP_LNKCTL,
- &tmp16);
- tmp16 &= ~PCI_EXP_LNKCTL_HAWD;
- tmp16 |= (gpu_cfg & PCI_EXP_LNKCTL_HAWD);
- pcie_capability_write_word(rdev->pdev,
- PCI_EXP_LNKCTL,
- tmp16);
+ pcie_capability_clear_and_set_word(root, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ bridge_cfg &
+ PCI_EXP_LNKCTL_HAWD);
+ pcie_capability_clear_and_set_word(rdev->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_HAWD,
+ gpu_cfg &
+ PCI_EXP_LNKCTL_HAWD);
/* linkctl2 */
pcie_capability_read_word(root, PCI_EXP_LNKCTL2,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 190/406] net/mlx5: Use RMW accessors for changing LNKCTL
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 189/406] drm/radeon: " Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 191/406] wifi: ath10k: " Greg Kroah-Hartman
` (224 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Ilpo Järvinen,
Bjorn Helgaas, Moshe Shemesh, Simon Horman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit 30de872537bda526664d7a20b646adfb3e7ce6e6 ]
Don't assume that only the driver would be accessing LNKCTL of the upstream
bridge. ASPM policy changes can trigger write to LNKCTL outside of driver's
control.
Use RMW capability accessors which do proper locking to avoid losing
concurrent updates to the register value.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Fixes: eabe8e5e88f5 ("net/mlx5: Handle sync reset now event")
Link: https://lore.kernel.org/r/20230717120503.15276-8-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 ++-------
1 file changed, 2 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
index e29db4c39b37f..a2d9904e10492 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c
@@ -279,16 +279,11 @@ static int mlx5_pci_link_toggle(struct mlx5_core_dev *dev)
pci_cfg_access_lock(sdev);
}
/* PCI link toggle */
- err = pci_read_config_word(bridge, cap + PCI_EXP_LNKCTL, ®16);
- if (err)
- return err;
- reg16 |= PCI_EXP_LNKCTL_LD;
- err = pci_write_config_word(bridge, cap + PCI_EXP_LNKCTL, reg16);
+ err = pcie_capability_set_word(bridge, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_LD);
if (err)
return err;
msleep(500);
- reg16 &= ~PCI_EXP_LNKCTL_LD;
- err = pci_write_config_word(bridge, cap + PCI_EXP_LNKCTL, reg16);
+ err = pcie_capability_clear_word(bridge, PCI_EXP_LNKCTL, PCI_EXP_LNKCTL_LD);
if (err)
return err;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 191/406] wifi: ath10k: Use RMW accessors for changing LNKCTL
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 190/406] net/mlx5: " Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 192/406] powerpc: Dont include lppaca.h in paca.h Greg Kroah-Hartman
` (223 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Ilpo Järvinen,
Bjorn Helgaas, Simon Horman, Kalle Valo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
[ Upstream commit f139492a09f15254fa261245cdbd65555cdf39e3 ]
Don't assume that only the driver would be accessing LNKCTL. ASPM policy
changes can trigger write to LNKCTL outside of driver's control.
Use RMW capability accessors which does proper locking to avoid losing
concurrent updates to the register value. On restore, clear the ASPMC field
properly.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Fixes: 76d870ed09ab ("ath10k: enable ASPM")
Link: https://lore.kernel.org/r/20230717120503.15276-11-ilpo.jarvinen@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Acked-by: Kalle Valo <kvalo@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/pci.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c
index 67e240327fb31..2c8f04b415c71 100644
--- a/drivers/net/wireless/ath/ath10k/pci.c
+++ b/drivers/net/wireless/ath/ath10k/pci.c
@@ -1963,8 +1963,9 @@ static int ath10k_pci_hif_start(struct ath10k *ar)
ath10k_pci_irq_enable(ar);
ath10k_pci_rx_post(ar);
- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
- ar_pci->link_ctl);
+ pcie_capability_clear_and_set_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_ASPMC,
+ ar_pci->link_ctl & PCI_EXP_LNKCTL_ASPMC);
return 0;
}
@@ -2820,8 +2821,8 @@ static int ath10k_pci_hif_power_up(struct ath10k *ar,
pcie_capability_read_word(ar_pci->pdev, PCI_EXP_LNKCTL,
&ar_pci->link_ctl);
- pcie_capability_write_word(ar_pci->pdev, PCI_EXP_LNKCTL,
- ar_pci->link_ctl & ~PCI_EXP_LNKCTL_ASPMC);
+ pcie_capability_clear_word(ar_pci->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_ASPMC);
/*
* Bring the target up cleanly.
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 192/406] powerpc: Dont include lppaca.h in paca.h
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 191/406] wifi: ath10k: " Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 193/406] powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT Greg Kroah-Hartman
` (222 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Ellerman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
[ Upstream commit 1aa000667669fa855853decbb1c69e974d8ff716 ]
By adding a forward declaration for struct lppaca we can untangle paca.h
and lppaca.h. Also move get_lppaca() into lppaca.h for consistency.
Add includes of lppaca.h to some files that need it.
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230823055317.751786-3-mpe@ellerman.id.au
Stable-dep-of: eac030b22ea1 ("powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/lppaca.h | 4 ++++
arch/powerpc/include/asm/paca.h | 6 +-----
arch/powerpc/include/asm/paravirt.h | 1 +
arch/powerpc/include/asm/plpar_wrappers.h | 1 +
arch/powerpc/kvm/book3s_hv_ras.c | 1 +
arch/powerpc/mm/book3s64/slb.c | 1 +
arch/powerpc/xmon/xmon.c | 1 +
7 files changed, 10 insertions(+), 5 deletions(-)
diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h
index c390ec377baed..5d509ba0550b5 100644
--- a/arch/powerpc/include/asm/lppaca.h
+++ b/arch/powerpc/include/asm/lppaca.h
@@ -130,6 +130,10 @@ static inline bool lppaca_shared_proc(struct lppaca *l)
return !!(l->__old_status & LPPACA_OLD_SHARED_PROC);
}
+#ifdef CONFIG_PPC_PSERIES
+#define get_lppaca() (get_paca()->lppaca_ptr)
+#endif
+
/*
* SLB shadow buffer structure as defined in the PAPR. The save_area
* contains adjacent ESID and VSID pairs for each shadowed SLB. The
diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h
index 9454d29ff4b47..555aa3580e160 100644
--- a/arch/powerpc/include/asm/paca.h
+++ b/arch/powerpc/include/asm/paca.h
@@ -14,7 +14,6 @@
#include <linux/string.h>
#include <asm/types.h>
-#include <asm/lppaca.h>
#include <asm/mmu.h>
#include <asm/page.h>
#ifdef CONFIG_PPC_BOOK3E
@@ -45,14 +44,11 @@ extern unsigned int debug_smp_processor_id(void); /* from linux/smp.h */
#define get_paca() local_paca
#endif
-#ifdef CONFIG_PPC_PSERIES
-#define get_lppaca() (get_paca()->lppaca_ptr)
-#endif
-
#define get_slb_shadow() (get_paca()->slb_shadow_ptr)
struct task_struct;
struct rtas_args;
+struct lppaca;
/*
* Defines the layout of the paca.
diff --git a/arch/powerpc/include/asm/paravirt.h b/arch/powerpc/include/asm/paravirt.h
index 588bfb9a0579c..546c725013789 100644
--- a/arch/powerpc/include/asm/paravirt.h
+++ b/arch/powerpc/include/asm/paravirt.h
@@ -6,6 +6,7 @@
#include <asm/smp.h>
#ifdef CONFIG_PPC64
#include <asm/paca.h>
+#include <asm/lppaca.h>
#include <asm/hvcall.h>
#endif
diff --git a/arch/powerpc/include/asm/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h
index ece84a430701f..7796cc05e2c8d 100644
--- a/arch/powerpc/include/asm/plpar_wrappers.h
+++ b/arch/powerpc/include/asm/plpar_wrappers.h
@@ -9,6 +9,7 @@
#include <asm/hvcall.h>
#include <asm/paca.h>
+#include <asm/lppaca.h>
#include <asm/page.h>
static inline long poll_pending(void)
diff --git a/arch/powerpc/kvm/book3s_hv_ras.c b/arch/powerpc/kvm/book3s_hv_ras.c
index 6028628ea3acf..7c693b3ee34b9 100644
--- a/arch/powerpc/kvm/book3s_hv_ras.c
+++ b/arch/powerpc/kvm/book3s_hv_ras.c
@@ -9,6 +9,7 @@
#include <linux/kvm.h>
#include <linux/kvm_host.h>
#include <linux/kernel.h>
+#include <asm/lppaca.h>
#include <asm/opal.h>
#include <asm/mce.h>
#include <asm/machdep.h>
diff --git a/arch/powerpc/mm/book3s64/slb.c b/arch/powerpc/mm/book3s64/slb.c
index c30fcbfa0e326..ccf0a876a7bd0 100644
--- a/arch/powerpc/mm/book3s64/slb.c
+++ b/arch/powerpc/mm/book3s64/slb.c
@@ -13,6 +13,7 @@
#include <asm/mmu.h>
#include <asm/mmu_context.h>
#include <asm/paca.h>
+#include <asm/lppaca.h>
#include <asm/ppc-opcode.h>
#include <asm/cputable.h>
#include <asm/cacheflush.h>
diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c
index 2872b66d9fec7..3de2adc0a8074 100644
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -58,6 +58,7 @@
#ifdef CONFIG_PPC64
#include <asm/hvcall.h>
#include <asm/paca.h>
+#include <asm/lppaca.h>
#endif
#include "nonstdio.h"
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 193/406] powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 192/406] powerpc: Dont include lppaca.h in paca.h Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 194/406] nfs/blocklayout: Use the passed in gfp flags Greg Kroah-Hartman
` (221 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Russell Currey, Michael Ellerman,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <ruscur@russell.cc>
[ Upstream commit eac030b22ea12cdfcbb2e941c21c03964403c63f ]
lppaca_shared_proc() takes a pointer to the lppaca which is typically
accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads
to checking if preemption is enabled, for example:
BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693
caller is lparcfg_data+0x408/0x19a0
CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2
Call Trace:
dump_stack_lvl+0x154/0x200 (unreliable)
check_preemption_disabled+0x214/0x220
lparcfg_data+0x408/0x19a0
...
This isn't actually a problem however, as it does not matter which
lppaca is accessed, the shared proc state will be the same.
vcpudispatch_stats_procfs_init() already works around this by disabling
preemption, but the lparcfg code does not, erroring any time
/proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled.
Instead of disabling preemption on the caller side, rework
lppaca_shared_proc() to not take a pointer and instead directly access
the lppaca, bypassing any potential preemption checks.
Fixes: f13c13a00512 ("powerpc: Stop using non-architected shared_proc field in lppaca")
Signed-off-by: Russell Currey <ruscur@russell.cc>
[mpe: Rework to avoid needing a definition in paca.h and lppaca.h]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230823055317.751786-4-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/lppaca.h | 11 +++++++++--
arch/powerpc/platforms/pseries/lpar.c | 10 +---------
arch/powerpc/platforms/pseries/lparcfg.c | 4 ++--
arch/powerpc/platforms/pseries/setup.c | 2 +-
drivers/cpuidle/cpuidle-pseries.c | 8 +-------
5 files changed, 14 insertions(+), 21 deletions(-)
diff --git a/arch/powerpc/include/asm/lppaca.h b/arch/powerpc/include/asm/lppaca.h
index 5d509ba0550b5..1412e643122e4 100644
--- a/arch/powerpc/include/asm/lppaca.h
+++ b/arch/powerpc/include/asm/lppaca.h
@@ -45,6 +45,7 @@
#include <asm/types.h>
#include <asm/mmu.h>
#include <asm/firmware.h>
+#include <asm/paca.h>
/*
* The lppaca is the "virtual processor area" registered with the hypervisor,
@@ -123,14 +124,20 @@ struct lppaca {
*/
#define LPPACA_OLD_SHARED_PROC 2
-static inline bool lppaca_shared_proc(struct lppaca *l)
+#ifdef CONFIG_PPC_PSERIES
+/*
+ * All CPUs should have the same shared proc value, so directly access the PACA
+ * to avoid false positives from DEBUG_PREEMPT.
+ */
+static inline bool lppaca_shared_proc(void)
{
+ struct lppaca *l = local_paca->lppaca_ptr;
+
if (!firmware_has_feature(FW_FEATURE_SPLPAR))
return false;
return !!(l->__old_status & LPPACA_OLD_SHARED_PROC);
}
-#ifdef CONFIG_PPC_PSERIES
#define get_lppaca() (get_paca()->lppaca_ptr)
#endif
diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 28396a7e77d6f..68f3b082245e0 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c
@@ -637,16 +637,8 @@ static const struct proc_ops vcpudispatch_stats_freq_proc_ops = {
static int __init vcpudispatch_stats_procfs_init(void)
{
- /*
- * Avoid smp_processor_id while preemptible. All CPUs should have
- * the same value for lppaca_shared_proc.
- */
- preempt_disable();
- if (!lppaca_shared_proc(get_lppaca())) {
- preempt_enable();
+ if (!lppaca_shared_proc())
return 0;
- }
- preempt_enable();
if (!proc_create("powerpc/vcpudispatch_stats", 0600, NULL,
&vcpudispatch_stats_proc_ops))
diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index d3517e498512f..a7d4e25ae82a1 100644
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -205,7 +205,7 @@ static void parse_ppp_data(struct seq_file *m)
ppp_data.active_system_procs);
/* pool related entries are appropriate for shared configs */
- if (lppaca_shared_proc(get_lppaca())) {
+ if (lppaca_shared_proc()) {
unsigned long pool_idle_time, pool_procs;
seq_printf(m, "pool=%d\n", ppp_data.pool_num);
@@ -529,7 +529,7 @@ static int pseries_lparcfg_data(struct seq_file *m, void *v)
partition_potential_processors);
seq_printf(m, "shared_processor_mode=%d\n",
- lppaca_shared_proc(get_lppaca()));
+ lppaca_shared_proc());
#ifdef CONFIG_PPC_BOOK3S_64
seq_printf(m, "slb_size=%d\n", mmu_slb_size);
diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c
index 0eac9ca782c21..822be2680b792 100644
--- a/arch/powerpc/platforms/pseries/setup.c
+++ b/arch/powerpc/platforms/pseries/setup.c
@@ -800,7 +800,7 @@ static void __init pSeries_setup_arch(void)
if (firmware_has_feature(FW_FEATURE_LPAR)) {
vpa_init(boot_cpuid);
- if (lppaca_shared_proc(get_lppaca())) {
+ if (lppaca_shared_proc()) {
static_branch_enable(&shared_processor);
pv_spinlocks_init();
}
diff --git a/drivers/cpuidle/cpuidle-pseries.c b/drivers/cpuidle/cpuidle-pseries.c
index ff164dec8422e..f4cf3ade03db8 100644
--- a/drivers/cpuidle/cpuidle-pseries.c
+++ b/drivers/cpuidle/cpuidle-pseries.c
@@ -409,13 +409,7 @@ static int __init pseries_idle_probe(void)
return -ENODEV;
if (firmware_has_feature(FW_FEATURE_SPLPAR)) {
- /*
- * Use local_paca instead of get_lppaca() since
- * preemption is not disabled, and it is not required in
- * fact, since lppaca_ptr does not need to be the value
- * associated to the current CPU, it can be from any CPU.
- */
- if (lppaca_shared_proc(local_paca->lppaca_ptr)) {
+ if (lppaca_shared_proc()) {
cpuidle_state_table = shared_states;
max_idle_state = ARRAY_SIZE(shared_states);
} else {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 194/406] nfs/blocklayout: Use the passed in gfp flags
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 193/406] powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 195/406] powerpc/iommu: Fix notifiers being shared by PCI and VIO buses Greg Kroah-Hartman
` (220 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Christoph Hellwig,
Anna Schumaker, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 08b45fcb2d4675f6182fe0edc0d8b1fe604051fa ]
This allocation should use the passed in GFP_ flags instead of
GFP_KERNEL. One places where this matters is in filelayout_pg_init_write()
which uses GFP_NOFS as the allocation flags.
Fixes: 5c83746a0cf2 ("pnfs/blocklayout: in-kernel GETDEVICEINFO XDR parsing")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/blocklayout/dev.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/blocklayout/dev.c b/fs/nfs/blocklayout/dev.c
index dec5880ac6de2..6e3a14fdff9c8 100644
--- a/fs/nfs/blocklayout/dev.c
+++ b/fs/nfs/blocklayout/dev.c
@@ -422,7 +422,7 @@ bl_parse_concat(struct nfs_server *server, struct pnfs_block_dev *d,
int ret, i;
d->children = kcalloc(v->concat.volumes_count,
- sizeof(struct pnfs_block_dev), GFP_KERNEL);
+ sizeof(struct pnfs_block_dev), gfp_mask);
if (!d->children)
return -ENOMEM;
@@ -451,7 +451,7 @@ bl_parse_stripe(struct nfs_server *server, struct pnfs_block_dev *d,
int ret, i;
d->children = kcalloc(v->stripe.volumes_count,
- sizeof(struct pnfs_block_dev), GFP_KERNEL);
+ sizeof(struct pnfs_block_dev), gfp_mask);
if (!d->children)
return -ENOMEM;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 195/406] powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 194/406] nfs/blocklayout: Use the passed in gfp flags Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 196/406] jfs: validate max amount of blocks before allocation Greg Kroah-Hartman
` (219 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nageswara R Sastry, Russell Currey,
Andrew Donnellan, Michael Ellerman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Russell Currey <ruscur@russell.cc>
[ Upstream commit c37b6908f7b2bd24dcaaf14a180e28c9132b9c58 ]
fail_iommu_setup() registers the fail_iommu_bus_notifier struct to both
PCI and VIO buses. struct notifier_block is a linked list node, so this
causes any notifiers later registered to either bus type to also be
registered to the other since they share the same node.
This causes issues in (at least) the vgaarb code, which registers a
notifier for PCI buses. pci_notify() ends up being called on a vio
device, converted with to_pci_dev() even though it's not a PCI device,
and finally makes a bad access in vga_arbiter_add_pci_device() as
discovered with KASAN:
BUG: KASAN: slab-out-of-bounds in vga_arbiter_add_pci_device+0x60/0xe00
Read of size 4 at addr c000000264c26fdc by task swapper/0/1
Call Trace:
dump_stack_lvl+0x1bc/0x2b8 (unreliable)
print_report+0x3f4/0xc60
kasan_report+0x244/0x698
__asan_load4+0xe8/0x250
vga_arbiter_add_pci_device+0x60/0xe00
pci_notify+0x88/0x444
notifier_call_chain+0x104/0x320
blocking_notifier_call_chain+0xa0/0x140
device_add+0xac8/0x1d30
device_register+0x58/0x80
vio_register_device_node+0x9ac/0xce0
vio_bus_scan_register_devices+0xc4/0x13c
__machine_initcall_pseries_vio_device_init+0x94/0xf0
do_one_initcall+0x12c/0xaa8
kernel_init_freeable+0xa48/0xba8
kernel_init+0x64/0x400
ret_from_kernel_thread+0x5c/0x64
Fix this by creating separate notifier_block structs for each bus type.
Fixes: d6b9a81b2a45 ("powerpc: IOMMU fault injection")
Reported-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
Signed-off-by: Russell Currey <ruscur@russell.cc>
Tested-by: Nageswara R Sastry <rnsastry@linux.ibm.com>
Reviewed-by: Andrew Donnellan <ajd@linux.ibm.com>
[mpe: Add #ifdef to fix CONFIG_IBMVIO=n build]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230322035322.328709-1-ruscur@russell.cc
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/iommu.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c
index 6806eefa52ceb..370635107f1c6 100644
--- a/arch/powerpc/kernel/iommu.c
+++ b/arch/powerpc/kernel/iommu.c
@@ -133,17 +133,28 @@ static int fail_iommu_bus_notify(struct notifier_block *nb,
return 0;
}
-static struct notifier_block fail_iommu_bus_notifier = {
+/*
+ * PCI and VIO buses need separate notifier_block structs, since they're linked
+ * list nodes. Sharing a notifier_block would mean that any notifiers later
+ * registered for PCI buses would also get called by VIO buses and vice versa.
+ */
+static struct notifier_block fail_iommu_pci_bus_notifier = {
.notifier_call = fail_iommu_bus_notify
};
+#ifdef CONFIG_IBMVIO
+static struct notifier_block fail_iommu_vio_bus_notifier = {
+ .notifier_call = fail_iommu_bus_notify
+};
+#endif
+
static int __init fail_iommu_setup(void)
{
#ifdef CONFIG_PCI
- bus_register_notifier(&pci_bus_type, &fail_iommu_bus_notifier);
+ bus_register_notifier(&pci_bus_type, &fail_iommu_pci_bus_notifier);
#endif
#ifdef CONFIG_IBMVIO
- bus_register_notifier(&vio_bus_type, &fail_iommu_bus_notifier);
+ bus_register_notifier(&vio_bus_type, &fail_iommu_vio_bus_notifier);
#endif
return 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 196/406] jfs: validate max amount of blocks before allocation.
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 195/406] powerpc/iommu: Fix notifiers being shared by PCI and VIO buses Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 197/406] fs: lockd: avoid possible wrong NULL parameter Greg Kroah-Hartman
` (218 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksei Filippov, Dave Kleikamp,
Sasha Levin, syzbot+5f088f29593e6b4c8db8
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexei Filippov <halip0503@gmail.com>
[ Upstream commit 0225e10972fa809728b8d4c1bd2772b3ec3fdb57 ]
The lack of checking bmp->db_max_freebud in extBalloc() can lead to
shift out of bounds, so this patch prevents undefined behavior, because
bmp->db_max_freebud == -1 only if there is no free space.
Signed-off-by: Aleksei Filippov <halip0503@gmail.com>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-and-tested-by: syzbot+5f088f29593e6b4c8db8@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?id=01abadbd6ae6a08b1f1987aa61554c6b3ac19ff2
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_extent.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/jfs/jfs_extent.c b/fs/jfs/jfs_extent.c
index f65bd6b35412b..d4e063dbb9a0b 100644
--- a/fs/jfs/jfs_extent.c
+++ b/fs/jfs/jfs_extent.c
@@ -508,6 +508,11 @@ extBalloc(struct inode *ip, s64 hint, s64 * nblocks, s64 * blkno)
* blocks in the map. in that case, we'll start off with the
* maximum free.
*/
+
+ /* give up if no space left */
+ if (bmp->db_maxfreebud == -1)
+ return -ENOSPC;
+
max = (s64) 1 << bmp->db_maxfreebud;
if (*nblocks >= max && *nblocks > nbperpage)
nb = nblks = (max > nbperpage) ? max : nbperpage;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 197/406] fs: lockd: avoid possible wrong NULL parameter
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 196/406] jfs: validate max amount of blocks before allocation Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 198/406] NFSD: da_addr_body field missing in some GETDEVICEINFO replies Greg Kroah-Hartman
` (217 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Su Hui, Nick Desaulniers,
Jeff Layton, Chuck Lever, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit de8d38cf44bac43e83bad28357ba84784c412752 ]
clang's static analysis warning: fs/lockd/mon.c: line 293, column 2:
Null pointer passed as 2nd argument to memory copy function.
Assuming 'hostname' is NULL and calling 'nsm_create_handle()', this will
pass NULL as 2nd argument to memory copy function 'memcpy()'. So return
NULL if 'hostname' is invalid.
Fixes: 77a3ef33e2de ("NSM: More clean up of nsm_get_handle()")
Signed-off-by: Su Hui <suhui@nfschina.com>
Reviewed-by: Nick Desaulniers <ndesaulniers@google.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/lockd/mon.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c
index 1d9488cf05348..87a0f207df0b9 100644
--- a/fs/lockd/mon.c
+++ b/fs/lockd/mon.c
@@ -276,6 +276,9 @@ static struct nsm_handle *nsm_create_handle(const struct sockaddr *sap,
{
struct nsm_handle *new;
+ if (!hostname)
+ return NULL;
+
new = kzalloc(sizeof(*new) + hostname_len + 1, GFP_KERNEL);
if (unlikely(new == NULL))
return NULL;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 198/406] NFSD: da_addr_body field missing in some GETDEVICEINFO replies
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 197/406] fs: lockd: avoid possible wrong NULL parameter Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 199/406] NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN Greg Kroah-Hartman
` (216 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Tom Haynes,
Chuck Lever, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit 6372e2ee629894433fe6107d7048536a3280a284 ]
The XDR specification in RFC 8881 looks like this:
struct device_addr4 {
layouttype4 da_layout_type;
opaque da_addr_body<>;
};
struct GETDEVICEINFO4resok {
device_addr4 gdir_device_addr;
bitmap4 gdir_notification;
};
union GETDEVICEINFO4res switch (nfsstat4 gdir_status) {
case NFS4_OK:
GETDEVICEINFO4resok gdir_resok4;
case NFS4ERR_TOOSMALL:
count4 gdir_mincount;
default:
void;
};
Looking at nfsd4_encode_getdeviceinfo() ....
When the client provides a zero gd_maxcount, then the Linux NFS
server implementation encodes the da_layout_type field and then
skips the da_addr_body field completely, proceeding directly to
encode gdir_notification field.
There does not appear to be an option in the specification to skip
encoding da_addr_body. Moreover, Section 18.40.3 says:
> If the client wants to just update or turn off notifications, it
> MAY send a GETDEVICEINFO operation with gdia_maxcount set to zero.
> In that event, if the device ID is valid, the reply's da_addr_body
> field of the gdir_device_addr field will be of zero length.
Since the layout drivers are responsible for encoding the
da_addr_body field, put this fix inside the ->encode_getdeviceinfo
methods.
Fixes: 9cf514ccfacb ("nfsd: implement pNFS operations")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Cc: Tom Haynes <loghyr@gmail.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/blocklayoutxdr.c | 9 +++++++++
fs/nfsd/flexfilelayoutxdr.c | 9 +++++++++
fs/nfsd/nfs4xdr.c | 25 +++++++++++--------------
3 files changed, 29 insertions(+), 14 deletions(-)
diff --git a/fs/nfsd/blocklayoutxdr.c b/fs/nfsd/blocklayoutxdr.c
index 442543304930b..2455dc8be18a8 100644
--- a/fs/nfsd/blocklayoutxdr.c
+++ b/fs/nfsd/blocklayoutxdr.c
@@ -82,6 +82,15 @@ nfsd4_block_encode_getdeviceinfo(struct xdr_stream *xdr,
int len = sizeof(__be32), ret, i;
__be32 *p;
+ /*
+ * See paragraph 5 of RFC 8881 S18.40.3.
+ */
+ if (!gdp->gd_maxcount) {
+ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
+ return nfserr_resource;
+ return nfs_ok;
+ }
+
p = xdr_reserve_space(xdr, len + sizeof(__be32));
if (!p)
return nfserr_resource;
diff --git a/fs/nfsd/flexfilelayoutxdr.c b/fs/nfsd/flexfilelayoutxdr.c
index e81d2a5cf381e..bb205328e043d 100644
--- a/fs/nfsd/flexfilelayoutxdr.c
+++ b/fs/nfsd/flexfilelayoutxdr.c
@@ -85,6 +85,15 @@ nfsd4_ff_encode_getdeviceinfo(struct xdr_stream *xdr,
int addr_len;
__be32 *p;
+ /*
+ * See paragraph 5 of RFC 8881 S18.40.3.
+ */
+ if (!gdp->gd_maxcount) {
+ if (xdr_stream_encode_u32(xdr, 0) != XDR_UNIT)
+ return nfserr_resource;
+ return nfs_ok;
+ }
+
/* len + padding for two strings */
addr_len = 16 + da->netaddr.netid_len + da->netaddr.addr_len;
ver_len = 20;
diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
index c7e8e641d3e5f..dbfa24cf33906 100644
--- a/fs/nfsd/nfs4xdr.c
+++ b/fs/nfsd/nfs4xdr.c
@@ -4407,20 +4407,17 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr,
*p++ = cpu_to_be32(gdev->gd_layout_type);
- /* If maxcount is 0 then just update notifications */
- if (gdev->gd_maxcount != 0) {
- ops = nfsd4_layout_ops[gdev->gd_layout_type];
- nfserr = ops->encode_getdeviceinfo(xdr, gdev);
- if (nfserr) {
- /*
- * We don't bother to burden the layout drivers with
- * enforcing gd_maxcount, just tell the client to
- * come back with a bigger buffer if it's not enough.
- */
- if (xdr->buf->len + 4 > gdev->gd_maxcount)
- goto toosmall;
- return nfserr;
- }
+ ops = nfsd4_layout_ops[gdev->gd_layout_type];
+ nfserr = ops->encode_getdeviceinfo(xdr, gdev);
+ if (nfserr) {
+ /*
+ * We don't bother to burden the layout drivers with
+ * enforcing gd_maxcount, just tell the client to
+ * come back with a bigger buffer if it's not enough.
+ */
+ if (xdr->buf->len + 4 > gdev->gd_maxcount)
+ goto toosmall;
+ return nfserr;
}
if (gdev->gd_notify_types) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 199/406] NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 198/406] NFSD: da_addr_body field missing in some GETDEVICEINFO replies Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 200/406] NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ Greg Kroah-Hartman
` (215 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <bcodding@redhat.com>
[ Upstream commit f67b55b6588bcf9316a1e6e8d529100a5aa3ebe6 ]
Commit 64cfca85bacd asserts the only valid return values for
nfs2/3_decode_dirent should not include -ENAMETOOLONG, but for a server
that sends a filename3 which exceeds MAXNAMELEN in a READDIR response the
client's behavior will be to endlessly retry the operation.
We could map -ENAMETOOLONG into -EBADCOOKIE, but that would produce
truncated listings without any error. The client should return an error
for this case to clearly assert that the server implementation must be
corrected.
Fixes: 64cfca85bacd ("NFS: Return valid errors from nfs2/3_decode_dirent()")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs2xdr.c | 2 +-
fs/nfs/nfs3xdr.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs2xdr.c b/fs/nfs/nfs2xdr.c
index 5e6453e9b3079..b34196da1f945 100644
--- a/fs/nfs/nfs2xdr.c
+++ b/fs/nfs/nfs2xdr.c
@@ -948,7 +948,7 @@ int nfs2_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
error = decode_filename_inline(xdr, &entry->name, &entry->len);
if (unlikely(error))
- return -EAGAIN;
+ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN;
/*
* The type (size and byte order) of nfscookie isn't defined in
diff --git a/fs/nfs/nfs3xdr.c b/fs/nfs/nfs3xdr.c
index b5a9379b14504..509f32845d7b2 100644
--- a/fs/nfs/nfs3xdr.c
+++ b/fs/nfs/nfs3xdr.c
@@ -1987,7 +1987,7 @@ int nfs3_decode_dirent(struct xdr_stream *xdr, struct nfs_entry *entry,
error = decode_inline_filename3(xdr, &entry->name, &entry->len);
if (unlikely(error))
- return -EAGAIN;
+ return error == -ENAMETOOLONG ? -ENAMETOOLONG : -EAGAIN;
error = decode_cookie3(xdr, &new_cookie);
if (unlikely(error))
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 200/406] NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 199/406] NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 201/406] media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables Greg Kroah-Hartman
` (214 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <kolga@netapp.com>
[ Upstream commit 5690eed941ab7e33c3c3d6b850100cabf740f075 ]
If the client sent a synchronous copy and the server replied with
ERR_OFFLOAD_NO_REQ indicating that it wants an asynchronous
copy instead, the client should retry with asynchronous copy.
Fixes: 539f57b3e0fd ("NFS handle COPY ERR_OFFLOAD_NO_REQS")
Signed-off-by: Olga Kornievskaia <kolga@netapp.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs42proc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs42proc.c b/fs/nfs/nfs42proc.c
index dad32b171e677..dfeea712014b7 100644
--- a/fs/nfs/nfs42proc.c
+++ b/fs/nfs/nfs42proc.c
@@ -443,8 +443,9 @@ ssize_t nfs42_proc_copy(struct file *src, loff_t pos_src,
continue;
}
break;
- } else if (err == -NFS4ERR_OFFLOAD_NO_REQS && !args.sync) {
- args.sync = true;
+ } else if (err == -NFS4ERR_OFFLOAD_NO_REQS &&
+ args.sync != res.synchronous) {
+ args.sync = res.synchronous;
dst_exception.retry = 1;
continue;
} else if ((err == -ESTALE ||
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 201/406] media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 200/406] NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 202/406] media: i2c: tvp5150: check return value of devm_kasprintf() Greg Kroah-Hartman
` (213 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Machek,
Ricardo Ribalda Delgado, Hans de Goede, Ricardo Ribalda,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit f126ff7e4024f6704e6ec0d4137037568708a3c7 ]
The supported ad5820 and ad5821 VCMs both use a single 16 bit register
which is written by sending 2 bytes with the data directly after sending
the i2c-client address.
The ad5823 OTOH has a more typical i2c / smbus device setup with multiple
8 bit registers where the first byte send after the i2c-client address is
the register address and the actual data only starts from the second byte
after the i2c-client address.
The ad5823 i2c_ and of_device_id-s was added at the same time as
the ad5821 ids with as rationale:
"""
Some camera modules also refer that AD5823 is a replacement of AD5820:
https://download.kamami.com/p564094-OV8865_DS.pdf
"""
The AD5823 may be an electrical and functional replacement of the AD5820,
but from a software pov it is not compatible at all and it is going to
need its own driver, drop its id from the ad5820 driver.
Fixes: b8bf73136bae ("media: ad5820: Add support for ad5821 and ad5823")
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Ricardo Ribalda Delgado <ribalda@kernel.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ad5820.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/i2c/ad5820.c b/drivers/media/i2c/ad5820.c
index f55322eebf6d0..d2c69ee27f008 100644
--- a/drivers/media/i2c/ad5820.c
+++ b/drivers/media/i2c/ad5820.c
@@ -359,7 +359,6 @@ static int ad5820_remove(struct i2c_client *client)
static const struct i2c_device_id ad5820_id_table[] = {
{ "ad5820", 0 },
{ "ad5821", 0 },
- { "ad5823", 0 },
{ }
};
MODULE_DEVICE_TABLE(i2c, ad5820_id_table);
@@ -367,7 +366,6 @@ MODULE_DEVICE_TABLE(i2c, ad5820_id_table);
static const struct of_device_id ad5820_of_table[] = {
{ .compatible = "adi,ad5820" },
{ .compatible = "adi,ad5821" },
- { .compatible = "adi,ad5823" },
{ }
};
MODULE_DEVICE_TABLE(of, ad5820_of_table);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 202/406] media: i2c: tvp5150: check return value of devm_kasprintf()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 201/406] media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 203/406] media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() Greg Kroah-Hartman
` (212 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Marco Felsch,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea@microchip.com>
[ Upstream commit 26ce7054d804be73935b9268d6e0ecf2fbbc8aef ]
devm_kasprintf() returns a pointer to dynamically allocated memory.
Pointer could be NULL in case allocation fails. Check pointer validity.
Identified with coccinelle (kmerr.cocci script).
Fixes: 0556f1d580d4 ("media: tvp5150: add input source selection of_graph support")
Signed-off-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Reviewed-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/tvp5150.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c
index 3b3221fd3fe8f..cf0570a6760ca 100644
--- a/drivers/media/i2c/tvp5150.c
+++ b/drivers/media/i2c/tvp5150.c
@@ -2078,6 +2078,10 @@ static int tvp5150_parse_dt(struct tvp5150 *decoder, struct device_node *np)
tvpc->ent.name = devm_kasprintf(dev, GFP_KERNEL, "%s %s",
v4l2c->name, v4l2c->label ?
v4l2c->label : "");
+ if (!tvpc->ent.name) {
+ ret = -ENOMEM;
+ goto err_free;
+ }
}
ep_np = of_graph_get_endpoint_by_regs(np, TVP5150_PAD_VID_OUT, 0);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 203/406] media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 202/406] media: i2c: tvp5150: check return value of devm_kasprintf() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 204/406] drivers: usb: smsusb: fix error handling code in smsusb_init_device Greg Kroah-Hartman
` (211 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Sakari Ailus,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit d7b13edd4cb4bfa335b6008ab867ac28582d3e5c ]
If fwnode_graph_get_remote_endpoint() fails, 'fwnode' is known to be NULL,
so fwnode_handle_put() is a no-op.
Release the reference taken from a previous fwnode_graph_get_port_parent()
call instead.
Also handle fwnode_graph_get_port_parent() failures.
In order to fix these issues, add an error handling path to the function
and the needed gotos.
Fixes: ca50c197bd96 ("[media] v4l: fwnode: Support generic fwnode for parsing standardised properties")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/v4l2-core/v4l2-fwnode.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/media/v4l2-core/v4l2-fwnode.c b/drivers/media/v4l2-core/v4l2-fwnode.c
index dfc53d11053fc..1977ce0195fee 100644
--- a/drivers/media/v4l2-core/v4l2-fwnode.c
+++ b/drivers/media/v4l2-core/v4l2-fwnode.c
@@ -572,19 +572,29 @@ int v4l2_fwnode_parse_link(struct fwnode_handle *fwnode,
link->local_id = fwep.id;
link->local_port = fwep.port;
link->local_node = fwnode_graph_get_port_parent(fwnode);
+ if (!link->local_node)
+ return -ENOLINK;
fwnode = fwnode_graph_get_remote_endpoint(fwnode);
- if (!fwnode) {
- fwnode_handle_put(fwnode);
- return -ENOLINK;
- }
+ if (!fwnode)
+ goto err_put_local_node;
fwnode_graph_parse_endpoint(fwnode, &fwep);
link->remote_id = fwep.id;
link->remote_port = fwep.port;
link->remote_node = fwnode_graph_get_port_parent(fwnode);
+ if (!link->remote_node)
+ goto err_put_remote_endpoint;
return 0;
+
+err_put_remote_endpoint:
+ fwnode_handle_put(fwnode);
+
+err_put_local_node:
+ fwnode_handle_put(link->local_node);
+
+ return -ENOLINK;
}
EXPORT_SYMBOL_GPL(v4l2_fwnode_parse_link);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 204/406] drivers: usb: smsusb: fix error handling code in smsusb_init_device
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 203/406] media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 205/406] media: dib7000p: Fix potential division by zero Greg Kroah-Hartman
` (210 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dongliang Mu, Hans Verkuil,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dongliang Mu <dzm91@hust.edu.cn>
[ Upstream commit b9c7141f384097fa4fa67d2f72e5731d628aef7c ]
The previous commit 4b208f8b561f ("[media] siano: register media controller
earlier")moves siano_media_device_register before smscore_register_device,
and adds corresponding error handling code if smscore_register_device
fails. However, it misses the following error handling code of
smsusb_init_device.
Fix this by moving error handling code at the end of smsusb_init_device
and adding a goto statement in the following error handling parts.
Fixes: 4b208f8b561f ("[media] siano: register media controller earlier")
Signed-off-by: Dongliang Mu <dzm91@hust.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/siano/smsusb.c | 21 +++++++++++----------
1 file changed, 11 insertions(+), 10 deletions(-)
diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c
index 5c223b5498b4b..6036ad3b15681 100644
--- a/drivers/media/usb/siano/smsusb.c
+++ b/drivers/media/usb/siano/smsusb.c
@@ -455,12 +455,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
rc = smscore_register_device(¶ms, &dev->coredev, 0, mdev);
if (rc < 0) {
pr_err("smscore_register_device(...) failed, rc %d\n", rc);
- smsusb_term_device(intf);
-#ifdef CONFIG_MEDIA_CONTROLLER_DVB
- media_device_unregister(mdev);
-#endif
- kfree(mdev);
- return rc;
+ goto err_unregister_device;
}
smscore_set_board_id(dev->coredev, board_id);
@@ -477,8 +472,7 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
rc = smsusb_start_streaming(dev);
if (rc < 0) {
pr_err("smsusb_start_streaming(...) failed\n");
- smsusb_term_device(intf);
- return rc;
+ goto err_unregister_device;
}
dev->state = SMSUSB_ACTIVE;
@@ -486,13 +480,20 @@ static int smsusb_init_device(struct usb_interface *intf, int board_id)
rc = smscore_start_device(dev->coredev);
if (rc < 0) {
pr_err("smscore_start_device(...) failed\n");
- smsusb_term_device(intf);
- return rc;
+ goto err_unregister_device;
}
pr_debug("device 0x%p created\n", dev);
return rc;
+
+err_unregister_device:
+ smsusb_term_device(intf);
+#ifdef CONFIG_MEDIA_CONTROLLER_DVB
+ media_device_unregister(mdev);
+#endif
+ kfree(mdev);
+ return rc;
}
static int smsusb_probe(struct usb_interface *intf,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 205/406] media: dib7000p: Fix potential division by zero
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 204/406] drivers: usb: smsusb: fix error handling code in smsusb_init_device Greg Kroah-Hartman
@ 2023-09-17 19:10 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 206/406] media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() Greg Kroah-Hartman
` (209 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:10 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniil Dulov, Hans Verkuil,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit a1db7b2c5533fc67e2681eb5efc921a67bc7d5b8 ]
Variable loopdiv can be assigned 0, then it is used as a denominator,
without checking it for 0.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 713d54a8bd81 ("[media] DiB7090: add support for the dib7090 based")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: (bw != NULL) -> bw]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/dib7000p.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/dib7000p.c b/drivers/media/dvb-frontends/dib7000p.c
index 55bee50aa8716..1f0b0690198ef 100644
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -497,7 +497,7 @@ static int dib7000p_update_pll(struct dvb_frontend *fe, struct dibx000_bandwidth
prediv = reg_1856 & 0x3f;
loopdiv = (reg_1856 >> 6) & 0x3f;
- if ((bw != NULL) && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
+ if (loopdiv && bw && (bw->pll_prediv != prediv || bw->pll_ratio != loopdiv)) {
dprintk("Updating pll (prediv: old = %d new = %d ; loopdiv : old = %d new = %d)\n", prediv, bw->pll_prediv, loopdiv, bw->pll_ratio);
reg_1856 &= 0xf000;
reg_1857 = dib7000p_read_word(state, 1857);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 206/406] media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2023-09-17 19:10 ` [PATCH 5.10 205/406] media: dib7000p: Fix potential division by zero Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 207/406] media: cx24120: Add retval check for cx24120_message_send() Greg Kroah-Hartman
` (208 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Hans Verkuil,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit ea9ef6c2e001c5dc94bee35ebd1c8a98621cf7b8 ]
'read' is freed when it is known to be NULL, but not when a read error
occurs.
Revert the logic to avoid a small leak, should a m920x_read() call fail.
Fixes: a2ab06d7c4d6 ("media: m920x: don't use stack on USB reads")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/m920x.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/usb/dvb-usb/m920x.c b/drivers/media/usb/dvb-usb/m920x.c
index 691e05833db19..da81fa189b5d5 100644
--- a/drivers/media/usb/dvb-usb/m920x.c
+++ b/drivers/media/usb/dvb-usb/m920x.c
@@ -277,7 +277,6 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
char *read = kmalloc(1, GFP_KERNEL);
if (!read) {
ret = -ENOMEM;
- kfree(read);
goto unlock;
}
@@ -288,8 +287,10 @@ static int m920x_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int nu
if ((ret = m920x_read(d->udev, M9206_I2C, 0x0,
0x20 | stop,
- read, 1)) != 0)
+ read, 1)) != 0) {
+ kfree(read);
goto unlock;
+ }
msg[i].buf[j] = read[0];
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 207/406] media: cx24120: Add retval check for cx24120_message_send()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 206/406] media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 208/406] scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print Greg Kroah-Hartman
` (207 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniil Dulov, Hans Verkuil,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniil Dulov <d.dulov@aladdin.ru>
[ Upstream commit 96002c0ac824e1773d3f706b1f92e2a9f2988047 ]
If cx24120_message_send() returns error, we should keep local struct
unchanged.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 5afc9a25be8d ("[media] Add support for TechniSat Skystar S2")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/cx24120.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/cx24120.c b/drivers/media/dvb-frontends/cx24120.c
index 2464b63fe0cf4..307efef263f27 100644
--- a/drivers/media/dvb-frontends/cx24120.c
+++ b/drivers/media/dvb-frontends/cx24120.c
@@ -972,7 +972,9 @@ static void cx24120_set_clock_ratios(struct dvb_frontend *fe)
cmd.arg[8] = (clock_ratios_table[idx].rate >> 8) & 0xff;
cmd.arg[9] = (clock_ratios_table[idx].rate >> 0) & 0xff;
- cx24120_message_send(state, &cmd);
+ ret = cx24120_message_send(state, &cmd);
+ if (ret != 0)
+ return;
/* Calculate ber window rates for stat work */
cx24120_calculate_ber_window(state, clock_ratios_table[idx].rate);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 208/406] scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 207/406] media: cx24120: Add retval check for cx24120_message_send() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 209/406] scsi: libsas: Introduce more SAM status code aliases in enum exec_status Greg Kroah-Hartman
` (206 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luo Jiaxing, John Garry,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Jiaxing <luojiaxing@huawei.com>
[ Upstream commit 4da0b7f6fac331f2d2336df3ca88a335f545b4dc ]
To help debugging efforts, print the device SAS address for v3 hw erroneous
completion log.
Here is an example print:
hisi_sas_v3_hw 0000:b4:02.0: erroneous completion iptt=2193 task=000000002b0c13f8 dev id=17 addr=570fd45f9d17b001
Link: https://lore.kernel.org/r/1617709711-195853-3-git-send-email-john.garry@huawei.com
Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: f5393a5602ca ("scsi: hisi_sas: Fix normally completed I/O analysed as failed")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 65971bd80186b..e025855609336 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2240,8 +2240,9 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
slot_err_v3_hw(hisi_hba, task, slot);
if (ts->stat != SAS_DATA_UNDERRUN)
- dev_info(dev, "erroneous completion iptt=%d task=%pK dev id=%d CQ hdr: 0x%x 0x%x 0x%x 0x%x Error info: 0x%x 0x%x 0x%x 0x%x\n",
+ dev_info(dev, "erroneous completion iptt=%d task=%pK dev id=%d addr=%016llx CQ hdr: 0x%x 0x%x 0x%x 0x%x Error info: 0x%x 0x%x 0x%x 0x%x\n",
slot->idx, task, sas_dev->device_id,
+ SAS_ADDR(device->sas_addr),
dw0, dw1, complete_hdr->act, dw3,
error_info[0], error_info[1],
error_info[2], error_info[3]);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 209/406] scsi: libsas: Introduce more SAM status code aliases in enum exec_status
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 208/406] scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 210/406] scsi: hisi_sas: Modify v3 HW SSP underflow error processing Greg Kroah-Hartman
` (205 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hannes Reinecke, Artur Paszkiewicz,
Jason Yan, John Garry, Himanshu Madhani, Jack Wang,
Bart Van Assche, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit d377f415dddc18b33c88dcd41cfe4fe6d9db82fb ]
This patch prepares for converting SAM status codes into an enum. Without
this patch converting SAM status codes into an enumeration type would
trigger complaints about enum type mismatches for the SAS code.
Link: https://lore.kernel.org/r/20210524025457.11299-2-bvanassche@acm.org
Cc: Hannes Reinecke <hare@suse.com>
Cc: Artur Paszkiewicz <artur.paszkiewicz@intel.com>
Cc: Jason Yan <yanaijie@huawei.com>
Reviewed-by: John Garry <john.garry@huawei.com>
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: f5393a5602ca ("scsi: hisi_sas: Fix normally completed I/O analysed as failed")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/aic94xx/aic94xx_task.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 8 ++++----
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 8 ++++----
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 8 ++++----
drivers/scsi/isci/request.c | 10 +++++-----
drivers/scsi/isci/task.c | 2 +-
drivers/scsi/libsas/sas_ata.c | 7 ++++---
drivers/scsi/libsas/sas_expander.c | 2 +-
drivers/scsi/libsas/sas_task.c | 4 ++--
drivers/scsi/mvsas/mv_sas.c | 10 +++++-----
drivers/scsi/pm8001/pm8001_hwi.c | 16 ++++++++--------
drivers/scsi/pm8001/pm8001_sas.c | 4 ++--
drivers/scsi/pm8001/pm80xx_hwi.c | 14 +++++++-------
include/scsi/libsas.h | 12 +++++++++---
14 files changed, 57 insertions(+), 50 deletions(-)
diff --git a/drivers/scsi/aic94xx/aic94xx_task.c b/drivers/scsi/aic94xx/aic94xx_task.c
index 593b167ceefee..2eb2885ee6e2f 100644
--- a/drivers/scsi/aic94xx/aic94xx_task.c
+++ b/drivers/scsi/aic94xx/aic94xx_task.c
@@ -208,7 +208,7 @@ static void asd_task_tasklet_complete(struct asd_ascb *ascb,
switch (opcode) {
case TC_NO_ERROR:
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
break;
case TC_UNDERRUN:
ts->resp = SAS_TASK_COMPLETE;
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
index 2c1028183b242..5b54cdd6b9767 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
@@ -1152,14 +1152,14 @@ static void slot_err_v1_hw(struct hisi_hba *hisi_hba,
}
default:
{
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
}
}
}
break;
case SAS_PROTOCOL_SMP:
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
case SAS_PROTOCOL_SATA:
@@ -1281,7 +1281,7 @@ static void slot_complete_v1_hw(struct hisi_hba *hisi_hba,
struct scatterlist *sg_resp = &task->smp_task.smp_resp;
void *to = page_address(sg_page(sg_resp));
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
dma_unmap_sg(dev, &task->smp_task.smp_req, 1,
DMA_TO_DEVICE);
@@ -1298,7 +1298,7 @@ static void slot_complete_v1_hw(struct hisi_hba *hisi_hba,
break;
default:
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
}
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
index b75d54339e40c..4bd26c7946328 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
@@ -2168,7 +2168,7 @@ static void slot_err_v2_hw(struct hisi_hba *hisi_hba,
}
break;
case SAS_PROTOCOL_SMP:
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
case SAS_PROTOCOL_SATA:
@@ -2427,7 +2427,7 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba,
struct scatterlist *sg_resp = &task->smp_task.smp_resp;
void *to = page_address(sg_page(sg_resp));
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
dma_unmap_sg(dev, &task->smp_task.smp_req, 1,
DMA_TO_DEVICE);
@@ -2441,12 +2441,12 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba,
case SAS_PROTOCOL_STP:
case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
{
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
hisi_sas_sata_done(task, slot);
break;
}
default:
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
}
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index e025855609336..59ac0f8e6d5c3 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2159,7 +2159,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
hisi_sas_sata_done(task, slot);
break;
case SAS_PROTOCOL_SMP:
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
default:
break;
@@ -2266,7 +2266,7 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
struct scatterlist *sg_resp = &task->smp_task.smp_resp;
void *to = page_address(sg_page(sg_resp));
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
dma_unmap_sg(dev, &task->smp_task.smp_req, 1,
DMA_TO_DEVICE);
@@ -2279,11 +2279,11 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
case SAS_PROTOCOL_SATA:
case SAS_PROTOCOL_STP:
case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
hisi_sas_sata_done(task, slot);
break;
default:
- ts->stat = SAM_STAT_CHECK_CONDITION;
+ ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
}
diff --git a/drivers/scsi/isci/request.c b/drivers/scsi/isci/request.c
index 6e0817941fa74..b6d68d871b6cb 100644
--- a/drivers/scsi/isci/request.c
+++ b/drivers/scsi/isci/request.c
@@ -2574,7 +2574,7 @@ static void isci_request_handle_controller_specific_errors(
if (!idev)
*status_ptr = SAS_DEVICE_UNKNOWN;
else
- *status_ptr = SAM_STAT_TASK_ABORTED;
+ *status_ptr = SAS_SAM_STAT_TASK_ABORTED;
clear_bit(IREQ_COMPLETE_IN_TARGET, &request->flags);
}
@@ -2704,7 +2704,7 @@ static void isci_request_handle_controller_specific_errors(
default:
/* Task in the target is not done. */
*response_ptr = SAS_TASK_UNDELIVERED;
- *status_ptr = SAM_STAT_TASK_ABORTED;
+ *status_ptr = SAS_SAM_STAT_TASK_ABORTED;
if (task->task_proto == SAS_PROTOCOL_SMP)
set_bit(IREQ_COMPLETE_IN_TARGET, &request->flags);
@@ -2727,7 +2727,7 @@ static void isci_process_stp_response(struct sas_task *task, struct dev_to_host_
if (ac_err_mask(fis->status))
ts->stat = SAS_PROTO_RESPONSE;
else
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
ts->resp = SAS_TASK_COMPLETE;
}
@@ -2790,7 +2790,7 @@ static void isci_request_io_request_complete(struct isci_host *ihost,
case SCI_IO_SUCCESS_IO_DONE_EARLY:
response = SAS_TASK_COMPLETE;
- status = SAM_STAT_GOOD;
+ status = SAS_SAM_STAT_GOOD;
set_bit(IREQ_COMPLETE_IN_TARGET, &request->flags);
if (completion_status == SCI_IO_SUCCESS_IO_DONE_EARLY) {
@@ -2860,7 +2860,7 @@ static void isci_request_io_request_complete(struct isci_host *ihost,
/* Fail the I/O. */
response = SAS_TASK_UNDELIVERED;
- status = SAM_STAT_TASK_ABORTED;
+ status = SAS_SAM_STAT_TASK_ABORTED;
clear_bit(IREQ_COMPLETE_IN_TARGET, &request->flags);
break;
diff --git a/drivers/scsi/isci/task.c b/drivers/scsi/isci/task.c
index 26fa1a4d1e6bf..1d1db40a1572c 100644
--- a/drivers/scsi/isci/task.c
+++ b/drivers/scsi/isci/task.c
@@ -160,7 +160,7 @@ int isci_task_execute_task(struct sas_task *task, gfp_t gfp_flags)
isci_task_refuse(ihost, task,
SAS_TASK_UNDELIVERED,
- SAM_STAT_TASK_ABORTED);
+ SAS_SAM_STAT_TASK_ABORTED);
} else {
task->task_state_flags |= SAS_TASK_AT_INITIATOR;
spin_unlock_irqrestore(&task->task_state_lock, flags);
diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c
index a1a06a832d866..f92b889369c39 100644
--- a/drivers/scsi/libsas/sas_ata.c
+++ b/drivers/scsi/libsas/sas_ata.c
@@ -122,9 +122,10 @@ static void sas_ata_task_done(struct sas_task *task)
}
}
- if (stat->stat == SAS_PROTO_RESPONSE || stat->stat == SAM_STAT_GOOD ||
- ((stat->stat == SAM_STAT_CHECK_CONDITION &&
- dev->sata_dev.class == ATA_DEV_ATAPI))) {
+ if (stat->stat == SAS_PROTO_RESPONSE ||
+ stat->stat == SAS_SAM_STAT_GOOD ||
+ (stat->stat == SAS_SAM_STAT_CHECK_CONDITION &&
+ dev->sata_dev.class == ATA_DEV_ATAPI)) {
memcpy(dev->sata_dev.fis, resp->ending_fis, ATA_RESP_FIS_SIZE);
if (!link->sactive) {
diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index 51485d0251f2d..8444a4287ac1c 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c
@@ -101,7 +101,7 @@ static int smp_execute_task_sg(struct domain_device *dev,
}
}
if (task->task_status.resp == SAS_TASK_COMPLETE &&
- task->task_status.stat == SAM_STAT_GOOD) {
+ task->task_status.stat == SAS_SAM_STAT_GOOD) {
res = 0;
break;
}
diff --git a/drivers/scsi/libsas/sas_task.c b/drivers/scsi/libsas/sas_task.c
index e2d42593ce529..2966ead1d4217 100644
--- a/drivers/scsi/libsas/sas_task.c
+++ b/drivers/scsi/libsas/sas_task.c
@@ -20,7 +20,7 @@ void sas_ssp_task_response(struct device *dev, struct sas_task *task,
else if (iu->datapres == 1)
tstat->stat = iu->resp_data[3];
else if (iu->datapres == 2) {
- tstat->stat = SAM_STAT_CHECK_CONDITION;
+ tstat->stat = SAS_SAM_STAT_CHECK_CONDITION;
tstat->buf_valid_size =
min_t(int, SAS_STATUS_BUF_SIZE,
be32_to_cpu(iu->sense_data_len));
@@ -32,7 +32,7 @@ void sas_ssp_task_response(struct device *dev, struct sas_task *task,
}
else
/* when datapres contains corrupt/unknown value... */
- tstat->stat = SAM_STAT_CHECK_CONDITION;
+ tstat->stat = SAS_SAM_STAT_CHECK_CONDITION;
}
EXPORT_SYMBOL_GPL(sas_ssp_task_response);
diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c
index 484e01428da28..a2a13969c686e 100644
--- a/drivers/scsi/mvsas/mv_sas.c
+++ b/drivers/scsi/mvsas/mv_sas.c
@@ -1314,7 +1314,7 @@ static int mvs_exec_internal_tmf_task(struct domain_device *dev,
}
if (task->task_status.resp == SAS_TASK_COMPLETE &&
- task->task_status.stat == SAM_STAT_GOOD) {
+ task->task_status.stat == SAS_SAM_STAT_GOOD) {
res = TMF_RESP_FUNC_COMPLETE;
break;
}
@@ -1764,7 +1764,7 @@ int mvs_slot_complete(struct mvs_info *mvi, u32 rx_desc, u32 flags)
case SAS_PROTOCOL_SSP:
/* hw says status == 0, datapres == 0 */
if (rx_desc & RXQ_GOOD) {
- tstat->stat = SAM_STAT_GOOD;
+ tstat->stat = SAS_SAM_STAT_GOOD;
tstat->resp = SAS_TASK_COMPLETE;
}
/* response frame present */
@@ -1773,12 +1773,12 @@ int mvs_slot_complete(struct mvs_info *mvi, u32 rx_desc, u32 flags)
sizeof(struct mvs_err_info);
sas_ssp_task_response(mvi->dev, task, iu);
} else
- tstat->stat = SAM_STAT_CHECK_CONDITION;
+ tstat->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
case SAS_PROTOCOL_SMP: {
struct scatterlist *sg_resp = &task->smp_task.smp_resp;
- tstat->stat = SAM_STAT_GOOD;
+ tstat->stat = SAS_SAM_STAT_GOOD;
to = kmap_atomic(sg_page(sg_resp));
memcpy(to + sg_resp->offset,
slot->response + sizeof(struct mvs_err_info),
@@ -1795,7 +1795,7 @@ int mvs_slot_complete(struct mvs_info *mvi, u32 rx_desc, u32 flags)
}
default:
- tstat->stat = SAM_STAT_CHECK_CONDITION;
+ tstat->stat = SAS_SAM_STAT_CHECK_CONDITION;
break;
}
if (!slot->port->port_attached) {
diff --git a/drivers/scsi/pm8001/pm8001_hwi.c b/drivers/scsi/pm8001/pm8001_hwi.c
index da9fbe62a34d1..e9b3485baee01 100644
--- a/drivers/scsi/pm8001/pm8001_hwi.c
+++ b/drivers/scsi/pm8001/pm8001_hwi.c
@@ -1881,7 +1881,7 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
param);
if (param == 0) {
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
} else {
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_PROTO_RESPONSE;
@@ -2341,7 +2341,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_dbg(pm8001_ha, IO, "IO_SUCCESS\n");
if (param == 0) {
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
/* check if response is for SEND READ LOG */
if (pm8001_dev &&
(pm8001_dev->id & NCQ_READ_LOG_FLAG)) {
@@ -2864,7 +2864,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
case IO_SUCCESS:
pm8001_dbg(pm8001_ha, IO, "IO_SUCCESS\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
if (pm8001_dev)
atomic_dec(&pm8001_dev->running_req);
break;
@@ -2891,17 +2891,17 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
case IO_ERROR_HW_TIMEOUT:
pm8001_dbg(pm8001_ha, IO, "IO_ERROR_HW_TIMEOUT\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_BUSY;
+ ts->stat = SAS_SAM_STAT_BUSY;
break;
case IO_XFER_ERROR_BREAK:
pm8001_dbg(pm8001_ha, IO, "IO_XFER_ERROR_BREAK\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_BUSY;
+ ts->stat = SAS_SAM_STAT_BUSY;
break;
case IO_XFER_ERROR_PHY_NOT_READY:
pm8001_dbg(pm8001_ha, IO, "IO_XFER_ERROR_PHY_NOT_READY\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_BUSY;
+ ts->stat = SAS_SAM_STAT_BUSY;
break;
case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
pm8001_dbg(pm8001_ha, IO,
@@ -3656,7 +3656,7 @@ int pm8001_mpi_task_abort_resp(struct pm8001_hba_info *pm8001_ha, void *piomb)
case IO_SUCCESS:
pm8001_dbg(pm8001_ha, EH, "IO_SUCCESS\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
break;
case IO_NOT_VALID:
pm8001_dbg(pm8001_ha, EH, "IO_NOT_VALID\n");
@@ -4288,7 +4288,7 @@ static int pm8001_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
spin_lock_irqsave(&task->task_state_lock, flags);
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
task->task_state_flags &= ~SAS_TASK_STATE_PENDING;
task->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
task->task_state_flags |= SAS_TASK_STATE_DONE;
diff --git a/drivers/scsi/pm8001/pm8001_sas.c b/drivers/scsi/pm8001/pm8001_sas.c
index ba5852548bee3..a16ed0695f1ae 100644
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -764,7 +764,7 @@ static int pm8001_exec_internal_tmf_task(struct domain_device *dev,
}
if (task->task_status.resp == SAS_TASK_COMPLETE &&
- task->task_status.stat == SAM_STAT_GOOD) {
+ task->task_status.stat == SAS_SAM_STAT_GOOD) {
res = TMF_RESP_FUNC_COMPLETE;
break;
}
@@ -846,7 +846,7 @@ pm8001_exec_internal_task_abort(struct pm8001_hba_info *pm8001_ha,
}
if (task->task_status.resp == SAS_TASK_COMPLETE &&
- task->task_status.stat == SAM_STAT_GOOD) {
+ task->task_status.stat == SAS_SAM_STAT_GOOD) {
res = TMF_RESP_FUNC_COMPLETE;
break;
diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_hwi.c
index 0305c8999ba5d..c98c0a53a018c 100644
--- a/drivers/scsi/pm8001/pm80xx_hwi.c
+++ b/drivers/scsi/pm8001/pm80xx_hwi.c
@@ -1916,7 +1916,7 @@ mpi_ssp_completion(struct pm8001_hba_info *pm8001_ha , void *piomb)
param);
if (param == 0) {
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
} else {
ts->resp = SAS_TASK_COMPLETE;
ts->stat = SAS_PROTO_RESPONSE;
@@ -2450,7 +2450,7 @@ mpi_sata_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
pm8001_dbg(pm8001_ha, IO, "IO_SUCCESS\n");
if (param == 0) {
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
/* check if response is for SEND READ LOG */
if (pm8001_dev &&
(pm8001_dev->id & NCQ_READ_LOG_FLAG)) {
@@ -3004,7 +3004,7 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
case IO_SUCCESS:
pm8001_dbg(pm8001_ha, IO, "IO_SUCCESS\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
if (pm8001_dev)
atomic_dec(&pm8001_dev->running_req);
if (pm8001_ha->smp_exp_mode == SMP_DIRECT) {
@@ -3046,17 +3046,17 @@ mpi_smp_completion(struct pm8001_hba_info *pm8001_ha, void *piomb)
case IO_ERROR_HW_TIMEOUT:
pm8001_dbg(pm8001_ha, IO, "IO_ERROR_HW_TIMEOUT\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_BUSY;
+ ts->stat = SAS_SAM_STAT_BUSY;
break;
case IO_XFER_ERROR_BREAK:
pm8001_dbg(pm8001_ha, IO, "IO_XFER_ERROR_BREAK\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_BUSY;
+ ts->stat = SAS_SAM_STAT_BUSY;
break;
case IO_XFER_ERROR_PHY_NOT_READY:
pm8001_dbg(pm8001_ha, IO, "IO_XFER_ERROR_PHY_NOT_READY\n");
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_BUSY;
+ ts->stat = SAS_SAM_STAT_BUSY;
break;
case IO_OPEN_CNX_ERROR_PROTOCOL_NOT_SUPPORTED:
pm8001_dbg(pm8001_ha, IO,
@@ -4679,7 +4679,7 @@ static int pm80xx_chip_sata_req(struct pm8001_hba_info *pm8001_ha,
spin_lock_irqsave(&task->task_state_lock, flags);
ts->resp = SAS_TASK_COMPLETE;
- ts->stat = SAM_STAT_GOOD;
+ ts->stat = SAS_SAM_STAT_GOOD;
task->task_state_flags &= ~SAS_TASK_STATE_PENDING;
task->task_state_flags &= ~SAS_TASK_AT_INITIATOR;
task->task_state_flags |= SAS_TASK_STATE_DONE;
diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h
index e6a43163ab5b7..daf9b07956abf 100644
--- a/include/scsi/libsas.h
+++ b/include/scsi/libsas.h
@@ -474,10 +474,16 @@ enum service_response {
};
enum exec_status {
- /* The SAM_STAT_.. codes fit in the lower 6 bits, alias some of
- * them here to silence 'case value not in enumerated type' warnings
+ /*
+ * Values 0..0x7f are used to return the SAM_STAT_* codes. To avoid
+ * 'case value not in enumerated type' compiler warnings every value
+ * returned through the exec_status enum needs an alias with the SAS_
+ * prefix here.
*/
- __SAM_STAT_CHECK_CONDITION = SAM_STAT_CHECK_CONDITION,
+ SAS_SAM_STAT_GOOD = SAM_STAT_GOOD,
+ SAS_SAM_STAT_BUSY = SAM_STAT_BUSY,
+ SAS_SAM_STAT_TASK_ABORTED = SAM_STAT_TASK_ABORTED,
+ SAS_SAM_STAT_CHECK_CONDITION = SAM_STAT_CHECK_CONDITION,
SAS_DEV_NO_RESPONSE = 0x80,
SAS_DATA_UNDERRUN,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 210/406] scsi: hisi_sas: Modify v3 HW SSP underflow error processing
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 209/406] scsi: libsas: Introduce more SAM status code aliases in enum exec_status Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 211/406] scsi: hisi_sas: Modify v3 HW SATA completion " Greg Kroah-Hartman
` (204 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xingui Yang, Qi Liu, John Garry,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <yangxingui@huawei.com>
[ Upstream commit 62413199cd6d2906c121c2dfa3d7b82fd05f08db ]
In case of SSP underflow allow the response frame IU to be examined for
setting the response stat value rather than always setting
SAS_DATA_UNDERRUN.
This will mean that we call sas_ssp_task_response() in those scenarios and
may send sense data to upper layer.
Such a condition would be for bad blocks were we just reporting an
underflow error to upper layer, but now the sense data will tell
immediately that the media is faulty.
Link: https://lore.kernel.org/r/1645703489-87194-7-git-send-email-john.garry@huawei.com
Signed-off-by: Xingui Yang <yangxingui@huawei.com>
Signed-off-by: Qi Liu <liuqi115@huawei.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: f5393a5602ca ("scsi: hisi_sas: Fix normally completed I/O analysed as failed")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 39 +++++++++++++++++---------
1 file changed, 26 insertions(+), 13 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 59ac0f8e6d5c3..937e4ba46134e 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -392,6 +392,8 @@
#define CMPLT_HDR_ERROR_PHASE_MSK (0xff << CMPLT_HDR_ERROR_PHASE_OFF)
#define CMPLT_HDR_RSPNS_XFRD_OFF 10
#define CMPLT_HDR_RSPNS_XFRD_MSK (0x1 << CMPLT_HDR_RSPNS_XFRD_OFF)
+#define CMPLT_HDR_RSPNS_GOOD_OFF 11
+#define CMPLT_HDR_RSPNS_GOOD_MSK (0x1 << CMPLT_HDR_RSPNS_GOOD_OFF)
#define CMPLT_HDR_ERX_OFF 12
#define CMPLT_HDR_ERX_MSK (0x1 << CMPLT_HDR_ERX_OFF)
#define CMPLT_HDR_ABORT_STAT_OFF 13
@@ -2115,7 +2117,7 @@ static irqreturn_t fatal_axi_int_v3_hw(int irq_no, void *p)
return IRQ_HANDLED;
}
-static void
+static bool
slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
struct hisi_sas_slot *slot)
{
@@ -2133,6 +2135,15 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
switch (task->task_proto) {
case SAS_PROTOCOL_SSP:
if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) {
+ /*
+ * If returned response frame is incorrect because of data underflow,
+ * but I/O information has been written to the host memory, we examine
+ * response IU.
+ */
+ if (!(complete_hdr->dw0 & CMPLT_HDR_RSPNS_GOOD_MSK) &&
+ (complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK))
+ return false;
+
ts->residual = trans_tx_fail_type;
ts->stat = SAS_DATA_UNDERRUN;
} else if (dw3 & CMPLT_HDR_IO_IN_TARGET_MSK) {
@@ -2164,6 +2175,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
default:
break;
}
+ return true;
}
static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
@@ -2238,19 +2250,20 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
if ((dw0 & CMPLT_HDR_CMPLT_MSK) == 0x3) {
u32 *error_info = hisi_sas_status_buf_addr_mem(slot);
- slot_err_v3_hw(hisi_hba, task, slot);
- if (ts->stat != SAS_DATA_UNDERRUN)
- dev_info(dev, "erroneous completion iptt=%d task=%pK dev id=%d addr=%016llx CQ hdr: 0x%x 0x%x 0x%x 0x%x Error info: 0x%x 0x%x 0x%x 0x%x\n",
- slot->idx, task, sas_dev->device_id,
- SAS_ADDR(device->sas_addr),
- dw0, dw1, complete_hdr->act, dw3,
- error_info[0], error_info[1],
- error_info[2], error_info[3]);
- if (unlikely(slot->abort)) {
- sas_task_abort(task);
- return;
+ if (slot_err_v3_hw(hisi_hba, task, slot)) {
+ if (ts->stat != SAS_DATA_UNDERRUN)
+ dev_info(dev, "erroneous completion iptt=%d task=%pK dev id=%d addr=%016llx CQ hdr: 0x%x 0x%x 0x%x 0x%x Error info: 0x%x 0x%x 0x%x 0x%x\n",
+ slot->idx, task, sas_dev->device_id,
+ SAS_ADDR(device->sas_addr),
+ dw0, dw1, complete_hdr->act, dw3,
+ error_info[0], error_info[1],
+ error_info[2], error_info[3]);
+ if (unlikely(slot->abort)) {
+ sas_task_abort(task);
+ return;
+ }
+ goto out;
}
- goto out;
}
switch (task->task_proto) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 211/406] scsi: hisi_sas: Modify v3 HW SATA completion error processing
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 210/406] scsi: hisi_sas: Modify v3 HW SSP underflow error processing Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 212/406] scsi: hisi_sas: Fix warnings detected by sparse Greg Kroah-Hartman
` (203 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xingui Yang, John Garry,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <yangxingui@huawei.com>
[ Upstream commit 7e15334f5d256367fb4c77f4ee0003e1e3d9bf9d ]
If the I/O completion response frame returned by the target device has been
written to the host memory and the err bit in the status field of the
received fis is 1, ts->stat should set to SAS_PROTO_RESPONSE, and this will
let EH analyze and further determine cause of failure.
Link: https://lore.kernel.org/r/1657823002-139010-5-git-send-email-john.garry@huawei.com
Signed-off-by: Xingui Yang <yangxingui@huawei.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: f5393a5602ca ("scsi: hisi_sas: Fix normally completed I/O analysed as failed")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 937e4ba46134e..f3b53eb2cbefe 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -467,6 +467,9 @@ struct hisi_sas_err_record_v3 {
#define RX_DATA_LEN_UNDERFLOW_OFF 6
#define RX_DATA_LEN_UNDERFLOW_MSK (1 << RX_DATA_LEN_UNDERFLOW_OFF)
+#define RX_FIS_STATUS_ERR_OFF 0
+#define RX_FIS_STATUS_ERR_MSK (1 << RX_FIS_STATUS_ERR_OFF)
+
#define HISI_SAS_COMMAND_ENTRIES_V3_HW 4096
#define HISI_SAS_MSI_COUNT_V3_HW 32
@@ -2130,6 +2133,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
hisi_sas_status_buf_addr_mem(slot);
u32 dma_rx_err_type = le32_to_cpu(record->dma_rx_err_type);
u32 trans_tx_fail_type = le32_to_cpu(record->trans_tx_fail_type);
+ u16 sipc_rx_err_type = le16_to_cpu(record->sipc_rx_err_type);
u32 dw3 = le32_to_cpu(complete_hdr->dw3);
switch (task->task_proto) {
@@ -2157,7 +2161,10 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
case SAS_PROTOCOL_SATA:
case SAS_PROTOCOL_STP:
case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
- if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) {
+ if ((complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) &&
+ (sipc_rx_err_type & RX_FIS_STATUS_ERR_MSK)) {
+ ts->stat = SAS_PROTO_RESPONSE;
+ } else if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) {
ts->residual = trans_tx_fail_type;
ts->stat = SAS_DATA_UNDERRUN;
} else if (dw3 & CMPLT_HDR_IO_IN_TARGET_MSK) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 212/406] scsi: hisi_sas: Fix warnings detected by sparse
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 211/406] scsi: hisi_sas: Modify v3 HW SATA completion " Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 213/406] scsi: hisi_sas: Fix normally completed I/O analysed as failed Greg Kroah-Hartman
` (202 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Xingui Yang,
Xiang Chen, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <yangxingui@huawei.com>
[ Upstream commit c0328cc595124579328462fc45d7a29a084cf357 ]
This patch fixes the following warning:
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c:2168:43: sparse: sparse: restricted __le32 degrades to integer
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202304161254.NztCVZIO-lkp@intel.com/
Signed-off-by: Xingui Yang <yangxingui@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Link: https://lore.kernel.org/r/1684118481-95908-4-git-send-email-chenxiang66@hisilicon.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: f5393a5602ca ("scsi: hisi_sas: Fix normally completed I/O analysed as failed")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index f3b53eb2cbefe..0aea82a1205bd 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2135,6 +2135,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
u32 trans_tx_fail_type = le32_to_cpu(record->trans_tx_fail_type);
u16 sipc_rx_err_type = le16_to_cpu(record->sipc_rx_err_type);
u32 dw3 = le32_to_cpu(complete_hdr->dw3);
+ u32 dw0 = le32_to_cpu(complete_hdr->dw0);
switch (task->task_proto) {
case SAS_PROTOCOL_SSP:
@@ -2144,8 +2145,8 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
* but I/O information has been written to the host memory, we examine
* response IU.
*/
- if (!(complete_hdr->dw0 & CMPLT_HDR_RSPNS_GOOD_MSK) &&
- (complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK))
+ if (!(dw0 & CMPLT_HDR_RSPNS_GOOD_MSK) &&
+ (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK))
return false;
ts->residual = trans_tx_fail_type;
@@ -2161,7 +2162,7 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
case SAS_PROTOCOL_SATA:
case SAS_PROTOCOL_STP:
case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
- if ((complete_hdr->dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) &&
+ if ((dw0 & CMPLT_HDR_RSPNS_XFRD_MSK) &&
(sipc_rx_err_type & RX_FIS_STATUS_ERR_MSK)) {
ts->stat = SAS_PROTO_RESPONSE;
} else if (dma_rx_err_type & RX_DATA_LEN_UNDERFLOW_MSK) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 213/406] scsi: hisi_sas: Fix normally completed I/O analysed as failed
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 212/406] scsi: hisi_sas: Fix warnings detected by sparse Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 214/406] media: rkvdec: increase max supported height for H.264 Greg Kroah-Hartman
` (201 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xingui Yang, Xiang Chen,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingui Yang <yangxingui@huawei.com>
[ Upstream commit f5393a5602cacfda2014e0ff8220e5a7564e7cd1 ]
The PIO read command has no response frame and the struct iu[1024] won't be
filled. I/Os which are normally completed will be treated as failed in
sas_ata_task_done() when iu contains abnormal dirty data.
Consequently ending_fis should not be filled by iu when the response frame
hasn't been written to memory.
Fixes: d380f55503ed ("scsi: hisi_sas: Don't bother clearing status buffer IU in task prep")
Signed-off-by: Xingui Yang <yangxingui@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Link: https://lore.kernel.org/r/1689045300-44318-2-git-send-email-chenxiang66@hisilicon.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 11 +++++++++--
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 6 ++++--
2 files changed, 13 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
index 4bd26c7946328..f6e9114debd4d 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
@@ -2026,6 +2026,11 @@ static void slot_err_v2_hw(struct hisi_hba *hisi_hba,
u16 dma_tx_err_type = le16_to_cpu(err_record->dma_tx_err_type);
u16 sipc_rx_err_type = le16_to_cpu(err_record->sipc_rx_err_type);
u32 dma_rx_err_type = le32_to_cpu(err_record->dma_rx_err_type);
+ struct hisi_sas_complete_v2_hdr *complete_queue =
+ hisi_hba->complete_hdr[slot->cmplt_queue];
+ struct hisi_sas_complete_v2_hdr *complete_hdr =
+ &complete_queue[slot->cmplt_queue_slot];
+ u32 dw0 = le32_to_cpu(complete_hdr->dw0);
int error = -1;
if (err_phase == 1) {
@@ -2310,7 +2315,8 @@ static void slot_err_v2_hw(struct hisi_hba *hisi_hba,
break;
}
}
- hisi_sas_sata_done(task, slot);
+ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)
+ hisi_sas_sata_done(task, slot);
}
break;
default:
@@ -2442,7 +2448,8 @@ static void slot_complete_v2_hw(struct hisi_hba *hisi_hba,
case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
{
ts->stat = SAS_SAM_STAT_GOOD;
- hisi_sas_sata_done(task, slot);
+ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)
+ hisi_sas_sata_done(task, slot);
break;
}
default:
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 0aea82a1205bd..0d21c64efa817 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -2175,7 +2175,8 @@ slot_err_v3_hw(struct hisi_hba *hisi_hba, struct sas_task *task,
ts->stat = SAS_OPEN_REJECT;
ts->open_rej_reason = SAS_OREJ_RSVD_RETRY;
}
- hisi_sas_sata_done(task, slot);
+ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)
+ hisi_sas_sata_done(task, slot);
break;
case SAS_PROTOCOL_SMP:
ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
@@ -2301,7 +2302,8 @@ static void slot_complete_v3_hw(struct hisi_hba *hisi_hba,
case SAS_PROTOCOL_STP:
case SAS_PROTOCOL_SATA | SAS_PROTOCOL_STP:
ts->stat = SAS_SAM_STAT_GOOD;
- hisi_sas_sata_done(task, slot);
+ if (dw0 & CMPLT_HDR_RSPNS_XFRD_MSK)
+ hisi_sas_sata_done(task, slot);
break;
default:
ts->stat = SAS_SAM_STAT_CHECK_CONDITION;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 214/406] media: rkvdec: increase max supported height for H.264
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 213/406] scsi: hisi_sas: Fix normally completed I/O analysed as failed Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 215/406] media: mediatek: vcodec: Return NULL if no vdec_fb is found Greg Kroah-Hartman
` (200 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Gaignard, Nicolas Dufresne,
Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
[ Upstream commit f000e6ca2d60fefd02a180a57df2c4162fa0c1b7 ]
After testing it is possible for the hardware to decode H264
bistream with a height up to 2560.
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Fixes: cd33c830448ba ("media: rkvdec: Add the rkvdec driver")
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/staging/media/rkvdec/rkvdec.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/media/rkvdec/rkvdec.c b/drivers/staging/media/rkvdec/rkvdec.c
index f6a29a7078625..86483f1c070b9 100644
--- a/drivers/staging/media/rkvdec/rkvdec.c
+++ b/drivers/staging/media/rkvdec/rkvdec.c
@@ -101,7 +101,7 @@ static const struct rkvdec_coded_fmt_desc rkvdec_coded_fmts[] = {
.max_width = 4096,
.step_width = 16,
.min_height = 48,
- .max_height = 2304,
+ .max_height = 2560,
.step_height = 16,
},
.ctrls = &rkvdec_h264_ctrls,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 215/406] media: mediatek: vcodec: Return NULL if no vdec_fb is found
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 214/406] media: rkvdec: increase max supported height for H.264 Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 216/406] usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() Greg Kroah-Hartman
` (199 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Irui Wang,
AngeloGioacchino Del Regno, Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Irui Wang <irui.wang@mediatek.com>
[ Upstream commit dfa2d6e07432270330ae191f50a0e70636a4cd2b ]
"fb_use_list" is used to store used or referenced frame buffers for
vp9 stateful decoder. "NULL" should be returned when getting target
frame buffer failed from "fb_use_list", not a random unexpected one.
Fixes: f77e89854b3e ("[media] vcodec: mediatek: Add Mediatek VP9 Video Decoder Driver")
Signed-off-by: Irui Wang <irui.wang@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
index d9880210b2ab6..43c108b68d0a0 100644
--- a/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
+++ b/drivers/media/platform/mtk-vcodec/vdec/vdec_vp9_if.c
@@ -226,10 +226,11 @@ static struct vdec_fb *vp9_rm_from_fb_use_list(struct vdec_vp9_inst
if (fb->base_y.va == addr) {
list_move_tail(&node->list,
&inst->available_fb_node_list);
- break;
+ return fb;
}
}
- return fb;
+
+ return NULL;
}
static void vp9_add_to_fb_free_list(struct vdec_vp9_inst *inst,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 216/406] usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 215/406] media: mediatek: vcodec: Return NULL if no vdec_fb is found Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 217/406] scsi: RDMA/srp: Fix residual handling Greg Kroah-Hartman
` (198 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xu Yang, Peter Chen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
[ Upstream commit 5eda42aebb7668b4dcff025cd3ccb0d3d7c53da6 ]
The function mxs_phy_is_otg_host() will return true if OTG_ID_VALUE is
0 at USBPHY_CTRL register. However, OTG_ID_VALUE will not reflect the real
state if the ID pin is float, such as Host-only or Type-C cases. The value
of OTG_ID_VALUE is always 1 which means device mode.
This patch will fix the issue by judging the current mode based on
last_event. The controller will update last_event in time.
Fixes: 7b09e67639d6 ("usb: phy: mxs: refine mxs_phy_disconnect_line")
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://lore.kernel.org/r/20230627110353.1879477-2-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/phy/phy-mxs-usb.c | 10 ++--------
1 file changed, 2 insertions(+), 8 deletions(-)
diff --git a/drivers/usb/phy/phy-mxs-usb.c b/drivers/usb/phy/phy-mxs-usb.c
index 67b39dc62b373..70e23334b27f9 100644
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -388,14 +388,8 @@ static void __mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool disconnect)
static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
{
- void __iomem *base = mxs_phy->phy.io_priv;
- u32 phyctrl = readl(base + HW_USBPHY_CTRL);
-
- if (IS_ENABLED(CONFIG_USB_OTG) &&
- !(phyctrl & BM_USBPHY_CTRL_OTG_ID_VALUE))
- return true;
-
- return false;
+ return IS_ENABLED(CONFIG_USB_OTG) &&
+ mxs_phy->phy.last_event == USB_EVENT_ID;
}
static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 217/406] scsi: RDMA/srp: Fix residual handling
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 216/406] usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 218/406] scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() Greg Kroah-Hartman
` (197 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Leon Romanovsky, Jason Gunthorpe,
Bart Van Assche, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit 89e637c19b2441aabc8dbf22a8745b932fd6996e ]
Although the code for residual handling in the SRP initiator follows the
SCSI documentation, that documentation has never been correct. Because
scsi_finish_command() starts from the data buffer length and subtracts the
residual, scsi_set_resid() must not be called if a residual overflow
occurs. Hence remove the scsi_set_resid() calls from the SRP initiator if a
residual overflow occurrs.
Cc: Leon Romanovsky <leon@kernel.org>
Cc: Jason Gunthorpe <jgg@nvidia.com>
Fixes: 9237f04e12cc ("scsi: core: Fix scsi_get/set_resid() interface")
Fixes: e714531a349f ("IB/srp: Fix residual handling")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230724200843.3376570-3-bvanassche@acm.org
Acked-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index adbd56af379ff..9b9b9557ae746 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1990,12 +1990,8 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
if (unlikely(rsp->flags & SRP_RSP_FLAG_DIUNDER))
scsi_set_resid(scmnd, be32_to_cpu(rsp->data_in_res_cnt));
- else if (unlikely(rsp->flags & SRP_RSP_FLAG_DIOVER))
- scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_in_res_cnt));
else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOUNDER))
scsi_set_resid(scmnd, be32_to_cpu(rsp->data_out_res_cnt));
- else if (unlikely(rsp->flags & SRP_RSP_FLAG_DOOVER))
- scsi_set_resid(scmnd, -be32_to_cpu(rsp->data_out_res_cnt));
srp_free_req(ch, req, scmnd,
be32_to_cpu(rsp->req_lim_delta));
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 218/406] scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 217/406] scsi: RDMA/srp: Fix residual handling Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 219/406] scsi: iscsi: Add length check for nlattr payload Greg Kroah-Hartman
` (196 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenchao Hao, Mike Christie,
Lee Duncan, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenchao Hao <haowenchao@huawei.com>
[ Upstream commit 0c26a2d7c98039e913e63f9250fde738a3f88a60 ]
There are two iscsi_set_param() functions defined in libiscsi.c and
scsi_transport_iscsi.c respectively which is confusing.
Rename the one in scsi_transport_iscsi.c to iscsi_if_set_param().
Signed-off-by: Wenchao Hao <haowenchao@huawei.com>
Link: https://lore.kernel.org/r/20221122181105.4123935-1-haowenchao@huawei.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Reviewed-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 971dfcb74a80 ("scsi: iscsi: Add length check for nlattr payload")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_transport_iscsi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 092bd6a3d64a1..a22bc594b2d4a 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2991,7 +2991,7 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev
}
static int
-iscsi_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
{
char *data = (char*)ev + sizeof(*ev);
struct iscsi_cls_conn *conn;
@@ -3940,7 +3940,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
err = -EINVAL;
break;
case ISCSI_UEVENT_SET_PARAM:
- err = iscsi_set_param(transport, ev);
+ err = iscsi_if_set_param(transport, ev);
break;
case ISCSI_UEVENT_CREATE_CONN:
case ISCSI_UEVENT_DESTROY_CONN:
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 219/406] scsi: iscsi: Add length check for nlattr payload
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 218/406] scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 220/406] scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() Greg Kroah-Hartman
` (195 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Chris Leech,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 971dfcb74a800047952f5288512b9c7ddedb050a ]
The current NETLINK_ISCSI netlink parsing loop checks every nlmsg to make
sure the length is bigger than sizeof(struct iscsi_uevent) and then calls
iscsi_if_recv_msg().
nlh = nlmsg_hdr(skb);
if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) ||
skb->len < nlh->nlmsg_len) {
break;
}
...
err = iscsi_if_recv_msg(skb, nlh, &group);
Hence, in iscsi_if_recv_msg() the nlmsg_data can be safely converted to
iscsi_uevent as the length is already checked.
However, in other cases the length of nlattr payload is not checked before
the payload is converted to other data structures. One example is
iscsi_set_path() which converts the payload to type iscsi_path without any
checks:
params = (struct iscsi_path *)((char *)ev + sizeof(*ev));
Whereas iscsi_if_transport_conn() correctly checks the pdu_len:
pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
if ((ev->u.send_pdu.hdr_size > pdu_len) ..
err = -EINVAL;
To sum up, some code paths called in iscsi_if_recv_msg() do not check the
length of the data (see below picture) and directly convert the data to
another data structure. This could result in an out-of-bound reads and heap
dirty data leakage.
_________ nlmsg_len(nlh) _______________
/ \
+----------+--------------+---------------------------+
| nlmsghdr | iscsi_uevent | data |
+----------+--------------+---------------------------+
\ /
iscsi_uevent->u.set_param.len
Fix the issue by adding the length check before accessing it. To clean up
the code, an additional parameter named rlen is added. The rlen is
calculated at the beginning of iscsi_if_recv_msg() which avoids duplicated
calculation.
Fixes: ac20c7bf070d ("[SCSI] iscsi_transport: Added Ping support")
Fixes: 43514774ff40 ("[SCSI] iscsi class: Add new NETLINK_ISCSI messages for cnic/bnx2i driver.")
Fixes: 1d9bf13a9cf9 ("[SCSI] iscsi class: add iscsi host set param event")
Fixes: 01cb225dad8d ("[SCSI] iscsi: add target discvery event to transport class")
Fixes: 264faaaa1254 ("[SCSI] iscsi: add transport end point callbacks")
Fixes: fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230725024529.428311-1-linma@zju.edu.cn
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_transport_iscsi.c | 72 +++++++++++++++++------------
1 file changed, 43 insertions(+), 29 deletions(-)
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index a22bc594b2d4a..64bc403a4c285 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -2991,14 +2991,15 @@ iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev
}
static int
-iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev, u32 rlen)
{
char *data = (char*)ev + sizeof(*ev);
struct iscsi_cls_conn *conn;
struct iscsi_cls_session *session;
int err = 0, value = 0, state;
- if (ev->u.set_param.len > PAGE_SIZE)
+ if (ev->u.set_param.len > rlen ||
+ ev->u.set_param.len > PAGE_SIZE)
return -EINVAL;
session = iscsi_session_lookup(ev->u.set_param.sid);
@@ -3095,7 +3096,7 @@ static int iscsi_if_ep_disconnect(struct iscsi_transport *transport,
static int
iscsi_if_transport_ep(struct iscsi_transport *transport,
- struct iscsi_uevent *ev, int msg_type)
+ struct iscsi_uevent *ev, int msg_type, u32 rlen)
{
struct iscsi_endpoint *ep;
int rc = 0;
@@ -3103,7 +3104,10 @@ iscsi_if_transport_ep(struct iscsi_transport *transport,
switch (msg_type) {
case ISCSI_UEVENT_TRANSPORT_EP_CONNECT_THROUGH_HOST:
case ISCSI_UEVENT_TRANSPORT_EP_CONNECT:
- rc = iscsi_if_ep_connect(transport, ev, msg_type);
+ if (rlen < sizeof(struct sockaddr))
+ rc = -EINVAL;
+ else
+ rc = iscsi_if_ep_connect(transport, ev, msg_type);
break;
case ISCSI_UEVENT_TRANSPORT_EP_POLL:
if (!transport->ep_poll)
@@ -3127,12 +3131,15 @@ iscsi_if_transport_ep(struct iscsi_transport *transport,
static int
iscsi_tgt_dscvr(struct iscsi_transport *transport,
- struct iscsi_uevent *ev)
+ struct iscsi_uevent *ev, u32 rlen)
{
struct Scsi_Host *shost;
struct sockaddr *dst_addr;
int err;
+ if (rlen < sizeof(*dst_addr))
+ return -EINVAL;
+
if (!transport->tgt_dscvr)
return -EINVAL;
@@ -3153,7 +3160,7 @@ iscsi_tgt_dscvr(struct iscsi_transport *transport,
static int
iscsi_set_host_param(struct iscsi_transport *transport,
- struct iscsi_uevent *ev)
+ struct iscsi_uevent *ev, u32 rlen)
{
char *data = (char*)ev + sizeof(*ev);
struct Scsi_Host *shost;
@@ -3162,7 +3169,8 @@ iscsi_set_host_param(struct iscsi_transport *transport,
if (!transport->set_host_param)
return -ENOSYS;
- if (ev->u.set_host_param.len > PAGE_SIZE)
+ if (ev->u.set_host_param.len > rlen ||
+ ev->u.set_host_param.len > PAGE_SIZE)
return -EINVAL;
shost = scsi_host_lookup(ev->u.set_host_param.host_no);
@@ -3179,12 +3187,15 @@ iscsi_set_host_param(struct iscsi_transport *transport,
}
static int
-iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+iscsi_set_path(struct iscsi_transport *transport, struct iscsi_uevent *ev, u32 rlen)
{
struct Scsi_Host *shost;
struct iscsi_path *params;
int err;
+ if (rlen < sizeof(*params))
+ return -EINVAL;
+
if (!transport->set_path)
return -ENOSYS;
@@ -3244,12 +3255,15 @@ iscsi_set_iface_params(struct iscsi_transport *transport,
}
static int
-iscsi_send_ping(struct iscsi_transport *transport, struct iscsi_uevent *ev)
+iscsi_send_ping(struct iscsi_transport *transport, struct iscsi_uevent *ev, u32 rlen)
{
struct Scsi_Host *shost;
struct sockaddr *dst_addr;
int err;
+ if (rlen < sizeof(*dst_addr))
+ return -EINVAL;
+
if (!transport->send_ping)
return -ENOSYS;
@@ -3747,13 +3761,12 @@ iscsi_get_host_stats(struct iscsi_transport *transport, struct nlmsghdr *nlh)
}
static int iscsi_if_transport_conn(struct iscsi_transport *transport,
- struct nlmsghdr *nlh)
+ struct nlmsghdr *nlh, u32 pdu_len)
{
struct iscsi_uevent *ev = nlmsg_data(nlh);
struct iscsi_cls_session *session;
struct iscsi_cls_conn *conn = NULL;
struct iscsi_endpoint *ep;
- uint32_t pdu_len;
int err = 0;
switch (nlh->nlmsg_type) {
@@ -3833,8 +3846,6 @@ static int iscsi_if_transport_conn(struct iscsi_transport *transport,
break;
case ISCSI_UEVENT_SEND_PDU:
- pdu_len = nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev);
-
if ((ev->u.send_pdu.hdr_size > pdu_len) ||
(ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) {
err = -EINVAL;
@@ -3864,6 +3875,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
struct iscsi_internal *priv;
struct iscsi_cls_session *session;
struct iscsi_endpoint *ep = NULL;
+ u32 rlen;
if (!netlink_capable(skb, CAP_SYS_ADMIN))
return -EPERM;
@@ -3883,6 +3895,13 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
portid = NETLINK_CB(skb).portid;
+ /*
+ * Even though the remaining payload may not be regarded as nlattr,
+ * (like address or something else), calculate the remaining length
+ * here to ease following length checks.
+ */
+ rlen = nlmsg_attrlen(nlh, sizeof(*ev));
+
switch (nlh->nlmsg_type) {
case ISCSI_UEVENT_CREATE_SESSION:
err = iscsi_if_create_session(priv, ep, ev,
@@ -3940,7 +3959,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
err = -EINVAL;
break;
case ISCSI_UEVENT_SET_PARAM:
- err = iscsi_if_set_param(transport, ev);
+ err = iscsi_if_set_param(transport, ev, rlen);
break;
case ISCSI_UEVENT_CREATE_CONN:
case ISCSI_UEVENT_DESTROY_CONN:
@@ -3948,7 +3967,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
case ISCSI_UEVENT_START_CONN:
case ISCSI_UEVENT_BIND_CONN:
case ISCSI_UEVENT_SEND_PDU:
- err = iscsi_if_transport_conn(transport, nlh);
+ err = iscsi_if_transport_conn(transport, nlh, rlen);
break;
case ISCSI_UEVENT_GET_STATS:
err = iscsi_if_get_stats(transport, nlh);
@@ -3957,23 +3976,22 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
case ISCSI_UEVENT_TRANSPORT_EP_POLL:
case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT:
case ISCSI_UEVENT_TRANSPORT_EP_CONNECT_THROUGH_HOST:
- err = iscsi_if_transport_ep(transport, ev, nlh->nlmsg_type);
+ err = iscsi_if_transport_ep(transport, ev, nlh->nlmsg_type, rlen);
break;
case ISCSI_UEVENT_TGT_DSCVR:
- err = iscsi_tgt_dscvr(transport, ev);
+ err = iscsi_tgt_dscvr(transport, ev, rlen);
break;
case ISCSI_UEVENT_SET_HOST_PARAM:
- err = iscsi_set_host_param(transport, ev);
+ err = iscsi_set_host_param(transport, ev, rlen);
break;
case ISCSI_UEVENT_PATH_UPDATE:
- err = iscsi_set_path(transport, ev);
+ err = iscsi_set_path(transport, ev, rlen);
break;
case ISCSI_UEVENT_SET_IFACE_PARAMS:
- err = iscsi_set_iface_params(transport, ev,
- nlmsg_attrlen(nlh, sizeof(*ev)));
+ err = iscsi_set_iface_params(transport, ev, rlen);
break;
case ISCSI_UEVENT_PING:
- err = iscsi_send_ping(transport, ev);
+ err = iscsi_send_ping(transport, ev, rlen);
break;
case ISCSI_UEVENT_GET_CHAP:
err = iscsi_get_chap(transport, nlh);
@@ -3982,13 +4000,10 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
err = iscsi_delete_chap(transport, ev);
break;
case ISCSI_UEVENT_SET_FLASHNODE_PARAMS:
- err = iscsi_set_flashnode_param(transport, ev,
- nlmsg_attrlen(nlh,
- sizeof(*ev)));
+ err = iscsi_set_flashnode_param(transport, ev, rlen);
break;
case ISCSI_UEVENT_NEW_FLASHNODE:
- err = iscsi_new_flashnode(transport, ev,
- nlmsg_attrlen(nlh, sizeof(*ev)));
+ err = iscsi_new_flashnode(transport, ev, rlen);
break;
case ISCSI_UEVENT_DEL_FLASHNODE:
err = iscsi_del_flashnode(transport, ev);
@@ -4003,8 +4018,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group)
err = iscsi_logout_flashnode_sid(transport, ev);
break;
case ISCSI_UEVENT_SET_CHAP:
- err = iscsi_set_chap(transport, ev,
- nlmsg_attrlen(nlh, sizeof(*ev)));
+ err = iscsi_set_chap(transport, ev, rlen);
break;
case ISCSI_UEVENT_GET_HOST_STATS:
err = iscsi_get_host_stats(transport, nlh);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 220/406] scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 219/406] scsi: iscsi: Add length check for nlattr payload Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 221/406] scsi: be2iscsi: Add length check when parsing nlattrs Greg Kroah-Hartman
` (194 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Chris Leech,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit ce51c817008450ef4188471db31639d42d37a5e1 ]
The functions iscsi_if_set_param() and iscsi_if_set_host_param() convert an
nlattr payload to type char* and then call C string handling functions like
sscanf and kstrdup:
char *data = (char*)ev + sizeof(*ev);
...
sscanf(data, "%d", &value);
However, since the nlattr is provided by the user-space program and the
nlmsg skb is allocated with GFP_KERNEL instead of GFP_ZERO flag (see
netlink_alloc_large_skb() in netlink_sendmsg()), dirty data on the heap can
lead to an OOB access for those string handling functions.
By investigating how the bug is introduced, we find it is really
interesting as the old version parsing code starting from commit
fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up") treated
the nlattr as integer bytes instead of string and had length check in
iscsi_copy_param():
if (ev->u.set_param.len != sizeof(uint32_t))
BUG();
But, since the commit a54a52caad4b ("[SCSI] iscsi: fixup set/get param
functions"), the code treated the nlattr as C string while forgetting to
add any strlen checks(), opening the possibility of an OOB access.
Fix the potential OOB by adding the strlen() check before accessing the
buf. If the data passes this check, all low-level set_param handlers can
safely treat this buf as legal C string.
Fixes: fd7255f51a13 ("[SCSI] iscsi: add sysfs attrs for uspace sync up")
Fixes: 1d9bf13a9cf9 ("[SCSI] iscsi class: add iscsi host set param event")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230723075820.3713119-1-linma@zju.edu.cn
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_transport_iscsi.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index 64bc403a4c285..074cbd64aa253 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3007,6 +3007,10 @@ iscsi_if_set_param(struct iscsi_transport *transport, struct iscsi_uevent *ev, u
if (!conn || !session)
return -EINVAL;
+ /* data will be regarded as NULL-ended string, do length check */
+ if (strlen(data) > ev->u.set_param.len)
+ return -EINVAL;
+
switch (ev->u.set_param.param) {
case ISCSI_PARAM_SESS_RECOVERY_TMO:
sscanf(data, "%d", &value);
@@ -3180,6 +3184,10 @@ iscsi_set_host_param(struct iscsi_transport *transport,
return -ENODEV;
}
+ /* see similar check in iscsi_if_set_param() */
+ if (strlen(data) > ev->u.set_host_param.len)
+ return -EINVAL;
+
err = transport->set_host_param(shost, ev->u.set_host_param.param,
data, ev->u.set_host_param.len);
scsi_host_put(shost);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 221/406] scsi: be2iscsi: Add length check when parsing nlattrs
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 220/406] scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 222/406] scsi: qla4xxx: " Greg Kroah-Hartman
` (193 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Chris Leech,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit ee0268f230f66cb472df3424f380ea668da2749a ]
beiscsi_iface_set_param() parses nlattr with nla_for_each_attr and assumes
every attributes can be viewed as struct iscsi_iface_param_info.
This is not true because there is no any nla_policy to validate the
attributes passed from the upper function iscsi_set_iface_params().
Add the nla_len check before accessing the nlattr data and return EINVAL if
the length check fails.
Fixes: 0e43895ec1f4 ("[SCSI] be2iscsi: adding functionality to change network settings using iscsiadm")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230723075938.3713864-1-linma@zju.edu.cn
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/be2iscsi/be_iscsi.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_iscsi.c
index c4881657a807b..e07052fb0ec32 100644
--- a/drivers/scsi/be2iscsi/be_iscsi.c
+++ b/drivers/scsi/be2iscsi/be_iscsi.c
@@ -450,6 +450,10 @@ int beiscsi_iface_set_param(struct Scsi_Host *shost,
}
nla_for_each_attr(attrib, data, dt_len, rm_len) {
+ /* ignore nla_type as it is never used */
+ if (nla_len(attrib) < sizeof(*iface_param))
+ return -EINVAL;
+
iface_param = nla_data(attrib);
if (iface_param->param_type != ISCSI_NET_PARAM)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 222/406] scsi: qla4xxx: Add length check when parsing nlattrs
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 221/406] scsi: be2iscsi: Add length check when parsing nlattrs Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 223/406] serial: sprd: Assign sprd_port after initialized to avoid wrong access Greg Kroah-Hartman
` (192 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma, Chris Leech,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit 47cd3770e31df942e2bb925a9a855c79ed0662eb ]
There are three places that qla4xxx parses nlattrs:
- qla4xxx_set_chap_entry()
- qla4xxx_iface_set_param()
- qla4xxx_sysfs_ddb_set_param()
and each of them directly converts the nlattr to specific pointer of
structure without length checking. This could be dangerous as those
attributes are not validated and a malformed nlattr (e.g., length 0) could
result in an OOB read that leaks heap dirty data.
Add the nla_len check before accessing the nlattr data and return EINVAL if
the length check fails.
Fixes: 26ffd7b45fe9 ("[SCSI] qla4xxx: Add support to set CHAP entries")
Fixes: 1e9e2be3ee03 ("[SCSI] qla4xxx: Add flash node mgmt support")
Fixes: 00c31889f751 ("[SCSI] qla4xxx: fix data alignment and use nl helpers")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Link: https://lore.kernel.org/r/20230723080053.3714534-1-linma@zju.edu.cn
Reviewed-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla4xxx/ql4_os.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
index 8d82d2a83059d..05ae9b1157096 100644
--- a/drivers/scsi/qla4xxx/ql4_os.c
+++ b/drivers/scsi/qla4xxx/ql4_os.c
@@ -973,6 +973,11 @@ static int qla4xxx_set_chap_entry(struct Scsi_Host *shost, void *data, int len)
memset(&chap_rec, 0, sizeof(chap_rec));
nla_for_each_attr(attr, data, len, rem) {
+ if (nla_len(attr) < sizeof(*param_info)) {
+ rc = -EINVAL;
+ goto exit_set_chap;
+ }
+
param_info = nla_data(attr);
switch (param_info->param) {
@@ -2755,6 +2760,11 @@ qla4xxx_iface_set_param(struct Scsi_Host *shost, void *data, uint32_t len)
}
nla_for_each_attr(attr, data, len, rem) {
+ if (nla_len(attr) < sizeof(*iface_param)) {
+ rval = -EINVAL;
+ goto exit_init_fw_cb;
+ }
+
iface_param = nla_data(attr);
if (iface_param->param_type == ISCSI_NET_PARAM) {
@@ -8119,6 +8129,11 @@ qla4xxx_sysfs_ddb_set_param(struct iscsi_bus_flash_session *fnode_sess,
memset((void *)&chap_tbl, 0, sizeof(chap_tbl));
nla_for_each_attr(attr, data, len, rem) {
+ if (nla_len(attr) < sizeof(*fnode_param)) {
+ rc = -EINVAL;
+ goto exit_set_param;
+ }
+
fnode_param = nla_data(attr);
switch (fnode_param->param) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 223/406] serial: sprd: Assign sprd_port after initialized to avoid wrong access
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 222/406] scsi: qla4xxx: " Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 224/406] serial: sprd: Fix DMA buffer leak issue Greg Kroah-Hartman
` (191 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chunyan Zhang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyan Zhang <chunyan.zhang@unisoc.com>
[ Upstream commit f9608f1887568b728839d006024585ab02ef29e5 ]
The global pointer 'sprd_port' may not zero when sprd_probe returns
failure, that is a risk for sprd_port to be accessed afterward, and
may lead to unexpected errors.
For example:
There are two UART ports, UART1 is used for console and configured in
kernel command line, i.e. "console=";
The UART1 probe failed and the memory allocated to sprd_port[1] was
released, but sprd_port[1] was not set to NULL;
In UART2 probe, the same virtual address was allocated to sprd_port[2],
and UART2 probe process finally will go into sprd_console_setup() to
register UART1 as console since it is configured as preferred console
(filled to console_cmdline[]), but the console parameters (sprd_port[1])
belong to UART2.
So move the sprd_port[] assignment to where the port already initialized
can avoid the above issue.
Fixes: b7396a38fb28 ("tty/serial: Add Spreadtrum sc9836-uart driver support")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Link: https://lore.kernel.org/r/20230725064053.235448-1-chunyan.zhang@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/sprd_serial.c | 25 +++++++++++++++++--------
1 file changed, 17 insertions(+), 8 deletions(-)
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index 9a7ae6384edfa..144c03ca3366a 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -1133,7 +1133,7 @@ static bool sprd_uart_is_console(struct uart_port *uport)
static int sprd_clk_init(struct uart_port *uport)
{
struct clk *clk_uart, *clk_parent;
- struct sprd_uart_port *u = sprd_port[uport->line];
+ struct sprd_uart_port *u = container_of(uport, struct sprd_uart_port, port);
clk_uart = devm_clk_get(uport->dev, "uart");
if (IS_ERR(clk_uart)) {
@@ -1176,22 +1176,22 @@ static int sprd_probe(struct platform_device *pdev)
{
struct resource *res;
struct uart_port *up;
+ struct sprd_uart_port *sport;
int irq;
int index;
int ret;
index = of_alias_get_id(pdev->dev.of_node, "serial");
- if (index < 0 || index >= ARRAY_SIZE(sprd_port)) {
+ if (index < 0 || index >= UART_NR_MAX) {
dev_err(&pdev->dev, "got a wrong serial alias id %d\n", index);
return -EINVAL;
}
- sprd_port[index] = devm_kzalloc(&pdev->dev, sizeof(*sprd_port[index]),
- GFP_KERNEL);
- if (!sprd_port[index])
+ sport = devm_kzalloc(&pdev->dev, sizeof(*sport), GFP_KERNEL);
+ if (!sport)
return -ENOMEM;
- up = &sprd_port[index]->port;
+ up = &sport->port;
up->dev = &pdev->dev;
up->line = index;
up->type = PORT_SPRD;
@@ -1222,7 +1222,7 @@ static int sprd_probe(struct platform_device *pdev)
* Allocate one dma buffer to prepare for receive transfer, in case
* memory allocation failure at runtime.
*/
- ret = sprd_rx_alloc_buf(sprd_port[index]);
+ ret = sprd_rx_alloc_buf(sport);
if (ret)
return ret;
@@ -1233,14 +1233,23 @@ static int sprd_probe(struct platform_device *pdev)
return ret;
}
}
+
sprd_ports_num++;
+ sprd_port[index] = sport;
ret = uart_add_one_port(&sprd_uart_driver, up);
if (ret)
- sprd_remove(pdev);
+ goto clean_port;
platform_set_drvdata(pdev, up);
+ return 0;
+
+clean_port:
+ sprd_port[index] = NULL;
+ if (--sprd_ports_num == 0)
+ uart_unregister_driver(&sprd_uart_driver);
+ sprd_rx_free_buf(sport);
return ret;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 224/406] serial: sprd: Fix DMA buffer leak issue
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 223/406] serial: sprd: Assign sprd_port after initialized to avoid wrong access Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 225/406] x86/APM: drop the duplicate APM_MINOR_DEV macro Greg Kroah-Hartman
` (190 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chunyan Zhang, Baolin Wang,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunyan Zhang <chunyan.zhang@unisoc.com>
[ Upstream commit cd119fdc3ee1450fbf7f78862b5de44c42b6e47f ]
Release DMA buffer when _probe() returns failure to avoid memory leak.
Fixes: f4487db58eb7 ("serial: sprd: Add DMA mode support")
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/20230725064053.235448-2-chunyan.zhang@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/sprd_serial.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/sprd_serial.c b/drivers/tty/serial/sprd_serial.c
index 144c03ca3366a..a1952e4f1fcbb 100644
--- a/drivers/tty/serial/sprd_serial.c
+++ b/drivers/tty/serial/sprd_serial.c
@@ -367,7 +367,7 @@ static void sprd_rx_free_buf(struct sprd_uart_port *sp)
if (sp->rx_dma.virt)
dma_free_coherent(sp->port.dev, SPRD_UART_RX_SIZE,
sp->rx_dma.virt, sp->rx_dma.phys_addr);
-
+ sp->rx_dma.virt = NULL;
}
static int sprd_rx_dma_config(struct uart_port *port, u32 burst)
@@ -1230,7 +1230,7 @@ static int sprd_probe(struct platform_device *pdev)
ret = uart_register_driver(&sprd_uart_driver);
if (ret < 0) {
pr_err("Failed to register SPRD-UART driver\n");
- return ret;
+ goto free_rx_buf;
}
}
@@ -1249,6 +1249,7 @@ static int sprd_probe(struct platform_device *pdev)
sprd_port[index] = NULL;
if (--sprd_ports_num == 0)
uart_unregister_driver(&sprd_uart_driver);
+free_rx_buf:
sprd_rx_free_buf(sport);
return ret;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 225/406] x86/APM: drop the duplicate APM_MINOR_DEV macro
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 224/406] serial: sprd: Fix DMA buffer leak issue Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 226/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly Greg Kroah-Hartman
` (189 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Jiri Kosina, x86,
Sohil Mehta, Corentin Labbe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 4ba2909638a29630a346d6c4907a3105409bee7d ]
This source file already includes <linux/miscdevice.h>, which contains
the same macro. It doesn't need to be defined here again.
Fixes: 874bcd00f520 ("apm-emulation: move APM_MINOR_DEV to include/linux/miscdevice.h")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Jiri Kosina <jikos@kernel.org>
Cc: x86@kernel.org
Cc: Sohil Mehta <sohil.mehta@intel.com>
Cc: Corentin Labbe <clabbe.montjoie@gmail.com>
Reviewed-by: Sohil Mehta <sohil.mehta@intel.com>
Link: https://lore.kernel.org/r/20230728011120.759-1-rdunlap@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/apm_32.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 660270359d393..166d9991e7111 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -237,12 +237,6 @@
extern int (*console_blank_hook)(int);
#endif
-/*
- * The apm_bios device is one of the misc char devices.
- * This is its minor number.
- */
-#define APM_MINOR_DEV 134
-
/*
* Various options can be changed at boot time as follows:
* (We allow underscores for compatibility with the modules code)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 226/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 225/406] x86/APM: drop the duplicate APM_MINOR_DEV macro Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 227/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly Greg Kroah-Hartman
` (188 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saurav Kashyap, Rob Evers,
Johannes Thumshirn, David Laight, Jozef Bacik, Laurence Oberman,
James E.J. Bottomley, Martin K. Petersen,
GR-QLogic-Storage-Upstream, linux-scsi, Johannes Thumshirn,
Oleksandr Natalenko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Natalenko <oleksandr@redhat.com>
[ Upstream commit 7d3d20dee4f648ec44e9717d5f647d594d184433 ]
The qedf_dbg_stop_io_on_error_cmd_read() function invokes sprintf()
directly on a __user pointer, which may crash the kernel.
Avoid doing that by using a small on-stack buffer for scnprintf() and then
calling simple_read_from_buffer() which does a proper copy_to_user() call.
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/
Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/
Cc: Saurav Kashyap <skashyap@marvell.com>
Cc: Rob Evers <revers@redhat.com>
Cc: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Jozef Bacik <jobacik@redhat.com>
Cc: Laurence Oberman <loberman@redhat.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: linux-scsi@vger.kernel.org
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Acked-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com>
Link: https://lore.kernel.org/r/20230731084034.37021-2-oleksandr@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qedf/qedf_debugfs.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
index a3ed681c8ce3f..3eb4334ac6a32 100644
--- a/drivers/scsi/qedf/qedf_debugfs.c
+++ b/drivers/scsi/qedf/qedf_debugfs.c
@@ -185,18 +185,17 @@ qedf_dbg_stop_io_on_error_cmd_read(struct file *filp, char __user *buffer,
size_t count, loff_t *ppos)
{
int cnt;
+ char cbuf[7];
struct qedf_dbg_ctx *qedf_dbg =
(struct qedf_dbg_ctx *)filp->private_data;
struct qedf_ctx *qedf = container_of(qedf_dbg,
struct qedf_ctx, dbg_ctx);
QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
- cnt = sprintf(buffer, "%s\n",
+ cnt = scnprintf(cbuf, sizeof(cbuf), "%s\n",
qedf->stop_io_on_error ? "true" : "false");
- cnt = min_t(int, count, cnt - *ppos);
- *ppos += cnt;
- return cnt;
+ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
}
static ssize_t
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 227/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 226/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 228/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly Greg Kroah-Hartman
` (187 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saurav Kashyap, Rob Evers,
Johannes Thumshirn, David Laight, Jozef Bacik, Laurence Oberman,
James E.J. Bottomley, Martin K. Petersen,
GR-QLogic-Storage-Upstream, linux-scsi, Johannes Thumshirn,
Oleksandr Natalenko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Natalenko <oleksandr@redhat.com>
[ Upstream commit 31b5991a9a91ba97237ac9da509d78eec453ff72 ]
The qedf_dbg_debug_cmd_read() function invokes sprintf() directly on a
__user pointer, which may crash the kernel.
Avoid doing that by using a small on-stack buffer for scnprintf() and then
calling simple_read_from_buffer() which does a proper copy_to_user() call.
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/
Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/
Cc: Saurav Kashyap <skashyap@marvell.com>
Cc: Rob Evers <revers@redhat.com>
Cc: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Jozef Bacik <jobacik@redhat.com>
Cc: Laurence Oberman <loberman@redhat.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: linux-scsi@vger.kernel.org
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Acked-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com>
Link: https://lore.kernel.org/r/20230731084034.37021-3-oleksandr@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qedf/qedf_debugfs.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
index 3eb4334ac6a32..1c5716540e465 100644
--- a/drivers/scsi/qedf/qedf_debugfs.c
+++ b/drivers/scsi/qedf/qedf_debugfs.c
@@ -138,15 +138,14 @@ qedf_dbg_debug_cmd_read(struct file *filp, char __user *buffer, size_t count,
loff_t *ppos)
{
int cnt;
+ char cbuf[32];
struct qedf_dbg_ctx *qedf_dbg =
(struct qedf_dbg_ctx *)filp->private_data;
QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "debug mask=0x%x\n", qedf_debug);
- cnt = sprintf(buffer, "debug mask = 0x%x\n", qedf_debug);
+ cnt = scnprintf(cbuf, sizeof(cbuf), "debug mask = 0x%x\n", qedf_debug);
- cnt = min_t(int, count, cnt - *ppos);
- *ppos += cnt;
- return cnt;
+ return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
}
static ssize_t
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 228/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 227/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 229/406] coresight: tmc: Explicit type conversions to prevent integer overflow Greg Kroah-Hartman
` (186 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saurav Kashyap, Rob Evers,
Johannes Thumshirn, David Laight, Jozef Bacik, Laurence Oberman,
James E.J. Bottomley, Martin K. Petersen,
GR-QLogic-Storage-Upstream, linux-scsi, Johannes Thumshirn,
Oleksandr Natalenko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Natalenko <oleksandr@redhat.com>
[ Upstream commit 25dbc20deab5165f847b4eb42f376f725a986ee8 ]
The qedf_dbg_fp_int_cmd_read() function invokes sprintf() directly on a
__user pointer, which may crash the kernel.
Avoid doing that by vmalloc()'ating a buffer for scnprintf() and then
calling simple_read_from_buffer() which does a proper copy_to_user() call.
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Link: https://lore.kernel.org/lkml/20230724120241.40495-1-oleksandr@redhat.com/
Link: https://lore.kernel.org/linux-scsi/20230726101236.11922-1-skashyap@marvell.com/
Cc: Saurav Kashyap <skashyap@marvell.com>
Cc: Rob Evers <revers@redhat.com>
Cc: Johannes Thumshirn <Johannes.Thumshirn@wdc.com>
Cc: David Laight <David.Laight@ACULAB.COM>
Cc: Jozef Bacik <jobacik@redhat.com>
Cc: Laurence Oberman <loberman@redhat.com>
Cc: "James E.J. Bottomley" <jejb@linux.ibm.com>
Cc: "Martin K. Petersen" <martin.petersen@oracle.com>
Cc: GR-QLogic-Storage-Upstream@marvell.com
Cc: linux-scsi@vger.kernel.org
Reviewed-by: Laurence Oberman <loberman@redhat.com>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Laurence Oberman <loberman@redhat.com>
Acked-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Oleksandr Natalenko <oleksandr@redhat.com>
Link: https://lore.kernel.org/r/20230731084034.37021-4-oleksandr@redhat.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qedf/qedf_dbg.h | 2 ++
drivers/scsi/qedf/qedf_debugfs.c | 21 +++++++++++++++------
2 files changed, 17 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/qedf/qedf_dbg.h b/drivers/scsi/qedf/qedf_dbg.h
index 2386bfb73c461..4a536c8377081 100644
--- a/drivers/scsi/qedf/qedf_dbg.h
+++ b/drivers/scsi/qedf/qedf_dbg.h
@@ -60,6 +60,8 @@ extern uint qedf_debug;
#define QEDF_LOG_NOTICE 0x40000000 /* Notice logs */
#define QEDF_LOG_WARN 0x80000000 /* Warning logs */
+#define QEDF_DEBUGFS_LOG_LEN (2 * PAGE_SIZE)
+
/* Debug context structure */
struct qedf_dbg_ctx {
unsigned int host_no;
diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
index 1c5716540e465..451fd236bfd05 100644
--- a/drivers/scsi/qedf/qedf_debugfs.c
+++ b/drivers/scsi/qedf/qedf_debugfs.c
@@ -8,6 +8,7 @@
#include <linux/uaccess.h>
#include <linux/debugfs.h>
#include <linux/module.h>
+#include <linux/vmalloc.h>
#include "qedf.h"
#include "qedf_dbg.h"
@@ -98,7 +99,9 @@ static ssize_t
qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
loff_t *ppos)
{
+ ssize_t ret;
size_t cnt = 0;
+ char *cbuf;
int id;
struct qedf_fastpath *fp = NULL;
struct qedf_dbg_ctx *qedf_dbg =
@@ -108,19 +111,25 @@ qedf_dbg_fp_int_cmd_read(struct file *filp, char __user *buffer, size_t count,
QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "entered\n");
- cnt = sprintf(buffer, "\nFastpath I/O completions\n\n");
+ cbuf = vmalloc(QEDF_DEBUGFS_LOG_LEN);
+ if (!cbuf)
+ return 0;
+
+ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt, "\nFastpath I/O completions\n\n");
for (id = 0; id < qedf->num_queues; id++) {
fp = &(qedf->fp_array[id]);
if (fp->sb_id == QEDF_SB_ID_NULL)
continue;
- cnt += sprintf((buffer + cnt), "#%d: %lu\n", id,
- fp->completions);
+ cnt += scnprintf(cbuf + cnt, QEDF_DEBUGFS_LOG_LEN - cnt,
+ "#%d: %lu\n", id, fp->completions);
}
- cnt = min_t(int, count, cnt - *ppos);
- *ppos += cnt;
- return cnt;
+ ret = simple_read_from_buffer(buffer, count, ppos, cbuf, cnt);
+
+ vfree(cbuf);
+
+ return ret;
}
static ssize_t
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 229/406] coresight: tmc: Explicit type conversions to prevent integer overflow
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 228/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 230/406] dma-buf/sync_file: Fix docs syntax Greg Kroah-Hartman
` (185 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruidong Tian, James Clark,
Suzuki K Poulose, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ruidong Tian <tianruidong@linux.alibaba.com>
[ Upstream commit fd380097cdb305582b7a1f9476391330299d2c59 ]
Perf cs_etm session executed unexpectedly when AUX buffer > 1G.
perf record -C 0 -m ,2G -e cs_etm// -- <workload>
[ perf record: Captured and wrote 2.615 MB perf.data ]
Perf only collect about 2M perf data rather than 2G. This is becasuse
the operation, "nr_pages << PAGE_SHIFT", in coresight tmc driver, will
overflow when nr_pages >= 0x80000(correspond to 1G AUX buffer). The
overflow cause buffer allocation to fail, and TMC driver will alloc
minimal buffer size(1M). You can just get about 2M perf data(1M AUX
buffer + perf data header) at least.
Explicit convert nr_pages to 64 bit to avoid overflow.
Fixes: 22f429f19c41 ("coresight: etm-perf: Add support for ETR backend")
Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework")
Fixes: 2e499bbc1a92 ("coresight: tmc: implementing TMC-ETF AUX space API")
Signed-off-by: Ruidong Tian <tianruidong@linux.alibaba.com>
Reviewed-by: James Clark <james.clark@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20230804081514.120171-2-tianruidong@linux.alibaba.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +-
drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +++--
drivers/hwtracing/coresight/coresight-tmc.h | 2 +-
3 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c
index 8978f3410bee5..eee069e95b9f6 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -426,7 +426,7 @@ static int tmc_set_etf_buffer(struct coresight_device *csdev,
return -EINVAL;
/* wrap head around to the amount of space we have */
- head = handle->head & ((buf->nr_pages << PAGE_SHIFT) - 1);
+ head = handle->head & (((unsigned long)buf->nr_pages << PAGE_SHIFT) - 1);
/* find the page to write to */
buf->cur = head / PAGE_SIZE;
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index 3e74f5aed20d7..ae2dd0c88f4eb 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -47,7 +47,8 @@ struct etr_perf_buffer {
};
/* Convert the perf index to an offset within the ETR buffer */
-#define PERF_IDX2OFF(idx, buf) ((idx) % ((buf)->nr_pages << PAGE_SHIFT))
+#define PERF_IDX2OFF(idx, buf) \
+ ((idx) % ((unsigned long)(buf)->nr_pages << PAGE_SHIFT))
/* Lower limit for ETR hardware buffer */
#define TMC_ETR_PERF_MIN_BUF_SIZE SZ_1M
@@ -1232,7 +1233,7 @@ alloc_etr_buf(struct tmc_drvdata *drvdata, struct perf_event *event,
* than the size requested via sysfs.
*/
if ((nr_pages << PAGE_SHIFT) > drvdata->size) {
- etr_buf = tmc_alloc_etr_buf(drvdata, (nr_pages << PAGE_SHIFT),
+ etr_buf = tmc_alloc_etr_buf(drvdata, ((ssize_t)nr_pages << PAGE_SHIFT),
0, node, NULL);
if (!IS_ERR(etr_buf))
goto done;
diff --git a/drivers/hwtracing/coresight/coresight-tmc.h b/drivers/hwtracing/coresight/coresight-tmc.h
index b91ec7dde7bc9..3655b3bfb2e32 100644
--- a/drivers/hwtracing/coresight/coresight-tmc.h
+++ b/drivers/hwtracing/coresight/coresight-tmc.h
@@ -321,7 +321,7 @@ ssize_t tmc_sg_table_get_data(struct tmc_sg_table *sg_table,
static inline unsigned long
tmc_sg_table_buf_size(struct tmc_sg_table *sg_table)
{
- return sg_table->data_pages.nr_pages << PAGE_SHIFT;
+ return (unsigned long)sg_table->data_pages.nr_pages << PAGE_SHIFT;
}
struct coresight_device *tmc_etr_get_catu_device(struct tmc_drvdata *drvdata);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 230/406] dma-buf/sync_file: Fix docs syntax
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 229/406] coresight: tmc: Explicit type conversions to prevent integer overflow Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 231/406] driver core: test_async: fix an error code Greg Kroah-Hartman
` (184 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rob Clark, Randy Dunlap, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <robdclark@chromium.org>
[ Upstream commit 05d56d8079d510a2994039470f65bea85f0075ee ]
Fixes the warning:
include/uapi/linux/sync_file.h:77: warning: Function parameter or member 'num_fences' not described in 'sync_file_info'
Fixes: 2d75c88fefb2 ("staging/android: refactor SYNC IOCTLs")
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20230724145000.125880-1-robdclark@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/sync_file.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/uapi/linux/sync_file.h b/include/uapi/linux/sync_file.h
index ee2dcfb3d6602..d7f7c04a6e0c1 100644
--- a/include/uapi/linux/sync_file.h
+++ b/include/uapi/linux/sync_file.h
@@ -52,7 +52,7 @@ struct sync_fence_info {
* @name: name of fence
* @status: status of fence. 1: signaled 0:active <0:error
* @flags: sync_file_info flags
- * @num_fences number of fences in the sync_file
+ * @num_fences: number of fences in the sync_file
* @pad: padding for 64-bit alignment, should always be zero
* @sync_fence_info: pointer to array of structs sync_fence_info with all
* fences in the sync_file
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 231/406] driver core: test_async: fix an error code
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 230/406] dma-buf/sync_file: Fix docs syntax Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 232/406] IB/uverbs: Fix an potential error pointer dereference Greg Kroah-Hartman
` (183 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 22d2381bbd70a5853c2ee77522f4965139672db9 ]
The test_platform_device_register_node() function should return error
pointers instead of NULL. That is what the callers are expecting.
Fixes: 57ea974fb871 ("driver core: Rewrite test_async_driver_probe to cover serialization and NUMA affinity")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/1e11ed19-e1f6-43d8-b352-474134b7c008@moroto.mountain
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/test/test_async_driver_probe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/base/test/test_async_driver_probe.c b/drivers/base/test/test_async_driver_probe.c
index c157a912d6739..88336f093decd 100644
--- a/drivers/base/test/test_async_driver_probe.c
+++ b/drivers/base/test/test_async_driver_probe.c
@@ -84,7 +84,7 @@ test_platform_device_register_node(char *name, int id, int nid)
pdev = platform_device_alloc(name, id);
if (!pdev)
- return NULL;
+ return ERR_PTR(-ENOMEM);
if (nid != NUMA_NO_NODE)
set_dev_node(&pdev->dev, nid);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 232/406] IB/uverbs: Fix an potential error pointer dereference
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 231/406] driver core: test_async: fix an error code Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 233/406] fsi: aspeed: Reset master errors after CFAM reset Greg Kroah-Hartman
` (182 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiang Yang, Leon Romanovsky,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Yang <xiangyang3@huawei.com>
[ Upstream commit 26b7d1a27167e7adf75b150755e05d2bc123ce55 ]
smatch reports the warning below:
drivers/infiniband/core/uverbs_std_types_counters.c:110
ib_uverbs_handler_UVERBS_METHOD_COUNTERS_READ() error: 'uattr'
dereferencing possible ERR_PTR()
The return value of uattr maybe ERR_PTR(-ENOENT), fix this by checking
the value of uattr before using it.
Fixes: ebb6796bd397 ("IB/uverbs: Add read counters support")
Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
Link: https://lore.kernel.org/r/20230804022525.1916766-1-xiangyang3@huawei.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/core/uverbs_std_types_counters.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/core/uverbs_std_types_counters.c b/drivers/infiniband/core/uverbs_std_types_counters.c
index b3c6c066b6010..c61b10fbf90a9 100644
--- a/drivers/infiniband/core/uverbs_std_types_counters.c
+++ b/drivers/infiniband/core/uverbs_std_types_counters.c
@@ -108,6 +108,8 @@ static int UVERBS_HANDLER(UVERBS_METHOD_COUNTERS_READ)(
return ret;
uattr = uverbs_attr_get(attrs, UVERBS_ATTR_READ_COUNTERS_BUFF);
+ if (IS_ERR(uattr))
+ return PTR_ERR(uattr);
read_attr.ncounters = uattr->ptr_attr.len / sizeof(u64);
read_attr.counters_buff = uverbs_zalloc(
attrs, array_size(read_attr.ncounters, sizeof(u64)));
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 233/406] fsi: aspeed: Reset master errors after CFAM reset
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 232/406] IB/uverbs: Fix an potential error pointer dereference Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 234/406] iommu/qcom: Disable and reset context bank before programming Greg Kroah-Hartman
` (181 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eddie James, Joel Stanley,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eddie James <eajames@linux.ibm.com>
[ Upstream commit 52300909f4670ac552bfeb33c1355b896eac8c06 ]
It has been observed that sometimes the FSI master will return all 0xffs
after a CFAM has been taken out of reset, without presenting any error.
Resetting the FSI master errors resolves the issue.
Fixes: 4a851d714ead ("fsi: aspeed: Support CFAM reset GPIO")
Signed-off-by: Eddie James <eajames@linux.ibm.com>
Link: https://lore.kernel.org/r/20230612195657.245125-8-eajames@linux.ibm.com
Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/fsi/fsi-master-aspeed.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/fsi/fsi-master-aspeed.c b/drivers/fsi/fsi-master-aspeed.c
index 87edc77260d20..db0519da0f892 100644
--- a/drivers/fsi/fsi-master-aspeed.c
+++ b/drivers/fsi/fsi-master-aspeed.c
@@ -445,6 +445,8 @@ static ssize_t cfam_reset_store(struct device *dev, struct device_attribute *att
gpiod_set_value(aspeed->cfam_reset_gpio, 1);
usleep_range(900, 1000);
gpiod_set_value(aspeed->cfam_reset_gpio, 0);
+ usleep_range(900, 1000);
+ opb_writel(aspeed, ctrl_base + FSI_MRESP0, cpu_to_be32(FSI_MRESP_RST_ALL_MASTER));
mutex_unlock(&aspeed->lock);
return count;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 234/406] iommu/qcom: Disable and reset context bank before programming
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 233/406] fsi: aspeed: Reset master errors after CFAM reset Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 235/406] iommu/vt-d: Fix to flush cache of PASID directory table Greg Kroah-Hartman
` (180 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Konrad Dybcio, Will Deacon, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
[ Upstream commit 9f3fef23d9b5a858a6e6d5f478bb1b6b76265e76 ]
Writing the new TTBRs, TCRs and MAIRs on a previously enabled
context bank may trigger a context fault, resulting in firmware
driven AP resets: change the domain initialization programming
sequence to disable the context bank(s) and to also clear the
related fault address (CB_FAR) and fault status (CB_FSR)
registers before writing new values to TTBR0/1, TCR/TCR2, MAIR0/1.
Fixes: 0ae349a0f33f ("iommu/qcom: Add qcom_iommu")
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230622092742.74819-4-angelogioacchino.delregno@collabora.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/iommu/arm/arm-smmu/qcom_iommu.c b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
index a24390c548a91..37c8f75a35801 100644
--- a/drivers/iommu/arm/arm-smmu/qcom_iommu.c
+++ b/drivers/iommu/arm/arm-smmu/qcom_iommu.c
@@ -283,6 +283,13 @@ static int qcom_iommu_init_domain(struct iommu_domain *domain,
ctx->secure_init = true;
}
+ /* Disable context bank before programming */
+ iommu_writel(ctx, ARM_SMMU_CB_SCTLR, 0);
+
+ /* Clear context bank fault address fault status registers */
+ iommu_writel(ctx, ARM_SMMU_CB_FAR, 0);
+ iommu_writel(ctx, ARM_SMMU_CB_FSR, ARM_SMMU_FSR_FAULT);
+
/* TTBRs */
iommu_writeq(ctx, ARM_SMMU_CB_TTBR0,
pgtbl_cfg.arm_lpae_s1_cfg.ttbr |
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 235/406] iommu/vt-d: Fix to flush cache of PASID directory table
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 234/406] iommu/qcom: Disable and reset context bank before programming Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 236/406] media: go7007: Remove redundant if statement Greg Kroah-Hartman
` (179 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lu Baolu, Yanfei Xu, Joerg Roedel,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yanfei Xu <yanfei.xu@intel.com>
[ Upstream commit 8a3b8e63f8371c1247b7aa24ff9c5312f1a6948b ]
Even the PCI devices don't support pasid capability, PASID table is
mandatory for a PCI device in scalable mode. However flushing cache
of pasid directory table for these devices are not taken after pasid
table is allocated as the "size" of table is zero. Fix it by
calculating the size by page order.
Found this when reading the code, no real problem encountered for now.
Fixes: 194b3348bdbb ("iommu/vt-d: Fix PASID directory pointer coherency")
Suggested-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Yanfei Xu <yanfei.xu@intel.com>
Link: https://lore.kernel.org/r/20230616081045.721873-1-yanfei.xu@intel.com
Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/intel/pasid.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/intel/pasid.c b/drivers/iommu/intel/pasid.c
index 80d6412e2c546..9b24e8224379e 100644
--- a/drivers/iommu/intel/pasid.c
+++ b/drivers/iommu/intel/pasid.c
@@ -187,7 +187,7 @@ int intel_pasid_alloc_table(struct device *dev)
device_attach_pasid_table(info, pasid_table);
if (!ecap_coherent(info->iommu->ecap))
- clflush_cache_range(pasid_table->table, size);
+ clflush_cache_range(pasid_table->table, (1 << order) * PAGE_SIZE);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 236/406] media: go7007: Remove redundant if statement
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 235/406] iommu/vt-d: Fix to flush cache of PASID directory table Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 237/406] USB: gadget: f_mass_storage: Fix unused variable warning Greg Kroah-Hartman
` (178 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King,
Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit f33cb49081da0ec5af0888f8ecbd566bd326eed1 ]
The if statement that compares msgs[i].len != 3 is always false because
it is in a code block where msg[i].len is equal to 3. The check is
redundant and can be removed.
As detected by cppcheck static analysis:
drivers/media/usb/go7007/go7007-i2c.c:168:20: warning: Opposite inner
'if' condition leads to a dead code block. [oppositeInnerCondition]
Link: https://lore.kernel.org/linux-media/20230727174007.635572-1-colin.i.king@gmail.com
Fixes: 866b8695d67e ("Staging: add the go7007 video driver")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/go7007/go7007-i2c.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/usb/go7007/go7007-i2c.c b/drivers/media/usb/go7007/go7007-i2c.c
index 38339dd2f83f7..2880370e45c8b 100644
--- a/drivers/media/usb/go7007/go7007-i2c.c
+++ b/drivers/media/usb/go7007/go7007-i2c.c
@@ -165,8 +165,6 @@ static int go7007_i2c_master_xfer(struct i2c_adapter *adapter,
} else if (msgs[i].len == 3) {
if (msgs[i].flags & I2C_M_RD)
return -EIO;
- if (msgs[i].len != 3)
- return -EIO;
if (go7007_i2c_xfer(go, msgs[i].addr, 0,
(msgs[i].buf[0] << 8) | msgs[i].buf[1],
0x01, &msgs[i].buf[2]) < 0)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 237/406] USB: gadget: f_mass_storage: Fix unused variable warning
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 236/406] media: go7007: Remove redundant if statement Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 238/406] media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() Greg Kroah-Hartman
` (177 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
[ Upstream commit 55c3e571d2a0aabef4f1354604443f1c415d2e85 ]
Fix a "variable set but not used" warning in f_mass_storage.c. rc is
used if verbose debugging is enabled but not otherwise.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: d5e2b67aae79 ("USB: g_mass_storage: template f_mass_storage.c file created")
Link: https://lore.kernel.org/r/cfed16c7-aa46-494b-ba84-b0e0dc99be3a@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_mass_storage.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c
index 950c9435beec3..553547f12fd20 100644
--- a/drivers/usb/gadget/function/f_mass_storage.c
+++ b/drivers/usb/gadget/function/f_mass_storage.c
@@ -951,7 +951,7 @@ static void invalidate_sub(struct fsg_lun *curlun)
{
struct file *filp = curlun->filp;
struct inode *inode = file_inode(filp);
- unsigned long rc;
+ unsigned long __maybe_unused rc;
rc = invalidate_mapping_pages(inode->i_mapping, 0, -1);
VLDBG(curlun, "invalidate_mapping_pages -> %ld\n", rc);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 238/406] media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 237/406] USB: gadget: f_mass_storage: Fix unused variable warning Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 239/406] media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips Greg Kroah-Hartman
` (176 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacopo Mondi, Marek Vasut,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin, Jai Luthra
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
[ Upstream commit 98cb72d3b9c5e03b10fa993752ecfcbd9c572d8c ]
Set OV5640_REG_IO_MIPI_CTRL00 bit 2 to 1 instead of 0, since 1 means
MIPI CSI2 interface, while 0 means CPI parallel interface.
In the ov5640_set_power_mipi() the interface should obviously be set
to MIPI CSI2 since this functions is used to power up the sensor when
operated in MIPI CSI2 mode. The sensor should not be in CPI mode in
that case.
This fixes a corner case where capturing the first frame on i.MX8MN
with CSI/ISI resulted in corrupted frame.
Fixes: aa4bb8b8838f ("media: ov5640: Re-work MIPI startup sequence")
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Tested-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com> # [Test on imx6q]
Signed-off-by: Marek Vasut <marex@denx.de>
Tested-by: Jai Luthra <j-luthra@ti.com> # [Test on bplay, sk-am62]
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov5640.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/ov5640.c b/drivers/media/i2c/ov5640.c
index 92a5f9aff9b53..db4b6095f4f4c 100644
--- a/drivers/media/i2c/ov5640.c
+++ b/drivers/media/i2c/ov5640.c
@@ -1942,9 +1942,9 @@ static int ov5640_set_power_mipi(struct ov5640_dev *sensor, bool on)
* "ov5640_set_stream_mipi()")
* [4] = 0 : Power up MIPI HS Tx
* [3] = 0 : Power up MIPI LS Rx
- * [2] = 0 : MIPI interface disabled
+ * [2] = 1 : MIPI interface enabled
*/
- ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x40);
+ ret = ov5640_write_reg(sensor, OV5640_REG_IO_MIPI_CTRL00, 0x44);
if (ret)
return ret;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 239/406] media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 238/406] media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 240/406] media: ov2680: Remove auto-gain and auto-exposure controls Greg Kroah-Hartman
` (175 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Stevenson, Rui Miguel Silva,
Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Stevenson <dave.stevenson@raspberrypi.com>
[ Upstream commit 66274280b2c745d380508dc27b9a4dfd736e5eda ]
The driver changes the Bayer order based on the flips, but
does not define the control correctly with the
V4L2_CTRL_FLAG_MODIFY_LAYOUT flag.
Add the V4L2_CTRL_FLAG_MODIFY_LAYOUT flag.
Signed-off-by: Dave Stevenson <dave.stevenson@raspberrypi.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Stable-dep-of: 7b5a42e6ae71 ("media: ov2680: Remove auto-gain and auto-exposure controls")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2680.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
index 59cdbc33658ce..cd0c083a4768a 100644
--- a/drivers/media/i2c/ov2680.c
+++ b/drivers/media/i2c/ov2680.c
@@ -966,6 +966,8 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor)
ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
+ ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
+ ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 240/406] media: ov2680: Remove auto-gain and auto-exposure controls
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 239/406] media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 241/406] media: ov2680: Fix ov2680_bayer_order() Greg Kroah-Hartman
` (174 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Scally, Rui Miguel Silva,
Hans de Goede, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 7b5a42e6ae71927359ea67a2c22570ba97fa4059 ]
Quoting the OV2680 datasheet:
"3.2 exposure and gain control
In the OV2680, the exposure time and gain are set manually from an external
controller. The OV2680 supports manual gain and exposure control only for
normal applications, no auto mode."
And indeed testing with the atomisp_ov2680 fork of ov2680.c has shown that
auto-exposure and auto-gain do not work.
Note that the code setting the auto-exposure flag was broken, callers
of ov2680_exposure_set() were directly passing !!ctrls->auto_exp->val as
"bool auto_exp" value, but ctrls->auto_exp is a menu control with:
enum v4l2_exposure_auto_type {
V4L2_EXPOSURE_AUTO = 0,
V4L2_EXPOSURE_MANUAL = 1,
...
So instead of passing !!ctrls->auto_exp->val they should have been passing
ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO, iow the passed value was
inverted of what it should have been.
Also remove ov2680_g_volatile_ctrl() since without auto support the gain
and exposure controls are not volatile.
This also fixes the control values not being properly applied in
ov2680_mode_set(). The 800x600 mode register-list also sets gain,
exposure and vflip overriding the last set ctrl values.
ov2680_mode_set() does call ov2680_gain_set() and ov2680_exposure_set()
but did this before writing the mode register-list, so these values
would still be overridden by the mode register-list.
Add a v4l2_ctrl_handler_setup() call after writing the mode register-list
to restore all ctrl values. Also remove the ctrls->gain->is_new check from
ov2680_gain_set() so that the gain always gets restored properly.
Last since ov2680_mode_set() now calls v4l2_ctrl_handler_setup(), remove
the v4l2_ctrl_handler_setup() call after ov2680_mode_restore() since
ov2680_mode_restore() calls ov2680_mode_set().
Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2680.c | 161 ++++---------------------------------
1 file changed, 17 insertions(+), 144 deletions(-)
diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
index cd0c083a4768a..f143e2af0b5fc 100644
--- a/drivers/media/i2c/ov2680.c
+++ b/drivers/media/i2c/ov2680.c
@@ -85,15 +85,8 @@ struct ov2680_mode_info {
struct ov2680_ctrls {
struct v4l2_ctrl_handler handler;
- struct {
- struct v4l2_ctrl *auto_exp;
- struct v4l2_ctrl *exposure;
- };
- struct {
- struct v4l2_ctrl *auto_gain;
- struct v4l2_ctrl *gain;
- };
-
+ struct v4l2_ctrl *exposure;
+ struct v4l2_ctrl *gain;
struct v4l2_ctrl *hflip;
struct v4l2_ctrl *vflip;
struct v4l2_ctrl *test_pattern;
@@ -143,6 +136,7 @@ static const struct reg_value ov2680_setting_30fps_QUXGA_800_600[] = {
{0x380e, 0x02}, {0x380f, 0x84}, {0x3811, 0x04}, {0x3813, 0x04},
{0x3814, 0x31}, {0x3815, 0x31}, {0x3820, 0xc0}, {0x4008, 0x00},
{0x4009, 0x03}, {0x4837, 0x1e}, {0x3501, 0x4e}, {0x3502, 0xe0},
+ {0x3503, 0x03},
};
static const struct reg_value ov2680_setting_30fps_720P_1280_720[] = {
@@ -405,69 +399,15 @@ static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value)
return 0;
}
-static int ov2680_gain_set(struct ov2680_dev *sensor, bool auto_gain)
-{
- struct ov2680_ctrls *ctrls = &sensor->ctrls;
- u32 gain;
- int ret;
-
- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(1),
- auto_gain ? 0 : BIT(1));
- if (ret < 0)
- return ret;
-
- if (auto_gain || !ctrls->gain->is_new)
- return 0;
-
- gain = ctrls->gain->val;
-
- ret = ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain);
-
- return 0;
-}
-
-static int ov2680_gain_get(struct ov2680_dev *sensor)
-{
- u32 gain;
- int ret;
-
- ret = ov2680_read_reg16(sensor, OV2680_REG_GAIN_PK, &gain);
- if (ret)
- return ret;
-
- return gain;
-}
-
-static int ov2680_exposure_set(struct ov2680_dev *sensor, bool auto_exp)
+static int ov2680_gain_set(struct ov2680_dev *sensor, u32 gain)
{
- struct ov2680_ctrls *ctrls = &sensor->ctrls;
- u32 exp;
- int ret;
-
- ret = ov2680_mod_reg(sensor, OV2680_REG_R_MANUAL, BIT(0),
- auto_exp ? 0 : BIT(0));
- if (ret < 0)
- return ret;
-
- if (auto_exp || !ctrls->exposure->is_new)
- return 0;
-
- exp = (u32)ctrls->exposure->val;
- exp <<= 4;
-
- return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, exp);
+ return ov2680_write_reg16(sensor, OV2680_REG_GAIN_PK, gain);
}
-static int ov2680_exposure_get(struct ov2680_dev *sensor)
+static int ov2680_exposure_set(struct ov2680_dev *sensor, u32 exp)
{
- int ret;
- u32 exp;
-
- ret = ov2680_read_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH, &exp);
- if (ret)
- return ret;
-
- return exp >> 4;
+ return ov2680_write_reg24(sensor, OV2680_REG_EXPOSURE_PK_HIGH,
+ exp << 4);
}
static int ov2680_stream_enable(struct ov2680_dev *sensor)
@@ -482,33 +422,17 @@ static int ov2680_stream_disable(struct ov2680_dev *sensor)
static int ov2680_mode_set(struct ov2680_dev *sensor)
{
- struct ov2680_ctrls *ctrls = &sensor->ctrls;
int ret;
- ret = ov2680_gain_set(sensor, false);
- if (ret < 0)
- return ret;
-
- ret = ov2680_exposure_set(sensor, false);
+ ret = ov2680_load_regs(sensor, sensor->current_mode);
if (ret < 0)
return ret;
- ret = ov2680_load_regs(sensor, sensor->current_mode);
+ /* Restore value of all ctrls */
+ ret = __v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
if (ret < 0)
return ret;
- if (ctrls->auto_gain->val) {
- ret = ov2680_gain_set(sensor, true);
- if (ret < 0)
- return ret;
- }
-
- if (ctrls->auto_exp->val == V4L2_EXPOSURE_AUTO) {
- ret = ov2680_exposure_set(sensor, true);
- if (ret < 0)
- return ret;
- }
-
sensor->mode_pending_changes = false;
return 0;
@@ -590,15 +514,10 @@ static int ov2680_s_power(struct v4l2_subdev *sd, int on)
else
ret = ov2680_power_off(sensor);
- mutex_unlock(&sensor->lock);
-
- if (on && ret == 0) {
- ret = v4l2_ctrl_handler_setup(&sensor->ctrls.handler);
- if (ret < 0)
- return ret;
-
+ if (on && ret == 0)
ret = ov2680_mode_restore(sensor);
- }
+
+ mutex_unlock(&sensor->lock);
return ret;
}
@@ -793,52 +712,19 @@ static int ov2680_enum_frame_interval(struct v4l2_subdev *sd,
return 0;
}
-static int ov2680_g_volatile_ctrl(struct v4l2_ctrl *ctrl)
-{
- struct v4l2_subdev *sd = ctrl_to_sd(ctrl);
- struct ov2680_dev *sensor = to_ov2680_dev(sd);
- struct ov2680_ctrls *ctrls = &sensor->ctrls;
- int val;
-
- if (!sensor->is_enabled)
- return 0;
-
- switch (ctrl->id) {
- case V4L2_CID_GAIN:
- val = ov2680_gain_get(sensor);
- if (val < 0)
- return val;
- ctrls->gain->val = val;
- break;
- case V4L2_CID_EXPOSURE:
- val = ov2680_exposure_get(sensor);
- if (val < 0)
- return val;
- ctrls->exposure->val = val;
- break;
- }
-
- return 0;
-}
-
static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
{
struct v4l2_subdev *sd = ctrl_to_sd(ctrl);
struct ov2680_dev *sensor = to_ov2680_dev(sd);
- struct ov2680_ctrls *ctrls = &sensor->ctrls;
if (!sensor->is_enabled)
return 0;
switch (ctrl->id) {
- case V4L2_CID_AUTOGAIN:
- return ov2680_gain_set(sensor, !!ctrl->val);
case V4L2_CID_GAIN:
- return ov2680_gain_set(sensor, !!ctrls->auto_gain->val);
- case V4L2_CID_EXPOSURE_AUTO:
- return ov2680_exposure_set(sensor, !!ctrl->val);
+ return ov2680_gain_set(sensor, ctrl->val);
case V4L2_CID_EXPOSURE:
- return ov2680_exposure_set(sensor, !!ctrls->auto_exp->val);
+ return ov2680_exposure_set(sensor, ctrl->val);
case V4L2_CID_VFLIP:
if (sensor->is_streaming)
return -EBUSY;
@@ -863,7 +749,6 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
}
static const struct v4l2_ctrl_ops ov2680_ctrl_ops = {
- .g_volatile_ctrl = ov2680_g_volatile_ctrl,
.s_ctrl = ov2680_s_ctrl,
};
@@ -935,7 +820,7 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor)
if (ret < 0)
return ret;
- v4l2_ctrl_handler_init(hdl, 7);
+ v4l2_ctrl_handler_init(hdl, 5);
hdl->lock = &sensor->lock;
@@ -947,16 +832,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor)
ARRAY_SIZE(test_pattern_menu) - 1,
0, 0, test_pattern_menu);
- ctrls->auto_exp = v4l2_ctrl_new_std_menu(hdl, ops,
- V4L2_CID_EXPOSURE_AUTO,
- V4L2_EXPOSURE_MANUAL, 0,
- V4L2_EXPOSURE_AUTO);
-
ctrls->exposure = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_EXPOSURE,
0, 32767, 1, 0);
- ctrls->auto_gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_AUTOGAIN,
- 0, 1, 1, 1);
ctrls->gain = v4l2_ctrl_new_std(hdl, ops, V4L2_CID_GAIN, 0, 2047, 1, 0);
if (hdl->error) {
@@ -964,14 +842,9 @@ static int ov2680_v4l2_register(struct ov2680_dev *sensor)
goto cleanup_entity;
}
- ctrls->gain->flags |= V4L2_CTRL_FLAG_VOLATILE;
- ctrls->exposure->flags |= V4L2_CTRL_FLAG_VOLATILE;
ctrls->vflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
ctrls->hflip->flags |= V4L2_CTRL_FLAG_MODIFY_LAYOUT;
- v4l2_ctrl_auto_cluster(2, &ctrls->auto_gain, 0, true);
- v4l2_ctrl_auto_cluster(2, &ctrls->auto_exp, 1, true);
-
sensor->sd.ctrl_handler = hdl;
ret = v4l2_async_register_subdev(&sensor->sd);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 241/406] media: ov2680: Fix ov2680_bayer_order()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 240/406] media: ov2680: Remove auto-gain and auto-exposure controls Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 242/406] media: ov2680: Fix vflip / hflip set functions Greg Kroah-Hartman
` (173 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Scally, Rui Miguel Silva,
Hans de Goede, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 50a7bad4e0a37d7018ab6fe843dd84bc6b2ecf72 ]
The index into ov2680_hv_flip_bayer_order[] should be 0-3, but
ov2680_bayer_order() was using 0 + BIT(2) + (BIT(2) << 1) as
max index, while the intention was to use: 0 + 1 + 2 as max index.
Fix the index calculation in ov2680_bayer_order(), while at it
also just use the ctrl values rather then reading them back using
a slow i2c-read transaction.
This also allows making the function void, since there now are
no more i2c-reads to error check.
Note the check for the ctrls being NULL is there to allow
adding an ov2680_fill_format() helper later, which will call
ov2680_set_bayer_order() during probe() before the ctrls are created.
[Sakari Ailus: Change all users of ov2680_set_bayer_order() here]
Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2680.c | 33 ++++++++++++++-------------------
1 file changed, 14 insertions(+), 19 deletions(-)
diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
index f143e2af0b5fc..a4baf440b9505 100644
--- a/drivers/media/i2c/ov2680.c
+++ b/drivers/media/i2c/ov2680.c
@@ -315,26 +315,17 @@ static void ov2680_power_down(struct ov2680_dev *sensor)
usleep_range(5000, 10000);
}
-static int ov2680_bayer_order(struct ov2680_dev *sensor)
+static void ov2680_set_bayer_order(struct ov2680_dev *sensor)
{
- u32 format1;
- u32 format2;
- u32 hv_flip;
- int ret;
-
- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT1, &format1);
- if (ret < 0)
- return ret;
+ int hv_flip = 0;
- ret = ov2680_read_reg(sensor, OV2680_REG_FORMAT2, &format2);
- if (ret < 0)
- return ret;
+ if (sensor->ctrls.vflip && sensor->ctrls.vflip->val)
+ hv_flip += 1;
- hv_flip = (format2 & BIT(2) << 1) | (format1 & BIT(2));
+ if (sensor->ctrls.hflip && sensor->ctrls.hflip->val)
+ hv_flip += 2;
sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip];
-
- return 0;
}
static int ov2680_vflip_enable(struct ov2680_dev *sensor)
@@ -345,7 +336,8 @@ static int ov2680_vflip_enable(struct ov2680_dev *sensor)
if (ret < 0)
return ret;
- return ov2680_bayer_order(sensor);
+ ov2680_set_bayer_order(sensor);
+ return 0;
}
static int ov2680_vflip_disable(struct ov2680_dev *sensor)
@@ -356,7 +348,8 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor)
if (ret < 0)
return ret;
- return ov2680_bayer_order(sensor);
+ ov2680_set_bayer_order(sensor);
+ return 0;
}
static int ov2680_hflip_enable(struct ov2680_dev *sensor)
@@ -367,7 +360,8 @@ static int ov2680_hflip_enable(struct ov2680_dev *sensor)
if (ret < 0)
return ret;
- return ov2680_bayer_order(sensor);
+ ov2680_set_bayer_order(sensor);
+ return 0;
}
static int ov2680_hflip_disable(struct ov2680_dev *sensor)
@@ -378,7 +372,8 @@ static int ov2680_hflip_disable(struct ov2680_dev *sensor)
if (ret < 0)
return ret;
- return ov2680_bayer_order(sensor);
+ ov2680_set_bayer_order(sensor);
+ return 0;
}
static int ov2680_test_pattern_set(struct ov2680_dev *sensor, int value)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 242/406] media: ov2680: Fix vflip / hflip set functions
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 241/406] media: ov2680: Fix ov2680_bayer_order() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 243/406] media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors Greg Kroah-Hartman
` (172 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Scally, Rui Miguel Silva,
Hans de Goede, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit d5d08ad330c9ccebc5e066fda815423a290f48b0 ]
ov2680_vflip_disable() / ov2680_hflip_disable() pass BIT(0) instead of
0 as value to ov2680_mod_reg().
While fixing this also:
1. Stop having separate enable/disable functions for hflip / vflip
2. Move the is_streaming check, which is unique to hflip / vflip
into the ov2680_set_?flip() functions.
for a nice code cleanup.
Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2680.c | 50 +++++++++-----------------------------
1 file changed, 12 insertions(+), 38 deletions(-)
diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
index a4baf440b9505..5249a9eb7c81a 100644
--- a/drivers/media/i2c/ov2680.c
+++ b/drivers/media/i2c/ov2680.c
@@ -328,23 +328,15 @@ static void ov2680_set_bayer_order(struct ov2680_dev *sensor)
sensor->fmt.code = ov2680_hv_flip_bayer_order[hv_flip];
}
-static int ov2680_vflip_enable(struct ov2680_dev *sensor)
+static int ov2680_set_vflip(struct ov2680_dev *sensor, s32 val)
{
int ret;
- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(2));
- if (ret < 0)
- return ret;
-
- ov2680_set_bayer_order(sensor);
- return 0;
-}
-
-static int ov2680_vflip_disable(struct ov2680_dev *sensor)
-{
- int ret;
+ if (sensor->is_streaming)
+ return -EBUSY;
- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1, BIT(2), BIT(0));
+ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT1,
+ BIT(2), val ? BIT(2) : 0);
if (ret < 0)
return ret;
@@ -352,23 +344,15 @@ static int ov2680_vflip_disable(struct ov2680_dev *sensor)
return 0;
}
-static int ov2680_hflip_enable(struct ov2680_dev *sensor)
+static int ov2680_set_hflip(struct ov2680_dev *sensor, s32 val)
{
int ret;
- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(2));
- if (ret < 0)
- return ret;
-
- ov2680_set_bayer_order(sensor);
- return 0;
-}
-
-static int ov2680_hflip_disable(struct ov2680_dev *sensor)
-{
- int ret;
+ if (sensor->is_streaming)
+ return -EBUSY;
- ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2, BIT(2), BIT(0));
+ ret = ov2680_mod_reg(sensor, OV2680_REG_FORMAT2,
+ BIT(2), val ? BIT(2) : 0);
if (ret < 0)
return ret;
@@ -721,19 +705,9 @@ static int ov2680_s_ctrl(struct v4l2_ctrl *ctrl)
case V4L2_CID_EXPOSURE:
return ov2680_exposure_set(sensor, ctrl->val);
case V4L2_CID_VFLIP:
- if (sensor->is_streaming)
- return -EBUSY;
- if (ctrl->val)
- return ov2680_vflip_enable(sensor);
- else
- return ov2680_vflip_disable(sensor);
+ return ov2680_set_vflip(sensor, ctrl->val);
case V4L2_CID_HFLIP:
- if (sensor->is_streaming)
- return -EBUSY;
- if (ctrl->val)
- return ov2680_hflip_enable(sensor);
- else
- return ov2680_hflip_disable(sensor);
+ return ov2680_set_hflip(sensor, ctrl->val);
case V4L2_CID_TEST_PATTERN:
return ov2680_test_pattern_set(sensor, ctrl->val);
default:
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 243/406] media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 242/406] media: ov2680: Fix vflip / hflip set functions Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 244/406] cgroup:namespace: Remove unused cgroup_namespaces_init() Greg Kroah-Hartman
` (171 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Scally, Rui Miguel Silva,
Hans de Goede, Sakari Ailus, Mauro Carvalho Chehab, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 84b4bd7e0d98166aa32fd470e672721190492eae ]
When the ov2680_power_on() "sensor soft reset failed" path is hit during
probe() the WARN() about putting an enabled regulator at
drivers/regulator/core.c:2398 triggers 3 times (once for each regulator),
filling dmesg with backtraces.
Fix this by properly disabling the regulators on ov2680_power_on() errors.
Fixes: 3ee47cad3e69 ("media: ov2680: Add Omnivision OV2680 sensor driver")
Reviewed-by: Daniel Scally <dan.scally@ideasonboard.com>
Acked-by: Rui Miguel Silva <rmfrfs@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ov2680.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/media/i2c/ov2680.c b/drivers/media/i2c/ov2680.c
index 5249a9eb7c81a..731a60f6a59af 100644
--- a/drivers/media/i2c/ov2680.c
+++ b/drivers/media/i2c/ov2680.c
@@ -459,7 +459,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
ret = ov2680_write_reg(sensor, OV2680_REG_SOFT_RESET, 0x01);
if (ret != 0) {
dev_err(dev, "sensor soft reset failed\n");
- return ret;
+ goto err_disable_regulators;
}
usleep_range(1000, 2000);
} else {
@@ -469,7 +469,7 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
ret = clk_prepare_enable(sensor->xvclk);
if (ret < 0)
- return ret;
+ goto err_disable_regulators;
sensor->is_enabled = true;
@@ -479,6 +479,10 @@ static int ov2680_power_on(struct ov2680_dev *sensor)
ov2680_stream_disable(sensor);
return 0;
+
+err_disable_regulators:
+ regulator_bulk_disable(OV2680_NUM_SUPPLIES, sensor->supplies);
+ return ret;
}
static int ov2680_s_power(struct v4l2_subdev *sd, int on)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 244/406] cgroup:namespace: Remove unused cgroup_namespaces_init()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 243/406] media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 245/406] scsi: core: Use 32-bit hostnum in scsi_host_lookup() Greg Kroah-Hartman
` (170 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lu Jialin, Tejun Heo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Jialin <lujialin4@huawei.com>
[ Upstream commit 82b90b6c5b38e457c7081d50dff11ecbafc1e61a ]
cgroup_namspace_init() just return 0. Therefore, there is no need to
call it during start_kernel. Just remove it.
Fixes: a79a908fd2b0 ("cgroup: introduce cgroup namespaces")
Signed-off-by: Lu Jialin <lujialin4@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/cgroup/namespace.c | 6 ------
1 file changed, 6 deletions(-)
diff --git a/kernel/cgroup/namespace.c b/kernel/cgroup/namespace.c
index 812a61afd538a..d2b4dd753234e 100644
--- a/kernel/cgroup/namespace.c
+++ b/kernel/cgroup/namespace.c
@@ -149,9 +149,3 @@ const struct proc_ns_operations cgroupns_operations = {
.install = cgroupns_install,
.owner = cgroupns_owner,
};
-
-static __init int cgroup_namespaces_init(void)
-{
- return 0;
-}
-subsys_initcall(cgroup_namespaces_init);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 245/406] scsi: core: Use 32-bit hostnum in scsi_host_lookup()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 244/406] cgroup:namespace: Remove unused cgroup_namespaces_init() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 246/406] scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock Greg Kroah-Hartman
` (169 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tony Battersby, Bart Van Assche,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Battersby <tonyb@cybernetics.com>
[ Upstream commit 62ec2092095b678ff89ce4ba51c2938cd1e8e630 ]
Change scsi_host_lookup() hostnum argument type from unsigned short to
unsigned int to match the type used everywhere else.
Fixes: 6d49f63b415c ("[SCSI] Make host_no an unsigned int")
Signed-off-by: Tony Battersby <tonyb@cybernetics.com>
Link: https://lore.kernel.org/r/a02497e7-c12b-ef15-47fc-3f0a0b00ffce@cybernetics.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hosts.c | 4 ++--
include/scsi/scsi_host.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 18321cf9db5d6..59eb6c2969860 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -522,7 +522,7 @@ EXPORT_SYMBOL(scsi_host_alloc);
static int __scsi_host_match(struct device *dev, const void *data)
{
struct Scsi_Host *p;
- const unsigned short *hostnum = data;
+ const unsigned int *hostnum = data;
p = class_to_shost(dev);
return p->host_no == *hostnum;
@@ -539,7 +539,7 @@ static int __scsi_host_match(struct device *dev, const void *data)
* that scsi_host_get() took. The put_device() below dropped
* the reference from class_find_device().
**/
-struct Scsi_Host *scsi_host_lookup(unsigned short hostnum)
+struct Scsi_Host *scsi_host_lookup(unsigned int hostnum)
{
struct device *cdev;
struct Scsi_Host *shost = NULL;
diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h
index 701f178b20aee..4a9f1e6e3aaca 100644
--- a/include/scsi/scsi_host.h
+++ b/include/scsi/scsi_host.h
@@ -745,7 +745,7 @@ extern void scsi_remove_host(struct Scsi_Host *);
extern struct Scsi_Host *scsi_host_get(struct Scsi_Host *);
extern int scsi_host_busy(struct Scsi_Host *shost);
extern void scsi_host_put(struct Scsi_Host *t);
-extern struct Scsi_Host *scsi_host_lookup(unsigned short);
+extern struct Scsi_Host *scsi_host_lookup(unsigned int hostnum);
extern const char *scsi_host_state_name(enum scsi_host_state);
extern void scsi_host_complete_all_commands(struct Scsi_Host *shost,
int status);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 246/406] scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 245/406] scsi: core: Use 32-bit hostnum in scsi_host_lookup() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 247/406] serial: tegra: handle clk prepare error in tegra_uart_hw_init() Greg Kroah-Hartman
` (168 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Davidlohr Bueso,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <dg573847474@gmail.com>
[ Upstream commit 1a1975551943f681772720f639ff42fbaa746212 ]
There is a long call chain that &fip->ctlr_lock is acquired by isr
fnic_isr_msix_wq_copy() under hard IRQ context. Thus other process context
code acquiring the lock should disable IRQ, otherwise deadlock could happen
if the IRQ preempts the execution while the lock is held in process context
on the same CPU.
[ISR]
fnic_isr_msix_wq_copy()
-> fnic_wq_copy_cmpl_handler()
-> fnic_fcpio_cmpl_handler()
-> fnic_fcpio_flogi_reg_cmpl_handler()
-> fnic_flush_tx()
-> fnic_send_frame()
-> fcoe_ctlr_els_send()
-> spin_lock_bh(&fip->ctlr_lock)
[Process Context]
1. fcoe_ctlr_timer_work()
-> fcoe_ctlr_flogi_send()
-> spin_lock_bh(&fip->ctlr_lock)
2. fcoe_ctlr_recv_work()
-> fcoe_ctlr_recv_handler()
-> fcoe_ctlr_recv_els()
-> fcoe_ctlr_announce()
-> spin_lock_bh(&fip->ctlr_lock)
3. fcoe_ctlr_recv_work()
-> fcoe_ctlr_recv_handler()
-> fcoe_ctlr_recv_els()
-> fcoe_ctlr_flogi_retry()
-> spin_lock_bh(&fip->ctlr_lock)
4. -> fcoe_xmit()
-> fcoe_ctlr_els_send()
-> spin_lock_bh(&fip->ctlr_lock)
spin_lock_bh() is not enough since fnic_isr_msix_wq_copy() is a
hardirq.
These flaws were found by an experimental static analysis tool I am
developing for irq-related deadlock.
The patch fix the potential deadlocks by spin_lock_irqsave() to disable
hard irq.
Fixes: 794d98e77f59 ("[SCSI] libfcoe: retry rejected FLOGI to another FCF if possible")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Link: https://lore.kernel.org/r/20230817074708.7509-1-dg573847474@gmail.com
Reviewed-by: Davidlohr Bueso <dave@stgolabs.net>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/fcoe/fcoe_ctlr.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index bbc5d6b9be737..a2d60ad2a6835 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -319,16 +319,17 @@ static void fcoe_ctlr_announce(struct fcoe_ctlr *fip)
{
struct fcoe_fcf *sel;
struct fcoe_fcf *fcf;
+ unsigned long flags;
mutex_lock(&fip->ctlr_mutex);
- spin_lock_bh(&fip->ctlr_lock);
+ spin_lock_irqsave(&fip->ctlr_lock, flags);
kfree_skb(fip->flogi_req);
fip->flogi_req = NULL;
list_for_each_entry(fcf, &fip->fcfs, list)
fcf->flogi_sent = 0;
- spin_unlock_bh(&fip->ctlr_lock);
+ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
sel = fip->sel_fcf;
if (sel && ether_addr_equal(sel->fcf_mac, fip->dest_addr))
@@ -699,6 +700,7 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
{
struct fc_frame *fp;
struct fc_frame_header *fh;
+ unsigned long flags;
u16 old_xid;
u8 op;
u8 mac[ETH_ALEN];
@@ -732,11 +734,11 @@ int fcoe_ctlr_els_send(struct fcoe_ctlr *fip, struct fc_lport *lport,
op = FIP_DT_FLOGI;
if (fip->mode == FIP_MODE_VN2VN)
break;
- spin_lock_bh(&fip->ctlr_lock);
+ spin_lock_irqsave(&fip->ctlr_lock, flags);
kfree_skb(fip->flogi_req);
fip->flogi_req = skb;
fip->flogi_req_send = 1;
- spin_unlock_bh(&fip->ctlr_lock);
+ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
schedule_work(&fip->timer_work);
return -EINPROGRESS;
case ELS_FDISC:
@@ -1713,10 +1715,11 @@ static int fcoe_ctlr_flogi_send_locked(struct fcoe_ctlr *fip)
static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
{
struct fcoe_fcf *fcf;
+ unsigned long flags;
int error;
mutex_lock(&fip->ctlr_mutex);
- spin_lock_bh(&fip->ctlr_lock);
+ spin_lock_irqsave(&fip->ctlr_lock, flags);
LIBFCOE_FIP_DBG(fip, "re-sending FLOGI - reselect\n");
fcf = fcoe_ctlr_select(fip);
if (!fcf || fcf->flogi_sent) {
@@ -1727,7 +1730,7 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
fcoe_ctlr_solicit(fip, NULL);
error = fcoe_ctlr_flogi_send_locked(fip);
}
- spin_unlock_bh(&fip->ctlr_lock);
+ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
mutex_unlock(&fip->ctlr_mutex);
return error;
}
@@ -1744,8 +1747,9 @@ static int fcoe_ctlr_flogi_retry(struct fcoe_ctlr *fip)
static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
{
struct fcoe_fcf *fcf;
+ unsigned long flags;
- spin_lock_bh(&fip->ctlr_lock);
+ spin_lock_irqsave(&fip->ctlr_lock, flags);
fcf = fip->sel_fcf;
if (!fcf || !fip->flogi_req_send)
goto unlock;
@@ -1772,7 +1776,7 @@ static void fcoe_ctlr_flogi_send(struct fcoe_ctlr *fip)
} else /* XXX */
LIBFCOE_FIP_DBG(fip, "No FCF selected - defer send\n");
unlock:
- spin_unlock_bh(&fip->ctlr_lock);
+ spin_unlock_irqrestore(&fip->ctlr_lock, flags);
}
/**
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 247/406] serial: tegra: handle clk prepare error in tegra_uart_hw_init()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 246/406] scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 248/406] amba: bus: fix refcount leak Greg Kroah-Hartman
` (167 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Yang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <yiyang13@huawei.com>
[ Upstream commit 5abd01145d0cc6cd1b7c2fe6ee0b9ea0fa13671e ]
In tegra_uart_hw_init(), the return value of clk_prepare_enable() should
be checked since it might fail.
Fixes: e9ea096dd225 ("serial: tegra: add serial driver")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Link: https://lore.kernel.org/r/20230817105406.228674-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/serial-tegra.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/tty/serial/serial-tegra.c b/drivers/tty/serial/serial-tegra.c
index 62377c831894d..fac4d90047b03 100644
--- a/drivers/tty/serial/serial-tegra.c
+++ b/drivers/tty/serial/serial-tegra.c
@@ -994,7 +994,11 @@ static int tegra_uart_hw_init(struct tegra_uart_port *tup)
tup->ier_shadow = 0;
tup->current_baud = 0;
- clk_prepare_enable(tup->uart_clk);
+ ret = clk_prepare_enable(tup->uart_clk);
+ if (ret) {
+ dev_err(tup->uport.dev, "could not enable clk\n");
+ return ret;
+ }
/* Reset the UART controller to clear all previous status.*/
reset_control_assert(tup->rst);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 248/406] amba: bus: fix refcount leak
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 247/406] serial: tegra: handle clk prepare error in tegra_uart_hw_init() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 249/406] Revert "IB/isert: Fix incorrect release of isert connection" Greg Kroah-Hartman
` (166 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peng Fan, Andy Shevchenko,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peng Fan <peng.fan@nxp.com>
[ Upstream commit e312cbdc11305568554a9e18a2ea5c2492c183f3 ]
commit 5de1540b7bc4 ("drivers/amba: create devices from device tree")
increases the refcount of of_node, but not releases it in
amba_device_release, so there is refcount leak. By using of_node_put
to avoid refcount leak.
Fixes: 5de1540b7bc4 ("drivers/amba: create devices from device tree")
Signed-off-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230821023928.3324283-1-peng.fan@oss.nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/amba/bus.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
index 47c72447ccd59..52ab582930caa 100644
--- a/drivers/amba/bus.c
+++ b/drivers/amba/bus.c
@@ -363,6 +363,7 @@ static void amba_device_release(struct device *dev)
{
struct amba_device *d = to_amba_device(dev);
+ of_node_put(d->dev.of_node);
if (d->res.parent)
release_resource(&d->res);
kfree(d);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 249/406] Revert "IB/isert: Fix incorrect release of isert connection"
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 248/406] amba: bus: fix refcount leak Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 250/406] RDMA/siw: Balance the reference of cep->kref in the error path Greg Kroah-Hartman
` (165 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dennis Dalessandro, Leon Romanovsky,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit dfe261107c080709459c32695847eec96238852b ]
Commit: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection") is
causing problems on OPA when DEVICE_REMOVAL is happening.
------------[ cut here ]------------
WARNING: CPU: 52 PID: 2117247 at drivers/infiniband/core/cq.c:359
ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
Modules linked in: nfsd nfs_acl target_core_user uio tcm_fc libfc
scsi_transport_fc tcm_loop target_core_pscsi target_core_iblock target_core_file
rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs
rfkill rpcrdma rdma_ucm ib_srpt sunrpc ib_isert iscsi_target_mod target_core_mod
opa_vnic ib_iser libiscsi ib_umad scsi_transport_iscsi rdma_cm ib_ipoib iw_cm
ib_cm hfi1(-) rdmavt ib_uverbs intel_rapl_msr intel_rapl_common sb_edac ib_core
x86_pkg_temp_thermal intel_powerclamp coretemp i2c_i801 mxm_wmi rapl iTCO_wdt
ipmi_si iTCO_vendor_support mei_me ipmi_devintf mei intel_cstate ioatdma
intel_uncore i2c_smbus joydev pcspkr lpc_ich ipmi_msghandler acpi_power_meter
acpi_pad xfs libcrc32c sr_mod sd_mod cdrom t10_pi sg crct10dif_pclmul
crc32_pclmul crc32c_intel drm_kms_helper drm_shmem_helper ahci libahci
ghash_clmulni_intel igb drm libata dca i2c_algo_bit wmi fuse
CPU: 52 PID: 2117247 Comm: modprobe Not tainted 6.5.0-rc1+ #1
Hardware name: Intel Corporation S2600CWR/S2600CW, BIOS
SE5C610.86B.01.01.0014.121820151719 12/18/2015
RIP: 0010:ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
Code: ff 48 8b 43 40 48 8d 7b 40 48 83 e8 40 4c 39 e7 75 b3 49 83
c4 10 4d 39 fc 75 94 5b 5d 41 5c 41 5d 41 5e 41 5f c3 cc cc cc cc <0f> 0b eb a1
90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f
RSP: 0018:ffffc10bea13fc80 EFLAGS: 00010206
RAX: 000000000000010c RBX: ffff9bf5c7e66c00 RCX: 000000008020001d
RDX: 000000008020001e RSI: fffff175221f9900 RDI: ffff9bf5c7e67640
RBP: ffff9bf5c7e67600 R08: ffff9bf5c7e64400 R09: 000000008020001d
R10: 0000000040000000 R11: 0000000000000000 R12: ffff9bee4b1e8a18
R13: dead000000000122 R14: dead000000000100 R15: ffff9bee4b1e8a38
FS: 00007ff1e6d38740(0000) GS:ffff9bfd9fb00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005652044ecc68 CR3: 0000000889b5c005 CR4: 00000000001706e0
Call Trace:
<TASK>
? __warn+0x80/0x130
? ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
? report_bug+0x195/0x1a0
? handle_bug+0x3c/0x70
? exc_invalid_op+0x14/0x70
? asm_exc_invalid_op+0x16/0x20
? ib_cq_pool_cleanup+0xac/0xb0 [ib_core]
disable_device+0x9d/0x160 [ib_core]
__ib_unregister_device+0x42/0xb0 [ib_core]
ib_unregister_device+0x22/0x30 [ib_core]
rvt_unregister_device+0x20/0x90 [rdmavt]
hfi1_unregister_ib_device+0x16/0xf0 [hfi1]
remove_one+0x55/0x1a0 [hfi1]
pci_device_remove+0x36/0xa0
device_release_driver_internal+0x193/0x200
driver_detach+0x44/0x90
bus_remove_driver+0x69/0xf0
pci_unregister_driver+0x2a/0xb0
hfi1_mod_cleanup+0xc/0x3c [hfi1]
__do_sys_delete_module.constprop.0+0x17a/0x2f0
? exit_to_user_mode_prepare+0xc4/0xd0
? syscall_trace_enter.constprop.0+0x126/0x1a0
do_syscall_64+0x5c/0x90
? syscall_exit_to_user_mode+0x12/0x30
? do_syscall_64+0x69/0x90
? syscall_exit_work+0x103/0x130
? syscall_exit_to_user_mode+0x12/0x30
? do_syscall_64+0x69/0x90
? exc_page_fault+0x65/0x150
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
RIP: 0033:0x7ff1e643f5ab
Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3
66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0
ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffec9103cc8 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
RAX: ffffffffffffffda RBX: 00005615267fdc50 RCX: 00007ff1e643f5ab
RDX: 0000000000000000 RSI: 0000000000000800 RDI: 00005615267fdcb8
RBP: 00005615267fdc50 R08: 0000000000000000 R09: 0000000000000000
R10: 00007ff1e659eac0 R11: 0000000000000206 R12: 00005615267fdcb8
R13: 0000000000000000 R14: 00005615267fdcb8 R15: 00007ffec9105ff8
</TASK>
---[ end trace 0000000000000000 ]---
And...
restrack: ------------[ cut here ]------------
infiniband hfi1_0: BUG: RESTRACK detected leak of resources
restrack: Kernel PD object allocated by ib_isert is not freed
restrack: Kernel CQ object allocated by ib_core is not freed
restrack: Kernel QP object allocated by rdma_cm is not freed
restrack: ------------[ cut here ]------------
Fixes: 699826f4e30a ("IB/isert: Fix incorrect release of isert connection")
Reported-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Closes: https://lore.kernel.org/all/921cd1d9-2879-f455-1f50-0053fe6a6655@cornelisnetworks.com
Link: https://lore.kernel.org/r/a27982d3235005c58f6d321f3fad5eb6e1beaf9e.1692604607.git.leonro@nvidia.com
Tested-by: Dennis Dalessandro <dennis.dalessandro@cornelisnetworks.com>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/isert/ib_isert.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c
index 7cd90604502ec..ed375f517e8ac 100644
--- a/drivers/infiniband/ulp/isert/ib_isert.c
+++ b/drivers/infiniband/ulp/isert/ib_isert.c
@@ -2560,6 +2560,8 @@ static void isert_wait_conn(struct iscsi_conn *conn)
isert_put_unsol_pending_cmds(conn);
isert_wait4cmds(conn);
isert_wait4logout(isert_conn);
+
+ queue_work(isert_release_wq, &isert_conn->release_work);
}
static void isert_free_conn(struct iscsi_conn *conn)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 250/406] RDMA/siw: Balance the reference of cep->kref in the error path
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 249/406] Revert "IB/isert: Fix incorrect release of isert connection" Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 251/406] RDMA/siw: Correct wrong debug message Greg Kroah-Hartman
` (164 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Bernard Metzler,
Leon Romanovsky, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@linux.dev>
[ Upstream commit b056327bee09e6b86683d3f709a438ccd6031d72 ]
The siw_connect can go to err in below after cep is allocated successfully:
1. If siw_cm_alloc_work returns failure. In this case socket is not
assoicated with cep so siw_cep_put can't be called by siw_socket_disassoc.
We need to call siw_cep_put twice since cep->kref is increased once after
it was initialized.
2. If siw_cm_queue_work can't find a work, which means siw_cep_get is not
called in siw_cm_queue_work, so cep->kref is increased twice by siw_cep_get
and when associate socket with cep after it was initialized. So we need to
call siw_cep_put three times (one in siw_socket_disassoc).
3. siw_send_mpareqrep returns error, this scenario is similar as 2.
So we need to remove one siw_cep_put in the error path.
Fixes: 6c52fdc244b5 ("rdma/siw: connection management")
Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Link: https://lore.kernel.org/r/20230821133255.31111-2-guoqing.jiang@linux.dev
Acked-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_cm.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_cm.c b/drivers/infiniband/sw/siw/siw_cm.c
index b87ba4c9fccf1..de5ab282ac748 100644
--- a/drivers/infiniband/sw/siw/siw_cm.c
+++ b/drivers/infiniband/sw/siw/siw_cm.c
@@ -1490,7 +1490,6 @@ int siw_connect(struct iw_cm_id *id, struct iw_cm_conn_param *params)
cep->cm_id = NULL;
id->rem_ref(id);
- siw_cep_put(cep);
qp->cep = NULL;
siw_cep_put(cep);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 251/406] RDMA/siw: Correct wrong debug message
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 250/406] RDMA/siw: Balance the reference of cep->kref in the error path Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 252/406] HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() Greg Kroah-Hartman
` (163 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Bernard Metzler,
Leon Romanovsky, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@linux.dev>
[ Upstream commit bee024d20451e4ce04ea30099cad09f7f75d288b ]
We need to print num_sle first then pbl->max_buf per the condition.
Also replace mem->pbl with pbl while at it.
Fixes: 303ae1cdfdf7 ("rdma/siw: application interface")
Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Link: https://lore.kernel.org/r/20230821133255.31111-3-guoqing.jiang@linux.dev
Acked-by: Bernard Metzler <bmt@zurich.ibm.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/sw/siw/siw_verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/sw/siw/siw_verbs.c b/drivers/infiniband/sw/siw/siw_verbs.c
index d043793ff0f53..1d4e0dc550e42 100644
--- a/drivers/infiniband/sw/siw/siw_verbs.c
+++ b/drivers/infiniband/sw/siw/siw_verbs.c
@@ -1487,7 +1487,7 @@ int siw_map_mr_sg(struct ib_mr *base_mr, struct scatterlist *sl, int num_sle,
if (pbl->max_buf < num_sle) {
siw_dbg_mem(mem, "too many SGE's: %d > %d\n",
- mem->pbl->max_buf, num_sle);
+ num_sle, pbl->max_buf);
return -ENOMEM;
}
for_each_sg(sl, slp, num_sle, i) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 252/406] HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 251/406] RDMA/siw: Correct wrong debug message Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 253/406] HID: multitouch: Correct devm device reference for hidinput input_dev name Greg Kroah-Hartman
` (162 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich,
Benjamin Tissoires, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 6f20d3261265885f6a6be4cda49d7019728760e0 ]
Presently, if a call to logi_dj_recv_send_report() fails, we do
not learn about the error until after sending short
HID_OUTPUT_REPORT with hid_hw_raw_request().
To handle this somewhat unlikely issue, return on error in
logi_dj_recv_send_report() (minding ugly sleep workaround) and
take into account the result of hid_hw_raw_request().
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 6a9ddc897883 ("HID: logitech-dj: enable notifications on connect/disconnect")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Link: https://lore.kernel.org/r/20230613101635.77820-1-n.zhandarovich@fintech.ru
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-dj.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c
index 587259b3db97c..f4d79ec826797 100644
--- a/drivers/hid/hid-logitech-dj.c
+++ b/drivers/hid/hid-logitech-dj.c
@@ -1217,6 +1217,9 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
* 50 msec should gives enough time to the receiver to be ready.
*/
msleep(50);
+
+ if (retval)
+ return retval;
}
/*
@@ -1238,7 +1241,7 @@ static int logi_dj_recv_switch_to_dj_mode(struct dj_receiver_dev *djrcv_dev,
buf[5] = 0x09;
buf[6] = 0x00;
- hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf,
+ retval = hid_hw_raw_request(hdev, REPORT_ID_HIDPP_SHORT, buf,
HIDPP_REPORT_SHORT_LENGTH, HID_OUTPUT_REPORT,
HID_REQ_SET_REPORT);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 253/406] HID: multitouch: Correct devm device reference for hidinput input_dev name
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 252/406] HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 254/406] x86/speculation: Mark all Skylake CPUs as vulnerable to GDS Greg Kroah-Hartman
` (161 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Dmitry Torokhov,
Rahul Rameshbabu, Benjamin Tissoires, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
[ Upstream commit 4794394635293a3e74591351fff469cea7ad15a2 ]
Reference the HID device rather than the input device for the devm
allocation of the input_dev name. Referencing the input_dev would lead to a
use-after-free when the input_dev was unregistered and subsequently fires a
uevent that depends on the name. At the point of firing the uevent, the
name would be freed by devres management.
Use devm_kasprintf to simplify the logic for allocating memory and
formatting the input_dev name string.
Reported-by: Maxime Ripard <mripard@kernel.org>
Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae
Fixes: c08d46aa805b ("HID: multitouch: devm conversion")
Suggested-by: Maxime Ripard <mripard@kernel.org>
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
Reviewed-by: Maxime Ripard <mripard@kernel.org>
Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index ea8c52f0aa783..dc7c33f6b2c4e 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -1541,7 +1541,6 @@ static void mt_post_parse(struct mt_device *td, struct mt_application *app)
static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
{
struct mt_device *td = hid_get_drvdata(hdev);
- char *name;
const char *suffix = NULL;
struct mt_report_data *rdata;
struct mt_application *mt_application = NULL;
@@ -1595,15 +1594,9 @@ static int mt_input_configured(struct hid_device *hdev, struct hid_input *hi)
break;
}
- if (suffix) {
- name = devm_kzalloc(&hi->input->dev,
- strlen(hdev->name) + strlen(suffix) + 2,
- GFP_KERNEL);
- if (name) {
- sprintf(name, "%s %s", hdev->name, suffix);
- hi->input->name = name;
- }
- }
+ if (suffix)
+ hi->input->name = devm_kasprintf(&hdev->dev, GFP_KERNEL,
+ "%s %s", hdev->name, suffix);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 254/406] x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 253/406] HID: multitouch: Correct devm device reference for hidinput input_dev name Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 255/406] tracing: Fix race issue between cpu buffer write and swap Greg Kroah-Hartman
` (160 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Zhivich, Dave Hansen,
Ingo Molnar, Daniel Sneddon, Linus Torvalds, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Hansen <dave.hansen@linux.intel.com>
[ Upstream commit c9f4c45c8ec3f07f4f083f9750032a1ec3eab6b2 ]
The Gather Data Sampling (GDS) vulnerability is common to all Skylake
processors. However, the "client" Skylakes* are now in this list:
https://www.intel.com/content/www/us/en/support/articles/000022396/processors.html
which means they are no longer included for new vulnerabilities here:
https://www.intel.com/content/www/us/en/developer/topic-technology/software-security-guidance/processors-affected-consolidated-product-cpu-model.html
or in other GDS documentation. Thus, they were not included in the
original GDS mitigation patches.
Mark SKYLAKE and SKYLAKE_L as vulnerable to GDS to match all the
other Skylake CPUs (which include Kaby Lake). Also group the CPUs
so that the ones that share the exact same vulnerabilities are next
to each other.
Last, move SRBDS to the end of each line. This makes it clear at a
glance that SKYLAKE_X is unique. Of the five Skylakes, it is the
only "server" CPU and has a different implementation from the
clients of the "special register" hardware, making it immune to SRBDS.
This makes the diff much harder to read, but the resulting table is
worth it.
I very much appreciate the report from Michael Zhivich about this
issue. Despite what level of support a hardware vendor is providing,
the kernel very much needs an accurate and up-to-date list of
vulnerable CPUs. More reports like this are very welcome.
* Client Skylakes are CPUID 406E3/506E3 which is family 6, models
0x4E and 0x5E, aka INTEL_FAM6_SKYLAKE and INTEL_FAM6_SKYLAKE_L.
Reported-by: Michael Zhivich <mzhivich@akamai.com>
Fixes: 8974eb588283 ("x86/speculation: Add Gather Data Sampling mitigation")
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Reviewed-by: Daniel Sneddon <daniel.sneddon@linux.intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/common.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index c1ff75ad11358..4ecc6072e9a48 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -1145,11 +1145,11 @@ static const struct x86_cpu_id cpu_vuln_blacklist[] __initconst = {
VULNBL_INTEL_STEPPINGS(BROADWELL_G, X86_STEPPING_ANY, SRBDS),
VULNBL_INTEL_STEPPINGS(BROADWELL_X, X86_STEPPING_ANY, MMIO),
VULNBL_INTEL_STEPPINGS(BROADWELL, X86_STEPPING_ANY, SRBDS),
- VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
VULNBL_INTEL_STEPPINGS(SKYLAKE_X, X86_STEPPING_ANY, MMIO | RETBLEED | GDS),
- VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED),
- VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS),
- VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, SRBDS | MMIO | RETBLEED | GDS),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS),
+ VULNBL_INTEL_STEPPINGS(SKYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS),
+ VULNBL_INTEL_STEPPINGS(KABYLAKE_L, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS),
+ VULNBL_INTEL_STEPPINGS(KABYLAKE, X86_STEPPING_ANY, MMIO | RETBLEED | GDS | SRBDS),
VULNBL_INTEL_STEPPINGS(CANNONLAKE_L, X86_STEPPING_ANY, RETBLEED),
VULNBL_INTEL_STEPPINGS(ICELAKE_L, X86_STEPPING_ANY, MMIO | MMIO_SBDS | RETBLEED | GDS),
VULNBL_INTEL_STEPPINGS(ICELAKE_D, X86_STEPPING_ANY, MMIO | GDS),
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 255/406] tracing: Fix race issue between cpu buffer write and swap
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 254/406] x86/speculation: Mark all Skylake CPUs as vulnerable to GDS Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 256/406] mtd: rawnand: brcmnand: Fix mtd oobsize Greg Kroah-Hartman
` (159 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, mhiramat, Zheng Yejian,
Steven Rostedt (Google), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <zhengyejian1@huawei.com>
[ Upstream commit 3163f635b20e9e1fb4659e74f47918c9dddfe64e ]
Warning happened in rb_end_commit() at code:
if (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing)))
WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142
rb_commit+0x402/0x4a0
Call Trace:
ring_buffer_unlock_commit+0x42/0x250
trace_buffer_unlock_commit_regs+0x3b/0x250
trace_event_buffer_commit+0xe5/0x440
trace_event_buffer_reserve+0x11c/0x150
trace_event_raw_event_sched_switch+0x23c/0x2c0
__traceiter_sched_switch+0x59/0x80
__schedule+0x72b/0x1580
schedule+0x92/0x120
worker_thread+0xa0/0x6f0
It is because the race between writing event into cpu buffer and swapping
cpu buffer through file per_cpu/cpu0/snapshot:
Write on CPU 0 Swap buffer by per_cpu/cpu0/snapshot on CPU 1
-------- --------
tracing_snapshot_write()
[...]
ring_buffer_lock_reserve()
cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a';
[...]
rb_reserve_next_event()
[...]
ring_buffer_swap_cpu()
if (local_read(&cpu_buffer_a->committing))
goto out_dec;
if (local_read(&cpu_buffer_b->committing))
goto out_dec;
buffer_a->buffers[cpu] = cpu_buffer_b;
buffer_b->buffers[cpu] = cpu_buffer_a;
// 2. cpu_buffer has swapped here.
rb_start_commit(cpu_buffer);
if (unlikely(READ_ONCE(cpu_buffer->buffer)
!= buffer)) { // 3. This check passed due to 'cpu_buffer->buffer'
[...] // has not changed here.
return NULL;
}
cpu_buffer_b->buffer = buffer_a;
cpu_buffer_a->buffer = buffer_b;
[...]
// 4. Reserve event from 'cpu_buffer_a'.
ring_buffer_unlock_commit()
[...]
cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!!
rb_commit(cpu_buffer)
rb_end_commit() // 6. WARN for the wrong 'committing' state !!!
Based on above analysis, we can easily reproduce by following testcase:
``` bash
#!/bin/bash
dmesg -n 7
sysctl -w kernel.panic_on_warn=1
TR=/sys/kernel/tracing
echo 7 > ${TR}/buffer_size_kb
echo "sched:sched_switch" > ${TR}/set_event
while [ true ]; do
echo 1 > ${TR}/per_cpu/cpu0/snapshot
done &
while [ true ]; do
echo 1 > ${TR}/per_cpu/cpu0/snapshot
done &
while [ true ]; do
echo 1 > ${TR}/per_cpu/cpu0/snapshot
done &
```
To fix it, IIUC, we can use smp_call_function_single() to do the swap on
the target cpu where the buffer is located, so that above race would be
avoided.
Link: https://lore.kernel.org/linux-trace-kernel/20230831132739.4070878-1-zhengyejian1@huawei.com
Cc: <mhiramat@kernel.org>
Fixes: f1affcaaa861 ("tracing: Add snapshot in the per_cpu trace directories")
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 2ded5012543bf..fbe13cfdb85b0 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -7164,6 +7164,11 @@ static int tracing_snapshot_open(struct inode *inode, struct file *file)
return ret;
}
+static void tracing_swap_cpu_buffer(void *tr)
+{
+ update_max_tr_single((struct trace_array *)tr, current, smp_processor_id());
+}
+
static ssize_t
tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
loff_t *ppos)
@@ -7222,13 +7227,15 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
ret = tracing_alloc_snapshot_instance(tr);
if (ret < 0)
break;
- local_irq_disable();
/* Now, we're going to swap */
- if (iter->cpu_file == RING_BUFFER_ALL_CPUS)
+ if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
+ local_irq_disable();
update_max_tr(tr, current, smp_processor_id(), NULL);
- else
- update_max_tr_single(tr, current, iter->cpu_file);
- local_irq_enable();
+ local_irq_enable();
+ } else {
+ smp_call_function_single(iter->cpu_file, tracing_swap_cpu_buffer,
+ (void *)tr, 1);
+ }
break;
default:
if (tr->allocated_snapshot) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 256/406] mtd: rawnand: brcmnand: Fix mtd oobsize
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 255/406] tracing: Fix race issue between cpu buffer write and swap Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 257/406] phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 Greg Kroah-Hartman
` (158 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, William Zhang, Miquel Raynal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Zhang <william.zhang@broadcom.com>
[ Upstream commit 60177390fa061c62d156f4a546e3efd90df3c183 ]
brcmnand controller can only access the flash spare area up to certain
bytes based on the ECC level. It can be less than the actual flash spare
area size. For example, for many NAND chip supporting ECC BCH-8, it has
226 bytes spare area. But controller can only uses 218 bytes. So brcmand
driver overrides the mtd oobsize with the controller's accessible spare
area size. When the nand base driver utilizes the nand_device object, it
resets the oobsize back to the actual flash spare aprea size from
nand_memory_organization structure and controller may not able to access
all the oob area as mtd advises.
This change fixes the issue by overriding the oobsize in the
nand_memory_organization structure to the controller's accessible spare
area size.
Fixes: a7ab085d7c16 ("mtd: rawnand: Initialize the nand_device object")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-6-william.zhang@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/nand/raw/brcmnand/brcmnand.c b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
index 580b91cbd18de..64c8c177d0082 100644
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -2534,6 +2534,8 @@ static int brcmnand_setup_dev(struct brcmnand_host *host)
struct nand_chip *chip = &host->chip;
const struct nand_ecc_props *requirements =
nanddev_get_ecc_requirements(&chip->base);
+ struct nand_memory_organization *memorg =
+ nanddev_get_memorg(&chip->base);
struct brcmnand_controller *ctrl = host->ctrl;
struct brcmnand_cfg *cfg = &host->hwcfg;
char msg[128];
@@ -2555,10 +2557,11 @@ static int brcmnand_setup_dev(struct brcmnand_host *host)
if (cfg->spare_area_size > ctrl->max_oob)
cfg->spare_area_size = ctrl->max_oob;
/*
- * Set oobsize to be consistent with controller's spare_area_size, as
- * the rest is inaccessible.
+ * Set mtd and memorg oobsize to be consistent with controller's
+ * spare_area_size, as the rest is inaccessible.
*/
mtd->oobsize = cfg->spare_area_size * (mtd->writesize >> FC_SHIFT);
+ memorg->oobsize = mtd->oobsize;
cfg->device_size = mtd->size;
cfg->block_size = mtd->erasesize;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 257/406] phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 256/406] mtd: rawnand: brcmnand: Fix mtd oobsize Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 258/406] phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate Greg Kroah-Hartman
` (157 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonas Karlman, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <jonas@kwiboo.se>
[ Upstream commit 644c06dfbd0da713f772abf0a8f8581ac78e6264 ]
inno_hdmi_phy_rk3328_clk_set_rate() is using the RK3228 macro
when configuring vco_div_5 on RK3328.
Fix this by using correct vco_div_5 macro for RK3328.
Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20230615171005.2251032-2-jonas@kwiboo.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
index 9ca20c947283d..b0ac1d3ee3905 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
@@ -790,8 +790,8 @@ static int inno_hdmi_phy_rk3328_clk_set_rate(struct clk_hw *hw,
RK3328_PRE_PLL_POWER_DOWN);
/* Configure pre-pll */
- inno_update_bits(inno, 0xa0, RK3228_PCLK_VCO_DIV_5_MASK,
- RK3228_PCLK_VCO_DIV_5(cfg->vco_div_5_en));
+ inno_update_bits(inno, 0xa0, RK3328_PCLK_VCO_DIV_5_MASK,
+ RK3328_PCLK_VCO_DIV_5(cfg->vco_div_5_en));
inno_write(inno, 0xa1, RK3328_PRE_PLL_PRE_DIV(cfg->prediv));
val = RK3328_SPREAD_SPECTRUM_MOD_DISABLE;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 258/406] phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 257/406] phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 259/406] phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write Greg Kroah-Hartman
` (156 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Yang, Jonas Karlman,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yang <zhengyang@rock-chips.com>
[ Upstream commit d5ef343c1d62bc4c4c2c393af654a41cb34b449f ]
inno_hdmi_phy_rk3328_clk_recalc_rate() is returning a rate not found
in the pre pll config table when the fractal divider is used.
This can prevent proper power_on because a tmdsclock for the new rate
is not found in the pre pll config table.
Fix this by saving and returning a rounded pixel rate that exist
in the pre pll config table.
Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy")
Signed-off-by: Zheng Yang <zhengyang@rock-chips.com>
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20230615171005.2251032-3-jonas@kwiboo.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
index b0ac1d3ee3905..093d2334e8cdc 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
@@ -745,10 +745,12 @@ unsigned long inno_hdmi_phy_rk3328_clk_recalc_rate(struct clk_hw *hw,
do_div(vco, (nd * (no_a == 1 ? no_b : no_a) * no_d * 2));
}
- inno->pixclock = vco;
- dev_dbg(inno->dev, "%s rate %lu\n", __func__, inno->pixclock);
+ inno->pixclock = DIV_ROUND_CLOSEST((unsigned long)vco, 1000) * 1000;
- return vco;
+ dev_dbg(inno->dev, "%s rate %lu vco %llu\n",
+ __func__, inno->pixclock, vco);
+
+ return inno->pixclock;
}
static long inno_hdmi_phy_rk3328_clk_round_rate(struct clk_hw *hw,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 259/406] phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 258/406] phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 260/406] rpmsg: glink: Add check for kstrdup Greg Kroah-Hartman
` (155 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jonas Karlman, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Karlman <jonas@kwiboo.se>
[ Upstream commit 19a1d46bd699940a496d3b0d4e142ef99834988c ]
inno_write is used to configure 0xaa reg, that also hold the
POST_PLL_POWER_DOWN bit.
When POST_PLL_REFCLK_SEL_TMDS is configured the power down bit is not
taken into consideration.
Fix this by keeping the power down bit until configuration is complete.
Also reorder the reg write order for consistency.
Fixes: 53706a116863 ("phy: add Rockchip Innosilicon hdmi phy")
Signed-off-by: Jonas Karlman <jonas@kwiboo.se>
Link: https://lore.kernel.org/r/20230615171005.2251032-5-jonas@kwiboo.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
index 093d2334e8cdc..2b0f5f2b4f339 100644
--- a/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
+++ b/drivers/phy/rockchip/phy-rockchip-inno-hdmi.c
@@ -1023,9 +1023,10 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno,
inno_write(inno, 0xac, RK3328_POST_PLL_FB_DIV_7_0(cfg->fbdiv));
if (cfg->postdiv == 1) {
- inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS);
inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) |
RK3328_POST_PLL_PRE_DIV(cfg->prediv));
+ inno_write(inno, 0xaa, RK3328_POST_PLL_REFCLK_SEL_TMDS |
+ RK3328_POST_PLL_POWER_DOWN);
} else {
v = (cfg->postdiv / 2) - 1;
v &= RK3328_POST_PLL_POST_DIV_MASK;
@@ -1033,7 +1034,8 @@ inno_hdmi_phy_rk3328_power_on(struct inno_hdmi_phy *inno,
inno_write(inno, 0xab, RK3328_POST_PLL_FB_DIV_8(cfg->fbdiv) |
RK3328_POST_PLL_PRE_DIV(cfg->prediv));
inno_write(inno, 0xaa, RK3328_POST_PLL_POST_DIV_ENABLE |
- RK3328_POST_PLL_REFCLK_SEL_TMDS);
+ RK3328_POST_PLL_REFCLK_SEL_TMDS |
+ RK3328_POST_PLL_POWER_DOWN);
}
for (v = 0; v < 14; v++)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 260/406] rpmsg: glink: Add check for kstrdup
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 259/406] phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false Greg Kroah-Hartman
` (154 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiasheng Jiang, Bjorn Andersson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiasheng Jiang <jiasheng@iscas.ac.cn>
[ Upstream commit b5c9ee8296a3760760c7b5d2e305f91412adc795 ]
Add check for the return value of kstrdup() and return the error
if it fails in order to avoid NULL pointer dereference.
Fixes: b4f8e52b89f6 ("rpmsg: Introduce Qualcomm RPM glink driver")
Signed-off-by: Jiasheng Jiang <jiasheng@iscas.ac.cn>
Link: https://lore.kernel.org/r/20230619030631.12361-1-jiasheng@iscas.ac.cn
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/rpmsg/qcom_glink_native.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 98b6d4c09c82c..e776d1bfc9767 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -222,6 +222,10 @@ static struct glink_channel *qcom_glink_alloc_channel(struct qcom_glink *glink,
channel->glink = glink;
channel->name = kstrdup(name, GFP_KERNEL);
+ if (!channel->name) {
+ kfree(channel);
+ return ERR_PTR(-ENOMEM);
+ }
init_completion(&channel->open_req);
init_completion(&channel->open_ack);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 260/406] rpmsg: glink: Add check for kstrdup Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-18 14:00 ` Marek Behún
2023-09-17 19:11 ` [PATCH 5.10 262/406] mtd: spi-nor: Check bus width while setting QE bit Greg Kroah-Hartman
` (153 subsequent siblings)
414 siblings, 1 reply; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Behún, Lee Jones,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Behún <kabel@kernel.org>
[ Upstream commit c3f853184bed04105682383c2971798c572226b5 ]
At the time we call
BUG_ON(props.color == LED_COLOR_ID_MULTI);
the props variable is still initialized to zero.
Call the BUG_ON only after we parse fwnode into props.
Fixes: 77dce3a22e89 ("leds: disallow /sys/class/leds/*:multi:* for now")
Signed-off-by: Marek Behún <kabel@kernel.org>
Link: https://lore.kernel.org/r/20230801151623.30387-1-kabel@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/led-core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
index c4e780bdb3852..2cf5897339ac1 100644
--- a/drivers/leds/led-core.c
+++ b/drivers/leds/led-core.c
@@ -425,15 +425,15 @@ int led_compose_name(struct device *dev, struct led_init_data *init_data,
struct fwnode_handle *fwnode = init_data->fwnode;
const char *devicename = init_data->devicename;
- /* We want to label LEDs that can produce full range of colors
- * as RGB, not multicolor */
- BUG_ON(props.color == LED_COLOR_ID_MULTI);
-
if (!led_classdev_name)
return -EINVAL;
led_parse_fwnode_props(dev, fwnode, &props);
+ /* We want to label LEDs that can produce full range of colors
+ * as RGB, not multicolor */
+ BUG_ON(props.color == LED_COLOR_ID_MULTI);
+
if (props.label) {
/*
* If init_data.devicename is NULL, then it indicates that
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 262/406] mtd: spi-nor: Check bus width while setting QE bit
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 263/406] mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() Greg Kroah-Hartman
` (152 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Walle, Tudor Ambarus,
Hsin-Yi Wang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hsin-Yi Wang <hsinyi@chromium.org>
[ Upstream commit f01d8155a92e33cdaa85d20bfbe6c441907b3c1f ]
spi_nor_write_16bit_sr_and_check() should also check if bus width is
4 before setting QE bit.
Fixes: 39d1e3340c73 ("mtd: spi-nor: Fix clearing of QE bit on lock()/unlock()")
Suggested-by: Michael Walle <michael@walle.cc>
Suggested-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Hsin-Yi Wang <hsinyi@chromium.org>
Reviewed-by: Michael Walle <michael@walle.cc>
Link: https://lore.kernel.org/r/20230818064524.1229100-2-hsinyi@chromium.org
Signed-off-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/spi-nor/core.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/mtd/spi-nor/core.c b/drivers/mtd/spi-nor/core.c
index 3422152319321..09e112f376918 100644
--- a/drivers/mtd/spi-nor/core.c
+++ b/drivers/mtd/spi-nor/core.c
@@ -800,21 +800,22 @@ static int spi_nor_write_16bit_sr_and_check(struct spi_nor *nor, u8 sr1)
ret = spi_nor_read_cr(nor, &sr_cr[1]);
if (ret)
return ret;
- } else if (nor->params->quad_enable) {
+ } else if (spi_nor_get_protocol_width(nor->read_proto) == 4 &&
+ spi_nor_get_protocol_width(nor->write_proto) == 4 &&
+ nor->params->quad_enable) {
/*
* If the Status Register 2 Read command (35h) is not
* supported, we should at least be sure we don't
* change the value of the SR2 Quad Enable bit.
*
- * We can safely assume that when the Quad Enable method is
- * set, the value of the QE bit is one, as a consequence of the
- * nor->params->quad_enable() call.
+ * When the Quad Enable method is set and the buswidth is 4, we
+ * can safely assume that the value of the QE bit is one, as a
+ * consequence of the nor->params->quad_enable() call.
*
- * We can safely assume that the Quad Enable bit is present in
- * the Status Register 2 at BIT(1). According to the JESD216
- * revB standard, BFPT DWORDS[15], bits 22:20, the 16-bit
- * Write Status (01h) command is available just for the cases
- * in which the QE bit is described in SR2 at BIT(1).
+ * According to the JESD216 revB standard, BFPT DWORDS[15],
+ * bits 22:20, the 16-bit Write Status (01h) command is
+ * available just for the cases in which the QE bit is
+ * described in SR2 at BIT(1).
*/
sr_cr[1] = SR2_QUAD_EN_BIT1;
} else {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 263/406] mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 262/406] mtd: spi-nor: Check bus width while setting QE bit Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 264/406] um: Fix hostaudio build errors Greg Kroah-Hartman
` (151 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yi Yang, Miquel Raynal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <yiyang13@huawei.com>
[ Upstream commit a5a88125d00612586e941ae13e7fcf36ba8f18a7 ]
In fsmc_nand_resume(), the return value of clk_prepare_enable() should be
checked since it might fail.
Fixes: e25da1c07dfb ("mtd: fsmc_nand: Add clk_{un}prepare() support")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230817115839.10192-1-yiyang13@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/fsmc_nand.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/fsmc_nand.c b/drivers/mtd/nand/raw/fsmc_nand.c
index 663ff5300ad99..3da66e95e5b7e 100644
--- a/drivers/mtd/nand/raw/fsmc_nand.c
+++ b/drivers/mtd/nand/raw/fsmc_nand.c
@@ -1190,9 +1190,14 @@ static int fsmc_nand_suspend(struct device *dev)
static int fsmc_nand_resume(struct device *dev)
{
struct fsmc_nand_data *host = dev_get_drvdata(dev);
+ int ret;
if (host) {
- clk_prepare_enable(host->clk);
+ ret = clk_prepare_enable(host->clk);
+ if (ret) {
+ dev_err(dev, "failed to enable clk\n");
+ return ret;
+ }
if (host->dev_timings)
fsmc_nand_setup(host, host->dev_timings);
nand_reset(&host->nand, 0);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 264/406] um: Fix hostaudio build errors
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 263/406] mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 265/406] dmaengine: ste_dma40: Add missing IRQ check in d40_probe Greg Kroah-Hartman
` (150 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, kernel test robot,
Richard Weinberger, Anton Ivanov, Johannes Berg, linux-um,
Tejun Heo, Takashi Iwai, Jaroslav Kysela, Masahiro Yamada,
Nathan Chancellor, Nick Desaulniers, Nicolas Schier, linux-kbuild,
alsa-devel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit db4bfcba7bb8d10f00bba2a3da6b9a9c2a1d7b71 ]
Use "select" to ensure that the required kconfig symbols are set
as expected.
Drop HOSTAUDIO since it is now equivalent to UML_SOUND.
Set CONFIG_SOUND=m in ARCH=um defconfig files to maintain the
status quo of the default configs.
Allow SOUND with UML regardless of HAS_IOMEM. Otherwise there is a
kconfig warning for unmet dependencies. (This was not an issue when
SOUND was defined in arch/um/drivers/Kconfig. I have done 50 randconfig
builds and didn't find any issues.)
This fixes build errors when CONFIG_SOUND is not set:
ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_cleanup_module':
hostaudio_kern.c:(.exit.text+0xa): undefined reference to `unregister_sound_mixer'
ld: hostaudio_kern.c:(.exit.text+0x15): undefined reference to `unregister_sound_dsp'
ld: arch/um/drivers/hostaudio_kern.o: in function `hostaudio_init_module':
hostaudio_kern.c:(.init.text+0x19): undefined reference to `register_sound_dsp'
ld: hostaudio_kern.c:(.init.text+0x31): undefined reference to `register_sound_mixer'
ld: hostaudio_kern.c:(.init.text+0x49): undefined reference to `unregister_sound_dsp'
and this kconfig warning:
WARNING: unmet direct dependencies detected for SOUND
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: d886e87cb82b ("sound: make OSS sound core optional")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Closes: lore.kernel.org/r/202307141416.vxuRVpFv-lkp@intel.com
Cc: Richard Weinberger <richard@nod.at>
Cc: Anton Ivanov <anton.ivanov@cambridgegreys.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: linux-um@lists.infradead.org
Cc: Tejun Heo <tj@kernel.org>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Jaroslav Kysela <perex@perex.cz>
Cc: Masahiro Yamada <masahiroy@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Nick Desaulniers <ndesaulniers@google.com>
Cc: Nicolas Schier <nicolas@fjasle.eu>
Cc: linux-kbuild@vger.kernel.org
Cc: alsa-devel@alsa-project.org
Reviewed-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/configs/i386_defconfig | 1 +
arch/um/configs/x86_64_defconfig | 1 +
arch/um/drivers/Kconfig | 16 +++-------------
arch/um/drivers/Makefile | 2 +-
sound/Kconfig | 2 +-
5 files changed, 7 insertions(+), 15 deletions(-)
diff --git a/arch/um/configs/i386_defconfig b/arch/um/configs/i386_defconfig
index fb51bd206dbed..4d7f99a02c1eb 100644
--- a/arch/um/configs/i386_defconfig
+++ b/arch/um/configs/i386_defconfig
@@ -35,6 +35,7 @@ CONFIG_TTY_CHAN=y
CONFIG_XTERM_CHAN=y
CONFIG_CON_CHAN="pts"
CONFIG_SSL_CHAN="pts"
+CONFIG_SOUND=m
CONFIG_UML_SOUND=m
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
diff --git a/arch/um/configs/x86_64_defconfig b/arch/um/configs/x86_64_defconfig
index 477b873174243..4bdd83008f623 100644
--- a/arch/um/configs/x86_64_defconfig
+++ b/arch/um/configs/x86_64_defconfig
@@ -33,6 +33,7 @@ CONFIG_TTY_CHAN=y
CONFIG_XTERM_CHAN=y
CONFIG_CON_CHAN="pts"
CONFIG_SSL_CHAN="pts"
+CONFIG_SOUND=m
CONFIG_UML_SOUND=m
CONFIG_DEVTMPFS=y
CONFIG_DEVTMPFS_MOUNT=y
diff --git a/arch/um/drivers/Kconfig b/arch/um/drivers/Kconfig
index 2e7b8e0e7194b..01dfbd57e29d7 100644
--- a/arch/um/drivers/Kconfig
+++ b/arch/um/drivers/Kconfig
@@ -104,24 +104,14 @@ config SSL_CHAN
config UML_SOUND
tristate "Sound support"
+ depends on SOUND
+ select SOUND_OSS_CORE
help
This option enables UML sound support. If enabled, it will pull in
- soundcore and the UML hostaudio relay, which acts as a intermediary
+ the UML hostaudio relay, which acts as a intermediary
between the host's dsp and mixer devices and the UML sound system.
It is safe to say 'Y' here.
-config SOUND
- tristate
- default UML_SOUND
-
-config SOUND_OSS_CORE
- bool
- default UML_SOUND
-
-config HOSTAUDIO
- tristate
- default UML_SOUND
-
endmenu
menu "UML Network Devices"
diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile
index 2a249f6194671..207d62ab519df 100644
--- a/arch/um/drivers/Makefile
+++ b/arch/um/drivers/Makefile
@@ -52,7 +52,7 @@ obj-$(CONFIG_UML_NET) += net.o
obj-$(CONFIG_MCONSOLE) += mconsole.o
obj-$(CONFIG_MMAPPER) += mmapper_kern.o
obj-$(CONFIG_BLK_DEV_UBD) += ubd.o
-obj-$(CONFIG_HOSTAUDIO) += hostaudio.o
+obj-$(CONFIG_UML_SOUND) += hostaudio.o
obj-$(CONFIG_NULL_CHAN) += null.o
obj-$(CONFIG_PORT_CHAN) += port.o
obj-$(CONFIG_PTY_CHAN) += pty.o
diff --git a/sound/Kconfig b/sound/Kconfig
index 36785410fbe15..aaf2022ffc57d 100644
--- a/sound/Kconfig
+++ b/sound/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
menuconfig SOUND
tristate "Sound card support"
- depends on HAS_IOMEM
+ depends on HAS_IOMEM || UML
help
If you have a sound card in your computer, i.e. if it can say more
than an occasional beep, say Y.
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 265/406] dmaengine: ste_dma40: Add missing IRQ check in d40_probe
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 264/406] um: Fix hostaudio build errors Greg Kroah-Hartman
@ 2023-09-17 19:11 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 266/406] cpufreq: Fix the race condition while updating the transition_task of policy Greg Kroah-Hartman
` (149 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ruan Jinjie, Linus Walleij,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ruanjinjie <ruanjinjie@huawei.com>
[ Upstream commit c05ce6907b3d6e148b70f0bb5eafd61dcef1ddc1 ]
Check for the return value of platform_get_irq(): if no interrupt
is specified, it wouldn't make sense to call request_irq().
Fixes: 8d318a50b3d7 ("DMAENGINE: Support for ST-Ericssons DMA40 block v3")
Signed-off-by: Ruan Jinjie <ruanjinjie@huawei.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230724144108.2582917-1-ruanjinjie@huawei.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/ste_dma40.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/dma/ste_dma40.c b/drivers/dma/ste_dma40.c
index b35b97cb8fd25..d99fec8215083 100644
--- a/drivers/dma/ste_dma40.c
+++ b/drivers/dma/ste_dma40.c
@@ -3598,6 +3598,10 @@ static int __init d40_probe(struct platform_device *pdev)
spin_lock_init(&base->lcla_pool.lock);
base->irq = platform_get_irq(pdev, 0);
+ if (base->irq < 0) {
+ ret = base->irq;
+ goto destroy_cache;
+ }
ret = request_irq(base->irq, d40_handle_interrupt, 0, D40_NAME, base);
if (ret) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 266/406] cpufreq: Fix the race condition while updating the transition_task of policy
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2023-09-17 19:11 ` [PATCH 5.10 265/406] dmaengine: ste_dma40: Add missing IRQ check in d40_probe Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 267/406] virtio_ring: fix avail_wrap_counter in virtqueue_add_packed Greg Kroah-Hartman
` (148 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liao Chang, Viresh Kumar,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liao Chang <liaochang1@huawei.com>
[ Upstream commit 61bfbf7951ba561dcbdd5357702d3cbc2d447812 ]
The field 'transition_task' of policy structure is used to track the
task which is performing the frequency transition. Using this field to
print a warning once detect a case where the same task is calling
_begin() again before completing the preivous frequency transition via
the _end().
However, there is a potential race condition in _end() and _begin() APIs
while updating the field 'transition_task' of policy, the scenario is
depicted below:
Task A Task B
/* 1st freq transition */
Invoke _begin() {
...
...
}
/* 2nd freq transition */
Invoke _begin() {
... //waiting for A to
... //clear
... //transition_ongoing
... //in _end() for
... //the 1st transition
|
Change the frequency |
|
Invoke _end() { |
... |
... |
transition_ongoing = false; V
transition_ongoing = true;
transition_task = current;
transition_task = NULL;
... //A overwrites the task
... //performing the transition
... //result in error warning.
}
To fix this race condition, the transition_lock of policy structure is
now acquired before updating policy structure in _end() API. Which ensure
that only one task can update the 'transition_task' field at a time.
Link: https://lore.kernel.org/all/b3c61d8a-d52d-3136-fbf0-d1de9f1ba411@huawei.com/
Fixes: ca654dc3a93d ("cpufreq: Catch double invocations of cpufreq_freq_transition_begin/end")
Signed-off-by: Liao Chang <liaochang1@huawei.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
index 58342390966b7..5b4bca71f201d 100644
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -450,8 +450,10 @@ void cpufreq_freq_transition_end(struct cpufreq_policy *policy,
policy->cur,
policy->cpuinfo.max_freq);
+ spin_lock(&policy->transition_lock);
policy->transition_ongoing = false;
policy->transition_task = NULL;
+ spin_unlock(&policy->transition_lock);
wake_up(&policy->transition_wait);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 267/406] virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 266/406] cpufreq: Fix the race condition while updating the transition_task of policy Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 268/406] igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU Greg Kroah-Hartman
` (147 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Yao, Jason Wang,
Michael S. Tsirkin, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Yao <yuanyaogoog@chromium.org>
[ Upstream commit 1acfe2c1225899eab5ab724c91b7e1eb2881b9ab ]
In current packed virtqueue implementation, the avail_wrap_counter won't
flip, in the case when the driver supplies a descriptor chain with a
length equals to the queue size; total_sg == vq->packed.vring.num.
Let’s assume the following situation:
vq->packed.vring.num=4
vq->packed.next_avail_idx: 1
vq->packed.avail_wrap_counter: 0
Then the driver adds a descriptor chain containing 4 descriptors.
We expect the following result with avail_wrap_counter flipped:
vq->packed.next_avail_idx: 1
vq->packed.avail_wrap_counter: 1
But, the current implementation gives the following result:
vq->packed.next_avail_idx: 1
vq->packed.avail_wrap_counter: 0
To reproduce the bug, you can set a packed queue size as small as
possible, so that the driver is more likely to provide a descriptor
chain with a length equal to the packed queue size. For example, in
qemu run following commands:
sudo qemu-system-x86_64 \
-enable-kvm \
-nographic \
-kernel "path/to/kernel_image" \
-m 1G \
-drive file="path/to/rootfs",if=none,id=disk \
-device virtio-blk,drive=disk \
-drive file="path/to/disk_image",if=none,id=rwdisk \
-device virtio-blk,drive=rwdisk,packed=on,queue-size=4,\
indirect_desc=off \
-append "console=ttyS0 root=/dev/vda rw init=/bin/bash"
Inside the VM, create a directory and mount the rwdisk device on it. The
rwdisk will hang and mount operation will not complete.
This commit fixes the wrap counter error by flipping the
packed.avail_wrap_counter, when start of descriptor chain equals to the
end of descriptor chain (head == i).
Fixes: 1ce9e6055fa0 ("virtio_ring: introduce packed ring support")
Signed-off-by: Yuan Yao <yuanyaogoog@chromium.org>
Message-Id: <20230808051110.3492693-1-yuanyaogoog@chromium.org>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/virtio/virtio_ring.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c
index 3cc2a4ee7152c..cf0e8e1893ee6 100644
--- a/drivers/virtio/virtio_ring.c
+++ b/drivers/virtio/virtio_ring.c
@@ -1190,7 +1190,7 @@ static inline int virtqueue_add_packed(struct virtqueue *_vq,
}
}
- if (i < head)
+ if (i <= head)
vq->packed.avail_wrap_counter ^= 1;
/* We're using some buffers from the free list. */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 268/406] igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 267/406] virtio_ring: fix avail_wrap_counter in virtqueue_add_packed Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 269/406] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c Greg Kroah-Hartman
` (146 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, David Laight,
Kyle Zeng, Simon Horman, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit c3b704d4a4a265660e665df51b129e8425216ed1 upstream.
This is a follow up of commit 915d975b2ffa ("net: deal with integer
overflows in kmalloc_reserve()") based on David Laight feedback.
Back in 2010, I failed to realize malicious users could set dev->mtu
to arbitrary values. This mtu has been since limited to 0x7fffffff but
regardless of how big dev->mtu is, it makes no sense for igmpv3_newpack()
to allocate more than IP_MAX_MTU and risk various skb fields overflows.
Fixes: 57e1ab6eaddc ("igmp: refine skb allocations")
Link: https://lore.kernel.org/netdev/d273628df80f45428e739274ab9ecb72@AcuMS.aculab.com/
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: David Laight <David.Laight@ACULAB.COM>
Cc: Kyle Zeng <zengyhkyle@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/igmp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -353,8 +353,9 @@ static struct sk_buff *igmpv3_newpack(st
struct flowi4 fl4;
int hlen = LL_RESERVED_SPACE(dev);
int tlen = dev->needed_tailroom;
- unsigned int size = mtu;
+ unsigned int size;
+ size = min(mtu, IP_MAX_MTU);
while (1) {
skb = alloc_skb(size + hlen + tlen,
GFP_ATOMIC | __GFP_NOWARN);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 269/406] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 268/406] igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 270/406] netfilter: xt_u32: validate user space input Greg Kroah-Hartman
` (145 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jozsef Kadlecsik, Kyle Zeng,
Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kyle Zeng <zengyhkyle@gmail.com>
commit 050d91c03b28ca479df13dfb02bcd2c60dd6a878 upstream.
The missing IP_SET_HASH_WITH_NET0 macro in ip_set_hash_netportnet can
lead to the use of wrong `CIDR_POS(c)` for calculating array offsets,
which can lead to integer underflow. As a result, it leads to slab
out-of-bound access.
This patch adds back the IP_SET_HASH_WITH_NET0 macro to
ip_set_hash_netportnet to address the issue.
Fixes: 886503f34d63 ("netfilter: ipset: actually allow allowable CIDR 0 in hash:net,port,net")
Suggested-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Kyle Zeng <zengyhkyle@gmail.com>
Acked-by: Jozsef Kadlecsik <kadlec@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipset/ip_set_hash_netportnet.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -35,6 +35,7 @@ MODULE_ALIAS("ip_set_hash:net,port,net")
#define IP_SET_HASH_WITH_PROTO
#define IP_SET_HASH_WITH_NETS
#define IPSET_NET_COUNT 2
+#define IP_SET_HASH_WITH_NET0
/* IPv4 variant */
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 270/406] netfilter: xt_u32: validate user space input
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 269/406] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 271/406] netfilter: xt_sctp: validate the flag_info count Greg Kroah-Hartman
` (144 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wander Lairson Costa,
Pablo Neira Ayuso
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <wander@redhat.com>
commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 upstream.
The xt_u32 module doesn't validate the fields in the xt_u32 structure.
An attacker may take advantage of this to trigger an OOB read by setting
the size fields with a value beyond the arrays boundaries.
Add a checkentry function to validate the structure.
This was originally reported by the ZDI project (ZDI-CAN-18408).
Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match")
Cc: stable@vger.kernel.org
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_u32.c | 21 +++++++++++++++++++++
1 file changed, 21 insertions(+)
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff
return ret ^ data->invert;
}
+static int u32_mt_checkentry(const struct xt_mtchk_param *par)
+{
+ const struct xt_u32 *data = par->matchinfo;
+ const struct xt_u32_test *ct;
+ unsigned int i;
+
+ if (data->ntests > ARRAY_SIZE(data->tests))
+ return -EINVAL;
+
+ for (i = 0; i < data->ntests; ++i) {
+ ct = &data->tests[i];
+
+ if (ct->nnums > ARRAY_SIZE(ct->location) ||
+ ct->nvalues > ARRAY_SIZE(ct->value))
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static struct xt_match xt_u32_mt_reg __read_mostly = {
.name = "u32",
.revision = 0,
.family = NFPROTO_UNSPEC,
.match = u32_mt,
+ .checkentry = u32_mt_checkentry,
.matchsize = sizeof(struct xt_u32),
.me = THIS_MODULE,
};
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 271/406] netfilter: xt_sctp: validate the flag_info count
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 270/406] netfilter: xt_u32: validate user space input Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 272/406] skbuff: skb_segment, Call zero copy functions before using skbuff frags Greg Kroah-Hartman
` (143 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Leong, Wander Lairson Costa,
Pablo Neira Ayuso
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <wander@redhat.com>
commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream.
sctp_mt_check doesn't validate the flag_count field. An attacker can
take advantage of that to trigger a OOB read and leak memory
information.
Add the field validation in the checkentry function.
Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables")
Cc: stable@vger.kernel.org
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/xt_sctp.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -150,6 +150,8 @@ static int sctp_mt_check(const struct xt
{
const struct xt_sctp_info *info = par->matchinfo;
+ if (info->flag_count > ARRAY_SIZE(info->flag_info))
+ return -EINVAL;
if (info->flags & ~XT_SCTP_VALID_FLAGS)
return -EINVAL;
if (info->invflags & ~XT_SCTP_VALID_FLAGS)
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 272/406] skbuff: skb_segment, Call zero copy functions before using skbuff frags
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 271/406] netfilter: xt_sctp: validate the flag_info count Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 273/406] igb: set max size RX buffer when store bad packet is enabled Greg Kroah-Hartman
` (142 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mohamed Khalfella, Amit Goyal,
Eric Dumazet, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mohamed Khalfella <mkhalfella@purestorage.com>
commit 2ea35288c83b3d501a88bc17f2df8f176b5cc96f upstream.
Commit bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions
once per nskb") added the call to zero copy functions in skb_segment().
The change introduced a bug in skb_segment() because skb_orphan_frags()
may possibly change the number of fragments or allocate new fragments
altogether leaving nrfrags and frag to point to the old values. This can
cause a panic with stacktrace like the one below.
[ 193.894380] BUG: kernel NULL pointer dereference, address: 00000000000000bc
[ 193.895273] CPU: 13 PID: 18164 Comm: vh-net-17428 Kdump: loaded Tainted: G O 5.15.123+ #26
[ 193.903919] RIP: 0010:skb_segment+0xb0e/0x12f0
[ 194.021892] Call Trace:
[ 194.027422] <TASK>
[ 194.072861] tcp_gso_segment+0x107/0x540
[ 194.082031] inet_gso_segment+0x15c/0x3d0
[ 194.090783] skb_mac_gso_segment+0x9f/0x110
[ 194.095016] __skb_gso_segment+0xc1/0x190
[ 194.103131] netem_enqueue+0x290/0xb10 [sch_netem]
[ 194.107071] dev_qdisc_enqueue+0x16/0x70
[ 194.110884] __dev_queue_xmit+0x63b/0xb30
[ 194.121670] bond_start_xmit+0x159/0x380 [bonding]
[ 194.128506] dev_hard_start_xmit+0xc3/0x1e0
[ 194.131787] __dev_queue_xmit+0x8a0/0xb30
[ 194.138225] macvlan_start_xmit+0x4f/0x100 [macvlan]
[ 194.141477] dev_hard_start_xmit+0xc3/0x1e0
[ 194.144622] sch_direct_xmit+0xe3/0x280
[ 194.147748] __dev_queue_xmit+0x54a/0xb30
[ 194.154131] tap_get_user+0x2a8/0x9c0 [tap]
[ 194.157358] tap_sendmsg+0x52/0x8e0 [tap]
[ 194.167049] handle_tx_zerocopy+0x14e/0x4c0 [vhost_net]
[ 194.173631] handle_tx+0xcd/0xe0 [vhost_net]
[ 194.176959] vhost_worker+0x76/0xb0 [vhost]
[ 194.183667] kthread+0x118/0x140
[ 194.190358] ret_from_fork+0x1f/0x30
[ 194.193670] </TASK>
In this case calling skb_orphan_frags() updated nr_frags leaving nrfrags
local variable in skb_segment() stale. This resulted in the code hitting
i >= nrfrags prematurely and trying to move to next frag_skb using
list_skb pointer, which was NULL, and caused kernel panic. Move the call
to zero copy functions before using frags and nr_frags.
Fixes: bf5c25d60861 ("skbuff: in skb_segment, call zerocopy functions once per nskb")
Signed-off-by: Mohamed Khalfella <mkhalfella@purestorage.com>
Reported-by: Amit Goyal <agoyal@purestorage.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 34 ++++++++++++++++++++--------------
1 file changed, 20 insertions(+), 14 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3799,21 +3799,20 @@ struct sk_buff *skb_segment(struct sk_bu
struct sk_buff *segs = NULL;
struct sk_buff *tail = NULL;
struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
- skb_frag_t *frag = skb_shinfo(head_skb)->frags;
unsigned int mss = skb_shinfo(head_skb)->gso_size;
unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
- struct sk_buff *frag_skb = head_skb;
unsigned int offset = doffset;
unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
unsigned int partial_segs = 0;
unsigned int headroom;
unsigned int len = head_skb->len;
+ struct sk_buff *frag_skb;
+ skb_frag_t *frag;
__be16 proto;
bool csum, sg;
- int nfrags = skb_shinfo(head_skb)->nr_frags;
int err = -ENOMEM;
int i = 0;
- int pos;
+ int nfrags, pos;
if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) &&
mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) {
@@ -3890,6 +3889,13 @@ normal:
headroom = skb_headroom(head_skb);
pos = skb_headlen(head_skb);
+ if (skb_orphan_frags(head_skb, GFP_ATOMIC))
+ return ERR_PTR(-ENOMEM);
+
+ nfrags = skb_shinfo(head_skb)->nr_frags;
+ frag = skb_shinfo(head_skb)->frags;
+ frag_skb = head_skb;
+
do {
struct sk_buff *nskb;
skb_frag_t *nskb_frag;
@@ -3914,6 +3920,10 @@ normal:
(skb_headlen(list_skb) == len || sg)) {
BUG_ON(skb_headlen(list_skb) > len);
+ nskb = skb_clone(list_skb, GFP_ATOMIC);
+ if (unlikely(!nskb))
+ goto err;
+
i = 0;
nfrags = skb_shinfo(list_skb)->nr_frags;
frag = skb_shinfo(list_skb)->frags;
@@ -3932,12 +3942,8 @@ normal:
frag++;
}
- nskb = skb_clone(list_skb, GFP_ATOMIC);
list_skb = list_skb->next;
- if (unlikely(!nskb))
- goto err;
-
if (unlikely(pskb_trim(nskb, len))) {
kfree_skb(nskb);
goto err;
@@ -4008,12 +4014,16 @@ normal:
skb_shinfo(nskb)->tx_flags |= skb_shinfo(head_skb)->tx_flags &
SKBTX_SHARED_FRAG;
- if (skb_orphan_frags(frag_skb, GFP_ATOMIC) ||
- skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
+ if (skb_zerocopy_clone(nskb, frag_skb, GFP_ATOMIC))
goto err;
while (pos < offset + len) {
if (i >= nfrags) {
+ if (skb_orphan_frags(list_skb, GFP_ATOMIC) ||
+ skb_zerocopy_clone(nskb, list_skb,
+ GFP_ATOMIC))
+ goto err;
+
i = 0;
nfrags = skb_shinfo(list_skb)->nr_frags;
frag = skb_shinfo(list_skb)->frags;
@@ -4027,10 +4037,6 @@ normal:
i--;
frag--;
}
- if (skb_orphan_frags(frag_skb, GFP_ATOMIC) ||
- skb_zerocopy_clone(nskb, frag_skb,
- GFP_ATOMIC))
- goto err;
list_skb = list_skb->next;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 273/406] igb: set max size RX buffer when store bad packet is enabled
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 272/406] skbuff: skb_segment, Call zero copy functions before using skbuff frags Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 274/406] PM / devfreq: Fix leak in devfreq_dev_release() Greg Kroah-Hartman
` (141 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manfred Rudigier, Radoslaw Tyl,
Tony Nguyen, David S. Miller, Arpana Arland
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radoslaw Tyl <radoslawx.tyl@intel.com>
commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f upstream.
Increase the RX buffer size to 3K when the SBP bit is on. The size of
the RX buffer determines the number of pages allocated which may not
be sufficient for receive frames larger than the set MTU size.
Cc: stable@vger.kernel.org
Fixes: 89eaefb61dc9 ("igb: Support RX-ALL feature flag.")
Reported-by: Manfred Rudigier <manfred.rudigier@omicronenergy.com>
Signed-off-by: Radoslaw Tyl <radoslawx.tyl@intel.com>
Tested-by: Arpana Arland <arpanax.arland@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -4731,6 +4731,10 @@ void igb_configure_rx_ring(struct igb_ad
static void igb_set_rx_buffer_len(struct igb_adapter *adapter,
struct igb_ring *rx_ring)
{
+#if (PAGE_SIZE < 8192)
+ struct e1000_hw *hw = &adapter->hw;
+#endif
+
/* set build_skb and buffer size flags */
clear_ring_build_skb_enabled(rx_ring);
clear_ring_uses_large_buffer(rx_ring);
@@ -4741,10 +4745,9 @@ static void igb_set_rx_buffer_len(struct
set_ring_build_skb_enabled(rx_ring);
#if (PAGE_SIZE < 8192)
- if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB)
- return;
-
- set_ring_uses_large_buffer(rx_ring);
+ if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB ||
+ rd32(E1000_RCTL) & E1000_RCTL_SBP)
+ set_ring_uses_large_buffer(rx_ring);
#endif
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 274/406] PM / devfreq: Fix leak in devfreq_dev_release()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 273/406] igb: set max size RX buffer when store bad packet is enabled Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 275/406] ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl Greg Kroah-Hartman
` (140 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Brezillon, Dhruva Gole,
Chanwoo Choi
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@collabora.com>
commit 5693d077595de721f9ddbf9d37f40e5409707dfe upstream.
srcu_init_notifier_head() allocates resources that need to be released
with a srcu_cleanup_notifier_head() call.
Reported by kmemleak.
Fixes: 0fe3a66410a3 ("PM / devfreq: Add new DEVFREQ_TRANSITION_NOTIFIER notifier")
Cc: <stable@vger.kernel.org>
Signed-off-by: Boris Brezillon <boris.brezillon@collabora.com>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/devfreq/devfreq.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -732,6 +732,7 @@ static void devfreq_dev_release(struct d
devfreq->profile->exit(devfreq->dev.parent);
mutex_destroy(&devfreq->lock);
+ srcu_cleanup_notifier_head(&devfreq->transition_notifier_list);
kfree(devfreq);
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 275/406] ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 274/406] PM / devfreq: Fix leak in devfreq_dev_release() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 276/406] printk: ringbuffer: Fix truncating buffer size min_t cast Greg Kroah-Hartman
` (139 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Meng_Cai, Takashi Sakamoto,
Jaroslav Kysela, Takashi Iwai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit 358040e3807754944dbddf948a23c6d914297ed7 upstream.
The update of rate_num/den and msbits were factored out to
fixup_unreferenced_params() function to be called explicitly after the
hw_refine or hw_params procedure. It's called from
snd_pcm_hw_refine_user(), but it's forgotten in the PCM compat ioctl.
This ended up with the incomplete rate_num/den and msbits parameters
when 32bit compat ioctl is used.
This patch adds the missing call in snd_pcm_ioctl_hw_params_compat().
Reported-by: Meng_Cai@novatek.com.cn
Fixes: f9a076bff053 ("ALSA: pcm: calculate non-mask/non-interval parameters always when possible")
Reviewed-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Reviewed-by: Jaroslav Kysela <perex@perex.cz>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230829134344.31588-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/core/pcm_compat.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/sound/core/pcm_compat.c
+++ b/sound/core/pcm_compat.c
@@ -252,10 +252,14 @@ static int snd_pcm_ioctl_hw_params_compa
goto error;
}
- if (refine)
+ if (refine) {
err = snd_pcm_hw_refine(substream, data);
- else
+ if (err < 0)
+ goto error;
+ err = fixup_unreferenced_params(substream, data);
+ } else {
err = snd_pcm_hw_params(substream, data);
+ }
if (err < 0)
goto error;
if (copy_to_user(data32, data, sizeof(*data32)) ||
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 276/406] printk: ringbuffer: Fix truncating buffer size min_t cast
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 275/406] ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 277/406] scsi: core: Fix the scsi_set_resid() documentation Greg Kroah-Hartman
` (138 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Mladek, Sergey Senozhatsky,
Steven Rostedt, John Ogness, Vijay Balakrishna, Kees Cook,
Tyler Hicks (Microsoft), Guilherme G . Piccoli
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit 53e9e33ede37a247d926db5e4a9e56b55204e66c upstream.
If an output buffer size exceeded U16_MAX, the min_t(u16, ...) cast in
copy_data() was causing writes to truncate. This manifested as output
bytes being skipped, seen as %NUL bytes in pstore dumps when the available
record size was larger than 65536. Fix the cast to no longer truncate
the calculation.
Cc: Petr Mladek <pmladek@suse.com>
Cc: Sergey Senozhatsky <senozhatsky@chromium.org>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: John Ogness <john.ogness@linutronix.de>
Reported-by: Vijay Balakrishna <vijayb@linux.microsoft.com>
Link: https://lore.kernel.org/lkml/d8bb1ec7-a4c5-43a2-9de0-9643a70b899f@linux.microsoft.com/
Fixes: b6cf8b3f3312 ("printk: add lockless ringbuffer")
Cc: stable@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Vijay Balakrishna <vijayb@linux.microsoft.com>
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com> # Steam Deck
Reviewed-by: Tyler Hicks (Microsoft) <code@tyhicks.com>
Tested-by: Tyler Hicks (Microsoft) <code@tyhicks.com>
Reviewed-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20230811054528.never.165-kees@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/printk/printk_ringbuffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/printk/printk_ringbuffer.c
+++ b/kernel/printk/printk_ringbuffer.c
@@ -1726,7 +1726,7 @@ static bool copy_data(struct prb_data_ri
if (!buf || !buf_size)
return true;
- data_size = min_t(u16, buf_size, len);
+ data_size = min_t(unsigned int, buf_size, len);
memcpy(&buf[0], data, data_size); /* LMM(copy_data:A) */
return true;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 277/406] scsi: core: Fix the scsi_set_resid() documentation
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 276/406] printk: ringbuffer: Fix truncating buffer size min_t cast Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 278/406] ipmi_si: fix a memleak in try_smi_init() Greg Kroah-Hartman
` (137 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Hannes Reinecke,
Douglas Gilbert, Bart Van Assche, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit f669b8a683e4ee26fa5cafe19d71cec1786b556a upstream.
Because scsi_finish_command() subtracts the residual from the buffer
length, residual overflows must not be reported. Reflect this in the SCSI
documentation. See also commit 9237f04e12cc ("scsi: core: Fix
scsi_get/set_resid() interface")
Cc: Damien Le Moal <dlemoal@kernel.org>
Cc: Hannes Reinecke <hare@suse.de>
Cc: Douglas Gilbert <dgilbert@interlog.com>
Cc: stable@vger.kernel.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230721160154.874010-2-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/scsi/scsi_mid_low_api.rst | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/Documentation/scsi/scsi_mid_low_api.rst
+++ b/Documentation/scsi/scsi_mid_low_api.rst
@@ -1195,11 +1195,11 @@ Members of interest:
- pointer to scsi_device object that this command is
associated with.
resid
- - an LLD should set this signed integer to the requested
+ - an LLD should set this unsigned integer to the requested
transfer length (i.e. 'request_bufflen') less the number
of bytes that are actually transferred. 'resid' is
preset to 0 so an LLD can ignore it if it cannot detect
- underruns (overruns should be rare). If possible an LLD
+ underruns (overruns should not be reported). An LLD
should set 'resid' prior to invoking 'done'. The most
interesting case is data transfers from a SCSI target
device (e.g. READs) that underrun.
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 278/406] ipmi_si: fix a memleak in try_smi_init()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 277/406] scsi: core: Fix the scsi_set_resid() documentation Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 279/406] ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() Greg Kroah-Hartman
` (136 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Yang, GONG, Ruiqi, Corey Minyard,
GONG
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yi Yang <yiyang13@huawei.com>
commit 6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f upstream.
Kmemleak reported the following leak info in try_smi_init():
unreferenced object 0xffff00018ecf9400 (size 1024):
comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s)
backtrace:
[<000000004ca5b312>] __kmalloc+0x4b8/0x7b0
[<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si]
[<000000006460d325>] 0xffff800081b10148
[<0000000039206ea5>] do_one_initcall+0x64/0x2a4
[<00000000601399ce>] do_init_module+0x50/0x300
[<000000003c12ba3c>] load_module+0x7a8/0x9e0
[<00000000c246fffe>] __se_sys_init_module+0x104/0x180
[<00000000eea99093>] __arm64_sys_init_module+0x24/0x30
[<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250
[<0000000070f4f8b7>] do_el0_svc+0x48/0xe0
[<000000005a05337f>] el0_svc+0x24/0x3c
[<000000005eb248d6>] el0_sync_handler+0x160/0x164
[<0000000030a59039>] el0_sync+0x160/0x180
The problem was that when an error occurred before handlers registration
and after allocating `new_smi->si_sm`, the variable wouldn't be freed in
the error handling afterwards since `shutdown_smi()` hadn't been
registered yet. Fix it by adding a `kfree()` in the error handling path
in `try_smi_init()`.
Cc: stable@vger.kernel.org # 4.19+
Fixes: 7960f18a5647 ("ipmi_si: Convert over to a shutdown handler")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: GONG, Ruiqi <gongruiqi@huaweicloud.com>
Signed-off-by: GONG, Ruiqi <gongruiqi@huaweicloud.com>
Message-Id: <20230629123328.2402075-1-gongruiqi@huaweicloud.com>
Signed-off-by: Corey Minyard <minyard@acm.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/ipmi/ipmi_si_intf.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/char/ipmi/ipmi_si_intf.c
+++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -2089,6 +2089,11 @@ static int try_smi_init(struct smi_info
new_smi->io.io_cleanup = NULL;
}
+ if (rv && new_smi->si_sm) {
+ kfree(new_smi->si_sm);
+ new_smi->si_sm = NULL;
+ }
+
return rv;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 279/406] ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 278/406] ipmi_si: fix a memleak in try_smi_init() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 280/406] backlight/gpio_backlight: Compare against struct fb_info.device Greg Kroah-Hartman
` (135 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot,
Gustavo A. R. Silva, Ard Biesheuvel, Tony Lindgren
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <gustavoars@kernel.org>
commit 847fb80cc01a54bc827b02547bb8743bdb59ddab upstream.
If function pwrdm_read_prev_pwrst() returns -EINVAL, we will end
up accessing array pwrdm->state_counter through negative index
-22. This is wrong and the compiler is legitimately warning us
about this potential problem.
Fix this by sanity checking the value stored in variable _prev_
before accessing array pwrdm->state_counter.
Address the following -Warray-bounds warning:
arch/arm/mach-omap2/powerdomain.c:178:45: warning: array subscript -22 is below array bounds of 'unsigned int[4]' [-Warray-bounds]
Link: https://github.com/KSPP/linux/issues/307
Fixes: ba20bb126940 ("OMAP: PM counter infrastructure.")
Cc: stable@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/20230607050639.LzbPn%25lkp@intel.com/
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Message-ID: <ZIFVGwImU3kpaGeH@work>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mach-omap2/powerdomain.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mach-omap2/powerdomain.c
+++ b/arch/arm/mach-omap2/powerdomain.c
@@ -174,7 +174,7 @@ static int _pwrdm_state_switch(struct po
break;
case PWRDM_STATE_PREV:
prev = pwrdm_read_prev_pwrst(pwrdm);
- if (pwrdm->state != prev)
+ if (prev >= 0 && pwrdm->state != prev)
pwrdm->state_counter[prev]++;
if (prev == PWRDM_POWER_RET)
_update_logic_membank_counters(pwrdm);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 280/406] backlight/gpio_backlight: Compare against struct fb_info.device
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 279/406] ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 281/406] backlight/bd6107: " Greg Kroah-Hartman
` (134 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Laurent Pinchart,
Rich Felker, John Paul Adrian Glaubitz, Lee Jones,
Daniel Thompson, Jingoo Han, linux-sh, dri-devel, Sam Ravnborg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 7b91d017f77c1bda56f27c2f4bbb70de7c6eca08 upstream.
Struct gpio_backlight_platform_data refers to a platform device within
the Linux device hierarchy. The test in gpio_backlight_check_fb()
compares it against the fbdev device in struct fb_info.dev, which
is different. Fix the test by comparing to struct fb_info.device.
Fixes a bug in the backlight driver and prepares fbdev for making
struct fb_info.dev optional.
v2:
* move renames into separate patch (Javier, Sam, Michael)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 8b770e3c9824 ("backlight: Add GPIO-based backlight driver")
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Lee Jones <lee@kernel.org>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: linux-sh@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.12+
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-4-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/gpio_backlight.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/backlight/gpio_backlight.c
+++ b/drivers/video/backlight/gpio_backlight.c
@@ -35,7 +35,7 @@ static int gpio_backlight_check_fb(struc
{
struct gpio_backlight *gbl = bl_get_data(bl);
- return gbl->fbdev == NULL || gbl->fbdev == info->dev;
+ return gbl->fbdev == NULL || gbl->fbdev == info->device;
}
static const struct backlight_ops gpio_backlight_ops = {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 281/406] backlight/bd6107: Compare against struct fb_info.device
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 280/406] backlight/gpio_backlight: Compare against struct fb_info.device Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 282/406] backlight/lv5207lp: " Greg Kroah-Hartman
` (133 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Laurent Pinchart,
Lee Jones, Daniel Thompson, Jingoo Han, dri-devel,
Javier Martinez Canillas, Sam Ravnborg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 992bdddaabfba19bdc77c1c7a4977b2aa41ec891 upstream.
Struct bd6107_platform_data refers to a platform device within
the Linux device hierarchy. The test in bd6107_backlight_check_fb()
compares it against the fbdev device in struct fb_info.dev, which
is different. Fix the test by comparing to struct fb_info.device.
Fixes a bug in the backlight driver and prepares fbdev for making
struct fb_info.dev optional.
v2:
* move renames into separate patch (Javier, Sam, Michael)
Fixes: 67b43e590415 ("backlight: Add ROHM BD6107 backlight driver")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Lee Jones <lee@kernel.org>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.12+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/bd6107.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/backlight/bd6107.c
+++ b/drivers/video/backlight/bd6107.c
@@ -104,7 +104,7 @@ static int bd6107_backlight_check_fb(str
{
struct bd6107 *bd = bl_get_data(backlight);
- return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->dev;
+ return bd->pdata->fbdev == NULL || bd->pdata->fbdev == info->device;
}
static const struct backlight_ops bd6107_backlight_ops = {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 282/406] backlight/lv5207lp: Compare against struct fb_info.device
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 281/406] backlight/bd6107: " Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 283/406] xtensa: PMU: fix base address for the newer hardware Greg Kroah-Hartman
` (132 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Laurent Pinchart,
Yoshinori Sato, Rich Felker, John Paul Adrian Glaubitz, Lee Jones,
Daniel Thompson, Jingoo Han, linux-sh, dri-devel,
Javier Martinez Canillas, Sam Ravnborg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 1ca8819320fd84e7d95b04e7668efc5f9fe9fa5c upstream.
Struct lv5207lp_platform_data refers to a platform device within
the Linux device hierarchy. The test in lv5207lp_backlight_check_fb()
compares it against the fbdev device in struct fb_info.dev, which
is different. Fix the test by comparing to struct fb_info.device.
Fixes a bug in the backlight driver and prepares fbdev for making
struct fb_info.dev optional.
v2:
* move renames into separate patch (Javier, Sam, Michael)
Fixes: 82e5c40d88f9 ("backlight: Add Sanyo LV5207LP backlight driver")
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Cc: Rich Felker <dalias@libc.org>
Cc: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Cc: Lee Jones <lee@kernel.org>
Cc: Daniel Thompson <daniel.thompson@linaro.org>
Cc: Jingoo Han <jingoohan1@gmail.com>
Cc: linux-sh@vger.kernel.org
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.12+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Reviewed-by: Daniel Thompson <daniel.thompson@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-6-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/backlight/lv5207lp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/backlight/lv5207lp.c
+++ b/drivers/video/backlight/lv5207lp.c
@@ -67,7 +67,7 @@ static int lv5207lp_backlight_check_fb(s
{
struct lv5207lp *lv = bl_get_data(backlight);
- return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->dev;
+ return lv->pdata->fbdev == NULL || lv->pdata->fbdev == info->device;
}
static const struct backlight_ops lv5207lp_backlight_ops = {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 283/406] xtensa: PMU: fix base address for the newer hardware
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 282/406] backlight/lv5207lp: " Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 284/406] arm64: csum: Fix OoB access in IP checksum code for negative lengths Greg Kroah-Hartman
` (131 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Max Filippov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Filippov <jcmvbkbc@gmail.com>
commit 687eb3c42f4ad81e7c947c50e2d865f692064291 upstream.
With introduction of ERI access control in RG.0 base address of the PMU
unit registers has changed. Add support for the new PMU configuration.
Cc: stable@vger.kernel.org
Signed-off-by: Max Filippov <jcmvbkbc@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/xtensa/include/asm/core.h | 9 +++++++++
arch/xtensa/kernel/perf_event.c | 17 +++++++++++++----
2 files changed, 22 insertions(+), 4 deletions(-)
--- a/arch/xtensa/include/asm/core.h
+++ b/arch/xtensa/include/asm/core.h
@@ -26,4 +26,13 @@
#define XCHAL_SPANNING_WAY 0
#endif
+#ifndef XCHAL_HW_MIN_VERSION
+#if defined(XCHAL_HW_MIN_VERSION_MAJOR) && defined(XCHAL_HW_MIN_VERSION_MINOR)
+#define XCHAL_HW_MIN_VERSION (XCHAL_HW_MIN_VERSION_MAJOR * 100 + \
+ XCHAL_HW_MIN_VERSION_MINOR)
+#else
+#define XCHAL_HW_MIN_VERSION 0
+#endif
+#endif
+
#endif
--- a/arch/xtensa/kernel/perf_event.c
+++ b/arch/xtensa/kernel/perf_event.c
@@ -13,17 +13,26 @@
#include <linux/perf_event.h>
#include <linux/platform_device.h>
+#include <asm/core.h>
#include <asm/processor.h>
#include <asm/stacktrace.h>
+#define XTENSA_HWVERSION_RG_2015_0 260000
+
+#if XCHAL_HW_MIN_VERSION >= XTENSA_HWVERSION_RG_2015_0
+#define XTENSA_PMU_ERI_BASE 0x00101000
+#else
+#define XTENSA_PMU_ERI_BASE 0x00001000
+#endif
+
/* Global control/status for all perf counters */
-#define XTENSA_PMU_PMG 0x1000
+#define XTENSA_PMU_PMG XTENSA_PMU_ERI_BASE
/* Perf counter values */
-#define XTENSA_PMU_PM(i) (0x1080 + (i) * 4)
+#define XTENSA_PMU_PM(i) (XTENSA_PMU_ERI_BASE + 0x80 + (i) * 4)
/* Perf counter control registers */
-#define XTENSA_PMU_PMCTRL(i) (0x1100 + (i) * 4)
+#define XTENSA_PMU_PMCTRL(i) (XTENSA_PMU_ERI_BASE + 0x100 + (i) * 4)
/* Perf counter status registers */
-#define XTENSA_PMU_PMSTAT(i) (0x1180 + (i) * 4)
+#define XTENSA_PMU_PMSTAT(i) (XTENSA_PMU_ERI_BASE + 0x180 + (i) * 4)
#define XTENSA_PMU_PMG_PMEN 0x1
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 284/406] arm64: csum: Fix OoB access in IP checksum code for negative lengths
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 283/406] xtensa: PMU: fix base address for the newer hardware Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 285/406] media: dvb: symbol fixup for dvb_attach() Greg Kroah-Hartman
` (130 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robin Murphy,
syzbot+4a9f9820bd8d302e22f7, Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will@kernel.org>
commit 8bd795fedb8450ecbef18eeadbd23ed8fc7630f5 upstream.
Although commit c2c24edb1d9c ("arm64: csum: Fix pathological zero-length
calls") added an early return for zero-length input, syzkaller has
popped up with an example of a _negative_ length which causes an
undefined shift and an out-of-bounds read:
| BUG: KASAN: slab-out-of-bounds in do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
| Read of size 4294966928 at addr ffff0000d7ac0170 by task syz-executor412/5975
|
| CPU: 0 PID: 5975 Comm: syz-executor412 Not tainted 6.4.0-rc4-syzkaller-g908f31f2a05b #0
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
| Call trace:
| dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
| show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
| __dump_stack lib/dump_stack.c:88 [inline]
| dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
| print_address_description mm/kasan/report.c:351 [inline]
| print_report+0x174/0x514 mm/kasan/report.c:462
| kasan_report+0xd4/0x130 mm/kasan/report.c:572
| kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
| __kasan_check_read+0x20/0x30 mm/kasan/shadow.c:31
| do_csum+0x44/0x254 arch/arm64/lib/csum.c:39
| csum_partial+0x30/0x58 lib/checksum.c:128
| gso_make_checksum include/linux/skbuff.h:4928 [inline]
| __udp_gso_segment+0xaf4/0x1bc4 net/ipv4/udp_offload.c:332
| udp6_ufo_fragment+0x540/0xca0 net/ipv6/udp_offload.c:47
| ipv6_gso_segment+0x5cc/0x1760 net/ipv6/ip6_offload.c:119
| skb_mac_gso_segment+0x2b4/0x5b0 net/core/gro.c:141
| __skb_gso_segment+0x250/0x3d0 net/core/dev.c:3401
| skb_gso_segment include/linux/netdevice.h:4859 [inline]
| validate_xmit_skb+0x364/0xdbc net/core/dev.c:3659
| validate_xmit_skb_list+0x94/0x130 net/core/dev.c:3709
| sch_direct_xmit+0xe8/0x548 net/sched/sch_generic.c:327
| __dev_xmit_skb net/core/dev.c:3805 [inline]
| __dev_queue_xmit+0x147c/0x3318 net/core/dev.c:4210
| dev_queue_xmit include/linux/netdevice.h:3085 [inline]
| packet_xmit+0x6c/0x318 net/packet/af_packet.c:276
| packet_snd net/packet/af_packet.c:3081 [inline]
| packet_sendmsg+0x376c/0x4c98 net/packet/af_packet.c:3113
| sock_sendmsg_nosec net/socket.c:724 [inline]
| sock_sendmsg net/socket.c:747 [inline]
| __sys_sendto+0x3b4/0x538 net/socket.c:2144
Extend the early return to reject negative lengths as well, aligning our
implementation with the generic code in lib/checksum.c
Cc: Robin Murphy <robin.murphy@arm.com>
Fixes: 5777eaed566a ("arm64: Implement optimised checksum routine")
Reported-by: syzbot+4a9f9820bd8d302e22f7@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/000000000000e0e94c0603f8d213@google.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/lib/csum.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/lib/csum.c
+++ b/arch/arm64/lib/csum.c
@@ -24,7 +24,7 @@ unsigned int __no_sanitize_address do_cs
const u64 *ptr;
u64 data, sum64 = 0;
- if (unlikely(len == 0))
+ if (unlikely(len <= 0))
return 0;
offset = (unsigned long)buff & 7;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 285/406] media: dvb: symbol fixup for dvb_attach()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 284/406] arm64: csum: Fix OoB access in IP checksum code for negative lengths Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 286/406] Revert "scsi: qla2xxx: Fix buffer overrun" Greg Kroah-Hartman
` (129 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Stefan Lippers-Hollmann,
Mauro Carvalho Chehab, Christoph Hellwig, linux-media,
linux-modules, Luis Chamberlain, Hans Verkuil
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 86495af1171e1feec79faa9b64c05c89f46e41d1 upstream.
In commit 9011e49d54dc ("modules: only allow symbol_get of
EXPORT_SYMBOL_GPL modules") the use of symbol_get is properly restricted
to GPL-only marked symbols. This interacts oddly with the DVB logic
which only uses dvb_attach() to load the dvb driver which then uses
symbol_get().
Fix this up by properly marking all of the dvb_attach attach symbols as
EXPORT_SYMBOL_GPL().
Fixes: 9011e49d54dc ("modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules")
Cc: stable <stable@kernel.org>
Reported-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: Christoph Hellwig <hch@lst.de>
Cc: linux-media@vger.kernel.org
Cc: linux-modules@vger.kernel.org
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Acked-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Link: https://lore.kernel.org/r/20230908092035.3815268-2-gregkh@linuxfoundation.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/ascot2e.c | 2 +-
drivers/media/dvb-frontends/atbm8830.c | 2 +-
drivers/media/dvb-frontends/au8522_dig.c | 2 +-
drivers/media/dvb-frontends/bcm3510.c | 2 +-
drivers/media/dvb-frontends/cx22700.c | 2 +-
drivers/media/dvb-frontends/cx22702.c | 2 +-
drivers/media/dvb-frontends/cx24110.c | 2 +-
drivers/media/dvb-frontends/cx24113.c | 2 +-
drivers/media/dvb-frontends/cx24116.c | 2 +-
drivers/media/dvb-frontends/cx24120.c | 2 +-
drivers/media/dvb-frontends/cx24123.c | 2 +-
drivers/media/dvb-frontends/cxd2820r_core.c | 2 +-
drivers/media/dvb-frontends/cxd2841er.c | 4 ++--
drivers/media/dvb-frontends/cxd2880/cxd2880_top.c | 2 +-
drivers/media/dvb-frontends/dib0070.c | 2 +-
drivers/media/dvb-frontends/dib0090.c | 4 ++--
drivers/media/dvb-frontends/dib3000mb.c | 2 +-
drivers/media/dvb-frontends/dib3000mc.c | 2 +-
drivers/media/dvb-frontends/dib7000m.c | 2 +-
drivers/media/dvb-frontends/dib7000p.c | 2 +-
drivers/media/dvb-frontends/dib8000.c | 2 +-
drivers/media/dvb-frontends/dib9000.c | 2 +-
drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 +-
drivers/media/dvb-frontends/drxd_hard.c | 2 +-
drivers/media/dvb-frontends/drxk_hard.c | 2 +-
drivers/media/dvb-frontends/ds3000.c | 2 +-
drivers/media/dvb-frontends/dvb-pll.c | 2 +-
drivers/media/dvb-frontends/ec100.c | 2 +-
drivers/media/dvb-frontends/helene.c | 4 ++--
drivers/media/dvb-frontends/horus3a.c | 2 +-
drivers/media/dvb-frontends/isl6405.c | 2 +-
drivers/media/dvb-frontends/isl6421.c | 2 +-
drivers/media/dvb-frontends/isl6423.c | 2 +-
drivers/media/dvb-frontends/itd1000.c | 2 +-
drivers/media/dvb-frontends/ix2505v.c | 2 +-
drivers/media/dvb-frontends/l64781.c | 2 +-
drivers/media/dvb-frontends/lg2160.c | 2 +-
drivers/media/dvb-frontends/lgdt3305.c | 2 +-
drivers/media/dvb-frontends/lgdt3306a.c | 2 +-
drivers/media/dvb-frontends/lgdt330x.c | 2 +-
drivers/media/dvb-frontends/lgs8gxx.c | 2 +-
drivers/media/dvb-frontends/lnbh25.c | 2 +-
drivers/media/dvb-frontends/lnbp21.c | 4 ++--
drivers/media/dvb-frontends/lnbp22.c | 2 +-
drivers/media/dvb-frontends/m88ds3103.c | 2 +-
drivers/media/dvb-frontends/m88rs2000.c | 2 +-
drivers/media/dvb-frontends/mb86a16.c | 2 +-
drivers/media/dvb-frontends/mb86a20s.c | 2 +-
drivers/media/dvb-frontends/mt312.c | 2 +-
drivers/media/dvb-frontends/mt352.c | 2 +-
drivers/media/dvb-frontends/nxt200x.c | 2 +-
drivers/media/dvb-frontends/nxt6000.c | 2 +-
drivers/media/dvb-frontends/or51132.c | 2 +-
drivers/media/dvb-frontends/or51211.c | 2 +-
drivers/media/dvb-frontends/s5h1409.c | 2 +-
drivers/media/dvb-frontends/s5h1411.c | 2 +-
drivers/media/dvb-frontends/s5h1420.c | 2 +-
drivers/media/dvb-frontends/s5h1432.c | 2 +-
drivers/media/dvb-frontends/s921.c | 2 +-
drivers/media/dvb-frontends/si21xx.c | 2 +-
drivers/media/dvb-frontends/sp887x.c | 2 +-
drivers/media/dvb-frontends/stb0899_drv.c | 2 +-
drivers/media/dvb-frontends/stb6000.c | 2 +-
drivers/media/dvb-frontends/stb6100.c | 2 +-
drivers/media/dvb-frontends/stv0288.c | 2 +-
drivers/media/dvb-frontends/stv0297.c | 2 +-
drivers/media/dvb-frontends/stv0299.c | 2 +-
drivers/media/dvb-frontends/stv0367.c | 6 +++---
drivers/media/dvb-frontends/stv0900_core.c | 2 +-
drivers/media/dvb-frontends/stv090x.c | 2 +-
drivers/media/dvb-frontends/stv6110.c | 2 +-
drivers/media/dvb-frontends/stv6110x.c | 2 +-
drivers/media/dvb-frontends/tda10021.c | 2 +-
drivers/media/dvb-frontends/tda10023.c | 2 +-
drivers/media/dvb-frontends/tda10048.c | 2 +-
drivers/media/dvb-frontends/tda1004x.c | 4 ++--
drivers/media/dvb-frontends/tda10086.c | 2 +-
drivers/media/dvb-frontends/tda665x.c | 2 +-
drivers/media/dvb-frontends/tda8083.c | 2 +-
drivers/media/dvb-frontends/tda8261.c | 2 +-
drivers/media/dvb-frontends/tda826x.c | 2 +-
drivers/media/dvb-frontends/ts2020.c | 2 +-
drivers/media/dvb-frontends/tua6100.c | 2 +-
drivers/media/dvb-frontends/ves1820.c | 2 +-
drivers/media/dvb-frontends/ves1x93.c | 2 +-
drivers/media/dvb-frontends/zl10036.c | 2 +-
drivers/media/dvb-frontends/zl10039.c | 2 +-
drivers/media/dvb-frontends/zl10353.c | 2 +-
drivers/media/pci/bt8xx/dst.c | 2 +-
drivers/media/pci/bt8xx/dst_ca.c | 2 +-
drivers/media/pci/ddbridge/ddbridge-dummy-fe.c | 2 +-
drivers/media/tuners/fc0011.c | 2 +-
drivers/media/tuners/fc0012.c | 2 +-
drivers/media/tuners/fc0013.c | 2 +-
drivers/media/tuners/max2165.c | 2 +-
drivers/media/tuners/mc44s803.c | 2 +-
drivers/media/tuners/mt2060.c | 2 +-
drivers/media/tuners/mt2131.c | 2 +-
drivers/media/tuners/mt2266.c | 2 +-
drivers/media/tuners/mxl5005s.c | 2 +-
drivers/media/tuners/qt1010.c | 2 +-
drivers/media/tuners/tda18218.c | 2 +-
drivers/media/tuners/xc4000.c | 2 +-
drivers/media/tuners/xc5000.c | 2 +-
104 files changed, 111 insertions(+), 111 deletions(-)
--- a/drivers/media/dvb-frontends/ascot2e.c
+++ b/drivers/media/dvb-frontends/ascot2e.c
@@ -533,7 +533,7 @@ struct dvb_frontend *ascot2e_attach(stru
priv->i2c_address, priv->i2c);
return fe;
}
-EXPORT_SYMBOL(ascot2e_attach);
+EXPORT_SYMBOL_GPL(ascot2e_attach);
MODULE_DESCRIPTION("Sony ASCOT2E terr/cab tuner driver");
MODULE_AUTHOR("info@netup.ru");
--- a/drivers/media/dvb-frontends/atbm8830.c
+++ b/drivers/media/dvb-frontends/atbm8830.c
@@ -489,7 +489,7 @@ error_out:
return NULL;
}
-EXPORT_SYMBOL(atbm8830_attach);
+EXPORT_SYMBOL_GPL(atbm8830_attach);
MODULE_DESCRIPTION("AltoBeam ATBM8830/8831 GB20600 demodulator driver");
MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
--- a/drivers/media/dvb-frontends/au8522_dig.c
+++ b/drivers/media/dvb-frontends/au8522_dig.c
@@ -879,7 +879,7 @@ error:
au8522_release_state(state);
return NULL;
}
-EXPORT_SYMBOL(au8522_attach);
+EXPORT_SYMBOL_GPL(au8522_attach);
static const struct dvb_frontend_ops au8522_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/bcm3510.c
+++ b/drivers/media/dvb-frontends/bcm3510.c
@@ -835,7 +835,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(bcm3510_attach);
+EXPORT_SYMBOL_GPL(bcm3510_attach);
static const struct dvb_frontend_ops bcm3510_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/cx22700.c
+++ b/drivers/media/dvb-frontends/cx22700.c
@@ -432,4 +432,4 @@ MODULE_DESCRIPTION("Conexant CX22700 DVB
MODULE_AUTHOR("Holger Waechtler");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(cx22700_attach);
+EXPORT_SYMBOL_GPL(cx22700_attach);
--- a/drivers/media/dvb-frontends/cx22702.c
+++ b/drivers/media/dvb-frontends/cx22702.c
@@ -604,7 +604,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(cx22702_attach);
+EXPORT_SYMBOL_GPL(cx22702_attach);
static const struct dvb_frontend_ops cx22702_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/cx24110.c
+++ b/drivers/media/dvb-frontends/cx24110.c
@@ -653,4 +653,4 @@ MODULE_DESCRIPTION("Conexant CX24110 DVB
MODULE_AUTHOR("Peter Hettkamp");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(cx24110_attach);
+EXPORT_SYMBOL_GPL(cx24110_attach);
--- a/drivers/media/dvb-frontends/cx24113.c
+++ b/drivers/media/dvb-frontends/cx24113.c
@@ -590,7 +590,7 @@ error:
return NULL;
}
-EXPORT_SYMBOL(cx24113_attach);
+EXPORT_SYMBOL_GPL(cx24113_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Activates frontend debugging (default:0)");
--- a/drivers/media/dvb-frontends/cx24116.c
+++ b/drivers/media/dvb-frontends/cx24116.c
@@ -1133,7 +1133,7 @@ struct dvb_frontend *cx24116_attach(cons
state->frontend.demodulator_priv = state;
return &state->frontend;
}
-EXPORT_SYMBOL(cx24116_attach);
+EXPORT_SYMBOL_GPL(cx24116_attach);
/*
* Initialise or wake up device
--- a/drivers/media/dvb-frontends/cx24120.c
+++ b/drivers/media/dvb-frontends/cx24120.c
@@ -305,7 +305,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(cx24120_attach);
+EXPORT_SYMBOL_GPL(cx24120_attach);
static int cx24120_test_rom(struct cx24120_state *state)
{
--- a/drivers/media/dvb-frontends/cx24123.c
+++ b/drivers/media/dvb-frontends/cx24123.c
@@ -1096,7 +1096,7 @@ error:
return NULL;
}
-EXPORT_SYMBOL(cx24123_attach);
+EXPORT_SYMBOL_GPL(cx24123_attach);
static const struct dvb_frontend_ops cx24123_ops = {
.delsys = { SYS_DVBS },
--- a/drivers/media/dvb-frontends/cxd2820r_core.c
+++ b/drivers/media/dvb-frontends/cxd2820r_core.c
@@ -536,7 +536,7 @@ struct dvb_frontend *cxd2820r_attach(con
return pdata.get_dvb_frontend(client);
}
-EXPORT_SYMBOL(cxd2820r_attach);
+EXPORT_SYMBOL_GPL(cxd2820r_attach);
static struct dvb_frontend *cxd2820r_get_dvb_frontend(struct i2c_client *client)
{
--- a/drivers/media/dvb-frontends/cxd2841er.c
+++ b/drivers/media/dvb-frontends/cxd2841er.c
@@ -3930,14 +3930,14 @@ struct dvb_frontend *cxd2841er_attach_s(
{
return cxd2841er_attach(cfg, i2c, SYS_DVBS);
}
-EXPORT_SYMBOL(cxd2841er_attach_s);
+EXPORT_SYMBOL_GPL(cxd2841er_attach_s);
struct dvb_frontend *cxd2841er_attach_t_c(struct cxd2841er_config *cfg,
struct i2c_adapter *i2c)
{
return cxd2841er_attach(cfg, i2c, 0);
}
-EXPORT_SYMBOL(cxd2841er_attach_t_c);
+EXPORT_SYMBOL_GPL(cxd2841er_attach_t_c);
static const struct dvb_frontend_ops cxd2841er_dvbs_s2_ops = {
.delsys = { SYS_DVBS, SYS_DVBS2 },
--- a/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
+++ b/drivers/media/dvb-frontends/cxd2880/cxd2880_top.c
@@ -1950,7 +1950,7 @@ struct dvb_frontend *cxd2880_attach(stru
return fe;
}
-EXPORT_SYMBOL(cxd2880_attach);
+EXPORT_SYMBOL_GPL(cxd2880_attach);
MODULE_DESCRIPTION("Sony CXD2880 DVB-T2/T tuner + demod driver");
MODULE_AUTHOR("Sony Semiconductor Solutions Corporation");
--- a/drivers/media/dvb-frontends/dib0070.c
+++ b/drivers/media/dvb-frontends/dib0070.c
@@ -762,7 +762,7 @@ free_mem:
fe->tuner_priv = NULL;
return NULL;
}
-EXPORT_SYMBOL(dib0070_attach);
+EXPORT_SYMBOL_GPL(dib0070_attach);
MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>");
MODULE_DESCRIPTION("Driver for the DiBcom 0070 base-band RF Tuner");
--- a/drivers/media/dvb-frontends/dib0090.c
+++ b/drivers/media/dvb-frontends/dib0090.c
@@ -2632,7 +2632,7 @@ struct dvb_frontend *dib0090_register(st
return NULL;
}
-EXPORT_SYMBOL(dib0090_register);
+EXPORT_SYMBOL_GPL(dib0090_register);
struct dvb_frontend *dib0090_fw_register(struct dvb_frontend *fe, struct i2c_adapter *i2c, const struct dib0090_config *config)
{
@@ -2658,7 +2658,7 @@ free_mem:
fe->tuner_priv = NULL;
return NULL;
}
-EXPORT_SYMBOL(dib0090_fw_register);
+EXPORT_SYMBOL_GPL(dib0090_fw_register);
MODULE_AUTHOR("Patrick Boettcher <patrick.boettcher@posteo.de>");
MODULE_AUTHOR("Olivier Grenie <olivier.grenie@parrot.com>");
--- a/drivers/media/dvb-frontends/dib3000mb.c
+++ b/drivers/media/dvb-frontends/dib3000mb.c
@@ -815,4 +815,4 @@ MODULE_AUTHOR(DRIVER_AUTHOR);
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(dib3000mb_attach);
+EXPORT_SYMBOL_GPL(dib3000mb_attach);
--- a/drivers/media/dvb-frontends/dib3000mc.c
+++ b/drivers/media/dvb-frontends/dib3000mc.c
@@ -935,7 +935,7 @@ error:
kfree(st);
return NULL;
}
-EXPORT_SYMBOL(dib3000mc_attach);
+EXPORT_SYMBOL_GPL(dib3000mc_attach);
static const struct dvb_frontend_ops dib3000mc_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/dib7000m.c
+++ b/drivers/media/dvb-frontends/dib7000m.c
@@ -1434,7 +1434,7 @@ error:
kfree(st);
return NULL;
}
-EXPORT_SYMBOL(dib7000m_attach);
+EXPORT_SYMBOL_GPL(dib7000m_attach);
static const struct dvb_frontend_ops dib7000m_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/dib7000p.c
+++ b/drivers/media/dvb-frontends/dib7000p.c
@@ -2822,7 +2822,7 @@ void *dib7000p_attach(struct dib7000p_op
return ops;
}
-EXPORT_SYMBOL(dib7000p_attach);
+EXPORT_SYMBOL_GPL(dib7000p_attach);
static const struct dvb_frontend_ops dib7000p_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/dib8000.c
+++ b/drivers/media/dvb-frontends/dib8000.c
@@ -4527,7 +4527,7 @@ void *dib8000_attach(struct dib8000_ops
return ops;
}
-EXPORT_SYMBOL(dib8000_attach);
+EXPORT_SYMBOL_GPL(dib8000_attach);
MODULE_AUTHOR("Olivier Grenie <Olivier.Grenie@parrot.com, Patrick Boettcher <patrick.boettcher@posteo.de>");
MODULE_DESCRIPTION("Driver for the DiBcom 8000 ISDB-T demodulator");
--- a/drivers/media/dvb-frontends/dib9000.c
+++ b/drivers/media/dvb-frontends/dib9000.c
@@ -2546,7 +2546,7 @@ error:
kfree(st);
return NULL;
}
-EXPORT_SYMBOL(dib9000_attach);
+EXPORT_SYMBOL_GPL(dib9000_attach);
static const struct dvb_frontend_ops dib9000_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/drx39xyj/drxj.c
+++ b/drivers/media/dvb-frontends/drx39xyj/drxj.c
@@ -12375,7 +12375,7 @@ error:
return NULL;
}
-EXPORT_SYMBOL(drx39xxj_attach);
+EXPORT_SYMBOL_GPL(drx39xxj_attach);
static const struct dvb_frontend_ops drx39xxj_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/drxd_hard.c
+++ b/drivers/media/dvb-frontends/drxd_hard.c
@@ -2948,7 +2948,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(drxd_attach);
+EXPORT_SYMBOL_GPL(drxd_attach);
MODULE_DESCRIPTION("DRXD driver");
MODULE_AUTHOR("Micronas");
--- a/drivers/media/dvb-frontends/drxk_hard.c
+++ b/drivers/media/dvb-frontends/drxk_hard.c
@@ -6845,7 +6845,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(drxk_attach);
+EXPORT_SYMBOL_GPL(drxk_attach);
MODULE_DESCRIPTION("DRX-K driver");
MODULE_AUTHOR("Ralph Metzler");
--- a/drivers/media/dvb-frontends/ds3000.c
+++ b/drivers/media/dvb-frontends/ds3000.c
@@ -859,7 +859,7 @@ struct dvb_frontend *ds3000_attach(const
ds3000_set_voltage(&state->frontend, SEC_VOLTAGE_OFF);
return &state->frontend;
}
-EXPORT_SYMBOL(ds3000_attach);
+EXPORT_SYMBOL_GPL(ds3000_attach);
static int ds3000_set_carrier_offset(struct dvb_frontend *fe,
s32 carrier_offset_khz)
--- a/drivers/media/dvb-frontends/dvb-pll.c
+++ b/drivers/media/dvb-frontends/dvb-pll.c
@@ -866,7 +866,7 @@ out:
return NULL;
}
-EXPORT_SYMBOL(dvb_pll_attach);
+EXPORT_SYMBOL_GPL(dvb_pll_attach);
static int
--- a/drivers/media/dvb-frontends/ec100.c
+++ b/drivers/media/dvb-frontends/ec100.c
@@ -299,7 +299,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(ec100_attach);
+EXPORT_SYMBOL_GPL(ec100_attach);
static const struct dvb_frontend_ops ec100_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/helene.c
+++ b/drivers/media/dvb-frontends/helene.c
@@ -1025,7 +1025,7 @@ struct dvb_frontend *helene_attach_s(str
priv->i2c_address, priv->i2c);
return fe;
}
-EXPORT_SYMBOL(helene_attach_s);
+EXPORT_SYMBOL_GPL(helene_attach_s);
struct dvb_frontend *helene_attach(struct dvb_frontend *fe,
const struct helene_config *config,
@@ -1061,7 +1061,7 @@ struct dvb_frontend *helene_attach(struc
priv->i2c_address, priv->i2c);
return fe;
}
-EXPORT_SYMBOL(helene_attach);
+EXPORT_SYMBOL_GPL(helene_attach);
static int helene_probe(struct i2c_client *client,
const struct i2c_device_id *id)
--- a/drivers/media/dvb-frontends/horus3a.c
+++ b/drivers/media/dvb-frontends/horus3a.c
@@ -395,7 +395,7 @@ struct dvb_frontend *horus3a_attach(stru
priv->i2c_address, priv->i2c);
return fe;
}
-EXPORT_SYMBOL(horus3a_attach);
+EXPORT_SYMBOL_GPL(horus3a_attach);
MODULE_DESCRIPTION("Sony HORUS3A satellite tuner driver");
MODULE_AUTHOR("Sergey Kozlov <serjk@netup.ru>");
--- a/drivers/media/dvb-frontends/isl6405.c
+++ b/drivers/media/dvb-frontends/isl6405.c
@@ -141,7 +141,7 @@ struct dvb_frontend *isl6405_attach(stru
return fe;
}
-EXPORT_SYMBOL(isl6405_attach);
+EXPORT_SYMBOL_GPL(isl6405_attach);
MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6405");
MODULE_AUTHOR("Hartmut Hackmann & Oliver Endriss");
--- a/drivers/media/dvb-frontends/isl6421.c
+++ b/drivers/media/dvb-frontends/isl6421.c
@@ -213,7 +213,7 @@ struct dvb_frontend *isl6421_attach(stru
return fe;
}
-EXPORT_SYMBOL(isl6421_attach);
+EXPORT_SYMBOL_GPL(isl6421_attach);
MODULE_DESCRIPTION("Driver for lnb supply and control ic isl6421");
MODULE_AUTHOR("Andrew de Quincey & Oliver Endriss");
--- a/drivers/media/dvb-frontends/isl6423.c
+++ b/drivers/media/dvb-frontends/isl6423.c
@@ -289,7 +289,7 @@ exit:
fe->sec_priv = NULL;
return NULL;
}
-EXPORT_SYMBOL(isl6423_attach);
+EXPORT_SYMBOL_GPL(isl6423_attach);
MODULE_DESCRIPTION("ISL6423 SEC");
MODULE_AUTHOR("Manu Abraham");
--- a/drivers/media/dvb-frontends/itd1000.c
+++ b/drivers/media/dvb-frontends/itd1000.c
@@ -389,7 +389,7 @@ struct dvb_frontend *itd1000_attach(stru
return fe;
}
-EXPORT_SYMBOL(itd1000_attach);
+EXPORT_SYMBOL_GPL(itd1000_attach);
MODULE_AUTHOR("Patrick Boettcher <pb@linuxtv.org>");
MODULE_DESCRIPTION("Integrant ITD1000 driver");
--- a/drivers/media/dvb-frontends/ix2505v.c
+++ b/drivers/media/dvb-frontends/ix2505v.c
@@ -302,7 +302,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(ix2505v_attach);
+EXPORT_SYMBOL_GPL(ix2505v_attach);
module_param_named(debug, ix2505v_debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/l64781.c
+++ b/drivers/media/dvb-frontends/l64781.c
@@ -593,4 +593,4 @@ MODULE_DESCRIPTION("LSI L64781 DVB-T Dem
MODULE_AUTHOR("Holger Waechtler, Marko Kohtala");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(l64781_attach);
+EXPORT_SYMBOL_GPL(l64781_attach);
--- a/drivers/media/dvb-frontends/lg2160.c
+++ b/drivers/media/dvb-frontends/lg2160.c
@@ -1426,7 +1426,7 @@ struct dvb_frontend *lg2160_attach(const
return &state->frontend;
}
-EXPORT_SYMBOL(lg2160_attach);
+EXPORT_SYMBOL_GPL(lg2160_attach);
MODULE_DESCRIPTION("LG Electronics LG216x ATSC/MH Demodulator Driver");
MODULE_AUTHOR("Michael Krufky <mkrufky@linuxtv.org>");
--- a/drivers/media/dvb-frontends/lgdt3305.c
+++ b/drivers/media/dvb-frontends/lgdt3305.c
@@ -1148,7 +1148,7 @@ fail:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(lgdt3305_attach);
+EXPORT_SYMBOL_GPL(lgdt3305_attach);
static const struct dvb_frontend_ops lgdt3304_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/lgdt3306a.c
+++ b/drivers/media/dvb-frontends/lgdt3306a.c
@@ -1895,7 +1895,7 @@ fail:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(lgdt3306a_attach);
+EXPORT_SYMBOL_GPL(lgdt3306a_attach);
#ifdef DBG_DUMP
--- a/drivers/media/dvb-frontends/lgdt330x.c
+++ b/drivers/media/dvb-frontends/lgdt330x.c
@@ -928,7 +928,7 @@ struct dvb_frontend *lgdt330x_attach(con
return lgdt330x_get_dvb_frontend(client);
}
-EXPORT_SYMBOL(lgdt330x_attach);
+EXPORT_SYMBOL_GPL(lgdt330x_attach);
static const struct dvb_frontend_ops lgdt3302_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/lgs8gxx.c
+++ b/drivers/media/dvb-frontends/lgs8gxx.c
@@ -1043,7 +1043,7 @@ error_out:
return NULL;
}
-EXPORT_SYMBOL(lgs8gxx_attach);
+EXPORT_SYMBOL_GPL(lgs8gxx_attach);
MODULE_DESCRIPTION("Legend Silicon LGS8913/LGS8GXX DMB-TH demodulator driver");
MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
--- a/drivers/media/dvb-frontends/lnbh25.c
+++ b/drivers/media/dvb-frontends/lnbh25.c
@@ -173,7 +173,7 @@ struct dvb_frontend *lnbh25_attach(struc
__func__, priv->i2c_address);
return fe;
}
-EXPORT_SYMBOL(lnbh25_attach);
+EXPORT_SYMBOL_GPL(lnbh25_attach);
MODULE_DESCRIPTION("ST LNBH25 driver");
MODULE_AUTHOR("info@netup.ru");
--- a/drivers/media/dvb-frontends/lnbp21.c
+++ b/drivers/media/dvb-frontends/lnbp21.c
@@ -155,7 +155,7 @@ struct dvb_frontend *lnbh24_attach(struc
return lnbx2x_attach(fe, i2c, override_set, override_clear,
i2c_addr, LNBH24_TTX);
}
-EXPORT_SYMBOL(lnbh24_attach);
+EXPORT_SYMBOL_GPL(lnbh24_attach);
struct dvb_frontend *lnbp21_attach(struct dvb_frontend *fe,
struct i2c_adapter *i2c, u8 override_set,
@@ -164,7 +164,7 @@ struct dvb_frontend *lnbp21_attach(struc
return lnbx2x_attach(fe, i2c, override_set, override_clear,
0x08, LNBP21_ISEL);
}
-EXPORT_SYMBOL(lnbp21_attach);
+EXPORT_SYMBOL_GPL(lnbp21_attach);
MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp21, lnbh24");
MODULE_AUTHOR("Oliver Endriss, Igor M. Liplianin");
--- a/drivers/media/dvb-frontends/lnbp22.c
+++ b/drivers/media/dvb-frontends/lnbp22.c
@@ -125,7 +125,7 @@ struct dvb_frontend *lnbp22_attach(struc
return fe;
}
-EXPORT_SYMBOL(lnbp22_attach);
+EXPORT_SYMBOL_GPL(lnbp22_attach);
MODULE_DESCRIPTION("Driver for lnb supply and control ic lnbp22");
MODULE_AUTHOR("Dominik Kuhlen");
--- a/drivers/media/dvb-frontends/m88ds3103.c
+++ b/drivers/media/dvb-frontends/m88ds3103.c
@@ -1699,7 +1699,7 @@ struct dvb_frontend *m88ds3103_attach(co
*tuner_i2c_adapter = pdata.get_i2c_adapter(client);
return pdata.get_dvb_frontend(client);
}
-EXPORT_SYMBOL(m88ds3103_attach);
+EXPORT_SYMBOL_GPL(m88ds3103_attach);
static const struct dvb_frontend_ops m88ds3103_ops = {
.delsys = {SYS_DVBS, SYS_DVBS2},
--- a/drivers/media/dvb-frontends/m88rs2000.c
+++ b/drivers/media/dvb-frontends/m88rs2000.c
@@ -807,7 +807,7 @@ error:
return NULL;
}
-EXPORT_SYMBOL(m88rs2000_attach);
+EXPORT_SYMBOL_GPL(m88rs2000_attach);
MODULE_DESCRIPTION("M88RS2000 DVB-S Demodulator driver");
MODULE_AUTHOR("Malcolm Priestley tvboxspy@gmail.com");
--- a/drivers/media/dvb-frontends/mb86a16.c
+++ b/drivers/media/dvb-frontends/mb86a16.c
@@ -1848,6 +1848,6 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(mb86a16_attach);
+EXPORT_SYMBOL_GPL(mb86a16_attach);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Manu Abraham");
--- a/drivers/media/dvb-frontends/mb86a20s.c
+++ b/drivers/media/dvb-frontends/mb86a20s.c
@@ -2081,7 +2081,7 @@ struct dvb_frontend *mb86a20s_attach(con
dev_info(&i2c->dev, "Detected a Fujitsu mb86a20s frontend\n");
return &state->frontend;
}
-EXPORT_SYMBOL(mb86a20s_attach);
+EXPORT_SYMBOL_GPL(mb86a20s_attach);
static const struct dvb_frontend_ops mb86a20s_ops = {
.delsys = { SYS_ISDBT },
--- a/drivers/media/dvb-frontends/mt312.c
+++ b/drivers/media/dvb-frontends/mt312.c
@@ -827,7 +827,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(mt312_attach);
+EXPORT_SYMBOL_GPL(mt312_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/mt352.c
+++ b/drivers/media/dvb-frontends/mt352.c
@@ -593,4 +593,4 @@ MODULE_DESCRIPTION("Zarlink MT352 DVB-T
MODULE_AUTHOR("Holger Waechtler, Daniel Mack, Antonio Mancuso");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(mt352_attach);
+EXPORT_SYMBOL_GPL(mt352_attach);
--- a/drivers/media/dvb-frontends/nxt200x.c
+++ b/drivers/media/dvb-frontends/nxt200x.c
@@ -1232,5 +1232,5 @@ MODULE_DESCRIPTION("NXT200X (ATSC 8VSB &
MODULE_AUTHOR("Kirk Lapray, Michael Krufky, Jean-Francois Thibert, and Taylor Jacob");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(nxt200x_attach);
+EXPORT_SYMBOL_GPL(nxt200x_attach);
--- a/drivers/media/dvb-frontends/nxt6000.c
+++ b/drivers/media/dvb-frontends/nxt6000.c
@@ -621,4 +621,4 @@ MODULE_DESCRIPTION("NxtWave NXT6000 DVB-
MODULE_AUTHOR("Florian Schirmer");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(nxt6000_attach);
+EXPORT_SYMBOL_GPL(nxt6000_attach);
--- a/drivers/media/dvb-frontends/or51132.c
+++ b/drivers/media/dvb-frontends/or51132.c
@@ -605,4 +605,4 @@ MODULE_AUTHOR("Kirk Lapray");
MODULE_AUTHOR("Trent Piepho");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(or51132_attach);
+EXPORT_SYMBOL_GPL(or51132_attach);
--- a/drivers/media/dvb-frontends/or51211.c
+++ b/drivers/media/dvb-frontends/or51211.c
@@ -551,5 +551,5 @@ MODULE_DESCRIPTION("Oren OR51211 VSB [pc
MODULE_AUTHOR("Kirk Lapray");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(or51211_attach);
+EXPORT_SYMBOL_GPL(or51211_attach);
--- a/drivers/media/dvb-frontends/s5h1409.c
+++ b/drivers/media/dvb-frontends/s5h1409.c
@@ -981,7 +981,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(s5h1409_attach);
+EXPORT_SYMBOL_GPL(s5h1409_attach);
static const struct dvb_frontend_ops s5h1409_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/s5h1411.c
+++ b/drivers/media/dvb-frontends/s5h1411.c
@@ -900,7 +900,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(s5h1411_attach);
+EXPORT_SYMBOL_GPL(s5h1411_attach);
static const struct dvb_frontend_ops s5h1411_ops = {
.delsys = { SYS_ATSC, SYS_DVBC_ANNEX_B },
--- a/drivers/media/dvb-frontends/s5h1420.c
+++ b/drivers/media/dvb-frontends/s5h1420.c
@@ -918,7 +918,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(s5h1420_attach);
+EXPORT_SYMBOL_GPL(s5h1420_attach);
static const struct dvb_frontend_ops s5h1420_ops = {
.delsys = { SYS_DVBS },
--- a/drivers/media/dvb-frontends/s5h1432.c
+++ b/drivers/media/dvb-frontends/s5h1432.c
@@ -355,7 +355,7 @@ struct dvb_frontend *s5h1432_attach(cons
return &state->frontend;
}
-EXPORT_SYMBOL(s5h1432_attach);
+EXPORT_SYMBOL_GPL(s5h1432_attach);
static const struct dvb_frontend_ops s5h1432_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/s921.c
+++ b/drivers/media/dvb-frontends/s921.c
@@ -495,7 +495,7 @@ struct dvb_frontend *s921_attach(const s
return &state->frontend;
}
-EXPORT_SYMBOL(s921_attach);
+EXPORT_SYMBOL_GPL(s921_attach);
static const struct dvb_frontend_ops s921_ops = {
.delsys = { SYS_ISDBT },
--- a/drivers/media/dvb-frontends/si21xx.c
+++ b/drivers/media/dvb-frontends/si21xx.c
@@ -938,7 +938,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(si21xx_attach);
+EXPORT_SYMBOL_GPL(si21xx_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/sp887x.c
+++ b/drivers/media/dvb-frontends/sp887x.c
@@ -626,4 +626,4 @@ MODULE_PARM_DESC(debug, "Turn on/off fro
MODULE_DESCRIPTION("Spase sp887x DVB-T demodulator driver");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(sp887x_attach);
+EXPORT_SYMBOL_GPL(sp887x_attach);
--- a/drivers/media/dvb-frontends/stb0899_drv.c
+++ b/drivers/media/dvb-frontends/stb0899_drv.c
@@ -1638,7 +1638,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(stb0899_attach);
+EXPORT_SYMBOL_GPL(stb0899_attach);
MODULE_PARM_DESC(verbose, "Set Verbosity level");
MODULE_AUTHOR("Manu Abraham");
MODULE_DESCRIPTION("STB0899 Multi-Std frontend");
--- a/drivers/media/dvb-frontends/stb6000.c
+++ b/drivers/media/dvb-frontends/stb6000.c
@@ -232,7 +232,7 @@ struct dvb_frontend *stb6000_attach(stru
return fe;
}
-EXPORT_SYMBOL(stb6000_attach);
+EXPORT_SYMBOL_GPL(stb6000_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/stb6100.c
+++ b/drivers/media/dvb-frontends/stb6100.c
@@ -557,7 +557,7 @@ static void stb6100_release(struct dvb_f
kfree(state);
}
-EXPORT_SYMBOL(stb6100_attach);
+EXPORT_SYMBOL_GPL(stb6100_attach);
MODULE_PARM_DESC(verbose, "Set Verbosity level");
MODULE_AUTHOR("Manu Abraham");
--- a/drivers/media/dvb-frontends/stv0288.c
+++ b/drivers/media/dvb-frontends/stv0288.c
@@ -590,7 +590,7 @@ error:
return NULL;
}
-EXPORT_SYMBOL(stv0288_attach);
+EXPORT_SYMBOL_GPL(stv0288_attach);
module_param(debug_legacy_dish_switch, int, 0444);
MODULE_PARM_DESC(debug_legacy_dish_switch,
--- a/drivers/media/dvb-frontends/stv0297.c
+++ b/drivers/media/dvb-frontends/stv0297.c
@@ -710,4 +710,4 @@ MODULE_DESCRIPTION("ST STV0297 DVB-C Dem
MODULE_AUTHOR("Dennis Noermann and Andrew de Quincey");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(stv0297_attach);
+EXPORT_SYMBOL_GPL(stv0297_attach);
--- a/drivers/media/dvb-frontends/stv0299.c
+++ b/drivers/media/dvb-frontends/stv0299.c
@@ -751,4 +751,4 @@ MODULE_DESCRIPTION("ST STV0299 DVB Demod
MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Peter Schildmann, Felix Domke, Andreas Oberritter, Andrew de Quincey, Kenneth Aafly");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(stv0299_attach);
+EXPORT_SYMBOL_GPL(stv0299_attach);
--- a/drivers/media/dvb-frontends/stv0367.c
+++ b/drivers/media/dvb-frontends/stv0367.c
@@ -1750,7 +1750,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(stv0367ter_attach);
+EXPORT_SYMBOL_GPL(stv0367ter_attach);
static int stv0367cab_gate_ctrl(struct dvb_frontend *fe, int enable)
{
@@ -2923,7 +2923,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(stv0367cab_attach);
+EXPORT_SYMBOL_GPL(stv0367cab_attach);
/*
* Functions for operation on Digital Devices hardware
@@ -3344,7 +3344,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(stv0367ddb_attach);
+EXPORT_SYMBOL_GPL(stv0367ddb_attach);
MODULE_PARM_DESC(debug, "Set debug");
MODULE_PARM_DESC(i2c_debug, "Set i2c debug");
--- a/drivers/media/dvb-frontends/stv0900_core.c
+++ b/drivers/media/dvb-frontends/stv0900_core.c
@@ -1957,7 +1957,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(stv0900_attach);
+EXPORT_SYMBOL_GPL(stv0900_attach);
MODULE_PARM_DESC(debug, "Set debug");
--- a/drivers/media/dvb-frontends/stv090x.c
+++ b/drivers/media/dvb-frontends/stv090x.c
@@ -5073,7 +5073,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(stv090x_attach);
+EXPORT_SYMBOL_GPL(stv090x_attach);
static const struct i2c_device_id stv090x_id_table[] = {
{"stv090x", 0},
--- a/drivers/media/dvb-frontends/stv6110.c
+++ b/drivers/media/dvb-frontends/stv6110.c
@@ -427,7 +427,7 @@ struct dvb_frontend *stv6110_attach(stru
return fe;
}
-EXPORT_SYMBOL(stv6110_attach);
+EXPORT_SYMBOL_GPL(stv6110_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/stv6110x.c
+++ b/drivers/media/dvb-frontends/stv6110x.c
@@ -469,7 +469,7 @@ const struct stv6110x_devctl *stv6110x_a
dev_info(&stv6110x->i2c->dev, "Attaching STV6110x\n");
return stv6110x->devctl;
}
-EXPORT_SYMBOL(stv6110x_attach);
+EXPORT_SYMBOL_GPL(stv6110x_attach);
static const struct i2c_device_id stv6110x_id_table[] = {
{"stv6110x", 0},
--- a/drivers/media/dvb-frontends/tda10021.c
+++ b/drivers/media/dvb-frontends/tda10021.c
@@ -523,4 +523,4 @@ MODULE_DESCRIPTION("Philips TDA10021 DVB
MODULE_AUTHOR("Ralph Metzler, Holger Waechtler, Markus Schulz");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(tda10021_attach);
+EXPORT_SYMBOL_GPL(tda10021_attach);
--- a/drivers/media/dvb-frontends/tda10023.c
+++ b/drivers/media/dvb-frontends/tda10023.c
@@ -594,4 +594,4 @@ MODULE_DESCRIPTION("Philips TDA10023 DVB
MODULE_AUTHOR("Georg Acher, Hartmut Birr");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(tda10023_attach);
+EXPORT_SYMBOL_GPL(tda10023_attach);
--- a/drivers/media/dvb-frontends/tda10048.c
+++ b/drivers/media/dvb-frontends/tda10048.c
@@ -1138,7 +1138,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(tda10048_attach);
+EXPORT_SYMBOL_GPL(tda10048_attach);
static const struct dvb_frontend_ops tda10048_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/dvb-frontends/tda1004x.c
+++ b/drivers/media/dvb-frontends/tda1004x.c
@@ -1378,5 +1378,5 @@ MODULE_DESCRIPTION("Philips TDA10045H &
MODULE_AUTHOR("Andrew de Quincey & Robert Schlabbach");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(tda10045_attach);
-EXPORT_SYMBOL(tda10046_attach);
+EXPORT_SYMBOL_GPL(tda10045_attach);
+EXPORT_SYMBOL_GPL(tda10046_attach);
--- a/drivers/media/dvb-frontends/tda10086.c
+++ b/drivers/media/dvb-frontends/tda10086.c
@@ -764,4 +764,4 @@ MODULE_DESCRIPTION("Philips TDA10086 DVB
MODULE_AUTHOR("Andrew de Quincey");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(tda10086_attach);
+EXPORT_SYMBOL_GPL(tda10086_attach);
--- a/drivers/media/dvb-frontends/tda665x.c
+++ b/drivers/media/dvb-frontends/tda665x.c
@@ -227,7 +227,7 @@ struct dvb_frontend *tda665x_attach(stru
return fe;
}
-EXPORT_SYMBOL(tda665x_attach);
+EXPORT_SYMBOL_GPL(tda665x_attach);
MODULE_DESCRIPTION("TDA665x driver");
MODULE_AUTHOR("Manu Abraham");
--- a/drivers/media/dvb-frontends/tda8083.c
+++ b/drivers/media/dvb-frontends/tda8083.c
@@ -481,4 +481,4 @@ MODULE_DESCRIPTION("Philips TDA8083 DVB-
MODULE_AUTHOR("Ralph Metzler, Holger Waechtler");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(tda8083_attach);
+EXPORT_SYMBOL_GPL(tda8083_attach);
--- a/drivers/media/dvb-frontends/tda8261.c
+++ b/drivers/media/dvb-frontends/tda8261.c
@@ -188,7 +188,7 @@ exit:
return NULL;
}
-EXPORT_SYMBOL(tda8261_attach);
+EXPORT_SYMBOL_GPL(tda8261_attach);
MODULE_AUTHOR("Manu Abraham");
MODULE_DESCRIPTION("TDA8261 8PSK/QPSK Tuner");
--- a/drivers/media/dvb-frontends/tda826x.c
+++ b/drivers/media/dvb-frontends/tda826x.c
@@ -164,7 +164,7 @@ struct dvb_frontend *tda826x_attach(stru
return fe;
}
-EXPORT_SYMBOL(tda826x_attach);
+EXPORT_SYMBOL_GPL(tda826x_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/ts2020.c
+++ b/drivers/media/dvb-frontends/ts2020.c
@@ -525,7 +525,7 @@ struct dvb_frontend *ts2020_attach(struc
return fe;
}
-EXPORT_SYMBOL(ts2020_attach);
+EXPORT_SYMBOL_GPL(ts2020_attach);
/*
* We implement own regmap locking due to legacy DVB attach which uses frontend
--- a/drivers/media/dvb-frontends/tua6100.c
+++ b/drivers/media/dvb-frontends/tua6100.c
@@ -186,7 +186,7 @@ struct dvb_frontend *tua6100_attach(stru
fe->tuner_priv = priv;
return fe;
}
-EXPORT_SYMBOL(tua6100_attach);
+EXPORT_SYMBOL_GPL(tua6100_attach);
MODULE_DESCRIPTION("DVB tua6100 driver");
MODULE_AUTHOR("Andrew de Quincey");
--- a/drivers/media/dvb-frontends/ves1820.c
+++ b/drivers/media/dvb-frontends/ves1820.c
@@ -434,4 +434,4 @@ MODULE_DESCRIPTION("VLSI VES1820 DVB-C D
MODULE_AUTHOR("Ralph Metzler, Holger Waechtler");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(ves1820_attach);
+EXPORT_SYMBOL_GPL(ves1820_attach);
--- a/drivers/media/dvb-frontends/ves1x93.c
+++ b/drivers/media/dvb-frontends/ves1x93.c
@@ -540,4 +540,4 @@ MODULE_DESCRIPTION("VLSI VES1x93 DVB-S D
MODULE_AUTHOR("Ralph Metzler");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(ves1x93_attach);
+EXPORT_SYMBOL_GPL(ves1x93_attach);
--- a/drivers/media/dvb-frontends/zl10036.c
+++ b/drivers/media/dvb-frontends/zl10036.c
@@ -496,7 +496,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(zl10036_attach);
+EXPORT_SYMBOL_GPL(zl10036_attach);
module_param_named(debug, zl10036_debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/zl10039.c
+++ b/drivers/media/dvb-frontends/zl10039.c
@@ -295,7 +295,7 @@ error:
kfree(state);
return NULL;
}
-EXPORT_SYMBOL(zl10039_attach);
+EXPORT_SYMBOL_GPL(zl10039_attach);
module_param(debug, int, 0644);
MODULE_PARM_DESC(debug, "Turn on/off frontend debugging (default:off).");
--- a/drivers/media/dvb-frontends/zl10353.c
+++ b/drivers/media/dvb-frontends/zl10353.c
@@ -665,4 +665,4 @@ MODULE_DESCRIPTION("Zarlink ZL10353 DVB-
MODULE_AUTHOR("Chris Pascoe");
MODULE_LICENSE("GPL");
-EXPORT_SYMBOL(zl10353_attach);
+EXPORT_SYMBOL_GPL(zl10353_attach);
--- a/drivers/media/pci/bt8xx/dst.c
+++ b/drivers/media/pci/bt8xx/dst.c
@@ -1722,7 +1722,7 @@ struct dst_state *dst_attach(struct dst_
return state; /* Manu (DST is a card not a frontend) */
}
-EXPORT_SYMBOL(dst_attach);
+EXPORT_SYMBOL_GPL(dst_attach);
static const struct dvb_frontend_ops dst_dvbt_ops = {
.delsys = { SYS_DVBT },
--- a/drivers/media/pci/bt8xx/dst_ca.c
+++ b/drivers/media/pci/bt8xx/dst_ca.c
@@ -668,7 +668,7 @@ struct dvb_device *dst_ca_attach(struct
return NULL;
}
-EXPORT_SYMBOL(dst_ca_attach);
+EXPORT_SYMBOL_GPL(dst_ca_attach);
MODULE_DESCRIPTION("DST DVB-S/T/C Combo CA driver");
MODULE_AUTHOR("Manu Abraham");
--- a/drivers/media/pci/ddbridge/ddbridge-dummy-fe.c
+++ b/drivers/media/pci/ddbridge/ddbridge-dummy-fe.c
@@ -112,7 +112,7 @@ struct dvb_frontend *ddbridge_dummy_fe_q
state->frontend.demodulator_priv = state;
return &state->frontend;
}
-EXPORT_SYMBOL(ddbridge_dummy_fe_qam_attach);
+EXPORT_SYMBOL_GPL(ddbridge_dummy_fe_qam_attach);
static const struct dvb_frontend_ops ddbridge_dummy_fe_qam_ops = {
.delsys = { SYS_DVBC_ANNEX_A },
--- a/drivers/media/tuners/fc0011.c
+++ b/drivers/media/tuners/fc0011.c
@@ -499,7 +499,7 @@ struct dvb_frontend *fc0011_attach(struc
return fe;
}
-EXPORT_SYMBOL(fc0011_attach);
+EXPORT_SYMBOL_GPL(fc0011_attach);
MODULE_DESCRIPTION("Fitipower FC0011 silicon tuner driver");
MODULE_AUTHOR("Michael Buesch <m@bues.ch>");
--- a/drivers/media/tuners/fc0012.c
+++ b/drivers/media/tuners/fc0012.c
@@ -495,7 +495,7 @@ err:
return fe;
}
-EXPORT_SYMBOL(fc0012_attach);
+EXPORT_SYMBOL_GPL(fc0012_attach);
MODULE_DESCRIPTION("Fitipower FC0012 silicon tuner driver");
MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>");
--- a/drivers/media/tuners/fc0013.c
+++ b/drivers/media/tuners/fc0013.c
@@ -608,7 +608,7 @@ struct dvb_frontend *fc0013_attach(struc
return fe;
}
-EXPORT_SYMBOL(fc0013_attach);
+EXPORT_SYMBOL_GPL(fc0013_attach);
MODULE_DESCRIPTION("Fitipower FC0013 silicon tuner driver");
MODULE_AUTHOR("Hans-Frieder Vogt <hfvogt@gmx.net>");
--- a/drivers/media/tuners/max2165.c
+++ b/drivers/media/tuners/max2165.c
@@ -410,7 +410,7 @@ struct dvb_frontend *max2165_attach(stru
return fe;
}
-EXPORT_SYMBOL(max2165_attach);
+EXPORT_SYMBOL_GPL(max2165_attach);
MODULE_AUTHOR("David T. L. Wong <davidtlwong@gmail.com>");
MODULE_DESCRIPTION("Maxim MAX2165 silicon tuner driver");
--- a/drivers/media/tuners/mc44s803.c
+++ b/drivers/media/tuners/mc44s803.c
@@ -356,7 +356,7 @@ error:
kfree(priv);
return NULL;
}
-EXPORT_SYMBOL(mc44s803_attach);
+EXPORT_SYMBOL_GPL(mc44s803_attach);
MODULE_AUTHOR("Jochen Friedrich");
MODULE_DESCRIPTION("Freescale MC44S803 silicon tuner driver");
--- a/drivers/media/tuners/mt2060.c
+++ b/drivers/media/tuners/mt2060.c
@@ -440,7 +440,7 @@ struct dvb_frontend * mt2060_attach(stru
return fe;
}
-EXPORT_SYMBOL(mt2060_attach);
+EXPORT_SYMBOL_GPL(mt2060_attach);
static int mt2060_probe(struct i2c_client *client,
const struct i2c_device_id *id)
--- a/drivers/media/tuners/mt2131.c
+++ b/drivers/media/tuners/mt2131.c
@@ -274,7 +274,7 @@ struct dvb_frontend * mt2131_attach(stru
fe->tuner_priv = priv;
return fe;
}
-EXPORT_SYMBOL(mt2131_attach);
+EXPORT_SYMBOL_GPL(mt2131_attach);
MODULE_AUTHOR("Steven Toth");
MODULE_DESCRIPTION("Microtune MT2131 silicon tuner driver");
--- a/drivers/media/tuners/mt2266.c
+++ b/drivers/media/tuners/mt2266.c
@@ -336,7 +336,7 @@ struct dvb_frontend * mt2266_attach(stru
mt2266_calibrate(priv);
return fe;
}
-EXPORT_SYMBOL(mt2266_attach);
+EXPORT_SYMBOL_GPL(mt2266_attach);
MODULE_AUTHOR("Olivier DANET");
MODULE_DESCRIPTION("Microtune MT2266 silicon tuner driver");
--- a/drivers/media/tuners/mxl5005s.c
+++ b/drivers/media/tuners/mxl5005s.c
@@ -4114,7 +4114,7 @@ struct dvb_frontend *mxl5005s_attach(str
fe->tuner_priv = state;
return fe;
}
-EXPORT_SYMBOL(mxl5005s_attach);
+EXPORT_SYMBOL_GPL(mxl5005s_attach);
MODULE_DESCRIPTION("MaxLinear MXL5005S silicon tuner driver");
MODULE_AUTHOR("Steven Toth");
--- a/drivers/media/tuners/qt1010.c
+++ b/drivers/media/tuners/qt1010.c
@@ -440,7 +440,7 @@ struct dvb_frontend * qt1010_attach(stru
fe->tuner_priv = priv;
return fe;
}
-EXPORT_SYMBOL(qt1010_attach);
+EXPORT_SYMBOL_GPL(qt1010_attach);
MODULE_DESCRIPTION("Quantek QT1010 silicon tuner driver");
MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
--- a/drivers/media/tuners/tda18218.c
+++ b/drivers/media/tuners/tda18218.c
@@ -336,7 +336,7 @@ struct dvb_frontend *tda18218_attach(str
return fe;
}
-EXPORT_SYMBOL(tda18218_attach);
+EXPORT_SYMBOL_GPL(tda18218_attach);
MODULE_DESCRIPTION("NXP TDA18218HN silicon tuner driver");
MODULE_AUTHOR("Antti Palosaari <crope@iki.fi>");
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -1744,7 +1744,7 @@ fail2:
xc4000_release(fe);
return NULL;
}
-EXPORT_SYMBOL(xc4000_attach);
+EXPORT_SYMBOL_GPL(xc4000_attach);
MODULE_AUTHOR("Steven Toth, Davide Ferri");
MODULE_DESCRIPTION("Xceive xc4000 silicon tuner driver");
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -1460,7 +1460,7 @@ fail:
xc5000_release(fe);
return NULL;
}
-EXPORT_SYMBOL(xc5000_attach);
+EXPORT_SYMBOL_GPL(xc5000_attach);
MODULE_AUTHOR("Steven Toth");
MODULE_DESCRIPTION("Xceive xc5000 silicon tuner driver");
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 286/406] Revert "scsi: qla2xxx: Fix buffer overrun"
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 285/406] media: dvb: symbol fixup for dvb_attach() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 287/406] scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Greg Kroah-Hartman
` (128 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nilesh Javali, Himanshu Madhani,
Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nilesh Javali <njavali@marvell.com>
commit 641671d97b9199f1ba35ccc2222d4b189a6a5de5 upstream.
Revert due to Get PLOGI Template failed.
This reverts commit b68710a8094fdffe8dd4f7a82c82649f479bb453.
Cc: stable@vger.kernel.org
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230821130045.34850-9-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -5107,7 +5107,7 @@ static void qla_get_login_template(scsi_
__be32 *q;
memset(ha->init_cb, 0, ha->init_cb_size);
- sz = min_t(int, sizeof(struct fc_els_csp), ha->init_cb_size);
+ sz = min_t(int, sizeof(struct fc_els_flogi), ha->init_cb_size);
rval = qla24xx_get_port_login_templ(vha, ha->init_cb_dma,
ha->init_cb, sz);
if (rval != QLA_SUCCESS) {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 287/406] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 286/406] Revert "scsi: qla2xxx: Fix buffer overrun" Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 288/406] ntb: Drop packets when qp link is down Greg Kroah-Hartman
` (127 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ranjan Kumar, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranjan Kumar <ranjan.kumar@broadcom.com>
commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream.
The driver retries certain register reads 3 times if the returned value is
0. This was done because the controller could return 0 for certain
registers if other registers were being accessed concurrently by the BMC.
In certain systems with increased BMC interactions, the register values
returned can be 0 for longer than 3 retries. Change the retry count from 3
to 30 for the affected registers to prevent problems with out-of-band
management.
Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads")
Cc: stable@vger.kernel.org
Signed-off-by: Ranjan Kumar <ranjan.kumar@broadcom.com>
Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++++++-----------
drivers/scsi/mpt3sas/mpt3sas_base.h | 1
2 files changed, 34 insertions(+), 13 deletions(-)
--- a/drivers/scsi/mpt3sas/mpt3sas_base.c
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c
@@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPT
static void
_base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc);
+static u32
+_base_readl_ext_retry(const volatile void __iomem *addr);
+
/**
* mpt3sas_base_check_cmd_timeout - Function
* to check timeout and command termination due
@@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __i
return ret_val;
}
+static u32
+_base_readl_ext_retry(const volatile void __iomem *addr)
+{
+ u32 i, ret_val;
+
+ for (i = 0 ; i < 30 ; i++) {
+ ret_val = readl(addr);
+ if (ret_val == 0)
+ continue;
+ }
+
+ return ret_val;
+}
+
static inline u32
_base_readl(const volatile void __iomem *addr)
{
@@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADA
dump_stack();
- doorbell = ioc->base_readl(&ioc->chip->Doorbell);
+ doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell);
if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) {
mpt3sas_print_fault_code(ioc, doorbell &
MPI2_DOORBELL_DATA_MASK);
@@ -5667,7 +5684,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS
{
u32 s, sc;
- s = ioc->base_readl(&ioc->chip->Doorbell);
+ s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell);
sc = s & MPI2_IOC_STATE_MASK;
return cooked ? sc : s;
}
@@ -5812,7 +5829,7 @@ _base_wait_for_doorbell_ack(struct MPT3S
__func__, count, timeout));
return 0;
} else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) {
- doorbell = ioc->base_readl(&ioc->chip->Doorbell);
+ doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell);
if ((doorbell & MPI2_IOC_STATE_MASK) ==
MPI2_IOC_STATE_FAULT) {
mpt3sas_print_fault_code(ioc, doorbell);
@@ -5852,7 +5869,7 @@ _base_wait_for_doorbell_not_used(struct
count = 0;
cntdn = 1000 * timeout;
do {
- doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell);
+ doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell);
if (!(doorbell_reg & MPI2_DOORBELL_USED)) {
dhsprintk(ioc,
ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n",
@@ -5989,7 +6006,7 @@ _base_handshake_req_reply_wait(struct MP
__le32 *mfp;
/* make sure doorbell is not in use */
- if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) {
+ if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) {
ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__);
return -EFAULT;
}
@@ -6038,7 +6055,7 @@ _base_handshake_req_reply_wait(struct MP
}
/* read the first two 16-bits, it gives the total length of the reply */
- reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell)
+ reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell)
& MPI2_DOORBELL_DATA_MASK);
writel(0, &ioc->chip->HostInterruptStatus);
if ((_base_wait_for_doorbell_int(ioc, 5))) {
@@ -6046,7 +6063,7 @@ _base_handshake_req_reply_wait(struct MP
__LINE__);
return -EFAULT;
}
- reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell)
+ reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell)
& MPI2_DOORBELL_DATA_MASK);
writel(0, &ioc->chip->HostInterruptStatus);
@@ -6057,10 +6074,10 @@ _base_handshake_req_reply_wait(struct MP
return -EFAULT;
}
if (i >= reply_bytes/2) /* overflow case */
- ioc->base_readl(&ioc->chip->Doorbell);
+ ioc->base_readl_ext_retry(&ioc->chip->Doorbell);
else
reply[i] = le16_to_cpu(
- ioc->base_readl(&ioc->chip->Doorbell)
+ ioc->base_readl_ext_retry(&ioc->chip->Doorbell)
& MPI2_DOORBELL_DATA_MASK);
writel(0, &ioc->chip->HostInterruptStatus);
}
@@ -6906,7 +6923,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER
goto out;
}
- host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic);
+ host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic);
drsprintk(ioc,
ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n",
count, host_diagnostic));
@@ -6926,7 +6943,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER
for (count = 0; count < (300000000 /
MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) {
- host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic);
+ host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic);
if (host_diagnostic == 0xFFFFFFFF) {
ioc_info(ioc,
@@ -7313,10 +7330,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPT
ioc->rdpq_array_enable_assigned = 0;
ioc->use_32bit_dma = false;
ioc->dma_mask = 64;
- if (ioc->is_aero_ioc)
+ if (ioc->is_aero_ioc) {
ioc->base_readl = &_base_readl_aero;
- else
+ ioc->base_readl_ext_retry = &_base_readl_ext_retry;
+ } else {
ioc->base_readl = &_base_readl;
+ ioc->base_readl_ext_retry = &_base_readl;
+ }
r = mpt3sas_base_map_resources(ioc);
if (r)
goto out_free_resources;
--- a/drivers/scsi/mpt3sas/mpt3sas_base.h
+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h
@@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER {
u8 diag_trigger_active;
u8 atomic_desc_capable;
BASE_READ_REG base_readl;
+ BASE_READ_REG base_readl_ext_retry;
struct SL_WH_MASTER_TRIGGER_T diag_trigger_master;
struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event;
struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 288/406] ntb: Drop packets when qp link is down
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 287/406] scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 289/406] ntb: Clean up tx tail index on link down Greg Kroah-Hartman
` (126 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Y Lu, Logan Gunthorpe,
Dave Jiang, Jon Mason
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
commit f195a1a6fe416882984f8bd6c61afc1383171860 upstream.
Currently when the transport receive packets after netdev has closed the
transport returns error and triggers tx errors to be incremented and
carrier to be stopped. There is no reason to return error if the device is
already closed. Drop the packet and return 0.
Fixes: e26a5843f7f5 ("NTB: Split ntb_hw_intel and ntb_transport drivers")
Reported-by: Yuan Y Lu <yuan.y.lu@intel.com>
Tested-by: Yuan Y Lu <yuan.y.lu@intel.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -2278,9 +2278,13 @@ int ntb_transport_tx_enqueue(struct ntb_
struct ntb_queue_entry *entry;
int rc;
- if (!qp || !qp->link_is_up || !len)
+ if (!qp || !len)
return -EINVAL;
+ /* If the qp link is down already, just ignore. */
+ if (!qp->link_is_up)
+ return 0;
+
entry = ntb_list_rm(&qp->ntb_tx_free_q_lock, &qp->tx_free_q);
if (!entry) {
qp->tx_err_no_buf++;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 289/406] ntb: Clean up tx tail index on link down
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 288/406] ntb: Drop packets when qp link is down Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 290/406] ntb: Fix calculation ntb_transport_tx_free_entry() Greg Kroah-Hartman
` (125 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuan Y Lu, Logan Gunthorpe,
Dave Jiang, Jon Mason
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
commit cc79bd2738c2d40aba58b2be6ce47dc0e471df0e upstream.
The tx tail index is not reset when the link goes down. This causes the
tail index to go out of sync when the link goes down and comes back up.
Refactor the ntb_qp_link_down_reset() and reset the tail index as well.
Fixes: 2849b5d70641 ("NTB: Reset transport QP link stats on down")
Reported-by: Yuan Y Lu <yuan.y.lu@intel.com>
Tested-by: Yuan Y Lu <yuan.y.lu@intel.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -911,7 +911,7 @@ static int ntb_set_mw(struct ntb_transpo
return 0;
}
-static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
+static void ntb_qp_link_context_reset(struct ntb_transport_qp *qp)
{
qp->link_is_up = false;
qp->active = false;
@@ -934,6 +934,13 @@ static void ntb_qp_link_down_reset(struc
qp->tx_async = 0;
}
+static void ntb_qp_link_down_reset(struct ntb_transport_qp *qp)
+{
+ ntb_qp_link_context_reset(qp);
+ if (qp->remote_rx_info)
+ qp->remote_rx_info->entry = qp->rx_max_entry - 1;
+}
+
static void ntb_qp_link_cleanup(struct ntb_transport_qp *qp)
{
struct ntb_transport_ctx *nt = qp->transport;
@@ -1176,7 +1183,7 @@ static int ntb_transport_init_queue(stru
qp->ndev = nt->ndev;
qp->client_ready = false;
qp->event_handler = NULL;
- ntb_qp_link_down_reset(qp);
+ ntb_qp_link_context_reset(qp);
if (mw_num < qp_count % mw_count)
num_qps_mw = qp_count / mw_count + 1;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 290/406] ntb: Fix calculation ntb_transport_tx_free_entry()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 289/406] ntb: Clean up tx tail index on link down Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 291/406] Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" Greg Kroah-Hartman
` (124 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Logan Gunthorpe, renlonglong,
Dave Jiang, Jon Mason
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Jiang <dave.jiang@intel.com>
commit 5a7693e6bbf19b22fd6c1d2c4b7beb0a03969e2c upstream.
ntb_transport_tx_free_entry() never returns 0 with the current
calculation. If head == tail, then it would return qp->tx_max_entry.
Change compare to tail >= head and when they are equal, a 0 would be
returned.
Fixes: e74bfeedad08 ("NTB: Add flow control to the ntb_netdev")
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Signed-off-by: renlonglong <ren.longlong@h3c.com>
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ntb/ntb_transport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/ntb/ntb_transport.c
+++ b/drivers/ntb/ntb_transport.c
@@ -2431,7 +2431,7 @@ unsigned int ntb_transport_tx_free_entry
unsigned int head = qp->tx_index;
unsigned int tail = qp->remote_rx_info->entry;
- return tail > head ? tail - head : qp->tx_max_entry + tail - head;
+ return tail >= head ? tail - head : qp->tx_max_entry + tail - head;
}
EXPORT_SYMBOL_GPL(ntb_transport_tx_free_entry);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 291/406] Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 290/406] ntb: Fix calculation ntb_transport_tx_free_entry() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 292/406] procfs: block chmod on /proc/thread-self/comm Greg Kroah-Hartman
` (123 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Bjorn Helgaas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bjorn Helgaas <bhelgaas@google.com>
commit 5260bd6d36c83c5b269c33baaaf8c78e520908b0 upstream.
This reverts commit d5af729dc2071273f14cbb94abbc60608142fd83.
d5af729dc207 ("PCI: Mark NVIDIA T4 GPUs to avoid bus reset") avoided
Secondary Bus Reset on the T4 because the reset seemed to not work when the
T4 was directly attached to a Root Port.
But NVIDIA thinks the issue is probably related to some issue with the Root
Port, not with the T4. The T4 provides neither PM nor FLR reset, so
masking bus reset compromises this device for assignment scenarios.
Revert d5af729dc207 as requested by Wu Zongyong. This will leave SBR
broken in the specific configuration Wu tested, as it was in v6.5, so Wu
will debug that further.
Link: https://lore.kernel.org/r/ZPqMCDWvITlOLHgJ@wuzongyong-alibaba
Link: https://lore.kernel.org/r/20230908201104.GA305023@bhelgaas
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -3578,7 +3578,7 @@ static void quirk_no_bus_reset(struct pc
*/
static void quirk_nvidia_no_bus_reset(struct pci_dev *dev)
{
- if ((dev->device & 0xffc0) == 0x2340 || dev->device == 0x1eb8)
+ if ((dev->device & 0xffc0) == 0x2340)
quirk_no_bus_reset(dev);
}
DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 292/406] procfs: block chmod on /proc/thread-self/comm
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 291/406] Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 293/406] parisc: Fix /proc/cpuinfo output for lscpu Greg Kroah-Hartman
` (122 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Aleksa Sarai, Christian Brauner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <cyphar@cyphar.com>
commit ccf61486fe1e1a48e18c638d1813cda77b3c0737 upstream.
Due to an oversight in commit 1b3044e39a89 ("procfs: fix pthread
cross-thread naming if !PR_DUMPABLE") in switching from REG to NOD,
chmod operations on /proc/thread-self/comm were no longer blocked as
they are on almost all other procfs files.
A very similar situation with /proc/self/environ was used to as a root
exploit a long time ago, but procfs has SB_I_NOEXEC so this is simply a
correctness issue.
Ref: https://lwn.net/Articles/191954/
Ref: 6d76fa58b050 ("Don't allow chmod() on the /proc/<pid>/ files")
Fixes: 1b3044e39a89 ("procfs: fix pthread cross-thread naming if !PR_DUMPABLE")
Cc: stable@vger.kernel.org # v4.7+
Signed-off-by: Aleksa Sarai <cyphar@cyphar.com>
Message-Id: <20230713141001.27046-1-cyphar@cyphar.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/base.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -3506,7 +3506,8 @@ static int proc_tid_comm_permission(stru
}
static const struct inode_operations proc_tid_comm_inode_operations = {
- .permission = proc_tid_comm_permission,
+ .setattr = proc_setattr,
+ .permission = proc_tid_comm_permission,
};
/*
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 293/406] parisc: Fix /proc/cpuinfo output for lscpu
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 292/406] procfs: block chmod on /proc/thread-self/comm Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks Greg Kroah-Hartman
` (121 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 9f5ba4b3e1b3c123eeca5d2d09161e8720048b5c upstream.
The lscpu command is broken since commit cab56b51ec0e ("parisc: Fix
device names in /proc/iomem") added the PA pathname to all PA
devices, includig the CPUs.
lscpu parses /proc/cpuinfo and now believes it found different CPU
types since every CPU is listed with an unique identifier (PA
pathname).
Fix this problem by simply dropping the PA pathname when listing the
CPUs in /proc/cpuinfo. There is no need to show the pathname in this
procfs file.
Fixes: cab56b51ec0e ("parisc: Fix device names in /proc/iomem")
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org> # v4.9+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/kernel/processor.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/arch/parisc/kernel/processor.c
+++ b/arch/parisc/kernel/processor.c
@@ -373,10 +373,18 @@ int
show_cpuinfo (struct seq_file *m, void *v)
{
unsigned long cpu;
+ char cpu_name[60], *p;
+
+ /* strip PA path from CPU name to not confuse lscpu */
+ strlcpy(cpu_name, per_cpu(cpu_data, 0).dev->name, sizeof(cpu_name));
+ p = strrchr(cpu_name, '[');
+ if (p)
+ *(--p) = 0;
for_each_online_cpu(cpu) {
- const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu);
#ifdef CONFIG_SMP
+ const struct cpuinfo_parisc *cpuinfo = &per_cpu(cpu_data, cpu);
+
if (0 == cpuinfo->hpa)
continue;
#endif
@@ -421,8 +429,7 @@ show_cpuinfo (struct seq_file *m, void *
seq_printf(m, "model\t\t: %s - %s\n",
boot_cpu_data.pdc.sys_model_name,
- cpuinfo->dev ?
- cpuinfo->dev->name : "Unknown");
+ cpu_name);
seq_printf(m, "hversion\t: 0x%08x\n"
"sversion\t: 0x%08x\n",
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 293/406] parisc: Fix /proc/cpuinfo output for lscpu Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 20:21 ` Eduard Zingerman
2023-09-17 19:12 ` [PATCH 5.10 295/406] dlm: fix plock lookup when using multiple lockspaces Greg Kroah-Hartman
` (120 subsequent siblings)
414 siblings, 1 reply; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yonghong Song, Alexei Starovoitov,
Yafang Shao, Eduard Zingerman, Alexei Starovoitov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <laoar.shao@gmail.com>
commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2 upstream.
After we converted the capabilities of our networking-bpf program from
cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program
failed to start. Because it failed the bpf verifier, and the error log
is "R3 pointer comparison prohibited".
A simple reproducer as follows,
SEC("cls-ingress")
int ingress(struct __sk_buff *skb)
{
struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
if ((long)(iph + 1) > (long)skb->data_end)
return TC_ACT_STOLEN;
return TC_ACT_OK;
}
Per discussion with Yonghong and Alexei [1], comparison of two packet
pointers is not a pointer leak. This patch fixes it.
Our local kernel is 6.1.y and we expect this fix to be backported to
6.1.y, so stable is CCed.
[1]. https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/
Suggested-by: Yonghong Song <yonghong.song@linux.dev>
Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230823020703.3790-2-laoar.shao@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/verifier.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -8178,6 +8178,12 @@ static int check_cond_jmp_op(struct bpf_
return -EINVAL;
}
+ /* check src2 operand */
+ err = check_reg_arg(env, insn->dst_reg, SRC_OP);
+ if (err)
+ return err;
+
+ dst_reg = ®s[insn->dst_reg];
if (BPF_SRC(insn->code) == BPF_X) {
if (insn->imm != 0) {
verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");
@@ -8189,12 +8195,13 @@ static int check_cond_jmp_op(struct bpf_
if (err)
return err;
- if (is_pointer_value(env, insn->src_reg)) {
+ src_reg = ®s[insn->src_reg];
+ if (!(reg_is_pkt_pointer_any(dst_reg) && reg_is_pkt_pointer_any(src_reg)) &&
+ is_pointer_value(env, insn->src_reg)) {
verbose(env, "R%d pointer comparison prohibited\n",
insn->src_reg);
return -EACCES;
}
- src_reg = ®s[insn->src_reg];
} else {
if (insn->src_reg != BPF_REG_0) {
verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");
@@ -8202,12 +8209,6 @@ static int check_cond_jmp_op(struct bpf_
}
}
- /* check src2 operand */
- err = check_reg_arg(env, insn->dst_reg, SRC_OP);
- if (err)
- return err;
-
- dst_reg = ®s[insn->dst_reg];
is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
if (BPF_SRC(insn->code) == BPF_K) {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 295/406] dlm: fix plock lookup when using multiple lockspaces
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 296/406] dccp: Fix out of bounds access in DCCP error handler Greg Kroah-Hartman
` (119 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Barry Marson, Alexander Aring,
David Teigland
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Aring <aahringo@redhat.com>
commit 7c53e847ff5e97f033fdd31f71949807633d506b upstream.
All posix lock ops, for all lockspaces (gfs2 file systems) are
sent to userspace (dlm_controld) through a single misc device.
The dlm_controld daemon reads the ops from the misc device
and sends them to other cluster nodes using separate, per-lockspace
cluster api communication channels. The ops for a single lockspace
are ordered at this level, so that the results are received in
the same sequence that the requests were sent. When the results
are sent back to the kernel via the misc device, they are again
funneled through the single misc device for all lockspaces. When
the dlm code in the kernel processes the results from the misc
device, these results will be returned in the same sequence that
the requests were sent, on a per-lockspace basis. A recent change
in this request/reply matching code missed the "per-lockspace"
check (fsid comparison) when matching request and reply, so replies
could be incorrectly matched to requests from other lockspaces.
Cc: stable@vger.kernel.org
Reported-by: Barry Marson <bmarson@redhat.com>
Fixes: 57e2c2f2d94c ("fs: dlm: fix mismatch of plock results from userspace")
Signed-off-by: Alexander Aring <aahringo@redhat.com>
Signed-off-by: David Teigland <teigland@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/dlm/plock.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/dlm/plock.c
+++ b/fs/dlm/plock.c
@@ -466,7 +466,8 @@ static ssize_t dev_write(struct file *fi
}
} else {
list_for_each_entry(iter, &recv_list, list) {
- if (!iter->info.wait) {
+ if (!iter->info.wait &&
+ iter->info.fsid == info.fsid) {
op = iter;
break;
}
@@ -478,8 +479,7 @@ static ssize_t dev_write(struct file *fi
if (info.wait)
WARN_ON(op->info.optype != DLM_PLOCK_OP_LOCK);
else
- WARN_ON(op->info.fsid != info.fsid ||
- op->info.number != info.number ||
+ WARN_ON(op->info.number != info.number ||
op->info.owner != info.owner ||
op->info.optype != info.optype);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 296/406] dccp: Fix out of bounds access in DCCP error handler
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 295/406] dlm: fix plock lookup when using multiple lockspaces Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 297/406] X.509: if signature is unsupported skip validation Greg Kroah-Hartman
` (118 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jann Horn, Kuniyuki Iwashima,
David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jann Horn <jannh@google.com>
commit 977ad86c2a1bcaf58f01ab98df5cc145083c489c upstream.
There was a previous attempt to fix an out-of-bounds access in the DCCP
error handlers, but that fix assumed that the error handlers only want
to access the first 8 bytes of the DCCP header. Actually, they also look
at the DCCP sequence number, which is stored beyond 8 bytes, so an
explicit pskb_may_pull() is required.
Fixes: 6706a97fec96 ("dccp: fix out of bound access in dccp_v4_err()")
Fixes: 1aa9d1a0e7ee ("ipv6: dccp: fix out of bound access in dccp_v6_err()")
Cc: stable@vger.kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dccp/ipv4.c | 13 +++++++++----
net/dccp/ipv6.c | 15 ++++++++++-----
2 files changed, 19 insertions(+), 9 deletions(-)
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -243,12 +243,17 @@ static int dccp_v4_err(struct sk_buff *s
int err;
struct net *net = dev_net(skb->dev);
- /* Only need dccph_dport & dccph_sport which are the first
- * 4 bytes in dccp header.
+ /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
+ * which is in byte 7 of the dccp header.
* Our caller (icmp_socket_deliver()) already pulled 8 bytes for us.
+ *
+ * Later on, we want to access the sequence number fields, which are
+ * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
*/
- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+ dh = (struct dccp_hdr *)(skb->data + offset);
+ if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
+ return -EINVAL;
+ iph = (struct iphdr *)skb->data;
dh = (struct dccp_hdr *)(skb->data + offset);
sk = __inet_lookup_established(net, &dccp_hashinfo,
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -67,7 +67,7 @@ static inline __u64 dccp_v6_init_sequenc
static int dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
u8 type, u8 code, int offset, __be32 info)
{
- const struct ipv6hdr *hdr = (const struct ipv6hdr *)skb->data;
+ const struct ipv6hdr *hdr;
const struct dccp_hdr *dh;
struct dccp_sock *dp;
struct ipv6_pinfo *np;
@@ -76,12 +76,17 @@ static int dccp_v6_err(struct sk_buff *s
__u64 seq;
struct net *net = dev_net(skb->dev);
- /* Only need dccph_dport & dccph_sport which are the first
- * 4 bytes in dccp header.
+ /* For the first __dccp_basic_hdr_len() check, we only need dh->dccph_x,
+ * which is in byte 7 of the dccp header.
* Our caller (icmpv6_notify()) already pulled 8 bytes for us.
+ *
+ * Later on, we want to access the sequence number fields, which are
+ * beyond 8 bytes, so we have to pskb_may_pull() ourselves.
*/
- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_sport) > 8);
- BUILD_BUG_ON(offsetofend(struct dccp_hdr, dccph_dport) > 8);
+ dh = (struct dccp_hdr *)(skb->data + offset);
+ if (!pskb_may_pull(skb, offset + __dccp_basic_hdr_len(dh)))
+ return -EINVAL;
+ hdr = (const struct ipv6hdr *)skb->data;
dh = (struct dccp_hdr *)(skb->data + offset);
sk = __inet6_lookup_established(net, &dccp_hashinfo,
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 297/406] X.509: if signature is unsupported skip validation
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 296/406] dccp: Fix out of bounds access in DCCP error handler Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 298/406] net: handle ARPHRD_PPP in dev_is_mac_header_xmit() Greg Kroah-Hartman
` (117 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thore Sommer, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thore Sommer <public@thson.de>
commit ef5b52a631f8c18353e80ccab8408b963305510c upstream.
When the hash algorithm for the signature is not available the digest size
is 0 and the signature in the certificate is marked as unsupported.
When validating a self-signed certificate, this needs to be checked,
because otherwise trying to validate the signature will fail with an
warning:
Loading compiled-in X.509 certificates
WARNING: CPU: 0 PID: 1 at crypto/rsa-pkcs1pad.c:537 \
pkcs1pad_verify+0x46/0x12c
...
Problem loading in-kernel X.509 certificate (-22)
Signed-off-by: Thore Sommer <public@thson.de>
Cc: stable@vger.kernel.org # v4.7+
Fixes: 6c2dc5ae4ab7 ("X.509: Extract signature digest and make self-signed cert checks earlier")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/asymmetric_keys/x509_public_key.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/crypto/asymmetric_keys/x509_public_key.c
+++ b/crypto/asymmetric_keys/x509_public_key.c
@@ -132,6 +132,11 @@ int x509_check_for_self_signed(struct x5
if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
goto out;
+ if (cert->unsupported_sig) {
+ ret = 0;
+ goto out;
+ }
+
ret = public_key_verify_signature(cert->pub, cert->sig);
if (ret < 0) {
if (ret == -ENOPKG) {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 298/406] net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 297/406] X.509: if signature is unsupported skip validation Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 299/406] fsverity: skip PKCS#7 parser when keyring is empty Greg Kroah-Hartman
` (116 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel, Siwar Zitouni,
Guillaume Nault, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
commit a4f39c9f14a634e4cd35fcd338c239d11fcc73fc upstream.
The goal is to support a bpf_redirect() from an ethernet device (ingress)
to a ppp device (egress).
The l2 header is added automatically by the ppp driver, thus the ethernet
header should be removed.
CC: stable@vger.kernel.org
Fixes: 27b29f63058d ("bpf: add bpf_redirect() helper")
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Tested-by: Siwar Zitouni <siwar.zitouni@6wind.com>
Reviewed-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/if_arp.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/include/linux/if_arp.h
+++ b/include/linux/if_arp.h
@@ -52,6 +52,10 @@ static inline bool dev_is_mac_header_xmi
case ARPHRD_NONE:
case ARPHRD_RAWIP:
case ARPHRD_PIMREG:
+ /* PPP adds its l2 header automatically in ppp_start_xmit().
+ * This makes it look like an l3 device to __bpf_redirect() and tcf_mirred_init().
+ */
+ case ARPHRD_PPP:
return false;
default:
return true;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 299/406] fsverity: skip PKCS#7 parser when keyring is empty
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 298/406] net: handle ARPHRD_PPP in dev_is_mac_header_xmit() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 300/406] pstore/ram: Check start of empty przs during init Greg Kroah-Hartman
` (115 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jarkko Sakkinen, Eric Biggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit 919dc320956ea353a7fb2d84265195ad5ef525ac upstream.
If an fsverity builtin signature is given for a file but the
".fs-verity" keyring is empty, there's no real reason to run the PKCS#7
parser. Skip this to avoid the PKCS#7 attack surface when builtin
signature support is configured into the kernel but is not being used.
This is a hardening improvement, not a fix per se, but I've added
Fixes and Cc stable to get it out to more users.
Fixes: 432434c9f8e1 ("fs-verity: support builtin file signatures")
Cc: stable@vger.kernel.org
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/20230820173237.2579-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/verity/signature.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/fs/verity/signature.c
+++ b/fs/verity/signature.c
@@ -61,6 +61,22 @@ int fsverity_verify_signature(const stru
return -EBADMSG;
}
+ if (fsverity_keyring->keys.nr_leaves_on_tree == 0) {
+ /*
+ * The ".fs-verity" keyring is empty, due to builtin signatures
+ * being supported by the kernel but not actually being used.
+ * In this case, verify_pkcs7_signature() would always return an
+ * error, usually ENOKEY. It could also be EBADMSG if the
+ * PKCS#7 is malformed, but that isn't very important to
+ * distinguish. So, just skip to ENOKEY to avoid the attack
+ * surface of the PKCS#7 parser, which would otherwise be
+ * reachable by any task able to execute FS_IOC_ENABLE_VERITY.
+ */
+ fsverity_err(inode,
+ "fs-verity keyring is empty, rejecting signed file!");
+ return -ENOKEY;
+ }
+
d = kzalloc(sizeof(*d) + hash_alg->digest_size, GFP_KERNEL);
if (!d)
return -ENOMEM;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 300/406] pstore/ram: Check start of empty przs during init
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 299/406] fsverity: skip PKCS#7 parser when keyring is empty Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 301/406] s390/ipl: add missing secure/has_secure file to ipl type unknown Greg Kroah-Hartman
` (114 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yunlong Xing, Enlin Mu, Kees Cook
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Enlin Mu <enlin.mu@unisoc.com>
commit fe8c3623ab06603eb760444a032d426542212021 upstream.
After commit 30696378f68a ("pstore/ram: Do not treat empty buffers as
valid"), initialization would assume a prz was valid after seeing that
the buffer_size is zero (regardless of the buffer start position). This
unchecked start value means it could be outside the bounds of the buffer,
leading to future access panics when written to:
sysdump_panic_event+0x3b4/0x5b8
atomic_notifier_call_chain+0x54/0x90
panic+0x1c8/0x42c
die+0x29c/0x2a8
die_kernel_fault+0x68/0x78
__do_kernel_fault+0x1c4/0x1e0
do_bad_area+0x40/0x100
do_translation_fault+0x68/0x80
do_mem_abort+0x68/0xf8
el1_da+0x1c/0xc0
__raw_writeb+0x38/0x174
__memcpy_toio+0x40/0xac
persistent_ram_update+0x44/0x12c
persistent_ram_write+0x1a8/0x1b8
ramoops_pstore_write+0x198/0x1e8
pstore_console_write+0x94/0xe0
...
To avoid this, also check if the prz start is 0 during the initialization
phase. If not, the next prz sanity check case will discover it (start >
size) and zap the buffer back to a sane state.
Fixes: 30696378f68a ("pstore/ram: Do not treat empty buffers as valid")
Cc: Yunlong Xing <yunlong.xing@unisoc.com>
Cc: stable@vger.kernel.org
Signed-off-by: Enlin Mu <enlin.mu@unisoc.com>
Link: https://lore.kernel.org/r/20230801060432.1307717-1-yunlong.xing@unisoc.com
[kees: update commit log with backtrace and clarifications]
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/pstore/ram_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -504,7 +504,7 @@ static int persistent_ram_post_init(stru
sig ^= PERSISTENT_RAM_SIG;
if (prz->buffer->sig == sig) {
- if (buffer_size(prz) == 0) {
+ if (buffer_size(prz) == 0 && buffer_start(prz) == 0) {
pr_debug("found existing empty buffer\n");
return 0;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 301/406] s390/ipl: add missing secure/has_secure file to ipl type unknown
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 300/406] pstore/ram: Check start of empty przs during init Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 302/406] crypto: stm32 - fix loop iterating through scatterlist for DMA Greg Kroah-Hartman
` (113 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sven Schnelle, Heiko Carstens
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Schnelle <svens@linux.ibm.com>
commit ea5717cb13468323a7c3dd394748301802991f39 upstream.
OS installers are relying on /sys/firmware/ipl/has_secure to be
present on machines supporting secure boot. This file is present
for all IPL types, but not the unknown type, which prevents a secure
installation when an LPAR is booted in HMC via FTP(s), because
this is an unknown IPL type in linux. While at it, also add the secure
file.
Fixes: c9896acc7851 ("s390/ipl: Provide has_secure sysfs attribute")
Cc: stable@vger.kernel.org
Signed-off-by: Sven Schnelle <svens@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/ipl.c | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -501,6 +501,8 @@ static struct attribute_group ipl_ccw_at
static struct attribute *ipl_unknown_attrs[] = {
&sys_ipl_type_attr.attr,
+ &sys_ipl_secure_attr.attr,
+ &sys_ipl_has_secure_attr.attr,
NULL,
};
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 302/406] crypto: stm32 - fix loop iterating through scatterlist for DMA
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 301/406] s390/ipl: add missing secure/has_secure file to ipl type unknown Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 303/406] cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug Greg Kroah-Hartman
` (112 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thomas Bourgoin, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
commit d9c83f71eeceed2cb54bb78be84f2d4055fd9a1f upstream.
We were reading the length of the scatterlist sg after copying value of
tsg inside.
So we are using the size of the previous scatterlist and for the first
one we are using an unitialised value.
Fix this by copying tsg in sg[0] before reading the size.
Fixes : 8a1012d3f2ab ("crypto: stm32 - Support for STM32 HASH module")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Bourgoin <thomas.bourgoin@foss.st.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/stm32/stm32-hash.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -564,9 +564,9 @@ static int stm32_hash_dma_send(struct st
}
for_each_sg(rctx->sg, tsg, rctx->nents, i) {
+ sg[0] = *tsg;
len = sg->length;
- sg[0] = *tsg;
if (sg_is_last(sg)) {
if (hdev->dma_mode == 1) {
len = (ALIGN(sg->length, 16) - 16);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 303/406] cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 302/406] crypto: stm32 - fix loop iterating through scatterlist for DMA Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 304/406] usb: typec: bus: verify partner exists in typec_altmode_attention Greg Kroah-Hartman
` (111 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gustavo A. R. Silva,
Florian Fainelli, Viresh Kumar
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gustavo A. R. Silva <gustavoars@kernel.org>
commit e520d0b6be950ce3738cf4b9bd3b392be818f1dc upstream.
Allocate extra space for terminating element at:
drivers/cpufreq/brcmstb-avs-cpufreq.c:
449 table[i].frequency = CPUFREQ_TABLE_END;
and add code comment to make this clear.
This fixes the following -Warray-bounds warning seen after building
ARM with multi_v7_defconfig (GCC 13):
In function 'brcm_avs_get_freq_table',
inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15:
drivers/cpufreq/brcmstb-avs-cpufreq.c:449:28: warning: array subscript 5 is outside array bounds of 'void[60]' [-Warray-bounds=]
449 | table[i].frequency = CPUFREQ_TABLE_END;
In file included from include/linux/node.h:18,
from include/linux/cpu.h:17,
from include/linux/cpufreq.h:12,
from drivers/cpufreq/brcmstb-avs-cpufreq.c:44:
In function 'devm_kmalloc_array',
inlined from 'devm_kcalloc' at include/linux/device.h:328:9,
inlined from 'brcm_avs_get_freq_table' at drivers/cpufreq/brcmstb-avs-cpufreq.c:437:10,
inlined from 'brcm_avs_cpufreq_init' at drivers/cpufreq/brcmstb-avs-cpufreq.c:623:15:
include/linux/device.h:323:16: note: at offset 60 into object of size 60 allocated by 'devm_kmalloc'
323 | return devm_kmalloc(dev, bytes, flags);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
This helps with the ongoing efforts to tighten the FORTIFY_SOURCE
routines on memcpy() and help us make progress towards globally
enabling -Warray-bounds.
Link: https://github.com/KSPP/linux/issues/324
Fixes: de322e085995 ("cpufreq: brcmstb-avs-cpufreq: AVS CPUfreq driver for Broadcom STB SoCs")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/cpufreq/brcmstb-avs-cpufreq.c
+++ b/drivers/cpufreq/brcmstb-avs-cpufreq.c
@@ -434,7 +434,11 @@ brcm_avs_get_freq_table(struct device *d
if (ret)
return ERR_PTR(ret);
- table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1, sizeof(*table),
+ /*
+ * We allocate space for the 5 different P-STATES AVS,
+ * plus extra space for a terminating element.
+ */
+ table = devm_kcalloc(dev, AVS_PSTATE_MAX + 1 + 1, sizeof(*table),
GFP_KERNEL);
if (!table)
return ERR_PTR(-ENOMEM);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 304/406] usb: typec: bus: verify partner exists in typec_altmode_attention
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 303/406] cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 305/406] USB: core: Unite old scheme and new scheme descriptor reads Greg Kroah-Hartman
` (110 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, RD Babiera, Heikki Krogerus,
Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <rdbabiera@google.com>
commit f23643306430f86e2f413ee2b986e0773e79da31 upstream.
Some usb hubs will negotiate DisplayPort Alt mode with the device
but will then negotiate a data role swap after entering the alt
mode. The data role swap causes the device to unregister all alt
modes, however the usb hub will still send Attention messages
even after failing to reregister the Alt Mode. type_altmode_attention
currently does not verify whether or not a device's altmode partner
exists, which results in a NULL pointer error when dereferencing
the typec_altmode and typec_altmode_ops belonging to the altmode
partner.
Verify the presence of a device's altmode partner before sending
the Attention message to the Alt Mode driver.
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230814180559.923475-1-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/bus.c | 12 ++++++++++--
drivers/usb/typec/tcpm/tcpm.c | 3 ++-
include/linux/usb/typec_altmode.h | 2 +-
3 files changed, 13 insertions(+), 4 deletions(-)
--- a/drivers/usb/typec/bus.c
+++ b/drivers/usb/typec/bus.c
@@ -152,12 +152,20 @@ EXPORT_SYMBOL_GPL(typec_altmode_exit);
*
* Notifies the partner of @adev about Attention command.
*/
-void typec_altmode_attention(struct typec_altmode *adev, u32 vdo)
+int typec_altmode_attention(struct typec_altmode *adev, u32 vdo)
{
- struct typec_altmode *pdev = &to_altmode(adev)->partner->adev;
+ struct altmode *partner = to_altmode(adev)->partner;
+ struct typec_altmode *pdev;
+
+ if (!partner)
+ return -ENODEV;
+
+ pdev = &partner->adev;
if (pdev->ops && pdev->ops->attention)
pdev->ops->attention(pdev, vdo);
+
+ return 0;
}
EXPORT_SYMBOL_GPL(typec_altmode_attention);
--- a/drivers/usb/typec/tcpm/tcpm.c
+++ b/drivers/usb/typec/tcpm/tcpm.c
@@ -1395,7 +1395,8 @@ static void tcpm_handle_vdm_request(stru
}
break;
case ADEV_ATTENTION:
- typec_altmode_attention(adev, p[1]);
+ if (typec_altmode_attention(adev, p[1]))
+ tcpm_log(port, "typec_altmode_attention no port partner altmode");
break;
}
}
--- a/include/linux/usb/typec_altmode.h
+++ b/include/linux/usb/typec_altmode.h
@@ -67,7 +67,7 @@ struct typec_altmode_ops {
int typec_altmode_enter(struct typec_altmode *altmode, u32 *vdo);
int typec_altmode_exit(struct typec_altmode *altmode);
-void typec_altmode_attention(struct typec_altmode *altmode, u32 vdo);
+int typec_altmode_attention(struct typec_altmode *altmode, u32 vdo);
int typec_altmode_vdm(struct typec_altmode *altmode,
const u32 header, const u32 *vdo, int count);
int typec_altmode_notify(struct typec_altmode *altmode, unsigned long conf,
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 305/406] USB: core: Unite old scheme and new scheme descriptor reads
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 304/406] usb: typec: bus: verify partner exists in typec_altmode_attention Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 306/406] USB: core: Change usb_get_device_descriptor() API Greg Kroah-Hartman
` (109 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, Oliver Neukum
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 85d07c55621676d47d873d2749b88f783cd4d5a1 upstream.
In preparation for reworking the usb_get_device_descriptor() routine,
it is desirable to unite the two different code paths responsible for
initially determining endpoint 0's maximum packet size in a newly
discovered USB device. Making this determination presents a
chicken-and-egg sort of problem, in that the only way to learn the
maxpacket value is to get it from the device descriptor retrieved from
the device, but communicating with the device to retrieve a descriptor
requires us to know beforehand the ep0 maxpacket size.
In practice this problem is solved in two different ways, referred to
in hub.c as the "old scheme" and the "new scheme". The old scheme
(which is the approach recommended by the USB-2 spec) involves asking
the device to send just the first eight bytes of its device
descriptor. Such a transfer uses packets containing no more than
eight bytes each, and every USB device must have an ep0 maxpacket size
>= 8, so this should succeed. Since the bMaxPacketSize0 field of the
device descriptor lies within the first eight bytes, this is all we
need.
The new scheme is an imitation of the technique used in an early
Windows USB implementation, giving it the happy advantage of working
with a wide variety of devices (some of them at the time would not
work with the old scheme, although that's probably less true now). It
involves making an initial guess of the ep0 maxpacket size, asking the
device to send up to 64 bytes worth of its device descriptor (which is
only 18 bytes long), and then resetting the device to clear any error
condition that might have resulted from the guess being wrong. The
initial guess is determined by the connection speed; it should be
correct in all cases other than full speed, for which the allowed
values are 8, 16, 32, and 64 (in this case the initial guess is 64).
The reason for this patch is that the old- and new-scheme parts of
hub_port_init() use different code paths, one involving
usb_get_device_descriptor() and one not, for their initial reads of
the device descriptor. Since these reads have essentially the same
purpose and are made under essentially the same circumstances, this is
illogical. It makes more sense to have both of them use a common
subroutine.
This subroutine does basically what the new scheme's code did, because
that approach is more general than the one used by the old scheme. It
only needs to know how many bytes to transfer and whether or not it is
being called for the first iteration of a retry loop (in case of
certain time-out errors). There are two main differences from the
former code:
We initialize the bDescriptorType field of the transfer buffer
to 0 before performing the transfer, to avoid possibly
accessing an uninitialized value afterward.
We read the device descriptor into a temporary buffer rather
than storing it directly into udev->descriptor, which the old
scheme implementation used to do.
Since the whole point of this first read of the device descriptor is
to determine the bMaxPacketSize0 value, that is what the new routine
returns (or an error code). The value is stored in a local variable
rather than in udev->descriptor. As a side effect, this necessitates
moving a section of code that checks the bcdUSB field for SuperSpeed
devices until after the full device descriptor has been retrieved.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Oliver Neukum <oneukum@suse.com>
Link: https://lore.kernel.org/r/495cb5d4-f956-4f4a-a875-1e67e9489510@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 173 ++++++++++++++++++++++++++-----------------------
1 file changed, 94 insertions(+), 79 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4594,6 +4594,67 @@ static int hub_enable_device(struct usb_
return hcd->driver->enable_device(hcd, udev);
}
+/*
+ * Get the bMaxPacketSize0 value during initialization by reading the
+ * device's device descriptor. Since we don't already know this value,
+ * the transfer is unsafe and it ignores I/O errors, only testing for
+ * reasonable received values.
+ *
+ * For "old scheme" initialization, size will be 8 so we read just the
+ * start of the device descriptor, which should work okay regardless of
+ * the actual bMaxPacketSize0 value. For "new scheme" initialization,
+ * size will be 64 (and buf will point to a sufficiently large buffer),
+ * which might not be kosher according to the USB spec but it's what
+ * Windows does and what many devices expect.
+ *
+ * Returns: bMaxPacketSize0 or a negative error code.
+ */
+static int get_bMaxPacketSize0(struct usb_device *udev,
+ struct usb_device_descriptor *buf, int size, bool first_time)
+{
+ int i, rc;
+
+ /*
+ * Retry on all errors; some devices are flakey.
+ * 255 is for WUSB devices, we actually need to use
+ * 512 (WUSB1.0[4.8.1]).
+ */
+ for (i = 0; i < GET_MAXPACKET0_TRIES; ++i) {
+ /* Start with invalid values in case the transfer fails */
+ buf->bDescriptorType = buf->bMaxPacketSize0 = 0;
+ rc = usb_control_msg(udev, usb_rcvaddr0pipe(),
+ USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
+ USB_DT_DEVICE << 8, 0,
+ buf, size,
+ initial_descriptor_timeout);
+ switch (buf->bMaxPacketSize0) {
+ case 8: case 16: case 32: case 64: case 255:
+ if (buf->bDescriptorType == USB_DT_DEVICE) {
+ rc = buf->bMaxPacketSize0;
+ break;
+ }
+ fallthrough;
+ default:
+ if (rc >= 0)
+ rc = -EPROTO;
+ break;
+ }
+
+ /*
+ * Some devices time out if they are powered on
+ * when already connected. They need a second
+ * reset, so return early. But only on the first
+ * attempt, lest we get into a time-out/reset loop.
+ */
+ if (rc > 0 || (rc == -ETIMEDOUT && first_time &&
+ udev->speed > USB_SPEED_FULL))
+ break;
+ }
+ return rc;
+}
+
+#define GET_DESCRIPTOR_BUFSIZE 64
+
/* Reset device, (re)assign address, get device descriptor.
* Device connection must be stable, no more debouncing needed.
* Returns device in USB_STATE_ADDRESS, except on error.
@@ -4618,6 +4679,12 @@ hub_port_init(struct usb_hub *hub, struc
int devnum = udev->devnum;
const char *driver_name;
bool do_new_scheme;
+ int maxp0;
+ struct usb_device_descriptor *buf;
+
+ buf = kmalloc(GET_DESCRIPTOR_BUFSIZE, GFP_NOIO);
+ if (!buf)
+ return -ENOMEM;
/* root hub ports have a slightly longer reset period
* (from USB 2.0 spec, section 7.1.7.5)
@@ -4732,9 +4799,6 @@ hub_port_init(struct usb_hub *hub, struc
for (retries = 0; retries < GET_DESCRIPTOR_TRIES; (++retries, msleep(100))) {
if (do_new_scheme) {
- struct usb_device_descriptor *buf;
- int r = 0;
-
retval = hub_enable_device(udev);
if (retval < 0) {
dev_err(&udev->dev,
@@ -4743,52 +4807,8 @@ hub_port_init(struct usb_hub *hub, struc
goto fail;
}
-#define GET_DESCRIPTOR_BUFSIZE 64
- buf = kmalloc(GET_DESCRIPTOR_BUFSIZE, GFP_NOIO);
- if (!buf) {
- retval = -ENOMEM;
- continue;
- }
-
- /* Retry on all errors; some devices are flakey.
- * 255 is for WUSB devices, we actually need to use
- * 512 (WUSB1.0[4.8.1]).
- */
- for (operations = 0; operations < GET_MAXPACKET0_TRIES;
- ++operations) {
- buf->bMaxPacketSize0 = 0;
- r = usb_control_msg(udev, usb_rcvaddr0pipe(),
- USB_REQ_GET_DESCRIPTOR, USB_DIR_IN,
- USB_DT_DEVICE << 8, 0,
- buf, GET_DESCRIPTOR_BUFSIZE,
- initial_descriptor_timeout);
- switch (buf->bMaxPacketSize0) {
- case 8: case 16: case 32: case 64: case 255:
- if (buf->bDescriptorType ==
- USB_DT_DEVICE) {
- r = 0;
- break;
- }
- fallthrough;
- default:
- if (r == 0)
- r = -EPROTO;
- break;
- }
- /*
- * Some devices time out if they are powered on
- * when already connected. They need a second
- * reset. But only on the first attempt,
- * lest we get into a time out/reset loop
- */
- if (r == 0 || (r == -ETIMEDOUT &&
- retries == 0 &&
- udev->speed > USB_SPEED_FULL))
- break;
- }
- udev->descriptor.bMaxPacketSize0 =
- buf->bMaxPacketSize0;
- kfree(buf);
+ maxp0 = get_bMaxPacketSize0(udev, buf,
+ GET_DESCRIPTOR_BUFSIZE, retries == 0);
retval = hub_port_reset(hub, port1, udev, delay, false);
if (retval < 0) /* error or disconnect */
@@ -4799,14 +4819,13 @@ hub_port_init(struct usb_hub *hub, struc
retval = -ENODEV;
goto fail;
}
- if (r) {
- if (r != -ENODEV)
+ if (maxp0 < 0) {
+ if (maxp0 != -ENODEV)
dev_err(&udev->dev, "device descriptor read/64, error %d\n",
- r);
- retval = -EMSGSIZE;
+ maxp0);
+ retval = maxp0;
continue;
}
-#undef GET_DESCRIPTOR_BUFSIZE
}
/*
@@ -4848,19 +4867,17 @@ hub_port_init(struct usb_hub *hub, struc
break;
}
- retval = usb_get_device_descriptor(udev, 8);
- if (retval < 8) {
+ /* !do_new_scheme || wusb */
+ maxp0 = get_bMaxPacketSize0(udev, buf, 8, retries == 0);
+ if (maxp0 < 0) {
+ retval = maxp0;
if (retval != -ENODEV)
dev_err(&udev->dev,
"device descriptor read/8, error %d\n",
retval);
- if (retval >= 0)
- retval = -EMSGSIZE;
} else {
u32 delay;
- retval = 0;
-
delay = udev->parent->hub_delay;
udev->hub_delay = min_t(u32, delay,
USB_TP_TRANSMISSION_DELAY_MAX);
@@ -4877,27 +4894,10 @@ hub_port_init(struct usb_hub *hub, struc
if (retval)
goto fail;
- /*
- * Some superspeed devices have finished the link training process
- * and attached to a superspeed hub port, but the device descriptor
- * got from those devices show they aren't superspeed devices. Warm
- * reset the port attached by the devices can fix them.
- */
- if ((udev->speed >= USB_SPEED_SUPER) &&
- (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) {
- dev_err(&udev->dev, "got a wrong device descriptor, "
- "warm reset device\n");
- hub_port_reset(hub, port1, udev,
- HUB_BH_RESET_TIME, true);
- retval = -EINVAL;
- goto fail;
- }
-
- if (udev->descriptor.bMaxPacketSize0 == 0xff ||
- udev->speed >= USB_SPEED_SUPER)
+ if (maxp0 == 0xff || udev->speed >= USB_SPEED_SUPER)
i = 512;
else
- i = udev->descriptor.bMaxPacketSize0;
+ i = maxp0;
if (usb_endpoint_maxp(&udev->ep0.desc) != i) {
if (udev->speed == USB_SPEED_LOW ||
!(i == 8 || i == 16 || i == 32 || i == 64)) {
@@ -4923,6 +4923,20 @@ hub_port_init(struct usb_hub *hub, struc
goto fail;
}
+ /*
+ * Some superspeed devices have finished the link training process
+ * and attached to a superspeed hub port, but the device descriptor
+ * got from those devices show they aren't superspeed devices. Warm
+ * reset the port attached by the devices can fix them.
+ */
+ if ((udev->speed >= USB_SPEED_SUPER) &&
+ (le16_to_cpu(udev->descriptor.bcdUSB) < 0x0300)) {
+ dev_err(&udev->dev, "got a wrong device descriptor, warm reset device\n");
+ hub_port_reset(hub, port1, udev, HUB_BH_RESET_TIME, true);
+ retval = -EINVAL;
+ goto fail;
+ }
+
usb_detect_quirks(udev);
if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
@@ -4943,6 +4957,7 @@ fail:
hub_port_disable(hub, port1, 0);
update_devnum(udev, devnum); /* for disconnect processing */
}
+ kfree(buf);
return retval;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 306/406] USB: core: Change usb_get_device_descriptor() API
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 305/406] USB: core: Unite old scheme and new scheme descriptor reads Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 307/406] USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Greg Kroah-Hartman
` (108 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit de28e469da75359a2bb8cd8778b78aa64b1be1f4 upstream.
The usb_get_device_descriptor() routine reads the device descriptor
from the udev device and stores it directly in udev->descriptor. This
interface is error prone, because the USB subsystem expects in-memory
copies of a device's descriptors to be immutable once the device has
been initialized.
The interface is changed so that the device descriptor is left in a
kmalloc-ed buffer, not copied into the usb_device structure. A
pointer to the buffer is returned to the caller, who is then
responsible for kfree-ing it. The corresponding changes needed in the
various callers are fairly small.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/d0111bb6-56c1-4f90-adf2-6cfe152f6561@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hcd.c | 10 +++++++---
drivers/usb/core/hub.c | 44 +++++++++++++++++++++++---------------------
drivers/usb/core/message.c | 29 ++++++++++++-----------------
drivers/usb/core/usb.h | 4 ++--
4 files changed, 44 insertions(+), 43 deletions(-)
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -982,6 +982,7 @@ static int register_root_hub(struct usb_
{
struct device *parent_dev = hcd->self.controller;
struct usb_device *usb_dev = hcd->self.root_hub;
+ struct usb_device_descriptor *descr;
const int devnum = 1;
int retval;
@@ -993,13 +994,16 @@ static int register_root_hub(struct usb_
mutex_lock(&usb_bus_idr_lock);
usb_dev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
- retval = usb_get_device_descriptor(usb_dev, USB_DT_DEVICE_SIZE);
- if (retval != sizeof usb_dev->descriptor) {
+ descr = usb_get_device_descriptor(usb_dev);
+ if (IS_ERR(descr)) {
+ retval = PTR_ERR(descr);
mutex_unlock(&usb_bus_idr_lock);
dev_dbg (parent_dev, "can't read %s device descriptor %d\n",
dev_name(&usb_dev->dev), retval);
- return (retval < 0) ? retval : -EMSGSIZE;
+ return retval;
}
+ usb_dev->descriptor = *descr;
+ kfree(descr);
if (le16_to_cpu(usb_dev->descriptor.bcdUSB) >= 0x0201) {
retval = usb_get_bos_descriptor(usb_dev);
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2646,12 +2646,17 @@ int usb_authorize_device(struct usb_devi
}
if (usb_dev->wusb) {
- result = usb_get_device_descriptor(usb_dev, sizeof(usb_dev->descriptor));
- if (result < 0) {
+ struct usb_device_descriptor *descr;
+
+ descr = usb_get_device_descriptor(usb_dev);
+ if (IS_ERR(descr)) {
+ result = PTR_ERR(descr);
dev_err(&usb_dev->dev, "can't re-read device descriptor for "
"authorization: %d\n", result);
goto error_device_descriptor;
}
+ usb_dev->descriptor = *descr;
+ kfree(descr);
}
usb_dev->authorized = 1;
@@ -4680,7 +4685,7 @@ hub_port_init(struct usb_hub *hub, struc
const char *driver_name;
bool do_new_scheme;
int maxp0;
- struct usb_device_descriptor *buf;
+ struct usb_device_descriptor *buf, *descr;
buf = kmalloc(GET_DESCRIPTOR_BUFSIZE, GFP_NOIO);
if (!buf)
@@ -4913,15 +4918,16 @@ hub_port_init(struct usb_hub *hub, struc
usb_ep0_reinit(udev);
}
- retval = usb_get_device_descriptor(udev, USB_DT_DEVICE_SIZE);
- if (retval < (signed)sizeof(udev->descriptor)) {
+ descr = usb_get_device_descriptor(udev);
+ if (IS_ERR(descr)) {
+ retval = PTR_ERR(descr);
if (retval != -ENODEV)
dev_err(&udev->dev, "device descriptor read/all, error %d\n",
retval);
- if (retval >= 0)
- retval = -ENOMSG;
goto fail;
}
+ udev->descriptor = *descr;
+ kfree(descr);
/*
* Some superspeed devices have finished the link training process
@@ -5038,7 +5044,7 @@ hub_power_remaining(struct usb_hub *hub)
static int descriptors_changed(struct usb_device *udev,
- struct usb_device_descriptor *old_device_descriptor,
+ struct usb_device_descriptor *new_device_descriptor,
struct usb_host_bos *old_bos)
{
int changed = 0;
@@ -5049,8 +5055,8 @@ static int descriptors_changed(struct us
int length;
char *buf;
- if (memcmp(&udev->descriptor, old_device_descriptor,
- sizeof(*old_device_descriptor)) != 0)
+ if (memcmp(&udev->descriptor, new_device_descriptor,
+ sizeof(*new_device_descriptor)) != 0)
return 1;
if ((old_bos && !udev->bos) || (!old_bos && udev->bos))
@@ -5370,9 +5376,8 @@ static void hub_port_connect_change(stru
{
struct usb_port *port_dev = hub->ports[port1 - 1];
struct usb_device *udev = port_dev->child;
- struct usb_device_descriptor descriptor;
+ struct usb_device_descriptor *descr;
int status = -ENODEV;
- int retval;
dev_dbg(&port_dev->dev, "status %04x, change %04x, %s\n", portstatus,
portchange, portspeed(hub, portstatus));
@@ -5399,23 +5404,20 @@ static void hub_port_connect_change(stru
* changed device descriptors before resuscitating the
* device.
*/
- descriptor = udev->descriptor;
- retval = usb_get_device_descriptor(udev,
- sizeof(udev->descriptor));
- if (retval < 0) {
+ descr = usb_get_device_descriptor(udev);
+ if (IS_ERR(descr)) {
dev_dbg(&udev->dev,
- "can't read device descriptor %d\n",
- retval);
+ "can't read device descriptor %ld\n",
+ PTR_ERR(descr));
} else {
- if (descriptors_changed(udev, &descriptor,
+ if (descriptors_changed(udev, descr,
udev->bos)) {
dev_dbg(&udev->dev,
"device descriptor has changed\n");
- /* for disconnect() calls */
- udev->descriptor = descriptor;
} else {
status = 0; /* Nothing to do */
}
+ kfree(descr);
}
#ifdef CONFIG_PM
} else if (udev->state == USB_STATE_SUSPENDED &&
--- a/drivers/usb/core/message.c
+++ b/drivers/usb/core/message.c
@@ -1039,39 +1039,34 @@ char *usb_cache_string(struct usb_device
}
/*
- * usb_get_device_descriptor - (re)reads the device descriptor (usbcore)
- * @dev: the device whose device descriptor is being updated
- * @size: how much of the descriptor to read
+ * usb_get_device_descriptor - read the device descriptor
+ * @udev: the device whose device descriptor should be read
* Context: !in_interrupt ()
*
- * Updates the copy of the device descriptor stored in the device structure,
- * which dedicates space for this purpose.
- *
* Not exported, only for use by the core. If drivers really want to read
* the device descriptor directly, they can call usb_get_descriptor() with
* type = USB_DT_DEVICE and index = 0.
*
- * This call is synchronous, and may not be used in an interrupt context.
- *
- * Return: The number of bytes received on success, or else the status code
- * returned by the underlying usb_control_msg() call.
+ * Returns: a pointer to a dynamically allocated usb_device_descriptor
+ * structure (which the caller must deallocate), or an ERR_PTR value.
*/
-int usb_get_device_descriptor(struct usb_device *dev, unsigned int size)
+struct usb_device_descriptor *usb_get_device_descriptor(struct usb_device *udev)
{
struct usb_device_descriptor *desc;
int ret;
- if (size > sizeof(*desc))
- return -EINVAL;
desc = kmalloc(sizeof(*desc), GFP_NOIO);
if (!desc)
- return -ENOMEM;
+ return ERR_PTR(-ENOMEM);
+
+ ret = usb_get_descriptor(udev, USB_DT_DEVICE, 0, desc, sizeof(*desc));
+ if (ret == sizeof(*desc))
+ return desc;
- ret = usb_get_descriptor(dev, USB_DT_DEVICE, 0, desc, size);
if (ret >= 0)
- memcpy(&dev->descriptor, desc, size);
+ ret = -EMSGSIZE;
kfree(desc);
- return ret;
+ return ERR_PTR(ret);
}
/*
--- a/drivers/usb/core/usb.h
+++ b/drivers/usb/core/usb.h
@@ -42,8 +42,8 @@ extern bool usb_endpoint_is_ignored(stru
struct usb_endpoint_descriptor *epd);
extern int usb_remove_device(struct usb_device *udev);
-extern int usb_get_device_descriptor(struct usb_device *dev,
- unsigned int size);
+extern struct usb_device_descriptor *usb_get_device_descriptor(
+ struct usb_device *udev);
extern int usb_set_isoch_delay(struct usb_device *dev);
extern int usb_get_bos_descriptor(struct usb_device *dev);
extern void usb_release_bos_descriptor(struct usb_device *dev);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 307/406] USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 306/406] USB: core: Change usb_get_device_descriptor() API Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 308/406] USB: core: Fix oversight in SuperSpeed initialization Greg Kroah-Hartman
` (107 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Khazhy Kumykov,
syzbot+18996170f8096c6174d0
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit ff33299ec8bb80cdcc073ad9c506bd79bb2ed20b upstream.
Syzbot reported an out-of-bounds read in sysfs.c:read_descriptors():
BUG: KASAN: slab-out-of-bounds in read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
Read of size 8 at addr ffff88801e78b8c8 by task udevd/5011
CPU: 0 PID: 5011 Comm: udevd Not tainted 6.4.0-rc6-syzkaller-00195-g40f71e7cd3c6 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/27/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:351
print_report mm/kasan/report.c:462 [inline]
kasan_report+0x11c/0x130 mm/kasan/report.c:572
read_descriptors+0x263/0x280 drivers/usb/core/sysfs.c:883
...
Allocated by task 758:
...
__do_kmalloc_node mm/slab_common.c:966 [inline]
__kmalloc+0x5e/0x190 mm/slab_common.c:979
kmalloc include/linux/slab.h:563 [inline]
kzalloc include/linux/slab.h:680 [inline]
usb_get_configuration+0x1f7/0x5170 drivers/usb/core/config.c:887
usb_enumerate_device drivers/usb/core/hub.c:2407 [inline]
usb_new_device+0x12b0/0x19d0 drivers/usb/core/hub.c:2545
As analyzed by Khazhy Kumykov, the cause of this bug is a race between
read_descriptors() and hub_port_init(): The first routine uses a field
in udev->descriptor, not expecting it to change, while the second
overwrites it.
Prior to commit 45bf39f8df7f ("USB: core: Don't hold device lock while
reading the "descriptors" sysfs file") this race couldn't occur,
because the routines were mutually exclusive thanks to the device
locking. Removing that locking from read_descriptors() exposed it to
the race.
The best way to fix the bug is to keep hub_port_init() from changing
udev->descriptor once udev has been initialized and registered.
Drivers expect the descriptors stored in the kernel to be immutable;
we should not undermine this expectation. In fact, this change should
have been made long ago.
So now hub_port_init() will take an additional argument, specifying a
buffer in which to store the device descriptor it reads. (If udev has
not yet been initialized, the buffer pointer will be NULL and then
hub_port_init() will store the device descriptor in udev as before.)
This eliminates the data race responsible for the out-of-bounds read.
The changes to hub_port_init() appear more extensive than they really
are, because of indentation changes resulting from an attempt to avoid
writing to other parts of the usb_device structure after it has been
initialized. Similar changes should be made to the code that reads
the BOS descriptor, but that can be handled in a separate patch later
on. This patch is sufficient to fix the bug found by syzbot.
Reported-and-tested-by: syzbot+18996170f8096c6174d0@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-usb/000000000000c0ffe505fe86c9ca@google.com/#r
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: Khazhy Kumykov <khazhy@google.com>
Fixes: 45bf39f8df7f ("USB: core: Don't hold device lock while reading the "descriptors" sysfs file")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/b958b47a-9a46-4c22-a9f9-e42e42c31251@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 114 ++++++++++++++++++++++++++++++-------------------
1 file changed, 70 insertions(+), 44 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4669,10 +4669,17 @@ static int get_bMaxPacketSize0(struct us
* the port lock. For a newly detected device that is not accessible
* through any global pointers, it's not necessary to lock the device,
* but it is still necessary to lock the port.
+ *
+ * For a newly detected device, @dev_descr must be NULL. The device
+ * descriptor retrieved from the device will then be stored in
+ * @udev->descriptor. For an already existing device, @dev_descr
+ * must be non-NULL. The device descriptor will be stored there,
+ * not in @udev->descriptor, because descriptors for registered
+ * devices are meant to be immutable.
*/
static int
hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1,
- int retry_counter)
+ int retry_counter, struct usb_device_descriptor *dev_descr)
{
struct usb_device *hdev = hub->hdev;
struct usb_hcd *hcd = bus_to_hcd(hdev->bus);
@@ -4684,6 +4691,7 @@ hub_port_init(struct usb_hub *hub, struc
int devnum = udev->devnum;
const char *driver_name;
bool do_new_scheme;
+ const bool initial = !dev_descr;
int maxp0;
struct usb_device_descriptor *buf, *descr;
@@ -4722,32 +4730,34 @@ hub_port_init(struct usb_hub *hub, struc
}
oldspeed = udev->speed;
- /* USB 2.0 section 5.5.3 talks about ep0 maxpacket ...
- * it's fixed size except for full speed devices.
- * For Wireless USB devices, ep0 max packet is always 512 (tho
- * reported as 0xff in the device descriptor). WUSB1.0[4.8.1].
- */
- switch (udev->speed) {
- case USB_SPEED_SUPER_PLUS:
- case USB_SPEED_SUPER:
- case USB_SPEED_WIRELESS: /* fixed at 512 */
- udev->ep0.desc.wMaxPacketSize = cpu_to_le16(512);
- break;
- case USB_SPEED_HIGH: /* fixed at 64 */
- udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
- break;
- case USB_SPEED_FULL: /* 8, 16, 32, or 64 */
- /* to determine the ep0 maxpacket size, try to read
- * the device descriptor to get bMaxPacketSize0 and
- * then correct our initial guess.
+ if (initial) {
+ /* USB 2.0 section 5.5.3 talks about ep0 maxpacket ...
+ * it's fixed size except for full speed devices.
+ * For Wireless USB devices, ep0 max packet is always 512 (tho
+ * reported as 0xff in the device descriptor). WUSB1.0[4.8.1].
*/
- udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
- break;
- case USB_SPEED_LOW: /* fixed at 8 */
- udev->ep0.desc.wMaxPacketSize = cpu_to_le16(8);
- break;
- default:
- goto fail;
+ switch (udev->speed) {
+ case USB_SPEED_SUPER_PLUS:
+ case USB_SPEED_SUPER:
+ case USB_SPEED_WIRELESS: /* fixed at 512 */
+ udev->ep0.desc.wMaxPacketSize = cpu_to_le16(512);
+ break;
+ case USB_SPEED_HIGH: /* fixed at 64 */
+ udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
+ break;
+ case USB_SPEED_FULL: /* 8, 16, 32, or 64 */
+ /* to determine the ep0 maxpacket size, try to read
+ * the device descriptor to get bMaxPacketSize0 and
+ * then correct our initial guess.
+ */
+ udev->ep0.desc.wMaxPacketSize = cpu_to_le16(64);
+ break;
+ case USB_SPEED_LOW: /* fixed at 8 */
+ udev->ep0.desc.wMaxPacketSize = cpu_to_le16(8);
+ break;
+ default:
+ goto fail;
+ }
}
if (udev->speed == USB_SPEED_WIRELESS)
@@ -4770,22 +4780,24 @@ hub_port_init(struct usb_hub *hub, struc
if (udev->speed < USB_SPEED_SUPER)
dev_info(&udev->dev,
"%s %s USB device number %d using %s\n",
- (udev->config) ? "reset" : "new", speed,
+ (initial ? "new" : "reset"), speed,
devnum, driver_name);
- /* Set up TT records, if needed */
- if (hdev->tt) {
- udev->tt = hdev->tt;
- udev->ttport = hdev->ttport;
- } else if (udev->speed != USB_SPEED_HIGH
- && hdev->speed == USB_SPEED_HIGH) {
- if (!hub->tt.hub) {
- dev_err(&udev->dev, "parent hub has no TT\n");
- retval = -EINVAL;
- goto fail;
+ if (initial) {
+ /* Set up TT records, if needed */
+ if (hdev->tt) {
+ udev->tt = hdev->tt;
+ udev->ttport = hdev->ttport;
+ } else if (udev->speed != USB_SPEED_HIGH
+ && hdev->speed == USB_SPEED_HIGH) {
+ if (!hub->tt.hub) {
+ dev_err(&udev->dev, "parent hub has no TT\n");
+ retval = -EINVAL;
+ goto fail;
+ }
+ udev->tt = &hub->tt;
+ udev->ttport = port1;
}
- udev->tt = &hub->tt;
- udev->ttport = port1;
}
/* Why interleave GET_DESCRIPTOR and SET_ADDRESS this way?
@@ -4814,6 +4826,12 @@ hub_port_init(struct usb_hub *hub, struc
maxp0 = get_bMaxPacketSize0(udev, buf,
GET_DESCRIPTOR_BUFSIZE, retries == 0);
+ if (maxp0 > 0 && !initial &&
+ maxp0 != udev->descriptor.bMaxPacketSize0) {
+ dev_err(&udev->dev, "device reset changed ep0 maxpacket size!\n");
+ retval = -ENODEV;
+ goto fail;
+ }
retval = hub_port_reset(hub, port1, udev, delay, false);
if (retval < 0) /* error or disconnect */
@@ -4883,6 +4901,12 @@ hub_port_init(struct usb_hub *hub, struc
} else {
u32 delay;
+ if (!initial && maxp0 != udev->descriptor.bMaxPacketSize0) {
+ dev_err(&udev->dev, "device reset changed ep0 maxpacket size!\n");
+ retval = -ENODEV;
+ goto fail;
+ }
+
delay = udev->parent->hub_delay;
udev->hub_delay = min_t(u32, delay,
USB_TP_TRANSMISSION_DELAY_MAX);
@@ -4926,7 +4950,10 @@ hub_port_init(struct usb_hub *hub, struc
retval);
goto fail;
}
- udev->descriptor = *descr;
+ if (initial)
+ udev->descriptor = *descr;
+ else
+ *dev_descr = *descr;
kfree(descr);
/*
@@ -5229,7 +5256,7 @@ static void hub_port_connect(struct usb_
}
/* reset (non-USB 3.0 devices) and get descriptor */
- status = hub_port_init(hub, udev, port1, i);
+ status = hub_port_init(hub, udev, port1, i, NULL);
if (status < 0)
goto loop;
@@ -5845,7 +5872,7 @@ static int usb_reset_and_verify_device(s
struct usb_device *parent_hdev = udev->parent;
struct usb_hub *parent_hub;
struct usb_hcd *hcd = bus_to_hcd(udev->bus);
- struct usb_device_descriptor descriptor = udev->descriptor;
+ struct usb_device_descriptor descriptor;
struct usb_host_bos *bos;
int i, j, ret = 0;
int port1 = udev->portnum;
@@ -5887,7 +5914,7 @@ static int usb_reset_and_verify_device(s
/* ep0 maxpacket size may change; let the HCD know about it.
* Other endpoints will be handled by re-enumeration. */
usb_ep0_reinit(udev);
- ret = hub_port_init(parent_hub, udev, port1, i);
+ ret = hub_port_init(parent_hub, udev, port1, i, &descriptor);
if (ret >= 0 || ret == -ENOTCONN || ret == -ENODEV)
break;
}
@@ -5899,7 +5926,6 @@ static int usb_reset_and_verify_device(s
/* Device might have changed firmware (DFU or similar) */
if (descriptors_changed(udev, &descriptor, bos)) {
dev_info(&udev->dev, "device firmware changed\n");
- udev->descriptor = descriptor; /* for disconnect() calls */
goto re_enumerate;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 308/406] USB: core: Fix oversight in SuperSpeed initialization
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 307/406] USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 309/406] usb: typec: tcpci: clear the fault status bit Greg Kroah-Hartman
` (106 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Stern, Thinh Nguyen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 59cf445754566984fd55af19ba7146c76e6627bc upstream.
Commit 85d07c556216 ("USB: core: Unite old scheme and new scheme
descriptor reads") altered the way USB devices are enumerated
following detection, and in the process it messed up the
initialization of SuperSpeed (or faster) devices:
[ 31.650759] usb 2-1: new SuperSpeed Plus Gen 2x1 USB device number 2 using xhci_hcd
[ 31.663107] usb 2-1: device descriptor read/8, error -71
[ 31.952697] usb 2-1: new SuperSpeed Plus Gen 2x1 USB device number 3 using xhci_hcd
[ 31.965122] usb 2-1: device descriptor read/8, error -71
[ 32.080991] usb usb2-port1: attempt power cycle
...
The problem was caused by the commit forgetting that in SuperSpeed or
faster devices, the device descriptor uses a logarithmic encoding of
the bMaxPacketSize0 value. (For some reason I thought the 255 case in
the switch statement was meant for these devices, but it isn't -- it
was meant for Wireless USB and is no longer needed.)
We can fix the oversight by testing for buf->bMaxPacketSize0 = 9
(meaning 512, the actual maxpacket size for ep0 on all SuperSpeed
devices) and straightening out the logic that checks and adjusts our
initial guesses of the maxpacket value.
Reported-and-tested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Closes: https://lore.kernel.org/linux-usb/20230810002257.nadxmfmrobkaxgnz@synopsys.com/
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: 85d07c556216 ("USB: core: Unite old scheme and new scheme descriptor reads")
Link: https://lore.kernel.org/r/8809e6c5-59d5-4d2d-ac8f-6d106658ad73@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 36 ++++++++++++++++++++++++------------
1 file changed, 24 insertions(+), 12 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -4633,7 +4633,7 @@ static int get_bMaxPacketSize0(struct us
buf, size,
initial_descriptor_timeout);
switch (buf->bMaxPacketSize0) {
- case 8: case 16: case 32: case 64: case 255:
+ case 8: case 16: case 32: case 64: case 9:
if (buf->bDescriptorType == USB_DT_DEVICE) {
rc = buf->bMaxPacketSize0;
break;
@@ -4923,23 +4923,35 @@ hub_port_init(struct usb_hub *hub, struc
if (retval)
goto fail;
- if (maxp0 == 0xff || udev->speed >= USB_SPEED_SUPER)
- i = 512;
- else
- i = maxp0;
- if (usb_endpoint_maxp(&udev->ep0.desc) != i) {
- if (udev->speed == USB_SPEED_LOW ||
- !(i == 8 || i == 16 || i == 32 || i == 64)) {
- dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", i);
- retval = -EMSGSIZE;
- goto fail;
- }
+ /*
+ * Check the ep0 maxpacket guess and correct it if necessary.
+ * maxp0 is the value stored in the device descriptor;
+ * i is the value it encodes (logarithmic for SuperSpeed or greater).
+ */
+ i = maxp0;
+ if (udev->speed >= USB_SPEED_SUPER) {
+ if (maxp0 <= 16)
+ i = 1 << maxp0;
+ else
+ i = 0; /* Invalid */
+ }
+ if (usb_endpoint_maxp(&udev->ep0.desc) == i) {
+ ; /* Initial ep0 maxpacket guess is right */
+ } else if ((udev->speed == USB_SPEED_FULL ||
+ udev->speed == USB_SPEED_HIGH) &&
+ (i == 8 || i == 16 || i == 32 || i == 64)) {
+ /* Initial guess is wrong; use the descriptor's value */
if (udev->speed == USB_SPEED_FULL)
dev_dbg(&udev->dev, "ep0 maxpacket = %d\n", i);
else
dev_warn(&udev->dev, "Using ep0 maxpacket: %d\n", i);
udev->ep0.desc.wMaxPacketSize = cpu_to_le16(i);
usb_ep0_reinit(udev);
+ } else {
+ /* Initial guess is wrong and descriptor's value is invalid */
+ dev_err(&udev->dev, "Invalid ep0 maxpacket: %d\n", maxp0);
+ retval = -EMSGSIZE;
+ goto fail;
}
descr = usb_get_device_descriptor(udev);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 309/406] usb: typec: tcpci: clear the fault status bit
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 308/406] USB: core: Fix oversight in SuperSpeed initialization Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 310/406] tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY Greg Kroah-Hartman
` (105 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Angus Ainslie (Purism),
Christian Bach, Marco Felsch, Fabio Estevam, Guenter Roeck,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marco Felsch <m.felsch@pengutronix.de>
[ Upstream commit 23e60c8daf5ec2ab1b731310761b668745fcf6ed ]
According the "USB Type-C Port Controller Interface Specification v2.0"
the TCPC sets the fault status register bit-7
(AllRegistersResetToDefault) once the registers have been reset to
their default values.
This triggers an alert(-irq) on PTN5110 devices albeit we do mask the
fault-irq, which may cause a kernel hang. Fix this generically by writing
a one to the corresponding bit-7.
Cc: stable@vger.kernel.org
Fixes: 74e656d6b055 ("staging: typec: Type-C Port Controller Interface driver (tcpci)")
Reported-by: "Angus Ainslie (Purism)" <angus@akkea.ca>
Closes: https://lore.kernel.org/all/20190508002749.14816-2-angus@akkea.ca/
Reported-by: Christian Bach <christian.bach@scs.ch>
Closes: https://lore.kernel.org/regressions/ZR0P278MB07737E5F1D48632897D51AC3EB329@ZR0P278MB0773.CHEP278.PROD.OUTLOOK.COM/t/
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Signed-off-by: Fabio Estevam <festevam@denx.de>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230816172502.1155079-1-festevam@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/tcpm/tcpci.c | 4 ++++
drivers/usb/typec/tcpm/tcpci.h | 1 +
2 files changed, 5 insertions(+)
diff --git a/drivers/usb/typec/tcpm/tcpci.c b/drivers/usb/typec/tcpm/tcpci.c
index 069affa5cb1ee..e34e46df80243 100644
--- a/drivers/usb/typec/tcpm/tcpci.c
+++ b/drivers/usb/typec/tcpm/tcpci.c
@@ -475,6 +475,10 @@ static int tcpci_init(struct tcpc_dev *tcpc)
if (time_after(jiffies, timeout))
return -ETIMEDOUT;
+ ret = tcpci_write16(tcpci, TCPC_FAULT_STATUS, TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT);
+ if (ret < 0)
+ return ret;
+
/* Handle vendor init */
if (tcpci->data->init) {
ret = tcpci->data->init(tcpci, tcpci->data);
diff --git a/drivers/usb/typec/tcpm/tcpci.h b/drivers/usb/typec/tcpm/tcpci.h
index 5ef07a56d67aa..95ce89139c6ef 100644
--- a/drivers/usb/typec/tcpm/tcpci.h
+++ b/drivers/usb/typec/tcpm/tcpci.h
@@ -84,6 +84,7 @@
#define TCPC_POWER_STATUS_VBUS_PRES BIT(2)
#define TCPC_FAULT_STATUS 0x1f
+#define TCPC_FAULT_STATUS_ALL_REG_RST_TO_DEFAULT BIT(7)
#define TCPC_ALERT_EXTENDED 0x21
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 310/406] tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 309/406] usb: typec: tcpci: clear the fault status bit Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 311/406] md/md-bitmap: remove unnecessary local variable in backlog_store() Greg Kroah-Hartman
` (104 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Yejian,
Masami Hiramatsu (Google), Brian Foster, Steven Rostedt (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian Foster <bfoster@redhat.com>
commit 3d07fa1dd19035eb0b13ae6697efd5caa9033e74 upstream.
The pipe cpumask used to serialize opens between the main and percpu
trace pipes is not zeroed or initialized. This can result in
spurious -EBUSY returns if underlying memory is not fully zeroed.
This has been observed by immediate failure to read the main
trace_pipe file on an otherwise newly booted and idle system:
# cat /sys/kernel/debug/tracing/trace_pipe
cat: /sys/kernel/debug/tracing/trace_pipe: Device or resource busy
Zero the allocation of pipe_cpumask to avoid the problem.
Link: https://lore.kernel.org/linux-trace-kernel/20230831125500.986862-1-bfoster@redhat.com
Cc: stable@vger.kernel.org
Fixes: c2489bb7e6be ("tracing: Introduce pipe_cpumask to avoid race on trace_pipes")
Reviewed-by: Zheng Yejian <zhengyejian1@huawei.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Brian Foster <bfoster@redhat.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -8890,7 +8890,7 @@ static struct trace_array *trace_array_c
if (!alloc_cpumask_var(&tr->tracing_cpumask, GFP_KERNEL))
goto out_free_tr;
- if (!alloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL))
+ if (!zalloc_cpumask_var(&tr->pipe_cpumask, GFP_KERNEL))
goto out_free_tr;
tr->trace_flags = global_trace.trace_flags & ~ZEROED_TRACE_FLAGS;
@@ -9736,7 +9736,7 @@ __init static int tracer_alloc_buffers(v
if (trace_create_savedcmd() < 0)
goto out_free_temp_buffer;
- if (!alloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL))
+ if (!zalloc_cpumask_var(&global_trace.pipe_cpumask, GFP_KERNEL))
goto out_free_savedcmd;
/* TODO: make the number of buffers hot pluggable with CPUS */
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 311/406] md/md-bitmap: remove unnecessary local variable in backlog_store()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 310/406] tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 312/406] udf: initialize newblock to 0 Greg Kroah-Hartman
` (103 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Song Liu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yu Kuai <yukuai3@huawei.com>
commit b4d129640f194ffc4cc64c3e97f98ae944c072e8 upstream.
Local variable is definied first in the beginning of backlog_store(),
there is no need to define it again.
Fixes: 8c13ab115b57 ("md/bitmap: don't set max_write_behind if there is no write mostly device")
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20230706083727.608914-2-yukuai1@huaweicloud.com
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md-bitmap.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -2512,8 +2512,6 @@ backlog_store(struct mddev *mddev, const
mddev_destroy_serial_pool(mddev, NULL, false);
} else if (backlog && !mddev->serial_info_pool) {
/* serial_info_pool is needed since backlog is not zero */
- struct md_rdev *rdev;
-
rdev_for_each(rdev, mddev)
mddev_create_serial_pool(mddev, rdev, false);
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 312/406] udf: initialize newblock to 0
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 311/406] md/md-bitmap: remove unnecessary local variable in backlog_store() Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 313/406] net/ipv6: SKB symmetric hash should incorporate transport ports Greg Kroah-Hartman
` (102 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Tom Rix, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tom Rix <trix@redhat.com>
commit 23970a1c9475b305770fd37bebfec7a10f263787 upstream.
The clang build reports this error
fs/udf/inode.c:805:6: error: variable 'newblock' is used uninitialized whenever 'if' condition is true [-Werror,-Wsometimes-uninitialized]
if (*err < 0)
^~~~~~~~
newblock is never set before error handling jump.
Initialize newblock to 0 and remove redundant settings.
Fixes: d8b39db5fab8 ("udf: Handle error when adding extent to a file")
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Tom Rix <trix@redhat.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Message-Id: <20221230175341.1629734-1-trix@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/udf/inode.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/udf/inode.c
+++ b/fs/udf/inode.c
@@ -695,7 +695,7 @@ static sector_t inode_getblk(struct inod
struct kernel_lb_addr eloc, tmpeloc;
int c = 1;
loff_t lbcount = 0, b_off = 0;
- udf_pblk_t newblocknum, newblock;
+ udf_pblk_t newblocknum, newblock = 0;
sector_t offset = 0;
int8_t etype;
struct udf_inode_info *iinfo = UDF_I(inode);
@@ -798,7 +798,6 @@ static sector_t inode_getblk(struct inod
ret = udf_do_extend_file(inode, &prev_epos, laarr, hole_len);
if (ret < 0) {
*err = ret;
- newblock = 0;
goto out_free;
}
c = 0;
@@ -861,7 +860,6 @@ static sector_t inode_getblk(struct inod
goal, err);
if (!newblocknum) {
*err = -ENOSPC;
- newblock = 0;
goto out_free;
}
if (isBeyondEOF)
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 313/406] net/ipv6: SKB symmetric hash should incorporate transport ports
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 312/406] udf: initialize newblock to 0 Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 314/406] io_uring: always lock in io_apoll_task_func Greg Kroah-Hartman
` (101 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars Ekman, Quan Tian, Eric Dumazet,
David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Tian <qtian@vmware.com>
commit a5e2151ff9d5852d0ababbbcaeebd9646af9c8d9 upstream.
__skb_get_hash_symmetric() was added to compute a symmetric hash over
the protocol, addresses and transport ports, by commit eb70db875671
("packet: Use symmetric hash for PACKET_FANOUT_HASH."). It uses
flow_keys_dissector_symmetric_keys as the flow_dissector to incorporate
IPv4 addresses, IPv6 addresses and ports. However, it should not specify
the flag as FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL, which stops further
dissection when an IPv6 flow label is encountered, making transport
ports not being incorporated in such case.
As a consequence, the symmetric hash is based on 5-tuple for IPv4 but
3-tuple for IPv6 when flow label is present. It caused a few problems,
e.g. when nft symhash and openvswitch l4_sym rely on the symmetric hash
to perform load balancing as different L4 flows between two given IPv6
addresses would always get the same symmetric hash, leading to uneven
traffic distribution.
Removing the use of FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL makes sure the
symmetric hash is based on 5-tuple for both IPv4 and IPv6 consistently.
Fixes: eb70db875671 ("packet: Use symmetric hash for PACKET_FANOUT_HASH.")
Reported-by: Lars Ekman <uablrek@gmail.com>
Closes: https://github.com/antrea-io/antrea/issues/5457
Signed-off-by: Quan Tian <qtian@vmware.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/flow_dissector.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1589,8 +1589,7 @@ u32 __skb_get_hash_symmetric(const struc
memset(&keys, 0, sizeof(keys));
__skb_flow_dissect(NULL, skb, &flow_keys_dissector_symmetric,
- &keys, NULL, 0, 0, 0,
- FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL);
+ &keys, NULL, 0, 0, 0, 0);
return __flow_hash_from_keys(&keys, &hashrnd);
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 314/406] io_uring: always lock in io_apoll_task_func
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 313/406] net/ipv6: SKB symmetric hash should incorporate transport ports Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 315/406] io_uring: break out of iowq iopoll on teardown Greg Kroah-Hartman
` (100 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dylan Yudaken, Jens Axboe,
Pavel Begunkov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
From: Dylan Yudaken <dylany@meta.com>
[ upstream commit c06c6c5d276707e04cedbcc55625e984922118aa ]
This is required for the failure case (io_req_complete_failed) and is
missing.
The alternative would be to only lock in the failure path, however all of
the non-error paths in io_poll_check_events that do not do not return
IOU_POLL_NO_ACTION end up locking anyway. The only extraneous lock would
be for the multishot poll overflowing the CQE ring, however multishot poll
would probably benefit from being locked as it will allow completions to
be batched.
So it seems reasonable to lock always.
Signed-off-by: Dylan Yudaken <dylany@meta.com>
Link: https://lore.kernel.org/r/20221124093559.3780686-3-dylany@meta.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 1 +
1 file changed, 1 insertion(+)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -5571,6 +5571,7 @@ static void io_apoll_task_func(struct io
if (ret > 0)
return;
+ io_tw_lock(req->ctx, locked);
io_poll_remove_entries(req);
spin_lock(&ctx->completion_lock);
hash_del(&req->hash_node);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 315/406] io_uring: break out of iowq iopoll on teardown
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 314/406] io_uring: always lock in io_apoll_task_func Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 316/406] io_uring: break iopolling on signal Greg Kroah-Hartman
` (99 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pavel Begunkov, Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
[ upstream commit 45500dc4e01c167ee063f3dcc22f51ced5b2b1e9 ]
io-wq will retry iopoll even when it failed with -EAGAIN. If that
races with task exit, which sets TIF_NOTIFY_SIGNAL for all its workers,
such workers might potentially infinitely spin retrying iopoll again and
again and each time failing on some allocation / waiting / etc. Don't
keep spinning if io-wq is dying.
Fixes: 561fb04a6a225 ("io_uring: replace workqueue usage with io-wq")
Cc: stable@vger.kernel.org
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io-wq.c | 10 ++++++++++
io_uring/io-wq.h | 1 +
io_uring/io_uring.c | 3 ++-
3 files changed, 13 insertions(+), 1 deletion(-)
--- a/io_uring/io-wq.c
+++ b/io_uring/io-wq.c
@@ -176,6 +176,16 @@ static void io_worker_ref_put(struct io_
complete(&wq->worker_done);
}
+bool io_wq_worker_stopped(void)
+{
+ struct io_worker *worker = current->pf_io_worker;
+
+ if (WARN_ON_ONCE(!io_wq_current_is_worker()))
+ return true;
+
+ return test_bit(IO_WQ_BIT_EXIT, &worker->wqe->wq->state);
+}
+
static void io_worker_cancel_cb(struct io_worker *worker)
{
struct io_wqe_acct *acct = io_wqe_get_acct(worker);
--- a/io_uring/io-wq.h
+++ b/io_uring/io-wq.h
@@ -129,6 +129,7 @@ void io_wq_hash_work(struct io_wq_work *
int io_wq_cpu_affinity(struct io_wq *wq, cpumask_var_t mask);
int io_wq_max_workers(struct io_wq *wq, int *new_count);
+bool io_wq_worker_stopped(void);
static inline bool io_wq_is_hashed(struct io_wq_work *work)
{
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -6898,7 +6898,8 @@ static void io_wq_submit_work(struct io_
*/
if (ret != -EAGAIN || !(req->ctx->flags & IORING_SETUP_IOPOLL))
break;
-
+ if (io_wq_worker_stopped())
+ break;
/*
* If REQ_F_NOWAIT is set, then don't wait or retry with
* poll. -EAGAIN is final for that case.
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 316/406] io_uring: break iopolling on signal
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 315/406] io_uring: break out of iowq iopoll on teardown Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 317/406] scsi: qla2xxx: Fix deletion race condition Greg Kroah-Hartman
` (98 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pavel Begunkov, Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Begunkov <asml.silence@gmail.com>
[ upstream commit dc314886cb3d0e4ab2858003e8de2917f8a3ccbd ]
Don't keep spinning iopoll with a signal set. It'll eventually return
back, e.g. by virtue of need_resched(), but it's not a nice user
experience.
Cc: stable@vger.kernel.org
Fixes: def596e9557c9 ("io_uring: support for IO polling")
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Link: https://lore.kernel.org/r/eeba551e82cad12af30c3220125eb6cb244cc94c.1691594339.git.asml.silence@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -2665,6 +2665,11 @@ static int io_iopoll_check(struct io_rin
break;
}
ret = io_do_iopoll(ctx, &nr_events, min);
+
+ if (task_sigpending(current)) {
+ ret = -EINTR;
+ goto out;
+ }
} while (!ret && nr_events < min && !need_resched());
out:
mutex_unlock(&ctx->uring_lock);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 317/406] scsi: qla2xxx: Fix deletion race condition
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 316/406] io_uring: break iopolling on signal Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 318/406] scsi: qla2xxx: fix inconsistent TMF timeout Greg Kroah-Hartman
` (97 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
commit 6dfe4344c168c6ca20fe7640649aacfcefcccb26 upstream.
System crash when using debug kernel due to link list corruption. The cause
of the link list corruption is due to session deletion was allowed to queue
up twice. Here's the internal trace that show the same port was allowed to
double queue for deletion on different cpu.
20808683956 015 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1
20808683957 027 qla2xxx [0000:13:00.1]-e801:4: Scheduling sess ffff93ebf9306800 for deletion 50:06:0e:80:12:48:ff:50 fc4_type 1
Move the clearing/setting of deleted flag lock.
Cc: stable@vger.kernel.org
Fixes: 726b85487067 ("qla2xxx: Add framework for async fabric discovery")
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230714070104.40052-2-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 16 ++++++++++++++--
drivers/scsi/qla2xxx/qla_target.c | 14 +++++++-------
2 files changed, 21 insertions(+), 9 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -483,6 +483,7 @@ static
void qla24xx_handle_adisc_event(scsi_qla_host_t *vha, struct event_arg *ea)
{
struct fc_port *fcport = ea->fcport;
+ unsigned long flags;
ql_dbg(ql_dbg_disc, vha, 0x20d2,
"%s %8phC DS %d LS %d rc %d login %d|%d rscn %d|%d lid %d\n",
@@ -497,9 +498,15 @@ void qla24xx_handle_adisc_event(scsi_qla
ql_dbg(ql_dbg_disc, vha, 0x2066,
"%s %8phC: adisc fail: post delete\n",
__func__, ea->fcport->port_name);
+
+ spin_lock_irqsave(&vha->work_lock, flags);
/* deleted = 0 & logout_on_delete = force fw cleanup */
- fcport->deleted = 0;
+ if (fcport->deleted == QLA_SESS_DELETED)
+ fcport->deleted = 0;
+
fcport->logout_on_delete = 1;
+ spin_unlock_irqrestore(&vha->work_lock, flags);
+
qlt_schedule_sess_for_deletion(ea->fcport);
return;
}
@@ -1405,7 +1412,6 @@ void __qla24xx_handle_gpdb_event(scsi_ql
spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags);
ea->fcport->login_gen++;
- ea->fcport->deleted = 0;
ea->fcport->logout_on_delete = 1;
if (!ea->fcport->login_succ && !IS_SW_RESV_ADDR(ea->fcport->d_id)) {
@@ -5639,6 +5645,8 @@ qla2x00_reg_remote_port(scsi_qla_host_t
void
qla2x00_update_fcport(scsi_qla_host_t *vha, fc_port_t *fcport)
{
+ unsigned long flags;
+
if (IS_SW_RESV_ADDR(fcport->d_id))
return;
@@ -5648,7 +5656,11 @@ qla2x00_update_fcport(scsi_qla_host_t *v
qla2x00_set_fcport_disc_state(fcport, DSC_UPD_FCPORT);
fcport->login_retry = vha->hw->login_retry_count;
fcport->flags &= ~(FCF_LOGIN_NEEDED | FCF_ASYNC_SENT);
+
+ spin_lock_irqsave(&vha->work_lock, flags);
fcport->deleted = 0;
+ spin_unlock_irqrestore(&vha->work_lock, flags);
+
if (vha->hw->current_topology == ISP_CFG_NL)
fcport->logout_on_delete = 0;
else
--- a/drivers/scsi/qla2xxx/qla_target.c
+++ b/drivers/scsi/qla2xxx/qla_target.c
@@ -1044,10 +1044,6 @@ void qlt_free_session_done(struct work_s
(struct imm_ntfy_from_isp *)sess->iocb, SRB_NACK_LOGO);
}
- spin_lock_irqsave(&vha->work_lock, flags);
- sess->flags &= ~FCF_ASYNC_SENT;
- spin_unlock_irqrestore(&vha->work_lock, flags);
-
spin_lock_irqsave(&ha->tgt.sess_lock, flags);
if (sess->se_sess) {
sess->se_sess = NULL;
@@ -1057,7 +1053,6 @@ void qlt_free_session_done(struct work_s
qla2x00_set_fcport_disc_state(sess, DSC_DELETED);
sess->fw_login_state = DSC_LS_PORT_UNAVAIL;
- sess->deleted = QLA_SESS_DELETED;
if (sess->login_succ && !IS_SW_RESV_ADDR(sess->d_id)) {
vha->fcport_count--;
@@ -1109,10 +1104,15 @@ void qlt_free_session_done(struct work_s
sess->explicit_logout = 0;
spin_unlock_irqrestore(&ha->tgt.sess_lock, flags);
- sess->free_pending = 0;
qla2x00_dfs_remove_rport(vha, sess);
+ spin_lock_irqsave(&vha->work_lock, flags);
+ sess->flags &= ~FCF_ASYNC_SENT;
+ sess->deleted = QLA_SESS_DELETED;
+ sess->free_pending = 0;
+ spin_unlock_irqrestore(&vha->work_lock, flags);
+
ql_dbg(ql_dbg_disc, vha, 0xf001,
"Unregistration of sess %p %8phC finished fcp_cnt %d\n",
sess, sess->port_name, vha->fcport_count);
@@ -1161,12 +1161,12 @@ void qlt_unreg_sess(struct fc_port *sess
* management from being sent.
*/
sess->flags |= FCF_ASYNC_SENT;
+ sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
spin_unlock_irqrestore(&sess->vha->work_lock, flags);
if (sess->se_sess)
vha->hw->tgt.tgt_ops->clear_nacl_from_fcport_map(sess);
- sess->deleted = QLA_SESS_DELETION_IN_PROGRESS;
qla2x00_set_fcport_disc_state(sess, DSC_DELETE_PEND);
sess->last_rscn_gen = sess->rscn_gen;
sess->last_login_gen = sess->login_gen;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 318/406] scsi: qla2xxx: fix inconsistent TMF timeout
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 317/406] scsi: qla2xxx: Fix deletion race condition Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 319/406] scsi: qla2xxx: Fix erroneous link up failure Greg Kroah-Hartman
` (96 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
commit 009e7fe4a1ed52276b332842a6b6e23b07200f2d upstream.
Different behavior were experienced of session being torn down vs not when
TMF is timed out. When FW detects the time out, the session is torn down.
When driver detects the time out, the session is not torn down.
Allow TMF error to return to upper layer without session tear down.
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230714070104.40052-10-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_isr.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3139,7 +3139,6 @@ check_scsi_status:
case CS_PORT_BUSY:
case CS_INCOMPLETE:
case CS_PORT_UNAVAILABLE:
- case CS_TIMEOUT:
case CS_RESET:
/*
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 319/406] scsi: qla2xxx: Fix erroneous link up failure
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 318/406] scsi: qla2xxx: fix inconsistent TMF timeout Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 320/406] scsi: qla2xxx: Turn off noisy message log Greg Kroah-Hartman
` (95 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
commit 5b51f35d127e7bef55fa869d2465e2bca4636454 upstream.
Link up failure occurred where driver failed to see certain events from FW
indicating link up (AEN 8011) and fabric login completion (AEN 8014).
Without these 2 events, driver would not proceed forward to scan the
fabric. The cause of this is due to delay in the receive of interrupt for
Mailbox 60 that causes qla to set the fw_started flag late. The late
setting of this flag causes other interrupts to be dropped. These dropped
interrupts happen to be the link up (AEN 8011) and fabric login completion
(AEN 8014).
Set fw_started flag early to prevent interrupts being dropped.
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230714070104.40052-6-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_init.c | 3 ++-
drivers/scsi/qla2xxx/qla_isr.c | 6 +++++-
2 files changed, 7 insertions(+), 2 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -4342,15 +4342,16 @@ qla2x00_init_rings(scsi_qla_host_t *vha)
memcpy(ha->port_name, ha->init_cb->port_name, WWN_SIZE);
}
+ QLA_FW_STARTED(ha);
rval = qla2x00_init_firmware(vha, ha->init_cb_size);
next_check:
if (rval) {
+ QLA_FW_STOPPED(ha);
ql_log(ql_log_fatal, vha, 0x00d2,
"Init Firmware **** FAILED ****.\n");
} else {
ql_dbg(ql_dbg_init, vha, 0x00d3,
"Init Firmware -- success.\n");
- QLA_FW_STARTED(ha);
vha->u_ql2xexchoffld = vha->u_ql2xiniexchg = 0;
}
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -982,8 +982,12 @@ qla2x00_async_event(scsi_qla_host_t *vha
unsigned long flags;
fc_port_t *fcport = NULL;
- if (!vha->hw->flags.fw_started)
+ if (!vha->hw->flags.fw_started) {
+ ql_log(ql_log_warn, vha, 0x50ff,
+ "Dropping AEN - %04x %04x %04x %04x.\n",
+ mb[0], mb[1], mb[2], mb[3]);
return;
+ }
/* Setup to process RIO completion. */
handle_cnt = 0;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 320/406] scsi: qla2xxx: Turn off noisy message log
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 319/406] scsi: qla2xxx: Fix erroneous link up failure Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 321/406] scsi: qla2xxx: Remove unsupported ql2xenabledif option Greg Kroah-Hartman
` (94 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
commit 8ebaa45163a3fedc885c1dc7d43ea987a2f00a06 upstream.
Some consider noisy log as test failure. Turn off noisy message log.
Cc: stable@vger.kernel.org
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230714070104.40052-8-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_nvme.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -604,7 +604,7 @@ static int qla_nvme_post_cmd(struct nvme
rval = qla2x00_start_nvme_mq(sp);
if (rval != QLA_SUCCESS) {
- ql_log(ql_log_warn, vha, 0x212d,
+ ql_dbg(ql_dbg_io + ql_dbg_verbose, vha, 0x212d,
"qla2x00_start_nvme_mq failed = %d\n", rval);
sp->priv = NULL;
priv->sp = NULL;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 321/406] scsi: qla2xxx: Remove unsupported ql2xenabledif option
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 320/406] scsi: qla2xxx: Turn off noisy message log Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 322/406] fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Greg Kroah-Hartman
` (93 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manish Rangankar, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Rangankar <mrangankar@marvell.com>
commit e9105c4b7a9208a21a9bda133707624f12ddabc2 upstream.
User accidently passed module parameter ql2xenabledif=1 which is
unsupported. However, driver still initialized which lead to guard tag
errors during device discovery.
Remove unsupported ql2xenabledif=1 option and validate the user input.
Cc: stable@vger.kernel.org
Signed-off-by: Manish Rangankar <mrangankar@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230821130045.34850-7-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/qla2xxx/qla_attr.c | 2 --
drivers/scsi/qla2xxx/qla_dbg.c | 2 +-
drivers/scsi/qla2xxx/qla_os.c | 9 +++++++--
3 files changed, 8 insertions(+), 5 deletions(-)
--- a/drivers/scsi/qla2xxx/qla_attr.c
+++ b/drivers/scsi/qla2xxx/qla_attr.c
@@ -3028,8 +3028,6 @@ qla24xx_vport_create(struct fc_vport *fc
vha->flags.difdix_supported = 1;
ql_dbg(ql_dbg_user, vha, 0x7082,
"Registered for DIF/DIX type 1 and 3 protection.\n");
- if (ql2xenabledif == 1)
- prot = SHOST_DIX_TYPE0_PROTECTION;
scsi_host_set_prot(vha->host,
prot | SHOST_DIF_TYPE1_PROTECTION
| SHOST_DIF_TYPE2_PROTECTION
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -18,7 +18,7 @@
* | Queue Command and IO tracing | 0x3074 | 0x300b |
* | | | 0x3027-0x3028 |
* | | | 0x303d-0x3041 |
- * | | | 0x302d,0x3033 |
+ * | | | 0x302e,0x3033 |
* | | | 0x3036,0x3038 |
* | | | 0x303a |
* | DPC Thread | 0x4023 | 0x4002,0x4013 |
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -3141,6 +3141,13 @@ qla2x00_probe_one(struct pci_dev *pdev,
host->max_id = ha->max_fibre_devices;
host->cmd_per_lun = 3;
host->unique_id = host->host_no;
+
+ if (ql2xenabledif && ql2xenabledif != 2) {
+ ql_log(ql_log_warn, base_vha, 0x302d,
+ "Invalid value for ql2xenabledif, resetting it to default (2)\n");
+ ql2xenabledif = 2;
+ }
+
if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif)
host->max_cmd_len = 32;
else
@@ -3373,8 +3380,6 @@ skip_dpc:
base_vha->flags.difdix_supported = 1;
ql_dbg(ql_dbg_init, base_vha, 0x00f1,
"Registering for DIF/DIX type 1 and 3 protection.\n");
- if (ql2xenabledif == 1)
- prot = SHOST_DIX_TYPE0_PROTECTION;
if (ql2xprotmask)
scsi_host_set_prot(host, ql2xprotmask);
else
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 322/406] fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 321/406] scsi: qla2xxx: Remove unsupported ql2xenabledif option Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 323/406] drm/ast: Fix DRAM init on AST2200 Greg Kroah-Hartman
` (92 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann,
Javier Martinez Canillas, Sam Ravnborg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit f90a0e5265b60cdd3c77990e8105f79aa2fac994 upstream.
Do not assing the Linux device to struct fb_info.dev. The call to
register_framebuffer() initializes the field to the fbdev device.
Drivers should not override its value.
Fixes a bug where the driver incorrectly decreases the hardware
device's reference counter and leaks the fbdev device.
v2:
* add Fixes tag (Dan)
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 88017bda96a5 ("ep93xx video driver")
Cc: <stable@vger.kernel.org> # v2.6.32+
Reviewed-by: Javier Martinez Canillas <javierm@redhat.com>
Reviewed-by: Sam Ravnborg <sam@ravnborg.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20230613110953.24176-15-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/ep93xx-fb.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/video/fbdev/ep93xx-fb.c
+++ b/drivers/video/fbdev/ep93xx-fb.c
@@ -474,7 +474,6 @@ static int ep93xxfb_probe(struct platfor
if (!info)
return -ENOMEM;
- info->dev = &pdev->dev;
platform_set_drvdata(pdev, info);
fbi = info->par;
fbi->mach_info = mach_info;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 323/406] drm/ast: Fix DRAM init on AST2200
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 322/406] fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 324/406] lib/test_meminit: allocate pages up to order MAX_ORDER Greg Kroah-Hartman
` (91 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Dave Airlie,
dri-devel, Sui Jingfeng, Jocelyn Falempe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 4cfe75f0f14f044dae66ad0e6eea812d038465d9 upstream.
Fix the test for the AST2200 in the DRAM initialization. The value
in ast->chip has to be compared against an enum constant instead of
a numerical value.
This bug got introduced when the driver was first imported into the
kernel.
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Fixes: 312fec1405dd ("drm: Initial KMS driver for AST (ASpeed Technologies) 2000 series (v2)")
Cc: Dave Airlie <airlied@redhat.com>
Cc: dri-devel@lists.freedesktop.org
Cc: <stable@vger.kernel.org> # v3.5+
Reviewed-by: Sui Jingfeng <suijingfeng@loongson.cn>
Reviewed-by: Jocelyn Falempe <jfalempe@redhat.com>
Tested-by: Jocelyn Falempe <jfalempe@redhat.com> # AST2600
Link: https://patchwork.freedesktop.org/patch/msgid/20230621130032.3568-2-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/ast/ast_post.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/ast/ast_post.c
+++ b/drivers/gpu/drm/ast/ast_post.c
@@ -290,7 +290,7 @@ static void ast_init_dram_reg(struct drm
;
} while (ast_read32(ast, 0x10100) != 0xa8);
} else {/* AST2100/1100 */
- if (ast->chip == AST2100 || ast->chip == 2200)
+ if (ast->chip == AST2100 || ast->chip == AST2200)
dram_reg_info = ast2100_dram_table_data;
else
dram_reg_info = ast1100_dram_table_data;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 324/406] lib/test_meminit: allocate pages up to order MAX_ORDER
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 323/406] drm/ast: Fix DRAM init on AST2200 Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 325/406] parisc: led: Fix LAN receive and transmit LEDs Greg Kroah-Hartman
` (90 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Donnellan,
Alexander Potapenko, Xiaoke Wang, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Donnellan <ajd@linux.ibm.com>
commit efb78fa86e95832b78ca0ba60f3706788a818938 upstream.
test_pages() tests the page allocator by calling alloc_pages() with
different orders up to order 10.
However, different architectures and platforms support different maximum
contiguous allocation sizes. The default maximum allocation order
(MAX_ORDER) is 10, but architectures can use CONFIG_ARCH_FORCE_MAX_ORDER
to override this. On platforms where this is less than 10, test_meminit()
will blow up with a WARN(). This is expected, so let's not do that.
Replace the hardcoded "10" with the MAX_ORDER macro so that we test
allocations up to the expected platform limit.
Link: https://lkml.kernel.org/r/20230714015238.47931-1-ajd@linux.ibm.com
Fixes: 5015a300a522 ("lib: introduce test_meminit module")
Signed-off-by: Andrew Donnellan <ajd@linux.ibm.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Cc: Xiaoke Wang <xkernel.wang@foxmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/test_meminit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/test_meminit.c
+++ b/lib/test_meminit.c
@@ -86,7 +86,7 @@ static int __init test_pages(int *total_
int failures = 0, num_tests = 0;
int i;
- for (i = 0; i < 10; i++)
+ for (i = 0; i <= MAX_ORDER; i++)
num_tests += do_alloc_pages_order(i, &failures);
REPORT_FAILURES_IN_FN();
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 325/406] parisc: led: Fix LAN receive and transmit LEDs
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 324/406] lib/test_meminit: allocate pages up to order MAX_ORDER Greg Kroah-Hartman
@ 2023-09-17 19:12 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 326/406] parisc: led: Reduce CPU overhead for disk & lan LED computation Greg Kroah-Hartman
` (89 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 4db89524b084f712a887256391fc19d9f66c8e55 upstream.
Fix the LAN receive and LAN transmit LEDs, which where swapped
up to now.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/include/asm/led.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/parisc/include/asm/led.h
+++ b/arch/parisc/include/asm/led.h
@@ -11,8 +11,8 @@
#define LED1 0x02
#define LED0 0x01 /* bottom (or furthest left) LED */
-#define LED_LAN_TX LED0 /* for LAN transmit activity */
-#define LED_LAN_RCV LED1 /* for LAN receive activity */
+#define LED_LAN_RCV LED0 /* for LAN receive activity */
+#define LED_LAN_TX LED1 /* for LAN transmit activity */
#define LED_DISK_IO LED2 /* for disk activity */
#define LED_HEARTBEAT LED3 /* heartbeat */
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 326/406] parisc: led: Reduce CPU overhead for disk & lan LED computation
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2023-09-17 19:12 ` [PATCH 5.10 325/406] parisc: led: Fix LAN receive and transmit LEDs Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 327/406] pinctrl: cherryview: fix address_space_handler() argument Greg Kroah-Hartman
` (88 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 358ad816e52d4253b38c2f312e6b1cbd89e0dbf7 upstream.
Older PA-RISC machines have LEDs which show the disk- and LAN-activity.
The computation is done in software and takes quite some time, e.g. on a
J6500 this may take up to 60% time of one CPU if the machine is loaded
via network traffic.
Since most people don't care about the LEDs, start with LEDs disabled and
just show a CPU heartbeat LED. The disk and LAN LEDs can be turned on
manually via /proc/pdc/led.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/parisc/led.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/parisc/led.c
+++ b/drivers/parisc/led.c
@@ -56,8 +56,8 @@
static int led_type __read_mostly = -1;
static unsigned char lastleds; /* LED state from most recent update */
static unsigned int led_heartbeat __read_mostly = 1;
-static unsigned int led_diskio __read_mostly = 1;
-static unsigned int led_lanrxtx __read_mostly = 1;
+static unsigned int led_diskio __read_mostly;
+static unsigned int led_lanrxtx __read_mostly;
static char lcd_text[32] __read_mostly;
static char lcd_text_default[32] __read_mostly;
static int lcd_no_led_support __read_mostly = 0; /* KittyHawk doesn't support LED on its LCD */
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 327/406] pinctrl: cherryview: fix address_space_handler() argument
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 326/406] parisc: led: Reduce CPU overhead for disk & lan LED computation Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 328/406] dt-bindings: clock: xlnx,versal-clk: drop select:false Greg Kroah-Hartman
` (87 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raag Jadav, Mika Westerberg,
Andy Shevchenko
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raag Jadav <raag.jadav@intel.com>
commit d5301c90716a8e20bc961a348182daca00c8e8f0 upstream.
First argument of acpi_*_address_space_handler() APIs is acpi_handle of
the device, which is incorrectly passed in driver ->remove() path here.
Fix it by passing the appropriate argument and while at it, make both
API calls consistent using ACPI_HANDLE().
Fixes: a0b028597d59 ("pinctrl: cherryview: Add support for GMMR GPIO opregion")
Cc: stable@vger.kernel.org
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/intel/pinctrl-cherryview.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1625,7 +1625,6 @@ static int chv_pinctrl_probe(struct plat
const struct intel_pinctrl_soc_data *soc_data;
struct intel_community *community;
struct device *dev = &pdev->dev;
- struct acpi_device *adev = ACPI_COMPANION(dev);
struct intel_pinctrl *pctrl;
acpi_status status;
int ret, irq;
@@ -1688,7 +1687,7 @@ static int chv_pinctrl_probe(struct plat
if (ret)
return ret;
- status = acpi_install_address_space_handler(adev->handle,
+ status = acpi_install_address_space_handler(ACPI_HANDLE(dev),
community->acpi_space_id,
chv_pinctrl_mmio_access_handler,
NULL, pctrl);
@@ -1705,7 +1704,7 @@ static int chv_pinctrl_remove(struct pla
struct intel_pinctrl *pctrl = platform_get_drvdata(pdev);
const struct intel_community *community = &pctrl->communities[0];
- acpi_remove_address_space_handler(ACPI_COMPANION(&pdev->dev),
+ acpi_remove_address_space_handler(ACPI_HANDLE(&pdev->dev),
community->acpi_space_id,
chv_pinctrl_mmio_access_handler);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 328/406] dt-bindings: clock: xlnx,versal-clk: drop select:false
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 327/406] pinctrl: cherryview: fix address_space_handler() argument Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 329/406] clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz Greg Kroah-Hartman
` (86 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Conor Dooley,
Shubhrajyoti Datta, Stephen Boyd
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 172044e30b00977784269e8ab72132a48293c654 upstream.
select:false makes the schema basically ignored and not effective, which
is clearly not what we want for a device binding.
Fixes: 352546805a44 ("dt-bindings: clock: Add bindings for versal clock driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230728165923.108589-1-krzysztof.kozlowski@linaro.org
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Reviewed-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 --
1 file changed, 2 deletions(-)
--- a/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml
+++ b/Documentation/devicetree/bindings/clock/xlnx,versal-clk.yaml
@@ -16,8 +16,6 @@ description: |
reads required input clock frequencies from the devicetree and acts as clock
provider for all clock consumers of PS clocks.
-select: false
-
properties:
compatible:
const: xlnx,versal-clk
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 329/406] clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 328/406] dt-bindings: clock: xlnx,versal-clk: drop select:false Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-29 19:56 ` Ahmad Fatoum
2023-09-17 19:13 ` [PATCH 5.10 330/406] clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock Greg Kroah-Hartman
` (85 subsequent siblings)
414 siblings, 1 reply; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ahmad Fatoum, Marco Felsch,
Abel Vesa
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ahmad Fatoum <a.fatoum@pengutronix.de>
commit 72d00e560d10665e6139c9431956a87ded6e9880 upstream.
Since commit b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates"),
the driver has the ability to dynamically compute PLL parameters to
approximate the requested rates. This is not always used, because the
logic is as follows:
- Check if the target rate is hardcoded in the frequency table
- Check if varying only kdiv is possible, so switch over is glitch free
- Compute rate dynamically by iterating over pdiv range
If we skip the frequency table for the 1443x PLL, we find that the
computed values differ to the hardcoded ones. This can be valid if the
hardcoded values guarantee for example an earlier lock-in or if the
divisors are chosen, so that other important rates are more likely to
be reached glitch-free.
For rates (393216000 and 361267200, this doesn't seem to be the case:
They are only approximated by existing parameters (393215995 and
361267196 Hz, respectively) and they aren't reachable glitch-free from
other hardcoded frequencies. Dropping them from the table allows us
to lock-in to these frequencies exactly.
This is immediately noticeable because they are the assigned-clock-rates
for IMX8MN_AUDIO_PLL1 and IMX8MN_AUDIO_PLL2, respectively and a look
into clk_summary so far showed that they were a few Hz short of the target:
imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
audio_pll2_out 0 0 0 361267196 0 0 50000 N
audio_pll1_out 1 1 0 393215995 0 0 50000 Y
and afterwards:
imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
audio_pll2_out 0 0 0 361267200 0 0 50000 N
audio_pll1_out 1 1 0 393216000 0 0 50000 Y
This change is equivalent to adding following hardcoded values:
/* rate mdiv pdiv sdiv kdiv */
PLL_1443X_RATE(393216000, 655, 5, 3, 23593),
PLL_1443X_RATE(361267200, 497, 33, 0, -16882),
Fixes: 053a4ffe2988 ("clk: imx: imx8mm: fix audio pll setting")
Cc: stable@vger.kernel.org # v5.18+
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
Link: https://lore.kernel.org/r/20230807084744.1184791-2-m.felsch@pengutronix.de
Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/imx/clk-pll14xx.c | 2 --
1 file changed, 2 deletions(-)
--- a/drivers/clk/imx/clk-pll14xx.c
+++ b/drivers/clk/imx/clk-pll14xx.c
@@ -60,8 +60,6 @@ static const struct imx_pll14xx_rate_tab
PLL_1443X_RATE(650000000U, 325, 3, 2, 0),
PLL_1443X_RATE(594000000U, 198, 2, 2, 0),
PLL_1443X_RATE(519750000U, 173, 2, 2, 16384),
- PLL_1443X_RATE(393216000U, 262, 2, 3, 9437),
- PLL_1443X_RATE(361267200U, 361, 3, 3, 17511),
};
struct imx_pll14xx_clk imx_1443x_pll = {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 330/406] clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 329/406] clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 331/406] soc: qcom: qmi_encdec: Restrict string length in decode Greg Kroah-Hartman
` (84 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Neil Armstrong,
Dmitry Baryshkov, Konrad Dybcio, Bjorn Andersson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
commit 1583694bb4eaf186f17131dbc1b83d6057d2749b upstream.
The pll0_vote clock definitely should have pll0 as a parent (instead of
pll8).
Fixes: 7792a8d6713c ("clk: mdm9615: Add support for MDM9615 Clock Controllers")
Cc: stable@kernel.org
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20230512211727.3445575-7-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-mdm9615.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/qcom/gcc-mdm9615.c
+++ b/drivers/clk/qcom/gcc-mdm9615.c
@@ -58,7 +58,7 @@ static struct clk_regmap pll0_vote = {
.enable_mask = BIT(0),
.hw.init = &(struct clk_init_data){
.name = "pll0_vote",
- .parent_names = (const char *[]){ "pll8" },
+ .parent_names = (const char *[]){ "pll0" },
.num_parents = 1,
.ops = &clk_pll_vote_ops,
},
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 331/406] soc: qcom: qmi_encdec: Restrict string length in decode
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 330/406] clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 332/406] NFS: Fix a potential data corruption Greg Kroah-Hartman
` (83 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Lew, Praveenkumar I,
Bjorn Andersson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Lew <quic_clew@quicinc.com>
commit 8d207400fd6b79c92aeb2f33bb79f62dff904ea2 upstream.
The QMI TLV value for strings in a lot of qmi element info structures
account for null terminated strings with MAX_LEN + 1. If a string is
actually MAX_LEN + 1 length, this will cause an out of bounds access
when the NULL character is appended in decoding.
Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
Cc: stable@vger.kernel.org
Signed-off-by: Chris Lew <quic_clew@quicinc.com>
Signed-off-by: Praveenkumar I <quic_ipkumar@quicinc.com>
Link: https://lore.kernel.org/r/20230801064712.3590128-1-quic_ipkumar@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/qcom/qmi_encdec.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/soc/qcom/qmi_encdec.c
+++ b/drivers/soc/qcom/qmi_encdec.c
@@ -534,8 +534,8 @@ static int qmi_decode_string_elem(struct
decoded_bytes += rc;
}
- if (string_len > temp_ei->elem_len) {
- pr_err("%s: String len %d > Max Len %d\n",
+ if (string_len >= temp_ei->elem_len) {
+ pr_err("%s: String len %d >= Max Len %d\n",
__func__, string_len, temp_ei->elem_len);
return -ETOOSMALL;
} else if (string_len > tlv_len) {
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 332/406] NFS: Fix a potential data corruption
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 331/406] soc: qcom: qmi_encdec: Restrict string length in decode Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 333/406] NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info Greg Kroah-Hartman
` (82 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Anna Schumaker
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
commit 88975a55969e11f26fe3846bf4fbf8e7dc8cbbd4 upstream.
We must ensure that the subrequests are joined back into the head before
we can retransmit a request. If the head was not on the commit lists,
because the server wrote it synchronously, we still need to add it back
to the retransmission list.
Add a call that mirrors the effect of nfs_cancel_remove_inode() for
O_DIRECT.
Fixes: ed5d588fe47f ("NFS: Try to join page groups before an O_DIRECT retransmission")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/direct.c | 20 +++++++++++++++++++-
1 file changed, 19 insertions(+), 1 deletion(-)
--- a/fs/nfs/direct.c
+++ b/fs/nfs/direct.c
@@ -509,13 +509,31 @@ out:
return result;
}
+static void nfs_direct_add_page_head(struct list_head *list,
+ struct nfs_page *req)
+{
+ struct nfs_page *head = req->wb_head;
+
+ if (!list_empty(&head->wb_list) || !nfs_lock_request(head))
+ return;
+ if (!list_empty(&head->wb_list)) {
+ nfs_unlock_request(head);
+ return;
+ }
+ list_add(&head->wb_list, list);
+ kref_get(&head->wb_kref);
+ kref_get(&head->wb_kref);
+}
+
static void nfs_direct_join_group(struct list_head *list, struct inode *inode)
{
struct nfs_page *req, *subreq;
list_for_each_entry(req, list, wb_list) {
- if (req->wb_head != req)
+ if (req->wb_head != req) {
+ nfs_direct_add_page_head(&req->wb_list, req);
continue;
+ }
subreq = req->wb_this_page;
if (subreq == req)
continue;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 333/406] NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 332/406] NFS: Fix a potential data corruption Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 334/406] kconfig: fix possible buffer overflow Greg Kroah-Hartman
` (81 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Benjamin Coddington,
Anna Schumaker
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
commit 96562c45af5c31b89a197af28f79bfa838fb8391 upstream.
It is an almost improbable error case but when page allocating loop in
nfs4_get_device_info() fails then we should only free the already
allocated pages, as __free_page() can't deal with NULL arguments.
Found by Linux Verification Center (linuxtesting.org).
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs_dev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nfs/pnfs_dev.c
+++ b/fs/nfs/pnfs_dev.c
@@ -152,7 +152,7 @@ nfs4_get_device_info(struct nfs_server *
set_bit(NFS_DEVICEID_NOCACHE, &d->flags);
out_free_pages:
- for (i = 0; i < max_pages; i++)
+ while (--i >= 0)
__free_page(pages[i]);
kfree(pages);
out_free_pdev:
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 334/406] kconfig: fix possible buffer overflow
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 333/406] NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 335/406] backlight: gpio_backlight: Drop output GPIO direction check for initial power state Greg Kroah-Hartman
` (80 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Meskhidze,
Masahiro Yamada, Sasha Levin, Ivanov Mikhail
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
[ Upstream commit a3b7039bb2b22fcd2ad20d59c00ed4e606ce3754 ]
Buffer 'new_argv' is accessed without bound check after accessing with
bound check via 'new_argc' index.
Fixes: e298f3b49def ("kconfig: add built-in function support")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/preprocess.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/kconfig/preprocess.c b/scripts/kconfig/preprocess.c
index 748da578b418c..d1f5bcff4b62d 100644
--- a/scripts/kconfig/preprocess.c
+++ b/scripts/kconfig/preprocess.c
@@ -396,6 +396,9 @@ static char *eval_clause(const char *str, size_t len, int argc, char *argv[])
p++;
}
+
+ if (new_argc >= FUNCTION_MAX_ARGS)
+ pperror("too many function arguments");
new_argv[new_argc++] = prev;
/*
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 335/406] backlight: gpio_backlight: Drop output GPIO direction check for initial power state
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 334/406] kconfig: fix possible buffer overflow Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 336/406] perf annotate bpf: Dont enclose non-debug code with an assert() Greg Kroah-Hartman
` (79 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Ying, Andy Shevchenko,
Linus Walleij, Bartosz Golaszewski, Lee Jones, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Liu <victor.liu@nxp.com>
[ Upstream commit fe1328b5b2a087221e31da77e617f4c2b70f3b7f ]
So, let's drop output GPIO direction check and only check GPIO value to set
the initial power state.
Fixes: 706dc68102bc ("backlight: gpio: Explicitly set the direction of the GPIO")
Signed-off-by: Liu Ying <victor.liu@nxp.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20230721093342.1532531-1-victor.liu@nxp.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/backlight/gpio_backlight.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/video/backlight/gpio_backlight.c b/drivers/video/backlight/gpio_backlight.c
index 5c5c99f7979e3..30ec5b6845335 100644
--- a/drivers/video/backlight/gpio_backlight.c
+++ b/drivers/video/backlight/gpio_backlight.c
@@ -87,8 +87,7 @@ static int gpio_backlight_probe(struct platform_device *pdev)
/* Not booted with device tree or no phandle link to the node */
bl->props.power = def_value ? FB_BLANK_UNBLANK
: FB_BLANK_POWERDOWN;
- else if (gpiod_get_direction(gbl->gpiod) == 0 &&
- gpiod_get_value_cansleep(gbl->gpiod) == 0)
+ else if (gpiod_get_value_cansleep(gbl->gpiod) == 0)
bl->props.power = FB_BLANK_POWERDOWN;
else
bl->props.power = FB_BLANK_UNBLANK;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 336/406] perf annotate bpf: Dont enclose non-debug code with an assert()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 335/406] backlight: gpio_backlight: Drop output GPIO direction check for initial power state Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 337/406] x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() Greg Kroah-Hartman
` (78 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Ian Rogers, Jiri Olsa,
Mohamed Mahmoud, Namhyung Kim, Dave Tucker, Derek Barbosa,
Song Liu, Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit 979e9c9fc9c2a761303585e07fe2699bdd88182f ]
In 616b14b47a86d880 ("perf build: Conditionally define NDEBUG") we
started using NDEBUG=1 when DEBUG=1 isn't present, so code that is
enclosed with assert() is not called.
In dd317df072071903 ("perf build: Make binutil libraries opt in") we
stopped linking against binutils-devel, for licensing reasons.
Recently people asked me why annotation of BPF programs wasn't working,
i.e. this:
$ perf annotate bpf_prog_5280546344e3f45c_kfree_skb
was returning:
case SYMBOL_ANNOTATE_ERRNO__NO_LIBOPCODES_FOR_BPF:
scnprintf(buf, buflen, "Please link with binutils's libopcode to enable BPF annotation");
This was on a fedora rpm, so its new enough that I had to try to test by
rebuilding using BUILD_NONDISTRO=1, only to get it segfaulting on me.
This combination made this libopcode function not to be called:
assert(bfd_check_format(bfdf, bfd_object));
Changing it to:
if (!bfd_check_format(bfdf, bfd_object))
abort();
Made it work, looking at this "check" function made me realize it
changes the 'bfdf' internal state, i.e. we better call it.
So stop using assert() on it, just call it and abort if it fails.
Probably it is better to propagate the error, etc, but it seems it is
unlikely to fail from the usage done so far and we really need to stop
using libopcodes, so do the quick fix above and move on.
With it we have BPF annotation back working when built with
BUILD_NONDISTRO=1:
⬢[acme@toolbox perf-tools-next]$ perf annotate --stdio2 bpf_prog_5280546344e3f45c_kfree_skb | head
No kallsyms or vmlinux with build-id 939bc71a1a51cdc434e60af93c7e734f7d5c0e7e was found
Samples: 12 of event 'cpu-clock:ppp', 4000 Hz, Event count (approx.): 3000000, [percent: local period]
bpf_prog_5280546344e3f45c_kfree_skb() bpf_prog_5280546344e3f45c_kfree_skb
Percent int kfree_skb(struct trace_event_raw_kfree_skb *args) {
nop
33.33 xchg %ax,%ax
push %rbp
mov %rsp,%rbp
sub $0x180,%rsp
push %rbx
push %r13
⬢[acme@toolbox perf-tools-next]$
Fixes: 6987561c9e86eace ("perf annotate: Enable annotation of BPF programs")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mohamed Mahmoud <mmahmoud@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Dave Tucker <datucker@redhat.com>
Cc: Derek Barbosa <debarbos@redhat.com>
Cc: Song Liu <songliubraving@fb.com>
Link: https://lore.kernel.org/lkml/ZMrMzoQBe0yqMek1@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/annotate.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index 3081894547883..c9078cee6be01 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1718,8 +1718,11 @@ static int symbol__disassemble_bpf(struct symbol *sym,
perf_exe(tpath, sizeof(tpath));
bfdf = bfd_openr(tpath, NULL);
- assert(bfdf);
- assert(bfd_check_format(bfdf, bfd_object));
+ if (bfdf == NULL)
+ abort();
+
+ if (!bfd_check_format(bfdf, bfd_object))
+ abort();
s = open_memstream(&buf, &buf_size);
if (!s) {
@@ -1767,7 +1770,8 @@ static int symbol__disassemble_bpf(struct symbol *sym,
#else
disassemble = disassembler(bfdf);
#endif
- assert(disassemble);
+ if (disassemble == NULL)
+ abort();
fflush(s);
do {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 337/406] x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 336/406] perf annotate bpf: Dont enclose non-debug code with an assert() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 338/406] perf top: Dont pass an ERR_PTR() directly to perf_session__delete() Greg Kroah-Hartman
` (77 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Christopherson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit 5df8ecfe3632d5879d1f154f7aa8de441b5d1c89 ]
Drop the explicit check on the extended CPUID level in cpu_has_svm(), the
kernel's cached CPUID info will leave the entire SVM leaf unset if said
leaf is not supported by hardware. Prior to using cached information,
the check was needed to avoid false positives due to Intel's rather crazy
CPUID behavior of returning the values of the maximum supported leaf if
the specified leaf is unsupported.
Fixes: 682a8108872f ("x86/kvm/svm: Simplify cpu_has_svm()")
Link: https://lore.kernel.org/r/20230721201859.2307736-13-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/include/asm/virtext.h | 6 ------
1 file changed, 6 deletions(-)
diff --git a/arch/x86/include/asm/virtext.h b/arch/x86/include/asm/virtext.h
index 8eefa3386d8ce..331474296e6f1 100644
--- a/arch/x86/include/asm/virtext.h
+++ b/arch/x86/include/asm/virtext.h
@@ -95,12 +95,6 @@ static inline int cpu_has_svm(const char **msg)
return 0;
}
- if (boot_cpu_data.extended_cpuid_level < SVM_CPUID_FUNC) {
- if (msg)
- *msg = "can't execute cpuid_8000000a";
- return 0;
- }
-
if (!boot_cpu_has(X86_FEATURE_SVM)) {
if (msg)
*msg = "svm not available";
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 338/406] perf top: Dont pass an ERR_PTR() directly to perf_session__delete()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 337/406] x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 339/406] watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load Greg Kroah-Hartman
` (76 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Hunter, Alexander Shishkin,
Alexey Budankov, Jeremie Galarneau, Jiri Olsa, Kate Stewart,
Mamatha Inamdar, Mukesh Ojha, Nageswara R Sastry, Namhyung Kim,
Peter Zijlstra, Ravi Bangoria, Shawn Landden, Song Liu,
Thomas Gleixner, Tzvetomir Stoyanov, Arnaldo Carvalho de Melo,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit ef23cb593304bde0cc046fd4cc83ae7ea2e24f16 ]
While debugging a segfault on 'perf lock contention' without an
available perf.data file I noticed that it was basically calling:
perf_session__delete(ERR_PTR(-1))
Resulting in:
(gdb) run lock contention
Starting program: /root/bin/perf lock contention
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
failed to open perf.data: No such file or directory (try 'perf record' first)
Initializing perf session failed
Program received signal SIGSEGV, Segmentation fault.
0x00000000005e7515 in auxtrace__free (session=0xffffffffffffffff) at util/auxtrace.c:2858
2858 if (!session->auxtrace)
(gdb) p session
$1 = (struct perf_session *) 0xffffffffffffffff
(gdb) bt
#0 0x00000000005e7515 in auxtrace__free (session=0xffffffffffffffff) at util/auxtrace.c:2858
#1 0x000000000057bb4d in perf_session__delete (session=0xffffffffffffffff) at util/session.c:300
#2 0x000000000047c421 in __cmd_contention (argc=0, argv=0x7fffffffe200) at builtin-lock.c:2161
#3 0x000000000047dc95 in cmd_lock (argc=0, argv=0x7fffffffe200) at builtin-lock.c:2604
#4 0x0000000000501466 in run_builtin (p=0xe597a8 <commands+552>, argc=2, argv=0x7fffffffe200) at perf.c:322
#5 0x00000000005016d5 in handle_internal_command (argc=2, argv=0x7fffffffe200) at perf.c:375
#6 0x0000000000501824 in run_argv (argcp=0x7fffffffe02c, argv=0x7fffffffe020) at perf.c:419
#7 0x0000000000501b11 in main (argc=2, argv=0x7fffffffe200) at perf.c:535
(gdb)
So just set it to NULL after using PTR_ERR(session) to decode the error
as perf_session__delete(NULL) is supported.
The same problem was found in 'perf top' after an audit of all
perf_session__new() failure handling.
Fixes: 6ef81c55a2b6584c ("perf session: Return error code for perf_session__new() function on failure")
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexey Budankov <alexey.budankov@linux.intel.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Jeremie Galarneau <jeremie.galarneau@efficios.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kate Stewart <kstewart@linuxfoundation.org>
Cc: Mamatha Inamdar <mamatha4@linux.vnet.ibm.com>
Cc: Mukesh Ojha <mojha@codeaurora.org>
Cc: Nageswara R Sastry <rnsastry@linux.vnet.ibm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi Bangoria <ravi.bangoria@linux.ibm.com>
Cc: Shawn Landden <shawn@git.icu>
Cc: Song Liu <songliubraving@fb.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
Link: https://lore.kernel.org/lkml/ZN4Q2rxxsL08A8rd@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-top.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 7c64134472c77..ee30372f77133 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1743,6 +1743,7 @@ int cmd_top(int argc, const char **argv)
top.session = perf_session__new(NULL, false, NULL);
if (IS_ERR(top.session)) {
status = PTR_ERR(top.session);
+ top.session = NULL;
goto out_delete_evlist;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 339/406] watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 338/406] perf top: Dont pass an ERR_PTR() directly to perf_session__delete() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 340/406] pwm: lpc32xx: Remove handling of PWM channels Greg Kroah-Hartman
` (75 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Raag Jadav, Andy Shevchenko,
Guenter Roeck, Wim Van Sebroeck, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raag Jadav <raag.jadav@intel.com>
[ Upstream commit cf38e7691c85f1b09973b22a0b89bf1e1228d2f9 ]
When built with CONFIG_INTEL_MID_WATCHDOG=m, currently the driver
needs to be loaded manually, for the lack of module alias.
This causes unintended resets in cases where watchdog timer is
set-up by bootloader and the driver is not explicitly loaded.
Add MODULE_ALIAS() to load the driver automatically at boot and
avoid this issue.
Fixes: 87a1ef8058d9 ("watchdog: add Intel MID watchdog driver support")
Signed-off-by: Raag Jadav <raag.jadav@intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230811120220.31578-1-raag.jadav@intel.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/intel-mid_wdt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/watchdog/intel-mid_wdt.c b/drivers/watchdog/intel-mid_wdt.c
index 9b2173f765c8c..fb7fae750181b 100644
--- a/drivers/watchdog/intel-mid_wdt.c
+++ b/drivers/watchdog/intel-mid_wdt.c
@@ -203,3 +203,4 @@ module_platform_driver(mid_wdt_driver);
MODULE_AUTHOR("David Cohen <david.a.cohen@linux.intel.com>");
MODULE_DESCRIPTION("Watchdog Driver for Intel MID platform");
MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:intel_mid_wdt");
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 340/406] pwm: lpc32xx: Remove handling of PWM channels
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 339/406] watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 341/406] net/sched: fq_pie: avoid stalls in fq_pie_timer() Greg Kroah-Hartman
` (74 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Vladimir Zapolskiy,
Uwe Kleine-König, Thierry Reding, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vz@mleia.com>
[ Upstream commit 4aae44f65827f0213a7361cf9c32cfe06114473f ]
Because LPC32xx PWM controllers have only a single output which is
registered as the only PWM device/channel per controller, it is known in
advance that pwm->hwpwm value is always 0. On basis of this fact
simplify the code by removing operations with pwm->hwpwm, there is no
controls which require channel number as input.
Even though I wasn't aware at the time when I forward ported that patch,
this fixes a null pointer dereference as lpc32xx->chip.pwms is NULL
before devm_pwmchip_add() is called.
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Fixes: 3d2813fb17e5 ("pwm: lpc32xx: Don't modify HW state in .probe() after the PWM chip was registered")
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-lpc32xx.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/pwm/pwm-lpc32xx.c b/drivers/pwm/pwm-lpc32xx.c
index 522f862eca526..504a8f506195a 100644
--- a/drivers/pwm/pwm-lpc32xx.c
+++ b/drivers/pwm/pwm-lpc32xx.c
@@ -51,10 +51,10 @@ static int lpc32xx_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm,
if (duty_cycles > 255)
duty_cycles = 255;
- val = readl(lpc32xx->base + (pwm->hwpwm << 2));
+ val = readl(lpc32xx->base);
val &= ~0xFFFF;
val |= (period_cycles << 8) | duty_cycles;
- writel(val, lpc32xx->base + (pwm->hwpwm << 2));
+ writel(val, lpc32xx->base);
return 0;
}
@@ -69,9 +69,9 @@ static int lpc32xx_pwm_enable(struct pwm_chip *chip, struct pwm_device *pwm)
if (ret)
return ret;
- val = readl(lpc32xx->base + (pwm->hwpwm << 2));
+ val = readl(lpc32xx->base);
val |= PWM_ENABLE;
- writel(val, lpc32xx->base + (pwm->hwpwm << 2));
+ writel(val, lpc32xx->base);
return 0;
}
@@ -81,9 +81,9 @@ static void lpc32xx_pwm_disable(struct pwm_chip *chip, struct pwm_device *pwm)
struct lpc32xx_pwm_chip *lpc32xx = to_lpc32xx_pwm_chip(chip);
u32 val;
- val = readl(lpc32xx->base + (pwm->hwpwm << 2));
+ val = readl(lpc32xx->base);
val &= ~PWM_ENABLE;
- writel(val, lpc32xx->base + (pwm->hwpwm << 2));
+ writel(val, lpc32xx->base);
clk_disable_unprepare(lpc32xx->clk);
}
@@ -121,9 +121,9 @@ static int lpc32xx_pwm_probe(struct platform_device *pdev)
lpc32xx->chip.base = -1;
/* If PWM is disabled, configure the output to the default value */
- val = readl(lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+ val = readl(lpc32xx->base);
val &= ~PWM_PIN_LEVEL;
- writel(val, lpc32xx->base + (lpc32xx->chip.pwms[0].hwpwm << 2));
+ writel(val, lpc32xx->base);
ret = pwmchip_add(&lpc32xx->chip);
if (ret < 0) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 341/406] net/sched: fq_pie: avoid stalls in fq_pie_timer()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 340/406] pwm: lpc32xx: Remove handling of PWM channels Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 342/406] sctp: annotate data-races around sk->sk_wmem_queued Greg Kroah-Hartman
` (73 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+e46fbd5289363464bc13,
Eric Dumazet, Michal Kubiak, Jamal Hadi Salim, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8c21ab1bae945686c602c5bfa4e3f3352c2452c5 ]
When setting a high number of flows (limit being 65536),
fq_pie_timer() is currently using too much time as syzbot reported.
Add logic to yield the cpu every 2048 flows (less than 150 usec
on debug kernels).
It should also help by not blocking qdisc fast paths for too long.
Worst case (65536 flows) would need 31 jiffies for a complete scan.
Relevant extract from syzbot report:
rcu: INFO: rcu_preempt detected expedited stalls on CPUs/tasks: { 0-.... } 2663 jiffies s: 873 root: 0x1/.
rcu: blocking rcu_node structures (internal RCU debug):
Sending NMI from CPU 1 to CPUs 0:
NMI backtrace for cpu 0
CPU: 0 PID: 5177 Comm: syz-executor273 Not tainted 6.5.0-syzkaller-00453-g727dbda16b83 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
RIP: 0010:check_kcov_mode kernel/kcov.c:173 [inline]
RIP: 0010:write_comp_data+0x21/0x90 kernel/kcov.c:236
Code: 2e 0f 1f 84 00 00 00 00 00 65 8b 05 01 b2 7d 7e 49 89 f1 89 c6 49 89 d2 81 e6 00 01 00 00 49 89 f8 65 48 8b 14 25 80 b9 03 00 <a9> 00 01 ff 00 74 0e 85 f6 74 59 8b 82 04 16 00 00 85 c0 74 4f 8b
RSP: 0018:ffffc90000007bb8 EFLAGS: 00000206
RAX: 0000000000000101 RBX: ffffc9000dc0d140 RCX: ffffffff885893b0
RDX: ffff88807c075940 RSI: 0000000000000100 RDI: 0000000000000001
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffc9000dc0d178
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS: 0000555555d54380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6b442f6130 CR3: 000000006fe1c000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<NMI>
</NMI>
<IRQ>
pie_calculate_probability+0x480/0x850 net/sched/sch_pie.c:415
fq_pie_timer+0x1da/0x4f0 net/sched/sch_fq_pie.c:387
call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
Fixes: ec97ecf1ebe4 ("net: sched: add Flow Queue PIE packet scheduler")
Link: https://lore.kernel.org/lkml/00000000000017ad3f06040bf394@google.com/
Reported-by: syzbot+e46fbd5289363464bc13@syzkaller.appspotmail.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Michal Kubiak <michal.kubiak@intel.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230829123541.3745013-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_fq_pie.c | 27 +++++++++++++++++++--------
1 file changed, 19 insertions(+), 8 deletions(-)
diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c
index 4f6b5b6fba3ed..a5b63158f081c 100644
--- a/net/sched/sch_fq_pie.c
+++ b/net/sched/sch_fq_pie.c
@@ -61,6 +61,7 @@ struct fq_pie_sched_data {
struct pie_params p_params;
u32 ecn_prob;
u32 flows_cnt;
+ u32 flows_cursor;
u32 quantum;
u32 memory_limit;
u32 new_flow_count;
@@ -378,21 +379,31 @@ static int fq_pie_change(struct Qdisc *sch, struct nlattr *opt,
static void fq_pie_timer(struct timer_list *t)
{
struct fq_pie_sched_data *q = from_timer(q, t, adapt_timer);
+ unsigned long next, tupdate;
struct Qdisc *sch = q->sch;
spinlock_t *root_lock; /* to lock qdisc for probability calculations */
- u32 idx;
+ int max_cnt, i;
root_lock = qdisc_lock(qdisc_root_sleeping(sch));
spin_lock(root_lock);
- for (idx = 0; idx < q->flows_cnt; idx++)
- pie_calculate_probability(&q->p_params, &q->flows[idx].vars,
- q->flows[idx].backlog);
-
- /* reset the timer to fire after 'tupdate' jiffies. */
- if (q->p_params.tupdate)
- mod_timer(&q->adapt_timer, jiffies + q->p_params.tupdate);
+ /* Limit this expensive loop to 2048 flows per round. */
+ max_cnt = min_t(int, q->flows_cnt - q->flows_cursor, 2048);
+ for (i = 0; i < max_cnt; i++) {
+ pie_calculate_probability(&q->p_params,
+ &q->flows[q->flows_cursor].vars,
+ q->flows[q->flows_cursor].backlog);
+ q->flows_cursor++;
+ }
+ tupdate = q->p_params.tupdate;
+ next = 0;
+ if (q->flows_cursor >= q->flows_cnt) {
+ q->flows_cursor = 0;
+ next = tupdate;
+ }
+ if (tupdate)
+ mod_timer(&q->adapt_timer, jiffies + next);
spin_unlock(root_lock);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 342/406] sctp: annotate data-races around sk->sk_wmem_queued
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 341/406] net/sched: fq_pie: avoid stalls in fq_pie_timer() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 343/406] ipv4: annotate data-races around fi->fib_dead Greg Kroah-Hartman
` (72 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Marcelo Ricardo Leitner, Xin Long, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit dc9511dd6f37fe803f6b15b61b030728d7057417 ]
sk->sk_wmem_queued can be read locklessly from sctp_poll()
Use sk_wmem_queued_add() when the field is changed,
and add READ_ONCE() annotations in sctp_writeable()
and sctp_assocs_seq_show()
syzbot reported:
BUG: KCSAN: data-race in sctp_poll / sctp_wfree
read-write to 0xffff888149d77810 of 4 bytes by interrupt on cpu 0:
sctp_wfree+0x170/0x4a0 net/sctp/socket.c:9147
skb_release_head_state+0xb7/0x1a0 net/core/skbuff.c:988
skb_release_all net/core/skbuff.c:1000 [inline]
__kfree_skb+0x16/0x140 net/core/skbuff.c:1016
consume_skb+0x57/0x180 net/core/skbuff.c:1232
sctp_chunk_destroy net/sctp/sm_make_chunk.c:1503 [inline]
sctp_chunk_put+0xcd/0x130 net/sctp/sm_make_chunk.c:1530
sctp_datamsg_put+0x29a/0x300 net/sctp/chunk.c:128
sctp_chunk_free+0x34/0x50 net/sctp/sm_make_chunk.c:1515
sctp_outq_sack+0xafa/0xd70 net/sctp/outqueue.c:1381
sctp_cmd_process_sack net/sctp/sm_sideeffect.c:834 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1366 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1198 [inline]
sctp_do_sm+0x12c7/0x31b0 net/sctp/sm_sideeffect.c:1169
sctp_assoc_bh_rcv+0x2b2/0x430 net/sctp/associola.c:1051
sctp_inq_push+0x108/0x120 net/sctp/inqueue.c:80
sctp_rcv+0x116e/0x1340 net/sctp/input.c:243
sctp6_rcv+0x25/0x40 net/sctp/ipv6.c:1120
ip6_protocol_deliver_rcu+0x92f/0xf30 net/ipv6/ip6_input.c:437
ip6_input_finish net/ipv6/ip6_input.c:482 [inline]
NF_HOOK include/linux/netfilter.h:303 [inline]
ip6_input+0xbd/0x1b0 net/ipv6/ip6_input.c:491
dst_input include/net/dst.h:468 [inline]
ip6_rcv_finish+0x1e2/0x2e0 net/ipv6/ip6_input.c:79
NF_HOOK include/linux/netfilter.h:303 [inline]
ipv6_rcv+0x74/0x150 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core net/core/dev.c:5452 [inline]
__netif_receive_skb+0x90/0x1b0 net/core/dev.c:5566
process_backlog+0x21f/0x380 net/core/dev.c:5894
__napi_poll+0x60/0x3b0 net/core/dev.c:6460
napi_poll net/core/dev.c:6527 [inline]
net_rx_action+0x32b/0x750 net/core/dev.c:6660
__do_softirq+0xc1/0x265 kernel/softirq.c:553
run_ksoftirqd+0x17/0x20 kernel/softirq.c:921
smpboot_thread_fn+0x30a/0x4a0 kernel/smpboot.c:164
kthread+0x1d7/0x210 kernel/kthread.c:389
ret_from_fork+0x2e/0x40 arch/x86/kernel/process.c:145
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
read to 0xffff888149d77810 of 4 bytes by task 17828 on cpu 1:
sctp_writeable net/sctp/socket.c:9304 [inline]
sctp_poll+0x265/0x410 net/sctp/socket.c:8671
sock_poll+0x253/0x270 net/socket.c:1374
vfs_poll include/linux/poll.h:88 [inline]
do_pollfd fs/select.c:873 [inline]
do_poll fs/select.c:921 [inline]
do_sys_poll+0x636/0xc00 fs/select.c:1015
__do_sys_ppoll fs/select.c:1121 [inline]
__se_sys_ppoll+0x1af/0x1f0 fs/select.c:1101
__x64_sys_ppoll+0x67/0x80 fs/select.c:1101
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x00019e80 -> 0x0000cc80
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 17828 Comm: syz-executor.1 Not tainted 6.5.0-rc7-syzkaller-00185-g28f20a19294d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://lore.kernel.org/r/20230830094519.950007-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/proc.c | 2 +-
net/sctp/socket.c | 10 +++++-----
2 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 982a87b3e11f8..963b94517ec20 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -284,7 +284,7 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
assoc->init_retries, assoc->shutdown_retries,
assoc->rtx_data_chunks,
refcount_read(&sk->sk_wmem_alloc),
- sk->sk_wmem_queued,
+ READ_ONCE(sk->sk_wmem_queued),
sk->sk_sndbuf,
sk->sk_rcvbuf);
seq_printf(seq, "\n");
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index fa4d31b507f29..68d53e3f0d07a 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -68,7 +68,7 @@
#include <net/sctp/stream_sched.h>
/* Forward declarations for internal helper functions. */
-static bool sctp_writeable(struct sock *sk);
+static bool sctp_writeable(const struct sock *sk);
static void sctp_wfree(struct sk_buff *skb);
static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,
size_t msg_len);
@@ -138,7 +138,7 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk)
refcount_add(sizeof(struct sctp_chunk), &sk->sk_wmem_alloc);
asoc->sndbuf_used += chunk->skb->truesize + sizeof(struct sctp_chunk);
- sk->sk_wmem_queued += chunk->skb->truesize + sizeof(struct sctp_chunk);
+ sk_wmem_queued_add(sk, chunk->skb->truesize + sizeof(struct sctp_chunk));
sk_mem_charge(sk, chunk->skb->truesize);
}
@@ -8900,7 +8900,7 @@ static void sctp_wfree(struct sk_buff *skb)
struct sock *sk = asoc->base.sk;
sk_mem_uncharge(sk, skb->truesize);
- sk->sk_wmem_queued -= skb->truesize + sizeof(struct sctp_chunk);
+ sk_wmem_queued_add(sk, -(skb->truesize + sizeof(struct sctp_chunk)));
asoc->sndbuf_used -= skb->truesize + sizeof(struct sctp_chunk);
WARN_ON(refcount_sub_and_test(sizeof(struct sctp_chunk),
&sk->sk_wmem_alloc));
@@ -9055,9 +9055,9 @@ void sctp_write_space(struct sock *sk)
* UDP-style sockets or TCP-style sockets, this code should work.
* - Daisy
*/
-static bool sctp_writeable(struct sock *sk)
+static bool sctp_writeable(const struct sock *sk)
{
- return sk->sk_sndbuf > sk->sk_wmem_queued;
+ return READ_ONCE(sk->sk_sndbuf) > READ_ONCE(sk->sk_wmem_queued);
}
/* Wait for an association to go into ESTABLISHED state. If timeout is 0,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 343/406] ipv4: annotate data-races around fi->fib_dead
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 342/406] sctp: annotate data-races around sk->sk_wmem_queued Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 344/406] net: read sk->sk_family once in sk_mc_loop() Greg Kroah-Hartman
` (71 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, David Ahern,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit fce92af1c29d90184dfec638b5738831097d66e9 ]
syzbot complained about a data-race in fib_table_lookup() [1]
Add appropriate annotations to document it.
[1]
BUG: KCSAN: data-race in fib_release_info / fib_table_lookup
write to 0xffff888150f31744 of 1 bytes by task 1189 on cpu 0:
fib_release_info+0x3a0/0x460 net/ipv4/fib_semantics.c:281
fib_table_delete+0x8d2/0x900 net/ipv4/fib_trie.c:1777
fib_magic+0x1c1/0x1f0 net/ipv4/fib_frontend.c:1106
fib_del_ifaddr+0x8cf/0xa60 net/ipv4/fib_frontend.c:1317
fib_inetaddr_event+0x77/0x200 net/ipv4/fib_frontend.c:1448
notifier_call_chain kernel/notifier.c:93 [inline]
blocking_notifier_call_chain+0x90/0x200 kernel/notifier.c:388
__inet_del_ifa+0x4df/0x800 net/ipv4/devinet.c:432
inet_del_ifa net/ipv4/devinet.c:469 [inline]
inetdev_destroy net/ipv4/devinet.c:322 [inline]
inetdev_event+0x553/0xaf0 net/ipv4/devinet.c:1606
notifier_call_chain kernel/notifier.c:93 [inline]
raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461
call_netdevice_notifiers_info net/core/dev.c:1962 [inline]
call_netdevice_notifiers_mtu+0xd2/0x130 net/core/dev.c:2037
dev_set_mtu_ext+0x30b/0x3e0 net/core/dev.c:8673
do_setlink+0x5be/0x2430 net/core/rtnetlink.c:2837
rtnl_setlink+0x255/0x300 net/core/rtnetlink.c:3177
rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6445
netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2549
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6463
netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline]
netlink_unicast+0x56f/0x640 net/netlink/af_netlink.c:1365
netlink_sendmsg+0x665/0x770 net/netlink/af_netlink.c:1914
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg net/socket.c:748 [inline]
sock_write_iter+0x1aa/0x230 net/socket.c:1129
do_iter_write+0x4b4/0x7b0 fs/read_write.c:860
vfs_writev+0x1a8/0x320 fs/read_write.c:933
do_writev+0xf8/0x220 fs/read_write.c:976
__do_sys_writev fs/read_write.c:1049 [inline]
__se_sys_writev fs/read_write.c:1046 [inline]
__x64_sys_writev+0x45/0x50 fs/read_write.c:1046
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffff888150f31744 of 1 bytes by task 21839 on cpu 1:
fib_table_lookup+0x2bf/0xd50 net/ipv4/fib_trie.c:1585
fib_lookup include/net/ip_fib.h:383 [inline]
ip_route_output_key_hash_rcu+0x38c/0x12c0 net/ipv4/route.c:2751
ip_route_output_key_hash net/ipv4/route.c:2641 [inline]
__ip_route_output_key include/net/route.h:134 [inline]
ip_route_output_flow+0xa6/0x150 net/ipv4/route.c:2869
send4+0x1e7/0x500 drivers/net/wireguard/socket.c:61
wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:175
wg_socket_send_buffer_to_peer+0xd6/0x100 drivers/net/wireguard/socket.c:200
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x10c/0x150 drivers/net/wireguard/send.c:51
process_one_work+0x434/0x860 kernel/workqueue.c:2600
worker_thread+0x5f2/0xa10 kernel/workqueue.c:2751
kthread+0x1d7/0x210 kernel/kthread.c:389
ret_from_fork+0x2e/0x40 arch/x86/kernel/process.c:145
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
value changed: 0x00 -> 0x01
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 21839 Comm: kworker/u4:18 Tainted: G W 6.5.0-syzkaller #0
Fixes: dccd9ecc3744 ("ipv4: Do not use dead fib_info entries.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230830095520.1046984-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/fib_semantics.c | 5 ++++-
net/ipv4/fib_trie.c | 3 ++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 4e94796ccdbd1..ed20d6ac10dc2 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -278,7 +278,8 @@ void fib_release_info(struct fib_info *fi)
hlist_del(&nexthop_nh->nh_hash);
} endfor_nexthops(fi)
}
- fi->fib_dead = 1;
+ /* Paired with READ_ONCE() from fib_table_lookup() */
+ WRITE_ONCE(fi->fib_dead, 1);
fib_info_put(fi);
}
spin_unlock_bh(&fib_info_lock);
@@ -1599,6 +1600,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
link_it:
ofi = fib_find_info(fi);
if (ofi) {
+ /* fib_table_lookup() should not see @fi yet. */
fi->fib_dead = 1;
free_fib_info(fi);
ofi->fib_treeref++;
@@ -1637,6 +1639,7 @@ struct fib_info *fib_create_info(struct fib_config *cfg,
failure:
if (fi) {
+ /* fib_table_lookup() should not see @fi yet. */
fi->fib_dead = 1;
free_fib_info(fi);
}
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index d11fb16234a6a..456240d2adc11 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1534,7 +1534,8 @@ int fib_table_lookup(struct fib_table *tb, const struct flowi4 *flp,
}
if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
continue;
- if (fi->fib_dead)
+ /* Paired with WRITE_ONCE() in fib_release_info() */
+ if (READ_ONCE(fi->fib_dead))
continue;
if (fa->fa_info->fib_scope < flp->flowi4_scope)
continue;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 344/406] net: read sk->sk_family once in sk_mc_loop()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 343/406] ipv4: annotate data-races around fi->fib_dead Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 345/406] drm/i915/gvt: Save/restore HW status to support GVT suspend/resume Greg Kroah-Hartman
` (70 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Kuniyuki Iwashima, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit a3e0fdf71bbe031de845e8e08ed7fba49f9c702c ]
syzbot is playing with IPV6_ADDRFORM quite a lot these days,
and managed to hit the WARN_ON_ONCE(1) in sk_mc_loop()
We have many more similar issues to fix.
WARNING: CPU: 1 PID: 1593 at net/core/sock.c:782 sk_mc_loop+0x165/0x260
Modules linked in:
CPU: 1 PID: 1593 Comm: kworker/1:3 Not tainted 6.1.40-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Workqueue: events_power_efficient gc_worker
RIP: 0010:sk_mc_loop+0x165/0x260 net/core/sock.c:782
Code: 34 1b fd 49 81 c7 18 05 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 20 00 74 08 4c 89 ff e8 25 36 6d fd 4d 8b 37 eb 13 e8 db 33 1b fd <0f> 0b b3 01 eb 34 e8 d0 33 1b fd 45 31 f6 49 83 c6 38 4c 89 f0 48
RSP: 0018:ffffc90000388530 EFLAGS: 00010246
RAX: ffffffff846d9b55 RBX: 0000000000000011 RCX: ffff88814f884980
RDX: 0000000000000102 RSI: ffffffff87ae5160 RDI: 0000000000000011
RBP: ffffc90000388550 R08: 0000000000000003 R09: ffffffff846d9a65
R10: 0000000000000002 R11: ffff88814f884980 R12: dffffc0000000000
R13: ffff88810dbee000 R14: 0000000000000010 R15: ffff888150084000
FS: 0000000000000000(0000) GS:ffff8881f6b00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000180 CR3: 000000014ee5b000 CR4: 00000000003506e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
[<ffffffff8507734f>] ip6_finish_output2+0x33f/0x1ae0 net/ipv6/ip6_output.c:83
[<ffffffff85062766>] __ip6_finish_output net/ipv6/ip6_output.c:200 [inline]
[<ffffffff85062766>] ip6_finish_output+0x6c6/0xb10 net/ipv6/ip6_output.c:211
[<ffffffff85061f8c>] NF_HOOK_COND include/linux/netfilter.h:298 [inline]
[<ffffffff85061f8c>] ip6_output+0x2bc/0x3d0 net/ipv6/ip6_output.c:232
[<ffffffff852071cf>] dst_output include/net/dst.h:444 [inline]
[<ffffffff852071cf>] ip6_local_out+0x10f/0x140 net/ipv6/output_core.c:161
[<ffffffff83618fb4>] ipvlan_process_v6_outbound drivers/net/ipvlan/ipvlan_core.c:483 [inline]
[<ffffffff83618fb4>] ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:529 [inline]
[<ffffffff83618fb4>] ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
[<ffffffff83618fb4>] ipvlan_queue_xmit+0x1174/0x1be0 drivers/net/ipvlan/ipvlan_core.c:677
[<ffffffff8361ddd9>] ipvlan_start_xmit+0x49/0x100 drivers/net/ipvlan/ipvlan_main.c:229
[<ffffffff84763fc0>] netdev_start_xmit include/linux/netdevice.h:4925 [inline]
[<ffffffff84763fc0>] xmit_one net/core/dev.c:3644 [inline]
[<ffffffff84763fc0>] dev_hard_start_xmit+0x320/0x980 net/core/dev.c:3660
[<ffffffff8494c650>] sch_direct_xmit+0x2a0/0x9c0 net/sched/sch_generic.c:342
[<ffffffff8494d883>] qdisc_restart net/sched/sch_generic.c:407 [inline]
[<ffffffff8494d883>] __qdisc_run+0xb13/0x1e70 net/sched/sch_generic.c:415
[<ffffffff8478c426>] qdisc_run+0xd6/0x260 include/net/pkt_sched.h:125
[<ffffffff84796eac>] net_tx_action+0x7ac/0x940 net/core/dev.c:5247
[<ffffffff858002bd>] __do_softirq+0x2bd/0x9bd kernel/softirq.c:599
[<ffffffff814c3fe8>] invoke_softirq kernel/softirq.c:430 [inline]
[<ffffffff814c3fe8>] __irq_exit_rcu+0xc8/0x170 kernel/softirq.c:683
[<ffffffff814c3f09>] irq_exit_rcu+0x9/0x20 kernel/softirq.c:695
Fixes: 7ad6848c7e81 ("ip: fix mc_loop checks for tunnels with multicast outer addresses")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20230830101244.1146934-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index 742356cfd07c4..e2d45631c15d7 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -690,7 +690,8 @@ bool sk_mc_loop(struct sock *sk)
return false;
if (!sk)
return true;
- switch (sk->sk_family) {
+ /* IPV6_ADDRFORM can change sk->sk_family under us. */
+ switch (READ_ONCE(sk->sk_family)) {
case AF_INET:
return inet_sk(sk)->mc_loop;
#if IS_ENABLED(CONFIG_IPV6)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 345/406] drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 344/406] net: read sk->sk_family once in sk_mc_loop() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 346/406] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() Greg Kroah-Hartman
` (69 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhenyu Wang, Hang Yuan, Colin Xu,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Xu <colin.xu@intel.com>
[ Upstream commit 5f60b12edcd0c2e83650a6f9aa4a969bd9fc5732 ]
This patch save/restore necessary GVT info during i915 suspend/resume so
that GVT enabled QEMU VM can continue running.
Only GGTT and fence regs are saved/restored now. GVT will save GGTT
entries on each host_entry update, restore the saved dirty entries
and re-init fence regs in resume routine.
V2:
- Change kzalloc/kfree to vzalloc/vfree since the space allocated
from kmalloc may not enough for all saved GGTT entries.
- Keep gvt suspend/resume wrapper in intel_gvt.h/intel_gvt.c and
move the actual implementation to gvt.h/gvt.c. (zhenyu)
- Check gvt config on and active with intel_gvt_active(). (zhenyu)
V3: (zhenyu)
- Incorrect copy length. Should be num entries * entry size.
- Use memcpy_toio()/memcpy_fromio() instead of memcpy for iomem.
- Add F_PM_SAVE flags to indicate which MMIOs to save/restore for PM.
V4:
Rebase.
V5:
Fail intel_gvt_save_ggtt as -ENOMEM if fail to alloc memory to save
ggtt. Free allocated ggtt_entries on failure.
V6:
Save host entry to per-vGPU gtt.ggtt_mm on each host_entry update.
V7:
Restore GGTT entry based on present bit.
Split fence restore and mmio restore in different functions.
Reviewed-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Signed-off-by: Hang Yuan <hang.yuan@linux.intel.com>
Signed-off-by: Colin Xu <colin.xu@intel.com>
Signed-off-by: Zhenyu Wang <zhenyuw@linux.intel.com>
Link: http://patchwork.freedesktop.org/patch/msgid/20201027045308.158955-1-colin.xu@intel.com
Stable-dep-of: a90c367e5af6 ("drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/gvt/gtt.c | 64 +++++++++++++++++++++++++++++
drivers/gpu/drm/i915/gvt/gtt.h | 4 ++
drivers/gpu/drm/i915/gvt/gvt.c | 9 ++++
drivers/gpu/drm/i915/gvt/gvt.h | 3 ++
drivers/gpu/drm/i915/gvt/handlers.c | 44 ++++++++++++++++++--
drivers/gpu/drm/i915/gvt/mmio.h | 4 ++
drivers/gpu/drm/i915/intel_gvt.c | 15 +++++++
drivers/gpu/drm/i915/intel_gvt.h | 5 +++
8 files changed, 145 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 0201f9b5f87e7..2029f8521a5dc 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -636,9 +636,18 @@ static void ggtt_set_host_entry(struct intel_vgpu_mm *mm,
struct intel_gvt_gtt_entry *entry, unsigned long index)
{
struct intel_gvt_gtt_pte_ops *pte_ops = mm->vgpu->gvt->gtt.pte_ops;
+ unsigned long offset = index;
GEM_BUG_ON(mm->type != INTEL_GVT_MM_GGTT);
+ if (vgpu_gmadr_is_aperture(mm->vgpu, index << I915_GTT_PAGE_SHIFT)) {
+ offset -= (vgpu_aperture_gmadr_base(mm->vgpu) >> PAGE_SHIFT);
+ mm->ggtt_mm.host_ggtt_aperture[offset] = entry->val64;
+ } else if (vgpu_gmadr_is_hidden(mm->vgpu, index << I915_GTT_PAGE_SHIFT)) {
+ offset -= (vgpu_hidden_gmadr_base(mm->vgpu) >> PAGE_SHIFT);
+ mm->ggtt_mm.host_ggtt_hidden[offset] = entry->val64;
+ }
+
pte_ops->set_entry(NULL, entry, index, false, 0, mm->vgpu);
}
@@ -1953,6 +1962,21 @@ static struct intel_vgpu_mm *intel_vgpu_create_ggtt_mm(struct intel_vgpu *vgpu)
return ERR_PTR(-ENOMEM);
}
+ mm->ggtt_mm.host_ggtt_aperture = vzalloc((vgpu_aperture_sz(vgpu) >> PAGE_SHIFT) * sizeof(u64));
+ if (!mm->ggtt_mm.host_ggtt_aperture) {
+ vfree(mm->ggtt_mm.virtual_ggtt);
+ vgpu_free_mm(mm);
+ return ERR_PTR(-ENOMEM);
+ }
+
+ mm->ggtt_mm.host_ggtt_hidden = vzalloc((vgpu_hidden_sz(vgpu) >> PAGE_SHIFT) * sizeof(u64));
+ if (!mm->ggtt_mm.host_ggtt_hidden) {
+ vfree(mm->ggtt_mm.host_ggtt_aperture);
+ vfree(mm->ggtt_mm.virtual_ggtt);
+ vgpu_free_mm(mm);
+ return ERR_PTR(-ENOMEM);
+ }
+
return mm;
}
@@ -1980,6 +2004,8 @@ void _intel_vgpu_mm_release(struct kref *mm_ref)
invalidate_ppgtt_mm(mm);
} else {
vfree(mm->ggtt_mm.virtual_ggtt);
+ vfree(mm->ggtt_mm.host_ggtt_aperture);
+ vfree(mm->ggtt_mm.host_ggtt_hidden);
}
vgpu_free_mm(mm);
@@ -2861,3 +2887,41 @@ void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu)
intel_vgpu_destroy_all_ppgtt_mm(vgpu);
intel_vgpu_reset_ggtt(vgpu, true);
}
+
+/**
+ * intel_gvt_restore_ggtt - restore all vGPU's ggtt entries
+ * @gvt: intel gvt device
+ *
+ * This function is called at driver resume stage to restore
+ * GGTT entries of every vGPU.
+ *
+ */
+void intel_gvt_restore_ggtt(struct intel_gvt *gvt)
+{
+ struct intel_vgpu *vgpu;
+ struct intel_vgpu_mm *mm;
+ int id;
+ gen8_pte_t pte;
+ u32 idx, num_low, num_hi, offset;
+
+ /* Restore dirty host ggtt for all vGPUs */
+ idr_for_each_entry(&(gvt)->vgpu_idr, vgpu, id) {
+ mm = vgpu->gtt.ggtt_mm;
+
+ num_low = vgpu_aperture_sz(vgpu) >> PAGE_SHIFT;
+ offset = vgpu_aperture_gmadr_base(vgpu) >> PAGE_SHIFT;
+ for (idx = 0; idx < num_low; idx++) {
+ pte = mm->ggtt_mm.host_ggtt_aperture[idx];
+ if (pte & _PAGE_PRESENT)
+ write_pte64(vgpu->gvt->gt->ggtt, offset + idx, pte);
+ }
+
+ num_hi = vgpu_hidden_sz(vgpu) >> PAGE_SHIFT;
+ offset = vgpu_hidden_gmadr_base(vgpu) >> PAGE_SHIFT;
+ for (idx = 0; idx < num_hi; idx++) {
+ pte = mm->ggtt_mm.host_ggtt_hidden[idx];
+ if (pte & _PAGE_PRESENT)
+ write_pte64(vgpu->gvt->gt->ggtt, offset + idx, pte);
+ }
+ }
+}
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index 52d0d88abd86a..b0e173f2d9904 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -164,6 +164,9 @@ struct intel_vgpu_mm {
} ppgtt_mm;
struct {
void *virtual_ggtt;
+ /* Save/restore for PM */
+ u64 *host_ggtt_aperture;
+ u64 *host_ggtt_hidden;
struct list_head partial_pte_list;
} ggtt_mm;
};
@@ -280,5 +283,6 @@ int intel_vgpu_emulate_ggtt_mmio_write(struct intel_vgpu *vgpu,
unsigned int off, void *p_data, unsigned int bytes);
void intel_vgpu_destroy_all_ppgtt_mm(struct intel_vgpu *vgpu);
+void intel_gvt_restore_ggtt(struct intel_gvt *gvt);
#endif /* _GVT_GTT_H_ */
diff --git a/drivers/gpu/drm/i915/gvt/gvt.c b/drivers/gpu/drm/i915/gvt/gvt.c
index 5c9ef8e58a087..87f22a88925ce 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.c
+++ b/drivers/gpu/drm/i915/gvt/gvt.c
@@ -405,6 +405,15 @@ int intel_gvt_init_device(struct drm_i915_private *i915)
return ret;
}
+int
+intel_gvt_pm_resume(struct intel_gvt *gvt)
+{
+ intel_gvt_restore_fence(gvt);
+ intel_gvt_restore_mmio(gvt);
+ intel_gvt_restore_ggtt(gvt);
+ return 0;
+}
+
int
intel_gvt_register_hypervisor(struct intel_gvt_mpt *m)
{
diff --git a/drivers/gpu/drm/i915/gvt/gvt.h b/drivers/gpu/drm/i915/gvt/gvt.h
index a81cf0f01e78e..b3d6355dd797d 100644
--- a/drivers/gpu/drm/i915/gvt/gvt.h
+++ b/drivers/gpu/drm/i915/gvt/gvt.h
@@ -255,6 +255,8 @@ struct intel_gvt_mmio {
#define F_CMD_ACCESS (1 << 3)
/* This reg has been accessed by a VM */
#define F_ACCESSED (1 << 4)
+/* This reg requires save & restore during host PM suspend/resume */
+#define F_PM_SAVE (1 << 5)
/* This reg could be accessed by unaligned address */
#define F_UNALIGN (1 << 6)
/* This reg is in GVT's mmio save-restor list and in hardware
@@ -685,6 +687,7 @@ void intel_gvt_debugfs_remove_vgpu(struct intel_vgpu *vgpu);
void intel_gvt_debugfs_init(struct intel_gvt *gvt);
void intel_gvt_debugfs_clean(struct intel_gvt *gvt);
+int intel_gvt_pm_resume(struct intel_gvt *gvt);
#include "trace.h"
#include "mpt.h"
diff --git a/drivers/gpu/drm/i915/gvt/handlers.c b/drivers/gpu/drm/i915/gvt/handlers.c
index 606e6c315fe24..55ce7aaabf893 100644
--- a/drivers/gpu/drm/i915/gvt/handlers.c
+++ b/drivers/gpu/drm/i915/gvt/handlers.c
@@ -3135,9 +3135,10 @@ static int init_skl_mmio_info(struct intel_gvt *gvt)
MMIO_DFH(TRVATTL3PTRDW(2), D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
MMIO_DFH(TRVATTL3PTRDW(3), D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
MMIO_DFH(TRVADR, D_SKL_PLUS, F_CMD_ACCESS, NULL, NULL);
- MMIO_DFH(TRTTE, D_SKL_PLUS, F_CMD_ACCESS,
- NULL, gen9_trtte_write);
- MMIO_DH(_MMIO(0x4dfc), D_SKL_PLUS, NULL, gen9_trtt_chicken_write);
+ MMIO_DFH(TRTTE, D_SKL_PLUS, F_CMD_ACCESS | F_PM_SAVE,
+ NULL, gen9_trtte_write);
+ MMIO_DFH(_MMIO(0x4dfc), D_SKL_PLUS, F_PM_SAVE,
+ NULL, gen9_trtt_chicken_write);
MMIO_D(_MMIO(0x46430), D_SKL_PLUS);
@@ -3686,3 +3687,40 @@ int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
intel_vgpu_default_mmio_read(vgpu, offset, pdata, bytes) :
intel_vgpu_default_mmio_write(vgpu, offset, pdata, bytes);
}
+
+void intel_gvt_restore_fence(struct intel_gvt *gvt)
+{
+ struct intel_vgpu *vgpu;
+ int i, id;
+
+ idr_for_each_entry(&(gvt)->vgpu_idr, vgpu, id) {
+ mmio_hw_access_pre(gvt->gt);
+ for (i = 0; i < vgpu_fence_sz(vgpu); i++)
+ intel_vgpu_write_fence(vgpu, i, vgpu_vreg64(vgpu, fence_num_to_offset(i)));
+ mmio_hw_access_post(gvt->gt);
+ }
+}
+
+static inline int mmio_pm_restore_handler(struct intel_gvt *gvt,
+ u32 offset, void *data)
+{
+ struct intel_vgpu *vgpu = data;
+ struct drm_i915_private *dev_priv = gvt->gt->i915;
+
+ if (gvt->mmio.mmio_attribute[offset >> 2] & F_PM_SAVE)
+ I915_WRITE(_MMIO(offset), vgpu_vreg(vgpu, offset));
+
+ return 0;
+}
+
+void intel_gvt_restore_mmio(struct intel_gvt *gvt)
+{
+ struct intel_vgpu *vgpu;
+ int id;
+
+ idr_for_each_entry(&(gvt)->vgpu_idr, vgpu, id) {
+ mmio_hw_access_pre(gvt->gt);
+ intel_gvt_for_each_tracked_mmio(gvt, mmio_pm_restore_handler, vgpu);
+ mmio_hw_access_post(gvt->gt);
+ }
+}
diff --git a/drivers/gpu/drm/i915/gvt/mmio.h b/drivers/gpu/drm/i915/gvt/mmio.h
index cc4812648bf4a..9e862dc73579b 100644
--- a/drivers/gpu/drm/i915/gvt/mmio.h
+++ b/drivers/gpu/drm/i915/gvt/mmio.h
@@ -104,4 +104,8 @@ int intel_vgpu_mmio_reg_rw(struct intel_vgpu *vgpu, unsigned int offset,
int intel_vgpu_mask_mmio_write(struct intel_vgpu *vgpu, unsigned int offset,
void *p_data, unsigned int bytes);
+
+void intel_gvt_restore_fence(struct intel_gvt *gvt);
+void intel_gvt_restore_mmio(struct intel_gvt *gvt);
+
#endif
diff --git a/drivers/gpu/drm/i915/intel_gvt.c b/drivers/gpu/drm/i915/intel_gvt.c
index 99fe8aef1c67f..4e70c1a9ef2ed 100644
--- a/drivers/gpu/drm/i915/intel_gvt.c
+++ b/drivers/gpu/drm/i915/intel_gvt.c
@@ -24,6 +24,7 @@
#include "i915_drv.h"
#include "i915_vgpu.h"
#include "intel_gvt.h"
+#include "gvt/gvt.h"
/**
* DOC: Intel GVT-g host support
@@ -147,3 +148,17 @@ void intel_gvt_driver_remove(struct drm_i915_private *dev_priv)
intel_gvt_clean_device(dev_priv);
}
+
+/**
+ * intel_gvt_resume - GVT resume routine wapper
+ *
+ * @dev_priv: drm i915 private *
+ *
+ * This function is called at the i915 driver resume stage to restore required
+ * HW status for GVT so that vGPU can continue running after resumed.
+ */
+void intel_gvt_resume(struct drm_i915_private *dev_priv)
+{
+ if (intel_gvt_active(dev_priv))
+ intel_gvt_pm_resume(dev_priv->gvt);
+}
diff --git a/drivers/gpu/drm/i915/intel_gvt.h b/drivers/gpu/drm/i915/intel_gvt.h
index 502fad8a8652c..d7d3fb6186fdd 100644
--- a/drivers/gpu/drm/i915/intel_gvt.h
+++ b/drivers/gpu/drm/i915/intel_gvt.h
@@ -33,6 +33,7 @@ int intel_gvt_init_device(struct drm_i915_private *dev_priv);
void intel_gvt_clean_device(struct drm_i915_private *dev_priv);
int intel_gvt_init_host(void);
void intel_gvt_sanitize_options(struct drm_i915_private *dev_priv);
+void intel_gvt_resume(struct drm_i915_private *dev_priv);
#else
static inline int intel_gvt_init(struct drm_i915_private *dev_priv)
{
@@ -46,6 +47,10 @@ static inline void intel_gvt_driver_remove(struct drm_i915_private *dev_priv)
static inline void intel_gvt_sanitize_options(struct drm_i915_private *dev_priv)
{
}
+
+static inline void intel_gvt_resume(struct drm_i915_private *dev_priv)
+{
+}
#endif
#endif /* _INTEL_GVT_H_ */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 346/406] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 345/406] drm/i915/gvt: Save/restore HW status to support GVT suspend/resume Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 347/406] ipv4: ignore dst hint for multipath routes Greg Kroah-Hartman
` (68 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yan Zhao, Yongwei Ma, Zhi Wang,
Sean Christopherson, Paolo Bonzini, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sean Christopherson <seanjc@google.com>
[ Upstream commit a90c367e5af63880008e21dd199dac839e0e9e0f ]
Drop intel_vgpu_reset_gtt() as it no longer has any callers. In addition
to eliminating dead code, this eliminates the last possible scenario where
__kvmgt_protect_table_find() can be reached without holding vgpu_lock.
Requiring vgpu_lock to be held when calling __kvmgt_protect_table_find()
will allow a protecting the gfn hash with vgpu_lock without too much fuss.
No functional change intended.
Fixes: ba25d977571e ("drm/i915/gvt: Do not destroy ppgtt_mm during vGPU D3->D0.")
Reviewed-by: Yan Zhao <yan.y.zhao@intel.com>
Tested-by: Yongwei Ma <yongwei.ma@intel.com>
Reviewed-by: Zhi Wang <zhi.a.wang@intel.com>
Link: https://lore.kernel.org/r/20230729013535.1070024-11-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/gvt/gtt.c | 18 ------------------
drivers/gpu/drm/i915/gvt/gtt.h | 1 -
2 files changed, 19 deletions(-)
diff --git a/drivers/gpu/drm/i915/gvt/gtt.c b/drivers/gpu/drm/i915/gvt/gtt.c
index 2029f8521a5dc..0d31a0db305d5 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.c
+++ b/drivers/gpu/drm/i915/gvt/gtt.c
@@ -2870,24 +2870,6 @@ void intel_vgpu_reset_ggtt(struct intel_vgpu *vgpu, bool invalidate_old)
ggtt_invalidate(gvt->gt);
}
-/**
- * intel_vgpu_reset_gtt - reset the all GTT related status
- * @vgpu: a vGPU
- *
- * This function is called from vfio core to reset reset all
- * GTT related status, including GGTT, PPGTT, scratch page.
- *
- */
-void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu)
-{
- /* Shadow pages are only created when there is no page
- * table tracking data, so remove page tracking data after
- * removing the shadow pages.
- */
- intel_vgpu_destroy_all_ppgtt_mm(vgpu);
- intel_vgpu_reset_ggtt(vgpu, true);
-}
-
/**
* intel_gvt_restore_ggtt - restore all vGPU's ggtt entries
* @gvt: intel gvt device
diff --git a/drivers/gpu/drm/i915/gvt/gtt.h b/drivers/gpu/drm/i915/gvt/gtt.h
index b0e173f2d9904..89ffb52cafa04 100644
--- a/drivers/gpu/drm/i915/gvt/gtt.h
+++ b/drivers/gpu/drm/i915/gvt/gtt.h
@@ -215,7 +215,6 @@ void intel_vgpu_reset_ggtt(struct intel_vgpu *vgpu, bool invalidate_old);
void intel_vgpu_invalidate_ppgtt(struct intel_vgpu *vgpu);
int intel_gvt_init_gtt(struct intel_gvt *gvt);
-void intel_vgpu_reset_gtt(struct intel_vgpu *vgpu);
void intel_gvt_clean_gtt(struct intel_gvt *gvt);
struct intel_vgpu_mm *intel_gvt_find_ppgtt_mm(struct intel_vgpu *vgpu,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 347/406] ipv4: ignore dst hint for multipath routes
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 346/406] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 348/406] igb: disable virtualization features on 82580 Greg Kroah-Hartman
` (67 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sriram Yagnaraman, Ido Schimmel,
David Ahern, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sriram Yagnaraman <sriram.yagnaraman@est.tech>
[ Upstream commit 6ac66cb03ae306c2e288a9be18226310529f5b25 ]
Route hints when the nexthop is part of a multipath group causes packets
in the same receive batch to be sent to the same nexthop irrespective of
the multipath hash of the packet. So, do not extract route hint for
packets whose destination is part of a multipath group.
A new SKB flag IPSKB_MULTIPATH is introduced for this purpose, set the
flag when route is looked up in ip_mkroute_input() and use it in
ip_extract_route_hint() to check for the existence of the flag.
Fixes: 02b24941619f ("ipv4: use dst hint for ipv4 list receive")
Signed-off-by: Sriram Yagnaraman <sriram.yagnaraman@est.tech>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip.h | 1 +
net/ipv4/ip_input.c | 3 ++-
net/ipv4/route.c | 1 +
3 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/include/net/ip.h b/include/net/ip.h
index 8d1173577fb5c..9be2efe00f2c0 100644
--- a/include/net/ip.h
+++ b/include/net/ip.h
@@ -56,6 +56,7 @@ struct inet_skb_parm {
#define IPSKB_FRAG_PMTU BIT(6)
#define IPSKB_L3SLAVE BIT(7)
#define IPSKB_NOPOLICY BIT(8)
+#define IPSKB_MULTIPATH BIT(9)
u16 frag_max_size;
};
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index eccd7897e7aa6..372579686162b 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -566,7 +566,8 @@ static void ip_sublist_rcv_finish(struct list_head *head)
static struct sk_buff *ip_extract_route_hint(const struct net *net,
struct sk_buff *skb, int rt_type)
{
- if (fib4_has_custom_rules(net) || rt_type == RTN_BROADCAST)
+ if (fib4_has_custom_rules(net) || rt_type == RTN_BROADCAST ||
+ IPCB(skb)->flags & IPSKB_MULTIPATH)
return NULL;
return skb;
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 374647693d7ac..3ddeb4fc0d08a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2066,6 +2066,7 @@ static int ip_mkroute_input(struct sk_buff *skb,
int h = fib_multipath_hash(res->fi->fib_net, NULL, skb, hkeys);
fib_select_multipath(res, h);
+ IPCB(skb)->flags |= IPSKB_MULTIPATH;
}
#endif
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 348/406] igb: disable virtualization features on 82580
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 347/406] ipv4: ignore dst hint for multipath routes Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 349/406] veth: Fixing transmit return status for dropped packets Greg Kroah-Hartman
` (66 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Corinna Vinschen, Simon Horman,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Corinna Vinschen <vinschen@redhat.com>
[ Upstream commit fa09bc40b21a33937872c4c4cf0f266ec9fa4869 ]
Disable virtualization features on 82580 just as on i210/i211.
This avoids that virt functions are acidentally called on 82850.
Fixes: 55cac248caa4 ("igb: Add full support for 82580 devices")
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igb/igb_main.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
index 1143800c889ac..01176c86be125 100644
--- a/drivers/net/ethernet/intel/igb/igb_main.c
+++ b/drivers/net/ethernet/intel/igb/igb_main.c
@@ -3857,8 +3857,9 @@ static void igb_probe_vfs(struct igb_adapter *adapter)
struct pci_dev *pdev = adapter->pdev;
struct e1000_hw *hw = &adapter->hw;
- /* Virtualization features not supported on i210 family. */
- if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211))
+ /* Virtualization features not supported on i210 and 82580 family. */
+ if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211) ||
+ (hw->mac.type == e1000_82580))
return;
/* Of the below we really only want the effect of getting
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 349/406] veth: Fixing transmit return status for dropped packets
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 348/406] igb: disable virtualization features on 82580 Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 350/406] net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr Greg Kroah-Hartman
` (65 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liang Chen, Eric Dumazet,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liang Chen <liangchen.linux@gmail.com>
[ Upstream commit 151e887d8ff97e2e42110ffa1fb1e6a2128fb364 ]
The veth_xmit function returns NETDEV_TX_OK even when packets are dropped.
This behavior leads to incorrect calculations of statistics counts, as
well as things like txq->trans_start updates.
Fixes: e314dbdc1c0d ("[NET]: Virtual ethernet device driver.")
Signed-off-by: Liang Chen <liangchen.linux@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/veth.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 4ba86fa4d6497..743716ebebdb9 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -285,6 +285,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct veth_priv *rcv_priv, *priv = netdev_priv(dev);
struct veth_rq *rq = NULL;
+ int ret = NETDEV_TX_OK;
struct net_device *rcv;
int length = skb->len;
bool rcv_xdp = false;
@@ -311,6 +312,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
} else {
drop:
atomic64_inc(&priv->dropped);
+ ret = NET_XMIT_DROP;
}
if (rcv_xdp)
@@ -318,7 +320,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev)
rcu_read_unlock();
- return NETDEV_TX_OK;
+ return ret;
}
static u64 veth_stats_tx(struct net_device *dev, u64 *packets, u64 *bytes)
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 350/406] net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 349/406] veth: Fixing transmit return status for dropped packets Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 351/406] af_unix: Fix data-races around user->unix_inflight Greg Kroah-Hartman
` (64 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Henrie, David Ahern,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Henrie <alexhenrie24@gmail.com>
[ Upstream commit f31867d0d9d82af757c1e0178b659438f4c1ea3c ]
The existing code incorrectly casted a negative value (the result of a
subtraction) to an unsigned value without checking. For example, if
/proc/sys/net/ipv6/conf/*/temp_prefered_lft was set to 1, the preferred
lifetime would jump to 4 billion seconds. On my machine and network the
shortest lifetime that avoided underflow was 3 seconds.
Fixes: 76506a986dc3 ("IPv6: fix DESYNC_FACTOR")
Signed-off-by: Alex Henrie <alexhenrie24@gmail.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9b414681500a5..0eafe26c05f77 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1359,7 +1359,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, bool block)
* idev->desync_factor if it's larger
*/
cnf_temp_preferred_lft = READ_ONCE(idev->cnf.temp_prefered_lft);
- max_desync_factor = min_t(__u32,
+ max_desync_factor = min_t(long,
idev->cnf.max_desync_factor,
cnf_temp_preferred_lft - regen_advance);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 351/406] af_unix: Fix data-races around user->unix_inflight.
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 350/406] net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 352/406] af_unix: Fix data-race around unix_tot_inflight Greg Kroah-Hartman
` (63 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, Kuniyuki Iwashima,
Willy Tarreau, Eric Dumazet, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit 0bc36c0650b21df36fbec8136add83936eaf0607 ]
user->unix_inflight is changed under spin_lock(unix_gc_lock),
but too_many_unix_fds() reads it locklessly.
Let's annotate the write/read accesses to user->unix_inflight.
BUG: KCSAN: data-race in unix_attach_fds / unix_inflight
write to 0xffffffff8546f2d0 of 8 bytes by task 44798 on cpu 1:
unix_inflight+0x157/0x180 net/unix/scm.c:66
unix_attach_fds+0x147/0x1e0 net/unix/scm.c:123
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
read to 0xffffffff8546f2d0 of 8 bytes by task 44814 on cpu 0:
too_many_unix_fds net/unix/scm.c:101 [inline]
unix_attach_fds+0x54/0x1e0 net/unix/scm.c:110
unix_scm_to_skb net/unix/af_unix.c:1827 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1950
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
value changed: 0x000000000000000c -> 0x000000000000000d
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 44814 Comm: systemd-coredum Not tainted 6.4.0-11989-g6843306689af #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Fixes: 712f4aad406b ("unix: properly account for FDs passed over unix sockets")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/unix/scm.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/unix/scm.c b/net/unix/scm.c
index aa27a02478dc1..e8e2a00bb0f58 100644
--- a/net/unix/scm.c
+++ b/net/unix/scm.c
@@ -63,7 +63,7 @@ void unix_inflight(struct user_struct *user, struct file *fp)
/* Paired with READ_ONCE() in wait_for_unix_gc() */
WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
}
- user->unix_inflight++;
+ WRITE_ONCE(user->unix_inflight, user->unix_inflight + 1);
spin_unlock(&unix_gc_lock);
}
@@ -84,7 +84,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp)
/* Paired with READ_ONCE() in wait_for_unix_gc() */
WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);
}
- user->unix_inflight--;
+ WRITE_ONCE(user->unix_inflight, user->unix_inflight - 1);
spin_unlock(&unix_gc_lock);
}
@@ -98,7 +98,7 @@ static inline bool too_many_unix_fds(struct task_struct *p)
{
struct user_struct *user = current_user();
- if (unlikely(user->unix_inflight > task_rlimit(p, RLIMIT_NOFILE)))
+ if (unlikely(READ_ONCE(user->unix_inflight) > task_rlimit(p, RLIMIT_NOFILE)))
return !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN);
return false;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 352/406] af_unix: Fix data-race around unix_tot_inflight.
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 351/406] af_unix: Fix data-races around user->unix_inflight Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 353/406] af_unix: Fix data-races around sk->sk_shutdown Greg Kroah-Hartman
` (62 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, Kuniyuki Iwashima,
Eric Dumazet, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit ade32bd8a738d7497ffe9743c46728db26740f78 ]
unix_tot_inflight is changed under spin_lock(unix_gc_lock), but
unix_release_sock() reads it locklessly.
Let's use READ_ONCE() for unix_tot_inflight.
Note that the writer side was marked by commit 9d6d7f1cb67c ("af_unix:
annote lockless accesses to unix_tot_inflight & gc_in_progress")
BUG: KCSAN: data-race in unix_inflight / unix_release_sock
write (marked) to 0xffffffff871852b8 of 4 bytes by task 123 on cpu 1:
unix_inflight+0x130/0x180 net/unix/scm.c:64
unix_attach_fds+0x137/0x1b0 net/unix/scm.c:123
unix_scm_to_skb net/unix/af_unix.c:1832 [inline]
unix_dgram_sendmsg+0x46a/0x14f0 net/unix/af_unix.c:1955
sock_sendmsg_nosec net/socket.c:724 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:747
____sys_sendmsg+0x4e4/0x610 net/socket.c:2493
___sys_sendmsg+0xc6/0x140 net/socket.c:2547
__sys_sendmsg+0x94/0x140 net/socket.c:2576
__do_sys_sendmsg net/socket.c:2585 [inline]
__se_sys_sendmsg net/socket.c:2583 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2583
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffffffff871852b8 of 4 bytes by task 4891 on cpu 0:
unix_release_sock+0x608/0x910 net/unix/af_unix.c:671
unix_release+0x59/0x80 net/unix/af_unix.c:1058
__sock_release+0x7d/0x170 net/socket.c:653
sock_close+0x19/0x30 net/socket.c:1385
__fput+0x179/0x5e0 fs/file_table.c:321
____fput+0x15/0x20 fs/file_table.c:349
task_work_run+0x116/0x1a0 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297
do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0x00000000 -> 0x00000001
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 4891 Comm: systemd-coredum Not tainted 6.4.0-rc5-01219-gfa0e21fa4443 #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Fixes: 9305cfa4443d ("[AF_UNIX]: Make unix_tot_inflight counter non-atomic")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/unix/af_unix.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 8d941cbba5cb7..237488b1b58b6 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -587,7 +587,7 @@ static void unix_release_sock(struct sock *sk, int embrion)
* What the above comment does talk about? --ANK(980817)
*/
- if (unix_tot_inflight)
+ if (READ_ONCE(unix_tot_inflight))
unix_gc(); /* Garbage collect fds */
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 353/406] af_unix: Fix data-races around sk->sk_shutdown.
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 352/406] af_unix: Fix data-race around unix_tot_inflight Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 354/406] af_unix: Fix data race around sk->sk_err Greg Kroah-Hartman
` (61 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, Kuniyuki Iwashima,
Eric Dumazet, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit afe8764f76346ba838d4f162883e23d2fcfaa90e ]
sk->sk_shutdown is changed under unix_state_lock(sk), but
unix_dgram_sendmsg() calls two functions to read sk_shutdown locklessly.
sock_alloc_send_pskb
`- sock_wait_for_wmem
Let's use READ_ONCE() there.
Note that the writer side was marked by commit e1d09c2c2f57 ("af_unix:
Fix data races around sk->sk_shutdown.").
BUG: KCSAN: data-race in sock_alloc_send_pskb / unix_release_sock
write (marked) to 0xffff8880069af12c of 1 bytes by task 1 on cpu 1:
unix_release_sock+0x75c/0x910 net/unix/af_unix.c:631
unix_release+0x59/0x80 net/unix/af_unix.c:1053
__sock_release+0x7d/0x170 net/socket.c:654
sock_close+0x19/0x30 net/socket.c:1386
__fput+0x2a3/0x680 fs/file_table.c:384
____fput+0x15/0x20 fs/file_table.c:412
task_work_run+0x116/0x1a0 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x174/0x180 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:297
do_syscall_64+0x4b/0x90 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
read to 0xffff8880069af12c of 1 bytes by task 28650 on cpu 0:
sock_alloc_send_pskb+0xd2/0x620 net/core/sock.c:2767
unix_dgram_sendmsg+0x2f8/0x14f0 net/unix/af_unix.c:1944
unix_seqpacket_sendmsg net/unix/af_unix.c:2308 [inline]
unix_seqpacket_sendmsg+0xba/0x130 net/unix/af_unix.c:2292
sock_sendmsg_nosec net/socket.c:725 [inline]
sock_sendmsg+0x148/0x160 net/socket.c:748
____sys_sendmsg+0x4e4/0x610 net/socket.c:2494
___sys_sendmsg+0xc6/0x140 net/socket.c:2548
__sys_sendmsg+0x94/0x140 net/socket.c:2577
__do_sys_sendmsg net/socket.c:2586 [inline]
__se_sys_sendmsg net/socket.c:2584 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2584
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x6e/0xd8
value changed: 0x00 -> 0x03
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 28650 Comm: systemd-coredum Not tainted 6.4.0-11989-g6843306689af #6
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index e2d45631c15d7..a971385a95d92 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2315,7 +2315,7 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
if (refcount_read(&sk->sk_wmem_alloc) < READ_ONCE(sk->sk_sndbuf))
break;
- if (sk->sk_shutdown & SEND_SHUTDOWN)
+ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
break;
if (sk->sk_err)
break;
@@ -2345,7 +2345,7 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
goto failure;
err = -EPIPE;
- if (sk->sk_shutdown & SEND_SHUTDOWN)
+ if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
goto failure;
if (sk_wmem_alloc_get(sk) < READ_ONCE(sk->sk_sndbuf))
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 354/406] af_unix: Fix data race around sk->sk_err.
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 353/406] af_unix: Fix data-races around sk->sk_shutdown Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 355/406] net: sched: sch_qfq: Fix UAF in qfq_dequeue() Greg Kroah-Hartman
` (60 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit b192812905e4b134f7b7994b079eb647e9d2d37e ]
As with sk->sk_shutdown shown in the previous patch, sk->sk_err can be
read locklessly by unix_dgram_sendmsg().
Let's use READ_ONCE() for sk_err as well.
Note that the writer side is marked by commit cc04410af7de ("af_unix:
annotate lockless accesses to sk->sk_err").
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index a971385a95d92..fcb998dc2dc68 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2317,7 +2317,7 @@ static long sock_wait_for_wmem(struct sock *sk, long timeo)
break;
if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
break;
- if (sk->sk_err)
+ if (READ_ONCE(sk->sk_err))
break;
timeo = schedule_timeout(timeo);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 355/406] net: sched: sch_qfq: Fix UAF in qfq_dequeue()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 354/406] af_unix: Fix data race around sk->sk_err Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 356/406] kcm: Destroy mutex in kcm_exit_net() Greg Kroah-Hartman
` (59 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, valis, Jamal Hadi Salim, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: valis <sec@valis.email>
[ Upstream commit 8fc134fee27f2263988ae38920bc03da416b03d8 ]
When the plug qdisc is used as a class of the qfq qdisc it could trigger a
UAF. This issue can be reproduced with following commands:
tc qdisc add dev lo root handle 1: qfq
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc qdisc add dev lo parent 1:1 handle 2: plug
tc filter add dev lo parent 1: basic classid 1:1
ping -c1 127.0.0.1
and boom:
[ 285.353793] BUG: KASAN: slab-use-after-free in qfq_dequeue+0xa7/0x7f0
[ 285.354910] Read of size 4 at addr ffff8880bad312a8 by task ping/144
[ 285.355903]
[ 285.356165] CPU: 1 PID: 144 Comm: ping Not tainted 6.5.0-rc3+ #4
[ 285.357112] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-2 04/01/2014
[ 285.358376] Call Trace:
[ 285.358773] <IRQ>
[ 285.359109] dump_stack_lvl+0x44/0x60
[ 285.359708] print_address_description.constprop.0+0x2c/0x3c0
[ 285.360611] kasan_report+0x10c/0x120
[ 285.361195] ? qfq_dequeue+0xa7/0x7f0
[ 285.361780] qfq_dequeue+0xa7/0x7f0
[ 285.362342] __qdisc_run+0xf1/0x970
[ 285.362903] net_tx_action+0x28e/0x460
[ 285.363502] __do_softirq+0x11b/0x3de
[ 285.364097] do_softirq.part.0+0x72/0x90
[ 285.364721] </IRQ>
[ 285.365072] <TASK>
[ 285.365422] __local_bh_enable_ip+0x77/0x90
[ 285.366079] __dev_queue_xmit+0x95f/0x1550
[ 285.366732] ? __pfx_csum_and_copy_from_iter+0x10/0x10
[ 285.367526] ? __pfx___dev_queue_xmit+0x10/0x10
[ 285.368259] ? __build_skb_around+0x129/0x190
[ 285.368960] ? ip_generic_getfrag+0x12c/0x170
[ 285.369653] ? __pfx_ip_generic_getfrag+0x10/0x10
[ 285.370390] ? csum_partial+0x8/0x20
[ 285.370961] ? raw_getfrag+0xe5/0x140
[ 285.371559] ip_finish_output2+0x539/0xa40
[ 285.372222] ? __pfx_ip_finish_output2+0x10/0x10
[ 285.372954] ip_output+0x113/0x1e0
[ 285.373512] ? __pfx_ip_output+0x10/0x10
[ 285.374130] ? icmp_out_count+0x49/0x60
[ 285.374739] ? __pfx_ip_finish_output+0x10/0x10
[ 285.375457] ip_push_pending_frames+0xf3/0x100
[ 285.376173] raw_sendmsg+0xef5/0x12d0
[ 285.376760] ? do_syscall_64+0x40/0x90
[ 285.377359] ? __static_call_text_end+0x136578/0x136578
[ 285.378173] ? do_syscall_64+0x40/0x90
[ 285.378772] ? kasan_enable_current+0x11/0x20
[ 285.379469] ? __pfx_raw_sendmsg+0x10/0x10
[ 285.380137] ? __sock_create+0x13e/0x270
[ 285.380673] ? __sys_socket+0xf3/0x180
[ 285.381174] ? __x64_sys_socket+0x3d/0x50
[ 285.381725] ? entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.382425] ? __rcu_read_unlock+0x48/0x70
[ 285.382975] ? ip4_datagram_release_cb+0xd8/0x380
[ 285.383608] ? __pfx_ip4_datagram_release_cb+0x10/0x10
[ 285.384295] ? preempt_count_sub+0x14/0xc0
[ 285.384844] ? __list_del_entry_valid+0x76/0x140
[ 285.385467] ? _raw_spin_lock_bh+0x87/0xe0
[ 285.386014] ? __pfx__raw_spin_lock_bh+0x10/0x10
[ 285.386645] ? release_sock+0xa0/0xd0
[ 285.387148] ? preempt_count_sub+0x14/0xc0
[ 285.387712] ? freeze_secondary_cpus+0x348/0x3c0
[ 285.388341] ? aa_sk_perm+0x177/0x390
[ 285.388856] ? __pfx_aa_sk_perm+0x10/0x10
[ 285.389441] ? check_stack_object+0x22/0x70
[ 285.390032] ? inet_send_prepare+0x2f/0x120
[ 285.390603] ? __pfx_inet_sendmsg+0x10/0x10
[ 285.391172] sock_sendmsg+0xcc/0xe0
[ 285.391667] __sys_sendto+0x190/0x230
[ 285.392168] ? __pfx___sys_sendto+0x10/0x10
[ 285.392727] ? kvm_clock_get_cycles+0x14/0x30
[ 285.393328] ? set_normalized_timespec64+0x57/0x70
[ 285.393980] ? _raw_spin_unlock_irq+0x1b/0x40
[ 285.394578] ? __x64_sys_clock_gettime+0x11c/0x160
[ 285.395225] ? __pfx___x64_sys_clock_gettime+0x10/0x10
[ 285.395908] ? _copy_to_user+0x3e/0x60
[ 285.396432] ? exit_to_user_mode_prepare+0x1a/0x120
[ 285.397086] ? syscall_exit_to_user_mode+0x22/0x50
[ 285.397734] ? do_syscall_64+0x71/0x90
[ 285.398258] __x64_sys_sendto+0x74/0x90
[ 285.398786] do_syscall_64+0x64/0x90
[ 285.399273] ? exit_to_user_mode_prepare+0x1a/0x120
[ 285.399949] ? syscall_exit_to_user_mode+0x22/0x50
[ 285.400605] ? do_syscall_64+0x71/0x90
[ 285.401124] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.401807] RIP: 0033:0x495726
[ 285.402233] Code: ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 09
[ 285.404683] RSP: 002b:00007ffcc25fb618 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 285.405677] RAX: ffffffffffffffda RBX: 0000000000000040 RCX: 0000000000495726
[ 285.406628] RDX: 0000000000000040 RSI: 0000000002518750 RDI: 0000000000000000
[ 285.407565] RBP: 00000000005205ef R08: 00000000005f8838 R09: 000000000000001c
[ 285.408523] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000002517634
[ 285.409460] R13: 00007ffcc25fb6f0 R14: 0000000000000003 R15: 0000000000000000
[ 285.410403] </TASK>
[ 285.410704]
[ 285.410929] Allocated by task 144:
[ 285.411402] kasan_save_stack+0x1e/0x40
[ 285.411926] kasan_set_track+0x21/0x30
[ 285.412442] __kasan_slab_alloc+0x55/0x70
[ 285.412973] kmem_cache_alloc_node+0x187/0x3d0
[ 285.413567] __alloc_skb+0x1b4/0x230
[ 285.414060] __ip_append_data+0x17f7/0x1b60
[ 285.414633] ip_append_data+0x97/0xf0
[ 285.415144] raw_sendmsg+0x5a8/0x12d0
[ 285.415640] sock_sendmsg+0xcc/0xe0
[ 285.416117] __sys_sendto+0x190/0x230
[ 285.416626] __x64_sys_sendto+0x74/0x90
[ 285.417145] do_syscall_64+0x64/0x90
[ 285.417624] entry_SYSCALL_64_after_hwframe+0x6e/0xd8
[ 285.418306]
[ 285.418531] Freed by task 144:
[ 285.418960] kasan_save_stack+0x1e/0x40
[ 285.419469] kasan_set_track+0x21/0x30
[ 285.419988] kasan_save_free_info+0x27/0x40
[ 285.420556] ____kasan_slab_free+0x109/0x1a0
[ 285.421146] kmem_cache_free+0x1c2/0x450
[ 285.421680] __netif_receive_skb_core+0x2ce/0x1870
[ 285.422333] __netif_receive_skb_one_core+0x97/0x140
[ 285.423003] process_backlog+0x100/0x2f0
[ 285.423537] __napi_poll+0x5c/0x2d0
[ 285.424023] net_rx_action+0x2be/0x560
[ 285.424510] __do_softirq+0x11b/0x3de
[ 285.425034]
[ 285.425254] The buggy address belongs to the object at ffff8880bad31280
[ 285.425254] which belongs to the cache skbuff_head_cache of size 224
[ 285.426993] The buggy address is located 40 bytes inside of
[ 285.426993] freed 224-byte region [ffff8880bad31280, ffff8880bad31360)
[ 285.428572]
[ 285.428798] The buggy address belongs to the physical page:
[ 285.429540] page:00000000f4b77674 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xbad31
[ 285.430758] flags: 0x100000000000200(slab|node=0|zone=1)
[ 285.431447] page_type: 0xffffffff()
[ 285.431934] raw: 0100000000000200 ffff88810094a8c0 dead000000000122 0000000000000000
[ 285.432757] raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
[ 285.433562] page dumped because: kasan: bad access detected
[ 285.434144]
[ 285.434320] Memory state around the buggy address:
[ 285.434828] ffff8880bad31180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.435580] ffff8880bad31200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.436264] >ffff8880bad31280: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 285.436777] ^
[ 285.437106] ffff8880bad31300: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
[ 285.437616] ffff8880bad31380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 285.438126] ==================================================================
[ 285.438662] Disabling lock debugging due to kernel taint
Fix this by:
1. Changing sch_plug's .peek handler to qdisc_peek_dequeued(), a
function compatible with non-work-conserving qdiscs
2. Checking the return value of qdisc_dequeue_peeked() in sch_qfq.
Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost")
Reported-by: valis <sec@valis.email>
Signed-off-by: valis <sec@valis.email>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230901162237.11525-1-jhs@mojatatu.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_plug.c | 2 +-
net/sched/sch_qfq.c | 22 +++++++++++++++++-----
2 files changed, 18 insertions(+), 6 deletions(-)
diff --git a/net/sched/sch_plug.c b/net/sched/sch_plug.c
index cbc2ebca4548c..339990bb59817 100644
--- a/net/sched/sch_plug.c
+++ b/net/sched/sch_plug.c
@@ -210,7 +210,7 @@ static struct Qdisc_ops plug_qdisc_ops __read_mostly = {
.priv_size = sizeof(struct plug_sched_data),
.enqueue = plug_enqueue,
.dequeue = plug_dequeue,
- .peek = qdisc_peek_head,
+ .peek = qdisc_peek_dequeued,
.init = plug_init,
.change = plug_change,
.reset = qdisc_reset_queue,
diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
index d5a1e4b237b18..ebf9f473c9392 100644
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -979,10 +979,13 @@ static void qfq_update_eligible(struct qfq_sched *q)
}
/* Dequeue head packet of the head class in the DRR queue of the aggregate. */
-static void agg_dequeue(struct qfq_aggregate *agg,
- struct qfq_class *cl, unsigned int len)
+static struct sk_buff *agg_dequeue(struct qfq_aggregate *agg,
+ struct qfq_class *cl, unsigned int len)
{
- qdisc_dequeue_peeked(cl->qdisc);
+ struct sk_buff *skb = qdisc_dequeue_peeked(cl->qdisc);
+
+ if (!skb)
+ return NULL;
cl->deficit -= (int) len;
@@ -992,6 +995,8 @@ static void agg_dequeue(struct qfq_aggregate *agg,
cl->deficit += agg->lmax;
list_move_tail(&cl->alist, &agg->active);
}
+
+ return skb;
}
static inline struct sk_buff *qfq_peek_skb(struct qfq_aggregate *agg,
@@ -1137,11 +1142,18 @@ static struct sk_buff *qfq_dequeue(struct Qdisc *sch)
if (!skb)
return NULL;
- qdisc_qstats_backlog_dec(sch, skb);
sch->q.qlen--;
+
+ skb = agg_dequeue(in_serv_agg, cl, len);
+
+ if (!skb) {
+ sch->q.qlen++;
+ return NULL;
+ }
+
+ qdisc_qstats_backlog_dec(sch, skb);
qdisc_bstats_update(sch, skb);
- agg_dequeue(in_serv_agg, cl, len);
/* If lmax is lowered, through qfq_change_class, for a class
* owning pending packets with larger size than the new value
* of lmax, then the following condition may hold.
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 356/406] kcm: Destroy mutex in kcm_exit_net()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 355/406] net: sched: sch_qfq: Fix UAF in qfq_dequeue() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 357/406] igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 Greg Kroah-Hartman
` (58 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shigeru Yoshida, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <syoshida@redhat.com>
[ Upstream commit 6ad40b36cd3b04209e2d6c89d252c873d8082a59 ]
kcm_exit_net() should call mutex_destroy() on knet->mutex. This is especially
needed if CONFIG_DEBUG_MUTEXES is enabled.
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Link: https://lore.kernel.org/r/20230902170708.1727999-1-syoshida@redhat.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/kcm/kcmsock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 32b516ab9c475..71608a6def988 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1982,6 +1982,8 @@ static __net_exit void kcm_exit_net(struct net *net)
* that all multiplexors and psocks have been destroyed.
*/
WARN_ON(!list_empty(&knet->mux_list));
+
+ mutex_destroy(&knet->mutex);
}
static struct pernet_operations kcm_net_ops = {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 357/406] igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 356/406] kcm: Destroy mutex in kcm_exit_net() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 358/406] igbvf: Change IGBVF_MIN " Greg Kroah-Hartman
` (57 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Zaborska, Naama Meir,
Tony Nguyen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Zaborska <olga.zaborska@intel.com>
[ Upstream commit 5aa48279712e1f134aac908acde4df798955a955 ]
Change the minimum value of RX/TX descriptors to 64 to enable setting the rx/tx
value between 64 and 80. All igc devices can use as low as 64 descriptors.
This change will unify igc with other drivers.
Based on commit 7b1be1987c1e ("e1000e: lower ring minimum size to 64")
Fixes: 0507ef8a0372 ("igc: Add transmit and receive fastpath and interrupt handlers")
Signed-off-by: Olga Zaborska <olga.zaborska@intel.com>
Tested-by: Naama Meir <naamax.meir@linux.intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igc/igc.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igc/igc.h b/drivers/net/ethernet/intel/igc/igc.h
index 33f64c80335d3..31af08ceb36b9 100644
--- a/drivers/net/ethernet/intel/igc/igc.h
+++ b/drivers/net/ethernet/intel/igc/igc.h
@@ -319,11 +319,11 @@ static inline u32 igc_rss_type(const union igc_adv_rx_desc *rx_desc)
/* TX/RX descriptor defines */
#define IGC_DEFAULT_TXD 256
#define IGC_DEFAULT_TX_WORK 128
-#define IGC_MIN_TXD 80
+#define IGC_MIN_TXD 64
#define IGC_MAX_TXD 4096
#define IGC_DEFAULT_RXD 256
-#define IGC_MIN_RXD 80
+#define IGC_MIN_RXD 64
#define IGC_MAX_RXD 4096
/* Supported Rx Buffer Sizes */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 358/406] igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 357/406] igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 359/406] igb: Change IGB_MIN " Greg Kroah-Hartman
` (56 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Zaborska, Rafal Romanowski,
Tony Nguyen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Zaborska <olga.zaborska@intel.com>
[ Upstream commit 8360717524a24a421c36ef8eb512406dbd42160a ]
Change the minimum value of RX/TX descriptors to 64 to enable setting the rx/tx
value between 64 and 80. All igbvf devices can use as low as 64 descriptors.
This change will unify igbvf with other drivers.
Based on commit 7b1be1987c1e ("e1000e: lower ring minimum size to 64")
Fixes: d4e0fe01a38a ("igbvf: add new driver to support 82576 virtual functions")
Signed-off-by: Olga Zaborska <olga.zaborska@intel.com>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igbvf/igbvf.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igbvf/igbvf.h b/drivers/net/ethernet/intel/igbvf/igbvf.h
index 975eb47ee04df..b39fca9827dc2 100644
--- a/drivers/net/ethernet/intel/igbvf/igbvf.h
+++ b/drivers/net/ethernet/intel/igbvf/igbvf.h
@@ -39,11 +39,11 @@ enum latency_range {
/* Tx/Rx descriptor defines */
#define IGBVF_DEFAULT_TXD 256
#define IGBVF_MAX_TXD 4096
-#define IGBVF_MIN_TXD 80
+#define IGBVF_MIN_TXD 64
#define IGBVF_DEFAULT_RXD 256
#define IGBVF_MAX_RXD 4096
-#define IGBVF_MIN_RXD 80
+#define IGBVF_MIN_RXD 64
#define IGBVF_MIN_ITR_USECS 10 /* 100000 irq/sec */
#define IGBVF_MAX_ITR_USECS 10000 /* 100 irq/sec */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 359/406] igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 358/406] igbvf: Change IGBVF_MIN " Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 360/406] s390/zcrypt: dont leak memory if dev_set_name() fails Greg Kroah-Hartman
` (55 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Zaborska, Tony Nguyen,
Sasha Levin, Pucha Himasekhar Reddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Zaborska <olga.zaborska@intel.com>
[ Upstream commit 6319685bdc8ad5310890add907b7c42f89302886 ]
Change the minimum value of RX/TX descriptors to 64 to enable setting the rx/tx
value between 64 and 80. All igb devices can use as low as 64 descriptors.
This change will unify igb with other drivers.
Based on commit 7b1be1987c1e ("e1000e: lower ring minimum size to 64")
Fixes: 9d5c824399de ("igb: PCI-Express 82575 Gigabit Ethernet driver")
Signed-off-by: Olga Zaborska <olga.zaborska@intel.com>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/igb/igb.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igb/igb.h b/drivers/net/ethernet/intel/igb/igb.h
index e6d2800a8abc5..da0e3897e6831 100644
--- a/drivers/net/ethernet/intel/igb/igb.h
+++ b/drivers/net/ethernet/intel/igb/igb.h
@@ -34,11 +34,11 @@ struct igb_adapter;
/* TX/RX descriptor defines */
#define IGB_DEFAULT_TXD 256
#define IGB_DEFAULT_TX_WORK 128
-#define IGB_MIN_TXD 80
+#define IGB_MIN_TXD 64
#define IGB_MAX_TXD 4096
#define IGB_DEFAULT_RXD 256
-#define IGB_MIN_RXD 80
+#define IGB_MIN_RXD 64
#define IGB_MAX_RXD 4096
#define IGB_DEFAULT_ITR 3 /* dynamic */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 360/406] s390/zcrypt: dont leak memory if dev_set_name() fails
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 359/406] igb: Change IGB_MIN " Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 361/406] idr: fix param name in idr_alloc_cyclic() doc Greg Kroah-Hartman
` (54 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko,
Harald Freudenberger, Heiko Carstens, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 6252f47b78031979ad919f971dc8468b893488bd ]
When dev_set_name() fails, zcdn_create() doesn't free the newly
allocated resources. Do it.
Fixes: 00fab2350e6b ("s390/zcrypt: multiple zcrypt device nodes support")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20230831110000.24279-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/zcrypt_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/s390/crypto/zcrypt_api.c b/drivers/s390/crypto/zcrypt_api.c
index 3b9eda311c273..b518009715eeb 100644
--- a/drivers/s390/crypto/zcrypt_api.c
+++ b/drivers/s390/crypto/zcrypt_api.c
@@ -399,6 +399,7 @@ static int zcdn_create(const char *name)
ZCRYPT_NAME "_%d", (int) MINOR(devt));
nodename[sizeof(nodename)-1] = '\0';
if (dev_set_name(&zcdndev->device, nodename)) {
+ kfree(zcdndev);
rc = -EINVAL;
goto unlockout;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 361/406] idr: fix param name in idr_alloc_cyclic() doc
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 360/406] s390/zcrypt: dont leak memory if dev_set_name() fails Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 362/406] ip_tunnels: use DEV_STATS_INC() Greg Kroah-Hartman
` (53 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ariel Marcovitch,
Matthew Wilcox (Oracle), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ariel Marcovitch <arielmarcovitch@gmail.com>
[ Upstream commit 2a15de80dd0f7e04a823291aa9eb49c5294f56af ]
The relevant parameter is 'start' and not 'nextid'
Fixes: 460488c58ca8 ("idr: Remove idr_alloc_ext")
Signed-off-by: Ariel Marcovitch <arielmarcovitch@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/idr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/idr.c b/lib/idr.c
index 7ecdfdb5309e7..13f2758c23773 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -100,7 +100,7 @@ EXPORT_SYMBOL_GPL(idr_alloc);
* @end: The maximum ID (exclusive).
* @gfp: Memory allocation flags.
*
- * Allocates an unused ID in the range specified by @nextid and @end. If
+ * Allocates an unused ID in the range specified by @start and @end. If
* @end is <= 0, it is treated as one larger than %INT_MAX. This allows
* callers to use @start + N as @end as long as N is within integer range.
* The search for an unused ID will start at the last ID allocated and will
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 362/406] ip_tunnels: use DEV_STATS_INC()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 361/406] idr: fix param name in idr_alloc_cyclic() doc Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 363/406] net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload Greg Kroah-Hartman
` (52 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9b271ebaf9a2c5c566a54bc6cd915962e8241130 ]
syzbot/KCSAN reported data-races in iptunnel_xmit_stats() [1]
This can run from multiple cpus without mutual exclusion.
Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.
[1]
BUG: KCSAN: data-race in iptunnel_xmit / iptunnel_xmit
read-write to 0xffff8881353df170 of 8 bytes by task 30263 on cpu 1:
iptunnel_xmit_stats include/net/ip_tunnels.h:493 [inline]
iptunnel_xmit+0x432/0x4a0 net/ipv4/ip_tunnel_core.c:87
ip_tunnel_xmit+0x1477/0x1750 net/ipv4/ip_tunnel.c:831
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:662
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
__bpf_tx_skb net/core/filter.c:2129 [inline]
__bpf_redirect_no_mac net/core/filter.c:2159 [inline]
__bpf_redirect+0x723/0x9c0 net/core/filter.c:2182
____bpf_clone_redirect net/core/filter.c:2453 [inline]
bpf_clone_redirect+0x16c/0x1d0 net/core/filter.c:2425
___bpf_prog_run+0xd7d/0x41e0 kernel/bpf/core.c:1954
__bpf_prog_run512+0x74/0xa0 kernel/bpf/core.c:2195
bpf_dispatcher_nop_func include/linux/bpf.h:1181 [inline]
__bpf_prog_run include/linux/filter.h:609 [inline]
bpf_prog_run include/linux/filter.h:616 [inline]
bpf_test_run+0x15d/0x3d0 net/bpf/test_run.c:423
bpf_prog_test_run_skb+0x77b/0xa00 net/bpf/test_run.c:1045
bpf_prog_test_run+0x265/0x3d0 kernel/bpf/syscall.c:3996
__sys_bpf+0x3af/0x780 kernel/bpf/syscall.c:5353
__do_sys_bpf kernel/bpf/syscall.c:5439 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5437 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5437
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read-write to 0xffff8881353df170 of 8 bytes by task 30249 on cpu 0:
iptunnel_xmit_stats include/net/ip_tunnels.h:493 [inline]
iptunnel_xmit+0x432/0x4a0 net/ipv4/ip_tunnel_core.c:87
ip_tunnel_xmit+0x1477/0x1750 net/ipv4/ip_tunnel.c:831
__gre_xmit net/ipv4/ip_gre.c:469 [inline]
ipgre_xmit+0x516/0x570 net/ipv4/ip_gre.c:662
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
__bpf_tx_skb net/core/filter.c:2129 [inline]
__bpf_redirect_no_mac net/core/filter.c:2159 [inline]
__bpf_redirect+0x723/0x9c0 net/core/filter.c:2182
____bpf_clone_redirect net/core/filter.c:2453 [inline]
bpf_clone_redirect+0x16c/0x1d0 net/core/filter.c:2425
___bpf_prog_run+0xd7d/0x41e0 kernel/bpf/core.c:1954
__bpf_prog_run512+0x74/0xa0 kernel/bpf/core.c:2195
bpf_dispatcher_nop_func include/linux/bpf.h:1181 [inline]
__bpf_prog_run include/linux/filter.h:609 [inline]
bpf_prog_run include/linux/filter.h:616 [inline]
bpf_test_run+0x15d/0x3d0 net/bpf/test_run.c:423
bpf_prog_test_run_skb+0x77b/0xa00 net/bpf/test_run.c:1045
bpf_prog_test_run+0x265/0x3d0 kernel/bpf/syscall.c:3996
__sys_bpf+0x3af/0x780 kernel/bpf/syscall.c:5353
__do_sys_bpf kernel/bpf/syscall.c:5439 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5437 [inline]
__x64_sys_bpf+0x43/0x50 kernel/bpf/syscall.c:5437
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x0000000000018830 -> 0x0000000000018831
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 30249 Comm: syz-executor.4 Not tainted 6.5.0-syzkaller-11704-g3f86ed6ec0b3 #0
Fixes: 039f50629b7f ("ip_tunnel: Move stats update to iptunnel_xmit()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip_tunnels.h | 15 +++++++--------
1 file changed, 7 insertions(+), 8 deletions(-)
diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 1ddd401a8981f..58d8e6260aa13 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h
@@ -455,15 +455,14 @@ static inline void iptunnel_xmit_stats(struct net_device *dev, int pkt_len)
tstats->tx_packets++;
u64_stats_update_end(&tstats->syncp);
put_cpu_ptr(tstats);
+ return;
+ }
+
+ if (pkt_len < 0) {
+ DEV_STATS_INC(dev, tx_errors);
+ DEV_STATS_INC(dev, tx_aborted_errors);
} else {
- struct net_device_stats *err_stats = &dev->stats;
-
- if (pkt_len < 0) {
- err_stats->tx_errors++;
- err_stats->tx_aborted_errors++;
- } else {
- err_stats->tx_dropped++;
- }
+ DEV_STATS_INC(dev, tx_dropped);
}
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 363/406] net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 362/406] ip_tunnels: use DEV_STATS_INC() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 364/406] net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times Greg Kroah-Hartman
` (51 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yanan Yang, Vladimir Oltean,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 954ad9bf13c4f95a4958b5f8433301f2ab99e1f5 ]
More careful measurement of the tc-cbs bandwidth shows that the stream
bandwidth (effectively idleslope) increases, there is a larger and
larger discrepancy between the rate limit obtained by the software
Qdisc, and the rate limit obtained by its offloaded counterpart.
The discrepancy becomes so large, that e.g. at an idleslope of 40000
(40Mbps), the offloaded cbs does not actually rate limit anything, and
traffic will pass at line rate through a 100 Mbps port.
The reason for the discrepancy is that the hardware documentation I've
been following is incorrect. UM11040.pdf (for SJA1105P/Q/R/S) states
about IDLE_SLOPE that it is "the rate (in unit of bytes/sec) at which
the credit counter is increased".
Cross-checking with UM10944.pdf (for SJA1105E/T) and UM11107.pdf
(for SJA1110), the wording is different: "This field specifies the
value, in bytes per second times link speed, by which the credit counter
is increased".
So there's an extra scaling for link speed that the driver is currently
not accounting for, and apparently (empirically), that link speed is
expressed in Kbps.
I've pondered whether to pollute the sja1105_mac_link_up()
implementation with CBS shaper reprogramming, but I don't think it is
worth it. IMO, the UAPI exposed by tc-cbs requires user space to
recalculate the sendslope anyway, since the formula for that depends on
port_transmit_rate (see man tc-cbs), which is not an invariant from tc's
perspective.
So we use the offload->sendslope and offload->idleslope to deduce the
original port_transmit_rate from the CBS formula, and use that value to
scale the offload->sendslope and offload->idleslope to values that the
hardware understands.
Some numerical data points:
40Mbps stream, max interfering frame size 1500, port speed 100M
---------------------------------------------------------------
tc-cbs parameters:
idleslope 40000 sendslope -60000 locredit -900 hicredit 600
which result in hardware values:
Before (doesn't work) After (works)
credit_hi 600 600
credit_lo 900 900
send_slope 7500000 75
idle_slope 5000000 50
40Mbps stream, max interfering frame size 1500, port speed 1G
-------------------------------------------------------------
tc-cbs parameters:
idleslope 40000 sendslope -960000 locredit -1440 hicredit 60
which result in hardware values:
Before (doesn't work) After (works)
credit_hi 60 60
credit_lo 1440 1440
send_slope 120000000 120
idle_slope 5000000 5
5.12Mbps stream, max interfering frame size 1522, port speed 100M
-----------------------------------------------------------------
tc-cbs parameters:
idleslope 5120 sendslope -94880 locredit -1444 hicredit 77
which result in hardware values:
Before (doesn't work) After (works)
credit_hi 77 77
credit_lo 1444 1444
send_slope 11860000 118
idle_slope 640000 6
Tested on SJA1105T, SJA1105S and SJA1110A, at 1Gbps and 100Mbps.
Fixes: 4d7525085a9b ("net: dsa: sja1105: offload the Credit-Based Shaper qdisc")
Reported-by: Yanan Yang <yanan.yang@nxp.com>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_main.c | 15 ++++++++++++---
1 file changed, 12 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index c03d76c108686..4c0ee13126e4f 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1725,6 +1725,7 @@ static int sja1105_setup_tc_cbs(struct dsa_switch *ds, int port,
{
struct sja1105_private *priv = ds->priv;
struct sja1105_cbs_entry *cbs;
+ s64 port_transmit_rate_kbps;
int index;
if (!offload->enable)
@@ -1742,9 +1743,17 @@ static int sja1105_setup_tc_cbs(struct dsa_switch *ds, int port,
*/
cbs->credit_hi = offload->hicredit;
cbs->credit_lo = abs(offload->locredit);
- /* User space is in kbits/sec, hardware in bytes/sec */
- cbs->idle_slope = offload->idleslope * BYTES_PER_KBIT;
- cbs->send_slope = abs(offload->sendslope * BYTES_PER_KBIT);
+ /* User space is in kbits/sec, while the hardware in bytes/sec times
+ * link speed. Since the given offload->sendslope is good only for the
+ * current link speed anyway, and user space is likely to reprogram it
+ * when that changes, don't even bother to track the port's link speed,
+ * but deduce the port transmit rate from idleslope - sendslope.
+ */
+ port_transmit_rate_kbps = offload->idleslope - offload->sendslope;
+ cbs->idle_slope = div_s64(offload->idleslope * BYTES_PER_KBIT,
+ port_transmit_rate_kbps);
+ cbs->send_slope = div_s64(abs(offload->sendslope * BYTES_PER_KBIT),
+ port_transmit_rate_kbps);
/* Convert the negative values from 64-bit 2's complement
* to 32-bit 2's complement (for the case of 0x80000000 whose
* negative is still negative).
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 364/406] net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 363/406] net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 365/406] netfilter: nfnetlink_osf: avoid OOB read Greg Kroah-Hartman
` (50 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 894cafc5c62ccced758077bd4e970dc714c42637 ]
After running command [2] too many times in a row:
[1] $ tc qdisc add dev sw2p0 root handle 1: mqprio num_tc 8 \
map 0 1 2 3 4 5 6 7 queues 1@0 1@1 1@2 1@3 1@4 1@5 1@6 1@7 hw 0
[2] $ tc qdisc replace dev sw2p0 parent 1:1 cbs offload 1 \
idleslope 120000 sendslope -880000 locredit -1320 hicredit 180
(aka more than priv->info->num_cbs_shapers times)
we start seeing the following error message:
Error: Specified device failed to setup cbs hardware offload.
This comes from the fact that ndo_setup_tc(TC_SETUP_QDISC_CBS) presents
the same API for the qdisc create and replace cases, and the sja1105
driver fails to distinguish between the 2. Thus, it always thinks that
it must allocate the same shaper for a {port, queue} pair, when it may
instead have to replace an existing one.
Fixes: 4d7525085a9b ("net: dsa: sja1105: offload the Credit-Based Shaper qdisc")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/sja1105/sja1105_main.c | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
diff --git a/drivers/net/dsa/sja1105/sja1105_main.c b/drivers/net/dsa/sja1105/sja1105_main.c
index 4c0ee13126e4f..4362fe0f346d2 100644
--- a/drivers/net/dsa/sja1105/sja1105_main.c
+++ b/drivers/net/dsa/sja1105/sja1105_main.c
@@ -1691,6 +1691,18 @@ static void sja1105_bridge_leave(struct dsa_switch *ds, int port,
#define BYTES_PER_KBIT (1000LL / 8)
+static int sja1105_find_cbs_shaper(struct sja1105_private *priv,
+ int port, int prio)
+{
+ int i;
+
+ for (i = 0; i < priv->info->num_cbs_shapers; i++)
+ if (priv->cbs[i].port == port && priv->cbs[i].prio == prio)
+ return i;
+
+ return -1;
+}
+
static int sja1105_find_unused_cbs_shaper(struct sja1105_private *priv)
{
int i;
@@ -1731,9 +1743,14 @@ static int sja1105_setup_tc_cbs(struct dsa_switch *ds, int port,
if (!offload->enable)
return sja1105_delete_cbs_shaper(priv, port, offload->queue);
- index = sja1105_find_unused_cbs_shaper(priv);
- if (index < 0)
- return -ENOSPC;
+ /* The user may be replacing an existing shaper */
+ index = sja1105_find_cbs_shaper(priv, port, offload->queue);
+ if (index < 0) {
+ /* That isn't the case - see if we can allocate a new one */
+ index = sja1105_find_unused_cbs_shaper(priv);
+ if (index < 0)
+ return -ENOSPC;
+ }
cbs = &priv->cbs[index];
cbs->port = port;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 365/406] netfilter: nfnetlink_osf: avoid OOB read
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 364/406] net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 366/406] net: hns3: fix the port information display when sfp is absent Greg Kroah-Hartman
` (49 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lucas Leong, Wander Lairson Costa,
Florian Westphal, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wander Lairson Costa <wander@redhat.com>
[ Upstream commit f4f8a7803119005e87b716874bec07c751efafec ]
The opt_num field is controlled by user mode and is not currently
validated inside the kernel. An attacker can take advantage of this to
trigger an OOB read and potentially leak information.
BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
Read of size 2 at addr ffff88804bc64272 by task poc/6431
CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
Call Trace:
nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88
nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281
nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47
expr_call_ops_eval net/netfilter/nf_tables_core.c:214
nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264
nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23
[..]
Also add validation to genre, subtype and version fields.
Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match")
Reported-by: Lucas Leong <wmliang@infosec.exchange>
Signed-off-by: Wander Lairson Costa <wander@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nfnetlink_osf.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c
index 9dbaa5ce24e51..573a372e760f4 100644
--- a/net/netfilter/nfnetlink_osf.c
+++ b/net/netfilter/nfnetlink_osf.c
@@ -316,6 +316,14 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl,
f = nla_data(osf_attrs[OSF_ATTR_FINGER]);
+ if (f->opt_num > ARRAY_SIZE(f->opt))
+ return -EINVAL;
+
+ if (!memchr(f->genre, 0, MAXGENRELEN) ||
+ !memchr(f->subtype, 0, MAXGENRELEN) ||
+ !memchr(f->version, 0, MAXGENRELEN))
+ return -EINVAL;
+
kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL);
if (!kf)
return -ENOMEM;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 366/406] net: hns3: fix the port information display when sfp is absent
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 365/406] netfilter: nfnetlink_osf: avoid OOB read Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 367/406] sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() Greg Kroah-Hartman
` (48 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yisen Zhuang, Jijie Shao,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yisen Zhuang <yisen.zhuang@huawei.com>
[ Upstream commit 674d9591a32d01df75d6b5fffed4ef942a294376 ]
When sfp is absent or unidentified, the port type should be
displayed as PORT_OTHERS, rather than PORT_FIBRE.
Fixes: 88d10bd6f730 ("net: hns3: add support for multiple media type")
Signed-off-by: Yisen Zhuang <yisen.zhuang@huawei.com>
Signed-off-by: Jijie Shao <shaojijie@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
index cd0d7a546957a..d35f4b2b480e6 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c
@@ -704,7 +704,9 @@ static int hns3_get_link_ksettings(struct net_device *netdev,
hns3_get_ksettings(h, cmd);
break;
case HNAE3_MEDIA_TYPE_FIBER:
- if (module_type == HNAE3_MODULE_TYPE_CR)
+ if (module_type == HNAE3_MODULE_TYPE_UNKNOWN)
+ cmd->base.port = PORT_OTHER;
+ else if (module_type == HNAE3_MODULE_TYPE_CR)
cmd->base.port = PORT_DA;
else
cmd->base.port = PORT_FIBRE;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 367/406] sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 366/406] net: hns3: fix the port information display when sfp is absent Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 368/406] ext4: add correct group descriptors and reserved GDT blocks to system zone Greg Kroah-Hartman
` (47 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Tesarik, Geert Uytterhoeven,
Jacopo Mondi, John Paul Adrian Glaubitz, Laurent Pinchart,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Petr Tesarik <petr.tesarik.ext@huawei.com>
[ Upstream commit fb60211f377b69acffead3147578f86d0092a7a5 ]
In all these cases, the last argument to dma_declare_coherent_memory() is
the buffer end address, but the expected value should be the size of the
reserved region.
Fixes: 39fb993038e1 ("media: arch: sh: ap325rxa: Use new renesas-ceu camera driver")
Fixes: c2f9b05fd5c1 ("media: arch: sh: ecovec: Use new renesas-ceu camera driver")
Fixes: f3590dc32974 ("media: arch: sh: kfr2r09: Use new renesas-ceu camera driver")
Fixes: 186c446f4b84 ("media: arch: sh: migor: Use new renesas-ceu camera driver")
Fixes: 1a3c230b4151 ("media: arch: sh: ms7724se: Use new renesas-ceu camera driver")
Signed-off-by: Petr Tesarik <petr.tesarik.ext@huawei.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Jacopo Mondi <jacopo.mondi@ideasonboard.com>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20230724120742.2187-1-petrtesarik@huaweicloud.com
Signed-off-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sh/boards/mach-ap325rxa/setup.c | 2 +-
arch/sh/boards/mach-ecovec24/setup.c | 6 ++----
arch/sh/boards/mach-kfr2r09/setup.c | 2 +-
arch/sh/boards/mach-migor/setup.c | 2 +-
arch/sh/boards/mach-se/7724/setup.c | 6 ++----
5 files changed, 7 insertions(+), 11 deletions(-)
diff --git a/arch/sh/boards/mach-ap325rxa/setup.c b/arch/sh/boards/mach-ap325rxa/setup.c
index bac8a058ebd7c..05bd42dde107b 100644
--- a/arch/sh/boards/mach-ap325rxa/setup.c
+++ b/arch/sh/boards/mach-ap325rxa/setup.c
@@ -530,7 +530,7 @@ static int __init ap325rxa_devices_setup(void)
device_initialize(&ap325rxa_ceu_device.dev);
dma_declare_coherent_memory(&ap325rxa_ceu_device.dev,
ceu_dma_membase, ceu_dma_membase,
- ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(&ap325rxa_ceu_device);
diff --git a/arch/sh/boards/mach-ecovec24/setup.c b/arch/sh/boards/mach-ecovec24/setup.c
index bab91a99124e1..9730a992dab33 100644
--- a/arch/sh/boards/mach-ecovec24/setup.c
+++ b/arch/sh/boards/mach-ecovec24/setup.c
@@ -1454,15 +1454,13 @@ static int __init arch_setup(void)
device_initialize(&ecovec_ceu_devices[0]->dev);
dma_declare_coherent_memory(&ecovec_ceu_devices[0]->dev,
ceu0_dma_membase, ceu0_dma_membase,
- ceu0_dma_membase +
- CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ecovec_ceu_devices[0]);
device_initialize(&ecovec_ceu_devices[1]->dev);
dma_declare_coherent_memory(&ecovec_ceu_devices[1]->dev,
ceu1_dma_membase, ceu1_dma_membase,
- ceu1_dma_membase +
- CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ecovec_ceu_devices[1]);
gpiod_add_lookup_table(&cn12_power_gpiod_table);
diff --git a/arch/sh/boards/mach-kfr2r09/setup.c b/arch/sh/boards/mach-kfr2r09/setup.c
index eeb5ce341efdd..4a1caa3e7cf5a 100644
--- a/arch/sh/boards/mach-kfr2r09/setup.c
+++ b/arch/sh/boards/mach-kfr2r09/setup.c
@@ -603,7 +603,7 @@ static int __init kfr2r09_devices_setup(void)
device_initialize(&kfr2r09_ceu_device.dev);
dma_declare_coherent_memory(&kfr2r09_ceu_device.dev,
ceu_dma_membase, ceu_dma_membase,
- ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(&kfr2r09_ceu_device);
diff --git a/arch/sh/boards/mach-migor/setup.c b/arch/sh/boards/mach-migor/setup.c
index 6703a2122c0d6..bd4ccd9f8dd06 100644
--- a/arch/sh/boards/mach-migor/setup.c
+++ b/arch/sh/boards/mach-migor/setup.c
@@ -604,7 +604,7 @@ static int __init migor_devices_setup(void)
device_initialize(&migor_ceu_device.dev);
dma_declare_coherent_memory(&migor_ceu_device.dev,
ceu_dma_membase, ceu_dma_membase,
- ceu_dma_membase + CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(&migor_ceu_device);
diff --git a/arch/sh/boards/mach-se/7724/setup.c b/arch/sh/boards/mach-se/7724/setup.c
index 8d6541ba01865..edc7712e4a804 100644
--- a/arch/sh/boards/mach-se/7724/setup.c
+++ b/arch/sh/boards/mach-se/7724/setup.c
@@ -940,15 +940,13 @@ static int __init devices_setup(void)
device_initialize(&ms7724se_ceu_devices[0]->dev);
dma_declare_coherent_memory(&ms7724se_ceu_devices[0]->dev,
ceu0_dma_membase, ceu0_dma_membase,
- ceu0_dma_membase +
- CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ms7724se_ceu_devices[0]);
device_initialize(&ms7724se_ceu_devices[1]->dev);
dma_declare_coherent_memory(&ms7724se_ceu_devices[1]->dev,
ceu1_dma_membase, ceu1_dma_membase,
- ceu1_dma_membase +
- CEU_BUFFER_MEMORY_SIZE - 1);
+ CEU_BUFFER_MEMORY_SIZE);
platform_device_add(ms7724se_ceu_devices[1]);
return platform_add_devices(ms7724se_devices,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 368/406] ext4: add correct group descriptors and reserved GDT blocks to system zone
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 367/406] sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 369/406] ata: sata_gemini: Add missing MODULE_DESCRIPTION Greg Kroah-Hartman
` (46 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Wang Jianjian, Theodore Tso
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Jianjian <wangjianjian0@foxmail.com>
commit 68228da51c9a436872a4ef4b5a7692e29f7e5bc7 upstream.
When setup_system_zone, flex_bg is not initialized so it is always 1.
Use a new helper function, ext4_num_base_meta_blocks() which does not
depend on sbi->s_log_groups_per_flex being initialized.
[ Squashed two patches in the Link URL's below together into a single
commit, which is simpler to review/understand. Also fix checkpatch
warnings. --TYT ]
Cc: stable@kernel.org
Signed-off-by: Wang Jianjian <wangjianjian0@foxmail.com>
Link: https://lore.kernel.org/r/tencent_21AF0D446A9916ED5C51492CC6C9A0A77B05@qq.com
Link: https://lore.kernel.org/r/tencent_D744D1450CC169AEA77FCF0A64719909ED05@qq.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/balloc.c | 15 +++++++++++----
fs/ext4/block_validity.c | 8 ++++----
fs/ext4/ext4.h | 2 ++
3 files changed, 17 insertions(+), 8 deletions(-)
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -903,11 +903,11 @@ unsigned long ext4_bg_num_gdb(struct sup
}
/*
- * This function returns the number of file system metadata clusters at
+ * This function returns the number of file system metadata blocks at
* the beginning of a block group, including the reserved gdt blocks.
*/
-static unsigned ext4_num_base_meta_clusters(struct super_block *sb,
- ext4_group_t block_group)
+unsigned int ext4_num_base_meta_blocks(struct super_block *sb,
+ ext4_group_t block_group)
{
struct ext4_sb_info *sbi = EXT4_SB(sb);
unsigned num;
@@ -925,8 +925,15 @@ static unsigned ext4_num_base_meta_clust
} else { /* For META_BG_BLOCK_GROUPS */
num += ext4_bg_num_gdb(sb, block_group);
}
- return EXT4_NUM_B2C(sbi, num);
+ return num;
}
+
+static unsigned int ext4_num_base_meta_clusters(struct super_block *sb,
+ ext4_group_t block_group)
+{
+ return EXT4_NUM_B2C(EXT4_SB(sb), ext4_num_base_meta_blocks(sb, block_group));
+}
+
/**
* ext4_inode_to_goal_block - return a hint for block allocation
* @inode: inode for block allocation
--- a/fs/ext4/block_validity.c
+++ b/fs/ext4/block_validity.c
@@ -217,7 +217,6 @@ int ext4_setup_system_zone(struct super_
struct ext4_system_blocks *system_blks;
struct ext4_group_desc *gdp;
ext4_group_t i;
- int flex_size = ext4_flex_bg_size(sbi);
int ret;
system_blks = kzalloc(sizeof(*system_blks), GFP_KERNEL);
@@ -225,12 +224,13 @@ int ext4_setup_system_zone(struct super_
return -ENOMEM;
for (i=0; i < ngroups; i++) {
+ unsigned int meta_blks = ext4_num_base_meta_blocks(sb, i);
+
cond_resched();
- if (ext4_bg_has_super(sb, i) &&
- ((i < 5) || ((i % flex_size) == 0))) {
+ if (meta_blks != 0) {
ret = add_system_zone(system_blks,
ext4_group_first_block_no(sb, i),
- ext4_bg_num_gdb(sb, i) + 1, 0);
+ meta_blks, 0);
if (ret)
goto err;
}
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2967,6 +2967,8 @@ extern const char *ext4_decode_error(str
extern void ext4_mark_group_bitmap_corrupted(struct super_block *sb,
ext4_group_t block_group,
unsigned int flags);
+extern unsigned int ext4_num_base_meta_blocks(struct super_block *sb,
+ ext4_group_t block_group);
extern __printf(6, 7)
void __ext4_error(struct super_block *, const char *, unsigned int, int, __u64,
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 369/406] ata: sata_gemini: Add missing MODULE_DESCRIPTION
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 368/406] ext4: add correct group descriptors and reserved GDT blocks to system zone Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 370/406] ata: pata_ftide010: " Greg Kroah-Hartman
` (45 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Linus Walleij
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 8566572bf3b4d6e416a4bf2110dbb4817d11ba59 upstream.
Add the missing MODULE_DESCRIPTION() to avoid warnings such as:
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/ata/sata_gemini.o
when compiling with W=1.
Fixes: be4e456ed3a5 ("ata: Add driver for Faraday Technology FTIDE010")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/sata_gemini.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/ata/sata_gemini.c
+++ b/drivers/ata/sata_gemini.c
@@ -435,6 +435,7 @@ static struct platform_driver gemini_sat
};
module_platform_driver(gemini_sata_driver);
+MODULE_DESCRIPTION("low level driver for Cortina Systems Gemini SATA bridge");
MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>");
MODULE_LICENSE("GPL");
MODULE_ALIAS("platform:" DRV_NAME);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 370/406] ata: pata_ftide010: Add missing MODULE_DESCRIPTION
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 369/406] ata: sata_gemini: Add missing MODULE_DESCRIPTION Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 371/406] fuse: nlookup missing decrement in fuse_direntplus_link Greg Kroah-Hartman
` (44 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Linus Walleij
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 7274eef5729037300f29d14edeb334a47a098f65 upstream.
Add the missing MODULE_DESCRIPTION() to avoid warnings such as:
WARNING: modpost: missing MODULE_DESCRIPTION() in drivers/ata/pata_ftide010.o
when compiling with W=1.
Fixes: be4e456ed3a5 ("ata: Add driver for Faraday Technology FTIDE010")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/pata_ftide010.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/ata/pata_ftide010.c
+++ b/drivers/ata/pata_ftide010.c
@@ -570,6 +570,7 @@ static struct platform_driver pata_ftide
};
module_platform_driver(pata_ftide010_driver);
+MODULE_DESCRIPTION("low level driver for Faraday Technology FTIDE010");
MODULE_AUTHOR("Linus Walleij <linus.walleij@linaro.org>");
MODULE_LICENSE("GPL");
MODULE_ALIAS("platform:" DRV_NAME);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 371/406] fuse: nlookup missing decrement in fuse_direntplus_link
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 370/406] ata: pata_ftide010: " Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 372/406] btrfs: dont start transaction when joining with TRANS_JOIN_NOSTART Greg Kroah-Hartman
` (43 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, ruanmeisi, Miklos Szeredi
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ruanmeisi <ruan.meisi@zte.com.cn>
commit b8bd342d50cbf606666488488f9fea374aceb2d5 upstream.
During our debugging of glusterfs, we found an Assertion failed error:
inode_lookup >= nlookup, which was caused by the nlookup value in the
kernel being greater than that in the FUSE file system.
The issue was introduced by fuse_direntplus_link, where in the function,
fuse_iget increments nlookup, and if d_splice_alias returns failure,
fuse_direntplus_link returns failure without decrementing nlookup
https://github.com/gluster/glusterfs/pull/4081
Signed-off-by: ruanmeisi <ruan.meisi@zte.com.cn>
Fixes: 0b05b18381ee ("fuse: implement NFS-like readdirplus support")
Cc: <stable@vger.kernel.org> # v3.9
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fuse/readdir.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/fs/fuse/readdir.c
+++ b/fs/fuse/readdir.c
@@ -243,8 +243,16 @@ retry:
dput(dentry);
dentry = alias;
}
- if (IS_ERR(dentry))
+ if (IS_ERR(dentry)) {
+ if (!IS_ERR(inode)) {
+ struct fuse_inode *fi = get_fuse_inode(inode);
+
+ spin_lock(&fi->lock);
+ fi->nlookup--;
+ spin_unlock(&fi->lock);
+ }
return PTR_ERR(dentry);
+ }
}
if (fc->readdirplus_auto)
set_bit(FUSE_I_INIT_RDPLUS, &get_fuse_inode(inode)->state);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 372/406] btrfs: dont start transaction when joining with TRANS_JOIN_NOSTART
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 371/406] fuse: nlookup missing decrement in fuse_direntplus_link Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 373/406] btrfs: use the correct superblock to compare fsid in btrfs_validate_super Greg Kroah-Hartman
` (42 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
commit 4490e803e1fe9fab8db5025e44e23b55df54078b upstream.
When joining a transaction with TRANS_JOIN_NOSTART, if we don't find a
running transaction we end up creating one. This goes against the purpose
of TRANS_JOIN_NOSTART which is to join a running transaction if its state
is at or below the state TRANS_STATE_COMMIT_START, otherwise return an
-ENOENT error and don't start a new transaction. So fix this to not create
a new transaction if there's no running transaction at or below that
state.
CC: stable@vger.kernel.org # 4.14+
Fixes: a6d155d2e363 ("Btrfs: fix deadlock between fiemap and transaction commits")
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/transaction.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -301,10 +301,11 @@ loop:
spin_unlock(&fs_info->trans_lock);
/*
- * If we are ATTACH, we just want to catch the current transaction,
- * and commit it. If there is no transaction, just return ENOENT.
+ * If we are ATTACH or TRANS_JOIN_NOSTART, we just want to catch the
+ * current transaction, and commit it. If there is no transaction, just
+ * return ENOENT.
*/
- if (type == TRANS_ATTACH)
+ if (type == TRANS_ATTACH || type == TRANS_JOIN_NOSTART)
return -ENOENT;
/*
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 373/406] btrfs: use the correct superblock to compare fsid in btrfs_validate_super
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 372/406] btrfs: dont start transaction when joining with TRANS_JOIN_NOSTART Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 374/406] mtd: rawnand: brcmnand: Fix crash during the panic_write Greg Kroah-Hartman
` (41 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn,
Guilherme G. Piccoli, Anand Jain, David Sterba
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Jain <anand.jain@oracle.com>
commit d167aa76dc0683828588c25767da07fb549e4f48 upstream.
The function btrfs_validate_super() should verify the fsid in the provided
superblock argument. Because, all its callers expect it to do that.
Such as in the following stack:
write_all_supers()
sb = fs_info->super_for_commit;
btrfs_validate_write_super(.., sb)
btrfs_validate_super(.., sb, ..)
scrub_one_super()
btrfs_validate_super(.., sb, ..)
And
check_dev_super()
btrfs_validate_super(.., sb, ..)
However, it currently verifies the fs_info::super_copy::fsid instead,
which is not correct. Fix this using the correct fsid in the superblock
argument.
CC: stable@vger.kernel.org # 5.4+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Guilherme G. Piccoli <gpiccoli@igalia.com>
Signed-off-by: Anand Jain <anand.jain@oracle.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/disk-io.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2496,11 +2496,10 @@ static int validate_super(struct btrfs_f
ret = -EINVAL;
}
- if (memcmp(fs_info->fs_devices->fsid, fs_info->super_copy->fsid,
- BTRFS_FSID_SIZE)) {
+ if (memcmp(fs_info->fs_devices->fsid, sb->fsid, BTRFS_FSID_SIZE) != 0) {
btrfs_err(fs_info,
"superblock fsid doesn't match fsid of fs_devices: %pU != %pU",
- fs_info->super_copy->fsid, fs_info->fs_devices->fsid);
+ sb->fsid, fs_info->fs_devices->fsid);
ret = -EINVAL;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 374/406] mtd: rawnand: brcmnand: Fix crash during the panic_write
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 373/406] btrfs: use the correct superblock to compare fsid in btrfs_validate_super Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 375/406] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write Greg Kroah-Hartman
` (40 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, William Zhang, Florian Fainelli,
Kursad Oney, Kamal Dasu, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Zhang <william.zhang@broadcom.com>
commit e66dd317194daae0475fe9e5577c80aa97f16cb9 upstream.
When executing a NAND command within the panic write path, wait for any
pending command instead of calling BUG_ON to avoid crashing while
already crashing.
Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Kursad Oney <kursad.oney@broadcom.com>
Reviewed-by: Kamal Dasu <kamal.dasu@broadcom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-4-william.zhang@broadcom.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -1543,7 +1543,17 @@ static void brcmnand_send_cmd(struct brc
dev_dbg(ctrl->dev, "send native cmd %d addr 0x%llx\n", cmd, cmd_addr);
- BUG_ON(ctrl->cmd_pending != 0);
+ /*
+ * If we came here through _panic_write and there is a pending
+ * command, try to wait for it. If it times out, rather than
+ * hitting BUG_ON, just return so we don't crash while crashing.
+ */
+ if (oops_in_progress) {
+ if (ctrl->cmd_pending &&
+ bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0))
+ return;
+ } else
+ BUG_ON(ctrl->cmd_pending != 0);
ctrl->cmd_pending = cmd;
ret = bcmnand_ctrl_poll_status(ctrl, NAND_CTRL_RDY, NAND_CTRL_RDY, 0);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 375/406] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 374/406] mtd: rawnand: brcmnand: Fix crash during the panic_write Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 376/406] mtd: rawnand: brcmnand: Fix potential false time out warning Greg Kroah-Hartman
` (39 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, William Zhang, Florian Fainelli,
Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Zhang <william.zhang@broadcom.com>
commit 5d53244186c9ac58cb88d76a0958ca55b83a15cd upstream.
When the oob buffer length is not in multiple of words, the oob write
function does out-of-bounds read on the oob source buffer at the last
iteration. Fix that by always checking length limit on the oob buffer
read and fill with 0xff when reaching the end of the buffer to the oob
registers.
Fixes: 27c5b17cd1b1 ("mtd: nand: add NAND driver "library" for Broadcom STB NAND controller")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-5-william.zhang@broadcom.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -1429,19 +1429,33 @@ static int write_oob_to_regs(struct brcm
const u8 *oob, int sas, int sector_1k)
{
int tbytes = sas << sector_1k;
- int j;
+ int j, k = 0;
+ u32 last = 0xffffffff;
+ u8 *plast = (u8 *)&last;
/* Adjust OOB values for 1K sector size */
if (sector_1k && (i & 0x01))
tbytes = max(0, tbytes - (int)ctrl->max_oob);
tbytes = min_t(int, tbytes, ctrl->max_oob);
- for (j = 0; j < tbytes; j += 4)
+ /*
+ * tbytes may not be multiple of words. Make sure we don't read out of
+ * the boundary and stop at last word.
+ */
+ for (j = 0; (j + 3) < tbytes; j += 4)
oob_reg_write(ctrl, j,
(oob[j + 0] << 24) |
(oob[j + 1] << 16) |
(oob[j + 2] << 8) |
(oob[j + 3] << 0));
+
+ /* handle the remaing bytes */
+ while (j < tbytes)
+ plast[k++] = oob[j++];
+
+ if (tbytes & 0x3)
+ oob_reg_write(ctrl, (tbytes & ~0x3), (__force u32)cpu_to_be32(last));
+
return tbytes;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 376/406] mtd: rawnand: brcmnand: Fix potential false time out warning
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (374 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 375/406] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 377/406] drm/amd/display: prevent potential division by zero errors Greg Kroah-Hartman
` (38 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, William Zhang, Florian Fainelli,
Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Zhang <william.zhang@broadcom.com>
commit 9cc0a598b944816f2968baf2631757f22721b996 upstream.
If system is busy during the command status polling function, the driver
may not get the chance to poll the status register till the end of time
out and return the premature status. Do a final check after time out
happens to ensure reading the correct status.
Fixes: 9d2ee0a60b8b ("mtd: nand: brcmnand: Check flash #WP pin status before nand erase/program")
Signed-off-by: William Zhang <william.zhang@broadcom.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230706182909.79151-3-william.zhang@broadcom.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/brcmnand/brcmnand.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/mtd/nand/raw/brcmnand/brcmnand.c
+++ b/drivers/mtd/nand/raw/brcmnand/brcmnand.c
@@ -1040,6 +1040,14 @@ static int bcmnand_ctrl_poll_status(stru
cpu_relax();
} while (time_after(limit, jiffies));
+ /*
+ * do a final check after time out in case the CPU was busy and the driver
+ * did not get enough time to perform the polling to avoid false alarms
+ */
+ val = brcmnand_read_reg(ctrl, BRCMNAND_INTFC_STATUS);
+ if ((val & mask) == expected_val)
+ return 0;
+
dev_warn(ctrl->dev, "timeout on status poll (expected %x got %x)\n",
expected_val, val & mask);
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 377/406] drm/amd/display: prevent potential division by zero errors
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (375 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 376/406] mtd: rawnand: brcmnand: Fix potential false time out warning Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 378/406] perf hists browser: Fix hierarchy mode header Greg Kroah-Hartman
` (37 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aurabindo Pillai, Hamza Mahfooz,
Alex Deucher
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamza Mahfooz <hamza.mahfooz@amd.com>
commit 07e388aab042774f284a2ad75a70a194517cdad4 upstream.
There are two places in apply_below_the_range() where it's possible for
a divide by zero error to occur. So, to fix this make sure the divisor
is non-zero before attempting the computation in both cases.
Cc: stable@vger.kernel.org
Link: https://gitlab.freedesktop.org/drm/amd/-/issues/2637
Fixes: a463b263032f ("drm/amd/display: Fix frames_to_insert math")
Fixes: ded6119e825a ("drm/amd/display: Reinstate LFC optimization")
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/modules/freesync/freesync.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
+++ b/drivers/gpu/drm/amd/display/modules/freesync/freesync.c
@@ -327,7 +327,9 @@ static void apply_below_the_range(struct
* - Delta for CEIL: delta_from_mid_point_in_us_1
* - Delta for FLOOR: delta_from_mid_point_in_us_2
*/
- if ((last_render_time_in_us / mid_point_frames_ceil) < in_out_vrr->min_duration_in_us) {
+ if (mid_point_frames_ceil &&
+ (last_render_time_in_us / mid_point_frames_ceil) <
+ in_out_vrr->min_duration_in_us) {
/* Check for out of range.
* If using CEIL produces a value that is out of range,
* then we are forced to use FLOOR.
@@ -374,8 +376,9 @@ static void apply_below_the_range(struct
/* Either we've calculated the number of frames to insert,
* or we need to insert min duration frames
*/
- if (last_render_time_in_us / frames_to_insert <
- in_out_vrr->min_duration_in_us){
+ if (frames_to_insert &&
+ (last_render_time_in_us / frames_to_insert) <
+ in_out_vrr->min_duration_in_us){
frames_to_insert -= (frames_to_insert > 1) ?
1 : 0;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 378/406] perf hists browser: Fix hierarchy mode header
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (376 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 377/406] drm/amd/display: prevent potential division by zero errors Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 379/406] perf tools: Handle old data in PERF_RECORD_ATTR Greg Kroah-Hartman
` (36 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namhyung Kim,
Arnaldo Carvalho de Melo, Adrian Hunter, Ian Rogers, Ingo Molnar,
Jiri Olsa, Peter Zijlstra
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
commit e2cabf2a44791f01c21f8d5189b946926e34142e upstream.
The commit ef9ff6017e3c4593 ("perf ui browser: Move the extra title
lines from the hists browser") introduced ui_browser__gotorc_title() to
help moving non-title lines easily. But it missed to update the title
for the hierarchy mode so it won't print the header line on TUI at all.
$ perf report --hierarchy
Fixes: ef9ff6017e3c4593 ("perf ui browser: Move the extra title lines from the hists browser")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230731094934.1616495-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/ui/browsers/hists.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -1778,7 +1778,7 @@ static void hists_browser__hierarchy_hea
hists_browser__scnprintf_hierarchy_headers(browser, headers,
sizeof(headers));
- ui_browser__gotorc(&browser->b, 0, 0);
+ ui_browser__gotorc_title(&browser->b, 0, 0);
ui_browser__set_color(&browser->b, HE_COLORSET_ROOT);
ui_browser__write_nstring(&browser->b, headers, browser->b.width + 1);
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 379/406] perf tools: Handle old data in PERF_RECORD_ATTR
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (377 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 378/406] perf hists browser: Fix hierarchy mode header Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 380/406] perf hists browser: Fix the number of entries for e key Greg Kroah-Hartman
` (35 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namhyung Kim, Adrian Hunter,
Ian Rogers, Ingo Molnar, Jiri Olsa, Peter Zijlstra, Tom Zanussi,
Arnaldo Carvalho de Melo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
commit 9bf63282ea77a531ea58acb42fb3f40d2d1e4497 upstream.
The PERF_RECORD_ATTR is used for a pipe mode to describe an event with
attribute and IDs. The ID table comes after the attr and it calculate
size of the table using the total record size and the attr size.
n_ids = (total_record_size - end_of_the_attr_field) / sizeof(u64)
This is fine for most use cases, but sometimes it saves the pipe output
in a file and then process it later. And it becomes a problem if there
is a change in attr size between the record and report.
$ perf record -o- > perf-pipe.data # old version
$ perf report -i- < perf-pipe.data # new version
For example, if the attr size is 128 and it has 4 IDs, then it would
save them in 168 byte like below:
8 byte: perf event header { .type = PERF_RECORD_ATTR, .size = 168 },
128 byte: perf event attr { .size = 128, ... },
32 byte: event IDs [] = { 1234, 1235, 1236, 1237 },
But when report later, it thinks the attr size is 136 then it only read
the last 3 entries as ID.
8 byte: perf event header { .type = PERF_RECORD_ATTR, .size = 168 },
136 byte: perf event attr { .size = 136, ... },
24 byte: event IDs [] = { 1235, 1236, 1237 }, // 1234 is missing
So it should use the recorded version of the attr. The attr has the
size field already then it should honor the size when reading data.
Fixes: 2c46dbb517a10b18 ("perf: Convert perf header attrs into attr events")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230825152552.112913-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
| 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3987,7 +3987,8 @@ int perf_event__process_attr(struct perf
union perf_event *event,
struct evlist **pevlist)
{
- u32 i, ids, n_ids;
+ u32 i, n_ids;
+ u64 *ids;
struct evsel *evsel;
struct evlist *evlist = *pevlist;
@@ -4003,9 +4004,8 @@ int perf_event__process_attr(struct perf
evlist__add(evlist, evsel);
- ids = event->header.size;
- ids -= (void *)&event->attr.id - (void *)event;
- n_ids = ids / sizeof(u64);
+ n_ids = event->header.size - sizeof(event->header) - event->attr.attr.size;
+ n_ids = n_ids / sizeof(u64);
/*
* We don't have the cpu and thread maps on the header, so
* for allocating the perf_sample_id table we fake 1 cpu and
@@ -4014,8 +4014,9 @@ int perf_event__process_attr(struct perf
if (perf_evsel__alloc_id(&evsel->core, 1, n_ids))
return -ENOMEM;
+ ids = (void *)&event->attr.attr + event->attr.attr.size;
for (i = 0; i < n_ids; i++) {
- perf_evlist__id_add(&evlist->core, &evsel->core, 0, i, event->attr.id[i]);
+ perf_evlist__id_add(&evlist->core, &evsel->core, 0, i, ids[i]);
}
return 0;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 380/406] perf hists browser: Fix the number of entries for e key
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (378 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 379/406] perf tools: Handle old data in PERF_RECORD_ATTR Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 381/406] ACPI: APEI: explicit init of HEST and GHES in apci_init() Greg Kroah-Hartman
` (34 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namhyung Kim,
Arnaldo Carvalho de Melo, Adrian Hunter, Ian Rogers, Ingo Molnar,
Jiri Olsa, Peter Zijlstra
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
commit f6b8436bede3e80226e8b2100279c4450c73806a upstream.
The 'e' key is to toggle expand/collapse the selected entry only. But
the current code has a bug that it only increases the number of entries
by 1 in the hierarchy mode so users cannot move under the current entry
after the key stroke. This is due to a wrong assumption in the
hist_entry__set_folding().
The commit b33f922651011eff ("perf hists browser: Put hist_entry folding
logic into single function") factored out the code, but actually it
should be handled separately. The hist_browser__set_folding() is to
update fold state for each entry so it needs to traverse all (child)
entries regardless of the current fold state. So it increases the
number of entries by 1.
But the hist_entry__set_folding() only cares the currently selected
entry and its all children. So it should count all unfolded child
entries. This code is implemented in hist_browser__toggle_fold()
already so we can just call it.
Fixes: b33f922651011eff ("perf hists browser: Put hist_entry folding logic into single function")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230731094934.1616495-2-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/ui/browsers/hists.c | 58 ++++++++++++++++-------------------------
1 file changed, 24 insertions(+), 34 deletions(-)
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -407,11 +407,6 @@ static bool hist_browser__selection_has_
return container_of(ms, struct callchain_list, ms)->has_children;
}
-static bool hist_browser__he_selection_unfolded(struct hist_browser *browser)
-{
- return browser->he_selection ? browser->he_selection->unfolded : false;
-}
-
static bool hist_browser__selection_unfolded(struct hist_browser *browser)
{
struct hist_entry *he = browser->he_selection;
@@ -584,8 +579,8 @@ static int hierarchy_set_folding(struct
return n;
}
-static void __hist_entry__set_folding(struct hist_entry *he,
- struct hist_browser *hb, bool unfold)
+static void hist_entry__set_folding(struct hist_entry *he,
+ struct hist_browser *hb, bool unfold)
{
hist_entry__init_have_children(he);
he->unfolded = unfold ? he->has_children : false;
@@ -603,34 +598,12 @@ static void __hist_entry__set_folding(st
he->nr_rows = 0;
}
-static void hist_entry__set_folding(struct hist_entry *he,
- struct hist_browser *browser, bool unfold)
-{
- double percent;
-
- percent = hist_entry__get_percent_limit(he);
- if (he->filtered || percent < browser->min_pcnt)
- return;
-
- __hist_entry__set_folding(he, browser, unfold);
-
- if (!he->depth || unfold)
- browser->nr_hierarchy_entries++;
- if (he->leaf)
- browser->nr_callchain_rows += he->nr_rows;
- else if (unfold && !hist_entry__has_hierarchy_children(he, browser->min_pcnt)) {
- browser->nr_hierarchy_entries++;
- he->has_no_entry = true;
- he->nr_rows = 1;
- } else
- he->has_no_entry = false;
-}
-
static void
__hist_browser__set_folding(struct hist_browser *browser, bool unfold)
{
struct rb_node *nd;
struct hist_entry *he;
+ double percent;
nd = rb_first_cached(&browser->hists->entries);
while (nd) {
@@ -640,6 +613,21 @@ __hist_browser__set_folding(struct hist_
nd = __rb_hierarchy_next(nd, HMD_FORCE_CHILD);
hist_entry__set_folding(he, browser, unfold);
+
+ percent = hist_entry__get_percent_limit(he);
+ if (he->filtered || percent < browser->min_pcnt)
+ continue;
+
+ if (!he->depth || unfold)
+ browser->nr_hierarchy_entries++;
+ if (he->leaf)
+ browser->nr_callchain_rows += he->nr_rows;
+ else if (unfold && !hist_entry__has_hierarchy_children(he, browser->min_pcnt)) {
+ browser->nr_hierarchy_entries++;
+ he->has_no_entry = true;
+ he->nr_rows = 1;
+ } else
+ he->has_no_entry = false;
}
}
@@ -659,8 +647,10 @@ static void hist_browser__set_folding_se
if (!browser->he_selection)
return;
- hist_entry__set_folding(browser->he_selection, browser, unfold);
- browser->b.nr_entries = hist_browser__nr_entries(browser);
+ if (unfold == browser->he_selection->unfolded)
+ return;
+
+ hist_browser__toggle_fold(browser);
}
static void ui_browser__warn_lost_events(struct ui_browser *browser)
@@ -731,8 +721,8 @@ static int hist_browser__handle_hotkey(s
hist_browser__set_folding(browser, true);
break;
case 'e':
- /* Expand the selected entry. */
- hist_browser__set_folding_selected(browser, !hist_browser__he_selection_unfolded(browser));
+ /* Toggle expand/collapse the selected entry. */
+ hist_browser__toggle_fold(browser);
break;
case 'H':
browser->show_headers = !browser->show_headers;
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 381/406] ACPI: APEI: explicit init of HEST and GHES in apci_init()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (379 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 380/406] perf hists browser: Fix the number of entries for e key Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 382/406] arm64: sdei: abort running SDEI handlers during crash Greg Kroah-Hartman
` (33 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuai Xue, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
[ Upstream commit dc4e8c07e9e2f69387579c49caca26ba239f7270 ]
>From commit e147133a42cb ("ACPI / APEI: Make hest.c manage the estatus
memory pool") was merged, ghes_init() relies on acpi_hest_init() to manage
the estatus memory pool. On the other hand, ghes_init() relies on
sdei_init() to detect the SDEI version and (un)register events. The
dependencies are as follows:
ghes_init() => acpi_hest_init() => acpi_bus_init() => acpi_init()
ghes_init() => sdei_init()
HEST is not PCI-specific and initcall ordering is implicit and not
well-defined within a level.
Based on above, remove acpi_hest_init() from acpi_pci_root_init() and
convert ghes_init() and sdei_init() from initcalls to explicit calls in the
following order:
acpi_hest_init()
ghes_init()
sdei_init()
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: 5cd474e57368 ("arm64: sdei: abort running SDEI handlers during crash")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/apei/ghes.c | 19 ++++++++-----------
drivers/acpi/bus.c | 2 ++
drivers/acpi/pci_root.c | 3 ---
drivers/firmware/Kconfig | 1 +
drivers/firmware/arm_sdei.c | 13 ++-----------
include/acpi/apei.h | 4 +++-
include/linux/arm_sdei.h | 2 ++
7 files changed, 18 insertions(+), 26 deletions(-)
diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
index 9bdb5bd5fda63..8678e162181f4 100644
--- a/drivers/acpi/apei/ghes.c
+++ b/drivers/acpi/apei/ghes.c
@@ -1457,33 +1457,35 @@ static struct platform_driver ghes_platform_driver = {
.remove = ghes_remove,
};
-static int __init ghes_init(void)
+void __init ghes_init(void)
{
int rc;
+ sdei_init();
+
if (acpi_disabled)
- return -ENODEV;
+ return;
switch (hest_disable) {
case HEST_NOT_FOUND:
- return -ENODEV;
+ return;
case HEST_DISABLED:
pr_info(GHES_PFX "HEST is not enabled!\n");
- return -EINVAL;
+ return;
default:
break;
}
if (ghes_disable) {
pr_info(GHES_PFX "GHES is not enabled!\n");
- return -EINVAL;
+ return;
}
ghes_nmi_init_cxt();
rc = platform_driver_register(&ghes_platform_driver);
if (rc)
- goto err;
+ return;
rc = apei_osc_setup();
if (rc == 0 && osc_sb_apei_support_acked)
@@ -1494,9 +1496,4 @@ static int __init ghes_init(void)
pr_info(GHES_PFX "APEI firmware first mode is enabled by APEI bit.\n");
else
pr_info(GHES_PFX "Failed to enable APEI firmware first mode.\n");
-
- return 0;
-err:
- return rc;
}
-device_initcall(ghes_init);
diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c
index 5e14288fcabe9..60dfe63301d00 100644
--- a/drivers/acpi/bus.c
+++ b/drivers/acpi/bus.c
@@ -1252,6 +1252,8 @@ static int __init acpi_init(void)
pci_mmcfg_late_init();
acpi_iort_init();
+ acpi_hest_init();
+ ghes_init();
acpi_scan_init();
acpi_ec_init();
acpi_debugfs_init();
diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c
index c12b5fb3e8fba..d972ea057a035 100644
--- a/drivers/acpi/pci_root.c
+++ b/drivers/acpi/pci_root.c
@@ -20,8 +20,6 @@
#include <linux/slab.h>
#include <linux/dmi.h>
#include <linux/platform_data/x86/apple.h>
-#include <acpi/apei.h> /* for acpi_hest_init() */
-
#include "internal.h"
#define ACPI_PCI_ROOT_CLASS "pci_bridge"
@@ -950,7 +948,6 @@ struct pci_bus *acpi_pci_root_create(struct acpi_pci_root *root,
void __init acpi_pci_root_init(void)
{
- acpi_hest_init();
if (acpi_pci_disabled)
return;
diff --git a/drivers/firmware/Kconfig b/drivers/firmware/Kconfig
index c08968c5ddf8c..807c5320dc0ff 100644
--- a/drivers/firmware/Kconfig
+++ b/drivers/firmware/Kconfig
@@ -72,6 +72,7 @@ config ARM_SCPI_POWER_DOMAIN
config ARM_SDE_INTERFACE
bool "ARM Software Delegated Exception Interface (SDEI)"
depends on ARM64
+ depends on ACPI_APEI_GHES
help
The Software Delegated Exception Interface (SDEI) is an ARM
standard for registering callbacks from the platform firmware
diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
index 5a877d76078f7..9c4ebaf1f0c8f 100644
--- a/drivers/firmware/arm_sdei.c
+++ b/drivers/firmware/arm_sdei.c
@@ -1063,14 +1063,14 @@ static bool __init sdei_present_acpi(void)
return true;
}
-static int __init sdei_init(void)
+void __init sdei_init(void)
{
struct platform_device *pdev;
int ret;
ret = platform_driver_register(&sdei_driver);
if (ret || !sdei_present_acpi())
- return ret;
+ return;
pdev = platform_device_register_simple(sdei_driver.driver.name,
0, NULL, 0);
@@ -1080,17 +1080,8 @@ static int __init sdei_init(void)
pr_info("Failed to register ACPI:SDEI platform device %d\n",
ret);
}
-
- return ret;
}
-/*
- * On an ACPI system SDEI needs to be ready before HEST:GHES tries to register
- * its events. ACPI is initialised from a subsys_initcall(), GHES is initialised
- * by device_initcall(). We want to be called in the middle.
- */
-subsys_initcall_sync(sdei_init);
-
int sdei_event_handler(struct pt_regs *regs,
struct sdei_registered_event *arg)
{
diff --git a/include/acpi/apei.h b/include/acpi/apei.h
index 680f80960c3dc..a6ac2e8b72da8 100644
--- a/include/acpi/apei.h
+++ b/include/acpi/apei.h
@@ -27,14 +27,16 @@ extern int hest_disable;
extern int erst_disable;
#ifdef CONFIG_ACPI_APEI_GHES
extern bool ghes_disable;
+void __init ghes_init(void);
#else
#define ghes_disable 1
+static inline void ghes_init(void) { }
#endif
#ifdef CONFIG_ACPI_APEI
void __init acpi_hest_init(void);
#else
-static inline void acpi_hest_init(void) { return; }
+static inline void acpi_hest_init(void) { }
#endif
typedef int (*apei_hest_func_t)(struct acpi_hest_header *hest_hdr, void *data);
diff --git a/include/linux/arm_sdei.h b/include/linux/arm_sdei.h
index 0a241c5c911d8..14dc461b0e829 100644
--- a/include/linux/arm_sdei.h
+++ b/include/linux/arm_sdei.h
@@ -46,9 +46,11 @@ int sdei_unregister_ghes(struct ghes *ghes);
/* For use by arch code when CPU hotplug notifiers are not appropriate. */
int sdei_mask_local_cpu(void);
int sdei_unmask_local_cpu(void);
+void __init sdei_init(void);
#else
static inline int sdei_mask_local_cpu(void) { return 0; }
static inline int sdei_unmask_local_cpu(void) { return 0; }
+static inline void sdei_init(void) { }
#endif /* CONFIG_ARM_SDE_INTERFACE */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 382/406] arm64: sdei: abort running SDEI handlers during crash
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (380 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 381/406] ACPI: APEI: explicit init of HEST and GHES in apci_init() Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 383/406] scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry Greg Kroah-Hartman
` (32 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, D Scott Phillips, James Morse,
Mihai Carabas, Will Deacon, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: D Scott Phillips <scott@os.amperecomputing.com>
[ Upstream commit 5cd474e57368f0957c343bb21e309cf82826b1ef ]
Interrupts are blocked in SDEI context, per the SDEI spec: "The client
interrupts cannot preempt the event handler." If we crashed in the SDEI
handler-running context (as with ACPI's AGDI) then we need to clean up the
SDEI state before proceeding to the crash kernel so that the crash kernel
can have working interrupts.
Track the active SDEI handler per-cpu so that we can COMPLETE_AND_RESUME
the handler, discarding the interrupted context.
Fixes: f5df26961853 ("arm64: kernel: Add arch-specific SDEI entry code and CPU masking")
Signed-off-by: D Scott Phillips <scott@os.amperecomputing.com>
Cc: stable@vger.kernel.org
Reviewed-by: James Morse <james.morse@arm.com>
Tested-by: Mihai Carabas <mihai.carabas@oracle.com>
Link: https://lore.kernel.org/r/20230627002939.2758-1-scott@os.amperecomputing.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/sdei.h | 6 ++++++
arch/arm64/kernel/entry.S | 27 +++++++++++++++++++++++++--
arch/arm64/kernel/sdei.c | 3 +++
arch/arm64/kernel/smp.c | 8 ++++----
drivers/firmware/arm_sdei.c | 19 +++++++++++++++++++
include/linux/arm_sdei.h | 2 ++
6 files changed, 59 insertions(+), 6 deletions(-)
diff --git a/arch/arm64/include/asm/sdei.h b/arch/arm64/include/asm/sdei.h
index 63e0b92a5fbb0..5882c0e29331e 100644
--- a/arch/arm64/include/asm/sdei.h
+++ b/arch/arm64/include/asm/sdei.h
@@ -17,6 +17,9 @@
#include <asm/virt.h>
+DECLARE_PER_CPU(struct sdei_registered_event *, sdei_active_normal_event);
+DECLARE_PER_CPU(struct sdei_registered_event *, sdei_active_critical_event);
+
extern unsigned long sdei_exit_mode;
/* Software Delegated Exception entry point from firmware*/
@@ -29,6 +32,9 @@ asmlinkage void __sdei_asm_entry_trampoline(unsigned long event_num,
unsigned long pc,
unsigned long pstate);
+/* Abort a running handler. Context is discarded. */
+void __sdei_handler_abort(void);
+
/*
* The above entry point does the minimum to call C code. This function does
* anything else, before calling the driver.
diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S
index 55e477f73158d..a94acea770c7c 100644
--- a/arch/arm64/kernel/entry.S
+++ b/arch/arm64/kernel/entry.S
@@ -1137,9 +1137,13 @@ SYM_CODE_START(__sdei_asm_handler)
mov x19, x1
-#if defined(CONFIG_VMAP_STACK) || defined(CONFIG_SHADOW_CALL_STACK)
+ /* Store the registered-event for crash_smp_send_stop() */
ldrb w4, [x19, #SDEI_EVENT_PRIORITY]
-#endif
+ cbnz w4, 1f
+ adr_this_cpu dst=x5, sym=sdei_active_normal_event, tmp=x6
+ b 2f
+1: adr_this_cpu dst=x5, sym=sdei_active_critical_event, tmp=x6
+2: str x19, [x5]
#ifdef CONFIG_VMAP_STACK
/*
@@ -1204,6 +1208,14 @@ SYM_CODE_START(__sdei_asm_handler)
ldr_l x2, sdei_exit_mode
+ /* Clear the registered-event seen by crash_smp_send_stop() */
+ ldrb w3, [x4, #SDEI_EVENT_PRIORITY]
+ cbnz w3, 1f
+ adr_this_cpu dst=x5, sym=sdei_active_normal_event, tmp=x6
+ b 2f
+1: adr_this_cpu dst=x5, sym=sdei_active_critical_event, tmp=x6
+2: str xzr, [x5]
+
alternative_if_not ARM64_UNMAP_KERNEL_AT_EL0
sdei_handler_exit exit_mode=x2
alternative_else_nop_endif
@@ -1214,4 +1226,15 @@ alternative_else_nop_endif
#endif
SYM_CODE_END(__sdei_asm_handler)
NOKPROBE(__sdei_asm_handler)
+
+SYM_CODE_START(__sdei_handler_abort)
+ mov_q x0, SDEI_1_0_FN_SDEI_EVENT_COMPLETE_AND_RESUME
+ adr x1, 1f
+ ldr_l x2, sdei_exit_mode
+ sdei_handler_exit exit_mode=x2
+ // exit the handler and jump to the next instruction.
+ // Exit will stomp x0-x17, PSTATE, ELR_ELx, and SPSR_ELx.
+1: ret
+SYM_CODE_END(__sdei_handler_abort)
+NOKPROBE(__sdei_handler_abort)
#endif /* CONFIG_ARM_SDE_INTERFACE */
diff --git a/arch/arm64/kernel/sdei.c b/arch/arm64/kernel/sdei.c
index 793c46d6a4479..0083f5afa51db 100644
--- a/arch/arm64/kernel/sdei.c
+++ b/arch/arm64/kernel/sdei.c
@@ -38,6 +38,9 @@ DEFINE_PER_CPU(unsigned long *, sdei_stack_normal_ptr);
DEFINE_PER_CPU(unsigned long *, sdei_stack_critical_ptr);
#endif
+DEFINE_PER_CPU(struct sdei_registered_event *, sdei_active_normal_event);
+DEFINE_PER_CPU(struct sdei_registered_event *, sdei_active_critical_event);
+
static void _free_sdei_stack(unsigned long * __percpu *ptr, int cpu)
{
unsigned long *p;
diff --git a/arch/arm64/kernel/smp.c b/arch/arm64/kernel/smp.c
index feee5a3cd1288..ae0977b632a18 100644
--- a/arch/arm64/kernel/smp.c
+++ b/arch/arm64/kernel/smp.c
@@ -1072,10 +1072,8 @@ void crash_smp_send_stop(void)
* If this cpu is the only one alive at this point in time, online or
* not, there are no stop messages to be sent around, so just back out.
*/
- if (num_other_online_cpus() == 0) {
- sdei_mask_local_cpu();
- return;
- }
+ if (num_other_online_cpus() == 0)
+ goto skip_ipi;
cpumask_copy(&mask, cpu_online_mask);
cpumask_clear_cpu(smp_processor_id(), &mask);
@@ -1094,7 +1092,9 @@ void crash_smp_send_stop(void)
pr_warn("SMP: failed to stop secondary CPUs %*pbl\n",
cpumask_pr_args(&mask));
+skip_ipi:
sdei_mask_local_cpu();
+ sdei_handler_abort();
}
bool smp_crash_stop_failed(void)
diff --git a/drivers/firmware/arm_sdei.c b/drivers/firmware/arm_sdei.c
index 9c4ebaf1f0c8f..68e55ca7491e5 100644
--- a/drivers/firmware/arm_sdei.c
+++ b/drivers/firmware/arm_sdei.c
@@ -1109,3 +1109,22 @@ int sdei_event_handler(struct pt_regs *regs,
return err;
}
NOKPROBE_SYMBOL(sdei_event_handler);
+
+void sdei_handler_abort(void)
+{
+ /*
+ * If the crash happened in an SDEI event handler then we need to
+ * finish the handler with the firmware so that we can have working
+ * interrupts in the crash kernel.
+ */
+ if (__this_cpu_read(sdei_active_critical_event)) {
+ pr_warn("still in SDEI critical event context, attempting to finish handler.\n");
+ __sdei_handler_abort();
+ __this_cpu_write(sdei_active_critical_event, NULL);
+ }
+ if (__this_cpu_read(sdei_active_normal_event)) {
+ pr_warn("still in SDEI normal event context, attempting to finish handler.\n");
+ __sdei_handler_abort();
+ __this_cpu_write(sdei_active_normal_event, NULL);
+ }
+}
diff --git a/include/linux/arm_sdei.h b/include/linux/arm_sdei.h
index 14dc461b0e829..255701e1251b4 100644
--- a/include/linux/arm_sdei.h
+++ b/include/linux/arm_sdei.h
@@ -47,10 +47,12 @@ int sdei_unregister_ghes(struct ghes *ghes);
int sdei_mask_local_cpu(void);
int sdei_unmask_local_cpu(void);
void __init sdei_init(void);
+void sdei_handler_abort(void);
#else
static inline int sdei_mask_local_cpu(void) { return 0; }
static inline int sdei_unmask_local_cpu(void) { return 0; }
static inline void sdei_init(void) { }
+static inline void sdei_handler_abort(void) { }
#endif /* CONFIG_ARM_SDE_INTERFACE */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 383/406] scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (381 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 382/406] arm64: sdei: abort running SDEI handlers during crash Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 384/406] scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe Greg Kroah-Hartman
` (31 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Himanshu Madhani, Saurav Kashyap,
Nilesh Javali, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saurav Kashyap <skashyap@marvell.com>
[ Upstream commit 707531bc2626c1959a03b93566ebb4e629c99276 ]
Driver unload with I/Os in flight causes server to crash. Complete I/O
with DID_IMM_RETRY if fcport undergoing deletion.
CPU: 44 PID: 35008 Comm: qla2xxx_4_dpc Kdump: loaded Tainted: G
OE X 5.3.18-22-default #1 SLE15-SP2 (unreleased)
Hardware name: HPE ProLiant DL380 Gen10/ProLiant DL380 Gen10, BIOS U30 07/16/2020
RIP: 0010:dma_direct_unmap_sg+0x24/0x60
Code: 4c 8b 04 24 eb b9 0f 1f 44 00 00 85 d2 7e 4e 41 57
4d 89 c7 41 56 41 89 ce 41 55 49 89 fd 41 54 41 89 d4 55 31 ed 53 48 89
f3 <8b> 53 18 48 8b 73 10 4d 89 f8 44 89 f1 4c 89 ef 83 c5 01 e8 44 ff
RSP: 0018:ffffc0c661037d88 EFLAGS: 00010046
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000002
RDX: 000000000000001d RSI: 0000000000000000 RDI: ffff9a51ee53b0b0
RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9a51ee53b0b0
R10: ffffc0c646463dc8 R11: ffff9a4a067087c8 R12: 000000000000001d
R13: ffff9a51ee53b0b0 R14: 0000000000000002 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff9a523f800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 000000043740a004 CR4: 00000000007606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
qla2xxx_qpair_sp_free_dma+0x20d/0x3c0 [qla2xxx]
qla2xxx_qpair_sp_compl+0x35/0x90 [qla2xxx]
__qla2x00_abort_all_cmds+0x180/0x390 [qla2xxx]
? qla24xx_process_purex_list+0x100/0x100 [qla2xxx]
qla2x00_abort_all_cmds+0x5e/0x80 [qla2xxx]
qla2x00_do_dpc+0x317/0xa30 [qla2xxx]
kthread+0x10d/0x130
? kthread_park+0xa0/0xa0
ret_from_fork+0x35/0x40
Link: https://lore.kernel.org/r/20201202132312.19966-14-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Saurav Kashyap <skashyap@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 6d0b65569c0a ("scsi: qla2xxx: Flush mailbox commands on chip reset")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_os.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index f1e7868787d4a..78a335f862cee 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -879,8 +879,8 @@ qla2xxx_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
goto qc24_fail_command;
}
- if (!fcport) {
- cmd->result = DID_NO_CONNECT << 16;
+ if (!fcport || fcport->deleted) {
+ cmd->result = DID_IMM_RETRY << 16;
goto qc24_fail_command;
}
@@ -961,8 +961,8 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd,
goto qc24_fail_command;
}
- if (!fcport) {
- cmd->result = DID_NO_CONNECT << 16;
+ if (!fcport || fcport->deleted) {
+ cmd->result = DID_IMM_RETRY << 16;
goto qc24_fail_command;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 384/406] scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (382 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 383/406] scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 385/406] scsi: qla2xxx: Fix crash in PCIe error handling Greg Kroah-Hartman
` (30 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Himanshu Madhani, Quinn Tran,
Nilesh Javali, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 5777fef788a59f5ac9ab6661988a95a045fc0574 ]
Consolidate zio threshold setting for both FCP & NVMe to prevent one
protocol from clobbering the setting of the other protocol.
Link: https://lore.kernel.org/r/20210329085229.4367-5-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 6d0b65569c0a ("scsi: qla2xxx: Flush mailbox commands on chip reset")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_def.h | 1 -
drivers/scsi/qla2xxx/qla_os.c | 34 ++++++++++++++--------------------
2 files changed, 14 insertions(+), 21 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 06b0ad2b51bb4..676e50142baaf 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4706,7 +4706,6 @@ typedef struct scsi_qla_host {
#define FX00_CRITEMP_RECOVERY 25
#define FX00_HOST_INFO_RESEND 26
#define QPAIR_ONLINE_CHECK_NEEDED 27
-#define SET_NVME_ZIO_THRESHOLD_NEEDED 28
#define DETECT_SFP_CHANGE 29
#define N2N_LOGIN_NEEDED 30
#define IOCB_WORK_ACTIVE 31
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 78a335f862cee..bf40b293dcea6 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -6973,28 +6973,23 @@ qla2x00_do_dpc(void *data)
mutex_unlock(&ha->mq_lock);
}
- if (test_and_clear_bit(SET_NVME_ZIO_THRESHOLD_NEEDED,
- &base_vha->dpc_flags)) {
+ if (test_and_clear_bit(SET_ZIO_THRESHOLD_NEEDED,
+ &base_vha->dpc_flags)) {
+ u16 threshold = ha->nvme_last_rptd_aen + ha->last_zio_threshold;
+
+ if (threshold > ha->orig_fw_xcb_count)
+ threshold = ha->orig_fw_xcb_count;
+
ql_log(ql_log_info, base_vha, 0xffffff,
- "nvme: SET ZIO Activity exchange threshold to %d.\n",
- ha->nvme_last_rptd_aen);
- if (qla27xx_set_zio_threshold(base_vha,
- ha->nvme_last_rptd_aen)) {
+ "SET ZIO Activity exchange threshold to %d.\n",
+ threshold);
+ if (qla27xx_set_zio_threshold(base_vha, threshold)) {
ql_log(ql_log_info, base_vha, 0xffffff,
- "nvme: Unable to SET ZIO Activity exchange threshold to %d.\n",
- ha->nvme_last_rptd_aen);
+ "Unable to SET ZIO Activity exchange threshold to %d.\n",
+ threshold);
}
}
- if (test_and_clear_bit(SET_ZIO_THRESHOLD_NEEDED,
- &base_vha->dpc_flags)) {
- ql_log(ql_log_info, base_vha, 0xffffff,
- "SET ZIO Activity exchange threshold to %d.\n",
- ha->last_zio_threshold);
- qla27xx_set_zio_threshold(base_vha,
- ha->last_zio_threshold);
- }
-
if (!IS_QLAFX00(ha))
qla2x00_do_dpc_all_vps(base_vha);
@@ -7210,14 +7205,13 @@ qla2x00_timer(struct timer_list *t)
index = atomic_read(&ha->nvme_active_aen_cnt);
if (!vha->vp_idx &&
(index != ha->nvme_last_rptd_aen) &&
- (index >= DEFAULT_ZIO_THRESHOLD) &&
ha->zio_mode == QLA_ZIO_MODE_6 &&
!ha->flags.host_shutting_down) {
+ ha->nvme_last_rptd_aen = atomic_read(&ha->nvme_active_aen_cnt);
ql_log(ql_log_info, vha, 0x3002,
"nvme: Sched: Set ZIO exchange threshold to %d.\n",
ha->nvme_last_rptd_aen);
- ha->nvme_last_rptd_aen = atomic_read(&ha->nvme_active_aen_cnt);
- set_bit(SET_NVME_ZIO_THRESHOLD_NEEDED, &vha->dpc_flags);
+ set_bit(SET_ZIO_THRESHOLD_NEEDED, &vha->dpc_flags);
start_dpc++;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 385/406] scsi: qla2xxx: Fix crash in PCIe error handling
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (383 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 384/406] scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe Greg Kroah-Hartman
@ 2023-09-17 19:13 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 386/406] scsi: qla2xxx: Flush mailbox commands on chip reset Greg Kroah-Hartman
` (29 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurence Oberman, Quinn Tran,
Nilesh Javali, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit f7a0ed479e66ab177801301a1a72c37775c40450 ]
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: qla2x00_abort_isp+0x21/0x6b0 [qla2xxx] PGD 0 P4D 0
Oops: 0000 [#1] SMP PTI
CPU: 0 PID: 1715 Comm: kworker/0:2
Tainted: GOE 4.12.14-122.37-default #1 SLE12-SP5
Hardware name: HPE Superdome Flex/Superdome Flex, BIOS
Bundle:3.30.100 SFW:IP147.007.004.017.000.2009211957 09/21/2020
Workqueue: events aer_recover_work_func
task: ffff9e399c14ca80 task.stack: ffffc1c58e4ac000
RIP: 0010:qla2x00_abort_isp+0x21/0x6b0 [qla2xxx]
RSP: 0018:ffffc1c58e4afd50 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff9e419cdef480 RCX: 0000000000000000
RDX: ffff9e399c14ca80 RSI: 0000000000000246 RDI: ffff9e419bbc27b8
RBP: ffff9e419bbc27b8 R08: 0000000000000004 R09: 00000000a0440000
R10: 0000000000000000 R11: ffff9e399416d1a0 R12: ffff9e419cdef000
R13: ffff9e3a7cfae800 R14: ffff9e3a7cfae800 R15: 00000000000000c0
FS: 0000000000000000(0000) GS:ffff9e39a0000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000006cd00a005 CR4: 00000000007606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
qla2xxx_pci_slot_reset+0x141/0x160 [qla2xxx]
report_slot_reset+0x41/0x80
? merge_result.part.4+0x30/0x30
pci_walk_bus+0x70/0x90
pcie_do_recovery+0x1db/0x2e0
aer_recover_work_func+0xc2/0xf0
process_one_work+0x14c/0x390
Disable board_disable logic where driver resources are freed while OS is in
the process of recovering the adapter.
Link: https://lore.kernel.org/r/20210329085229.4367-9-njavali@marvell.com
Tested-by: Laurence Oberman <loberman@redhat.com>
Signed-off-by: Quinn Tran <qutran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: 6d0b65569c0a ("scsi: qla2xxx: Flush mailbox commands on chip reset")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_dbg.c | 16 ++-
drivers/scsi/qla2xxx/qla_def.h | 10 ++
drivers/scsi/qla2xxx/qla_gbl.h | 3 +
drivers/scsi/qla2xxx/qla_init.c | 40 ++++---
drivers/scsi/qla2xxx/qla_inline.h | 46 ++++++++
drivers/scsi/qla2xxx/qla_iocb.c | 60 +++++++++--
drivers/scsi/qla2xxx/qla_isr.c | 9 +-
drivers/scsi/qla2xxx/qla_mbx.c | 3 +-
drivers/scsi/qla2xxx/qla_nvme.c | 10 +-
drivers/scsi/qla2xxx/qla_os.c | 173 ++++++++++++++++++------------
10 files changed, 265 insertions(+), 105 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_dbg.c b/drivers/scsi/qla2xxx/qla_dbg.c
index 3e618d777082b..8e9ffbec6643f 100644
--- a/drivers/scsi/qla2xxx/qla_dbg.c
+++ b/drivers/scsi/qla2xxx/qla_dbg.c
@@ -112,8 +112,13 @@ qla27xx_dump_mpi_ram(struct qla_hw_data *ha, uint32_t addr, uint32_t *ram,
uint32_t stat;
ulong i, j, timer = 6000000;
int rval = QLA_FUNCTION_FAILED;
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
+
+ if (qla_pci_disconnected(vha, reg))
+ return rval;
+
for (i = 0; i < ram_dwords; i += dwords, addr += dwords) {
if (i + dwords > ram_dwords)
dwords = ram_dwords - i;
@@ -137,6 +142,9 @@ qla27xx_dump_mpi_ram(struct qla_hw_data *ha, uint32_t addr, uint32_t *ram,
while (timer--) {
udelay(5);
+ if (qla_pci_disconnected(vha, reg))
+ return rval;
+
stat = rd_reg_dword(®->host_status);
/* Check for pending interrupts. */
if (!(stat & HSRX_RISC_INT))
@@ -191,9 +199,13 @@ qla24xx_dump_ram(struct qla_hw_data *ha, uint32_t addr, __be32 *ram,
uint32_t dwords = qla2x00_gid_list_size(ha) / 4;
uint32_t stat;
ulong i, j, timer = 6000000;
+ scsi_qla_host_t *vha = pci_get_drvdata(ha->pdev);
clear_bit(MBX_INTERRUPT, &ha->mbx_cmd_flags);
+ if (qla_pci_disconnected(vha, reg))
+ return rval;
+
for (i = 0; i < ram_dwords; i += dwords, addr += dwords) {
if (i + dwords > ram_dwords)
dwords = ram_dwords - i;
@@ -215,8 +227,10 @@ qla24xx_dump_ram(struct qla_hw_data *ha, uint32_t addr, __be32 *ram,
ha->flags.mbox_int = 0;
while (timer--) {
udelay(5);
- stat = rd_reg_dword(®->host_status);
+ if (qla_pci_disconnected(vha, reg))
+ return rval;
+ stat = rd_reg_dword(®->host_status);
/* Check for pending interrupts. */
if (!(stat & HSRX_RISC_INT))
continue;
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 676e50142baaf..9a09b36fd573c 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -396,6 +396,7 @@ typedef union {
} b;
} port_id_t;
#define INVALID_PORT_ID 0xFFFFFF
+#define ISP_REG16_DISCONNECT 0xFFFF
static inline le_id_t be_id_to_le(be_id_t id)
{
@@ -3848,6 +3849,13 @@ struct qla_hw_data_stat {
u32 num_mpi_reset;
};
+/* refer to pcie_do_recovery reference */
+typedef enum {
+ QLA_PCI_RESUME,
+ QLA_PCI_ERR_DETECTED,
+ QLA_PCI_MMIO_ENABLED,
+ QLA_PCI_SLOT_RESET,
+} pci_error_state_t;
/*
* Qlogic host adapter specific data structure.
*/
@@ -4586,6 +4594,7 @@ struct qla_hw_data {
#define DEFAULT_ZIO_THRESHOLD 5
struct qla_hw_data_stat stat;
+ pci_error_state_t pci_error_state;
};
struct active_regions {
@@ -4706,6 +4715,7 @@ typedef struct scsi_qla_host {
#define FX00_CRITEMP_RECOVERY 25
#define FX00_HOST_INFO_RESEND 26
#define QPAIR_ONLINE_CHECK_NEEDED 27
+#define DO_EEH_RECOVERY 28
#define DETECT_SFP_CHANGE 29
#define N2N_LOGIN_NEEDED 30
#define IOCB_WORK_ACTIVE 31
diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h
index 7e5ee31581d61..8ef2de6822de9 100644
--- a/drivers/scsi/qla2xxx/qla_gbl.h
+++ b/drivers/scsi/qla2xxx/qla_gbl.h
@@ -222,6 +222,7 @@ extern int qla2x00_post_uevent_work(struct scsi_qla_host *, u32);
extern int qla2x00_post_uevent_work(struct scsi_qla_host *, u32);
extern void qla2x00_disable_board_on_pci_error(struct work_struct *);
+extern void qla_eeh_work(struct work_struct *);
extern void qla2x00_sp_compl(srb_t *sp, int);
extern void qla2xxx_qpair_sp_free_dma(srb_t *sp);
extern void qla2xxx_qpair_sp_compl(srb_t *sp, int);
@@ -233,6 +234,8 @@ int qla24xx_post_relogin_work(struct scsi_qla_host *vha);
void qla2x00_wait_for_sess_deletion(scsi_qla_host_t *);
void qla24xx_process_purex_rdp(struct scsi_qla_host *vha,
struct purex_item *pkt);
+void qla_pci_set_eeh_busy(struct scsi_qla_host *);
+void qla_schedule_eeh_work(struct scsi_qla_host *);
/*
* Global Functions in qla_mid.c source file.
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index 3c24a52d5a909..f24f087c733b1 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -6982,22 +6982,18 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
}
spin_unlock_irqrestore(&ha->vport_slock, flags);
- if (!ha->flags.eeh_busy) {
- /* Make sure for ISP 82XX IO DMA is complete */
- if (IS_P3P_TYPE(ha)) {
- qla82xx_chip_reset_cleanup(vha);
- ql_log(ql_log_info, vha, 0x00b4,
- "Done chip reset cleanup.\n");
-
- /* Done waiting for pending commands.
- * Reset the online flag.
- */
- vha->flags.online = 0;
- }
+ /* Make sure for ISP 82XX IO DMA is complete */
+ if (IS_P3P_TYPE(ha)) {
+ qla82xx_chip_reset_cleanup(vha);
+ ql_log(ql_log_info, vha, 0x00b4,
+ "Done chip reset cleanup.\n");
- /* Requeue all commands in outstanding command list. */
- qla2x00_abort_all_cmds(vha, DID_RESET << 16);
+ /* Done waiting for pending commands. Reset online flag */
+ vha->flags.online = 0;
}
+
+ /* Requeue all commands in outstanding command list. */
+ qla2x00_abort_all_cmds(vha, DID_RESET << 16);
/* memory barrier */
wmb();
}
@@ -7025,6 +7021,12 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
if (vha->flags.online) {
qla2x00_abort_isp_cleanup(vha);
+ if (qla2x00_isp_reg_stat(ha)) {
+ ql_log(ql_log_info, vha, 0x803f,
+ "ISP Abort - ISP reg disconnect, exiting.\n");
+ return status;
+ }
+
if (test_and_clear_bit(ISP_ABORT_TO_ROM, &vha->dpc_flags)) {
ha->flags.chip_reset_done = 1;
vha->flags.online = 1;
@@ -7065,8 +7067,18 @@ qla2x00_abort_isp(scsi_qla_host_t *vha)
ha->isp_ops->get_flash_version(vha, req->ring);
+ if (qla2x00_isp_reg_stat(ha)) {
+ ql_log(ql_log_info, vha, 0x803f,
+ "ISP Abort - ISP reg disconnect pre nvram config, exiting.\n");
+ return status;
+ }
ha->isp_ops->nvram_config(vha);
+ if (qla2x00_isp_reg_stat(ha)) {
+ ql_log(ql_log_info, vha, 0x803f,
+ "ISP Abort - ISP reg disconnect post nvmram config, exiting.\n");
+ return status;
+ }
if (!qla2x00_restart_isp(vha)) {
clear_bit(RESET_MARKER_NEEDED, &vha->dpc_flags);
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index 7e8b59a0954bb..47ee5b9f2a55c 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -435,3 +435,49 @@ qla_put_iocbs(struct qla_qpair *qp, struct iocb_resource *iores)
}
iores->res_type = RESOURCE_NONE;
}
+
+#define ISP_REG_DISCONNECT 0xffffffffU
+/**************************************************************************
+ * qla2x00_isp_reg_stat
+ *
+ * Description:
+ * Read the host status register of ISP before aborting the command.
+ *
+ * Input:
+ * ha = pointer to host adapter structure.
+ *
+ *
+ * Returns:
+ * Either true or false.
+ *
+ * Note: Return true if there is register disconnect.
+ **************************************************************************/
+static inline
+uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
+{
+ struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
+ struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
+
+ if (IS_P3P_TYPE(ha))
+ return ((rd_reg_dword(®82->host_int)) == ISP_REG_DISCONNECT);
+ else
+ return ((rd_reg_dword(®->host_status)) ==
+ ISP_REG_DISCONNECT);
+}
+
+static inline
+bool qla_pci_disconnected(struct scsi_qla_host *vha,
+ struct device_reg_24xx __iomem *reg)
+{
+ uint32_t stat;
+ bool ret = false;
+
+ stat = rd_reg_dword(®->host_status);
+ if (stat == 0xffffffff) {
+ ql_log(ql_log_info, vha, 0x8041,
+ "detected PCI disconnect.\n");
+ qla_schedule_eeh_work(vha);
+ ret = true;
+ }
+ return ret;
+}
diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c
index 54fc0afbc02ac..1752a62031710 100644
--- a/drivers/scsi/qla2xxx/qla_iocb.c
+++ b/drivers/scsi/qla2xxx/qla_iocb.c
@@ -1644,8 +1644,14 @@ qla24xx_start_scsi(srb_t *sp)
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
- cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
- rd_reg_dword_relaxed(req->req_q_out);
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ goto queuing_error;
+ }
+
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
else
@@ -1836,8 +1842,13 @@ qla24xx_dif_start_scsi(srb_t *sp)
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
- cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
- rd_reg_dword_relaxed(req->req_q_out);
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ goto queuing_error;
+ }
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
else
@@ -1911,6 +1922,7 @@ qla24xx_dif_start_scsi(srb_t *sp)
qla_put_iocbs(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
return QLA_FUNCTION_FAILED;
}
@@ -1978,8 +1990,14 @@ qla2xxx_start_scsi_mq(srb_t *sp)
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
- cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
- rd_reg_dword_relaxed(req->req_q_out);
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ goto queuing_error;
+ }
+
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
else
@@ -2185,8 +2203,14 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp)
goto queuing_error;
if (req->cnt < (req_cnt + 2)) {
- cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
- rd_reg_dword_relaxed(req->req_q_out);
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ goto queuing_error;
+ }
+
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
else
@@ -2263,6 +2287,7 @@ qla2xxx_dif_start_scsi_mq(srb_t *sp)
qla_put_iocbs(sp->qpair, &sp->iores);
spin_unlock_irqrestore(&qpair->qp_lock, flags);
+
return QLA_FUNCTION_FAILED;
}
@@ -2307,6 +2332,11 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp)
cnt = qla2x00_debounce_register(
ISP_REQ_Q_OUT(ha, ®->isp));
+ if (!qpair->use_shadow_reg && cnt == ISP_REG16_DISCONNECT) {
+ qla_schedule_eeh_work(vha);
+ return NULL;
+ }
+
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
else
@@ -3711,6 +3741,9 @@ qla2x00_start_sp(srb_t *sp)
void *pkt;
unsigned long flags;
+ if (vha->hw->flags.eeh_busy)
+ return -EIO;
+
spin_lock_irqsave(qp->qp_lock_ptr, flags);
pkt = __qla2x00_alloc_iocbs(sp->qpair, sp);
if (!pkt) {
@@ -3928,8 +3961,14 @@ qla2x00_start_bidir(srb_t *sp, struct scsi_qla_host *vha, uint32_t tot_dsds)
/* Check for room on request queue. */
if (req->cnt < req_cnt + 2) {
- cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
- rd_reg_dword_relaxed(req->req_q_out);
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ goto queuing_error;
+ }
+
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
else
@@ -3968,5 +4007,6 @@ qla2x00_start_bidir(srb_t *sp, struct scsi_qla_host *vha, uint32_t tot_dsds)
qla2x00_start_iocbs(vha, req);
queuing_error:
spin_unlock_irqrestore(&ha->hardware_lock, flags);
+
return rval;
}
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 5678cf23c44bc..fd0beb194e351 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -269,12 +269,7 @@ qla2x00_check_reg32_for_disconnect(scsi_qla_host_t *vha, uint32_t reg)
if (!test_and_set_bit(PFLG_DISCONNECTED, &vha->pci_flags) &&
!test_bit(PFLG_DRIVER_REMOVING, &vha->pci_flags) &&
!test_bit(PFLG_DRIVER_PROBING, &vha->pci_flags)) {
- /*
- * Schedule this (only once) on the default system
- * workqueue so that all the adapter workqueues and the
- * DPC thread can be shutdown cleanly.
- */
- schedule_work(&vha->hw->board_disable);
+ qla_schedule_eeh_work(vha);
}
return true;
} else
@@ -1643,8 +1638,6 @@ qla2x00_async_event(scsi_qla_host_t *vha, struct rsp_que *rsp, uint16_t *mb)
case MBA_TEMPERATURE_ALERT:
ql_dbg(ql_dbg_async, vha, 0x505e,
"TEMPERATURE ALERT: %04x %04x %04x\n", mb[1], mb[2], mb[3]);
- if (mb[1] == 0x12)
- schedule_work(&ha->board_disable);
break;
case MBA_TRANS_INSERT:
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 6ff720d8961d0..8b65e8a82ec99 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -167,7 +167,8 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
/* check if ISP abort is active and return cmd with timeout */
if ((test_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags) ||
test_bit(ISP_ABORT_RETRY, &base_vha->dpc_flags) ||
- test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags)) &&
+ test_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags) ||
+ ha->flags.eeh_busy) &&
!is_rom_cmd(mcp->mb[0])) {
ql_log(ql_log_info, vha, 0x1005,
"Cmd 0x%x aborted with timeout since ISP Abort is pending\n",
diff --git a/drivers/scsi/qla2xxx/qla_nvme.c b/drivers/scsi/qla2xxx/qla_nvme.c
index 840dc1e10a233..6dad7787f20de 100644
--- a/drivers/scsi/qla2xxx/qla_nvme.c
+++ b/drivers/scsi/qla2xxx/qla_nvme.c
@@ -397,8 +397,13 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp)
}
req_cnt = qla24xx_calc_iocbs(vha, tot_dsds);
if (req->cnt < (req_cnt + 2)) {
- cnt = IS_SHADOW_REG_CAPABLE(ha) ? *req->out_ptr :
- rd_reg_dword_relaxed(req->req_q_out);
+ if (IS_SHADOW_REG_CAPABLE(ha)) {
+ cnt = *req->out_ptr;
+ } else {
+ cnt = rd_reg_dword_relaxed(req->req_q_out);
+ if (qla2x00_check_reg16_for_disconnect(vha, cnt))
+ goto queuing_error;
+ }
if (req->ring_index < cnt)
req->cnt = cnt - req->ring_index;
@@ -535,6 +540,7 @@ static inline int qla2x00_start_nvme_mq(srb_t *sp)
queuing_error:
spin_unlock_irqrestore(&qpair->qp_lock, flags);
+
return rval;
}
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index bf40b293dcea6..5a4df566afd16 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -961,6 +961,13 @@ qla2xxx_mqueuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd,
goto qc24_fail_command;
}
+ if (!qpair->online) {
+ ql_dbg(ql_dbg_io, vha, 0x3077,
+ "qpair not online. eeh_busy=%d.\n", ha->flags.eeh_busy);
+ cmd->result = DID_NO_CONNECT << 16;
+ goto qc24_fail_command;
+ }
+
if (!fcport || fcport->deleted) {
cmd->result = DID_IMM_RETRY << 16;
goto qc24_fail_command;
@@ -1190,35 +1197,6 @@ qla2x00_wait_for_chip_reset(scsi_qla_host_t *vha)
return return_status;
}
-#define ISP_REG_DISCONNECT 0xffffffffU
-/**************************************************************************
-* qla2x00_isp_reg_stat
-*
-* Description:
-* Read the host status register of ISP before aborting the command.
-*
-* Input:
-* ha = pointer to host adapter structure.
-*
-*
-* Returns:
-* Either true or false.
-*
-* Note: Return true if there is register disconnect.
-**************************************************************************/
-static inline
-uint32_t qla2x00_isp_reg_stat(struct qla_hw_data *ha)
-{
- struct device_reg_24xx __iomem *reg = &ha->iobase->isp24;
- struct device_reg_82xx __iomem *reg82 = &ha->iobase->isp82;
-
- if (IS_P3P_TYPE(ha))
- return ((rd_reg_dword(®82->host_int)) == ISP_REG_DISCONNECT);
- else
- return ((rd_reg_dword(®->host_status)) ==
- ISP_REG_DISCONNECT);
-}
-
/**************************************************************************
* qla2xxx_eh_abort
*
@@ -1253,6 +1231,7 @@ qla2xxx_eh_abort(struct scsi_cmnd *cmd)
if (qla2x00_isp_reg_stat(ha)) {
ql_log(ql_log_info, vha, 0x8042,
"PCI/Register disconnect, exiting.\n");
+ qla_pci_set_eeh_busy(vha);
return FAILED;
}
@@ -1444,6 +1423,7 @@ qla2xxx_eh_device_reset(struct scsi_cmnd *cmd)
if (qla2x00_isp_reg_stat(ha)) {
ql_log(ql_log_info, vha, 0x803e,
"PCI/Register disconnect, exiting.\n");
+ qla_pci_set_eeh_busy(vha);
return FAILED;
}
@@ -1460,6 +1440,7 @@ qla2xxx_eh_target_reset(struct scsi_cmnd *cmd)
if (qla2x00_isp_reg_stat(ha)) {
ql_log(ql_log_info, vha, 0x803f,
"PCI/Register disconnect, exiting.\n");
+ qla_pci_set_eeh_busy(vha);
return FAILED;
}
@@ -1495,6 +1476,7 @@ qla2xxx_eh_bus_reset(struct scsi_cmnd *cmd)
if (qla2x00_isp_reg_stat(ha)) {
ql_log(ql_log_info, vha, 0x8040,
"PCI/Register disconnect, exiting.\n");
+ qla_pci_set_eeh_busy(vha);
return FAILED;
}
@@ -1572,7 +1554,7 @@ qla2xxx_eh_host_reset(struct scsi_cmnd *cmd)
if (qla2x00_isp_reg_stat(ha)) {
ql_log(ql_log_info, vha, 0x8041,
"PCI/Register disconnect, exiting.\n");
- schedule_work(&ha->board_disable);
+ qla_pci_set_eeh_busy(vha);
return SUCCESS;
}
@@ -6677,6 +6659,9 @@ qla2x00_do_dpc(void *data)
schedule();
+ if (test_and_clear_bit(DO_EEH_RECOVERY, &base_vha->dpc_flags))
+ qla_pci_set_eeh_busy(base_vha);
+
if (!base_vha->flags.init_done || ha->flags.mbox_busy)
goto end_loop;
@@ -7384,6 +7369,8 @@ static void qla_pci_error_cleanup(scsi_qla_host_t *vha)
int i;
unsigned long flags;
+ ql_dbg(ql_dbg_aer, vha, 0x9000,
+ "%s\n", __func__);
ha->chip_reset++;
ha->base_qpair->chip_reset = ha->chip_reset;
@@ -7393,28 +7380,16 @@ static void qla_pci_error_cleanup(scsi_qla_host_t *vha)
ha->base_qpair->chip_reset;
}
- /* purge MBox commands */
- if (atomic_read(&ha->num_pend_mbx_stage3)) {
- clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
- complete(&ha->mbx_intr_comp);
- }
-
- i = 0;
-
- while (atomic_read(&ha->num_pend_mbx_stage3) ||
- atomic_read(&ha->num_pend_mbx_stage2) ||
- atomic_read(&ha->num_pend_mbx_stage1)) {
- msleep(20);
- i++;
- if (i > 50)
- break;
- }
-
- ha->flags.purge_mbox = 0;
+ /*
+ * purge mailbox might take a while. Slot Reset/chip reset
+ * will take care of the purge
+ */
mutex_lock(&ha->mq_lock);
+ ha->base_qpair->online = 0;
list_for_each_entry(qpair, &base_vha->qp_list, qp_list_elem)
qpair->online = 0;
+ wmb();
mutex_unlock(&ha->mq_lock);
qla2x00_mark_all_devices_lost(vha);
@@ -7451,14 +7426,17 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
{
scsi_qla_host_t *vha = pci_get_drvdata(pdev);
struct qla_hw_data *ha = vha->hw;
+ pci_ers_result_t ret = PCI_ERS_RESULT_NEED_RESET;
- ql_dbg(ql_dbg_aer, vha, 0x9000,
- "PCI error detected, state %x.\n", state);
+ ql_log(ql_log_warn, vha, 0x9000,
+ "PCI error detected, state %x.\n", state);
+ ha->pci_error_state = QLA_PCI_ERR_DETECTED;
if (!atomic_read(&pdev->enable_cnt)) {
ql_log(ql_log_info, vha, 0xffff,
"PCI device is disabled,state %x\n", state);
- return PCI_ERS_RESULT_NEED_RESET;
+ ret = PCI_ERS_RESULT_NEED_RESET;
+ goto out;
}
switch (state) {
@@ -7468,11 +7446,12 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags);
qla2xxx_wake_dpc(vha);
}
- return PCI_ERS_RESULT_CAN_RECOVER;
+ ret = PCI_ERS_RESULT_CAN_RECOVER;
+ break;
case pci_channel_io_frozen:
- ha->flags.eeh_busy = 1;
- qla_pci_error_cleanup(vha);
- return PCI_ERS_RESULT_NEED_RESET;
+ qla_pci_set_eeh_busy(vha);
+ ret = PCI_ERS_RESULT_NEED_RESET;
+ break;
case pci_channel_io_perm_failure:
ha->flags.pci_channel_io_perm_failure = 1;
qla2x00_abort_all_cmds(vha, DID_NO_CONNECT << 16);
@@ -7480,9 +7459,12 @@ qla2xxx_pci_error_detected(struct pci_dev *pdev, pci_channel_state_t state)
set_bit(QPAIR_ONLINE_CHECK_NEEDED, &vha->dpc_flags);
qla2xxx_wake_dpc(vha);
}
- return PCI_ERS_RESULT_DISCONNECT;
+ ret = PCI_ERS_RESULT_DISCONNECT;
}
- return PCI_ERS_RESULT_NEED_RESET;
+out:
+ ql_dbg(ql_dbg_aer, vha, 0x600d,
+ "PCI error detected returning [%x].\n", ret);
+ return ret;
}
static pci_ers_result_t
@@ -7496,6 +7478,10 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev)
struct device_reg_2xxx __iomem *reg = &ha->iobase->isp;
struct device_reg_24xx __iomem *reg24 = &ha->iobase->isp24;
+ ql_log(ql_log_warn, base_vha, 0x9000,
+ "mmio enabled\n");
+
+ ha->pci_error_state = QLA_PCI_MMIO_ENABLED;
if (IS_QLA82XX(ha))
return PCI_ERS_RESULT_RECOVERED;
@@ -7519,10 +7505,11 @@ qla2xxx_pci_mmio_enabled(struct pci_dev *pdev)
ql_log(ql_log_info, base_vha, 0x9003,
"RISC paused -- mmio_enabled, Dumping firmware.\n");
qla2xxx_dump_fw(base_vha);
-
- return PCI_ERS_RESULT_NEED_RESET;
- } else
- return PCI_ERS_RESULT_RECOVERED;
+ }
+ /* set PCI_ERS_RESULT_NEED_RESET to trigger call to qla2xxx_pci_slot_reset */
+ ql_dbg(ql_dbg_aer, base_vha, 0x600d,
+ "mmio enabled returning.\n");
+ return PCI_ERS_RESULT_NEED_RESET;
}
static pci_ers_result_t
@@ -7534,9 +7521,10 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
int rc;
struct qla_qpair *qpair = NULL;
- ql_dbg(ql_dbg_aer, base_vha, 0x9004,
- "Slot Reset.\n");
+ ql_log(ql_log_warn, base_vha, 0x9004,
+ "Slot Reset.\n");
+ ha->pci_error_state = QLA_PCI_SLOT_RESET;
/* Workaround: qla2xxx driver which access hardware earlier
* needs error state to be pci_channel_io_online.
* Otherwise mailbox command timesout.
@@ -7570,16 +7558,24 @@ qla2xxx_pci_slot_reset(struct pci_dev *pdev)
qpair->online = 1;
mutex_unlock(&ha->mq_lock);
+ ha->flags.eeh_busy = 0;
base_vha->flags.online = 1;
set_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
- if (ha->isp_ops->abort_isp(base_vha) == QLA_SUCCESS)
- ret = PCI_ERS_RESULT_RECOVERED;
+ ha->isp_ops->abort_isp(base_vha);
clear_bit(ABORT_ISP_ACTIVE, &base_vha->dpc_flags);
+ if (qla2x00_isp_reg_stat(ha)) {
+ ha->flags.eeh_busy = 1;
+ qla_pci_error_cleanup(base_vha);
+ ql_log(ql_log_warn, base_vha, 0x9005,
+ "Device unable to recover from PCI error.\n");
+ } else {
+ ret = PCI_ERS_RESULT_RECOVERED;
+ }
exit_slot_reset:
ql_dbg(ql_dbg_aer, base_vha, 0x900e,
- "slot_reset return %x.\n", ret);
+ "Slot Reset returning %x.\n", ret);
return ret;
}
@@ -7591,16 +7587,55 @@ qla2xxx_pci_resume(struct pci_dev *pdev)
struct qla_hw_data *ha = base_vha->hw;
int ret;
- ql_dbg(ql_dbg_aer, base_vha, 0x900f,
- "pci_resume.\n");
+ ql_log(ql_log_warn, base_vha, 0x900f,
+ "Pci Resume.\n");
- ha->flags.eeh_busy = 0;
ret = qla2x00_wait_for_hba_online(base_vha);
if (ret != QLA_SUCCESS) {
ql_log(ql_log_fatal, base_vha, 0x9002,
"The device failed to resume I/O from slot/link_reset.\n");
}
+ ha->pci_error_state = QLA_PCI_RESUME;
+ ql_dbg(ql_dbg_aer, base_vha, 0x600d,
+ "Pci Resume returning.\n");
+}
+
+void qla_pci_set_eeh_busy(struct scsi_qla_host *vha)
+{
+ struct qla_hw_data *ha = vha->hw;
+ struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
+ bool do_cleanup = false;
+ unsigned long flags;
+
+ if (ha->flags.eeh_busy)
+ return;
+
+ spin_lock_irqsave(&base_vha->work_lock, flags);
+ if (!ha->flags.eeh_busy) {
+ ha->flags.eeh_busy = 1;
+ do_cleanup = true;
+ }
+ spin_unlock_irqrestore(&base_vha->work_lock, flags);
+
+ if (do_cleanup)
+ qla_pci_error_cleanup(base_vha);
+}
+
+/*
+ * this routine will schedule a task to pause IO from interrupt context
+ * if caller sees a PCIE error event (register read = 0xf's)
+ */
+void qla_schedule_eeh_work(struct scsi_qla_host *vha)
+{
+ struct qla_hw_data *ha = vha->hw;
+ struct scsi_qla_host *base_vha = pci_get_drvdata(ha->pdev);
+
+ if (ha->flags.eeh_busy)
+ return;
+
+ set_bit(DO_EEH_RECOVERY, &base_vha->dpc_flags);
+ qla2xxx_wake_dpc(base_vha);
}
static void
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 386/406] scsi: qla2xxx: Flush mailbox commands on chip reset
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (384 preceding siblings ...)
2023-09-17 19:13 ` [PATCH 5.10 385/406] scsi: qla2xxx: Fix crash in PCIe error handling Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 387/406] ARM: dts: samsung: exynos4210-i9100: Fix LCD screens physical size Greg Kroah-Hartman
` (28 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quinn Tran, Nilesh Javali,
Himanshu Madhani, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quinn Tran <qutran@marvell.com>
[ Upstream commit 6d0b65569c0a10b27c49bacd8d25bcd406003533 ]
Fix race condition between Interrupt thread and Chip reset thread in trying
to flush the same mailbox. With the race condition, the "ha->mbx_intr_comp"
will get an extra complete() call. The extra complete call create erroneous
mailbox timeout condition when the next mailbox is sent where the mailbox
call does not wait for interrupt to arrive. Instead, it advances without
waiting.
Add lock protection around the check for mailbox completion.
Cc: stable@vger.kernel.org
Fixes: b2000805a975 ("scsi: qla2xxx: Flush mailbox commands on chip reset")
Signed-off-by: Quinn Tran <quinn.tran@marvell.com>
Signed-off-by: Nilesh Javali <njavali@marvell.com>
Link: https://lore.kernel.org/r/20230821130045.34850-3-njavali@marvell.com
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_def.h | 1 -
drivers/scsi/qla2xxx/qla_init.c | 7 ++++---
drivers/scsi/qla2xxx/qla_mbx.c | 4 ----
drivers/scsi/qla2xxx/qla_os.c | 1 -
4 files changed, 4 insertions(+), 9 deletions(-)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index 9a09b36fd573c..6645b69fc2a0f 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -4200,7 +4200,6 @@ struct qla_hw_data {
uint8_t aen_mbx_count;
atomic_t num_pend_mbx_stage1;
atomic_t num_pend_mbx_stage2;
- atomic_t num_pend_mbx_stage3;
uint16_t frame_payload_size;
uint32_t login_retry_count;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index f24f087c733b1..a8d2c06285c24 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -6926,14 +6926,15 @@ qla2x00_abort_isp_cleanup(scsi_qla_host_t *vha)
}
/* purge MBox commands */
- if (atomic_read(&ha->num_pend_mbx_stage3)) {
+ spin_lock_irqsave(&ha->hardware_lock, flags);
+ if (test_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags)) {
clear_bit(MBX_INTR_WAIT, &ha->mbx_cmd_flags);
complete(&ha->mbx_intr_comp);
}
+ spin_unlock_irqrestore(&ha->hardware_lock, flags);
i = 0;
- while (atomic_read(&ha->num_pend_mbx_stage3) ||
- atomic_read(&ha->num_pend_mbx_stage2) ||
+ while (atomic_read(&ha->num_pend_mbx_stage2) ||
atomic_read(&ha->num_pend_mbx_stage1)) {
msleep(20);
i++;
diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c
index 8b65e8a82ec99..21ba7100ff676 100644
--- a/drivers/scsi/qla2xxx/qla_mbx.c
+++ b/drivers/scsi/qla2xxx/qla_mbx.c
@@ -269,7 +269,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
spin_unlock_irqrestore(&ha->hardware_lock, flags);
wait_time = jiffies;
- atomic_inc(&ha->num_pend_mbx_stage3);
if (!wait_for_completion_timeout(&ha->mbx_intr_comp,
mcp->tov * HZ)) {
ql_dbg(ql_dbg_mbx, vha, 0x117a,
@@ -284,7 +283,6 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
spin_unlock_irqrestore(&ha->hardware_lock,
flags);
atomic_dec(&ha->num_pend_mbx_stage2);
- atomic_dec(&ha->num_pend_mbx_stage3);
rval = QLA_ABORTED;
goto premature_exit;
}
@@ -294,11 +292,9 @@ qla2x00_mailbox_command(scsi_qla_host_t *vha, mbx_cmd_t *mcp)
ha->flags.mbox_busy = 0;
spin_unlock_irqrestore(&ha->hardware_lock, flags);
atomic_dec(&ha->num_pend_mbx_stage2);
- atomic_dec(&ha->num_pend_mbx_stage3);
rval = QLA_ABORTED;
goto premature_exit;
}
- atomic_dec(&ha->num_pend_mbx_stage3);
if (time_after(jiffies, wait_time + 5 * HZ))
ql_log(ql_log_warn, vha, 0x1015, "cmd=0x%x, waited %d msecs\n",
diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c
index 5a4df566afd16..8d199deaf3b12 100644
--- a/drivers/scsi/qla2xxx/qla_os.c
+++ b/drivers/scsi/qla2xxx/qla_os.c
@@ -2848,7 +2848,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
ha->max_exchg = FW_MAX_EXCHANGES_CNT;
atomic_set(&ha->num_pend_mbx_stage1, 0);
atomic_set(&ha->num_pend_mbx_stage2, 0);
- atomic_set(&ha->num_pend_mbx_stage3, 0);
atomic_set(&ha->zio_threshold, DEFAULT_ZIO_THRESHOLD);
ha->last_zio_threshold = DEFAULT_ZIO_THRESHOLD;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 387/406] ARM: dts: samsung: exynos4210-i9100: Fix LCD screens physical size
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (385 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 386/406] scsi: qla2xxx: Flush mailbox commands on chip reset Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 388/406] ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 Greg Kroah-Hartman
` (27 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Sam Ravnborg,
Krzysztof Kozlowski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Cercueil <paul@crapouillou.net>
[ Upstream commit b3f3fc32e5ff1e848555af8616318cc667457f90 ]
The previous values were completely bogus, and resulted in the computed
DPI ratio being much lower than reality, causing applications and UIs to
misbehave.
The new values were measured by myself with a ruler.
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Fixes: 8620cc2f99b7 ("ARM: dts: exynos: Add devicetree file for the Galaxy S2")
Cc: <stable@vger.kernel.org> # v5.8+
Link: https://lore.kernel.org/r/20230714153720.336990-1-paul@crapouillou.net
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/exynos4210-i9100.dts | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/boot/dts/exynos4210-i9100.dts b/arch/arm/boot/dts/exynos4210-i9100.dts
index ecc9d4dc707e4..d186b93144e38 100644
--- a/arch/arm/boot/dts/exynos4210-i9100.dts
+++ b/arch/arm/boot/dts/exynos4210-i9100.dts
@@ -170,8 +170,8 @@
power-on-delay = <10>;
reset-delay = <10>;
- panel-width-mm = <90>;
- panel-height-mm = <154>;
+ panel-width-mm = <56>;
+ panel-height-mm = <93>;
display-timings {
timing {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 388/406] ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (386 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 387/406] ARM: dts: samsung: exynos4210-i9100: Fix LCD screens physical size Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 389/406] bus: mhi: host: Skip MHI reset if device is in RDDM Greg Kroah-Hartman
` (26 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksey Nasibulin, Christian Marangi,
Rafał Miłecki, Florian Fainelli, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksey Nasibulin <alealexpro100@ya.ru>
[ Upstream commit 91994e59079dcb455783d3f9ea338eea6f671af3 ]
Linksys ea6500-v2 have 256MB of ram. Currently we only use 128MB.
Expand the definition to use all the available RAM.
Fixes: 03e96644d7a8 ("ARM: dts: BCM5301X: Add basic DT for Linksys EA6500 V2")
Signed-off-by: Aleksey Nasibulin <alealexpro100@ya.ru>
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Cc: stable@vger.kernel.org
Acked-by: Rafał Miłecki <rafal@milecki.pl>
Link: https://lore.kernel.org/r/20230712014017.28123-1-ansuelsmth@gmail.com
Signed-off-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
index cd797b4202ad8..01c48faabfade 100644
--- a/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
+++ b/arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts
@@ -19,7 +19,8 @@
memory@0 {
device_type = "memory";
- reg = <0x00000000 0x08000000>;
+ reg = <0x00000000 0x08000000>,
+ <0x88000000 0x08000000>;
};
gpio-keys {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 389/406] bus: mhi: host: Skip MHI reset if device is in RDDM
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (387 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 388/406] ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 390/406] net: ipv4: fix one memleak in __inet_del_ifa() Greg Kroah-Hartman
` (25 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiang Yu, Jeffrey Hugo,
Manivannan Sadhasivam, Manivannan Sadhasivam, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Yu <quic_qianyu@quicinc.com>
[ Upstream commit cabce92dd805945a090dc6fc73b001bb35ed083a ]
In RDDM EE, device can not process MHI reset issued by host. In case of MHI
power off, host is issuing MHI reset and polls for it to get cleared until
it times out. Since this timeout can not be avoided in case of RDDM, skip
the MHI reset in this scenarios.
Cc: <stable@vger.kernel.org>
Fixes: a6e2e3522f29 ("bus: mhi: core: Add support for PM state transitions")
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
Reviewed-by: Jeffrey Hugo <quic_jhugo@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://lore.kernel.org/r/1684390959-17836-1-git-send-email-quic_qianyu@quicinc.com
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bus/mhi/host/pm.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/bus/mhi/host/pm.c b/drivers/bus/mhi/host/pm.c
index 7d69b740b9f93..fe8ecd6eaa4d1 100644
--- a/drivers/bus/mhi/host/pm.c
+++ b/drivers/bus/mhi/host/pm.c
@@ -490,6 +490,10 @@ static void mhi_pm_disable_transition(struct mhi_controller *mhi_cntrl,
u32 in_reset = -1;
unsigned long timeout = msecs_to_jiffies(mhi_cntrl->timeout_ms);
+ /* Skip MHI RESET if in RDDM state */
+ if (mhi_cntrl->rddm_image && mhi_get_exec_env(mhi_cntrl) == MHI_EE_RDDM)
+ goto skip_mhi_reset;
+
dev_dbg(dev, "Triggering MHI Reset in device\n");
mhi_set_mhi_state(mhi_cntrl, MHI_STATE_RESET);
@@ -515,6 +519,7 @@ static void mhi_pm_disable_transition(struct mhi_controller *mhi_cntrl,
mhi_write_reg(mhi_cntrl, mhi_cntrl->bhi, BHI_INTVEC, 0);
}
+skip_mhi_reset:
dev_dbg(dev,
"Waiting for all pending event ring processing to complete\n");
mhi_event = mhi_cntrl->mhi_event;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 390/406] net: ipv4: fix one memleak in __inet_del_ifa()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (388 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 389/406] bus: mhi: host: Skip MHI reset if device is in RDDM Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 391/406] selftests/kselftest/runner/run_one(): allow running non-executable files Greg Kroah-Hartman
` (24 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Jian, Julian Anastasov,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Jian <liujian56@huawei.com>
[ Upstream commit ac28b1ec6135649b5d78b028e47264cb3ebca5ea ]
I got the below warning when do fuzzing test:
unregister_netdevice: waiting for bond0 to become free. Usage count = 2
It can be repoduced via:
ip link add bond0 type bond
sysctl -w net.ipv4.conf.bond0.promote_secondaries=1
ip addr add 4.117.174.103/0 scope 0x40 dev bond0
ip addr add 192.168.100.111/255.255.255.254 scope 0 dev bond0
ip addr add 0.0.0.4/0 scope 0x40 secondary dev bond0
ip addr del 4.117.174.103/0 scope 0x40 dev bond0
ip link delete bond0 type bond
In this reproduction test case, an incorrect 'last_prim' is found in
__inet_del_ifa(), as a result, the secondary address(0.0.0.4/0 scope 0x40)
is lost. The memory of the secondary address is leaked and the reference of
in_device and net_device is leaked.
Fix this problem:
Look for 'last_prim' starting at location of the deleted IP and inserting
the promoted IP into the location of 'last_prim'.
Fixes: 0ff60a45678e ("[IPV4]: Fix secondary IP addresses after promotion")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Julian Anastasov <ja@ssi.bg>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/devinet.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 88b6120878cd9..da1ca8081c035 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -351,14 +351,14 @@ static void __inet_del_ifa(struct in_device *in_dev,
{
struct in_ifaddr *promote = NULL;
struct in_ifaddr *ifa, *ifa1;
- struct in_ifaddr *last_prim;
+ struct in_ifaddr __rcu **last_prim;
struct in_ifaddr *prev_prom = NULL;
int do_promote = IN_DEV_PROMOTE_SECONDARIES(in_dev);
ASSERT_RTNL();
ifa1 = rtnl_dereference(*ifap);
- last_prim = rtnl_dereference(in_dev->ifa_list);
+ last_prim = ifap;
if (in_dev->dead)
goto no_promotions;
@@ -372,7 +372,7 @@ static void __inet_del_ifa(struct in_device *in_dev,
while ((ifa = rtnl_dereference(*ifap1)) != NULL) {
if (!(ifa->ifa_flags & IFA_F_SECONDARY) &&
ifa1->ifa_scope <= ifa->ifa_scope)
- last_prim = ifa;
+ last_prim = &ifa->ifa_next;
if (!(ifa->ifa_flags & IFA_F_SECONDARY) ||
ifa1->ifa_mask != ifa->ifa_mask ||
@@ -436,9 +436,9 @@ static void __inet_del_ifa(struct in_device *in_dev,
rcu_assign_pointer(prev_prom->ifa_next, next_sec);
- last_sec = rtnl_dereference(last_prim->ifa_next);
+ last_sec = rtnl_dereference(*last_prim);
rcu_assign_pointer(promote->ifa_next, last_sec);
- rcu_assign_pointer(last_prim->ifa_next, promote);
+ rcu_assign_pointer(*last_prim, promote);
}
promote->ifa_flags &= ~IFA_F_SECONDARY;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 391/406] selftests/kselftest/runner/run_one(): allow running non-executable files
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (389 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 390/406] net: ipv4: fix one memleak in __inet_del_ifa() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 392/406] kselftest/runner.sh: Propagate SIGTERM to runner child Greg Kroah-Hartman
` (23 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, Shuah Khan,
Andrew Morton, Linus Torvalds, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sjpark@amazon.de>
[ Upstream commit 303f8e2d02002dbe331cab7813ee091aead3cd39 ]
When running a test program, 'run_one()' checks if the program has the
execution permission and fails if it doesn't. However, it's easy to
mistakenly lose the permissions, as some common tools like 'diff' don't
support the permission change well[1]. Compared to that, making mistakes
in the test program's path would only rare, as those are explicitly listed
in 'TEST_PROGS'. Therefore, it might make more sense to resolve the
situation on our own and run the program.
For this reason, this commit makes the test program runner function still
print the warning message but to try parsing the interpreter of the
program and to explicitly run it with the interpreter, in this case.
[1] https://lore.kernel.org/mm-commits/YRJisBs9AunccCD4@kroah.com/
Link: https://lkml.kernel.org/r/20210810164534.25902-1-sj38.park@gmail.com
Signed-off-by: SeongJae Park <sjpark@amazon.de>
Suggested-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Shuah Khan <shuah@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Stable-dep-of: 9616cb34b08e ("kselftest/runner.sh: Propagate SIGTERM to runner child")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/kselftest/runner.sh | 28 +++++++++++++--------
1 file changed, 18 insertions(+), 10 deletions(-)
diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh
index cc9c846585f05..a9ba782d8ca0f 100644
--- a/tools/testing/selftests/kselftest/runner.sh
+++ b/tools/testing/selftests/kselftest/runner.sh
@@ -33,9 +33,9 @@ tap_timeout()
{
# Make sure tests will time out if utility is available.
if [ -x /usr/bin/timeout ] ; then
- /usr/bin/timeout --foreground "$kselftest_timeout" "$1"
+ /usr/bin/timeout --foreground "$kselftest_timeout" $1
else
- "$1"
+ $1
fi
}
@@ -65,17 +65,25 @@ run_one()
TEST_HDR_MSG="selftests: $DIR: $BASENAME_TEST"
echo "# $TEST_HDR_MSG"
- if [ ! -x "$TEST" ]; then
- echo -n "# Warning: file $TEST is "
- if [ ! -e "$TEST" ]; then
- echo "missing!"
- else
- echo "not executable, correct this."
- fi
+ if [ ! -e "$TEST" ]; then
+ echo "# Warning: file $TEST is missing!"
echo "not ok $test_num $TEST_HDR_MSG"
else
+ cmd="./$BASENAME_TEST"
+ if [ ! -x "$TEST" ]; then
+ echo "# Warning: file $TEST is not executable"
+
+ if [ $(head -n 1 "$TEST" | cut -c -2) = "#!" ]
+ then
+ interpreter=$(head -n 1 "$TEST" | cut -c 3-)
+ cmd="$interpreter ./$BASENAME_TEST"
+ else
+ echo "not ok $test_num $TEST_HDR_MSG"
+ return
+ fi
+ fi
cd `dirname $TEST` > /dev/null
- ((((( tap_timeout ./$BASENAME_TEST 2>&1; echo $? >&3) |
+ ((((( tap_timeout "$cmd" 2>&1; echo $? >&3) |
tap_prefix >&4) 3>&1) |
(read xs; exit $xs)) 4>>"$logfile" &&
echo "ok $test_num $TEST_HDR_MSG") ||
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 392/406] kselftest/runner.sh: Propagate SIGTERM to runner child
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (390 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 391/406] selftests/kselftest/runner/run_one(): allow running non-executable files Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 393/406] net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add Greg Kroah-Hartman
` (22 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Björn Töpel, Shuah Khan,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Björn Töpel <bjorn@rivosinc.com>
[ Upstream commit 9616cb34b08ec86642b162eae75c5a7ca8debe3c ]
Timeouts in kselftest are done using the "timeout" command with the
"--foreground" option. Without the "foreground" option, it is not
possible for a user to cancel the runner using SIGINT, because the
signal is not propagated to timeout which is running in a different
process group. The "forground" options places the timeout in the same
process group as its parent, but only sends the SIGTERM (on timeout)
signal to the forked process. Unfortunately, this does not play nice
with all kselftests, e.g. "net:fcnal-test.sh", where the child
processes will linger because timeout does not send SIGTERM to the
group.
Some users have noted these hangs [1].
Fix this by nesting the timeout with an additional timeout without the
foreground option.
Link: https://lore.kernel.org/all/7650b2eb-0aee-a2b0-2e64-c9bc63210f67@alu.unizg.hr/ # [1]
Fixes: 651e0d881461 ("kselftest/runner: allow to properly deliver signals to tests")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/kselftest/runner.sh | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/kselftest/runner.sh b/tools/testing/selftests/kselftest/runner.sh
index a9ba782d8ca0f..83616f0779a7e 100644
--- a/tools/testing/selftests/kselftest/runner.sh
+++ b/tools/testing/selftests/kselftest/runner.sh
@@ -33,7 +33,8 @@ tap_timeout()
{
# Make sure tests will time out if utility is available.
if [ -x /usr/bin/timeout ] ; then
- /usr/bin/timeout --foreground "$kselftest_timeout" $1
+ /usr/bin/timeout --foreground "$kselftest_timeout" \
+ /usr/bin/timeout "$kselftest_timeout" $1
else
$1
fi
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 393/406] net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (391 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 392/406] kselftest/runner.sh: Propagate SIGTERM to runner child Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 394/406] net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() Greg Kroah-Hartman
` (21 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guangguan Wang, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guangguan Wang <guangguan.wang@linux.alibaba.com>
[ Upstream commit f5146e3ef0a9eea405874b36178c19a4863b8989 ]
While doing smcr_port_add, there maybe linkgroup add into or delete
from smc_lgr_list.list at the same time, which may result kernel crash.
So, use smc_lgr_list.lock to protect smc_lgr_list.list iterate in
smcr_port_add.
The crash calltrace show below:
BUG: kernel NULL pointer dereference, address: 0000000000000000
PGD 0 P4D 0
Oops: 0000 [#1] SMP NOPTI
CPU: 0 PID: 559726 Comm: kworker/0:92 Kdump: loaded Tainted: G
Hardware name: Alibaba Cloud Alibaba Cloud ECS, BIOS 449e491 04/01/2014
Workqueue: events smc_ib_port_event_work [smc]
RIP: 0010:smcr_port_add+0xa6/0xf0 [smc]
RSP: 0000:ffffa5a2c8f67de0 EFLAGS: 00010297
RAX: 0000000000000001 RBX: ffff9935e0650000 RCX: 0000000000000000
RDX: 0000000000000010 RSI: ffff9935e0654290 RDI: ffff9935c8560000
RBP: 0000000000000000 R08: 0000000000000000 R09: ffff9934c0401918
R10: 0000000000000000 R11: ffffffffb4a5c278 R12: ffff99364029aae4
R13: ffff99364029aa00 R14: 00000000ffffffed R15: ffff99364029ab08
FS: 0000000000000000(0000) GS:ffff994380600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000f06a10003 CR4: 0000000002770ef0
PKRU: 55555554
Call Trace:
smc_ib_port_event_work+0x18f/0x380 [smc]
process_one_work+0x19b/0x340
worker_thread+0x30/0x370
? process_one_work+0x340/0x340
kthread+0x114/0x130
? __kthread_cancel_work+0x50/0x50
ret_from_fork+0x1f/0x30
Fixes: 1f90a05d9ff9 ("net/smc: add smcr_port_add() and smcr_link_up() processing")
Signed-off-by: Guangguan Wang <guangguan.wang@linux.alibaba.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c
index e84241ff4ac4f..ab9ecdd1af0ac 100644
--- a/net/smc/smc_core.c
+++ b/net/smc/smc_core.c
@@ -1101,6 +1101,7 @@ void smcr_port_add(struct smc_ib_device *smcibdev, u8 ibport)
{
struct smc_link_group *lgr, *n;
+ spin_lock_bh(&smc_lgr_list.lock);
list_for_each_entry_safe(lgr, n, &smc_lgr_list.list, list) {
struct smc_link *link;
@@ -1115,6 +1116,7 @@ void smcr_port_add(struct smc_ib_device *smcibdev, u8 ibport)
if (link)
smc_llc_add_link_local(link);
}
+ spin_unlock_bh(&smc_lgr_list.lock);
}
/* link is down - switch connections to alternate link,
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 394/406] net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (392 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 393/406] net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 395/406] net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() Greg Kroah-Hartman
` (20 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangyu Hua, Marcin Wojtas,
Russell King (Oracle), David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangyu Hua <hbh25y@gmail.com>
[ Upstream commit 51fe0a470543f345e3c62b6798929de3ddcedc1d ]
rules is allocated in ethtool_get_rxnfc and the size is determined by
rule_cnt from user space. So rule_cnt needs to be check before using
rules to avoid OOB writing or NULL pointer dereference.
Fixes: 90b509b39ac9 ("net: mvpp2: cls: Add Classification offload support")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Marcin Wojtas <mw@semihalf.com>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
index 68c5ed8716c84..e0e6275b3e20c 100644
--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
@@ -5201,6 +5201,11 @@ static int mvpp2_ethtool_get_rxnfc(struct net_device *dev,
break;
case ETHTOOL_GRXCLSRLALL:
for (i = 0; i < MVPP2_N_RFS_ENTRIES_PER_FLOW; i++) {
+ if (loc == info->rule_cnt) {
+ ret = -EMSGSIZE;
+ break;
+ }
+
if (port->rfs_rules[i])
rules[loc++] = i;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 395/406] net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (393 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 394/406] net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 396/406] hsr: Fix uninit-value access in fill_frame_info() Greg Kroah-Hartman
` (19 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangyu Hua, Simon Horman,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangyu Hua <hbh25y@gmail.com>
[ Upstream commit e4c79810755f66c9a933ca810da2724133b1165a ]
rule_locs is allocated in ethtool_get_rxnfc and the size is determined by
rule_cnt from user space. So rule_cnt needs to be check before using
rule_locs to avoid NULL pointer dereference.
Fixes: 7aab747e5563 ("net: ethernet: mediatek: add ethtool functions to configure RX flows of HW LRO")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
index a8319295f1ab2..aa9e616cc1d59 100644
--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
@@ -2013,6 +2013,9 @@ static int mtk_hwlro_get_fdir_all(struct net_device *dev,
int i;
for (i = 0; i < MTK_MAX_LRO_IP_CNT; i++) {
+ if (cnt == cmd->rule_cnt)
+ return -EMSGSIZE;
+
if (mac->hwlro_ip[i]) {
rule_locs[cnt] = i;
cnt++;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 396/406] hsr: Fix uninit-value access in fill_frame_info()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (394 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 395/406] net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 397/406] r8152: check budget for r8152_poll() Greg Kroah-Hartman
` (18 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+bf7e6250c7ce248f3ec9,
Ziyang Xuan, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <william.xuanziyang@huawei.com>
[ Upstream commit 484b4833c604c0adcf19eac1ca14b60b757355b5 ]
Syzbot reports the following uninit-value access problem.
=====================================================
BUG: KMSAN: uninit-value in fill_frame_info net/hsr/hsr_forward.c:601 [inline]
BUG: KMSAN: uninit-value in hsr_forward_skb+0x9bd/0x30f0 net/hsr/hsr_forward.c:616
fill_frame_info net/hsr/hsr_forward.c:601 [inline]
hsr_forward_skb+0x9bd/0x30f0 net/hsr/hsr_forward.c:616
hsr_dev_xmit+0x192/0x330 net/hsr/hsr_device.c:223
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3560
__dev_queue_xmit+0x34d0/0x52a0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
packet_xmit+0x9c/0x6b0 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3087 [inline]
packet_sendmsg+0x8b1d/0x9f30 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
__sys_sendto+0x781/0xa30 net/socket.c:2176
__do_sys_sendto net/socket.c:2188 [inline]
__se_sys_sendto net/socket.c:2184 [inline]
__ia32_sys_sendto+0x11f/0x1c0 net/socket.c:2184
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
Uninit was created at:
slab_post_alloc_hook+0x12f/0xb70 mm/slab.h:767
slab_alloc_node mm/slub.c:3478 [inline]
kmem_cache_alloc_node+0x577/0xa80 mm/slub.c:3523
kmalloc_reserve+0x148/0x470 net/core/skbuff.c:559
__alloc_skb+0x318/0x740 net/core/skbuff.c:644
alloc_skb include/linux/skbuff.h:1286 [inline]
alloc_skb_with_frags+0xc8/0xbd0 net/core/skbuff.c:6299
sock_alloc_send_pskb+0xa80/0xbf0 net/core/sock.c:2794
packet_alloc_skb net/packet/af_packet.c:2936 [inline]
packet_snd net/packet/af_packet.c:3030 [inline]
packet_sendmsg+0x70e8/0x9f30 net/packet/af_packet.c:3119
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
__sys_sendto+0x781/0xa30 net/socket.c:2176
__do_sys_sendto net/socket.c:2188 [inline]
__se_sys_sendto net/socket.c:2184 [inline]
__ia32_sys_sendto+0x11f/0x1c0 net/socket.c:2184
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0xa2/0x100 arch/x86/entry/common.c:178
do_fast_syscall_32+0x37/0x80 arch/x86/entry/common.c:203
do_SYSENTER_32+0x1f/0x30 arch/x86/entry/common.c:246
entry_SYSENTER_compat_after_hwframe+0x70/0x82
It is because VLAN not yet supported in hsr driver. Return error
when protocol is ETH_P_8021Q in fill_frame_info() now to fix it.
Fixes: 451d8123f897 ("net: prp: add packet handling support")
Reported-by: syzbot+bf7e6250c7ce248f3ec9@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bf7e6250c7ce248f3ec9
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/hsr/hsr_forward.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index aec48e670fb69..2a02cb2edec2f 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -531,6 +531,7 @@ static int fill_frame_info(struct hsr_frame_info *frame,
proto = vlan_hdr->vlanhdr.h_vlan_encapsulated_proto;
/* FIXME: */
netdev_warn_once(skb->dev, "VLAN not yet supported");
+ return -EINVAL;
}
frame->is_from_san = false;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 397/406] r8152: check budget for r8152_poll()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (395 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 396/406] hsr: Fix uninit-value access in fill_frame_info() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 398/406] kcm: Fix memory leak in error path of kcm_sendmsg() Greg Kroah-Hartman
` (17 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hayes Wang, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hayes Wang <hayeswang@realtek.com>
[ Upstream commit a7b8d60b37237680009dd0b025fe8c067aba0ee3 ]
According to the document of napi, there is no rx process when the
budget is 0. Therefore, r8152_poll() has to return 0 directly when the
budget is equal to 0.
Fixes: d2187f8e4454 ("r8152: divide the tx and rx bottom functions")
Signed-off-by: Hayes Wang <hayeswang@realtek.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/r8152.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index f9a79d67d6d4f..cc7c86debfa27 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -2439,6 +2439,9 @@ static int r8152_poll(struct napi_struct *napi, int budget)
struct r8152 *tp = container_of(napi, struct r8152, napi);
int work_done;
+ if (!budget)
+ return 0;
+
work_done = rx_bottom(tp, budget);
if (work_done < budget) {
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 398/406] kcm: Fix memory leak in error path of kcm_sendmsg()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (396 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 397/406] r8152: check budget for r8152_poll() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 399/406] platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors Greg Kroah-Hartman
` (16 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shigeru Yoshida, David S. Miller,
Sasha Levin, syzbot+6f98de741f7dbbfc4ccb
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <syoshida@redhat.com>
[ Upstream commit c821a88bd720b0046433173185fd841a100d44ad ]
syzbot reported a memory leak like below:
BUG: memory leak
unreferenced object 0xffff88810b088c00 (size 240):
comm "syz-executor186", pid 5012, jiffies 4294943306 (age 13.680s)
hex dump (first 32 bytes):
00 89 08 0b 81 88 ff ff 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff83e5d5ff>] __alloc_skb+0x1ef/0x230 net/core/skbuff.c:634
[<ffffffff84606e59>] alloc_skb include/linux/skbuff.h:1289 [inline]
[<ffffffff84606e59>] kcm_sendmsg+0x269/0x1050 net/kcm/kcmsock.c:815
[<ffffffff83e479c6>] sock_sendmsg_nosec net/socket.c:725 [inline]
[<ffffffff83e479c6>] sock_sendmsg+0x56/0xb0 net/socket.c:748
[<ffffffff83e47f55>] ____sys_sendmsg+0x365/0x470 net/socket.c:2494
[<ffffffff83e4c389>] ___sys_sendmsg+0xc9/0x130 net/socket.c:2548
[<ffffffff83e4c536>] __sys_sendmsg+0xa6/0x120 net/socket.c:2577
[<ffffffff84ad7bb8>] do_syscall_x64 arch/x86/entry/common.c:50 [inline]
[<ffffffff84ad7bb8>] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
[<ffffffff84c0008b>] entry_SYSCALL_64_after_hwframe+0x63/0xcd
In kcm_sendmsg(), kcm_tx_msg(head)->last_skb is used as a cursor to append
newly allocated skbs to 'head'. If some bytes are copied, an error occurred,
and jumped to out_error label, 'last_skb' is left unmodified. A later
kcm_sendmsg() will use an obsoleted 'last_skb' reference, corrupting the
'head' frag_list and causing the leak.
This patch fixes this issue by properly updating the last allocated skb in
'last_skb'.
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Reported-and-tested-by: syzbot+6f98de741f7dbbfc4ccb@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6f98de741f7dbbfc4ccb
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/kcm/kcmsock.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index 71608a6def988..fb025406ea567 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1073,6 +1073,8 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
if (head != kcm->seq_skb)
kfree_skb(head);
+ else if (copied)
+ kcm_tx_msg(head)->last_skb = skb;
err = sk_stream_error(sk, msg->msg_flags, err);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 399/406] platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (397 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 398/406] kcm: Fix memory leak in error path of kcm_sendmsg() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 400/406] platform/mellanox: mlxbf-tmfifo: Drop jumbo frames Greg Kroah-Hartman
` (15 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liming Sun, Vadim Pasternak,
David Thompson, Hans de Goede, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liming Sun <limings@nvidia.com>
[ Upstream commit 78034cbece79c2d730ad0770b3b7f23eedbbecf5 ]
This commit fixes tmfifo console stuck issue when the virtual
networking interface is in down state. In such case, the network
Rx descriptors runs out and causes the Rx network packet staying
in the head of the tmfifo thus blocking the console packets. The
fix is to drop the Rx network packet when no more Rx descriptors.
Function name mlxbf_tmfifo_release_pending_pkt() is also renamed
to mlxbf_tmfifo_release_pkt() to be more approperiate.
Fixes: 1357dfd7261f ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc")
Signed-off-by: Liming Sun <limings@nvidia.com>
Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
Reviewed-by: David Thompson <davthompson@nvidia.com>
Link: https://lore.kernel.org/r/8c0177dc938ae03f52ff7e0b62dbeee74b7bec09.1693322547.git.limings@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/mellanox/mlxbf-tmfifo.c | 66 ++++++++++++++++++------
1 file changed, 49 insertions(+), 17 deletions(-)
diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
index 64d22ecf3cddd..42fcccf06157f 100644
--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
@@ -56,6 +56,7 @@ struct mlxbf_tmfifo;
* @vq: pointer to the virtio virtqueue
* @desc: current descriptor of the pending packet
* @desc_head: head descriptor of the pending packet
+ * @drop_desc: dummy desc for packet dropping
* @cur_len: processed length of the current descriptor
* @rem_len: remaining length of the pending packet
* @pkt_len: total length of the pending packet
@@ -72,6 +73,7 @@ struct mlxbf_tmfifo_vring {
struct virtqueue *vq;
struct vring_desc *desc;
struct vring_desc *desc_head;
+ struct vring_desc drop_desc;
int cur_len;
int rem_len;
u32 pkt_len;
@@ -83,6 +85,14 @@ struct mlxbf_tmfifo_vring {
struct mlxbf_tmfifo *fifo;
};
+/* Check whether vring is in drop mode. */
+#define IS_VRING_DROP(_r) ({ \
+ typeof(_r) (r) = (_r); \
+ (r->desc_head == &r->drop_desc ? true : false); })
+
+/* A stub length to drop maximum length packet. */
+#define VRING_DROP_DESC_MAX_LEN GENMASK(15, 0)
+
/* Interrupt types. */
enum {
MLXBF_TM_RX_LWM_IRQ,
@@ -243,6 +253,7 @@ static int mlxbf_tmfifo_alloc_vrings(struct mlxbf_tmfifo *fifo,
vring->align = SMP_CACHE_BYTES;
vring->index = i;
vring->vdev_id = tm_vdev->vdev.id.device;
+ vring->drop_desc.len = VRING_DROP_DESC_MAX_LEN;
dev = &tm_vdev->vdev.dev;
size = vring_size(vring->num, vring->align);
@@ -348,7 +359,7 @@ static u32 mlxbf_tmfifo_get_pkt_len(struct mlxbf_tmfifo_vring *vring,
return len;
}
-static void mlxbf_tmfifo_release_pending_pkt(struct mlxbf_tmfifo_vring *vring)
+static void mlxbf_tmfifo_release_pkt(struct mlxbf_tmfifo_vring *vring)
{
struct vring_desc *desc_head;
u32 len = 0;
@@ -577,19 +588,25 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring,
if (vring->cur_len + sizeof(u64) <= len) {
/* The whole word. */
- if (is_rx)
- memcpy(addr + vring->cur_len, &data, sizeof(u64));
- else
- memcpy(&data, addr + vring->cur_len, sizeof(u64));
+ if (!IS_VRING_DROP(vring)) {
+ if (is_rx)
+ memcpy(addr + vring->cur_len, &data,
+ sizeof(u64));
+ else
+ memcpy(&data, addr + vring->cur_len,
+ sizeof(u64));
+ }
vring->cur_len += sizeof(u64);
} else {
/* Leftover bytes. */
- if (is_rx)
- memcpy(addr + vring->cur_len, &data,
- len - vring->cur_len);
- else
- memcpy(&data, addr + vring->cur_len,
- len - vring->cur_len);
+ if (!IS_VRING_DROP(vring)) {
+ if (is_rx)
+ memcpy(addr + vring->cur_len, &data,
+ len - vring->cur_len);
+ else
+ memcpy(&data, addr + vring->cur_len,
+ len - vring->cur_len);
+ }
vring->cur_len = len;
}
@@ -690,8 +707,16 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring,
/* Get the descriptor of the next packet. */
if (!vring->desc) {
desc = mlxbf_tmfifo_get_next_pkt(vring, is_rx);
- if (!desc)
- return false;
+ if (!desc) {
+ /* Drop next Rx packet to avoid stuck. */
+ if (is_rx) {
+ desc = &vring->drop_desc;
+ vring->desc_head = desc;
+ vring->desc = desc;
+ } else {
+ return false;
+ }
+ }
} else {
desc = vring->desc;
}
@@ -724,17 +749,24 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring,
vring->rem_len -= len;
/* Get the next desc on the chain. */
- if (vring->rem_len > 0 &&
+ if (!IS_VRING_DROP(vring) && vring->rem_len > 0 &&
(virtio16_to_cpu(vdev, desc->flags) & VRING_DESC_F_NEXT)) {
idx = virtio16_to_cpu(vdev, desc->next);
desc = &vr->desc[idx];
goto mlxbf_tmfifo_desc_done;
}
- /* Done and release the pending packet. */
- mlxbf_tmfifo_release_pending_pkt(vring);
+ /* Done and release the packet. */
desc = NULL;
fifo->vring[is_rx] = NULL;
+ if (!IS_VRING_DROP(vring)) {
+ mlxbf_tmfifo_release_pkt(vring);
+ } else {
+ vring->pkt_len = 0;
+ vring->desc_head = NULL;
+ vring->desc = NULL;
+ return false;
+ }
/*
* Make sure the load/store are in order before
@@ -914,7 +946,7 @@ static void mlxbf_tmfifo_virtio_del_vqs(struct virtio_device *vdev)
/* Release the pending packet. */
if (vring->desc)
- mlxbf_tmfifo_release_pending_pkt(vring);
+ mlxbf_tmfifo_release_pkt(vring);
vq = vring->vq;
if (vq) {
vring->vq = NULL;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 400/406] platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (398 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 399/406] platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 401/406] net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() Greg Kroah-Hartman
` (14 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liming Sun, Vadim Pasternak,
David Thompson, Hans de Goede, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liming Sun <limings@nvidia.com>
[ Upstream commit fc4c655821546239abb3cf4274d66b9747aa87dd ]
This commit drops over-sized network packets to avoid tmfifo
queue stuck.
Fixes: 1357dfd7261f ("platform/mellanox: Add TmFifo driver for Mellanox BlueField Soc")
Signed-off-by: Liming Sun <limings@nvidia.com>
Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
Reviewed-by: David Thompson <davthompson@nvidia.com>
Link: https://lore.kernel.org/r/9318936c2447f76db475c985ca6d91f057efcd41.1693322547.git.limings@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/mellanox/mlxbf-tmfifo.c | 24 +++++++++++++++++-------
1 file changed, 17 insertions(+), 7 deletions(-)
diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
index 42fcccf06157f..194f3205e5597 100644
--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
@@ -205,7 +205,7 @@ static u8 mlxbf_tmfifo_net_default_mac[ETH_ALEN] = {
static efi_char16_t mlxbf_tmfifo_efi_name[] = L"RshimMacAddr";
/* Maximum L2 header length. */
-#define MLXBF_TMFIFO_NET_L2_OVERHEAD 36
+#define MLXBF_TMFIFO_NET_L2_OVERHEAD (ETH_HLEN + VLAN_HLEN)
/* Supported virtio-net features. */
#define MLXBF_TMFIFO_NET_FEATURES \
@@ -623,13 +623,14 @@ static void mlxbf_tmfifo_rxtx_word(struct mlxbf_tmfifo_vring *vring,
* flag is set.
*/
static void mlxbf_tmfifo_rxtx_header(struct mlxbf_tmfifo_vring *vring,
- struct vring_desc *desc,
+ struct vring_desc **desc,
bool is_rx, bool *vring_change)
{
struct mlxbf_tmfifo *fifo = vring->fifo;
struct virtio_net_config *config;
struct mlxbf_tmfifo_msg_hdr hdr;
int vdev_id, hdr_len;
+ bool drop_rx = false;
/* Read/Write packet header. */
if (is_rx) {
@@ -649,8 +650,8 @@ static void mlxbf_tmfifo_rxtx_header(struct mlxbf_tmfifo_vring *vring,
if (ntohs(hdr.len) >
__virtio16_to_cpu(virtio_legacy_is_little_endian(),
config->mtu) +
- MLXBF_TMFIFO_NET_L2_OVERHEAD)
- return;
+ MLXBF_TMFIFO_NET_L2_OVERHEAD)
+ drop_rx = true;
} else {
vdev_id = VIRTIO_ID_CONSOLE;
hdr_len = 0;
@@ -665,16 +666,25 @@ static void mlxbf_tmfifo_rxtx_header(struct mlxbf_tmfifo_vring *vring,
if (!tm_dev2)
return;
- vring->desc = desc;
+ vring->desc = *desc;
vring = &tm_dev2->vrings[MLXBF_TMFIFO_VRING_RX];
*vring_change = true;
}
+
+ if (drop_rx && !IS_VRING_DROP(vring)) {
+ if (vring->desc_head)
+ mlxbf_tmfifo_release_pkt(vring);
+ *desc = &vring->drop_desc;
+ vring->desc_head = *desc;
+ vring->desc = *desc;
+ }
+
vring->pkt_len = ntohs(hdr.len) + hdr_len;
} else {
/* Network virtio has an extra header. */
hdr_len = (vring->vdev_id == VIRTIO_ID_NET) ?
sizeof(struct virtio_net_hdr) : 0;
- vring->pkt_len = mlxbf_tmfifo_get_pkt_len(vring, desc);
+ vring->pkt_len = mlxbf_tmfifo_get_pkt_len(vring, *desc);
hdr.type = (vring->vdev_id == VIRTIO_ID_NET) ?
VIRTIO_ID_NET : VIRTIO_ID_CONSOLE;
hdr.len = htons(vring->pkt_len - hdr_len);
@@ -723,7 +733,7 @@ static bool mlxbf_tmfifo_rxtx_one_desc(struct mlxbf_tmfifo_vring *vring,
/* Beginning of a packet. Start to Rx/Tx packet header. */
if (vring->pkt_len == 0) {
- mlxbf_tmfifo_rxtx_header(vring, desc, is_rx, &vring_change);
+ mlxbf_tmfifo_rxtx_header(vring, &desc, is_rx, &vring_change);
(*avail)--;
/* Return if new packet is for another ring. */
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 401/406] net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (399 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 400/406] platform/mellanox: mlxbf-tmfifo: Drop jumbo frames Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 402/406] ipv6: fix ip6_sock_set_addr_preferences() typo Greg Kroah-Hartman
` (13 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liu Jian, Sabrina Dubroca,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Jian <liujian56@huawei.com>
[ Upstream commit cfaa80c91f6f99b9342b6557f0f0e1143e434066 ]
I got the below warning when do fuzzing test:
BUG: KASAN: null-ptr-deref in scatterwalk_copychunks+0x320/0x470
Read of size 4 at addr 0000000000000008 by task kworker/u8:1/9
CPU: 0 PID: 9 Comm: kworker/u8:1 Tainted: G OE
Hardware name: linux,dummy-virt (DT)
Workqueue: pencrypt_parallel padata_parallel_worker
Call trace:
dump_backtrace+0x0/0x420
show_stack+0x34/0x44
dump_stack+0x1d0/0x248
__kasan_report+0x138/0x140
kasan_report+0x44/0x6c
__asan_load4+0x94/0xd0
scatterwalk_copychunks+0x320/0x470
skcipher_next_slow+0x14c/0x290
skcipher_walk_next+0x2fc/0x480
skcipher_walk_first+0x9c/0x110
skcipher_walk_aead_common+0x380/0x440
skcipher_walk_aead_encrypt+0x54/0x70
ccm_encrypt+0x13c/0x4d0
crypto_aead_encrypt+0x7c/0xfc
pcrypt_aead_enc+0x28/0x84
padata_parallel_worker+0xd0/0x2dc
process_one_work+0x49c/0xbdc
worker_thread+0x124/0x880
kthread+0x210/0x260
ret_from_fork+0x10/0x18
This is because the value of rec_seq of tls_crypto_info configured by the
user program is too large, for example, 0xffffffffffffff. In addition, TLS
is asynchronously accelerated. When tls_do_encryption() returns
-EINPROGRESS and sk->sk_err is set to EBADMSG due to rec_seq overflow,
skmsg is released before the asynchronous encryption process ends. As a
result, the UAF problem occurs during the asynchronous processing of the
encryption module.
If the operation is asynchronous and the encryption module returns
EINPROGRESS, do not free the record information.
Fixes: 635d93981786 ("net/tls: free record only on encryption error")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://lore.kernel.org/r/20230909081434.2324940-1-liujian56@huawei.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_sw.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index ac7feadb43904..50eae668578a7 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -810,7 +810,7 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk,
psock = sk_psock_get(sk);
if (!psock || !policy) {
err = tls_push_record(sk, flags, record_type);
- if (err && sk->sk_err == EBADMSG) {
+ if (err && err != -EINPROGRESS && sk->sk_err == EBADMSG) {
*copied -= sk_msg_free(sk, msg);
tls_free_open_rec(sk);
err = -sk->sk_err;
@@ -839,7 +839,7 @@ static int bpf_exec_tx_verdict(struct sk_msg *msg, struct sock *sk,
switch (psock->eval) {
case __SK_PASS:
err = tls_push_record(sk, flags, record_type);
- if (err && sk->sk_err == EBADMSG) {
+ if (err && err != -EINPROGRESS && sk->sk_err == EBADMSG) {
*copied -= sk_msg_free(sk, msg);
tls_free_open_rec(sk);
err = -sk->sk_err;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 402/406] ipv6: fix ip6_sock_set_addr_preferences() typo
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (400 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 401/406] net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 403/406] ixgbe: fix timestamp configuration code Greg Kroah-Hartman
` (12 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Christoph Hellwig,
Chuck Lever, Simon Horman, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 8cdd9f1aaedf823006449faa4e540026c692ac43 ]
ip6_sock_set_addr_preferences() second argument should be an integer.
SUNRPC attempts to set IPV6_PREFER_SRC_PUBLIC were
translated to IPV6_PREFER_SRC_TMP
Fixes: 18d5ad623275 ("ipv6: add ip6_sock_set_addr_preferences")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Chuck Lever <chuck.lever@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20230911154213.713941-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ipv6.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 4c8f97a6da5a7..47d644de0e47c 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1249,7 +1249,7 @@ static inline int __ip6_sock_set_addr_preferences(struct sock *sk, int val)
return 0;
}
-static inline int ip6_sock_set_addr_preferences(struct sock *sk, bool val)
+static inline int ip6_sock_set_addr_preferences(struct sock *sk, int val)
{
int ret;
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 403/406] ixgbe: fix timestamp configuration code
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (401 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 402/406] ipv6: fix ip6_sock_set_addr_preferences() typo Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 404/406] kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() Greg Kroah-Hartman
` (11 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Simon Horman,
Tony Nguyen, David S. Miller, Sasha Levin, Pucha Himasekhar Reddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vadim Fedorenko <vadim.fedorenko@linux.dev>
[ Upstream commit 3c44191dd76cf9c0cc49adaf34384cbd42ef8ad2 ]
The commit in fixes introduced flags to control the status of hardware
configuration while processing packets. At the same time another structure
is used to provide configuration of timestamper to user-space applications.
The way it was coded makes this structures go out of sync easily. The
repro is easy for 82599 chips:
[root@hostname ~]# hwstamp_ctl -i eth0 -r 12 -t 1
current settings:
tx_type 0
rx_filter 0
new settings:
tx_type 1
rx_filter 12
The eth0 device is properly configured to timestamp any PTPv2 events.
[root@hostname ~]# hwstamp_ctl -i eth0 -r 1 -t 1
current settings:
tx_type 1
rx_filter 12
SIOCSHWTSTAMP failed: Numerical result out of range
The requested time stamping mode is not supported by the hardware.
The error is properly returned because HW doesn't support all packets
timestamping. But the adapter->flags is cleared of timestamp flags
even though no HW configuration was done. From that point no RX timestamps
are received by user-space application. But configuration shows good
values:
[root@hostname ~]# hwstamp_ctl -i eth0
current settings:
tx_type 1
rx_filter 12
Fix the issue by applying new flags only when the HW was actually
configured.
Fixes: a9763f3cb54c ("ixgbe: Update PTP to support X550EM_x devices")
Signed-off-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 28 +++++++++++---------
1 file changed, 15 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
index 8b7f300355710..3eb2c05361e80 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c
@@ -989,6 +989,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
u32 tsync_tx_ctl = IXGBE_TSYNCTXCTL_ENABLED;
u32 tsync_rx_ctl = IXGBE_TSYNCRXCTL_ENABLED;
u32 tsync_rx_mtrl = PTP_EV_PORT << 16;
+ u32 aflags = adapter->flags;
bool is_l2 = false;
u32 regval;
@@ -1009,20 +1010,20 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
case HWTSTAMP_FILTER_NONE:
tsync_rx_ctl = 0;
tsync_rx_mtrl = 0;
- adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ aflags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
break;
case HWTSTAMP_FILTER_PTP_V1_L4_SYNC:
tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
tsync_rx_mtrl |= IXGBE_RXMTRL_V1_SYNC_MSG;
- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
break;
case HWTSTAMP_FILTER_PTP_V1_L4_DELAY_REQ:
tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_L4_V1;
tsync_rx_mtrl |= IXGBE_RXMTRL_V1_DELAY_REQ_MSG;
- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
break;
case HWTSTAMP_FILTER_PTP_V2_EVENT:
case HWTSTAMP_FILTER_PTP_V2_L2_EVENT:
@@ -1036,8 +1037,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_EVENT_V2;
is_l2 = true;
config->rx_filter = HWTSTAMP_FILTER_PTP_V2_EVENT;
- adapter->flags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
+ aflags |= (IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
+ IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
break;
case HWTSTAMP_FILTER_PTP_V1_L4_EVENT:
case HWTSTAMP_FILTER_NTP_ALL:
@@ -1048,7 +1049,7 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
if (hw->mac.type >= ixgbe_mac_X550) {
tsync_rx_ctl |= IXGBE_TSYNCRXCTL_TYPE_ALL;
config->rx_filter = HWTSTAMP_FILTER_ALL;
- adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
+ aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
break;
}
fallthrough;
@@ -1059,8 +1060,6 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
* Delay_Req messages and hardware does not support
* timestamping all packets => return error
*/
- adapter->flags &= ~(IXGBE_FLAG_RX_HWTSTAMP_ENABLED |
- IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER);
config->rx_filter = HWTSTAMP_FILTER_NONE;
return -ERANGE;
}
@@ -1092,8 +1091,8 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
IXGBE_TSYNCRXCTL_TYPE_ALL |
IXGBE_TSYNCRXCTL_TSIP_UT_EN;
config->rx_filter = HWTSTAMP_FILTER_ALL;
- adapter->flags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
- adapter->flags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER;
+ aflags |= IXGBE_FLAG_RX_HWTSTAMP_ENABLED;
+ aflags &= ~IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER;
is_l2 = true;
break;
default:
@@ -1126,6 +1125,9 @@ static int ixgbe_ptp_set_timestamp_mode(struct ixgbe_adapter *adapter,
IXGBE_WRITE_FLUSH(hw);
+ /* configure adapter flags only when HW is actually configured */
+ adapter->flags = aflags;
+
/* clear TX/RX time stamp registers, just to be sure */
ixgbe_ptp_clear_tx_timestamp(adapter);
IXGBE_READ_REG(hw, IXGBE_RXSTMPH);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 404/406] kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (402 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 403/406] ixgbe: fix timestamp configuration code Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 405/406] drm/amd/display: Fix a bug when searching for insert_above_mpcc Greg Kroah-Hartman
` (10 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit a22730b1b4bf437c6bbfdeff5feddf54be4aeada ]
syzkaller found a memory leak in kcm_sendmsg(), and commit c821a88bd720
("kcm: Fix memory leak in error path of kcm_sendmsg()") suppressed it by
updating kcm_tx_msg(head)->last_skb if partial data is copied so that the
following sendmsg() will resume from the skb.
However, we cannot know how many bytes were copied when we get the error.
Thus, we could mess up the MSG_MORE queue.
When kcm_sendmsg() fails for SOCK_DGRAM, we should purge the queue as we
do so for UDP by udp_flush_pending_frames().
Even without this change, when the error occurred, the following sendmsg()
resumed from a wrong skb and the queue was messed up. However, we have
yet to get such a report, and only syzkaller stumbled on it. So, this
can be changed safely.
Note this does not change SOCK_SEQPACKET behaviour.
Fixes: c821a88bd720 ("kcm: Fix memory leak in error path of kcm_sendmsg()")
Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20230912022753.33327-1-kuniyu@amazon.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/kcm/kcmsock.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index fb025406ea567..39b3c7fbf9f66 100644
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1064,17 +1064,18 @@ static int kcm_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
out_error:
kcm_push(kcm);
- if (copied && sock->type == SOCK_SEQPACKET) {
+ if (sock->type == SOCK_SEQPACKET) {
/* Wrote some bytes before encountering an
* error, return partial success.
*/
- goto partial_message;
- }
-
- if (head != kcm->seq_skb)
+ if (copied)
+ goto partial_message;
+ if (head != kcm->seq_skb)
+ kfree_skb(head);
+ } else {
kfree_skb(head);
- else if (copied)
- kcm_tx_msg(head)->last_skb = skb;
+ kcm->seq_skb = NULL;
+ }
err = sk_stream_error(sk, msg->msg_flags, err);
--
2.40.1
^ permalink raw reply related [flat|nested] 431+ messages in thread
* [PATCH 5.10 405/406] drm/amd/display: Fix a bug when searching for insert_above_mpcc
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (403 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 404/406] kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 406/406] parisc: Drop loops_per_jiffy from per_cpu struct Greg Kroah-Hartman
` (9 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Jun Lei, Tom Chung, Wesley Chalmers, Daniel Wheeler
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wesley Chalmers <wesley.chalmers@amd.com>
commit 3d028d5d60d516c536de1ddd3ebf3d55f3f8983b upstream.
[WHY]
Currently, when insert_plane is called with insert_above_mpcc
parameter that is equal to tree->opp_list, the function returns NULL.
[HOW]
Instead, the function should insert the plane at the top of the tree.
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Reviewed-by: Jun Lei <jun.lei@amd.com>
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Wesley Chalmers <wesley.chalmers@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c
@@ -206,8 +206,9 @@ struct mpcc *mpc1_insert_plane(
/* check insert_above_mpcc exist in tree->opp_list */
struct mpcc *temp_mpcc = tree->opp_list;
- while (temp_mpcc && temp_mpcc->mpcc_bot != insert_above_mpcc)
- temp_mpcc = temp_mpcc->mpcc_bot;
+ if (temp_mpcc != insert_above_mpcc)
+ while (temp_mpcc && temp_mpcc->mpcc_bot != insert_above_mpcc)
+ temp_mpcc = temp_mpcc->mpcc_bot;
if (temp_mpcc == NULL)
return NULL;
}
^ permalink raw reply [flat|nested] 431+ messages in thread
* [PATCH 5.10 406/406] parisc: Drop loops_per_jiffy from per_cpu struct
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (404 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 405/406] drm/amd/display: Fix a bug when searching for insert_above_mpcc Greg Kroah-Hartman
@ 2023-09-17 19:14 ` Greg Kroah-Hartman
2023-09-18 7:57 ` [PATCH 5.10 000/406] 5.10.195-rc1 review Pavel Machek
` (8 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-17 19:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller, Guenter Roeck
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Helge Deller <deller@gmx.de>
commit 93346da8ff47cc00f953c7f38a2d6ba11977fc42 upstream.
There is no need to keep a loops_per_jiffy value per cpu. Drop it.
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/include/asm/processor.h | 1 -
arch/parisc/kernel/processor.c | 5 ++---
2 files changed, 2 insertions(+), 4 deletions(-)
--- a/arch/parisc/include/asm/processor.h
+++ b/arch/parisc/include/asm/processor.h
@@ -97,7 +97,6 @@ struct cpuinfo_parisc {
unsigned long cpu_loc; /* CPU location from PAT firmware */
unsigned int state;
struct parisc_device *dev;
- unsigned long loops_per_jiffy;
};
extern struct system_cpuinfo_parisc boot_cpu_data;
--- a/arch/parisc/kernel/processor.c
+++ b/arch/parisc/kernel/processor.c
@@ -163,7 +163,6 @@ static int __init processor_probe(struct
if (cpuid)
memset(p, 0, sizeof(struct cpuinfo_parisc));
- p->loops_per_jiffy = loops_per_jiffy;
p->dev = dev; /* Save IODC data in case we need it */
p->hpa = dev->hpa.start; /* save CPU hpa */
p->cpuid = cpuid; /* save CPU id */
@@ -440,8 +439,8 @@ show_cpuinfo (struct seq_file *m, void *
show_cache_info(m);
seq_printf(m, "bogomips\t: %lu.%02lu\n",
- cpuinfo->loops_per_jiffy / (500000 / HZ),
- (cpuinfo->loops_per_jiffy / (5000 / HZ)) % 100);
+ loops_per_jiffy / (500000 / HZ),
+ loops_per_jiffy / (5000 / HZ) % 100);
seq_printf(m, "software id\t: %ld\n\n",
boot_cpu_data.pdc.model.sw_id);
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks
2023-09-17 19:12 ` [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks Greg Kroah-Hartman
@ 2023-09-17 20:21 ` Eduard Zingerman
2023-09-18 1:51 ` Alexei Starovoitov
0 siblings, 1 reply; 431+ messages in thread
From: Eduard Zingerman @ 2023-09-17 20:21 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, Yonghong Song, Alexei Starovoitov, Yafang Shao,
Alexei Starovoitov, gerhorst
On Sun, 2023-09-17 at 21:12 +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
I believe Luis Gerhorst posted an objection to this patch for 6.1 in [1],
for reasons described in [2]. The objection is relevant for 5.10 as well
(does not depend on kernel version, actually).
[1] https://lore.kernel.org/all/2023091653-peso-sprint-889d@gregkh/
[2] https://lore.kernel.org/bpf/20230913122827.91591-1-gerhorst@amazon.de/
>
> ------------------
>
> From: Yafang Shao <laoar.shao@gmail.com>
>
> commit d75e30dddf73449bc2d10bb8e2f1a2c446bc67a2 upstream.
>
> After we converted the capabilities of our networking-bpf program from
> cap_sys_admin to cap_net_admin+cap_bpf, our networking-bpf program
> failed to start. Because it failed the bpf verifier, and the error log
> is "R3 pointer comparison prohibited".
>
> A simple reproducer as follows,
>
> SEC("cls-ingress")
> int ingress(struct __sk_buff *skb)
> {
> struct iphdr *iph = (void *)(long)skb->data + sizeof(struct ethhdr);
>
> if ((long)(iph + 1) > (long)skb->data_end)
> return TC_ACT_STOLEN;
> return TC_ACT_OK;
> }
>
> Per discussion with Yonghong and Alexei [1], comparison of two packet
> pointers is not a pointer leak. This patch fixes it.
>
> Our local kernel is 6.1.y and we expect this fix to be backported to
> 6.1.y, so stable is CCed.
>
> [1]. https://lore.kernel.org/bpf/CAADnVQ+Nmspr7Si+pxWn8zkE7hX-7s93ugwC+94aXSy4uQ9vBg@mail.gmail.com/
>
> Suggested-by: Yonghong Song <yonghong.song@linux.dev>
> Suggested-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
> Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
> Acked-by: Eduard Zingerman <eddyz87@gmail.com>
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/r/20230823020703.3790-2-laoar.shao@gmail.com
> Signed-off-by: Alexei Starovoitov <ast@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> kernel/bpf/verifier.c | 17 +++++++++--------
> 1 file changed, 9 insertions(+), 8 deletions(-)
>
> --- a/kernel/bpf/verifier.c
> +++ b/kernel/bpf/verifier.c
> @@ -8178,6 +8178,12 @@ static int check_cond_jmp_op(struct bpf_
> return -EINVAL;
> }
>
> + /* check src2 operand */
> + err = check_reg_arg(env, insn->dst_reg, SRC_OP);
> + if (err)
> + return err;
> +
> + dst_reg = ®s[insn->dst_reg];
> if (BPF_SRC(insn->code) == BPF_X) {
> if (insn->imm != 0) {
> verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");
> @@ -8189,12 +8195,13 @@ static int check_cond_jmp_op(struct bpf_
> if (err)
> return err;
>
> - if (is_pointer_value(env, insn->src_reg)) {
> + src_reg = ®s[insn->src_reg];
> + if (!(reg_is_pkt_pointer_any(dst_reg) && reg_is_pkt_pointer_any(src_reg)) &&
> + is_pointer_value(env, insn->src_reg)) {
> verbose(env, "R%d pointer comparison prohibited\n",
> insn->src_reg);
> return -EACCES;
> }
> - src_reg = ®s[insn->src_reg];
> } else {
> if (insn->src_reg != BPF_REG_0) {
> verbose(env, "BPF_JMP/JMP32 uses reserved fields\n");
> @@ -8202,12 +8209,6 @@ static int check_cond_jmp_op(struct bpf_
> }
> }
>
> - /* check src2 operand */
> - err = check_reg_arg(env, insn->dst_reg, SRC_OP);
> - if (err)
> - return err;
> -
> - dst_reg = ®s[insn->dst_reg];
> is_jmp32 = BPF_CLASS(insn->code) == BPF_JMP32;
>
> if (BPF_SRC(insn->code) == BPF_K) {
>
>
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks
2023-09-17 20:21 ` Eduard Zingerman
@ 2023-09-18 1:51 ` Alexei Starovoitov
2023-09-18 7:07 ` Greg Kroah-Hartman
0 siblings, 1 reply; 431+ messages in thread
From: Alexei Starovoitov @ 2023-09-18 1:51 UTC (permalink / raw)
To: Eduard Zingerman
Cc: Greg Kroah-Hartman, stable, patches, Yonghong Song, Yafang Shao,
Alexei Starovoitov, gerhorst
On Sun, Sep 17, 2023 at 1:21 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
>
> On Sun, 2023-09-17 at 21:12 +0200, Greg Kroah-Hartman wrote:
> > 5.10-stable review patch. If anyone has any objections, please let me know.
>
> I believe Luis Gerhorst posted an objection to this patch for 6.1 in [1],
> for reasons described in [2]. The objection is relevant for 5.10 as well
> (does not depend on kernel version, actually).
Yes. Let's delay the backport of this patch until that thread is resolved.
> [1] https://lore.kernel.org/all/2023091653-peso-sprint-889d@gregkh/
> [2] https://lore.kernel.org/bpf/20230913122827.91591-1-gerhorst@amazon.de/
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation
2023-09-17 19:09 ` [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation Greg Kroah-Hartman
@ 2023-09-18 2:53 ` Eric Biggers
2023-09-18 7:14 ` Greg Kroah-Hartman
0 siblings, 1 reply; 431+ messages in thread
From: Eric Biggers @ 2023-09-18 2:53 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Ard Biesheuvel, Herbert Xu, Sasha Levin
On Sun, Sep 17, 2023 at 09:09:10PM +0200, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Eric Biggers <ebiggers@google.com>
>
> [ Upstream commit 28dcca4cc0c01e2467549a36b1b0eacfdb01236c ]
>
> Sync the BLAKE2b code with the BLAKE2s code as much as possible:
>
> - Move a lot of code into new headers <crypto/blake2b.h> and
> <crypto/internal/blake2b.h>, and adjust it to be like the
> corresponding BLAKE2s code, i.e. like <crypto/blake2s.h> and
> <crypto/internal/blake2s.h>.
>
> - Rename constants, e.g. BLAKE2B_*_DIGEST_SIZE => BLAKE2B_*_HASH_SIZE.
>
> - Use a macro BLAKE2B_ALG() to define the shash_alg structs.
>
> - Export blake2b_compress_generic() for use as a fallback.
>
> This makes it much easier to add optimized implementations of BLAKE2b,
> as optimized implementations can use the helper functions
> crypto_blake2b_{setkey,init,update,final}() and
> blake2b_compress_generic(). The ARM implementation will use these.
>
> But this change is also helpful because it eliminates unnecessary
> differences between the BLAKE2b and BLAKE2s code, so that the same
> improvements can easily be made to both. (The two algorithms are
> basically identical, except for the word size and constants.) It also
> makes it straightforward to add a library API for BLAKE2b in the future
> if/when it's needed.
>
> This change does make the BLAKE2b code slightly more complicated than it
> needs to be, as it doesn't actually provide a library API yet. For
> example, __blake2b_update() doesn't really need to exist yet; it could
> just be inlined into crypto_blake2b_update(). But I believe this is
> outweighed by the benefits of keeping the code in sync.
>
> Signed-off-by: Eric Biggers <ebiggers@google.com>
> Acked-by: Ard Biesheuvel <ardb@kernel.org>
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> Stable-dep-of: 9ae4577bc077 ("crypto: api - Use work queue in crypto_destroy_instance")
> Signed-off-by: Sasha Levin <sashal@kernel.org>
1.) This isn't a Stable-dep-of 9ae4577bc077. I don't see why this is being
backported.
2.) On lore.kernel.org, there is no record of this patch being queued to 5.10.
See https://lore.kernel.org/all/?q=%22sync+with+blake2s+implementation%22. The
first mention of 5.10 and this patch is this thread, which is already the -rc1
review. I guess the only list that the initial "patch was queued" email was
sent to is stable-commits, and stable-commits is not archived on
lore.kernel.org. That is surprising and makes it harder for people to give
feedback on patches going into stable. stable-commits should be archived on
lore.kernel.lorg, and patches should generally be sent to more lists as well.
(I'm probably shouting into a void here as I've given this same feedback on
other patches before and nothing changed, but here it is again...)
- Eric
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks
2023-09-18 1:51 ` Alexei Starovoitov
@ 2023-09-18 7:07 ` Greg Kroah-Hartman
0 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-18 7:07 UTC (permalink / raw)
To: Alexei Starovoitov
Cc: Eduard Zingerman, stable, patches, Yonghong Song, Yafang Shao,
Alexei Starovoitov, gerhorst
On Sun, Sep 17, 2023 at 06:51:14PM -0700, Alexei Starovoitov wrote:
> On Sun, Sep 17, 2023 at 1:21 PM Eduard Zingerman <eddyz87@gmail.com> wrote:
> >
> > On Sun, 2023-09-17 at 21:12 +0200, Greg Kroah-Hartman wrote:
> > > 5.10-stable review patch. If anyone has any objections, please let me know.
> >
> > I believe Luis Gerhorst posted an objection to this patch for 6.1 in [1],
> > for reasons described in [2]. The objection is relevant for 5.10 as well
> > (does not depend on kernel version, actually).
>
> Yes. Let's delay the backport of this patch until that thread is resolved.
Ok, but note, this is already in a released 6.1.y and 6.5.y release so
we need fixes in there for whatever ends up in Linus's tree to resolve
this. I'll drop this from the pending queues right now for now.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation
2023-09-18 2:53 ` Eric Biggers
@ 2023-09-18 7:14 ` Greg Kroah-Hartman
0 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-18 7:14 UTC (permalink / raw)
To: Eric Biggers; +Cc: stable, patches, Ard Biesheuvel, Herbert Xu, Sasha Levin
On Sun, Sep 17, 2023 at 07:53:18PM -0700, Eric Biggers wrote:
> On Sun, Sep 17, 2023 at 09:09:10PM +0200, Greg Kroah-Hartman wrote:
> > 5.10-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Eric Biggers <ebiggers@google.com>
> >
> > [ Upstream commit 28dcca4cc0c01e2467549a36b1b0eacfdb01236c ]
> >
> > Sync the BLAKE2b code with the BLAKE2s code as much as possible:
> >
> > - Move a lot of code into new headers <crypto/blake2b.h> and
> > <crypto/internal/blake2b.h>, and adjust it to be like the
> > corresponding BLAKE2s code, i.e. like <crypto/blake2s.h> and
> > <crypto/internal/blake2s.h>.
> >
> > - Rename constants, e.g. BLAKE2B_*_DIGEST_SIZE => BLAKE2B_*_HASH_SIZE.
> >
> > - Use a macro BLAKE2B_ALG() to define the shash_alg structs.
> >
> > - Export blake2b_compress_generic() for use as a fallback.
> >
> > This makes it much easier to add optimized implementations of BLAKE2b,
> > as optimized implementations can use the helper functions
> > crypto_blake2b_{setkey,init,update,final}() and
> > blake2b_compress_generic(). The ARM implementation will use these.
> >
> > But this change is also helpful because it eliminates unnecessary
> > differences between the BLAKE2b and BLAKE2s code, so that the same
> > improvements can easily be made to both. (The two algorithms are
> > basically identical, except for the word size and constants.) It also
> > makes it straightforward to add a library API for BLAKE2b in the future
> > if/when it's needed.
> >
> > This change does make the BLAKE2b code slightly more complicated than it
> > needs to be, as it doesn't actually provide a library API yet. For
> > example, __blake2b_update() doesn't really need to exist yet; it could
> > just be inlined into crypto_blake2b_update(). But I believe this is
> > outweighed by the benefits of keeping the code in sync.
> >
> > Signed-off-by: Eric Biggers <ebiggers@google.com>
> > Acked-by: Ard Biesheuvel <ardb@kernel.org>
> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> > Stable-dep-of: 9ae4577bc077 ("crypto: api - Use work queue in crypto_destroy_instance")
> > Signed-off-by: Sasha Levin <sashal@kernel.org>
>
> 1.) This isn't a Stable-dep-of 9ae4577bc077. I don't see why this is being
> backported.
Odd, I don't know why either, Sasha's tools must have picked this up
incorrectly. Now dropped.
> 2.) On lore.kernel.org, there is no record of this patch being queued to 5.10.
> See https://lore.kernel.org/all/?q=%22sync+with+blake2s+implementation%22. The
> first mention of 5.10 and this patch is this thread, which is already the -rc1
> review. I guess the only list that the initial "patch was queued" email was
> sent to is stable-commits, and stable-commits is not archived on
> lore.kernel.org. That is surprising and makes it harder for people to give
> feedback on patches going into stable. stable-commits should be archived on
> lore.kernel.lorg, and patches should generally be sent to more lists as well.
> (I'm probably shouting into a void here as I've given this same feedback on
> other patches before and nothing changed, but here it is again...)
I'll figure out how to sign this list up to lore. We got complaints
when we were sending these emails to lkml, which is fair, but I thought
lore was subscribed to the list already, sorry about that.
greg k-h
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (405 preceding siblings ...)
2023-09-17 19:14 ` [PATCH 5.10 406/406] parisc: Drop loops_per_jiffy from per_cpu struct Greg Kroah-Hartman
@ 2023-09-18 7:57 ` Pavel Machek
2023-09-18 12:46 ` Jon Hunter
` (7 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Pavel Machek @ 2023-09-18 7:57 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
[-- Attachment #1: Type: text/plain, Size: 662 bytes --]
Hi!
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
CIP testing did not find any problems here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Tested-by: Pavel Machek (CIP) <pavel@denx.de>
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (406 preceding siblings ...)
2023-09-18 7:57 ` [PATCH 5.10 000/406] 5.10.195-rc1 review Pavel Machek
@ 2023-09-18 12:46 ` Jon Hunter
2023-09-18 17:46 ` Florian Fainelli
` (6 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Jon Hunter @ 2023-09-18 12:46 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, linux-tegra, stable
On Sun, 17 Sep 2023 21:07:34 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
11 builds: 11 pass, 0 fail
28 boots: 28 pass, 0 fail
75 tests: 75 pass, 0 fail
Linux version: 5.10.195-rc1-g95379666b7a6
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
2023-09-17 19:11 ` [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false Greg Kroah-Hartman
@ 2023-09-18 14:00 ` Marek Behún
2023-09-18 15:22 ` Greg Kroah-Hartman
0 siblings, 1 reply; 431+ messages in thread
From: Marek Behún @ 2023-09-18 14:00 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: stable, patches, Lee Jones, Sasha Levin
Greg, please drop this patch from both 5.10 and 5.15.
Reference:
https://lore.kernel.org/linux-leds/ZQLelWcNjjp2xndY@duo.ucw.cz/T/
I am going to send a fix to drop the check altogether.
Marek
On Sun, 17 Sep 2023 21:11:55 +0200
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Marek Behún <kabel@kernel.org>
>
> [ Upstream commit c3f853184bed04105682383c2971798c572226b5 ]
>
> At the time we call
> BUG_ON(props.color == LED_COLOR_ID_MULTI);
> the props variable is still initialized to zero.
>
> Call the BUG_ON only after we parse fwnode into props.
>
> Fixes: 77dce3a22e89 ("leds: disallow /sys/class/leds/*:multi:* for now")
> Signed-off-by: Marek Behún <kabel@kernel.org>
> Link: https://lore.kernel.org/r/20230801151623.30387-1-kabel@kernel.org
> Signed-off-by: Lee Jones <lee@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/leds/led-core.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c
> index c4e780bdb3852..2cf5897339ac1 100644
> --- a/drivers/leds/led-core.c
> +++ b/drivers/leds/led-core.c
> @@ -425,15 +425,15 @@ int led_compose_name(struct device *dev, struct led_init_data *init_data,
> struct fwnode_handle *fwnode = init_data->fwnode;
> const char *devicename = init_data->devicename;
>
> - /* We want to label LEDs that can produce full range of colors
> - * as RGB, not multicolor */
> - BUG_ON(props.color == LED_COLOR_ID_MULTI);
> -
> if (!led_classdev_name)
> return -EINVAL;
>
> led_parse_fwnode_props(dev, fwnode, &props);
>
> + /* We want to label LEDs that can produce full range of colors
> + * as RGB, not multicolor */
> + BUG_ON(props.color == LED_COLOR_ID_MULTI);
> +
> if (props.label) {
> /*
> * If init_data.devicename is NULL, then it indicates that
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
2023-09-18 14:00 ` Marek Behún
@ 2023-09-18 15:22 ` Greg Kroah-Hartman
2023-09-18 16:17 ` Marek Behún
0 siblings, 1 reply; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-18 15:22 UTC (permalink / raw)
To: Marek Behún; +Cc: stable, patches, Lee Jones, Sasha Levin
On Mon, Sep 18, 2023 at 04:00:04PM +0200, Marek Behún wrote:
> Greg, please drop this patch from both 5.10 and 5.15.
>
> Reference:
> https://lore.kernel.org/linux-leds/ZQLelWcNjjp2xndY@duo.ucw.cz/T/
But this is already in released kernels:
6.1.53 6.4.16 6.5.3 6.6-rc1
> I am going to send a fix to drop the check altogether.
We will be glad to queue up the fix as well when it hits Linus's tree,
please be sure to tag it for stable backporting so we can get it in all
locations.
But for now, being bug-compatible makes more sense, right? Or is this
really critical and should not be in these kernels now?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
2023-09-18 15:22 ` Greg Kroah-Hartman
@ 2023-09-18 16:17 ` Marek Behún
2023-09-19 7:57 ` Greg Kroah-Hartman
0 siblings, 1 reply; 431+ messages in thread
From: Marek Behún @ 2023-09-18 16:17 UTC (permalink / raw)
To: Greg Kroah-Hartman; +Cc: stable, patches, Lee Jones, Sasha Levin
On Mon, 18 Sep 2023 17:22:59 +0200
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> On Mon, Sep 18, 2023 at 04:00:04PM +0200, Marek Behún wrote:
> > Greg, please drop this patch from both 5.10 and 5.15.
> >
> > Reference:
> > https://lore.kernel.org/linux-leds/ZQLelWcNjjp2xndY@duo.ucw.cz/T/
>
> But this is already in released kernels:
> 6.1.53 6.4.16 6.5.3 6.6-rc1
>
> > I am going to send a fix to drop the check altogether.
>
> We will be glad to queue up the fix as well when it hits Linus's tree,
> please be sure to tag it for stable backporting so we can get it in all
> locations.
>
> But for now, being bug-compatible makes more sense, right? Or is this
> really critical and should not be in these kernels now?
According to that e-mail, the patch breaks booting for some systems, so
if it would be possible to avoid it...
I've sent a fixup patch which removes the BUG_ON altogether, and
referenced the patch that broke booting in the Fixes tag. But I don't
know how long it will take to hit Linus' tree, it may take several
weeks.
Marek
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (407 preceding siblings ...)
2023-09-18 12:46 ` Jon Hunter
@ 2023-09-18 17:46 ` Florian Fainelli
2023-09-18 18:33 ` Guenter Roeck
` (5 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Florian Fainelli @ 2023-09-18 17:46 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor
On 9/17/2023 12:07 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (408 preceding siblings ...)
2023-09-18 17:46 ` Florian Fainelli
@ 2023-09-18 18:33 ` Guenter Roeck
2023-09-18 22:25 ` Shuah Khan
` (4 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Guenter Roeck @ 2023-09-18 18:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On Sun, Sep 17, 2023 at 09:07:34PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 159 pass: 159 fail: 0
Qemu test results:
total: 495 pass: 495 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (409 preceding siblings ...)
2023-09-18 18:33 ` Guenter Roeck
@ 2023-09-18 22:25 ` Shuah Khan
2023-09-18 22:27 ` Shuah Khan
` (3 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Shuah Khan @ 2023-09-18 22:25 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Shuah Khan
On 9/17/23 13:07, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (410 preceding siblings ...)
2023-09-18 22:25 ` Shuah Khan
@ 2023-09-18 22:27 ` Shuah Khan
2023-09-19 8:03 ` Naresh Kamboju
` (2 subsequent siblings)
414 siblings, 0 replies; 431+ messages in thread
From: Shuah Khan @ 2023-09-18 22:27 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, Shuah Khan
On 9/17/23 13:07, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
2023-09-18 16:17 ` Marek Behún
@ 2023-09-19 7:57 ` Greg Kroah-Hartman
0 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-19 7:57 UTC (permalink / raw)
To: Marek Behún; +Cc: stable, patches, Lee Jones, Sasha Levin
On Mon, Sep 18, 2023 at 06:17:27PM +0200, Marek Behún wrote:
> On Mon, 18 Sep 2023 17:22:59 +0200
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> > On Mon, Sep 18, 2023 at 04:00:04PM +0200, Marek Behún wrote:
> > > Greg, please drop this patch from both 5.10 and 5.15.
> > >
> > > Reference:
> > > https://lore.kernel.org/linux-leds/ZQLelWcNjjp2xndY@duo.ucw.cz/T/
> >
> > But this is already in released kernels:
> > 6.1.53 6.4.16 6.5.3 6.6-rc1
> >
> > > I am going to send a fix to drop the check altogether.
> >
> > We will be glad to queue up the fix as well when it hits Linus's tree,
> > please be sure to tag it for stable backporting so we can get it in all
> > locations.
> >
> > But for now, being bug-compatible makes more sense, right? Or is this
> > really critical and should not be in these kernels now?
>
> According to that e-mail, the patch breaks booting for some systems, so
> if it would be possible to avoid it...
>
> I've sent a fixup patch which removes the BUG_ON altogether, and
> referenced the patch that broke booting in the Fixes tag. But I don't
> know how long it will take to hit Linus' tree, it may take several
> weeks.
Ok, thanks, now dropped from these trees. Please pester the maintainers
to get this merged into Linus's tree soon so that the other stable trees
can be fixed up as well.
greg k-h
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (411 preceding siblings ...)
2023-09-18 22:27 ` Shuah Khan
@ 2023-09-19 8:03 ` Naresh Kamboju
2023-09-20 4:57 ` Guenter Roeck
2023-09-21 20:35 ` Joel Fernandes
414 siblings, 0 replies; 431+ messages in thread
From: Naresh Kamboju @ 2023-09-19 8:03 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Mon, 18 Sept 2023 at 00:47, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 5.10.195-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-5.10.y
* git commit: 95379666b7a68327e8f4c3a0dbf28ae0c479ab4c
* git describe: v5.10.194-407-g95379666b7a6
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.194-407-g95379666b7a6
## Test Regressions (compared to v5.10.194)
## Metric Regressions (compared to v5.10.194)
## Test Fixes (compared to v5.10.194)
## Metric Fixes (compared to v5.10.194)
## Test result summary
total: 80823, pass: 63120, fail: 2111, skip: 15541, xfail: 51
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 111 total, 111 passed, 0 failed
* arm64: 38 total, 38 passed, 0 failed
* i386: 28 total, 28 passed, 0 failed
* mips: 23 total, 23 passed, 0 failed
* parisc: 3 total, 0 passed, 3 failed
* powerpc: 23 total, 23 passed, 0 failed
* riscv: 8 total, 8 passed, 0 failed
* s390: 9 total, 9 passed, 0 failed
* sh: 11 total, 11 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 33 total, 33 passed, 0 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-lib
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timens
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-vm
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (412 preceding siblings ...)
2023-09-19 8:03 ` Naresh Kamboju
@ 2023-09-20 4:57 ` Guenter Roeck
2023-09-20 8:11 ` Greg Kroah-Hartman
2023-09-21 20:35 ` Joel Fernandes
414 siblings, 1 reply; 431+ messages in thread
From: Guenter Roeck @ 2023-09-20 4:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On 9/17/23 12:07, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
chromeos-5.10 locks up in configfs_lookup() after the merge of v5.10.195.
I am a bit puzzled because I see
c709c7ca020a configfs: fix a race in configfs_lookup()
in v5.10.195 but not in the list of commits below. I guess I must be
missing something.
Either case, the code now looks as follows.
configfs_lookup()
{
...
spin_lock(&configfs_dirent_lock);
...
err = configfs_attach_attr(sd, dentry);
...
spin_unlock(&configfs_dirent_lock);
...
}
and
configfs_attach_attr(...)
{
...
spin_lock(&configfs_dirent_lock);
...
}
which unless it is way too late here and I really need to go to sleep
just won't work.
Guenter
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.195-rc1
>
> Helge Deller <deller@gmx.de>
> parisc: Drop loops_per_jiffy from per_cpu struct
>
> Wesley Chalmers <wesley.chalmers@amd.com>
> drm/amd/display: Fix a bug when searching for insert_above_mpcc
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
>
> Vadim Fedorenko <vadim.fedorenko@linux.dev>
> ixgbe: fix timestamp configuration code
>
> Eric Dumazet <edumazet@google.com>
> ipv6: fix ip6_sock_set_addr_preferences() typo
>
> Liu Jian <liujian56@huawei.com>
> net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
>
> Liming Sun <limings@nvidia.com>
> platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
>
> Liming Sun <limings@nvidia.com>
> platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
>
> Shigeru Yoshida <syoshida@redhat.com>
> kcm: Fix memory leak in error path of kcm_sendmsg()
>
> Hayes Wang <hayeswang@realtek.com>
> r8152: check budget for r8152_poll()
>
> Ziyang Xuan <william.xuanziyang@huawei.com>
> hsr: Fix uninit-value access in fill_frame_info()
>
> Hangyu Hua <hbh25y@gmail.com>
> net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
>
> Hangyu Hua <hbh25y@gmail.com>
> net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
>
> Guangguan Wang <guangguan.wang@linux.alibaba.com>
> net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
>
> Björn Töpel <bjorn@rivosinc.com>
> kselftest/runner.sh: Propagate SIGTERM to runner child
>
> SeongJae Park <sjpark@amazon.de>
> selftests/kselftest/runner/run_one(): allow running non-executable files
>
> Liu Jian <liujian56@huawei.com>
> net: ipv4: fix one memleak in __inet_del_ifa()
>
> Qiang Yu <quic_qianyu@quicinc.com>
> bus: mhi: host: Skip MHI reset if device is in RDDM
>
> Aleksey Nasibulin <alealexpro100@ya.ru>
> ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
>
> Paul Cercueil <paul@crapouillou.net>
> ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Flush mailbox commands on chip reset
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix crash in PCIe error handling
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
>
> Saurav Kashyap <skashyap@marvell.com>
> scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
>
> D Scott Phillips <scott@os.amperecomputing.com>
> arm64: sdei: abort running SDEI handlers during crash
>
> Shuai Xue <xueshuai@linux.alibaba.com>
> ACPI: APEI: explicit init of HEST and GHES in apci_init()
>
> Namhyung Kim <namhyung@kernel.org>
> perf hists browser: Fix the number of entries for 'e' key
>
> Namhyung Kim <namhyung@kernel.org>
> perf tools: Handle old data in PERF_RECORD_ATTR
>
> Namhyung Kim <namhyung@kernel.org>
> perf hists browser: Fix hierarchy mode header
>
> Hamza Mahfooz <hamza.mahfooz@amd.com>
> drm/amd/display: prevent potential division by zero errors
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix potential false time out warning
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix crash during the panic_write
>
> Anand Jain <anand.jain@oracle.com>
> btrfs: use the correct superblock to compare fsid in btrfs_validate_super
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
>
> ruanmeisi <ruan.meisi@zte.com.cn>
> fuse: nlookup missing decrement in fuse_direntplus_link
>
> Damien Le Moal <dlemoal@kernel.org>
> ata: pata_ftide010: Add missing MODULE_DESCRIPTION
>
> Damien Le Moal <dlemoal@kernel.org>
> ata: sata_gemini: Add missing MODULE_DESCRIPTION
>
> Wang Jianjian <wangjianjian0@foxmail.com>
> ext4: add correct group descriptors and reserved GDT blocks to system zone
>
> Petr Tesarik <petr.tesarik.ext@huawei.com>
> sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
>
> Yisen Zhuang <yisen.zhuang@huawei.com>
> net: hns3: fix the port information display when sfp is absent
>
> Wander Lairson Costa <wander@redhat.com>
> netfilter: nfnetlink_osf: avoid OOB read
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
>
> Eric Dumazet <edumazet@google.com>
> ip_tunnels: use DEV_STATS_INC()
>
> Ariel Marcovitch <arielmarcovitch@gmail.com>
> idr: fix param name in idr_alloc_cyclic() doc
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> s390/zcrypt: don't leak memory if dev_set_name() fails
>
> Olga Zaborska <olga.zaborska@intel.com>
> igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
>
> Olga Zaborska <olga.zaborska@intel.com>
> igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
>
> Olga Zaborska <olga.zaborska@intel.com>
> igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
>
> Shigeru Yoshida <syoshida@redhat.com>
> kcm: Destroy mutex in kcm_exit_net()
>
> valis <sec@valis.email>
> net: sched: sch_qfq: Fix UAF in qfq_dequeue()
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data race around sk->sk_err.
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data-races around sk->sk_shutdown.
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data-race around unix_tot_inflight.
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data-races around user->unix_inflight.
>
> Alex Henrie <alexhenrie24@gmail.com>
> net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
>
> Liang Chen <liangchen.linux@gmail.com>
> veth: Fixing transmit return status for dropped packets
>
> Corinna Vinschen <vinschen@redhat.com>
> igb: disable virtualization features on 82580
>
> Sriram Yagnaraman <sriram.yagnaraman@est.tech>
> ipv4: ignore dst hint for multipath routes
>
> Sean Christopherson <seanjc@google.com>
> drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
>
> Colin Xu <colin.xu@intel.com>
> drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
>
> Eric Dumazet <edumazet@google.com>
> net: read sk->sk_family once in sk_mc_loop()
>
> Eric Dumazet <edumazet@google.com>
> ipv4: annotate data-races around fi->fib_dead
>
> Eric Dumazet <edumazet@google.com>
> sctp: annotate data-races around sk->sk_wmem_queued
>
> Eric Dumazet <edumazet@google.com>
> net/sched: fq_pie: avoid stalls in fq_pie_timer()
>
> Vladimir Zapolskiy <vz@mleia.com>
> pwm: lpc32xx: Remove handling of PWM channels
>
> Raag Jadav <raag.jadav@intel.com>
> watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
>
> Arnaldo Carvalho de Melo <acme@redhat.com>
> perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
>
> Sean Christopherson <seanjc@google.com>
> x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
>
> Arnaldo Carvalho de Melo <acme@redhat.com>
> perf annotate bpf: Don't enclose non-debug code with an assert()
>
> Ying Liu <victor.liu@nxp.com>
> backlight: gpio_backlight: Drop output GPIO direction check for initial power state
>
> Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
> kconfig: fix possible buffer overflow
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Fix a potential data corruption
>
> Chris Lew <quic_clew@quicinc.com>
> soc: qcom: qmi_encdec: Restrict string length in decode
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
>
> Ahmad Fatoum <a.fatoum@pengutronix.de>
> clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> dt-bindings: clock: xlnx,versal-clk: drop select:false
>
> Raag Jadav <raag.jadav@intel.com>
> pinctrl: cherryview: fix address_space_handler() argument
>
> Helge Deller <deller@gmx.de>
> parisc: led: Reduce CPU overhead for disk & lan LED computation
>
> Helge Deller <deller@gmx.de>
> parisc: led: Fix LAN receive and transmit LEDs
>
> Andrew Donnellan <ajd@linux.ibm.com>
> lib/test_meminit: allocate pages up to order MAX_ORDER
>
> Thomas Zimmermann <tzimmermann@suse.de>
> drm/ast: Fix DRAM init on AST2200
>
> Thomas Zimmermann <tzimmermann@suse.de>
> fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
>
> Manish Rangankar <mrangankar@marvell.com>
> scsi: qla2xxx: Remove unsupported ql2xenabledif option
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Turn off noisy message log
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix erroneous link up failure
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: fix inconsistent TMF timeout
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix deletion race condition
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: break iopolling on signal
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: break out of iowq iopoll on teardown
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: always lock in io_apoll_task_func
>
> Quan Tian <qtian@vmware.com>
> net/ipv6: SKB symmetric hash should incorporate transport ports
>
> Tom Rix <trix@redhat.com>
> udf: initialize newblock to 0
>
> Yu Kuai <yukuai3@huawei.com>
> md/md-bitmap: remove unnecessary local variable in backlog_store()
>
> Brian Foster <bfoster@redhat.com>
> tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
>
> Marco Felsch <m.felsch@pengutronix.de>
> usb: typec: tcpci: clear the fault status bit
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Fix oversight in SuperSpeed initialization
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Change usb_get_device_descriptor() API
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Unite old scheme and new scheme descriptor reads
>
> RD Babiera <rdbabiera@google.com>
> usb: typec: bus: verify partner exists in typec_altmode_attention
>
> Gustavo A. R. Silva <gustavoars@kernel.org>
> cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
>
> Thomas Bourgoin <thomas.bourgoin@foss.st.com>
> crypto: stm32 - fix loop iterating through scatterlist for DMA
>
> Sven Schnelle <svens@linux.ibm.com>
> s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
>
> Enlin Mu <enlin.mu@unisoc.com>
> pstore/ram: Check start of empty przs during init
>
> Eric Biggers <ebiggers@google.com>
> fsverity: skip PKCS#7 parser when keyring is empty
>
> Nicolas Dichtel <nicolas.dichtel@6wind.com>
> net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
>
> Thore Sommer <public@thson.de>
> X.509: if signature is unsupported skip validation
>
> Jann Horn <jannh@google.com>
> dccp: Fix out of bounds access in DCCP error handler
>
> Alexander Aring <aahringo@redhat.com>
> dlm: fix plock lookup when using multiple lockspaces
>
> Yafang Shao <laoar.shao@gmail.com>
> bpf: Fix issue in verifying allow_ptr_leaks
>
> Helge Deller <deller@gmx.de>
> parisc: Fix /proc/cpuinfo output for lscpu
>
> Aleksa Sarai <cyphar@cyphar.com>
> procfs: block chmod on /proc/thread-self/comm
>
> Bjorn Helgaas <bhelgaas@google.com>
> Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
>
> Dave Jiang <dave.jiang@intel.com>
> ntb: Fix calculation ntb_transport_tx_free_entry()
>
> Dave Jiang <dave.jiang@intel.com>
> ntb: Clean up tx tail index on link down
>
> Dave Jiang <dave.jiang@intel.com>
> ntb: Drop packets when qp link is down
>
> Ranjan Kumar <ranjan.kumar@broadcom.com>
> scsi: mpt3sas: Perform additional retries if doorbell read returns 0
>
> Nilesh Javali <njavali@marvell.com>
> Revert "scsi: qla2xxx: Fix buffer overrun"
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> media: dvb: symbol fixup for dvb_attach()
>
> Will Deacon <will@kernel.org>
> arm64: csum: Fix OoB access in IP checksum code for negative lengths
>
> Max Filippov <jcmvbkbc@gmail.com>
> xtensa: PMU: fix base address for the newer hardware
>
> Thomas Zimmermann <tzimmermann@suse.de>
> backlight/lv5207lp: Compare against struct fb_info.device
>
> Thomas Zimmermann <tzimmermann@suse.de>
> backlight/bd6107: Compare against struct fb_info.device
>
> Thomas Zimmermann <tzimmermann@suse.de>
> backlight/gpio_backlight: Compare against struct fb_info.device
>
> Gustavo A. R. Silva <gustavoars@kernel.org>
> ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
>
> Yi Yang <yiyang13@huawei.com>
> ipmi_si: fix a memleak in try_smi_init()
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: core: Fix the scsi_set_resid() documentation
>
> Kees Cook <keescook@chromium.org>
> printk: ringbuffer: Fix truncating buffer size min_t cast
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
>
> Boris Brezillon <boris.brezillon@collabora.com>
> PM / devfreq: Fix leak in devfreq_dev_release()
>
> Radoslaw Tyl <radoslawx.tyl@intel.com>
> igb: set max size RX buffer when store bad packet is enabled
>
> Mohamed Khalfella <mkhalfella@purestorage.com>
> skbuff: skb_segment, Call zero copy functions before using skbuff frags
>
> Wander Lairson Costa <wander@redhat.com>
> netfilter: xt_sctp: validate the flag_info count
>
> Wander Lairson Costa <wander@redhat.com>
> netfilter: xt_u32: validate user space input
>
> Kyle Zeng <zengyhkyle@gmail.com>
> netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
>
> Eric Dumazet <edumazet@google.com>
> igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
>
> Yuan Yao <yuanyaogoog@chromium.org>
> virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
>
> Liao Chang <liaochang1@huawei.com>
> cpufreq: Fix the race condition while updating the transition_task of policy
>
> ruanjinjie <ruanjinjie@huawei.com>
> dmaengine: ste_dma40: Add missing IRQ check in d40_probe
>
> Randy Dunlap <rdunlap@infradead.org>
> um: Fix hostaudio build errors
>
> Yi Yang <yiyang13@huawei.com>
> mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
>
> Hsin-Yi Wang <hsinyi@chromium.org>
> mtd: spi-nor: Check bus width while setting QE bit
>
> Marek Behún <kabel@kernel.org>
> leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> rpmsg: glink: Add check for kstrdup
>
> Jonas Karlman <jonas@kwiboo.se>
> phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
>
> Zheng Yang <zhengyang@rock-chips.com>
> phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
>
> Jonas Karlman <jonas@kwiboo.se>
> phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix mtd oobsize
>
> Zheng Yejian <zhengyejian1@huawei.com>
> tracing: Fix race issue between cpu buffer write and swap
>
> Dave Hansen <dave.hansen@linux.intel.com>
> x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
>
> Rahul Rameshbabu <sergeantsagara@protonmail.com>
> HID: multitouch: Correct devm device reference for hidinput input_dev name
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
>
> Guoqing Jiang <guoqing.jiang@linux.dev>
> RDMA/siw: Correct wrong debug message
>
> Guoqing Jiang <guoqing.jiang@linux.dev>
> RDMA/siw: Balance the reference of cep->kref in the error path
>
> Leon Romanovsky <leon@kernel.org>
> Revert "IB/isert: Fix incorrect release of isert connection"
>
> Peng Fan <peng.fan@nxp.com>
> amba: bus: fix refcount leak
>
> Yi Yang <yiyang13@huawei.com>
> serial: tegra: handle clk prepare error in tegra_uart_hw_init()
>
> Chengfeng Ye <dg573847474@gmail.com>
> scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
>
> Tony Battersby <tonyb@cybernetics.com>
> scsi: core: Use 32-bit hostnum in scsi_host_lookup()
>
> Lu Jialin <lujialin4@huawei.com>
> cgroup:namespace: Remove unused cgroup_namespaces_init()
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Fix vflip / hflip set functions
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Fix ov2680_bayer_order()
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Remove auto-gain and auto-exposure controls
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
>
> Marek Vasut <marex@denx.de>
> media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: gadget: f_mass_storage: Fix unused variable warning
>
> Colin Ian King <colin.i.king@gmail.com>
> media: go7007: Remove redundant if statement
>
> Yanfei Xu <yanfei.xu@intel.com>
> iommu/vt-d: Fix to flush cache of PASID directory table
>
> AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
> iommu/qcom: Disable and reset context bank before programming
>
> Eddie James <eajames@linux.ibm.com>
> fsi: aspeed: Reset master errors after CFAM reset
>
> Xiang Yang <xiangyang3@huawei.com>
> IB/uverbs: Fix an potential error pointer dereference
>
> Dan Carpenter <dan.carpenter@linaro.org>
> driver core: test_async: fix an error code
>
> Rob Clark <robdclark@chromium.org>
> dma-buf/sync_file: Fix docs syntax
>
> Ruidong Tian <tianruidong@linux.alibaba.com>
> coresight: tmc: Explicit type conversions to prevent integer overflow
>
> Oleksandr Natalenko <oleksandr@redhat.com>
> scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
>
> Oleksandr Natalenko <oleksandr@redhat.com>
> scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
>
> Oleksandr Natalenko <oleksandr@redhat.com>
> scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
>
> Randy Dunlap <rdunlap@infradead.org>
> x86/APM: drop the duplicate APM_MINOR_DEV macro
>
> Chunyan Zhang <chunyan.zhang@unisoc.com>
> serial: sprd: Fix DMA buffer leak issue
>
> Chunyan Zhang <chunyan.zhang@unisoc.com>
> serial: sprd: Assign sprd_port after initialized to avoid wrong access
>
> Lin Ma <linma@zju.edu.cn>
> scsi: qla4xxx: Add length check when parsing nlattrs
>
> Lin Ma <linma@zju.edu.cn>
> scsi: be2iscsi: Add length check when parsing nlattrs
>
> Lin Ma <linma@zju.edu.cn>
> scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
>
> Lin Ma <linma@zju.edu.cn>
> scsi: iscsi: Add length check for nlattr payload
>
> Wenchao Hao <haowenchao@huawei.com>
> scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: RDMA/srp: Fix residual handling
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
>
> Irui Wang <irui.wang@mediatek.com>
> media: mediatek: vcodec: Return NULL if no vdec_fb is found
>
> Benjamin Gaignard <benjamin.gaignard@collabora.com>
> media: rkvdec: increase max supported height for H.264
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Fix normally completed I/O analysed as failed
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Fix warnings detected by sparse
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Modify v3 HW SATA completion error processing
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Modify v3 HW SSP underflow error processing
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: libsas: Introduce more SAM status code aliases in enum exec_status
>
> Luo Jiaxing <luojiaxing@huawei.com>
> scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
>
> Daniil Dulov <d.dulov@aladdin.ru>
> media: cx24120: Add retval check for cx24120_message_send()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
>
> Daniil Dulov <d.dulov@aladdin.ru>
> media: dib7000p: Fix potential division by zero
>
> Dongliang Mu <dzm91@hust.edu.cn>
> drivers: usb: smsusb: fix error handling code in smsusb_init_device
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> media: i2c: tvp5150: check return value of devm_kasprintf()
>
> Hans de Goede <hdegoede@redhat.com>
> media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
>
> Olga Kornievskaia <kolga@netapp.com>
> NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
>
> Benjamin Coddington <bcodding@redhat.com>
> NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
>
> Chuck Lever <chuck.lever@oracle.com>
> NFSD: da_addr_body field missing in some GETDEVICEINFO replies
>
> Su Hui <suhui@nfschina.com>
> fs: lockd: avoid possible wrong NULL parameter
>
> Alexei Filippov <halip0503@gmail.com>
> jfs: validate max amount of blocks before allocation.
>
> Russell Currey <ruscur@russell.cc>
> powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
>
> Dan Carpenter <dan.carpenter@linaro.org>
> nfs/blocklayout: Use the passed in gfp flags
>
> Russell Currey <ruscur@russell.cc>
> powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
>
> Michael Ellerman <mpe@ellerman.id.au>
> powerpc: Don't include lppaca.h in paca.h
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> wifi: ath10k: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> net/mlx5: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> drm/radeon: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> drm/amdgpu: Use RMW accessors for changing LNKCTL
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/perf: Convert fsl_emb notifier to state machine callbacks
>
> Sourabh Jain <sourabhjain@linux.ibm.com>
> powerpc/fadump: reset dump area size if fadump memory reserve fails
>
> Stefan Hajnoczi <stefanha@redhat.com>
> vfio/type1: fix cap_migration information leak
>
> Ahmad Fatoum <a.fatoum@pengutronix.de>
> clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
>
> Marco Felsch <m.felsch@pengutronix.de>
> clk: imx8mp: fix sai4 clock
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> PCI/ASPM: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> PCI: pciehp: Use RMW accessors for changing LNKCTL
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> pinctrl: mcp23s08: check return value of devm_kasprintf()
>
> Wu Zongyong <wuzongyong@linux.alibaba.com>
> PCI: Mark NVIDIA T4 GPUs to avoid bus reset
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> clk: qcom: reset: Use the correct type of sleep/delay based on length
>
> Patrick Whewell <patrick.whewell@sightlineapplications.com>
> clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
>
> Kemeng Shi <shikemeng@huaweicloud.com>
> ext4: correct grp validation in ext4_mb_good_group
>
> David Wronek <davidwronek@gmail.com>
> clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
>
> Zhang Jianhua <chris.zjh@huawei.com>
> clk: sunxi-ng: Modify mismatched function name
>
> Minjie Du <duminjie@vivo.com>
> drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
>
> Corey Minyard <minyard@acm.org>
> ipmi:ssif: Fix a memory leak when scanning for an adapter
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> ipmi:ssif: Add check for kstrdup
>
> Su Hui <suhui@nfschina.com>
> ALSA: ac97: Fix possible error value of *rac97
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> of: unittest: Fix overlay type in apply/revert check
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Fix cast to enum warning
>
> Sui Jingfeng <suijingfeng@loongson.cn>
> drm/mediatek: Fix potential memory leak if vmap() fail
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Fix build warning for 64-bit build
>
> Gaosheng Cui <cuigaosheng1@huawei.com>
> audit: fix possible soft lockup in __audit_inode_child()
>
> Fabio Estevam <festevam@denx.de>
> drm/msm/a2xx: Call adreno_gpu_init() earlier
>
> Yang Wang <kevinyang.wang@amd.com>
> drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> smackfs: Prevent underflow in smk_set_cipso()
>
> Zhang Shurong <zhang_shurong@foxmail.com>
> firmware: meson_sm: fix to avoid potential NULL pointer dereference
>
> Daniel Vetter <daniel.vetter@ffwll.ch>
> drm/msm/mdp5: Don't leak some plane state
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
>
> Nayna Jain <nayna@linux.ibm.com>
> ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
>
> Marek Vasut <marex@denx.de>
> drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> drm/armada: Fix off-by-one error in armada_overlay_get_property()
>
> Ruan Jinjie <ruanjinjie@huawei.com>
> of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
>
> Yangtao Li <frank.li@vivo.com>
> drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
>
> Tan Zhongjun <tanzhongjun@yulong.com>
> drm/tegra: Remove superfluous error messages around platform_get_irq()
>
> Yu Kuai <yukuai3@huawei.com>
> md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
>
> Guoqing Jiang <guoqing.jiang@linux.dev>
> md/bitmap: don't set max_write_behind if there is no write mostly device
>
> Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
> drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
>
> Bogdan Togorean <bogdan.togorean@analog.com>
> drm: adv7511: Fix low refresh rate register for ADV7533/5
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
>
> Krzysztof Kozlowski <krzk@kernel.org>
> ARM: dts: s5pv210: adjust node names to DT spec
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
>
> Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> ARM: dts: s3c64xx: align pinctrl with dtschema
>
> Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> x86/mm: Fix PAT bit missing from page protection modify mask
>
> Lucas Stach <l.stach@pengutronix.de>
> drm/etnaviv: fix dumping of active MMU context
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Add cells sizes to PCIe node
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Drop nonexistent #usb-cells
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
>
> Serge Semin <Sergey.Semin@baikalelectronics.ru>
> ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
>
> Arnd Bergmann <arnd@arndb.de>
> drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
>
> Luca Weiss <luca@z3ntu.xyz>
> soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
>
> Luca Weiss <luca@z3ntu.xyz>
> soc: qcom: ocmem: Add OCMEM hardware version print
>
> Randy Dunlap <rdunlap@infradead.org>
> ASoC: stac9766: fix build errors with REGMAP_AC97
>
> Baokun Li <libaokun1@huawei.com>
> quota: fix dqput() to follow the guarantees dquot_srcu should provide
>
> Baokun Li <libaokun1@huawei.com>
> quota: add new helper dquot_active()
>
> Baokun Li <libaokun1@huawei.com>
> quota: rename dquot_active() to inode_quota_active()
>
> Baokun Li <libaokun1@huawei.com>
> quota: factor out dquot_write_dquot()
>
> Marek Vasut <marex@denx.de>
> drm/bridge: tc358764: Fix debug print parameter order
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> netrom: Deny concurrent connect().
>
> Budimir Markovic <markovicbudimir@gmail.com>
> net/sched: sch_hfsc: Ensure inner classes have fsc curve
>
> Biju Das <biju.das.jz@bp.renesas.com>
> hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
>
> Vadim Pasternak <vadimp@nvidia.com>
> mlxsw: i2c: Limit single transaction buffer size
>
> Vadim Pasternak <vadimp@nvidia.com>
> mlxsw: i2c: Fix chunk size setting in output mailbox buffer
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> net: arcnet: Do not call kfree_skb() under local_irq_disable()
>
> Wang Ming <machel@vivo.com>
> wifi: ath9k: use IS_ERR() with debugfs_create_dir()
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: mwifiex: avoid possible NULL skb pointer dereference
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: protect WMI command response buffer replacement with a lock
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
>
> Daniel T. Lee <danieltimlee@gmail.com>
> samples/bpf: fix broken map lookup probe
>
> Polaris Pi <pinkperfect2021@gmail.com>
> wifi: mwifiex: Fix missed return in oob checks failed path
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
>
> Artem Chernyshev <artem.chernyshev@red-soft.ru>
> fs: ocfs2: namei: check return value of ocfs2_add_entry()
>
> Yan Zhai <yan@cloudflare.com>
> lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
>
> Yan Zhai <yan@cloudflare.com>
> lwt: Fix return values of BPF xmit ops
>
> Florian Fainelli <florian.fainelli@broadcom.com>
> hwrng: iproc-rng200 - Implement suspend and resume calls
>
> Gaurav Jain <gaurav.jain@nxp.com>
> crypto: caam - fix unchecked return value error
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: ice_aq_check_events: fix off-by-one check when filling buffer
>
> Yipeng Zou <zouyipeng@huawei.com>
> selftests/bpf: Clean up fmod_ret in bench_rename test script
>
> Menglong Dong <imagedong@tencent.com>
> net: tcp: fix unexcepted socket die when snd_wnd is 0
>
> Min Li <lm0963hack@gmail.com>
> Bluetooth: Fix potential use-after-free when clear keys
>
> Yuanjun Gong <ruc_gongyuanjun@163.com>
> Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: api - Use work queue in crypto_destroy_instance
>
> Eric Biggers <ebiggers@google.com>
> crypto: blake2b - sync with blake2s implementation
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> crypto: stm32 - Properly handle pm_runtime_get failing
>
> Alan Maguire <alan.maguire@oracle.com>
> selftests/bpf: fix static assert compilation issue for test_cls_*.c
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
>
> Polaris Pi <pinkperfect2021@gmail.com>
> wifi: mwifiex: Fix OOB and integer underflow when rx packets
>
> Marc Kleine-Budde <mkl@pengutronix.de>
> can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
>
> Zhang Shurong <zhang_shurong@foxmail.com>
> spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
>
> Lin Ma <linma@zju.edu.cn>
> wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
>
> Lorenz Bauer <lmb@isovalent.com>
> bpf: reject unhashed sockets in bpf_sk_assign
>
> Lorenz Bauer <lmb@isovalent.com>
> udp: re-score reuseport groups when connected sockets are present
>
> Dan Carpenter <dan.carpenter@linaro.org>
> regmap: rbtree: Use alloc_flags for memory allocations
>
> Martin Kaiser <martin@kaiser.cx>
> hwrng: nomadik - keep clock enabled while hwrng is registered
>
> Eric Dumazet <edumazet@google.com>
> tcp: tcp_enter_quickack_mode() should be static
>
> Yafang Shao <laoar.shao@gmail.com>
> bpf: Clear the probe_addr for uprobe
>
> Alexander Lobakin <alobakin@pm.me>
> bpftool: Use a local bpf_perf_event_value to fix accessing its fields
>
> Liao Chang <liaochang1@huawei.com>
> cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
>
> Mikel Rychliski <mikel@mikelr.com>
> x86/efistub: Fix PCI ROM preservation in mixed mode
>
> Holger Dengler <dengler@linux.ibm.com>
> s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
>
> Holger Dengler <dengler@linux.ibm.com>
> s390/pkey: fix/harmonize internal keyblob headers
>
> Xu Yang <xu.yang_2@nxp.com>
> perf/imx_ddr: don't enable counter0 if none of 4 counters are used
>
> Ard Biesheuvel <ardb@kernel.org>
> x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> selftests/resctrl: Close perf value read fd on errors
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> selftests/resctrl: Don't leak buffer in fill_cache()
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
>
> Waiman Long <longman@redhat.com>
> refscale: Fix uninitalized use of wait_queue_head_t
>
> Kees Cook <keescook@chromium.org>
> selftests/harness: Actually report SKIP for signal tests
>
> Christian Brauner <brauner@kernel.org>
> tmpfs: verify {g,u}id mount options correctly
>
> Wang Ming <machel@vivo.com>
> fs: Fix error checking for d_hash_and_lookup()
>
> Wen Yang <wenyang.linux@foxmail.com>
> eventfd: prevent underflow for eventfd semaphores
>
> David Woodhouse <dwmw@amazon.co.uk>
> eventfd: Export eventfd_ctx_do_read()
>
> Matthew Wilcox <willy@infradead.org>
> reiserfs: Check the return value from __getblk()
>
> Sabrina Dubroca <sd@queasysnail.net>
> Revert "net: macsec: preserve ingress frame ordering"
>
> Jan Kara <jack@suse.cz>
> udf: Handle error when adding extent to a file
>
> Vladislav Efanov <VEfanov@ispras.ru>
> udf: Check consistency of Space Bitmap Descriptor
>
> Jordan Rife <jrife@google.com>
> net: Avoid address overwrite in kernel_connect
>
> Shih-Yi Chen <shihyic@nvidia.com>
> platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
>
> Zheng Yejian <zhengyejian1@huawei.com>
> tracing: Introduce pipe_cpumask to avoid race on trace_pipes
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: seq: oss: Fix racy open/close of MIDI devices
>
> Michael Kelley <mikelley@microsoft.com>
> scsi: storvsc: Always set no_report_opcodes
>
> Dan Carpenter <dan.carpenter@linaro.org>
> sctp: handle invalid error codes without calling BUG()
>
> David Christensen <drc@linux.vnet.ibm.com>
> bnx2x: fix page fault following EEH recovery
>
> Dmitry Mastykin <dmastykin@astralinux.ru>
> netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
>
> Chengfeng Ye <dg573847474@gmail.com>
> scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
>
> Baoquan He <bhe@redhat.com>
> idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
>
> Martin Kohn <m.kohn@welotec.com>
> net: usb: qmi_wwan: add Quectel EM05GV2
>
> Ani Sinha <anisinha@redhat.com>
> vmbus_testing: fix wrong python syntax for integer value comparison
>
> Baoquan He <bhe@redhat.com>
> clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
>
> Masami Hiramatsu (Google) <mhiramat@kernel.org>
> kprobes: Prohibit probing on CFI preamble symbol
>
> Christian Göttsche <cgzones@googlemail.com>
> security: keys: perform capable check only on privileged operations
>
> Minjie Du <duminjie@vivo.com>
> ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
>
> Eric Snowberg <eric.snowberg@oracle.com>
> ovl: Always reevaluate the file signature for IMA
>
> Leo Chen <sancchen@amd.com>
> drm/amd/display: Exit idle optimizations before attempt to access PHY
>
> Konstantin Shelekhin <k.shelekhin@ftml.net>
> platform/x86: huawei-wmi: Silence ambient light sensor
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: intel: hid: Always call BTNL ACPI method
>
> Guiting Shen <aarongt.shen@gmail.com>
> ASoC: atmel: Fix the 8K sample parameter in I2SC master
>
> Edgar <ljijcj@163.com>
> ASoc: codecs: ES8316: Fix DMIC config
>
> Winston Wen <wentao@uniontech.com>
> fs/nls: make load_nls() take a const parameter
>
> Stefan Haberland <sth@linux.ibm.com>
> s390/dasd: fix hanging device after request requeue
>
> Stefan Haberland <sth@linux.ibm.com>
> s390/dasd: use correct number of retries for ERP requests
>
> Ben Hutchings <benh@debian.org>
> m68k: Fix invalid .section syntax
>
> Jiri Benc <jbenc@redhat.com>
> vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
>
> Yuanjun Gong <ruc_gongyuanjun@163.com>
> ethernet: atheros: fix return value check in atl1c_tso_csum()
>
> Dmytro Maluka <dmy@semihalf.com>
> ASoC: da7219: Check for failure reading AAD IRQ events
>
> Dmytro Maluka <dmy@semihalf.com>
> ASoC: da7219: Flush pending AAD IRQ when suspending
>
> Dominique Martinet <asmadeus@codewreck.org>
> 9p: virtio: make sure 'offs' is initialized in zc_request
>
> Nikolay Burykin <burikin@ivk.ru>
> media: pci: cx23885: fix error handling for cx23885 ATSC boards
>
> Dmitry Antipov <dmantipov@yandex.ru>
> media: pulse8-cec: handle possible ping error
>
> Adrien Thierry <athierry@redhat.com>
> phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
>
> Xiaolei Wang <xiaolei.wang@windriver.com>
> ARM: dts: imx: Set default tuning step for imx7d usdhc
>
> Stefan Wahren <stefan.wahren@i2se.com>
> ARM: dts: imx: Adjust dma-apbh node name
>
> Marek Vasut <marex@denx.de>
> ARM: dts: imx7s: Drop dma-apb interrupt-names
>
> Joy Zou <joy.zou@nxp.com>
> ARM: dts: imx: update sdma node name format
>
> Oder Chiou <oder_chiou@realtek.com>
> ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
>
> Mario Limonciello <mario.limonciello@amd.com>
> pinctrl: amd: Don't show `Invalid config param` errors
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
>
> Juerg Haefliger <juerg.haefliger@canonical.com>
> fsi: master-ast-cf: Add MODULE_FIRMWARE macro
>
> Wang Ming <machel@vivo.com>
> firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
>
> Hugo Villeneuve <hvilleneuve@dimonoff.com>
> serial: sc16is7xx: fix bug when first setting GPIO direction
>
> Hugo Villeneuve <hvilleneuve@dimonoff.com>
> serial: sc16is7xx: fix broken port 0 uart init
>
> Johan Hovold <johan+linaro@kernel.org>
> serial: qcom-geni: fix opp vote on shutdown
>
> Sishuai Gong <sishuai@purdue.edu>
> configfs: fix a race in configfs_lookup()
>
> Zheng Wang <zyytlz.wz@163.com>
> Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
>
> Nam Cao <namcaov@gmail.com>
> staging: rtl8712: fix race condition
>
> Aaron Armstrong Skomra <aaron.skomra@wacom.com>
> HID: wacom: remove the battery when the EKR is off
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
>
> Luke Lu <luke.lu@libre.computer>
> usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
>
> Slark Xiao <slark_xiao@163.com>
> USB: serial: option: add FOXCONN T99W368/T99W373 product
>
> Martin Kohn <m.kohn@welotec.com>
> USB: serial: option: add Quectel EM05G variant (0x030e)
>
> Christoph Hellwig <hch@lst.de>
> modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
>
> Christoph Hellwig <hch@lst.de>
> rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
>
> Christoph Hellwig <hch@lst.de>
> net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
>
> Christoph Hellwig <hch@lst.de>
> mmc: au1xmmc: force non-modular build and remove symbol_get usage
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: pxa: remove use of symbol_get()
>
> Gao Xiang <hsiangkao@linux.alibaba.com>
> erofs: ensure that the post-EOF tails are all zeroed
>
>
> -------------
>
> Diffstat:
>
> .../devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 -
> Documentation/scsi/scsi_mid_low_api.rst | 4 +-
> Makefile | 4 +-
> arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 +-
> arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +
> arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +
> arch/arm/boot/dts/bcm5301x.dtsi | 4 +-
> arch/arm/boot/dts/bcm53573.dtsi | 27 +-
> arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +-
> arch/arm/boot/dts/exynos4210-i9100.dts | 4 +-
> arch/arm/boot/dts/imx23.dtsi | 2 +-
> arch/arm/boot/dts/imx25.dtsi | 2 +-
> arch/arm/boot/dts/imx28.dtsi | 2 +-
> arch/arm/boot/dts/imx31.dtsi | 2 +-
> arch/arm/boot/dts/imx35.dtsi | 2 +-
> arch/arm/boot/dts/imx50.dtsi | 2 +-
> arch/arm/boot/dts/imx51.dtsi | 2 +-
> arch/arm/boot/dts/imx53.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl.dtsi | 4 +-
> arch/arm/boot/dts/imx6sl.dtsi | 2 +-
> arch/arm/boot/dts/imx6sx.dtsi | 4 +-
> arch/arm/boot/dts/imx6ul.dtsi | 4 +-
> arch/arm/boot/dts/imx7s.dtsi | 11 +-
> arch/arm/boot/dts/s3c6410-mini6410.dts | 6 +-
> arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++-------
> arch/arm/boot/dts/s5pv210-aquila.dts | 12 +-
> arch/arm/boot/dts/s5pv210-aries.dtsi | 4 +-
> arch/arm/boot/dts/s5pv210-goni.dts | 14 +-
> arch/arm/boot/dts/s5pv210-smdkv210.dts | 30 +-
> arch/arm/mach-omap2/powerdomain.c | 2 +-
> arch/arm/mach-pxa/sharpsl_pm.c | 2 -
> arch/arm/mach-pxa/spitz.c | 14 +-
> arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +
> arch/arm64/boot/dts/qcom/sdm845.dtsi | 3 +-
> arch/arm64/include/asm/sdei.h | 6 +
> arch/arm64/kernel/entry.S | 27 +-
> arch/arm64/kernel/sdei.c | 3 +
> arch/arm64/kernel/smp.c | 8 +-
> arch/arm64/lib/csum.c | 2 +-
> arch/m68k/fpsp040/skeleton.S | 4 +-
> arch/m68k/ifpsp060/os.S | 4 +-
> arch/m68k/kernel/relocate_kernel.S | 4 +-
> arch/mips/alchemy/devboards/db1000.c | 8 +-
> arch/mips/alchemy/devboards/db1200.c | 19 +-
> arch/mips/alchemy/devboards/db1300.c | 10 +-
> arch/parisc/include/asm/led.h | 4 +-
> arch/parisc/include/asm/processor.h | 1 -
> arch/parisc/kernel/processor.c | 18 +-
> arch/powerpc/include/asm/lppaca.h | 13 +-
> arch/powerpc/include/asm/paca.h | 6 +-
> arch/powerpc/include/asm/paravirt.h | 1 +
> arch/powerpc/include/asm/plpar_wrappers.h | 1 +
> arch/powerpc/kernel/fadump.c | 1 +
> arch/powerpc/kernel/iommu.c | 17 +-
> arch/powerpc/kvm/book3s_hv_ras.c | 1 +
> arch/powerpc/mm/book3s64/slb.c | 1 +
> arch/powerpc/perf/core-fsl-emb.c | 8 +-
> arch/powerpc/platforms/pseries/lpar.c | 10 +-
> arch/powerpc/platforms/pseries/lparcfg.c | 4 +-
> arch/powerpc/platforms/pseries/setup.c | 2 +-
> arch/powerpc/xmon/xmon.c | 1 +
> arch/s390/crypto/paes_s390.c | 2 +-
> arch/s390/kernel/ipl.c | 2 +
> arch/sh/boards/mach-ap325rxa/setup.c | 2 +-
> arch/sh/boards/mach-ecovec24/setup.c | 6 +-
> arch/sh/boards/mach-kfr2r09/setup.c | 2 +-
> arch/sh/boards/mach-migor/setup.c | 2 +-
> arch/sh/boards/mach-se/7724/setup.c | 6 +-
> arch/um/configs/i386_defconfig | 1 +
> arch/um/configs/x86_64_defconfig | 1 +
> arch/um/drivers/Kconfig | 16 +-
> arch/um/drivers/Makefile | 2 +-
> arch/x86/boot/compressed/head_64.S | 30 +-
> arch/x86/include/asm/pgtable_types.h | 11 +-
> arch/x86/include/asm/virtext.h | 6 -
> arch/x86/kernel/apm_32.c | 6 -
> arch/x86/kernel/cpu/common.c | 8 +-
> arch/xtensa/include/asm/core.h | 9 +
> arch/xtensa/kernel/perf_event.c | 17 +-
> crypto/algapi.c | 16 +-
> crypto/asymmetric_keys/x509_public_key.c | 5 +
> crypto/blake2b_generic.c | 226 +++----------
> drivers/acpi/apei/ghes.c | 19 +-
> drivers/acpi/bus.c | 2 +
> drivers/acpi/pci_root.c | 3 -
> drivers/amba/bus.c | 1 +
> drivers/ata/pata_arasan_cf.c | 3 +-
> drivers/ata/pata_ftide010.c | 1 +
> drivers/ata/sata_gemini.c | 1 +
> drivers/base/regmap/regcache-rbtree.c | 10 +-
> drivers/base/test/test_async_driver_probe.c | 2 +-
> drivers/bluetooth/btsdio.c | 1 +
> drivers/bluetooth/btusb.c | 2 +-
> drivers/bluetooth/hci_nokia.c | 6 +-
> drivers/bus/mhi/host/pm.c | 5 +
> drivers/bus/ti-sysc.c | 2 +-
> drivers/char/hw_random/iproc-rng200.c | 25 ++
> drivers/char/hw_random/nomadik-rng.c | 12 +-
> drivers/char/ipmi/ipmi_si_intf.c | 5 +
> drivers/char/ipmi/ipmi_ssif.c | 7 +-
> drivers/clk/Kconfig | 1 +
> drivers/clk/imx/clk-composite-8m.c | 12 +-
> drivers/clk/imx/clk-imx8mp.c | 5 -
> drivers/clk/imx/clk-pll14xx.c | 2 -
> drivers/clk/keystone/pll.c | 2 +-
> drivers/clk/qcom/gcc-mdm9615.c | 2 +-
> drivers/clk/qcom/gcc-sc7180.c | 33 +-
> drivers/clk/qcom/gcc-sm8250.c | 93 +++---
> drivers/clk/qcom/reset.c | 3 +-
> drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +-
> drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +-
> drivers/cpufreq/cpufreq.c | 2 +
> drivers/cpufreq/powernow-k8.c | 3 +-
> drivers/cpuidle/cpuidle-pseries.c | 8 +-
> drivers/crypto/caam/caampkc.c | 4 +-
> drivers/crypto/stm32/stm32-hash.c | 9 +-
> drivers/devfreq/devfreq.c | 1 +
> drivers/dma/Kconfig | 2 +
> drivers/dma/ste_dma40.c | 4 +
> drivers/firmware/Kconfig | 1 +
> drivers/firmware/arm_sdei.c | 32 +-
> drivers/firmware/efi/libstub/x86-stub.c | 2 +-
> drivers/firmware/meson/meson_sm.c | 2 +
> drivers/firmware/stratix10-svc.c | 2 +-
> drivers/fsi/fsi-master-aspeed.c | 2 +
> drivers/fsi/fsi-master-ast-cf.c | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 14 +-
> drivers/gpu/drm/amd/amdgpu/cik.c | 36 +--
> drivers/gpu/drm/amd/amdgpu/si.c | 36 +--
> .../amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +
> drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 5 +-
> .../drm/amd/display/modules/freesync/freesync.c | 9 +-
> drivers/gpu/drm/amd/pm/amdgpu_pm.c | 10 +-
> drivers/gpu/drm/armada/armada_overlay.c | 6 +-
> drivers/gpu/drm/ast/ast_post.c | 2 +-
> drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +-
> drivers/gpu/drm/bridge/tc358764.c | 2 +-
> drivers/gpu/drm/etnaviv/etnaviv_dump.c | 14 +-
> drivers/gpu/drm/i915/gvt/gtt.c | 68 +++-
> drivers/gpu/drm/i915/gvt/gtt.h | 5 +-
> drivers/gpu/drm/i915/gvt/gvt.c | 9 +
> drivers/gpu/drm/i915/gvt/gvt.h | 3 +
> drivers/gpu/drm/i915/gvt/handlers.c | 44 ++-
> drivers/gpu/drm/i915/gvt/mmio.h | 4 +
> drivers/gpu/drm/i915/intel_gvt.c | 15 +
> drivers/gpu/drm/i915/intel_gvt.h | 5 +
> drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +-
> drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 8 +-
> drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +-
> drivers/gpu/drm/panel/panel-simple.c | 4 +-
> drivers/gpu/drm/radeon/cik.c | 36 +--
> drivers/gpu/drm/radeon/si.c | 37 +--
> drivers/gpu/drm/tegra/dpaux.c | 6 +-
> drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 4 +-
> drivers/hid/hid-logitech-dj.c | 5 +-
> drivers/hid/hid-multitouch.c | 13 +-
> drivers/hid/wacom.h | 1 +
> drivers/hid/wacom_sys.c | 25 +-
> drivers/hid/wacom_wac.c | 1 +
> drivers/hid/wacom_wac.h | 1 +
> drivers/hwmon/tmp513.c | 2 +-
> drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +-
> drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +-
> drivers/hwtracing/coresight/coresight-tmc.h | 2 +-
> .../infiniband/core/uverbs_std_types_counters.c | 2 +
> drivers/infiniband/sw/siw/siw_cm.c | 1 -
> drivers/infiniband/sw/siw/siw_verbs.c | 2 +-
> drivers/infiniband/ulp/isert/ib_isert.c | 2 +
> drivers/infiniband/ulp/srp/ib_srp.c | 4 -
> drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 +
> drivers/iommu/intel/pasid.c | 2 +-
> drivers/leds/led-core.c | 8 +-
> drivers/md/md-bitmap.c | 28 +-
> drivers/media/cec/usb/pulse8/pulse8-cec.c | 7 +-
> drivers/media/dvb-frontends/ascot2e.c | 2 +-
> drivers/media/dvb-frontends/atbm8830.c | 2 +-
> drivers/media/dvb-frontends/au8522_dig.c | 2 +-
> drivers/media/dvb-frontends/bcm3510.c | 2 +-
> drivers/media/dvb-frontends/cx22700.c | 2 +-
> drivers/media/dvb-frontends/cx22702.c | 2 +-
> drivers/media/dvb-frontends/cx24110.c | 2 +-
> drivers/media/dvb-frontends/cx24113.c | 2 +-
> drivers/media/dvb-frontends/cx24116.c | 2 +-
> drivers/media/dvb-frontends/cx24120.c | 6 +-
> drivers/media/dvb-frontends/cx24123.c | 2 +-
> drivers/media/dvb-frontends/cxd2820r_core.c | 2 +-
> drivers/media/dvb-frontends/cxd2841er.c | 4 +-
> drivers/media/dvb-frontends/cxd2880/cxd2880_top.c | 2 +-
> drivers/media/dvb-frontends/dib0070.c | 2 +-
> drivers/media/dvb-frontends/dib0090.c | 4 +-
> drivers/media/dvb-frontends/dib3000mb.c | 2 +-
> drivers/media/dvb-frontends/dib3000mc.c | 2 +-
> drivers/media/dvb-frontends/dib7000m.c | 2 +-
> drivers/media/dvb-frontends/dib7000p.c | 4 +-
> drivers/media/dvb-frontends/dib8000.c | 2 +-
> drivers/media/dvb-frontends/dib9000.c | 2 +-
> drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 +-
> drivers/media/dvb-frontends/drxd_hard.c | 2 +-
> drivers/media/dvb-frontends/drxk_hard.c | 2 +-
> drivers/media/dvb-frontends/ds3000.c | 2 +-
> drivers/media/dvb-frontends/dvb-pll.c | 2 +-
> drivers/media/dvb-frontends/ec100.c | 2 +-
> drivers/media/dvb-frontends/helene.c | 4 +-
> drivers/media/dvb-frontends/horus3a.c | 2 +-
> drivers/media/dvb-frontends/isl6405.c | 2 +-
> drivers/media/dvb-frontends/isl6421.c | 2 +-
> drivers/media/dvb-frontends/isl6423.c | 2 +-
> drivers/media/dvb-frontends/itd1000.c | 2 +-
> drivers/media/dvb-frontends/ix2505v.c | 2 +-
> drivers/media/dvb-frontends/l64781.c | 2 +-
> drivers/media/dvb-frontends/lg2160.c | 2 +-
> drivers/media/dvb-frontends/lgdt3305.c | 2 +-
> drivers/media/dvb-frontends/lgdt3306a.c | 2 +-
> drivers/media/dvb-frontends/lgdt330x.c | 2 +-
> drivers/media/dvb-frontends/lgs8gxx.c | 2 +-
> drivers/media/dvb-frontends/lnbh25.c | 2 +-
> drivers/media/dvb-frontends/lnbp21.c | 4 +-
> drivers/media/dvb-frontends/lnbp22.c | 2 +-
> drivers/media/dvb-frontends/m88ds3103.c | 2 +-
> drivers/media/dvb-frontends/m88rs2000.c | 2 +-
> drivers/media/dvb-frontends/mb86a16.c | 2 +-
> drivers/media/dvb-frontends/mb86a20s.c | 2 +-
> drivers/media/dvb-frontends/mt312.c | 2 +-
> drivers/media/dvb-frontends/mt352.c | 2 +-
> drivers/media/dvb-frontends/nxt200x.c | 2 +-
> drivers/media/dvb-frontends/nxt6000.c | 2 +-
> drivers/media/dvb-frontends/or51132.c | 2 +-
> drivers/media/dvb-frontends/or51211.c | 2 +-
> drivers/media/dvb-frontends/s5h1409.c | 2 +-
> drivers/media/dvb-frontends/s5h1411.c | 2 +-
> drivers/media/dvb-frontends/s5h1420.c | 2 +-
> drivers/media/dvb-frontends/s5h1432.c | 2 +-
> drivers/media/dvb-frontends/s921.c | 2 +-
> drivers/media/dvb-frontends/si21xx.c | 2 +-
> drivers/media/dvb-frontends/sp887x.c | 2 +-
> drivers/media/dvb-frontends/stb0899_drv.c | 2 +-
> drivers/media/dvb-frontends/stb6000.c | 2 +-
> drivers/media/dvb-frontends/stb6100.c | 2 +-
> drivers/media/dvb-frontends/stv0288.c | 2 +-
> drivers/media/dvb-frontends/stv0297.c | 2 +-
> drivers/media/dvb-frontends/stv0299.c | 2 +-
> drivers/media/dvb-frontends/stv0367.c | 6 +-
> drivers/media/dvb-frontends/stv0900_core.c | 2 +-
> drivers/media/dvb-frontends/stv090x.c | 2 +-
> drivers/media/dvb-frontends/stv6110.c | 2 +-
> drivers/media/dvb-frontends/stv6110x.c | 2 +-
> drivers/media/dvb-frontends/tda10021.c | 2 +-
> drivers/media/dvb-frontends/tda10023.c | 2 +-
> drivers/media/dvb-frontends/tda10048.c | 2 +-
> drivers/media/dvb-frontends/tda1004x.c | 4 +-
> drivers/media/dvb-frontends/tda10086.c | 2 +-
> drivers/media/dvb-frontends/tda665x.c | 2 +-
> drivers/media/dvb-frontends/tda8083.c | 2 +-
> drivers/media/dvb-frontends/tda8261.c | 2 +-
> drivers/media/dvb-frontends/tda826x.c | 2 +-
> drivers/media/dvb-frontends/ts2020.c | 2 +-
> drivers/media/dvb-frontends/tua6100.c | 2 +-
> drivers/media/dvb-frontends/ves1820.c | 2 +-
> drivers/media/dvb-frontends/ves1x93.c | 2 +-
> drivers/media/dvb-frontends/zl10036.c | 2 +-
> drivers/media/dvb-frontends/zl10039.c | 2 +-
> drivers/media/dvb-frontends/zl10353.c | 2 +-
> drivers/media/i2c/ad5820.c | 2 -
> drivers/media/i2c/ov2680.c | 246 +++------------
> drivers/media/i2c/ov5640.c | 4 +-
> drivers/media/i2c/tvp5150.c | 4 +
> drivers/media/pci/bt8xx/dst.c | 2 +-
> drivers/media/pci/bt8xx/dst_ca.c | 2 +-
> drivers/media/pci/cx23885/cx23885-dvb.c | 12 -
> drivers/media/pci/ddbridge/ddbridge-dummy-fe.c | 2 +-
> .../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +-
> drivers/media/tuners/fc0011.c | 2 +-
> drivers/media/tuners/fc0012.c | 2 +-
> drivers/media/tuners/fc0013.c | 2 +-
> drivers/media/tuners/max2165.c | 2 +-
> drivers/media/tuners/mc44s803.c | 2 +-
> drivers/media/tuners/mt2060.c | 2 +-
> drivers/media/tuners/mt2131.c | 2 +-
> drivers/media/tuners/mt2266.c | 2 +-
> drivers/media/tuners/mxl5005s.c | 2 +-
> drivers/media/tuners/qt1010.c | 2 +-
> drivers/media/tuners/tda18218.c | 2 +-
> drivers/media/tuners/xc4000.c | 2 +-
> drivers/media/tuners/xc5000.c | 2 +-
> drivers/media/usb/dvb-usb/m920x.c | 5 +-
> drivers/media/usb/go7007/go7007-i2c.c | 2 -
> drivers/media/usb/siano/smsusb.c | 21 +-
> drivers/media/v4l2-core/v4l2-fwnode.c | 18 +-
> drivers/mmc/host/Kconfig | 5 +-
> drivers/mtd/nand/raw/brcmnand/brcmnand.c | 45 ++-
> drivers/mtd/nand/raw/fsmc_nand.c | 7 +-
> drivers/mtd/spi-nor/core.c | 19 +-
> drivers/net/arcnet/arcnet.c | 2 +-
> drivers/net/can/usb/gs_usb.c | 5 +-
> drivers/net/dsa/sja1105/sja1105_main.c | 38 ++-
> drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +-
> drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +-
> drivers/net/ethernet/freescale/enetc/enetc_ptp.c | 2 +-
> drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 +-
> drivers/net/ethernet/intel/ice/ice_main.c | 13 +-
> drivers/net/ethernet/intel/igb/igb.h | 4 +-
> drivers/net/ethernet/intel/igb/igb_main.c | 16 +-
> drivers/net/ethernet/intel/igbvf/igbvf.h | 4 +-
> drivers/net/ethernet/intel/igc/igc.h | 4 +-
> drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 28 +-
> drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 +
> drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +
> drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 +-
> drivers/net/ethernet/mellanox/mlxsw/i2c.c | 5 +-
> drivers/net/macsec.c | 3 +-
> drivers/net/usb/qmi_wwan.c | 1 +
> drivers/net/usb/r8152.c | 3 +
> drivers/net/veth.c | 4 +-
> drivers/net/vxlan/vxlan_core.c | 58 ++--
> drivers/net/wireless/ath/ath10k/pci.c | 9 +-
> drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
> drivers/net/wireless/ath/ath9k/wmi.c | 20 +-
> drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +-
> drivers/net/wireless/marvell/mwifiex/pcie.c | 25 +-
> drivers/net/wireless/marvell/mwifiex/sta_rx.c | 12 +-
> drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 30 +-
> drivers/net/wireless/marvell/mwifiex/util.c | 10 +-
> drivers/net/wireless/mediatek/mt76/testmode.c | 1 +
> drivers/ntb/ntb_transport.c | 19 +-
> drivers/of/unittest.c | 12 +-
> drivers/opp/core.c | 2 +-
> drivers/parisc/led.c | 4 +-
> drivers/pci/hotplug/pciehp_hpc.c | 12 +-
> drivers/pci/pcie/aspm.c | 30 +-
> drivers/perf/fsl_imx8_ddr_perf.c | 24 +-
> drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 6 +-
> drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 18 +-
> drivers/pinctrl/intel/pinctrl-cherryview.c | 5 +-
> drivers/pinctrl/pinctrl-amd.c | 4 +-
> drivers/pinctrl/pinctrl-mcp23s08_spi.c | 10 +
> drivers/platform/mellanox/mlxbf-tmfifo.c | 91 ++++--
> drivers/platform/x86/huawei-wmi.c | 2 +
> drivers/platform/x86/intel-hid.c | 21 +-
> drivers/pwm/pwm-lpc32xx.c | 16 +-
> drivers/rpmsg/qcom_glink_native.c | 4 +
> drivers/rtc/rtc-ds1685.c | 2 +-
> drivers/s390/block/dasd.c | 125 +++-----
> drivers/s390/block/dasd_3990_erp.c | 2 +-
> drivers/s390/crypto/pkey_api.c | 2 +-
> drivers/s390/crypto/zcrypt_api.c | 1 +
> drivers/s390/crypto/zcrypt_ep11misc.c | 4 +-
> drivers/s390/crypto/zcrypt_ep11misc.h | 9 +-
> drivers/scsi/aic94xx/aic94xx_task.c | 2 +-
> drivers/scsi/be2iscsi/be_iscsi.c | 4 +
> drivers/scsi/fcoe/fcoe_ctlr.c | 20 +-
> drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 8 +-
> drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 19 +-
> drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 62 ++--
> drivers/scsi/hosts.c | 4 +-
> drivers/scsi/isci/request.c | 10 +-
> drivers/scsi/isci/task.c | 2 +-
> drivers/scsi/libsas/sas_ata.c | 7 +-
> drivers/scsi/libsas/sas_expander.c | 2 +-
> drivers/scsi/libsas/sas_task.c | 4 +-
> drivers/scsi/mpt3sas/mpt3sas_base.c | 46 ++-
> drivers/scsi/mpt3sas/mpt3sas_base.h | 1 +
> drivers/scsi/mvsas/mv_sas.c | 10 +-
> drivers/scsi/pm8001/pm8001_hwi.c | 16 +-
> drivers/scsi/pm8001/pm8001_sas.c | 4 +-
> drivers/scsi/pm8001/pm80xx_hwi.c | 14 +-
> drivers/scsi/qedf/qedf_dbg.h | 2 +
> drivers/scsi/qedf/qedf_debugfs.c | 35 ++-
> drivers/scsi/qedi/qedi_main.c | 5 +-
> drivers/scsi/qla2xxx/qla_attr.c | 2 -
> drivers/scsi/qla2xxx/qla_dbg.c | 18 +-
> drivers/scsi/qla2xxx/qla_def.h | 12 +-
> drivers/scsi/qla2xxx/qla_gbl.h | 3 +
> drivers/scsi/qla2xxx/qla_init.c | 68 ++--
> drivers/scsi/qla2xxx/qla_inline.h | 46 +++
> drivers/scsi/qla2xxx/qla_iocb.c | 60 +++-
> drivers/scsi/qla2xxx/qla_isr.c | 16 +-
> drivers/scsi/qla2xxx/qla_mbx.c | 7 +-
> drivers/scsi/qla2xxx/qla_nvme.c | 12 +-
> drivers/scsi/qla2xxx/qla_os.c | 223 +++++++------
> drivers/scsi/qla2xxx/qla_target.c | 14 +-
> drivers/scsi/qla4xxx/ql4_os.c | 15 +
> drivers/scsi/scsi_transport_iscsi.c | 80 +++--
> drivers/scsi/storvsc_drv.c | 2 +
> drivers/soc/qcom/ocmem.c | 14 +-
> drivers/soc/qcom/qmi_encdec.c | 4 +-
> drivers/spi/spi-tegra20-sflash.c | 6 +-
> drivers/staging/media/rkvdec/rkvdec.c | 2 +-
> drivers/staging/rtl8712/os_intfs.c | 1 +
> drivers/staging/rtl8712/usb_intf.c | 1 -
> drivers/tty/serial/qcom_geni_serial.c | 5 +
> drivers/tty/serial/sc16is7xx.c | 17 +-
> drivers/tty/serial/serial-tegra.c | 6 +-
> drivers/tty/serial/sprd_serial.c | 30 +-
> drivers/usb/chipidea/ci_hdrc_imx.c | 10 +-
> drivers/usb/chipidea/usbmisc_imx.c | 6 +-
> drivers/usb/core/hcd.c | 10 +-
> drivers/usb/core/hub.c | 349 ++++++++++++---------
> drivers/usb/core/message.c | 29 +-
> drivers/usb/core/usb.h | 4 +-
> drivers/usb/dwc3/dwc3-meson-g12a.c | 6 +
> drivers/usb/gadget/function/f_mass_storage.c | 2 +-
> drivers/usb/phy/phy-mxs-usb.c | 10 +-
> drivers/usb/serial/option.c | 7 +
> drivers/usb/typec/bus.c | 12 +-
> drivers/usb/typec/tcpm/tcpci.c | 4 +
> drivers/usb/typec/tcpm/tcpci.h | 1 +
> drivers/usb/typec/tcpm/tcpm.c | 3 +-
> drivers/vfio/vfio_iommu_type1.c | 2 +-
> drivers/video/backlight/bd6107.c | 2 +-
> drivers/video/backlight/gpio_backlight.c | 5 +-
> drivers/video/backlight/lv5207lp.c | 2 +-
> drivers/video/fbdev/ep93xx-fb.c | 1 -
> drivers/virtio/virtio_ring.c | 2 +-
> drivers/watchdog/intel-mid_wdt.c | 1 +
> fs/btrfs/disk-io.c | 5 +-
> fs/btrfs/transaction.c | 7 +-
> fs/configfs/dir.c | 2 +
> fs/dlm/plock.c | 6 +-
> fs/erofs/zdata.c | 2 +
> fs/eventfd.c | 7 +-
> fs/ext4/balloc.c | 15 +-
> fs/ext4/block_validity.c | 8 +-
> fs/ext4/ext4.h | 2 +
> fs/ext4/mballoc.c | 2 +-
> fs/fuse/readdir.c | 10 +-
> fs/jfs/jfs_extent.c | 5 +
> fs/lockd/mon.c | 3 +
> fs/namei.c | 2 +-
> fs/nfs/blocklayout/dev.c | 4 +-
> fs/nfs/direct.c | 20 +-
> fs/nfs/nfs2xdr.c | 2 +-
> fs/nfs/nfs3xdr.c | 2 +-
> fs/nfs/nfs42proc.c | 5 +-
> fs/nfs/pnfs_dev.c | 2 +-
> fs/nfsd/blocklayoutxdr.c | 9 +
> fs/nfsd/flexfilelayoutxdr.c | 9 +
> fs/nfsd/nfs4xdr.c | 25 +-
> fs/nilfs2/alloc.c | 3 +-
> fs/nilfs2/inode.c | 7 +-
> fs/nilfs2/segment.c | 5 +
> fs/nls/nls_base.c | 4 +-
> fs/ocfs2/namei.c | 4 +
> fs/overlayfs/super.c | 2 +-
> fs/proc/base.c | 3 +-
> fs/pstore/ram_core.c | 2 +-
> fs/quota/dquot.c | 174 ++++++----
> fs/reiserfs/journal.c | 4 +-
> fs/udf/balloc.c | 31 +-
> fs/udf/inode.c | 45 ++-
> fs/verity/signature.c | 16 +
> include/acpi/apei.h | 4 +-
> include/crypto/algapi.h | 3 +
> include/crypto/blake2b.h | 67 ++++
> include/crypto/internal/blake2b.h | 115 +++++++
> include/linux/arm_sdei.h | 4 +
> include/linux/eventfd.h | 6 +
> include/linux/if_arp.h | 4 +
> include/linux/nls.h | 2 +-
> include/linux/trace_events.h | 3 +-
> include/linux/usb/typec_altmode.h | 2 +-
> include/net/ip.h | 1 +
> include/net/ip_tunnels.h | 15 +-
> include/net/ipv6.h | 2 +-
> include/net/lwtunnel.h | 5 +-
> include/net/tcp.h | 1 -
> include/scsi/libsas.h | 12 +-
> include/scsi/scsi_host.h | 2 +-
> include/uapi/linux/sync_file.h | 2 +-
> io_uring/io-wq.c | 10 +
> io_uring/io-wq.h | 1 +
> io_uring/io_uring.c | 9 +-
> kernel/auditsc.c | 2 +
> kernel/bpf/verifier.c | 17 +-
> kernel/cgroup/namespace.c | 6 -
> kernel/kprobes.c | 14 +-
> kernel/module.c | 15 +-
> kernel/printk/printk_ringbuffer.c | 2 +-
> kernel/rcu/refscale.c | 3 +-
> kernel/trace/bpf_trace.c | 2 +-
> kernel/trace/trace.c | 72 ++++-
> kernel/trace/trace.h | 2 +
> kernel/trace/trace_uprobe.c | 3 +-
> lib/idr.c | 2 +-
> lib/test_meminit.c | 2 +-
> mm/shmem.c | 28 +-
> net/9p/trans_virtio.c | 2 +-
> net/bluetooth/hci_core.c | 16 +-
> net/core/filter.c | 2 +
> net/core/flow_dissector.c | 3 +-
> net/core/lwt_bpf.c | 7 +-
> net/core/skbuff.c | 34 +-
> net/core/sock.c | 9 +-
> net/dccp/ipv4.c | 13 +-
> net/dccp/ipv6.c | 15 +-
> net/hsr/hsr_forward.c | 1 +
> net/ipv4/devinet.c | 10 +-
> net/ipv4/fib_semantics.c | 5 +-
> net/ipv4/fib_trie.c | 3 +-
> net/ipv4/igmp.c | 3 +-
> net/ipv4/ip_input.c | 3 +-
> net/ipv4/ip_output.c | 2 +-
> net/ipv4/route.c | 1 +
> net/ipv4/tcp_input.c | 3 +-
> net/ipv4/tcp_timer.c | 18 +-
> net/ipv4/udp.c | 20 +-
> net/ipv6/addrconf.c | 2 +-
> net/ipv6/ip6_output.c | 2 +-
> net/ipv6/udp.c | 19 +-
> net/kcm/kcmsock.c | 15 +-
> net/netfilter/ipset/ip_set_hash_netportnet.c | 1 +
> net/netfilter/nfnetlink_osf.c | 8 +
> net/netfilter/xt_sctp.c | 2 +
> net/netfilter/xt_u32.c | 21 ++
> net/netlabel/netlabel_kapi.c | 3 +-
> net/netrom/af_netrom.c | 5 +
> net/sched/sch_fq_pie.c | 27 +-
> net/sched/sch_hfsc.c | 4 +
> net/sched/sch_plug.c | 2 +-
> net/sched/sch_qfq.c | 22 +-
> net/sctp/proc.c | 2 +-
> net/sctp/sm_sideeffect.c | 5 +-
> net/sctp/socket.c | 10 +-
> net/smc/smc_core.c | 2 +
> net/socket.c | 6 +-
> net/tls/tls_sw.c | 4 +-
> net/unix/af_unix.c | 2 +-
> net/unix/scm.c | 6 +-
> samples/bpf/tracex6_kern.c | 17 +-
> scripts/kconfig/preprocess.c | 3 +
> security/integrity/ima/Kconfig | 12 -
> security/keys/keyctl.c | 11 +-
> security/smack/smackfs.c | 2 +-
> sound/Kconfig | 2 +-
> sound/core/pcm_compat.c | 8 +-
> sound/core/seq/oss/seq_oss_midi.c | 35 ++-
> sound/pci/ac97/ac97_codec.c | 5 +-
> sound/soc/atmel/atmel-i2s.c | 5 +-
> sound/soc/codecs/Kconfig | 1 +
> sound/soc/codecs/da7219-aad.c | 12 +-
> sound/soc/codecs/es8316.c | 2 +-
> sound/soc/codecs/rt5682-sdw.c | 7 +-
> tools/bpf/bpftool/skeleton/profiler.bpf.c | 27 +-
> tools/hv/vmbus_testing | 4 +-
> tools/perf/builtin-top.c | 1 +
> tools/perf/ui/browsers/hists.c | 60 ++--
> tools/perf/util/annotate.c | 10 +-
> tools/perf/util/header.c | 11 +-
> .../selftests/bpf/benchs/run_bench_rename.sh | 2 +-
> .../selftests/bpf/progs/test_cls_redirect.h | 9 +
> tools/testing/selftests/kselftest/runner.sh | 29 +-
> tools/testing/selftests/kselftest_harness.h | 11 +-
> tools/testing/selftests/resctrl/cache.c | 18 +-
> tools/testing/selftests/resctrl/fill_buf.c | 3 +-
> tools/testing/selftests/resctrl/resctrl.h | 1 +
> 555 files changed, 3750 insertions(+), 2444 deletions(-)
>
>
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-20 4:57 ` Guenter Roeck
@ 2023-09-20 8:11 ` Greg Kroah-Hartman
2023-09-20 15:18 ` Guenter Roeck
0 siblings, 1 reply; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-20 8:11 UTC (permalink / raw)
To: Guenter Roeck, Kyle Zeng
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On Tue, Sep 19, 2023 at 09:57:25PM -0700, Guenter Roeck wrote:
> On 9/17/23 12:07, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.10.195 release.
> > There are 406 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> > Anything received after that time might be too late.
> >
>
> chromeos-5.10 locks up in configfs_lookup() after the merge of v5.10.195.
>
> I am a bit puzzled because I see
>
> c709c7ca020a configfs: fix a race in configfs_lookup()
>
> in v5.10.195 but not in the list of commits below. I guess I must be
> missing something.
It was part of the big patchset, it was posted here:
https://lore.kernel.org/r/20230917191101.511939651@linuxfoundation.org
Not hidden at all :)
and was submitted here:
https://lore.kernel.org/r/ZPOZFHHA0abVmGx+@westworld
> Either case, the code now looks as follows.
>
> configfs_lookup()
> {
> ...
> spin_lock(&configfs_dirent_lock);
> ...
> err = configfs_attach_attr(sd, dentry);
> ...
> spin_unlock(&configfs_dirent_lock);
> ...
> }
>
> and
>
> configfs_attach_attr(...)
> {
> ...
> spin_lock(&configfs_dirent_lock);
> ...
> }
>
> which unless it is way too late here and I really need to go to sleep
> just won't work.
Kyle, you did the backport, any comments?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-20 8:11 ` Greg Kroah-Hartman
@ 2023-09-20 15:18 ` Guenter Roeck
2023-09-20 17:01 ` Florian Fainelli
0 siblings, 1 reply; 431+ messages in thread
From: Guenter Roeck @ 2023-09-20 15:18 UTC (permalink / raw)
To: Greg Kroah-Hartman, Kyle Zeng
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
On 9/20/23 01:11, Greg Kroah-Hartman wrote:
> On Tue, Sep 19, 2023 at 09:57:25PM -0700, Guenter Roeck wrote:
>> On 9/17/23 12:07, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 5.10.195 release.
>>> There are 406 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
>>> Anything received after that time might be too late.
>>>
>>
>> chromeos-5.10 locks up in configfs_lookup() after the merge of v5.10.195.
>>
>> I am a bit puzzled because I see
>>
>> c709c7ca020a configfs: fix a race in configfs_lookup()
>>
>> in v5.10.195 but not in the list of commits below. I guess I must be
>> missing something.
>
> It was part of the big patchset, it was posted here:
> https://lore.kernel.org/r/20230917191101.511939651@linuxfoundation.org
>
> Not hidden at all :)
>
> and was submitted here:
> https://lore.kernel.org/r/ZPOZFHHA0abVmGx+@westworld
>
>> Either case, the code now looks as follows.
>>
>> configfs_lookup()
>> {
>> ...
>> spin_lock(&configfs_dirent_lock);
>> ...
>> err = configfs_attach_attr(sd, dentry);
>> ...
>> spin_unlock(&configfs_dirent_lock);
>> ...
>> }
>>
>> and
>>
>> configfs_attach_attr(...)
>> {
>> ...
>> spin_lock(&configfs_dirent_lock);
>> ...
>> }
>>
>> which unless it is way too late here and I really need to go to sleep
>> just won't work.
>
> Kyle, you did the backport, any comments?
>
After a good night sleep, the code still looks wrong to me. Reverting
the offending patch in chromeos-5.10 solved the problem there.
That makes me suspect that no one actually tests configfs.
Guenter
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-20 15:18 ` Guenter Roeck
@ 2023-09-20 17:01 ` Florian Fainelli
2023-09-20 19:13 ` Kyle Zeng
0 siblings, 1 reply; 431+ messages in thread
From: Florian Fainelli @ 2023-09-20 17:01 UTC (permalink / raw)
To: Guenter Roeck, Greg Kroah-Hartman, Kyle Zeng
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor
On 9/20/23 08:18, Guenter Roeck wrote:
> On 9/20/23 01:11, Greg Kroah-Hartman wrote:
>> On Tue, Sep 19, 2023 at 09:57:25PM -0700, Guenter Roeck wrote:
>>> On 9/17/23 12:07, Greg Kroah-Hartman wrote:
>>>> This is the start of the stable review cycle for the 5.10.195 release.
>>>> There are 406 patches in this series, all will be posted as a response
>>>> to this one. If anyone has any issues with these being applied, please
>>>> let me know.
>>>>
>>>> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
>>>> Anything received after that time might be too late.
>>>>
>>>
>>> chromeos-5.10 locks up in configfs_lookup() after the merge of
>>> v5.10.195.
>>>
>>> I am a bit puzzled because I see
>>>
>>> c709c7ca020a configfs: fix a race in configfs_lookup()
>>>
>>> in v5.10.195 but not in the list of commits below. I guess I must be
>>> missing something.
>>
>> It was part of the big patchset, it was posted here:
>> https://lore.kernel.org/r/20230917191101.511939651@linuxfoundation.org
>>
>> Not hidden at all :)
>>
>> and was submitted here:
>> https://lore.kernel.org/r/ZPOZFHHA0abVmGx+@westworld
>>
>>> Either case, the code now looks as follows.
>>>
>>> configfs_lookup()
>>> {
>>> ...
>>> spin_lock(&configfs_dirent_lock);
>>> ...
>>> err = configfs_attach_attr(sd, dentry);
>>> ...
>>> spin_unlock(&configfs_dirent_lock);
>>> ...
>>> }
>>>
>>> and
>>>
>>> configfs_attach_attr(...)
>>> {
>>> ...
>>> spin_lock(&configfs_dirent_lock);
>>> ...
>>> }
>>>
>>> which unless it is way too late here and I really need to go to sleep
>>> just won't work.
>>
>> Kyle, you did the backport, any comments?
>>
>
> After a good night sleep, the code still looks wrong to me. Reverting
> the offending patch in chromeos-5.10 solved the problem there.
> That makes me suspect that no one actually tests configfs.
Humm indeed, looking at our testing we don't have our USB devices being
tested which would exercise configfs since we switch the USB device
between different configurations (mass storage, serial, networking
etc.). Let me see about adding that so we get some coverage.
--
Florian
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-20 17:01 ` Florian Fainelli
@ 2023-09-20 19:13 ` Kyle Zeng
2023-09-21 7:13 ` Greg Kroah-Hartman
0 siblings, 1 reply; 431+ messages in thread
From: Kyle Zeng @ 2023-09-20 19:13 UTC (permalink / raw)
To: Florian Fainelli
Cc: Guenter Roeck, Greg Kroah-Hartman, stable, patches, linux-kernel,
torvalds, akpm, shuah, patches, lkft-triage, pavel, jonathanh,
sudipm.mukherjee, srw, rwarsow, conor
[-- Attachment #1: Type: text/plain, Size: 3283 bytes --]
On Wed, Sep 20, 2023 at 10:01:55AM -0700, Florian Fainelli wrote:
> On 9/20/23 08:18, Guenter Roeck wrote:
> > On 9/20/23 01:11, Greg Kroah-Hartman wrote:
> > > On Tue, Sep 19, 2023 at 09:57:25PM -0700, Guenter Roeck wrote:
> > > > On 9/17/23 12:07, Greg Kroah-Hartman wrote:
> > > > > This is the start of the stable review cycle for the 5.10.195 release.
> > > > > There are 406 patches in this series, all will be posted as a response
> > > > > to this one. If anyone has any issues with these being applied, please
> > > > > let me know.
> > > > >
> > > > > Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> > > > > Anything received after that time might be too late.
> > > > >
> > > >
> > > > chromeos-5.10 locks up in configfs_lookup() after the merge of
> > > > v5.10.195.
> > > >
> > > > I am a bit puzzled because I see
> > > >
> > > > c709c7ca020a configfs: fix a race in configfs_lookup()
> > > >
> > > > in v5.10.195 but not in the list of commits below. I guess I must be
> > > > missing something.
> > >
> > > It was part of the big patchset, it was posted here:
> > > https://lore.kernel.org/r/20230917191101.511939651@linuxfoundation.org
> > >
> > > Not hidden at all :)
> > >
> > > and was submitted here:
> > > https://lore.kernel.org/r/ZPOZFHHA0abVmGx+@westworld
> > >
> > > > Either case, the code now looks as follows.
> > > >
> > > > configfs_lookup()
> > > > {
> > > > ...
> > > > spin_lock(&configfs_dirent_lock);
> > > > ...
> > > > err = configfs_attach_attr(sd, dentry);
> > > > ...
> > > > spin_unlock(&configfs_dirent_lock);
> > > > ...
> > > > }
> > > >
> > > > and
> > > >
> > > > configfs_attach_attr(...)
> > > > {
> > > > ...
> > > > spin_lock(&configfs_dirent_lock);
> > > > ...
> > > > }
> > > >
> > > > which unless it is way too late here and I really need to go to sleep
> > > > just won't work.
> > >
> > > Kyle, you did the backport, any comments?
> > >
> >
> > After a good night sleep, the code still looks wrong to me. Reverting
> > the offending patch in chromeos-5.10 solved the problem there.
> > That makes me suspect that no one actually tests configfs.
>
> Humm indeed, looking at our testing we don't have our USB devices being
> tested which would exercise configfs since we switch the USB device between
> different configurations (mass storage, serial, networking etc.). Let me see
> about adding that so we get some coverage.
> --
> Florian
>
Sorry for the wrong patch. My intention was to backport c42dd069be8dfc9b2239a5c89e73bbd08ab35de0
to v5.10 to avoid a race condition triggered in my test. I tested the
patch with my PoC program and made sure it won't trigger the crash. But
I didn't notice that it could hang the kernel.
I sincerely apologize for the mistake.
My new proposed patch backports both
c42dd069be8dfc9b2239a5c89e73bbd08ab35de0 and d07f132a225c013e59aa77f514ad9211ecab82ee.
I made sure it does not trigger the race condition anymore.
Can anyone having access to more comprehensive tests please check whether it works?
Also, I'm not sure whether it is OK or how to backport two patches in
one patch. Please advise on how to do it properly.
The crash triggering PoC program is also attached.
Thanks,
Kyle Zeng
[-- Attachment #2: patch --]
[-- Type: text/plain, Size: 3493 bytes --]
diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c
index 12388ed4faa5..43093c218628 100644
--- a/fs/configfs/dir.c
+++ b/fs/configfs/dir.c
@@ -55,7 +55,7 @@ static void configfs_d_iput(struct dentry * dentry,
/*
* Set sd->s_dentry to null only when this dentry is the one
* that is going to be killed. Otherwise configfs_d_iput may
- * run just after configfs_attach_attr and set sd->s_dentry to
+ * run just after configfs_lookup and set sd->s_dentry to
* NULL even it's still in use.
*/
if (sd->s_dentry == dentry)
@@ -428,44 +428,13 @@ static void configfs_remove_dir(struct config_item * item)
dput(dentry);
}
-
-/* attaches attribute's configfs_dirent to the dentry corresponding to the
- * attribute file
- */
-static int configfs_attach_attr(struct configfs_dirent * sd, struct dentry * dentry)
-{
- struct configfs_attribute * attr = sd->s_element;
- struct inode *inode;
-
- spin_lock(&configfs_dirent_lock);
- dentry->d_fsdata = configfs_get(sd);
- sd->s_dentry = dentry;
- spin_unlock(&configfs_dirent_lock);
-
- inode = configfs_create(dentry, (attr->ca_mode & S_IALLUGO) | S_IFREG);
- if (IS_ERR(inode)) {
- configfs_put(sd);
- return PTR_ERR(inode);
- }
- if (sd->s_type & CONFIGFS_ITEM_BIN_ATTR) {
- inode->i_size = 0;
- inode->i_fop = &configfs_bin_file_operations;
- } else {
- inode->i_size = PAGE_SIZE;
- inode->i_fop = &configfs_file_operations;
- }
- d_add(dentry, inode);
- return 0;
-}
-
static struct dentry * configfs_lookup(struct inode *dir,
struct dentry *dentry,
unsigned int flags)
{
struct configfs_dirent * parent_sd = dentry->d_parent->d_fsdata;
struct configfs_dirent * sd;
- int found = 0;
- int err;
+ struct inode *inode = NULL;
/*
* Fake invisibility if dir belongs to a group/default groups hierarchy
@@ -475,36 +444,39 @@ static struct dentry * configfs_lookup(struct inode *dir,
* not complete their initialization, since the dentries of the
* attributes won't be instantiated.
*/
- err = -ENOENT;
if (!configfs_dirent_is_ready(parent_sd))
- goto out;
+ return ERR_PTR(-ENOENT);
+ spin_lock(&configfs_dirent_lock);
list_for_each_entry(sd, &parent_sd->s_children, s_sibling) {
- if (sd->s_type & CONFIGFS_NOT_PINNED) {
- const unsigned char * name = configfs_get_name(sd);
+ if ((sd->s_type & CONFIGFS_NOT_PINNED) &&
+ !strcmp(configfs_get_name(sd), dentry->d_name.name)) {
+ struct configfs_attribute *attr = sd->s_element;
+ umode_t mode = (attr->ca_mode & S_IALLUGO) | S_IFREG;
- if (strcmp(name, dentry->d_name.name))
- continue;
+ dentry->d_fsdata = configfs_get(sd);
+ sd->s_dentry = dentry;
+ spin_unlock(&configfs_dirent_lock);
- found = 1;
- err = configfs_attach_attr(sd, dentry);
- break;
+ inode = configfs_create(dentry, mode);
+ if (IS_ERR(inode)) {
+ configfs_put(sd);
+ return ERR_CAST(inode);
+ }
+ if (sd->s_type & CONFIGFS_ITEM_BIN_ATTR) {
+ inode->i_size = 0;
+ inode->i_fop = &configfs_bin_file_operations;
+ } else {
+ inode->i_size = PAGE_SIZE;
+ inode->i_fop = &configfs_file_operations;
+ }
+ goto done;
}
}
-
- if (!found) {
- /*
- * If it doesn't exist and it isn't a NOT_PINNED item,
- * it must be negative.
- */
- if (dentry->d_name.len > NAME_MAX)
- return ERR_PTR(-ENAMETOOLONG);
- d_add(dentry, NULL);
- return NULL;
- }
-
-out:
- return ERR_PTR(err);
+ spin_unlock(&configfs_dirent_lock);
+done:
+ d_add(dentry, inode);
+ return NULL;
}
/*
[-- Attachment #3: poc.c --]
[-- Type: text/x-csrc, Size: 240 bytes --]
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
int main(void)
{
int fd = open("/sys/kernel/config", 0);
if(!fork()) {
while(1) lseek(fd, SEEK_CUR, 1);
}
while(1) unlinkat(fd, "file", 0);
return 0;
}
^ permalink raw reply related [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-20 19:13 ` Kyle Zeng
@ 2023-09-21 7:13 ` Greg Kroah-Hartman
0 siblings, 0 replies; 431+ messages in thread
From: Greg Kroah-Hartman @ 2023-09-21 7:13 UTC (permalink / raw)
To: Kyle Zeng
Cc: Florian Fainelli, Guenter Roeck, stable, patches, linux-kernel,
torvalds, akpm, shuah, patches, lkft-triage, pavel, jonathanh,
sudipm.mukherjee, srw, rwarsow, conor
On Wed, Sep 20, 2023 at 12:13:25PM -0700, Kyle Zeng wrote:
> On Wed, Sep 20, 2023 at 10:01:55AM -0700, Florian Fainelli wrote:
> > On 9/20/23 08:18, Guenter Roeck wrote:
> > > On 9/20/23 01:11, Greg Kroah-Hartman wrote:
> > > > On Tue, Sep 19, 2023 at 09:57:25PM -0700, Guenter Roeck wrote:
> > > > > On 9/17/23 12:07, Greg Kroah-Hartman wrote:
> > > > > > This is the start of the stable review cycle for the 5.10.195 release.
> > > > > > There are 406 patches in this series, all will be posted as a response
> > > > > > to this one. If anyone has any issues with these being applied, please
> > > > > > let me know.
> > > > > >
> > > > > > Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> > > > > > Anything received after that time might be too late.
> > > > > >
> > > > >
> > > > > chromeos-5.10 locks up in configfs_lookup() after the merge of
> > > > > v5.10.195.
> > > > >
> > > > > I am a bit puzzled because I see
> > > > >
> > > > > c709c7ca020a configfs: fix a race in configfs_lookup()
> > > > >
> > > > > in v5.10.195 but not in the list of commits below. I guess I must be
> > > > > missing something.
> > > >
> > > > It was part of the big patchset, it was posted here:
> > > > https://lore.kernel.org/r/20230917191101.511939651@linuxfoundation.org
> > > >
> > > > Not hidden at all :)
> > > >
> > > > and was submitted here:
> > > > https://lore.kernel.org/r/ZPOZFHHA0abVmGx+@westworld
> > > >
> > > > > Either case, the code now looks as follows.
> > > > >
> > > > > configfs_lookup()
> > > > > {
> > > > > ...
> > > > > spin_lock(&configfs_dirent_lock);
> > > > > ...
> > > > > err = configfs_attach_attr(sd, dentry);
> > > > > ...
> > > > > spin_unlock(&configfs_dirent_lock);
> > > > > ...
> > > > > }
> > > > >
> > > > > and
> > > > >
> > > > > configfs_attach_attr(...)
> > > > > {
> > > > > ...
> > > > > spin_lock(&configfs_dirent_lock);
> > > > > ...
> > > > > }
> > > > >
> > > > > which unless it is way too late here and I really need to go to sleep
> > > > > just won't work.
> > > >
> > > > Kyle, you did the backport, any comments?
> > > >
> > >
> > > After a good night sleep, the code still looks wrong to me. Reverting
> > > the offending patch in chromeos-5.10 solved the problem there.
> > > That makes me suspect that no one actually tests configfs.
> >
> > Humm indeed, looking at our testing we don't have our USB devices being
> > tested which would exercise configfs since we switch the USB device between
> > different configurations (mass storage, serial, networking etc.). Let me see
> > about adding that so we get some coverage.
> > --
> > Florian
> >
>
> Sorry for the wrong patch. My intention was to backport c42dd069be8dfc9b2239a5c89e73bbd08ab35de0
> to v5.10 to avoid a race condition triggered in my test. I tested the
> patch with my PoC program and made sure it won't trigger the crash. But
> I didn't notice that it could hang the kernel.
> I sincerely apologize for the mistake.
>
> My new proposed patch backports both
> c42dd069be8dfc9b2239a5c89e73bbd08ab35de0 and d07f132a225c013e59aa77f514ad9211ecab82ee.
> I made sure it does not trigger the race condition anymore.
> Can anyone having access to more comprehensive tests please check whether it works?
>
> Also, I'm not sure whether it is OK or how to backport two patches in
> one patch. Please advise on how to do it properly.
Please backport them both individually, do not merge them together.
I'll go revert the current change now and push out a release with it so
that it fixes users of this kernel tree.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 000/406] 5.10.195-rc1 review
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
` (413 preceding siblings ...)
2023-09-20 4:57 ` Guenter Roeck
@ 2023-09-21 20:35 ` Joel Fernandes
414 siblings, 0 replies; 431+ messages in thread
From: Joel Fernandes @ 2023-09-21 20:35 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Sun, Sep 17, 2023 at 09:07:34PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.195 release.
> There are 406 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Tue, 19 Sep 2023 19:10:04 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.195-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
For RCU,
Tested-by: Joel Fernandes (Google) <joel@joelfernandes.org>
thanks,
- Joel
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.195-rc1
>
> Helge Deller <deller@gmx.de>
> parisc: Drop loops_per_jiffy from per_cpu struct
>
> Wesley Chalmers <wesley.chalmers@amd.com>
> drm/amd/display: Fix a bug when searching for insert_above_mpcc
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg().
>
> Vadim Fedorenko <vadim.fedorenko@linux.dev>
> ixgbe: fix timestamp configuration code
>
> Eric Dumazet <edumazet@google.com>
> ipv6: fix ip6_sock_set_addr_preferences() typo
>
> Liu Jian <liujian56@huawei.com>
> net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict()
>
> Liming Sun <limings@nvidia.com>
> platform/mellanox: mlxbf-tmfifo: Drop jumbo frames
>
> Liming Sun <limings@nvidia.com>
> platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors
>
> Shigeru Yoshida <syoshida@redhat.com>
> kcm: Fix memory leak in error path of kcm_sendmsg()
>
> Hayes Wang <hayeswang@realtek.com>
> r8152: check budget for r8152_poll()
>
> Ziyang Xuan <william.xuanziyang@huawei.com>
> hsr: Fix uninit-value access in fill_frame_info()
>
> Hangyu Hua <hbh25y@gmail.com>
> net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all()
>
> Hangyu Hua <hbh25y@gmail.com>
> net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc()
>
> Guangguan Wang <guangguan.wang@linux.alibaba.com>
> net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add
>
> Björn Töpel <bjorn@rivosinc.com>
> kselftest/runner.sh: Propagate SIGTERM to runner child
>
> SeongJae Park <sjpark@amazon.de>
> selftests/kselftest/runner/run_one(): allow running non-executable files
>
> Liu Jian <liujian56@huawei.com>
> net: ipv4: fix one memleak in __inet_del_ifa()
>
> Qiang Yu <quic_qianyu@quicinc.com>
> bus: mhi: host: Skip MHI reset if device is in RDDM
>
> Aleksey Nasibulin <alealexpro100@ya.ru>
> ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2
>
> Paul Cercueil <paul@crapouillou.net>
> ARM: dts: samsung: exynos4210-i9100: Fix LCD screen's physical size
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Flush mailbox commands on chip reset
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix crash in PCIe error handling
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe
>
> Saurav Kashyap <skashyap@marvell.com>
> scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry
>
> D Scott Phillips <scott@os.amperecomputing.com>
> arm64: sdei: abort running SDEI handlers during crash
>
> Shuai Xue <xueshuai@linux.alibaba.com>
> ACPI: APEI: explicit init of HEST and GHES in apci_init()
>
> Namhyung Kim <namhyung@kernel.org>
> perf hists browser: Fix the number of entries for 'e' key
>
> Namhyung Kim <namhyung@kernel.org>
> perf tools: Handle old data in PERF_RECORD_ATTR
>
> Namhyung Kim <namhyung@kernel.org>
> perf hists browser: Fix hierarchy mode header
>
> Hamza Mahfooz <hamza.mahfooz@amd.com>
> drm/amd/display: prevent potential division by zero errors
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix potential false time out warning
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix crash during the panic_write
>
> Anand Jain <anand.jain@oracle.com>
> btrfs: use the correct superblock to compare fsid in btrfs_validate_super
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: don't start transaction when joining with TRANS_JOIN_NOSTART
>
> ruanmeisi <ruan.meisi@zte.com.cn>
> fuse: nlookup missing decrement in fuse_direntplus_link
>
> Damien Le Moal <dlemoal@kernel.org>
> ata: pata_ftide010: Add missing MODULE_DESCRIPTION
>
> Damien Le Moal <dlemoal@kernel.org>
> ata: sata_gemini: Add missing MODULE_DESCRIPTION
>
> Wang Jianjian <wangjianjian0@foxmail.com>
> ext4: add correct group descriptors and reserved GDT blocks to system zone
>
> Petr Tesarik <petr.tesarik.ext@huawei.com>
> sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory()
>
> Yisen Zhuang <yisen.zhuang@huawei.com>
> net: hns3: fix the port information display when sfp is absent
>
> Wander Lairson Costa <wander@redhat.com>
> netfilter: nfnetlink_osf: avoid OOB read
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload
>
> Eric Dumazet <edumazet@google.com>
> ip_tunnels: use DEV_STATS_INC()
>
> Ariel Marcovitch <arielmarcovitch@gmail.com>
> idr: fix param name in idr_alloc_cyclic() doc
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> s390/zcrypt: don't leak memory if dev_set_name() fails
>
> Olga Zaborska <olga.zaborska@intel.com>
> igb: Change IGB_MIN to allow set rx/tx value between 64 and 80
>
> Olga Zaborska <olga.zaborska@intel.com>
> igbvf: Change IGBVF_MIN to allow set rx/tx value between 64 and 80
>
> Olga Zaborska <olga.zaborska@intel.com>
> igc: Change IGC_MIN to allow set rx/tx value between 64 and 80
>
> Shigeru Yoshida <syoshida@redhat.com>
> kcm: Destroy mutex in kcm_exit_net()
>
> valis <sec@valis.email>
> net: sched: sch_qfq: Fix UAF in qfq_dequeue()
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data race around sk->sk_err.
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data-races around sk->sk_shutdown.
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data-race around unix_tot_inflight.
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> af_unix: Fix data-races around user->unix_inflight.
>
> Alex Henrie <alexhenrie24@gmail.com>
> net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr
>
> Liang Chen <liangchen.linux@gmail.com>
> veth: Fixing transmit return status for dropped packets
>
> Corinna Vinschen <vinschen@redhat.com>
> igb: disable virtualization features on 82580
>
> Sriram Yagnaraman <sriram.yagnaraman@est.tech>
> ipv4: ignore dst hint for multipath routes
>
> Sean Christopherson <seanjc@google.com>
> drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt()
>
> Colin Xu <colin.xu@intel.com>
> drm/i915/gvt: Save/restore HW status to support GVT suspend/resume
>
> Eric Dumazet <edumazet@google.com>
> net: read sk->sk_family once in sk_mc_loop()
>
> Eric Dumazet <edumazet@google.com>
> ipv4: annotate data-races around fi->fib_dead
>
> Eric Dumazet <edumazet@google.com>
> sctp: annotate data-races around sk->sk_wmem_queued
>
> Eric Dumazet <edumazet@google.com>
> net/sched: fq_pie: avoid stalls in fq_pie_timer()
>
> Vladimir Zapolskiy <vz@mleia.com>
> pwm: lpc32xx: Remove handling of PWM channels
>
> Raag Jadav <raag.jadav@intel.com>
> watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load
>
> Arnaldo Carvalho de Melo <acme@redhat.com>
> perf top: Don't pass an ERR_PTR() directly to perf_session__delete()
>
> Sean Christopherson <seanjc@google.com>
> x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm()
>
> Arnaldo Carvalho de Melo <acme@redhat.com>
> perf annotate bpf: Don't enclose non-debug code with an assert()
>
> Ying Liu <victor.liu@nxp.com>
> backlight: gpio_backlight: Drop output GPIO direction check for initial power state
>
> Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
> kconfig: fix possible buffer overflow
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> NFS: Fix a potential data corruption
>
> Chris Lew <quic_clew@quicinc.com>
> soc: qcom: qmi_encdec: Restrict string length in decode
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock
>
> Ahmad Fatoum <a.fatoum@pengutronix.de>
> clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> dt-bindings: clock: xlnx,versal-clk: drop select:false
>
> Raag Jadav <raag.jadav@intel.com>
> pinctrl: cherryview: fix address_space_handler() argument
>
> Helge Deller <deller@gmx.de>
> parisc: led: Reduce CPU overhead for disk & lan LED computation
>
> Helge Deller <deller@gmx.de>
> parisc: led: Fix LAN receive and transmit LEDs
>
> Andrew Donnellan <ajd@linux.ibm.com>
> lib/test_meminit: allocate pages up to order MAX_ORDER
>
> Thomas Zimmermann <tzimmermann@suse.de>
> drm/ast: Fix DRAM init on AST2200
>
> Thomas Zimmermann <tzimmermann@suse.de>
> fbdev/ep93xx-fb: Do not assign to struct fb_info.dev
>
> Manish Rangankar <mrangankar@marvell.com>
> scsi: qla2xxx: Remove unsupported ql2xenabledif option
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Turn off noisy message log
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix erroneous link up failure
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: fix inconsistent TMF timeout
>
> Quinn Tran <qutran@marvell.com>
> scsi: qla2xxx: Fix deletion race condition
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: break iopolling on signal
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: break out of iowq iopoll on teardown
>
> Pavel Begunkov <asml.silence@gmail.com>
> io_uring: always lock in io_apoll_task_func
>
> Quan Tian <qtian@vmware.com>
> net/ipv6: SKB symmetric hash should incorporate transport ports
>
> Tom Rix <trix@redhat.com>
> udf: initialize newblock to 0
>
> Yu Kuai <yukuai3@huawei.com>
> md/md-bitmap: remove unnecessary local variable in backlog_store()
>
> Brian Foster <bfoster@redhat.com>
> tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY
>
> Marco Felsch <m.felsch@pengutronix.de>
> usb: typec: tcpci: clear the fault status bit
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Fix oversight in SuperSpeed initialization
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Fix race by not overwriting udev->descriptor in hub_port_init()
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Change usb_get_device_descriptor() API
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: core: Unite old scheme and new scheme descriptor reads
>
> RD Babiera <rdbabiera@google.com>
> usb: typec: bus: verify partner exists in typec_altmode_attention
>
> Gustavo A. R. Silva <gustavoars@kernel.org>
> cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug
>
> Thomas Bourgoin <thomas.bourgoin@foss.st.com>
> crypto: stm32 - fix loop iterating through scatterlist for DMA
>
> Sven Schnelle <svens@linux.ibm.com>
> s390/ipl: add missing secure/has_secure file to ipl type 'unknown'
>
> Enlin Mu <enlin.mu@unisoc.com>
> pstore/ram: Check start of empty przs during init
>
> Eric Biggers <ebiggers@google.com>
> fsverity: skip PKCS#7 parser when keyring is empty
>
> Nicolas Dichtel <nicolas.dichtel@6wind.com>
> net: handle ARPHRD_PPP in dev_is_mac_header_xmit()
>
> Thore Sommer <public@thson.de>
> X.509: if signature is unsupported skip validation
>
> Jann Horn <jannh@google.com>
> dccp: Fix out of bounds access in DCCP error handler
>
> Alexander Aring <aahringo@redhat.com>
> dlm: fix plock lookup when using multiple lockspaces
>
> Yafang Shao <laoar.shao@gmail.com>
> bpf: Fix issue in verifying allow_ptr_leaks
>
> Helge Deller <deller@gmx.de>
> parisc: Fix /proc/cpuinfo output for lscpu
>
> Aleksa Sarai <cyphar@cyphar.com>
> procfs: block chmod on /proc/thread-self/comm
>
> Bjorn Helgaas <bhelgaas@google.com>
> Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset"
>
> Dave Jiang <dave.jiang@intel.com>
> ntb: Fix calculation ntb_transport_tx_free_entry()
>
> Dave Jiang <dave.jiang@intel.com>
> ntb: Clean up tx tail index on link down
>
> Dave Jiang <dave.jiang@intel.com>
> ntb: Drop packets when qp link is down
>
> Ranjan Kumar <ranjan.kumar@broadcom.com>
> scsi: mpt3sas: Perform additional retries if doorbell read returns 0
>
> Nilesh Javali <njavali@marvell.com>
> Revert "scsi: qla2xxx: Fix buffer overrun"
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> media: dvb: symbol fixup for dvb_attach()
>
> Will Deacon <will@kernel.org>
> arm64: csum: Fix OoB access in IP checksum code for negative lengths
>
> Max Filippov <jcmvbkbc@gmail.com>
> xtensa: PMU: fix base address for the newer hardware
>
> Thomas Zimmermann <tzimmermann@suse.de>
> backlight/lv5207lp: Compare against struct fb_info.device
>
> Thomas Zimmermann <tzimmermann@suse.de>
> backlight/bd6107: Compare against struct fb_info.device
>
> Thomas Zimmermann <tzimmermann@suse.de>
> backlight/gpio_backlight: Compare against struct fb_info.device
>
> Gustavo A. R. Silva <gustavoars@kernel.org>
> ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch()
>
> Yi Yang <yiyang13@huawei.com>
> ipmi_si: fix a memleak in try_smi_init()
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: core: Fix the scsi_set_resid() documentation
>
> Kees Cook <keescook@chromium.org>
> printk: ringbuffer: Fix truncating buffer size min_t cast
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl
>
> Boris Brezillon <boris.brezillon@collabora.com>
> PM / devfreq: Fix leak in devfreq_dev_release()
>
> Radoslaw Tyl <radoslawx.tyl@intel.com>
> igb: set max size RX buffer when store bad packet is enabled
>
> Mohamed Khalfella <mkhalfella@purestorage.com>
> skbuff: skb_segment, Call zero copy functions before using skbuff frags
>
> Wander Lairson Costa <wander@redhat.com>
> netfilter: xt_sctp: validate the flag_info count
>
> Wander Lairson Costa <wander@redhat.com>
> netfilter: xt_u32: validate user space input
>
> Kyle Zeng <zengyhkyle@gmail.com>
> netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c
>
> Eric Dumazet <edumazet@google.com>
> igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU
>
> Yuan Yao <yuanyaogoog@chromium.org>
> virtio_ring: fix avail_wrap_counter in virtqueue_add_packed
>
> Liao Chang <liaochang1@huawei.com>
> cpufreq: Fix the race condition while updating the transition_task of policy
>
> ruanjinjie <ruanjinjie@huawei.com>
> dmaengine: ste_dma40: Add missing IRQ check in d40_probe
>
> Randy Dunlap <rdunlap@infradead.org>
> um: Fix hostaudio build errors
>
> Yi Yang <yiyang13@huawei.com>
> mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume()
>
> Hsin-Yi Wang <hsinyi@chromium.org>
> mtd: spi-nor: Check bus width while setting QE bit
>
> Marek Behún <kabel@kernel.org>
> leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> rpmsg: glink: Add check for kstrdup
>
> Jonas Karlman <jonas@kwiboo.se>
> phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write
>
> Zheng Yang <zhengyang@rock-chips.com>
> phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate
>
> Jonas Karlman <jonas@kwiboo.se>
> phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328
>
> William Zhang <william.zhang@broadcom.com>
> mtd: rawnand: brcmnand: Fix mtd oobsize
>
> Zheng Yejian <zhengyejian1@huawei.com>
> tracing: Fix race issue between cpu buffer write and swap
>
> Dave Hansen <dave.hansen@linux.intel.com>
> x86/speculation: Mark all Skylake CPUs as vulnerable to GDS
>
> Rahul Rameshbabu <sergeantsagara@protonmail.com>
> HID: multitouch: Correct devm device reference for hidinput input_dev name
>
> Nikita Zhandarovich <n.zhandarovich@fintech.ru>
> HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode()
>
> Guoqing Jiang <guoqing.jiang@linux.dev>
> RDMA/siw: Correct wrong debug message
>
> Guoqing Jiang <guoqing.jiang@linux.dev>
> RDMA/siw: Balance the reference of cep->kref in the error path
>
> Leon Romanovsky <leon@kernel.org>
> Revert "IB/isert: Fix incorrect release of isert connection"
>
> Peng Fan <peng.fan@nxp.com>
> amba: bus: fix refcount leak
>
> Yi Yang <yiyang13@huawei.com>
> serial: tegra: handle clk prepare error in tegra_uart_hw_init()
>
> Chengfeng Ye <dg573847474@gmail.com>
> scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock
>
> Tony Battersby <tonyb@cybernetics.com>
> scsi: core: Use 32-bit hostnum in scsi_host_lookup()
>
> Lu Jialin <lujialin4@huawei.com>
> cgroup:namespace: Remove unused cgroup_namespaces_init()
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Fix vflip / hflip set functions
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Fix ov2680_bayer_order()
>
> Hans de Goede <hdegoede@redhat.com>
> media: ov2680: Remove auto-gain and auto-exposure controls
>
> Dave Stevenson <dave.stevenson@raspberrypi.com>
> media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips
>
> Marek Vasut <marex@denx.de>
> media: ov5640: Enable MIPI interface in ov5640_set_power_mipi()
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: gadget: f_mass_storage: Fix unused variable warning
>
> Colin Ian King <colin.i.king@gmail.com>
> media: go7007: Remove redundant if statement
>
> Yanfei Xu <yanfei.xu@intel.com>
> iommu/vt-d: Fix to flush cache of PASID directory table
>
> AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
> iommu/qcom: Disable and reset context bank before programming
>
> Eddie James <eajames@linux.ibm.com>
> fsi: aspeed: Reset master errors after CFAM reset
>
> Xiang Yang <xiangyang3@huawei.com>
> IB/uverbs: Fix an potential error pointer dereference
>
> Dan Carpenter <dan.carpenter@linaro.org>
> driver core: test_async: fix an error code
>
> Rob Clark <robdclark@chromium.org>
> dma-buf/sync_file: Fix docs syntax
>
> Ruidong Tian <tianruidong@linux.alibaba.com>
> coresight: tmc: Explicit type conversions to prevent integer overflow
>
> Oleksandr Natalenko <oleksandr@redhat.com>
> scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly
>
> Oleksandr Natalenko <oleksandr@redhat.com>
> scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
>
> Oleksandr Natalenko <oleksandr@redhat.com>
> scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly
>
> Randy Dunlap <rdunlap@infradead.org>
> x86/APM: drop the duplicate APM_MINOR_DEV macro
>
> Chunyan Zhang <chunyan.zhang@unisoc.com>
> serial: sprd: Fix DMA buffer leak issue
>
> Chunyan Zhang <chunyan.zhang@unisoc.com>
> serial: sprd: Assign sprd_port after initialized to avoid wrong access
>
> Lin Ma <linma@zju.edu.cn>
> scsi: qla4xxx: Add length check when parsing nlattrs
>
> Lin Ma <linma@zju.edu.cn>
> scsi: be2iscsi: Add length check when parsing nlattrs
>
> Lin Ma <linma@zju.edu.cn>
> scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param()
>
> Lin Ma <linma@zju.edu.cn>
> scsi: iscsi: Add length check for nlattr payload
>
> Wenchao Hao <haowenchao@huawei.com>
> scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param()
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: RDMA/srp: Fix residual handling
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()
>
> Irui Wang <irui.wang@mediatek.com>
> media: mediatek: vcodec: Return NULL if no vdec_fb is found
>
> Benjamin Gaignard <benjamin.gaignard@collabora.com>
> media: rkvdec: increase max supported height for H.264
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Fix normally completed I/O analysed as failed
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Fix warnings detected by sparse
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Modify v3 HW SATA completion error processing
>
> Xingui Yang <yangxingui@huawei.com>
> scsi: hisi_sas: Modify v3 HW SSP underflow error processing
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: libsas: Introduce more SAM status code aliases in enum exec_status
>
> Luo Jiaxing <luojiaxing@huawei.com>
> scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print
>
> Daniil Dulov <d.dulov@aladdin.ru>
> media: cx24120: Add retval check for cx24120_message_send()
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer()
>
> Daniil Dulov <d.dulov@aladdin.ru>
> media: dib7000p: Fix potential division by zero
>
> Dongliang Mu <dzm91@hust.edu.cn>
> drivers: usb: smsusb: fix error handling code in smsusb_init_device
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link()
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> media: i2c: tvp5150: check return value of devm_kasprintf()
>
> Hans de Goede <hdegoede@redhat.com>
> media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables
>
> Olga Kornievskaia <kolga@netapp.com>
> NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ
>
> Benjamin Coddington <bcodding@redhat.com>
> NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN
>
> Chuck Lever <chuck.lever@oracle.com>
> NFSD: da_addr_body field missing in some GETDEVICEINFO replies
>
> Su Hui <suhui@nfschina.com>
> fs: lockd: avoid possible wrong NULL parameter
>
> Alexei Filippov <halip0503@gmail.com>
> jfs: validate max amount of blocks before allocation.
>
> Russell Currey <ruscur@russell.cc>
> powerpc/iommu: Fix notifiers being shared by PCI and VIO buses
>
> Dan Carpenter <dan.carpenter@linaro.org>
> nfs/blocklayout: Use the passed in gfp flags
>
> Russell Currey <ruscur@russell.cc>
> powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT
>
> Michael Ellerman <mpe@ellerman.id.au>
> powerpc: Don't include lppaca.h in paca.h
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> wifi: ath10k: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> net/mlx5: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> drm/radeon: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> drm/amdgpu: Use RMW accessors for changing LNKCTL
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/perf: Convert fsl_emb notifier to state machine callbacks
>
> Sourabh Jain <sourabhjain@linux.ibm.com>
> powerpc/fadump: reset dump area size if fadump memory reserve fails
>
> Stefan Hajnoczi <stefanha@redhat.com>
> vfio/type1: fix cap_migration information leak
>
> Ahmad Fatoum <a.fatoum@pengutronix.de>
> clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op
>
> Marco Felsch <m.felsch@pengutronix.de>
> clk: imx8mp: fix sai4 clock
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> PCI/ASPM: Use RMW accessors for changing LNKCTL
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> PCI: pciehp: Use RMW accessors for changing LNKCTL
>
> Claudiu Beznea <claudiu.beznea@microchip.com>
> pinctrl: mcp23s08: check return value of devm_kasprintf()
>
> Wu Zongyong <wuzongyong@linux.alibaba.com>
> PCI: Mark NVIDIA T4 GPUs to avoid bus reset
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> clk: qcom: reset: Use the correct type of sleep/delay based on length
>
> Patrick Whewell <patrick.whewell@sightlineapplications.com>
> clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents
>
> Kemeng Shi <shikemeng@huaweicloud.com>
> ext4: correct grp validation in ext4_mb_good_group
>
> David Wronek <davidwronek@gmail.com>
> clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src
>
> Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
> clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents
>
> Zhang Jianhua <chris.zjh@huawei.com>
> clk: sunxi-ng: Modify mismatched function name
>
> Minjie Du <duminjie@vivo.com>
> drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init()
>
> Corey Minyard <minyard@acm.org>
> ipmi:ssif: Fix a memory leak when scanning for an adapter
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> ipmi:ssif: Add check for kstrdup
>
> Su Hui <suhui@nfschina.com>
> ALSA: ac97: Fix possible error value of *rac97
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> of: unittest: Fix overlay type in apply/revert check
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Fix cast to enum warning
>
> Sui Jingfeng <suijingfeng@loongson.cn>
> drm/mediatek: Fix potential memory leak if vmap() fail
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Fix build warning for 64-bit build
>
> Gaosheng Cui <cuigaosheng1@huawei.com>
> audit: fix possible soft lockup in __audit_inode_child()
>
> Fabio Estevam <festevam@denx.de>
> drm/msm/a2xx: Call adreno_gpu_init() earlier
>
> Yang Wang <kevinyang.wang@amd.com>
> drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> smackfs: Prevent underflow in smk_set_cipso()
>
> Zhang Shurong <zhang_shurong@foxmail.com>
> firmware: meson_sm: fix to avoid potential NULL pointer dereference
>
> Daniel Vetter <daniel.vetter@ffwll.ch>
> drm/msm/mdp5: Don't leak some plane state
>
> Jiasheng Jiang <jiasheng@iscas.ac.cn>
> drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask
>
> Nayna Jain <nayna@linux.ibm.com>
> ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig
>
> Marek Vasut <marex@denx.de>
> drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> drm/armada: Fix off-by-one error in armada_overlay_get_property()
>
> Ruan Jinjie <ruanjinjie@huawei.com>
> of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
>
> Yangtao Li <frank.li@vivo.com>
> drm/tegra: dpaux: Fix incorrect return value of platform_get_irq
>
> Tan Zhongjun <tanzhongjun@yulong.com>
> drm/tegra: Remove superfluous error messages around platform_get_irq()
>
> Yu Kuai <yukuai3@huawei.com>
> md/md-bitmap: hold 'reconfig_mutex' in backlog_store()
>
> Guoqing Jiang <guoqing.jiang@linux.dev>
> md/bitmap: don't set max_write_behind if there is no write mostly device
>
> Srinivasan Shanmugam <srinivasan.shanmugam@amd.com>
> drm/amdgpu: Update min() to min_t() in 'amdgpu_info_ioctl'
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk"
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Fix Ethernet info for Luxul devices
>
> Bogdan Togorean <bogdan.togorean@analog.com>
> drm: adv7511: Fix low refresh rate register for ADV7533/5
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split)
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210
>
> Krzysztof Kozlowski <krzk@kernel.org>
> ARM: dts: s5pv210: adjust node names to DT spec
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split)
>
> Krzysztof Kozlowski <krzysztof.kozlowski@canonical.com>
> ARM: dts: s3c64xx: align pinctrl with dtschema
>
> Janusz Krzysztofik <janusz.krzysztofik@linux.intel.com>
> x86/mm: Fix PAT bit missing from page protection modify mask
>
> Lucas Stach <l.stach@pengutronix.de>
> drm/etnaviv: fix dumping of active MMU context
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Use updated "spi-gpio" binding properties
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Add cells sizes to PCIe node
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Drop nonexistent #usb-cells
>
> Rafał Miłecki <rafal@milecki.pl>
> ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch
>
> Serge Semin <Sergey.Semin@baikalelectronics.ru>
> ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name
>
> Arnd Bergmann <arnd@arndb.de>
> drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar()
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller
>
> Luca Weiss <luca@z3ntu.xyz>
> soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros
>
> Luca Weiss <luca@z3ntu.xyz>
> soc: qcom: ocmem: Add OCMEM hardware version print
>
> Randy Dunlap <rdunlap@infradead.org>
> ASoC: stac9766: fix build errors with REGMAP_AC97
>
> Baokun Li <libaokun1@huawei.com>
> quota: fix dqput() to follow the guarantees dquot_srcu should provide
>
> Baokun Li <libaokun1@huawei.com>
> quota: add new helper dquot_active()
>
> Baokun Li <libaokun1@huawei.com>
> quota: rename dquot_active() to inode_quota_active()
>
> Baokun Li <libaokun1@huawei.com>
> quota: factor out dquot_write_dquot()
>
> Marek Vasut <marex@denx.de>
> drm/bridge: tc358764: Fix debug print parameter order
>
> Kuniyuki Iwashima <kuniyu@amazon.com>
> netrom: Deny concurrent connect().
>
> Budimir Markovic <markovicbudimir@gmail.com>
> net/sched: sch_hfsc: Ensure inner classes have fsc curve
>
> Biju Das <biju.das.jz@bp.renesas.com>
> hwmon: (tmp513) Fix the channel number in tmp51x_is_visible()
>
> Vadim Pasternak <vadimp@nvidia.com>
> mlxsw: i2c: Limit single transaction buffer size
>
> Vadim Pasternak <vadimp@nvidia.com>
> mlxsw: i2c: Fix chunk size setting in output mailbox buffer
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> net: arcnet: Do not call kfree_skb() under local_irq_disable()
>
> Wang Ming <machel@vivo.com>
> wifi: ath9k: use IS_ERR() with debugfs_create_dir()
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave()
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: mwifiex: avoid possible NULL skb pointer dereference
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: protect WMI command response buffer replacement with a lock
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx
>
> Daniel T. Lee <danieltimlee@gmail.com>
> samples/bpf: fix broken map lookup probe
>
> Polaris Pi <pinkperfect2021@gmail.com>
> wifi: mwifiex: Fix missed return in oob checks failed path
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: mwifiex: fix memory leak in mwifiex_histogram_read()
>
> Artem Chernyshev <artem.chernyshev@red-soft.ru>
> fs: ocfs2: namei: check return value of ocfs2_add_entry()
>
> Yan Zhai <yan@cloudflare.com>
> lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
>
> Yan Zhai <yan@cloudflare.com>
> lwt: Fix return values of BPF xmit ops
>
> Florian Fainelli <florian.fainelli@broadcom.com>
> hwrng: iproc-rng200 - Implement suspend and resume calls
>
> Gaurav Jain <gaurav.jain@nxp.com>
> crypto: caam - fix unchecked return value error
>
> Przemek Kitszel <przemyslaw.kitszel@intel.com>
> ice: ice_aq_check_events: fix off-by-one check when filling buffer
>
> Yipeng Zou <zouyipeng@huawei.com>
> selftests/bpf: Clean up fmod_ret in bench_rename test script
>
> Menglong Dong <imagedong@tencent.com>
> net: tcp: fix unexcepted socket die when snd_wnd is 0
>
> Min Li <lm0963hack@gmail.com>
> Bluetooth: Fix potential use-after-free when clear keys
>
> Yuanjun Gong <ruc_gongyuanjun@163.com>
> Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe()
>
> Herbert Xu <herbert@gondor.apana.org.au>
> crypto: api - Use work queue in crypto_destroy_instance
>
> Eric Biggers <ebiggers@google.com>
> crypto: blake2b - sync with blake2s implementation
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> crypto: stm32 - Properly handle pm_runtime_get failing
>
> Alan Maguire <alan.maguire@oracle.com>
> selftests/bpf: fix static assert compilation issue for test_cls_*.c
>
> Dmitry Antipov <dmantipov@yandex.ru>
> wifi: mwifiex: fix error recovery in PCIE buffer descriptor management
>
> Polaris Pi <pinkperfect2021@gmail.com>
> wifi: mwifiex: Fix OOB and integer underflow when rx packets
>
> Marc Kleine-Budde <mkl@pengutronix.de>
> can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM
>
> Zhang Shurong <zhang_shurong@foxmail.com>
> spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe()
>
> Lin Ma <linma@zju.edu.cn>
> wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH
>
> Lorenz Bauer <lmb@isovalent.com>
> bpf: reject unhashed sockets in bpf_sk_assign
>
> Lorenz Bauer <lmb@isovalent.com>
> udp: re-score reuseport groups when connected sockets are present
>
> Dan Carpenter <dan.carpenter@linaro.org>
> regmap: rbtree: Use alloc_flags for memory allocations
>
> Martin Kaiser <martin@kaiser.cx>
> hwrng: nomadik - keep clock enabled while hwrng is registered
>
> Eric Dumazet <edumazet@google.com>
> tcp: tcp_enter_quickack_mode() should be static
>
> Yafang Shao <laoar.shao@gmail.com>
> bpf: Clear the probe_addr for uprobe
>
> Alexander Lobakin <alobakin@pm.me>
> bpftool: Use a local bpf_perf_event_value to fix accessing its fields
>
> Liao Chang <liaochang1@huawei.com>
> cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit()
>
> Mikel Rychliski <mikel@mikelr.com>
> x86/efistub: Fix PCI ROM preservation in mixed mode
>
> Holger Dengler <dengler@linux.ibm.com>
> s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs
>
> Holger Dengler <dengler@linux.ibm.com>
> s390/pkey: fix/harmonize internal keyblob headers
>
> Xu Yang <xu.yang_2@nxp.com>
> perf/imx_ddr: don't enable counter0 if none of 4 counters are used
>
> Ard Biesheuvel <ardb@kernel.org>
> x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> selftests/resctrl: Close perf value read fd on errors
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> selftests/resctrl: Unmount resctrl FS if child fails to run benchmark
>
> Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> selftests/resctrl: Don't leak buffer in fill_cache()
>
> Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
> OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd()
>
> Waiman Long <longman@redhat.com>
> refscale: Fix uninitalized use of wait_queue_head_t
>
> Kees Cook <keescook@chromium.org>
> selftests/harness: Actually report SKIP for signal tests
>
> Christian Brauner <brauner@kernel.org>
> tmpfs: verify {g,u}id mount options correctly
>
> Wang Ming <machel@vivo.com>
> fs: Fix error checking for d_hash_and_lookup()
>
> Wen Yang <wenyang.linux@foxmail.com>
> eventfd: prevent underflow for eventfd semaphores
>
> David Woodhouse <dwmw@amazon.co.uk>
> eventfd: Export eventfd_ctx_do_read()
>
> Matthew Wilcox <willy@infradead.org>
> reiserfs: Check the return value from __getblk()
>
> Sabrina Dubroca <sd@queasysnail.net>
> Revert "net: macsec: preserve ingress frame ordering"
>
> Jan Kara <jack@suse.cz>
> udf: Handle error when adding extent to a file
>
> Vladislav Efanov <VEfanov@ispras.ru>
> udf: Check consistency of Space Bitmap Descriptor
>
> Jordan Rife <jrife@google.com>
> net: Avoid address overwrite in kernel_connect
>
> Shih-Yi Chen <shihyic@nvidia.com>
> platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications
>
> Zheng Yejian <zhengyejian1@huawei.com>
> tracing: Introduce pipe_cpumask to avoid race on trace_pipes
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: seq: oss: Fix racy open/close of MIDI devices
>
> Michael Kelley <mikelley@microsoft.com>
> scsi: storvsc: Always set no_report_opcodes
>
> Dan Carpenter <dan.carpenter@linaro.org>
> sctp: handle invalid error codes without calling BUG()
>
> David Christensen <drc@linux.vnet.ibm.com>
> bnx2x: fix page fault following EEH recovery
>
> Dmitry Mastykin <dmastykin@astralinux.ru>
> netlabel: fix shift wrapping bug in netlbl_catmap_setlong()
>
> Chengfeng Ye <dg573847474@gmail.com>
> scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock
>
> Baoquan He <bhe@redhat.com>
> idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM
>
> Martin Kohn <m.kohn@welotec.com>
> net: usb: qmi_wwan: add Quectel EM05GV2
>
> Ani Sinha <anisinha@redhat.com>
> vmbus_testing: fix wrong python syntax for integer value comparison
>
> Baoquan He <bhe@redhat.com>
> clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM
>
> Masami Hiramatsu (Google) <mhiramat@kernel.org>
> kprobes: Prohibit probing on CFI preamble symbol
>
> Christian Göttsche <cgzones@googlemail.com>
> security: keys: perform capable check only on privileged operations
>
> Minjie Du <duminjie@vivo.com>
> ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer()
>
> Eric Snowberg <eric.snowberg@oracle.com>
> ovl: Always reevaluate the file signature for IMA
>
> Leo Chen <sancchen@amd.com>
> drm/amd/display: Exit idle optimizations before attempt to access PHY
>
> Konstantin Shelekhin <k.shelekhin@ftml.net>
> platform/x86: huawei-wmi: Silence ambient light sensor
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: intel: hid: Always call BTNL ACPI method
>
> Guiting Shen <aarongt.shen@gmail.com>
> ASoC: atmel: Fix the 8K sample parameter in I2SC master
>
> Edgar <ljijcj@163.com>
> ASoc: codecs: ES8316: Fix DMIC config
>
> Winston Wen <wentao@uniontech.com>
> fs/nls: make load_nls() take a const parameter
>
> Stefan Haberland <sth@linux.ibm.com>
> s390/dasd: fix hanging device after request requeue
>
> Stefan Haberland <sth@linux.ibm.com>
> s390/dasd: use correct number of retries for ERP requests
>
> Ben Hutchings <benh@debian.org>
> m68k: Fix invalid .section syntax
>
> Jiri Benc <jbenc@redhat.com>
> vxlan: generalize vxlan_parse_gpe_hdr and remove unused args
>
> Yuanjun Gong <ruc_gongyuanjun@163.com>
> ethernet: atheros: fix return value check in atl1c_tso_csum()
>
> Dmytro Maluka <dmy@semihalf.com>
> ASoC: da7219: Check for failure reading AAD IRQ events
>
> Dmytro Maluka <dmy@semihalf.com>
> ASoC: da7219: Flush pending AAD IRQ when suspending
>
> Dominique Martinet <asmadeus@codewreck.org>
> 9p: virtio: make sure 'offs' is initialized in zc_request
>
> Nikolay Burykin <burikin@ivk.ru>
> media: pci: cx23885: fix error handling for cx23885 ATSC boards
>
> Dmitry Antipov <dmantipov@yandex.ru>
> media: pulse8-cec: handle possible ping error
>
> Adrien Thierry <athierry@redhat.com>
> phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code
>
> Xiaolei Wang <xiaolei.wang@windriver.com>
> ARM: dts: imx: Set default tuning step for imx7d usdhc
>
> Stefan Wahren <stefan.wahren@i2se.com>
> ARM: dts: imx: Adjust dma-apbh node name
>
> Marek Vasut <marex@denx.de>
> ARM: dts: imx7s: Drop dma-apb interrupt-names
>
> Joy Zou <joy.zou@nxp.com>
> ARM: dts: imx: update sdma node name format
>
> Oder Chiou <oder_chiou@realtek.com>
> ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire
>
> Mario Limonciello <mario.limonciello@amd.com>
> pinctrl: amd: Don't show `Invalid config param` errors
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse
>
> Ryusuke Konishi <konishi.ryusuke@gmail.com>
> nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers()
>
> Juerg Haefliger <juerg.haefliger@canonical.com>
> fsi: master-ast-cf: Add MODULE_FIRMWARE macro
>
> Wang Ming <machel@vivo.com>
> firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe
>
> Hugo Villeneuve <hvilleneuve@dimonoff.com>
> serial: sc16is7xx: fix bug when first setting GPIO direction
>
> Hugo Villeneuve <hvilleneuve@dimonoff.com>
> serial: sc16is7xx: fix broken port 0 uart init
>
> Johan Hovold <johan+linaro@kernel.org>
> serial: qcom-geni: fix opp vote on shutdown
>
> Sishuai Gong <sishuai@purdue.edu>
> configfs: fix a race in configfs_lookup()
>
> Zheng Wang <zyytlz.wz@163.com>
> Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
>
> Nam Cao <namcaov@gmail.com>
> staging: rtl8712: fix race condition
>
> Aaron Armstrong Skomra <aaron.skomra@wacom.com>
> HID: wacom: remove the battery when the EKR is off
>
> Xu Yang <xu.yang_2@nxp.com>
> usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0
>
> Luke Lu <luke.lu@libre.computer>
> usb: dwc3: meson-g12a: do post init to fix broken usb after resumption
>
> Slark Xiao <slark_xiao@163.com>
> USB: serial: option: add FOXCONN T99W368/T99W373 product
>
> Martin Kohn <m.kohn@welotec.com>
> USB: serial: option: add Quectel EM05G variant (0x030e)
>
> Christoph Hellwig <hch@lst.de>
> modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules
>
> Christoph Hellwig <hch@lst.de>
> rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff
>
> Christoph Hellwig <hch@lst.de>
> net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index
>
> Christoph Hellwig <hch@lst.de>
> mmc: au1xmmc: force non-modular build and remove symbol_get usage
>
> Arnd Bergmann <arnd@arndb.de>
> ARM: pxa: remove use of symbol_get()
>
> Gao Xiang <hsiangkao@linux.alibaba.com>
> erofs: ensure that the post-EOF tails are all zeroed
>
>
> -------------
>
> Diffstat:
>
> .../devicetree/bindings/clock/xlnx,versal-clk.yaml | 2 -
> Documentation/scsi/scsi_mid_low_api.rst | 4 +-
> Makefile | 4 +-
> arch/arm/boot/dts/bcm4708-linksys-ea6500-v2.dts | 3 +-
> arch/arm/boot/dts/bcm47189-luxul-xap-1440.dts | 13 +
> arch/arm/boot/dts/bcm47189-luxul-xap-810.dts | 13 +
> arch/arm/boot/dts/bcm5301x.dtsi | 4 +-
> arch/arm/boot/dts/bcm53573.dtsi | 27 +-
> arch/arm/boot/dts/bcm947189acdbmr.dts | 6 +-
> arch/arm/boot/dts/exynos4210-i9100.dts | 4 +-
> arch/arm/boot/dts/imx23.dtsi | 2 +-
> arch/arm/boot/dts/imx25.dtsi | 2 +-
> arch/arm/boot/dts/imx28.dtsi | 2 +-
> arch/arm/boot/dts/imx31.dtsi | 2 +-
> arch/arm/boot/dts/imx35.dtsi | 2 +-
> arch/arm/boot/dts/imx50.dtsi | 2 +-
> arch/arm/boot/dts/imx51.dtsi | 2 +-
> arch/arm/boot/dts/imx53.dtsi | 2 +-
> arch/arm/boot/dts/imx6qdl.dtsi | 4 +-
> arch/arm/boot/dts/imx6sl.dtsi | 2 +-
> arch/arm/boot/dts/imx6sx.dtsi | 4 +-
> arch/arm/boot/dts/imx6ul.dtsi | 4 +-
> arch/arm/boot/dts/imx7s.dtsi | 11 +-
> arch/arm/boot/dts/s3c6410-mini6410.dts | 6 +-
> arch/arm/boot/dts/s3c64xx-pinctrl.dtsi | 210 ++++++-------
> arch/arm/boot/dts/s5pv210-aquila.dts | 12 +-
> arch/arm/boot/dts/s5pv210-aries.dtsi | 4 +-
> arch/arm/boot/dts/s5pv210-goni.dts | 14 +-
> arch/arm/boot/dts/s5pv210-smdkv210.dts | 30 +-
> arch/arm/mach-omap2/powerdomain.c | 2 +-
> arch/arm/mach-pxa/sharpsl_pm.c | 2 -
> arch/arm/mach-pxa/spitz.c | 14 +-
> arch/arm64/boot/dts/qcom/msm8996.dtsi | 3 +
> arch/arm64/boot/dts/qcom/sdm845.dtsi | 3 +-
> arch/arm64/include/asm/sdei.h | 6 +
> arch/arm64/kernel/entry.S | 27 +-
> arch/arm64/kernel/sdei.c | 3 +
> arch/arm64/kernel/smp.c | 8 +-
> arch/arm64/lib/csum.c | 2 +-
> arch/m68k/fpsp040/skeleton.S | 4 +-
> arch/m68k/ifpsp060/os.S | 4 +-
> arch/m68k/kernel/relocate_kernel.S | 4 +-
> arch/mips/alchemy/devboards/db1000.c | 8 +-
> arch/mips/alchemy/devboards/db1200.c | 19 +-
> arch/mips/alchemy/devboards/db1300.c | 10 +-
> arch/parisc/include/asm/led.h | 4 +-
> arch/parisc/include/asm/processor.h | 1 -
> arch/parisc/kernel/processor.c | 18 +-
> arch/powerpc/include/asm/lppaca.h | 13 +-
> arch/powerpc/include/asm/paca.h | 6 +-
> arch/powerpc/include/asm/paravirt.h | 1 +
> arch/powerpc/include/asm/plpar_wrappers.h | 1 +
> arch/powerpc/kernel/fadump.c | 1 +
> arch/powerpc/kernel/iommu.c | 17 +-
> arch/powerpc/kvm/book3s_hv_ras.c | 1 +
> arch/powerpc/mm/book3s64/slb.c | 1 +
> arch/powerpc/perf/core-fsl-emb.c | 8 +-
> arch/powerpc/platforms/pseries/lpar.c | 10 +-
> arch/powerpc/platforms/pseries/lparcfg.c | 4 +-
> arch/powerpc/platforms/pseries/setup.c | 2 +-
> arch/powerpc/xmon/xmon.c | 1 +
> arch/s390/crypto/paes_s390.c | 2 +-
> arch/s390/kernel/ipl.c | 2 +
> arch/sh/boards/mach-ap325rxa/setup.c | 2 +-
> arch/sh/boards/mach-ecovec24/setup.c | 6 +-
> arch/sh/boards/mach-kfr2r09/setup.c | 2 +-
> arch/sh/boards/mach-migor/setup.c | 2 +-
> arch/sh/boards/mach-se/7724/setup.c | 6 +-
> arch/um/configs/i386_defconfig | 1 +
> arch/um/configs/x86_64_defconfig | 1 +
> arch/um/drivers/Kconfig | 16 +-
> arch/um/drivers/Makefile | 2 +-
> arch/x86/boot/compressed/head_64.S | 30 +-
> arch/x86/include/asm/pgtable_types.h | 11 +-
> arch/x86/include/asm/virtext.h | 6 -
> arch/x86/kernel/apm_32.c | 6 -
> arch/x86/kernel/cpu/common.c | 8 +-
> arch/xtensa/include/asm/core.h | 9 +
> arch/xtensa/kernel/perf_event.c | 17 +-
> crypto/algapi.c | 16 +-
> crypto/asymmetric_keys/x509_public_key.c | 5 +
> crypto/blake2b_generic.c | 226 +++----------
> drivers/acpi/apei/ghes.c | 19 +-
> drivers/acpi/bus.c | 2 +
> drivers/acpi/pci_root.c | 3 -
> drivers/amba/bus.c | 1 +
> drivers/ata/pata_arasan_cf.c | 3 +-
> drivers/ata/pata_ftide010.c | 1 +
> drivers/ata/sata_gemini.c | 1 +
> drivers/base/regmap/regcache-rbtree.c | 10 +-
> drivers/base/test/test_async_driver_probe.c | 2 +-
> drivers/bluetooth/btsdio.c | 1 +
> drivers/bluetooth/btusb.c | 2 +-
> drivers/bluetooth/hci_nokia.c | 6 +-
> drivers/bus/mhi/host/pm.c | 5 +
> drivers/bus/ti-sysc.c | 2 +-
> drivers/char/hw_random/iproc-rng200.c | 25 ++
> drivers/char/hw_random/nomadik-rng.c | 12 +-
> drivers/char/ipmi/ipmi_si_intf.c | 5 +
> drivers/char/ipmi/ipmi_ssif.c | 7 +-
> drivers/clk/Kconfig | 1 +
> drivers/clk/imx/clk-composite-8m.c | 12 +-
> drivers/clk/imx/clk-imx8mp.c | 5 -
> drivers/clk/imx/clk-pll14xx.c | 2 -
> drivers/clk/keystone/pll.c | 2 +-
> drivers/clk/qcom/gcc-mdm9615.c | 2 +-
> drivers/clk/qcom/gcc-sc7180.c | 33 +-
> drivers/clk/qcom/gcc-sm8250.c | 93 +++---
> drivers/clk/qcom/reset.c | 3 +-
> drivers/clk/sunxi-ng/ccu_mmc_timing.c | 2 +-
> drivers/cpufreq/brcmstb-avs-cpufreq.c | 6 +-
> drivers/cpufreq/cpufreq.c | 2 +
> drivers/cpufreq/powernow-k8.c | 3 +-
> drivers/cpuidle/cpuidle-pseries.c | 8 +-
> drivers/crypto/caam/caampkc.c | 4 +-
> drivers/crypto/stm32/stm32-hash.c | 9 +-
> drivers/devfreq/devfreq.c | 1 +
> drivers/dma/Kconfig | 2 +
> drivers/dma/ste_dma40.c | 4 +
> drivers/firmware/Kconfig | 1 +
> drivers/firmware/arm_sdei.c | 32 +-
> drivers/firmware/efi/libstub/x86-stub.c | 2 +-
> drivers/firmware/meson/meson_sm.c | 2 +
> drivers/firmware/stratix10-svc.c | 2 +-
> drivers/fsi/fsi-master-aspeed.c | 2 +
> drivers/fsi/fsi-master-ast-cf.c | 1 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 3 +
> drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 14 +-
> drivers/gpu/drm/amd/amdgpu/cik.c | 36 +--
> drivers/gpu/drm/amd/amdgpu/si.c | 36 +--
> .../amd/display/dc/dce110/dce110_hw_sequencer.c | 3 +
> drivers/gpu/drm/amd/display/dc/dcn10/dcn10_mpc.c | 5 +-
> .../drm/amd/display/modules/freesync/freesync.c | 9 +-
> drivers/gpu/drm/amd/pm/amdgpu_pm.c | 10 +-
> drivers/gpu/drm/armada/armada_overlay.c | 6 +-
> drivers/gpu/drm/ast/ast_post.c | 2 +-
> drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 9 +-
> drivers/gpu/drm/bridge/tc358764.c | 2 +-
> drivers/gpu/drm/etnaviv/etnaviv_dump.c | 14 +-
> drivers/gpu/drm/i915/gvt/gtt.c | 68 +++-
> drivers/gpu/drm/i915/gvt/gtt.h | 5 +-
> drivers/gpu/drm/i915/gvt/gvt.c | 9 +
> drivers/gpu/drm/i915/gvt/gvt.h | 3 +
> drivers/gpu/drm/i915/gvt/handlers.c | 44 ++-
> drivers/gpu/drm/i915/gvt/mmio.h | 4 +
> drivers/gpu/drm/i915/intel_gvt.c | 15 +
> drivers/gpu/drm/i915/intel_gvt.h | 5 +
> drivers/gpu/drm/mediatek/mtk_drm_gem.c | 6 +-
> drivers/gpu/drm/msm/adreno/a2xx_gpu.c | 8 +-
> drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 3 +-
> drivers/gpu/drm/panel/panel-simple.c | 4 +-
> drivers/gpu/drm/radeon/cik.c | 36 +--
> drivers/gpu/drm/radeon/si.c | 37 +--
> drivers/gpu/drm/tegra/dpaux.c | 6 +-
> drivers/gpu/drm/xlnx/zynqmp_dpsub.c | 4 +-
> drivers/hid/hid-logitech-dj.c | 5 +-
> drivers/hid/hid-multitouch.c | 13 +-
> drivers/hid/wacom.h | 1 +
> drivers/hid/wacom_sys.c | 25 +-
> drivers/hid/wacom_wac.c | 1 +
> drivers/hid/wacom_wac.h | 1 +
> drivers/hwmon/tmp513.c | 2 +-
> drivers/hwtracing/coresight/coresight-tmc-etf.c | 2 +-
> drivers/hwtracing/coresight/coresight-tmc-etr.c | 5 +-
> drivers/hwtracing/coresight/coresight-tmc.h | 2 +-
> .../infiniband/core/uverbs_std_types_counters.c | 2 +
> drivers/infiniband/sw/siw/siw_cm.c | 1 -
> drivers/infiniband/sw/siw/siw_verbs.c | 2 +-
> drivers/infiniband/ulp/isert/ib_isert.c | 2 +
> drivers/infiniband/ulp/srp/ib_srp.c | 4 -
> drivers/iommu/arm/arm-smmu/qcom_iommu.c | 7 +
> drivers/iommu/intel/pasid.c | 2 +-
> drivers/leds/led-core.c | 8 +-
> drivers/md/md-bitmap.c | 28 +-
> drivers/media/cec/usb/pulse8/pulse8-cec.c | 7 +-
> drivers/media/dvb-frontends/ascot2e.c | 2 +-
> drivers/media/dvb-frontends/atbm8830.c | 2 +-
> drivers/media/dvb-frontends/au8522_dig.c | 2 +-
> drivers/media/dvb-frontends/bcm3510.c | 2 +-
> drivers/media/dvb-frontends/cx22700.c | 2 +-
> drivers/media/dvb-frontends/cx22702.c | 2 +-
> drivers/media/dvb-frontends/cx24110.c | 2 +-
> drivers/media/dvb-frontends/cx24113.c | 2 +-
> drivers/media/dvb-frontends/cx24116.c | 2 +-
> drivers/media/dvb-frontends/cx24120.c | 6 +-
> drivers/media/dvb-frontends/cx24123.c | 2 +-
> drivers/media/dvb-frontends/cxd2820r_core.c | 2 +-
> drivers/media/dvb-frontends/cxd2841er.c | 4 +-
> drivers/media/dvb-frontends/cxd2880/cxd2880_top.c | 2 +-
> drivers/media/dvb-frontends/dib0070.c | 2 +-
> drivers/media/dvb-frontends/dib0090.c | 4 +-
> drivers/media/dvb-frontends/dib3000mb.c | 2 +-
> drivers/media/dvb-frontends/dib3000mc.c | 2 +-
> drivers/media/dvb-frontends/dib7000m.c | 2 +-
> drivers/media/dvb-frontends/dib7000p.c | 4 +-
> drivers/media/dvb-frontends/dib8000.c | 2 +-
> drivers/media/dvb-frontends/dib9000.c | 2 +-
> drivers/media/dvb-frontends/drx39xyj/drxj.c | 2 +-
> drivers/media/dvb-frontends/drxd_hard.c | 2 +-
> drivers/media/dvb-frontends/drxk_hard.c | 2 +-
> drivers/media/dvb-frontends/ds3000.c | 2 +-
> drivers/media/dvb-frontends/dvb-pll.c | 2 +-
> drivers/media/dvb-frontends/ec100.c | 2 +-
> drivers/media/dvb-frontends/helene.c | 4 +-
> drivers/media/dvb-frontends/horus3a.c | 2 +-
> drivers/media/dvb-frontends/isl6405.c | 2 +-
> drivers/media/dvb-frontends/isl6421.c | 2 +-
> drivers/media/dvb-frontends/isl6423.c | 2 +-
> drivers/media/dvb-frontends/itd1000.c | 2 +-
> drivers/media/dvb-frontends/ix2505v.c | 2 +-
> drivers/media/dvb-frontends/l64781.c | 2 +-
> drivers/media/dvb-frontends/lg2160.c | 2 +-
> drivers/media/dvb-frontends/lgdt3305.c | 2 +-
> drivers/media/dvb-frontends/lgdt3306a.c | 2 +-
> drivers/media/dvb-frontends/lgdt330x.c | 2 +-
> drivers/media/dvb-frontends/lgs8gxx.c | 2 +-
> drivers/media/dvb-frontends/lnbh25.c | 2 +-
> drivers/media/dvb-frontends/lnbp21.c | 4 +-
> drivers/media/dvb-frontends/lnbp22.c | 2 +-
> drivers/media/dvb-frontends/m88ds3103.c | 2 +-
> drivers/media/dvb-frontends/m88rs2000.c | 2 +-
> drivers/media/dvb-frontends/mb86a16.c | 2 +-
> drivers/media/dvb-frontends/mb86a20s.c | 2 +-
> drivers/media/dvb-frontends/mt312.c | 2 +-
> drivers/media/dvb-frontends/mt352.c | 2 +-
> drivers/media/dvb-frontends/nxt200x.c | 2 +-
> drivers/media/dvb-frontends/nxt6000.c | 2 +-
> drivers/media/dvb-frontends/or51132.c | 2 +-
> drivers/media/dvb-frontends/or51211.c | 2 +-
> drivers/media/dvb-frontends/s5h1409.c | 2 +-
> drivers/media/dvb-frontends/s5h1411.c | 2 +-
> drivers/media/dvb-frontends/s5h1420.c | 2 +-
> drivers/media/dvb-frontends/s5h1432.c | 2 +-
> drivers/media/dvb-frontends/s921.c | 2 +-
> drivers/media/dvb-frontends/si21xx.c | 2 +-
> drivers/media/dvb-frontends/sp887x.c | 2 +-
> drivers/media/dvb-frontends/stb0899_drv.c | 2 +-
> drivers/media/dvb-frontends/stb6000.c | 2 +-
> drivers/media/dvb-frontends/stb6100.c | 2 +-
> drivers/media/dvb-frontends/stv0288.c | 2 +-
> drivers/media/dvb-frontends/stv0297.c | 2 +-
> drivers/media/dvb-frontends/stv0299.c | 2 +-
> drivers/media/dvb-frontends/stv0367.c | 6 +-
> drivers/media/dvb-frontends/stv0900_core.c | 2 +-
> drivers/media/dvb-frontends/stv090x.c | 2 +-
> drivers/media/dvb-frontends/stv6110.c | 2 +-
> drivers/media/dvb-frontends/stv6110x.c | 2 +-
> drivers/media/dvb-frontends/tda10021.c | 2 +-
> drivers/media/dvb-frontends/tda10023.c | 2 +-
> drivers/media/dvb-frontends/tda10048.c | 2 +-
> drivers/media/dvb-frontends/tda1004x.c | 4 +-
> drivers/media/dvb-frontends/tda10086.c | 2 +-
> drivers/media/dvb-frontends/tda665x.c | 2 +-
> drivers/media/dvb-frontends/tda8083.c | 2 +-
> drivers/media/dvb-frontends/tda8261.c | 2 +-
> drivers/media/dvb-frontends/tda826x.c | 2 +-
> drivers/media/dvb-frontends/ts2020.c | 2 +-
> drivers/media/dvb-frontends/tua6100.c | 2 +-
> drivers/media/dvb-frontends/ves1820.c | 2 +-
> drivers/media/dvb-frontends/ves1x93.c | 2 +-
> drivers/media/dvb-frontends/zl10036.c | 2 +-
> drivers/media/dvb-frontends/zl10039.c | 2 +-
> drivers/media/dvb-frontends/zl10353.c | 2 +-
> drivers/media/i2c/ad5820.c | 2 -
> drivers/media/i2c/ov2680.c | 246 +++------------
> drivers/media/i2c/ov5640.c | 4 +-
> drivers/media/i2c/tvp5150.c | 4 +
> drivers/media/pci/bt8xx/dst.c | 2 +-
> drivers/media/pci/bt8xx/dst_ca.c | 2 +-
> drivers/media/pci/cx23885/cx23885-dvb.c | 12 -
> drivers/media/pci/ddbridge/ddbridge-dummy-fe.c | 2 +-
> .../media/platform/mtk-vcodec/vdec/vdec_vp9_if.c | 5 +-
> drivers/media/tuners/fc0011.c | 2 +-
> drivers/media/tuners/fc0012.c | 2 +-
> drivers/media/tuners/fc0013.c | 2 +-
> drivers/media/tuners/max2165.c | 2 +-
> drivers/media/tuners/mc44s803.c | 2 +-
> drivers/media/tuners/mt2060.c | 2 +-
> drivers/media/tuners/mt2131.c | 2 +-
> drivers/media/tuners/mt2266.c | 2 +-
> drivers/media/tuners/mxl5005s.c | 2 +-
> drivers/media/tuners/qt1010.c | 2 +-
> drivers/media/tuners/tda18218.c | 2 +-
> drivers/media/tuners/xc4000.c | 2 +-
> drivers/media/tuners/xc5000.c | 2 +-
> drivers/media/usb/dvb-usb/m920x.c | 5 +-
> drivers/media/usb/go7007/go7007-i2c.c | 2 -
> drivers/media/usb/siano/smsusb.c | 21 +-
> drivers/media/v4l2-core/v4l2-fwnode.c | 18 +-
> drivers/mmc/host/Kconfig | 5 +-
> drivers/mtd/nand/raw/brcmnand/brcmnand.c | 45 ++-
> drivers/mtd/nand/raw/fsmc_nand.c | 7 +-
> drivers/mtd/spi-nor/core.c | 19 +-
> drivers/net/arcnet/arcnet.c | 2 +-
> drivers/net/can/usb/gs_usb.c | 5 +-
> drivers/net/dsa/sja1105/sja1105_main.c | 38 ++-
> drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 7 +-
> drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +-
> drivers/net/ethernet/freescale/enetc/enetc_ptp.c | 2 +-
> drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 4 +-
> drivers/net/ethernet/intel/ice/ice_main.c | 13 +-
> drivers/net/ethernet/intel/igb/igb.h | 4 +-
> drivers/net/ethernet/intel/igb/igb_main.c | 16 +-
> drivers/net/ethernet/intel/igbvf/igbvf.h | 4 +-
> drivers/net/ethernet/intel/igc/igc.h | 4 +-
> drivers/net/ethernet/intel/ixgbe/ixgbe_ptp.c | 28 +-
> drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 5 +
> drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 +
> drivers/net/ethernet/mellanox/mlx5/core/fw_reset.c | 9 +-
> drivers/net/ethernet/mellanox/mlxsw/i2c.c | 5 +-
> drivers/net/macsec.c | 3 +-
> drivers/net/usb/qmi_wwan.c | 1 +
> drivers/net/usb/r8152.c | 3 +
> drivers/net/veth.c | 4 +-
> drivers/net/vxlan/vxlan_core.c | 58 ++--
> drivers/net/wireless/ath/ath10k/pci.c | 9 +-
> drivers/net/wireless/ath/ath9k/htc_drv_debug.c | 2 +-
> drivers/net/wireless/ath/ath9k/wmi.c | 20 +-
> drivers/net/wireless/marvell/mwifiex/debugfs.c | 9 +-
> drivers/net/wireless/marvell/mwifiex/pcie.c | 25 +-
> drivers/net/wireless/marvell/mwifiex/sta_rx.c | 12 +-
> drivers/net/wireless/marvell/mwifiex/uap_txrx.c | 30 +-
> drivers/net/wireless/marvell/mwifiex/util.c | 10 +-
> drivers/net/wireless/mediatek/mt76/testmode.c | 1 +
> drivers/ntb/ntb_transport.c | 19 +-
> drivers/of/unittest.c | 12 +-
> drivers/opp/core.c | 2 +-
> drivers/parisc/led.c | 4 +-
> drivers/pci/hotplug/pciehp_hpc.c | 12 +-
> drivers/pci/pcie/aspm.c | 30 +-
> drivers/perf/fsl_imx8_ddr_perf.c | 24 +-
> drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 6 +-
> drivers/phy/rockchip/phy-rockchip-inno-hdmi.c | 18 +-
> drivers/pinctrl/intel/pinctrl-cherryview.c | 5 +-
> drivers/pinctrl/pinctrl-amd.c | 4 +-
> drivers/pinctrl/pinctrl-mcp23s08_spi.c | 10 +
> drivers/platform/mellanox/mlxbf-tmfifo.c | 91 ++++--
> drivers/platform/x86/huawei-wmi.c | 2 +
> drivers/platform/x86/intel-hid.c | 21 +-
> drivers/pwm/pwm-lpc32xx.c | 16 +-
> drivers/rpmsg/qcom_glink_native.c | 4 +
> drivers/rtc/rtc-ds1685.c | 2 +-
> drivers/s390/block/dasd.c | 125 +++-----
> drivers/s390/block/dasd_3990_erp.c | 2 +-
> drivers/s390/crypto/pkey_api.c | 2 +-
> drivers/s390/crypto/zcrypt_api.c | 1 +
> drivers/s390/crypto/zcrypt_ep11misc.c | 4 +-
> drivers/s390/crypto/zcrypt_ep11misc.h | 9 +-
> drivers/scsi/aic94xx/aic94xx_task.c | 2 +-
> drivers/scsi/be2iscsi/be_iscsi.c | 4 +
> drivers/scsi/fcoe/fcoe_ctlr.c | 20 +-
> drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 8 +-
> drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 19 +-
> drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 62 ++--
> drivers/scsi/hosts.c | 4 +-
> drivers/scsi/isci/request.c | 10 +-
> drivers/scsi/isci/task.c | 2 +-
> drivers/scsi/libsas/sas_ata.c | 7 +-
> drivers/scsi/libsas/sas_expander.c | 2 +-
> drivers/scsi/libsas/sas_task.c | 4 +-
> drivers/scsi/mpt3sas/mpt3sas_base.c | 46 ++-
> drivers/scsi/mpt3sas/mpt3sas_base.h | 1 +
> drivers/scsi/mvsas/mv_sas.c | 10 +-
> drivers/scsi/pm8001/pm8001_hwi.c | 16 +-
> drivers/scsi/pm8001/pm8001_sas.c | 4 +-
> drivers/scsi/pm8001/pm80xx_hwi.c | 14 +-
> drivers/scsi/qedf/qedf_dbg.h | 2 +
> drivers/scsi/qedf/qedf_debugfs.c | 35 ++-
> drivers/scsi/qedi/qedi_main.c | 5 +-
> drivers/scsi/qla2xxx/qla_attr.c | 2 -
> drivers/scsi/qla2xxx/qla_dbg.c | 18 +-
> drivers/scsi/qla2xxx/qla_def.h | 12 +-
> drivers/scsi/qla2xxx/qla_gbl.h | 3 +
> drivers/scsi/qla2xxx/qla_init.c | 68 ++--
> drivers/scsi/qla2xxx/qla_inline.h | 46 +++
> drivers/scsi/qla2xxx/qla_iocb.c | 60 +++-
> drivers/scsi/qla2xxx/qla_isr.c | 16 +-
> drivers/scsi/qla2xxx/qla_mbx.c | 7 +-
> drivers/scsi/qla2xxx/qla_nvme.c | 12 +-
> drivers/scsi/qla2xxx/qla_os.c | 223 +++++++------
> drivers/scsi/qla2xxx/qla_target.c | 14 +-
> drivers/scsi/qla4xxx/ql4_os.c | 15 +
> drivers/scsi/scsi_transport_iscsi.c | 80 +++--
> drivers/scsi/storvsc_drv.c | 2 +
> drivers/soc/qcom/ocmem.c | 14 +-
> drivers/soc/qcom/qmi_encdec.c | 4 +-
> drivers/spi/spi-tegra20-sflash.c | 6 +-
> drivers/staging/media/rkvdec/rkvdec.c | 2 +-
> drivers/staging/rtl8712/os_intfs.c | 1 +
> drivers/staging/rtl8712/usb_intf.c | 1 -
> drivers/tty/serial/qcom_geni_serial.c | 5 +
> drivers/tty/serial/sc16is7xx.c | 17 +-
> drivers/tty/serial/serial-tegra.c | 6 +-
> drivers/tty/serial/sprd_serial.c | 30 +-
> drivers/usb/chipidea/ci_hdrc_imx.c | 10 +-
> drivers/usb/chipidea/usbmisc_imx.c | 6 +-
> drivers/usb/core/hcd.c | 10 +-
> drivers/usb/core/hub.c | 349 ++++++++++++---------
> drivers/usb/core/message.c | 29 +-
> drivers/usb/core/usb.h | 4 +-
> drivers/usb/dwc3/dwc3-meson-g12a.c | 6 +
> drivers/usb/gadget/function/f_mass_storage.c | 2 +-
> drivers/usb/phy/phy-mxs-usb.c | 10 +-
> drivers/usb/serial/option.c | 7 +
> drivers/usb/typec/bus.c | 12 +-
> drivers/usb/typec/tcpm/tcpci.c | 4 +
> drivers/usb/typec/tcpm/tcpci.h | 1 +
> drivers/usb/typec/tcpm/tcpm.c | 3 +-
> drivers/vfio/vfio_iommu_type1.c | 2 +-
> drivers/video/backlight/bd6107.c | 2 +-
> drivers/video/backlight/gpio_backlight.c | 5 +-
> drivers/video/backlight/lv5207lp.c | 2 +-
> drivers/video/fbdev/ep93xx-fb.c | 1 -
> drivers/virtio/virtio_ring.c | 2 +-
> drivers/watchdog/intel-mid_wdt.c | 1 +
> fs/btrfs/disk-io.c | 5 +-
> fs/btrfs/transaction.c | 7 +-
> fs/configfs/dir.c | 2 +
> fs/dlm/plock.c | 6 +-
> fs/erofs/zdata.c | 2 +
> fs/eventfd.c | 7 +-
> fs/ext4/balloc.c | 15 +-
> fs/ext4/block_validity.c | 8 +-
> fs/ext4/ext4.h | 2 +
> fs/ext4/mballoc.c | 2 +-
> fs/fuse/readdir.c | 10 +-
> fs/jfs/jfs_extent.c | 5 +
> fs/lockd/mon.c | 3 +
> fs/namei.c | 2 +-
> fs/nfs/blocklayout/dev.c | 4 +-
> fs/nfs/direct.c | 20 +-
> fs/nfs/nfs2xdr.c | 2 +-
> fs/nfs/nfs3xdr.c | 2 +-
> fs/nfs/nfs42proc.c | 5 +-
> fs/nfs/pnfs_dev.c | 2 +-
> fs/nfsd/blocklayoutxdr.c | 9 +
> fs/nfsd/flexfilelayoutxdr.c | 9 +
> fs/nfsd/nfs4xdr.c | 25 +-
> fs/nilfs2/alloc.c | 3 +-
> fs/nilfs2/inode.c | 7 +-
> fs/nilfs2/segment.c | 5 +
> fs/nls/nls_base.c | 4 +-
> fs/ocfs2/namei.c | 4 +
> fs/overlayfs/super.c | 2 +-
> fs/proc/base.c | 3 +-
> fs/pstore/ram_core.c | 2 +-
> fs/quota/dquot.c | 174 ++++++----
> fs/reiserfs/journal.c | 4 +-
> fs/udf/balloc.c | 31 +-
> fs/udf/inode.c | 45 ++-
> fs/verity/signature.c | 16 +
> include/acpi/apei.h | 4 +-
> include/crypto/algapi.h | 3 +
> include/crypto/blake2b.h | 67 ++++
> include/crypto/internal/blake2b.h | 115 +++++++
> include/linux/arm_sdei.h | 4 +
> include/linux/eventfd.h | 6 +
> include/linux/if_arp.h | 4 +
> include/linux/nls.h | 2 +-
> include/linux/trace_events.h | 3 +-
> include/linux/usb/typec_altmode.h | 2 +-
> include/net/ip.h | 1 +
> include/net/ip_tunnels.h | 15 +-
> include/net/ipv6.h | 2 +-
> include/net/lwtunnel.h | 5 +-
> include/net/tcp.h | 1 -
> include/scsi/libsas.h | 12 +-
> include/scsi/scsi_host.h | 2 +-
> include/uapi/linux/sync_file.h | 2 +-
> io_uring/io-wq.c | 10 +
> io_uring/io-wq.h | 1 +
> io_uring/io_uring.c | 9 +-
> kernel/auditsc.c | 2 +
> kernel/bpf/verifier.c | 17 +-
> kernel/cgroup/namespace.c | 6 -
> kernel/kprobes.c | 14 +-
> kernel/module.c | 15 +-
> kernel/printk/printk_ringbuffer.c | 2 +-
> kernel/rcu/refscale.c | 3 +-
> kernel/trace/bpf_trace.c | 2 +-
> kernel/trace/trace.c | 72 ++++-
> kernel/trace/trace.h | 2 +
> kernel/trace/trace_uprobe.c | 3 +-
> lib/idr.c | 2 +-
> lib/test_meminit.c | 2 +-
> mm/shmem.c | 28 +-
> net/9p/trans_virtio.c | 2 +-
> net/bluetooth/hci_core.c | 16 +-
> net/core/filter.c | 2 +
> net/core/flow_dissector.c | 3 +-
> net/core/lwt_bpf.c | 7 +-
> net/core/skbuff.c | 34 +-
> net/core/sock.c | 9 +-
> net/dccp/ipv4.c | 13 +-
> net/dccp/ipv6.c | 15 +-
> net/hsr/hsr_forward.c | 1 +
> net/ipv4/devinet.c | 10 +-
> net/ipv4/fib_semantics.c | 5 +-
> net/ipv4/fib_trie.c | 3 +-
> net/ipv4/igmp.c | 3 +-
> net/ipv4/ip_input.c | 3 +-
> net/ipv4/ip_output.c | 2 +-
> net/ipv4/route.c | 1 +
> net/ipv4/tcp_input.c | 3 +-
> net/ipv4/tcp_timer.c | 18 +-
> net/ipv4/udp.c | 20 +-
> net/ipv6/addrconf.c | 2 +-
> net/ipv6/ip6_output.c | 2 +-
> net/ipv6/udp.c | 19 +-
> net/kcm/kcmsock.c | 15 +-
> net/netfilter/ipset/ip_set_hash_netportnet.c | 1 +
> net/netfilter/nfnetlink_osf.c | 8 +
> net/netfilter/xt_sctp.c | 2 +
> net/netfilter/xt_u32.c | 21 ++
> net/netlabel/netlabel_kapi.c | 3 +-
> net/netrom/af_netrom.c | 5 +
> net/sched/sch_fq_pie.c | 27 +-
> net/sched/sch_hfsc.c | 4 +
> net/sched/sch_plug.c | 2 +-
> net/sched/sch_qfq.c | 22 +-
> net/sctp/proc.c | 2 +-
> net/sctp/sm_sideeffect.c | 5 +-
> net/sctp/socket.c | 10 +-
> net/smc/smc_core.c | 2 +
> net/socket.c | 6 +-
> net/tls/tls_sw.c | 4 +-
> net/unix/af_unix.c | 2 +-
> net/unix/scm.c | 6 +-
> samples/bpf/tracex6_kern.c | 17 +-
> scripts/kconfig/preprocess.c | 3 +
> security/integrity/ima/Kconfig | 12 -
> security/keys/keyctl.c | 11 +-
> security/smack/smackfs.c | 2 +-
> sound/Kconfig | 2 +-
> sound/core/pcm_compat.c | 8 +-
> sound/core/seq/oss/seq_oss_midi.c | 35 ++-
> sound/pci/ac97/ac97_codec.c | 5 +-
> sound/soc/atmel/atmel-i2s.c | 5 +-
> sound/soc/codecs/Kconfig | 1 +
> sound/soc/codecs/da7219-aad.c | 12 +-
> sound/soc/codecs/es8316.c | 2 +-
> sound/soc/codecs/rt5682-sdw.c | 7 +-
> tools/bpf/bpftool/skeleton/profiler.bpf.c | 27 +-
> tools/hv/vmbus_testing | 4 +-
> tools/perf/builtin-top.c | 1 +
> tools/perf/ui/browsers/hists.c | 60 ++--
> tools/perf/util/annotate.c | 10 +-
> tools/perf/util/header.c | 11 +-
> .../selftests/bpf/benchs/run_bench_rename.sh | 2 +-
> .../selftests/bpf/progs/test_cls_redirect.h | 9 +
> tools/testing/selftests/kselftest/runner.sh | 29 +-
> tools/testing/selftests/kselftest_harness.h | 11 +-
> tools/testing/selftests/resctrl/cache.c | 18 +-
> tools/testing/selftests/resctrl/fill_buf.c | 3 +-
> tools/testing/selftests/resctrl/resctrl.h | 1 +
> 555 files changed, 3750 insertions(+), 2444 deletions(-)
>
>
^ permalink raw reply [flat|nested] 431+ messages in thread
* Re: [PATCH 5.10 329/406] clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz
2023-09-17 19:13 ` [PATCH 5.10 329/406] clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz Greg Kroah-Hartman
@ 2023-09-29 19:56 ` Ahmad Fatoum
0 siblings, 0 replies; 431+ messages in thread
From: Ahmad Fatoum @ 2023-09-29 19:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: patches, Marco Felsch, Abel Vesa
Hi,
On 17.09.23 21:13, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Ahmad Fatoum <a.fatoum@pengutronix.de>
>
> commit 72d00e560d10665e6139c9431956a87ded6e9880 upstream.
>
> Since commit b09c68dc57c9 ("clk: imx: pll14xx: Support dynamic rates"),
> the driver has the ability to dynamically compute PLL parameters to
> approximate the requested rates. This is not always used, because the
> logic is as follows:
>
> - Check if the target rate is hardcoded in the frequency table
> - Check if varying only kdiv is possible, so switch over is glitch free
> - Compute rate dynamically by iterating over pdiv range
>
> If we skip the frequency table for the 1443x PLL, we find that the
> computed values differ to the hardcoded ones. This can be valid if the
> hardcoded values guarantee for example an earlier lock-in or if the
> divisors are chosen, so that other important rates are more likely to
> be reached glitch-free.
>
> For rates (393216000 and 361267200, this doesn't seem to be the case:
> They are only approximated by existing parameters (393215995 and
> 361267196 Hz, respectively) and they aren't reachable glitch-free from
> other hardcoded frequencies. Dropping them from the table allows us
> to lock-in to these frequencies exactly.
>
> This is immediately noticeable because they are the assigned-clock-rates
> for IMX8MN_AUDIO_PLL1 and IMX8MN_AUDIO_PLL2, respectively and a look
> into clk_summary so far showed that they were a few Hz short of the target:
>
> imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
> audio_pll2_out 0 0 0 361267196 0 0 50000 N
> audio_pll1_out 1 1 0 393215995 0 0 50000 Y
>
> and afterwards:
>
> imx8mn-board:~# grep audio_pll[12]_out /sys/kernel/debug/clk/clk_summary
> audio_pll2_out 0 0 0 361267200 0 0 50000 N
> audio_pll1_out 1 1 0 393216000 0 0 50000 Y
>
> This change is equivalent to adding following hardcoded values:
>
> /* rate mdiv pdiv sdiv kdiv */
> PLL_1443X_RATE(393216000, 655, 5, 3, 23593),
> PLL_1443X_RATE(361267200, 497, 33, 0, -16882),
>
> Fixes: 053a4ffe2988 ("clk: imx: imx8mm: fix audio pll setting")
> Cc: stable@vger.kernel.org # v5.18+
Patch is only correct for v5.18 onward. Please drop for v5.10.
Thanks,
Ahmad
> Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
> Signed-off-by: Marco Felsch <m.felsch@pengutronix.de>
> Link: https://lore.kernel.org/r/20230807084744.1184791-2-m.felsch@pengutronix.de
> Signed-off-by: Abel Vesa <abel.vesa@linaro.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/clk/imx/clk-pll14xx.c | 2 --
> 1 file changed, 2 deletions(-)
>
> --- a/drivers/clk/imx/clk-pll14xx.c
> +++ b/drivers/clk/imx/clk-pll14xx.c
> @@ -60,8 +60,6 @@ static const struct imx_pll14xx_rate_tab
> PLL_1443X_RATE(650000000U, 325, 3, 2, 0),
> PLL_1443X_RATE(594000000U, 198, 2, 2, 0),
> PLL_1443X_RATE(519750000U, 173, 2, 2, 16384),
> - PLL_1443X_RATE(393216000U, 262, 2, 3, 9437),
> - PLL_1443X_RATE(361267200U, 361, 3, 3, 17511),
> };
>
> struct imx_pll14xx_clk imx_1443x_pll = {
>
>
>
--
Pengutronix e.K. | |
Steuerwalder Str. 21 | http://www.pengutronix.de/ |
31137 Hildesheim, Germany | Phone: +49-5121-206917-0 |
Amtsgericht Hildesheim, HRA 2686 | Fax: +49-5121-206917-5555 |
^ permalink raw reply [flat|nested] 431+ messages in thread
end of thread, other threads:[~2023-09-29 19:56 UTC | newest]
Thread overview: 431+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-09-17 19:07 [PATCH 5.10 000/406] 5.10.195-rc1 review Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 001/406] erofs: ensure that the post-EOF tails are all zeroed Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 002/406] ARM: pxa: remove use of symbol_get() Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 003/406] mmc: au1xmmc: force non-modular build and remove symbol_get usage Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 004/406] net: enetc: use EXPORT_SYMBOL_GPL for enetc_phc_index Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 005/406] rtc: ds1685: use EXPORT_SYMBOL_GPL for ds1685_rtc_poweroff Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 006/406] modules: only allow symbol_get of EXPORT_SYMBOL_GPL modules Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 007/406] USB: serial: option: add Quectel EM05G variant (0x030e) Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 008/406] USB: serial: option: add FOXCONN T99W368/T99W373 product Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 009/406] usb: dwc3: meson-g12a: do post init to fix broken usb after resumption Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 010/406] usb: chipidea: imx: improve logic if samsung,picophy-* parameter is 0 Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 011/406] HID: wacom: remove the battery when the EKR is off Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 012/406] staging: rtl8712: fix race condition Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 013/406] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to " Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 014/406] configfs: fix a race in configfs_lookup() Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 015/406] serial: qcom-geni: fix opp vote on shutdown Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 016/406] serial: sc16is7xx: fix broken port 0 uart init Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 017/406] serial: sc16is7xx: fix bug when first setting GPIO direction Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 018/406] firmware: stratix10-svc: Fix an NULL vs IS_ERR() bug in probe Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 019/406] fsi: master-ast-cf: Add MODULE_FIRMWARE macro Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 020/406] nilfs2: fix general protection fault in nilfs_lookup_dirty_data_buffers() Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 021/406] nilfs2: fix WARNING in mark_buffer_dirty due to discarded buffer reuse Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 022/406] pinctrl: amd: Dont show `Invalid config param` errors Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 023/406] ASoC: rt5682: Fix a problem with error handling in the io init function of the soundwire Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 024/406] ARM: dts: imx: update sdma node name format Greg Kroah-Hartman
2023-09-17 19:07 ` [PATCH 5.10 025/406] ARM: dts: imx7s: Drop dma-apb interrupt-names Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 026/406] ARM: dts: imx: Adjust dma-apbh node name Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 027/406] ARM: dts: imx: Set default tuning step for imx7d usdhc Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 028/406] phy: qcom-snps-femto-v2: use qcom_snps_hsphy_suspend/resume error code Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 029/406] media: pulse8-cec: handle possible ping error Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 030/406] media: pci: cx23885: fix error handling for cx23885 ATSC boards Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 031/406] 9p: virtio: make sure offs is initialized in zc_request Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 032/406] ASoC: da7219: Flush pending AAD IRQ when suspending Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 033/406] ASoC: da7219: Check for failure reading AAD IRQ events Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 034/406] ethernet: atheros: fix return value check in atl1c_tso_csum() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 035/406] vxlan: generalize vxlan_parse_gpe_hdr and remove unused args Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 036/406] m68k: Fix invalid .section syntax Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 037/406] s390/dasd: use correct number of retries for ERP requests Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 038/406] s390/dasd: fix hanging device after request requeue Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 039/406] fs/nls: make load_nls() take a const parameter Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 040/406] ASoc: codecs: ES8316: Fix DMIC config Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 041/406] ASoC: atmel: Fix the 8K sample parameter in I2SC master Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 042/406] platform/x86: intel: hid: Always call BTNL ACPI method Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 043/406] platform/x86: huawei-wmi: Silence ambient light sensor Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 044/406] drm/amd/display: Exit idle optimizations before attempt to access PHY Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 045/406] ovl: Always reevaluate the file signature for IMA Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 046/406] ata: pata_arasan_cf: Use dev_err_probe() instead dev_err() in data_xfer() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 047/406] security: keys: perform capable check only on privileged operations Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 048/406] kprobes: Prohibit probing on CFI preamble symbol Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 049/406] clk: fixed-mmio: make COMMON_CLK_FIXED_MMIO depend on HAS_IOMEM Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 050/406] vmbus_testing: fix wrong python syntax for integer value comparison Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 051/406] net: usb: qmi_wwan: add Quectel EM05GV2 Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 052/406] idmaengine: make FSL_EDMA and INTEL_IDMA64 depends on HAS_IOMEM Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 053/406] scsi: qedi: Fix potential deadlock on &qedi_percpu->p_work_lock Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 054/406] netlabel: fix shift wrapping bug in netlbl_catmap_setlong() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 055/406] bnx2x: fix page fault following EEH recovery Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 056/406] sctp: handle invalid error codes without calling BUG() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 057/406] scsi: storvsc: Always set no_report_opcodes Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 058/406] ALSA: seq: oss: Fix racy open/close of MIDI devices Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 059/406] tracing: Introduce pipe_cpumask to avoid race on trace_pipes Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 060/406] platform/mellanox: Fix mlxbf-tmfifo not handling all virtio CONSOLE notifications Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 061/406] net: Avoid address overwrite in kernel_connect Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 062/406] udf: Check consistency of Space Bitmap Descriptor Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 063/406] udf: Handle error when adding extent to a file Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 064/406] Revert "net: macsec: preserve ingress frame ordering" Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 065/406] reiserfs: Check the return value from __getblk() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 066/406] eventfd: Export eventfd_ctx_do_read() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 067/406] eventfd: prevent underflow for eventfd semaphores Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 068/406] fs: Fix error checking for d_hash_and_lookup() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 069/406] tmpfs: verify {g,u}id mount options correctly Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 070/406] selftests/harness: Actually report SKIP for signal tests Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 071/406] refscale: Fix uninitalized use of wait_queue_head_t Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 072/406] OPP: Fix passing 0 to PTR_ERR in _opp_attach_genpd() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 073/406] selftests/resctrl: Dont leak buffer in fill_cache() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 074/406] selftests/resctrl: Unmount resctrl FS if child fails to run benchmark Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 075/406] selftests/resctrl: Close perf value read fd on errors Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 076/406] x86/decompressor: Dont rely on upper 32 bits of GPRs being preserved Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 077/406] perf/imx_ddr: dont enable counter0 if none of 4 counters are used Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 078/406] s390/pkey: fix/harmonize internal keyblob headers Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 079/406] s390/paes: fix PKEY_TYPE_EP11_AES handling for secure keyblobs Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 080/406] x86/efistub: Fix PCI ROM preservation in mixed mode Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 081/406] cpufreq: powernow-k8: Use related_cpus instead of cpus in driver.exit() Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 082/406] bpftool: Use a local bpf_perf_event_value to fix accessing its fields Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 083/406] bpf: Clear the probe_addr for uprobe Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 084/406] tcp: tcp_enter_quickack_mode() should be static Greg Kroah-Hartman
2023-09-17 19:08 ` [PATCH 5.10 085/406] hwrng: nomadik - keep clock enabled while hwrng is registered Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 086/406] regmap: rbtree: Use alloc_flags for memory allocations Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 087/406] udp: re-score reuseport groups when connected sockets are present Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 088/406] bpf: reject unhashed sockets in bpf_sk_assign Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 089/406] wifi: mt76: testmode: add nla_policy for MT76_TM_ATTR_TX_LENGTH Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 090/406] spi: tegra20-sflash: fix to check return value of platform_get_irq() in tegra_sflash_probe() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 091/406] can: gs_usb: gs_usb_receive_bulk_callback(): count RX overflow errors also in case of OOM Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 092/406] wifi: mwifiex: Fix OOB and integer underflow when rx packets Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 093/406] wifi: mwifiex: fix error recovery in PCIE buffer descriptor management Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 094/406] selftests/bpf: fix static assert compilation issue for test_cls_*.c Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 095/406] crypto: stm32 - Properly handle pm_runtime_get failing Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 096/406] crypto: blake2b - sync with blake2s implementation Greg Kroah-Hartman
2023-09-18 2:53 ` Eric Biggers
2023-09-18 7:14 ` Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 097/406] crypto: api - Use work queue in crypto_destroy_instance Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 098/406] Bluetooth: nokia: fix value check in nokia_bluetooth_serdev_probe() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 099/406] Bluetooth: Fix potential use-after-free when clear keys Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 100/406] net: tcp: fix unexcepted socket die when snd_wnd is 0 Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 101/406] selftests/bpf: Clean up fmod_ret in bench_rename test script Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 102/406] ice: ice_aq_check_events: fix off-by-one check when filling buffer Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 103/406] crypto: caam - fix unchecked return value error Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 104/406] hwrng: iproc-rng200 - Implement suspend and resume calls Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 105/406] lwt: Fix return values of BPF xmit ops Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 106/406] lwt: Check LWTUNNEL_XMIT_CONTINUE strictly Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 107/406] fs: ocfs2: namei: check return value of ocfs2_add_entry() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 108/406] wifi: mwifiex: fix memory leak in mwifiex_histogram_read() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 109/406] wifi: mwifiex: Fix missed return in oob checks failed path Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 110/406] samples/bpf: fix broken map lookup probe Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 111/406] wifi: ath9k: fix races between ath9k_wmi_cmd and ath9k_wmi_ctrl_rx Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 112/406] wifi: ath9k: protect WMI command response buffer replacement with a lock Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 113/406] wifi: mwifiex: avoid possible NULL skb pointer dereference Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 114/406] Bluetooth: btusb: Do not call kfree_skb() under spin_lock_irqsave() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 115/406] wifi: ath9k: use IS_ERR() with debugfs_create_dir() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 116/406] net: arcnet: Do not call kfree_skb() under local_irq_disable() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 117/406] mlxsw: i2c: Fix chunk size setting in output mailbox buffer Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 118/406] mlxsw: i2c: Limit single transaction buffer size Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 119/406] hwmon: (tmp513) Fix the channel number in tmp51x_is_visible() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 120/406] net/sched: sch_hfsc: Ensure inner classes have fsc curve Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 121/406] netrom: Deny concurrent connect() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 122/406] drm/bridge: tc358764: Fix debug print parameter order Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 123/406] quota: factor out dquot_write_dquot() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 124/406] quota: rename dquot_active() to inode_quota_active() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 125/406] quota: add new helper dquot_active() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 126/406] quota: fix dqput() to follow the guarantees dquot_srcu should provide Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 127/406] ASoC: stac9766: fix build errors with REGMAP_AC97 Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 128/406] soc: qcom: ocmem: Add OCMEM hardware version print Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 129/406] soc: qcom: ocmem: Fix NUM_PORTS & NUM_MACROS macros Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 130/406] arm64: dts: qcom: msm8996: Add missing interrupt to the USB2 controller Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 131/406] drm/amdgpu: avoid integer overflow warning in amdgpu_device_resize_fb_bar() Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 132/406] ARM: dts: BCM5301X: Harmonize EHCI/OHCI DT nodes name Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 133/406] ARM: dts: BCM53573: Describe on-SoC BCM53125 rev 4 switch Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 134/406] ARM: dts: BCM53573: Drop nonexistent #usb-cells Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 135/406] ARM: dts: BCM53573: Add cells sizes to PCIe node Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 136/406] ARM: dts: BCM53573: Use updated "spi-gpio" binding properties Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 137/406] drm/etnaviv: fix dumping of active MMU context Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 138/406] x86/mm: Fix PAT bit missing from page protection modify mask Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 139/406] ARM: dts: s3c64xx: align pinctrl with dtschema Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 140/406] ARM: dts: samsung: s3c6410-mini6410: correct ethernet reg addresses (split) Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 141/406] ARM: dts: s5pv210: adjust node names to DT spec Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 142/406] ARM: dts: s5pv210: add dummy 5V regulator for backlight on SMDKv210 Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 143/406] ARM: dts: samsung: s5pv210-smdkv210: correct ethernet reg addresses (split) Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 144/406] drm: adv7511: Fix low refresh rate register for ADV7533/5 Greg Kroah-Hartman
2023-09-17 19:09 ` [PATCH 5.10 145/406] ARM: dts: BCM53573: Fix Ethernet info for Luxul devices Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 146/406] arm64: dts: qcom: sdm845: Add missing RPMh power domain to GCC Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 147/406] arm64: dts: qcom: sdm845: Fix the min frequency of "ice_core_clk" Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 148/406] drm/amdgpu: Update min() to min_t() in amdgpu_info_ioctl Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 149/406] md/bitmap: dont set max_write_behind if there is no write mostly device Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 150/406] md/md-bitmap: hold reconfig_mutex in backlog_store() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 151/406] drm/tegra: Remove superfluous error messages around platform_get_irq() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 152/406] drm/tegra: dpaux: Fix incorrect return value of platform_get_irq Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 153/406] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 154/406] drm/armada: Fix off-by-one error in armada_overlay_get_property() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 155/406] drm/panel: simple: Add missing connector type and pixel format for AUO T215HVN01 Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 156/406] ima: Remove deprecated IMA_TRUSTED_KEYRING Kconfig Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 157/406] drm: xlnx: zynqmp_dpsub: Add missing check for dma_set_mask Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 158/406] drm/msm/mdp5: Dont leak some plane state Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 159/406] firmware: meson_sm: fix to avoid potential NULL pointer dereference Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 160/406] smackfs: Prevent underflow in smk_set_cipso() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 161/406] drm/amd/pm: fix variable dereferenced issue in amdgpu_device_attr_create() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 162/406] drm/msm/a2xx: Call adreno_gpu_init() earlier Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 163/406] audit: fix possible soft lockup in __audit_inode_child() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 164/406] bus: ti-sysc: Fix build warning for 64-bit build Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 165/406] drm/mediatek: Fix potential memory leak if vmap() fail Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 166/406] bus: ti-sysc: Fix cast to enum warning Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 167/406] of: unittest: Fix overlay type in apply/revert check Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 168/406] ALSA: ac97: Fix possible error value of *rac97 Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 169/406] ipmi:ssif: Add check for kstrdup Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 170/406] ipmi:ssif: Fix a memory leak when scanning for an adapter Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 171/406] drivers: clk: keystone: Fix parameter judgment in _of_pll_clk_init() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 172/406] clk: sunxi-ng: Modify mismatched function name Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 173/406] clk: qcom: gcc-sc7180: use ARRAY_SIZE instead of specifying num_parents Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 174/406] clk: qcom: gcc-sc7180: Fix up gcc_sdcc2_apps_clk_src Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 175/406] ext4: correct grp validation in ext4_mb_good_group Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 176/406] clk: qcom: gcc-sm8250: use ARRAY_SIZE instead of specifying num_parents Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 177/406] clk: qcom: gcc-sm8250: Fix gcc_sdcc2_apps_clk_src Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 178/406] clk: qcom: reset: Use the correct type of sleep/delay based on length Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 179/406] PCI: Mark NVIDIA T4 GPUs to avoid bus reset Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 180/406] pinctrl: mcp23s08: check return value of devm_kasprintf() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 181/406] PCI: pciehp: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 182/406] PCI/ASPM: " Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 183/406] clk: imx8mp: fix sai4 clock Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 184/406] clk: imx: composite-8m: fix clock pauses when set_rate would be a no-op Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 185/406] vfio/type1: fix cap_migration information leak Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 186/406] powerpc/fadump: reset dump area size if fadump memory reserve fails Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 187/406] powerpc/perf: Convert fsl_emb notifier to state machine callbacks Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 188/406] drm/amdgpu: Use RMW accessors for changing LNKCTL Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 189/406] drm/radeon: " Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 190/406] net/mlx5: " Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 191/406] wifi: ath10k: " Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 192/406] powerpc: Dont include lppaca.h in paca.h Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 193/406] powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPT Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 194/406] nfs/blocklayout: Use the passed in gfp flags Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 195/406] powerpc/iommu: Fix notifiers being shared by PCI and VIO buses Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 196/406] jfs: validate max amount of blocks before allocation Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 197/406] fs: lockd: avoid possible wrong NULL parameter Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 198/406] NFSD: da_addr_body field missing in some GETDEVICEINFO replies Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 199/406] NFS: Guard against READDIR loop when entry names exceed MAXNAMELEN Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 200/406] NFSv4.2: fix handling of COPY ERR_OFFLOAD_NO_REQ Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 201/406] media: ad5820: Drop unsupported ad5823 from i2c_ and of_device_id tables Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 202/406] media: i2c: tvp5150: check return value of devm_kasprintf() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 203/406] media: v4l2-core: Fix a potential resource leak in v4l2_fwnode_parse_link() Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 204/406] drivers: usb: smsusb: fix error handling code in smsusb_init_device Greg Kroah-Hartman
2023-09-17 19:10 ` [PATCH 5.10 205/406] media: dib7000p: Fix potential division by zero Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 206/406] media: dvb-usb: m920x: Fix a potential memory leak in m920x_i2c_xfer() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 207/406] media: cx24120: Add retval check for cx24120_message_send() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 208/406] scsi: hisi_sas: Print SAS address for v3 hw erroneous completion print Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 209/406] scsi: libsas: Introduce more SAM status code aliases in enum exec_status Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 210/406] scsi: hisi_sas: Modify v3 HW SSP underflow error processing Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 211/406] scsi: hisi_sas: Modify v3 HW SATA completion " Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 212/406] scsi: hisi_sas: Fix warnings detected by sparse Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 213/406] scsi: hisi_sas: Fix normally completed I/O analysed as failed Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 214/406] media: rkvdec: increase max supported height for H.264 Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 215/406] media: mediatek: vcodec: Return NULL if no vdec_fb is found Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 216/406] usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 217/406] scsi: RDMA/srp: Fix residual handling Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 218/406] scsi: iscsi: Rename iscsi_set_param() to iscsi_if_set_param() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 219/406] scsi: iscsi: Add length check for nlattr payload Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 220/406] scsi: iscsi: Add strlen() check in iscsi_if_set{_host}_param() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 221/406] scsi: be2iscsi: Add length check when parsing nlattrs Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 222/406] scsi: qla4xxx: " Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 223/406] serial: sprd: Assign sprd_port after initialized to avoid wrong access Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 224/406] serial: sprd: Fix DMA buffer leak issue Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 225/406] x86/APM: drop the duplicate APM_MINOR_DEV macro Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 226/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_stop_io_on_error_cmd_read() directly Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 227/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 228/406] scsi: qedf: Do not touch __user pointer in qedf_dbg_fp_int_cmd_read() directly Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 229/406] coresight: tmc: Explicit type conversions to prevent integer overflow Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 230/406] dma-buf/sync_file: Fix docs syntax Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 231/406] driver core: test_async: fix an error code Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 232/406] IB/uverbs: Fix an potential error pointer dereference Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 233/406] fsi: aspeed: Reset master errors after CFAM reset Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 234/406] iommu/qcom: Disable and reset context bank before programming Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 235/406] iommu/vt-d: Fix to flush cache of PASID directory table Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 236/406] media: go7007: Remove redundant if statement Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 237/406] USB: gadget: f_mass_storage: Fix unused variable warning Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 238/406] media: ov5640: Enable MIPI interface in ov5640_set_power_mipi() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 239/406] media: i2c: ov2680: Set V4L2_CTRL_FLAG_MODIFY_LAYOUT on flips Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 240/406] media: ov2680: Remove auto-gain and auto-exposure controls Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 241/406] media: ov2680: Fix ov2680_bayer_order() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 242/406] media: ov2680: Fix vflip / hflip set functions Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 243/406] media: ov2680: Fix regulators being left enabled on ov2680_power_on() errors Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 244/406] cgroup:namespace: Remove unused cgroup_namespaces_init() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 245/406] scsi: core: Use 32-bit hostnum in scsi_host_lookup() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 246/406] scsi: fcoe: Fix potential deadlock on &fip->ctlr_lock Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 247/406] serial: tegra: handle clk prepare error in tegra_uart_hw_init() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 248/406] amba: bus: fix refcount leak Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 249/406] Revert "IB/isert: Fix incorrect release of isert connection" Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 250/406] RDMA/siw: Balance the reference of cep->kref in the error path Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 251/406] RDMA/siw: Correct wrong debug message Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 252/406] HID: logitech-dj: Fix error handling in logi_dj_recv_switch_to_dj_mode() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 253/406] HID: multitouch: Correct devm device reference for hidinput input_dev name Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 254/406] x86/speculation: Mark all Skylake CPUs as vulnerable to GDS Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 255/406] tracing: Fix race issue between cpu buffer write and swap Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 256/406] mtd: rawnand: brcmnand: Fix mtd oobsize Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 257/406] phy/rockchip: inno-hdmi: use correct vco_div_5 macro on rk3328 Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 258/406] phy/rockchip: inno-hdmi: round fractal pixclock in rk3328 recalc_rate Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 259/406] phy/rockchip: inno-hdmi: do not power on rk3328 post pll on reg write Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 260/406] rpmsg: glink: Add check for kstrdup Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 261/406] leds: Fix BUG_ON check for LED_COLOR_ID_MULTI that is always false Greg Kroah-Hartman
2023-09-18 14:00 ` Marek Behún
2023-09-18 15:22 ` Greg Kroah-Hartman
2023-09-18 16:17 ` Marek Behún
2023-09-19 7:57 ` Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 262/406] mtd: spi-nor: Check bus width while setting QE bit Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 263/406] mtd: rawnand: fsmc: handle clk prepare error in fsmc_nand_resume() Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 264/406] um: Fix hostaudio build errors Greg Kroah-Hartman
2023-09-17 19:11 ` [PATCH 5.10 265/406] dmaengine: ste_dma40: Add missing IRQ check in d40_probe Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 266/406] cpufreq: Fix the race condition while updating the transition_task of policy Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 267/406] virtio_ring: fix avail_wrap_counter in virtqueue_add_packed Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 268/406] igmp: limit igmpv3_newpack() packet size to IP_MAX_MTU Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 269/406] netfilter: ipset: add the missing IP_SET_HASH_WITH_NET0 macro for ip_set_hash_netportnet.c Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 270/406] netfilter: xt_u32: validate user space input Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 271/406] netfilter: xt_sctp: validate the flag_info count Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 272/406] skbuff: skb_segment, Call zero copy functions before using skbuff frags Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 273/406] igb: set max size RX buffer when store bad packet is enabled Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 274/406] PM / devfreq: Fix leak in devfreq_dev_release() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 275/406] ALSA: pcm: Fix missing fixup call in compat hw_refine ioctl Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 276/406] printk: ringbuffer: Fix truncating buffer size min_t cast Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 277/406] scsi: core: Fix the scsi_set_resid() documentation Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 278/406] ipmi_si: fix a memleak in try_smi_init() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 279/406] ARM: OMAP2+: Fix -Warray-bounds warning in _pwrdm_state_switch() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 280/406] backlight/gpio_backlight: Compare against struct fb_info.device Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 281/406] backlight/bd6107: " Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 282/406] backlight/lv5207lp: " Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 283/406] xtensa: PMU: fix base address for the newer hardware Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 284/406] arm64: csum: Fix OoB access in IP checksum code for negative lengths Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 285/406] media: dvb: symbol fixup for dvb_attach() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 286/406] Revert "scsi: qla2xxx: Fix buffer overrun" Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 287/406] scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 288/406] ntb: Drop packets when qp link is down Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 289/406] ntb: Clean up tx tail index on link down Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 290/406] ntb: Fix calculation ntb_transport_tx_free_entry() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 291/406] Revert "PCI: Mark NVIDIA T4 GPUs to avoid bus reset" Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 292/406] procfs: block chmod on /proc/thread-self/comm Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 293/406] parisc: Fix /proc/cpuinfo output for lscpu Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 294/406] bpf: Fix issue in verifying allow_ptr_leaks Greg Kroah-Hartman
2023-09-17 20:21 ` Eduard Zingerman
2023-09-18 1:51 ` Alexei Starovoitov
2023-09-18 7:07 ` Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 295/406] dlm: fix plock lookup when using multiple lockspaces Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 296/406] dccp: Fix out of bounds access in DCCP error handler Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 297/406] X.509: if signature is unsupported skip validation Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 298/406] net: handle ARPHRD_PPP in dev_is_mac_header_xmit() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 299/406] fsverity: skip PKCS#7 parser when keyring is empty Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 300/406] pstore/ram: Check start of empty przs during init Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 301/406] s390/ipl: add missing secure/has_secure file to ipl type unknown Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 302/406] crypto: stm32 - fix loop iterating through scatterlist for DMA Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 303/406] cpufreq: brcmstb-avs-cpufreq: Fix -Warray-bounds bug Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 304/406] usb: typec: bus: verify partner exists in typec_altmode_attention Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 305/406] USB: core: Unite old scheme and new scheme descriptor reads Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 306/406] USB: core: Change usb_get_device_descriptor() API Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 307/406] USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 308/406] USB: core: Fix oversight in SuperSpeed initialization Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 309/406] usb: typec: tcpci: clear the fault status bit Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 310/406] tracing: Zero the pipe cpumask on alloc to avoid spurious -EBUSY Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 311/406] md/md-bitmap: remove unnecessary local variable in backlog_store() Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 312/406] udf: initialize newblock to 0 Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 313/406] net/ipv6: SKB symmetric hash should incorporate transport ports Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 314/406] io_uring: always lock in io_apoll_task_func Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 315/406] io_uring: break out of iowq iopoll on teardown Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 316/406] io_uring: break iopolling on signal Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 317/406] scsi: qla2xxx: Fix deletion race condition Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 318/406] scsi: qla2xxx: fix inconsistent TMF timeout Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 319/406] scsi: qla2xxx: Fix erroneous link up failure Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 320/406] scsi: qla2xxx: Turn off noisy message log Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 321/406] scsi: qla2xxx: Remove unsupported ql2xenabledif option Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 322/406] fbdev/ep93xx-fb: Do not assign to struct fb_info.dev Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 323/406] drm/ast: Fix DRAM init on AST2200 Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 324/406] lib/test_meminit: allocate pages up to order MAX_ORDER Greg Kroah-Hartman
2023-09-17 19:12 ` [PATCH 5.10 325/406] parisc: led: Fix LAN receive and transmit LEDs Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 326/406] parisc: led: Reduce CPU overhead for disk & lan LED computation Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 327/406] pinctrl: cherryview: fix address_space_handler() argument Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 328/406] dt-bindings: clock: xlnx,versal-clk: drop select:false Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 329/406] clk: imx: pll14xx: dynamically configure PLL for 393216000/361267200Hz Greg Kroah-Hartman
2023-09-29 19:56 ` Ahmad Fatoum
2023-09-17 19:13 ` [PATCH 5.10 330/406] clk: qcom: gcc-mdm9615: use proper parent for pll0_vote clock Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 331/406] soc: qcom: qmi_encdec: Restrict string length in decode Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 332/406] NFS: Fix a potential data corruption Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 333/406] NFSv4/pnfs: minor fix for cleanup path in nfs4_get_device_info Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 334/406] kconfig: fix possible buffer overflow Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 335/406] backlight: gpio_backlight: Drop output GPIO direction check for initial power state Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 336/406] perf annotate bpf: Dont enclose non-debug code with an assert() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 337/406] x86/virt: Drop unnecessary check on extended CPUID level in cpu_has_svm() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 338/406] perf top: Dont pass an ERR_PTR() directly to perf_session__delete() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 339/406] watchdog: intel-mid_wdt: add MODULE_ALIAS() to allow auto-load Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 340/406] pwm: lpc32xx: Remove handling of PWM channels Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 341/406] net/sched: fq_pie: avoid stalls in fq_pie_timer() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 342/406] sctp: annotate data-races around sk->sk_wmem_queued Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 343/406] ipv4: annotate data-races around fi->fib_dead Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 344/406] net: read sk->sk_family once in sk_mc_loop() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 345/406] drm/i915/gvt: Save/restore HW status to support GVT suspend/resume Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 346/406] drm/i915/gvt: Drop unused helper intel_vgpu_reset_gtt() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 347/406] ipv4: ignore dst hint for multipath routes Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 348/406] igb: disable virtualization features on 82580 Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 349/406] veth: Fixing transmit return status for dropped packets Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 350/406] net: ipv6/addrconf: avoid integer underflow in ipv6_create_tempaddr Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 351/406] af_unix: Fix data-races around user->unix_inflight Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 352/406] af_unix: Fix data-race around unix_tot_inflight Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 353/406] af_unix: Fix data-races around sk->sk_shutdown Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 354/406] af_unix: Fix data race around sk->sk_err Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 355/406] net: sched: sch_qfq: Fix UAF in qfq_dequeue() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 356/406] kcm: Destroy mutex in kcm_exit_net() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 357/406] igc: Change IGC_MIN to allow set rx/tx value between 64 and 80 Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 358/406] igbvf: Change IGBVF_MIN " Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 359/406] igb: Change IGB_MIN " Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 360/406] s390/zcrypt: dont leak memory if dev_set_name() fails Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 361/406] idr: fix param name in idr_alloc_cyclic() doc Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 362/406] ip_tunnels: use DEV_STATS_INC() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 363/406] net: dsa: sja1105: fix bandwidth discrepancy between tc-cbs software and offload Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 364/406] net: dsa: sja1105: fix -ENOSPC when replacing the same tc-cbs too many times Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 365/406] netfilter: nfnetlink_osf: avoid OOB read Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 366/406] net: hns3: fix the port information display when sfp is absent Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 367/406] sh: boards: Fix CEU buffer size passed to dma_declare_coherent_memory() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 368/406] ext4: add correct group descriptors and reserved GDT blocks to system zone Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 369/406] ata: sata_gemini: Add missing MODULE_DESCRIPTION Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 370/406] ata: pata_ftide010: " Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 371/406] fuse: nlookup missing decrement in fuse_direntplus_link Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 372/406] btrfs: dont start transaction when joining with TRANS_JOIN_NOSTART Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 373/406] btrfs: use the correct superblock to compare fsid in btrfs_validate_super Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 374/406] mtd: rawnand: brcmnand: Fix crash during the panic_write Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 375/406] mtd: rawnand: brcmnand: Fix potential out-of-bounds access in oob write Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 376/406] mtd: rawnand: brcmnand: Fix potential false time out warning Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 377/406] drm/amd/display: prevent potential division by zero errors Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 378/406] perf hists browser: Fix hierarchy mode header Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 379/406] perf tools: Handle old data in PERF_RECORD_ATTR Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 380/406] perf hists browser: Fix the number of entries for e key Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 381/406] ACPI: APEI: explicit init of HEST and GHES in apci_init() Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 382/406] arm64: sdei: abort running SDEI handlers during crash Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 383/406] scsi: qla2xxx: If fcport is undergoing deletion complete I/O with retry Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 384/406] scsi: qla2xxx: Consolidate zio threshold setting for both FCP & NVMe Greg Kroah-Hartman
2023-09-17 19:13 ` [PATCH 5.10 385/406] scsi: qla2xxx: Fix crash in PCIe error handling Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 386/406] scsi: qla2xxx: Flush mailbox commands on chip reset Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 387/406] ARM: dts: samsung: exynos4210-i9100: Fix LCD screens physical size Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 388/406] ARM: dts: BCM5301X: Extend RAM to full 256MB for Linksys EA6500 V2 Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 389/406] bus: mhi: host: Skip MHI reset if device is in RDDM Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 390/406] net: ipv4: fix one memleak in __inet_del_ifa() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 391/406] selftests/kselftest/runner/run_one(): allow running non-executable files Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 392/406] kselftest/runner.sh: Propagate SIGTERM to runner child Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 393/406] net/smc: use smc_lgr_list.lock to protect smc_lgr_list.list iterate in smcr_port_add Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 394/406] net: ethernet: mvpp2_main: fix possible OOB write in mvpp2_ethtool_get_rxnfc() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 395/406] net: ethernet: mtk_eth_soc: fix possible NULL pointer dereference in mtk_hwlro_get_fdir_all() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 396/406] hsr: Fix uninit-value access in fill_frame_info() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 397/406] r8152: check budget for r8152_poll() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 398/406] kcm: Fix memory leak in error path of kcm_sendmsg() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 399/406] platform/mellanox: mlxbf-tmfifo: Drop the Rx packet if no more descriptors Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 400/406] platform/mellanox: mlxbf-tmfifo: Drop jumbo frames Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 401/406] net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 402/406] ipv6: fix ip6_sock_set_addr_preferences() typo Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 403/406] ixgbe: fix timestamp configuration code Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 404/406] kcm: Fix error handling for SOCK_DGRAM in kcm_sendmsg() Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 405/406] drm/amd/display: Fix a bug when searching for insert_above_mpcc Greg Kroah-Hartman
2023-09-17 19:14 ` [PATCH 5.10 406/406] parisc: Drop loops_per_jiffy from per_cpu struct Greg Kroah-Hartman
2023-09-18 7:57 ` [PATCH 5.10 000/406] 5.10.195-rc1 review Pavel Machek
2023-09-18 12:46 ` Jon Hunter
2023-09-18 17:46 ` Florian Fainelli
2023-09-18 18:33 ` Guenter Roeck
2023-09-18 22:25 ` Shuah Khan
2023-09-18 22:27 ` Shuah Khan
2023-09-19 8:03 ` Naresh Kamboju
2023-09-20 4:57 ` Guenter Roeck
2023-09-20 8:11 ` Greg Kroah-Hartman
2023-09-20 15:18 ` Guenter Roeck
2023-09-20 17:01 ` Florian Fainelli
2023-09-20 19:13 ` Kyle Zeng
2023-09-21 7:13 ` Greg Kroah-Hartman
2023-09-21 20:35 ` Joel Fernandes
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).