diff for duplicates of <20241106120321.799810217@linuxfoundation.org> diff --git a/a/1.txt b/N1/1.txt index 576b9d9..3d16ef0 100644 --- a/a/1.txt +++ b/N1/1.txt @@ -1,220 +1,38 @@ -4.19-stable review patch. If anyone has any objections, please let me know. +6.11-stable review patch. If anyone has any objections, please let me know. ------------------ -From: Yu Kuai <yukuai3@huawei.com> +From: Jan Schär <jan@jschaer.ch> -[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ] +commit 4413665dd6c528b31284119e3571c25f371e1c36 upstream. -1) initial state, three tasks: +The WD19 family of docks has the same audio chipset as the WD15. This +change enables jack detection on the WD19. - Process 1 Process 2 Process 3 - (BIC1) (BIC2) (BIC3) - | Λ | Λ | Λ - | | | | | | - V | V | V | - bfqq1 bfqq2 bfqq3 -process ref: 1 1 1 +We don't need the dell_dock_mixer_init quirk for the WD19. It is only +needed because of the dell_alc4020_map quirk for the WD15 in +mixer_maps.c, which disables the volume controls. Even for the WD15, +this quirk was apparently only needed when the dock firmware was not +updated. -2) bfqq1 merged to bfqq2: - - Process 1 Process 2 Process 3 - (BIC1) (BIC2) (BIC3) - | | | Λ - \--------------\| | | - V V | - bfqq1--------->bfqq2 bfqq3 -process ref: 0 2 1 - -3) bfqq2 merged to bfqq3: - - Process 1 Process 2 Process 3 - (BIC1) (BIC2) (BIC3) - here -> Λ | | - \--------------\ \-------------\| - V V - bfqq1--------->bfqq2---------->bfqq3 -process ref: 0 1 3 - -In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then -get bfqq3 through merge chain, and finially handle IO by bfqq3. -Howerver, current code will think bfqq2 is owned by BIC1, like initial -state, and set bfqq2->bic to BIC1. - -bfq_insert_request --> by Process 1 - bfqq = bfq_init_rq(rq) - bfqq = bfq_get_bfqq_handle_split - bfqq = bic_to_bfqq - -> get bfqq2 from BIC1 - bfqq->ref++ - rq->elv.priv[0] = bic - rq->elv.priv[1] = bfqq - if (bfqq_process_refs(bfqq) == 1) - bfqq->bic = bic - -> record BIC1 to bfqq2 - - __bfq_insert_request - new_bfqq = bfq_setup_cooperator - -> get bfqq3 from bfqq2->new_bfqq - bfqq_request_freed(bfqq) - new_bfqq->ref++ - rq->elv.priv[1] = new_bfqq - -> handle IO by bfqq3 - -Fix the problem by checking bfqq is from merge chain fist. And this -might fix a following problem reported by our syzkaller(unreproducible): - -================================================================== -BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] -BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] -BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 -Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595 - -CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 -Workqueue: kblockd blk_mq_requeue_work -Call Trace: - <TASK> - __dump_stack lib/dump_stack.c:88 [inline] - dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106 - print_address_description mm/kasan/report.c:364 [inline] - print_report+0x10d/0x610 mm/kasan/report.c:475 - kasan_report+0x8e/0xc0 mm/kasan/report.c:588 - bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline] - bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline] - bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889 - bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757 - bfq_init_rq block/bfq-iosched.c:6876 [inline] - bfq_insert_request block/bfq-iosched.c:6254 [inline] - bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304 - blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593 - blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502 - process_one_work kernel/workqueue.c:2627 [inline] - process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 - worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 - kthread+0x33c/0x440 kernel/kthread.c:388 - ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 - </TASK> - -Allocated by task 20776: - kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 - kasan_set_track+0x25/0x30 mm/kasan/common.c:52 - __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328 - kasan_slab_alloc include/linux/kasan.h:188 [inline] - slab_post_alloc_hook mm/slab.h:763 [inline] - slab_alloc_node mm/slub.c:3458 [inline] - kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503 - ioc_create_icq block/blk-ioc.c:370 [inline] - ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436 - bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812 - blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403 - __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517 - blk_mq_get_new_requests block/blk-mq.c:2940 [inline] - blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042 - __submit_bio+0x331/0x6f0 block/blk-core.c:624 - __submit_bio_noacct_mq block/blk-core.c:703 [inline] - submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732 - submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826 - xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958 - xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619 - xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330 - process_one_work kernel/workqueue.c:2627 [inline] - process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 - worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 - kthread+0x33c/0x440 kernel/kthread.c:388 - ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 - -Freed by task 946: - kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 - kasan_set_track+0x25/0x30 mm/kasan/common.c:52 - kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522 - ____kasan_slab_free mm/kasan/common.c:236 [inline] - __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244 - kasan_slab_free include/linux/kasan.h:164 [inline] - slab_free_hook mm/slub.c:1815 [inline] - slab_free_freelist_hook mm/slub.c:1841 [inline] - slab_free mm/slub.c:3786 [inline] - kmem_cache_free+0x118/0x6f0 mm/slub.c:3808 - rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189 - rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462 - __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553 - -Last potentially related work creation: - kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 - __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 - __call_rcu_common kernel/rcu/tree.c:2712 [inline] - call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 - ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 - ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 - process_one_work kernel/workqueue.c:2627 [inline] - process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 - worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 - kthread+0x33c/0x440 kernel/kthread.c:388 - ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 - -Second to last potentially related work creation: - kasan_save_stack+0x20/0x40 mm/kasan/common.c:45 - __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492 - __call_rcu_common kernel/rcu/tree.c:2712 [inline] - call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826 - ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105 - ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124 - process_one_work kernel/workqueue.c:2627 [inline] - process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700 - worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781 - kthread+0x33c/0x440 kernel/kthread.c:388 - ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147 - ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305 - -The buggy address belongs to the object at ffff888123839d68 - which belongs to the cache bfq_io_cq of size 1360 -The buggy address is located 336 bytes inside of - freed 1360-byte region [ffff888123839d68, ffff88812383a2b8) - -The buggy address belongs to the physical page: -page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838 -head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 -flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff) -page_type: 0xffffffff() -raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488 -raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000 -page dumped because: kasan: bad access detected - -Memory state around the buggy address: - ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ->ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ^ - ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb - ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb -================================================================== - -Fixes: 36eca8948323 ("block, bfq: add Early Queue Merge (EQM)") -Signed-off-by: Yu Kuai <yukuai3@huawei.com> -Link: https://lore.kernel.org/r/20240902130329.3787024-2-yukuai1@huaweicloud.com -Signed-off-by: Jens Axboe <axboe@kernel.dk> -Signed-off-by: Sasha Levin <sashal@kernel.org> +Signed-off-by: Jan Schär <jan@jschaer.ch> +Cc: <stable@vger.kernel.org> +Link: https://patch.msgid.link/20241029221249.15661-1-jan@jschaer.ch +Signed-off-by: Takashi Iwai <tiwai@suse.de> +Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- - block/bfq-iosched.c | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c -index 7415db053217c..1479e8d6fede2 100644 ---- a/block/bfq-iosched.c -+++ b/block/bfq-iosched.c -@@ -5218,7 +5218,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq) - * addition, if the queue has also just been split, we have to - * resume its state. - */ -- if (likely(bfqq != &bfqd->oom_bfqq) && bfqq_process_refs(bfqq) == 1) { -+ if (likely(bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq && -+ bfqq_process_refs(bfqq) == 1) { - bfqq->bic = bic; - if (split) { - /* --- -2.43.0 + sound/usb/mixer_quirks.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/sound/usb/mixer_quirks.c ++++ b/sound/usb/mixer_quirks.c +@@ -3880,6 +3880,9 @@ int snd_usb_mixer_apply_create_quirk(str + break; + err = dell_dock_mixer_init(mixer); + break; ++ case USB_ID(0x0bda, 0x402e): /* Dell WD19 dock */ ++ err = dell_dock_mixer_create(mixer); ++ break; + + case USB_ID(0x2a39, 0x3fd2): /* RME ADI-2 Pro */ + case USB_ID(0x2a39, 0x3fd3): /* RME ADI-2 DAC */ diff --git a/a/content_digest b/N1/content_digest index c6fb5b0..93acbbf 100644 --- a/a/content_digest +++ b/N1/content_digest @@ -1,234 +1,51 @@ - "ref\020241106120320.865793091@linuxfoundation.org\0" + "ref\020241106120319.234238499@linuxfoundation.org\0" "From\0Greg Kroah-Hartman <gregkh@linuxfoundation.org>\0" - "Subject\0[PATCH 4.19 037/350] block, bfq: fix possible UAF for bfqq->bic with merge chain\0" - "Date\0Wed, 6 Nov 2024 12:59:25 +0100\0" + "Subject\0[PATCH 6.11 105/245] ALSA: usb-audio: Add quirks for Dell WD19 dock\0" + "Date\0Wed, 6 Nov 2024 13:02:38 +0100\0" "To\0stable@vger.kernel.org\0" "Cc\0Greg Kroah-Hartman <gregkh@linuxfoundation.org>" patches@lists.linux.dev - Yu Kuai <yukuai3@huawei.com> - Jens Axboe <axboe@kernel.dk> - " Sasha Levin <sashal@kernel.org>\0" + " Jan Sch\303\244r <jan@jschaer.ch>" + " Takashi Iwai <tiwai@suse.de>\0" "\00:1\0" "b\0" - "4.19-stable review patch. If anyone has any objections, please let me know.\n" + "6.11-stable review patch. If anyone has any objections, please let me know.\n" "\n" "------------------\n" "\n" - "From: Yu Kuai <yukuai3@huawei.com>\n" + "From: Jan Sch\303\244r <jan@jschaer.ch>\n" "\n" - "[ Upstream commit 18ad4df091dd5d067d2faa8fce1180b79f7041a7 ]\n" + "commit 4413665dd6c528b31284119e3571c25f371e1c36 upstream.\n" "\n" - "1) initial state, three tasks:\n" + "The WD19 family of docks has the same audio chipset as the WD15. This\n" + "change enables jack detection on the WD19.\n" "\n" - "\t\tProcess 1 Process 2\tProcess 3\n" - "\t\t (BIC1) (BIC2)\t\t (BIC3)\n" - "\t\t | \316\233 | \316\233\t\t | \316\233\n" - "\t\t | | | |\t\t | |\n" - "\t\t V | V |\t\t V |\n" - "\t\t bfqq1 bfqq2\t\t bfqq3\n" - "process ref:\t 1\t\t 1\t\t 1\n" + "We don't need the dell_dock_mixer_init quirk for the WD19. It is only\n" + "needed because of the dell_alc4020_map quirk for the WD15 in\n" + "mixer_maps.c, which disables the volume controls. Even for the WD15,\n" + "this quirk was apparently only needed when the dock firmware was not\n" + "updated.\n" "\n" - "2) bfqq1 merged to bfqq2:\n" - "\n" - "\t\tProcess 1 Process 2\tProcess 3\n" - "\t\t (BIC1) (BIC2)\t\t (BIC3)\n" - "\t\t | |\t\t | \316\233\n" - "\t\t \\--------------\\|\t\t | |\n" - "\t\t V\t\t V |\n" - "\t\t bfqq1--------->bfqq2\t\t bfqq3\n" - "process ref:\t 0\t\t 2\t\t 1\n" - "\n" - "3) bfqq2 merged to bfqq3:\n" - "\n" - "\t\tProcess 1 Process 2\tProcess 3\n" - "\t\t (BIC1) (BIC2)\t\t (BIC3)\n" - "\t here -> \316\233 |\t\t |\n" - "\t\t \\--------------\\ \\-------------\\|\n" - "\t\t V\t\t V\n" - "\t\t bfqq1--------->bfqq2---------->bfqq3\n" - "process ref:\t 0\t\t 1\t\t 3\n" - "\n" - "In this case, IO from Process 1 will get bfqq2 from BIC1 first, and then\n" - "get bfqq3 through merge chain, and finially handle IO by bfqq3.\n" - "Howerver, current code will think bfqq2 is owned by BIC1, like initial\n" - "state, and set bfqq2->bic to BIC1.\n" - "\n" - "bfq_insert_request\n" - "-> by Process 1\n" - " bfqq = bfq_init_rq(rq)\n" - " bfqq = bfq_get_bfqq_handle_split\n" - " bfqq = bic_to_bfqq\n" - " -> get bfqq2 from BIC1\n" - " bfqq->ref++\n" - " rq->elv.priv[0] = bic\n" - " rq->elv.priv[1] = bfqq\n" - " if (bfqq_process_refs(bfqq) == 1)\n" - " bfqq->bic = bic\n" - " -> record BIC1 to bfqq2\n" - "\n" - " __bfq_insert_request\n" - " new_bfqq = bfq_setup_cooperator\n" - " -> get bfqq3 from bfqq2->new_bfqq\n" - " bfqq_request_freed(bfqq)\n" - " new_bfqq->ref++\n" - " rq->elv.priv[1] = new_bfqq\n" - " -> handle IO by bfqq3\n" - "\n" - "Fix the problem by checking bfqq is from merge chain fist. And this\n" - "might fix a following problem reported by our syzkaller(unreproducible):\n" - "\n" - "==================================================================\n" - "BUG: KASAN: slab-use-after-free in bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\n" - "BUG: KASAN: slab-use-after-free in bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\n" - "BUG: KASAN: slab-use-after-free in bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\n" - "Write of size 1 at addr ffff888123839eb8 by task kworker/0:1H/18595\n" - "\n" - "CPU: 0 PID: 18595 Comm: kworker/0:1H Tainted: G L 6.6.0-07439-gba2303cacfda #6\n" - "Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014\n" - "Workqueue: kblockd blk_mq_requeue_work\n" - "Call Trace:\n" - " <TASK>\n" - " __dump_stack lib/dump_stack.c:88 [inline]\n" - " dump_stack_lvl+0x91/0xf0 lib/dump_stack.c:106\n" - " print_address_description mm/kasan/report.c:364 [inline]\n" - " print_report+0x10d/0x610 mm/kasan/report.c:475\n" - " kasan_report+0x8e/0xc0 mm/kasan/report.c:588\n" - " bfq_do_early_stable_merge block/bfq-iosched.c:5692 [inline]\n" - " bfq_do_or_sched_stable_merge block/bfq-iosched.c:5805 [inline]\n" - " bfq_get_queue+0x25b0/0x2610 block/bfq-iosched.c:5889\n" - " bfq_get_bfqq_handle_split+0x169/0x5d0 block/bfq-iosched.c:6757\n" - " bfq_init_rq block/bfq-iosched.c:6876 [inline]\n" - " bfq_insert_request block/bfq-iosched.c:6254 [inline]\n" - " bfq_insert_requests+0x1112/0x5cf0 block/bfq-iosched.c:6304\n" - " blk_mq_insert_request+0x290/0x8d0 block/blk-mq.c:2593\n" - " blk_mq_requeue_work+0x6bc/0xa70 block/blk-mq.c:1502\n" - " process_one_work kernel/workqueue.c:2627 [inline]\n" - " process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n" - " worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n" - " kthread+0x33c/0x440 kernel/kthread.c:388\n" - " ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n" - " ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n" - " </TASK>\n" - "\n" - "Allocated by task 20776:\n" - " kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n" - " kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n" - " __kasan_slab_alloc+0x87/0x90 mm/kasan/common.c:328\n" - " kasan_slab_alloc include/linux/kasan.h:188 [inline]\n" - " slab_post_alloc_hook mm/slab.h:763 [inline]\n" - " slab_alloc_node mm/slub.c:3458 [inline]\n" - " kmem_cache_alloc_node+0x1a4/0x6f0 mm/slub.c:3503\n" - " ioc_create_icq block/blk-ioc.c:370 [inline]\n" - " ioc_find_get_icq+0x180/0xaa0 block/blk-ioc.c:436\n" - " bfq_prepare_request+0x39/0xf0 block/bfq-iosched.c:6812\n" - " blk_mq_rq_ctx_init.isra.7+0x6ac/0xa00 block/blk-mq.c:403\n" - " __blk_mq_alloc_requests+0xcc0/0x1070 block/blk-mq.c:517\n" - " blk_mq_get_new_requests block/blk-mq.c:2940 [inline]\n" - " blk_mq_submit_bio+0x624/0x27c0 block/blk-mq.c:3042\n" - " __submit_bio+0x331/0x6f0 block/blk-core.c:624\n" - " __submit_bio_noacct_mq block/blk-core.c:703 [inline]\n" - " submit_bio_noacct_nocheck+0x816/0xb40 block/blk-core.c:732\n" - " submit_bio_noacct+0x7a6/0x1b50 block/blk-core.c:826\n" - " xlog_write_iclog+0x7d5/0xa00 fs/xfs/xfs_log.c:1958\n" - " xlog_state_release_iclog+0x3b8/0x720 fs/xfs/xfs_log.c:619\n" - " xlog_cil_push_work+0x19c5/0x2270 fs/xfs/xfs_log_cil.c:1330\n" - " process_one_work kernel/workqueue.c:2627 [inline]\n" - " process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n" - " worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n" - " kthread+0x33c/0x440 kernel/kthread.c:388\n" - " ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n" - " ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n" - "\n" - "Freed by task 946:\n" - " kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n" - " kasan_set_track+0x25/0x30 mm/kasan/common.c:52\n" - " kasan_save_free_info+0x2b/0x50 mm/kasan/generic.c:522\n" - " ____kasan_slab_free mm/kasan/common.c:236 [inline]\n" - " __kasan_slab_free+0x12c/0x1c0 mm/kasan/common.c:244\n" - " kasan_slab_free include/linux/kasan.h:164 [inline]\n" - " slab_free_hook mm/slub.c:1815 [inline]\n" - " slab_free_freelist_hook mm/slub.c:1841 [inline]\n" - " slab_free mm/slub.c:3786 [inline]\n" - " kmem_cache_free+0x118/0x6f0 mm/slub.c:3808\n" - " rcu_do_batch+0x35c/0xe30 kernel/rcu/tree.c:2189\n" - " rcu_core+0x819/0xd90 kernel/rcu/tree.c:2462\n" - " __do_softirq+0x1b0/0x7a2 kernel/softirq.c:553\n" - "\n" - "Last potentially related work creation:\n" - " kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n" - " __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492\n" - " __call_rcu_common kernel/rcu/tree.c:2712 [inline]\n" - " call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826\n" - " ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105\n" - " ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124\n" - " process_one_work kernel/workqueue.c:2627 [inline]\n" - " process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n" - " worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n" - " kthread+0x33c/0x440 kernel/kthread.c:388\n" - " ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n" - " ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n" - "\n" - "Second to last potentially related work creation:\n" - " kasan_save_stack+0x20/0x40 mm/kasan/common.c:45\n" - " __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492\n" - " __call_rcu_common kernel/rcu/tree.c:2712 [inline]\n" - " call_rcu+0xce/0x1020 kernel/rcu/tree.c:2826\n" - " ioc_destroy_icq+0x54c/0x830 block/blk-ioc.c:105\n" - " ioc_release_fn+0xf0/0x360 block/blk-ioc.c:124\n" - " process_one_work kernel/workqueue.c:2627 [inline]\n" - " process_scheduled_works+0x432/0x13f0 kernel/workqueue.c:2700\n" - " worker_thread+0x6f2/0x1160 kernel/workqueue.c:2781\n" - " kthread+0x33c/0x440 kernel/kthread.c:388\n" - " ret_from_fork+0x4d/0x80 arch/x86/kernel/process.c:147\n" - " ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:305\n" - "\n" - "The buggy address belongs to the object at ffff888123839d68\n" - " which belongs to the cache bfq_io_cq of size 1360\n" - "The buggy address is located 336 bytes inside of\n" - " freed 1360-byte region [ffff888123839d68, ffff88812383a2b8)\n" - "\n" - "The buggy address belongs to the physical page:\n" - "page:ffffea00048e0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88812383f588 pfn:0x123838\n" - "head:ffffea00048e0e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n" - "flags: 0x17ffffc0000a40(workingset|slab|head|node=0|zone=2|lastcpupid=0x1fffff)\n" - "page_type: 0xffffffff()\n" - "raw: 0017ffffc0000a40 ffff88810588c200 ffffea00048ffa10 ffff888105889488\n" - "raw: ffff88812383f588 0000000000150006 00000001ffffffff 0000000000000000\n" - "page dumped because: kasan: bad access detected\n" - "\n" - "Memory state around the buggy address:\n" - " ffff888123839d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n" - " ffff888123839e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n" - ">ffff888123839e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n" - " ^\n" - " ffff888123839f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n" - " ffff888123839f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n" - "==================================================================\n" - "\n" - "Fixes: 36eca8948323 (\"block, bfq: add Early Queue Merge (EQM)\")\n" - "Signed-off-by: Yu Kuai <yukuai3@huawei.com>\n" - "Link: https://lore.kernel.org/r/20240902130329.3787024-2-yukuai1@huaweicloud.com\n" - "Signed-off-by: Jens Axboe <axboe@kernel.dk>\n" - "Signed-off-by: Sasha Levin <sashal@kernel.org>\n" + "Signed-off-by: Jan Sch\303\244r <jan@jschaer.ch>\n" + "Cc: <stable@vger.kernel.org>\n" + "Link: https://patch.msgid.link/20241029221249.15661-1-jan@jschaer.ch\n" + "Signed-off-by: Takashi Iwai <tiwai@suse.de>\n" + "Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>\n" "---\n" - " block/bfq-iosched.c | 3 ++-\n" - " 1 file changed, 2 insertions(+), 1 deletion(-)\n" - "\n" - "diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c\n" - "index 7415db053217c..1479e8d6fede2 100644\n" - "--- a/block/bfq-iosched.c\n" - "+++ b/block/bfq-iosched.c\n" - "@@ -5218,7 +5218,8 @@ static struct bfq_queue *bfq_init_rq(struct request *rq)\n" - " \t * addition, if the queue has also just been split, we have to\n" - " \t * resume its state.\n" - " \t */\n" - "-\tif (likely(bfqq != &bfqd->oom_bfqq) && bfqq_process_refs(bfqq) == 1) {\n" - "+\tif (likely(bfqq != &bfqd->oom_bfqq) && !bfqq->new_bfqq &&\n" - "+\t bfqq_process_refs(bfqq) == 1) {\n" - " \t\tbfqq->bic = bic;\n" - " \t\tif (split) {\n" - " \t\t\t/*\n" - "-- \n" - 2.43.0 + " sound/usb/mixer_quirks.c | 3 +++\n" + " 1 file changed, 3 insertions(+)\n" + "\n" + "--- a/sound/usb/mixer_quirks.c\n" + "+++ b/sound/usb/mixer_quirks.c\n" + "@@ -3880,6 +3880,9 @@ int snd_usb_mixer_apply_create_quirk(str\n" + " \t\t\tbreak;\n" + " \t\terr = dell_dock_mixer_init(mixer);\n" + " \t\tbreak;\n" + "+\tcase USB_ID(0x0bda, 0x402e): /* Dell WD19 dock */\n" + "+\t\terr = dell_dock_mixer_create(mixer);\n" + "+\t\tbreak;\n" + " \n" + " \tcase USB_ID(0x2a39, 0x3fd2): /* RME ADI-2 Pro */\n" + " \tcase USB_ID(0x2a39, 0x3fd3): /* RME ADI-2 DAC */" -bed9531f7fd90d72124fd879b4e9be3113544c8a518cae1a32c04b2076b1feb5 +ff43817db73134071bd07e096f015257821b82975a948689cf3f1d18534c7819
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox