* [PATCH 5.10 001/300] net/sched: sch_qfq: Fix null-deref in agg_dequeue
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 002/300] x86/bugs: Fix reporting of LFENCE retpoline Greg Kroah-Hartman
` (304 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Mei, Cong Wang, Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Mei <xmei5@asu.edu>
commit dd831ac8221e691e9e918585b1003c7071df0379 upstream.
To prevent a potential crash in agg_dequeue (net/sched/sch_qfq.c)
when cl->qdisc->ops->peek(cl->qdisc) returns NULL, we check the return
value before using it, similar to the existing approach in sch_hfsc.c.
To avoid code duplication, the following changes are made:
1. Changed qdisc_warn_nonwc(include/net/pkt_sched.h) into a static
inline function.
2. Moved qdisc_peek_len from net/sched/sch_hfsc.c to
include/net/pkt_sched.h so that sch_qfq can reuse it.
3. Applied qdisc_peek_len in agg_dequeue to avoid crashing.
Signed-off-by: Xiang Mei <xmei5@asu.edu>
Reviewed-by: Cong Wang <xiyou.wangcong@gmail.com>
Link: https://patch.msgid.link/20250705212143.3982664-1-xmei5@asu.edu
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/pkt_sched.h | 25 ++++++++++++++++++++++++-
net/sched/sch_api.c | 10 ----------
net/sched/sch_hfsc.c | 16 ----------------
net/sched/sch_qfq.c | 2 +-
4 files changed, 25 insertions(+), 28 deletions(-)
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -114,7 +114,6 @@ struct qdisc_rate_table *qdisc_get_rtab(
struct netlink_ext_ack *extack);
void qdisc_put_rtab(struct qdisc_rate_table *tab);
void qdisc_put_stab(struct qdisc_size_table *tab);
-void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc);
bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
struct net_device *dev, struct netdev_queue *txq,
spinlock_t *root_lock, bool validate);
@@ -190,4 +189,28 @@ static inline void skb_txtime_consumed(s
skb->tstamp = ktime_set(0, 0);
}
+static inline void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
+{
+ if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
+ pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
+ txt, qdisc->ops->id, qdisc->handle >> 16);
+ qdisc->flags |= TCQ_F_WARN_NONWC;
+ }
+}
+
+static inline unsigned int qdisc_peek_len(struct Qdisc *sch)
+{
+ struct sk_buff *skb;
+ unsigned int len;
+
+ skb = sch->ops->peek(sch);
+ if (unlikely(skb == NULL)) {
+ qdisc_warn_nonwc("qdisc_peek_len", sch);
+ return 0;
+ }
+ len = qdisc_pkt_len(skb);
+
+ return len;
+}
+
#endif
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -595,16 +595,6 @@ out:
qdisc_skb_cb(skb)->pkt_len = pkt_len;
}
-void qdisc_warn_nonwc(const char *txt, struct Qdisc *qdisc)
-{
- if (!(qdisc->flags & TCQ_F_WARN_NONWC)) {
- pr_warn("%s: %s qdisc %X: is non-work-conserving?\n",
- txt, qdisc->ops->id, qdisc->handle >> 16);
- qdisc->flags |= TCQ_F_WARN_NONWC;
- }
-}
-EXPORT_SYMBOL(qdisc_warn_nonwc);
-
static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
{
struct qdisc_watchdog *wd = container_of(timer, struct qdisc_watchdog,
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -836,22 +836,6 @@ update_vf(struct hfsc_class *cl, unsigne
}
}
-static unsigned int
-qdisc_peek_len(struct Qdisc *sch)
-{
- struct sk_buff *skb;
- unsigned int len;
-
- skb = sch->ops->peek(sch);
- if (unlikely(skb == NULL)) {
- qdisc_warn_nonwc("qdisc_peek_len", sch);
- return 0;
- }
- len = qdisc_pkt_len(skb);
-
- return len;
-}
-
static void
hfsc_adjust_levels(struct hfsc_class *cl)
{
--- a/net/sched/sch_qfq.c
+++ b/net/sched/sch_qfq.c
@@ -1007,7 +1007,7 @@ static struct sk_buff *agg_dequeue(struc
if (cl->qdisc->q.qlen == 0) /* no more packets, remove from list */
list_del_init(&cl->alist);
- else if (cl->deficit < qdisc_pkt_len(cl->qdisc->ops->peek(cl->qdisc))) {
+ else if (cl->deficit < qdisc_peek_len(cl->qdisc)) {
cl->deficit += agg->lmax;
list_move_tail(&cl->alist, &agg->active);
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 002/300] x86/bugs: Fix reporting of LFENCE retpoline
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 001/300] net/sched: sch_qfq: Fix null-deref in agg_dequeue Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 003/300] btrfs: always drop log root tree reference in btrfs_replay_log() Greg Kroah-Hartman
` (303 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Kaplan, Borislav Petkov (AMD),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Kaplan <david.kaplan@amd.com>
[ Upstream commit d1cc1baef67ac6c09b74629ca053bf3fb812f7dc ]
The LFENCE retpoline mitigation is not secure but the kernel prints
inconsistent messages about this fact. The dmesg log says 'Mitigation:
LFENCE', implying the system is mitigated. But sysfs reports 'Vulnerable:
LFENCE' implying the system (correctly) is not mitigated.
Fix this by printing a consistent 'Vulnerable: LFENCE' string everywhere
when this mitigation is selected.
Signed-off-by: David Kaplan <david.kaplan@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Link: https://lore.kernel.org/20250915134706.3201818-1-david.kaplan@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/cpu/bugs.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c
index 8794e3f4974b3..57ba697e29180 100644
--- a/arch/x86/kernel/cpu/bugs.c
+++ b/arch/x86/kernel/cpu/bugs.c
@@ -1508,7 +1508,7 @@ spectre_v2_user_select_mitigation(void)
static const char * const spectre_v2_strings[] = {
[SPECTRE_V2_NONE] = "Vulnerable",
[SPECTRE_V2_RETPOLINE] = "Mitigation: Retpolines",
- [SPECTRE_V2_LFENCE] = "Mitigation: LFENCE",
+ [SPECTRE_V2_LFENCE] = "Vulnerable: LFENCE",
[SPECTRE_V2_EIBRS] = "Mitigation: Enhanced / Automatic IBRS",
[SPECTRE_V2_EIBRS_LFENCE] = "Mitigation: Enhanced / Automatic IBRS + LFENCE",
[SPECTRE_V2_EIBRS_RETPOLINE] = "Mitigation: Enhanced / Automatic IBRS + Retpolines",
@@ -3011,9 +3011,6 @@ static char *pbrsb_eibrs_state(void)
static ssize_t spectre_v2_show_state(char *buf)
{
- if (spectre_v2_enabled == SPECTRE_V2_LFENCE)
- return sysfs_emit(buf, "Vulnerable: LFENCE\n");
-
if (spectre_v2_enabled == SPECTRE_V2_EIBRS && unprivileged_ebpf_enabled())
return sysfs_emit(buf, "Vulnerable: eIBRS with unprivileged eBPF\n");
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 003/300] btrfs: always drop log root tree reference in btrfs_replay_log()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 001/300] net/sched: sch_qfq: Fix null-deref in agg_dequeue Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 002/300] x86/bugs: Fix reporting of LFENCE retpoline Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-04 20:31 ` Ben Hutchings
2025-12-03 15:23 ` [PATCH 5.10 004/300] btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() Greg Kroah-Hartman
` (302 subsequent siblings)
305 siblings, 1 reply; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 ]
Currently we have this odd behaviour:
1) At btrfs_replay_log() we drop the reference of the log root tree if
the call to btrfs_recover_log_trees() failed;
2) But if the call to btrfs_recover_log_trees() did not fail, we don't
drop the reference in btrfs_replay_log() - we expect that
btrfs_recover_log_trees() does it in case it returns success.
Let's simplify this and make btrfs_replay_log() always drop the reference
on the log root tree, not only this simplifies code as it's what makes
sense since it's btrfs_replay_log() who grabbed the reference in the first
place.
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/disk-io.c | 2 +-
fs/btrfs/tree-log.c | 1 -
2 files changed, 1 insertion(+), 2 deletions(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 91475cb7d568b..29f0ba4adfbce 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -2309,10 +2309,10 @@ static int btrfs_replay_log(struct btrfs_fs_info *fs_info,
}
/* returns with log_tree_root freed on success */
ret = btrfs_recover_log_trees(log_tree_root);
+ btrfs_put_root(log_tree_root);
if (ret) {
btrfs_handle_fs_error(fs_info, ret,
"Failed to recover log tree");
- btrfs_put_root(log_tree_root);
return ret;
}
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 6d715bb773643..cdb5a2770faf3 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -6432,7 +6432,6 @@ int btrfs_recover_log_trees(struct btrfs_root *log_root_tree)
log_root_tree->log_root = NULL;
clear_bit(BTRFS_FS_LOG_RECOVERING, &fs_info->flags);
- btrfs_put_root(log_root_tree);
return 0;
error:
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 003/300] btrfs: always drop log root tree reference in btrfs_replay_log()
2025-12-03 15:23 ` [PATCH 5.10 003/300] btrfs: always drop log root tree reference in btrfs_replay_log() Greg Kroah-Hartman
@ 2025-12-04 20:31 ` Ben Hutchings
0 siblings, 0 replies; 312+ messages in thread
From: Ben Hutchings @ 2025-12-04 20:31 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable, Sasha Levin
Cc: patches, Filipe Manana, David Sterba
[-- Attachment #1: Type: text/plain, Size: 1145 bytes --]
On Wed, 2025-12-03 at 16:23 +0100, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Filipe Manana <fdmanana@suse.com>
>
> [ Upstream commit 2f5b8095ea47b142c56c09755a8b1e14145a2d30 ]
>
> Currently we have this odd behaviour:
>
> 1) At btrfs_replay_log() we drop the reference of the log root tree if
> the call to btrfs_recover_log_trees() failed;
>
> 2) But if the call to btrfs_recover_log_trees() did not fail, we don't
> drop the reference in btrfs_replay_log() - we expect that
> btrfs_recover_log_trees() does it in case it returns success.
>
> Let's simplify this and make btrfs_replay_log() always drop the reference
> on the log root tree, not only this simplifies code as it's what makes
> sense since it's btrfs_replay_log() who grabbed the reference in the first
> place.
[...]
This looks like cleanup rather than a bug fix, and I don't see any other
patches in the series that depend on it.
Ben.
--
Ben Hutchings
It is easier to change the specification to fit the program
than vice versa.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 312+ messages in thread
* [PATCH 5.10 004/300] btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 003/300] btrfs: always drop log root tree reference in btrfs_replay_log() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 005/300] NFSD: Fix crash in nfsd4_read_release() Greg Kroah-Hartman
` (301 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Filipe Manana, David Sterba,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 45c222468d33202c07c41c113301a4b9c8451b8f ]
After setting the BTRFS_ROOT_FORCE_COW flag on the root we are doing a
full write barrier, smp_wmb(), but we don't need to, all we need is a
smp_mb__after_atomic(). The use of the smp_wmb() is from the old days
when we didn't use a bit and used instead an int field in the root to
signal if cow is forced. After the int field was changed to a bit in
the root's state (flags field), we forgot to update the memory barrier
in create_pending_snapshot() to smp_mb__after_atomic(), but we did the
change in commit_fs_roots() after clearing BTRFS_ROOT_FORCE_COW. That
happened in commit 27cdeb7096b8 ("Btrfs: use bitfield instead of integer
data type for the some variants in btrfs_root"). On the reader side, in
should_cow_block(), we also use the counterpart smp_mb__before_atomic()
which generates further confusion.
So change the smp_wmb() to smp_mb__after_atomic(). In fact we don't
even need any barrier at all since create_pending_snapshot() is called
in the critical section of a transaction commit and therefore no one
can concurrently join/attach the transaction, or start a new one, until
the transaction is unblocked. By the time someone starts a new transaction
and enters should_cow_block(), a lot of implicit memory barriers already
took place by having acquired several locks such as fs_info->trans_lock
and extent buffer locks on the root node at least. Nevertlheless, for
consistency use smp_mb__after_atomic() after setting the force cow bit
in create_pending_snapshot().
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/transaction.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index f68cfcc1f8300..d558f354b8b82 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -1660,7 +1660,7 @@ static noinline int create_pending_snapshot(struct btrfs_trans_handle *trans,
}
/* see comments in should_cow_block() */
set_bit(BTRFS_ROOT_FORCE_COW, &root->state);
- smp_wmb();
+ smp_mb__after_atomic();
btrfs_set_root_node(new_root_item, tmp);
/* record when the snapshot was created in key.offset */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 005/300] NFSD: Fix crash in nfsd4_read_release()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 004/300] btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 006/300] net: usb: asix_devices: Check return value of usbnet_get_endpoints Greg Kroah-Hartman
` (300 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Chuck Lever
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
commit abb1f08a2121dd270193746e43b2a9373db9ad84 upstream.
When tracing is enabled, the trace_nfsd_read_done trace point
crashes during the pynfs read.testNoFh test.
Fixes: 15a8b55dbb1b ("nfsd: call op_release, even when op_func returns an error")
Cc: stable@vger.kernel.org
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4proc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -945,10 +945,11 @@ nfsd4_read(struct svc_rqst *rqstp, struc
static void
nfsd4_read_release(union nfsd4_op_u *u)
{
- if (u->read.rd_nf)
+ if (u->read.rd_nf) {
+ trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp,
+ u->read.rd_offset, u->read.rd_length);
nfsd_file_put(u->read.rd_nf);
- trace_nfsd_read_done(u->read.rd_rqstp, u->read.rd_fhp,
- u->read.rd_offset, u->read.rd_length);
+ }
}
static __be32
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 006/300] net: usb: asix_devices: Check return value of usbnet_get_endpoints
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 005/300] NFSD: Fix crash in nfsd4_read_release() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 007/300] fbdev: atyfb: Check if pll_ops->init_pll failed Greg Kroah-Hartman
` (299 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit dc89548c6926d68dfdda11bebc1a5258bc41d887 upstream.
The code did not check the return value of usbnet_get_endpoints.
Add checks and return the error if it fails to transfer the error.
Found via static anlaysis and this is similar to
commit 07161b2416f7 ("sr9800: Add check for usbnet_get_endpoints").
Fixes: 933a27d39e0e ("USB: asix - Add AX88178 support and many other changes")
Fixes: 2e55cc7210fe ("[PATCH] USB: usbnet (3/9) module for ASIX Ethernet adapters")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Link: https://patch.msgid.link/20251026164318.57624-1-linmq006@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/asix_devices.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/drivers/net/usb/asix_devices.c
+++ b/drivers/net/usb/asix_devices.c
@@ -230,7 +230,9 @@ static int ax88172_bind(struct usbnet *d
int i;
unsigned long gpio_bits = dev->driver_info->data;
- usbnet_get_endpoints(dev,intf);
+ ret = usbnet_get_endpoints(dev, intf);
+ if (ret)
+ goto out;
/* Toggle the GPIOs in a manufacturer/model specific way */
for (i = 2; i >= 0; i--) {
@@ -681,7 +683,9 @@ static int ax88772_bind(struct usbnet *d
u32 phyid;
struct asix_common_private *priv;
- usbnet_get_endpoints(dev, intf);
+ ret = usbnet_get_endpoints(dev, intf);
+ if (ret)
+ return ret;
/* Maybe the boot loader passed the MAC address via device tree */
if (!eth_platform_get_mac_address(&dev->udev->dev, buf)) {
@@ -1063,7 +1067,9 @@ static int ax88178_bind(struct usbnet *d
int ret;
u8 buf[ETH_ALEN] = {0};
- usbnet_get_endpoints(dev,intf);
+ ret = usbnet_get_endpoints(dev, intf);
+ if (ret)
+ return ret;
/* Get the MAC address */
ret = asix_read_cmd(dev, AX_CMD_READ_NODE_ID, 0, 0, ETH_ALEN, buf, 0);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 007/300] fbdev: atyfb: Check if pll_ops->init_pll failed
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 006/300] net: usb: asix_devices: Check return value of usbnet_get_endpoints Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 008/300] ACPI: video: Fix use-after-free in acpi_video_switch_brightness() Greg Kroah-Hartman
` (298 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Daniel Palmer, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <daniel@0x0f.com>
commit 7073c7fc8d8ba47194e5fc58fcafc0efe7586e9b upstream.
Actually check the return value from pll_ops->init_pll()
as it can return an error.
If the card's BIOS didn't run because it's not the primary VGA card
the fact that the xclk source is unsupported is printed as shown
below but the driver continues on regardless and on my machine causes
a hard lock up.
[ 61.470088] atyfb 0000:03:05.0: enabling device (0080 -> 0083)
[ 61.476191] atyfb: using auxiliary register aperture
[ 61.481239] atyfb: 3D RAGE XL (Mach64 GR, PCI-33) [0x4752 rev 0x27]
[ 61.487569] atyfb: 512K SGRAM (1:1), 14.31818 MHz XTAL, 230 MHz PLL, 83 Mhz MCLK, 63 MHz XCLK
[ 61.496112] atyfb: Unsupported xclk source: 5.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Daniel Palmer <daniel@0x0f.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/aty/atyfb_base.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/video/fbdev/aty/atyfb_base.c
+++ b/drivers/video/fbdev/aty/atyfb_base.c
@@ -2606,8 +2606,12 @@ static int aty_init(struct fb_info *info
pr_cont("\n");
}
#endif
- if (par->pll_ops->init_pll)
- par->pll_ops->init_pll(info, &par->pll);
+ if (par->pll_ops->init_pll) {
+ ret = par->pll_ops->init_pll(info, &par->pll);
+ if (ret)
+ return ret;
+ }
+
if (par->pll_ops->resume_pll)
par->pll_ops->resume_pll(info, &par->pll);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 008/300] ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 007/300] fbdev: atyfb: Check if pll_ops->init_pll failed Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 009/300] fbdev: bitblit: bound-check glyph index in bit_putcs* Greg Kroah-Hartman
` (297 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yuhao Jiang, Hans de Goede,
Rafael J. Wysocki
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuhao Jiang <danisjiang@gmail.com>
commit 8f067aa59430266386b83c18b983ca583faa6a11 upstream.
The switch_brightness_work delayed work accesses device->brightness
and device->backlight, freed by acpi_video_dev_unregister_backlight()
during device removal.
If the work executes after acpi_video_bus_unregister_backlight()
frees these resources, it causes a use-after-free when
acpi_video_switch_brightness() dereferences device->brightness or
device->backlight.
Fix this by calling cancel_delayed_work_sync() for each device's
switch_brightness_work in acpi_video_bus_remove_notify_handler()
after removing the notify handler that queues the work. This ensures
the work completes before the memory is freed.
Fixes: 8ab58e8e7e097 ("ACPI / video: Fix backlight taking 2 steps on a brightness up/down keypress")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Yuhao Jiang <danisjiang@gmail.com>
Reviewed-by: Hans de Goede <hansg@kernel.org>
[ rjw: Changelog edit ]
Link: https://patch.msgid.link/20251022200704.2655507-1-danisjiang@gmail.com
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/acpi_video.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -2028,8 +2028,10 @@ static void acpi_video_bus_remove_notify
struct acpi_video_device *dev;
mutex_lock(&video->device_list_lock);
- list_for_each_entry(dev, &video->video_device_list, entry)
+ list_for_each_entry(dev, &video->video_device_list, entry) {
acpi_video_dev_remove_notify_handler(dev);
+ cancel_delayed_work_sync(&dev->switch_brightness_work);
+ }
mutex_unlock(&video->device_list_lock);
acpi_video_bus_stop_devices(video);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 009/300] fbdev: bitblit: bound-check glyph index in bit_putcs*
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 008/300] ACPI: video: Fix use-after-free in acpi_video_switch_brightness() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 010/300] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Greg Kroah-Hartman
` (296 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+793cf822d213be1a74f2,
Junjie Cao, Thomas Zimmermann, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junjie Cao <junjie.cao@intel.com>
commit 18c4ef4e765a798b47980555ed665d78b71aeadf upstream.
bit_putcs_aligned()/unaligned() derived the glyph pointer from the
character value masked by 0xff/0x1ff, which may exceed the actual font's
glyph count and read past the end of the built-in font array.
Clamp the index to the actual glyph count before computing the address.
This fixes a global out-of-bounds read reported by syzbot.
Reported-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=793cf822d213be1a74f2
Tested-by: syzbot+793cf822d213be1a74f2@syzkaller.appspotmail.com
Signed-off-by: Junjie Cao <junjie.cao@intel.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/bitblit.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -79,12 +79,16 @@ static inline void bit_putcs_aligned(str
struct fb_image *image, u8 *buf, u8 *dst)
{
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+ unsigned int charcnt = vc->vc_font.charcount;
u32 idx = vc->vc_font.width >> 3;
u8 *src;
while (cnt--) {
- src = vc->vc_font.data + (scr_readw(s++)&
- charmask)*cellsize;
+ u16 ch = scr_readw(s++) & charmask;
+
+ if (ch >= charcnt)
+ ch = 0;
+ src = vc->vc_font.data + (unsigned int)ch * cellsize;
if (attr) {
update_attr(buf, src, attr, vc);
@@ -112,14 +116,18 @@ static inline void bit_putcs_unaligned(s
u8 *dst)
{
u16 charmask = vc->vc_hi_font_mask ? 0x1ff : 0xff;
+ unsigned int charcnt = vc->vc_font.charcount;
u32 shift_low = 0, mod = vc->vc_font.width % 8;
u32 shift_high = 8;
u32 idx = vc->vc_font.width >> 3;
u8 *src;
while (cnt--) {
- src = vc->vc_font.data + (scr_readw(s++)&
- charmask)*cellsize;
+ u16 ch = scr_readw(s++) & charmask;
+
+ if (ch >= charcnt)
+ ch = 0;
+ src = vc->vc_font.data + (unsigned int)ch * cellsize;
if (attr) {
update_attr(buf, src, attr, vc);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 010/300] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 009/300] fbdev: bitblit: bound-check glyph index in bit_putcs* Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 011/300] fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS Greg Kroah-Hartman
` (295 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gokul Sivakumar, Arend van Spriel,
Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
commit 3776c685ebe5f43e9060af06872661de55e80b9a upstream.
Currently, whenever there is a need to transmit an Action frame,
the brcmfmac driver always uses the P2P vif to send the "actframe" IOVAR to
firmware. The P2P interfaces were available when wpa_supplicant is managing
the wlan interface.
However, the P2P interfaces are not created/initialized when only hostapd
is managing the wlan interface. And if hostapd receives an ANQP Query REQ
Action frame even from an un-associated STA, the brcmfmac driver tries
to use an uninitialized P2P vif pointer for sending the IOVAR to firmware.
This NULL pointer dereferencing triggers a driver crash.
[ 1417.074538] Unable to handle kernel NULL pointer dereference at virtual
address 0000000000000000
[...]
[ 1417.075188] Hardware name: Raspberry Pi 4 Model B Rev 1.5 (DT)
[...]
[ 1417.075653] Call trace:
[ 1417.075662] brcmf_p2p_send_action_frame+0x23c/0xc58 [brcmfmac]
[ 1417.075738] brcmf_cfg80211_mgmt_tx+0x304/0x5c0 [brcmfmac]
[ 1417.075810] cfg80211_mlme_mgmt_tx+0x1b0/0x428 [cfg80211]
[ 1417.076067] nl80211_tx_mgmt+0x238/0x388 [cfg80211]
[ 1417.076281] genl_family_rcv_msg_doit+0xe0/0x158
[ 1417.076302] genl_rcv_msg+0x220/0x2a0
[ 1417.076317] netlink_rcv_skb+0x68/0x140
[ 1417.076330] genl_rcv+0x40/0x60
[ 1417.076343] netlink_unicast+0x330/0x3b8
[ 1417.076357] netlink_sendmsg+0x19c/0x3f8
[ 1417.076370] __sock_sendmsg+0x64/0xc0
[ 1417.076391] ____sys_sendmsg+0x268/0x2a0
[ 1417.076408] ___sys_sendmsg+0xb8/0x118
[ 1417.076427] __sys_sendmsg+0x90/0xf8
[ 1417.076445] __arm64_sys_sendmsg+0x2c/0x40
[ 1417.076465] invoke_syscall+0x50/0x120
[ 1417.076486] el0_svc_common.constprop.0+0x48/0xf0
[ 1417.076506] do_el0_svc+0x24/0x38
[ 1417.076525] el0_svc+0x30/0x100
[ 1417.076548] el0t_64_sync_handler+0x100/0x130
[ 1417.076569] el0t_64_sync+0x190/0x198
[ 1417.076589] Code: f9401e80 aa1603e2 f9403be1 5280e483 (f9400000)
Fix this, by always using the vif corresponding to the wdev on which the
Action frame Transmission request was initiated by the userspace. This way,
even if P2P vif is not available, the IOVAR is sent to firmware on AP vif
and the ANQP Query RESP Action frame is transmitted without crashing the
driver.
Move init_completion() for "send_af_done" from brcmf_p2p_create_p2pdev()
to brcmf_p2p_attach(). Because the former function would not get executed
when only hostapd is managing wlan interface, and it is not safe to do
reinit_completion() later in brcmf_p2p_tx_action_frame(), without any prior
init_completion().
And in the brcmf_p2p_tx_action_frame() function, the condition check for
P2P Presence response frame is not needed, since the wpa_supplicant is
properly sending the P2P Presense Response frame on the P2P-GO vif instead
of the P2P-Device vif.
Cc: stable@vger.kernel.org
Fixes: 18e2f61db3b7 ("brcmfmac: P2P action frame tx")
Signed-off-by: Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
Link: https://patch.msgid.link/20251013102819.9727-1-gokulkumar.sivakumar@infineon.com
[Cc stable]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 3 -
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++++--------
drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 -
3 files changed, 12 insertions(+), 22 deletions(-)
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -5187,8 +5187,7 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wip
brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, freq=%d\n",
*cookie, le16_to_cpu(action_frame->len), freq);
- ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
- af_params);
+ ack = brcmf_p2p_send_action_frame(vif->ifp, af_params);
cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
GFP_KERNEL);
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c
@@ -1529,6 +1529,7 @@ int brcmf_p2p_notify_action_tx_complete(
/**
* brcmf_p2p_tx_action_frame() - send action frame over fil.
*
+ * @ifp: interface to transmit on.
* @p2p: p2p info struct for vif.
* @af_params: action frame data/info.
*
@@ -1538,12 +1539,11 @@ int brcmf_p2p_notify_action_tx_complete(
* The WLC_E_ACTION_FRAME_COMPLETE event will be received when the action
* frame is transmitted.
*/
-static s32 brcmf_p2p_tx_action_frame(struct brcmf_p2p_info *p2p,
+static s32 brcmf_p2p_tx_action_frame(struct brcmf_if *ifp,
+ struct brcmf_p2p_info *p2p,
struct brcmf_fil_af_params_le *af_params)
{
struct brcmf_pub *drvr = p2p->cfg->pub;
- struct brcmf_cfg80211_vif *vif;
- struct brcmf_p2p_action_frame *p2p_af;
s32 err = 0;
brcmf_dbg(TRACE, "Enter\n");
@@ -1552,14 +1552,7 @@ static s32 brcmf_p2p_tx_action_frame(str
clear_bit(BRCMF_P2P_STATUS_ACTION_TX_COMPLETED, &p2p->status);
clear_bit(BRCMF_P2P_STATUS_ACTION_TX_NOACK, &p2p->status);
- /* check if it is a p2p_presence response */
- p2p_af = (struct brcmf_p2p_action_frame *)af_params->action_frame.data;
- if (p2p_af->subtype == P2P_AF_PRESENCE_RSP)
- vif = p2p->bss_idx[P2PAPI_BSSCFG_CONNECTION].vif;
- else
- vif = p2p->bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
-
- err = brcmf_fil_bsscfg_data_set(vif->ifp, "actframe", af_params,
+ err = brcmf_fil_bsscfg_data_set(ifp, "actframe", af_params,
sizeof(*af_params));
if (err) {
bphy_err(drvr, " sending action frame has failed\n");
@@ -1711,16 +1704,14 @@ static bool brcmf_p2p_check_dwell_overfl
/**
* brcmf_p2p_send_action_frame() - send action frame .
*
- * @cfg: driver private data for cfg80211 interface.
- * @ndev: net device to transmit on.
+ * @ifp: interface to transmit on.
* @af_params: configuration data for action frame.
*/
-bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
- struct net_device *ndev,
+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
struct brcmf_fil_af_params_le *af_params)
{
+ struct brcmf_cfg80211_info *cfg = ifp->drvr->config;
struct brcmf_p2p_info *p2p = &cfg->p2p;
- struct brcmf_if *ifp = netdev_priv(ndev);
struct brcmf_fil_action_frame_le *action_frame;
struct brcmf_config_af_params config_af_params;
struct afx_hdl *afx_hdl = &p2p->afx_hdl;
@@ -1857,7 +1848,7 @@ bool brcmf_p2p_send_action_frame(struct
if (af_params->channel)
msleep(P2P_AF_RETRY_DELAY_TIME);
- ack = !brcmf_p2p_tx_action_frame(p2p, af_params);
+ ack = !brcmf_p2p_tx_action_frame(ifp, p2p, af_params);
tx_retry++;
dwell_overflow = brcmf_p2p_check_dwell_overflow(requested_dwell,
dwell_jiffies);
@@ -2217,7 +2208,6 @@ static struct wireless_dev *brcmf_p2p_cr
WARN_ON(p2p_ifp->bsscfgidx != bsscfgidx);
- init_completion(&p2p->send_af_done);
INIT_WORK(&p2p->afx_hdl.afx_work, brcmf_p2p_afx_handler);
init_completion(&p2p->afx_hdl.act_frm_scan);
init_completion(&p2p->wait_next_af);
@@ -2505,6 +2495,8 @@ s32 brcmf_p2p_attach(struct brcmf_cfg802
pri_ifp = brcmf_get_ifp(cfg->pub, 0);
p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif = pri_ifp->vif;
+ init_completion(&p2p->send_af_done);
+
if (p2pdev_forced) {
err_ptr = brcmf_p2p_create_p2pdev(p2p, NULL, NULL);
if (IS_ERR(err_ptr)) {
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.h
@@ -168,8 +168,7 @@ int brcmf_p2p_notify_action_frame_rx(str
int brcmf_p2p_notify_action_tx_complete(struct brcmf_if *ifp,
const struct brcmf_event_msg *e,
void *data);
-bool brcmf_p2p_send_action_frame(struct brcmf_cfg80211_info *cfg,
- struct net_device *ndev,
+bool brcmf_p2p_send_action_frame(struct brcmf_if *ifp,
struct brcmf_fil_af_params_le *af_params);
bool brcmf_p2p_scan_finding_common_channel(struct brcmf_cfg80211_info *cfg,
struct brcmf_bss_info_le *bi);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 011/300] fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 010/300] wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 012/300] fbdev: valkyriefb: Fix reference count leak in valkyriefb_init Greg Kroah-Hartman
` (294 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Fuchs,
John Paul Adrian Glaubitz, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Fuchs <fuchsfl@gmail.com>
commit 5f566c0ac51cd2474e47da68dbe719d3acf7d999 upstream.
Commit e24cca19babe ("sh: Kill off MAX_DMA_ADDRESS leftovers.") removed
the define ONCHIP_NR_DMA_CHANNELS. So that the leftover reference needs
to be replaced by CONFIG_NR_ONCHIP_DMA_CHANNELS to compile successfully
with CONFIG_PVR2_DMA enabled.
Signed-off-by: Florian Fuchs <fuchsfl@gmail.com>
Reviewed-by: John Paul Adrian Glaubitz <glaubitz@physik.fu-berlin.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/pvr2fb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/video/fbdev/pvr2fb.c
+++ b/drivers/video/fbdev/pvr2fb.c
@@ -191,7 +191,7 @@ static unsigned long pvr2fb_map;
#ifdef CONFIG_PVR2_DMA
static unsigned int shdma = PVR2_CASCADE_CHAN;
-static unsigned int pvr2dma = ONCHIP_NR_DMA_CHANNELS;
+static unsigned int pvr2dma = CONFIG_NR_ONCHIP_DMA_CHANNELS;
#endif
static struct fb_videomode pvr2_modedb[] = {
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 012/300] fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 011/300] fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 013/300] ASoC: qdsp6: q6asm: do not sleep while atomic Greg Kroah-Hartman
` (293 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Helge Deller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit eb53368f8d6e2dfba84c8a94d245719bcf9ae270 upstream.
The of_find_node_by_name() function returns a device tree node with its
reference count incremented. The caller is responsible for calling
of_node_put() to release this reference when done.
Found via static analysis.
Fixes: cc5d0189b9ba ("[PATCH] powerpc: Remove device_node addrs/n_addr")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/valkyriefb.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/video/fbdev/valkyriefb.c
+++ b/drivers/video/fbdev/valkyriefb.c
@@ -336,11 +336,13 @@ int __init valkyriefb_init(void)
if (of_address_to_resource(dp, 0, &r)) {
printk(KERN_ERR "can't find address for valkyrie\n");
+ of_node_put(dp);
return 0;
}
frame_buffer_phys = r.start;
cmap_regs_phys = r.start + 0x304000;
+ of_node_put(dp);
}
#endif /* ppc (!CONFIG_MAC) */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 013/300] ASoC: qdsp6: q6asm: do not sleep while atomic
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 012/300] fbdev: valkyriefb: Fix reference count leak in valkyriefb_init Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-04 21:00 ` Ben Hutchings
2025-12-03 15:23 ` [PATCH 5.10 014/300] wifi: ath10k: Fix memory leak on unsupported WMI command Greg Kroah-Hartman
` (292 subsequent siblings)
305 siblings, 1 reply; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Stable, Srinivas Kandagatla,
Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
For some reason we ended up kfree between spinlock lock and unlock,
which can sleep.
move the kfree out of spinlock section.
Fixes: a2a5d30218fd ("ASoC: qdsp6: q6asm: Add support to memory map and unmap")
Cc: Stable@vger.kernel.org
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
Link: https://patch.msgid.link/20251017085307.4325-2-srinivas.kandagatla@oss.qualcomm.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/qcom/qdsp6/q6asm.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/soc/qcom/qdsp6/q6asm.c
+++ b/sound/soc/qcom/qdsp6/q6asm.c
@@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(
spin_lock_irqsave(&ac->lock, flags);
port->num_periods = 0;
+ spin_unlock_irqrestore(&ac->lock, flags);
kfree(port->buf);
port->buf = NULL;
- spin_unlock_irqrestore(&ac->lock, flags);
}
/**
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 013/300] ASoC: qdsp6: q6asm: do not sleep while atomic
2025-12-03 15:23 ` [PATCH 5.10 013/300] ASoC: qdsp6: q6asm: do not sleep while atomic Greg Kroah-Hartman
@ 2025-12-04 21:00 ` Ben Hutchings
0 siblings, 0 replies; 312+ messages in thread
From: Ben Hutchings @ 2025-12-04 21:00 UTC (permalink / raw)
To: Srinivas Kandagatla; +Cc: patches, Mark Brown, Greg Kroah-Hartman, stable
[-- Attachment #1: Type: text/plain, Size: 1643 bytes --]
On Wed, 2025-12-03 at 16:23 +0100, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
>
> commit fdbb53d318aa94a094434e5f226617f0eb1e8f22 upstream.
>
> For some reason we ended up kfree between spinlock lock and unlock,
> which can sleep.
>
> move the kfree out of spinlock section.
>
> Fixes: a2a5d30218fd ("ASoC: qdsp6: q6asm: Add support to memory map and unmap")
> Cc: Stable@vger.kernel.org
> Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
> Link: https://patch.msgid.link/20251017085307.4325-2-srinivas.kandagatla@oss.qualcomm.com
> Signed-off-by: Mark Brown <broonie@kernel.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> sound/soc/qcom/qdsp6/q6asm.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> --- a/sound/soc/qcom/qdsp6/q6asm.c
> +++ b/sound/soc/qcom/qdsp6/q6asm.c
> @@ -376,9 +376,9 @@ static void q6asm_audio_client_free_buf(
>
> spin_lock_irqsave(&ac->lock, flags);
> port->num_periods = 0;
> + spin_unlock_irqrestore(&ac->lock, flags);
> kfree(port->buf);
> port->buf = NULL;
> - spin_unlock_irqrestore(&ac->lock, flags);
You are right to move the kfree(), but are you sure it's safe to also
move the clearing of port->buf? It seems like this introduces a
potential data race and UAF in q6asm_stream_callback().
Ben.
> }
>
> /**
>
>
--
Ben Hutchings
It is easier to change the specification to fit the program
than vice versa.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 312+ messages in thread
* [PATCH 5.10 014/300] wifi: ath10k: Fix memory leak on unsupported WMI command
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 013/300] ASoC: qdsp6: q6asm: do not sleep while atomic Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 015/300] drm/msm/a6xx: Fix GMU firmware parser Greg Kroah-Hartman
` (291 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeff Johnson, Loic Poulain,
Baochen Qiang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 2e9c1da4ee9d0acfca2e0a3d78f3d8cb5802da1b ]
ath10k_wmi_cmd_send takes ownership of the passed buffer (skb) and has the
responsibility to release it in case of error. This patch fixes missing
free in case of early error due to unhandled WMI command ID.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
Fixes: 553215592f14 ("ath10k: warn if give WMI command is not supported")
Suggested-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Link: https://patch.msgid.link/20250926195656.187970-1-loic.poulain@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/wmi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index c9a74f3e2e601..6293dbc32bde4 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c
@@ -1936,6 +1936,7 @@ int ath10k_wmi_cmd_send(struct ath10k *ar, struct sk_buff *skb, u32 cmd_id)
if (cmd_id == WMI_CMD_UNSUPPORTED) {
ath10k_warn(ar, "wmi command %d is not supported by firmware\n",
cmd_id);
+ dev_kfree_skb_any(skb);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 015/300] drm/msm/a6xx: Fix GMU firmware parser
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 014/300] wifi: ath10k: Fix memory leak on unsupported WMI command Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 016/300] ALSA: usb-audio: fix control pipe direction Greg Kroah-Hartman
` (290 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akhil P Oommen, Konrad Dybcio,
Rob Clark, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Akhil P Oommen <akhilpo@oss.qualcomm.com>
[ Upstream commit b4789aac9d3441d9f830f0a4022d8dc122d6cab3 ]
Current parser logic for GMU firmware assumes a dword aligned payload
size for every block. This is not true for all GMU firmwares. So, fix
this by using correct 'size' value in the calculation for the offset
for the next block's header.
Fixes: c6ed04f856a4 ("drm/msm/a6xx: A640/A650 GMU firmware path")
Signed-off-by: Akhil P Oommen <akhilpo@oss.qualcomm.com>
Acked-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
Patchwork: https://patchwork.freedesktop.org/patch/674040/
Message-ID: <20250911-assorted-sept-1-v2-2-a8bf1ee20792@oss.qualcomm.com>
Signed-off-by: Rob Clark <robin.clark@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
index f11da95566dab..e3b36e2373567 100644
--- a/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
+++ b/drivers/gpu/drm/msm/adreno/a6xx_gmu.c
@@ -666,6 +666,9 @@ static bool fw_block_mem(struct a6xx_gmu_bo *bo, const struct block_header *blk)
return true;
}
+#define NEXT_BLK(blk) \
+ ((const struct block_header *)((const char *)(blk) + sizeof(*(blk)) + (blk)->size))
+
static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
{
struct a6xx_gpu *a6xx_gpu = container_of(gmu, struct a6xx_gpu, gmu);
@@ -696,7 +699,7 @@ static int a6xx_gmu_fw_load(struct a6xx_gmu *gmu)
for (blk = (const struct block_header *) fw_image->data;
(const u8*) blk < fw_image->data + fw_image->size;
- blk = (const struct block_header *) &blk->data[blk->size >> 2]) {
+ blk = NEXT_BLK(blk)) {
if (blk->size == 0)
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 016/300] ALSA: usb-audio: fix control pipe direction
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 015/300] drm/msm/a6xx: Fix GMU firmware parser Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 017/300] bpf: Sync pending IRQ work before freeing ring buffer Greg Kroah-Hartman
` (289 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roy Vegard Ovesen, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
[ Upstream commit 7963891f7c9c6f759cc9ab7da71406b4234f3dd6 ]
Since the requesttype has USB_DIR_OUT the pipe should be
constructed with usb_sndctrlpipe().
Fixes: 8dc5efe3d17c ("ALSA: usb-audio: Add support for Presonus Studio 1810c")
Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
Link: https://patch.msgid.link/aPPL3tBFE_oU-JHv@ark
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_s1810c.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
index c53a9773f310b..457e07f6fc7c8 100644
--- a/sound/usb/mixer_s1810c.c
+++ b/sound/usb/mixer_s1810c.c
@@ -181,7 +181,7 @@ snd_sc1810c_get_status_field(struct usb_device *dev,
pkt_out.fields[SC1810C_STATE_F1_IDX] = SC1810C_SET_STATE_F1;
pkt_out.fields[SC1810C_STATE_F2_IDX] = SC1810C_SET_STATE_F2;
- ret = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
+ ret = snd_usb_ctl_msg(dev, usb_sndctrlpipe(dev, 0),
SC1810C_SET_STATE_REQ,
SC1810C_SET_STATE_REQTYPE,
(*seqnum), 0, &pkt_out, sizeof(pkt_out));
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 017/300] bpf: Sync pending IRQ work before freeing ring buffer
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 016/300] ALSA: usb-audio: fix control pipe direction Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 018/300] usbnet: Prevents free active kevent Greg Kroah-Hartman
` (288 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2617fc732430968b45d2,
Noorain Eqbal, Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Noorain Eqbal <nooraineqbal@gmail.com>
[ Upstream commit 4e9077638301816a7d73fa1e1b4c1db4a7e3b59c ]
Fix a race where irq_work can be queued in bpf_ringbuf_commit()
but the ring buffer is freed before the work executes.
In the syzbot reproducer, a BPF program attached to sched_switch
triggers bpf_ringbuf_commit(), queuing an irq_work. If the ring buffer
is freed before this work executes, the irq_work thread may accesses
freed memory.
Calling `irq_work_sync(&rb->work)` ensures that all pending irq_work
complete before freeing the buffer.
Fixes: 457f44363a88 ("bpf: Implement BPF ring buffer and verifier support for it")
Reported-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2617fc732430968b45d2
Tested-by: syzbot+2617fc732430968b45d2@syzkaller.appspotmail.com
Signed-off-by: Noorain Eqbal <nooraineqbal@gmail.com>
Link: https://lore.kernel.org/r/20251020180301.103366-1-nooraineqbal@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/ringbuf.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/bpf/ringbuf.c
+++ b/kernel/bpf/ringbuf.c
@@ -209,6 +209,8 @@ static void bpf_ringbuf_free(struct bpf_
struct page **pages = rb->pages;
int i, nr_pages = rb->nr_pages;
+ irq_work_sync(&rb->work);
+
vunmap(rb);
for (i = 0; i < nr_pages; i++)
__free_page(pages[i]);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 018/300] usbnet: Prevents free active kevent
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 017/300] bpf: Sync pending IRQ work before freeing ring buffer Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 019/300] drm/etnaviv: fix flush sequence logic Greg Kroah-Hartman
` (287 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sam Sun, Lizhi Xu, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <lizhi.xu@windriver.com>
[ Upstream commit 420c84c330d1688b8c764479e5738bbdbf0a33de ]
The root cause of this issue are:
1. When probing the usbnet device, executing usbnet_link_change(dev, 0, 0);
put the kevent work in global workqueue. However, the kevent has not yet
been scheduled when the usbnet device is unregistered. Therefore, executing
free_netdev() results in the "free active object (kevent)" error reported
here.
2. Another factor is that when calling usbnet_disconnect()->unregister_netdev(),
if the usbnet device is up, ndo_stop() is executed to cancel the kevent.
However, because the device is not up, ndo_stop() is not executed.
The solution to this problem is to cancel the kevent before executing
free_netdev().
Fixes: a69e617e533e ("usbnet: Fix linkwatch use-after-free on disconnect")
Reported-by: Sam Sun <samsun1006219@gmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=8bfd7bcc98f7300afb84
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Link: https://patch.msgid.link/20251022024007.1831898-1-lizhi.xu@windriver.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/usbnet.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index ac439f9ccfd46..9ac9fbdad5c08 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -1597,6 +1597,8 @@ void usbnet_disconnect (struct usb_interface *intf)
net = dev->net;
unregister_netdev (net);
+ cancel_work_sync(&dev->kevent);
+
while ((urb = usb_get_from_anchor(&dev->deferred))) {
dev_kfree_skb(urb->context);
kfree(urb->sg);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 019/300] drm/etnaviv: fix flush sequence logic
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 018/300] usbnet: Prevents free active kevent Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 020/300] drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() Greg Kroah-Hartman
` (286 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomeu Vizoso, Lucas Stach,
Christian Gmeiner, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <tomeu@tomeuvizoso.net>
[ Upstream commit a042beac6e6f8ac1e923784cfff98b47cbabb185 ]
The current logic uses the flush sequence from the current address
space. This is harmless when deducing the flush requirements for the
current submit, as either the incoming address space is the same one
as the currently active one or we switch context, in which case the
flush is unconditional.
However, this sequence is also stored as the current flush sequence
of the GPU. If we switch context the stored flush sequence will no
longer belong to the currently active address space. This incoherency
can then cause missed flushes, resulting in translation errors.
Fixes: 27b67278e007 ("drm/etnaviv: rework MMU handling")
Signed-off-by: Tomeu Vizoso <tomeu@tomeuvizoso.net>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
Link: https://lore.kernel.org/r/20251021093723.3887980-1-l.stach@pengutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
index 982174af74b1e..7d897aafb2a6a 100644
--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@@ -346,7 +346,7 @@ void etnaviv_buffer_queue(struct etnaviv_gpu *gpu, u32 exec_state,
u32 link_target, link_dwords;
bool switch_context = gpu->exec_state != exec_state;
bool switch_mmu_context = gpu->mmu_context != mmu_context;
- unsigned int new_flush_seq = READ_ONCE(gpu->mmu_context->flush_seq);
+ unsigned int new_flush_seq = READ_ONCE(mmu_context->flush_seq);
bool need_flush = switch_mmu_context || gpu->flush_seq != new_flush_seq;
bool has_blt = !!(gpu->identity.minor_features5 &
chipMinorFeatures5_BLT_ENGINE);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 020/300] drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 019/300] drm/etnaviv: fix flush sequence logic Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 021/300] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji Greg Kroah-Hartman
` (285 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Wang, Hawking Zhang,
Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Wang <kevinyang.wang@amd.com>
[ Upstream commit 238d468d3ed18a324bb9d8c99f18c665dbac0511 ]
'table_index' is a variable defined by the smu driver (kmd)
'table_id' is a variable defined by the hw smu (pmfw)
This code should use table_index as a bounds check.
Fixes: caad2613dc4bd ("drm/amd/powerplay: move table setting common code to smu_cmn.c")
Signed-off-by: Yang Wang <kevinyang.wang@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit fca0c66b22303de0d1d6313059baf4dc960a4753)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
index 92b2ea4c197b8..5219eb685c88e 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c
@@ -587,7 +587,7 @@ int smu_cmn_update_table(struct smu_context *smu,
table_index);
uint32_t table_size;
int ret = 0;
- if (!table_data || table_id >= SMU_TABLE_COUNT || table_id < 0)
+ if (!table_data || table_index >= SMU_TABLE_COUNT || table_id < 0)
return -EINVAL;
table_size = smu_table->tables[table_index].size;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 021/300] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 020/300] drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 022/300] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland Greg Kroah-Hartman
` (284 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Smith, Alex Deucher,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <itistotalbotnet@gmail.com>
[ Upstream commit 07a13f913c291d6ec72ee4fc848d13ecfdc0e705 ]
Previously this was initialized with zero which represented PCIe Gen
1.0 instead of using the
maximum value from the speed table which is the behaviour of all other
smumgr implementations.
Fixes: 18edef19ea44 ("drm/amd/powerplay: implement fw image related smu interface for Fiji.")
Signed-off-by: John Smith <itistotalbotnet@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit c52238c9fb414555c68340cd80e487d982c1921c)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c
index ecb9ee46d6b35..6049edcaf6ce9 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c
@@ -2026,7 +2026,7 @@ static int fiji_init_smc_table(struct pp_hwmgr *hwmgr)
table->VoltageResponseTime = 0;
table->PhaseResponseTime = 0;
table->MemoryThermThrottleEnable = 1;
- table->PCIeBootLinkLevel = 0; /* 0:Gen1 1:Gen2 2:Gen3*/
+ table->PCIeBootLinkLevel = (uint8_t) (data->dpm_table.pcie_speed_table.count);
table->PCIeGenInterval = 1;
table->VRConfig = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 022/300] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 021/300] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 023/300] block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL Greg Kroah-Hartman
` (283 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, John Smith, Alex Deucher,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Smith <itistotalbotnet@gmail.com>
[ Upstream commit 501672e3c1576aa9a8364144213c77b98a31a42c ]
Previously this was initialized with zero which represented PCIe Gen
1.0 instead of using the
maximum value from the speed table which is the behaviour of all other
smumgr implementations.
Fixes: 18aafc59b106 ("drm/amd/powerplay: implement fw related smu interface for iceland.")
Signed-off-by: John Smith <itistotalbotnet@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 92b0a6ae6672857ddeabf892223943d2f0e06c97)
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c b/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c
index 431ad2fd38df1..06d89fafae55b 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/smumgr/iceland_smumgr.c
@@ -2028,7 +2028,7 @@ static int iceland_init_smc_table(struct pp_hwmgr *hwmgr)
table->VoltageResponseTime = 0;
table->PhaseResponseTime = 0;
table->MemoryThermThrottleEnable = 1;
- table->PCIeBootLinkLevel = 0;
+ table->PCIeBootLinkLevel = (uint8_t) (data->dpm_table.pcie_speed_table.count);
table->PCIeGenInterval = 1;
result = iceland_populate_smc_svi2_config(hwmgr, table);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 023/300] block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 022/300] drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 024/300] regmap: slimbus: fix bus_context pointer in regmap init calls Greg Kroah-Hartman
` (282 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Chaitanya Kulkarni,
Christoph Hellwig, Johannes Thumshirn, Jens Axboe
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 12a1c9353c47c0fb3464eba2d78cdf649dee1cf7 upstream.
REQ_OP_ZONE_RESET_ALL is a zone management request. Fix
op_is_zone_mgmt() to return true for that operation, like it already
does for REQ_OP_ZONE_RESET.
While no problems were reported without this fix, this change allows
strengthening checks in various block device drivers (scsi sd,
virtioblk, DM) where op_is_zone_mgmt() is used to verify that a zone
management command is not being issued to a regular block device.
Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/blk_types.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -496,6 +496,7 @@ static inline bool op_is_zone_mgmt(enum
{
switch (op & REQ_OP_MASK) {
case REQ_OP_ZONE_RESET:
+ case REQ_OP_ZONE_RESET_ALL:
case REQ_OP_ZONE_OPEN:
case REQ_OP_ZONE_CLOSE:
case REQ_OP_ZONE_FINISH:
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 024/300] regmap: slimbus: fix bus_context pointer in regmap init calls
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 023/300] block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 025/300] net: phy: dp83867: Disable EEE support as not implemented Greg Kroah-Hartman
` (281 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Ma Ke,
Steev Klimaszewski, Srinivas Kandagatla, Abel Vesa, Alexey Klimov,
Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Klimov <alexey.klimov@linaro.org>
commit 434f7349a1f00618a620b316f091bd13a12bc8d2 upstream.
Commit 4e65bda8273c ("ASoC: wcd934x: fix error handling in
wcd934x_codec_parse_data()") revealed the problem in the slimbus regmap.
That commit breaks audio playback, for instance, on sdm845 Thundercomm
Dragonboard 845c board:
Unable to handle kernel paging request at virtual address ffff8000847cbad4
...
CPU: 5 UID: 0 PID: 776 Comm: aplay Not tainted 6.18.0-rc1-00028-g7ea30958b305 #11 PREEMPT
Hardware name: Thundercomm Dragonboard 845c (DT)
...
Call trace:
slim_xfer_msg+0x24/0x1ac [slimbus] (P)
slim_read+0x48/0x74 [slimbus]
regmap_slimbus_read+0x18/0x24 [regmap_slimbus]
_regmap_raw_read+0xe8/0x174
_regmap_bus_read+0x44/0x80
_regmap_read+0x60/0xd8
_regmap_update_bits+0xf4/0x140
_regmap_select_page+0xa8/0x124
_regmap_raw_write_impl+0x3b8/0x65c
_regmap_bus_raw_write+0x60/0x80
_regmap_write+0x58/0xc0
regmap_write+0x4c/0x80
wcd934x_hw_params+0x494/0x8b8 [snd_soc_wcd934x]
snd_soc_dai_hw_params+0x3c/0x7c [snd_soc_core]
__soc_pcm_hw_params+0x22c/0x634 [snd_soc_core]
dpcm_be_dai_hw_params+0x1d4/0x38c [snd_soc_core]
dpcm_fe_dai_hw_params+0x9c/0x17c [snd_soc_core]
snd_pcm_hw_params+0x124/0x464 [snd_pcm]
snd_pcm_common_ioctl+0x110c/0x1820 [snd_pcm]
snd_pcm_ioctl+0x34/0x4c [snd_pcm]
__arm64_sys_ioctl+0xac/0x104
invoke_syscall+0x48/0x104
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xec
el0t_64_sync_handler+0xa0/0xf0
el0t_64_sync+0x198/0x19c
The __devm_regmap_init_slimbus() started to be used instead of
__regmap_init_slimbus() after the commit mentioned above and turns out
the incorrect bus_context pointer (3rd argument) was used in
__devm_regmap_init_slimbus(). It should be just "slimbus" (which is equal
to &slimbus->dev). Correct it. The wcd934x codec seems to be the only or
the first user of devm_regmap_init_slimbus() but we should fix it till
the point where __devm_regmap_init_slimbus() was introduced therefore
two "Fixes" tags.
While at this, also correct the same argument in __regmap_init_slimbus().
Fixes: 4e65bda8273c ("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
Fixes: 7d6f7fb053ad ("regmap: add SLIMbus support")
Cc: stable@vger.kernel.org
Cc: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Cc: Ma Ke <make24@iscas.ac.cn>
Cc: Steev Klimaszewski <steev@kali.org>
Cc: Srinivas Kandagatla <srini@kernel.org>
Reviewed-by: Abel Vesa <abel.vesa@linaro.org>
Signed-off-by: Alexey Klimov <alexey.klimov@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20251022201013.1740211-1-alexey.klimov@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap-slimbus.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/base/regmap/regmap-slimbus.c
+++ b/drivers/base/regmap/regmap-slimbus.c
@@ -48,8 +48,7 @@ struct regmap *__regmap_init_slimbus(str
if (IS_ERR(bus))
return ERR_CAST(bus);
- return __regmap_init(&slimbus->dev, bus, &slimbus->dev, config,
- lock_key, lock_name);
+ return __regmap_init(&slimbus->dev, bus, slimbus, config, lock_key, lock_name);
}
EXPORT_SYMBOL_GPL(__regmap_init_slimbus);
@@ -63,8 +62,7 @@ struct regmap *__devm_regmap_init_slimbu
if (IS_ERR(bus))
return ERR_CAST(bus);
- return __devm_regmap_init(&slimbus->dev, bus, &slimbus, config,
- lock_key, lock_name);
+ return __devm_regmap_init(&slimbus->dev, bus, slimbus, config, lock_key, lock_name);
}
EXPORT_SYMBOL_GPL(__devm_regmap_init_slimbus);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 025/300] net: phy: dp83867: Disable EEE support as not implemented
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 024/300] regmap: slimbus: fix bus_context pointer in regmap init calls Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 026/300] net: ravb: Enforce descriptor type ordering Greg Kroah-Hartman
` (280 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Emanuele Ghidoli, Andrew Lunn,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
[ Upstream commit 84a905290cb4c3d9a71a9e3b2f2e02e031e7512f ]
While the DP83867 PHYs report EEE capability through their feature
registers, the actual hardware does not support EEE (see Links).
When the connected MAC enables EEE, it causes link instability and
communication failures.
The issue is reproducible with a iMX8MP and relevant stmmac ethernet port.
Since the introduction of phylink-managed EEE support in the stmmac driver,
EEE is now enabled by default, leading to issues on systems using the
DP83867 PHY.
Call phy_disable_eee during phy initialization to prevent EEE from being
enabled on DP83867 PHYs.
Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/1445244/dp83867ir-dp83867-disable-eee-lpi
Link: https://e2e.ti.com/support/interface-group/interface/f/interface-forum/658638/dp83867ir-eee-energy-efficient-ethernet
Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy")
Cc: stable@vger.kernel.org
Signed-off-by: Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20251023144857.529566-1-ghidoliemanuele@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ replaced phy_disable_eee() call with direct eee_broken_modes assignment ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/dp83867.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/phy/dp83867.c
+++ b/drivers/net/phy/dp83867.c
@@ -664,6 +664,12 @@ static int dp83867_config_init(struct ph
return ret;
}
+ /* Although the DP83867 reports EEE capability through the
+ * MDIO_PCS_EEE_ABLE and MDIO_AN_EEE_ADV registers, the feature
+ * is not actually implemented in hardware.
+ */
+ phydev->eee_broken_modes = MDIO_EEE_100TX | MDIO_EEE_1000T;
+
if (phy_interface_is_rgmii(phydev) ||
phydev->interface == PHY_INTERFACE_MODE_SGMII) {
val = phy_read(phydev, MII_DP83867_PHYCTRL);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 026/300] net: ravb: Enforce descriptor type ordering
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 025/300] net: phy: dp83867: Disable EEE support as not implemented Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 027/300] xfs: always warn about deprecated mount options Greg Kroah-Hartman
` (279 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabrizio Castro, Lad Prabhakar,
Niklas Söderlund, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
[ Upstream commit 5370c31e84b0e0999c7b5ff949f4e104def35584 ]
Ensure the TX descriptor type fields are published in a safe order so the
DMA engine never begins processing a descriptor chain before all descriptor
fields are fully initialised.
For multi-descriptor transmits the driver writes DT_FEND into the last
descriptor and DT_FSTART into the first. The DMA engine begins processing
when it observes DT_FSTART. Move the dma_wmb() barrier so it executes
immediately after DT_FEND and immediately before writing DT_FSTART
(and before DT_FSINGLE in the single-descriptor case). This guarantees
that all prior CPU writes to the descriptor memory are visible to the
device before DT_FSTART is seen.
This avoids a situation where compiler/CPU reordering could publish
DT_FSTART ahead of DT_FEND or other descriptor fields, allowing the DMA to
start on a partially initialised chain and causing corrupted transmissions
or TX timeouts. Such a failure was observed on RZ/G2L with an RT kernel as
transmit queue timeouts and device resets.
Fixes: 2f45d1902acf ("ravb: minimize TX data copying")
Cc: stable@vger.kernel.org
Co-developed-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
Signed-off-by: Fabrizio Castro <fabrizio.castro.jz@renesas.com>
Signed-off-by: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Link: https://patch.msgid.link/20251017151830.171062-4-prabhakar.mahadev-lad.rj@bp.renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ kept unconditional skb_tx_timestamp() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1596,13 +1596,25 @@ static netdev_tx_t ravb_start_xmit(struc
}
skb_tx_timestamp(skb);
- /* Descriptor type must be set after all the above writes */
- dma_wmb();
+
if (num_tx_desc > 1) {
desc->die_dt = DT_FEND;
desc--;
+ /* When using multi-descriptors, DT_FEND needs to get written
+ * before DT_FSTART, but the compiler may reorder the memory
+ * writes in an attempt to optimize the code.
+ * Use a dma_wmb() barrier to make sure DT_FEND and DT_FSTART
+ * are written exactly in the order shown in the code.
+ * This is particularly important for cases where the DMA engine
+ * is already running when we are running this code. If the DMA
+ * sees DT_FSTART without the corresponding DT_FEND it will enter
+ * an error condition.
+ */
+ dma_wmb();
desc->die_dt = DT_FSTART;
} else {
+ /* Descriptor type must be set after all the above writes */
+ dma_wmb();
desc->die_dt = DT_FSINGLE;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 027/300] xfs: always warn about deprecated mount options
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 026/300] net: ravb: Enforce descriptor type ordering Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 028/300] devcoredump: Fix circular locking dependency with devcd->mutex Greg Kroah-Hartman
` (278 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Christoph Hellwig,
Carlos Maiolino, Carlos Maiolino, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Darrick J. Wong" <djwong@kernel.org>
[ Upstream commit 630785bfbe12c3ee3ebccd8b530a98d632b7e39d ]
The deprecation of the 'attr2' mount option in 6.18 wasn't entirely
successful because nobody noticed that the kernel never printed a
warning about attr2 being set in fstab if the only xfs filesystem is the
root fs; the initramfs mounts the root fs with no mount options; and the
init scripts only conveyed the fstab options by remounting the root fs.
Fix this by making it complain all the time.
Cc: stable@vger.kernel.org # v5.13
Fixes: 92cf7d36384b99 ("xfs: Skip repetitive warnings about mount options")
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Carlos Maiolino <cmaiolino@redhat.com>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
[ adapted m_features field reference to m_flags ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_super.c | 33 +++++++++++++++++++++------------
1 file changed, 21 insertions(+), 12 deletions(-)
--- a/fs/xfs/xfs_super.c
+++ b/fs/xfs/xfs_super.c
@@ -1162,16 +1162,25 @@ suffix_kstrtoint(
static inline void
xfs_fs_warn_deprecated(
struct fs_context *fc,
- struct fs_parameter *param,
- uint64_t flag,
- bool value)
+ struct fs_parameter *param)
{
- /* Don't print the warning if reconfiguring and current mount point
- * already had the flag set
+ /*
+ * Always warn about someone passing in a deprecated mount option.
+ * Previously we wouldn't print the warning if we were reconfiguring
+ * and current mount point already had the flag set, but that was not
+ * the right thing to do.
+ *
+ * Many distributions mount the root filesystem with no options in the
+ * initramfs and rely on mount -a to remount the root fs with the
+ * options in fstab. However, the old behavior meant that there would
+ * never be a warning about deprecated mount options for the root fs in
+ * /etc/fstab. On a single-fs system, that means no warning at all.
+ *
+ * Compounding this problem are distribution scripts that copy
+ * /proc/mounts to fstab, which means that we can't remove mount
+ * options unless we're 100% sure they have only ever been advertised
+ * in /proc/mounts in response to explicitly provided mount options.
*/
- if ((fc->purpose & FS_CONTEXT_FOR_RECONFIGURE) &&
- !!(XFS_M(fc->root->d_sb)->m_flags & flag) == value)
- return;
xfs_warn(fc->s_fs_info, "%s mount option is deprecated.", param->key);
}
@@ -1314,19 +1323,19 @@ xfs_fc_parse_param(
#endif
/* Following mount options will be removed in September 2025 */
case Opt_ikeep:
- xfs_fs_warn_deprecated(fc, param, XFS_MOUNT_IKEEP, true);
+ xfs_fs_warn_deprecated(fc, param);
parsing_mp->m_flags |= XFS_MOUNT_IKEEP;
return 0;
case Opt_noikeep:
- xfs_fs_warn_deprecated(fc, param, XFS_MOUNT_IKEEP, false);
+ xfs_fs_warn_deprecated(fc, param);
parsing_mp->m_flags &= ~XFS_MOUNT_IKEEP;
return 0;
case Opt_attr2:
- xfs_fs_warn_deprecated(fc, param, XFS_MOUNT_ATTR2, true);
+ xfs_fs_warn_deprecated(fc, param);
parsing_mp->m_flags |= XFS_MOUNT_ATTR2;
return 0;
case Opt_noattr2:
- xfs_fs_warn_deprecated(fc, param, XFS_MOUNT_NOATTR2, true);
+ xfs_fs_warn_deprecated(fc, param);
parsing_mp->m_flags &= ~XFS_MOUNT_ATTR2;
parsing_mp->m_flags |= XFS_MOUNT_NOATTR2;
return 0;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 028/300] devcoredump: Fix circular locking dependency with devcd->mutex.
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 027/300] xfs: always warn about deprecated mount options Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 029/300] can: gs_usb: increase max interface to U8_MAX Greg Kroah-Hartman
` (277 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mukesh Ojha, Johannes Berg,
Rafael J. Wysocki, Danilo Krummrich, linux-kernel,
Maarten Lankhorst, Matthew Brost, Mukesh Ojha, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maarten Lankhorst <dev@lankhorst.se>
[ Upstream commit a91c8096590bd7801a26454789f2992094fe36da ]
The original code causes a circular locking dependency found by lockdep.
======================================================
WARNING: possible circular locking dependency detected
6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 Tainted: G S U
------------------------------------------------------
xe_fault_inject/5091 is trying to acquire lock:
ffff888156815688 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}, at: __flush_work+0x25d/0x660
but task is already holding lock:
ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&devcd->mutex){+.+.}-{3:3}:
mutex_lock_nested+0x4e/0xc0
devcd_data_write+0x27/0x90
sysfs_kf_bin_write+0x80/0xf0
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
-> #1 (kn->active#236){++++}-{0:0}:
kernfs_drain+0x1e2/0x200
__kernfs_remove+0xae/0x400
kernfs_remove_by_name_ns+0x5d/0xc0
remove_files+0x54/0x70
sysfs_remove_group+0x3d/0xa0
sysfs_remove_groups+0x2e/0x60
device_remove_attrs+0xc7/0x100
device_del+0x15d/0x3b0
devcd_del+0x19/0x30
process_one_work+0x22b/0x6f0
worker_thread+0x1e8/0x3d0
kthread+0x11c/0x250
ret_from_fork+0x26c/0x2e0
ret_from_fork_asm+0x1a/0x30
-> #0 ((work_completion)(&(&devcd->del_wk)->work)){+.+.}-{0:0}:
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
__flush_work+0x27a/0x660
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
entry_SYSCALL_64_after_hwframe+0x76/0x7e
other info that might help us debug this:
Chain exists of: (work_completion)(&(&devcd->del_wk)->work) --> kn->active#236 --> &devcd->mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&devcd->mutex);
lock(kn->active#236);
lock(&devcd->mutex);
lock((work_completion)(&(&devcd->del_wk)->work));
*** DEADLOCK ***
5 locks held by xe_fault_inject/5091:
#0: ffff8881129f9488 (sb_writers#5){.+.+}-{0:0}, at: ksys_write+0x72/0xf0
#1: ffff88810c755078 (&of->mutex#2){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x123/0x220
#2: ffff8881054811a0 (&dev->mutex){....}-{3:3}, at: device_release_driver_internal+0x55/0x280
#3: ffff888156815620 (&devcd->mutex){+.+.}-{3:3}, at: dev_coredump_put+0x3f/0xa0
#4: ffffffff8359e020 (rcu_read_lock){....}-{1:2}, at: __flush_work+0x72/0x660
stack backtrace:
CPU: 14 UID: 0 PID: 5091 Comm: xe_fault_inject Tainted: G S U 6.16.0-rc6-lgci-xe-xe-pw-151626v3+ #1 PREEMPT_{RT,(lazy)}
Tainted: [S]=CPU_OUT_OF_SPEC, [U]=USER
Hardware name: Micro-Star International Co., Ltd. MS-7D25/PRO Z690-A DDR4(MS-7D25), BIOS 1.10 12/13/2021
Call Trace:
<TASK>
dump_stack_lvl+0x91/0xf0
dump_stack+0x10/0x20
print_circular_bug+0x285/0x360
check_noncircular+0x135/0x150
? register_lock_class+0x48/0x4a0
__lock_acquire+0x1661/0x2860
lock_acquire+0xc4/0x2f0
? __flush_work+0x25d/0x660
? mark_held_locks+0x46/0x90
? __flush_work+0x25d/0x660
__flush_work+0x27a/0x660
? __flush_work+0x25d/0x660
? trace_hardirqs_on+0x1e/0xd0
? __pfx_wq_barrier_func+0x10/0x10
flush_delayed_work+0x5d/0xa0
dev_coredump_put+0x63/0xa0
xe_driver_devcoredump_fini+0x12/0x20 [xe]
devm_action_release+0x12/0x30
release_nodes+0x3a/0x120
devres_release_all+0x8a/0xd0
device_unbind_cleanup+0x12/0x80
device_release_driver_internal+0x23a/0x280
? bus_find_device+0xa8/0xe0
device_driver_detach+0x14/0x20
unbind_store+0xaf/0xc0
drv_attr_store+0x21/0x50
sysfs_kf_write+0x4a/0x80
kernfs_fop_write_iter+0x169/0x220
vfs_write+0x293/0x560
ksys_write+0x72/0xf0
__x64_sys_write+0x19/0x30
x64_sys_call+0x2bf/0x2660
do_syscall_64+0x93/0xb60
? __f_unlock_pos+0x15/0x20
? __x64_sys_getdents64+0x9b/0x130
? __pfx_filldir64+0x10/0x10
? do_syscall_64+0x1a2/0xb60
? clear_bhb_loop+0x30/0x80
? clear_bhb_loop+0x30/0x80
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x76e292edd574
Code: c7 00 16 00 00 00 b8 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 80 3d d5 ea 0e 00 00 74 13 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 54 c3 0f 1f 00 55 48 89 e5 48 83 ec 20 48 89
RSP: 002b:00007fffe247a828 EFLAGS: 00000202 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000076e292edd574
RDX: 000000000000000c RSI: 00006267f6306063 RDI: 000000000000000b
RBP: 000000000000000c R08: 000076e292fc4b20 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 00006267f6306063
R13: 000000000000000b R14: 00006267e6859c00 R15: 000076e29322a000
</TASK>
xe 0000:03:00.0: [drm] Xe device coredump has been deleted.
Fixes: 01daccf74832 ("devcoredump : Serialize devcd_del work")
Cc: Mukesh Ojha <quic_mojha@quicinc.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: Rafael J. Wysocki <rafael@kernel.org>
Cc: Danilo Krummrich <dakr@kernel.org>
Cc: linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org # v6.1+
Signed-off-by: Maarten Lankhorst <dev@lankhorst.se>
Cc: Matthew Brost <matthew.brost@intel.com>
Acked-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250723142416.1020423-1-dev@lankhorst.se
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ replaced disable_delayed_work_sync() with cancel_delayed_work_sync() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/devcoredump.c | 138 +++++++++++++++++++++++++++------------------
1 file changed, 84 insertions(+), 54 deletions(-)
--- a/drivers/base/devcoredump.c
+++ b/drivers/base/devcoredump.c
@@ -30,50 +30,46 @@ struct devcd_entry {
void *data;
size_t datalen;
/*
- * Here, mutex is required to serialize the calls to del_wk work between
- * user/kernel space which happens when devcd is added with device_add()
- * and that sends uevent to user space. User space reads the uevents,
- * and calls to devcd_data_write() which try to modify the work which is
- * not even initialized/queued from devcoredump.
+ * There are 2 races for which mutex is required.
*
+ * The first race is between device creation and userspace writing to
+ * schedule immediately destruction.
*
+ * This race is handled by arming the timer before device creation, but
+ * when device creation fails the timer still exists.
*
- * cpu0(X) cpu1(Y)
+ * To solve this, hold the mutex during device_add(), and set
+ * init_completed on success before releasing the mutex.
*
- * dev_coredump() uevent sent to user space
- * device_add() ======================> user space process Y reads the
- * uevents writes to devcd fd
- * which results into writes to
+ * That way the timer will never fire until device_add() is called,
+ * it will do nothing if init_completed is not set. The timer is also
+ * cancelled in that case.
*
- * devcd_data_write()
- * mod_delayed_work()
- * try_to_grab_pending()
- * del_timer()
- * debug_assert_init()
- * INIT_DELAYED_WORK()
- * schedule_delayed_work()
- *
- *
- * Also, mutex alone would not be enough to avoid scheduling of
- * del_wk work after it get flush from a call to devcd_free()
- * mentioned as below.
- *
- * disabled_store()
- * devcd_free()
- * mutex_lock() devcd_data_write()
- * flush_delayed_work()
- * mutex_unlock()
- * mutex_lock()
- * mod_delayed_work()
- * mutex_unlock()
- * So, delete_work flag is required.
+ * The second race involves multiple parallel invocations of devcd_free(),
+ * add a deleted flag so only 1 can call the destructor.
*/
struct mutex mutex;
- bool delete_work;
+ bool init_completed, deleted;
struct module *owner;
ssize_t (*read)(char *buffer, loff_t offset, size_t count,
void *data, size_t datalen);
void (*free)(void *data);
+ /*
+ * If nothing interferes and device_add() was returns success,
+ * del_wk will destroy the device after the timer fires.
+ *
+ * Multiple userspace processes can interfere in the working of the timer:
+ * - Writing to the coredump will reschedule the timer to run immediately,
+ * if still armed.
+ *
+ * This is handled by using "if (cancel_delayed_work()) {
+ * schedule_delayed_work() }", to prevent re-arming after having
+ * been previously fired.
+ * - Writing to /sys/class/devcoredump/disabled will destroy the
+ * coredump synchronously.
+ * This is handled by using disable_delayed_work_sync(), and then
+ * checking if deleted flag is set with &devcd->mutex held.
+ */
struct delayed_work del_wk;
struct device *failing_dev;
};
@@ -102,14 +98,27 @@ static void devcd_dev_release(struct dev
kfree(devcd);
}
+static void __devcd_del(struct devcd_entry *devcd)
+{
+ devcd->deleted = true;
+ device_del(&devcd->devcd_dev);
+ put_device(&devcd->devcd_dev);
+}
+
static void devcd_del(struct work_struct *wk)
{
struct devcd_entry *devcd;
+ bool init_completed;
devcd = container_of(wk, struct devcd_entry, del_wk.work);
- device_del(&devcd->devcd_dev);
- put_device(&devcd->devcd_dev);
+ /* devcd->mutex serializes against dev_coredumpm_timeout */
+ mutex_lock(&devcd->mutex);
+ init_completed = devcd->init_completed;
+ mutex_unlock(&devcd->mutex);
+
+ if (init_completed)
+ __devcd_del(devcd);
}
static ssize_t devcd_data_read(struct file *filp, struct kobject *kobj,
@@ -129,12 +138,12 @@ static ssize_t devcd_data_write(struct f
struct device *dev = kobj_to_dev(kobj);
struct devcd_entry *devcd = dev_to_devcd(dev);
- mutex_lock(&devcd->mutex);
- if (!devcd->delete_work) {
- devcd->delete_work = true;
- mod_delayed_work(system_wq, &devcd->del_wk, 0);
- }
- mutex_unlock(&devcd->mutex);
+ /*
+ * Although it's tempting to use mod_delayed work here,
+ * that will cause a reschedule if the timer already fired.
+ */
+ if (cancel_delayed_work(&devcd->del_wk))
+ schedule_delayed_work(&devcd->del_wk, 0);
return count;
}
@@ -162,11 +171,21 @@ static int devcd_free(struct device *dev
{
struct devcd_entry *devcd = dev_to_devcd(dev);
+ /*
+ * To prevent a race with devcd_data_write(), cancel work and
+ * complete manually instead.
+ *
+ * We cannot rely on the return value of
+ * cancel_delayed_work_sync() here, because it might be in the
+ * middle of a cancel_delayed_work + schedule_delayed_work pair.
+ *
+ * devcd->mutex here guards against multiple parallel invocations
+ * of devcd_free().
+ */
+ cancel_delayed_work_sync(&devcd->del_wk);
mutex_lock(&devcd->mutex);
- if (!devcd->delete_work)
- devcd->delete_work = true;
-
- flush_delayed_work(&devcd->del_wk);
+ if (!devcd->deleted)
+ __devcd_del(devcd);
mutex_unlock(&devcd->mutex);
return 0;
}
@@ -190,12 +209,10 @@ static ssize_t disabled_show(struct clas
* put_device() <- last reference
* error = fn(dev, data) devcd_dev_release()
* devcd_free(dev, data) kfree(devcd)
- * mutex_lock(&devcd->mutex);
*
*
- * In the above diagram, It looks like disabled_store() would be racing with parallely
- * running devcd_del() and result in memory abort while acquiring devcd->mutex which
- * is called after kfree of devcd memory after dropping its last reference with
+ * In the above diagram, it looks like disabled_store() would be racing with parallelly
+ * running devcd_del() and result in memory abort after dropping its last reference with
* put_device(). However, this will not happens as fn(dev, data) runs
* with its own reference to device via klist_node so it is not its last reference.
* so, above situation would not occur.
@@ -357,7 +374,7 @@ void dev_coredumpm(struct device *dev, s
devcd->read = read;
devcd->free = free;
devcd->failing_dev = get_device(dev);
- devcd->delete_work = false;
+ devcd->deleted = false;
mutex_init(&devcd->mutex);
device_initialize(&devcd->devcd_dev);
@@ -366,8 +383,14 @@ void dev_coredumpm(struct device *dev, s
atomic_inc_return(&devcd_count));
devcd->devcd_dev.class = &devcd_class;
- mutex_lock(&devcd->mutex);
dev_set_uevent_suppress(&devcd->devcd_dev, true);
+
+ /* devcd->mutex prevents devcd_del() completing until init finishes */
+ mutex_lock(&devcd->mutex);
+ devcd->init_completed = false;
+ INIT_DELAYED_WORK(&devcd->del_wk, devcd_del);
+ schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT);
+
if (device_add(&devcd->devcd_dev))
goto put_device;
@@ -381,13 +404,20 @@ void dev_coredumpm(struct device *dev, s
dev_set_uevent_suppress(&devcd->devcd_dev, false);
kobject_uevent(&devcd->devcd_dev.kobj, KOBJ_ADD);
- INIT_DELAYED_WORK(&devcd->del_wk, devcd_del);
- schedule_delayed_work(&devcd->del_wk, DEVCD_TIMEOUT);
+
+ /*
+ * Safe to run devcd_del() now that we are done with devcd_dev.
+ * Alternatively we could have taken a ref on devcd_dev before
+ * dropping the lock.
+ */
+ devcd->init_completed = true;
mutex_unlock(&devcd->mutex);
return;
put_device:
- put_device(&devcd->devcd_dev);
mutex_unlock(&devcd->mutex);
+ cancel_delayed_work_sync(&devcd->del_wk);
+ put_device(&devcd->devcd_dev);
+
put_module:
module_put(owner);
free:
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 029/300] can: gs_usb: increase max interface to U8_MAX
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 028/300] devcoredump: Fix circular locking dependency with devcd->mutex Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 030/300] serial: 8250_dw: Use devm_add_action_or_reset() Greg Kroah-Hartman
` (276 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Runcheng Lu, Vincent Mailhol,
Celeste Liu, Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Celeste Liu <uwu@coelacanthus.name>
commit 2a27f6a8fb5722223d526843040f747e9b0e8060 upstream
This issue was found by Runcheng Lu when develop HSCanT USB to CAN FD
converter[1]. The original developers may have only 3 interfaces
device to test so they write 3 here and wait for future change.
During the HSCanT development, we actually used 4 interfaces, so the
limitation of 3 is not enough now. But just increase one is not
future-proofed. Since the channel index type in gs_host_frame is u8,
just make canch[] become a flexible array with a u8 index, so it
naturally constraint by U8_MAX and avoid statically allocate 256
pointer for every gs_usb device.
[1]: https://github.com/cherry-embedded/HSCanT-hardware
Fixes: d08e973a77d1 ("can: gs_usb: Added support for the GS_USB CAN devices")
Reported-by: Runcheng Lu <runcheng.lu@hpmicro.com>
Cc: stable@vger.kernel.org
Reviewed-by: Vincent Mailhol <mailhol@kernel.org>
Signed-off-by: Celeste Liu <uwu@coelacanthus.name>
Link: https://patch.msgid.link/20250930-gs-usb-max-if-v5-1-863330bf6666@coelacanthus.name
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/usb/gs_usb.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -156,10 +156,6 @@ struct gs_host_frame {
#define GS_MAX_TX_URBS 10
/* Only launch a max of GS_MAX_RX_URBS usb requests at a time. */
#define GS_MAX_RX_URBS 30
-/* Maximum number of interfaces the driver supports per device.
- * Current hardware only supports 2 interfaces. The future may vary.
- */
-#define GS_MAX_INTF 2
struct gs_tx_context {
struct gs_can *dev;
@@ -190,10 +186,11 @@ struct gs_can {
/* usb interface struct */
struct gs_usb {
- struct gs_can *canch[GS_MAX_INTF];
struct usb_anchor rx_submitted;
struct usb_device *udev;
u8 active_channels;
+ u8 channel_cnt;
+ struct gs_can *canch[];
};
/* 'allocate' a tx context.
@@ -321,7 +318,7 @@ static void gs_usb_receive_bulk_callback
}
/* device reports out of range channel id */
- if (hf->channel >= GS_MAX_INTF)
+ if (hf->channel >= usbcan->channel_cnt)
goto device_detach;
dev = usbcan->canch[hf->channel];
@@ -409,7 +406,7 @@ static void gs_usb_receive_bulk_callback
/* USB failure take down all interfaces */
if (rc == -ENODEV) {
device_detach:
- for (rc = 0; rc < GS_MAX_INTF; rc++) {
+ for (rc = 0; rc < usbcan->channel_cnt; rc++) {
if (usbcan->canch[rc])
netif_device_detach(usbcan->canch[rc]->netdev);
}
@@ -991,20 +988,22 @@ static int gs_usb_probe(struct usb_inter
icount = dconf->icount + 1;
dev_info(&intf->dev, "Configuring for %d interfaces\n", icount);
- if (icount > GS_MAX_INTF) {
+ if (icount > type_max(typeof(dev->channel_cnt))) {
dev_err(&intf->dev,
- "Driver cannot handle more that %d CAN interfaces\n",
- GS_MAX_INTF);
+ "Driver cannot handle more that %u CAN interfaces\n",
+ type_max(typeof(dev->channel_cnt)));
kfree(dconf);
return -EINVAL;
}
- dev = kzalloc(sizeof(*dev), GFP_KERNEL);
+ dev = kzalloc(struct_size(dev, canch, icount), GFP_KERNEL);
if (!dev) {
kfree(dconf);
return -ENOMEM;
}
+ dev->channel_cnt = icount;
+
init_usb_anchor(&dev->rx_submitted);
usb_set_intfdata(intf, dev);
@@ -1045,7 +1044,7 @@ static void gs_usb_disconnect(struct usb
return;
}
- for (i = 0; i < GS_MAX_INTF; i++)
+ for (i = 0; i < dev->channel_cnt; i++)
if (dev->canch[i])
gs_destroy_candev(dev->canch[i]);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 030/300] serial: 8250_dw: Use devm_add_action_or_reset()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 029/300] can: gs_usb: increase max interface to U8_MAX Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 031/300] serial: 8250_dw: handle reset control deassert error Greg Kroah-Hartman
` (275 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 295b09128d12fb1a7a67f771cc0ae0df869eafaf ]
Slightly simplify ->probe() and drop a few goto labels by using
devm_add_action_or_reset() for clock and reset cleanup.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20220509172129.37770-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: daeb4037adf7 ("serial: 8250_dw: handle reset control deassert error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_dw.c | 63 ++++++++++++++++++--------------------
1 file changed, 31 insertions(+), 32 deletions(-)
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -438,6 +438,16 @@ static void dw8250_quirks(struct uart_po
}
}
+static void dw8250_clk_disable_unprepare(void *data)
+{
+ clk_disable_unprepare(data);
+}
+
+static void dw8250_reset_control_assert(void *data)
+{
+ reset_control_assert(data);
+}
+
static int dw8250_probe(struct platform_device *pdev)
{
struct uart_8250_port uart = {}, *up = &uart;
@@ -539,35 +549,43 @@ static int dw8250_probe(struct platform_
if (err)
dev_warn(dev, "could not enable optional baudclk: %d\n", err);
+ err = devm_add_action_or_reset(dev, dw8250_clk_disable_unprepare, data->clk);
+ if (err)
+ return err;
+
if (data->clk)
p->uartclk = clk_get_rate(data->clk);
/* If no clock rate is defined, fail. */
if (!p->uartclk) {
dev_err(dev, "clock rate not defined\n");
- err = -EINVAL;
- goto err_clk;
+ return -EINVAL;
}
data->pclk = devm_clk_get_optional(dev, "apb_pclk");
- if (IS_ERR(data->pclk)) {
- err = PTR_ERR(data->pclk);
- goto err_clk;
- }
+ if (IS_ERR(data->pclk))
+ return PTR_ERR(data->pclk);
err = clk_prepare_enable(data->pclk);
if (err) {
dev_err(dev, "could not enable apb_pclk\n");
- goto err_clk;
+ return err;
}
+ err = devm_add_action_or_reset(dev, dw8250_clk_disable_unprepare, data->pclk);
+ if (err)
+ return err;
+
data->rst = devm_reset_control_get_optional_exclusive(dev, NULL);
- if (IS_ERR(data->rst)) {
- err = PTR_ERR(data->rst);
- goto err_pclk;
- }
+ if (IS_ERR(data->rst))
+ return PTR_ERR(data->rst);
+
reset_control_deassert(data->rst);
+ err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst);
+ if (err)
+ return err;
+
dw8250_quirks(p, data);
/* If the Busy Functionality is not implemented, don't handle it */
@@ -585,10 +603,8 @@ static int dw8250_probe(struct platform_
}
data->data.line = serial8250_register_8250_port(up);
- if (data->data.line < 0) {
- err = data->data.line;
- goto err_reset;
- }
+ if (data->data.line < 0)
+ return data->data.line;
/*
* Some platforms may provide a reference clock shared between several
@@ -609,17 +625,6 @@ static int dw8250_probe(struct platform_
pm_runtime_enable(dev);
return 0;
-
-err_reset:
- reset_control_assert(data->rst);
-
-err_pclk:
- clk_disable_unprepare(data->pclk);
-
-err_clk:
- clk_disable_unprepare(data->clk);
-
- return err;
}
static int dw8250_remove(struct platform_device *pdev)
@@ -637,12 +642,6 @@ static int dw8250_remove(struct platform
serial8250_unregister_port(data->data.line);
- reset_control_assert(data->rst);
-
- clk_disable_unprepare(data->pclk);
-
- clk_disable_unprepare(data->clk);
-
pm_runtime_disable(dev);
pm_runtime_put_noidle(dev);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 031/300] serial: 8250_dw: handle reset control deassert error
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 030/300] serial: 8250_dw: Use devm_add_action_or_reset() Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 032/300] x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID Greg Kroah-Hartman
` (274 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Artem Shimko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Shimko <a.shimko.dev@gmail.com>
[ Upstream commit daeb4037adf7d3349b4a1fb792f4bc9824686a4b ]
Check the return value of reset_control_deassert() in the probe
function to prevent continuing probe when reset deassertion fails.
Previously, reset_control_deassert() was called without checking its
return value, which could lead to probe continuing even when the
device reset wasn't properly deasserted.
The fix checks the return value and returns an error with dev_err_probe()
if reset deassertion fails, providing better error handling and
diagnostics.
Fixes: acbdad8dd1ab ("serial: 8250_dw: simplify optional reset handling")
Cc: stable <stable@kernel.org>
Signed-off-by: Artem Shimko <a.shimko.dev@gmail.com>
Link: https://patch.msgid.link/20251019095131.252848-1-a.shimko.dev@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_dw.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_dw.c
+++ b/drivers/tty/serial/8250/8250_dw.c
@@ -580,7 +580,9 @@ static int dw8250_probe(struct platform_
if (IS_ERR(data->rst))
return PTR_ERR(data->rst);
- reset_control_deassert(data->rst);
+ err = reset_control_deassert(data->rst);
+ if (err)
+ return dev_err_probe(dev, err, "failed to deassert resets\n");
err = devm_add_action_or_reset(dev, dw8250_reset_control_assert, data->rst);
if (err)
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 032/300] x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 031/300] serial: 8250_dw: handle reset control deassert error Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 033/300] x86/boot: Compile boot code with -std=gnu11 too Greg Kroah-Hartman
` (273 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Babu Moger, Borislav Petkov (AMD),
Reinette Chatre
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Babu Moger <babu.moger@amd.com>
[ Upstream commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92 ]
Users can create as many monitoring groups as the number of RMIDs supported
by the hardware. However, on AMD systems, only a limited number of RMIDs
are guaranteed to be actively tracked by the hardware. RMIDs that exceed
this limit are placed in an "Unavailable" state.
When a bandwidth counter is read for such an RMID, the hardware sets
MSR_IA32_QM_CTR.Unavailable (bit 62). When such an RMID starts being tracked
again the hardware counter is reset to zero. MSR_IA32_QM_CTR.Unavailable
remains set on first read after tracking re-starts and is clear on all
subsequent reads as long as the RMID is tracked.
resctrl miscounts the bandwidth events after an RMID transitions from the
"Unavailable" state back to being tracked. This happens because when the
hardware starts counting again after resetting the counter to zero, resctrl
in turn compares the new count against the counter value stored from the
previous time the RMID was tracked.
This results in resctrl computing an event value that is either undercounting
(when new counter is more than stored counter) or a mistaken overflow (when
new counter is less than stored counter).
Reset the stored value (arch_mbm_state::prev_msr) of MSR_IA32_QM_CTR to
zero whenever the RMID is in the "Unavailable" state to ensure accurate
counting after the RMID resets to zero when it starts to be tracked again.
Example scenario that results in mistaken overflow
==================================================
1. The resctrl filesystem is mounted, and a task is assigned to a
monitoring group.
$mount -t resctrl resctrl /sys/fs/resctrl
$mkdir /sys/fs/resctrl/mon_groups/test1/
$echo 1234 > /sys/fs/resctrl/mon_groups/test1/tasks
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
21323 <- Total bytes on domain 0
"Unavailable" <- Total bytes on domain 1
Task is running on domain 0. Counter on domain 1 is "Unavailable".
2. The task runs on domain 0 for a while and then moves to domain 1. The
counter starts incrementing on domain 1.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
7345357 <- Total bytes on domain 0
4545 <- Total bytes on domain 1
3. At some point, the RMID in domain 0 transitions to the "Unavailable"
state because the task is no longer executing in that domain.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
"Unavailable" <- Total bytes on domain 0
434341 <- Total bytes on domain 1
4. Since the task continues to migrate between domains, it may eventually
return to domain 0.
$cat /sys/fs/resctrl/mon_groups/test1/mon_data/mon_L3_*/mbm_total_bytes
17592178699059 <- Overflow on domain 0
3232332 <- Total bytes on domain 1
In this case, the RMID on domain 0 transitions from "Unavailable" state to
active state. The hardware sets MSR_IA32_QM_CTR.Unavailable (bit 62) when
the counter is read and begins tracking the RMID counting from 0.
Subsequent reads succeed but return a value smaller than the previously
saved MSR value (7345357). Consequently, the resctrl's overflow logic is
triggered, it compares the previous value (7345357) with the new, smaller
value and incorrectly interprets this as a counter overflow, adding a large
delta.
In reality, this is a false positive: the counter did not overflow but was
simply reset when the RMID transitioned from "Unavailable" back to active
state.
Here is the text from APM [1] available from [2].
"In PQOS Version 2.0 or higher, the MBM hardware will set the U bit on the
first QM_CTR read when it begins tracking an RMID that it was not
previously tracking. The U bit will be zero for all subsequent reads from
that RMID while it is still tracked by the hardware. Therefore, a QM_CTR
read with the U bit set when that RMID is in use by a processor can be
considered 0 when calculating the difference with a subsequent read."
[1] AMD64 Architecture Programmer's Manual Volume 2: System Programming
Publication # 24593 Revision 3.41 section 19.3.3 Monitoring L3 Memory
Bandwidth (MBM).
[ bp: Split commit message into smaller paragraph chunks for better
consumption. ]
Fixes: 4d05bf71f157d ("x86/resctrl: Introduce AMD QOS feature")
Signed-off-by: Babu Moger <babu.moger@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Reinette Chatre <reinette.chatre@intel.com>
Tested-by: Reinette Chatre <reinette.chatre@intel.com>
Cc: stable@vger.kernel.org # needs adjustments for <= v6.17
Link: https://bugzilla.kernel.org/show_bug.cgi?id=206537 # [2]
(cherry picked from commit 15292f1b4c55a3a7c940dbcb6cb8793871ed3d92)
[babu.moger@amd.com: Needed backport for v5.10 stable]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/cpu/resctrl/monitor.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/arch/x86/kernel/cpu/resctrl/monitor.c
+++ b/arch/x86/kernel/cpu/resctrl/monitor.c
@@ -224,11 +224,19 @@ static u64 mbm_overflow_count(u64 prev_m
static u64 __mon_event_count(u32 rmid, struct rmid_read *rr)
{
- struct mbm_state *m;
+ struct mbm_state *m = NULL;
u64 chunks, tval;
tval = __rmid_read(rmid, rr->evtid);
if (tval & (RMID_VAL_ERROR | RMID_VAL_UNAVAIL)) {
+ if (tval & RMID_VAL_UNAVAIL) {
+ if (rr->evtid == QOS_L3_MBM_TOTAL_EVENT_ID)
+ m = &rr->d->mbm_total[rmid];
+ else if (rr->evtid == QOS_L3_MBM_LOCAL_EVENT_ID)
+ m = &rr->d->mbm_local[rmid];
+ if (m)
+ m->prev_msr = 0;
+ }
return tval;
}
switch (rr->evtid) {
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 033/300] x86/boot: Compile boot code with -std=gnu11 too
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 032/300] x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 034/300] arch: back to -std=gnu89 in < v5.18 Greg Kroah-Hartman
` (272 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Dobriyan, Ingo Molnar,
H. Peter Anvin (Intel), Matthieu Baerts (NGI0), Nathan Chancellor,
Dave Hansen, Ard Biesheuvel
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <adobriyan@gmail.com>
commit b3bee1e7c3f2b1b77182302c7b2131c804175870 upstream.
Use -std=gnu11 for consistency with main kernel code.
It doesn't seem to change anything in vmlinux.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: H. Peter Anvin (Intel) <hpa@zytor.com>
Link: https://lore.kernel.org/r/2058761e-12a4-4b2f-9690-3c3c1c9902a5@p183
[ This kernel version doesn't build with GCC 15:
In file included from include/uapi/linux/posix_types.h:5,
from include/uapi/linux/types.h:14,
from include/linux/types.h:6,
from arch/x86/realmode/rm/wakeup.h:11,
from arch/x86/realmode/rm/wakemain.c:2:
include/linux/stddef.h:11:9: error: cannot use keyword 'false' as enumeration constant
11 | false = 0,
| ^~~~~
include/linux/stddef.h:11:9: note: 'false' is a keyword with '-std=c23' onwards
include/linux/types.h:30:33: error: 'bool' cannot be defined via 'typedef'
30 | typedef _Bool bool;
| ^~~~
include/linux/types.h:30:33: note: 'bool' is a keyword with '-std=c23' onwards
include/linux/types.h:30:1: warning: useless type name in empty declaration
30 | typedef _Bool bool;
| ^~~~~~~
The fix is similar to commit ee2ab467bddf ("x86/boot: Use '-std=gnu11'
to fix build with GCC 15") which has been backported to this kernel.
Note: In < 5.18 version, -std=gnu89 is used instead of -std=gnu11, see
commit e8c07082a810 ("Kbuild: move to -std=gnu11"). I suggest not to
modify that in this commit here as all the other similar fixes to
support GCC 15 set -std=gnu11. This can be done in a dedicated commit
if needed.
There was a conflict, because commit 2838307b019d ("x86/build: Remove
-m16 workaround for unsupported versions of GCC") is not in this
version and change code in the context. -std=gnu11 can still be added
at the same place. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -31,7 +31,7 @@ endif
CODE16GCC_CFLAGS := -m32 -Wa,$(srctree)/arch/x86/boot/code16gcc.h
M16_CFLAGS := $(call cc-option, -m16, $(CODE16GCC_CFLAGS))
-REALMODE_CFLAGS := $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
+REALMODE_CFLAGS := -std=gnu11 $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
-Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
-fno-strict-aliasing -fomit-frame-pointer -fno-pic \
-mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 034/300] arch: back to -std=gnu89 in < v5.18
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 033/300] x86/boot: Compile boot code with -std=gnu11 too Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:23 ` [PATCH 5.10 035/300] tracing: fix declaration-after-statement warning Greg Kroah-Hartman
` (271 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthieu Baerts (NGI0),
Nathan Chancellor, Ard Biesheuvel, Alexey Dobriyan, Arnd Bergmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
Recent fixes have been backported to < v5.18 to fix build issues with
GCC 5.15. They all force -std=gnu11 in the CFLAGS, "because [the kernel]
requests the gnu11 standard via '-std=' in the main Makefile".
This is true for >= 5.18 versions, but not before. This switch to
-std=gnu11 has been done in commit e8c07082a810 ("Kbuild: move to
-std=gnu11").
For a question of uniformity, force -std=gnu89, similar to what is done
in the main Makefile.
Note: the fixes tags below refers to upstream commits, but this fix is
only for kernels not having commit e8c07082a810 ("Kbuild: move to
-std=gnu11").
Fixes: 7cbb015e2d3d ("parisc: fix building with gcc-15")
Fixes: 3b8b80e99376 ("s390: Add '-std=gnu11' to decompressor and purgatory CFLAGS")
Fixes: b3bee1e7c3f2 ("x86/boot: Compile boot code with -std=gnu11 too")
Fixes: ee2ab467bddf ("x86/boot: Use '-std=gnu11' to fix build with GCC 15")
Fixes: 8ba14d9f490a ("efi: libstub: Use '-std=gnu11' to fix build with GCC 15")
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: Nathan Chancellor <nathan@kernel.org>
Cc: Ard Biesheuvel <ardb@kernel.org>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/parisc/boot/compressed/Makefile | 2 +-
arch/s390/Makefile | 2 +-
arch/s390/purgatory/Makefile | 2 +-
arch/x86/Makefile | 2 +-
arch/x86/boot/compressed/Makefile | 2 +-
drivers/firmware/efi/libstub/Makefile | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
--- a/arch/parisc/boot/compressed/Makefile
+++ b/arch/parisc/boot/compressed/Makefile
@@ -22,7 +22,7 @@ KBUILD_CFLAGS += -fno-PIE -mno-space-reg
ifndef CONFIG_64BIT
KBUILD_CFLAGS += -mfast-indirect-calls
endif
-KBUILD_CFLAGS += -std=gnu11
+KBUILD_CFLAGS += -std=gnu89
OBJECTS += $(obj)/head.o $(obj)/real2.o $(obj)/firmware.o $(obj)/misc.o $(obj)/piggy.o
--- a/arch/s390/Makefile
+++ b/arch/s390/Makefile
@@ -23,7 +23,7 @@ endif
aflags_dwarf := -Wa,-gdwarf-2
KBUILD_AFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -D__ASSEMBLY__
KBUILD_AFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO),$(aflags_dwarf))
-KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -std=gnu11
+KBUILD_CFLAGS_DECOMPRESSOR := $(CLANG_FLAGS) -m64 -O2 -std=gnu89
KBUILD_CFLAGS_DECOMPRESSOR += -DDISABLE_BRANCH_PROFILING -D__NO_FORTIFY
KBUILD_CFLAGS_DECOMPRESSOR += -fno-delete-null-pointer-checks -msoft-float
KBUILD_CFLAGS_DECOMPRESSOR += -fno-asynchronous-unwind-tables
--- a/arch/s390/purgatory/Makefile
+++ b/arch/s390/purgatory/Makefile
@@ -20,7 +20,7 @@ GCOV_PROFILE := n
UBSAN_SANITIZE := n
KASAN_SANITIZE := n
-KBUILD_CFLAGS := -std=gnu11 -fno-strict-aliasing -Wall -Wstrict-prototypes
+KBUILD_CFLAGS := -std=gnu89 -fno-strict-aliasing -Wall -Wstrict-prototypes
KBUILD_CFLAGS += -Wno-pointer-sign -Wno-sign-compare
KBUILD_CFLAGS += -fno-zero-initialized-in-bss -fno-builtin -ffreestanding
KBUILD_CFLAGS += -c -MD -Os -m64 -msoft-float -fno-common
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -31,7 +31,7 @@ endif
CODE16GCC_CFLAGS := -m32 -Wa,$(srctree)/arch/x86/boot/code16gcc.h
M16_CFLAGS := $(call cc-option, -m16, $(CODE16GCC_CFLAGS))
-REALMODE_CFLAGS := -std=gnu11 $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
+REALMODE_CFLAGS := -std=gnu89 $(M16_CFLAGS) -g -Os -DDISABLE_BRANCH_PROFILING -D__DISABLE_EXPORTS \
-Wall -Wstrict-prototypes -march=i386 -mregparm=3 \
-fno-strict-aliasing -fomit-frame-pointer -fno-pic \
-mno-mmx -mno-sse $(call cc-option,-fcf-protection=none)
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -33,7 +33,7 @@ targets := vmlinux vmlinux.bin vmlinux.b
# avoid errors with '-march=i386', and future flags may depend on the target to
# be valid.
KBUILD_CFLAGS := -m$(BITS) -O2 $(CLANG_FLAGS)
-KBUILD_CFLAGS += -std=gnu11
+KBUILD_CFLAGS += -std=gnu89
KBUILD_CFLAGS += -fno-strict-aliasing -fPIE
KBUILD_CFLAGS += -DDISABLE_BRANCH_PROFILING
cflags-$(CONFIG_X86_32) := -march=i386
--- a/drivers/firmware/efi/libstub/Makefile
+++ b/drivers/firmware/efi/libstub/Makefile
@@ -7,7 +7,7 @@
#
cflags-$(CONFIG_X86_32) := -march=i386
cflags-$(CONFIG_X86_64) := -mcmodel=small
-cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu11 \
+cflags-$(CONFIG_X86) += -m$(BITS) -D__KERNEL__ -std=gnu89 \
-fPIC -fno-strict-aliasing -mno-red-zone \
-mno-mmx -mno-sse -fshort-wchar \
-Wno-pointer-sign \
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 035/300] tracing: fix declaration-after-statement warning
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 034/300] arch: back to -std=gnu89 in < v5.18 Greg Kroah-Hartman
@ 2025-12-03 15:23 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 036/300] usb: gadget: f_fs: Fix epfile null pointer access after ep enable Greg Kroah-Hartman
` (270 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:23 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthieu Baerts (NGI0),
Douglas Raillard, Masami Hiramatsu (Google),
Steven Rostedt (Google), Mathieu Desnoyers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
When building this kernel version this warning is visible:
kernel/trace/trace_events_synth.c: In function 'synth_event_reg':
kernel/trace/trace_events_synth.c:847:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
847 | int ret = trace_event_reg(call, type, data);
| ^~~
This can be easily fixed by declaring 'ret' earlier.
This issue is visible in < v5.18, because -std=gnu89 is used by default,
see commit e8c07082a810 ("Kbuild: move to -std=gnu11").
Please note that in v5.15.y, the 'Fixes' commit has been modified during
the backport, not to have this warning. See commit 72848b81b3dd
("tracing: Ensure module defining synth event cannot be unloaded while
tracing") from v5.15.y.
Fixes: 21581dd4e7ff ("tracing: Ensure module defining synth event cannot be unloaded while tracing")
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: Douglas Raillard <douglas.raillard@arm.com>
Cc: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: Steven Rostedt (Google) <rostedt@goodmis.org>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events_synth.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/kernel/trace/trace_events_synth.c
+++ b/kernel/trace/trace_events_synth.c
@@ -831,6 +831,7 @@ static int synth_event_reg(struct trace_
enum trace_reg type, void *data)
{
struct synth_event *event = container_of(call, struct synth_event, call);
+ int ret;
switch (type) {
#ifdef CONFIG_PERF_EVENTS
@@ -844,7 +845,7 @@ static int synth_event_reg(struct trace_
break;
}
- int ret = trace_event_reg(call, type, data);
+ ret = trace_event_reg(call, type, data);
switch (type) {
#ifdef CONFIG_PERF_EVENTS
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 036/300] usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2025-12-03 15:23 ` [PATCH 5.10 035/300] tracing: fix declaration-after-statement warning Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 037/300] block: make REQ_OP_ZONE_OPEN a write operation Greg Kroah-Hartman
` (269 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Owen Gu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <guhuinan@xiaomi.com>
commit cfd6f1a7b42f62523c96d9703ef32b0dbc495ba4 upstream.
A race condition occurs when ffs_func_eps_enable() runs concurrently
with ffs_data_reset(). The ffs_data_clear() called in ffs_data_reset()
sets ffs->epfiles to NULL before resetting ffs->eps_count to 0, leading
to a NULL pointer dereference when accessing epfile->ep in
ffs_func_eps_enable() after successful usb_ep_enable().
The ffs->epfiles pointer is set to NULL in both ffs_data_clear() and
ffs_data_close() functions, and its modification is protected by the
spinlock ffs->eps_lock. And the whole ffs_func_eps_enable() function
is also protected by ffs->eps_lock.
Thus, add NULL pointer handling for ffs->epfiles in the
ffs_func_eps_enable() function to fix issues
Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Link: https://lore.kernel.org/r/20250915092907.17802-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -1993,7 +1993,12 @@ static int ffs_func_eps_enable(struct ff
ep = func->eps;
epfile = ffs->epfiles;
count = ffs->eps_count;
- while(count--) {
+ if (!epfile) {
+ ret = -ENOMEM;
+ goto done;
+ }
+
+ while (count--) {
ep->ep->driver_data = ep;
ret = config_ep_by_speed(func->gadget, &func->function, ep->ep);
@@ -2017,6 +2022,7 @@ static int ffs_func_eps_enable(struct ff
}
wake_up_interruptible(&ffs->wait);
+done:
spin_unlock_irqrestore(&func->ffs->eps_lock, flags);
return ret;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 037/300] block: make REQ_OP_ZONE_OPEN a write operation
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 036/300] usb: gadget: f_fs: Fix epfile null pointer access after ep enable Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 038/300] soc: qcom: smem: Fix endian-unaware access of num_entries Greg Kroah-Hartman
` (268 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Chaitanya Kulkarni,
Christoph Hellwig, Johannes Thumshirn, Jens Axboe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
[ Upstream commit 19de03b312d69a7e9bacb51c806c6e3f4207376c ]
A REQ_OP_OPEN_ZONE request changes the condition of a sequential zone of
a zoned block device to the explicitly open condition
(BLK_ZONE_COND_EXP_OPEN). As such, it should be considered a write
operation.
Change this operation code to be an odd number to reflect this. The
following operation numbers are changed to keep the numbering compact.
No problems were reported without this change as this operation has no
data. However, this unifies the zone operation to reflect that they
modify the device state and also allows strengthening checks in the
block layer, e.g. checking if this operation is not issued against a
read-only device.
Fixes: 6c1b1da58f8c ("block: add zone open, close and finish operations")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
[ relocated REQ_OP_ZONE_APPEND from 15 to 21 to resolve numbering conflict ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/blk_types.h | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/include/linux/blk_types.h
+++ b/include/linux/blk_types.h
@@ -349,17 +349,17 @@ enum req_opf {
/* write the zero filled sector many times */
REQ_OP_WRITE_ZEROES = 9,
/* Open a zone */
- REQ_OP_ZONE_OPEN = 10,
+ REQ_OP_ZONE_OPEN = 11,
/* Close a zone */
- REQ_OP_ZONE_CLOSE = 11,
+ REQ_OP_ZONE_CLOSE = 13,
/* Transition a zone to full */
- REQ_OP_ZONE_FINISH = 13,
- /* write data at the current zone write pointer */
- REQ_OP_ZONE_APPEND = 15,
+ REQ_OP_ZONE_FINISH = 15,
/* reset a zone write pointer */
REQ_OP_ZONE_RESET = 17,
/* reset all the zone present on the device */
REQ_OP_ZONE_RESET_ALL = 19,
+ /* write data at the current zone write pointer */
+ REQ_OP_ZONE_APPEND = 21,
/* SCSI passthrough using struct scsi_request */
REQ_OP_SCSI_IN = 32,
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 038/300] soc: qcom: smem: Fix endian-unaware access of num_entries
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 037/300] block: make REQ_OP_ZONE_OPEN a write operation Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 039/300] spi: loopback-test: Dont use %pK through printk Greg Kroah-Hartman
` (267 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Reidel, Bjorn Andersson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Reidel <adrian@mainlining.org>
[ Upstream commit 19e7aa0e9e46d0ad111a4af55b3d681b6ad945e0 ]
Add a missing le32_to_cpu when accessing num_entries, which is always a
little endian integer.
Fixes booting on Xiaomi Mi 9T (xiaomi-davinci) in big endian.
Signed-off-by: Jens Reidel <adrian@mainlining.org>
Link: https://lore.kernel.org/r/20250726235646.254730-1-adrian@mainlining.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/smem.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/qcom/smem.c b/drivers/soc/qcom/smem.c
index 28c19bcb2f205..d2d62d2b378b4 100644
--- a/drivers/soc/qcom/smem.c
+++ b/drivers/soc/qcom/smem.c
@@ -709,7 +709,7 @@ static u32 qcom_smem_get_item_count(struct qcom_smem *smem)
if (IS_ERR_OR_NULL(ptable))
return SMEM_ITEM_COUNT;
- info = (struct smem_info *)&ptable->entry[ptable->num_entries];
+ info = (struct smem_info *)&ptable->entry[le32_to_cpu(ptable->num_entries)];
if (memcmp(info->magic, SMEM_INFO_MAGIC, sizeof(info->magic)))
return SMEM_ITEM_COUNT;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 039/300] spi: loopback-test: Dont use %pK through printk
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 038/300] soc: qcom: smem: Fix endian-unaware access of num_entries Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 040/300] soc: ti: pruss: dont " Greg Kroah-Hartman
` (266 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit b832b19318534bb4f1673b24d78037fee339c679 ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
There are still a few users of %pK left, but these use it through seq_file,
for which its usage is safe.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://patch.msgid.link/20250811-restricted-pointers-spi-v1-1-32c47f954e4d@linutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-loopback-test.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/spi/spi-loopback-test.c b/drivers/spi/spi-loopback-test.c
index 89fccb9da1b8e..556118c931092 100644
--- a/drivers/spi/spi-loopback-test.c
+++ b/drivers/spi/spi-loopback-test.c
@@ -409,7 +409,7 @@ static void spi_test_dump_message(struct spi_device *spi,
int i;
u8 b;
- dev_info(&spi->dev, " spi_msg@%pK\n", msg);
+ dev_info(&spi->dev, " spi_msg@%p\n", msg);
if (msg->status)
dev_info(&spi->dev, " status: %i\n",
msg->status);
@@ -419,15 +419,15 @@ static void spi_test_dump_message(struct spi_device *spi,
msg->actual_length);
list_for_each_entry(xfer, &msg->transfers, transfer_list) {
- dev_info(&spi->dev, " spi_transfer@%pK\n", xfer);
+ dev_info(&spi->dev, " spi_transfer@%p\n", xfer);
dev_info(&spi->dev, " len: %i\n", xfer->len);
- dev_info(&spi->dev, " tx_buf: %pK\n", xfer->tx_buf);
+ dev_info(&spi->dev, " tx_buf: %p\n", xfer->tx_buf);
if (dump_data && xfer->tx_buf)
spi_test_print_hex_dump(" TX: ",
xfer->tx_buf,
xfer->len);
- dev_info(&spi->dev, " rx_buf: %pK\n", xfer->rx_buf);
+ dev_info(&spi->dev, " rx_buf: %p\n", xfer->rx_buf);
if (dump_data && xfer->rx_buf)
spi_test_print_hex_dump(" RX: ",
xfer->rx_buf,
@@ -521,7 +521,7 @@ static int spi_check_rx_ranges(struct spi_device *spi,
/* if still not found then something has modified too much */
/* we could list the "closest" transfer here... */
dev_err(&spi->dev,
- "loopback strangeness - rx changed outside of allowed range at: %pK\n",
+ "loopback strangeness - rx changed outside of allowed range at: %p\n",
addr);
/* do not return, only set ret,
* so that we list all addresses
@@ -659,7 +659,7 @@ static int spi_test_translate(struct spi_device *spi,
}
dev_err(&spi->dev,
- "PointerRange [%pK:%pK[ not in range [%pK:%pK[ or [%pK:%pK[\n",
+ "PointerRange [%p:%p[ not in range [%p:%p[ or [%p:%p[\n",
*ptr, *ptr + len,
RX(0), RX(SPI_TEST_MAX_SIZE),
TX(0), TX(SPI_TEST_MAX_SIZE));
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 040/300] soc: ti: pruss: dont use %pK through printk
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 039/300] spi: loopback-test: Dont use %pK through printk Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 041/300] bpf: Dont " Greg Kroah-Hartman
` (265 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Nishanth Menon, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit a5039648f86424885aae37f03dc39bc9cb972ecb ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Link: https://lore.kernel.org/r/20250811-restricted-pointers-soc-v2-1-7af7ed993546@linutronix.de
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/ti/pruss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/soc/ti/pruss.c b/drivers/soc/ti/pruss.c
index 30695172a508f..bf2ba4c8595ba 100644
--- a/drivers/soc/ti/pruss.c
+++ b/drivers/soc/ti/pruss.c
@@ -229,7 +229,7 @@ static int pruss_probe(struct platform_device *pdev)
pruss->mem_regions[i].pa = res.start;
pruss->mem_regions[i].size = resource_size(&res);
- dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %pK\n",
+ dev_dbg(dev, "memory %8s: pa %pa size 0x%zx va %p\n",
mem_names[i], &pruss->mem_regions[i].pa,
pruss->mem_regions[i].size, pruss->mem_regions[i].va);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 041/300] bpf: Dont use %pK through printk
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 040/300] soc: ti: pruss: dont " Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 042/300] pinctrl: single: fix bias pull up/down handling in pin_config_set Greg Kroah-Hartman
` (264 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Weißschuh,
Andrii Nakryiko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
[ Upstream commit 2caa6b88e0ba0231fb4ff0ba8e73cedd5fb81fc8 ]
In the past %pK was preferable to %p as it would not leak raw pointer
values into the kernel log.
Since commit ad67b74d2469 ("printk: hash addresses printed with %p")
the regular %p has been improved to avoid this issue.
Furthermore, restricted pointers ("%pK") were never meant to be used
through printk(). They can still unintentionally leak raw pointers or
acquire sleeping locks in atomic contexts.
Switch to the regular pointer formatting which is safer and
easier to reason about.
Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250811-restricted-pointers-bpf-v1-1-a1d7cc3cb9e7@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/filter.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/filter.h b/include/linux/filter.h
index e3aca0dc7d9c6..f97b0f1a4eab2 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h
@@ -1031,7 +1031,7 @@ void bpf_jit_prog_release_other(struct bpf_prog *fp, struct bpf_prog *fp_other);
static inline void bpf_jit_dump(unsigned int flen, unsigned int proglen,
u32 pass, void *image)
{
- pr_err("flen=%u proglen=%u pass=%u image=%pK from=%s pid=%d\n", flen,
+ pr_err("flen=%u proglen=%u pass=%u image=%p from=%s pid=%d\n", flen,
proglen, pass, image, current->comm, task_pid_nr(current));
if (image)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 042/300] pinctrl: single: fix bias pull up/down handling in pin_config_set
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 041/300] bpf: Dont " Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 043/300] mmc: host: renesas_sdhi: Fix the actual clock Greg Kroah-Hartman
` (263 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhang, Linus Walleij,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhang <chizhang@asrmicro.com>
[ Upstream commit 236152dd9b1675a35eee912e79e6c57ca6b6732f ]
In the pin_config_set function, when handling PIN_CONFIG_BIAS_PULL_DOWN or
PIN_CONFIG_BIAS_PULL_UP, the function calls pcs_pinconf_clear_bias()
which writes the register. However, the subsequent operations continue
using the stale 'data' value from before the register write, effectively
causing the bias clear operation to be overwritten and not take effect.
Fix this by reading the 'data' value from the register after calling
pcs_pinconf_clear_bias().
This bug seems to have existed when this code was first merged in commit
9dddb4df90d1 ("pinctrl: single: support generic pinconf").
Signed-off-by: Chi Zhang <chizhang@asrmicro.com>
Link: https://lore.kernel.org/20250807062038.13610-1-chizhang@asrmicro.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-single.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/pinctrl-single.c b/drivers/pinctrl/pinctrl-single.c
index 22fd7ebd5cf3f..9485737638b3c 100644
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -586,8 +586,10 @@ static int pcs_pinconf_set(struct pinctrl_dev *pctldev,
break;
case PIN_CONFIG_BIAS_PULL_DOWN:
case PIN_CONFIG_BIAS_PULL_UP:
- if (arg)
+ if (arg) {
pcs_pinconf_clear_bias(pctldev, pin);
+ data = pcs->read(pcs->base + offset);
+ }
fallthrough;
case PIN_CONFIG_INPUT_SCHMITT_ENABLE:
data &= ~func->conf[i].mask;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 043/300] mmc: host: renesas_sdhi: Fix the actual clock
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 042/300] pinctrl: single: fix bias pull up/down handling in pin_config_set Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 044/300] memstick: Add timeout to prevent indefinite waiting Greg Kroah-Hartman
` (262 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biju Das, Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Biju Das <biju.das.jz@bp.renesas.com>
[ Upstream commit 9c174e4dacee9fb2014a4ffc953d79a5707b77e4 ]
Wrong actual clock reported, if the SD clock division ratio is other
than 1:1(bits DIV[7:0] in SD_CLK_CTRL are set to 11111111).
On high speed mode, cat /sys/kernel/debug/mmc1/ios
Without the patch:
clock: 50000000 Hz
actual clock: 200000000 Hz
After the fix:
clock: 50000000 Hz
actual clock: 50000000 Hz
Signed-off-by: Biju Das <biju.das.jz@bp.renesas.com>
Link: https://lore.kernel.org/r/20250629203859.170850-1-biju.das.jz@bp.renesas.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/renesas_sdhi_core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/mmc/host/renesas_sdhi_core.c b/drivers/mmc/host/renesas_sdhi_core.c
index a15b44ca87d35..c0acb309e3243 100644
--- a/drivers/mmc/host/renesas_sdhi_core.c
+++ b/drivers/mmc/host/renesas_sdhi_core.c
@@ -183,7 +183,11 @@ static void renesas_sdhi_set_clock(struct tmio_mmc_host *host,
clk &= ~0xff;
}
- sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clk & CLK_CTL_DIV_MASK);
+ clock = clk & CLK_CTL_DIV_MASK;
+ if (clock != 0xff)
+ host->mmc->actual_clock /= (1 << (ffs(clock) + 1));
+
+ sd_ctrl_write16(host, CTL_SD_CARD_CLK_CTL, clock);
if (!(host->pdata->flags & TMIO_MMC_MIN_RCAR2))
usleep_range(10000, 11000);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 044/300] memstick: Add timeout to prevent indefinite waiting
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 043/300] mmc: host: renesas_sdhi: Fix the actual clock Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-04 21:45 ` Ben Hutchings
2025-12-03 15:24 ` [PATCH 5.10 045/300] ACPI: video: force native for Lenovo 82K8 Greg Kroah-Hartman
` (261 subsequent siblings)
305 siblings, 1 reply; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiayi Li, Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayi Li <lijiayi@kylinos.cn>
[ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
and memstick_alloc_card() to prevent indefinite blocking in case of
hardware or communication failures.
Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/memstick/core/memstick.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
index e24ab362e51a9..7b8483f8d6f4f 100644
--- a/drivers/memstick/core/memstick.c
+++ b/drivers/memstick/core/memstick.c
@@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
{
card->next_request = h_memstick_set_rw_addr;
memstick_new_req(card->host);
- wait_for_completion(&card->mrq_complete);
+ if (!wait_for_completion_timeout(&card->mrq_complete,
+ msecs_to_jiffies(500)))
+ card->current_mrq.error = -ETIMEDOUT;
return card->current_mrq.error;
}
@@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
card->next_request = h_memstick_read_dev_id;
memstick_new_req(host);
- wait_for_completion(&card->mrq_complete);
+ if (!wait_for_completion_timeout(&card->mrq_complete,
+ msecs_to_jiffies(500)))
+ card->current_mrq.error = -ETIMEDOUT;
if (card->current_mrq.error)
goto err_out;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 044/300] memstick: Add timeout to prevent indefinite waiting
2025-12-03 15:24 ` [PATCH 5.10 044/300] memstick: Add timeout to prevent indefinite waiting Greg Kroah-Hartman
@ 2025-12-04 21:45 ` Ben Hutchings
0 siblings, 0 replies; 312+ messages in thread
From: Ben Hutchings @ 2025-12-04 21:45 UTC (permalink / raw)
To: Jiayi Li; +Cc: patches, Ulf Hansson, Sasha Levin, Greg Kroah-Hartman, stable
[-- Attachment #1: Type: text/plain, Size: 2298 bytes --]
On Wed, 2025-12-03 at 16:24 +0100, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Jiayi Li <lijiayi@kylinos.cn>
>
> [ Upstream commit b65e630a55a490a0269ab1e4a282af975848064c ]
>
> Add timeout handling to wait_for_completion calls in memstick_set_rw_addr()
> and memstick_alloc_card() to prevent indefinite blocking in case of
> hardware or communication failures.
However, if the card does respond after the timeout, it appears that
there can be a data race and UAF of the memstick_dev structure in
memstick_next_req() and the callback function. It looks like some (but
not all) host drivers implement command timeouts themselves, so perhaps
that is where this should actually be fixed.
Ben.
> Signed-off-by: Jiayi Li <lijiayi@kylinos.cn>
> Link: https://lore.kernel.org/r/20250804024825.1565078-1-lijiayi@kylinos.cn
> Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/memstick/core/memstick.c | 8 ++++++--
> 1 file changed, 6 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
> index e24ab362e51a9..7b8483f8d6f4f 100644
> --- a/drivers/memstick/core/memstick.c
> +++ b/drivers/memstick/core/memstick.c
> @@ -369,7 +369,9 @@ int memstick_set_rw_addr(struct memstick_dev *card)
> {
> card->next_request = h_memstick_set_rw_addr;
> memstick_new_req(card->host);
> - wait_for_completion(&card->mrq_complete);
> + if (!wait_for_completion_timeout(&card->mrq_complete,
> + msecs_to_jiffies(500)))
> + card->current_mrq.error = -ETIMEDOUT;
>
> return card->current_mrq.error;
> }
> @@ -403,7 +405,9 @@ static struct memstick_dev *memstick_alloc_card(struct memstick_host *host)
>
> card->next_request = h_memstick_read_dev_id;
> memstick_new_req(host);
> - wait_for_completion(&card->mrq_complete);
> + if (!wait_for_completion_timeout(&card->mrq_complete,
> + msecs_to_jiffies(500)))
> + card->current_mrq.error = -ETIMEDOUT;
>
> if (card->current_mrq.error)
> goto err_out;
--
Ben Hutchings
It is easier to change the specification to fit the program
than vice versa.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 312+ messages in thread
* [PATCH 5.10 045/300] ACPI: video: force native for Lenovo 82K8
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 044/300] memstick: Add timeout to prevent indefinite waiting Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 046/300] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 Greg Kroah-Hartman
` (260 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wilson Alvarez,
Mario Limonciello (AMD), Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello (AMD) <superm1@kernel.org>
[ Upstream commit f144bc21befdcf8e54d2f19b23b4e84f13be01f9 ]
Lenovo 82K8 has a broken brightness control provided by nvidia_wmi_ec.
Add a quirk to prevent using it.
Reported-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/4512
Tested-by: Wilson Alvarez <wilson.e.alvarez@rubonnek.com>
Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
Link: https://patch.msgid.link/20250820170927.895573-1-superm1@kernel.org
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/video_detect.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c
index 338e1f44906a9..0ecc47e273140 100644
--- a/drivers/acpi/video_detect.c
+++ b/drivers/acpi/video_detect.c
@@ -635,6 +635,14 @@ static const struct dmi_system_id video_detect_dmi_table[] = {
DMI_MATCH(DMI_PRODUCT_NAME, "MS-7721"),
},
},
+ /* https://gitlab.freedesktop.org/drm/amd/-/issues/4512 */
+ {
+ .callback = video_detect_force_native,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "82K8"),
+ },
+ },
{ },
};
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 046/300] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 045/300] ACPI: video: force native for Lenovo 82K8 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 047/300] cpufreq/longhaul: handle NULL policy in longhaul_exit Greg Kroah-Hartman
` (259 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo B . Marlière,
Andrii Nakryiko, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marlière <rbm@suse.com>
[ Upstream commit 98857d111c53954aa038fcbc4cf48873e4240f7c ]
Commit e9fc3ce99b34 ("libbpf: Streamline error reporting for high-level
APIs") redefined the way that bpf_prog_detach2() returns. Therefore, adapt
the usage in test_lirc_mode2_user.c.
Signed-off-by: Ricardo B. Marlière <rbm@suse.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20250828-selftests-bpf-v1-1-c7811cd8b98c@suse.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/test_lirc_mode2_user.c b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
index fb5fd6841ef39..d63878bc2d5f9 100644
--- a/tools/testing/selftests/bpf/test_lirc_mode2_user.c
+++ b/tools/testing/selftests/bpf/test_lirc_mode2_user.c
@@ -73,7 +73,7 @@ int main(int argc, char **argv)
/* Let's try detach it before it was ever attached */
ret = bpf_prog_detach2(progfd, lircfd, BPF_LIRC_MODE2);
- if (ret != -1 || errno != ENOENT) {
+ if (ret != -ENOENT) {
printf("bpf_prog_detach2 not attached should fail: %m\n");
return 1;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 047/300] cpufreq/longhaul: handle NULL policy in longhaul_exit
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 046/300] selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 048/300] arc: Fix __fls() const-foldability via __builtin_clzl() Greg Kroah-Hartman
` (258 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dennis Beier, Viresh Kumar,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dennis Beier <nanovim@gmail.com>
[ Upstream commit 592532a77b736b5153e0c2e4c74aa50af0a352ab ]
longhaul_exit() was calling cpufreq_cpu_get(0) without checking
for a NULL policy pointer. On some systems, this could lead to a
NULL dereference and a kernel warning or panic.
This patch adds a check using unlikely() and returns early if the
policy is NULL.
Bugzilla: #219962
Signed-off-by: Dennis Beier <nanovim@gmail.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/longhaul.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c
index 182a4dbca0952..7197b0daabea2 100644
--- a/drivers/cpufreq/longhaul.c
+++ b/drivers/cpufreq/longhaul.c
@@ -955,6 +955,9 @@ static void __exit longhaul_exit(void)
struct cpufreq_policy *policy = cpufreq_cpu_get(0);
int i;
+ if (unlikely(!policy))
+ return;
+
for (i = 0; i < numscales; i++) {
if (mults[i] == maxmult) {
struct cpufreq_freqs freqs;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 048/300] arc: Fix __fls() const-foldability via __builtin_clzl()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 047/300] cpufreq/longhaul: handle NULL policy in longhaul_exit Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 049/300] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment Greg Kroah-Hartman
` (257 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Kees Cook,
Vineet Gupta, Yury Norov (NVIDIA), Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <kees@kernel.org>
[ Upstream commit a3fecb9160482367365cc384c59dd220b162b066 ]
While tracking down a problem where constant expressions used by
BUILD_BUG_ON() suddenly stopped working[1], we found that an added static
initializer was convincing the compiler that it couldn't track the state
of the prior statically initialized value. Tracing this down found that
ffs() was used in the initializer macro, but since it wasn't marked with
__attribute__const__, the compiler had to assume the function might
change variable states as a side-effect (which is not true for ffs(),
which provides deterministic math results).
For arc architecture with CONFIG_ISA_ARCV2=y, the __fls() function
uses __builtin_arc_fls() which lacks GCC's const attribute, preventing
compile-time constant folding, and KUnit testing of ffs/fls fails on
arc[3]. A patch[2] to GCC to solve this has been sent.
Add a fix for this by handling compile-time constants with the standard
__builtin_clzl() builtin (which has const attribute) while preserving
the optimized arc-specific builtin for runtime cases. This has the added
benefit of skipping runtime calculation of compile-time constant values.
Even with the GCC bug fixed (which is about "attribute const") this is a
good change to avoid needless runtime costs, and should be done
regardless of the state of GCC's bug.
Build tested ARCH=arc allyesconfig with GCC arc-linux 15.2.0.
Link: https://github.com/KSPP/linux/issues/364 [1]
Link: https://gcc.gnu.org/pipermail/gcc-patches/2025-August/693273.html
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202508031025.doWxtzzc-lkp@intel.com/ [3]
Signed-off-by: Kees Cook <kees@kernel.org>
Acked-by: Vineet Gupta <vgupta@kernel.org>
Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arc/include/asm/bitops.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arc/include/asm/bitops.h b/arch/arc/include/asm/bitops.h
index fb98440c0bd4c..325512148c7b8 100644
--- a/arch/arc/include/asm/bitops.h
+++ b/arch/arc/include/asm/bitops.h
@@ -315,6 +315,8 @@ static inline __attribute__ ((const)) int fls(unsigned long x)
*/
static inline __attribute__ ((const)) int __fls(unsigned long x)
{
+ if (__builtin_constant_p(x))
+ return x ? BITS_PER_LONG - 1 - __builtin_clzl(x) : 0;
/* FLS insn has exactly same semantics as the API */
return __builtin_arc_fls(x);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 049/300] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 048/300] arc: Fix __fls() const-foldability via __builtin_clzl() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 050/300] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups Greg Kroah-Hartman
` (256 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Bruel, Thomas Gleixner,
Marc Zyngier, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Bruel <christian.bruel@foss.st.com>
[ Upstream commit 2ef3886ce626dcdab0cbc452dbbebc19f57133d8 ]
The PCI Local Bus Specification 3.0 (section 6.8.1.6) allows modifying the
low-order bits of the MSI Message DATA register to encode nr_irqs interrupt
numbers in the log2(nr_irqs) bits for the domain.
The problem arises if the base vector (GICV2m base spi) is not aligned with
nr_irqs; in this case, the low-order log2(nr_irqs) bits from the base
vector conflict with the nr_irqs masking, causing the wrong MSI interrupt
to be identified.
To fix this, use bitmap_find_next_zero_area_off() instead of
bitmap_find_free_region() to align the initial base vector with nr_irqs.
Signed-off-by: Christian Bruel <christian.bruel@foss.st.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/all/20250902091045.220847-1-christian.bruel@foss.st.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/irqchip/irq-gic-v2m.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/drivers/irqchip/irq-gic-v2m.c b/drivers/irqchip/irq-gic-v2m.c
index b17deec1c5d4d..06c5087a439d7 100644
--- a/drivers/irqchip/irq-gic-v2m.c
+++ b/drivers/irqchip/irq-gic-v2m.c
@@ -179,14 +179,19 @@ static int gicv2m_irq_domain_alloc(struct irq_domain *domain, unsigned int virq,
{
msi_alloc_info_t *info = args;
struct v2m_data *v2m = NULL, *tmp;
- int hwirq, offset, i, err = 0;
+ int hwirq, i, err = 0;
+ unsigned long offset;
+ unsigned long align_mask = nr_irqs - 1;
spin_lock(&v2m_lock);
list_for_each_entry(tmp, &v2m_nodes, entry) {
- offset = bitmap_find_free_region(tmp->bm, tmp->nr_spis,
- get_count_order(nr_irqs));
- if (offset >= 0) {
+ unsigned long align_off = tmp->spi_start - (tmp->spi_start & ~align_mask);
+
+ offset = bitmap_find_next_zero_area_off(tmp->bm, tmp->nr_spis, 0,
+ nr_irqs, align_mask, align_off);
+ if (offset < tmp->nr_spis) {
v2m = tmp;
+ bitmap_set(v2m->bm, offset, nr_irqs);
break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 050/300] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 049/300] irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 051/300] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card Greg Kroah-Hartman
` (255 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Svyatoslav Ryhel, Mikko Perttunen,
Thierry Reding, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <clamor95@gmail.com>
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
Add missing Tegra114 nvmem cells and fuse lookups which were added for
Tegra124+ but omitted for Tegra114.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++++++++++
1 file changed, 122 insertions(+)
diff --git a/drivers/soc/tegra/fuse/fuse-tegra30.c b/drivers/soc/tegra/fuse/fuse-tegra30.c
index c1aa7815bd6ec..f7f1a73a52f3a 100644
--- a/drivers/soc/tegra/fuse/fuse-tegra30.c
+++ b/drivers/soc/tegra/fuse/fuse-tegra30.c
@@ -117,6 +117,124 @@ const struct tegra_fuse_soc tegra30_fuse_soc = {
#endif
#ifdef CONFIG_ARCH_TEGRA_114_SOC
+static const struct nvmem_cell_info tegra114_fuse_cells[] = {
+ {
+ .name = "tsensor-cpu1",
+ .offset = 0x084,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-cpu2",
+ .offset = 0x088,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-common",
+ .offset = 0x08c,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-cpu0",
+ .offset = 0x098,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "xusb-pad-calibration",
+ .offset = 0x0f0,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-cpu3",
+ .offset = 0x12c,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-gpu",
+ .offset = 0x154,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-mem0",
+ .offset = 0x158,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-mem1",
+ .offset = 0x15c,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ }, {
+ .name = "tsensor-pllx",
+ .offset = 0x160,
+ .bytes = 4,
+ .bit_offset = 0,
+ .nbits = 32,
+ },
+};
+
+static const struct nvmem_cell_lookup tegra114_fuse_lookups[] = {
+ {
+ .nvmem_name = "fuse",
+ .cell_name = "xusb-pad-calibration",
+ .dev_id = "7009f000.padctl",
+ .con_id = "calibration",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-common",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "common",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu0",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu0",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu1",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu1",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu2",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu2",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-cpu3",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "cpu3",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-mem0",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "mem0",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-mem1",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "mem1",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-gpu",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "gpu",
+ }, {
+ .nvmem_name = "fuse",
+ .cell_name = "tsensor-pllx",
+ .dev_id = "700e2000.thermal-sensor",
+ .con_id = "pllx",
+ },
+};
+
static const struct tegra_fuse_info tegra114_fuse_info = {
.read = tegra30_fuse_read,
.size = 0x2a0,
@@ -127,6 +245,10 @@ const struct tegra_fuse_soc tegra114_fuse_soc = {
.init = tegra30_fuse_init,
.speedo_init = tegra114_init_speedo_data,
.info = &tegra114_fuse_info,
+ .lookups = tegra114_fuse_lookups,
+ .num_lookups = ARRAY_SIZE(tegra114_fuse_lookups),
+ .cells = tegra114_fuse_cells,
+ .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
.soc_attr_group = &tegra_soc_attr_group,
};
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 051/300] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 050/300] soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 052/300] ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() Greg Kroah-Hartman
` (254 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sarthak Garg, Adrian Hunter,
Ulf Hansson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarthak Garg <quic_sartgarg@quicinc.com>
[ Upstream commit 08b68ca543ee9d5a8d2dc406165e4887dd8f170b ]
For Qualcomm SoCs which needs level shifter for SD card, extra delay is
seen on receiver data path.
To compensate this delay enable tuning for SDR50 mode for targets which
has level shifter. SDHCI_SDR50_NEEDS_TUNING caps will be set for targets
with level shifter on Qualcomm SOC's.
Signed-off-by: Sarthak Garg <quic_sartgarg@quicinc.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/sdhci-msm.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/drivers/mmc/host/sdhci-msm.c b/drivers/mmc/host/sdhci-msm.c
index 183617d56b446..c900525b52516 100644
--- a/drivers/mmc/host/sdhci-msm.c
+++ b/drivers/mmc/host/sdhci-msm.c
@@ -78,6 +78,7 @@
#define CORE_IO_PAD_PWR_SWITCH_EN BIT(15)
#define CORE_IO_PAD_PWR_SWITCH BIT(16)
#define CORE_HC_SELECT_IN_EN BIT(18)
+#define CORE_HC_SELECT_IN_SDR50 (4 << 19)
#define CORE_HC_SELECT_IN_HS400 (6 << 19)
#define CORE_HC_SELECT_IN_MASK (7 << 19)
@@ -1113,6 +1114,10 @@ static bool sdhci_msm_is_tuning_needed(struct sdhci_host *host)
{
struct mmc_ios *ios = &host->mmc->ios;
+ if (ios->timing == MMC_TIMING_UHS_SDR50 &&
+ host->flags & SDHCI_SDR50_NEEDS_TUNING)
+ return true;
+
/*
* Tuning is required for SDR104, HS200 and HS400 cards and
* if clock frequency is greater than 100MHz in these modes.
@@ -1181,6 +1186,8 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
struct mmc_ios ios = host->mmc->ios;
struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
struct sdhci_msm_host *msm_host = sdhci_pltfm_priv(pltfm_host);
+ const struct sdhci_msm_offset *msm_offset = msm_host->offset;
+ u32 config;
if (!sdhci_msm_is_tuning_needed(host)) {
msm_host->use_cdr = false;
@@ -1197,6 +1204,14 @@ static int sdhci_msm_execute_tuning(struct mmc_host *mmc, u32 opcode)
*/
msm_host->tuning_done = 0;
+ if (ios.timing == MMC_TIMING_UHS_SDR50 &&
+ host->flags & SDHCI_SDR50_NEEDS_TUNING) {
+ config = readl_relaxed(host->ioaddr + msm_offset->core_vendor_spec);
+ config &= ~CORE_HC_SELECT_IN_MASK;
+ config |= CORE_HC_SELECT_IN_EN | CORE_HC_SELECT_IN_SDR50;
+ writel_relaxed(config, host->ioaddr + msm_offset->core_vendor_spec);
+ }
+
/*
* For HS400 tuning in HS200 timing requires:
* - select MCLK/2 in VENDOR_SPEC
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 052/300] ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 051/300] mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 053/300] tee: allow a driver to allocate a tee_device without a pool Greg Kroah-Hartman
` (253 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
[ Upstream commit e9dff11a7a50fcef23fe3e8314fafae6d5641826 ]
When deleting the previous walkstate operand stack
acpi_ds_call_control_method() was deleting obj_desc->Method.param_count
operands. But Method.param_count does not necessarily match
this_walk_state->num_operands, it may be either less or more.
After correcting the for loop to check `i < this_walk_state->num_operands`
the code is identical to acpi_ds_clear_operands(), so just outright
replace the code with acpi_ds_clear_operands() to fix this.
Link: https://github.com/acpica/acpica/commit/53fc0220
Signed-off-by: Hans de Goede <hansg@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/dsmethod.c | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 13c67f58e9052..5a2081ee37f55 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -546,14 +546,7 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
* Delete the operands on the previous walkstate operand stack
* (they were copied to new objects)
*/
- for (i = 0; i < obj_desc->method.param_count; i++) {
- acpi_ut_remove_reference(this_walk_state->operands[i]);
- this_walk_state->operands[i] = NULL;
- }
-
- /* Clear the operand stack */
-
- this_walk_state->num_operands = 0;
+ acpi_ds_clear_operands(this_walk_state);
ACPI_DEBUG_PRINT((ACPI_DB_DISPATCH,
"**** Begin nested execution of [%4.4s] **** WalkState=%p\n",
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 053/300] tee: allow a driver to allocate a tee_device without a pool
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 052/300] ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 054/300] nvme-fc: use lock accessing port_state and rport state Greg Kroah-Hartman
` (252 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sumit Garg, Amirreza Zarrabi,
Jens Wiklander, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
[ Upstream commit 6dbcd5a9ab6cb6644e7d728521da1c9035ec7235 ]
A TEE driver doesn't always need to provide a pool if it doesn't
support memory sharing ioctls and can allocate memory for TEE
messages in another way. Although this is mentioned in the
documentation for tee_device_alloc(), it is not handled correctly.
Reviewed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tee/tee_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c
index e6de0e80b793e..7f205464a0c7a 100644
--- a/drivers/tee/tee_core.c
+++ b/drivers/tee/tee_core.c
@@ -894,7 +894,7 @@ struct tee_device *tee_device_alloc(const struct tee_desc *teedesc,
if (!teedesc || !teedesc->name || !teedesc->ops ||
!teedesc->ops->get_version || !teedesc->ops->open ||
- !teedesc->ops->release || !pool)
+ !teedesc->ops->release)
return ERR_PTR(-EINVAL);
teedev = kzalloc(sizeof(*teedev), GFP_KERNEL);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 054/300] nvme-fc: use lock accessing port_state and rport state
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 053/300] tee: allow a driver to allocate a tee_device without a pool Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 055/300] video: backlight: lp855x_bl: Set correct EPROM start for LP8556 Greg Kroah-Hartman
` (251 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Daniel Wagner,
Hannes Reinecke, Keith Busch, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Wagner <wagi@kernel.org>
[ Upstream commit 891cdbb162ccdb079cd5228ae43bdeebce8597ad ]
nvme_fc_unregister_remote removes the remote port on a lport object at
any point in time when there is no active association. This races with
with the reconnect logic, because nvme_fc_create_association is not
taking a lock to check the port_state and atomically increase the
active count on the rport.
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/all/u4ttvhnn7lark5w3sgrbuy2rxupcvosp4qmvj46nwzgeo5ausc@uyrkdls2muwx
Signed-off-by: Daniel Wagner <wagi@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/fc.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c
index f49e98c2e31db..635ec11c9a6fc 100644
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3042,11 +3042,17 @@ nvme_fc_create_association(struct nvme_fc_ctrl *ctrl)
++ctrl->ctrl.nr_reconnects;
- if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE)
+ spin_lock_irqsave(&ctrl->rport->lock, flags);
+ if (ctrl->rport->remoteport.port_state != FC_OBJSTATE_ONLINE) {
+ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
return -ENODEV;
+ }
- if (nvme_fc_ctlr_active_on_rport(ctrl))
+ if (nvme_fc_ctlr_active_on_rport(ctrl)) {
+ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
return -ENOTUNIQ;
+ }
+ spin_unlock_irqrestore(&ctrl->rport->lock, flags);
dev_info(ctrl->ctrl.device,
"NVME-FC{%d}: create association : host wwpn 0x%016llx "
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 055/300] video: backlight: lp855x_bl: Set correct EPROM start for LP8556
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 054/300] nvme-fc: use lock accessing port_state and rport state Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 056/300] cpuidle: Fail cpuidle device registration if there is one already Greg Kroah-Hartman
` (250 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Svyatoslav Ryhel,
Daniel Thompson (RISCstar), Lee Jones, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Svyatoslav Ryhel <clamor95@gmail.com>
[ Upstream commit 07c7efda24453e05951fb2879f5452b720b91169 ]
According to LP8556 datasheet EPROM region starts at 0x98 so adjust value
in the driver accordingly.
Signed-off-by: Svyatoslav Ryhel <clamor95@gmail.com>
Reviewed-by: "Daniel Thompson (RISCstar)" <danielt@kernel.org>
Link: https://lore.kernel.org/r/20250909074304.92135-2-clamor95@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/backlight/lp855x_bl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/video/backlight/lp855x_bl.c b/drivers/video/backlight/lp855x_bl.c
index e94932c69f540..80a4b12563c6f 100644
--- a/drivers/video/backlight/lp855x_bl.c
+++ b/drivers/video/backlight/lp855x_bl.c
@@ -21,7 +21,7 @@
#define LP855X_DEVICE_CTRL 0x01
#define LP855X_EEPROM_START 0xA0
#define LP855X_EEPROM_END 0xA7
-#define LP8556_EPROM_START 0xA0
+#define LP8556_EPROM_START 0x98
#define LP8556_EPROM_END 0xAF
/* LP8555/7 Registers */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 056/300] cpuidle: Fail cpuidle device registration if there is one already
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 055/300] video: backlight: lp855x_bl: Set correct EPROM start for LP8556 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 057/300] clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel Greg Kroah-Hartman
` (249 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
[ Upstream commit 7b1b7961170e4fcad488755e5ffaaaf9bd527e8f ]
Refuse to register a cpuidle device if the given CPU has a cpuidle
device already and print a message regarding it.
Without this, an attempt to register a new cpuidle device without
unregistering the existing one leads to the removal of the existing
cpuidle device without removing its sysfs interface.
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpuidle/cpuidle.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c
index 83af15f77f66f..1c1fa6ac9244a 100644
--- a/drivers/cpuidle/cpuidle.c
+++ b/drivers/cpuidle/cpuidle.c
@@ -576,8 +576,14 @@ static void __cpuidle_device_init(struct cpuidle_device *dev)
static int __cpuidle_register_device(struct cpuidle_device *dev)
{
struct cpuidle_driver *drv = cpuidle_get_cpu_driver(dev);
+ unsigned int cpu = dev->cpu;
int i, ret;
+ if (per_cpu(cpuidle_devices, cpu)) {
+ pr_info("CPU%d: cpuidle device already registered\n", cpu);
+ return -EEXIST;
+ }
+
if (!try_module_get(drv->owner))
return -EINVAL;
@@ -589,7 +595,7 @@ static int __cpuidle_register_device(struct cpuidle_device *dev)
dev->states_usage[i].disable |= CPUIDLE_STATE_DISABLED_BY_USER;
}
- per_cpu(cpuidle_devices, dev->cpu) = dev;
+ per_cpu(cpuidle_devices, cpu) = dev;
list_add(&dev->device_list, &cpuidle_detected_devices);
ret = cpuidle_coupled_register_device(dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 057/300] clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 056/300] cpuidle: Fail cpuidle device registration if there is one already Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 058/300] uprobe: Do not emulate/sstep original instruction when ip is changed Greg Kroah-Hartman
` (248 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Lezcano, Arnd Bergmann,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Lezcano <daniel.lezcano@linaro.org>
[ Upstream commit 0b781f527d6f99e68e5b3780ae03cd69a7cb5c0c ]
The driver uses the raw_readl() and raw_writel() functions. Those are
not for MMIO devices. Replace them with readl() and writel()
[ dlezcano: Fixed typo in the subject s/reald/readl/ ]
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20250804152344.1109310-2-daniel.lezcano@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clocksource/timer-vf-pit.c | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
diff --git a/drivers/clocksource/timer-vf-pit.c b/drivers/clocksource/timer-vf-pit.c
index 1a86a4e7e3443..d948ab2720a76 100644
--- a/drivers/clocksource/timer-vf-pit.c
+++ b/drivers/clocksource/timer-vf-pit.c
@@ -35,30 +35,30 @@ static unsigned long cycle_per_jiffy;
static inline void pit_timer_enable(void)
{
- __raw_writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
+ writel(PITTCTRL_TEN | PITTCTRL_TIE, clkevt_base + PITTCTRL);
}
static inline void pit_timer_disable(void)
{
- __raw_writel(0, clkevt_base + PITTCTRL);
+ writel(0, clkevt_base + PITTCTRL);
}
static inline void pit_irq_acknowledge(void)
{
- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
}
static u64 notrace pit_read_sched_clock(void)
{
- return ~__raw_readl(clksrc_base + PITCVAL);
+ return ~readl(clksrc_base + PITCVAL);
}
static int __init pit_clocksource_init(unsigned long rate)
{
/* set the max load value and start the clock source counter */
- __raw_writel(0, clksrc_base + PITTCTRL);
- __raw_writel(~0UL, clksrc_base + PITLDVAL);
- __raw_writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
+ writel(0, clksrc_base + PITTCTRL);
+ writel(~0UL, clksrc_base + PITLDVAL);
+ writel(PITTCTRL_TEN, clksrc_base + PITTCTRL);
sched_clock_register(pit_read_sched_clock, 32, rate);
return clocksource_mmio_init(clksrc_base + PITCVAL, "vf-pit", rate,
@@ -76,7 +76,7 @@ static int pit_set_next_event(unsigned long delta,
* hardware requirement.
*/
pit_timer_disable();
- __raw_writel(delta - 1, clkevt_base + PITLDVAL);
+ writel(delta - 1, clkevt_base + PITLDVAL);
pit_timer_enable();
return 0;
@@ -125,8 +125,8 @@ static struct clock_event_device clockevent_pit = {
static int __init pit_clockevent_init(unsigned long rate, int irq)
{
- __raw_writel(0, clkevt_base + PITTCTRL);
- __raw_writel(PITTFLG_TIF, clkevt_base + PITTFLG);
+ writel(0, clkevt_base + PITTCTRL);
+ writel(PITTFLG_TIF, clkevt_base + PITTFLG);
BUG_ON(request_irq(irq, pit_timer_interrupt, IRQF_TIMER | IRQF_IRQPOLL,
"VF pit timer", &clockevent_pit));
@@ -183,7 +183,7 @@ static int __init pit_timer_init(struct device_node *np)
cycle_per_jiffy = clk_rate / (HZ);
/* enable the pit module */
- __raw_writel(~PITMCR_MDIS, timer_base + PITMCR);
+ writel(~PITMCR_MDIS, timer_base + PITMCR);
ret = pit_clocksource_init(clk_rate);
if (ret)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 058/300] uprobe: Do not emulate/sstep original instruction when ip is changed
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 057/300] clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 059/300] hwmon: (dell-smm) Add support for Dell OptiPlex 7040 Greg Kroah-Hartman
` (247 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oleg Nesterov, Andrii Nakryiko,
Jiri Olsa, Alexei Starovoitov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
[ Upstream commit 4363264111e1297fa37aa39b0598faa19298ecca ]
If uprobe handler changes instruction pointer we still execute single
step) or emulate the original instruction and increment the (new) ip
with its length.
This makes the new instruction pointer bogus and application will
likely crash on illegal instruction execution.
If user decided to take execution elsewhere, it makes little sense
to execute the original instruction, so let's skip it.
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20250916215301.664963-3-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/events/uprobes.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
index 1ea2c1f311261..4f2a9fab8ae88 100644
--- a/kernel/events/uprobes.c
+++ b/kernel/events/uprobes.c
@@ -2242,6 +2242,13 @@ static void handle_swbp(struct pt_regs *regs)
handler_chain(uprobe, regs);
+ /*
+ * If user decided to take execution elsewhere, it makes little sense
+ * to execute the original instruction, so let's skip it.
+ */
+ if (instruction_pointer(regs) != bp_vaddr)
+ goto out;
+
if (arch_uprobe_skip_sstep(&uprobe->arch, regs))
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 059/300] hwmon: (dell-smm) Add support for Dell OptiPlex 7040
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 058/300] uprobe: Do not emulate/sstep original instruction when ip is changed Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 060/300] tools/cpupower: Fix incorrect size in cpuidle_state_disable() Greg Kroah-Hartman
` (246 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Guenter Roeck,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 53d3bd48ef6ff1567a75ca77728968f5ab493cb4 ]
The Dell OptiPlex 7040 supports the legacy SMM interface for reading
sensors and performing fan control. Whitelist this machine so that
this driver loads automatically.
Closes: https://github.com/Wer-Wolf/i8kutils/issues/15
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20250917181036.10972-5-W_Armin@gmx.de
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/dell-smm-hwmon.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/hwmon/dell-smm-hwmon.c b/drivers/hwmon/dell-smm-hwmon.c
index 10c7b6295b02e..9fb389fa17817 100644
--- a/drivers/hwmon/dell-smm-hwmon.c
+++ b/drivers/hwmon/dell-smm-hwmon.c
@@ -1065,6 +1065,13 @@ static const struct dmi_system_id i8k_dmi_table[] __initconst = {
},
.driver_data = (void *)&i8k_config_data[DELL_PRECISION_490],
},
+ {
+ .ident = "Dell OptiPlex 7040",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "OptiPlex 7040"),
+ },
+ },
{
.ident = "Dell Precision",
.matches = {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 060/300] tools/cpupower: Fix incorrect size in cpuidle_state_disable()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 059/300] hwmon: (dell-smm) Add support for Dell OptiPlex 7040 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 061/300] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage Greg Kroah-Hartman
` (245 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaushlendra Kumar, Shuah Khan,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 23199d2aa6dcaf6dd2da772f93d2c94317d71459 ]
Fix incorrect size parameter passed to cpuidle_state_write_file() in
cpuidle_state_disable().
The function was incorrectly using sizeof(disable) which returns the
size of the unsigned int variable (4 bytes) instead of the actual
length of the string stored in the 'value' buffer.
Since 'value' is populated with snprintf() to contain the string
representation of the disable value, we should use the length
returned by snprintf() to get the correct string length for
writing to the sysfs file.
This ensures the correct number of bytes is written to the cpuidle
state disable file in sysfs.
Link: https://lore.kernel.org/r/20250917050820.1785377-1-kaushlendra.kumar@intel.com
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/cpupower/lib/cpuidle.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/power/cpupower/lib/cpuidle.c b/tools/power/cpupower/lib/cpuidle.c
index 479c5971aa6da..c15d0de12357f 100644
--- a/tools/power/cpupower/lib/cpuidle.c
+++ b/tools/power/cpupower/lib/cpuidle.c
@@ -231,6 +231,7 @@ int cpuidle_state_disable(unsigned int cpu,
{
char value[SYSFS_PATH_MAX];
int bytes_written;
+ int len;
if (cpuidle_state_count(cpu) <= idlestate)
return -1;
@@ -239,10 +240,10 @@ int cpuidle_state_disable(unsigned int cpu,
idlestate_value_files[IDLESTATE_DISABLE]))
return -2;
- snprintf(value, SYSFS_PATH_MAX, "%u", disable);
+ len = snprintf(value, SYSFS_PATH_MAX, "%u", disable);
bytes_written = cpuidle_state_write_file(cpu, idlestate, "disable",
- value, sizeof(disable));
+ value, len);
if (bytes_written)
return 0;
return -3;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 061/300] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 060/300] tools/cpupower: Fix incorrect size in cpuidle_state_disable() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 062/300] tools/power x86_energy_perf_policy: Enhance HWP enable Greg Kroah-Hartman
` (244 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kaushlendra Kumar, Len Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
[ Upstream commit 62127655b7ab7b8c2997041aca48a81bf5c6da0c ]
The fopen_or_die() function was previously hardcoded
to open files in read-only mode ("r"), ignoring the
mode parameter passed to it. This patch corrects
fopen_or_die() to use the provided mode argument,
allowing for flexible file access as intended.
Additionally, the call to fopen_or_die() in
err_on_hypervisor() incorrectly used the mode
"ro", which is not a valid fopen mode. This is
fixed to use the correct "r" mode.
Signed-off-by: Kaushlendra Kumar <kaushlendra.kumar@intel.com>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 1c80aa498d543..60917e32ec853 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -627,7 +627,7 @@ void cmdline(int argc, char **argv)
*/
FILE *fopen_or_die(const char *path, const char *mode)
{
- FILE *filep = fopen(path, "r");
+ FILE *filep = fopen(path, mode);
if (!filep)
err(1, "%s: open failed", path);
@@ -641,7 +641,7 @@ void err_on_hypervisor(void)
char *buffer;
/* On VMs /proc/cpuinfo contains a "flags" entry for hypervisor */
- cpuinfo = fopen_or_die("/proc/cpuinfo", "ro");
+ cpuinfo = fopen_or_die("/proc/cpuinfo", "r");
buffer = malloc(4096);
if (!buffer) {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 062/300] tools/power x86_energy_perf_policy: Enhance HWP enable
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 061/300] tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 063/300] tools/power x86_energy_perf_policy: Prefer driver HWP limits Greg Kroah-Hartman
` (243 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Len Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <len.brown@intel.com>
[ Upstream commit c97c057d357c4b39b153e9e430bbf8976e05bd4e ]
On enabling HWP, preserve the reserved bits in MSR_PM_ENABLE.
Also, skip writing the MSR_PM_ENABLE if HWP is already enabled.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 60917e32ec853..5c93546fc689b 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -1077,13 +1077,18 @@ int update_hwp_request_pkg(int pkg)
int enable_hwp_on_cpu(int cpu)
{
- unsigned long long msr;
+ unsigned long long old_msr, new_msr;
+
+ get_msr(cpu, MSR_PM_ENABLE, &old_msr);
+
+ if (old_msr & 1)
+ return 0; /* already enabled */
- get_msr(cpu, MSR_PM_ENABLE, &msr);
- put_msr(cpu, MSR_PM_ENABLE, 1);
+ new_msr = old_msr | 1;
+ put_msr(cpu, MSR_PM_ENABLE, new_msr);
if (verbose)
- printf("cpu%d: MSR_PM_ENABLE old: %d new: %d\n", cpu, (unsigned int) msr, 1);
+ printf("cpu%d: MSR_PM_ENABLE old: %llX new: %llX\n", cpu, old_msr, new_msr);
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 063/300] tools/power x86_energy_perf_policy: Prefer driver HWP limits
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 062/300] tools/power x86_energy_perf_policy: Enhance HWP enable Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 064/300] mfd: stmpe: Remove IRQ domain upon removal Greg Kroah-Hartman
` (242 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Len Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Len Brown <len.brown@intel.com>
[ Upstream commit 2734fdbc9bb8a3aeb309ba0d62212d7f53f30bc7 ]
When we are successful in using cpufreq min/max limits,
skip setting the raw MSR limits entirely.
This is necessary to avoid undoing any modification that
the cpufreq driver makes to our sysfs request.
eg. intel_pstate may take our request for a limit
that is valid according to HWP.CAP.MIN/MAX and clip
it to be within the range available in PLATFORM_INFO.
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../x86_energy_perf_policy/x86_energy_perf_policy.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
index 5c93546fc689b..702b5882cfce4 100644
--- a/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
+++ b/tools/power/x86/x86_energy_perf_policy/x86_energy_perf_policy.c
@@ -62,6 +62,7 @@ unsigned char turbo_update_value;
unsigned char update_hwp_epp;
unsigned char update_hwp_min;
unsigned char update_hwp_max;
+unsigned char hwp_limits_done_via_sysfs;
unsigned char update_hwp_desired;
unsigned char update_hwp_window;
unsigned char update_hwp_use_pkg;
@@ -862,8 +863,10 @@ int ratio_2_sysfs_khz(int ratio)
}
/*
* If HWP is enabled and cpufreq sysfs attribtes are present,
- * then update sysfs, so that it will not become
- * stale when we write to MSRs.
+ * then update via sysfs. The intel_pstate driver may modify (clip)
+ * this request, say, when HWP_CAP is outside of PLATFORM_INFO limits,
+ * and the driver-chosen value takes precidence.
+ *
* (intel_pstate's max_perf_pct and min_perf_pct will follow cpufreq,
* so we don't have to touch that.)
*/
@@ -918,6 +921,8 @@ int update_sysfs(int cpu)
if (update_hwp_max)
update_cpufreq_scaling_freq(1, cpu, req_update.hwp_max);
+ hwp_limits_done_via_sysfs = 1;
+
return 0;
}
@@ -996,10 +1001,10 @@ int update_hwp_request(int cpu)
if (debug)
print_hwp_request(cpu, &req, "old: ");
- if (update_hwp_min)
+ if (update_hwp_min && !hwp_limits_done_via_sysfs)
req.hwp_min = req_update.hwp_min;
- if (update_hwp_max)
+ if (update_hwp_max && !hwp_limits_done_via_sysfs)
req.hwp_max = req_update.hwp_max;
if (update_hwp_desired)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 064/300] mfd: stmpe: Remove IRQ domain upon removal
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 063/300] tools/power x86_energy_perf_policy: Prefer driver HWP limits Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 065/300] mfd: stmpe-i2c: Add missing MODULE_LICENSE Greg Kroah-Hartman
` (241 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Stein, Lee Jones,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 57bf2a312ab2d0bc8ee0f4e8a447fa94a2fc877d ]
The IRQ domain is (optionally) added during stmpe_probe, but never removed.
Add the call to stmpe_remove.
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20250725070752.338376-1-alexander.stein@ew.tq-group.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmpe.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/mfd/stmpe.c b/drivers/mfd/stmpe.c
index 7f758fb60c1fa..70ca3fe4e99ee 100644
--- a/drivers/mfd/stmpe.c
+++ b/drivers/mfd/stmpe.c
@@ -1494,6 +1494,9 @@ int stmpe_probe(struct stmpe_client_info *ci, enum stmpe_partnum partnum)
int stmpe_remove(struct stmpe *stmpe)
{
+ if (stmpe->domain)
+ irq_domain_remove(stmpe->domain);
+
if (!IS_ERR(stmpe->vio) && regulator_is_enabled(stmpe->vio))
regulator_disable(stmpe->vio);
if (!IS_ERR(stmpe->vcc) && regulator_is_enabled(stmpe->vcc))
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 065/300] mfd: stmpe-i2c: Add missing MODULE_LICENSE
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 064/300] mfd: stmpe: Remove IRQ domain upon removal Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 066/300] mfd: madera: Work around false-positive -Wininitialized warning Greg Kroah-Hartman
` (240 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Stein, Lee Jones,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit 00ea54f058cd4cb082302fe598cfe148e0aadf94 ]
This driver is licensed GPL-2.0-only, so add the corresponding module flag.
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Link: https://lore.kernel.org/r/20250725071153.338912-3-alexander.stein@ew.tq-group.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/stmpe-i2c.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/mfd/stmpe-i2c.c b/drivers/mfd/stmpe-i2c.c
index cd2f45257dc16..d52bb3ea7fb6f 100644
--- a/drivers/mfd/stmpe-i2c.c
+++ b/drivers/mfd/stmpe-i2c.c
@@ -139,3 +139,4 @@ module_exit(stmpe_exit);
MODULE_LICENSE("GPL v2");
MODULE_DESCRIPTION("STMPE MFD I2C Interface Driver");
MODULE_AUTHOR("Rabin Vincent <rabin.vincent@stericsson.com>");
+MODULE_LICENSE("GPL");
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 066/300] mfd: madera: Work around false-positive -Wininitialized warning
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 065/300] mfd: stmpe-i2c: Add missing MODULE_LICENSE Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 067/300] mfd: da9063: Split chip variant reading in two bus transactions Greg Kroah-Hartman
` (239 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Richard Fitzgerald,
Lee Jones, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 364752aa0c6ab0a06a2d5bfdb362c1ca407f1a30 ]
clang-21 warns about one uninitialized variable getting dereferenced
in madera_dev_init:
drivers/mfd/madera-core.c:739:10: error: variable 'mfd_devs' is uninitialized when used here [-Werror,-Wuninitialized]
739 | mfd_devs, n_devs,
| ^~~~~~~~
drivers/mfd/madera-core.c:459:33: note: initialize the variable 'mfd_devs' to silence this warning
459 | const struct mfd_cell *mfd_devs;
| ^
| = NULL
The code is actually correct here because n_devs is only nonzero
when mfd_devs is a valid pointer, but this is impossible for the
compiler to see reliably.
Change the logic to check for the pointer as well, to make this easier
for the compiler to follow.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20250807071932.4085458-1-arnd@kernel.org
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/madera-core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mfd/madera-core.c b/drivers/mfd/madera-core.c
index 4ed6ad8ce0020..e3b7048de0c66 100644
--- a/drivers/mfd/madera-core.c
+++ b/drivers/mfd/madera-core.c
@@ -436,7 +436,7 @@ int madera_dev_init(struct madera *madera)
struct device *dev = madera->dev;
unsigned int hwid;
int (*patch_fn)(struct madera *) = NULL;
- const struct mfd_cell *mfd_devs;
+ const struct mfd_cell *mfd_devs = NULL;
int n_devs = 0;
int i, ret;
@@ -642,7 +642,7 @@ int madera_dev_init(struct madera *madera)
goto err_reset;
}
- if (!n_devs) {
+ if (!n_devs || !mfd_devs) {
dev_err(madera->dev, "Device ID 0x%x not a %s\n", hwid,
madera->type_name);
ret = -ENODEV;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 067/300] mfd: da9063: Split chip variant reading in two bus transactions
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 066/300] mfd: madera: Work around false-positive -Wininitialized warning Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 068/300] drm/amd/pm: Use cached metrics data on arcturus Greg Kroah-Hartman
` (238 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Kehne, Lee Jones, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Kehne <jens.kehne@agilent.com>
[ Upstream commit 9ac4890ac39352ccea132109e32911495574c3ec ]
We observed the initial probe of the da9063 failing in
da9063_get_device_type in about 30% of boots on a Xilinx ZynqMP based
board. The problem originates in da9063_i2c_blockreg_read, which uses
a single bus transaction to turn the register page and then read a
register. On the bus, this should translate to a write to register 0,
followed by a read to the target register, separated by a repeated
start. However, we found that after the write to register 0, the
controller sometimes continues directly with the register address of
the read request, without sending the chip address or a repeated start
in between, which makes the read request invalid.
To fix this, separate turning the page and reading the register into
two separate transactions. This brings the initialization code in line
with the rest of the driver, which uses register maps (which to my
knowledge do not use repeated starts after turning the page). This has
been included in our kernel for several months and was recently
included in a shipped product. For us, it reliably fixes the issue,
and we have not observed any new issues.
While the underlying problem is probably with the i2c controller or
its driver, I still propose a change here in the interest of
robustness: First, I'm not sure this issue can be fixed on the
controller side, since there are other issues related to repeated
start which can't (AR# 60695, AR# 61664). Second, similar problems
might exist with other controllers.
Signed-off-by: Jens Kehne <jens.kehne@agilent.com>
Link: https://lore.kernel.org/r/20250804133754.3496718-1-jens.kehne@agilent.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/da9063-i2c.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
diff --git a/drivers/mfd/da9063-i2c.c b/drivers/mfd/da9063-i2c.c
index 3419814d016b5..6e6a466c7d8c9 100644
--- a/drivers/mfd/da9063-i2c.c
+++ b/drivers/mfd/da9063-i2c.c
@@ -37,9 +37,13 @@ enum da9063_page_sel_buf_fmt {
DA9063_PAGE_SEL_BUF_SIZE,
};
+enum da9063_page_sel_msgs {
+ DA9063_PAGE_SEL_MSG = 0,
+ DA9063_PAGE_SEL_CNT,
+};
+
enum da9063_paged_read_msgs {
- DA9063_PAGED_READ_MSG_PAGE_SEL = 0,
- DA9063_PAGED_READ_MSG_REG_SEL,
+ DA9063_PAGED_READ_MSG_REG_SEL = 0,
DA9063_PAGED_READ_MSG_DATA,
DA9063_PAGED_READ_MSG_CNT,
};
@@ -65,10 +69,21 @@ static int da9063_i2c_blockreg_read(struct i2c_client *client, u16 addr,
(page_num << DA9063_I2C_PAGE_SEL_SHIFT) & DA9063_REG_PAGE_MASK;
/* Write reg address, page selection */
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].addr = client->addr;
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].flags = 0;
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].len = DA9063_PAGE_SEL_BUF_SIZE;
- xfer[DA9063_PAGED_READ_MSG_PAGE_SEL].buf = page_sel_buf;
+ xfer[DA9063_PAGE_SEL_MSG].addr = client->addr;
+ xfer[DA9063_PAGE_SEL_MSG].flags = 0;
+ xfer[DA9063_PAGE_SEL_MSG].len = DA9063_PAGE_SEL_BUF_SIZE;
+ xfer[DA9063_PAGE_SEL_MSG].buf = page_sel_buf;
+
+ ret = i2c_transfer(client->adapter, xfer, DA9063_PAGE_SEL_CNT);
+ if (ret < 0) {
+ dev_err(&client->dev, "Page switch failed: %d\n", ret);
+ return ret;
+ }
+
+ if (ret != DA9063_PAGE_SEL_CNT) {
+ dev_err(&client->dev, "Page switch failed to complete\n");
+ return -EIO;
+ }
/* Select register address */
xfer[DA9063_PAGED_READ_MSG_REG_SEL].addr = client->addr;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 068/300] drm/amd/pm: Use cached metrics data on arcturus
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 067/300] mfd: da9063: Split chip variant reading in two bus transactions Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 069/300] drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff Greg Kroah-Hartman
` (237 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Asad Kamal, Alex Deucher,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
[ Upstream commit 2f3b1ccf83be83a3330e38194ddfd1a91fec69be ]
Cached metrics data validity is 1ms on arcturus. It's not reasonable for
any client to query gpu_metrics at a faster rate and constantly
interrupt PMFW.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Asad Kamal <asad.kamal@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
index 3a31058b029e3..729f6d60fac0a 100644
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -2276,7 +2276,7 @@ static ssize_t arcturus_get_gpu_metrics(struct smu_context *smu,
ret = smu_cmn_get_metrics_table(smu,
&metrics,
- true);
+ false);
if (ret)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 069/300] drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 068/300] drm/amd/pm: Use cached metrics data on arcturus Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 070/300] drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() Greg Kroah-Hartman
` (236 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sathishkumar S, Leo Liu,
Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sathishkumar S <sathishkumar.sundararaju@amd.com>
[ Upstream commit 0e7581eda8c76d1ca4cf519631a4d4eb9f82b94c ]
Acquire jpeg_pg_lock before changes to jpeg power state
and release it after power off from idle work handler.
Signed-off-by: Sathishkumar S <sathishkumar.sundararaju@amd.com>
Reviewed-by: Leo Liu <leo.liu@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
index 8996cb4ed57a8..1341a7f866cd2 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c
@@ -87,10 +87,12 @@ static void amdgpu_jpeg_idle_work_handler(struct work_struct *work)
fences += amdgpu_fence_count_emitted(&adev->jpeg.inst[i].ring_dec);
}
- if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt))
+ if (!fences && !atomic_read(&adev->jpeg.total_submission_cnt)) {
+ mutex_lock(&adev->jpeg.jpeg_pg_lock);
amdgpu_device_ip_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_JPEG,
AMD_PG_STATE_GATE);
- else
+ mutex_unlock(&adev->jpeg.jpeg_pg_lock);
+ } else
schedule_delayed_work(&adev->jpeg.idle_work, JPEG_IDLE_TIMEOUT);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 070/300] drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 069/300] drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 071/300] PCI: Disable MSI on RDC PCI to PCIe bridges Greg Kroah-Hartman
` (235 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seyediman Seyedarab,
Danilo Krummrich, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seyediman Seyedarab <imandevel@gmail.com>
[ Upstream commit 6510b62fe9303aaf48ff136ff69186bcfc32172d ]
snprintf() returns the number of characters that *would* have been
written, which can overestimate how much you actually wrote to the
buffer in case of truncation. That leads to 'data += this' advancing
the pointer past the end of the buffer and size going negative.
Switching to scnprintf() prevents potential buffer overflows and ensures
consistent behavior when building the output string.
Signed-off-by: Seyediman Seyedarab <ImanDevel@gmail.com>
Link: https://lore.kernel.org/r/20250724195913.60742-1-ImanDevel@gmail.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/core/enum.c b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
index b9581feb24ccb..a23b40b27b81b 100644
--- a/drivers/gpu/drm/nouveau/nvkm/core/enum.c
+++ b/drivers/gpu/drm/nouveau/nvkm/core/enum.c
@@ -44,7 +44,7 @@ nvkm_snprintbf(char *data, int size, const struct nvkm_bitfield *bf, u32 value)
bool space = false;
while (size >= 1 && bf->name) {
if (value & bf->mask) {
- int this = snprintf(data, size, "%s%s",
+ int this = scnprintf(data, size, "%s%s",
space ? " " : "", bf->name);
size -= this;
data += this;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 071/300] PCI: Disable MSI on RDC PCI to PCIe bridges
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 070/300] drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 072/300] selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 Greg Kroah-Hartman
` (234 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marcos Del Sol Vives, Bjorn Helgaas,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marcos Del Sol Vives <marcos@orca.pet>
[ Upstream commit ebc7086b39e5e4f3d3ca82caaea20538c9b62d42 ]
RDC PCI to PCIe bridges, present on Vortex86DX3 and Vortex86EX2 SoCs, do
not support MSIs. If enabled, interrupts generated by PCIe devices never
reach the processor.
I have contacted the manufacturer (DM&P) and they confirmed that PCI MSIs
need to be disabled for them.
Signed-off-by: Marcos Del Sol Vives <marcos@orca.pet>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/20250705233209.721507-1-marcos@orca.pet
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/quirks.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
index 7d9f048ed18f8..ac355ae17bfee 100644
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -2554,6 +2554,7 @@ static void quirk_disable_msi(struct pci_dev *dev)
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_8131_BRIDGE, quirk_disable_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_VIA, 0xa238, quirk_disable_msi);
DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_ATI, 0x5a3f, quirk_disable_msi);
+DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_RDC, 0x1031, quirk_disable_msi);
/*
* The APC bridge device in AMD 780 family northbridges has some random
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 072/300] selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 071/300] PCI: Disable MSI on RDC PCI to PCIe bridges Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 073/300] selftests/net: Ensure assert() triggers in psock_tpacket.c Greg Kroah-Hartman
` (233 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wake Liu, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <wakel@google.com>
[ Upstream commit c36748e8733ef9c5f4cd1d7c4327994e5b88b8df ]
The `__WORDSIZE` macro, defined in the non-standard `<bits/wordsize.h>`
header, is a GNU extension and not universally available with all
toolchains, such as Clang when used with musl libc.
This can lead to build failures in environments where this header is
missing.
The intention of the code is to determine the bit width of a C `long`.
Replace the non-portable `__WORDSIZE` with the standard and portable
`sizeof(long) * 8` expression to achieve the same result.
This change also removes the inclusion of the now-unused
`<bits/wordsize.h>` header.
Signed-off-by: Wake Liu <wakel@google.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/psock_tpacket.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
index 404a2ce759ab6..93092d13b3c59 100644
--- a/tools/testing/selftests/net/psock_tpacket.c
+++ b/tools/testing/selftests/net/psock_tpacket.c
@@ -33,7 +33,6 @@
#include <ctype.h>
#include <fcntl.h>
#include <unistd.h>
-#include <bits/wordsize.h>
#include <net/ethernet.h>
#include <netinet/ip.h>
#include <arpa/inet.h>
@@ -785,7 +784,7 @@ static int test_kernel_bit_width(void)
static int test_user_bit_width(void)
{
- return __WORDSIZE;
+ return sizeof(long) * 8;
}
static const char *tpacket_str[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 073/300] selftests/net: Ensure assert() triggers in psock_tpacket.c
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 072/300] selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8 Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 074/300] drm/amdkfd: return -ENOTTY for unsupported IOCTLs Greg Kroah-Hartman
` (232 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wake Liu, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wake Liu <wakel@google.com>
[ Upstream commit bc4c0a48bdad7f225740b8e750fdc1da6d85e1eb ]
The get_next_frame() function in psock_tpacket.c was missing a return
statement in its default switch case, leading to a compiler warning.
This was caused by a `bug_on(1)` call, which is defined as an
`assert()`, being compiled out because NDEBUG is defined during the
build.
Instead of adding a `return NULL;` which would silently hide the error
and could lead to crashes later, this change restores the original
author's intent. By adding `#undef NDEBUG` before including <assert.h>,
we ensure the assertion is active and will cause the test to abort if
this unreachable code is ever executed.
Signed-off-by: Wake Liu <wakel@google.com>
Link: https://patch.msgid.link/20250809062013.2407822-1-wakel@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/psock_tpacket.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/testing/selftests/net/psock_tpacket.c b/tools/testing/selftests/net/psock_tpacket.c
index 93092d13b3c59..ca0d9a5a9e08c 100644
--- a/tools/testing/selftests/net/psock_tpacket.c
+++ b/tools/testing/selftests/net/psock_tpacket.c
@@ -22,6 +22,7 @@
* - TPACKET_V3: RX_RING
*/
+#undef NDEBUG
#include <stdio.h>
#include <stdlib.h>
#include <sys/types.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 074/300] drm/amdkfd: return -ENOTTY for unsupported IOCTLs
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 073/300] selftests/net: Ensure assert() triggers in psock_tpacket.c Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 075/300] media: pci: ivtv: Dont create fake v4l2_fh Greg Kroah-Hartman
` (231 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey McRae, Alex Deucher,
Felix Kuehling, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey McRae <geoffrey.mcrae@amd.com>
[ Upstream commit 57af162bfc8c05332a28c4d458d246cc46d2746d ]
Some kfd ioctls may not be available depending on the kernel version the
user is running, as such we need to report -ENOTTY so userland can
determine the cause of the ioctl failure.
Signed-off-by: Geoffrey McRae <geoffrey.mcrae@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Felix Kuehling <felix.kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
index 869c8786df5c9..04367ae4b425d 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c
@@ -1887,8 +1887,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
unsigned int usize, asize;
int retcode = -EINVAL;
- if (nr >= AMDKFD_CORE_IOCTL_COUNT)
+ if (nr >= AMDKFD_CORE_IOCTL_COUNT) {
+ retcode = -ENOTTY;
goto err_i1;
+ }
if ((nr >= AMDKFD_COMMAND_START) && (nr < AMDKFD_COMMAND_END)) {
u32 amdkfd_size;
@@ -1901,8 +1903,10 @@ static long kfd_ioctl(struct file *filep, unsigned int cmd, unsigned long arg)
asize = amdkfd_size;
cmd = ioctl->cmd;
- } else
+ } else {
+ retcode = -ENOTTY;
goto err_i1;
+ }
dev_dbg(kfd_device, "ioctl cmd 0x%x (#0x%x), arg 0x%lx\n", cmd, nr, arg);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 075/300] media: pci: ivtv: Dont create fake v4l2_fh
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 074/300] drm/amdkfd: return -ENOTTY for unsupported IOCTLs Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 076/300] drm/tidss: Use the crtc_* timings when programming the HW Greg Kroah-Hartman
` (230 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Hans Verkuil,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
[ Upstream commit cc6e8d1ccea792d8550428e0831e3a35b0ccfddc ]
The ivtv driver has a structure named ivtv_open_id that models an open
file handle for the device. It embeds a v4l2_fh instance for file
handles that correspond to a V4L2 video device, and stores a pointer to
that v4l2_fh in struct ivtv_stream to identify which open file handle
owns a particular stream.
In addition to video devices, streams can be owned by ALSA PCM devices.
Those devices do not make use of the v4l2_fh instance for obvious
reasons, but the snd_ivtv_pcm_capture_open() function still initializes
a "fake" v4l2_fh for the sole purpose of using it as an open file handle
identifier. The v4l2_fh is not properly destroyed when the ALSA PCM
device is closed, leading to possible resource leaks.
Fortunately, the v4l2_fh instance pointed to by ivtv_stream is not
accessed, only the pointer value is used for comparison. Replace it with
a pointer to the ivtv_open_id structure that embeds the v4l2_fh, and
don't initialize the v4l2_fh for ALSA PCM devices.
Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 --
drivers/media/pci/ivtv/ivtv-driver.h | 3 ++-
drivers/media/pci/ivtv/ivtv-fileops.c | 18 +++++++++---------
drivers/media/pci/ivtv/ivtv-irq.c | 4 ++--
4 files changed, 13 insertions(+), 14 deletions(-)
diff --git a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
index 8f346d7da9c8d..269a799ec046c 100644
--- a/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
+++ b/drivers/media/pci/ivtv/ivtv-alsa-pcm.c
@@ -148,14 +148,12 @@ static int snd_ivtv_pcm_capture_open(struct snd_pcm_substream *substream)
s = &itv->streams[IVTV_ENC_STREAM_TYPE_PCM];
- v4l2_fh_init(&item.fh, &s->vdev);
item.itv = itv;
item.type = s->type;
/* See if the stream is available */
if (ivtv_claim_stream(&item, item.type)) {
/* No, it's already in use */
- v4l2_fh_exit(&item.fh);
snd_ivtv_unlock(itvsc);
return -EBUSY;
}
diff --git a/drivers/media/pci/ivtv/ivtv-driver.h b/drivers/media/pci/ivtv/ivtv-driver.h
index 00caf60ff9890..7c3fc594cee56 100644
--- a/drivers/media/pci/ivtv/ivtv-driver.h
+++ b/drivers/media/pci/ivtv/ivtv-driver.h
@@ -324,6 +324,7 @@ struct ivtv_queue {
};
struct ivtv; /* forward reference */
+struct ivtv_open_id;
struct ivtv_stream {
/* These first four fields are always set, even if the stream
@@ -333,7 +334,7 @@ struct ivtv_stream {
const char *name; /* name of the stream */
int type; /* stream type */
- struct v4l2_fh *fh; /* pointer to the streaming filehandle */
+ struct ivtv_open_id *id; /* pointer to the streaming ivtv_open_id */
spinlock_t qlock; /* locks access to the queues */
unsigned long s_flags; /* status flags, see above */
int dma; /* can be PCI_DMA_TODEVICE, PCI_DMA_FROMDEVICE or PCI_DMA_NONE */
diff --git a/drivers/media/pci/ivtv/ivtv-fileops.c b/drivers/media/pci/ivtv/ivtv-fileops.c
index 4202c3a47d33e..7ed0d2d85253e 100644
--- a/drivers/media/pci/ivtv/ivtv-fileops.c
+++ b/drivers/media/pci/ivtv/ivtv-fileops.c
@@ -38,16 +38,16 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
if (test_and_set_bit(IVTV_F_S_CLAIMED, &s->s_flags)) {
/* someone already claimed this stream */
- if (s->fh == &id->fh) {
+ if (s->id == id) {
/* yes, this file descriptor did. So that's OK. */
return 0;
}
- if (s->fh == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
+ if (s->id == NULL && (type == IVTV_DEC_STREAM_TYPE_VBI ||
type == IVTV_ENC_STREAM_TYPE_VBI)) {
/* VBI is handled already internally, now also assign
the file descriptor to this stream for external
reading of the stream. */
- s->fh = &id->fh;
+ s->id = id;
IVTV_DEBUG_INFO("Start Read VBI\n");
return 0;
}
@@ -55,7 +55,7 @@ int ivtv_claim_stream(struct ivtv_open_id *id, int type)
IVTV_DEBUG_INFO("Stream %d is busy\n", type);
return -EBUSY;
}
- s->fh = &id->fh;
+ s->id = id;
if (type == IVTV_DEC_STREAM_TYPE_VBI) {
/* Enable reinsertion interrupt */
ivtv_clear_irq_mask(itv, IVTV_IRQ_DEC_VBI_RE_INSERT);
@@ -93,7 +93,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
struct ivtv *itv = s->itv;
struct ivtv_stream *s_vbi;
- s->fh = NULL;
+ s->id = NULL;
if ((s->type == IVTV_DEC_STREAM_TYPE_VBI || s->type == IVTV_ENC_STREAM_TYPE_VBI) &&
test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
/* this stream is still in use internally */
@@ -125,7 +125,7 @@ void ivtv_release_stream(struct ivtv_stream *s)
/* was already cleared */
return;
}
- if (s_vbi->fh) {
+ if (s_vbi->id) {
/* VBI stream still claimed by a file descriptor */
return;
}
@@ -349,7 +349,7 @@ static ssize_t ivtv_read(struct ivtv_stream *s, char __user *ubuf, size_t tot_co
size_t tot_written = 0;
int single_frame = 0;
- if (atomic_read(&itv->capturing) == 0 && s->fh == NULL) {
+ if (atomic_read(&itv->capturing) == 0 && s->id == NULL) {
/* shouldn't happen */
IVTV_DEBUG_WARN("Stream %s not initialized before read\n", s->name);
return -EIO;
@@ -819,7 +819,7 @@ void ivtv_stop_capture(struct ivtv_open_id *id, int gop_end)
id->type == IVTV_ENC_STREAM_TYPE_VBI) &&
test_bit(IVTV_F_S_INTERNAL_USE, &s->s_flags)) {
/* Also used internally, don't stop capturing */
- s->fh = NULL;
+ s->id = NULL;
}
else {
ivtv_stop_v4l2_encode_stream(s, gop_end);
@@ -903,7 +903,7 @@ int ivtv_v4l2_close(struct file *filp)
v4l2_fh_exit(fh);
/* Easy case first: this stream was never claimed by us */
- if (s->fh != &id->fh)
+ if (s->id != id)
goto close_done;
/* 'Unclaim' this stream */
diff --git a/drivers/media/pci/ivtv/ivtv-irq.c b/drivers/media/pci/ivtv/ivtv-irq.c
index e39bf64c5c715..404335e5aff4e 100644
--- a/drivers/media/pci/ivtv/ivtv-irq.c
+++ b/drivers/media/pci/ivtv/ivtv-irq.c
@@ -305,7 +305,7 @@ static void dma_post(struct ivtv_stream *s)
ivtv_process_vbi_data(itv, buf, 0, s->type);
s->q_dma.bytesused += buf->bytesused;
}
- if (s->fh == NULL) {
+ if (s->id == NULL) {
ivtv_queue_move(s, &s->q_dma, NULL, &s->q_free, 0);
return;
}
@@ -330,7 +330,7 @@ static void dma_post(struct ivtv_stream *s)
set_bit(IVTV_F_I_HAVE_WORK, &itv->i_flags);
}
- if (s->fh)
+ if (s->id)
wake_up(&s->waitq);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 076/300] drm/tidss: Use the crtc_* timings when programming the HW
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 075/300] media: pci: ivtv: Dont create fake v4l2_fh Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 077/300] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall Greg Kroah-Hartman
` (229 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aradhya Bhatia, Parth Pancholi,
Jayesh Choudhary, Devarsh Thakkar, Tomi Valkeinen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit 478306edc23eec4f0ec24a46222485910c66212d ]
Use the crtc_* fields from drm_display_mode, instead of the "logical"
fields. This shouldn't change anything in practice, but afaiu the crtc_*
fields are the correct ones to use here.
Reviewed-by: Aradhya Bhatia <aradhya.bhatia@linux.dev>
Tested-by: Parth Pancholi <parth.pancholi@toradex.com>
Tested-by: Jayesh Choudhary <j-choudhary@ti.com>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Link: https://lore.kernel.org/r/20250723-cdns-dsi-impro-v5-3-e61cc06074c2@ideasonboard.com
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_crtc.c | 2 +-
drivers/gpu/drm/tidss/tidss_dispc.c | 16 ++++++++--------
2 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_crtc.c b/drivers/gpu/drm/tidss/tidss_crtc.c
index 26fd2761e80db..d39c865e126bd 100644
--- a/drivers/gpu/drm/tidss/tidss_crtc.c
+++ b/drivers/gpu/drm/tidss/tidss_crtc.c
@@ -226,7 +226,7 @@ static void tidss_crtc_atomic_enable(struct drm_crtc *crtc,
tidss_runtime_get(tidss);
r = dispc_vp_set_clk_rate(tidss->dispc, tcrtc->hw_videoport,
- mode->clock * 1000);
+ mode->crtc_clock * 1000);
if (r != 0)
return;
diff --git a/drivers/gpu/drm/tidss/tidss_dispc.c b/drivers/gpu/drm/tidss/tidss_dispc.c
index b1093dc1b79a2..14bf95d901ada 100644
--- a/drivers/gpu/drm/tidss/tidss_dispc.c
+++ b/drivers/gpu/drm/tidss/tidss_dispc.c
@@ -978,13 +978,13 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
dispc_set_num_datalines(dispc, hw_videoport, fmt->data_width);
- hfp = mode->hsync_start - mode->hdisplay;
- hsw = mode->hsync_end - mode->hsync_start;
- hbp = mode->htotal - mode->hsync_end;
+ hfp = mode->crtc_hsync_start - mode->crtc_hdisplay;
+ hsw = mode->crtc_hsync_end - mode->crtc_hsync_start;
+ hbp = mode->crtc_htotal - mode->crtc_hsync_end;
- vfp = mode->vsync_start - mode->vdisplay;
- vsw = mode->vsync_end - mode->vsync_start;
- vbp = mode->vtotal - mode->vsync_end;
+ vfp = mode->crtc_vsync_start - mode->crtc_vdisplay;
+ vsw = mode->crtc_vsync_end - mode->crtc_vsync_start;
+ vbp = mode->crtc_vtotal - mode->crtc_vsync_end;
dispc_vp_write(dispc, hw_videoport, DISPC_VP_TIMING_H,
FLD_VAL(hsw - 1, 7, 0) |
@@ -1026,8 +1026,8 @@ void dispc_vp_enable(struct dispc_device *dispc, u32 hw_videoport,
FLD_VAL(ivs, 12, 12));
dispc_vp_write(dispc, hw_videoport, DISPC_VP_SIZE_SCREEN,
- FLD_VAL(mode->hdisplay - 1, 11, 0) |
- FLD_VAL(mode->vdisplay - 1, 27, 16));
+ FLD_VAL(mode->crtc_hdisplay - 1, 11, 0) |
+ FLD_VAL(mode->crtc_vdisplay - 1, 27, 16));
VP_REG_FLD_MOD(dispc, hw_videoport, DISPC_VP_CONTROL, 1, 0, 0);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 077/300] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 076/300] drm/tidss: Use the crtc_* timings when programming the HW Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 078/300] net: stmmac: Check stmmac_hw_setup() in stmmac_resume() Greg Kroah-Hartman
` (228 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Cooper, Kirill A. Shutemov,
Dave Hansen, Sasha Levin, Dave Hansen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
[ Upstream commit 8ba38a7a9a699905b84fa97578a8291010dec273 ]
emulate_vsyscall() expects to see X86_PF_INSTR in PFEC on a vsyscall
page fault, but the CPU does not report X86_PF_INSTR if neither
X86_FEATURE_NX nor X86_FEATURE_SMEP are enabled.
X86_FEATURE_NX should be enabled on nearly all 64-bit CPUs, except for
early P4 processors that did not support this feature.
Instead of explicitly checking for X86_PF_INSTR, compare the fault
address to RIP.
On machines with X86_FEATURE_NX enabled, issue a warning if RIP is equal
to fault address but X86_PF_INSTR is absent.
[ dhansen: flesh out code comments ]
Originally-by: Dave Hansen <dave.hansen@intel.com>
Reported-by: Andrew Cooper <andrew.cooper3@citrix.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Link: https://lore.kernel.org/all/bd81a98b-f8d4-4304-ac55-d4151a1a77ab@intel.com
Link: https://lore.kernel.org/all/20250624145918.2720487-1-kirill.shutemov%40linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index f0b817eb6e8ba..3e60a355dd5ad 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -124,7 +124,12 @@ bool emulate_vsyscall(unsigned long error_code,
if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER)
return false;
- if (!(error_code & X86_PF_INSTR)) {
+ /*
+ * Assume that faults at regs->ip are because of an
+ * instruction fetch. Return early and avoid
+ * emulation for faults during data accesses:
+ */
+ if (address != regs->ip) {
/* Failed vsyscall read */
if (vsyscall_mode == EMULATE)
return false;
@@ -136,13 +141,19 @@ bool emulate_vsyscall(unsigned long error_code,
return false;
}
+ /*
+ * X86_PF_INSTR is only set when NX is supported. When
+ * available, use it to double-check that the emulation code
+ * is only being used for instruction fetches:
+ */
+ if (cpu_feature_enabled(X86_FEATURE_NX))
+ WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
+
/*
* No point in checking CS -- the only way to get here is a user mode
* trap to a high address, which means that we're in 64-bit user code.
*/
- WARN_ON_ONCE(address != regs->ip);
-
if (vsyscall_mode == NONE) {
warn_bad_vsyscall(KERN_INFO, regs,
"vsyscall attempted with vsyscall=none");
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 078/300] net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 077/300] x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 079/300] powerpc/eeh: Use result of error_detected() in uevent Greg Kroah-Hartman
` (227 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tiezhu Yang, Maxime Chevallier,
Huacai Chen, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiezhu Yang <yangtiezhu@loongson.cn>
[ Upstream commit 6896c2449a1858acb643014894d01b3a1223d4e5 ]
stmmac_hw_setup() may return 0 on success and an appropriate negative
integer as defined in errno.h file on failure, just check it and then
return early if failed in stmmac_resume().
Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Huacai Chen <chenhuacai@loongson.cn>
Link: https://patch.msgid.link/20250811073506.27513-2-yangtiezhu@loongson.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index e6fa2782d28f2..ac278d81f1614 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -5415,7 +5415,14 @@ int stmmac_resume(struct device *dev)
stmmac_free_tx_skbufs(priv);
stmmac_clear_descriptors(priv);
- stmmac_hw_setup(ndev, false);
+ ret = stmmac_hw_setup(ndev, false);
+ if (ret < 0) {
+ netdev_err(priv->dev, "%s: Hw setup failed\n", __func__);
+ mutex_unlock(&priv->lock);
+ rtnl_unlock();
+ return ret;
+ }
+
stmmac_init_coalesce(priv);
stmmac_set_rx_mode(ndev);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 079/300] powerpc/eeh: Use result of error_detected() in uevent
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 078/300] net: stmmac: Check stmmac_hw_setup() in stmmac_resume() Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 080/300] bridge: Redirect to backup port when port is administratively down Greg Kroah-Hartman
` (226 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lukas Wunner, Niklas Schnelle,
Bjorn Helgaas, Kuppuswamy Sathyanarayanan, Mahesh Salgaonkar,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit 704e5dd1c02371dfc7d22e1520102b197a3b628b ]
Ever since uevent support was added for AER and EEH with commit
856e1eb9bdd4 ("PCI/AER: Add uevents in AER and EEH error/resume"), it
reported PCI_ERS_RESULT_NONE as uevent when recovery begins.
Commit 7b42d97e99d3 ("PCI/ERR: Always report current recovery status for
udev") subsequently amended AER to report the actual return value of
error_detected().
Make the same change to EEH to align it with AER and s390.
Suggested-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/linux-pci/aIp6LiKJor9KLVpv@wunner.de/
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Reviewed-by: Kuppuswamy Sathyanarayanan <sathyanarayanan.kuppuswamy@linux.intel.com>
Acked-by: Mahesh Salgaonkar <mahesh@linux.ibm.com>
Link: https://patch.msgid.link/20250807-add_err_uevents-v5-3-adf85b0620b0@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/eeh_driver.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
index ed5be1bff60ca..2f13d906e1fcb 100644
--- a/arch/powerpc/kernel/eeh_driver.c
+++ b/arch/powerpc/kernel/eeh_driver.c
@@ -335,7 +335,7 @@ static enum pci_ers_result eeh_report_error(struct eeh_dev *edev,
rc = driver->err_handler->error_detected(pdev, pci_channel_io_frozen);
edev->in_error = true;
- pci_uevent_ers(pdev, PCI_ERS_RESULT_NONE);
+ pci_uevent_ers(pdev, rc);
return rc;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 080/300] bridge: Redirect to backup port when port is administratively down
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 079/300] powerpc/eeh: Use result of error_detected() in uevent Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 081/300] net: ipv6: fix field-spanning memcpy warning in AH output Greg Kroah-Hartman
` (225 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Machata, Ido Schimmel,
Nikolay Aleksandrov, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 3d05b24429e1de7a17c8fdccb04a04dbc8ad297b ]
If a backup port is configured for a bridge port, the bridge will
redirect known unicast traffic towards the backup port when the primary
port is administratively up but without a carrier. This is useful, for
example, in MLAG configurations where a system is connected to two
switches and there is a peer link between both switches. The peer link
serves as the backup port in case one of the switches loses its
connection to the multi-homed system.
In order to avoid flooding when the primary port loses its carrier, the
bridge does not flush dynamic FDB entries pointing to the port upon STP
disablement, if the port has a backup port.
The above means that known unicast traffic destined to the primary port
will be blackholed when the port is put administratively down, until the
FDB entries pointing to it are aged-out.
Given that the current behavior is quite weird and unlikely to be
depended on by anyone, amend the bridge to redirect to the backup port
also when the primary port is administratively down and not only when it
does not have a carrier.
The change is motivated by a report from a user who expected traffic to
be redirected to the backup port when the primary port was put
administratively down while debugging a network issue.
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250812080213.325298-2-idosch@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bridge/br_forward.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index ada03d49e7c1a..4db9a51438790 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -142,7 +142,8 @@ void br_forward(const struct net_bridge_port *to,
goto out;
/* redirect to backup link if the destination port is down */
- if (rcu_access_pointer(to->backup_port) && !netif_carrier_ok(to->dev)) {
+ if (rcu_access_pointer(to->backup_port) &&
+ (!netif_carrier_ok(to->dev) || !netif_running(to->dev))) {
struct net_bridge_port *backup_port;
backup_port = rcu_dereference(to->backup_port);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 081/300] net: ipv6: fix field-spanning memcpy warning in AH output
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 080/300] bridge: Redirect to backup port when port is administratively down Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 082/300] media: imon: make send_packet() more robust Greg Kroah-Hartman
` (224 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+01b0667934cdceb4451c,
Charalampos Mitrodimas, Steffen Klassert, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charalampos Mitrodimas <charmitro@posteo.net>
[ Upstream commit 2327a3d6f65ce2fe2634546dde4a25ef52296fec ]
Fix field-spanning memcpy warnings in ah6_output() and
ah6_output_done() where extension headers are copied to/from IPv6
address fields, triggering fortify-string warnings about writes beyond
the 16-byte address fields.
memcpy: detected field-spanning write (size 40) of single field "&top_iph->saddr" at net/ipv6/ah6.c:439 (size 16)
WARNING: CPU: 0 PID: 8838 at net/ipv6/ah6.c:439 ah6_output+0xe7e/0x14e0 net/ipv6/ah6.c:439
The warnings are false positives as the extension headers are
intentionally placed after the IPv6 header in memory. Fix by properly
copying addresses and extension headers separately, and introduce
helper functions to avoid code duplication.
Reported-by: syzbot+01b0667934cdceb4451c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=01b0667934cdceb4451c
Signed-off-by: Charalampos Mitrodimas <charmitro@posteo.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ah6.c | 50 +++++++++++++++++++++++++++++++-------------------
1 file changed, 31 insertions(+), 19 deletions(-)
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 080ee7f44c649..4bc6767c7e139 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -46,6 +46,34 @@ struct ah_skb_cb {
#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+/* Helper to save IPv6 addresses and extension headers to temporary storage */
+static inline void ah6_save_hdrs(struct tmp_ext *iph_ext,
+ struct ipv6hdr *top_iph, int extlen)
+{
+ if (!extlen)
+ return;
+
+#if IS_ENABLED(CONFIG_IPV6_MIP6)
+ iph_ext->saddr = top_iph->saddr;
+#endif
+ iph_ext->daddr = top_iph->daddr;
+ memcpy(&iph_ext->hdrs, top_iph + 1, extlen - sizeof(*iph_ext));
+}
+
+/* Helper to restore IPv6 addresses and extension headers from temporary storage */
+static inline void ah6_restore_hdrs(struct ipv6hdr *top_iph,
+ struct tmp_ext *iph_ext, int extlen)
+{
+ if (!extlen)
+ return;
+
+#if IS_ENABLED(CONFIG_IPV6_MIP6)
+ top_iph->saddr = iph_ext->saddr;
+#endif
+ top_iph->daddr = iph_ext->daddr;
+ memcpy(top_iph + 1, &iph_ext->hdrs, extlen - sizeof(*iph_ext));
+}
+
static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
unsigned int size)
{
@@ -307,13 +335,7 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
- if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
- memcpy(&top_iph->saddr, iph_ext, extlen);
-#else
- memcpy(&top_iph->daddr, iph_ext, extlen);
-#endif
- }
+ ah6_restore_hdrs(top_iph, iph_ext, extlen);
kfree(AH_SKB_CB(skb)->tmp);
xfrm_output_resume(skb->sk, skb, err);
@@ -384,12 +406,8 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
*/
memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
+ ah6_save_hdrs(iph_ext, top_iph, extlen);
if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
- memcpy(iph_ext, &top_iph->saddr, extlen);
-#else
- memcpy(iph_ext, &top_iph->daddr, extlen);
-#endif
err = ipv6_clear_mutable_options(top_iph,
extlen - sizeof(*iph_ext) +
sizeof(*top_iph),
@@ -440,13 +458,7 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
- if (extlen) {
-#if IS_ENABLED(CONFIG_IPV6_MIP6)
- memcpy(&top_iph->saddr, iph_ext, extlen);
-#else
- memcpy(&top_iph->daddr, iph_ext, extlen);
-#endif
- }
+ ah6_restore_hdrs(top_iph, iph_ext, extlen);
out_free:
kfree(iph_base);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 082/300] media: imon: make send_packet() more robust
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 081/300] net: ipv6: fix field-spanning memcpy warning in AH output Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 083/300] drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts Greg Kroah-Hartman
` (223 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tetsuo Handa, Sean Young,
Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit eecd203ada43a4693ce6fdd3a58ae10c7819252c ]
syzbot is reporting that imon has three problems which result in
hung tasks due to forever holding device lock [1].
First problem is that when usb_rx_callback_intf0() once got -EPROTO error
after ictx->dev_present_intf0 became true, usb_rx_callback_intf0()
resubmits urb after printk(), and resubmitted urb causes
usb_rx_callback_intf0() to again get -EPROTO error. This results in
printk() flooding (RCU stalls).
Alan Stern commented [2] that
In theory it's okay to resubmit _if_ the driver has a robust
error-recovery scheme (such as giving up after some fixed limit on the
number of errors or after some fixed time has elapsed, perhaps with a
time delay to prevent a flood of errors). Most drivers don't bother to
do this; they simply give up right away. This makes them more
vulnerable to short-term noise interference during USB transfers, but in
reality such interference is quite rare. There's nothing really wrong
with giving up right away.
but imon has a poor error-recovery scheme which just retries forever;
this behavior should be fixed.
Since I'm not sure whether it is safe for imon users to give up upon any
error code, this patch takes care of only union of error codes chosen from
modules in drivers/media/rc/ directory which handle -EPROTO error (i.e.
ir_toy, mceusb and igorplugusb).
Second problem is that when usb_rx_callback_intf0() once got -EPROTO error
before ictx->dev_present_intf0 becomes true, usb_rx_callback_intf0() always
resubmits urb due to commit 8791d63af0cf ("[media] imon: don't wedge
hardware after early callbacks"). Move the ictx->dev_present_intf0 test
introduced by commit 6f6b90c9231a ("[media] imon: don't parse scancodes
until intf configured") to immediately before imon_incoming_packet(), or
the first problem explained above happens without printk() flooding (i.e.
hung task).
Third problem is that when usb_rx_callback_intf0() is not called for some
reason (e.g. flaky hardware; the reproducer for this problem sometimes
prevents usb_rx_callback_intf0() from being called),
wait_for_completion_interruptible() in send_packet() never returns (i.e.
hung task). As a workaround for such situation, change send_packet() to
wait for completion with timeout of 10 seconds.
Link: https://syzkaller.appspot.com/bug?extid=592e2ab8775dbe0bf09a [1]
Link: https://lkml.kernel.org/r/d6da6709-d799-4be3-a695-850bddd6eb24@rowland.harvard.edu [2]
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/imon.c | 61 +++++++++++++++++++++++++----------------
1 file changed, 37 insertions(+), 24 deletions(-)
diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
index 1de0fe3e58799..565826cff0db4 100644
--- a/drivers/media/rc/imon.c
+++ b/drivers/media/rc/imon.c
@@ -650,12 +650,15 @@ static int send_packet(struct imon_context *ictx)
smp_rmb(); /* ensure later readers know we're not busy */
pr_err_ratelimited("error submitting urb(%d)\n", retval);
} else {
- /* Wait for transmission to complete (or abort) */
- retval = wait_for_completion_interruptible(
- &ictx->tx.finished);
- if (retval) {
+ /* Wait for transmission to complete (or abort or timeout) */
+ retval = wait_for_completion_interruptible_timeout(&ictx->tx.finished, 10 * HZ);
+ if (retval <= 0) {
usb_kill_urb(ictx->tx_urb);
pr_err_ratelimited("task interrupted\n");
+ if (retval < 0)
+ ictx->tx.status = retval;
+ else
+ ictx->tx.status = -ETIMEDOUT;
}
ictx->tx.busy = false;
@@ -1759,14 +1762,6 @@ static void usb_rx_callback_intf0(struct urb *urb)
if (!ictx)
return;
- /*
- * if we get a callback before we're done configuring the hardware, we
- * can't yet process the data, as there's nowhere to send it, but we
- * still need to submit a new rx URB to avoid wedging the hardware
- */
- if (!ictx->dev_present_intf0)
- goto out;
-
switch (urb->status) {
case -ENOENT: /* usbcore unlink successful! */
return;
@@ -1775,16 +1770,29 @@ static void usb_rx_callback_intf0(struct urb *urb)
break;
case 0:
- imon_incoming_packet(ictx, urb, intfnum);
+ /*
+ * if we get a callback before we're done configuring the hardware, we
+ * can't yet process the data, as there's nowhere to send it, but we
+ * still need to submit a new rx URB to avoid wedging the hardware
+ */
+ if (ictx->dev_present_intf0)
+ imon_incoming_packet(ictx, urb, intfnum);
break;
+ case -ECONNRESET:
+ case -EILSEQ:
+ case -EPROTO:
+ case -EPIPE:
+ dev_warn(ictx->dev, "imon %s: status(%d)\n",
+ __func__, urb->status);
+ return;
+
default:
dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
__func__, urb->status);
break;
}
-out:
usb_submit_urb(ictx->rx_urb_intf0, GFP_ATOMIC);
}
@@ -1800,14 +1808,6 @@ static void usb_rx_callback_intf1(struct urb *urb)
if (!ictx)
return;
- /*
- * if we get a callback before we're done configuring the hardware, we
- * can't yet process the data, as there's nowhere to send it, but we
- * still need to submit a new rx URB to avoid wedging the hardware
- */
- if (!ictx->dev_present_intf1)
- goto out;
-
switch (urb->status) {
case -ENOENT: /* usbcore unlink successful! */
return;
@@ -1816,16 +1816,29 @@ static void usb_rx_callback_intf1(struct urb *urb)
break;
case 0:
- imon_incoming_packet(ictx, urb, intfnum);
+ /*
+ * if we get a callback before we're done configuring the hardware, we
+ * can't yet process the data, as there's nowhere to send it, but we
+ * still need to submit a new rx URB to avoid wedging the hardware
+ */
+ if (ictx->dev_present_intf1)
+ imon_incoming_packet(ictx, urb, intfnum);
break;
+ case -ECONNRESET:
+ case -EILSEQ:
+ case -EPROTO:
+ case -EPIPE:
+ dev_warn(ictx->dev, "imon %s: status(%d)\n",
+ __func__, urb->status);
+ return;
+
default:
dev_warn(ictx->dev, "imon %s: status(%d): ignored\n",
__func__, urb->status);
break;
}
-out:
usb_submit_urb(ictx->rx_urb_intf1, GFP_ATOMIC);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 083/300] drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 082/300] media: imon: make send_packet() more robust Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 084/300] iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register Greg Kroah-Hartman
` (222 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bjorn Andersson, Konrad Dybcio,
linux-arm-msm, Laurent Pinchart, Dmitry Baryshkov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
[ Upstream commit cb640b2ca54617f4a9d4d6efd5ff2afd6be11f19 ]
Detecting the monitor for DisplayPort targets is more complicated than
just reading the HPD pin level: it requires reading the DPCD in order to
check what kind of device is attached to the port and whether there is
an actual display attached.
In order to let DRM framework handle such configurations, disable
DRM_BRIDGE_OP_DETECT for dp-connector devices, letting the actual DP
driver perform detection. This still keeps DRM_BRIDGE_OP_HPD enabled, so
it is valid for the bridge to report HPD events.
Currently inside the kernel there are only two targets which list
hpd-gpios for dp-connector devices: arm64/qcom/qcs6490-rb3gen2 and
arm64/qcom/sa8295p-adp. Both should be fine with this change.
Cc: Bjorn Andersson <andersson@kernel.org>
Cc: Konrad Dybcio <konradybcio@kernel.org>
Cc: linux-arm-msm@vger.kernel.org
Acked-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Link: https://lore.kernel.org/r/20250802-dp-conn-no-detect-v1-1-2748c2b946da@oss.qualcomm.com
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/display-connector.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/display-connector.c b/drivers/gpu/drm/bridge/display-connector.c
index 544a47335cac4..d34120eb5e674 100644
--- a/drivers/gpu/drm/bridge/display-connector.c
+++ b/drivers/gpu/drm/bridge/display-connector.c
@@ -229,7 +229,8 @@ static int display_connector_probe(struct platform_device *pdev)
if (conn->bridge.ddc)
conn->bridge.ops |= DRM_BRIDGE_OP_EDID
| DRM_BRIDGE_OP_DETECT;
- if (conn->hpd_gpio)
+ /* Detecting the monitor requires reading DPCD */
+ if (conn->hpd_gpio && type != DRM_MODE_CONNECTOR_DisplayPort)
conn->bridge.ops |= DRM_BRIDGE_OP_DETECT;
if (conn->hpd_irq >= 0)
conn->bridge.ops |= DRM_BRIDGE_OP_HPD;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 084/300] iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 083/300] drm/bridge: display-connector: dont set OP_DETECT for DisplayPorts Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 085/300] usb: gadget: f_ncm: Fix MAC assignment NCM ethernet Greg Kroah-Hartman
` (221 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rodrigo Gobbi, David Lechner,
Jonathan Cameron, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
[ Upstream commit d75c7021c08e8ae3f311ef2464dca0eaf75fab9f ]
avg sample info is a bit field coded inside the following
bits: 5,6,7 and 8 of a device status register.
Channel num info the same, but over bits: 1, 2 and 3.
Mask both values in order to avoid touching other register bits,
since the first info (avg sample), came from DT.
Signed-off-by: Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://patch.msgid.link/20250717221559.158872-1-rodrigo.gobbi.7@gmail.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/spear_adc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/adc/spear_adc.c b/drivers/iio/adc/spear_adc.c
index 1bc986a7009d2..4d4aff88aa6ce 100644
--- a/drivers/iio/adc/spear_adc.c
+++ b/drivers/iio/adc/spear_adc.c
@@ -12,6 +12,7 @@
#include <linux/kernel.h>
#include <linux/slab.h>
#include <linux/io.h>
+#include <linux/bitfield.h>
#include <linux/clk.h>
#include <linux/err.h>
#include <linux/completion.h>
@@ -29,9 +30,9 @@
/* Bit definitions for SPEAR_ADC_STATUS */
#define SPEAR_ADC_STATUS_START_CONVERSION BIT(0)
-#define SPEAR_ADC_STATUS_CHANNEL_NUM(x) ((x) << 1)
+#define SPEAR_ADC_STATUS_CHANNEL_NUM_MASK GENMASK(3, 1)
#define SPEAR_ADC_STATUS_ADC_ENABLE BIT(4)
-#define SPEAR_ADC_STATUS_AVG_SAMPLE(x) ((x) << 5)
+#define SPEAR_ADC_STATUS_AVG_SAMPLE_MASK GENMASK(8, 5)
#define SPEAR_ADC_STATUS_VREF_INTERNAL BIT(9)
#define SPEAR_ADC_DATA_MASK 0x03ff
@@ -148,8 +149,8 @@ static int spear_adc_read_raw(struct iio_dev *indio_dev,
case IIO_CHAN_INFO_RAW:
mutex_lock(&indio_dev->mlock);
- status = SPEAR_ADC_STATUS_CHANNEL_NUM(chan->channel) |
- SPEAR_ADC_STATUS_AVG_SAMPLE(st->avg_samples) |
+ status = FIELD_PREP(SPEAR_ADC_STATUS_CHANNEL_NUM_MASK, chan->channel) |
+ FIELD_PREP(SPEAR_ADC_STATUS_AVG_SAMPLE_MASK, st->avg_samples) |
SPEAR_ADC_STATUS_START_CONVERSION |
SPEAR_ADC_STATUS_ADC_ENABLE;
if (st->vref_external == 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 085/300] usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 084/300] iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 086/300] char: misc: Does not request module for miscdevice with dynamic minor Greg Kroah-Hartman
` (220 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, raub camaioni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: raub camaioni <raubcameo@gmail.com>
[ Upstream commit 956606bafb5fc6e5968aadcda86fc0037e1d7548 ]
This fix is already present in f_ecm.c and was never
propagated to f_ncm.c
When creating multiple NCM ethernet devices
on a composite usb gadget device
each MAC address on the HOST side will be identical.
Having the same MAC on different network interfaces is bad.
This fix updates the MAC address inside the
ncm_strings_defs global during the ncm_bind call.
This ensures each device has a unique MAC.
In f_ecm.c ecm_string_defs is updated in the same way.
The defunct MAC assignment in ncm_alloc has been removed.
Signed-off-by: raub camaioni <raubcameo@gmail.com>
Link: https://lore.kernel.org/r/20250815131358.1047525-1-raubcameo@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_ncm.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
index 752951b56ad3f..ea5f2cf330206 100644
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1472,6 +1472,8 @@ static int ncm_bind(struct usb_configuration *c, struct usb_function *f)
ncm_opts->bound = true;
+ ncm_string_defs[1].s = ncm->ethaddr;
+
us = usb_gstrings_attach(cdev, ncm_strings,
ARRAY_SIZE(ncm_string_defs));
if (IS_ERR(us)) {
@@ -1735,7 +1737,6 @@ static struct usb_function *ncm_alloc(struct usb_function_instance *fi)
mutex_unlock(&opts->lock);
return ERR_PTR(-EINVAL);
}
- ncm_string_defs[STRING_MAC_IDX].s = ncm->ethaddr;
spin_lock_init(&ncm->lock);
ncm_reset_values(ncm);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 086/300] char: misc: Does not request module for miscdevice with dynamic minor
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 085/300] usb: gadget: f_ncm: Fix MAC assignment NCM ethernet Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 087/300] net: When removing nexthops, dont call synchronize_net if it is not necessary Greg Kroah-Hartman
` (219 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thadeu Lima de Souza Cascardo,
Zijun Hu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <zijun.hu@oss.qualcomm.com>
[ Upstream commit 1ba0fb42aa6a5f072b1b8c0b0520b32ad4ef4b45 ]
misc_open() may request module for miscdevice with dynamic minor, which
is meaningless since:
- The dynamic minor allocated is unknown in advance without registering
miscdevice firstly.
- Macro MODULE_ALIAS_MISCDEV() is not applicable for dynamic minor.
Fix by only requesting module for miscdevice with fixed minor.
Acked-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Signed-off-by: Zijun Hu <zijun.hu@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250714-rfc_miscdev-v6-6-2ed949665bde@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/char/misc.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/char/misc.c b/drivers/char/misc.c
index f6a147427029a..cbe86a1f2244b 100644
--- a/drivers/char/misc.c
+++ b/drivers/char/misc.c
@@ -113,7 +113,8 @@ static int misc_open(struct inode *inode, struct file *file)
}
}
- if (!new_fops) {
+ /* Only request module for fixed minor code */
+ if (!new_fops && minor < MISC_DYNAMIC_MINOR) {
mutex_unlock(&misc_mtx);
request_module("char-major-%d-%d", MISC_MAJOR, minor);
mutex_lock(&misc_mtx);
@@ -124,10 +125,11 @@ static int misc_open(struct inode *inode, struct file *file)
break;
}
}
- if (!new_fops)
- goto fail;
}
+ if (!new_fops)
+ goto fail;
+
/*
* Place the miscdevice in the file's
* private_data so it can be used by the
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 087/300] net: When removing nexthops, dont call synchronize_net if it is not necessary
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 086/300] char: misc: Does not request module for miscdevice with dynamic minor Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 088/300] net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV Greg Kroah-Hartman
` (218 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Paasch, Ido Schimmel,
Nikolay Aleksandrov, Eric Dumazet, David Ahern, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Paasch <cpaasch@openai.com>
[ Upstream commit b0ac6d3b56a2384db151696cfda2836a8a961b6d ]
When removing a nexthop, commit
90f33bffa382 ("nexthops: don't modify published nexthop groups") added a
call to synchronize_rcu() (later changed to _net()) to make sure
everyone sees the new nexthop-group before the rtnl-lock is released.
When one wants to delete a large number of groups and nexthops, it is
fastest to first flush the groups (ip nexthop flush groups) and then
flush the nexthops themselves (ip -6 nexthop flush). As that way the
groups don't need to be rebalanced.
However, `ip -6 nexthop flush` will still take a long time if there is
a very large number of nexthops because of the call to
synchronize_net(). Now, if there are no more groups, there is no point
in calling synchronize_net(). So, let's skip that entirely by checking
if nh->grp_list is empty.
This gives us a nice speedup:
BEFORE:
=======
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 2097152 nexthops
real 1m45.345s
user 0m0.001s
sys 0m0.005s
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 4194304 nexthops
real 3m10.430s
user 0m0.002s
sys 0m0.004s
AFTER:
======
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 2097152 nexthops
real 0m17.545s
user 0m0.003s
sys 0m0.003s
$ time sudo ip -6 nexthop flush
Dump was interrupted and may be inconsistent.
Flushed 4194304 nexthops
real 0m35.823s
user 0m0.002s
sys 0m0.004s
Signed-off-by: Christoph Paasch <cpaasch@openai.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://patch.msgid.link/20250816-nexthop_dump-v2-2-491da3462118@openai.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/nexthop.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c
index 477d6a6f0de36..75e1c8d3bd835 100644
--- a/net/ipv4/nexthop.c
+++ b/net/ipv4/nexthop.c
@@ -843,6 +843,12 @@ static void remove_nexthop_from_groups(struct net *net, struct nexthop *nh,
{
struct nh_grp_entry *nhge, *tmp;
+ /* If there is nothing to do, let's avoid the costly call to
+ * synchronize_net()
+ */
+ if (list_empty(&nh->grp_list))
+ return;
+
list_for_each_entry_safe(nhge, tmp, &nh->grp_list, nh_list)
remove_nh_grp_entry(net, nhge, nlinfo);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 088/300] net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 087/300] net: When removing nexthops, dont call synchronize_net if it is not necessary Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 089/300] PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call Greg Kroah-Hartman
` (217 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Eric Dumazet,
Shakeel Butt, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 9d85c565a7b7c78b732393c02bcaa4d5c275fe58 ]
Initially, trace_sock_exceed_buf_limit() was invoked when
__sk_mem_raise_allocated() failed due to the memcg limit or the
global limit.
However, commit d6f19938eb031 ("net: expose sk wmem in
sock_exceed_buf_limit tracepoint") somehow suppressed the event
only when memcg failed to charge for SK_MEM_RECV, although the
memcg failure for SK_MEM_SEND still triggers the event.
Let's restore the event for SK_MEM_RECV.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Shakeel Butt <shakeel.butt@linux.dev>
Link: https://patch.msgid.link/20250815201712.1745332-5-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index 3108c999ccdbb..37f2a79c23b23 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2695,8 +2695,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
return 1;
}
- if (kind == SK_MEM_SEND || (kind == SK_MEM_RECV && charged))
- trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
+ trace_sock_exceed_buf_limit(sk, prot, allocated, kind);
sk_memory_allocated_sub(sk, amt);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 089/300] PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 088/300] net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 090/300] ALSA: usb-audio: Add validation of UAC2/UAC3 effect units Greg Kroah-Hartman
` (216 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sungho Kim, Bjorn Helgaas,
Logan Gunthorpe, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sungho Kim <sungho.kim@furiosa.ai>
[ Upstream commit 6238784e502b6a9fbeb3a6b77284b29baa4135cc ]
The error handling path in pci_p2pdma_add_resource() contains a bug in its
`pgmap_free` label.
Memory is allocated for the `p2p_pgmap` struct, and the pointer is stored
in `p2p_pgmap`. However, the error path calls devm_kfree() with `pgmap`,
which is a pointer to a member field within the `p2p_pgmap` struct, not the
base pointer of the allocation.
Correct the bug by passing the correct base pointer, `p2p_pgmap`, to
devm_kfree().
Signed-off-by: Sungho Kim <sungho.kim@furiosa.ai>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: Logan Gunthorpe <logang@deltatee.com>
Link: https://patch.msgid.link/20250820105714.2939896-1-sungho.kim@furiosa.ai
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/p2pdma.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/pci/p2pdma.c b/drivers/pci/p2pdma.c
index f07c5dbc94e10..6c9dca2dd57e7 100644
--- a/drivers/pci/p2pdma.c
+++ b/drivers/pci/p2pdma.c
@@ -215,7 +215,7 @@ int pci_p2pdma_add_resource(struct pci_dev *pdev, int bar, size_t size,
pages_free:
devm_memunmap_pages(&pdev->dev, pgmap);
pgmap_free:
- devm_kfree(&pdev->dev, pgmap);
+ devm_kfree(&pdev->dev, p2p_pgmap);
return error;
}
EXPORT_SYMBOL_GPL(pci_p2pdma_add_resource);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 090/300] ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 089/300] PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 091/300] rds: Fix endianness annotation for RDS_MPATH_HASH Greg Kroah-Hartman
` (215 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 2aec0b6a6b5395bca7d6fde9c7e9dc391d329698 ]
Just add fixed struct size validations for UAC2 and UAC3 effect
units. The descriptor has a variable-length array, so it should be
validated with a proper function later once when the unit is really
parsed and used by the driver (currently only referred partially for
the input terminal parsing).
Link: https://patch.msgid.link/20250821151751.12100-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/validate.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/sound/usb/validate.c b/sound/usb/validate.c
index a0d55b77c9941..4bb4893f6e74f 100644
--- a/sound/usb/validate.c
+++ b/sound/usb/validate.c
@@ -266,7 +266,11 @@ static const struct usb_desc_validator audio_validators[] = {
FUNC(UAC_VERSION_2, UAC_MIXER_UNIT, validate_mixer_unit),
FUNC(UAC_VERSION_2, UAC_SELECTOR_UNIT, validate_selector_unit),
FUNC(UAC_VERSION_2, UAC_FEATURE_UNIT, validate_uac2_feature_unit),
- /* UAC_VERSION_2, UAC2_EFFECT_UNIT: not implemented yet */
+ /* just a stop-gap, it should be a proper function for the array
+ * once if the unit is really parsed/used
+ */
+ FIXED(UAC_VERSION_2, UAC2_EFFECT_UNIT,
+ struct uac2_effect_unit_descriptor),
FUNC(UAC_VERSION_2, UAC2_PROCESSING_UNIT_V2, validate_processing_unit),
FUNC(UAC_VERSION_2, UAC2_EXTENSION_UNIT_V2, validate_processing_unit),
FIXED(UAC_VERSION_2, UAC2_CLOCK_SOURCE,
@@ -286,7 +290,8 @@ static const struct usb_desc_validator audio_validators[] = {
FUNC(UAC_VERSION_3, UAC3_MIXER_UNIT, validate_mixer_unit),
FUNC(UAC_VERSION_3, UAC3_SELECTOR_UNIT, validate_selector_unit),
FUNC(UAC_VERSION_3, UAC3_FEATURE_UNIT, validate_uac3_feature_unit),
- /* UAC_VERSION_3, UAC3_EFFECT_UNIT: not implemented yet */
+ FIXED(UAC_VERSION_3, UAC3_EFFECT_UNIT,
+ struct uac2_effect_unit_descriptor), /* sharing the same struct */
FUNC(UAC_VERSION_3, UAC3_PROCESSING_UNIT, validate_processing_unit),
FUNC(UAC_VERSION_3, UAC3_EXTENSION_UNIT, validate_processing_unit),
FIXED(UAC_VERSION_3, UAC3_CLOCK_SOURCE,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 091/300] rds: Fix endianness annotation for RDS_MPATH_HASH
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 090/300] ALSA: usb-audio: Add validation of UAC2/UAC3 effect units Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 092/300] scsi: pm80xx: Fix race condition caused by static variables Greg Kroah-Hartman
` (214 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ujwal Kundur, Allison Henderson,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ujwal Kundur <ujwal.kundur@gmail.com>
[ Upstream commit 77907a068717fbefb25faf01fecca553aca6ccaa ]
jhash_1word accepts host endian inputs while rs_bound_port is a be16
value (sockaddr_in6.sin6_port). Use ntohs() for consistency.
Flagged by Sparse.
Signed-off-by: Ujwal Kundur <ujwal.kundur@gmail.com>
Reviewed-by: Allison Henderson <allison.henderson@oracle.com>
Link: https://patch.msgid.link/20250820175550.498-4-ujwal.kundur@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rds/rds.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/rds/rds.h b/net/rds/rds.h
index d35d1fc398076..1257867e85e4e 100644
--- a/net/rds/rds.h
+++ b/net/rds/rds.h
@@ -93,7 +93,7 @@ enum {
/* Max number of multipaths per RDS connection. Must be a power of 2 */
#define RDS_MPATH_WORKERS 8
-#define RDS_MPATH_HASH(rs, n) (jhash_1word((rs)->rs_bound_port, \
+#define RDS_MPATH_HASH(rs, n) (jhash_1word(ntohs((rs)->rs_bound_port), \
(rs)->rs_hash_initval) & ((n) - 1))
#define IS_CANONICAL(laddr, faddr) (htonl(laddr) < htonl(faddr))
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 092/300] scsi: pm80xx: Fix race condition caused by static variables
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 091/300] rds: Fix endianness annotation for RDS_MPATH_HASH Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 093/300] extcon: adc-jack: Fix wakeup source leaks on device unbind Greg Kroah-Hartman
` (213 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francisco Gutierrez,
Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francisco Gutierrez <frankramirez@google.com>
[ Upstream commit d6477ee38ccfbeaed885733c13f41d9076e2f94a ]
Eliminate the use of static variables within the log pull implementation
to resolve a race condition and prevent data gaps when pulling logs from
multiple controllers in parallel, ensuring each operation is properly
isolated.
Signed-off-by: Francisco Gutierrez <frankramirez@google.com>
Link: https://lore.kernel.org/r/20250723183543.1443301-1-frankramirez@google.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 22 ++++++++++++----------
drivers/scsi/pm8001/pm8001_init.c | 1 +
drivers/scsi/pm8001/pm8001_sas.h | 4 ++++
3 files changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 12035baf0997b..9c117e4e7f5bb 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -534,23 +534,25 @@ static ssize_t pm8001_ctl_iop_log_show(struct device *cdev,
char *str = buf;
u32 read_size =
pm8001_ha->main_cfg_tbl.pm80xx_tbl.event_log_size / 1024;
- static u32 start, end, count;
u32 max_read_times = 32;
u32 max_count = (read_size * 1024) / (max_read_times * 4);
u32 *temp = (u32 *)pm8001_ha->memoryMap.region[IOP].virt_ptr;
- if ((count % max_count) == 0) {
- start = 0;
- end = max_read_times;
- count = 0;
+ mutex_lock(&pm8001_ha->iop_log_lock);
+
+ if ((pm8001_ha->iop_log_count % max_count) == 0) {
+ pm8001_ha->iop_log_start = 0;
+ pm8001_ha->iop_log_end = max_read_times;
+ pm8001_ha->iop_log_count = 0;
} else {
- start = end;
- end = end + max_read_times;
+ pm8001_ha->iop_log_start = pm8001_ha->iop_log_end;
+ pm8001_ha->iop_log_end = pm8001_ha->iop_log_end + max_read_times;
}
- for (; start < end; start++)
- str += sprintf(str, "%08x ", *(temp+start));
- count++;
+ for (; pm8001_ha->iop_log_start < pm8001_ha->iop_log_end; pm8001_ha->iop_log_start++)
+ str += sprintf(str, "%08x ", *(temp+pm8001_ha->iop_log_start));
+ pm8001_ha->iop_log_count++;
+ mutex_unlock(&pm8001_ha->iop_log_lock);
return str - buf;
}
static DEVICE_ATTR(iop_log, S_IRUGO, pm8001_ctl_iop_log_show, NULL);
diff --git a/drivers/scsi/pm8001/pm8001_init.c b/drivers/scsi/pm8001/pm8001_init.c
index 45bffa49f8766..8fe26597bf905 100644
--- a/drivers/scsi/pm8001/pm8001_init.c
+++ b/drivers/scsi/pm8001/pm8001_init.c
@@ -505,6 +505,7 @@ static struct pm8001_hba_info *pm8001_pci_alloc(struct pci_dev *pdev,
pm8001_ha->id = pm8001_id++;
pm8001_ha->logging_level = logging_level;
pm8001_ha->non_fatal_count = 0;
+ mutex_init(&pm8001_ha->iop_log_lock);
if (link_rate >= 1 && link_rate <= 15)
pm8001_ha->link_rate = (link_rate << 8);
else {
diff --git a/drivers/scsi/pm8001/pm8001_sas.h b/drivers/scsi/pm8001/pm8001_sas.h
index 74099d82e4364..c0aba3493d470 100644
--- a/drivers/scsi/pm8001/pm8001_sas.h
+++ b/drivers/scsi/pm8001/pm8001_sas.h
@@ -540,6 +540,10 @@ struct pm8001_hba_info {
u32 ci_offset;
u32 pi_offset;
u32 max_memcnt;
+ u32 iop_log_start;
+ u32 iop_log_end;
+ u32 iop_log_count;
+ struct mutex iop_log_lock;
};
struct pm8001_work {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 093/300] extcon: adc-jack: Fix wakeup source leaks on device unbind
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 092/300] scsi: pm80xx: Fix race condition caused by static variables Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 094/300] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption Greg Kroah-Hartman
` (212 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, MyungJoo Ham, Krzysztof Kozlowski,
Chanwoo Choi, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 78b6a991eb6c6f19ed7d0ac91cda3b3b117fda8f ]
Device can be unbound, so driver must also release memory for the wakeup
source. Do not use devm interface, because it would change the order of
cleanup.
Link: https://lore.kernel.org/lkml/20250501-device-wakeup-leak-extcon-v2-1-7af77802cbea@linaro.org/
Acked-by: MyungJoo Ham <myungjoo.ham@samsung.com>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/extcon/extcon-adc-jack.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/extcon/extcon-adc-jack.c b/drivers/extcon/extcon-adc-jack.c
index 0317b614b6805..ea06cd4340525 100644
--- a/drivers/extcon/extcon-adc-jack.c
+++ b/drivers/extcon/extcon-adc-jack.c
@@ -162,6 +162,7 @@ static int adc_jack_remove(struct platform_device *pdev)
{
struct adc_jack_data *data = platform_get_drvdata(pdev);
+ device_init_wakeup(&pdev->dev, false);
free_irq(data->irq, data);
cancel_work_sync(&data->handler.work);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 094/300] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 093/300] extcon: adc-jack: Fix wakeup source leaks on device unbind Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:24 ` [PATCH 5.10 095/300] media: fix uninitialized symbol warnings Greg Kroah-Hartman
` (211 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amber Lin, Harish Kasiviswanathan,
Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amber Lin <Amber.Lin@amd.com>
[ Upstream commit f3820e9d356132e18405cd7606e22dc87ccfa6d1 ]
When KFD asks CP to preempt queues, other than preempt CP queues, CP
also requests SDMA to preempt SDMA queues with UNMAP_LATENCY timeout.
Currently queue_preemption_timeout_ms is 9000 ms by default but can be
configured via module parameter. KFD_UNMAP_LATENCY_MS is hard coded as
4000 ms though. This patch ties KFD_UNMAP_LATENCY_MS to
queue_preemption_timeout_ms so in a slow system such as emulator, both
CP and SDMA slowness are taken into account.
Signed-off-by: Amber Lin <Amber.Lin@amd.com>
Reviewed-by: Harish Kasiviswanathan <Harish.Kasiviswanathan@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
index 057c48a9b53a7..af2ea008340cc 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_priv.h
@@ -108,7 +108,14 @@
#define KFD_KERNEL_QUEUE_SIZE 2048
-#define KFD_UNMAP_LATENCY_MS (4000)
+/* KFD_UNMAP_LATENCY_MS is the timeout CP waiting for SDMA preemption. One XCC
+ * can be associated to 2 SDMA engines. queue_preemption_timeout_ms is the time
+ * driver waiting for CP returning the UNMAP_QUEUE fence. Thus the math is
+ * queue_preemption_timeout_ms = sdma_preemption_time * 2 + cp workload
+ * The format here makes CP workload 10% of total timeout
+ */
+#define KFD_UNMAP_LATENCY_MS \
+ ((queue_preemption_timeout_ms - queue_preemption_timeout_ms / 10) >> 1)
/*
* 512 = 0x200
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 095/300] media: fix uninitialized symbol warnings
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 094/300] drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption Greg Kroah-Hartman
@ 2025-12-03 15:24 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 096/300] mips: lantiq: danube: add missing properties to cpu node Greg Kroah-Hartman
` (210 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:24 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chelsy Ratnawat, Hans Verkuil,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
[ Upstream commit b4c441310c3baaa7c39a5457e305ca93c7a0400d ]
Initialize variables to fix these smatch warnings
drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
symbol 'protocol'.
drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
symbol 'scancode'.
drivers/media/i2c/ir-kbd-i2c.c:339 ir_key_poll() error: uninitialized
symbol 'toggle'.
drivers/media/tuners/xc4000.c:1102 xc_debug_dump() error: uninitialized
symbol 'adc_envelope'.
drivers/media/tuners/xc4000.c:1108 xc_debug_dump() error: uninitialized
symbol 'lock_status'.
drivers/media/tuners/xc4000.c:1123 xc_debug_dump() error: uninitialized
symbol 'frame_lines'.
drivers/media/tuners/xc4000.c:1127 xc_debug_dump() error: uninitialized
symbol 'quality'.
drivers/media/tuners/xc5000.c:645 xc_debug_dump() error: uninitialized
symbol 'adc_envelope'.
drivers/media/tuners/xc5000.c:651 xc_debug_dump() error: uninitialized
symbol 'lock_status'.
drivers/media/tuners/xc5000.c:665 xc_debug_dump() error: uninitialized
symbol 'frame_lines'.
drivers/media/tuners/xc5000.c:668 xc_debug_dump() error: uninitialized
symbol 'quality'.
drivers/media/tuners/xc5000.c:671 xc_debug_dump() error: uninitialized
symbol 'snr'.
drivers/media/tuners/xc5000.c:674 xc_debug_dump() error: uninitialized
symbol 'totalgain'.
Signed-off-by: Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
[hverkuil: dropped ' = 0' from rc in ir-kbd-i2c.c, not needed]
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/i2c/ir-kbd-i2c.c | 6 +++---
drivers/media/tuners/xc4000.c | 8 ++++----
drivers/media/tuners/xc5000.c | 12 ++++++------
3 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/media/i2c/ir-kbd-i2c.c b/drivers/media/i2c/ir-kbd-i2c.c
index 56674173524fd..0c1c54b5a6f5e 100644
--- a/drivers/media/i2c/ir-kbd-i2c.c
+++ b/drivers/media/i2c/ir-kbd-i2c.c
@@ -284,9 +284,9 @@ static int get_key_avermedia_cardbus(struct IR_i2c *ir, enum rc_proto *protocol,
static int ir_key_poll(struct IR_i2c *ir)
{
- enum rc_proto protocol;
- u32 scancode;
- u8 toggle;
+ enum rc_proto protocol = 0;
+ u32 scancode = 0;
+ u8 toggle = 0;
int rc;
dev_dbg(&ir->rc->dev, "%s\n", __func__);
diff --git a/drivers/media/tuners/xc4000.c b/drivers/media/tuners/xc4000.c
index 849df4d1c573c..c8aa193e04e71 100644
--- a/drivers/media/tuners/xc4000.c
+++ b/drivers/media/tuners/xc4000.c
@@ -1089,12 +1089,12 @@ static int check_firmware(struct dvb_frontend *fe, unsigned int type,
static void xc_debug_dump(struct xc4000_priv *priv)
{
- u16 adc_envelope;
+ u16 adc_envelope = 0;
u32 freq_error_hz = 0;
- u16 lock_status;
+ u16 lock_status = 0;
u32 hsync_freq_hz = 0;
- u16 frame_lines;
- u16 quality;
+ u16 frame_lines = 0;
+ u16 quality = 0;
u16 signal = 0;
u16 noise = 0;
u8 hw_majorversion = 0, hw_minorversion = 0;
diff --git a/drivers/media/tuners/xc5000.c b/drivers/media/tuners/xc5000.c
index ec9a3cd4784e1..a28481edd22ed 100644
--- a/drivers/media/tuners/xc5000.c
+++ b/drivers/media/tuners/xc5000.c
@@ -622,14 +622,14 @@ static int xc5000_fwupload(struct dvb_frontend *fe,
static void xc_debug_dump(struct xc5000_priv *priv)
{
- u16 adc_envelope;
+ u16 adc_envelope = 0;
u32 freq_error_hz = 0;
- u16 lock_status;
+ u16 lock_status = 0;
u32 hsync_freq_hz = 0;
- u16 frame_lines;
- u16 quality;
- u16 snr;
- u16 totalgain;
+ u16 frame_lines = 0;
+ u16 quality = 0;
+ u16 snr = 0;
+ u16 totalgain = 0;
u8 hw_majorversion = 0, hw_minorversion = 0;
u8 fw_majorversion = 0, fw_minorversion = 0;
u16 fw_buildversion = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 096/300] mips: lantiq: danube: add missing properties to cpu node
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2025-12-03 15:24 ` [PATCH 5.10 095/300] media: fix uninitialized symbol warnings Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 097/300] mips: lantiq: danube: add missing device_type in pci node Greg Kroah-Hartman
` (209 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit e8dee66c37085dc9858eb8608bc783c2900e50e7 ]
This fixes the following warnings:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#address-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpus: '#size-cells' is a required property
from schema $id: http://devicetree.org/schemas/cpus.yaml#
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: cpu@0 (mips,mips24Kc): 'reg' is a required property
from schema $id: http://devicetree.org/schemas/mips/cpus.yaml#
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/lantiq/danube.dtsi | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
index 510be63c8bdf1..ff6ff9568e1bc 100644
--- a/arch/mips/boot/dts/lantiq/danube.dtsi
+++ b/arch/mips/boot/dts/lantiq/danube.dtsi
@@ -5,8 +5,12 @@
compatible = "lantiq,xway", "lantiq,danube";
cpus {
+ #address-cells = <1>;
+ #size-cells = <0>;
+
cpu@0 {
compatible = "mips,mips24Kc";
+ reg = <0>;
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 097/300] mips: lantiq: danube: add missing device_type in pci node
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 096/300] mips: lantiq: danube: add missing properties to cpu node Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 098/300] mips: lantiq: xway: sysctrl: rename stp clock Greg Kroah-Hartman
` (208 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit d66949a1875352d2ddd52b144333288952a9e36f ]
This fixes the following warning:
arch/mips/boot/dts/lantiq/danube_easy50712.dtb: pci@e105400 (lantiq,pci-xway): 'device_type' is a required property
from schema $id: http://devicetree.org/schemas/pci/pci-bus-common.yaml#
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/lantiq/danube.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/mips/boot/dts/lantiq/danube.dtsi b/arch/mips/boot/dts/lantiq/danube.dtsi
index ff6ff9568e1bc..1a5f4faa0831f 100644
--- a/arch/mips/boot/dts/lantiq/danube.dtsi
+++ b/arch/mips/boot/dts/lantiq/danube.dtsi
@@ -105,6 +105,8 @@
0x1000000 0 0x00000000 0xae00000 0 0x200000>; /* io space */
reg = <0x7000000 0x8000 /* config space */
0xe105400 0x400>; /* pci bridge */
+
+ device_type = "pci";
};
};
};
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 098/300] mips: lantiq: xway: sysctrl: rename stp clock
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 097/300] mips: lantiq: danube: add missing device_type in pci node Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 099/300] scsi: pm8001: Use int instead of u32 to store error codes Greg Kroah-Hartman
` (207 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aleksander Jan Bajkowski,
Thomas Bogendoerfer, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksander Jan Bajkowski <olek2@wp.pl>
[ Upstream commit b0d04fe6a633ada2c7bc1b5ddd011cbd85961868 ]
Bindig requires a node name matching ‘^gpio@[0-9a-f]+$’. This patch
changes the clock name from “stp” to “gpio”.
Signed-off-by: Aleksander Jan Bajkowski <olek2@wp.pl>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/lantiq/xway/sysctrl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c
index 084f6caba5f23..96a62b42e2971 100644
--- a/arch/mips/lantiq/xway/sysctrl.c
+++ b/arch/mips/lantiq/xway/sysctrl.c
@@ -463,7 +463,7 @@ void __init ltq_soc_init(void)
/* add our generic xway clocks */
clkdev_add_pmu("10000000.fpi", NULL, 0, 0, PMU_FPI);
clkdev_add_pmu("1e100a00.gptu", NULL, 1, 0, PMU_GPT);
- clkdev_add_pmu("1e100bb0.stp", NULL, 1, 0, PMU_STP);
+ clkdev_add_pmu("1e100bb0.gpio", NULL, 1, 0, PMU_STP);
clkdev_add_pmu("1e100c00.serial", NULL, 0, 0, PMU_ASC1);
clkdev_add_pmu("1e104100.dma", NULL, 1, 0, PMU_DMA);
clkdev_add_pmu("1e100800.spi", NULL, 1, 0, PMU_SPI);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 099/300] scsi: pm8001: Use int instead of u32 to store error codes
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 098/300] mips: lantiq: xway: sysctrl: rename stp clock Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 100/300] dmaengine: sh: setup_xref error handling Greg Kroah-Hartman
` (206 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Martin K. Petersen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit bee3554d1a4efbce91d6eca732f41b97272213a5 ]
Use int instead of u32 for 'ret' variable to store negative error codes
returned by PM8001_CHIP_DISP->set_nvmd_req().
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Link: https://lore.kernel.org/r/20250826093242.230344-1-rongqianfeng@vivo.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/pm8001/pm8001_ctl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
index 9c117e4e7f5bb..d5d5965fa7a0e 100644
--- a/drivers/scsi/pm8001/pm8001_ctl.c
+++ b/drivers/scsi/pm8001/pm8001_ctl.c
@@ -683,7 +683,7 @@ static int pm8001_set_nvmd(struct pm8001_hba_info *pm8001_ha)
struct pm8001_ioctl_payload *payload;
DECLARE_COMPLETION_ONSTACK(completion);
u8 *ioctlbuffer;
- u32 ret;
+ int ret;
u32 length = 1024 * 5 + sizeof(*payload) - 1;
if (pm8001_ha->fw_image->size > 4096) {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 100/300] dmaengine: sh: setup_xref error handling
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 099/300] scsi: pm8001: Use int instead of u32 to store error codes Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 101/300] dmaengine: mv_xor: match alloc_wc and free_wc Greg Kroah-Hartman
` (205 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Andreatta, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Andreatta <thomasandreatta2000@gmail.com>
[ Upstream commit d9a3e9929452780df16f3414f0d59b5f69d058cf ]
This patch modifies the type of setup_xref from void to int and handles
errors since the function can fail.
`setup_xref` now returns the (eventual) error from
`dmae_set_dmars`|`dmae_set_chcr`, while `shdma_tx_submit` handles the
result, removing the chunks from the queue and marking PM as idle in
case of an error.
Signed-off-by: Thomas Andreatta <thomas.andreatta2000@gmail.com>
Link: https://lore.kernel.org/r/20250827152442.90962-1-thomas.andreatta2000@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/sh/shdma-base.c | 25 +++++++++++++++++++------
drivers/dma/sh/shdmac.c | 17 +++++++++++++----
include/linux/shdma-base.h | 2 +-
3 files changed, 33 insertions(+), 11 deletions(-)
diff --git a/drivers/dma/sh/shdma-base.c b/drivers/dma/sh/shdma-base.c
index 7f72b3f4cd1ae..e1b8808f2a984 100644
--- a/drivers/dma/sh/shdma-base.c
+++ b/drivers/dma/sh/shdma-base.c
@@ -129,12 +129,25 @@ static dma_cookie_t shdma_tx_submit(struct dma_async_tx_descriptor *tx)
const struct shdma_ops *ops = sdev->ops;
dev_dbg(schan->dev, "Bring up channel %d\n",
schan->id);
- /*
- * TODO: .xfer_setup() might fail on some platforms.
- * Make it int then, on error remove chunks from the
- * queue again
- */
- ops->setup_xfer(schan, schan->slave_id);
+
+ ret = ops->setup_xfer(schan, schan->slave_id);
+ if (ret < 0) {
+ dev_err(schan->dev, "setup_xfer failed: %d\n", ret);
+
+ /* Remove chunks from the queue and mark them as idle */
+ list_for_each_entry_safe(chunk, c, &schan->ld_queue, node) {
+ if (chunk->cookie == cookie) {
+ chunk->mark = DESC_IDLE;
+ list_move(&chunk->node, &schan->ld_free);
+ }
+ }
+
+ schan->pm_state = SHDMA_PM_ESTABLISHED;
+ ret = pm_runtime_put(schan->dev);
+
+ spin_unlock_irq(&schan->chan_lock);
+ return ret;
+ }
if (schan->pm_state == SHDMA_PM_PENDING)
shdma_chan_xfer_ld_queue(schan);
diff --git a/drivers/dma/sh/shdmac.c b/drivers/dma/sh/shdmac.c
index 5aafe548ca5f3..2b9774ae7fd32 100644
--- a/drivers/dma/sh/shdmac.c
+++ b/drivers/dma/sh/shdmac.c
@@ -301,21 +301,30 @@ static bool sh_dmae_channel_busy(struct shdma_chan *schan)
return dmae_is_busy(sh_chan);
}
-static void sh_dmae_setup_xfer(struct shdma_chan *schan,
- int slave_id)
+static int sh_dmae_setup_xfer(struct shdma_chan *schan, int slave_id)
{
struct sh_dmae_chan *sh_chan = container_of(schan, struct sh_dmae_chan,
shdma_chan);
+ int ret = 0;
if (slave_id >= 0) {
const struct sh_dmae_slave_config *cfg =
sh_chan->config;
- dmae_set_dmars(sh_chan, cfg->mid_rid);
- dmae_set_chcr(sh_chan, cfg->chcr);
+ ret = dmae_set_dmars(sh_chan, cfg->mid_rid);
+ if (ret < 0)
+ goto END;
+
+ ret = dmae_set_chcr(sh_chan, cfg->chcr);
+ if (ret < 0)
+ goto END;
+
} else {
dmae_init(sh_chan);
}
+
+END:
+ return ret;
}
/*
diff --git a/include/linux/shdma-base.h b/include/linux/shdma-base.h
index 6dfd05ef5c2d9..03ba4dab2ef73 100644
--- a/include/linux/shdma-base.h
+++ b/include/linux/shdma-base.h
@@ -96,7 +96,7 @@ struct shdma_ops {
int (*desc_setup)(struct shdma_chan *, struct shdma_desc *,
dma_addr_t, dma_addr_t, size_t *);
int (*set_slave)(struct shdma_chan *, int, dma_addr_t, bool);
- void (*setup_xfer)(struct shdma_chan *, int);
+ int (*setup_xfer)(struct shdma_chan *, int);
void (*start_xfer)(struct shdma_chan *, struct shdma_desc *);
struct shdma_desc *(*embedded_desc)(void *, int);
bool (*chan_irq)(struct shdma_chan *, int);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 101/300] dmaengine: mv_xor: match alloc_wc and free_wc
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 100/300] dmaengine: sh: setup_xref error handling Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 102/300] dmaengine: dw-edma: Set status for callback_result Greg Kroah-Hartman
` (204 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rosen Penev, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rosen Penev <rosenp@gmail.com>
[ Upstream commit a33e3b667d2f004fdfae6b442bd4676f6c510abb ]
dma_alloc_wc is used but not dma_free_wc.
Signed-off-by: Rosen Penev <rosenp@gmail.com>
Link: https://lore.kernel.org/r/20250821220942.10578-1-rosenp@gmail.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/mv_xor.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
index 94a12f3267c14..8224d52d16901 100644
--- a/drivers/dma/mv_xor.c
+++ b/drivers/dma/mv_xor.c
@@ -1013,7 +1013,7 @@ static int mv_xor_channel_remove(struct mv_xor_chan *mv_chan)
dma_async_device_unregister(&mv_chan->dmadev);
- dma_free_coherent(dev, MV_XOR_POOL_SIZE,
+ dma_free_wc(dev, MV_XOR_POOL_SIZE,
mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
dma_unmap_single(dev, mv_chan->dummy_src_addr,
MV_XOR_MIN_BYTE_COUNT, DMA_FROM_DEVICE);
@@ -1163,7 +1163,7 @@ mv_xor_channel_add(struct mv_xor_device *xordev,
err_free_irq:
free_irq(mv_chan->irq, mv_chan);
err_free_dma:
- dma_free_coherent(&pdev->dev, MV_XOR_POOL_SIZE,
+ dma_free_wc(&pdev->dev, MV_XOR_POOL_SIZE,
mv_chan->dma_desc_pool_virt, mv_chan->dma_desc_pool);
err_unmap_dst:
dma_unmap_single(dma_dev->dev, mv_chan->dummy_dst_addr,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 102/300] dmaengine: dw-edma: Set status for callback_result
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 101/300] dmaengine: mv_xor: match alloc_wc and free_wc Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 103/300] ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled Greg Kroah-Hartman
` (203 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Devendra K Verma, Vinod Koul,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Devendra K Verma <devverma@amd.com>
[ Upstream commit 5e742de97c806a4048418237ef1283e7d71eaf4b ]
DMA Engine has support for the callback_result which provides
the status of the request and the residue. This helps in
determining the correct status of the request and in
efficient resource management of the request.
The 'callback_result' method is preferred over the deprecated
'callback' method.
Signed-off-by: Devendra K Verma <devverma@amd.com>
Link: https://lore.kernel.org/r/20250821121505.318179-1-devverma@amd.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/dw-edma/dw-edma-core.c | 22 ++++++++++++++++++++++
1 file changed, 22 insertions(+)
diff --git a/drivers/dma/dw-edma/dw-edma-core.c b/drivers/dma/dw-edma/dw-edma-core.c
index f91dbf43a5980..df2874f6f4620 100644
--- a/drivers/dma/dw-edma/dw-edma-core.c
+++ b/drivers/dma/dw-edma/dw-edma-core.c
@@ -488,6 +488,25 @@ dw_edma_device_prep_dma_cyclic(struct dma_chan *dchan, dma_addr_t paddr,
return dw_edma_device_transfer(&xfer);
}
+static void dw_hdma_set_callback_result(struct virt_dma_desc *vd,
+ enum dmaengine_tx_result result)
+{
+ u32 residue = 0;
+ struct dw_edma_desc *desc;
+ struct dmaengine_result *res;
+
+ if (!vd->tx.callback_result)
+ return;
+
+ desc = vd2dw_edma_desc(vd);
+ if (desc)
+ residue = desc->alloc_sz - desc->xfer_sz;
+
+ res = &vd->tx_result;
+ res->result = result;
+ res->residue = residue;
+}
+
static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
{
struct dw_edma_desc *desc;
@@ -503,6 +522,8 @@ static void dw_edma_done_interrupt(struct dw_edma_chan *chan)
case EDMA_REQ_NONE:
desc = vd2dw_edma_desc(vd);
if (!desc->chunks_alloc) {
+ dw_hdma_set_callback_result(vd,
+ DMA_TRANS_NOERROR);
list_del(&vd->node);
vchan_cookie_complete(vd);
}
@@ -541,6 +562,7 @@ static void dw_edma_abort_interrupt(struct dw_edma_chan *chan)
spin_lock_irqsave(&chan->vc.lock, flags);
vd = vchan_next_desc(&chan->vc);
if (vd) {
+ dw_hdma_set_callback_result(vd, DMA_TRANS_ABORTED);
list_del(&vd->node);
vchan_cookie_complete(vd);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 103/300] ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 102/300] dmaengine: dw-edma: Set status for callback_result Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 104/300] net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms Greg Kroah-Hartman
` (202 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yue Haibing, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yue Haibing <yuehaibing@huawei.com>
[ Upstream commit 3d95261eeb74958cd496e1875684827dc5d028cc ]
In ipv6_rpl_srh_rcv() we use min(net->ipv6.devconf_all->rpl_seg_enabled,
idev->cnf.rpl_seg_enabled) is intended to return 0 when either value is
zero, but if one of the values is negative it will in fact return non-zero.
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
Link: https://patch.msgid.link/20250901123726.1972881-3-yuehaibing@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/addrconf.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d38d15ccc7501..ced20abf4ef8e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6978,7 +6978,9 @@ static const struct ctl_table addrconf_sysctl[] = {
.data = &ipv6_devconf.rpl_seg_enabled,
.maxlen = sizeof(int),
.mode = 0644,
- .proc_handler = proc_dointvec,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
},
{
/* sentinel */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 104/300] net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 103/300] ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 105/300] ALSA: usb-audio: apply quirk for MOONDROP Quark2 Greg Kroah-Hartman
` (201 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juraj Šarinay,
Krzysztof Kozlowski, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juraj Šarinay <juraj@sarinay.com>
[ Upstream commit 21f82062d0f241e55dd59eb630e8710862cc90b4 ]
An exchange with a NFC target must complete within NCI_DATA_TIMEOUT.
A delay of 700 ms is not sufficient for cryptographic operations on smart
cards. CardOS 6.0 may need up to 1.3 seconds to perform 256-bit ECDH
or 3072-bit RSA. To prevent brute-force attacks, passports and similar
documents introduce even longer delays into access control protocols
(BAC/PACE).
The timeout should be higher, but not too much. The expiration allows
us to detect that a NFC target has disappeared.
Signed-off-by: Juraj Šarinay <juraj@sarinay.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://patch.msgid.link/20250902113630.62393-1-juraj@sarinay.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/nfc/nci_core.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/nfc/nci_core.h b/include/net/nfc/nci_core.h
index 004e49f748419..beea7e014b157 100644
--- a/include/net/nfc/nci_core.h
+++ b/include/net/nfc/nci_core.h
@@ -52,7 +52,7 @@ enum nci_state {
#define NCI_RF_DISC_SELECT_TIMEOUT 5000
#define NCI_RF_DEACTIVATE_TIMEOUT 30000
#define NCI_CMD_TIMEOUT 5000
-#define NCI_DATA_TIMEOUT 700
+#define NCI_DATA_TIMEOUT 3000
struct nci_dev;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 105/300] ALSA: usb-audio: apply quirk for MOONDROP Quark2
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 104/300] net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 106/300] net: call cond_resched() less often in __release_sock() Greg Kroah-Hartman
` (200 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoli An, Cryolitia PukNgae,
Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cryolitia PukNgae <cryolitia@uniontech.com>
[ Upstream commit a73349c5dd27bc544b048e2e2c8ef6394f05b793 ]
It reports a MIN value -15360 for volume control, but will mute when
setting it less than -14208
Tested-by: Guoli An <anguoli@uniontech.com>
Signed-off-by: Cryolitia PukNgae <cryolitia@uniontech.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://patch.msgid.link/20250903-sound-v1-4-d4ca777b8512@uniontech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 8826a588f5ab8..c84e25b2b1fb9 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -1192,6 +1192,13 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
cval->res = 1;
}
break;
+ case USB_ID(0x3302, 0x12db): /* MOONDROP Quark2 */
+ if (!strcmp(kctl->id.name, "PCM Playback Volume")) {
+ usb_audio_info(chip,
+ "set volume quirk for MOONDROP Quark2\n");
+ cval->min = -14208; /* Mute under it */
+ }
+ break;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 106/300] net: call cond_resched() less often in __release_sock()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 105/300] ALSA: usb-audio: apply quirk for MOONDROP Quark2 Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 107/300] iommu/amd: Skip enabling command/event buffers for kdump Greg Kroah-Hartman
` (199 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Kuniyuki Iwashima,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 16c610162d1f1c332209de1c91ffb09b659bb65d ]
While stress testing TCP I had unexpected retransmits and sack packets
when a single cpu receives data from multiple high-throughput flows.
super_netperf 4 -H srv -T,10 -l 3000 &
Tcpdump extract:
00:00:00.000007 IP6 clnt > srv: Flags [.], seq 26062848:26124288, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26124288:26185728, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26185728:26243072, ack 1, win 66, options [nop,nop,TS val 651460834 ecr 3100749131], length 57344
00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26243072:26304512, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26304512:26365952, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 61440
00:00:00.000007 IP6 clnt > srv: Flags [P.], seq 26365952:26423296, ack 1, win 66, options [nop,nop,TS val 651460844 ecr 3100749141], length 57344
00:00:00.000006 IP6 clnt > srv: Flags [.], seq 26423296:26484736, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [.], seq 26484736:26546176, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 61440
00:00:00.000005 IP6 clnt > srv: Flags [P.], seq 26546176:26603520, ack 1, win 66, options [nop,nop,TS val 651460853 ecr 3100749150], length 57344
00:00:00.003932 IP6 clnt > srv: Flags [P.], seq 26603520:26619904, ack 1, win 66, options [nop,nop,TS val 651464844 ecr 3100753141], length 16384
00:00:00.006602 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651471419 ecr 3100759716], length 4096
00:00:00.013000 IP6 clnt > srv: Flags [.], seq 24862720:24866816, ack 1, win 66, options [nop,nop,TS val 651484421 ecr 3100772718], length 4096
00:00:00.000416 IP6 srv > clnt: Flags [.], ack 26619904, win 1393, options [nop,nop,TS val 3100773185 ecr 651484421,nop,nop,sack 1 {24862720:24866816}], length 0
After analysis, it appears this is because of the cond_resched()
call from __release_sock().
When current thread is yielding, while still holding the TCP socket lock,
it might regain the cpu after a very long time.
Other peer TLP/RTO is firing (multiple times) and packets are retransmit,
while the initial copy is waiting in the socket backlog or receive queue.
In this patch, I call cond_resched() only once every 16 packets.
Modern TCP stack now spends less time per packet in the backlog,
especially because ACK are no longer sent (commit 133c4c0d3717
"tcp: defer regular ACK while processing socket backlog")
Before:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
TcpOutSegs 19046186 0.0
TcpRetransSegs 1471 0.0
TcpExtTCPTimeouts 1397 0.0
TcpExtTCPLossProbes 1356 0.0
TcpExtTCPDSACKRecv 1352 0.0
TcpExtTCPSpuriousRTOs 114 0.0
TcpExtTCPDSACKRecvSegs 1352 0.0
After:
clnt:/# nstat -n;sleep 10;nstat|egrep "TcpOutSegs|TcpRetransSegs|TCPFastRetrans|TCPTimeouts|Probes|TCPSpuriousRTOs|DSACK"
TcpOutSegs 19218936 0.0
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250903174811.1930820-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index 37f2a79c23b23..6c93381cf0bdf 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2561,23 +2561,27 @@ void __release_sock(struct sock *sk)
__acquires(&sk->sk_lock.slock)
{
struct sk_buff *skb, *next;
+ int nb = 0;
while ((skb = sk->sk_backlog.head) != NULL) {
sk->sk_backlog.head = sk->sk_backlog.tail = NULL;
spin_unlock_bh(&sk->sk_lock.slock);
- do {
+ while (1) {
next = skb->next;
prefetch(next);
WARN_ON_ONCE(skb_dst_is_noref(skb));
skb_mark_not_on_list(skb);
sk_backlog_rcv(sk, skb);
- cond_resched();
-
skb = next;
- } while (skb != NULL);
+ if (!skb)
+ break;
+
+ if (!(++nb & 15))
+ cond_resched();
+ }
spin_lock_bh(&sk->sk_lock.slock);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 107/300] iommu/amd: Skip enabling command/event buffers for kdump
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 106/300] net: call cond_resched() less often in __release_sock() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 108/300] usb: gadget: f_hid: Fix zero length packet transfer Greg Kroah-Hartman
` (198 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasant Hegde, Sairaj Kodilkar,
Ashish Kalra, Joerg Roedel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ashish Kalra <ashish.kalra@amd.com>
[ Upstream commit 9be15fbfc6c5c89c22cf6e209f66ea43ee0e58bb ]
After a panic if SNP is enabled in the previous kernel then the kdump
kernel boots with IOMMU SNP enforcement still enabled.
IOMMU command buffers and event buffer registers remain locked and
exclusive to the previous kernel. Attempts to enable command and event
buffers in the kdump kernel will fail, as hardware ignores writes to
the locked MMIO registers as per AMD IOMMU spec Section 2.12.2.1.
Skip enabling command buffers and event buffers for kdump boot as they
are already enabled in the previous kernel.
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Tested-by: Sairaj Kodilkar <sarunkod@amd.com>
Signed-off-by: Ashish Kalra <ashish.kalra@amd.com>
Link: https://lore.kernel.org/r/576445eb4f168b467b0fc789079b650ca7c5b037.1756157913.git.ashish.kalra@amd.com
Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/init.c | 28 +++++++++++++++++++---------
1 file changed, 19 insertions(+), 9 deletions(-)
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 1ba6adb5b9124..8ac0ac915efd3 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -697,11 +697,16 @@ static void iommu_enable_command_buffer(struct amd_iommu *iommu)
BUG_ON(iommu->cmd_buf == NULL);
- entry = iommu_virt_to_phys(iommu->cmd_buf);
- entry |= MMIO_CMD_SIZE_512;
-
- memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
- &entry, sizeof(entry));
+ if (!is_kdump_kernel()) {
+ /*
+ * Command buffer is re-used for kdump kernel and setting
+ * of MMIO register is not required.
+ */
+ entry = iommu_virt_to_phys(iommu->cmd_buf);
+ entry |= MMIO_CMD_SIZE_512;
+ memcpy_toio(iommu->mmio_base + MMIO_CMD_BUF_OFFSET,
+ &entry, sizeof(entry));
+ }
amd_iommu_reset_cmd_buffer(iommu);
}
@@ -750,10 +755,15 @@ static void iommu_enable_event_buffer(struct amd_iommu *iommu)
BUG_ON(iommu->evt_buf == NULL);
- entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
-
- memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
- &entry, sizeof(entry));
+ if (!is_kdump_kernel()) {
+ /*
+ * Event buffer is re-used for kdump kernel and setting
+ * of MMIO register is not required.
+ */
+ entry = iommu_virt_to_phys(iommu->evt_buf) | EVT_LEN_MASK;
+ memcpy_toio(iommu->mmio_base + MMIO_EVT_BUF_OFFSET,
+ &entry, sizeof(entry));
+ }
/* set head and tail to zero manually */
writel(0x00, iommu->mmio_base + MMIO_EVT_HEAD_OFFSET);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 108/300] usb: gadget: f_hid: Fix zero length packet transfer
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 107/300] iommu/amd: Skip enabling command/event buffers for kdump Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 109/300] net: phy: marvell: Fix 88e1510 downshift counter errata Greg Kroah-Hartman
` (197 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, William Wu, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: William Wu <william.wu@rock-chips.com>
[ Upstream commit ed6f727c575b1eb8136e744acfd5e7306c9548f6 ]
Set the hid req->zero flag of ep0/in_ep to true by default,
then the UDC drivers can transfer a zero length packet at
the end if the hid transfer with size divisible to EPs max
packet size according to the USB 2.0 spec.
Signed-off-by: William Wu <william.wu@rock-chips.com>
Link: https://lore.kernel.org/r/1756204087-26111-1-git-send-email-william.wu@rock-chips.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/gadget/function/f_hid.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c
index 2f30699f0426f..c285b23c3707c 100644
--- a/drivers/usb/gadget/function/f_hid.c
+++ b/drivers/usb/gadget/function/f_hid.c
@@ -490,7 +490,7 @@ static ssize_t f_hidg_write(struct file *file, const char __user *buffer,
}
req->status = 0;
- req->zero = 0;
+ req->zero = 1;
req->length = count;
req->complete = f_hidg_req_complete;
req->context = hidg;
@@ -761,7 +761,7 @@ static int hidg_setup(struct usb_function *f,
return -EOPNOTSUPP;
respond:
- req->zero = 0;
+ req->zero = 1;
req->length = length;
status = usb_ep_queue(cdev->gadget->ep0, req, GFP_ATOMIC);
if (status < 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 109/300] net: phy: marvell: Fix 88e1510 downshift counter errata
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 108/300] usb: gadget: f_hid: Fix zero length packet transfer Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 110/300] phy: cadence: cdns-dphy: Enable lower resolutions in dphy Greg Kroah-Hartman
` (196 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rohan G Thomas, Matthew Gerlach,
Andrew Lunn, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rohan G Thomas <rohan.g.thomas@altera.com>
[ Upstream commit deb105f49879dd50d595f7f55207d6e74dec34e6 ]
The 88e1510 PHY has an erratum where the phy downshift counter is not
cleared after phy being suspended(BMCR_PDOWN set) and then later
resumed(BMCR_PDOWN cleared). This can cause the gigabit link to
intermittently downshift to a lower speed.
Disabling and re-enabling the downshift feature clears the counter,
allowing the PHY to retry gigabit link negotiation up to the programmed
retry count times before downshifting. This behavior has been observed
on copper links.
Signed-off-by: Rohan G Thomas <rohan.g.thomas@altera.com>
Reviewed-by: Matthew Gerlach <matthew.gerlach@altera.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://patch.msgid.link/20250906-marvell_fix-v2-1-f6efb286937f@altera.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/marvell.c | 39 ++++++++++++++++++++++++++++++++++++++-
1 file changed, 38 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c
index 54786712a9913..6504aa0f1889d 100644
--- a/drivers/net/phy/marvell.c
+++ b/drivers/net/phy/marvell.c
@@ -1596,6 +1596,43 @@ static int marvell_resume(struct phy_device *phydev)
return err;
}
+/* m88e1510_resume
+ *
+ * The 88e1510 PHY has an erratum where the phy downshift counter is not cleared
+ * after phy being suspended(BMCR_PDOWN set) and then later resumed(BMCR_PDOWN
+ * cleared). This can cause the link to intermittently downshift to a lower speed.
+ *
+ * Disabling and re-enabling the downshift feature clears the counter, allowing
+ * the PHY to retry gigabit link negotiation up to the programmed retry count
+ * before downshifting. This behavior has been observed on copper links.
+ */
+static int m88e1510_resume(struct phy_device *phydev)
+{
+ int err;
+ u8 cnt = 0;
+
+ err = marvell_resume(phydev);
+ if (err < 0)
+ return err;
+
+ /* read downshift counter value */
+ err = m88e1011_get_downshift(phydev, &cnt);
+ if (err < 0)
+ return err;
+
+ if (cnt) {
+ /* downshift disabled */
+ err = m88e1011_set_downshift(phydev, 0);
+ if (err < 0)
+ return err;
+
+ /* downshift enabled, with previous counter value */
+ err = m88e1011_set_downshift(phydev, cnt);
+ }
+
+ return err;
+}
+
static int marvell_aneg_done(struct phy_device *phydev)
{
int retval = phy_read(phydev, MII_M1011_PHY_STATUS);
@@ -2845,7 +2882,7 @@ static struct phy_driver marvell_drivers[] = {
.did_interrupt = m88e1121_did_interrupt,
.get_wol = m88e1318_get_wol,
.set_wol = m88e1318_set_wol,
- .resume = marvell_resume,
+ .resume = m88e1510_resume,
.suspend = marvell_suspend,
.read_page = marvell_read_page,
.write_page = marvell_write_page,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 110/300] phy: cadence: cdns-dphy: Enable lower resolutions in dphy
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 109/300] net: phy: marvell: Fix 88e1510 downshift counter errata Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 111/300] net: sh_eth: Disable WoL if system can not suspend Greg Kroah-Hartman
` (195 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Udit Kumar, Devarsh Thakkar,
Harikrishna Shenoy, Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Harikrishna Shenoy <h-shenoy@ti.com>
[ Upstream commit 43bd2c44515f8ee5c019ce6e6583f5640387a41b ]
Enable support for data lane rates between 80-160 Mbps cdns dphy
as mentioned in TRM [0] by setting the pll_opdiv field to 16.
This change enables lower resolutions like 640x480 at 60Hz.
[0]: https://www.ti.com/lit/zip/spruil1
(Table 12-552. DPHY_TX_PLL_CTRL Register Field Descriptions)
Reviewed-by: Udit Kumar <u-kumar1@ti.com>
Reviewed-by: Devarsh Thakkar <devarsht@ti.com>
Signed-off-by: Harikrishna Shenoy <h-shenoy@ti.com>
Link: https://lore.kernel.org/r/20250807052002.717807-1-h-shenoy@ti.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/cadence/cdns-dphy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/phy/cadence/cdns-dphy.c b/drivers/phy/cadence/cdns-dphy.c
index 90c4e9b5aac83..04cee5a00a5b4 100644
--- a/drivers/phy/cadence/cdns-dphy.c
+++ b/drivers/phy/cadence/cdns-dphy.c
@@ -115,7 +115,7 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
dlane_bps = opts->hs_clk_rate;
- if (dlane_bps > 2500000000UL || dlane_bps < 160000000UL)
+ if (dlane_bps > 2500000000UL || dlane_bps < 80000000UL)
return -EINVAL;
else if (dlane_bps >= 1250000000)
cfg->pll_opdiv = 1;
@@ -125,6 +125,8 @@ static int cdns_dsi_get_dphy_pll_cfg(struct cdns_dphy *dphy,
cfg->pll_opdiv = 4;
else if (dlane_bps >= 160000000)
cfg->pll_opdiv = 8;
+ else if (dlane_bps >= 80000000)
+ cfg->pll_opdiv = 16;
cfg->pll_fbdiv = DIV_ROUND_UP_ULL(dlane_bps * 2 * cfg->pll_opdiv *
cfg->pll_ipdiv,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 111/300] net: sh_eth: Disable WoL if system can not suspend
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 110/300] phy: cadence: cdns-dphy: Enable lower resolutions in dphy Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 112/300] media: redrat3: use int type to store negative error codes Greg Kroah-Hartman
` (194 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Andrew Lunn,
Geert Uytterhoeven, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 9c02ea544ac35a9def5827d30594406947ccd81a ]
The MAC can't facilitate WoL if the system can't go to sleep. Gate the
WoL support callbacks in ethtool at compile time using CONFIG_PM_SLEEP.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://patch.msgid.link/20250909085849.3808169-1-niklas.soderlund+renesas@ragnatech.se
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/renesas/sh_eth.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index e2019dc3ac563..88ba7972ce635 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -2362,6 +2362,7 @@ static int sh_eth_set_ringparam(struct net_device *ndev,
return 0;
}
+#ifdef CONFIG_PM_SLEEP
static void sh_eth_get_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
{
struct sh_eth_private *mdp = netdev_priv(ndev);
@@ -2388,6 +2389,7 @@ static int sh_eth_set_wol(struct net_device *ndev, struct ethtool_wolinfo *wol)
return 0;
}
+#endif
static const struct ethtool_ops sh_eth_ethtool_ops = {
.get_regs_len = sh_eth_get_regs_len,
@@ -2403,8 +2405,10 @@ static const struct ethtool_ops sh_eth_ethtool_ops = {
.set_ringparam = sh_eth_set_ringparam,
.get_link_ksettings = phy_ethtool_get_link_ksettings,
.set_link_ksettings = phy_ethtool_set_link_ksettings,
+#ifdef CONFIG_PM_SLEEP
.get_wol = sh_eth_get_wol,
.set_wol = sh_eth_set_wol,
+#endif
};
/* network device open function */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 112/300] media: redrat3: use int type to store negative error codes
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 111/300] net: sh_eth: Disable WoL if system can not suspend Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 113/300] selftests: traceroute: Use require_command() Greg Kroah-Hartman
` (193 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qianfeng Rong, Sean Young,
Hans Verkuil, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qianfeng Rong <rongqianfeng@vivo.com>
[ Upstream commit ecba852dc9f4993f4f894ea1f352564560e19a3e ]
Change "ret" from u8 to int type in redrat3_enable_detector() to store
negative error codes or zero returned by redrat3_send_cmd() and
usb_submit_urb() - this better aligns with the coding standards and
maintains code consistency.
No effect on runtime.
Signed-off-by: Qianfeng Rong <rongqianfeng@vivo.com>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Hans Verkuil <hverkuil+cisco@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/rc/redrat3.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/rc/redrat3.c b/drivers/media/rc/redrat3.c
index a61f9820ade95..dc4e9b14baa9f 100644
--- a/drivers/media/rc/redrat3.c
+++ b/drivers/media/rc/redrat3.c
@@ -422,7 +422,7 @@ static int redrat3_send_cmd(int cmd, struct redrat3_dev *rr3)
static int redrat3_enable_detector(struct redrat3_dev *rr3)
{
struct device *dev = rr3->dev;
- u8 ret;
+ int ret;
ret = redrat3_send_cmd(RR3_RC_DET_ENABLE, rr3);
if (ret != 0)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 113/300] selftests: traceroute: Use require_command()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 112/300] media: redrat3: use int type to store negative error codes Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 114/300] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT Greg Kroah-Hartman
` (192 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Petr Machata, David Ahern,
Ido Schimmel, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 47efbac9b768553331b9459743a29861e0acd797 ]
Use require_command() so that the test will return SKIP (4) when a
required command is not present.
Before:
# ./traceroute.sh
SKIP: Could not run IPV6 test without traceroute6
SKIP: Could not run IPV4 test without traceroute
$ echo $?
0
After:
# ./traceroute.sh
TEST: traceroute6 not installed [SKIP]
$ echo $?
4
Reviewed-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20250908073238.119240-6-idosch@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/traceroute.sh | 13 +++----------
1 file changed, 3 insertions(+), 10 deletions(-)
diff --git a/tools/testing/selftests/net/traceroute.sh b/tools/testing/selftests/net/traceroute.sh
index de9ca97abc306..9cb5e96e64333 100755
--- a/tools/testing/selftests/net/traceroute.sh
+++ b/tools/testing/selftests/net/traceroute.sh
@@ -209,11 +209,6 @@ setup_traceroute6()
run_traceroute6()
{
- if [ ! -x "$(command -v traceroute6)" ]; then
- echo "SKIP: Could not run IPV6 test without traceroute6"
- return
- fi
-
setup_traceroute6
# traceroute6 host-2 from host-1 (expects 2000:102::2)
@@ -278,11 +273,6 @@ setup_traceroute()
run_traceroute()
{
- if [ ! -x "$(command -v traceroute)" ]; then
- echo "SKIP: Could not run IPV4 test without traceroute"
- return
- fi
-
setup_traceroute
# traceroute host-2 from host-1 (expects 1.0.1.1). Takes a while.
@@ -316,6 +306,9 @@ do
esac
done
+require_command traceroute6
+require_command traceroute
+
run_tests
printf "\nTests passed: %3d\n" ${nsuccess}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 114/300] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 113/300] selftests: traceroute: Use require_command() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 115/300] selftests: Disable dad for ipv6 in fcnal-test.sh Greg Kroah-Hartman
` (191 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li RongQing, Sean Christopherson,
Wangyang Guo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li RongQing <lirongqing@baidu.com>
[ Upstream commit 960550503965094b0babd7e8c83ec66c8a763b0b ]
The commit b2798ba0b876 ("KVM: X86: Choose qspinlock when dedicated
physical CPUs are available") states that when PV_DEDICATED=1
(vCPU has dedicated pCPU), qspinlock should be preferred regardless of
PV_UNHALT. However, the current implementation doesn't reflect this: when
PV_UNHALT=0, we still use virt_spin_lock() even with dedicated pCPUs.
This is suboptimal because:
1. Native qspinlocks should outperform virt_spin_lock() for dedicated
vCPUs irrespective of HALT exiting
2. virt_spin_lock() should only be preferred when vCPUs may be preempted
(non-dedicated case)
So reorder the PV spinlock checks to:
1. First handle dedicated pCPU case (disable virt_spin_lock_key)
2. Second check single CPU, and nopvspin configuration
3. Only then check PV_UNHALT support
This ensures we always use native qspinlock for dedicated vCPUs, delivering
pretty performance gains at high contention levels.
Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Sean Christopherson <seanjc@google.com>
Tested-by: Wangyang Guo <wangyang.guo@intel.com>
Link: https://lore.kernel.org/r/20250722110005.4988-1-lirongqing@baidu.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/kernel/kvm.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index fe9babe94861f..d7d2eb79120d6 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c
@@ -964,16 +964,6 @@ ASM_RET
*/
void __init kvm_spinlock_init(void)
{
- /*
- * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
- * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
- * preferred over native qspinlock when vCPU is preempted.
- */
- if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
- pr_info("PV spinlocks disabled, no host support\n");
- return;
- }
-
/*
* Disable PV spinlocks and use native qspinlock when dedicated pCPUs
* are available.
@@ -993,6 +983,16 @@ void __init kvm_spinlock_init(void)
goto out;
}
+ /*
+ * In case host doesn't support KVM_FEATURE_PV_UNHALT there is still an
+ * advantage of keeping virt_spin_lock_key enabled: virt_spin_lock() is
+ * preferred over native qspinlock when vCPU is preempted.
+ */
+ if (!kvm_para_has_feature(KVM_FEATURE_PV_UNHALT)) {
+ pr_info("PV spinlocks disabled, no host support\n");
+ return;
+ }
+
pr_info("PV spinlocks enabled\n");
__pv_init_lock_hash();
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 115/300] selftests: Disable dad for ipv6 in fcnal-test.sh
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 114/300] x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 116/300] eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP Greg Kroah-Hartman
` (190 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@kernel.org>
[ Upstream commit 53d591730ea34f97a82f7ec6e7c987ca6e34dc21 ]
Constrained test environment; duplicate address detection is not needed
and causes races so disable it.
Signed-off-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250910025828.38900-1-dsahern@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fcnal-test.sh | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index acffe0029fdd1..806c409de124e 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -400,6 +400,8 @@ create_ns()
ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.keep_addr_on_down=1
ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.forwarding=1
ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.forwarding=1
+ ip netns exec ${ns} sysctl -qw net.ipv6.conf.default.accept_dad=0
+ ip netns exec ${ns} sysctl -qw net.ipv6.conf.all.accept_dad=0
}
# create veth pair to connect namespaces and apply addresses.
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 116/300] eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 115/300] selftests: Disable dad for ipv6 in fcnal-test.sh Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 117/300] selftests: Replace sleep with slowwait Greg Kroah-Hartman
` (189 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Palmer, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Palmer <daniel@thingy.jp>
[ Upstream commit 43adad382e1fdecabd2c4cd2bea777ef4ce4109e ]
When 8139too is probing and 8139TOO_PIO=y it will call pci_iomap_range()
and from there __pci_ioport_map() for the PCI IO space.
If HAS_IOPORT_MAP=n and NO_GENERIC_PCI_IOPORT_MAP=n, like it is on my
m68k config, __pci_ioport_map() becomes NULL, pci_iomap_range() will
always fail and the driver will complain it couldn't map the PIO space
and return an error.
NO_IOPORT_MAP seems to cover the case where what 8139too is trying
to do cannot ever work so make 8139TOO_PIO depend on being it false
and avoid creating an unusable driver.
Signed-off-by: Daniel Palmer <daniel@thingy.jp>
Link: https://patch.msgid.link/20250907064349.3427600-1-daniel@thingy.jp
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/realtek/Kconfig b/drivers/net/ethernet/realtek/Kconfig
index 93d9df55b361a..01811924c4db4 100644
--- a/drivers/net/ethernet/realtek/Kconfig
+++ b/drivers/net/ethernet/realtek/Kconfig
@@ -58,7 +58,7 @@ config 8139TOO
config 8139TOO_PIO
bool "Use PIO instead of MMIO"
default y
- depends on 8139TOO
+ depends on 8139TOO && !NO_IOPORT_MAP
help
This instructs the driver to use programmed I/O ports (PIO) instead
of PCI shared memory (MMIO). This can possibly solve some problems
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 117/300] selftests: Replace sleep with slowwait
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 116/300] eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-09 15:22 ` Ben Hutchings
2025-12-03 15:25 ` [PATCH 5.10 118/300] udp_tunnel: use netdev_warn() instead of netdev_WARN() Greg Kroah-Hartman
` (188 subsequent siblings)
305 siblings, 1 reply; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Ahern, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@kernel.org>
[ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
Replace the sleep in kill_procs with slowwait.
Signed-off-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fcnal-test.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
index 806c409de124e..2f5cdbc5dee39 100755
--- a/tools/testing/selftests/net/fcnal-test.sh
+++ b/tools/testing/selftests/net/fcnal-test.sh
@@ -183,7 +183,7 @@ show_hint()
kill_procs()
{
killall nettest ping ping6 >/dev/null 2>&1
- sleep 1
+ slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
}
do_run_cmd()
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 117/300] selftests: Replace sleep with slowwait
2025-12-03 15:25 ` [PATCH 5.10 117/300] selftests: Replace sleep with slowwait Greg Kroah-Hartman
@ 2025-12-09 15:22 ` Ben Hutchings
0 siblings, 0 replies; 312+ messages in thread
From: Ben Hutchings @ 2025-12-09 15:22 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, David Ahern, Simon Horman, Jakub Kicinski, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1392 bytes --]
On Wed, 2025-12-03 at 16:25 +0100, Greg Kroah-Hartman wrote:
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: David Ahern <dsahern@kernel.org>
>
> [ Upstream commit 2f186dd5585c3afb415df80e52f71af16c9d3655 ]
>
> Replace the sleep in kill_procs with slowwait.
The slowwait function isn't defined in 5.10 (or any stable branch older
than 6.9).
Ben.
> Signed-off-by: David Ahern <dsahern@kernel.org>
> Reviewed-by: Simon Horman <horms@kernel.org>
> Link: https://patch.msgid.link/20250910025828.38900-2-dsahern@kernel.org
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> tools/testing/selftests/net/fcnal-test.sh | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/net/fcnal-test.sh b/tools/testing/selftests/net/fcnal-test.sh
> index 806c409de124e..2f5cdbc5dee39 100755
> --- a/tools/testing/selftests/net/fcnal-test.sh
> +++ b/tools/testing/selftests/net/fcnal-test.sh
> @@ -183,7 +183,7 @@ show_hint()
> kill_procs()
> {
> killall nettest ping ping6 >/dev/null 2>&1
> - sleep 1
> + slowwait 2 sh -c 'test -z "$(pgrep '"'^(nettest|ping|ping6)$'"')"'
> }
>
> do_run_cmd()
--
Ben Hutchings
It is easier to write an incorrect program
than to understand a correct one.
[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 312+ messages in thread
* [PATCH 5.10 118/300] udp_tunnel: use netdev_warn() instead of netdev_WARN()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 117/300] selftests: Replace sleep with slowwait Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 119/300] net/cls_cgroup: Fix task_get_classid() during qdisc run Greg Kroah-Hartman
` (187 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alok Tiwari, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alok Tiwari <alok.a.tiwari@oracle.com>
[ Upstream commit dc2f650f7e6857bf384069c1a56b2937a1ee370d ]
netdev_WARN() uses WARN/WARN_ON to print a backtrace along with
file and line information. In this case, udp_tunnel_nic_register()
returning an error is just a failed operation, not a kernel bug.
udp_tunnel_nic_register() can fail due to a memory allocation
failure (kzalloc() or udp_tunnel_nic_alloc()).
This is a normal runtime error and not a kernel bug.
Replace netdev_WARN() with netdev_warn() accordingly.
Signed-off-by: Alok Tiwari <alok.a.tiwari@oracle.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250910195031.3784748-1-alok.a.tiwari@oracle.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/udp_tunnel_nic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/udp_tunnel_nic.c b/net/ipv4/udp_tunnel_nic.c
index bc3a043a5d5c7..72b0210cdead7 100644
--- a/net/ipv4/udp_tunnel_nic.c
+++ b/net/ipv4/udp_tunnel_nic.c
@@ -897,7 +897,7 @@ udp_tunnel_nic_netdevice_event(struct notifier_block *unused,
err = udp_tunnel_nic_register(dev);
if (err)
- netdev_WARN(dev, "failed to register for UDP tunnel offloads: %d", err);
+ netdev_warn(dev, "failed to register for UDP tunnel offloads: %d", err);
return notifier_from_errno(err);
}
/* All other events will need the udp_tunnel_nic state */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 119/300] net/cls_cgroup: Fix task_get_classid() during qdisc run
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 118/300] udp_tunnel: use netdev_warn() instead of netdev_WARN() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 120/300] selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency Greg Kroah-Hartman
` (186 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yafang Shao, Daniel Borkmann,
Thomas Graf, Sebastian Andrzej Siewior, Nikolay Aleksandrov,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yafang Shao <laoar.shao@gmail.com>
[ Upstream commit 66048f8b3cc7e462953c04285183cdee43a1cb89 ]
During recent testing with the netem qdisc to inject delays into TCP
traffic, we observed that our CLS BPF program failed to function correctly
due to incorrect classid retrieval from task_get_classid(). The issue
manifests in the following call stack:
bpf_get_cgroup_classid+5
cls_bpf_classify+507
__tcf_classify+90
tcf_classify+217
__dev_queue_xmit+798
bond_dev_queue_xmit+43
__bond_start_xmit+211
bond_start_xmit+70
dev_hard_start_xmit+142
sch_direct_xmit+161
__qdisc_run+102 <<<<< Issue location
__dev_xmit_skb+1015
__dev_queue_xmit+637
neigh_hh_output+159
ip_finish_output2+461
__ip_finish_output+183
ip_finish_output+41
ip_output+120
ip_local_out+94
__ip_queue_xmit+394
ip_queue_xmit+21
__tcp_transmit_skb+2169
tcp_write_xmit+959
__tcp_push_pending_frames+55
tcp_push+264
tcp_sendmsg_locked+661
tcp_sendmsg+45
inet_sendmsg+67
sock_sendmsg+98
sock_write_iter+147
vfs_write+786
ksys_write+181
__x64_sys_write+25
do_syscall_64+56
entry_SYSCALL_64_after_hwframe+100
The problem occurs when multiple tasks share a single qdisc. In such cases,
__qdisc_run() may transmit skbs created by different tasks. Consequently,
task_get_classid() retrieves an incorrect classid since it references the
current task's context rather than the skb's originating task.
Given that dev_queue_xmit() always executes with bh disabled, we can use
softirq_count() instead to obtain the correct classid.
The simple steps to reproduce this issue:
1. Add network delay to the network interface:
such as: tc qdisc add dev bond0 root netem delay 1.5ms
2. Build two distinct net_cls cgroups, each with a network-intensive task
3. Initiate parallel TCP streams from both tasks to external servers.
Under this specific condition, the issue reliably occurs. The kernel
eventually dequeues an SKB that originated from Task-A while executing in
the context of Task-B.
It is worth noting that it will change the established behavior for a
slightly different scenario:
<sock S is created by task A>
<class ID for task A is changed>
<skb is created by sock S xmit and classified>
prior to this patch the skb will be classified with the 'new' task A
classid, now with the old/original one. The bpf_get_cgroup_classid_curr()
function is a more appropriate choice for this case.
Signed-off-by: Yafang Shao <laoar.shao@gmail.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Thomas Graf <tgraf@suug.ch>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://patch.msgid.link/20250902062933.30087-1-laoar.shao@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/cls_cgroup.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/net/cls_cgroup.h b/include/net/cls_cgroup.h
index 7e78e7d6f0152..668aeee9b3f66 100644
--- a/include/net/cls_cgroup.h
+++ b/include/net/cls_cgroup.h
@@ -63,7 +63,7 @@ static inline u32 task_get_classid(const struct sk_buff *skb)
* calls by looking at the number of nested bh disable calls because
* softirqs always disables bh.
*/
- if (in_serving_softirq()) {
+ if (softirq_count()) {
struct sock *sk = skb_to_full_sk(skb);
/* If there is an sock_cgroup_classid we'll use that. */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 120/300] selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 119/300] net/cls_cgroup: Fix task_get_classid() during qdisc run Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 121/300] scsi: lpfc: Define size of debugfs entry for xri rebalancing Greg Kroah-Hartman
` (185 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nai-Chen Cheng, Simon Horman,
Shuah Khan, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nai-Chen Cheng <bleach1827@gmail.com>
[ Upstream commit d3f7457da7b9527a06dbcbfaf666aa51ac2eeb53 ]
The selftests 'make clean' does not clean the net/lib because it only
processes $(TARGETS) and ignores $(INSTALL_DEP_TARGETS). This leaves
compiled objects in net/lib after cleaning, requiring manual cleanup.
Include $(INSTALL_DEP_TARGETS) in clean target to ensure net/lib
dependency is properly cleaned.
Signed-off-by: Nai-Chen Cheng <bleach1827@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Simon Horman <horms@kernel.org> # build-tested
Acked-by: Shuah Khan <skhan@linuxfoundation.org>
Link: https://patch.msgid.link/20250910-selftests-makefile-clean-v1-1-29e7f496cd87@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile
index db1e24d7155fa..1d33d2d298dfc 100644
--- a/tools/testing/selftests/Makefile
+++ b/tools/testing/selftests/Makefile
@@ -257,7 +257,7 @@ gen_tar: install
@echo "Created ${TAR_PATH}"
clean:
- @for TARGET in $(TARGETS); do \
+ @for TARGET in $(TARGETS) $(INSTALL_DEP_TARGETS); do \
BUILD_TARGET=$$BUILD/$$TARGET; \
$(MAKE) OUTPUT=$$BUILD_TARGET -C $$TARGET clean;\
done;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 121/300] scsi: lpfc: Define size of debugfs entry for xri rebalancing
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 120/300] selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 122/300] allow finish_no_open(file, ERR_PTR(-E...)) Greg Kroah-Hartman
` (184 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Justin Tee, Martin K. Petersen,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Justin Tee <justin.tee@broadcom.com>
[ Upstream commit 5de09770b1c0e229d2cec93e7f634fcdc87c9bc8 ]
To assist in debugging lpfc_xri_rebalancing driver parameter, a debugfs
entry is used. The debugfs file operations for xri rebalancing have
been previously implemented, but lack definition for its information
buffer size. Similar to other pre-existing debugfs entry buffers,
define LPFC_HDWQINFO_SIZE as 8192 bytes.
Signed-off-by: Justin Tee <justin.tee@broadcom.com>
Message-ID: <20250915180811.137530-9-justintee8345@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_debugfs.h | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.h b/drivers/scsi/lpfc/lpfc_debugfs.h
index 7ab6d3b086982..cb14a62bffb28 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.h
+++ b/drivers/scsi/lpfc/lpfc_debugfs.h
@@ -44,6 +44,9 @@
/* hbqinfo output buffer size */
#define LPFC_HBQINFO_SIZE 8192
+/* hdwqinfo output buffer size */
+#define LPFC_HDWQINFO_SIZE 8192
+
/* nvmestat output buffer size */
#define LPFC_NVMESTAT_SIZE 8192
#define LPFC_IOKTIME_SIZE 8192
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 122/300] allow finish_no_open(file, ERR_PTR(-E...))
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 121/300] scsi: lpfc: Define size of debugfs entry for xri rebalancing Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 123/300] usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs Greg Kroah-Hartman
` (183 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Al Viro, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit fe91e078b60d1beabf5cef4a37c848457a6d2dfb ]
... allowing any ->lookup() return value to be passed to it.
Reviewed-by: NeilBrown <neil@brown.name>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/open.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/open.c b/fs/open.c
index 7bcc26b14cd79..f081f09e411ef 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -896,18 +896,20 @@ EXPORT_SYMBOL(finish_open);
* finish_no_open - finish ->atomic_open() without opening the file
*
* @file: file pointer
- * @dentry: dentry or NULL (as returned from ->lookup())
+ * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
*
- * This can be used to set the result of a successful lookup in ->atomic_open().
+ * This can be used to set the result of a lookup in ->atomic_open().
*
* NB: unlike finish_open() this function does consume the dentry reference and
* the caller need not dput() it.
*
- * Returns "0" which must be the return value of ->atomic_open() after having
- * called this function.
+ * Returns 0 or -E..., which must be the return value of ->atomic_open() after
+ * having called this function.
*/
int finish_no_open(struct file *file, struct dentry *dentry)
{
+ if (IS_ERR(dentry))
+ return PTR_ERR(dentry);
file->f_path.dentry = dentry;
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 123/300] usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 122/300] allow finish_no_open(file, ERR_PTR(-E...)) Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 124/300] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices Greg Kroah-Hartman
` (182 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Forest Crossman, Alan Stern,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Forest Crossman <cyrozap@gmail.com>
[ Upstream commit 368ed48a5ef52e384f54d5809f0a0b79ac567479 ]
The usbmon binary interface currently truncates captures of large
transfers from higher-speed USB devices. Because a single event capture
is limited to one-fifth of the total buffer size, the current maximum
size of a captured URB is around 240 KiB. This is insufficient when
capturing traffic from modern devices that use transfers of several
hundred kilobytes or more, as truncated URBs can make it impossible for
user-space USB analysis tools like Wireshark to properly defragment and
reassemble higher-level protocol packets in the captured data.
The root cause of this issue is the 1200 KiB BUFF_MAX limit, which has
not been changed since the binary interface was introduced in 2006.
To resolve this issue, this patch increases BUFF_MAX to 64 MiB. The
original comment for BUFF_MAX based the limit's calculation on a
saturated 480 Mbit/s bus. Applying the same logic to a modern USB 3.2
Gen 2×2 20 Gbit/s bus (~2500 MB/s over a 20ms window) indicates the
buffer should be at least 50 MB. The new limit of 64 MiB covers that,
plus a little extra for any overhead.
With this change, both users and developers should now be able to debug
and reverse engineer modern USB devices even when running unmodified
distro kernels.
Please note that this change does not affect the default buffer size. A
larger buffer is only allocated when a user explicitly requests it via
the MON_IOCT_RING_SIZE ioctl, so the change to the maximum buffer size
should not unduly increase memory usage for users that don't
deliberately request a larger buffer.
Link: https://lore.kernel.org/CAO3ALPzdUkmMr0YMrODLeDSLZqNCkWcAP8NumuPHLjNJ8wC1kQ@mail.gmail.com
Signed-off-by: Forest Crossman <cyrozap@gmail.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/CAO3ALPxU5RzcoueC454L=WZ1qGMfAcnxm+T+p+9D8O9mcrUbCQ@mail.gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/mon/mon_bin.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c
index 35483217b1f6c..93998d328d9aa 100644
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -68,18 +68,20 @@
* The magic limit was calculated so that it allows the monitoring
* application to pick data once in two ticks. This way, another application,
* which presumably drives the bus, gets to hog CPU, yet we collect our data.
- * If HZ is 100, a 480 mbit/s bus drives 614 KB every jiffy. USB has an
- * enormous overhead built into the bus protocol, so we need about 1000 KB.
+ *
+ * Originally, for a 480 Mbit/s bus this required a buffer of about 1 MB. For
+ * modern 20 Gbps buses, this value increases to over 50 MB. The maximum
+ * buffer size is set to 64 MiB to accommodate this.
*
* This is still too much for most cases, where we just snoop a few
* descriptor fetches for enumeration. So, the default is a "reasonable"
- * amount for systems with HZ=250 and incomplete bus saturation.
+ * amount for typical, low-throughput use cases.
*
* XXX What about multi-megabyte URBs which take minutes to transfer?
*/
-#define BUFF_MAX CHUNK_ALIGN(1200*1024)
-#define BUFF_DFL CHUNK_ALIGN(300*1024)
-#define BUFF_MIN CHUNK_ALIGN(8*1024)
+#define BUFF_MAX CHUNK_ALIGN(64*1024*1024)
+#define BUFF_DFL CHUNK_ALIGN(300*1024)
+#define BUFF_MIN CHUNK_ALIGN(8*1024)
/*
* The per-event API header (2 per URB).
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 124/300] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 123/300] usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 125/300] ipv6: np->rxpmtu race annotation Greg Kroah-Hartman
` (181 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Krishna Kurapati, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
[ Upstream commit 41cf11946b9076383a2222bbf1ef57d64d033f66 ]
Allow autosuspend to be used by xhci plat device. For Qualcomm SoCs,
when in host mode, it is intended that the controller goes to suspend
state to save power and wait for interrupts from connected peripheral
to wake it up. This is particularly used in cases where a HID or Audio
device is connected. In such scenarios, the usb controller can enter
auto suspend and resume action after getting interrupts from the
connected device.
Signed-off-by: Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
Link: https://lore.kernel.org/r/20250916120436.3617598-1-krishna.kurapati@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-plat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
index daf93bee7669b..c6ef7863c3e97 100644
--- a/drivers/usb/host/xhci-plat.c
+++ b/drivers/usb/host/xhci-plat.c
@@ -242,6 +242,7 @@ static int xhci_plat_probe(struct platform_device *pdev)
}
pm_runtime_set_active(&pdev->dev);
+ pm_runtime_use_autosuspend(&pdev->dev);
pm_runtime_enable(&pdev->dev);
pm_runtime_get_noresume(&pdev->dev);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 125/300] ipv6: np->rxpmtu race annotation
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 124/300] usb: xhci: plat: Facilitate using autosuspend for xhci plat devices Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 126/300] jfs: Verify inode mode when loading from disk Greg Kroah-Hartman
` (180 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Willem de Bruijn,
David Ahern, Kuniyuki Iwashima, Jakub Kicinski, Paolo Abeni,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 9fba1eb39e2f74d2002c5cbcf1d4435d37a4f752 ]
Add READ_ONCE() annotations because np->rxpmtu can be changed
while udpv6_recvmsg() and rawv6_recvmsg() read it.
Since this is a very rarely used feature, and that udpv6_recvmsg()
and rawv6_recvmsg() read np->rxopt anyway, change the test order
so that np->rxpmtu does not need to be in a hot cache line.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Link: https://patch.msgid.link/20250916160951.541279-4-edumazet@google.com
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/raw.c | 2 +-
net/ipv6/udp.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 7ff06fa7ed19a..3308b9a4d5237 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -474,7 +474,7 @@ static int rawv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len, addr_len);
- if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+ if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
skb = skb_recv_datagram(sk, flags, noblock, &err);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index a23780434edd3..db04e753ed5a3 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -361,7 +361,7 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
if (flags & MSG_ERRQUEUE)
return ipv6_recv_error(sk, msg, len, addr_len);
- if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+ if (np->rxopt.bits.rxpmtu && READ_ONCE(np->rxpmtu))
return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
try_again:
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 126/300] jfs: Verify inode mode when loading from disk
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 125/300] ipv6: np->rxpmtu race annotation Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 127/300] jfs: fix uninitialized waitqueue in transaction manager Greg Kroah-Hartman
` (179 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Tetsuo Handa, Dave Kleikamp,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
[ Upstream commit 7a5aa54fba2bd591b22b9b624e6baa9037276986 ]
The inode mode loaded from corrupted disk can be invalid. Do like what
commit 0a9e74051313 ("isofs: Verify inode mode when loading from disk")
does.
Reported-by: syzbot <syzbot+895c23f6917da440ed0d@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?extid=895c23f6917da440ed0d
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/inode.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c
index 2472b33e3a2d8..01f55fac31cf3 100644
--- a/fs/jfs/inode.c
+++ b/fs/jfs/inode.c
@@ -59,9 +59,15 @@ struct inode *jfs_iget(struct super_block *sb, unsigned long ino)
*/
inode->i_link[inode->i_size] = '\0';
}
- } else {
+ } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) ||
+ S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) {
inode->i_op = &jfs_file_inode_operations;
init_special_inode(inode, inode->i_mode, inode->i_rdev);
+ } else {
+ printk(KERN_DEBUG "JFS: Invalid file type 0%04o for inode %lu.\n",
+ inode->i_mode, inode->i_ino);
+ iget_failed(inode);
+ return ERR_PTR(-EIO);
}
unlock_new_inode(inode);
return inode;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 127/300] jfs: fix uninitialized waitqueue in transaction manager
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 126/300] jfs: Verify inode mode when loading from disk Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:37 ` syzbot
2025-12-03 15:25 ` [PATCH 5.10 128/300] wifi: ath10k: Fix connection after GTK rekeying Greg Kroah-Hartman
` (178 subsequent siblings)
305 siblings, 1 reply; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c4f3462d8b2ad7977bea,
Shaurya Rane, Dave Kleikamp, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
[ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
The transaction manager initialization in txInit() was not properly
initializing TxBlock[0].waitor waitqueue, causing a crash when
txEnd(0) is called on read-only filesystems.
When a filesystem is mounted read-only, txBegin() returns tid=0 to
indicate no transaction. However, txEnd(0) still gets called and
tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
waitqueue was never initialized because the initialization loop
started at index 1 instead of 0.
This causes a 'non-static key' lockdep warning and system crash:
INFO: trying to register non-static key in txEnd
Fix by ensuring all transaction blocks including TxBlock[0] have
their waitqueues properly initialized during txInit().
Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jfs/jfs_txnmgr.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
index 6f6a5b9203d3f..97a2eb0f0b75d 100644
--- a/fs/jfs/jfs_txnmgr.c
+++ b/fs/jfs/jfs_txnmgr.c
@@ -272,14 +272,15 @@ int txInit(void)
if (TxBlock == NULL)
return -ENOMEM;
- for (k = 1; k < nTxBlock - 1; k++) {
- TxBlock[k].next = k + 1;
+ for (k = 0; k < nTxBlock; k++) {
init_waitqueue_head(&TxBlock[k].gcwait);
init_waitqueue_head(&TxBlock[k].waitor);
}
+
+ for (k = 1; k < nTxBlock - 1; k++) {
+ TxBlock[k].next = k + 1;
+ }
TxBlock[k].next = 0;
- init_waitqueue_head(&TxBlock[k].gcwait);
- init_waitqueue_head(&TxBlock[k].waitor);
TxAnchor.freetid = 1;
init_waitqueue_head(&TxAnchor.freewait);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 127/300] jfs: fix uninitialized waitqueue in transaction manager
2025-12-03 15:25 ` [PATCH 5.10 127/300] jfs: fix uninitialized waitqueue in transaction manager Greg Kroah-Hartman
@ 2025-12-03 15:37 ` syzbot
0 siblings, 0 replies; 312+ messages in thread
From: syzbot @ 2025-12-03 15:37 UTC (permalink / raw)
To: gregkh; +Cc: dave.kleikamp, gregkh, patches, sashal, ssrane_b23, stable
> 5.10-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
>
> [ Upstream commit 300b072df72694ea330c4c673c035253e07827b8 ]
>
> The transaction manager initialization in txInit() was not properly
> initializing TxBlock[0].waitor waitqueue, causing a crash when
> txEnd(0) is called on read-only filesystems.
>
> When a filesystem is mounted read-only, txBegin() returns tid=0 to
> indicate no transaction. However, txEnd(0) still gets called and
> tries to access TxBlock[0].waitor via tid_to_tblock(0), but this
> waitqueue was never initialized because the initialization loop
> started at index 1 instead of 0.
>
> This causes a 'non-static key' lockdep warning and system crash:
> INFO: trying to register non-static key in txEnd
>
> Fix by ensuring all transaction blocks including TxBlock[0] have
> their waitqueues properly initialized during txInit().
>
> Reported-by: syzbot+c4f3462d8b2ad7977bea@syzkaller.appspotmail.com
>
> Signed-off-by: Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
> Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> fs/jfs/jfs_txnmgr.c | 9 +++++----
> 1 file changed, 5 insertions(+), 4 deletions(-)
>
> diff --git a/fs/jfs/jfs_txnmgr.c b/fs/jfs/jfs_txnmgr.c
> index 6f6a5b9203d3f..97a2eb0f0b75d 100644
> --- a/fs/jfs/jfs_txnmgr.c
> +++ b/fs/jfs/jfs_txnmgr.c
> @@ -272,14 +272,15 @@ int txInit(void)
> if (TxBlock == NULL)
> return -ENOMEM;
>
> - for (k = 1; k < nTxBlock - 1; k++) {
> - TxBlock[k].next = k + 1;
> + for (k = 0; k < nTxBlock; k++) {
> init_waitqueue_head(&TxBlock[k].gcwait);
> init_waitqueue_head(&TxBlock[k].waitor);
> }
> +
> + for (k = 1; k < nTxBlock - 1; k++) {
> + TxBlock[k].next = k + 1;
> + }
> TxBlock[k].next = 0;
> - init_waitqueue_head(&TxBlock[k].gcwait);
> - init_waitqueue_head(&TxBlock[k].waitor);
>
> TxAnchor.freetid = 1;
> init_waitqueue_head(&TxAnchor.freewait);
> --
> 2.51.0
>
>
>
I see the command but can't find the corresponding bug.
The email is sent to syzbot+HASH@syzkaller.appspotmail.com address
but the HASH does not correspond to any known bug.
Please double check the address.
^ permalink raw reply [flat|nested] 312+ messages in thread
* [PATCH 5.10 128/300] wifi: ath10k: Fix connection after GTK rekeying
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 127/300] jfs: fix uninitialized waitqueue in transaction manager Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 129/300] net: intel: fm10k: Fix parameter idx set but not used Greg Kroah-Hartman
` (177 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Klimov, Loic Poulain,
Baochen Qiang, Vasanthakumar Thiagarajan, Jeff Johnson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Loic Poulain <loic.poulain@oss.qualcomm.com>
[ Upstream commit 487e8a8c3421df0af3707e54c7e069f1d89cbda7 ]
It appears that not all hardware/firmware implementations support
group key deletion correctly, which can lead to connection hangs
and deauthentication following GTK rekeying (delete and install).
To avoid this issue, instead of attempting to delete the key using
the special WMI_CIPHER_NONE value, we now replace the key with an
invalid (random) value.
This behavior has been observed with WCN39xx chipsets.
Tested-on: WCN3990 hw1.0 WLAN.HL.3.3.7.c2-00931-QCAHLSWMTPLZ-1
Reported-by: Alexey Klimov <alexey.klimov@linaro.org>
Closes: https://lore.kernel.org/all/DAWJQ2NIKY28.1XOG35E4A682G@linaro.org
Signed-off-by: Loic Poulain <loic.poulain@oss.qualcomm.com>
Reviewed-by: Baochen Qiang <baochen.qiang@oss.qualcomm.com>
Reviewed-by: Vasanthakumar Thiagarajan <vasanthakumar.thiagarajan@oss.qualcomm.com>
Tested-by: Alexey Klimov <alexey.klimov@linaro.org> # QRB2210 RB1
Link: https://patch.msgid.link/20250902143225.837487-1-loic.poulain@oss.qualcomm.com
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/mac.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
index 5dd0239e9d51b..3a708b3c9d4ec 100644
--- a/drivers/net/wireless/ath/ath10k/mac.c
+++ b/drivers/net/wireless/ath/ath10k/mac.c
@@ -13,6 +13,7 @@
#include <linux/acpi.h>
#include <linux/of.h>
#include <linux/bitfield.h>
+#include <linux/random.h>
#include "hif.h"
#include "core.h"
@@ -275,8 +276,15 @@ static int ath10k_send_key(struct ath10k_vif *arvif,
key->flags |= IEEE80211_KEY_FLAG_GENERATE_IV;
if (cmd == DISABLE_KEY) {
- arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
- arg.key_data = NULL;
+ if (flags & WMI_KEY_GROUP) {
+ /* Not all hardware handles group-key deletion operation
+ * correctly. Replace the key with a junk value to invalidate it.
+ */
+ get_random_bytes(key->key, key->keylen);
+ } else {
+ arg.key_cipher = ar->wmi_key_cipher[WMI_CIPHER_NONE];
+ arg.key_data = NULL;
+ }
}
return ath10k_wmi_vdev_install_key(arvif->ar, &arg);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 129/300] net: intel: fm10k: Fix parameter idx set but not used
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 128/300] wifi: ath10k: Fix connection after GTK rekeying Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 130/300] r8169: set EEE speed down ratio to 1 Greg Kroah-Hartman
` (176 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vadim Fedorenko, Brahmajit Das,
Aleksandr Loktionov, Tony Nguyen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brahmajit Das <listout@listout.xyz>
[ Upstream commit 99e9c5ffbbee0f258a1da4eadf602b943f8c8300 ]
Variable idx is set in the loop, but is never used resulting in dead
code. Building with GCC 16, which enables
-Werror=unused-but-set-parameter= by default results in build error.
This patch removes the idx parameter, since all the callers of the
fm10k_unbind_hw_stats_q as 0 as idx anyways.
Suggested-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Brahmajit Das <listout@listout.xyz>
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 ++---
drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +-
drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +-
4 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.c b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
index f51a63fca513e..1f919a50c7653 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.c
@@ -447,17 +447,16 @@ void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
/**
* fm10k_unbind_hw_stats_q - Unbind the queue counters from their queues
* @q: pointer to the ring of hardware statistics queue
- * @idx: index pointing to the start of the ring iteration
* @count: number of queues to iterate over
*
* Function invalidates the index values for the queues so any updates that
* may have happened are ignored and the base for the queue stats is reset.
**/
-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count)
+void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count)
{
u32 i;
- for (i = 0; i < count; i++, idx++, q++) {
+ for (i = 0; i < count; i++, q++) {
q->rx_stats_idx = 0;
q->tx_stats_idx = 0;
}
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_common.h b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
index 4c48fb73b3e78..13fca6a91a01b 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_common.h
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_common.h
@@ -43,6 +43,6 @@ u32 fm10k_read_hw_stats_32b(struct fm10k_hw *hw, u32 addr,
void fm10k_update_hw_stats_q(struct fm10k_hw *hw, struct fm10k_hw_stats_q *q,
u32 idx, u32 count);
#define fm10k_unbind_hw_stats_32b(s) ((s)->base_h = 0)
-void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 idx, u32 count);
+void fm10k_unbind_hw_stats_q(struct fm10k_hw_stats_q *q, u32 count);
s32 fm10k_get_host_state_generic(struct fm10k_hw *hw, bool *host_ready);
#endif /* _FM10K_COMMON_H_ */
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
index c0780c3624c82..7e0e790f38b70 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pf.c
@@ -1509,7 +1509,7 @@ static void fm10k_rebind_hw_stats_pf(struct fm10k_hw *hw,
fm10k_unbind_hw_stats_32b(&stats->nodesc_drop);
/* Unbind Queue Statistics */
- fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
+ fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
/* Reinitialize bases for all stats */
fm10k_update_hw_stats_pf(hw, stats);
diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
index dc8ccd378ec92..6a3aebd56e6c4 100644
--- a/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
+++ b/drivers/net/ethernet/intel/fm10k/fm10k_vf.c
@@ -465,7 +465,7 @@ static void fm10k_rebind_hw_stats_vf(struct fm10k_hw *hw,
struct fm10k_hw_stats *stats)
{
/* Unbind Queue Statistics */
- fm10k_unbind_hw_stats_q(stats->q, 0, hw->mac.max_queues);
+ fm10k_unbind_hw_stats_q(stats->q, hw->mac.max_queues);
/* Reinitialize bases for all stats */
fm10k_update_hw_stats_vf(hw, stats);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 130/300] r8169: set EEE speed down ratio to 1
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 129/300] net: intel: fm10k: Fix parameter idx set but not used Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 131/300] PCI: cadence: Check for the existence of cdns_pcie::ops before using it Greg Kroah-Hartman
` (175 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChunHao Lin, Heiner Kallweit,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChunHao Lin <hau@realtek.com>
[ Upstream commit bf7154ffb1c65a201906296a9d3eb22e9daa5ffc ]
EEE speed down means speed down MAC MCU clock. It is not from spec.
It is kind of Realtek specific power saving feature. But enable it
may cause some issues, like packet drop or interrupt loss. Different
hardware may have different issues.
EEE speed down ratio (mac ocp 0xe056[7:4]) is used to set EEE speed
down rate. The larger this value is, the more power can save. But it
actually save less power then we expected. And, as mentioned above,
will impact compatibility. So set it to 1 (mac ocp 0xe056[7:4] = 0)
, which means not to speed down, to improve compatibility.
Signed-off-by: ChunHao Lin <hau@realtek.com>
Reviewed-by: Heiner Kallweit <hkallweit1@gmail.com>
Link: https://patch.msgid.link/20250918023425.3463-1-hau@realtek.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/realtek/r8169_main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/realtek/r8169_main.c b/drivers/net/ethernet/realtek/r8169_main.c
index 9fb8fdd5b2619..fc3e42c1ee0d9 100644
--- a/drivers/net/ethernet/realtek/r8169_main.c
+++ b/drivers/net/ethernet/realtek/r8169_main.c
@@ -3278,7 +3278,7 @@ static void rtl_hw_start_8168h_1(struct rtl8169_private *tp)
r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
}
- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
r8168_mac_ocp_modify(tp, 0xe052, 0x6000, 0x8008);
r8168_mac_ocp_modify(tp, 0xe0d6, 0x01ff, 0x017f);
r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
@@ -3433,7 +3433,7 @@ static void rtl_hw_start_8117(struct rtl8169_private *tp)
r8168_mac_ocp_modify(tp, 0xd412, 0x0fff, sw_cnt_1ms_ini);
}
- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0070);
+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
r8168_mac_ocp_write(tp, 0xea80, 0x0003);
r8168_mac_ocp_modify(tp, 0xe052, 0x0000, 0x0009);
r8168_mac_ocp_modify(tp, 0xd420, 0x0fff, 0x047f);
@@ -3628,7 +3628,7 @@ static void rtl_hw_start_8125_common(struct rtl8169_private *tp)
r8168_mac_ocp_modify(tp, 0xc0b4, 0x0000, 0x000c);
r8168_mac_ocp_modify(tp, 0xeb6a, 0x00ff, 0x0033);
r8168_mac_ocp_modify(tp, 0xeb50, 0x03e0, 0x0040);
- r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0030);
+ r8168_mac_ocp_modify(tp, 0xe056, 0x00f0, 0x0000);
r8168_mac_ocp_modify(tp, 0xe040, 0x1000, 0x0000);
r8168_mac_ocp_modify(tp, 0xea1c, 0x0003, 0x0001);
r8168_mac_ocp_modify(tp, 0xe0c0, 0x4f0f, 0x4403);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 131/300] PCI: cadence: Check for the existence of cdns_pcie::ops before using it
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 130/300] r8169: set EEE speed down ratio to 1 Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 132/300] sparc/module: Add R_SPARC_UA64 relocation handling Greg Kroah-Hartman
` (174 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen Wang, Manivannan Sadhasivam,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Wang <unicorn_wang@outlook.com>
[ Upstream commit 49a6c160ad4812476f8ae1a8f4ed6d15adfa6c09 ]
cdns_pcie::ops might not be populated by all the Cadence glue drivers. This
is going to be true for the upcoming Sophgo platform which doesn't set the
ops.
Hence, add a check to prevent NULL pointer dereference.
Signed-off-by: Chen Wang <unicorn_wang@outlook.com>
[mani: reworded subject and description]
Signed-off-by: Manivannan Sadhasivam <mani@kernel.org>
Link: https://patch.msgid.link/35182ee1d972dfcd093a964e11205efcebbdc044.1757643388.git.unicorn_wang@outlook.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
drivers/pci/controller/cadence/pcie-cadence.c | 4 ++--
drivers/pci/controller/cadence/pcie-cadence.h | 6 +++---
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/pci/controller/cadence/pcie-cadence-host.c b/drivers/pci/controller/cadence/pcie-cadence-host.c
index c29176bdecd19..28e1497a4fc40 100644
--- a/drivers/pci/controller/cadence/pcie-cadence-host.c
+++ b/drivers/pci/controller/cadence/pcie-cadence-host.c
@@ -444,7 +444,7 @@ static int cdns_pcie_host_init_address_translation(struct cdns_pcie_rc *rc)
cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_PCI_ADDR1(0), addr1);
cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(0), desc1);
- if (pcie->ops->cpu_addr_fixup)
+ if (pcie->ops && pcie->ops->cpu_addr_fixup)
cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(12) |
diff --git a/drivers/pci/controller/cadence/pcie-cadence.c b/drivers/pci/controller/cadence/pcie-cadence.c
index 52767f26048fd..7b4d403569ecd 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.c
+++ b/drivers/pci/controller/cadence/pcie-cadence.c
@@ -89,7 +89,7 @@ void cdns_pcie_set_outbound_region(struct cdns_pcie *pcie, u8 busnr, u8 fn,
cdns_pcie_writel(pcie, CDNS_PCIE_AT_OB_REGION_DESC1(r), desc1);
/* Set the CPU address */
- if (pcie->ops->cpu_addr_fixup)
+ if (pcie->ops && pcie->ops->cpu_addr_fixup)
cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(nbits) |
@@ -119,7 +119,7 @@ void cdns_pcie_set_outbound_region_for_normal_msg(struct cdns_pcie *pcie,
}
/* Set the CPU address */
- if (pcie->ops->cpu_addr_fixup)
+ if (pcie->ops && pcie->ops->cpu_addr_fixup)
cpu_addr = pcie->ops->cpu_addr_fixup(pcie, cpu_addr);
addr0 = CDNS_PCIE_AT_OB_REGION_CPU_ADDR0_NBITS(17) |
diff --git a/drivers/pci/controller/cadence/pcie-cadence.h b/drivers/pci/controller/cadence/pcie-cadence.h
index 3139ea9f02c89..f01f683d1cb95 100644
--- a/drivers/pci/controller/cadence/pcie-cadence.h
+++ b/drivers/pci/controller/cadence/pcie-cadence.h
@@ -471,7 +471,7 @@ static inline u32 cdns_pcie_ep_fn_readl(struct cdns_pcie *pcie, u8 fn, u32 reg)
static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
{
- if (pcie->ops->start_link)
+ if (pcie->ops && pcie->ops->start_link)
return pcie->ops->start_link(pcie);
return 0;
@@ -479,13 +479,13 @@ static inline int cdns_pcie_start_link(struct cdns_pcie *pcie)
static inline void cdns_pcie_stop_link(struct cdns_pcie *pcie)
{
- if (pcie->ops->stop_link)
+ if (pcie->ops && pcie->ops->stop_link)
pcie->ops->stop_link(pcie);
}
static inline bool cdns_pcie_link_up(struct cdns_pcie *pcie)
{
- if (pcie->ops->link_up)
+ if (pcie->ops && pcie->ops->link_up)
return pcie->ops->link_up(pcie);
return true;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 132/300] sparc/module: Add R_SPARC_UA64 relocation handling
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 131/300] PCI: cadence: Check for the existence of cdns_pcie::ops before using it Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 133/300] remoteproc: qcom: q6v5: Avoid handling handover twice Greg Kroah-Hartman
` (173 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Koakuma, Andreas Larsson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Koakuma <koachan@protonmail.com>
[ Upstream commit 05457d96175d25c976ab6241c332ae2eb5e07833 ]
This is needed so that the kernel can handle R_SPARC_UA64 relocations,
which is emitted by LLVM's IAS.
Signed-off-by: Koakuma <koachan@protonmail.com>
Reviewed-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/sparc/include/asm/elf_64.h | 1 +
arch/sparc/kernel/module.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/arch/sparc/include/asm/elf_64.h b/arch/sparc/include/asm/elf_64.h
index 7e078bc73ef56..d3dda47d0bc5a 100644
--- a/arch/sparc/include/asm/elf_64.h
+++ b/arch/sparc/include/asm/elf_64.h
@@ -59,6 +59,7 @@
#define R_SPARC_7 43
#define R_SPARC_5 44
#define R_SPARC_6 45
+#define R_SPARC_UA64 54
/* Bits present in AT_HWCAP, primarily for Sparc32. */
#define HWCAP_SPARC_FLUSH 0x00000001
diff --git a/arch/sparc/kernel/module.c b/arch/sparc/kernel/module.c
index df39580f398d3..737f7a5c28359 100644
--- a/arch/sparc/kernel/module.c
+++ b/arch/sparc/kernel/module.c
@@ -117,6 +117,7 @@ int apply_relocate_add(Elf_Shdr *sechdrs,
break;
#ifdef CONFIG_SPARC64
case R_SPARC_64:
+ case R_SPARC_UA64:
location[0] = v >> 56;
location[1] = v >> 48;
location[2] = v >> 40;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 133/300] remoteproc: qcom: q6v5: Avoid handling handover twice
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 132/300] sparc/module: Add R_SPARC_UA64 relocation handling Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 134/300] NFSv4: handle ERR_GRACE on delegation recalls Greg Kroah-Hartman
` (172 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephan Gerhold,
Bjorn Andersson, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephan Gerhold <stephan.gerhold@linaro.org>
[ Upstream commit 54898664e1eb6b5b3e6cdd9343c6eb15da776153 ]
A remoteproc could theoretically signal handover twice. This is unexpected
and would break the reference counting for the handover resources (power
domains, clocks, regulators, etc), so add a check to prevent that from
happening.
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Signed-off-by: Stephan Gerhold <stephan.gerhold@linaro.org>
Link: https://lore.kernel.org/r/20250820-rproc-qcom-q6v5-fixes-v2-2-910b1a3aff71@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/remoteproc/qcom_q6v5.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/remoteproc/qcom_q6v5.c b/drivers/remoteproc/qcom_q6v5.c
index f2080738ca05e..82e28eb4d477d 100644
--- a/drivers/remoteproc/qcom_q6v5.c
+++ b/drivers/remoteproc/qcom_q6v5.c
@@ -123,6 +123,11 @@ static irqreturn_t q6v5_handover_interrupt(int irq, void *data)
{
struct qcom_q6v5 *q6v5 = data;
+ if (q6v5->handover_issued) {
+ dev_err(q6v5->dev, "Handover signaled, but it already happened\n");
+ return IRQ_HANDLED;
+ }
+
if (q6v5->handover)
q6v5->handover(q6v5);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 134/300] NFSv4: handle ERR_GRACE on delegation recalls
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 133/300] remoteproc: qcom: q6v5: Avoid handling handover twice Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 135/300] NFSv4.1: fix mount hang after CREATE_SESSION failure Greg Kroah-Hartman
` (171 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Olga Kornievskaia, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <okorniev@redhat.com>
[ Upstream commit be390f95242785adbf37d7b8a5101dd2f2ba891b ]
RFC7530 states that clients should be prepared for the return of
NFS4ERR_GRACE errors for non-reclaim lock and I/O requests.
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 87774f3b4c354..c454fb042ab2b 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -7473,10 +7473,10 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state,
return err;
do {
err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW);
- if (err != -NFS4ERR_DELAY)
+ if (err != -NFS4ERR_DELAY && err != -NFS4ERR_GRACE)
break;
ssleep(1);
- } while (err == -NFS4ERR_DELAY);
+ } while (err == -NFS4ERR_DELAY || err == -NFSERR_GRACE);
return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 135/300] NFSv4.1: fix mount hang after CREATE_SESSION failure
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 134/300] NFSv4: handle ERR_GRACE on delegation recalls Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 136/300] nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Greg Kroah-Hartman
` (170 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Iliopoulos, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anthony Iliopoulos <ailiop@suse.com>
[ Upstream commit bf75ad096820fee5da40e671ebb32de725a1c417 ]
When client initialization goes through server trunking discovery, it
schedules the state manager and then sleeps waiting for nfs_client
initialization completion.
The state manager can fail during state recovery, and specifically in
lease establishment as nfs41_init_clientid() will bail out in case of
errors returned from nfs4_proc_create_session(), without ever marking
the client ready. The session creation can fail for a variety of reasons
e.g. during backchannel parameter negotiation, with status -EINVAL.
The error status will propagate all the way to the nfs4_state_manager
but the client status will not be marked, and thus the mount process
will remain blocked waiting.
Fix it by adding -EINVAL error handling to nfs4_state_manager().
Signed-off-by: Anthony Iliopoulos <ailiop@suse.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4state.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index e3cabced1aead..171bc21eb945b 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -2724,6 +2724,9 @@ static void nfs4_state_manager(struct nfs_client *clp)
case -ENETUNREACH:
nfs_mark_client_ready(clp, -EIO);
break;
+ case -EINVAL:
+ nfs_mark_client_ready(clp, status);
+ break;
default:
ssleep(1);
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 136/300] nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 135/300] NFSv4.1: fix mount hang after CREATE_SESSION failure Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 137/300] fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock Greg Kroah-Hartman
` (169 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Al Viro, Anna Schumaker, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Al Viro <viro@zeniv.linux.org.uk>
[ Upstream commit a890a2e339b929dbd843328f9a92a1625404fe63 ]
Theoretically it's an oopsable race, but I don't believe one can manage
to hit it on real hardware; might become doable on a KVM, but it still
won't be easy to attack.
Anyway, it's easy to deal with - since xdr_encode_hyper() is just a call of
put_unaligned_be64(), we can put that under ->d_lock and be done with that.
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index c454fb042ab2b..12f5c240a2689 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -365,7 +365,9 @@ static void nfs4_setup_readdir(u64 cookie, __be32 *verifier, struct dentry *dent
*p++ = htonl(attrs); /* bitmap */
*p++ = htonl(12); /* attribute buffer length */
*p++ = htonl(NF4DIR);
+ spin_lock(&dentry->d_lock);
p = xdr_encode_hyper(p, NFS_FILEID(d_inode(dentry->d_parent)));
+ spin_unlock(&dentry->d_lock);
readdir->pgbase = (char *)p - (char *)start;
readdir->count -= readdir->pgbase;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 137/300] fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 136/300] nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 138/300] net: macb: avoid dealing with endianness in macb_set_hwaddr() Greg Kroah-Hartman
` (168 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, chuguangqing, Theodore Tso,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: chuguangqing <chuguangqing@inspur.com>
[ Upstream commit 1534f72dc2a11ded38b0e0268fbcc0ca24e9fd4a ]
The parent function ext4_xattr_inode_lookup_create already uses GFP_NOFS for memory alloction, so the function ext4_xattr_inode_cache_find should use same gfp_flag.
Signed-off-by: chuguangqing <chuguangqing@inspur.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ext4/xattr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 203ffcc999400..fa8ce1c66d123 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1492,7 +1492,7 @@ ext4_xattr_inode_cache_find(struct inode *inode, const void *value,
WARN_ON_ONCE(ext4_handle_valid(journal_current_handle()) &&
!(current->flags & PF_MEMALLOC_NOFS));
- ea_data = kvmalloc(value_len, GFP_KERNEL);
+ ea_data = kvmalloc(value_len, GFP_NOFS);
if (!ea_data) {
mb_cache_entry_put(ea_inode_cache, ce);
return NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 138/300] net: macb: avoid dealing with endianness in macb_set_hwaddr()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 137/300] fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 139/300] Bluetooth: SCO: Fix UAF on sco_conn_free Greg Kroah-Hartman
` (167 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Anderson, Théo Lebrun,
Simon Horman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <theo.lebrun@bootlin.com>
[ Upstream commit 70a5ce8bc94545ba0fb47b2498bfb12de2132f4d ]
bp->dev->dev_addr is of type `unsigned char *`. Casting it to a u32
pointer and dereferencing implies dealing manually with endianness,
which is error-prone.
Replace by calls to get_unaligned_le32|le16() helpers.
This was found using sparse:
⟩ make C=2 drivers/net/ethernet/cadence/macb_main.o
warning: incorrect type in assignment (different base types)
expected unsigned int [usertype] bottom
got restricted __le32 [usertype]
warning: incorrect type in assignment (different base types)
expected unsigned short [usertype] top
got restricted __le16 [usertype]
...
Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250923-macb-fixes-v6-5-772d655cdeb6@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/cadence/macb_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
index 2a103be1c9d8a..c407e8d0eb618 100644
--- a/drivers/net/ethernet/cadence/macb_main.c
+++ b/drivers/net/ethernet/cadence/macb_main.c
@@ -276,9 +276,9 @@ static void macb_set_hwaddr(struct macb *bp)
u32 bottom;
u16 top;
- bottom = cpu_to_le32(*((u32 *)bp->dev->dev_addr));
+ bottom = get_unaligned_le32(bp->dev->dev_addr);
macb_or_gem_writel(bp, SA1B, bottom);
- top = cpu_to_le16(*((u16 *)(bp->dev->dev_addr + 4)));
+ top = get_unaligned_le16(bp->dev->dev_addr + 4);
macb_or_gem_writel(bp, SA1T, top);
/* Clear unused address register sets */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 139/300] Bluetooth: SCO: Fix UAF on sco_conn_free
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 138/300] net: macb: avoid dealing with endianness in macb_set_hwaddr() Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 140/300] Bluetooth: bcsp: receive data only if registered Greg Kroah-Hartman
` (166 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, cen zhang, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit ecb9a843be4d6fd710d7026e359f21015a062572 ]
BUG: KASAN: slab-use-after-free in sco_conn_free net/bluetooth/sco.c:87 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
BUG: KASAN: slab-use-after-free in sco_conn_put+0xdd/0x410
net/bluetooth/sco.c:107
Write of size 8 at addr ffff88811cb96b50 by task kworker/u17:4/352
CPU: 1 UID: 0 PID: 352 Comm: kworker/u17:4 Not tainted
6.17.0-rc5-g717368f83676 #4 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
Workqueue: hci13 hci_cmd_sync_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x10b/0x170 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x191/0x550 mm/kasan/report.c:482
kasan_report+0xc4/0x100 mm/kasan/report.c:595
sco_conn_free net/bluetooth/sco.c:87 [inline]
kref_put include/linux/kref.h:65 [inline]
sco_conn_put+0xdd/0x410 net/bluetooth/sco.c:107
sco_connect_cfm+0xb4/0xae0 net/bluetooth/sco.c:1441
hci_connect_cfm include/net/bluetooth/hci_core.h:2082 [inline]
hci_conn_failed+0x20a/0x2e0 net/bluetooth/hci_conn.c:1313
hci_conn_unlink+0x55f/0x810 net/bluetooth/hci_conn.c:1121
hci_conn_del+0xb6/0x1110 net/bluetooth/hci_conn.c:1147
hci_abort_conn_sync+0x8c5/0xbb0 net/bluetooth/hci_sync.c:5689
hci_cmd_sync_work+0x281/0x380 net/bluetooth/hci_sync.c:332
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0x77e/0x1040 kernel/workqueue.c:3319
worker_thread+0xbee/0x1200 kernel/workqueue.c:3400
kthread+0x3c7/0x870 kernel/kthread.c:463
ret_from_fork+0x13a/0x1e0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 31370:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x30/0x70 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x82/0x90 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4382 [inline]
__kmalloc_noprof+0x22f/0x390 mm/slub.c:4394
kmalloc_noprof include/linux/slab.h:909 [inline]
sk_prot_alloc+0xae/0x220 net/core/sock.c:2239
sk_alloc+0x34/0x5a0 net/core/sock.c:2295
bt_sock_alloc+0x3c/0x330 net/bluetooth/af_bluetooth.c:151
sco_sock_alloc net/bluetooth/sco.c:562 [inline]
sco_sock_create+0xc0/0x350 net/bluetooth/sco.c:593
bt_sock_create+0x161/0x3b0 net/bluetooth/af_bluetooth.c:135
__sock_create+0x3ad/0x780 net/socket.c:1589
sock_create net/socket.c:1647 [inline]
__sys_socket_create net/socket.c:1684 [inline]
__sys_socket+0xd5/0x330 net/socket.c:1731
__do_sys_socket net/socket.c:1745 [inline]
__se_sys_socket net/socket.c:1743 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1743
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xc7/0x240 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 31374:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x30/0x70 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x3d/0x50 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2428 [inline]
slab_free mm/slub.c:4701 [inline]
kfree+0x199/0x3b0 mm/slub.c:4900
sk_prot_free net/core/sock.c:2278 [inline]
__sk_destruct+0x4aa/0x630 net/core/sock.c:2373
sco_sock_release+0x2ad/0x300 net/bluetooth/sco.c:1333
__sock_release net/socket.c:649 [inline]
sock_close+0xb8/0x230 net/socket.c:1439
__fput+0x3d1/0x9e0 fs/file_table.c:468
task_work_run+0x206/0x2a0 kernel/task_work.c:227
get_signal+0x1201/0x1410 kernel/signal.c:2807
arch_do_signal_or_restart+0x34/0x740 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x68/0xc0 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x1dd/0x240 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Reported-by: cen zhang <zzzccc427@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/sco.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index ae788d3e0c53a..ce084a184a1cd 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -400,6 +400,13 @@ static void sco_sock_kill(struct sock *sk)
BT_DBG("sk %p state %d", sk, sk->sk_state);
+ /* Sock is dead, so set conn->sk to NULL to avoid possible UAF */
+ if (sco_pi(sk)->conn) {
+ sco_conn_lock(sco_pi(sk)->conn);
+ sco_pi(sk)->conn->sk = NULL;
+ sco_conn_unlock(sco_pi(sk)->conn);
+ }
+
/* Kill poor orphan */
bt_sock_unlink(&sco_sk_list, sk);
sock_set_flag(sk, SOCK_DEAD);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 140/300] Bluetooth: bcsp: receive data only if registered
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 139/300] Bluetooth: SCO: Fix UAF on sco_conn_free Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 141/300] ALSA: usb-audio: add mono main switch to Presonus S1824c Greg Kroah-Hartman
` (165 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4ed6852d4da4606c93da,
Ivan Pravdin, Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ivan Pravdin <ipravdin.official@gmail.com>
[ Upstream commit ca94b2b036c22556c3a66f1b80f490882deef7a6 ]
Currently, bcsp_recv() can be called even when the BCSP protocol has not
been registered. This leads to a NULL pointer dereference, as shown in
the following stack trace:
KASAN: null-ptr-deref in range [0x0000000000000108-0x000000000000010f]
RIP: 0010:bcsp_recv+0x13d/0x1740 drivers/bluetooth/hci_bcsp.c:590
Call Trace:
<TASK>
hci_uart_tty_receive+0x194/0x220 drivers/bluetooth/hci_ldisc.c:627
tiocsti+0x23c/0x2c0 drivers/tty/tty_io.c:2290
tty_ioctl+0x626/0xde0 drivers/tty/tty_io.c:2706
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
To prevent this, ensure that the HCI_UART_REGISTERED flag is set before
processing received data. If the protocol is not registered, return
-EUNATCH.
Reported-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=4ed6852d4da4606c93da
Tested-by: syzbot+4ed6852d4da4606c93da@syzkaller.appspotmail.com
Signed-off-by: Ivan Pravdin <ipravdin.official@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_bcsp.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/bluetooth/hci_bcsp.c b/drivers/bluetooth/hci_bcsp.c
index 8055f63603f45..8ff69111ceede 100644
--- a/drivers/bluetooth/hci_bcsp.c
+++ b/drivers/bluetooth/hci_bcsp.c
@@ -582,6 +582,9 @@ static int bcsp_recv(struct hci_uart *hu, const void *data, int count)
struct bcsp_struct *bcsp = hu->priv;
const unsigned char *ptr;
+ if (!test_bit(HCI_UART_REGISTERED, &hu->flags))
+ return -EUNATCH;
+
BT_DBG("hu %p count %d rx_state %d rx_count %ld",
hu, count, bcsp->rx_state, bcsp->rx_count);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 141/300] ALSA: usb-audio: add mono main switch to Presonus S1824c
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 140/300] Bluetooth: bcsp: receive data only if registered Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 142/300] exfat: limit log print for IO error Greg Kroah-Hartman
` (164 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roy Vegard Ovesen, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
[ Upstream commit 659169c4eb21f8d9646044a4f4e1bc314f6f9d0c ]
The 1824c does not have the A/B switch that the 1810c has,
but instead it has a mono main switch that sums the two
main output channels to mono.
Signed-off-by: Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_s1810c.c | 26 +++++++++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
diff --git a/sound/usb/mixer_s1810c.c b/sound/usb/mixer_s1810c.c
index 457e07f6fc7c8..e3056bc576d28 100644
--- a/sound/usb/mixer_s1810c.c
+++ b/sound/usb/mixer_s1810c.c
@@ -93,6 +93,7 @@ struct s1810c_ctl_packet {
#define SC1810C_CTL_LINE_SW 0
#define SC1810C_CTL_MUTE_SW 1
+#define SC1824C_CTL_MONO_SW 2
#define SC1810C_CTL_AB_SW 3
#define SC1810C_CTL_48V_SW 4
@@ -123,6 +124,7 @@ struct s1810c_state_packet {
#define SC1810C_STATE_48V_SW 58
#define SC1810C_STATE_LINE_SW 59
#define SC1810C_STATE_MUTE_SW 60
+#define SC1824C_STATE_MONO_SW 61
#define SC1810C_STATE_AB_SW 62
struct s1810_mixer_state {
@@ -502,6 +504,15 @@ static const struct snd_kcontrol_new snd_s1810c_mute_sw = {
.private_value = (SC1810C_STATE_MUTE_SW | SC1810C_CTL_MUTE_SW << 8)
};
+static const struct snd_kcontrol_new snd_s1824c_mono_sw = {
+ .iface = SNDRV_CTL_ELEM_IFACE_MIXER,
+ .name = "Mono Main Out Switch",
+ .info = snd_ctl_boolean_mono_info,
+ .get = snd_s1810c_switch_get,
+ .put = snd_s1810c_switch_set,
+ .private_value = (SC1824C_STATE_MONO_SW | SC1824C_CTL_MONO_SW << 8)
+};
+
static const struct snd_kcontrol_new snd_s1810c_48v_sw = {
.iface = SNDRV_CTL_ELEM_IFACE_MIXER,
.name = "48V Phantom Power On Mic Inputs Switch",
@@ -588,8 +599,17 @@ int snd_sc1810_init_mixer(struct usb_mixer_interface *mixer)
if (ret < 0)
return ret;
- ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
- if (ret < 0)
- return ret;
+ // The 1824c has a Mono Main switch instead of a
+ // A/B select switch.
+ if (mixer->chip->usb_id == USB_ID(0x194f, 0x010d)) {
+ ret = snd_s1810c_switch_init(mixer, &snd_s1824c_mono_sw);
+ if (ret < 0)
+ return ret;
+ } else if (mixer->chip->usb_id == USB_ID(0x194f, 0x010c)) {
+ ret = snd_s1810c_switch_init(mixer, &snd_s1810c_ab_sw);
+ if (ret < 0)
+ return ret;
+ }
+
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 142/300] exfat: limit log print for IO error
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 141/300] ALSA: usb-audio: add mono main switch to Presonus S1824c Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 143/300] page_pool: Clamp pool size to max 16K pages Greg Kroah-Hartman
` (163 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chi Zhiling, Namjae Jeon,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chi Zhiling <chizhiling@kylinos.cn>
[ Upstream commit 6dfba108387bf4e71411b3da90b2d5cce48ba054 ]
For exFAT filesystems with 4MB read_ahead_size, removing the storage device
when the read operation is in progress, which cause the last read syscall
spent 150s [1]. The main reason is that exFAT generates excessive log
messages [2].
After applying this patch, approximately 300,000 lines of log messages
were suppressed, and the delay of the last read() syscall was reduced
to about 4 seconds.
[1]:
write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000120>
read(4, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000032>
write(5, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 131072) = 131072 <0.000119>
read(4, 0x7fccf28ae000, 131072) = -1 EIO (Input/output error) <150.186215>
[2]:
[ 333.696603] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
[ 333.697378] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
[ 333.698156] exFAT-fs (vdb): error, failed to access to FAT (entry 0x0000d780, err:-5)
Signed-off-by: Chi Zhiling <chizhiling@kylinos.cn>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/exfat/fatent.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/exfat/fatent.c b/fs/exfat/fatent.c
index b6cce8225d058..38a7b129f731e 100644
--- a/fs/exfat/fatent.c
+++ b/fs/exfat/fatent.c
@@ -88,35 +88,36 @@ int exfat_ent_get(struct super_block *sb, unsigned int loc,
int err;
if (!is_valid_cluster(sbi, loc)) {
- exfat_fs_error(sb, "invalid access to FAT (entry 0x%08x)",
+ exfat_fs_error_ratelimit(sb,
+ "invalid access to FAT (entry 0x%08x)",
loc);
return -EIO;
}
err = __exfat_ent_get(sb, loc, content);
if (err) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"failed to access to FAT (entry 0x%08x, err:%d)",
loc, err);
return err;
}
if (*content == EXFAT_FREE_CLUSTER) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"invalid access to FAT free cluster (entry 0x%08x)",
loc);
return -EIO;
}
if (*content == EXFAT_BAD_CLUSTER) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"invalid access to FAT bad cluster (entry 0x%08x)",
loc);
return -EIO;
}
if (*content != EXFAT_EOF_CLUSTER && !is_valid_cluster(sbi, *content)) {
- exfat_fs_error(sb,
+ exfat_fs_error_ratelimit(sb,
"invalid access to FAT (entry 0x%08x) bogus content (0x%08x)",
loc, *content);
return -EIO;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 143/300] page_pool: Clamp pool size to max 16K pages
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 142/300] exfat: limit log print for IO error Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 144/300] orangefs: fix xattr related buffer overflow Greg Kroah-Hartman
` (162 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Tariq Toukan,
Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragos Tatulea <dtatulea@nvidia.com>
[ Upstream commit a1b501a8c6a87c9265fd03bd004035199e2e8128 ]
page_pool_init() returns E2BIG when the page_pool size goes above 32K
pages. As some drivers are configuring the page_pool size according to
the MTU and ring size, there are cases where this limit is exceeded and
the queue creation fails.
The page_pool size doesn't have to cover a full queue, especially for
larger ring size. So clamp the size instead of returning an error. Do
this in the core to avoid having each driver do the clamping.
The current limit was deemed to high [1] so it was reduced to 16K to avoid
page waste.
[1] https://lore.kernel.org/all/1758532715-820422-3-git-send-email-tariqt@nvidia.com/
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/20250926131605.2276734-2-dtatulea@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/page_pool.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/net/core/page_pool.c b/net/core/page_pool.c
index a11809b3149b4..15ad99330bb9b 100644
--- a/net/core/page_pool.c
+++ b/net/core/page_pool.c
@@ -33,11 +33,7 @@ static int page_pool_init(struct page_pool *pool,
return -EINVAL;
if (pool->p.pool_size)
- ring_qsize = pool->p.pool_size;
-
- /* Sanity limit mem that can be pinned down */
- if (ring_qsize > 32768)
- return -E2BIG;
+ ring_qsize = min(pool->p.pool_size, 16384);
/* DMA direction is either DMA_FROM_DEVICE or DMA_BIDIRECTIONAL.
* DMA_BIDIRECTIONAL is for allowing page used for DMA sending,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 144/300] orangefs: fix xattr related buffer overflow...
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 143/300] page_pool: Clamp pool size to max 16K pages Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 145/300] ACPICA: Update dsmethod.c to get rid of unused variable warning Greg Kroah-Hartman
` (161 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Marshall,
Stanislav Fort of Aisle Research, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Marshall <hubcap@omnibond.com>
[ Upstream commit 025e880759c279ec64d0f754fe65bf45961da864 ]
Willy Tarreau <w@1wt.eu> forwarded me a message from
Disclosure <disclosure@aisle.com> with the following
warning:
> The helper `xattr_key()` uses the pointer variable in the loop condition
> rather than dereferencing it. As `key` is incremented, it remains non-NULL
> (until it runs into unmapped memory), so the loop does not terminate on
> valid C strings and will walk memory indefinitely, consuming CPU or hanging
> the thread.
I easily reproduced this with setfattr and getfattr, causing a kernel
oops, hung user processes and corrupted orangefs files. Disclosure
sent along a diff (not a patch) with a suggested fix, which I based
this patch on.
After xattr_key started working right, xfstest generic/069 exposed an
xattr related memory leak that lead to OOM. xattr_key returns
a hashed key. When adding xattrs to the orangefs xattr cache, orangefs
used hash_add, a kernel hashing macro. hash_add also hashes the key using
hash_log which resulted in additions to the xattr cache going to the wrong
hash bucket. generic/069 tortures a single file and orangefs does a
getattr for the xattr "security.capability" every time. Orangefs
negative caches on xattrs which includes a kmalloc. Since adds to the
xattr cache were going to the wrong bucket, every getattr for
"security.capability" resulted in another kmalloc, none of which were
ever freed.
I changed the two uses of hash_add to hlist_add_head instead
and the memory leak ceased and generic/069 quit throwing furniture.
Signed-off-by: Mike Marshall <hubcap@omnibond.com>
Reported-by: Stanislav Fort of Aisle Research <stanislav.fort@aisle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/orangefs/xattr.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index bdc285aea3600..5e355d9d9a819 100644
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -54,7 +54,9 @@ static inline int convert_to_internal_xattr_flags(int setxattr_flags)
static unsigned int xattr_key(const char *key)
{
unsigned int i = 0;
- while (key)
+ if (!key)
+ return 0;
+ while (*key)
i += *key++;
return i % 16;
}
@@ -175,8 +177,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
cx->length = -1;
cx->timeout = jiffies +
orangefs_getattr_timeout_msecs*HZ/1000;
- hash_add(orangefs_inode->xattr_cache, &cx->node,
- xattr_key(cx->key));
+ hlist_add_head( &cx->node,
+ &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
}
}
goto out_release_op;
@@ -229,8 +231,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
memcpy(cx->val, buffer, length);
cx->length = length;
cx->timeout = jiffies + HZ;
- hash_add(orangefs_inode->xattr_cache, &cx->node,
- xattr_key(cx->key));
+ hlist_add_head(&cx->node,
+ &orangefs_inode->xattr_cache[xattr_key(cx->key)]);
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 145/300] ACPICA: Update dsmethod.c to get rid of unused variable warning
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 144/300] orangefs: fix xattr related buffer overflow Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 146/300] btrfs: mark dirty extent range for out of bound prealloc extents Greg Kroah-Hartman
` (160 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Saket Dumbre, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saket Dumbre <saket.dumbre@intel.com>
[ Upstream commit 761dc71c6020d6aa68666e96373342d49a7e9d0a ]
All the 3 major C compilers (MSVC, GCC, LLVM/Clang) warn about
the unused variable i after the removal of its usage by PR #1031
addressing Issue #1027
Link: https://github.com/acpica/acpica/commit/6d235320
Signed-off-by: Saket Dumbre <saket.dumbre@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpica/dsmethod.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/acpi/acpica/dsmethod.c b/drivers/acpi/acpica/dsmethod.c
index 5a2081ee37f55..0f4770a48912d 100644
--- a/drivers/acpi/acpica/dsmethod.c
+++ b/drivers/acpi/acpica/dsmethod.c
@@ -462,7 +462,6 @@ acpi_ds_call_control_method(struct acpi_thread_state *thread,
struct acpi_walk_state *next_walk_state = NULL;
union acpi_operand_object *obj_desc;
struct acpi_evaluate_info *info;
- u32 i;
ACPI_FUNCTION_TRACE_PTR(ds_call_control_method, this_walk_state);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 146/300] btrfs: mark dirty extent range for out of bound prealloc extents
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 145/300] ACPICA: Update dsmethod.c to get rid of unused variable warning Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 147/300] fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink Greg Kroah-Hartman
` (159 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, austinchang, Filipe Manana,
David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: austinchang <austinchang@synology.com>
[ Upstream commit 3b1a4a59a2086badab391687a6a0b86e03048393 ]
In btrfs_fallocate(), when the allocated range overlaps with a prealloc
extent and the extent starts after i_size, the range doesn't get marked
dirty in file_extent_tree. This results in persisting an incorrect
disk_i_size for the inode when not using the no-holes feature.
This is reproducible since commit 41a2ee75aab0 ("btrfs: introduce
per-inode file extent tree"), then became hidden since commit 3d7db6e8bd22
("btrfs: don't allocate file extent tree for non regular files") and then
visible again after commit 8679d2687c35 ("btrfs: initialize
inode::file_extent_tree after i_mode has been set"), which fixes the
previous commit.
The following reproducer triggers the problem:
$ cat test.sh
MNT=/mnt/test
DEV=/dev/vdb
mkdir -p $MNT
mkfs.btrfs -f -O ^no-holes $DEV
mount $DEV $MNT
touch $MNT/file1
fallocate -n -o 1M -l 2M $MNT/file1
umount $MNT
mount $DEV $MNT
len=$((1 * 1024 * 1024))
fallocate -o 1M -l $len $MNT/file1
du --bytes $MNT/file1
umount $MNT
mount $DEV $MNT
du --bytes $MNT/file1
umount $MNT
Running the reproducer gives the following result:
$ ./test.sh
(...)
2097152 /mnt/test/file1
1048576 /mnt/test/file1
The difference is exactly 1048576 as we assigned.
Fix by adding a call to btrfs_inode_set_file_extent_range() in
btrfs_fallocate_update_isize().
Fixes: 41a2ee75aab0 ("btrfs: introduce per-inode file extent tree")
Signed-off-by: austinchang <austinchang@synology.com>
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/file.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 53a3c32a0f8ce..38a293a9d0644 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -3049,12 +3049,22 @@ static int btrfs_fallocate_update_isize(struct inode *inode,
{
struct btrfs_trans_handle *trans;
struct btrfs_root *root = BTRFS_I(inode)->root;
+ u64 range_start;
+ u64 range_end;
int ret;
int ret2;
if (mode & FALLOC_FL_KEEP_SIZE || end <= i_size_read(inode))
return 0;
+ range_start = round_down(i_size_read(inode), root->fs_info->sectorsize);
+ range_end = round_up(end, root->fs_info->sectorsize);
+
+ ret = btrfs_inode_set_file_extent_range(BTRFS_I(inode), range_start,
+ range_end - range_start);
+ if (ret)
+ return ret;
+
trans = btrfs_start_transaction(root, 1);
if (IS_ERR(trans))
return PTR_ERR(trans);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 147/300] fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 146/300] btrfs: mark dirty extent range for out of bound prealloc extents Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 148/300] um: Fix help message for ssl-non-raw Greg Kroah-Hartman
` (158 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yikang Yue, Mikulas Patocka,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yikang Yue <yikangy2@illinois.edu>
[ Upstream commit 32058c38d3b79a28963a59ac0353644dc24775cd ]
The function call new_inode() is a primitive for allocating an inode in memory,
rather than planning disk space for it. Therefore, -ENOMEM should be returned
as the error code rather than -ENOSPC.
To be specific, new_inode()'s call path looks like this:
new_inode
new_inode_pseudo
alloc_inode
ops->alloc_inode (hpfs_alloc_inode)
alloc_inode_sb
kmem_cache_alloc_lru
Therefore, the failure of new_inode() indicates a memory presure issue (-ENOMEM),
not a lack of disk space. However, the current implementation of
hpfs_mkdir/create/mknod/symlink incorrectly returns -ENOSPC when new_inode() fails.
This patch fix this by set err to -ENOMEM before the goto statement.
BTW, we also noticed that other nested calls within these four functions,
like hpfs_alloc_f/dnode and hpfs_add_dirent, might also fail due to memory presure.
But similarly, only -ENOSPC is returned. Addressing these will involve code
modifications in other functions, and we plan to submit dedicated patches for these
issues in the future. For this patch, we focus on new_inode().
Signed-off-by: Yikang Yue <yikangy2@illinois.edu>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/hpfs/namei.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/fs/hpfs/namei.c b/fs/hpfs/namei.c
index 1aee39160ac5b..bc1309ef4cfa5 100644
--- a/fs/hpfs/namei.c
+++ b/fs/hpfs/namei.c
@@ -52,8 +52,10 @@ static int hpfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
dee.fnode = cpu_to_le32(fno);
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail2;
+ }
hpfs_init_inode(result);
result->i_ino = fno;
hpfs_i(result)->i_parent_dir = dir->i_ino;
@@ -154,9 +156,10 @@ static int hpfs_create(struct inode *dir, struct dentry *dentry, umode_t mode, b
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail1;
-
+ }
hpfs_init_inode(result);
result->i_ino = fno;
result->i_mode |= S_IFREG;
@@ -241,9 +244,10 @@ static int hpfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, de
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail1;
-
+ }
hpfs_init_inode(result);
result->i_ino = fno;
hpfs_i(result)->i_parent_dir = dir->i_ino;
@@ -317,8 +321,10 @@ static int hpfs_symlink(struct inode *dir, struct dentry *dentry, const char *sy
dee.creation_date = dee.write_date = dee.read_date = cpu_to_le32(local_get_seconds(dir->i_sb));
result = new_inode(dir->i_sb);
- if (!result)
+ if (!result) {
+ err = -ENOMEM;
goto bail1;
+ }
result->i_ino = fno;
hpfs_init_inode(result);
hpfs_i(result)->i_parent_dir = dir->i_ino;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 148/300] um: Fix help message for ssl-non-raw
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 147/300] fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 149/300] ARM: at91: pm: save and restore ACR during PLL disable/enable Greg Kroah-Hartman
` (157 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tiwei Bie, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tiwei Bie <tiwei.btw@antgroup.com>
[ Upstream commit 725e9d81868fcedaeef775948e699955b01631ae ]
Add the missing option name in the help message. Additionally,
switch to __uml_help(), because this is a global option rather
than a per-channel option.
Signed-off-by: Tiwei Bie <tiwei.btw@antgroup.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/drivers/ssl.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/arch/um/drivers/ssl.c b/arch/um/drivers/ssl.c
index 6476b28d7c5ec..63da74e3f2776 100644
--- a/arch/um/drivers/ssl.c
+++ b/arch/um/drivers/ssl.c
@@ -202,4 +202,7 @@ static int ssl_non_raw_setup(char *str)
return 1;
}
__setup("ssl-non-raw", ssl_non_raw_setup);
-__channel_help(ssl_non_raw_setup, "set serial lines to non-raw mode");
+__uml_help(ssl_non_raw_setup,
+"ssl-non-raw\n"
+" Set serial lines to non-raw mode.\n\n"
+);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 149/300] ARM: at91: pm: save and restore ACR during PLL disable/enable
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 148/300] um: Fix help message for ssl-non-raw Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 150/300] 9p: fix /sys/fs/9p/caches overwriting itself Greg Kroah-Hartman
` (156 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Ferre, Cristian Birsan,
Alexandre Belloni, Claudiu Beznea, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Ferre <nicolas.ferre@microchip.com>
[ Upstream commit 0c01fe49651d387776abed6a28541e80c8a93319 ]
Add a new word in assembly to store ACR value during the calls
to at91_plla_disable/at91_plla_enable macros and use it.
Signed-off-by: Nicolas Ferre <nicolas.ferre@microchip.com>
[cristian.birsan@microchip.com: remove ACR_DEFAULT_PLLA loading]
Signed-off-by: Cristian Birsan <cristian.birsan@microchip.com>
Link: https://lore.kernel.org/r/20250827145427.46819-4-nicolas.ferre@microchip.com
Reviewed-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Claudiu Beznea <claudiu.beznea@tuxon.dev>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-at91/pm_suspend.S | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/arch/arm/mach-at91/pm_suspend.S b/arch/arm/mach-at91/pm_suspend.S
index b683c2caa40b9..80494afb28a33 100644
--- a/arch/arm/mach-at91/pm_suspend.S
+++ b/arch/arm/mach-at91/pm_suspend.S
@@ -373,6 +373,10 @@ ENDPROC(at91_backup_mode)
bic tmp2, tmp2, #AT91_PMC_PLL_UPDT_ID
str tmp2, [pmc, #AT91_PMC_PLL_UPDT]
+ /* save acr */
+ ldr tmp2, [pmc, #AT91_PMC_PLL_ACR]
+ str tmp2, .saved_acr
+
/* save div. */
mov tmp1, #0
ldr tmp2, [pmc, #AT91_PMC_PLL_CTRL0]
@@ -442,7 +446,7 @@ ENDPROC(at91_backup_mode)
str tmp1, [pmc, #AT91_PMC_PLL_UPDT]
/* step 2. */
- ldr tmp1, =AT91_PMC_PLL_ACR_DEFAULT_PLLA
+ ldr tmp1, .saved_acr
str tmp1, [pmc, #AT91_PMC_PLL_ACR]
/* step 3. */
@@ -694,6 +698,8 @@ ENDPROC(at91_sramc_self_refresh)
.word 0
.saved_mckr:
.word 0
+.saved_acr:
+ .word 0
.saved_pllar:
.word 0
.saved_sam9_lpr:
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 150/300] 9p: fix /sys/fs/9p/caches overwriting itself
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 149/300] ARM: at91: pm: save and restore ACR during PLL disable/enable Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 151/300] 9p: sysfs_init: dont hardcode error to ENOMEM Greg Kroah-Hartman
` (155 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randall P. Embry, Dominique Martinet,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <rpembry@gmail.com>
[ Upstream commit 86db0c32f16c5538ddb740f54669ace8f3a1f3d7 ]
caches_show() overwrote its buffer on each iteration,
so only the last cache tag was visible in sysfs output.
Properly append with snprintf(buf + count, …).
Signed-off-by: Randall P. Embry <rpembry@gmail.com>
Message-ID: <20250926-v9fs_misc-v1-2-a8b3907fc04d@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/v9fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index 39def020a074b..b304e070139ca 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -558,7 +558,7 @@ static ssize_t caches_show(struct kobject *kobj,
spin_lock(&v9fs_sessionlist_lock);
list_for_each_entry(v9ses, &v9fs_sessionlist, slist) {
if (v9ses->cachetag) {
- n = snprintf(buf, limit, "%s\n", v9ses->cachetag);
+ n = snprintf(buf + count, limit, "%s\n", v9ses->cachetag);
if (n < 0) {
count = n;
break;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 151/300] 9p: sysfs_init: dont hardcode error to ENOMEM
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 150/300] 9p: fix /sys/fs/9p/caches overwriting itself Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 152/300] ACPI: property: Return present device nodes only on fwnode interface Greg Kroah-Hartman
` (154 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randall P. Embry, Dominique Martinet,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randall P. Embry <rpembry@gmail.com>
[ Upstream commit 528f218b31aac4bbfc58914d43766a22ab545d48 ]
v9fs_sysfs_init() always returned -ENOMEM on failure;
return the actual sysfs_create_group() error instead.
Signed-off-by: Randall P. Embry <rpembry@gmail.com>
Message-ID: <20250926-v9fs_misc-v1-3-a8b3907fc04d@codewreck.org>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/9p/v9fs.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/9p/v9fs.c b/fs/9p/v9fs.c
index b304e070139ca..1dd8a735bf7f6 100644
--- a/fs/9p/v9fs.c
+++ b/fs/9p/v9fs.c
@@ -594,13 +594,16 @@ static struct attribute_group v9fs_attr_group = {
static int __init v9fs_sysfs_init(void)
{
+ int ret;
+
v9fs_kobj = kobject_create_and_add("9p", fs_kobj);
if (!v9fs_kobj)
return -ENOMEM;
- if (sysfs_create_group(v9fs_kobj, &v9fs_attr_group)) {
+ ret = sysfs_create_group(v9fs_kobj, &v9fs_attr_group);
+ if (ret) {
kobject_put(v9fs_kobj);
- return -ENOMEM;
+ return ret;
}
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 152/300] ACPI: property: Return present device nodes only on fwnode interface
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 151/300] 9p: sysfs_init: dont hardcode error to ENOMEM Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 153/300] tools bitmap: Add missing asm-generic/bitsperlong.h include Greg Kroah-Hartman
` (153 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Laurent Pinchart,
Jonathan Cameron, Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit d9f866b2bb3eec38b3734f1fed325ec7c55ccdfa ]
fwnode_graph_get_next_subnode() may return fwnode backed by ACPI
device nodes and there has been no check these devices are present
in the system, unlike there has been on fwnode OF backend.
In order to provide consistent behaviour towards callers,
add a check for device presence by introducing
a new function acpi_get_next_present_subnode(), used as the
get_next_child_node() fwnode operation that also checks device
node presence.
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20251001102636.1272722-2-sakari.ailus@linux.intel.com
[ rjw: Kerneldoc comment and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/property.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index cf872dc5b07a6..821150dcb9762 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -1107,6 +1107,28 @@ struct fwnode_handle *acpi_get_next_subnode(const struct fwnode_handle *fwnode,
return NULL;
}
+/*
+ * acpi_get_next_present_subnode - Return the next present child node handle
+ * @fwnode: Firmware node to find the next child node for.
+ * @child: Handle to one of the device's child nodes or a null handle.
+ *
+ * Like acpi_get_next_subnode(), but the device nodes returned by
+ * acpi_get_next_present_subnode() are guaranteed to be present.
+ *
+ * Returns: The fwnode handle of the next present sub-node.
+ */
+static struct fwnode_handle *
+acpi_get_next_present_subnode(const struct fwnode_handle *fwnode,
+ struct fwnode_handle *child)
+{
+ do {
+ child = acpi_get_next_subnode(fwnode, child);
+ } while (is_acpi_device_node(child) &&
+ !acpi_device_is_present(to_acpi_device_node(child)));
+
+ return child;
+}
+
/**
* acpi_node_get_parent - Return parent fwnode of this fwnode
* @fwnode: Firmware node whose parent to get
@@ -1421,7 +1443,7 @@ acpi_fwnode_device_get_match_data(const struct fwnode_handle *fwnode,
.property_read_string_array = \
acpi_fwnode_property_read_string_array, \
.get_parent = acpi_node_get_parent, \
- .get_next_child_node = acpi_get_next_subnode, \
+ .get_next_child_node = acpi_get_next_present_subnode, \
.get_named_child_node = acpi_fwnode_get_named_child_node, \
.get_name = acpi_fwnode_get_name, \
.get_name_prefix = acpi_fwnode_get_name_prefix, \
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 153/300] tools bitmap: Add missing asm-generic/bitsperlong.h include
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 152/300] ACPI: property: Return present device nodes only on fwnode interface Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 154/300] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Greg Kroah-Hartman
` (152 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Yury Norov,
Adrian Hunter, Alexander Shishkin, André Almeida,
Daniel Borkmann, Darren Hart, David S. Miller, Davidlohr Bueso,
Ido Schimmel, Ingo Molnar, Jakub Kicinski, Jamal Hadi Salim,
Jason Xing, Jiri Olsa, Jonas Gottlieb, Kan Liang, Mark Rutland,
Maurice Lambert, Namhyung Kim, Paolo Abeni, Peter Zijlstra,
Petr Machata, Rasmus Villemoes, Thomas Gleixner, Yuyang Huang,
Arnaldo Carvalho de Melo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit f38ce0209ab4553906b44bd1159e35c740a84161 ]
small_const_nbits is defined in asm-generic/bitsperlong.h which
bitmap.h uses but doesn't include causing build failures in some build
systems. Add the missing #include.
Note the bitmap.h in tools has diverged from that of the kernel, so no
changes are made there.
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Yury Norov <yury.norov@gmail.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: André Almeida <andrealmeid@igalia.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Darren Hart <dvhart@infradead.org>
Cc: David S. Miller <davem@davemloft.net>
Cc: Davidlohr Bueso <dave@stgolabs.net>
Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Jason Xing <kerneljasonxing@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Jonas Gottlieb <jonas.gottlieb@stackit.cloud>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Maurice Lambert <mauricelambert434@gmail.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Petr Machata <petrm@nvidia.com>
Cc: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yuyang Huang <yuyanghuang@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/include/linux/bitmap.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/include/linux/bitmap.h b/tools/include/linux/bitmap.h
index de45cad6cec19..1eeba6a147fb6 100644
--- a/tools/include/linux/bitmap.h
+++ b/tools/include/linux/bitmap.h
@@ -3,6 +3,7 @@
#define _PERF_BITOPS_H
#include <string.h>
+#include <asm-generic/bitsperlong.h>
#include <linux/align.h>
#include <linux/bitops.h>
#include <stdlib.h>
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 154/300] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 153/300] tools bitmap: Add missing asm-generic/bitsperlong.h include Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:25 ` [PATCH 5.10 155/300] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity Greg Kroah-Hartman
` (151 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+48b0652a95834717f190,
Helge Deller, Albin Babu Varghese, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
[ Upstream commit 3637d34b35b287ab830e66048841ace404382b67 ]
Add bounds checking to prevent writes past framebuffer boundaries when
rendering text near screen edges. Return early if the Y position is off-screen
and clip image height to screen boundary. Break from the rendering loop if the
X position is off-screen. When clipping image width to fit the screen, update
the character count to match the clipped width to prevent buffer size
mismatches.
Without the character count update, bit_putcs_aligned and bit_putcs_unaligned
receive mismatched parameters where the buffer is allocated for the clipped
width but cnt reflects the original larger count, causing out-of-bounds writes.
Reported-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=48b0652a95834717f190
Suggested-by: Helge Deller <deller@gmx.de>
Tested-by: syzbot+48b0652a95834717f190@syzkaller.appspotmail.com
Signed-off-by: Albin Babu Varghese <albinbabuvarghese20@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/bitblit.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/video/fbdev/core/bitblit.c b/drivers/video/fbdev/core/bitblit.c
index 4e774010d09f6..7c2fc9f83a848 100644
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -168,6 +168,11 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
image.height = vc->vc_font.height;
image.depth = 1;
+ if (image.dy >= info->var.yres)
+ return;
+
+ image.height = min(image.height, info->var.yres - image.dy);
+
if (attribute) {
buf = kmalloc(cellsize, GFP_ATOMIC);
if (!buf)
@@ -181,6 +186,18 @@ static void bit_putcs(struct vc_data *vc, struct fb_info *info,
cnt = count;
image.width = vc->vc_font.width * cnt;
+
+ if (image.dx >= info->var.xres)
+ break;
+
+ if (image.dx + image.width > info->var.xres) {
+ image.width = info->var.xres - image.dx;
+ cnt = image.width / vc->vc_font.width;
+ if (cnt == 0)
+ break;
+ image.width = cnt * vc->vc_font.width;
+ }
+
pitch = DIV_ROUND_UP(image.width, 8) + scan_align;
pitch &= ~scan_align;
size = pitch * image.height + buf_align;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 155/300] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 154/300] fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds Greg Kroah-Hartman
@ 2025-12-03 15:25 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 156/300] ceph: add checking of wait_for_completion_killable() return value Greg Kroah-Hartman
` (150 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:25 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Valerio Setti, Jerome Brunet,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Valerio Setti <vsetti@baylibre.com>
[ Upstream commit 4c4ed5e073a923fb3323022e1131cb51ad8df7a0 ]
According to I2S specs audio data is sampled on the rising edge of the
clock and it can change on the falling one. When operating in normal mode
this SoC behaves the opposite so a clock polarity inversion is required
in this case.
This was tested on an OdroidC2 (Amlogic S905 SoC) board.
Signed-off-by: Valerio Setti <vsetti@baylibre.com>
Reviewed-by: Jerome Brunet <jbrunet@baylibre.com>
Tested-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://patch.msgid.link/20251007-fix-i2s-polarity-v1-1-86704d9cda10@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/meson/aiu-encoder-i2s.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/meson/aiu-encoder-i2s.c b/sound/soc/meson/aiu-encoder-i2s.c
index 67729de41a73e..a512cd49bc507 100644
--- a/sound/soc/meson/aiu-encoder-i2s.c
+++ b/sound/soc/meson/aiu-encoder-i2s.c
@@ -236,8 +236,12 @@ static int aiu_encoder_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
inv == SND_SOC_DAIFMT_IB_IF)
val |= AIU_CLK_CTRL_LRCLK_INVERT;
- if (inv == SND_SOC_DAIFMT_IB_NF ||
- inv == SND_SOC_DAIFMT_IB_IF)
+ /*
+ * The SoC changes data on the rising edge of the bitclock
+ * so an inversion of the bitclock is required in normal mode
+ */
+ if (inv == SND_SOC_DAIFMT_NB_NF ||
+ inv == SND_SOC_DAIFMT_NB_IF)
val |= AIU_CLK_CTRL_AOCLK_INVERT;
/* Signal skew */
@@ -328,4 +332,3 @@ const struct snd_soc_dai_ops aiu_encoder_i2s_dai_ops = {
.startup = aiu_encoder_i2s_startup,
.shutdown = aiu_encoder_i2s_shutdown,
};
-
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 156/300] ceph: add checking of wait_for_completion_killable() return value
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2025-12-03 15:25 ` [PATCH 5.10 155/300] ASoC: meson: aiu-encoder-i2s: fix bit clock polarity Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 157/300] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again Greg Kroah-Hartman
` (149 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Viacheslav Dubeyko, Alex Markuze,
Ilya Dryomov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
[ Upstream commit b7ed1e29cfe773d648ca09895b92856bd3a2092d ]
The Coverity Scan service has detected the calling of
wait_for_completion_killable() without checking the return
value in ceph_lock_wait_for_completion() [1]. The CID 1636232
defect contains explanation: "If the function returns an error
value, the error value may be mistaken for a normal value.
In ceph_lock_wait_for_completion(): Value returned from
a function is not checked for errors before being used. (CWE-252)".
The patch adds the checking of wait_for_completion_killable()
return value and return the error code from
ceph_lock_wait_for_completion().
[1] https://scan5.scan.coverity.com/#/project-view/64304/10063?selectedIssue=1636232
Signed-off-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Reviewed-by: Alex Markuze <amarkuze@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/locks.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/locks.c b/fs/ceph/locks.c
index 674d6ea89f717..642582a642a3a 100644
--- a/fs/ceph/locks.c
+++ b/fs/ceph/locks.c
@@ -202,7 +202,10 @@ static int ceph_lock_wait_for_completion(struct ceph_mds_client *mdsc,
if (err && err != -ERESTARTSYS)
return err;
- wait_for_completion_killable(&req->r_safe_completion);
+ err = wait_for_completion_killable(&req->r_safe_completion);
+ if (err)
+ return err;
+
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 157/300] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 156/300] ceph: add checking of wait_for_completion_killable() return value Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 158/300] riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro Greg Kroah-Hartman
` (148 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kailang Yang, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kailang Yang <kailang@realtek.com>
[ Upstream commit f4b3cef55f5f96fdb4e7f9ca90b7d6213689faeb ]
There was a similar bug in the past (Bug 217440), which was fixed for
this laptop.
The same issue is occurring again as of kernel v.6.12.2. The symptoms
are very similar - initially audio works but after a warm reboot, the
audio completely disappears until the computer is powered off (there
is no audio output at all).
The issue is also related by caused by a different change now. By
bisecting different kernel versions, I found that reverting
cc3d0b5dd989 in patch_realtek.c[*] restores the sound and it works
fine after the reboot.
[*] https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/sound/pci/hda/patch_realtek.c?h=v6.12.2&id=4ed7f16070a8475c088ff423b2eb11ba15eb89b6
[ patch description reformatted by tiwai ]
Fixes: cc3d0b5dd989 ("ALSA: hda/realtek: Update ALC256 depop procedure")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=220109
Signed-off-by: Kailang Yang <kailang@realtek.com>
Link: https://lore.kernel.org/5317ca723c82447a938414fcca85cbf5@realtek.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 84dde97424080..a9c71f38710ed 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -3637,6 +3637,15 @@ static void alc256_shutup(struct hda_codec *codec)
hp_pin = 0x21;
alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x1); /* Low power */
+
+ /* 3k pull low control for Headset jack. */
+ /* NOTE: call this before clearing the pin, otherwise codec stalls */
+ /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
+ * when booting with headset plugged. So skip setting it for the codec alc257
+ */
+ if (spec->en_3kpull_low)
+ alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
+
hp_pin_sense = snd_hda_jack_detect(codec, hp_pin);
if (hp_pin_sense) {
@@ -3647,14 +3656,6 @@ static void alc256_shutup(struct hda_codec *codec)
msleep(75);
- /* 3k pull low control for Headset jack. */
- /* NOTE: call this before clearing the pin, otherwise codec stalls */
- /* If disable 3k pulldown control for alc257, the Mic detection will not work correctly
- * when booting with headset plugged. So skip setting it for the codec alc257
- */
- if (spec->en_3kpull_low)
- alc_update_coef_idx(codec, 0x46, 0, 3 << 12);
-
if (!spec->no_shutup_pins)
snd_hda_codec_write(codec, hp_pin, 0,
AC_VERB_SET_PIN_WIDGET_CONTROL, 0x0);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 158/300] riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 157/300] ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 159/300] net: vlan: sync VLAN features with lower device Greg Kroah-Hartman
` (147 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josephine Pfeiffer, Paul Walmsley,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josephine Pfeiffer <hi@josie.lol>
[ Upstream commit a74f038fa50e0d33b740f44f862fe856f16de6a8 ]
The pt_dump_seq_puts() macro incorrectly uses seq_printf() instead of
seq_puts(). This is both a performance issue and conceptually wrong,
as the macro name suggests plain string output (puts) but the
implementation uses formatted output (printf).
The macro is used in ptdump.c:301 to output a newline character. Using
seq_printf() adds unnecessary overhead for format string parsing when
outputting this constant string.
This bug was introduced in commit 59c4da8640cc ("riscv: Add support to
dump the kernel page tables") in 2020, which copied the implementation
pattern from other architectures that had the same bug.
Fixes: 59c4da8640cc ("riscv: Add support to dump the kernel page tables")
Signed-off-by: Josephine Pfeiffer <hi@josie.lol>
Link: https://lore.kernel.org/r/20251018170451.3355496-1-hi@josie.lol
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/mm/ptdump.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/mm/ptdump.c b/arch/riscv/mm/ptdump.c
index ace74dec7492c..dddb1932ba8b6 100644
--- a/arch/riscv/mm/ptdump.c
+++ b/arch/riscv/mm/ptdump.c
@@ -22,7 +22,7 @@
#define pt_dump_seq_puts(m, fmt) \
({ \
if (m) \
- seq_printf(m, fmt); \
+ seq_puts(m, fmt); \
})
/*
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 159/300] net: vlan: sync VLAN features with lower device
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 158/300] riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 160/300] net: dsa: b53: fix resetting speed and pause on forced link Greg Kroah-Hartman
` (146 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit c211f5d7cbd5cb34489d526648bb9c8ecc907dee ]
After registering a VLAN device and setting its feature flags, we need to
synchronize the VLAN features with the lower device. For example, the VLAN
device does not have the NETIF_F_LRO flag, it should be synchronized with
the lower device based on the NETIF_F_UPPER_DISABLES definition.
As the dev->vlan_features has changed, we need to call
netdev_update_features(). The caller must run after netdev_upper_dev_link()
links the lower devices, so this patch adds the netdev_update_features()
call in register_vlan_dev().
Fixes: fd867d51f889 ("net/core: generic support for disabling netdev features down stack")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://patch.msgid.link/20251030073539.133779-1-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/8021q/vlan.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 07b829d19e01e..7be41986001bb 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -191,6 +191,8 @@ int register_vlan_dev(struct net_device *dev, struct netlink_ext_ack *extack)
vlan_group_set_device(grp, vlan->vlan_proto, vlan_id, dev);
grp->nr_vlan_devs++;
+ netdev_update_features(dev);
+
return 0;
out_unregister_netdev:
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 160/300] net: dsa: b53: fix resetting speed and pause on forced link
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 159/300] net: vlan: sync VLAN features with lower device Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 161/300] net: dsa: b53: fix enabling ip multicast Greg Kroah-Hartman
` (145 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit b6a8a5477fe9bd6be2b594a88f82f8bba41e6d54 ]
There is no guarantee that the port state override registers have their
default values, as not all switches support being reset via register or
have a reset GPIO.
So when forcing port config, we need to make sure to clear all fields,
which we currently do not do for the speed and flow control
configuration. This can cause flow control stay enabled, or in the case
of speed becoming an illegal value, e.g. configured for 1G (0x2), then
setting 100M (0x1), results in 0x3 which is invalid.
For PORT_OVERRIDE_SPEED_2000M we need to make sure to only clear it on
supported chips, as the bit can have different meanings on other chips,
e.g. for BCM5389 this controls scanning PHYs for link/speed
configuration.
Fixes: 5e004460f874 ("net: dsa: b53: Add helper to set link parameters")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251101132807.50419-2-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 361f9be65386e..704ec51a1500e 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1151,6 +1151,10 @@ static void b53_force_port_config(struct b53_device *dev, int port,
else
reg &= ~PORT_OVERRIDE_FULL_DUPLEX;
+ reg &= ~(0x3 << GMII_PO_SPEED_S);
+ if (is5301x(dev) || is58xx(dev))
+ reg &= ~PORT_OVERRIDE_SPEED_2000M;
+
switch (speed) {
case 2000:
reg |= PORT_OVERRIDE_SPEED_2000M;
@@ -1169,6 +1173,11 @@ static void b53_force_port_config(struct b53_device *dev, int port,
return;
}
+ if (is5325(dev))
+ reg &= ~PORT_OVERRIDE_LP_FLOW_25;
+ else
+ reg &= ~(PORT_OVERRIDE_RX_FLOW | PORT_OVERRIDE_TX_FLOW);
+
if (rx_pause) {
if (is5325(dev))
reg |= PORT_OVERRIDE_LP_FLOW_25;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 161/300] net: dsa: b53: fix enabling ip multicast
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 160/300] net: dsa: b53: fix resetting speed and pause on forced link Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 162/300] net: dsa: b53: stop reading ARL entries if search is done Greg Kroah-Hartman
` (144 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit c264294624e956a967a9e2e5fa41e3273340b089 ]
In the New Control register bit 1 is either reserved, or has a different
function:
Out of Range Error Discard
When enabled, the ingress port discards any frames
if the Length field is between 1500 and 1536
(excluding 1500 and 1536) and with good CRC.
The actual bit for enabling IP multicast is bit 0, which was only
explicitly enabled for BCM5325 so far.
For older switch chips, this bit defaults to 0, so we want to enable it
as well, while newer switch chips default to 1, and their documentation
says "It is illegal to set this bit to zero."
So drop the wrong B53_IPMC_FWD_EN define, enable the IP multicast bit
also for other switch chips. While at it, rename it to (B53_)IP_MC as
that is how it is called in Broadcom code.
Fixes: 63cc54a6f073 ("net: dsa: b53: Fix egress flooding settings")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251102100758.28352-2-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 4 ++--
drivers/net/dsa/b53/b53_regs.h | 3 +--
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 704ec51a1500e..a30961f9b0060 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -349,11 +349,11 @@ static void b53_set_forwarding(struct b53_device *dev, int enable)
* frames should be flooded or not.
*/
b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
- mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IPMC_FWD_EN;
+ mgmt |= B53_UC_FWD_EN | B53_MC_FWD_EN | B53_IP_MC;
b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
} else {
b53_read8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, &mgmt);
- mgmt |= B53_IP_MCAST_25;
+ mgmt |= B53_IP_MC;
b53_write8(dev, B53_CTRL_PAGE, B53_IP_MULTICAST_CTRL, mgmt);
}
}
diff --git a/drivers/net/dsa/b53/b53_regs.h b/drivers/net/dsa/b53/b53_regs.h
index 77fb7ae660b8c..95f70248c194d 100644
--- a/drivers/net/dsa/b53/b53_regs.h
+++ b/drivers/net/dsa/b53/b53_regs.h
@@ -104,8 +104,7 @@
/* IP Multicast control (8 bit) */
#define B53_IP_MULTICAST_CTRL 0x21
-#define B53_IP_MCAST_25 BIT(0)
-#define B53_IPMC_FWD_EN BIT(1)
+#define B53_IP_MC BIT(0)
#define B53_UC_FWD_EN BIT(6)
#define B53_MC_FWD_EN BIT(7)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 162/300] net: dsa: b53: stop reading ARL entries if search is done
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 161/300] net: dsa: b53: fix enabling ip multicast Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 163/300] sctp: Hold RCU read lock while iterating over address list Greg Kroah-Hartman
` (143 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jonas Gorski, Florian Fainelli,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonas Gorski <jonas.gorski@gmail.com>
[ Upstream commit 0be04b5fa62a82a9929ca261f6c9f64a3d0a28da ]
The switch clears the ARL_SRCH_STDN bit when the search is done, i.e. it
finished traversing the ARL table.
This means that there will be no valid result, so we should not attempt
to read and process any further entries.
We only ever check the validity of the entries for 4 ARL bin chips, and
only after having passed the first entry to the b53_fdb_copy().
This means that we always pass an invalid entry at the end to the
b53_fdb_copy(). b53_fdb_copy() does check the validity though before
passing on the entry, so it never gets passed on.
On < 4 ARL bin chips, we will even continue reading invalid entries
until we reach the result limit.
Fixes: 1da6df85c6fb ("net: dsa: b53: Implement ARL add/del/dump operations")
Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://patch.msgid.link/20251102100758.28352-3-jonas.gorski@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/b53/b53_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index a30961f9b0060..416ed1ca1d522 100644
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1731,7 +1731,7 @@ static int b53_arl_search_wait(struct b53_device *dev)
do {
b53_read8(dev, B53_ARLIO_PAGE, B53_ARL_SRCH_CTL, ®);
if (!(reg & ARL_SRCH_STDN))
- return 0;
+ return -ENOENT;
if (reg & ARL_SRCH_VLID)
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 163/300] sctp: Hold RCU read lock while iterating over address list
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 162/300] net: dsa: b53: stop reading ARL entries if search is done Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 164/300] sctp: Prevent TOCTOU out-of-bounds write Greg Kroah-Hartman
` (142 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wiehler, Kuniyuki Iwashima,
Xin Long, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit 38f50242bf0f237cdc262308d624d333286ec3c5 ]
With CONFIG_PROVE_RCU_LIST=y and by executing
$ netcat -l --sctp &
$ netcat --sctp localhost &
$ ss --sctp
one can trigger the following Lockdep-RCU splat(s):
WARNING: suspicious RCU usage
6.18.0-rc1-00093-g7f864458e9a6 #5 Not tainted
-----------------------------
net/sctp/diag.c:76 RCU-list traversed in non-reader section!!
other info that might help us debug this:
rcu_scheduler_active = 2, debug_locks = 1
2 locks held by ss/215:
#0: ffff9c740828bec0 (nlk_cb_mutex-SOCK_DIAG){+.+.}-{4:4}, at: __netlink_dump_start+0x84/0x2b0
#1: ffff9c7401d72cd0 (sk_lock-AF_INET6){+.+.}-{0:0}, at: sctp_sock_dump+0x38/0x200
stack backtrace:
CPU: 0 UID: 0 PID: 215 Comm: ss Not tainted 6.18.0-rc1-00093-g7f864458e9a6 #5 PREEMPT(voluntary)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x5d/0x90
lockdep_rcu_suspicious.cold+0x4e/0xa3
inet_sctp_diag_fill.isra.0+0x4b1/0x5d0
sctp_sock_dump+0x131/0x200
sctp_transport_traverse_process+0x170/0x1b0
? __pfx_sctp_sock_filter+0x10/0x10
? __pfx_sctp_sock_dump+0x10/0x10
sctp_diag_dump+0x103/0x140
__inet_diag_dump+0x70/0xb0
netlink_dump+0x148/0x490
__netlink_dump_start+0x1f3/0x2b0
inet_diag_handler_cmd+0xcd/0x100
? __pfx_inet_diag_dump_start+0x10/0x10
? __pfx_inet_diag_dump+0x10/0x10
? __pfx_inet_diag_dump_done+0x10/0x10
sock_diag_rcv_msg+0x18e/0x320
? __pfx_sock_diag_rcv_msg+0x10/0x10
netlink_rcv_skb+0x4d/0x100
netlink_unicast+0x1d7/0x2b0
netlink_sendmsg+0x203/0x450
____sys_sendmsg+0x30c/0x340
___sys_sendmsg+0x94/0xf0
__sys_sendmsg+0x83/0xf0
do_syscall_64+0xbb/0x390
entry_SYSCALL_64_after_hwframe+0x77/0x7f
...
</TASK>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-2-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/diag.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 07d0ada23bfd2..5f441a48e7aa3 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -73,19 +73,23 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
struct nlattr *attr;
void *info = NULL;
+ rcu_read_lock();
list_for_each_entry_rcu(laddr, address_list, list)
addrcnt++;
+ rcu_read_unlock();
attr = nla_reserve(skb, INET_DIAG_LOCALS, addrlen * addrcnt);
if (!attr)
return -EMSGSIZE;
info = nla_data(attr);
+ rcu_read_lock();
list_for_each_entry_rcu(laddr, address_list, list) {
memcpy(info, &laddr->a, sizeof(laddr->a));
memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
info += addrlen;
}
+ rcu_read_unlock();
return 0;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 164/300] sctp: Prevent TOCTOU out-of-bounds write
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 163/300] sctp: Hold RCU read lock while iterating over address list Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 165/300] net: sctp: Fix some typos Greg Kroah-Hartman
` (141 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuniyuki Iwashima, Stefan Wiehler,
Xin Long, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit 95aef86ab231f047bb8085c70666059b58f53c09 ]
For the following path not holding the sock lock,
sctp_diag_dump() -> sctp_for_each_endpoint() -> sctp_ep_dump()
make sure not to exceed bounds in case the address list has grown
between buffer allocation (time-of-check) and write (time-of-use).
Suggested-by: Kuniyuki Iwashima <kuniyu@google.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-3-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/diag.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 5f441a48e7aa3..da00a31e167d7 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -88,6 +88,9 @@ static int inet_diag_msg_sctpladdrs_fill(struct sk_buff *skb,
memcpy(info, &laddr->a, sizeof(laddr->a));
memset(info + sizeof(laddr->a), 0, addrlen - sizeof(laddr->a));
info += addrlen;
+
+ if (!--addrcnt)
+ break;
}
rcu_read_unlock();
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 165/300] net: sctp: Fix some typos
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 164/300] sctp: Prevent TOCTOU out-of-bounds write Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 166/300] net: Use nlmsg_unicast() instead of netlink_unicast() Greg Kroah-Hartman
` (140 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hulk Robot, Lu Wei, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Wei <luwei32@huawei.com>
[ Upstream commit 21c00a186fac6e035eef5e6751f1e2d2609f969c ]
Modify "unkown" to "unknown" in net/sctp/sm_make_chunk.c and
Modify "orginal" to "original" in net/sctp/socket.c.
Reported-by: Hulk Robot <hulkci@huawei.com>
Signed-off-by: Lu Wei <luwei32@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f1fc201148c7 ("sctp: Hold sock lock while iterating over address list")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/sm_make_chunk.c | 2 +-
net/sctp/socket.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index cf77c4693b91d..85cc11a85b383 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -3206,7 +3206,7 @@ bool sctp_verify_asconf(const struct sctp_association *asoc,
return false;
break;
default:
- /* This is unkown to us, reject! */
+ /* This is unknown to us, reject! */
return false;
}
}
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 196196ebe81a9..8fe09f962957f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -9266,7 +9266,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
net_enable_timestamp();
- /* Set newsk security attributes from orginal sk and connection
+ /* Set newsk security attributes from original sk and connection
* security attribute from ep.
*/
security_sctp_sk_clone(ep, sk, newsk);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 166/300] net: Use nlmsg_unicast() instead of netlink_unicast()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 165/300] net: sctp: Fix some typos Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 167/300] sctp: hold endpoint before calling cb in sctp_transport_lookup_process Greg Kroah-Hartman
` (139 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yajun Deng, David Ahern,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yajun Deng <yajun.deng@linux.dev>
[ Upstream commit 01757f536ac825e3614d583fee9acb48c64ed084 ]
It has 'if (err >0 )' statement in nlmsg_unicast(), so use nlmsg_unicast()
instead of netlink_unicast(), this looks more concise.
v2: remove the change in netfilter.
Signed-off-by: Yajun Deng <yajun.deng@linux.dev>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f1fc201148c7 ("sctp: Hold sock lock while iterating over address list")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/fib_frontend.c | 2 +-
net/ipv4/inet_diag.c | 5 +----
net/ipv4/raw_diag.c | 7 ++-----
net/ipv4/udp_diag.c | 6 ++----
net/mptcp/mptcp_diag.c | 6 ++----
net/netlink/af_netlink.c | 2 +-
net/sctp/diag.c | 6 ++----
net/unix/diag.c | 6 ++----
8 files changed, 13 insertions(+), 27 deletions(-)
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index f902cd8cb852b..e35e7793c0e47 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1400,7 +1400,7 @@ static void nl_fib_input(struct sk_buff *skb)
portid = NETLINK_CB(skb).portid; /* netlink portid */
NETLINK_CB(skb).portid = 0; /* from kernel */
NETLINK_CB(skb).dst_group = 0; /* unicast */
- netlink_unicast(net->ipv4.fibnl, skb, portid, MSG_DONTWAIT);
+ nlmsg_unicast(net->ipv4.fibnl, skb, portid);
}
static int __net_init nl_fib_lookup_init(struct net *net)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index b9df76f6571cd..611f45da24f82 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -572,10 +572,7 @@ int inet_diag_dump_one_icsk(struct inet_hashinfo *hashinfo,
nlmsg_free(rep);
goto out;
}
- err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
- MSG_DONTWAIT);
- if (err > 0)
- err = 0;
+ err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
out:
if (sk)
diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c
index 1b5b8af27aafa..ccacbde30a2c5 100644
--- a/net/ipv4/raw_diag.c
+++ b/net/ipv4/raw_diag.c
@@ -119,11 +119,8 @@ static int raw_diag_dump_one(struct netlink_callback *cb,
return err;
}
- err = netlink_unicast(net->diag_nlsk, rep,
- NETLINK_CB(in_skb).portid,
- MSG_DONTWAIT);
- if (err > 0)
- err = 0;
+ err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
+
return err;
}
diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
index 1dbece34496e5..ed69d1edfd099 100644
--- a/net/ipv4/udp_diag.c
+++ b/net/ipv4/udp_diag.c
@@ -77,10 +77,8 @@ static int udp_dump_one(struct udp_table *tbl,
kfree_skb(rep);
goto out;
}
- err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
- MSG_DONTWAIT);
- if (err > 0)
- err = 0;
+ err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
+
out:
if (sk)
sock_put(sk);
diff --git a/net/mptcp/mptcp_diag.c b/net/mptcp/mptcp_diag.c
index f1af3f44875ed..7f900b58c71da 100644
--- a/net/mptcp/mptcp_diag.c
+++ b/net/mptcp/mptcp_diag.c
@@ -57,10 +57,8 @@ static int mptcp_diag_dump_one(struct netlink_callback *cb,
kfree_skb(rep);
goto out;
}
- err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
- MSG_DONTWAIT);
- if (err > 0)
- err = 0;
+ err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
+
out:
sock_put(sk);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 552682a5ff243..42b7b8574f099 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2470,7 +2470,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err,
nlmsg_end(skb, rep);
- netlink_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid, MSG_DONTWAIT);
+ nlmsg_unicast(in_skb->sk, skb, NETLINK_CB(in_skb).portid);
}
EXPORT_SYMBOL(netlink_ack);
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index da00a31e167d7..b1e672227924a 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -288,10 +288,8 @@ static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p)
goto out;
}
- err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
- MSG_DONTWAIT);
- if (err > 0)
- err = 0;
+ err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
+
out:
return err;
}
diff --git a/net/unix/diag.c b/net/unix/diag.c
index 7066a36234106..486276a1782ed 100644
--- a/net/unix/diag.c
+++ b/net/unix/diag.c
@@ -299,10 +299,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb,
goto again;
}
- err = netlink_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid,
- MSG_DONTWAIT);
- if (err > 0)
- err = 0;
+ err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
+
out:
if (sk)
sock_put(sk);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 167/300] sctp: hold endpoint before calling cb in sctp_transport_lookup_process
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 166/300] net: Use nlmsg_unicast() instead of netlink_unicast() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 168/300] sctp: Hold sock lock while iterating over address list Greg Kroah-Hartman
` (138 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xin Long, David S. Miller,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit f9d31c4cf4c11ff10317f038b9c6f7c3bda6cdd4 ]
The same fix in commit 5ec7d18d1813 ("sctp: use call_rcu to free endpoint")
is also needed for dumping one asoc and sock after the lookup.
Fixes: 86fdb3448cc1 ("sctp: ensure ep is not destroyed before doing the dump")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: f1fc201148c7 ("sctp: Hold sock lock while iterating over address list")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sctp/sctp.h | 3 +--
net/sctp/diag.c | 46 +++++++++++++++++++----------------------
net/sctp/socket.c | 22 +++++++++++++-------
3 files changed, 37 insertions(+), 34 deletions(-)
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index 6d89a7f3f6a4c..775fde82c6576 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -110,8 +110,7 @@ struct sctp_transport *sctp_transport_get_next(struct net *net,
struct rhashtable_iter *iter);
struct sctp_transport *sctp_transport_get_idx(struct net *net,
struct rhashtable_iter *iter, int pos);
-int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
- struct net *net,
+int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net,
const union sctp_addr *laddr,
const union sctp_addr *paddr, void *p);
int sctp_transport_traverse_process(sctp_callback_t cb, sctp_callback_t cb_done,
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index b1e672227924a..3631a32d96b07 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -249,48 +249,44 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+ 64;
}
-static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p)
+static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *tsp, void *p)
{
struct sctp_association *assoc = tsp->asoc;
- struct sock *sk = tsp->asoc->base.sk;
struct sctp_comm_param *commp = p;
- struct sk_buff *in_skb = commp->skb;
+ struct sock *sk = ep->base.sk;
const struct inet_diag_req_v2 *req = commp->r;
- const struct nlmsghdr *nlh = commp->nlh;
- struct net *net = sock_net(in_skb->sk);
+ struct sk_buff *skb = commp->skb;
struct sk_buff *rep;
int err;
err = sock_diag_check_cookie(sk, req->id.idiag_cookie);
if (err)
- goto out;
+ return err;
- err = -ENOMEM;
rep = nlmsg_new(inet_assoc_attr_size(assoc), GFP_KERNEL);
if (!rep)
- goto out;
+ return -ENOMEM;
lock_sock(sk);
- if (sk != assoc->base.sk) {
- release_sock(sk);
- sk = assoc->base.sk;
- lock_sock(sk);
+ if (ep != assoc->ep) {
+ err = -EAGAIN;
+ goto out;
}
- err = inet_sctp_diag_fill(sk, assoc, rep, req,
- sk_user_ns(NETLINK_CB(in_skb).sk),
- NETLINK_CB(in_skb).portid,
- nlh->nlmsg_seq, 0, nlh,
- commp->net_admin);
- release_sock(sk);
+
+ err = inet_sctp_diag_fill(sk, assoc, rep, req, sk_user_ns(NETLINK_CB(skb).sk),
+ NETLINK_CB(skb).portid, commp->nlh->nlmsg_seq, 0,
+ commp->nlh, commp->net_admin);
if (err < 0) {
WARN_ON(err == -EMSGSIZE);
- kfree_skb(rep);
goto out;
}
+ release_sock(sk);
- err = nlmsg_unicast(net->diag_nlsk, rep, NETLINK_CB(in_skb).portid);
+ return nlmsg_unicast(sock_net(skb->sk)->diag_nlsk, rep, NETLINK_CB(skb).portid);
out:
+ release_sock(sk);
+ kfree_skb(rep);
return err;
}
@@ -431,15 +427,15 @@ static void sctp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
static int sctp_diag_dump_one(struct netlink_callback *cb,
const struct inet_diag_req_v2 *req)
{
- struct sk_buff *in_skb = cb->skb;
- struct net *net = sock_net(in_skb->sk);
+ struct sk_buff *skb = cb->skb;
+ struct net *net = sock_net(skb->sk);
const struct nlmsghdr *nlh = cb->nlh;
union sctp_addr laddr, paddr;
struct sctp_comm_param commp = {
- .skb = in_skb,
+ .skb = skb,
.r = req,
.nlh = nlh,
- .net_admin = netlink_net_capable(in_skb, CAP_NET_ADMIN),
+ .net_admin = netlink_net_capable(skb, CAP_NET_ADMIN),
};
if (req->sdiag_family == AF_INET) {
@@ -462,7 +458,7 @@ static int sctp_diag_dump_one(struct netlink_callback *cb,
paddr.v6.sin6_family = AF_INET6;
}
- return sctp_transport_lookup_process(sctp_tsp_dump_one,
+ return sctp_transport_lookup_process(sctp_sock_dump_one,
net, &laddr, &paddr, &commp);
}
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 8fe09f962957f..5ea0bad561a18 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5212,23 +5212,31 @@ int sctp_for_each_endpoint(int (*cb)(struct sctp_endpoint *, void *),
}
EXPORT_SYMBOL_GPL(sctp_for_each_endpoint);
-int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *),
- struct net *net,
+int sctp_transport_lookup_process(sctp_callback_t cb, struct net *net,
const union sctp_addr *laddr,
const union sctp_addr *paddr, void *p)
{
struct sctp_transport *transport;
- int err;
+ struct sctp_endpoint *ep;
+ int err = -ENOENT;
rcu_read_lock();
transport = sctp_addrs_lookup_transport(net, laddr, paddr);
+ if (!transport) {
+ rcu_read_unlock();
+ return err;
+ }
+ ep = transport->asoc->ep;
+ if (!sctp_endpoint_hold(ep)) { /* asoc can be peeled off */
+ sctp_transport_put(transport);
+ rcu_read_unlock();
+ return err;
+ }
rcu_read_unlock();
- if (!transport)
- return -ENOENT;
- err = cb(transport, p);
+ err = cb(ep, transport, p);
+ sctp_endpoint_put(ep);
sctp_transport_put(transport);
-
return err;
}
EXPORT_SYMBOL_GPL(sctp_transport_lookup_process);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 168/300] sctp: Hold sock lock while iterating over address list
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 167/300] sctp: hold endpoint before calling cb in sctp_transport_lookup_process Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 169/300] net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Greg Kroah-Hartman
` (137 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Stefan Wiehler,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wiehler <stefan.wiehler@nokia.com>
[ Upstream commit f1fc201148c7e684c10a72b6a3375597f28d1ef6 ]
Move address list traversal in inet_assoc_attr_size() under the sock
lock to avoid holding the RCU read lock.
Suggested-by: Xin Long <lucien.xin@gmail.com>
Fixes: 8f840e47f190 ("sctp: add the sctp_diag.c file")
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251028161506.3294376-4-stefan.wiehler@nokia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/diag.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/net/sctp/diag.c b/net/sctp/diag.c
index 3631a32d96b07..2cf5ee7a698e2 100644
--- a/net/sctp/diag.c
+++ b/net/sctp/diag.c
@@ -230,14 +230,15 @@ struct sctp_comm_param {
bool net_admin;
};
-static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+static size_t inet_assoc_attr_size(struct sock *sk,
+ struct sctp_association *asoc)
{
int addrlen = sizeof(struct sockaddr_storage);
int addrcnt = 0;
struct sctp_sockaddr_entry *laddr;
list_for_each_entry_rcu(laddr, &asoc->base.bind_addr.address_list,
- list)
+ list, lockdep_sock_is_held(sk))
addrcnt++;
return nla_total_size(sizeof(struct sctp_info))
@@ -263,11 +264,14 @@ static int sctp_sock_dump_one(struct sctp_endpoint *ep, struct sctp_transport *t
if (err)
return err;
- rep = nlmsg_new(inet_assoc_attr_size(assoc), GFP_KERNEL);
- if (!rep)
+ lock_sock(sk);
+
+ rep = nlmsg_new(inet_assoc_attr_size(sk, assoc), GFP_KERNEL);
+ if (!rep) {
+ release_sock(sk);
return -ENOMEM;
+ }
- lock_sock(sk);
if (ep != assoc->ep) {
err = -EAGAIN;
goto out;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 169/300] net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 168/300] sctp: Hold sock lock while iterating over address list Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 170/300] tracing: Fix memory leaks in create_field_var() Greg Kroah-Hartman
` (136 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qendrim Maxhuni, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qendrim Maxhuni <qendrim.maxhuni@garderos.com>
[ Upstream commit e120f46768d98151ece8756ebd688b0e43dc8b29 ]
Raw IP packets have no MAC header, leaving skb->mac_header uninitialized.
This can trigger kernel panics on ARM64 when xfrm or other subsystems
access the offset due to strict alignment checks.
Initialize the MAC header to prevent such crashes.
This can trigger kernel panics on ARM when running IPsec over the
qmimux0 interface.
Example trace:
Internal error: Oops: 000000009600004f [#1] SMP
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 6.12.34-gbe78e49cb433 #1
Hardware name: LS1028A RDB Board (DT)
pstate: 60000005 (nZCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : xfrm_input+0xde8/0x1318
lr : xfrm_input+0x61c/0x1318
sp : ffff800080003b20
Call trace:
xfrm_input+0xde8/0x1318
xfrm6_rcv+0x38/0x44
xfrm6_esp_rcv+0x48/0xa8
ip6_protocol_deliver_rcu+0x94/0x4b0
ip6_input_finish+0x44/0x70
ip6_input+0x44/0xc0
ipv6_rcv+0x6c/0x114
__netif_receive_skb_one_core+0x5c/0x8c
__netif_receive_skb+0x18/0x60
process_backlog+0x78/0x17c
__napi_poll+0x38/0x180
net_rx_action+0x168/0x2f0
Fixes: c6adf77953bc ("net: usb: qmi_wwan: add qmap mux protocol support")
Signed-off-by: Qendrim Maxhuni <qendrim.maxhuni@garderos.com>
Link: https://patch.msgid.link/20251029075744.105113-1-qendrim.maxhuni@garderos.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/qmi_wwan.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 84f949d8c8c9e..fb5c7ab467c0a 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -207,6 +207,12 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
return 0;
skbn->dev = net;
+ /* Raw IP packets don't have a MAC header, but other subsystems
+ * (like xfrm) may still access MAC header offsets, so they must
+ * be initialized.
+ */
+ skb_reset_mac_header(skbn);
+
switch (skb->data[offset + qmimux_hdr_sz] & 0xf0) {
case 0x40:
skbn->protocol = htons(ETH_P_IP);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 170/300] tracing: Fix memory leaks in create_field_var()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 169/300] net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 171/300] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC Greg Kroah-Hartman
` (135 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Steven Rostedt (Google),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 80f0d631dcc76ee1b7755bfca1d8417d91d71414 ]
The function create_field_var() allocates memory for 'val' through
create_hist_field() inside parse_atom(), and for 'var' through
create_var(), which in turn allocates var->type and var->var.name
internally. Simply calling kfree() to release these structures will
result in memory leaks.
Use destroy_hist_field() to properly free 'val', and explicitly release
the memory of var->type and var->var.name before freeing 'var' itself.
Link: https://patch.msgid.link/20251106120132.3639920-1-zilin@seu.edu.cn
Fixes: 02205a6752f22 ("tracing: Add support for 'field variables'")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_events_hist.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index a0342b45a06da..f499838d9103f 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -2729,14 +2729,16 @@ static struct field_var *create_field_var(struct hist_trigger_data *hist_data,
var = create_var(hist_data, file, field_name, val->size, val->type);
if (IS_ERR(var)) {
hist_err(tr, HIST_ERR_VAR_CREATE_FIND_FAIL, errpos(field_name));
- kfree(val);
+ destroy_hist_field(val, 0);
ret = PTR_ERR(var);
goto err;
}
field_var = kzalloc(sizeof(struct field_var), GFP_KERNEL);
if (!field_var) {
- kfree(val);
+ destroy_hist_field(val, 0);
+ kfree_const(var->type);
+ kfree(var->var.name);
kfree(var);
ret = -ENOMEM;
goto err;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 171/300] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 170/300] tracing: Fix memory leaks in create_field_var() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 172/300] extcon: adc-jack: Cleanup wakeup source only if it was enabled Greg Kroah-Hartman
` (134 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Ard Biesheuvel,
Eric Biggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 2b81082ad37cc3f28355fb73a6a69b91ff7dbf20 upstream.
Commit 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with
clang-17 and older") inadvertently disabled KASAN in curve25519-hacl64.o
for GCC unconditionally because clang-min-version will always evaluate
to nothing for GCC. Add a check for CONFIG_CC_IS_CLANG to avoid applying
the workaround for GCC, which is only needed for clang-17 and older.
Cc: stable@vger.kernel.org
Fixes: 2f13daee2a72 ("lib/crypto/curve25519-hacl64: Disable KASAN with clang-17 and older")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251103-curve25519-hacl64-fix-kasan-workaround-v2-1-ab581cbd8035@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/crypto/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/crypto/Makefile
+++ b/lib/crypto/Makefile
@@ -23,7 +23,7 @@ libcurve25519-generic-y := curve25519
libcurve25519-generic-$(CONFIG_ARCH_SUPPORTS_INT128) := curve25519-hacl64.o
libcurve25519-generic-y += curve25519-generic.o
# clang versions prior to 18 may blow out the stack with KASAN
-ifeq ($(call clang-min-version, 180000),)
+ifeq ($(CONFIG_CC_IS_CLANG)_$(call clang-min-version, 180000),y_)
KASAN_SANITIZE_curve25519-hacl64.o := n
endif
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 172/300] extcon: adc-jack: Cleanup wakeup source only if it was enabled
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 171/300] lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 173/300] compiler_types: Move unused static inline functions warning to W=2 Greg Kroah-Hartman
` (133 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Krzysztof Kozlowski, Chanwoo Choi
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 92bac7d4de9c07933f6b76d8f1c7f8240f911f4f upstream.
Driver in the probe enables wakeup source conditionally, so the cleanup
path should do the same - do not release the wakeup source memory if it
was not allocated.
Link: https://lore.kernel.org/lkml/20250509071703.39442-2-krzysztof.kozlowski@linaro.org/
Reported-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Closes: https://lore.kernel.org/r/22aaebb7-553b-4571-8a43-58a523241082@wanadoo.fr/
Fixes: 78b6a991eb6c ("extcon: adc-jack: Fix wakeup source leaks on device unbind")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Chanwoo Choi <cw00.choi@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/extcon/extcon-adc-jack.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/extcon/extcon-adc-jack.c
+++ b/drivers/extcon/extcon-adc-jack.c
@@ -162,7 +162,8 @@ static int adc_jack_remove(struct platfo
{
struct adc_jack_data *data = platform_get_drvdata(pdev);
- device_init_wakeup(&pdev->dev, false);
+ if (data->wakeup_source)
+ device_init_wakeup(&pdev->dev, false);
free_irq(data->irq, data);
cancel_work_sync(&data->handler.work);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 173/300] compiler_types: Move unused static inline functions warning to W=2
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 172/300] extcon: adc-jack: Cleanup wakeup source only if it was enabled Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 174/300] RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors Greg Kroah-Hartman
` (132 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Zijlstra, Andy Shevchenko,
Nathan Chancellor, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
[ Upstream commit 9818af18db4bfefd320d0fef41390a616365e6f7 ]
Per Nathan, clang catches unused "static inline" functions in C files
since commit 6863f5643dd7 ("kbuild: allow Clang to find unused static
inline functions for W=1 build").
Linus said:
> So I entirely ignore W=1 issues, because I think so many of the extra
> warnings are bogus.
>
> But if this one in particular is causing more problems than most -
> some teams do seem to use W=1 as part of their test builds - it's fine
> to send me a patch that just moves bad warnings to W=2.
>
> And if anybody uses W=2 for their test builds, that's THEIR problem..
Here is the change to bump the warning from W=1 to W=2.
Fixes: 6863f5643dd7 ("kbuild: allow Clang to find unused static inline functions for W=1 build")
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://patch.msgid.link/20251106105000.2103276-1-andriy.shevchenko@linux.intel.com
[nathan: Adjust comment as well]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/compiler_types.h | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/include/linux/compiler_types.h b/include/linux/compiler_types.h
index eb2bda017ccb7..9cecd02c1280a 100644
--- a/include/linux/compiler_types.h
+++ b/include/linux/compiler_types.h
@@ -158,10 +158,9 @@ struct ftrace_likely_data {
/*
* GCC does not warn about unused static inline functions for -Wunused-function.
* Suppress the warning in clang as well by using __maybe_unused, but enable it
- * for W=1 build. This will allow clang to find unused functions. Remove the
- * __inline_maybe_unused entirely after fixing most of -Wunused-function warnings.
+ * for W=2 build. This will allow clang to find unused functions.
*/
-#ifdef KBUILD_EXTRA_WARN1
+#ifdef KBUILD_EXTRA_WARN2
#define __inline_maybe_unused
#else
#define __inline_maybe_unused __maybe_unused
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 174/300] RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 173/300] compiler_types: Move unused static inline functions warning to W=2 Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 175/300] NFS4: Fix state renewals missing after boot Greg Kroah-Hartman
` (131 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danil Skrebenkov, Andrew Jones,
Paul Walmsley, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
[ Upstream commit ae9e9f3d67dcef7582a4524047b01e33c5185ddb ]
openSBI v1.7 adds harts checks for ipi operations. Especially it
adds comparison between hmask passed as an argument from linux
and mask of online harts (from openSBI side). If they don't
fit each other the error occurs.
When cpu is offline, cpu_online_mask is explicitly cleared in
__cpu_disable. However, there is no explicit clearing of
mm_cpumask. mm_cpumask is used for rfence operations that
call openSBI RFENCE extension which uses ipi to remote harts.
If hart is offline there may be error if mask of linux is not
as mask of online harts in openSBI.
this patch adds explicit clearing of mm_cpumask for offline hart.
Signed-off-by: Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Link: https://lore.kernel.org/r/20250919132849.31676-1-danil.skrebenkov@cloudbear.ru
[pjw@kernel.org: rewrote subject line for clarity]
Signed-off-by: Paul Walmsley <pjw@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/cpu-hotplug.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/riscv/kernel/cpu-hotplug.c b/arch/riscv/kernel/cpu-hotplug.c
index 0e948e87bd813..6cd16a2af2ee0 100644
--- a/arch/riscv/kernel/cpu-hotplug.c
+++ b/arch/riscv/kernel/cpu-hotplug.c
@@ -65,6 +65,7 @@ void __cpu_die(unsigned int cpu)
}
pr_notice("CPU%u: off\n", cpu);
+ clear_tasks_mm_cpumask(cpu);
/* Verify from the firmware if the cpu is really stopped*/
if (cpu_ops[cpu]->cpu_is_stopped)
ret = cpu_ops[cpu]->cpu_is_stopped(cpu);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 175/300] NFS4: Fix state renewals missing after boot
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 174/300] RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 176/300] HID: quirks: avoid Cooler Master MM712 dongle wakeup bug Greg Kroah-Hartman
` (130 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joshua Watt, Anna Schumaker,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Watt <jpewhacker@gmail.com>
[ Upstream commit 9bb3baa9d1604cd20f49ae7dac9306b4037a0e7a ]
Since the last renewal time was initialized to 0 and jiffies start
counting at -5 minutes, any clients connected in the first 5 minutes
after a reboot would have their renewal timer set to a very long
interval. If the connection was idle, this would result in the client
state timing out on the server and the next call to the server would
return NFS4ERR_BADSESSION.
Fix this by initializing the last renewal time to the current jiffies
instead of 0.
Signed-off-by: Joshua Watt <jpewhacker@gmail.com>
Signed-off-by: Anna Schumaker <anna.schumaker@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4client.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
index 89835457b7fda..5fd63df2db8b1 100644
--- a/fs/nfs/nfs4client.c
+++ b/fs/nfs/nfs4client.c
@@ -221,6 +221,7 @@ struct nfs_client *nfs4_alloc_client(const struct nfs_client_initdata *cl_init)
clp->cl_state = 1 << NFS4CLNT_LEASE_EXPIRED;
clp->cl_mvops = nfs_v4_minor_ops[cl_init->minorversion];
clp->cl_mig_gen = 1;
+ clp->cl_last_renewal = jiffies;
#if IS_ENABLED(CONFIG_NFS_V4_1)
init_waitqueue_head(&clp->cl_lock_waitq);
#endif
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 176/300] HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 175/300] NFS4: Fix state renewals missing after boot Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 177/300] ASoC: max98090/91: fixed max98091 ALSA widget powering up/down Greg Kroah-Hartman
` (129 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tristan Lobb, Jiri Kosina,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tristan Lobb <tristan.lobb@it-lobb.de>
[ Upstream commit 0be4253bf878d9aaa2b96031ac8683fceeb81480 ]
The Cooler Master Mice Dongle includes a vendor defined HID interface
alongside its mouse interface. Not polling it will cause the mouse to
stop responding to polls on any interface once woken up again after
going into power saving mode.
Add the HID_QUIRK_ALWAYS_POLL quirk alongside the Cooler Master VID and
the Dongle's PID.
Signed-off-by: Tristan Lobb <tristan.lobb@it-lobb.de>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ids.h | 3 +++
drivers/hid/hid-quirks.c | 1 +
2 files changed, 4 insertions(+)
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index 8bfa90e37ea17..c213f1cc8aebc 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -298,6 +298,9 @@
#define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500
#define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff
+#define USB_VENDOR_ID_COOLER_MASTER 0x2516
+#define USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE 0x01b7
+
#define USB_VENDOR_ID_CORSAIR 0x1b1c
#define USB_DEVICE_ID_CORSAIR_K90 0x1b02
diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c
index 9c1c65612adb7..5fcd6f7b5f787 100644
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -57,6 +57,7 @@ static const struct hid_device_id hid_quirks[] = {
{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_FLIGHT_SIM_YOKE), HID_QUIRK_NOGET },
{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_PEDALS), HID_QUIRK_NOGET },
{ HID_USB_DEVICE(USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_PRO_THROTTLE), HID_QUIRK_NOGET },
+ { HID_USB_DEVICE(USB_VENDOR_ID_COOLER_MASTER, USB_DEVICE_ID_COOLER_MASTER_MICE_DONGLE), HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB), HID_QUIRK_NO_INIT_REPORTS },
{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB_RAPIDFIRE), HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL },
{ HID_USB_DEVICE(USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB), HID_QUIRK_NO_INIT_REPORTS },
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 177/300] ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 176/300] HID: quirks: avoid Cooler Master MM712 dongle wakeup bug Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 178/300] net: fec: correct rx_bytes statistic for the case SHIFT16 is set Greg Kroah-Hartman
` (128 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sharique Mohammad, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sharique Mohammad <sharq0406@gmail.com>
[ Upstream commit 7a37291ed40a33a5f6c3d370fdde5ee0d8f7d0e4 ]
The widgets DMIC3_ENA and DMIC4_ENA must be defined in the DAPM
suppy widget, just like DMICL_ENA and DMICR_ENA. Whenever they
are turned on or off, the required startup or shutdown sequences
must be taken care by the max98090_shdn_event.
Signed-off-by: Sharique Mohammad <sharq0406@gmail.com>
Link: https://patch.msgid.link/20251015134215.750001-1-sharq0406@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/max98090.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
index 0c73979cad4a4..c7df685be4ea5 100644
--- a/sound/soc/codecs/max98090.c
+++ b/sound/soc/codecs/max98090.c
@@ -1233,9 +1233,11 @@ static const struct snd_soc_dapm_widget max98091_dapm_widgets[] = {
SND_SOC_DAPM_INPUT("DMIC4"),
SND_SOC_DAPM_SUPPLY("DMIC3_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
- M98090_DIGMIC3_SHIFT, 0, NULL, 0),
+ M98090_DIGMIC3_SHIFT, 0, max98090_shdn_event,
+ SND_SOC_DAPM_POST_PMU),
SND_SOC_DAPM_SUPPLY("DMIC4_ENA", M98090_REG_DIGITAL_MIC_ENABLE,
- M98090_DIGMIC4_SHIFT, 0, NULL, 0),
+ M98090_DIGMIC4_SHIFT, 0, max98090_shdn_event,
+ SND_SOC_DAPM_POST_PMU),
};
static const struct snd_soc_dapm_route max98090_dapm_routes[] = {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 178/300] net: fec: correct rx_bytes statistic for the case SHIFT16 is set
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 177/300] ASoC: max98090/91: fixed max98091 ALSA widget powering up/down Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 179/300] Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Greg Kroah-Hartman
` (127 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Fang, Frank Li, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Fang <wei.fang@nxp.com>
[ Upstream commit ad17e7e92a7c52ce70bb764813fcf99464f96903 ]
Two additional bytes in front of each frame received into the RX FIFO if
SHIFT16 is set, so we need to subtract the extra two bytes from pkt_len
to correct the statistic of rx_bytes.
Fixes: 3ac72b7b63d5 ("net: fec: align IP header in hardware")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/20251106021421.2096585-1-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/fec_main.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 9905e65621004..dfe3e7b1fae51 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c
@@ -1525,6 +1525,8 @@ fec_enet_rx_queue(struct net_device *ndev, int budget, u16 queue_id)
ndev->stats.rx_packets++;
pkt_len = fec16_to_cpu(bdp->cbd_datlen);
ndev->stats.rx_bytes += pkt_len;
+ if (fep->quirks & FEC_QUIRK_HAS_RACC)
+ ndev->stats.rx_bytes -= 2;
index = fec_enet_get_bd_index(bdp, &rxq->bd);
skb = rxq->rx_skbuff[index];
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 179/300] Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 178/300] net: fec: correct rx_bytes statistic for the case SHIFT16 is set Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 180/300] Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Greg Kroah-Hartman
` (126 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2fc81b50a4f8263a159b,
Raphael Pinsonneault-Thibeault, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
[ Upstream commit 23d22f2f71768034d6ef86168213843fc49bf550 ]
There is a KASAN: slab-use-after-free read in btusb_disconnect().
Calling "usb_driver_release_interface(&btusb_driver, data->intf)" will
free the btusb data associated with the interface. The same data is
then used later in the function, hence the UAF.
Fix by moving the accesses to btusb data to before the data is free'd.
Reported-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=2fc81b50a4f8263a159b
Tested-by: syzbot+2fc81b50a4f8263a159b@syzkaller.appspotmail.com
Fixes: fd913ef7ce619 ("Bluetooth: btusb: Add out-of-band wakeup support")
Signed-off-by: Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btusb.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
index cf0a0b3eaf886..155eaaf0485a1 100644
--- a/drivers/bluetooth/btusb.c
+++ b/drivers/bluetooth/btusb.c
@@ -4391,6 +4391,11 @@ static void btusb_disconnect(struct usb_interface *intf)
hci_unregister_dev(hdev);
+ if (data->oob_wake_irq)
+ device_init_wakeup(&data->udev->dev, false);
+ if (data->reset_gpio)
+ gpiod_put(data->reset_gpio);
+
if (intf == data->intf) {
if (data->isoc)
usb_driver_release_interface(&btusb_driver, data->isoc);
@@ -4401,17 +4406,11 @@ static void btusb_disconnect(struct usb_interface *intf)
usb_driver_release_interface(&btusb_driver, data->diag);
usb_driver_release_interface(&btusb_driver, data->intf);
} else if (intf == data->diag) {
- usb_driver_release_interface(&btusb_driver, data->intf);
if (data->isoc)
usb_driver_release_interface(&btusb_driver, data->isoc);
+ usb_driver_release_interface(&btusb_driver, data->intf);
}
- if (data->oob_wake_irq)
- device_init_wakeup(&data->udev->dev, false);
-
- if (data->reset_gpio)
- gpiod_put(data->reset_gpio);
-
hci_free_dev(hdev);
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 180/300] Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 179/300] Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 181/300] Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Greg Kroah-Hartman
` (125 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 3b78f50918276ab28fb22eac9aa49401ac436a3b ]
Bluetooth 6lowpan.c netdev has header_ops, so it must set link-local
header for RX skb, otherwise things crash, eg. with AF_PACKET SOCK_RAW
Add missing skb_reset_mac_header() for uncompressed ipv6 RX path.
For the compressed one, it is done in lowpan_header_decompress().
Log: (BlueZ 6lowpan-tester Client Recv Raw - Success)
------
kernel BUG at net/core/skbuff.c:212!
Call Trace:
<IRQ>
...
packet_rcv (net/packet/af_packet.c:2152)
...
<TASK>
__local_bh_enable_ip (kernel/softirq.c:407)
netif_rx (net/core/dev.c:5648)
chan_recv_cb (net/bluetooth/6lowpan.c:294 net/bluetooth/6lowpan.c:359)
------
Fixes: 18722c247023 ("Bluetooth: Enable 6LoWPAN support for BT LE devices")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 7e698b0ac7bc7..32dc74115dcbc 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -317,6 +317,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
local_skb->pkt_type = PACKET_HOST;
local_skb->dev = dev;
+ skb_reset_mac_header(local_skb);
skb_set_transport_header(local_skb, sizeof(struct ipv6hdr));
if (give_skb_to_upper(local_skb, dev) != NET_RX_SUCCESS) {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 181/300] Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 180/300] Bluetooth: 6lowpan: reset link-local header on ipv6 recv path Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 182/300] Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions Greg Kroah-Hartman
` (124 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit b454505bf57a2e4f5d49951d4deb03730a9348d9 ]
Bluetooth 6lowpan.c confuses BDADDR_LE and ADDR_LE_DEV address types,
e.g. debugfs "connect" command takes the former, and "disconnect" and
"connect" to already connected device take the latter. This is due to
using same value both for l2cap_chan_connect and hci_conn_hash_lookup_le
which take different dst_type values.
Fix address type passed to hci_conn_hash_lookup_le().
Retain the debugfs API difference between "connect" and "disconnect"
commands since it's been like this since 2015 and nobody apparently
complained.
Fixes: f5ad4ffceba0 ("Bluetooth: 6lowpan: Use hci_conn_hash_lookup_le() when possible")
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 28 ++++++++++++++++++++++++----
1 file changed, 24 insertions(+), 4 deletions(-)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index 32dc74115dcbc..d035bb927aec2 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -994,10 +994,11 @@ static struct l2cap_chan *bt_6lowpan_listen(void)
}
static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
- struct l2cap_conn **conn)
+ struct l2cap_conn **conn, bool disconnect)
{
struct hci_conn *hcon;
struct hci_dev *hdev;
+ int le_addr_type;
int n;
n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -1008,13 +1009,32 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
if (n < 7)
return -EINVAL;
+ if (disconnect) {
+ /* The "disconnect" debugfs command has used different address
+ * type constants than "connect" since 2015. Let's retain that
+ * for now even though it's obviously buggy...
+ */
+ *addr_type += 1;
+ }
+
+ switch (*addr_type) {
+ case BDADDR_LE_PUBLIC:
+ le_addr_type = ADDR_LE_DEV_PUBLIC;
+ break;
+ case BDADDR_LE_RANDOM:
+ le_addr_type = ADDR_LE_DEV_RANDOM;
+ break;
+ default:
+ return -EINVAL;
+ }
+
/* The LE_PUBLIC address type is ignored because of BDADDR_ANY */
hdev = hci_get_route(addr, BDADDR_ANY, BDADDR_LE_PUBLIC);
if (!hdev)
return -ENOENT;
hci_dev_lock(hdev);
- hcon = hci_conn_hash_lookup_le(hdev, addr, *addr_type);
+ hcon = hci_conn_hash_lookup_le(hdev, addr, le_addr_type);
hci_dev_unlock(hdev);
hci_dev_put(hdev);
@@ -1141,7 +1161,7 @@ static ssize_t lowpan_control_write(struct file *fp,
buf[buf_size] = '\0';
if (memcmp(buf, "connect ", 8) == 0) {
- ret = get_l2cap_conn(&buf[8], &addr, &addr_type, &conn);
+ ret = get_l2cap_conn(&buf[8], &addr, &addr_type, &conn, false);
if (ret == -EINVAL)
return ret;
@@ -1178,7 +1198,7 @@ static ssize_t lowpan_control_write(struct file *fp,
}
if (memcmp(buf, "disconnect ", 11) == 0) {
- ret = get_l2cap_conn(&buf[11], &addr, &addr_type, &conn);
+ ret = get_l2cap_conn(&buf[11], &addr, &addr_type, &conn, true);
if (ret < 0)
return ret;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 182/300] Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 181/300] Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 183/300] sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Greg Kroah-Hartman
` (123 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit 98454bc812f3611551e4b1f81732da4aa7b9597e ]
disconnect_all_peers() calls sleeping function (l2cap_chan_close) under
spinlock. Holding the lock doesn't actually do any good -- we work on a
local copy of the list, and the lock doesn't protect against peer->chan
having already been freed.
Fix by taking refcounts of peer->chan instead. Clean up the code and
old comments a bit.
Take devices_lock instead of RCU, because the kfree_rcu();
l2cap_chan_put(); construct in chan_close_cb() does not guarantee
peer->chan is necessarily valid in RCU.
Also take l2cap_chan_lock() which is required for l2cap_chan_close().
Log: (bluez 6lowpan-tester Client Connect - Disable)
------
BUG: sleeping function called from invalid context at kernel/locking/mutex.c:575
...
<TASK>
...
l2cap_send_disconn_req (net/bluetooth/l2cap_core.c:938 net/bluetooth/l2cap_core.c:1495)
...
? __pfx_l2cap_chan_close (net/bluetooth/l2cap_core.c:809)
do_enable_set (net/bluetooth/6lowpan.c:1048 net/bluetooth/6lowpan.c:1068)
------
Fixes: 90305829635d ("Bluetooth: 6lowpan: Converting rwlocks to use RCU")
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/6lowpan.c | 68 ++++++++++++++++++++++++++---------------
1 file changed, 43 insertions(+), 25 deletions(-)
diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index d035bb927aec2..9486d66863264 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -52,6 +52,11 @@ static bool enable_6lowpan;
static struct l2cap_chan *listen_chan;
static DEFINE_MUTEX(set_lock);
+enum {
+ LOWPAN_PEER_CLOSING,
+ LOWPAN_PEER_MAXBITS
+};
+
struct lowpan_peer {
struct list_head list;
struct rcu_head rcu;
@@ -60,6 +65,8 @@ struct lowpan_peer {
/* peer addresses in various formats */
unsigned char lladdr[ETH_ALEN];
struct in6_addr peer_addr;
+
+ DECLARE_BITMAP(flags, LOWPAN_PEER_MAXBITS);
};
struct lowpan_btle_dev {
@@ -1051,41 +1058,52 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
static void disconnect_all_peers(void)
{
struct lowpan_btle_dev *entry;
- struct lowpan_peer *peer, *tmp_peer, *new_peer;
- struct list_head peers;
-
- INIT_LIST_HEAD(&peers);
+ struct lowpan_peer *peer;
+ int nchans;
- /* We make a separate list of peers as the close_cb() will
- * modify the device peers list so it is better not to mess
- * with the same list at the same time.
+ /* l2cap_chan_close() cannot be called from RCU, and lock ordering
+ * chan->lock > devices_lock prevents taking write side lock, so copy
+ * then close.
*/
rcu_read_lock();
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list)
+ list_for_each_entry_rcu(peer, &entry->peers, list)
+ clear_bit(LOWPAN_PEER_CLOSING, peer->flags);
+ rcu_read_unlock();
- list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
- list_for_each_entry_rcu(peer, &entry->peers, list) {
- new_peer = kmalloc(sizeof(*new_peer), GFP_ATOMIC);
- if (!new_peer)
- break;
+ do {
+ struct l2cap_chan *chans[32];
+ int i;
- new_peer->chan = peer->chan;
- INIT_LIST_HEAD(&new_peer->list);
+ nchans = 0;
- list_add(&new_peer->list, &peers);
- }
- }
+ spin_lock(&devices_lock);
- rcu_read_unlock();
+ list_for_each_entry_rcu(entry, &bt_6lowpan_devices, list) {
+ list_for_each_entry_rcu(peer, &entry->peers, list) {
+ if (test_and_set_bit(LOWPAN_PEER_CLOSING,
+ peer->flags))
+ continue;
- spin_lock(&devices_lock);
- list_for_each_entry_safe(peer, tmp_peer, &peers, list) {
- l2cap_chan_close(peer->chan, ENOENT);
+ l2cap_chan_hold(peer->chan);
+ chans[nchans++] = peer->chan;
- list_del_rcu(&peer->list);
- kfree_rcu(peer, rcu);
- }
- spin_unlock(&devices_lock);
+ if (nchans >= ARRAY_SIZE(chans))
+ goto done;
+ }
+ }
+
+done:
+ spin_unlock(&devices_lock);
+
+ for (i = 0; i < nchans; ++i) {
+ l2cap_chan_lock(chans[i]);
+ l2cap_chan_close(chans[i], ENOENT);
+ l2cap_chan_unlock(chans[i]);
+ l2cap_chan_put(chans[i]);
+ }
+ } while (nchans);
}
struct set_enable {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 183/300] sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 182/300] Bluetooth: 6lowpan: Dont hold spin lock over sleeping functions Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 184/300] net/smc: fix mismatch between CLC header and proposal Greg Kroah-Hartman
` (122 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+f8c46c8b2b7f6e076e99,
Eric Dumazet, Daniel Borkmann, Xin Long, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 1534ff77757e44bcc4b98d0196bc5c0052fce5fa ]
syzbot reported a possible shift-out-of-bounds [1]
Blamed commit added rto_alpha_max and rto_beta_max set to 1000.
It is unclear if some sctp users are setting very large rto_alpha
and/or rto_beta.
In order to prevent user regression, perform the test at run time.
Also add READ_ONCE() annotations as sysctl values can change under us.
[1]
UBSAN: shift-out-of-bounds in net/sctp/transport.c:509:41
shift exponent 64 is too large for 32-bit type 'unsigned int'
CPU: 0 UID: 0 PID: 16704 Comm: syz.2.2320 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x16c/0x1f0 lib/dump_stack.c:120
ubsan_epilogue lib/ubsan.c:233 [inline]
__ubsan_handle_shift_out_of_bounds+0x27f/0x420 lib/ubsan.c:494
sctp_transport_update_rto.cold+0x1c/0x34b net/sctp/transport.c:509
sctp_check_transmitted+0x11c4/0x1c30 net/sctp/outqueue.c:1502
sctp_outq_sack+0x4ef/0x1b20 net/sctp/outqueue.c:1338
sctp_cmd_process_sack net/sctp/sm_sideeffect.c:840 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1372 [inline]
Fixes: b58537a1f562 ("net: sctp: fix permissions for rto_alpha and rto_beta knobs")
Reported-by: syzbot+f8c46c8b2b7f6e076e99@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/690c81ae.050a0220.3d0d33.014e.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20251106111054.3288127-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sctp/transport.c | 13 +++++++++----
1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index 9c721d70df9c6..9921041079781 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -337,6 +337,7 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
if (tp->rttvar || tp->srtt) {
struct net *net = tp->asoc->base.net;
+ unsigned int rto_beta, rto_alpha;
/* 6.3.1 C3) When a new RTT measurement R' is made, set
* RTTVAR <- (1 - RTO.Beta) * RTTVAR + RTO.Beta * |SRTT - R'|
* SRTT <- (1 - RTO.Alpha) * SRTT + RTO.Alpha * R'
@@ -348,10 +349,14 @@ void sctp_transport_update_rto(struct sctp_transport *tp, __u32 rtt)
* For example, assuming the default value of RTO.Alpha of
* 1/8, rto_alpha would be expressed as 3.
*/
- tp->rttvar = tp->rttvar - (tp->rttvar >> net->sctp.rto_beta)
- + (((__u32)abs((__s64)tp->srtt - (__s64)rtt)) >> net->sctp.rto_beta);
- tp->srtt = tp->srtt - (tp->srtt >> net->sctp.rto_alpha)
- + (rtt >> net->sctp.rto_alpha);
+ rto_beta = READ_ONCE(net->sctp.rto_beta);
+ if (rto_beta < 32)
+ tp->rttvar = tp->rttvar - (tp->rttvar >> rto_beta)
+ + (((__u32)abs((__s64)tp->srtt - (__s64)rtt)) >> rto_beta);
+ rto_alpha = READ_ONCE(net->sctp.rto_alpha);
+ if (rto_alpha < 32)
+ tp->srtt = tp->srtt - (tp->srtt >> rto_alpha)
+ + (rtt >> rto_alpha);
} else {
/* 6.3.1 C2) When the first RTT measurement R is made, set
* SRTT <- R, RTTVAR <- R/2.
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 184/300] net/smc: fix mismatch between CLC header and proposal
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 183/300] sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 185/300] tipc: Fix use-after-free in tipc_mon_reinit_self() Greg Kroah-Hartman
` (121 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, D. Wythe, Alexandra Winter,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: D. Wythe <alibuda@linux.alibaba.com>
[ Upstream commit ec33f2e5a2d0dbbfd71435209aee812fdc9369b8 ]
The current CLC proposal message construction uses a mix of
`ini->smc_type_v1/v2` and `pclc_base->hdr.typev1/v2` to decide whether
to include optional extensions (IPv6 prefix extension for v1, and v2
extension). This leads to a critical inconsistency: when
`smc_clc_prfx_set()` fails - for example, in IPv6-only environments with
only link-local addresses, or when the local IP address and the outgoing
interface’s network address are not in the same subnet.
As a result, the proposal message is assembled using the stale
`ini->smc_type_v1` value—causing the IPv6 prefix extension to be
included even though the header indicates v1 is not supported.
The peer then receives a malformed CLC proposal where the header type
does not match the payload, and immediately resets the connection.
The fix ensures consistency between the CLC header flags and the actual
payload by synchronizing `ini->smc_type_v1` with `pclc_base->hdr.typev1`
when prefix setup fails.
Fixes: 8c3dca341aea ("net/smc: build and send V2 CLC proposal")
Signed-off-by: D. Wythe <alibuda@linux.alibaba.com>
Reviewed-by: Alexandra Winter <wintera@linux.ibm.com>
Link: https://patch.msgid.link/20251107024029.88753-1-alibuda@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_clc.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/smc/smc_clc.c b/net/smc/smc_clc.c
index 2aa69e29fa1d5..dca448c98c9de 100644
--- a/net/smc/smc_clc.c
+++ b/net/smc/smc_clc.c
@@ -529,6 +529,7 @@ int smc_clc_send_proposal(struct smc_sock *smc, struct smc_init_info *ini)
return SMC_CLC_DECL_CNFERR;
}
pclc_base->hdr.typev1 = SMC_TYPE_N;
+ ini->smc_type_v1 = SMC_TYPE_N;
} else {
pclc_base->iparea_offset = htons(sizeof(*pclc_smcd));
plen += sizeof(*pclc_prfx) +
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 185/300] tipc: Fix use-after-free in tipc_mon_reinit_self().
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 184/300] net/smc: fix mismatch between CLC header and proposal Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 186/300] net: mdio: fix resource leak in mdiobus_register_device() Greg Kroah-Hartman
` (120 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+d7dad7fd4b3921104957,
Kuniyuki Iwashima, Simon Horman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuniyuki Iwashima <kuniyu@google.com>
[ Upstream commit 0725e6afb55128be21a2ca36e9674f573ccec173 ]
syzbot reported use-after-free of tipc_net(net)->monitors[]
in tipc_mon_reinit_self(). [0]
The array is protected by RTNL, but tipc_mon_reinit_self()
iterates over it without RTNL.
tipc_mon_reinit_self() is called from tipc_net_finalize(),
which is always under RTNL except for tipc_net_finalize_work().
Let's hold RTNL in tipc_net_finalize_work().
[0]:
BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
Read of size 1 at addr ffff88805eae1030 by task kworker/0:7/5989
CPU: 0 UID: 0 PID: 5989 Comm: kworker/0:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Workqueue: events tipc_net_finalize_work
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__kasan_check_byte+0x2a/0x40 mm/kasan/common.c:568
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire+0x8d/0x360 kernel/locking/lockdep.c:5842
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xa7/0xf0 kernel/locking/spinlock.c:162
rtlock_slowlock kernel/locking/rtmutex.c:1894 [inline]
rwbase_rtmutex_lock_state kernel/locking/spinlock_rt.c:160 [inline]
rwbase_write_lock+0xd3/0x7e0 kernel/locking/rwbase_rt.c:244
rt_write_lock+0x76/0x110 kernel/locking/spinlock_rt.c:243
write_lock_bh include/linux/rwlock_rt.h:99 [inline]
tipc_mon_reinit_self+0x79/0x430 net/tipc/monitor.c:718
tipc_net_finalize+0x115/0x190 net/tipc/net.c:140
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xade/0x17b0 kernel/workqueue.c:3319
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400
kthread+0x70e/0x8a0 kernel/kthread.c:463
ret_from_fork+0x439/0x7d0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6089:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__kmalloc_cache_noprof+0x1a8/0x320 mm/slub.c:4407
kmalloc_noprof include/linux/slab.h:905 [inline]
kzalloc_noprof include/linux/slab.h:1039 [inline]
tipc_mon_create+0xc3/0x4d0 net/tipc/monitor.c:657
tipc_enable_bearer net/tipc/bearer.c:357 [inline]
__tipc_nl_bearer_enable+0xe16/0x13f0 net/tipc/bearer.c:1047
__tipc_nl_compat_doit net/tipc/netlink_compat.c:371 [inline]
tipc_nl_compat_doit+0x3bc/0x5f0 net/tipc/netlink_compat.c:393
tipc_nl_compat_handle net/tipc/netlink_compat.c:-1 [inline]
tipc_nl_compat_recv+0x83c/0xbe0 net/tipc/netlink_compat.c:1321
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:729
____sys_sendmsg+0x508/0x820 net/socket.c:2614
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668
__sys_sendmsg net/socket.c:2700 [inline]
__do_sys_sendmsg net/socket.c:2705 [inline]
__se_sys_sendmsg net/socket.c:2703 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2703
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6088:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x195/0x550 mm/slub.c:4894
tipc_l2_device_event+0x380/0x650 net/tipc/bearer.c:-1
notifier_call_chain+0x1b3/0x3e0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2267 [inline]
call_netdevice_notifiers net/core/dev.c:2281 [inline]
unregister_netdevice_many_notify+0x14d7/0x1fe0 net/core/dev.c:12166
unregister_netdevice_many net/core/dev.c:12229 [inline]
unregister_netdevice_queue+0x33c/0x380 net/core/dev.c:12073
unregister_netdevice include/linux/netdevice.h:3385 [inline]
__tun_detach+0xe4d/0x1620 drivers/net/tun.c:621
tun_detach drivers/net/tun.c:637 [inline]
tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3433
__fput+0x458/0xa80 fs/file_table.c:468
task_work_run+0x1d4/0x260 kernel/task_work.c:227
resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
exit_to_user_mode_loop+0xec/0x110 kernel/entry/common.c:43
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: 46cb01eeeb86 ("tipc: update mon's self addr when node addr generated")
Reported-by: syzbot+d7dad7fd4b3921104957@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/690c323a.050a0220.baf87.007f.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251107064038.2361188-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tipc/net.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 671cb4f9d5633..95aa3a97b53a8 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -141,7 +141,9 @@ void tipc_net_finalize_work(struct work_struct *work)
{
struct tipc_net *tn = container_of(work, struct tipc_net, work);
+ rtnl_lock();
tipc_net_finalize(tipc_link_net(tn->bcl), tn->trial_addr);
+ rtnl_unlock();
}
void tipc_net_stop(struct net *net)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 186/300] net: mdio: fix resource leak in mdiobus_register_device()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 185/300] tipc: Fix use-after-free in tipc_mon_reinit_self() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 187/300] wifi: mac80211: skip rate verification for not captured PSDUs Greg Kroah-Hartman
` (119 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Buday Csaba, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Buday Csaba <buday.csaba@prolan.hu>
[ Upstream commit e6ca8f533ed41129fcf052297718f417f021cc7d ]
Fix a possible leak in mdiobus_register_device() when both a
reset-gpio and a reset-controller are present.
Clean up the already claimed reset-gpio, when the registration of
the reset-controller fails, so when an error code is returned, the
device retains its state before the registration attempt.
Link: https://lore.kernel.org/all/20251106144603.39053c81@kernel.org/
Fixes: 71dd6c0dff51 ("net: phy: add support for reset-controller")
Signed-off-by: Buday Csaba <buday.csaba@prolan.hu>
Link: https://patch.msgid.link/4b419377f8dd7d2f63f919d0f74a336c734f8fff.1762584481.git.buday.csaba@prolan.hu
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/mdio_bus.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
index d15deb3281edb..d7a65a5c855e5 100644
--- a/drivers/net/phy/mdio_bus.c
+++ b/drivers/net/phy/mdio_bus.c
@@ -80,8 +80,11 @@ int mdiobus_register_device(struct mdio_device *mdiodev)
return err;
err = mdiobus_register_reset(mdiodev);
- if (err)
+ if (err) {
+ gpiod_put(mdiodev->reset_gpio);
+ mdiodev->reset_gpio = NULL;
return err;
+ }
/* Assert the reset signal */
mdio_device_reset(mdiodev, 1);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 187/300] wifi: mac80211: skip rate verification for not captured PSDUs
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 186/300] net: mdio: fix resource leak in mdiobus_register_device() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 188/300] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Greg Kroah-Hartman
` (118 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Miri Korenblit,
Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit 7fe0d21f5633af8c3fab9f0ef0706c6156623484 ]
If for example the sniffer did not follow any AIDs in an MU frame, then
some of the information may not be filled in or is even expected to be
invalid. As an example, in that case it is expected that Nss is zero.
Fixes: 2ff5e52e7836 ("radiotap: add 0-length PSDU "not captured" type")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://patch.msgid.link/20251110142554.83a2858ee15b.I9f78ce7984872f474722f9278691ae16378f0a3e@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/rx.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index b46c4c770608c..98f06563d184c 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -4779,10 +4779,14 @@ void ieee80211_rx_list(struct ieee80211_hw *hw, struct ieee80211_sta *pubsta,
if (WARN_ON(!local->started))
goto drop;
- if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC))) {
+ if (likely(!(status->flag & RX_FLAG_FAILED_PLCP_CRC) &&
+ !(status->flag & RX_FLAG_NO_PSDU &&
+ status->zero_length_psdu_type ==
+ IEEE80211_RADIOTAP_ZERO_LEN_PSDU_NOT_CAPTURED))) {
/*
- * Validate the rate, unless a PLCP error means that
- * we probably can't have a valid rate here anyway.
+ * Validate the rate, unless there was a PLCP error which may
+ * have an invalid rate or the PSDU was not capture and may be
+ * missing rate information.
*/
switch (status->encoding) {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 188/300] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 187/300] wifi: mac80211: skip rate verification for not captured PSDUs Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 189/300] net/mlx5e: Fix maxrate wraparound in threshold between units Greg Kroah-Hartman
` (117 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0c85cae3350b7d486aee,
Ranganath V N, Eric Dumazet, Cong Wang, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ranganath V N <vnranganath.20@gmail.com>
[ Upstream commit ce50039be49eea9b4cd8873ca6eccded1b4a130a ]
Fix a KMSAN kernel-infoleak detected by the syzbot .
[net?] KMSAN: kernel-infoleak in __skb_datagram_iter
In tcf_ife_dump(), the variable 'opt' was partially initialized using a
designatied initializer. While the padding bytes are reamined
uninitialized. nla_put() copies the entire structure into a
netlink message, these uninitialized bytes leaked to userspace.
Initialize the structure with memset before assigning its fields
to ensure all members and padding are cleared prior to beign copied.
This change silences the KMSAN report and prevents potential information
leaks from the kernel memory.
This fix has been tested and validated by syzbot. This patch closes the
bug reported at the following syzkaller link and ensures no infoleak.
Reported-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0c85cae3350b7d486aee
Tested-by: syzbot+0c85cae3350b7d486aee@syzkaller.appspotmail.com
Fixes: ef6980b6becb ("introduce IFE action")
Signed-off-by: Ranganath V N <vnranganath.20@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251109091336.9277-3-vnranganath.20@gmail.com
Acked-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_ife.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
index 99548b2a1bc83..892d4824d81d5 100644
--- a/net/sched/act_ife.c
+++ b/net/sched/act_ife.c
@@ -643,13 +643,15 @@ static int tcf_ife_dump(struct sk_buff *skb, struct tc_action *a, int bind,
unsigned char *b = skb_tail_pointer(skb);
struct tcf_ife_info *ife = to_ife(a);
struct tcf_ife_params *p;
- struct tc_ife opt = {
- .index = ife->tcf_index,
- .refcnt = refcount_read(&ife->tcf_refcnt) - ref,
- .bindcnt = atomic_read(&ife->tcf_bindcnt) - bind,
- };
+ struct tc_ife opt;
struct tcf_t t;
+ memset(&opt, 0, sizeof(opt));
+
+ opt.index = ife->tcf_index,
+ opt.refcnt = refcount_read(&ife->tcf_refcnt) - ref,
+ opt.bindcnt = atomic_read(&ife->tcf_bindcnt) - bind,
+
spin_lock_bh(&ife->tcf_lock);
opt.action = ife->tcf_action;
p = rcu_dereference_protected(ife->params,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 189/300] net/mlx5e: Fix maxrate wraparound in threshold between units
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 188/300] net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 190/300] net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps Greg Kroah-Hartman
` (116 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Nimrod Oren,
Tariq Toukan, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit a7bf4d5063c7837096aab2853224eb23628514d9 ]
The previous calculation used roundup() which caused an overflow for
rates between 25.5Gbps and 26Gbps.
For example, a rate of 25.6Gbps would result in using 100Mbps units with
value of 256, which would overflow the 8 bits field.
Simplify the upper_limit_mbps calculation by removing the
unnecessary roundup, and adjust the comparison to use <= to correctly
handle the boundary condition.
Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1762681073-1084058-4-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index c25fb0cbde274..4f1ce1287cdae 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -587,18 +587,19 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
struct mlx5_core_dev *mdev = priv->mdev;
u8 max_bw_value[IEEE_8021QAZ_MAX_TCS];
u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS];
- __u64 upper_limit_mbps = roundup(255 * MLX5E_100MB, MLX5E_1GB);
+ __u64 upper_limit_mbps;
int i;
memset(max_bw_value, 0, sizeof(max_bw_value));
memset(max_bw_unit, 0, sizeof(max_bw_unit));
+ upper_limit_mbps = 255 * MLX5E_100MB;
for (i = 0; i <= mlx5_max_tc(mdev); i++) {
if (!maxrate->tc_maxrate[i]) {
max_bw_unit[i] = MLX5_BW_NO_LIMIT;
continue;
}
- if (maxrate->tc_maxrate[i] < upper_limit_mbps) {
+ if (maxrate->tc_maxrate[i] <= upper_limit_mbps) {
max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
MLX5E_100MB);
max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 190/300] net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 189/300] net/mlx5e: Fix maxrate wraparound in threshold between units Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 191/300] net_sched: limit try_bulk_dequeue_skb() batches Greg Kroah-Hartman
` (115 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gal Pressman, Nimrod Oren,
Tariq Toukan, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gal Pressman <gal@nvidia.com>
[ Upstream commit 43b27d1bd88a4bce34ec2437d103acfae9655f9e ]
Add validation to reject rates exceeding 255 Gbps that would overflow
the 8 bits max bandwidth field.
Fixes: d8880795dabf ("net/mlx5e: Implement DCBNL IEEE max rate")
Signed-off-by: Gal Pressman <gal@nvidia.com>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1762681073-1084058-5-git-send-email-tariqt@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 4f1ce1287cdae..5c48a4872f35d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -588,11 +588,13 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
u8 max_bw_value[IEEE_8021QAZ_MAX_TCS];
u8 max_bw_unit[IEEE_8021QAZ_MAX_TCS];
__u64 upper_limit_mbps;
+ __u64 upper_limit_gbps;
int i;
memset(max_bw_value, 0, sizeof(max_bw_value));
memset(max_bw_unit, 0, sizeof(max_bw_unit));
upper_limit_mbps = 255 * MLX5E_100MB;
+ upper_limit_gbps = 255 * MLX5E_1GB;
for (i = 0; i <= mlx5_max_tc(mdev); i++) {
if (!maxrate->tc_maxrate[i]) {
@@ -604,10 +606,16 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
MLX5E_100MB);
max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
max_bw_unit[i] = MLX5_100_MBPS_UNIT;
- } else {
+ } else if (max_bw_value[i] <= upper_limit_gbps) {
max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
MLX5E_1GB);
max_bw_unit[i] = MLX5_GBPS_UNIT;
+ } else {
+ netdev_err(netdev,
+ "tc_%d maxrate %llu Kbps exceeds limit %llu\n",
+ i, maxrate->tc_maxrate[i],
+ upper_limit_gbps);
+ return -EINVAL;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 191/300] net_sched: limit try_bulk_dequeue_skb() batches
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 190/300] net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 192/300] hsr: Fix supervision frame sending on HSRv0 Greg Kroah-Hartman
` (114 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet,
Toke Høiland-Jørgensen, Jesper Dangaard Brouer,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 0345552a653ce5542affeb69ac5aa52177a5199b ]
After commit 100dfa74cad9 ("inet: dev_queue_xmit() llist adoption")
I started seeing many qdisc requeues on IDPF under high TX workload.
$ tc -s qd sh dev eth1 handle 1: ; sleep 1; tc -s qd sh dev eth1 handle 1:
qdisc mq 1: root
Sent 43534617319319 bytes 268186451819 pkt (dropped 0, overlimits 0 requeues 3532840114)
backlog 1056Kb 6675p requeues 3532840114
qdisc mq 1: root
Sent 43554665866695 bytes 268309964788 pkt (dropped 0, overlimits 0 requeues 3537737653)
backlog 781164b 4822p requeues 3537737653
This is caused by try_bulk_dequeue_skb() being only limited by BQL budget.
perf record -C120-239 -e qdisc:qdisc_dequeue sleep 1 ; perf script
...
netperf 75332 [146] 2711.138269: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1292 skbaddr=0xff378005a1e9f200
netperf 75332 [146] 2711.138953: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1213 skbaddr=0xff378004d607a500
netperf 75330 [144] 2711.139631: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1233 skbaddr=0xff3780046be20100
netperf 75333 [147] 2711.140356: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1093 skbaddr=0xff37800514845b00
netperf 75337 [151] 2711.141037: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1353 skbaddr=0xff37800460753300
netperf 75337 [151] 2711.141877: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1367 skbaddr=0xff378004e72c7b00
netperf 75330 [144] 2711.142643: qdisc:qdisc_dequeue: dequeue ifindex=5 qdisc handle=0x80150000 parent=0x10013 txq_state=0x0 packets=1202 skbaddr=0xff3780045bd60000
...
This is bad because :
1) Large batches hold one victim cpu for a very long time.
2) Driver often hit their own TX ring limit (all slots are used).
3) We call dev_requeue_skb()
4) Requeues are using a FIFO (q->gso_skb), breaking qdisc ability to
implement FQ or priority scheduling.
5) dequeue_skb() gets packets from q->gso_skb one skb at a time
with no xmit_more support. This is causing many spinlock games
between the qdisc and the device driver.
Requeues were supposed to be very rare, lets keep them this way.
Limit batch sizes to /proc/sys/net/core/dev_weight (default 64) as
__qdisc_run() was designed to use.
Fixes: 5772e9a3463b ("qdisc: bulk dequeue support for qdiscs with TCQ_F_ONETXQUEUE")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Jesper Dangaard Brouer <hawk@kernel.org>
Link: https://patch.msgid.link/20251109161215.2574081-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_generic.c | 17 ++++++++++-------
1 file changed, 10 insertions(+), 7 deletions(-)
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index ecdd9e83f2f49..243a1d6b349c7 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -172,9 +172,10 @@ static inline void dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
static void try_bulk_dequeue_skb(struct Qdisc *q,
struct sk_buff *skb,
const struct netdev_queue *txq,
- int *packets)
+ int *packets, int budget)
{
int bytelimit = qdisc_avail_bulklimit(txq) - skb->len;
+ int cnt = 0;
while (bytelimit > 0) {
struct sk_buff *nskb = q->dequeue(q);
@@ -185,8 +186,10 @@ static void try_bulk_dequeue_skb(struct Qdisc *q,
bytelimit -= nskb->len; /* covers GSO len */
skb->next = nskb;
skb = nskb;
- (*packets)++; /* GSO counts as one pkt */
+ if (++cnt >= budget)
+ break;
}
+ (*packets) += cnt;
skb_mark_not_on_list(skb);
}
@@ -220,7 +223,7 @@ static void try_bulk_dequeue_skb_slow(struct Qdisc *q,
* A requeued skb (via q->gso_skb) can also be a SKB list.
*/
static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
- int *packets)
+ int *packets, int budget)
{
const struct netdev_queue *txq = q->dev_queue;
struct sk_buff *skb = NULL;
@@ -287,7 +290,7 @@ static struct sk_buff *dequeue_skb(struct Qdisc *q, bool *validate,
if (skb) {
bulk:
if (qdisc_may_bulk(q))
- try_bulk_dequeue_skb(q, skb, txq, packets);
+ try_bulk_dequeue_skb(q, skb, txq, packets, budget);
else
try_bulk_dequeue_skb_slow(q, skb, packets);
}
@@ -379,7 +382,7 @@ bool sch_direct_xmit(struct sk_buff *skb, struct Qdisc *q,
* >0 - queue is not empty.
*
*/
-static inline bool qdisc_restart(struct Qdisc *q, int *packets)
+static inline bool qdisc_restart(struct Qdisc *q, int *packets, int budget)
{
spinlock_t *root_lock = NULL;
struct netdev_queue *txq;
@@ -388,7 +391,7 @@ static inline bool qdisc_restart(struct Qdisc *q, int *packets)
bool validate;
/* Dequeue packet */
- skb = dequeue_skb(q, &validate, packets);
+ skb = dequeue_skb(q, &validate, packets, budget);
if (unlikely(!skb))
return false;
@@ -406,7 +409,7 @@ void __qdisc_run(struct Qdisc *q)
int quota = READ_ONCE(dev_tx_weight);
int packets;
- while (qdisc_restart(q, &packets)) {
+ while (qdisc_restart(q, &packets, quota)) {
quota -= packets;
if (quota <= 0) {
__netif_schedule(q);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 192/300] hsr: Fix supervision frame sending on HSRv0
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 191/300] net_sched: limit try_bulk_dequeue_skb() batches Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 193/300] Bluetooth: L2CAP: export l2cap_chan_hold for modules Greg Kroah-Hartman
` (113 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Felix Maurer,
Sebastian Andrzej Siewior, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Maurer <fmaurer@redhat.com>
[ Upstream commit 96a3a03abf3d8cc38cd9cb0d280235fbcf7c3f7f ]
On HSRv0, no supervision frames were sent. The supervison frames were
generated successfully, but failed the check for a sufficiently long mac
header, i.e., at least sizeof(struct hsr_ethhdr), in hsr_fill_frame_info()
because the mac header only contained the ethernet header.
Fix this by including the HSR header in the mac header when generating HSR
supervision frames. Note that the mac header now also includes the TLV
fields. This matches how we set the headers on rx and also the size of
struct hsrv0_ethhdr_sp.
Reported-by: Hangbin Liu <liuhangbin@gmail.com>
Closes: https://lore.kernel.org/netdev/aMONxDXkzBZZRfE5@fedora/
Fixes: 9cfb5e7f0ded ("net: hsr: fix hsr_init_sk() vs network/transport headers.")
Signed-off-by: Felix Maurer <fmaurer@redhat.com>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Tested-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Link: https://patch.msgid.link/4354114fea9a642fe71f49aeeb6c6159d1d61840.1762876095.git.fmaurer@redhat.com
Tested-by: Hangbin Liu <liuhangbin@gmail.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/hsr/hsr_device.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 505eb58f7e081..5a54a18892080 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -296,6 +296,9 @@ static void send_hsr_supervision_frame(struct hsr_port *master,
}
hsr_stag = skb_put(skb, sizeof(struct hsr_sup_tag));
+ skb_set_network_header(skb, ETH_HLEN + HSR_HLEN);
+ skb_reset_mac_len(skb);
+
set_hsr_stag_path(hsr_stag, (hsr->prot_version ? 0x0 : 0xf));
set_hsr_stag_HSR_ver(hsr_stag, hsr->prot_version);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 193/300] Bluetooth: L2CAP: export l2cap_chan_hold for modules
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 192/300] hsr: Fix supervision frame sending on HSRv0 Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 194/300] acpi,srat: Fix incorrect device handle check for Generic Initiator Greg Kroah-Hartman
` (112 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pauli Virtanen, Paul Menzel,
Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pauli Virtanen <pav@iki.fi>
[ Upstream commit e060088db0bdf7932e0e3c2d24b7371c4c5b867c ]
l2cap_chan_put() is exported, so export also l2cap_chan_hold() for
modules.
l2cap_chan_hold() has use case in net/bluetooth/6lowpan.c
Signed-off-by: Pauli Virtanen <pav@iki.fi>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/l2cap_core.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b6345996fc022..166623372d0f5 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -518,6 +518,7 @@ void l2cap_chan_hold(struct l2cap_chan *c)
kref_get(&c->kref);
}
+EXPORT_SYMBOL_GPL(l2cap_chan_hold);
struct l2cap_chan *l2cap_chan_hold_unless_zero(struct l2cap_chan *c)
{
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 194/300] acpi,srat: Fix incorrect device handle check for Generic Initiator
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 193/300] Bluetooth: L2CAP: export l2cap_chan_hold for modules Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 195/300] regulator: fixed: use dev_err_probe for register Greg Kroah-Hartman
` (111 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wu Zongyong, Shuai Xue,
Jonathan Cameron, Dave Jiang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuai Xue <xueshuai@linux.alibaba.com>
[ Upstream commit 7c3643f204edf1c5edb12b36b34838683ee5f8dc ]
The Generic Initiator Affinity Structure in SRAT table uses device
handle type field to indicate the device type. According to ACPI
specification, the device handle type value of 1 represents PCI device,
not 0.
Fixes: 894c26a1c274 ("ACPI: Support Generic Initiator only domains")
Reported-by: Wu Zongyong <wuzongyong@linux.alibaba.com>
Signed-off-by: Shuai Xue <xueshuai@linux.alibaba.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Link: https://patch.msgid.link/20250913023224.39281-1-xueshuai@linux.alibaba.com
Signed-off-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/numa/srat.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/numa/srat.c b/drivers/acpi/numa/srat.c
index 6021a10134422..8749a00ad73de 100644
--- a/drivers/acpi/numa/srat.c
+++ b/drivers/acpi/numa/srat.c
@@ -140,7 +140,7 @@ acpi_table_print_srat_entry(struct acpi_subtable_header *header)
struct acpi_srat_generic_affinity *p =
(struct acpi_srat_generic_affinity *)header;
- if (p->device_handle_type == 0) {
+ if (p->device_handle_type == 1) {
/*
* For pci devices this may be the only place they
* are assigned a proximity domain
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 195/300] regulator: fixed: use dev_err_probe for register
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 194/300] acpi,srat: Fix incorrect device handle check for Generic Initiator Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 196/300] regulator: fixed: fix GPIO descriptor leak on register failure Greg Kroah-Hartman
` (110 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Morgan, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <macromorgan@hotmail.com>
[ Upstream commit d0f95e6496a974a890df5eda65ffaee66ab0dc73 ]
Instead of returning error directly, use dev_err_probe. This avoids
messages in the dmesg log for devices which will be probed again later.
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Link: https://lore.kernel.org/r/20210721165716.19915-1-macroalpha82@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Stable-dep-of: 636f4618b1cd ("regulator: fixed: fix GPIO descriptor leak on register failure")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/fixed.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index 4acfff1908072..49e162b3cf42d 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -238,8 +238,9 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
drvdata->dev = devm_regulator_register(&pdev->dev, &drvdata->desc,
&cfg);
if (IS_ERR(drvdata->dev)) {
- ret = PTR_ERR(drvdata->dev);
- dev_err(&pdev->dev, "Failed to register regulator: %d\n", ret);
+ ret = dev_err_probe(&pdev->dev, PTR_ERR(drvdata->dev),
+ "Failed to register regulator: %ld\n",
+ PTR_ERR(drvdata->dev));
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 196/300] regulator: fixed: fix GPIO descriptor leak on register failure
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 195/300] regulator: fixed: use dev_err_probe for register Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 197/300] ASoC: cs4271: Fix regulator leak on probe failure Greg Kroah-Hartman
` (109 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 636f4618b1cd96f6b5a2b8c7c4f665c8533ecf13 ]
In the commit referenced by the Fixes tag,
devm_gpiod_get_optional() was replaced by manual
GPIO management, relying on the regulator core to release the
GPIO descriptor. However, this approach does not account for the
error path: when regulator registration fails, the core never
takes over the GPIO, resulting in a resource leak.
Add gpiod_put() before returning on regulator registration failure.
Fixes: 5e6f3ae5c13b ("regulator: fixed: Let core handle GPIO descriptor")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Link: https://patch.msgid.link/20251028172828.625-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/fixed.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/regulator/fixed.c b/drivers/regulator/fixed.c
index 49e162b3cf42d..1503a5ea0cc89 100644
--- a/drivers/regulator/fixed.c
+++ b/drivers/regulator/fixed.c
@@ -241,6 +241,7 @@ static int reg_fixed_voltage_probe(struct platform_device *pdev)
ret = dev_err_probe(&pdev->dev, PTR_ERR(drvdata->dev),
"Failed to register regulator: %ld\n",
PTR_ERR(drvdata->dev));
+ gpiod_put(cfg.ena_gpiod);
return ret;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 197/300] ASoC: cs4271: Fix regulator leak on probe failure
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 196/300] regulator: fixed: fix GPIO descriptor leak on register failure Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 198/300] drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE Greg Kroah-Hartman
` (108 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Charles Keepax,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 6b6eddc63ce871897d3a5bc4f8f593e698aef104 ]
The probe function enables regulators at the beginning
but fails to disable them in its error handling path.
If any operation after enabling the regulators fails,
the probe will exit with an error, leaving the regulators
permanently enabled, which could lead to a resource leak.
Add a proper error handling path to call regulator_bulk_disable()
before returning an error.
Fixes: 9a397f473657 ("ASoC: cs4271: add regulator consumer support")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Reviewed-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://patch.msgid.link/20251105062246.1955-1-vulab@iscas.ac.cn
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs4271.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/cs4271.c b/sound/soc/codecs/cs4271.c
index d43762ae8f3da..6d997ea772ec0 100644
--- a/sound/soc/codecs/cs4271.c
+++ b/sound/soc/codecs/cs4271.c
@@ -594,17 +594,17 @@ static int cs4271_component_probe(struct snd_soc_component *component)
ret = regcache_sync(cs4271->regmap);
if (ret < 0)
- return ret;
+ goto err_disable_regulator;
ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2,
CS4271_MODE2_PDN | CS4271_MODE2_CPEN,
CS4271_MODE2_PDN | CS4271_MODE2_CPEN);
if (ret < 0)
- return ret;
+ goto err_disable_regulator;
ret = regmap_update_bits(cs4271->regmap, CS4271_MODE2,
CS4271_MODE2_PDN, 0);
if (ret < 0)
- return ret;
+ goto err_disable_regulator;
/* Power-up sequence requires 85 uS */
udelay(85);
@@ -614,6 +614,10 @@ static int cs4271_component_probe(struct snd_soc_component *component)
CS4271_MODE2_MUTECAEQUB);
return 0;
+
+err_disable_regulator:
+ regulator_bulk_disable(ARRAY_SIZE(cs4271->supplies), cs4271->supplies);
+ return ret;
}
static void cs4271_component_remove(struct snd_soc_component *component)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 198/300] drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 197/300] ASoC: cs4271: Fix regulator leak on probe failure Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 199/300] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd Greg Kroah-Hartman
` (107 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rohit Keshri, Ian Forbes,
Maaz Mombasawala, Zack Rusin, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Forbes <ian.forbes@broadcom.com>
[ Upstream commit 32b415a9dc2c212e809b7ebc2b14bc3fbda2b9af ]
This data originates from userspace and is used in buffer offset
calculations which could potentially overflow causing an out-of-bounds
access.
Fixes: 8ce75f8ab904 ("drm/vmwgfx: Update device includes for DX device functionality")
Reported-by: Rohit Keshri <rkeshri@redhat.com>
Signed-off-by: Ian Forbes <ian.forbes@broadcom.com>
Reviewed-by: Maaz Mombasawala <maaz.mombasawala@broadcom.com>
Signed-off-by: Zack Rusin <zack.rusin@broadcom.com>
Link: https://patch.msgid.link/20251021190128.13014-1-ian.forbes@broadcom.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 987633c6c49f4..17d7f172a9e0f 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -3622,6 +3622,11 @@ static int vmw_cmd_check(struct vmw_private *dev_priv,
cmd_id = header->id;
+ if (header->size > SVGA_CMD_MAX_DATASIZE) {
+ VMW_DEBUG_USER("SVGA3D command: %d is too big.\n",
+ cmd_id + SVGA_3D_CMD_BASE);
+ return -E2BIG;
+ }
*size = header->size + sizeof(SVGA3dCmdHeader);
cmd_id -= SVGA_3D_CMD_BASE;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 199/300] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 198/300] drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 200/300] fsdax: mark the iomap argument to dax_iomap_sector as const Greg Kroah-Hartman
` (106 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haein Lee, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haein Lee <lhi0729@kaist.ac.kr>
[ Upstream commit 632108ec072ad64c8c83db6e16a7efee29ebfb74 ]
In snd_usb_create_streams(), for UAC version 3 devices, the Interface
Association Descriptor (IAD) is retrieved via usb_ifnum_to_if(). If this
call fails, a fallback routine attempts to obtain the IAD from the next
interface and sets a BADD profile. However, snd_usb_mixer_controls_badd()
assumes that the IAD retrieved from usb_ifnum_to_if() is always valid,
without performing a NULL check. This can lead to a NULL pointer
dereference when usb_ifnum_to_if() fails to find the interface descriptor.
This patch adds a NULL pointer check after calling usb_ifnum_to_if() in
snd_usb_mixer_controls_badd() to prevent the dereference.
This issue was discovered by syzkaller, which triggered the bug by sending
a crafted USB device descriptor.
Fixes: 17156f23e93c ("ALSA: usb: add UAC3 BADD profiles support")
Signed-off-by: Haein Lee <lhi0729@kaist.ac.kr>
Link: https://patch.msgid.link/vwhzmoba9j2f.vwhzmob9u9e2.g6@dooray.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index c84e25b2b1fb9..6b9a472ea43cb 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2999,6 +2999,8 @@ static int snd_usb_mixer_controls_badd(struct usb_mixer_interface *mixer,
int i;
assoc = usb_ifnum_to_if(dev, ctrlif)->intf_assoc;
+ if (!assoc)
+ return -EINVAL;
/* Detect BADD capture/playback channels from AS EP descriptors */
for (i = 0; i < assoc->bInterfaceCount; i++) {
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 200/300] fsdax: mark the iomap argument to dax_iomap_sector as const
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 199/300] ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 201/300] mm/ksm: fix flag-dropping behavior in ksm_madvise Greg Kroah-Hartman
` (105 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Darrick J. Wong,
Eliav Farber, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 7e4f4b2d689d959b03cb07dfbdb97b9696cb1076 ]
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Signed-off-by: Eliav Farber <farbere@amazon.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/dax.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/dax.c b/fs/dax.c
index 91820b9b50b73..2ca33ef5d519d 100644
--- a/fs/dax.c
+++ b/fs/dax.c
@@ -1006,7 +1006,7 @@ int dax_writeback_mapping_range(struct address_space *mapping,
}
EXPORT_SYMBOL_GPL(dax_writeback_mapping_range);
-static sector_t dax_iomap_sector(struct iomap *iomap, loff_t pos)
+static sector_t dax_iomap_sector(const struct iomap *iomap, loff_t pos)
{
return (iomap->addr + (pos & PAGE_MASK) - iomap->offset) >> 9;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 201/300] mm/ksm: fix flag-dropping behavior in ksm_madvise
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 200/300] fsdax: mark the iomap argument to dax_iomap_sector as const Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 202/300] lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN Greg Kroah-Hartman
` (104 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Acs, Miguel Ojeda,
David Hildenbrand, SeongJae Park, Alice Ryhl, Xu Xin,
Chengming Zhou, Peter Xu, Axel Rasmussen, Andrew Morton,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Acs <acsjakub@amazon.de>
[ Upstream commit f04aad36a07cc17b7a5d5b9a2d386ce6fae63e93 ]
syzkaller discovered the following crash: (kernel BUG)
[ 44.607039] ------------[ cut here ]------------
[ 44.607422] kernel BUG at mm/userfaultfd.c:2067!
[ 44.608148] Oops: invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN NOPTI
[ 44.608814] CPU: 1 UID: 0 PID: 2475 Comm: reproducer Not tainted 6.16.0-rc6 #1 PREEMPT(none)
[ 44.609635] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 44.610695] RIP: 0010:userfaultfd_release_all+0x3a8/0x460
<snip other registers, drop unreliable trace>
[ 44.617726] Call Trace:
[ 44.617926] <TASK>
[ 44.619284] userfaultfd_release+0xef/0x1b0
[ 44.620976] __fput+0x3f9/0xb60
[ 44.621240] fput_close_sync+0x110/0x210
[ 44.622222] __x64_sys_close+0x8f/0x120
[ 44.622530] do_syscall_64+0x5b/0x2f0
[ 44.622840] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ 44.623244] RIP: 0033:0x7f365bb3f227
Kernel panics because it detects UFFD inconsistency during
userfaultfd_release_all(). Specifically, a VMA which has a valid pointer
to vma->vm_userfaultfd_ctx, but no UFFD flags in vma->vm_flags.
The inconsistency is caused in ksm_madvise(): when user calls madvise()
with MADV_UNMEARGEABLE on a VMA that is registered for UFFD in MINOR mode,
it accidentally clears all flags stored in the upper 32 bits of
vma->vm_flags.
Assuming x86_64 kernel build, unsigned long is 64-bit and unsigned int and
int are 32-bit wide. This setup causes the following mishap during the &=
~VM_MERGEABLE assignment.
VM_MERGEABLE is a 32-bit constant of type unsigned int, 0x8000'0000.
After ~ is applied, it becomes 0x7fff'ffff unsigned int, which is then
promoted to unsigned long before the & operation. This promotion fills
upper 32 bits with leading 0s, as we're doing unsigned conversion (and
even for a signed conversion, this wouldn't help as the leading bit is 0).
& operation thus ends up AND-ing vm_flags with 0x0000'0000'7fff'ffff
instead of intended 0xffff'ffff'7fff'ffff and hence accidentally clears
the upper 32-bits of its value.
Fix it by changing `VM_MERGEABLE` constant to unsigned long, using the
BIT() macro.
Note: other VM_* flags are not affected: This only happens to the
VM_MERGEABLE flag, as the other VM_* flags are all constants of type int
and after ~ operation, they end up with leading 1 and are thus converted
to unsigned long with leading 1s.
Note 2:
After commit 31defc3b01d9 ("userfaultfd: remove (VM_)BUG_ON()s"), this is
no longer a kernel BUG, but a WARNING at the same place:
[ 45.595973] WARNING: CPU: 1 PID: 2474 at mm/userfaultfd.c:2067
but the root-cause (flag-drop) remains the same.
[akpm@linux-foundation.org: rust bindgen wasn't able to handle BIT(), from Miguel]
Link: https://lore.kernel.org/oe-kbuild-all/202510030449.VfSaAjvd-lkp@intel.com/
Link: https://lkml.kernel.org/r/20251001090353.57523-2-acsjakub@amazon.de
Fixes: 7677f7fd8be7 ("userfaultfd: add minor fault registration mode")
Signed-off-by: Jakub Acs <acsjakub@amazon.de>
Signed-off-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: SeongJae Park <sj@kernel.org>
Tested-by: Alice Ryhl <aliceryhl@google.com>
Tested-by: Miguel Ojeda <miguel.ojeda.sandonis@gmail.com>
Cc: Xu Xin <xu.xin16@zte.com.cn>
Cc: Chengming Zhou <chengming.zhou@linux.dev>
Cc: Peter Xu <peterx@redhat.com>
Cc: Axel Rasmussen <axelrasmussen@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
[ acsjakub: drop rust-compatibility change (no rust in 5.10) ]
Signed-off-by: Jakub Acs <acsjakub@amazon.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/mm.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e168d87d6f2ee..4787d39bbad4a 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -296,7 +296,7 @@ extern unsigned int kobjsize(const void *objp);
#define VM_MIXEDMAP 0x10000000 /* Can contain "struct page" and pure PFN pages */
#define VM_HUGEPAGE 0x20000000 /* MADV_HUGEPAGE marked this vma */
#define VM_NOHUGEPAGE 0x40000000 /* MADV_NOHUGEPAGE marked this vma */
-#define VM_MERGEABLE 0x80000000 /* KSM may merge identical pages */
+#define VM_MERGEABLE BIT(31) /* KSM may merge identical pages */
#ifdef CONFIG_ARCH_USES_HIGH_VMA_FLAGS
#define VM_HIGH_ARCH_BIT_0 32 /* bit only usable on 64-bit architectures */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 202/300] lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 201/300] mm/ksm: fix flag-dropping behavior in ksm_madvise Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 203/300] mtd: onenand: Pass correct pointer to IRQ handler Greg Kroah-Hartman
` (103 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel, Eric Biggers,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@kernel.org>
commit 44e8241c51f762aafa50ed116da68fd6ecdcc954 upstream.
On big endian arm kernels, the arm optimized Curve25519 code produces
incorrect outputs and fails the Curve25519 test. This has been true
ever since this code was added.
It seems that hardly anyone (or even no one?) actually uses big endian
arm kernels. But as long as they're ostensibly supported, we should
disable this code on them so that it's not accidentally used.
Note: for future-proofing, use !CPU_BIG_ENDIAN instead of
CPU_LITTLE_ENDIAN. Both of these are arch-specific options that could
get removed in the future if big endian support gets dropped.
Fixes: d8f1308a025f ("crypto: arm/curve25519 - wire up NEON implementation")
Cc: stable@vger.kernel.org
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Link: https://lore.kernel.org/r/20251104054906.716914-1-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/crypto/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/crypto/Kconfig b/arch/arm/crypto/Kconfig
index c46c05548080a..c5d676e7f16be 100644
--- a/arch/arm/crypto/Kconfig
+++ b/arch/arm/crypto/Kconfig
@@ -147,7 +147,7 @@ config CRYPTO_NHPOLY1305_NEON
config CRYPTO_CURVE25519_NEON
tristate "NEON accelerated Curve25519 scalar multiplication library"
- depends on KERNEL_MODE_NEON
+ depends on KERNEL_MODE_NEON && !CPU_BIG_ENDIAN
select CRYPTO_LIB_CURVE25519_GENERIC
select CRYPTO_ARCH_HAVE_LIB_CURVE25519
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 203/300] mtd: onenand: Pass correct pointer to IRQ handler
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 202/300] lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 204/300] netfilter: nf_tables: reject duplicate device on updates Greg Kroah-Hartman
` (102 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Miquel Raynal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 97315e7c901a1de60e8ca9b11e0e96d0f9253e18 ]
This was supposed to pass "onenand" instead of "&onenand" with the
ampersand. Passing a random stack address which will be gone when the
function ends makes no sense. However the good thing is that the pointer
is never used, so this doesn't cause a problem at run time.
Fixes: e23abf4b7743 ("mtd: OneNAND: S5PC110: Implement DMA interrupt method")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/onenand/onenand_samsung.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/onenand/onenand_samsung.c b/drivers/mtd/nand/onenand/onenand_samsung.c
index 87b28e397d671..d51d3ff6f0a3c 100644
--- a/drivers/mtd/nand/onenand/onenand_samsung.c
+++ b/drivers/mtd/nand/onenand/onenand_samsung.c
@@ -908,7 +908,7 @@ static int s3c_onenand_probe(struct platform_device *pdev)
err = devm_request_irq(&pdev->dev, r->start,
s5pc110_onenand_irq,
IRQF_SHARED, "onenand",
- &onenand);
+ onenand);
if (err) {
dev_err(&pdev->dev, "failed to get irq\n");
return err;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 204/300] netfilter: nf_tables: reject duplicate device on updates
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 203/300] mtd: onenand: Pass correct pointer to IRQ handler Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 205/300] HID: hid-ntrig: Prevent memory leak in ntrig_report_version() Greg Kroah-Hartman
` (101 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Florian Westphal,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit cf5fb87fcdaaaafec55dcc0dc5a9e15ead343973 upstream.
A chain/flowtable update with duplicated devices in the same batch is
possible. Unfortunately, netdev event path only removes the first
device that is found, leaving unregistered the hook of the duplicated
device.
Check if a duplicated device exists in the transaction batch, bail out
with EEXIST in such case.
WARNING is hit when unregistering the hook:
[49042.221275] WARNING: CPU: 4 PID: 8425 at net/netfilter/core.c:340 nf_hook_entry_head+0xaa/0x150
[49042.221375] CPU: 4 UID: 0 PID: 8425 Comm: nft Tainted: G S 6.16.0+ #170 PREEMPT(full)
[...]
[49042.221382] RIP: 0010:nf_hook_entry_head+0xaa/0x150
Fixes: 78d9f48f7f44 ("netfilter: nf_tables: add devices to existing flowtable")
Fixes: b9703ed44ffb ("netfilter: nf_tables: support for adding new devices to an existing netdev chain")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8e799848cbcc1..dcb35be8b2af2 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -7105,6 +7105,7 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
{
const struct nlattr * const *nla = ctx->nla;
struct nft_flowtable_hook flowtable_hook;
+ struct nftables_pernet *nft_net;
struct nft_hook *hook, *next;
struct nft_trans *trans;
bool unregister = false;
@@ -7120,6 +7121,20 @@ static int nft_flowtable_update(struct nft_ctx *ctx, const struct nlmsghdr *nlh,
if (nft_hook_list_find(&flowtable->hook_list, hook)) {
list_del(&hook->list);
kfree(hook);
+ continue;
+ }
+
+ nft_net = net_generic(ctx->net, nf_tables_net_id);
+ list_for_each_entry(trans, &nft_net->commit_list, list) {
+ if (trans->msg_type != NFT_MSG_NEWFLOWTABLE ||
+ trans->ctx.table != ctx->table ||
+ !nft_trans_flowtable_update(trans))
+ continue;
+
+ if (nft_hook_list_find(&nft_trans_flowtable_hooks(trans), hook)) {
+ err = -EEXIST;
+ goto err_flowtable_update_hook;
+ }
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 205/300] HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 204/300] netfilter: nf_tables: reject duplicate device on updates Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 206/300] NFSD: free copynotify stateid in nfs4_free_ol_stateid() Greg Kroah-Hartman
` (100 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Ichikawa, Jiri Kosina,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Ichikawa <masami256@gmail.com>
[ Upstream commit 53f731f5bba0cf03b751ccceb98b82fadc9ccd1e ]
Use a scope-based cleanup helper for the buffer allocated with kmalloc()
in ntrig_report_version() to simplify the cleanup logic and prevent
memory leaks (specifically the !hid_is_usb()-case one).
[jkosina@suse.com: elaborate on the actual existing leak]
Fixes: 185c926283da ("HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version()")
Signed-off-by: Masami Ichikawa <masami256@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-ntrig.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
index a1128c5315fff..3c41f6841f775 100644
--- a/drivers/hid/hid-ntrig.c
+++ b/drivers/hid/hid-ntrig.c
@@ -142,13 +142,13 @@ static void ntrig_report_version(struct hid_device *hdev)
int ret;
char buf[20];
struct usb_device *usb_dev = hid_to_usb_dev(hdev);
- unsigned char *data = kmalloc(8, GFP_KERNEL);
+ unsigned char *data __free(kfree) = kmalloc(8, GFP_KERNEL);
if (!hid_is_usb(hdev))
return;
if (!data)
- goto err_free;
+ return;
ret = usb_control_msg(usb_dev, usb_rcvctrlpipe(usb_dev, 0),
USB_REQ_CLEAR_FEATURE,
@@ -163,9 +163,6 @@ static void ntrig_report_version(struct hid_device *hdev)
hid_info(hdev, "Firmware version: %s (%02x%02x %02x%02x)\n",
buf, data[2], data[3], data[4], data[5]);
}
-
-err_free:
- kfree(data);
}
static ssize_t show_phys_width(struct device *dev,
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 206/300] NFSD: free copynotify stateid in nfs4_free_ol_stateid()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 205/300] HID: hid-ntrig: Prevent memory leak in ntrig_report_version() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 207/300] gcov: add support for GCC 15 Greg Kroah-Hartman
` (99 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, rtm, Olga Kornievskaia, Chuck Lever
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Olga Kornievskaia <okorniev@redhat.com>
commit 4aa17144d5abc3c756883e3a010246f0dba8b468 upstream.
Typically copynotify stateid is freed either when parent's stateid
is being close/freed or in nfsd4_laundromat if the stateid hasn't
been used in a lease period.
However, in case when the server got an OPEN (which created
a parent stateid), followed by a COPY_NOTIFY using that stateid,
followed by a client reboot. New client instance while doing
CREATE_SESSION would force expire previous state of this client.
It leads to the open state being freed thru release_openowner->
nfs4_free_ol_stateid() and it finds that it still has copynotify
stateid associated with it. We currently print a warning and is
triggerred
WARNING: CPU: 1 PID: 8858 at fs/nfsd/nfs4state.c:1550 nfs4_free_ol_stateid+0xb0/0x100 [nfsd]
This patch, instead, frees the associated copynotify stateid here.
If the parent stateid is freed (without freeing the copynotify
stateids associated with it), it leads to the list corruption
when laundromat ends up freeing the copynotify state later.
[ 1626.839430] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP
[ 1626.842828] Modules linked in: nfnetlink_queue nfnetlink_log bluetooth cfg80211 rpcrdma rdma_cm iw_cm ib_cm ib_core nfsd nfs_acl lockd grace nfs_localio ext4 crc16 mbcache jbd2 overlay uinput snd_seq_dummy snd_hrtimer qrtr rfkill vfat fat uvcvideo snd_hda_codec_generic videobuf2_vmalloc videobuf2_memops snd_hda_intel uvc snd_intel_dspcfg videobuf2_v4l2 videobuf2_common snd_hda_codec snd_hda_core videodev snd_hwdep snd_seq mc snd_seq_device snd_pcm snd_timer snd soundcore sg loop auth_rpcgss vsock_loopback vmw_vsock_virtio_transport_common vmw_vsock_vmci_transport vmw_vmci vsock xfs 8021q garp stp llc mrp nvme ghash_ce e1000e nvme_core sr_mod nvme_keyring nvme_auth cdrom vmwgfx drm_ttm_helper ttm sunrpc dm_mirror dm_region_hash dm_log iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi fuse dm_multipath dm_mod nfnetlink
[ 1626.855594] CPU: 2 UID: 0 PID: 199 Comm: kworker/u24:33 Kdump: loaded Tainted: G B W 6.17.0-rc7+ #22 PREEMPT(voluntary)
[ 1626.857075] Tainted: [B]=BAD_PAGE, [W]=WARN
[ 1626.857573] Hardware name: VMware, Inc. VMware20,1/VBSA, BIOS VMW201.00V.24006586.BA64.2406042154 06/04/2024
[ 1626.858724] Workqueue: nfsd4 laundromat_main [nfsd]
[ 1626.859304] pstate: 61400005 (nZCv daif +PAN -UAO -TCO +DIT -SSBS BTYPE=--)
[ 1626.860010] pc : __list_del_entry_valid_or_report+0x148/0x200
[ 1626.860601] lr : __list_del_entry_valid_or_report+0x148/0x200
[ 1626.861182] sp : ffff8000881d7a40
[ 1626.861521] x29: ffff8000881d7a40 x28: 0000000000000018 x27: ffff0000c2a98200
[ 1626.862260] x26: 0000000000000600 x25: 0000000000000000 x24: ffff8000881d7b20
[ 1626.862986] x23: ffff0000c2a981e8 x22: 1fffe00012410e7d x21: ffff0000920873e8
[ 1626.863701] x20: ffff0000920873e8 x19: ffff000086f22998 x18: 0000000000000000
[ 1626.864421] x17: 20747562202c3839 x16: 3932326636383030 x15: 3030666666662065
[ 1626.865092] x14: 6220646c756f6873 x13: 0000000000000001 x12: ffff60004fd9e4a3
[ 1626.865713] x11: 1fffe0004fd9e4a2 x10: ffff60004fd9e4a2 x9 : dfff800000000000
[ 1626.866320] x8 : 00009fffb0261b5e x7 : ffff00027ecf2513 x6 : 0000000000000001
[ 1626.866938] x5 : ffff00027ecf2510 x4 : ffff60004fd9e4a3 x3 : 0000000000000000
[ 1626.867553] x2 : 0000000000000000 x1 : ffff000096069640 x0 : 000000000000006d
[ 1626.868167] Call trace:
[ 1626.868382] __list_del_entry_valid_or_report+0x148/0x200 (P)
[ 1626.868876] _free_cpntf_state_locked+0xd0/0x268 [nfsd]
[ 1626.869368] nfs4_laundromat+0x6f8/0x1058 [nfsd]
[ 1626.869813] laundromat_main+0x24/0x60 [nfsd]
[ 1626.870231] process_one_work+0x584/0x1050
[ 1626.870595] worker_thread+0x4c4/0xc60
[ 1626.870893] kthread+0x2f8/0x398
[ 1626.871146] ret_from_fork+0x10/0x20
[ 1626.871422] Code: aa1303e1 aa1403e3 910e8000 97bc55d7 (d4210000)
[ 1626.871892] SMP: stopping secondary CPUs
Reported-by: rtm@csail.mit.edu
Closes: https://lore.kernel.org/linux-nfs/d8f064c1-a26f-4eed-b4f0-1f7f608f415f@oracle.com/T/#t
Fixes: 624322f1adc5 ("NFSD add COPY_NOTIFY operation")
Cc: stable@vger.kernel.org
Signed-off-by: Olga Kornievskaia <okorniev@redhat.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1499,7 +1499,8 @@ static void nfs4_free_ol_stateid(struct
release_all_access(stp);
if (stp->st_stateowner)
nfs4_put_stateowner(stp->st_stateowner);
- WARN_ON(!list_empty(&stid->sc_cp_list));
+ if (!list_empty(&stid->sc_cp_list))
+ nfs4_free_cpntf_statelist(stid->sc_client->net, stid);
kmem_cache_free(stateid_slab, stid);
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 207/300] gcov: add support for GCC 15
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 206/300] NFSD: free copynotify stateid in nfs4_free_ol_stateid() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 208/300] strparser: Fix signed/unsigned mismatch bug Greg Kroah-Hartman
` (98 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Oberparleiter, Matthieu Baerts,
Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Oberparleiter <oberpar@linux.ibm.com>
commit ec4d11fc4b2dd4a2fa8c9d801ee9753b74623554 upstream.
Using gcov on kernels compiled with GCC 15 results in truncated 16-byte
long .gcda files with no usable data. To fix this, update GCOV_COUNTERS
to match the value defined by GCC 15.
Tested with GCC 14.3.0 and GCC 15.2.0.
Link: https://lkml.kernel.org/r/20251028115125.1319410-1-oberpar@linux.ibm.com
Signed-off-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Reported-by: Matthieu Baerts <matttbe@kernel.org>
Closes: https://github.com/linux-test-project/lcov/issues/445
Tested-by: Matthieu Baerts <matttbe@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/gcov/gcc_4_7.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/kernel/gcov/gcc_4_7.c
+++ b/kernel/gcov/gcc_4_7.c
@@ -19,7 +19,9 @@
#include <linux/vmalloc.h>
#include "gcov.h"
-#if (__GNUC__ >= 14)
+#if (__GNUC__ >= 15)
+#define GCOV_COUNTERS 10
+#elif (__GNUC__ >= 14)
#define GCOV_COUNTERS 9
#elif (__GNUC__ >= 10)
#define GCOV_COUNTERS 8
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 208/300] strparser: Fix signed/unsigned mismatch bug
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 207/300] gcov: add support for GCC 15 Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 209/300] ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe Greg Kroah-Hartman
` (97 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nate Karstens, Jacob Keller,
Sabrina Dubroca, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nate Karstens <nate.karstens@garmin.com>
commit 4da4e4bde1c453ac5cc2dce5def81d504ae257ee upstream.
The `len` member of the sk_buff is an unsigned int. This is cast to
`ssize_t` (a signed type) for the first sk_buff in the comparison,
but not the second sk_buff. On 32-bit systems, this can result in
an integer underflow for certain values because unsigned arithmetic
is being used.
This appears to be an oversight: if the intention was to use unsigned
arithmetic, then the first cast would have been omitted. The change
ensures both len values are cast to `ssize_t`.
The underflow causes an issue with ktls when multiple TLS PDUs are
included in a single TCP segment. The mainline kernel does not use
strparser for ktls anymore, but this is still useful for other
features that still use strparser, and for backporting.
Signed-off-by: Nate Karstens <nate.karstens@garmin.com>
Cc: stable@vger.kernel.org
Fixes: 43a0c6751a32 ("strparser: Stream parser for messages")
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Link: https://patch.msgid.link/20251106222835.1871628-1-nate.karstens@garmin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/strparser/strparser.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/strparser/strparser.c
+++ b/net/strparser/strparser.c
@@ -238,7 +238,7 @@ static int __strp_recv(read_descriptor_t
strp_parser_err(strp, -EMSGSIZE, desc);
break;
} else if (len <= (ssize_t)head->len -
- skb->len - stm->strp.offset) {
+ (ssize_t)skb->len - stm->strp.offset) {
/* Length must be into new skb (and also
* greater than zero)
*/
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 209/300] ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 208/300] strparser: Fix signed/unsigned mismatch bug Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 210/300] fs/proc: fix uaf in proc_readdir_de() Greg Kroah-Hartman
` (96 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chuang Wang, Ido Schimmel,
Eric Dumazet, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuang Wang <nashuiliang@gmail.com>
commit ac1499fcd40fe06479e9b933347b837ccabc2a40 upstream.
The sit driver's packet transmission path calls: sit_tunnel_xmit() ->
update_or_create_fnhe(), which lead to fnhe_remove_oldest() being called
to delete entries exceeding FNHE_RECLAIM_DEPTH+random.
The race window is between fnhe_remove_oldest() selecting fnheX for
deletion and the subsequent kfree_rcu(). During this time, the
concurrent path's __mkroute_output() -> find_exception() can fetch the
soon-to-be-deleted fnheX, and rt_bind_exception() then binds it with a
new dst using a dst_hold(). When the original fnheX is freed via RCU,
the dst reference remains permanently leaked.
CPU 0 CPU 1
__mkroute_output()
find_exception() [fnheX]
update_or_create_fnhe()
fnhe_remove_oldest() [fnheX]
rt_bind_exception() [bind dst]
RCU callback [fnheX freed, dst leak]
This issue manifests as a device reference count leak and a warning in
dmesg when unregistering the net device:
unregister_netdevice: waiting for sitX to become free. Usage count = N
Ido Schimmel provided the simple test validation method [1].
The fix clears 'oldest->fnhe_daddr' before calling fnhe_flush_routes().
Since rt_bind_exception() checks this field, setting it to zero prevents
the stale fnhe from being reused and bound to a new dst just before it
is freed.
[1]
ip netns add ns1
ip -n ns1 link set dev lo up
ip -n ns1 address add 192.0.2.1/32 dev lo
ip -n ns1 link add name dummy1 up type dummy
ip -n ns1 route add 192.0.2.2/32 dev dummy1
ip -n ns1 link add name gretap1 up arp off type gretap \
local 192.0.2.1 remote 192.0.2.2
ip -n ns1 route add 198.51.0.0/16 dev gretap1
taskset -c 0 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
taskset -c 2 ip netns exec ns1 mausezahn gretap1 \
-A 198.51.100.1 -B 198.51.0.0/16 -t udp -p 1000 -c 0 -q &
sleep 10
ip netns pids ns1 | xargs kill
ip netns del ns1
Cc: stable@vger.kernel.org
Fixes: 67d6d681e15b ("ipv4: make exception cache less predictible")
Signed-off-by: Chuang Wang <nashuiliang@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251111064328.24440-1-nashuiliang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/route.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -646,6 +646,11 @@ static void fnhe_remove_oldest(struct fn
oldest_p = fnhe_p;
}
}
+
+ /* Clear oldest->fnhe_daddr to prevent this fnhe from being
+ * rebound with new dsts in rt_bind_exception().
+ */
+ oldest->fnhe_daddr = 0;
fnhe_flush_routes(oldest);
*oldest_p = oldest->fnhe_next;
kfree_rcu(oldest, rcu);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 210/300] fs/proc: fix uaf in proc_readdir_de()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 209/300] ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 211/300] spi: Try to get ACPI GPIO IRQ earlier Greg Kroah-Hartman
` (95 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yang, Al Viro, Christian Brauner,
wangzijie, Alexey Dobriyan, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <albinwyang@tencent.com>
commit 895b4c0c79b092d732544011c3cecaf7322c36a1 upstream.
Pde is erased from subdir rbtree through rb_erase(), but not set the node
to EMPTY, which may result in uaf access. We should use RB_CLEAR_NODE()
set the erased node to EMPTY, then pde_subdir_next() will return NULL to
avoid uaf access.
We found an uaf issue while using stress-ng testing, need to run testcase
getdent and tun in the same time. The steps of the issue is as follows:
1) use getdent to traverse dir /proc/pid/net/dev_snmp6/, and current
pde is tun3;
2) in the [time windows] unregister netdevice tun3 and tun2, and erase
them from rbtree. erase tun3 first, and then erase tun2. the
pde(tun2) will be released to slab;
3) continue to getdent process, then pde_subdir_next() will return
pde(tun2) which is released, it will case uaf access.
CPU 0 | CPU 1
-------------------------------------------------------------------------
traverse dir /proc/pid/net/dev_snmp6/ | unregister_netdevice(tun->dev) //tun3 tun2
sys_getdents64() |
iterate_dir() |
proc_readdir() |
proc_readdir_de() | snmp6_unregister_dev()
pde_get(de); | proc_remove()
read_unlock(&proc_subdir_lock); | remove_proc_subtree()
| write_lock(&proc_subdir_lock);
[time window] | rb_erase(&root->subdir_node, &parent->subdir);
| write_unlock(&proc_subdir_lock);
read_lock(&proc_subdir_lock); |
next = pde_subdir_next(de); |
pde_put(de); |
de = next; //UAF |
rbtree of dev_snmp6
|
pde(tun3)
/ \
NULL pde(tun2)
Link: https://lkml.kernel.org/r/20251025024233.158363-1-albin_yang@163.com
Signed-off-by: Wei Yang <albinwyang@tencent.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christian Brauner <brauner@kernel.org>
Cc: wangzijie <wangzijie1@honor.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/generic.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -693,6 +693,12 @@ void pde_put(struct proc_dir_entry *pde)
}
}
+static void pde_erase(struct proc_dir_entry *pde, struct proc_dir_entry *parent)
+{
+ rb_erase(&pde->subdir_node, &parent->subdir);
+ RB_CLEAR_NODE(&pde->subdir_node);
+}
+
/*
* Remove a /proc entry and free it if it's not currently in use.
*/
@@ -715,7 +721,7 @@ void remove_proc_entry(const char *name,
WARN(1, "removing permanent /proc entry '%s'", de->name);
de = NULL;
} else {
- rb_erase(&de->subdir_node, &parent->subdir);
+ pde_erase(de, parent);
if (S_ISDIR(de->mode))
parent->nlink--;
}
@@ -759,7 +765,7 @@ int remove_proc_subtree(const char *name
root->parent->name, root->name);
return -EINVAL;
}
- rb_erase(&root->subdir_node, &parent->subdir);
+ pde_erase(root, parent);
de = root;
while (1) {
@@ -771,7 +777,7 @@ int remove_proc_subtree(const char *name
next->parent->name, next->name);
return -EINVAL;
}
- rb_erase(&next->subdir_node, &de->subdir);
+ pde_erase(next, de);
de = next;
continue;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 211/300] spi: Try to get ACPI GPIO IRQ earlier
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 210/300] fs/proc: fix uaf in proc_readdir_de() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 212/300] EDAC/altera: Handle OCRAM ECC enable after warm reset Greg Kroah-Hartman
` (94 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hansg@kernel.org>
commit 3cd2018e15b3d66d2187d92867e265f45ad79e6f upstream.
Since commit d24cfee7f63d ("spi: Fix acpi deferred irq probe"), the
acpi_dev_gpio_irq_get() call gets delayed till spi_probe() is called
on the SPI device.
If there is no driver for the SPI device then the move to spi_probe()
results in acpi_dev_gpio_irq_get() never getting called. This may
cause problems by leaving the GPIO pin floating because this call is
responsible for setting up the GPIO pin direction and/or bias according
to the values from the ACPI tables.
Re-add the removed acpi_dev_gpio_irq_get() in acpi_register_spi_device()
to ensure the GPIO pin is always correctly setup, while keeping the
acpi_dev_gpio_irq_get() call added to spi_probe() to deal with
-EPROBE_DEFER returns caused by the GPIO controller not having a driver
yet.
Link: https://bbs.archlinux.org/viewtopic.php?id=302348
Fixes: d24cfee7f63d ("spi: Fix acpi deferred irq probe")
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hansg@kernel.org>
Link: https://patch.msgid.link/20251102190921.30068-1-hansg@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c
@@ -2259,6 +2259,16 @@ static acpi_status acpi_register_spi_dev
acpi_set_modalias(adev, acpi_device_hid(adev), spi->modalias,
sizeof(spi->modalias));
+ /*
+ * This gets re-tried in spi_probe() for -EPROBE_DEFER handling in case
+ * the GPIO controller does not have a driver yet. This needs to be done
+ * here too, because this call sets the GPIO direction and/or bias.
+ * Setting these needs to be done even if there is no driver, in which
+ * case spi_probe() will never get called.
+ */
+ if (spi->irq < 0)
+ spi->irq = acpi_dev_gpio_irq_get(adev, 0);
+
acpi_device_set_enumerated(adev);
adev->power.flags.ignore_parent = true;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 212/300] EDAC/altera: Handle OCRAM ECC enable after warm reset
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 211/300] spi: Try to get ACPI GPIO IRQ earlier Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 213/300] EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection Greg Kroah-Hartman
` (93 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niravkumar L Rabara,
Borislav Petkov (AMD), Dinh Nguyen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
commit fd3ecda38fe0cb713d167b5477d25f6b350f0514 upstream.
The OCRAM ECC is always enabled either by the BootROM or by the Secure Device
Manager (SDM) during a power-on reset on SoCFPGA.
However, during a warm reset, the OCRAM content is retained to preserve data,
while the control and status registers are reset to their default values. As
a result, ECC must be explicitly re-enabled after a warm reset.
Fixes: 17e47dc6db4f ("EDAC/altera: Add Stratix10 OCRAM ECC support")
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251111080801.1279401-1-niravkumarlaxmidas.rabara@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/altera_edac.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1147,10 +1147,22 @@ altr_check_ocram_deps_init(struct altr_e
if (ret)
return ret;
- /* Verify OCRAM has been initialized */
+ /*
+ * Verify that OCRAM has been initialized.
+ * During a warm reset, OCRAM contents are retained, but the control
+ * and status registers are reset to their default values. Therefore,
+ * ECC must be explicitly re-enabled in the control register.
+ * Error condition: if INITCOMPLETEA is clear and ECC_EN is already set.
+ */
if (!ecc_test_bits(ALTR_A10_ECC_INITCOMPLETEA,
- (base + ALTR_A10_ECC_INITSTAT_OFST)))
- return -ENODEV;
+ (base + ALTR_A10_ECC_INITSTAT_OFST))) {
+ if (!ecc_test_bits(ALTR_A10_ECC_EN,
+ (base + ALTR_A10_ECC_CTRL_OFST)))
+ ecc_set_bits(ALTR_A10_ECC_EN,
+ (base + ALTR_A10_ECC_CTRL_OFST));
+ else
+ return -ENODEV;
+ }
/* Enable IRQ on Single Bit Error */
writel(ALTR_A10_ECC_SERRINTEN, (base + ALTR_A10_ECC_ERRINTENS_OFST));
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 213/300] EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 212/300] EDAC/altera: Handle OCRAM ECC enable after warm reset Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 214/300] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() Greg Kroah-Hartman
` (92 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niravkumar L Rabara,
Borislav Petkov (AMD), Dinh Nguyen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
commit 281326be67252ac5794d1383f67526606b1d6b13 upstream.
The current single-bit error injection mechanism flips bits directly in ECC RAM
by performing write and read operations. When the ECC RAM is actively used by
the Ethernet or USB controller, this approach sometimes trigger a false
double-bit error.
Switch both Ethernet and USB EDAC devices to use the INTTEST register
(altr_edac_a10_device_inject_fops) for single-bit error injection, similar to
the existing double-bit error injection method.
Fixes: 064acbd4f4ab ("EDAC, altera: Add Stratix10 peripheral support")
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Dinh Nguyen <dinguyen@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20251111081333.1279635-1-niravkumarlaxmidas.rabara@altera.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/edac/altera_edac.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/edac/altera_edac.c
+++ b/drivers/edac/altera_edac.c
@@ -1332,7 +1332,7 @@ static const struct edac_device_prv_data
.ue_set_mask = ALTR_A10_ECC_TDERRA,
.set_err_ofst = ALTR_A10_ECC_INTTEST_OFST,
.ecc_irq_handler = altr_edac_a10_ecc_irq,
- .inject_fops = &altr_edac_a10_device_inject2_fops,
+ .inject_fops = &altr_edac_a10_device_inject_fops,
};
#endif /* CONFIG_EDAC_ALTERA_ETHERNET */
@@ -1422,7 +1422,7 @@ static const struct edac_device_prv_data
.ue_set_mask = ALTR_A10_ECC_TDERRA,
.set_err_ofst = ALTR_A10_ECC_INTTEST_OFST,
.ecc_irq_handler = altr_edac_a10_ecc_irq,
- .inject_fops = &altr_edac_a10_device_inject2_fops,
+ .inject_fops = &altr_edac_a10_device_inject_fops,
};
#endif /* CONFIG_EDAC_ALTERA_USB */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 214/300] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 213/300] EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:26 ` [PATCH 5.10 215/300] HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 Greg Kroah-Hartman
` (91 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Abdun Nihaal, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abdun Nihaal <nihaal@cse.iitm.ac.in>
commit 3f978e3f1570155a1327ffa25f60968bc7b9398f upstream.
In hfcsusb_probe(), the memory allocated for ctrl_urb gets leaked when
setup_instance() fails with an error code. Fix that by freeing the urb
before freeing the hw structure. Also change the error paths to use the
goto ladder style.
Compile tested only. Issue found using a prototype static analysis tool.
Fixes: 69f52adb2d53 ("mISDN: Add HFC USB driver")
Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
Link: https://patch.msgid.link/20251030042524.194812-1-nihaal@cse.iitm.ac.in
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/isdn/hardware/mISDN/hfcsusb.c | 18 +++++++++++++-----
1 file changed, 13 insertions(+), 5 deletions(-)
--- a/drivers/isdn/hardware/mISDN/hfcsusb.c
+++ b/drivers/isdn/hardware/mISDN/hfcsusb.c
@@ -1903,13 +1903,13 @@ out:
mISDN_freebchannel(&hw->bch[1]);
mISDN_freebchannel(&hw->bch[0]);
mISDN_freedchannel(&hw->dch);
- kfree(hw);
return err;
}
static int
hfcsusb_probe(struct usb_interface *intf, const struct usb_device_id *id)
{
+ int err;
struct hfcsusb *hw;
struct usb_device *dev = interface_to_usbdev(intf);
struct usb_host_interface *iface = intf->cur_altsetting;
@@ -2100,20 +2100,28 @@ hfcsusb_probe(struct usb_interface *intf
if (!hw->ctrl_urb) {
pr_warn("%s: No memory for control urb\n",
driver_info->vend_name);
- kfree(hw);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto err_free_hw;
}
pr_info("%s: %s: detected \"%s\" (%s, if=%d alt=%d)\n",
hw->name, __func__, driver_info->vend_name,
conf_str[small_match], ifnum, alt_used);
- if (setup_instance(hw, dev->dev.parent))
- return -EIO;
+ if (setup_instance(hw, dev->dev.parent)) {
+ err = -EIO;
+ goto err_free_urb;
+ }
hw->intf = intf;
usb_set_intfdata(hw->intf, hw);
return 0;
+
+err_free_urb:
+ usb_free_urb(hw->ctrl_urb);
+err_free_hw:
+ kfree(hw);
+ return err;
}
/* function called when an active device is removed */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 215/300] HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 214/300] isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe() Greg Kroah-Hartman
@ 2025-12-03 15:26 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 216/300] mtd: rawnand: cadence: fix DMA device NULL pointer dereference Greg Kroah-Hartman
` (90 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:26 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, staffan.melin, Terry Junge,
Zhang Heng, Jiri Kosina
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Heng <zhangheng@kylinos.cn>
commit beab067dbcff642243291fd528355d64c41dc3b2 upstream.
Based on available evidence, the USB ID 4c4a:4155 used by multiple
devices has been attributed to Jieli. The commit 1a8953f4f774
("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY") affected touchscreen
functionality. Added checks for manufacturer and serial number to
maintain microphone compatibility, enabling both devices to function
properly.
[jkosina@suse.com: edit shortlog]
Fixes: 1a8953f4f774 ("HID: Add IGNORE quirk for SMARTLINKTECHNOLOGY")
Cc: stable@vger.kernel.org
Tested-by: staffan.melin@oscillator.se
Reviewed-by: Terry Junge <linuxhid@cosmicgizmosystems.com>
Signed-off-by: Zhang Heng <zhangheng@kylinos.cn>
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-ids.h | 4 ++--
drivers/hid/hid-quirks.c | 13 ++++++++++++-
2 files changed, 14 insertions(+), 3 deletions(-)
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -1365,7 +1365,7 @@
#define USB_VENDOR_ID_SIGNOTEC 0x2133
#define USB_DEVICE_ID_SIGNOTEC_VIEWSONIC_PD1011 0x0018
-#define USB_VENDOR_ID_SMARTLINKTECHNOLOGY 0x4c4a
-#define USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155 0x4155
+#define USB_VENDOR_ID_JIELI_SDK_DEFAULT 0x4c4a
+#define USB_DEVICE_ID_JIELI_SDK_4155 0x4155
#endif
--- a/drivers/hid/hid-quirks.c
+++ b/drivers/hid/hid-quirks.c
@@ -876,7 +876,6 @@ static const struct hid_device_id hid_ig
#endif
{ HID_USB_DEVICE(USB_VENDOR_ID_YEALINK, USB_DEVICE_ID_YEALINK_P1K_P4K_B2K) },
{ HID_USB_DEVICE(USB_VENDOR_ID_QUANTA, USB_DEVICE_ID_QUANTA_HP_5MP_CAMERA_5473) },
- { HID_USB_DEVICE(USB_VENDOR_ID_SMARTLINKTECHNOLOGY, USB_DEVICE_ID_SMARTLINKTECHNOLOGY_4155) },
{ }
};
@@ -1025,6 +1024,18 @@ bool hid_ignore(struct hid_device *hdev)
strlen(elan_acpi_id[i].id)))
return true;
break;
+ case USB_VENDOR_ID_JIELI_SDK_DEFAULT:
+ /*
+ * Multiple USB devices with identical IDs (mic & touchscreen).
+ * The touch screen requires hid core processing, but the
+ * microphone does not. They can be distinguished by manufacturer
+ * and serial number.
+ */
+ if (hdev->product == USB_DEVICE_ID_JIELI_SDK_4155 &&
+ strncmp(hdev->name, "SmartlinkTechnology", 19) == 0 &&
+ strncmp(hdev->uniq, "20201111000001", 14) == 0)
+ return true;
+ break;
}
if (hdev->type == HID_TYPE_USBMOUSE &&
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 216/300] mtd: rawnand: cadence: fix DMA device NULL pointer dereference
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2025-12-03 15:26 ` [PATCH 5.10 215/300] HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155 Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 217/300] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Greg Kroah-Hartman
` (89 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Niravkumar L Rabara, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
commit 5c56bf214af85ca042bf97f8584aab2151035840 upstream.
The DMA device pointer `dma_dev` was being dereferenced before ensuring
that `cdns_ctrl->dmac` is properly initialized.
Move the assignment of `dma_dev` after successfully acquiring the DMA
channel to ensure the pointer is valid before use.
Fixes: d76d22b5096c ("mtd: rawnand: cadence: use dma_map_resource for sdma address")
Cc: stable@vger.kernel.org
Signed-off-by: Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/cadence-nand-controller.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/cadence-nand-controller.c
+++ b/drivers/mtd/nand/raw/cadence-nand-controller.c
@@ -2833,7 +2833,7 @@ cadence_nand_irq_cleanup(int irqnum, str
static int cadence_nand_init(struct cdns_nand_ctrl *cdns_ctrl)
{
dma_cap_mask_t mask;
- struct dma_device *dma_dev = cdns_ctrl->dmac->device;
+ struct dma_device *dma_dev;
int ret;
cdns_ctrl->cdma_desc = dma_alloc_coherent(cdns_ctrl->dev,
@@ -2877,6 +2877,7 @@ static int cadence_nand_init(struct cdns
}
}
+ dma_dev = cdns_ctrl->dmac->device;
cdns_ctrl->io.iova_dma = dma_map_resource(dma_dev->dev, cdns_ctrl->io.dma,
cdns_ctrl->io.size,
DMA_BIDIRECTIONAL, 0);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 217/300] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 216/300] mtd: rawnand: cadence: fix DMA device NULL pointer dereference Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 218/300] be2net: pass wrb_params in case of OS2BMC Greg Kroah-Hartman
` (88 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Yongpeng Yang,
Christian Brauner
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongpeng Yang <yangyongpeng@xiaomi.com>
commit f2c1f631630e01821fe4c3fdf6077bc7a8284f82 upstream.
sb_min_blocksize() may return 0. Check its return value to avoid
accessing the filesystem super block when sb->s_blocksize is 0.
Cc: stable@vger.kernel.org # v6.15
Fixes: 719c1e1829166d ("exfat: add super block operations")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Yongpeng Yang <yangyongpeng@xiaomi.com>
Link: https://patch.msgid.link/20251104125009.2111925-3-yangyongpeng.storage@gmail.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/exfat/super.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/exfat/super.c
+++ b/fs/exfat/super.c
@@ -416,7 +416,10 @@ static int exfat_read_boot_sector(struct
struct exfat_sb_info *sbi = EXFAT_SB(sb);
/* set block size to read super block */
- sb_min_blocksize(sb, 512);
+ if (!sb_min_blocksize(sb, 512)) {
+ exfat_err(sb, "unable to set blocksize");
+ return -EINVAL;
+ }
/* read boot sector */
sbi->boot_bh = sb_bread(sb, 0);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 218/300] be2net: pass wrb_params in case of OS2BMC
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 217/300] exfat: check return value of sb_min_blocksize in exfat_read_boot_sector Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 219/300] Input: cros_ec_keyb - fix an invalid memory access Greg Kroah-Hartman
` (87 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andrey Vatoropin, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Vatoropin <a.vatoropin@crpt.ru>
commit 7d277a7a58578dd62fd546ddaef459ec24ccae36 upstream.
be_insert_vlan_in_pkt() is called with the wrb_params argument being NULL
at be_send_pkt_to_bmc() call site. This may lead to dereferencing a NULL
pointer when processing a workaround for specific packet, as commit
bc0c3405abbb ("be2net: fix a Tx stall bug caused by a specific ipv6
packet") states.
The correct way would be to pass the wrb_params from be_xmit().
Fixes: 760c295e0e8d ("be2net: Support for OS2BMC.")
Cc: stable@vger.kernel.org
Signed-off-by: Andrey Vatoropin <a.vatoropin@crpt.ru>
Link: https://patch.msgid.link/20251119105015.194501-1-a.vatoropin@crpt.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/emulex/benet/be_main.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -1297,7 +1297,8 @@ static void be_xmit_flush(struct be_adap
(adapter->bmc_filt_mask & BMC_FILT_MULTICAST)
static bool be_send_pkt_to_bmc(struct be_adapter *adapter,
- struct sk_buff **skb)
+ struct sk_buff **skb,
+ struct be_wrb_params *wrb_params)
{
struct ethhdr *eh = (struct ethhdr *)(*skb)->data;
bool os2bmc = false;
@@ -1361,7 +1362,7 @@ done:
* to BMC, asic expects the vlan to be inline in the packet.
*/
if (os2bmc)
- *skb = be_insert_vlan_in_pkt(adapter, *skb, NULL);
+ *skb = be_insert_vlan_in_pkt(adapter, *skb, wrb_params);
return os2bmc;
}
@@ -1388,7 +1389,7 @@ static netdev_tx_t be_xmit(struct sk_buf
/* if os2bmc is enabled and if the pkt is destined to bmc,
* enqueue the pkt a 2nd time with mgmt bit set.
*/
- if (be_send_pkt_to_bmc(adapter, &skb)) {
+ if (be_send_pkt_to_bmc(adapter, &skb, &wrb_params)) {
BE_WRB_F_SET(wrb_params.features, OS2BMC, 1);
wrb_cnt = be_xmit_enqueue(adapter, txo, skb, &wrb_params);
if (unlikely(!wrb_cnt))
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 219/300] Input: cros_ec_keyb - fix an invalid memory access
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 218/300] be2net: pass wrb_params in case of OS2BMC Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 220/300] Input: imx_sc_key - fix memory corruption on unload Greg Kroah-Hartman
` (86 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tzung-Bi Shih, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tzung-Bi Shih <tzungbi@kernel.org>
commit e08969c4d65ac31297fcb4d31d4808c789152f68 upstream.
If cros_ec_keyb_register_matrix() isn't called (due to
`buttons_switches_only`) in cros_ec_keyb_probe(), `ckdev->idev` remains
NULL. An invalid memory access is observed in cros_ec_keyb_process()
when receiving an EC_MKBP_EVENT_KEY_MATRIX event in cros_ec_keyb_work()
in such case.
Unable to handle kernel read from unreadable memory at virtual address 0000000000000028
...
x3 : 0000000000000000 x2 : 0000000000000000
x1 : 0000000000000000 x0 : 0000000000000000
Call trace:
input_event
cros_ec_keyb_work
blocking_notifier_call_chain
ec_irq_thread
It's still unknown about why the kernel receives such malformed event,
in any cases, the kernel shouldn't access `ckdev->idev` and friends if
the driver doesn't intend to initialize them.
Signed-off-by: Tzung-Bi Shih <tzungbi@kernel.org>
Link: https://patch.msgid.link/20251104070310.3212712-1-tzungbi@kernel.org
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/cros_ec_keyb.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/input/keyboard/cros_ec_keyb.c
+++ b/drivers/input/keyboard/cros_ec_keyb.c
@@ -242,6 +242,12 @@ static int cros_ec_keyb_work(struct noti
case EC_MKBP_EVENT_KEY_MATRIX:
pm_wakeup_event(ckdev->dev, 0);
+ if (!ckdev->idev) {
+ dev_warn_once(ckdev->dev,
+ "Unexpected key matrix event\n");
+ return NOTIFY_OK;
+ }
+
if (ckdev->ec->event_size != ckdev->cols) {
dev_err(ckdev->dev,
"Discarded incomplete key matrix event.\n");
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 220/300] Input: imx_sc_key - fix memory corruption on unload
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 219/300] Input: cros_ec_keyb - fix an invalid memory access Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 221/300] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
` (85 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Peng Fan, Frank Li,
Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit d83f1512758f4ef6fc5e83219fe7eeeb6b428ea4 upstream.
This is supposed to be "priv" but we accidentally pass "&priv" which is
an address in the stack and so it will lead to memory corruption when
the imx_sc_key_action() function is called. Remove the &.
Fixes: 768062fd1284 ("Input: imx_sc_key - use devm_add_action_or_reset() to handle all cleanups")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Link: https://patch.msgid.link/aQYKR75r2VMFJutT@stanley.mountain
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/imx_sc_key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/keyboard/imx_sc_key.c
+++ b/drivers/input/keyboard/imx_sc_key.c
@@ -158,7 +158,7 @@ static int imx_sc_key_probe(struct platf
return error;
}
- error = devm_add_action_or_reset(&pdev->dev, imx_sc_key_action, &priv);
+ error = devm_add_action_or_reset(&pdev->dev, imx_sc_key_action, priv);
if (error)
return error;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 221/300] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 220/300] Input: imx_sc_key - fix memory corruption on unload Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 222/300] scsi: sg: Do not sleep in atomic context Greg Kroah-Hartman
` (84 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marco Patalano, Justin Tee,
Ewan D. Milne, Keith Busch
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ewan D. Milne <emilne@redhat.com>
commit 0a2c5495b6d1ecb0fa18ef6631450f391a888256 upstream.
nvme_fc_delete_assocation() waits for pending I/O to complete before
returning, and an error can cause ->ioerr_work to be queued after
cancel_work_sync() had been called. Move the call to cancel_work_sync() to
be after nvme_fc_delete_association() to ensure ->ioerr_work is not running
when the nvme_fc_ctrl object is freed. Otherwise the following can occur:
[ 1135.911754] list_del corruption, ff2d24c8093f31f8->next is NULL
[ 1135.917705] ------------[ cut here ]------------
[ 1135.922336] kernel BUG at lib/list_debug.c:52!
[ 1135.926784] Oops: invalid opcode: 0000 [#1] SMP NOPTI
[ 1135.931851] CPU: 48 UID: 0 PID: 726 Comm: kworker/u449:23 Kdump: loaded Not tainted 6.12.0 #1 PREEMPT(voluntary)
[ 1135.943490] Hardware name: Dell Inc. PowerEdge R660/0HGTK9, BIOS 2.5.4 01/16/2025
[ 1135.950969] Workqueue: 0x0 (nvme-wq)
[ 1135.954673] RIP: 0010:__list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1135.961041] Code: c7 c7 98 68 72 94 e8 26 45 fe ff 0f 0b 48 c7 c7 70 68 72 94 e8 18 45 fe ff 0f 0b 48 89 fe 48 c7 c7 80 69 72 94 e8 07 45 fe ff <0f> 0b 48 89 d1 48 c7 c7 a0 6a 72 94 48 89 c2 e8 f3 44 fe ff 0f 0b
[ 1135.979788] RSP: 0018:ff579b19482d3e50 EFLAGS: 00010046
[ 1135.985015] RAX: 0000000000000033 RBX: ff2d24c8093f31f0 RCX: 0000000000000000
[ 1135.992148] RDX: 0000000000000000 RSI: ff2d24d6bfa1d0c0 RDI: ff2d24d6bfa1d0c0
[ 1135.999278] RBP: ff2d24c8093f31f8 R08: 0000000000000000 R09: ffffffff951e2b08
[ 1136.006413] R10: ffffffff95122ac8 R11: 0000000000000003 R12: ff2d24c78697c100
[ 1136.013546] R13: fffffffffffffff8 R14: 0000000000000000 R15: ff2d24c78697c0c0
[ 1136.020677] FS: 0000000000000000(0000) GS:ff2d24d6bfa00000(0000) knlGS:0000000000000000
[ 1136.028765] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1136.034510] CR2: 00007fd207f90b80 CR3: 000000163ea22003 CR4: 0000000000f73ef0
[ 1136.041641] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 1136.048776] DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
[ 1136.055910] PKRU: 55555554
[ 1136.058623] Call Trace:
[ 1136.061074] <TASK>
[ 1136.063179] ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.067540] ? show_trace_log_lvl+0x1b0/0x2f0
[ 1136.071898] ? move_linked_works+0x4a/0xa0
[ 1136.075998] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.081744] ? __die_body.cold+0x8/0x12
[ 1136.085584] ? die+0x2e/0x50
[ 1136.088469] ? do_trap+0xca/0x110
[ 1136.091789] ? do_error_trap+0x65/0x80
[ 1136.095543] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.101289] ? exc_invalid_op+0x50/0x70
[ 1136.105127] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.110874] ? asm_exc_invalid_op+0x1a/0x20
[ 1136.115059] ? __list_del_entry_valid_or_report.cold+0xf/0x6f
[ 1136.120806] move_linked_works+0x4a/0xa0
[ 1136.124733] worker_thread+0x216/0x3a0
[ 1136.128485] ? __pfx_worker_thread+0x10/0x10
[ 1136.132758] kthread+0xfa/0x240
[ 1136.135904] ? __pfx_kthread+0x10/0x10
[ 1136.139657] ret_from_fork+0x31/0x50
[ 1136.143236] ? __pfx_kthread+0x10/0x10
[ 1136.146988] ret_from_fork_asm+0x1a/0x30
[ 1136.150915] </TASK>
Fixes: 19fce0470f05 ("nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context")
Cc: stable@vger.kernel.org
Tested-by: Marco Patalano <mpatalan@redhat.com>
Reviewed-by: Justin Tee <justin.tee@broadcom.com>
Signed-off-by: Ewan D. Milne <emilne@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/fc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvme/host/fc.c
+++ b/drivers/nvme/host/fc.c
@@ -3257,7 +3257,6 @@ nvme_fc_delete_ctrl(struct nvme_ctrl *nc
{
struct nvme_fc_ctrl *ctrl = to_fc_ctrl(nctrl);
- cancel_work_sync(&ctrl->ioerr_work);
cancel_delayed_work_sync(&ctrl->connect_work);
/*
* kill the association on the link side. this will block
@@ -3321,6 +3320,7 @@ nvme_fc_reset_ctrl_work(struct work_stru
/* will block will waiting for io to terminate */
nvme_fc_delete_association(ctrl);
+ cancel_work_sync(&ctrl->ioerr_work);
if (!nvme_change_ctrl_state(&ctrl->ctrl, NVME_CTRL_CONNECTING))
dev_err(ctrl->ctrl.device,
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 222/300] scsi: sg: Do not sleep in atomic context
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 221/300] nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 223/300] scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() Greg Kroah-Hartman
` (83 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c01f8e6e73f20459912e,
Hannes Reinecke, Bart Van Assche, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit 90449f2d1e1f020835cba5417234636937dd657e upstream.
sg_finish_rem_req() calls blk_rq_unmap_user(). The latter function may
sleep. Hence, call sg_finish_rem_req() with interrupts enabled instead
of disabled.
Reported-by: syzbot+c01f8e6e73f20459912e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/linux-scsi/691560c4.a70a0220.3124cb.001a.GAE@google.com/
Cc: Hannes Reinecke <hare@suse.de>
Cc: stable@vger.kernel.org
Fixes: 97d27b0dd015 ("scsi: sg: close race condition in sg_remove_sfp_usercontext()")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://patch.msgid.link/20251113181643.1108973-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/sg.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/drivers/scsi/sg.c
+++ b/drivers/scsi/sg.c
@@ -2235,9 +2235,17 @@ sg_remove_sfp_usercontext(struct work_st
write_lock_irqsave(&sfp->rq_list_lock, iflags);
while (!list_empty(&sfp->rq_list)) {
srp = list_first_entry(&sfp->rq_list, Sg_request, entry);
- sg_finish_rem_req(srp);
list_del(&srp->entry);
+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
+
+ sg_finish_rem_req(srp);
+ /*
+ * sg_rq_end_io() uses srp->parentfp. Hence, only clear
+ * srp->parentfp after blk_mq_free_request() has been called.
+ */
srp->parentfp = NULL;
+
+ write_lock_irqsave(&sfp->rq_list_lock, iflags);
}
write_unlock_irqrestore(&sfp->rq_list_lock, iflags);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 223/300] scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 222/300] scsi: sg: Do not sleep in atomic context Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 224/300] MIPS: Malta: Fix !EVA SOC-it PCI MMIO Greg Kroah-Hartman
` (82 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hamza Mahfooz, Chaitanya Kulkarni,
Allen Pais, Martin K. Petersen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
commit e6965188f84a7883e6a0d3448e86b0cf29b24dfc upstream.
If the allocation of tl_hba->sh fails in tcm_loop_driver_probe() and we
attempt to dereference it in tcm_loop_tpg_address_show() we will get a
segfault, see below for an example. So, check tl_hba->sh before
dereferencing it.
Unable to allocate struct scsi_host
BUG: kernel NULL pointer dereference, address: 0000000000000194
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 1 PID: 8356 Comm: tokio-runtime-w Not tainted 6.6.104.2-4.azl3 #1
Hardware name: Microsoft Corporation Virtual Machine/Virtual Machine, BIOS Hyper-V UEFI Release v4.1 09/28/2024
RIP: 0010:tcm_loop_tpg_address_show+0x2e/0x50 [tcm_loop]
...
Call Trace:
<TASK>
configfs_read_iter+0x12d/0x1d0 [configfs]
vfs_read+0x1b5/0x300
ksys_read+0x6f/0xf0
...
Cc: stable@vger.kernel.org
Fixes: 2628b352c3d4 ("tcm_loop: Show address of tpg in configfs")
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Allen Pais <apais@linux.microsoft.com>
Link: https://patch.msgid.link/1762370746-6304-1-git-send-email-hamzamahfooz@linux.microsoft.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/target/loopback/tcm_loop.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -933,6 +933,9 @@ static ssize_t tcm_loop_tpg_address_show
struct tcm_loop_tpg, tl_se_tpg);
struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
+ if (!tl_hba->sh)
+ return -ENODEV;
+
return snprintf(page, PAGE_SIZE, "%d:0:%d\n",
tl_hba->sh->host_no, tl_tpg->tl_tpgt);
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 224/300] MIPS: Malta: Fix !EVA SOC-it PCI MMIO
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 223/300] scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 225/300] drm/tegra: dc: Fix reference leak in tegra_dc_couple() Greg Kroah-Hartman
` (81 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki,
Thomas Bogendoerfer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit ebd729fef31620e0bf74cbf8a4c7fda73a2a4e7e upstream.
Fix a regression that has caused accesses to the PCI MMIO window to
complete unclaimed in non-EVA configurations with the SOC-it family of
system controllers, preventing PCI devices from working that use MMIO.
In the non-EVA case PHYS_OFFSET is set to 0, meaning that PCI_BAR0 is
set with an empty mask (and PCI_HEAD4 matches addresses starting from 0
accordingly). Consequently all addresses are matched for incoming DMA
accesses from PCI. This seems to confuse the system controller's logic
and outgoing bus cycles targeting the PCI MMIO window seem not to make
it to the intended devices.
This happens as well when a wider mask is used with PCI_BAR0, such as
0x80000000 or 0xe0000000, that makes addresses match that overlap with
the PCI MMIO window, which starts at 0x10000000 in our configuration.
Set the mask in PCI_BAR0 to 0xf0000000 for non-EVA then, covering the
non-EVA maximum 256 MiB of RAM, which is what YAMON does and which used
to work correctly up to the offending commit. Set PCI_P2SCMSKL to match
PCI_BAR0 as required by the system controller's specification, and match
PCI_P2SCMAPL to PCI_HEAD4 for identity mapping.
Verified with:
Core board type/revision = 0x0d (Core74K) / 0x01
System controller/revision = MIPS SOC-it 101 OCP / 1.3 SDR-FW-4:1
Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x1c
Processor ID/revision = 0x97 (MIPS 74Kf) / 0x4c
for non-EVA and with:
Core board type/revision = 0x0c (CoreFPGA-5) / 0x00
System controller/revision = MIPS ROC-it2 / 0.0 FW-1:1 (CLK_unknown) GIC
Processor Company ID/options = 0x01 (MIPS Technologies, Inc.) / 0x00
Processor ID/revision = 0xa0 (MIPS interAptiv UP) / 0x20
for EVA/non-EVA, fixing:
defxx 0000:00:12.0: assign IRQ: got 10
defxx: v1.12 2021/03/10 Lawrence V. Stefani and others
0000:00:12.0: Could not read adapter factory MAC address!
vs:
defxx 0000:00:12.0: assign IRQ: got 10
defxx: v1.12 2021/03/10 Lawrence V. Stefani and others
0000:00:12.0: DEFPA at MMIO addr = 0x10142000, IRQ = 10, Hardware addr = 00-00-f8-xx-xx-xx
0000:00:12.0: registered as fddi0
for non-EVA and causing no change for EVA.
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 422dd256642b ("MIPS: Malta: Allow PCI devices DMA to lower 2GB physical")
Cc: stable@vger.kernel.org # v4.9+
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mti-malta/malta-init.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/arch/mips/mti-malta/malta-init.c
+++ b/arch/mips/mti-malta/malta-init.c
@@ -242,16 +242,22 @@ mips_pci_controller:
#endif
/*
- * Setup the Malta max (2GB) memory for PCI DMA in host bridge
- * in transparent addressing mode.
+ * Set up memory mapping in host bridge for PCI DMA masters,
+ * in transparent addressing mode. For EVA use the Malta
+ * maximum of 2 GiB memory in the alias space at 0x80000000
+ * as per PHYS_OFFSET. Otherwise use 256 MiB of memory in
+ * the regular space, avoiding mapping the PCI MMIO window
+ * for DMA as it seems to confuse the system controller's
+ * logic, causing PCI MMIO to stop working.
*/
- mask = PHYS_OFFSET | PCI_BASE_ADDRESS_MEM_PREFETCH;
- MSC_WRITE(MSC01_PCI_BAR0, mask);
- MSC_WRITE(MSC01_PCI_HEAD4, mask);
+ mask = PHYS_OFFSET ? PHYS_OFFSET : 0xf0000000;
+ MSC_WRITE(MSC01_PCI_BAR0,
+ mask | PCI_BASE_ADDRESS_MEM_PREFETCH);
+ MSC_WRITE(MSC01_PCI_HEAD4,
+ PHYS_OFFSET | PCI_BASE_ADDRESS_MEM_PREFETCH);
- mask &= MSC01_PCI_BAR0_SIZE_MSK;
MSC_WRITE(MSC01_PCI_P2SCMSKL, mask);
- MSC_WRITE(MSC01_PCI_P2SCMAPL, mask);
+ MSC_WRITE(MSC01_PCI_P2SCMAPL, PHYS_OFFSET);
/* Don't handle target retries indefinitely. */
if ((data & MSC01_PCI_CFG_MAXRTRY_MSK) ==
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 225/300] drm/tegra: dc: Fix reference leak in tegra_dc_couple()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 224/300] MIPS: Malta: Fix !EVA SOC-it PCI MMIO Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 226/300] mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() Greg Kroah-Hartman
` (80 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Mikko Perttunen,
Thierry Reding
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit 4c5376b4b143c4834ebd392aef2215847752b16a upstream.
driver_find_device() calls get_device() to increment the reference
count once a matching device is found, but there is no put_device() to
balance the reference count. To avoid reference count leakage, add
put_device() to decrease the reference count.
Found by code review.
Cc: stable@vger.kernel.org
Fixes: a31500fe7055 ("drm/tegra: dc: Restore coupling of display controllers")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Acked-by: Mikko Perttunen <mperttunen@nvidia.com>
Signed-off-by: Thierry Reding <treding@nvidia.com>
Link: https://patch.msgid.link/20251022114720.24937-1-make24@iscas.ac.cn
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/tegra/dc.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/tegra/dc.c
+++ b/drivers/gpu/drm/tegra/dc.c
@@ -2524,6 +2524,7 @@ static int tegra_dc_couple(struct tegra_
dc->client.parent = &parent->client;
dev_dbg(dc->dev, "coupled to %s\n", dev_name(companion));
+ put_device(companion);
}
return 0;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 226/300] mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 225/300] drm/tegra: dc: Fix reference leak in tegra_dc_couple() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 227/300] net: openvswitch: remove never-working support for setting nsh fields Greg Kroah-Hartman
` (79 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zilin Guan, Ido Schimmel,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zilin Guan <zilin@seu.edu.cn>
[ Upstream commit 407a06507c2358554958e8164dc97176feddcafc ]
The function mlxsw_sp_flower_stats() calls mlxsw_sp_acl_ruleset_get() to
obtain a ruleset reference. If the subsequent call to
mlxsw_sp_acl_rule_lookup() fails to find a rule, the function returns
an error without releasing the ruleset reference, causing a memory leak.
Fix this by using a goto to the existing error handling label, which
calls mlxsw_sp_acl_ruleset_put() to properly release the reference.
Fixes: 7c1b8eb175b69 ("mlxsw: spectrum: Add support for TC flower offload statistics")
Signed-off-by: Zilin Guan <zilin@seu.edu.cn>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20251112052114.1591695-1-zilin@seu.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
index 41855e58564b1..3d99b16ebd553 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_flower.c
@@ -650,8 +650,10 @@ int mlxsw_sp_flower_stats(struct mlxsw_sp *mlxsw_sp,
return -EINVAL;
rule = mlxsw_sp_acl_rule_lookup(mlxsw_sp, ruleset, f->cookie);
- if (!rule)
- return -EINVAL;
+ if (!rule) {
+ err = -EINVAL;
+ goto err_rule_get_stats;
+ }
err = mlxsw_sp_acl_rule_get_stats(mlxsw_sp, rule, &packets, &bytes,
&drops, &lastuse, &used_hw_stats);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 227/300] net: openvswitch: remove never-working support for setting nsh fields
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 226/300] mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 228/300] s390/ctcm: Fix double-kfree Greg Kroah-Hartman
` (78 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junvy Yang, Ilya Maximets,
Eelco Chaudron, Aaron Conole, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Maximets <i.maximets@ovn.org>
[ Upstream commit dfe28c4167a9259fc0c372d9f9473e1ac95cff67 ]
The validation of the set(nsh(...)) action is completely wrong.
It runs through the nsh_key_put_from_nlattr() function that is the
same function that validates NSH keys for the flow match and the
push_nsh() action. However, the set(nsh(...)) has a very different
memory layout. Nested attributes in there are doubled in size in
case of the masked set(). That makes proper validation impossible.
There is also confusion in the code between the 'masked' flag, that
says that the nested attributes are doubled in size containing both
the value and the mask, and the 'is_mask' that says that the value
we're parsing is the mask. This is causing kernel crash on trying to
write into mask part of the match with SW_FLOW_KEY_PUT() during
validation, while validate_nsh() doesn't allocate any memory for it:
BUG: kernel NULL pointer dereference, address: 0000000000000018
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 1c2383067 P4D 1c2383067 PUD 20b703067 PMD 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 8 UID: 0 Kdump: loaded Not tainted 6.17.0-rc4+ #107 PREEMPT(voluntary)
RIP: 0010:nsh_key_put_from_nlattr+0x19d/0x610 [openvswitch]
Call Trace:
<TASK>
validate_nsh+0x60/0x90 [openvswitch]
validate_set.constprop.0+0x270/0x3c0 [openvswitch]
__ovs_nla_copy_actions+0x477/0x860 [openvswitch]
ovs_nla_copy_actions+0x8d/0x100 [openvswitch]
ovs_packet_cmd_execute+0x1cc/0x310 [openvswitch]
genl_family_rcv_msg_doit+0xdb/0x130
genl_family_rcv_msg+0x14b/0x220
genl_rcv_msg+0x47/0xa0
netlink_rcv_skb+0x53/0x100
genl_rcv+0x24/0x40
netlink_unicast+0x280/0x3b0
netlink_sendmsg+0x1f7/0x430
____sys_sendmsg+0x36b/0x3a0
___sys_sendmsg+0x87/0xd0
__sys_sendmsg+0x6d/0xd0
do_syscall_64+0x7b/0x2c0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The third issue with this process is that while trying to convert
the non-masked set into masked one, validate_set() copies and doubles
the size of the OVS_KEY_ATTR_NSH as if it didn't have any nested
attributes. It should be copying each nested attribute and doubling
them in size independently. And the process must be properly reversed
during the conversion back from masked to a non-masked variant during
the flow dump.
In the end, the only two outcomes of trying to use this action are
either validation failure or a kernel crash. And if somehow someone
manages to install a flow with such an action, it will most definitely
not do what it is supposed to, since all the keys and the masks are
mixed up.
Fixing all the issues is a complex task as it requires re-writing
most of the validation code.
Given that and the fact that this functionality never worked since
introduction, let's just remove it altogether. It's better to
re-introduce it later with a proper implementation instead of trying
to fix it in stable releases.
Fixes: b2d0f5d5dc53 ("openvswitch: enable NSH support")
Reported-by: Junvy Yang <zhuque@tencent.com>
Signed-off-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Eelco Chaudron <echaudro@redhat.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
Link: https://patch.msgid.link/20251112112246.95064-1-i.maximets@ovn.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/openvswitch/actions.c | 68 +---------------------------------
net/openvswitch/flow_netlink.c | 64 ++++----------------------------
net/openvswitch/flow_netlink.h | 2 -
3 files changed, 9 insertions(+), 125 deletions(-)
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index c3ca4ae11c09f..3b3cc6ea274f8 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -594,69 +594,6 @@ static int set_ipv6(struct sk_buff *skb, struct sw_flow_key *flow_key,
return 0;
}
-static int set_nsh(struct sk_buff *skb, struct sw_flow_key *flow_key,
- const struct nlattr *a)
-{
- struct nshhdr *nh;
- size_t length;
- int err;
- u8 flags;
- u8 ttl;
- int i;
-
- struct ovs_key_nsh key;
- struct ovs_key_nsh mask;
-
- err = nsh_key_from_nlattr(a, &key, &mask);
- if (err)
- return err;
-
- /* Make sure the NSH base header is there */
- if (!pskb_may_pull(skb, skb_network_offset(skb) + NSH_BASE_HDR_LEN))
- return -ENOMEM;
-
- nh = nsh_hdr(skb);
- length = nsh_hdr_len(nh);
-
- /* Make sure the whole NSH header is there */
- err = skb_ensure_writable(skb, skb_network_offset(skb) +
- length);
- if (unlikely(err))
- return err;
-
- nh = nsh_hdr(skb);
- skb_postpull_rcsum(skb, nh, length);
- flags = nsh_get_flags(nh);
- flags = OVS_MASKED(flags, key.base.flags, mask.base.flags);
- flow_key->nsh.base.flags = flags;
- ttl = nsh_get_ttl(nh);
- ttl = OVS_MASKED(ttl, key.base.ttl, mask.base.ttl);
- flow_key->nsh.base.ttl = ttl;
- nsh_set_flags_and_ttl(nh, flags, ttl);
- nh->path_hdr = OVS_MASKED(nh->path_hdr, key.base.path_hdr,
- mask.base.path_hdr);
- flow_key->nsh.base.path_hdr = nh->path_hdr;
- switch (nh->mdtype) {
- case NSH_M_TYPE1:
- for (i = 0; i < NSH_MD1_CONTEXT_SIZE; i++) {
- nh->md1.context[i] =
- OVS_MASKED(nh->md1.context[i], key.context[i],
- mask.context[i]);
- }
- memcpy(flow_key->nsh.context, nh->md1.context,
- sizeof(nh->md1.context));
- break;
- case NSH_M_TYPE2:
- memset(flow_key->nsh.context, 0,
- sizeof(flow_key->nsh.context));
- break;
- default:
- return -EINVAL;
- }
- skb_postpush_rcsum(skb, nh, length);
- return 0;
-}
-
/* Must follow skb_ensure_writable() since that can move the skb data. */
static void set_tp_port(struct sk_buff *skb, __be16 *port,
__be16 new_port, __sum16 *check)
@@ -1123,10 +1060,6 @@ static int execute_masked_set_action(struct sk_buff *skb,
get_mask(a, struct ovs_key_ethernet *));
break;
- case OVS_KEY_ATTR_NSH:
- err = set_nsh(skb, flow_key, a);
- break;
-
case OVS_KEY_ATTR_IPV4:
err = set_ipv4(skb, flow_key, nla_data(a),
get_mask(a, struct ovs_key_ipv4 *));
@@ -1163,6 +1096,7 @@ static int execute_masked_set_action(struct sk_buff *skb,
case OVS_KEY_ATTR_CT_LABELS:
case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4:
case OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6:
+ case OVS_KEY_ATTR_NSH:
err = -EINVAL;
break;
}
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 3f8f43dbf44fc..a70a87a4392ab 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -1280,6 +1280,11 @@ static int metadata_from_nlattrs(struct net *net, struct sw_flow_match *match,
return 0;
}
+/*
+ * Constructs NSH header 'nh' from attributes of OVS_ACTION_ATTR_PUSH_NSH,
+ * where 'nh' points to a memory block of 'size' bytes. It's assumed that
+ * attributes were previously validated with validate_push_nsh().
+ */
int nsh_hdr_from_nlattr(const struct nlattr *attr,
struct nshhdr *nh, size_t size)
{
@@ -1289,8 +1294,6 @@ int nsh_hdr_from_nlattr(const struct nlattr *attr,
u8 ttl = 0;
int mdlen = 0;
- /* validate_nsh has check this, so we needn't do duplicate check here
- */
if (size < NSH_BASE_HDR_LEN)
return -ENOBUFS;
@@ -1334,46 +1337,6 @@ int nsh_hdr_from_nlattr(const struct nlattr *attr,
return 0;
}
-int nsh_key_from_nlattr(const struct nlattr *attr,
- struct ovs_key_nsh *nsh, struct ovs_key_nsh *nsh_mask)
-{
- struct nlattr *a;
- int rem;
-
- /* validate_nsh has check this, so we needn't do duplicate check here
- */
- nla_for_each_nested(a, attr, rem) {
- int type = nla_type(a);
-
- switch (type) {
- case OVS_NSH_KEY_ATTR_BASE: {
- const struct ovs_nsh_key_base *base = nla_data(a);
- const struct ovs_nsh_key_base *base_mask = base + 1;
-
- nsh->base = *base;
- nsh_mask->base = *base_mask;
- break;
- }
- case OVS_NSH_KEY_ATTR_MD1: {
- const struct ovs_nsh_key_md1 *md1 = nla_data(a);
- const struct ovs_nsh_key_md1 *md1_mask = md1 + 1;
-
- memcpy(nsh->context, md1->context, sizeof(*md1));
- memcpy(nsh_mask->context, md1_mask->context,
- sizeof(*md1_mask));
- break;
- }
- case OVS_NSH_KEY_ATTR_MD2:
- /* Not supported yet */
- return -ENOTSUPP;
- default:
- return -EINVAL;
- }
- }
-
- return 0;
-}
-
static int nsh_key_put_from_nlattr(const struct nlattr *attr,
struct sw_flow_match *match, bool is_mask,
bool is_push_nsh, bool log)
@@ -2797,17 +2760,13 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
return err;
}
-static bool validate_nsh(const struct nlattr *attr, bool is_mask,
- bool is_push_nsh, bool log)
+static bool validate_push_nsh(const struct nlattr *attr, bool log)
{
struct sw_flow_match match;
struct sw_flow_key key;
- int ret = 0;
ovs_match_init(&match, &key, true, NULL);
- ret = nsh_key_put_from_nlattr(attr, &match, is_mask,
- is_push_nsh, log);
- return !ret;
+ return !nsh_key_put_from_nlattr(attr, &match, false, true, log);
}
/* Return false if there are any non-masked bits set.
@@ -2955,13 +2914,6 @@ static int validate_set(const struct nlattr *a,
break;
- case OVS_KEY_ATTR_NSH:
- if (eth_type != htons(ETH_P_NSH))
- return -EINVAL;
- if (!validate_nsh(nla_data(a), masked, false, log))
- return -EINVAL;
- break;
-
default:
return -EINVAL;
}
@@ -3368,7 +3320,7 @@ static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
return -EINVAL;
}
mac_proto = MAC_PROTO_NONE;
- if (!validate_nsh(nla_data(a), false, true, true))
+ if (!validate_push_nsh(nla_data(a), log))
return -EINVAL;
break;
diff --git a/net/openvswitch/flow_netlink.h b/net/openvswitch/flow_netlink.h
index fe7f77fc5f189..ff8cdecbe3465 100644
--- a/net/openvswitch/flow_netlink.h
+++ b/net/openvswitch/flow_netlink.h
@@ -65,8 +65,6 @@ int ovs_nla_put_actions(const struct nlattr *attr,
void ovs_nla_free_flow_actions(struct sw_flow_actions *);
void ovs_nla_free_flow_actions_rcu(struct sw_flow_actions *);
-int nsh_key_from_nlattr(const struct nlattr *attr, struct ovs_key_nsh *nsh,
- struct ovs_key_nsh *nsh_mask);
int nsh_hdr_from_nlattr(const struct nlattr *attr, struct nshhdr *nh,
size_t size);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 228/300] s390/ctcm: Fix double-kfree
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 227/300] net: openvswitch: remove never-working support for setting nsh fields Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 229/300] vsock: Ignore signal/timeout on connect() if already established Greg Kroah-Hartman
` (77 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aswin Karuvally, Aleksei Nikiforov,
Simon Horman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
[ Upstream commit da02a1824884d6c84c5e5b5ac373b0c9e3288ec2 ]
The function 'mpc_rcvd_sweep_req(mpcginfo)' is called conditionally
from function 'ctcmpc_unpack_skb'. It frees passed mpcginfo.
After that a call to function 'kfree' in function 'ctcmpc_unpack_skb'
frees it again.
Remove 'kfree' call in function 'mpc_rcvd_sweep_req(mpcginfo)'.
Bug detected by the clang static analyzer.
Fixes: 0c0b20587b9f25a2 ("s390/ctcm: fix potential memory leak")
Reviewed-by: Aswin Karuvally <aswin@linux.ibm.com>
Signed-off-by: Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
Signed-off-by: Aswin Karuvally <aswin@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251112182724.1109474-1-aswin@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/net/ctcm_mpc.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/s390/net/ctcm_mpc.c b/drivers/s390/net/ctcm_mpc.c
index 20a6097e1b204..4e6f340d09261 100644
--- a/drivers/s390/net/ctcm_mpc.c
+++ b/drivers/s390/net/ctcm_mpc.c
@@ -712,7 +712,6 @@ static void mpc_rcvd_sweep_req(struct mpcg_info *mpcginfo)
grp->sweep_req_pend_num--;
ctcmpc_send_sweep_resp(ch);
- kfree(mpcginfo);
return;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 229/300] vsock: Ignore signal/timeout on connect() if already established
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 228/300] s390/ctcm: Fix double-kfree Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 230/300] scsi: core: Fix a regression triggered by scsi_host_busy() Greg Kroah-Hartman
` (76 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Luczaj, Stefano Garzarella,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Luczaj <mhal@rbox.co>
[ Upstream commit 002541ef650b742a198e4be363881439bb9d86b4 ]
During connect(), acting on a signal/timeout by disconnecting an already
established socket leads to several issues:
1. connect() invoking vsock_transport_cancel_pkt() ->
virtio_transport_purge_skbs() may race with sendmsg() invoking
virtio_transport_get_credit(). This results in a permanently elevated
`vvs->bytes_unsent`. Which, in turn, confuses the SOCK_LINGER handling.
2. connect() resetting a connected socket's state may race with socket
being placed in a sockmap. A disconnected socket remaining in a sockmap
breaks sockmap's assumptions. And gives rise to WARNs.
3. connect() transitioning SS_CONNECTED -> SS_UNCONNECTED allows for a
transport change/drop after TCP_ESTABLISHED. Which poses a problem for
any simultaneous sendmsg() or connect() and may result in a
use-after-free/null-ptr-deref.
Do not disconnect socket on signal/timeout. Keep the logic for unconnected
sockets: they don't linger, can't be placed in a sockmap, are rejected by
sendmsg().
[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/
[2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/
[3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/
Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
Signed-off-by: Michal Luczaj <mhal@rbox.co>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://patch.msgid.link/20251119-vsock-interrupted-connect-v2-1-70734cf1233f@rbox.co
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/af_vsock.c | 40 +++++++++++++++++++++++++++++++---------
1 file changed, 31 insertions(+), 9 deletions(-)
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 36b65b45c5c7a..3a5cde1a026ed 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -1464,18 +1464,40 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr,
timeout = schedule_timeout(timeout);
lock_sock(sk);
- if (signal_pending(current)) {
- err = sock_intr_errno(timeout);
- sk->sk_state = sk->sk_state == TCP_ESTABLISHED ? TCP_CLOSING : TCP_CLOSE;
- sock->state = SS_UNCONNECTED;
- vsock_transport_cancel_pkt(vsk);
- vsock_remove_connected(vsk);
- goto out_wait;
- } else if ((sk->sk_state != TCP_ESTABLISHED) && (timeout == 0)) {
- err = -ETIMEDOUT;
+ /* Connection established. Whatever happens to socket once we
+ * release it, that's not connect()'s concern. No need to go
+ * into signal and timeout handling. Call it a day.
+ *
+ * Note that allowing to "reset" an already established socket
+ * here is racy and insecure.
+ */
+ if (sk->sk_state == TCP_ESTABLISHED)
+ break;
+
+ /* If connection was _not_ established and a signal/timeout came
+ * to be, we want the socket's state reset. User space may want
+ * to retry.
+ *
+ * sk_state != TCP_ESTABLISHED implies that socket is not on
+ * vsock_connected_table. We keep the binding and the transport
+ * assigned.
+ */
+ if (signal_pending(current) || timeout == 0) {
+ err = timeout == 0 ? -ETIMEDOUT : sock_intr_errno(timeout);
+
+ /* Listener might have already responded with
+ * VIRTIO_VSOCK_OP_RESPONSE. Its handling expects our
+ * sk_state == TCP_SYN_SENT, which hereby we break.
+ * In such case VIRTIO_VSOCK_OP_RST will follow.
+ */
sk->sk_state = TCP_CLOSE;
sock->state = SS_UNCONNECTED;
+
+ /* Try to cancel VIRTIO_VSOCK_OP_REQUEST skb sent out by
+ * transport->connect().
+ */
vsock_transport_cancel_pkt(vsk);
+
goto out_wait;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 230/300] scsi: core: Fix a regression triggered by scsi_host_busy()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 229/300] vsock: Ignore signal/timeout on connect() if already established Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 231/300] net: tls: Cancel RX async resync request on rcd_delta overflow Greg Kroah-Hartman
` (75 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Reichel, Ming Lei,
Jens Axboe, Bart Van Assche, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit a0b7780602b1b196f47e527fec82166a7e67c4d0 ]
Commit 995412e23bb2 ("blk-mq: Replace tags->lock with SRCU for tag
iterators") introduced the following regression:
Call trace:
__srcu_read_lock+0x30/0x80 (P)
blk_mq_tagset_busy_iter+0x44/0x300
scsi_host_busy+0x38/0x70
ufshcd_print_host_state+0x34/0x1bc
ufshcd_link_startup.constprop.0+0xe4/0x2e0
ufshcd_init+0x944/0xf80
ufshcd_pltfrm_init+0x504/0x820
ufs_rockchip_probe+0x2c/0x88
platform_probe+0x5c/0xa4
really_probe+0xc0/0x38c
__driver_probe_device+0x7c/0x150
driver_probe_device+0x40/0x120
__driver_attach+0xc8/0x1e0
bus_for_each_dev+0x7c/0xdc
driver_attach+0x24/0x30
bus_add_driver+0x110/0x230
driver_register+0x68/0x130
__platform_driver_register+0x20/0x2c
ufs_rockchip_pltform_init+0x1c/0x28
do_one_initcall+0x60/0x1e0
kernel_init_freeable+0x248/0x2c4
kernel_init+0x20/0x140
ret_from_fork+0x10/0x20
Fix this regression by making scsi_host_busy() check whether the SCSI
host tag set has already been initialized. tag_set->ops is set by
scsi_mq_setup_tags() just before blk_mq_alloc_tag_set() is called. This
fix is based on the assumption that scsi_host_busy() and
scsi_mq_setup_tags() calls are serialized. This is the case in the UFS
driver.
Reported-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Closes: https://lore.kernel.org/linux-block/pnezafputodmqlpumwfbn644ohjybouveehcjhz2hmhtcf2rka@sdhoiivync4y/
Cc: Ming Lei <ming.lei@redhat.com>
Cc: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://patch.msgid.link/20251007214800.1678255-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hosts.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c
index 17fa1cd91da61..97cbe22d7fee2 100644
--- a/drivers/scsi/hosts.c
+++ b/drivers/scsi/hosts.c
@@ -598,8 +598,9 @@ int scsi_host_busy(struct Scsi_Host *shost)
{
int cnt = 0;
- blk_mq_tagset_busy_iter(&shost->tag_set,
- scsi_host_check_in_flight, &cnt);
+ if (shost->tag_set.ops)
+ blk_mq_tagset_busy_iter(&shost->tag_set,
+ scsi_host_check_in_flight, &cnt);
return cnt;
}
EXPORT_SYMBOL(scsi_host_busy);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 231/300] net: tls: Cancel RX async resync request on rcd_delta overflow
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 230/300] scsi: core: Fix a regression triggered by scsi_host_busy() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 232/300] kconfig/mconf: Initialize the default locale at startup Greg Kroah-Hartman
` (74 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shahar Shitrit, Sabrina Dubroca,
Tariq Toukan, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shahar Shitrit <shshitrit@nvidia.com>
[ Upstream commit c15d5c62ab313c19121f10e25d4fec852bd1c40c ]
When a netdev issues a RX async resync request for a TLS connection,
the TLS module handles it by logging record headers and attempting to
match them to the tcp_sn provided by the device. If a match is found,
the TLS module approves the tcp_sn for resynchronization.
While waiting for a device response, the TLS module also increments
rcd_delta each time a new TLS record is received, tracking the distance
from the original resync request.
However, if the device response is delayed or fails (e.g due to
unstable connection and device getting out of tracking, hardware
errors, resource exhaustion etc.), the TLS module keeps logging and
incrementing, which can lead to a WARN() when rcd_delta exceeds the
threshold.
To address this, introduce tls_offload_rx_resync_async_request_cancel()
to explicitly cancel resync requests when a device response failure is
detected. Call this helper also as a final safeguard when rcd_delta
crosses its threshold, as reaching this point implies that earlier
cancellation did not occur.
Signed-off-by: Shahar Shitrit <shshitrit@nvidia.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
Link: https://patch.msgid.link/1761508983-937977-3-git-send-email-tariqt@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tls.h | 6 ++++++
net/tls/tls_device.c | 4 +++-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/include/net/tls.h b/include/net/tls.h
index c76a827a678ae..b4040f76b007f 100644
--- a/include/net/tls.h
+++ b/include/net/tls.h
@@ -674,6 +674,12 @@ tls_offload_rx_resync_async_request_end(struct sock *sk, __be32 seq)
((u64)ntohl(seq) << 32) | RESYNC_REQ);
}
+static inline void
+tls_offload_rx_resync_async_request_cancel(struct tls_offload_resync_async *resync_async)
+{
+ atomic64_set(&resync_async->req, 0);
+}
+
static inline void
tls_offload_rx_resync_set_type(struct sock *sk, enum tls_offload_sync_type type)
{
diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c
index 5cb6846544cc7..8e89ff403073b 100644
--- a/net/tls/tls_device.c
+++ b/net/tls/tls_device.c
@@ -710,8 +710,10 @@ tls_device_rx_resync_async(struct tls_offload_resync_async *resync_async,
/* shouldn't get to wraparound:
* too long in async stage, something bad happened
*/
- if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX))
+ if (WARN_ON_ONCE(resync_async->rcd_delta == USHRT_MAX)) {
+ tls_offload_rx_resync_async_request_cancel(resync_async);
return false;
+ }
/* asynchronous stage: log all headers seq such that
* req_seq <= seq <= end_seq, and wait for real resync request
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 232/300] kconfig/mconf: Initialize the default locale at startup
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 231/300] net: tls: Cancel RX async resync request on rcd_delta overflow Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 233/300] kconfig/nconf: " Greg Kroah-Hartman
` (73 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Horký, Nathan Chancellor,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Horký <jakub.git@horky.net>
[ Upstream commit 3927c4a1084c48ef97f11281a0a43ecb2cb4d6f1 ]
Fix bug where make menuconfig doesn't initialize the default locale, which
causes ncurses menu borders to be displayed incorrectly (lqqqqk) in
UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY.
Signed-off-by: Jakub Horký <jakub.git@horky.net>
Link: https://patch.msgid.link/20251014154933.3990990-1-jakub.git@horky.net
[nathan: Alphabetize locale.h include]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/mconf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/kconfig/mconf.c b/scripts/kconfig/mconf.c
index 4063dbc1b9270..a6d24c63c98c2 100644
--- a/scripts/kconfig/mconf.c
+++ b/scripts/kconfig/mconf.c
@@ -12,6 +12,7 @@
#include <errno.h>
#include <fcntl.h>
#include <limits.h>
+#include <locale.h>
#include <stdarg.h>
#include <stdlib.h>
#include <string.h>
@@ -1008,6 +1009,8 @@ int main(int ac, char **av)
signal(SIGINT, sig_handler);
+ setlocale(LC_ALL, "");
+
if (ac > 1 && strcmp(av[1], "-s") == 0) {
silent = 1;
/* Silence conf_read() until the real callback is set up */
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 233/300] kconfig/nconf: Initialize the default locale at startup
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 232/300] kconfig/mconf: Initialize the default locale at startup Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 234/300] mm/mm_init: fix hash table order logging in alloc_large_system_hash() Greg Kroah-Hartman
` (72 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Horký, Nathan Chancellor,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jakub Horký <jakub.git@horky.net>
[ Upstream commit 43c2931a95e6b295bfe9e3b90dbe0f7596933e91 ]
Fix bug where make nconfig doesn't initialize the default locale, which
causes ncurses menu borders to be displayed incorrectly (lqqqqk) in
UTF-8 terminals that don't support VT100 ACS by default, such as PuTTY.
Signed-off-by: Jakub Horký <jakub.git@horky.net>
Link: https://patch.msgid.link/20251014144405.3975275-2-jakub.git@horky.net
[nathan: Alphabetize locale.h include]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
scripts/kconfig/nconf.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/scripts/kconfig/nconf.c b/scripts/kconfig/nconf.c
index cdbd60a3ae16a..5b504be357135 100644
--- a/scripts/kconfig/nconf.c
+++ b/scripts/kconfig/nconf.c
@@ -7,6 +7,7 @@
#ifndef _GNU_SOURCE
#define _GNU_SOURCE
#endif
+#include <locale.h>
#include <string.h>
#include <strings.h>
#include <stdlib.h>
@@ -1478,6 +1479,8 @@ int main(int ac, char **av)
int lines, columns;
char *mode;
+ setlocale(LC_ALL, "");
+
if (ac > 1 && strcmp(av[1], "-s") == 0) {
/* Silence conf_read() until the real callback is set up */
conf_set_message_callback(NULL);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 234/300] mm/mm_init: fix hash table order logging in alloc_large_system_hash()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 233/300] kconfig/nconf: " Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 235/300] ALSA: usb-audio: fix uac2 clock source at terminal parser Greg Kroah-Hartman
` (71 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Isaac J. Manjarres,
Mike Rapoport (Microsoft), David Hildenbrand, Andrew Morton,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <isaacmanjarres@google.com>
[ Upstream commit 0d6c356dd6547adac2b06b461528e3573f52d953 ]
When emitting the order of the allocation for a hash table,
alloc_large_system_hash() unconditionally subtracts PAGE_SHIFT from log
base 2 of the allocation size. This is not correct if the allocation size
is smaller than a page, and yields a negative value for the order as seen
below:
TCP established hash table entries: 32 (order: -4, 256 bytes, linear) TCP
bind hash table entries: 32 (order: -2, 1024 bytes, linear)
Use get_order() to compute the order when emitting the hash table
information to correctly handle cases where the allocation size is smaller
than a page:
TCP established hash table entries: 32 (order: 0, 256 bytes, linear) TCP
bind hash table entries: 32 (order: 0, 1024 bytes, linear)
Link: https://lkml.kernel.org/r/20251028191020.413002-1-isaacmanjarres@google.com
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Reviewed-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
(cherry picked from commit 0d6c356dd6547adac2b06b461528e3573f52d953)
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
mm/page_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index d906c6b961815..495a350c90a52 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -8372,7 +8372,7 @@ void *__init alloc_large_system_hash(const char *tablename,
panic("Failed to allocate %s hash table\n", tablename);
pr_info("%s hash table entries: %ld (order: %d, %lu bytes, %s)\n",
- tablename, 1UL << log2qty, ilog2(size) - PAGE_SHIFT, size,
+ tablename, 1UL << log2qty, get_order(size), size,
virt ? "vmalloc" : "linear");
if (_hash_shift)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 235/300] ALSA: usb-audio: fix uac2 clock source at terminal parser
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 234/300] mm/mm_init: fix hash table order logging in alloc_large_system_hash() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 236/300] net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Greg Kroah-Hartman
` (70 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, René Rebe, Takashi Iwai,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: René Rebe <rene@exactco.de>
[ Upstream commit d26e9f669cc0a6a85cf17180c09a6686db9f4002 ]
Since 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to
UAC3 values") usb-audio is using UAC3_CLOCK_SOURCE instead of
bDescriptorSubtype, later refactored with e0ccdef9265 ("ALSA: usb-audio:
Clean up check_input_term()") into parse_term_uac2_clock_source().
This breaks the clock source selection for at least my
1397:0003 BEHRINGER International GmbH FCA610 Pro.
Fix by using UAC2_CLOCK_SOURCE in parse_term_uac2_clock_source().
Fixes: 8b3a087f7f65 ("ALSA: usb-audio: Unify virtual type units type to UAC3 values")
Signed-off-by: René Rebe <rene@exactco.de>
Link: https://patch.msgid.link/20251125.154149.1121389544970412061.rene@exactco.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 6b9a472ea43cb..949b171377267 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -925,7 +925,7 @@ static int parse_term_uac2_clock_source(struct mixer_build *state,
{
struct uac_clock_source_descriptor *d = p1;
- term->type = UAC3_CLOCK_SOURCE << 16; /* virtual type */
+ term->type = UAC2_CLOCK_SOURCE << 16; /* virtual type */
term->id = id;
term->name = d->iClockSource;
return 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 236/300] net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 235/300] ALSA: usb-audio: fix uac2 clock source at terminal parser Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 237/300] uio_hv_generic: Set event for all channels on the device Greg Kroah-Hartman
` (69 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Horman, Jacob Keller,
Nishanth Menon, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nishanth Menon <nm@ti.com>
[ Upstream commit 90a88306eb874fe4bbdd860e6c9787f5bbc588b5 ]
Make knav_dma_open_channel consistently return NULL on error instead
of ERR_PTR. Currently the header include/linux/soc/ti/knav_dma.h
returns NULL when the driver is disabled, but the driver
implementation does not even return NULL or ERR_PTR on failure,
causing inconsistency in the users. This results in a crash in
netcp_free_navigator_resources as followed (trimmed):
Unhandled fault: alignment exception (0x221) at 0xfffffff2
[fffffff2] *pgd=80000800207003, *pmd=82ffda003, *pte=00000000
Internal error: : 221 [#1] SMP ARM
Modules linked in:
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.17.0-rc7 #1 NONE
Hardware name: Keystone
PC is at knav_dma_close_channel+0x30/0x19c
LR is at netcp_free_navigator_resources+0x2c/0x28c
[... TRIM...]
Call trace:
knav_dma_close_channel from netcp_free_navigator_resources+0x2c/0x28c
netcp_free_navigator_resources from netcp_ndo_open+0x430/0x46c
netcp_ndo_open from __dev_open+0x114/0x29c
__dev_open from __dev_change_flags+0x190/0x208
__dev_change_flags from netif_change_flags+0x1c/0x58
netif_change_flags from dev_change_flags+0x38/0xa0
dev_change_flags from ip_auto_config+0x2c4/0x11f0
ip_auto_config from do_one_initcall+0x58/0x200
do_one_initcall from kernel_init_freeable+0x1cc/0x238
kernel_init_freeable from kernel_init+0x1c/0x12c
kernel_init from ret_from_fork+0x14/0x38
[... TRIM...]
Standardize the error handling by making the function return NULL on
all error conditions. The API is used in just the netcp_core.c so the
impact is limited.
Note, this change, in effect reverts commit 5b6cb43b4d62 ("net:
ethernet: ti: netcp_core: return error while dma channel open issue"),
but provides a less error prone implementation.
Suggested-by: Simon Horman <horms@kernel.org>
Suggested-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Nishanth Menon <nm@ti.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20251103162811.3730055-1-nm@ti.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/netcp_core.c | 10 +++++-----
drivers/soc/ti/knav_dma.c | 14 +++++++-------
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/ti/netcp_core.c b/drivers/net/ethernet/ti/netcp_core.c
index f145abb77a497..77dd20431c447 100644
--- a/drivers/net/ethernet/ti/netcp_core.c
+++ b/drivers/net/ethernet/ti/netcp_core.c
@@ -1339,10 +1339,10 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
tx_pipe->dma_channel = knav_dma_open_channel(dev,
tx_pipe->dma_chan_name, &config);
- if (IS_ERR(tx_pipe->dma_channel)) {
+ if (!tx_pipe->dma_channel) {
dev_err(dev, "failed opening tx chan(%s)\n",
tx_pipe->dma_chan_name);
- ret = PTR_ERR(tx_pipe->dma_channel);
+ ret = -EINVAL;
goto err;
}
@@ -1360,7 +1360,7 @@ int netcp_txpipe_open(struct netcp_tx_pipe *tx_pipe)
return 0;
err:
- if (!IS_ERR_OR_NULL(tx_pipe->dma_channel))
+ if (tx_pipe->dma_channel)
knav_dma_close_channel(tx_pipe->dma_channel);
tx_pipe->dma_channel = NULL;
return ret;
@@ -1679,10 +1679,10 @@ static int netcp_setup_navigator_resources(struct net_device *ndev)
netcp->rx_channel = knav_dma_open_channel(netcp->netcp_device->device,
netcp->dma_chan_name, &config);
- if (IS_ERR(netcp->rx_channel)) {
+ if (!netcp->rx_channel) {
dev_err(netcp->ndev_dev, "failed opening rx chan(%s\n",
netcp->dma_chan_name);
- ret = PTR_ERR(netcp->rx_channel);
+ ret = -EINVAL;
goto fail;
}
diff --git a/drivers/soc/ti/knav_dma.c b/drivers/soc/ti/knav_dma.c
index 56597f6ea666a..a677e874de543 100644
--- a/drivers/soc/ti/knav_dma.c
+++ b/drivers/soc/ti/knav_dma.c
@@ -410,7 +410,7 @@ static int of_channel_match_helper(struct device_node *np, const char *name,
* @name: slave channel name
* @config: dma configuration parameters
*
- * Returns pointer to appropriate DMA channel on success or error.
+ * Return: Pointer to appropriate DMA channel on success or NULL on error.
*/
void *knav_dma_open_channel(struct device *dev, const char *name,
struct knav_dma_cfg *config)
@@ -423,13 +423,13 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
if (!kdev) {
pr_err("keystone-navigator-dma driver not registered\n");
- return (void *)-EINVAL;
+ return NULL;
}
chan_num = of_channel_match_helper(dev->of_node, name, &instance);
if (chan_num < 0) {
dev_err(kdev->dev, "No DMA instance with name %s\n", name);
- return (void *)-EINVAL;
+ return NULL;
}
dev_dbg(kdev->dev, "initializing %s channel %d from DMA %s\n",
@@ -440,7 +440,7 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
if (config->direction != DMA_MEM_TO_DEV &&
config->direction != DMA_DEV_TO_MEM) {
dev_err(kdev->dev, "bad direction\n");
- return (void *)-EINVAL;
+ return NULL;
}
/* Look for correct dma instance */
@@ -452,7 +452,7 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
}
if (!found) {
dev_err(kdev->dev, "No DMA instance with name %s\n", instance);
- return (void *)-EINVAL;
+ return NULL;
}
/* Look for correct dma channel from dma instance */
@@ -473,14 +473,14 @@ void *knav_dma_open_channel(struct device *dev, const char *name,
if (!found) {
dev_err(kdev->dev, "channel %d is not in DMA %s\n",
chan_num, instance);
- return (void *)-EINVAL;
+ return NULL;
}
if (atomic_read(&chan->ref_count) >= 1) {
if (!check_config(chan, config)) {
dev_err(kdev->dev, "channel %d config miss-match\n",
chan_num);
- return (void *)-EINVAL;
+ return NULL;
}
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 237/300] uio_hv_generic: Set event for all channels on the device
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 236/300] net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 238/300] net: qede: Initialize qede_ll_ops with designated initializer Greg Kroah-Hartman
` (68 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Michael Kelley,
Saurabh Sengar, Naman Jain
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <longli@microsoft.com>
commit d062463edf1770427dc2d637df4088df4835aa47 upstream.
Hyper-V may offer a non latency sensitive device with subchannels without
monitor bit enabled. The decision is entirely on the Hyper-V host not
configurable within guest.
When a device has subchannels, also signal events for the subchannel
if its monitor bit is disabled.
This patch also removes the memory barrier when monitor bit is enabled
as it is not necessary. The memory barrier is only needed between
setting up interrupt mask and calling vmbus_set_event() when monitor
bit is disabled.
Signed-off-by: Long Li <longli@microsoft.com>
Reviewed-by: Michael Kelley <mhklinux@outlook.com>
Reviewed-by: Saurabh Sengar <ssengar@linux.microsoft.com>
Link: https://lore.kernel.org/r/1741644721-20389-1-git-send-email-longli@linuxonhyperv.com
Fixes: b15b7d2a1b09 ("uio_hv_generic: Let userspace take care of interrupt mask")
Closes: https://bugs.debian.org/1120602
Signed-off-by: Naman Jain <namjain@linux.microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio_hv_generic.c | 21 +++++++++++++++++----
1 file changed, 17 insertions(+), 4 deletions(-)
--- a/drivers/uio/uio_hv_generic.c
+++ b/drivers/uio/uio_hv_generic.c
@@ -80,9 +80,15 @@ hv_uio_irqcontrol(struct uio_info *info,
{
struct hv_uio_private_data *pdata = info->priv;
struct hv_device *dev = pdata->device;
+ struct vmbus_channel *primary, *sc;
- dev->channel->inbound.ring_buffer->interrupt_mask = !irq_state;
- virt_mb();
+ primary = dev->channel;
+ primary->inbound.ring_buffer->interrupt_mask = !irq_state;
+
+ mutex_lock(&vmbus_connection.channel_mutex);
+ list_for_each_entry(sc, &primary->sc_list, sc_list)
+ sc->inbound.ring_buffer->interrupt_mask = !irq_state;
+ mutex_unlock(&vmbus_connection.channel_mutex);
return 0;
}
@@ -93,11 +99,18 @@ hv_uio_irqcontrol(struct uio_info *info,
static void hv_uio_channel_cb(void *context)
{
struct vmbus_channel *chan = context;
- struct hv_device *hv_dev = chan->device_obj;
- struct hv_uio_private_data *pdata = hv_get_drvdata(hv_dev);
+ struct hv_device *hv_dev;
+ struct hv_uio_private_data *pdata;
virt_mb();
+ /*
+ * The callback may come from a subchannel, in which case look
+ * for the hv device in the primary channel
+ */
+ hv_dev = chan->primary_channel ?
+ chan->primary_channel->device_obj : chan->device_obj;
+ pdata = hv_get_drvdata(hv_dev);
uio_event_notify(&pdata->info);
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 238/300] net: qede: Initialize qede_ll_ops with designated initializer
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 237/300] uio_hv_generic: Set event for all channels on the device Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 239/300] Makefile.compiler: replace cc-ifversion with compiler-specific macros Greg Kroah-Hartman
` (67 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 6b3ab7f2cbfaeb6580709cd8ef4d72cfd01bfde4 upstream.
After a recent change [1] in clang's randstruct implementation to
randomize structures that only contain function pointers, there is an
error because qede_ll_ops get randomized but does not use a designated
initializer for the first member:
drivers/net/ethernet/qlogic/qede/qede_main.c:206:2: error: a randomized struct can only be initialized with a designated initializer
206 | {
| ^
Explicitly initialize the common member using a designated initializer
to fix the build.
Cc: stable@vger.kernel.org
Fixes: 035f7f87b729 ("randstruct: Enable Clang support")
Link: https://github.com/llvm/llvm-project/commit/04364fb888eea6db9811510607bed4b200bcb082 [1]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Link: https://patch.msgid.link/20250507-qede-fix-clang-randstruct-v1-1-5ccc15626fba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/qlogic/qede/qede_main.c
+++ b/drivers/net/ethernet/qlogic/qede/qede_main.c
@@ -199,7 +199,7 @@ static struct pci_driver qede_pci_driver
};
static struct qed_eth_cb_ops qede_ll_ops = {
- {
+ .common = {
#ifdef CONFIG_RFS_ACCEL
.arfs_filter_op = qede_arfs_filter_op,
#endif
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 239/300] Makefile.compiler: replace cc-ifversion with compiler-specific macros
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 238/300] net: qede: Initialize qede_ll_ops with designated initializer Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 240/300] Revert "NFS: Dont set NFS_INO_REVAL_PAGECACHE in the inode cache validity" Greg Kroah-Hartman
` (66 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bill Wendling, Nathan Chancellor,
Nick Desaulniers, Masahiro Yamada
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nick Desaulniers <ndesaulniers@google.com>
commit 88b61e3bff93f99712718db785b4aa0c1165f35c upstream.
cc-ifversion is GCC specific. Replace it with compiler specific
variants. Update the users of cc-ifversion to use these new macros.
Link: https://github.com/ClangBuiltLinux/linux/issues/350
Link: https://lore.kernel.org/llvm/CAGG=3QWSAUakO42kubrCap8fp-gm1ERJJAYXTnP1iHk_wrH=BQ@mail.gmail.com/
Suggested-by: Bill Wendling <morbo@google.com>
Reviewed-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
[nathan: Backport to 5.10 and eliminate instances of cc-ifversion that
did not exist upstream when this change was original created]
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/kbuild/makefiles.rst | 29 +++++++++++++++-----------
Makefile | 4 ++-
arch/mips/loongson64/Platform | 2 -
arch/powerpc/Makefile | 4 ++-
arch/s390/Makefile | 4 +--
drivers/gpu/drm/amd/display/dc/calcs/Makefile | 2 -
drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 2 -
drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 2 -
drivers/gpu/drm/amd/display/dc/dcn30/Makefile | 2 -
drivers/gpu/drm/amd/display/dc/dml/Makefile | 2 -
drivers/gpu/drm/amd/display/dc/dsc/Makefile | 2 -
scripts/Kbuild.include | 10 ++++++--
12 files changed, 39 insertions(+), 26 deletions(-)
--- a/Documentation/kbuild/makefiles.rst
+++ b/Documentation/kbuild/makefiles.rst
@@ -552,22 +552,27 @@ more details, with real examples.
In the above example, -Wno-unused-but-set-variable will be added to
KBUILD_CFLAGS only if gcc really accepts it.
- cc-ifversion
- cc-ifversion tests the version of $(CC) and equals the fourth parameter
- if version expression is true, or the fifth (if given) if the version
- expression is false.
+ gcc-min-version
+ gcc-min-version tests if the value of $(CONFIG_GCC_VERSION) is greater than
+ or equal to the provided value and evaluates to y if so.
Example::
- #fs/reiserfs/Makefile
- ccflags-y := $(call cc-ifversion, -lt, 0402, -O1)
+ cflags-$(call gcc-min-version, 70100) := -foo
- In this example, ccflags-y will be assigned the value -O1 if the
- $(CC) version is less than 4.2.
- cc-ifversion takes all the shell operators:
- -eq, -ne, -lt, -le, -gt, and -ge
- The third parameter may be a text as in this example, but it may also
- be an expanded variable or a macro.
+ In this example, cflags-y will be assigned the value -foo if $(CC) is gcc and
+ $(CONFIG_GCC_VERSION) is >= 7.1.
+
+ clang-min-version
+ clang-min-version tests if the value of $(CONFIG_CLANG_VERSION) is greater
+ than or equal to the provided value and evaluates to y if so.
+
+ Example::
+
+ cflags-$(call clang-min-version, 110000) := -foo
+
+ In this example, cflags-y will be assigned the value -foo if $(CC) is clang
+ and $(CONFIG_CLANG_VERSION) is >= 11.0.0.
cc-cross-prefix
cc-cross-prefix is used to check if there exists a $(CC) in path with
--- a/Makefile
+++ b/Makefile
@@ -855,7 +855,9 @@ DEBUG_CFLAGS :=
# Workaround for GCC versions < 5.0
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61801
ifdef CONFIG_CC_IS_GCC
-DEBUG_CFLAGS += $(call cc-ifversion, -lt, 0500, $(call cc-option, -fno-var-tracking-assignments))
+ifneq ($(call gcc-min-version, 50000),y)
+DEBUG_CFLAGS += $(call cc-option, -fno-var-tracking-assignments)
+endif
endif
ifdef CONFIG_DEBUG_INFO
--- a/arch/mips/loongson64/Platform
+++ b/arch/mips/loongson64/Platform
@@ -12,7 +12,7 @@ cflags-$(CONFIG_CPU_LOONGSON64) += -Wa,-
# by GAS. The cc-option can't probe for this behaviour so -march=loongson3a
# can't easily be used safely within the kbuild framework.
#
-ifeq ($(call cc-ifversion, -ge, 0409, y), y)
+ifeq ($(call gcc-min-version, 40900), y)
ifeq ($(call ld-ifversion, -ge, 225000000, y), y)
cflags-$(CONFIG_CPU_LOONGSON64) += \
$(call cc-option,-march=loongson3a -U_MIPS_ISA -D_MIPS_ISA=_MIPS_ISA_MIPS64)
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -168,7 +168,9 @@ endif
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=44199
# https://gcc.gnu.org/bugzilla/show_bug.cgi?id=52828
ifndef CONFIG_CC_IS_CLANG
-CC_FLAGS_FTRACE += $(call cc-ifversion, -lt, 0409, -mno-sched-epilog)
+ifneq ($(call gcc-min-version, 40900),y)
+CC_FLAGS_FTRACE += -mno-sched-epilog
+endif
endif
endif
--- a/arch/s390/Makefile
+++ b/arch/s390/Makefile
@@ -35,8 +35,8 @@ KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CON
KBUILD_CFLAGS_DECOMPRESSOR += $(if $(CONFIG_DEBUG_INFO_DWARF4), $(call cc-option, -gdwarf-4,))
ifdef CONFIG_CC_IS_GCC
- ifeq ($(call cc-ifversion, -ge, 1200, y), y)
- ifeq ($(call cc-ifversion, -lt, 1300, y), y)
+ ifeq ($(call gcc-min-version, 120000), y)
+ ifneq ($(call gcc-min-version, 130000), y)
KBUILD_CFLAGS += $(call cc-disable-warning, array-bounds)
KBUILD_CFLAGS_DECOMPRESSOR += $(call cc-disable-warning, array-bounds)
endif
--- a/drivers/gpu/drm/amd/display/dc/calcs/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/calcs/Makefile
@@ -34,7 +34,7 @@ calcs_ccflags := -mhard-float -maltivec
endif
ifdef CONFIG_CC_IS_GCC
-ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+ifneq ($(call gcc-min-version, 70100),y)
IS_OLD_GCC = 1
endif
endif
--- a/drivers/gpu/drm/amd/display/dc/dcn20/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/Makefile
@@ -18,7 +18,7 @@ CFLAGS_$(AMDDALPATH)/dc/dcn20/dcn20_reso
endif
ifdef CONFIG_CC_IS_GCC
-ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+ifneq ($(call gcc-min-version, 70100),y)
IS_OLD_GCC = 1
endif
endif
--- a/drivers/gpu/drm/amd/display/dc/dcn21/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dcn21/Makefile
@@ -14,7 +14,7 @@ CFLAGS_$(AMDDALPATH)/dc/dcn21/dcn21_reso
endif
ifdef CONFIG_CC_IS_GCC
-ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+ifneq ($(call gcc-min-version, 70100),y)
IS_OLD_GCC = 1
endif
endif
--- a/drivers/gpu/drm/amd/display/dc/dcn30/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dcn30/Makefile
@@ -47,7 +47,7 @@ CFLAGS_REMOVE_$(AMDDALPATH)/dc/dcn30/dcn
endif
ifdef CONFIG_CC_IS_GCC
-ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+ifneq ($(call gcc-min-version, 70100),y)
IS_OLD_GCC = 1
endif
endif
--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile
@@ -35,7 +35,7 @@ dml_ccflags := -mhard-float -maltivec
endif
ifdef CONFIG_CC_IS_GCC
-ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+ifneq ($(call gcc-min-version, 70100),y)
IS_OLD_GCC = 1
endif
endif
--- a/drivers/gpu/drm/amd/display/dc/dsc/Makefile
+++ b/drivers/gpu/drm/amd/display/dc/dsc/Makefile
@@ -11,7 +11,7 @@ dsc_ccflags := -mhard-float -maltivec
endif
ifdef CONFIG_CC_IS_GCC
-ifeq ($(call cc-ifversion, -lt, 0701, y), y)
+ifneq ($(call gcc-min-version, 70100),y)
IS_OLD_GCC = 1
endif
endif
--- a/scripts/Kbuild.include
+++ b/scripts/Kbuild.include
@@ -133,9 +133,13 @@ cc-option-yn = $(call try-run,\
cc-disable-warning = $(call try-run,\
$(CC) -Werror $(KBUILD_CPPFLAGS) $(KBUILD_CFLAGS) -W$(strip $(1)) -c -x c /dev/null -o "$$TMP",-Wno-$(strip $(1)))
-# cc-ifversion
-# Usage: EXTRA_CFLAGS += $(call cc-ifversion, -lt, 0402, -O1)
-cc-ifversion = $(shell [ $(CONFIG_GCC_VERSION)0 $(1) $(2)000 ] && echo $(3) || echo $(4))
+# gcc-min-version
+# Usage: cflags-$(call gcc-min-version, 70100) += -foo
+gcc-min-version = $(shell [ $(CONFIG_GCC_VERSION)0 -ge $(1)0 ] && echo y)
+
+# clang-min-version
+# Usage: cflags-$(call clang-min-version, 110000) += -foo
+clang-min-version = $(shell [ $(CONFIG_CLANG_VERSION)0 -ge $(1)0 ] && echo y)
# ld-option
# Usage: KBUILD_LDFLAGS += $(call ld-option, -X, -Y)
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 240/300] Revert "NFS: Dont set NFS_INO_REVAL_PAGECACHE in the inode cache validity"
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 239/300] Makefile.compiler: replace cc-ifversion with compiler-specific macros Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 241/300] net: netpoll: fix incorrect refcount handling causing incorrect cleanup Greg Kroah-Hartman
` (65 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ahmed, Aaron, Trond Myklebust
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
This reverts commit 36a9346c225270262d9f34e66c91aa1723fa903f.
The above commit was incorrectly labelled as a dependency for commit
b01f21cacde9 ("NFS: Fix the setting of capabilities when automounting a
new filesystem")
A revert is needed, since the incorrectly applied commit depends upon a
series of other patches that were merged into Linux 5.13, but have not
been applied to the 5.10 stable series.
Reported-by: "Ahmed, Aaron" <aarnahmd@amazon.com>
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/inode.c | 6 ++++--
fs/nfs/nfs4proc.c | 1 +
2 files changed, 5 insertions(+), 2 deletions(-)
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -217,12 +217,11 @@ static void nfs_set_cache_invalid(struct
flags &= ~NFS_INO_INVALID_OTHER;
flags &= ~(NFS_INO_INVALID_CHANGE
| NFS_INO_INVALID_SIZE
+ | NFS_INO_REVAL_PAGECACHE
| NFS_INO_INVALID_XATTR);
} else if (flags & NFS_INO_REVAL_PAGECACHE)
flags |= NFS_INO_INVALID_CHANGE | NFS_INO_INVALID_SIZE;
- flags &= ~NFS_INO_REVAL_PAGECACHE;
-
if (!nfs_has_xattr_cache(nfsi))
flags &= ~NFS_INO_INVALID_XATTR;
if (inode->i_mapping->nrpages == 0)
@@ -1901,6 +1900,7 @@ static int nfs_update_inode(struct inode
nfsi->cache_validity &= ~(NFS_INO_INVALID_ATTR
| NFS_INO_INVALID_ATIME
| NFS_INO_REVAL_FORCED
+ | NFS_INO_REVAL_PAGECACHE
| NFS_INO_INVALID_BLOCKS);
/* Do atomic weak cache consistency updates */
@@ -1942,6 +1942,7 @@ static int nfs_update_inode(struct inode
} else {
nfsi->cache_validity |= save_cache_validity &
(NFS_INO_INVALID_CHANGE
+ | NFS_INO_REVAL_PAGECACHE
| NFS_INO_REVAL_FORCED);
cache_revalidated = false;
}
@@ -1987,6 +1988,7 @@ static int nfs_update_inode(struct inode
} else {
nfsi->cache_validity |= save_cache_validity &
(NFS_INO_INVALID_SIZE
+ | NFS_INO_REVAL_PAGECACHE
| NFS_INO_REVAL_FORCED);
cache_revalidated = false;
}
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -1212,6 +1212,7 @@ nfs4_update_changeattr_locked(struct ino
| cache_validity;
if (cinfo->atomic && cinfo->before == inode_peek_iversion_raw(inode)) {
+ nfsi->cache_validity &= ~NFS_INO_REVAL_PAGECACHE;
nfsi->attrtimeo_timestamp = jiffies;
} else {
if (S_ISDIR(inode->i_mode)) {
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 241/300] net: netpoll: fix incorrect refcount handling causing incorrect cleanup
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 240/300] Revert "NFS: Dont set NFS_INO_REVAL_PAGECACHE in the inode cache validity" Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 242/300] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer Greg Kroah-Hartman
` (64 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Vosburgh, Breno Leitao,
Simon Horman, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Breno Leitao <leitao@debian.org>
[ Upstream commit 49c8d2c1f94cc2f4d1a108530d7ba52614b874c2 ]
commit efa95b01da18 ("netpoll: fix use after free") incorrectly
ignored the refcount and prematurely set dev->npinfo to NULL during
netpoll cleanup, leading to improper behavior and memory leaks.
Scenario causing lack of proper cleanup:
1) A netpoll is associated with a NIC (e.g., eth0) and netdev->npinfo is
allocated, and refcnt = 1
- Keep in mind that npinfo is shared among all netpoll instances. In
this case, there is just one.
2) Another netpoll is also associated with the same NIC and
npinfo->refcnt += 1.
- Now dev->npinfo->refcnt = 2;
- There is just one npinfo associated to the netdev.
3) When the first netpolls goes to clean up:
- The first cleanup succeeds and clears np->dev->npinfo, ignoring
refcnt.
- It basically calls `RCU_INIT_POINTER(np->dev->npinfo, NULL);`
- Set dev->npinfo = NULL, without proper cleanup
- No ->ndo_netpoll_cleanup() is either called
4) Now the second target tries to clean up
- The second cleanup fails because np->dev->npinfo is already NULL.
* In this case, ops->ndo_netpoll_cleanup() was never called, and
the skb pool is not cleaned as well (for the second netpoll
instance)
- This leaks npinfo and skbpool skbs, which is clearly reported by
kmemleak.
Revert commit efa95b01da18 ("netpoll: fix use after free") and adds
clarifying comments emphasizing that npinfo cleanup should only happen
once the refcount reaches zero, ensuring stable and correct netpoll
behavior.
Cc: <stable@vger.kernel.org> # 3.17.x
Cc: Jay Vosburgh <jv@jvosburgh.net>
Fixes: efa95b01da18 ("netpoll: fix use after free")
Signed-off-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251107-netconsole_torture-v10-1-749227b55f63@debian.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/netpoll.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -863,6 +863,10 @@ void __netpoll_cleanup(struct netpoll *n
synchronize_srcu(&netpoll_srcu);
+ /* At this point, there is a single npinfo instance per netdevice, and
+ * its refcnt tracks how many netpoll structures are linked to it. We
+ * only perform npinfo cleanup when the refcnt decrements to zero.
+ */
if (refcount_dec_and_test(&npinfo->refcnt)) {
const struct net_device_ops *ops;
@@ -872,8 +876,7 @@ void __netpoll_cleanup(struct netpoll *n
RCU_INIT_POINTER(np->dev->npinfo, NULL);
call_rcu(&npinfo->rcu, rcu_cleanup_netpoll_info);
- } else
- RCU_INIT_POINTER(np->dev->npinfo, NULL);
+ }
}
EXPORT_SYMBOL_GPL(__netpoll_cleanup);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 242/300] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 241/300] net: netpoll: fix incorrect refcount handling causing incorrect cleanup Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 243/300] pmdomain: imx: Fix reference count leak in imx_gpc_remove Greg Kroah-Hartman
` (63 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+bfd77469c8966de076f7,
Lizhi Xu, Takashi Iwai, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit 05a1fc5efdd8560f34a3af39c9cf1e1526cc3ddf ]
The PCM stream data in USB-audio driver is transferred over USB URB
packet buffers, and each packet size is determined dynamically. The
packet sizes are limited by some factors such as wMaxPacketSize USB
descriptor. OTOH, in the current code, the actually used packet sizes
are determined only by the rate and the PPS, which may be bigger than
the size limit above. This results in a buffer overflow, as reported
by syzbot.
Basically when the limit is smaller than the calculated packet size,
it implies that something is wrong, most likely a weird USB
descriptor. So the best option would be just to return an error at
the parameter setup time before doing any further operations.
This patch introduces such a sanity check, and returns -EINVAL when
the packet size is greater than maxpacksize. The comparison with
ep->packsize[1] alone should suffice since it's always equal or
greater than ep->packsize[0].
Reported-by: syzbot+bfd77469c8966de076f7@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=bfd77469c8966de076f7
Link: https://lore.kernel.org/690b6b46.050a0220.3d0d33.0054.GAE@google.com
Cc: Lizhi Xu <lizhi.xu@windriver.com>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251109091211.12739-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
[ changed ep->cur_rate to rate parameter and chip to ep->chip ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/endpoint.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/sound/usb/endpoint.c
+++ b/sound/usb/endpoint.c
@@ -1093,6 +1093,11 @@ int snd_usb_endpoint_set_params(struct s
ep->sample_rem = rate % ep->pps;
ep->packsize[0] = rate / ep->pps;
ep->packsize[1] = (rate + (ep->pps - 1)) / ep->pps;
+ if (ep->packsize[1] > ep->maxpacksize) {
+ usb_audio_dbg(ep->chip, "Too small maxpacksize %u for rate %u / pps %u\n",
+ ep->maxpacksize, rate, ep->pps);
+ return -EINVAL;
+ }
/* calculate the frequency in 16.16 format */
ep->freqm = ep->freqn;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 243/300] pmdomain: imx: Fix reference count leak in imx_gpc_remove
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 242/300] ALSA: usb-audio: Fix potential overflow of PCM transfer buffer Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 244/300] pmdomain: arm: scmi: Fix genpd leak on provider registration failure Greg Kroah-Hartman
` (62 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miaoqian Lin, Ulf Hansson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
[ Upstream commit bbde14682eba21d86f5f3d6fe2d371b1f97f1e61 ]
of_get_child_by_name() returns a node pointer with refcount incremented, we
should use of_node_put() on it when not needed anymore. Add the missing
of_node_put() to avoid refcount leak.
Fixes: 721cabf6c660 ("soc: imx: move PGC handling to a new GPC driver")
Cc: stable@vger.kernel.org
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ drivers/pmdomain/imx/gpc.c -> drivers/soc/imx/gpc.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/soc/imx/gpc.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/soc/imx/gpc.c
+++ b/drivers/soc/imx/gpc.c
@@ -540,6 +540,8 @@ static int imx_gpc_remove(struct platfor
return ret;
}
+ of_node_put(pgc_node);
+
return 0;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 244/300] pmdomain: arm: scmi: Fix genpd leak on provider registration failure
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 243/300] pmdomain: imx: Fix reference count leak in imx_gpc_remove Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 245/300] ata: libata-scsi: Fix system suspend for a security locked drive Greg Kroah-Hartman
` (61 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sudeep Holla, Peng Fan, Ulf Hansson,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sudeep Holla <sudeep.holla@arm.com>
[ Upstream commit 7458f72cc28f9eb0de811effcb5376d0ec19094a ]
If of_genpd_add_provider_onecell() fails during probe, the previously
created generic power domains are not removed, leading to a memory leak
and potential kernel crash later in genpd_debug_add().
Add proper error handling to unwind the initialized domains before
returning from probe to ensure all resources are correctly released on
failure.
Example crash trace observed without this fix:
| Unable to handle kernel paging request at virtual address fffffffffffffc70
| CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.18.0-rc1 #405 PREEMPT
| Hardware name: ARM LTD ARM Juno Development Platform/ARM Juno Development Platform
| pstate: 00000005 (nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : genpd_debug_add+0x2c/0x160
| lr : genpd_debug_init+0x74/0x98
| Call trace:
| genpd_debug_add+0x2c/0x160 (P)
| genpd_debug_init+0x74/0x98
| do_one_initcall+0xd0/0x2d8
| do_initcall_level+0xa0/0x140
| do_initcalls+0x60/0xa8
| do_basic_setup+0x28/0x40
| kernel_init_freeable+0xe8/0x170
| kernel_init+0x2c/0x140
| ret_from_fork+0x10/0x20
Fixes: 898216c97ed2 ("firmware: arm_scmi: add device power domain support using genpd")
Signed-off-by: Sudeep Holla <sudeep.holla@arm.com>
Reviewed-by: Peng Fan <peng.fan@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
[ drivers/pmdomain/arm/scmi_pm_domain.c -> drivers/firmware/arm_scmi/scmi_pm_domain.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/drivers/firmware/arm_scmi/scmi_pm_domain.c
+++ b/drivers/firmware/arm_scmi/scmi_pm_domain.c
@@ -53,7 +53,7 @@ static int scmi_pd_power_off(struct gene
static int scmi_pm_domain_probe(struct scmi_device *sdev)
{
- int num_domains, i;
+ int num_domains, i, ret;
struct device *dev = &sdev->dev;
struct device_node *np = dev->of_node;
struct scmi_pm_domain *scmi_pd;
@@ -106,9 +106,18 @@ static int scmi_pm_domain_probe(struct s
scmi_pd_data->domains = domains;
scmi_pd_data->num_domains = num_domains;
+ ret = of_genpd_add_provider_onecell(np, scmi_pd_data);
+ if (ret)
+ goto err_rm_genpds;
+
dev_set_drvdata(dev, scmi_pd_data);
- return of_genpd_add_provider_onecell(np, scmi_pd_data);
+ return 0;
+err_rm_genpds:
+ for (i = num_domains - 1; i >= 0; i--)
+ pm_genpd_remove(domains[i]);
+
+ return ret;
}
static void scmi_pm_domain_remove(struct scmi_device *sdev)
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 245/300] ata: libata-scsi: Fix system suspend for a security locked drive
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 244/300] pmdomain: arm: scmi: Fix genpd leak on provider registration failure Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 246/300] mptcp: introduce mptcp_schedule_work Greg Kroah-Hartman
` (60 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilia Baryshnikov, Hannes Reinecke,
Martin K. Petersen, Damien Le Moal, Niklas Cassel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
[ Upstream commit b11890683380a36b8488229f818d5e76e8204587 ]
Commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status
handling") fixed ata_to_sense_error() to properly generate sense key
ABORTED COMMAND (without any additional sense code), instead of the
previous bogus sense key ILLEGAL REQUEST with the additional sense code
UNALIGNED WRITE COMMAND, for a failed command.
However, this broke suspend for Security locked drives (drives that have
Security enabled, and have not been Security unlocked by boot firmware).
The reason for this is that the SCSI disk driver, for the Synchronize
Cache command only, treats any sense data with sense key ILLEGAL REQUEST
as a successful command (regardless of ASC / ASCQ).
After commit cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error()
status handling") the code that treats any sense data with sense key
ILLEGAL REQUEST as a successful command is no longer applicable, so the
command fails, which causes the system suspend to be aborted:
sd 1:0:0:0: PM: dpm_run_callback(): scsi_bus_suspend returns -5
sd 1:0:0:0: PM: failed to suspend async: error -5
PM: Some devices failed to suspend, or early wake event detected
To make suspend work once again, for a Security locked device only,
return sense data LOGICAL UNIT ACCESS NOT AUTHORIZED, the actual sense
data which a real SCSI device would have returned if locked.
The SCSI disk driver treats this sense data as a successful command.
Cc: stable@vger.kernel.org
Reported-by: Ilia Baryshnikov <qwelias@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220704
Fixes: cf3fc037623c ("ata: libata-scsi: Fix ata_to_sense_error() status handling")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Niklas Cassel <cassel@kernel.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 8 ++++++++
include/linux/ata.h | 1 +
2 files changed, 9 insertions(+)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -961,6 +961,14 @@ static void ata_gen_ata_sense(struct ata
ata_scsi_set_sense(dev, cmd, NOT_READY, 0x04, 0x21);
return;
}
+
+ if (ata_id_is_locked(dev->id)) {
+ /* Security locked */
+ /* LOGICAL UNIT ACCESS NOT AUTHORIZED */
+ ata_scsi_set_sense(dev, cmd, DATA_PROTECT, 0x74, 0x71);
+ return;
+ }
+
/* Use ata_to_sense_error() to map status register bits
* onto sense key, asc & ascq.
*/
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -557,6 +557,7 @@ struct ata_bmdma_prd {
#define ata_id_has_ncq(id) ((id)[ATA_ID_SATA_CAPABILITY] & (1 << 8))
#define ata_id_queue_depth(id) (((id)[ATA_ID_QUEUE_DEPTH] & 0x1f) + 1)
#define ata_id_removable(id) ((id)[ATA_ID_CONFIG] & (1 << 7))
+#define ata_id_is_locked(id) (((id)[ATA_ID_DLF] & 0x7) == 0x7)
#define ata_id_has_atapi_AN(id) \
((((id)[ATA_ID_SATA_CAPABILITY] != 0x0000) && \
((id)[ATA_ID_SATA_CAPABILITY] != 0xffff)) && \
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 246/300] mptcp: introduce mptcp_schedule_work
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 245/300] ata: libata-scsi: Fix system suspend for a security locked drive Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 247/300] mptcp: fix race condition in mptcp_schedule_work() Greg Kroah-Hartman
` (59 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit ba8f48f7a4d79352b764ace585b5f602ef940be0 ]
remove some of code duplications an allow preventing
rescheduling on close.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 035bca3f017e ("mptcp: fix race condition in mptcp_schedule_work()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/pm.c | 3 +--
net/mptcp/protocol.c | 36 ++++++++++++++++++++++--------------
net/mptcp/protocol.h | 1 +
3 files changed, 24 insertions(+), 16 deletions(-)
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -89,8 +89,7 @@ static bool mptcp_pm_schedule_work(struc
return false;
msk->pm.status |= BIT(new_status);
- if (schedule_work(&msk->work))
- sock_hold((struct sock *)msk);
+ mptcp_schedule_work((struct sock *)msk);
return true;
}
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -641,9 +641,8 @@ static bool move_skbs_to_msk(struct mptc
* this is not a good place to change state. Let the workqueue
* do it.
*/
- if (mptcp_pending_data_fin(sk, NULL) &&
- schedule_work(&msk->work))
- sock_hold(sk);
+ if (mptcp_pending_data_fin(sk, NULL))
+ mptcp_schedule_work(sk);
}
spin_unlock_bh(&sk->sk_lock.slock);
@@ -715,23 +714,32 @@ static void mptcp_reset_timer(struct soc
sk_reset_timer(sk, &icsk->icsk_retransmit_timer, jiffies + tout);
}
+bool mptcp_schedule_work(struct sock *sk)
+{
+ if (inet_sk_state_load(sk) != TCP_CLOSE &&
+ schedule_work(&mptcp_sk(sk)->work)) {
+ /* each subflow already holds a reference to the sk, and the
+ * workqueue is invoked by a subflow, so sk can't go away here.
+ */
+ sock_hold(sk);
+ return true;
+ }
+ return false;
+}
+
void mptcp_data_acked(struct sock *sk)
{
mptcp_reset_timer(sk);
if ((!test_bit(MPTCP_SEND_SPACE, &mptcp_sk(sk)->flags) ||
- (inet_sk_state_load(sk) != TCP_ESTABLISHED)) &&
- schedule_work(&mptcp_sk(sk)->work))
- sock_hold(sk);
+ (inet_sk_state_load(sk) != TCP_ESTABLISHED)))
+ mptcp_schedule_work(sk);
}
void mptcp_subflow_eof(struct sock *sk)
{
- struct mptcp_sock *msk = mptcp_sk(sk);
-
- if (!test_and_set_bit(MPTCP_WORK_EOF, &msk->flags) &&
- schedule_work(&msk->work))
- sock_hold(sk);
+ if (!test_and_set_bit(MPTCP_WORK_EOF, &mptcp_sk(sk)->flags))
+ mptcp_schedule_work(sk);
}
static void mptcp_check_for_eof(struct mptcp_sock *msk)
@@ -1643,8 +1651,7 @@ static void mptcp_retransmit_handler(str
mptcp_stop_timer(sk);
} else {
set_bit(MPTCP_WORK_RTX, &msk->flags);
- if (schedule_work(&msk->work))
- sock_hold(sk);
+ mptcp_schedule_work(sk);
}
}
@@ -2503,7 +2510,8 @@ static void mptcp_release_cb(struct sock
struct sock *ssk;
ssk = mptcp_subflow_recv_lookup(msk);
- if (!ssk || !schedule_work(&msk->work))
+ if (!ssk || sk->sk_state == TCP_CLOSE ||
+ !schedule_work(&msk->work))
__sock_put(sk);
}
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -410,6 +410,7 @@ static inline bool mptcp_is_fully_establ
void mptcp_rcv_space_init(struct mptcp_sock *msk, const struct sock *ssk);
void mptcp_data_ready(struct sock *sk, struct sock *ssk);
bool mptcp_finish_join(struct sock *sk);
+bool mptcp_schedule_work(struct sock *sk);
void mptcp_data_acked(struct sock *sk);
void mptcp_subflow_eof(struct sock *sk);
bool mptcp_update_rcv_data_fin(struct mptcp_sock *msk, u64 data_fin_seq, bool use_64bit);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 247/300] mptcp: fix race condition in mptcp_schedule_work()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 246/300] mptcp: introduce mptcp_schedule_work Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 248/300] dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups Greg Kroah-Hartman
` (58 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+355158e7e301548a1424,
Eric Dumazet, Matthieu Baerts (NGI0), Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 035bca3f017ee9dea3a5a756e77a6f7138cc6eea ]
syzbot reported use-after-free in mptcp_schedule_work() [1]
Issue here is that mptcp_schedule_work() schedules a work,
then gets a refcount on sk->sk_refcnt if the work was scheduled.
This refcount will be released by mptcp_worker().
[A] if (schedule_work(...)) {
[B] sock_hold(sk);
return true;
}
Problem is that mptcp_worker() can run immediately and complete before [B]
We need instead :
sock_hold(sk);
if (schedule_work(...))
return true;
sock_put(sk);
[1]
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 1 PID: 29 at lib/refcount.c:25 refcount_warn_saturate+0xfa/0x1d0 lib/refcount.c:25
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
sock_hold include/net/sock.h:816 [inline]
mptcp_schedule_work+0x164/0x1a0 net/mptcp/protocol.c:943
mptcp_tout_timer+0x21/0xa0 net/mptcp/protocol.c:2316
call_timer_fn+0x17e/0x5f0 kernel/time/timer.c:1747
expire_timers kernel/time/timer.c:1798 [inline]
__run_timers kernel/time/timer.c:2372 [inline]
__run_timer_base+0x648/0x970 kernel/time/timer.c:2384
run_timer_base kernel/time/timer.c:2393 [inline]
run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2403
handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
run_ktimerd+0xcf/0x190 kernel/softirq.c:1138
smpboot_thread_fn+0x542/0xa60 kernel/smpboot.c:160
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Cc: stable@vger.kernel.org
Fixes: 3b1d6210a957 ("mptcp: implement and use MPTCP-level retransmission")
Reported-by: syzbot+355158e7e301548a1424@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6915b46f.050a0220.3565dc.0028.GAE@google.com/T/#u
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251113103924.3737425-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -716,14 +716,19 @@ static void mptcp_reset_timer(struct soc
bool mptcp_schedule_work(struct sock *sk)
{
- if (inet_sk_state_load(sk) != TCP_CLOSE &&
- schedule_work(&mptcp_sk(sk)->work)) {
- /* each subflow already holds a reference to the sk, and the
- * workqueue is invoked by a subflow, so sk can't go away here.
- */
- sock_hold(sk);
+ if (inet_sk_state_load(sk) == TCP_CLOSE)
+ return false;
+
+ /* Get a reference on this socket, mptcp_worker() will release it.
+ * As mptcp_worker() might complete before us, we can not avoid
+ * a sock_hold()/sock_put() if schedule_work() returns false.
+ */
+ sock_hold(sk);
+
+ if (schedule_work(&mptcp_sk(sk)->work))
return true;
- }
+
+ sock_put(sk);
return false;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 248/300] dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 247/300] mptcp: fix race condition in mptcp_schedule_work() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 249/300] mm/mempool: replace kmap_atomic() with kmap_local_page() Greg Kroah-Hartman
` (57 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Conor Dooley,
Linus Walleij, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 316e361b5d2cdeb8d778983794a1c6eadcb26814 ]
The "groups" property can hold multiple entries (e.g.
toshiba/tmpv7708-rm-mbrc.dts file), so allow that by dropping incorrect
type (pinmux-node.yaml schema already defines that as string-array) and
adding constraints for items. This fixes dtbs_check warnings like:
toshiba/tmpv7708-rm-mbrc.dtb: pinctrl@24190000 (toshiba,tmpv7708-pinctrl):
pwm-pins:groups: ['pwm0_gpio16_grp', 'pwm1_gpio17_grp', 'pwm2_gpio18_grp', 'pwm3_gpio19_grp'] is too long
Fixes: 1825c1fe0057 ("pinctrl: Add DT bindings for Toshiba Visconti TMPV7700 SoC")
Cc: stable@vger.kernel.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
[ adjusted $ref context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 +++++-----
1 file changed, 14 insertions(+), 12 deletions(-)
--- a/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/toshiba,visconti-pinctrl.yaml
@@ -46,18 +46,20 @@ patternProperties:
groups:
description:
Name of the pin group to use for the functions.
- $ref: "/schemas/types.yaml#/definitions/string"
- enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp,
- i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp,
- spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp,
- spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp,
- uart0_grp, uart1_grp, uart2_grp, uart3_grp,
- pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp,
- pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp,
- pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp,
- pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp,
- pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp,
- pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp]
+ items:
+ enum: [i2c0_grp, i2c1_grp, i2c2_grp, i2c3_grp, i2c4_grp,
+ i2c5_grp, i2c6_grp, i2c7_grp, i2c8_grp,
+ spi0_grp, spi0_cs0_grp, spi0_cs1_grp, spi0_cs2_grp,
+ spi1_grp, spi2_grp, spi3_grp, spi4_grp, spi5_grp, spi6_grp,
+ uart0_grp, uart1_grp, uart2_grp, uart3_grp,
+ pwm0_gpio4_grp, pwm0_gpio8_grp, pwm0_gpio12_grp,
+ pwm0_gpio16_grp, pwm1_gpio5_grp, pwm1_gpio9_grp,
+ pwm1_gpio13_grp, pwm1_gpio17_grp, pwm2_gpio6_grp,
+ pwm2_gpio10_grp, pwm2_gpio14_grp, pwm2_gpio18_grp,
+ pwm3_gpio7_grp, pwm3_gpio11_grp, pwm3_gpio15_grp,
+ pwm3_gpio19_grp, pcmif_out_grp, pcmif_in_grp]
+ minItems: 1
+ maxItems: 8
drive-strength:
enum: [2, 4, 6, 8, 16, 24, 32]
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 249/300] mm/mempool: replace kmap_atomic() with kmap_local_page()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 248/300] dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 250/300] mm/mempool: fix poisoning order>0 pages with HIGHMEM Greg Kroah-Hartman
` (56 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio M. De Francesco, Ira Weiny,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Fabio M. De Francesco" <fabio.maria.de.francesco@linux.intel.com>
[ Upstream commit f2bcc99a5e901a13b754648d1dbab60f4adf9375 ]
kmap_atomic() has been deprecated in favor of kmap_local_page().
Therefore, replace kmap_atomic() with kmap_local_page().
kmap_atomic() is implemented like a kmap_local_page() which also disables
page-faults and preemption (the latter only in !PREEMPT_RT kernels). The
kernel virtual addresses returned by these two API are only valid in the
context of the callers (i.e., they cannot be handed to other threads).
With kmap_local_page() the mappings are per thread and CPU local like in
kmap_atomic(); however, they can handle page-faults and can be called from
any context (including interrupts). The tasks that call kmap_local_page()
can be preempted and, when they are scheduled to run again, the kernel
virtual addresses are restored and are still valid.
The code blocks between the mappings and un-mappings don't rely on the
above-mentioned side effects of kmap_atomic(), so that mere replacements
of the old API with the new one is all that they require (i.e., there is
no need to explicitly call pagefault_disable() and/or preempt_disable()).
Link: https://lkml.kernel.org/r/20231120142640.7077-1-fabio.maria.de.francesco@linux.intel.com
Signed-off-by: Fabio M. De Francesco <fabio.maria.de.francesco@linux.intel.com>
Cc: Ira Weiny <ira.weiny@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: ec33b59542d9 ("mm/mempool: fix poisoning order>0 pages with HIGHMEM")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempool.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -63,10 +63,10 @@ static void check_element(mempool_t *poo
} else if (pool->free == mempool_free_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_atomic((struct page *)element);
+ void *addr = kmap_local_page((struct page *)element);
__check_element(pool, addr, 1UL << (PAGE_SHIFT + order));
- kunmap_atomic(addr);
+ kunmap_local(addr);
}
}
@@ -86,10 +86,10 @@ static void poison_element(mempool_t *po
} else if (pool->alloc == mempool_alloc_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_atomic((struct page *)element);
+ void *addr = kmap_local_page((struct page *)element);
__poison_element(addr, 1UL << (PAGE_SHIFT + order));
- kunmap_atomic(addr);
+ kunmap_local(addr);
}
}
#else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 250/300] mm/mempool: fix poisoning order>0 pages with HIGHMEM
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 249/300] mm/mempool: replace kmap_atomic() with kmap_local_page() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 251/300] mptcp: fix a race in mptcp_pm_del_add_timer() Greg Kroah-Hartman
` (55 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Christoph Hellwig,
Vlastimil Babka, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlastimil Babka <vbabka@suse.cz>
[ Upstream commit ec33b59542d96830e3c89845ff833cf7b25ef172 ]
The kernel test has reported:
BUG: unable to handle page fault for address: fffba000
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
*pde = 03171067 *pte = 00000000
Oops: Oops: 0002 [#1]
CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Tainted: G T 6.18.0-rc2-00031-gec7f31b2a2d3 #1 NONE a1d066dfe789f54bc7645c7989957d2bdee593ca
Tainted: [T]=RANDSTRUCT
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
EIP: memset (arch/x86/include/asm/string_32.h:168 arch/x86/lib/memcpy_32.c:17)
Code: a5 8b 4d f4 83 e1 03 74 02 f3 a4 83 c4 04 5e 5f 5d 2e e9 73 41 01 00 90 90 90 3e 8d 74 26 00 55 89 e5 57 56 89 c6 89 d0 89 f7 <f3> aa 89 f0 5e 5f 5d 2e e9 53 41 01 00 cc cc cc 55 89 e5 53 57 56
EAX: 0000006b EBX: 00000015 ECX: 001fefff EDX: 0000006b
ESI: fffb9000 EDI: fffba000 EBP: c611fbf0 ESP: c611fbe8
DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068 EFLAGS: 00010287
CR0: 80050033 CR2: fffba000 CR3: 0316e000 CR4: 00040690
Call Trace:
poison_element (mm/mempool.c:83 mm/mempool.c:102)
mempool_init_node (mm/mempool.c:142 mm/mempool.c:226)
mempool_init_noprof (mm/mempool.c:250 (discriminator 1))
? mempool_alloc_pages (mm/mempool.c:640)
bio_integrity_initfn (block/bio-integrity.c:483 (discriminator 8))
? mempool_alloc_pages (mm/mempool.c:640)
do_one_initcall (init/main.c:1283)
Christoph found out this is due to the poisoning code not dealing
properly with CONFIG_HIGHMEM because only the first page is mapped but
then the whole potentially high-order page is accessed.
We could give up on HIGHMEM here, but it's straightforward to fix this
with a loop that's mapping, poisoning or checking and unmapping
individual pages.
Reported-by: kernel test robot <oliver.sang@intel.com>
Closes: https://lore.kernel.org/oe-lkp/202511111411.9ebfa1ba-lkp@intel.com
Analyzed-by: Christoph Hellwig <hch@lst.de>
Fixes: bdfedb76f4f5 ("mm, mempool: poison elements backed by slab allocator")
Cc: stable@vger.kernel.org
Tested-by: kernel test robot <oliver.sang@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://patch.msgid.link/20251113-mempool-poison-v1-1-233b3ef984c3@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/mempool.c | 32 ++++++++++++++++++++++++++------
1 file changed, 26 insertions(+), 6 deletions(-)
--- a/mm/mempool.c
+++ b/mm/mempool.c
@@ -63,10 +63,20 @@ static void check_element(mempool_t *poo
} else if (pool->free == mempool_free_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_local_page((struct page *)element);
- __check_element(pool, addr, 1UL << (PAGE_SHIFT + order));
- kunmap_local(addr);
+#ifdef CONFIG_HIGHMEM
+ for (int i = 0; i < (1 << order); i++) {
+ struct page *page = (struct page *)element;
+ void *addr = kmap_local_page(page + i);
+
+ __check_element(pool, addr, PAGE_SIZE);
+ kunmap_local(addr);
+ }
+#else
+ void *addr = page_address((struct page *)element);
+
+ __check_element(pool, addr, PAGE_SIZE << order);
+#endif
}
}
@@ -86,10 +96,20 @@ static void poison_element(mempool_t *po
} else if (pool->alloc == mempool_alloc_pages) {
/* Mempools backed by page allocator */
int order = (int)(long)pool->pool_data;
- void *addr = kmap_local_page((struct page *)element);
- __poison_element(addr, 1UL << (PAGE_SHIFT + order));
- kunmap_local(addr);
+#ifdef CONFIG_HIGHMEM
+ for (int i = 0; i < (1 << order); i++) {
+ struct page *page = (struct page *)element;
+ void *addr = kmap_local_page(page + i);
+
+ __poison_element(addr, PAGE_SIZE);
+ kunmap_local(addr);
+ }
+#else
+ void *addr = page_address((struct page *)element);
+
+ __poison_element(addr, PAGE_SIZE << order);
+#endif
}
}
#else /* CONFIG_DEBUG_SLAB || CONFIG_SLUB_DEBUG_ON */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 251/300] mptcp: fix a race in mptcp_pm_del_add_timer()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 250/300] mm/mempool: fix poisoning order>0 pages with HIGHMEM Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 252/300] mptcp: do not fallback when OoO is present Greg Kroah-Hartman
` (54 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+2a6fbf0f0530375968df,
Eric Dumazet, Geliang Tang, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 426358d9be7ce3518966422f87b96f1bad27295f ]
mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)
while another might have free entry already, as reported by syzbot.
Add RCU protection to fix this issue.
Also change confusing add_timer variable with stop_timer boolean.
syzbot report:
BUG: KASAN: slab-use-after-free in __timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616
Read of size 4 at addr ffff8880311e4150 by task kworker/1:1/44
CPU: 1 UID: 0 PID: 44 Comm: kworker/1:1 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Workqueue: events mptcp_worker
Call Trace:
<TASK>
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
__timer_delete_sync+0x372/0x3f0 kernel/time/timer.c:1616
sk_stop_timer_sync+0x1b/0x90 net/core/sock.c:3631
mptcp_pm_del_add_timer+0x283/0x310 net/mptcp/pm.c:362
mptcp_incoming_options+0x1357/0x1f60 net/mptcp/options.c:1174
tcp_data_queue+0xca/0x6450 net/ipv4/tcp_input.c:5361
tcp_rcv_established+0x1335/0x2670 net/ipv4/tcp_input.c:6441
tcp_v4_do_rcv+0x98b/0xbf0 net/ipv4/tcp_ipv4.c:1931
tcp_v4_rcv+0x252a/0x2dc0 net/ipv4/tcp_ipv4.c:2374
ip_protocol_deliver_rcu+0x221/0x440 net/ipv4/ip_input.c:205
ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:239
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
NF_HOOK+0x30c/0x3a0 include/linux/netfilter.h:318
__netif_receive_skb_one_core net/core/dev.c:6079 [inline]
__netif_receive_skb+0x143/0x380 net/core/dev.c:6192
process_backlog+0x31e/0x900 net/core/dev.c:6544
__napi_poll+0xb6/0x540 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x5f7/0xda0 net/core/dev.c:7784
handle_softirqs+0x22f/0x710 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
__local_bh_enable_ip+0x1a0/0x2e0 kernel/softirq.c:302
mptcp_pm_send_ack net/mptcp/pm.c:210 [inline]
mptcp_pm_addr_send_ack+0x41f/0x500 net/mptcp/pm.c:-1
mptcp_pm_worker+0x174/0x320 net/mptcp/pm.c:1002
mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 44:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417
kasan_kmalloc include/linux/kasan.h:262 [inline]
__kmalloc_cache_noprof+0x1ef/0x6c0 mm/slub.c:5748
kmalloc_noprof include/linux/slab.h:957 [inline]
mptcp_pm_alloc_anno_list+0x104/0x460 net/mptcp/pm.c:385
mptcp_pm_create_subflow_or_signal_addr+0xf9d/0x1360 net/mptcp/pm_kernel.c:355
mptcp_pm_nl_fully_established net/mptcp/pm_kernel.c:409 [inline]
__mptcp_pm_kernel_worker+0x417/0x1ef0 net/mptcp/pm_kernel.c:1529
mptcp_pm_worker+0x1ee/0x320 net/mptcp/pm.c:1008
mptcp_worker+0xd5/0x1170 net/mptcp/protocol.c:2762
process_one_work kernel/workqueue.c:3263 [inline]
process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346
worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427
kthread+0x711/0x8a0 kernel/kthread.c:463
ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6630:
kasan_save_stack mm/kasan/common.c:56 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:77
__kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2523 [inline]
slab_free mm/slub.c:6611 [inline]
kfree+0x197/0x950 mm/slub.c:6818
mptcp_remove_anno_list_by_saddr+0x2d/0x40 net/mptcp/pm.c:158
mptcp_pm_flush_addrs_and_subflows net/mptcp/pm_kernel.c:1209 [inline]
mptcp_nl_flush_addrs_list net/mptcp/pm_kernel.c:1240 [inline]
mptcp_pm_nl_flush_addrs_doit+0x593/0xbb0 net/mptcp/pm_kernel.c:1281
genl_family_rcv_msg_doit+0x215/0x300 net/netlink/genetlink.c:1115
genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]
genl_rcv_msg+0x60e/0x790 net/netlink/genetlink.c:1210
netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x846/0xa10 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x21c/0x270 net/socket.c:742
____sys_sendmsg+0x508/0x820 net/socket.c:2630
___sys_sendmsg+0x21f/0x2a0 net/socket.c:2684
__sys_sendmsg net/socket.c:2716 [inline]
__do_sys_sendmsg net/socket.c:2721 [inline]
__se_sys_sendmsg net/socket.c:2719 [inline]
__x64_sys_sendmsg+0x1a1/0x260 net/socket.c:2719
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Cc: stable@vger.kernel.org
Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
Reported-by: syzbot+2a6fbf0f0530375968df@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/691ad3c3.a70a0220.f6df1.0004.GAE@google.com
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Geliang Tang <geliang@kernel.org>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251117100745.1913963-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ applied changes to pm_netlink.c instead of pm.c ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/pm_netlink.c | 20 +++++++++++++-------
1 file changed, 13 insertions(+), 7 deletions(-)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -34,6 +34,7 @@ struct mptcp_pm_add_entry {
struct timer_list add_timer;
struct mptcp_sock *sock;
u8 retrans_times;
+ struct rcu_head rcu;
};
struct pm_nl_pernet {
@@ -253,22 +254,27 @@ mptcp_pm_del_add_timer(struct mptcp_sock
{
struct mptcp_pm_add_entry *entry;
struct sock *sk = (struct sock *)msk;
- struct timer_list *add_timer = NULL;
+ bool stop_timer = false;
+
+ rcu_read_lock();
spin_lock_bh(&msk->pm.lock);
entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
if (entry && (!check_id || entry->addr.id == addr->id)) {
entry->retrans_times = ADD_ADDR_RETRANS_MAX;
- add_timer = &entry->add_timer;
+ stop_timer = true;
}
if (!check_id && entry)
list_del(&entry->list);
spin_unlock_bh(&msk->pm.lock);
- /* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */
- if (add_timer)
- sk_stop_timer_sync(sk, add_timer);
+ /* Note: entry might have been removed by another thread.
+ * We hold rcu_read_lock() to ensure it is not freed under us.
+ */
+ if (stop_timer)
+ sk_stop_timer_sync(sk, &entry->add_timer);
+ rcu_read_unlock();
return entry;
}
@@ -311,7 +317,7 @@ void mptcp_pm_free_anno_list(struct mptc
list_for_each_entry_safe(entry, tmp, &free_list, list) {
sk_stop_timer_sync(sk, &entry->add_timer);
- kfree(entry);
+ kfree_rcu(entry, rcu);
}
}
@@ -772,7 +778,7 @@ static bool remove_anno_list_by_saddr(st
entry = mptcp_pm_del_add_timer(msk, addr, false);
if (entry) {
- kfree(entry);
+ kfree_rcu(entry, rcu);
return true;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 252/300] mptcp: do not fallback when OoO is present
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 251/300] mptcp: fix a race in mptcp_pm_del_add_timer() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 253/300] usb: deprecate the third argument of usb_maxpacket() Greg Kroah-Hartman
` (53 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts (NGI0),
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 1bba3f219c5e8c29e63afa3c1fc24f875ebec119 ]
In case of DSS corruption, the MPTCP protocol tries to avoid the subflow
reset if fallback is possible. Such corruptions happen in the receive
path; to ensure fallback is possible the stack additionally needs to
check for OoO data, otherwise the fallback will break the data stream.
Fixes: e32d262c89e2 ("mptcp: handle consistently DSS corruption")
Cc: stable@vger.kernel.org
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/598
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20251118-net-mptcp-misc-fixes-6-18-rc6-v1-4-806d3781c95f@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[ patch mptcp_dss_corruption() ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -477,6 +477,15 @@ static void mptcp_check_data_fin(struct
static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk)
{
if (READ_ONCE(msk->allow_infinite_fallback)) {
+ /* The caller possibly is not holding the msk socket lock, but
+ * in the fallback case only the current subflow is touching
+ * the OoO queue.
+ */
+ if (!RB_EMPTY_ROOT(&msk->out_of_order_queue)) {
+ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET);
+ mptcp_subflow_reset(ssk);
+ return;
+ }
MPTCP_INC_STATS(sock_net(ssk),
MPTCP_MIB_DSSCORRUPTIONFALLBACK);
mptcp_do_fallback(ssk);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 253/300] usb: deprecate the third argument of usb_maxpacket()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 252/300] mptcp: do not fallback when OoO is present Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 254/300] Input: remove " Greg Kroah-Hartman
` (52 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vincent Mailhol, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
[ Upstream commit 0f08c2e7458e25c967d844170f8ad1aac3b57a02 ]
This is a transitional patch with the ultimate goal of changing the
prototype of usb_maxpacket() from:
| static inline __u16
| usb_maxpacket(struct usb_device *udev, int pipe, int is_out)
into:
| static inline u16 usb_maxpacket(struct usb_device *udev, int pipe)
The third argument of usb_maxpacket(): is_out gets removed because it
can be derived from its second argument: pipe using
usb_pipeout(pipe). Furthermore, in the current version,
ubs_pipeout(pipe) is called regardless in order to sanitize the is_out
parameter.
In order to make a smooth change, we first deprecate the is_out
parameter by simply ignoring it (using a variadic function) and will
remove it later, once all the callers get updated.
The body of the function is reworked accordingly and is_out is
replaced by usb_pipeout(pipe). The WARN_ON() calls become unnecessary
and get removed.
Finally, the return type is changed from __u16 to u16 because this is
not a UAPI function.
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://lore.kernel.org/r/20220317035514.6378-2-mailhol.vincent@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 69aeb5073123 ("Input: pegasus-notetaker - fix potential out-of-bounds access")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/usb.h | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1980,21 +1980,17 @@ usb_pipe_endpoint(struct usb_device *dev
return eps[usb_pipeendpoint(pipe)];
}
-/*-------------------------------------------------------------------------*/
-
-static inline __u16
-usb_maxpacket(struct usb_device *udev, int pipe, int is_out)
+static inline u16 usb_maxpacket(struct usb_device *udev, int pipe,
+ /* int is_out deprecated */ ...)
{
struct usb_host_endpoint *ep;
unsigned epnum = usb_pipeendpoint(pipe);
- if (is_out) {
- WARN_ON(usb_pipein(pipe));
+ if (usb_pipeout(pipe))
ep = udev->ep_out[epnum];
- } else {
- WARN_ON(usb_pipeout(pipe));
+ else
ep = udev->ep_in[epnum];
- }
+
if (!ep)
return 0;
@@ -2002,8 +1998,6 @@ usb_maxpacket(struct usb_device *udev, i
return usb_endpoint_maxp(&ep->desc);
}
-/* ----------------------------------------------------------------------- */
-
/* translate USB error codes to codes user space understands */
static inline int usb_translate_errors(int error_code)
{
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 254/300] Input: remove third argument of usb_maxpacket()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 253/300] usb: deprecate the third argument of usb_maxpacket() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 255/300] Input: pegasus-notetaker - fix potential out-of-bounds access Greg Kroah-Hartman
` (51 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjala, Dmitry Torokhov,
Henk Vergonet, Vincent Mailhol, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
[ Upstream commit 948bf187694fc1f4c20cf972fa18b1a6fb3d7603 ]
The third argument of usb_maxpacket(): in_out has been deprecated
because it could be derived from the second argument (e.g. using
usb_pipeout(pipe)).
N.B. function usb_maxpacket() was made variadic to accommodate the
transition from the old prototype with three arguments to the new one
with only two arguments (so that no renaming is needed). The variadic
argument is to be removed once all users of usb_maxpacket() get
migrated.
CC: Ville Syrjala <syrjala@sci.fi>
CC: Dmitry Torokhov <dmitry.torokhov@gmail.com>
CC: Henk Vergonet <Henk.Vergonet@gmail.com>
Signed-off-by: Vincent Mailhol <mailhol.vincent@wanadoo.fr>
Link: https://lore.kernel.org/r/20220317035514.6378-4-mailhol.vincent@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 69aeb5073123 ("Input: pegasus-notetaker - fix potential out-of-bounds access")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/ati_remote2.c | 2 +-
drivers/input/misc/cm109.c | 2 +-
drivers/input/misc/powermate.c | 2 +-
drivers/input/misc/yealink.c | 2 +-
drivers/input/tablet/acecad.c | 2 +-
drivers/input/tablet/pegasus_notetaker.c | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/input/misc/ati_remote2.c
+++ b/drivers/input/misc/ati_remote2.c
@@ -639,7 +639,7 @@ static int ati_remote2_urb_init(struct a
return -ENOMEM;
pipe = usb_rcvintpipe(udev, ar2->ep[i]->bEndpointAddress);
- maxp = usb_maxpacket(udev, pipe, usb_pipeout(pipe));
+ maxp = usb_maxpacket(udev, pipe);
maxp = maxp > 4 ? 4 : maxp;
usb_fill_int_urb(ar2->urb[i], udev, pipe, ar2->buf[i], maxp,
--- a/drivers/input/misc/cm109.c
+++ b/drivers/input/misc/cm109.c
@@ -745,7 +745,7 @@ static int cm109_usb_probe(struct usb_in
/* get a handle to the interrupt data pipe */
pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
- ret = usb_maxpacket(udev, pipe, usb_pipeout(pipe));
+ ret = usb_maxpacket(udev, pipe);
if (ret != USB_PKT_LEN)
dev_err(&intf->dev, "invalid payload size %d, expected %d\n",
ret, USB_PKT_LEN);
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -374,7 +374,7 @@ static int powermate_probe(struct usb_in
/* get a handle to the interrupt data pipe */
pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
- maxp = usb_maxpacket(udev, pipe, usb_pipeout(pipe));
+ maxp = usb_maxpacket(udev, pipe);
if (maxp < POWERMATE_PAYLOAD_SIZE_MIN || maxp > POWERMATE_PAYLOAD_SIZE_MAX) {
printk(KERN_WARNING "powermate: Expected payload of %d--%d bytes, found %d bytes!\n",
--- a/drivers/input/misc/yealink.c
+++ b/drivers/input/misc/yealink.c
@@ -905,7 +905,7 @@ static int usb_probe(struct usb_interfac
/* get a handle to the interrupt data pipe */
pipe = usb_rcvintpipe(udev, endpoint->bEndpointAddress);
- ret = usb_maxpacket(udev, pipe, usb_pipeout(pipe));
+ ret = usb_maxpacket(udev, pipe);
if (ret != USB_PKT_LEN)
dev_err(&intf->dev, "invalid payload size %d, expected %zd\n",
ret, USB_PKT_LEN);
--- a/drivers/input/tablet/acecad.c
+++ b/drivers/input/tablet/acecad.c
@@ -130,7 +130,7 @@ static int usb_acecad_probe(struct usb_i
return -ENODEV;
pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
- maxp = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
+ maxp = usb_maxpacket(dev, pipe);
acecad = kzalloc(sizeof(struct usb_acecad), GFP_KERNEL);
input_dev = input_allocate_device();
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -296,7 +296,7 @@ static int pegasus_probe(struct usb_inte
pegasus->intf = intf;
pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
- pegasus->data_len = usb_maxpacket(dev, pipe, usb_pipeout(pipe));
+ pegasus->data_len = usb_maxpacket(dev, pipe);
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
&pegasus->data_dma);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 255/300] Input: pegasus-notetaker - fix potential out-of-bounds access
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 254/300] Input: remove " Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 256/300] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers Greg Kroah-Hartman
` (50 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Dmitry Torokhov,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 69aeb507312306f73495598a055293fa749d454e ]
In the pegasus_notetaker driver, the pegasus_probe() function allocates
the URB transfer buffer using the wMaxPacketSize value from
the endpoint descriptor. An attacker can use a malicious USB descriptor
to force the allocation of a very small buffer.
Subsequently, if the device sends an interrupt packet with a specific
pattern (e.g., where the first byte is 0x80 or 0x42),
the pegasus_parse_packet() function parses the packet without checking
the allocated buffer size. This leads to an out-of-bounds memory access.
Fixes: 1afca2b66aac ("Input: add Pegasus Notetaker tablet driver")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Link: https://lore.kernel.org/r/20251007214131.3737115-2-eeodqql09@gmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/tablet/pegasus_notetaker.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/input/tablet/pegasus_notetaker.c
+++ b/drivers/input/tablet/pegasus_notetaker.c
@@ -63,6 +63,9 @@
#define BUTTON_PRESSED 0xb5
#define COMMAND_VERSION 0xa9
+/* 1 Status + 1 Color + 2 X + 2 Y = 6 bytes */
+#define NOTETAKER_PACKET_SIZE 6
+
/* in xy data packet */
#define BATTERY_NO_REPORT 0x40
#define BATTERY_LOW 0x41
@@ -297,6 +300,12 @@ static int pegasus_probe(struct usb_inte
pipe = usb_rcvintpipe(dev, endpoint->bEndpointAddress);
pegasus->data_len = usb_maxpacket(dev, pipe);
+ if (pegasus->data_len < NOTETAKER_PACKET_SIZE) {
+ dev_err(&intf->dev, "packet size is too small (%d)\n",
+ pegasus->data_len);
+ error = -EINVAL;
+ goto err_free_mem;
+ }
pegasus->data = usb_alloc_coherent(dev, pegasus->data_len, GFP_KERNEL,
&pegasus->data_dma);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 256/300] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 255/300] Input: pegasus-notetaker - fix potential out-of-bounds access Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 257/300] Bluetooth: SMP: Fix not generating mackey and ltk when repairing Greg Kroah-Hartman
` (49 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Seungjin Bae, Jimmy Assarsson,
Marc Kleine-Budde, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Seungjin Bae <eeodqql09@gmail.com>
[ Upstream commit 0c73772cd2b8cc108d5f5334de89ad648d89b9ec ]
The `kvaser_usb_leaf_wait_cmd()` and `kvaser_usb_leaf_read_bulk_callback`
functions contain logic to zero-length commands. These commands are used
to align data to the USB endpoint's wMaxPacketSize boundary.
The driver attempts to skip these placeholders by aligning the buffer
position `pos` to the next packet boundary using `round_up()` function.
However, if zero-length command is found exactly on a packet boundary
(i.e., `pos` is a multiple of wMaxPacketSize, including 0), `round_up`
function will return the unchanged value of `pos`. This prevents `pos`
to be increased, causing an infinite loop in the parsing logic.
This patch fixes this in the function by using `pos + 1` instead.
This ensures that even if `pos` is on a boundary, the calculation is
based on `pos + 1`, forcing `round_up()` to always return the next
aligned boundary.
Fixes: 7259124eac7d ("can: kvaser_usb: Split driver into kvaser_usb_core.c and kvaser_usb_leaf.c")
Signed-off-by: Seungjin Bae <eeodqql09@gmail.com>
Reviewed-by: Jimmy Assarsson <extja@kvaser.com>
Tested-by: Jimmy Assarsson <extja@kvaser.com>
Link: https://patch.msgid.link/20251023162709.348240-1-eeodqql09@gmail.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
index f06d63db9077b..df0460e3633c5 100644
--- a/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
+++ b/drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c
@@ -609,7 +609,7 @@ static int kvaser_usb_leaf_wait_cmd(const struct kvaser_usb *dev, u8 id,
* for further details.
*/
if (tmp->len == 0) {
- pos = round_up(pos,
+ pos = round_up(pos + 1,
le16_to_cpu
(dev->bulk_in->wMaxPacketSize));
continue;
@@ -1571,7 +1571,7 @@ static void kvaser_usb_leaf_read_bulk_callback(struct kvaser_usb *dev,
* number of events in case of a heavy rx load on the bus.
*/
if (cmd->len == 0) {
- pos = round_up(pos, le16_to_cpu
+ pos = round_up(pos + 1, le16_to_cpu
(dev->bulk_in->wMaxPacketSize));
continue;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 257/300] Bluetooth: SMP: Fix not generating mackey and ltk when repairing
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 256/300] can: kvaser_usb: leaf: Fix potential infinite loop in command parsers Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 258/300] net: aquantia: Add missing descriptor cache invalidation on ATL2 Greg Kroah-Hartman
` (48 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 545d7827b2cd5de5eb85580cebeda6b35b3ff443 ]
The change eed467b517e8 ("Bluetooth: fix passkey uninitialized when used")
introduced a goto that bypasses the creation of temporary mackey and ltk
which are later used by the likes of DHKey Check step.
Later ffee202a78c2 ("Bluetooth: Always request for user confirmation for
Just Works (LE SC)") which means confirm_hint is always set in case
JUST_WORKS so the branch checking for an existing LTK becomes pointless
as confirm_hint will always be set, so this just merge both cases of
malicious or legitimate devices to be confirmed before continuing with the
pairing procedure.
Link: https://github.com/bluez/bluez/issues/1622
Fixes: eed467b517e8 ("Bluetooth: fix passkey uninitialized when used")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/smp.c | 31 +++++++------------------------
1 file changed, 7 insertions(+), 24 deletions(-)
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index fc896d39a6d95..79550d115364e 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -2131,7 +2131,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
struct smp_chan *smp = chan->data;
struct hci_conn *hcon = conn->hcon;
u8 *pkax, *pkbx, *na, *nb, confirm_hint;
- u32 passkey;
+ u32 passkey = 0;
int err;
bt_dev_dbg(hcon->hdev, "conn %p", conn);
@@ -2183,24 +2183,6 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd),
smp->prnd);
SMP_ALLOW_CMD(smp, SMP_CMD_DHKEY_CHECK);
-
- /* Only Just-Works pairing requires extra checks */
- if (smp->method != JUST_WORKS)
- goto mackey_and_ltk;
-
- /* If there already exists long term key in local host, leave
- * the decision to user space since the remote device could
- * be legitimate or malicious.
- */
- if (hci_find_ltk(hcon->hdev, &hcon->dst, hcon->dst_type,
- hcon->role)) {
- /* Set passkey to 0. The value can be any number since
- * it'll be ignored anyway.
- */
- passkey = 0;
- confirm_hint = 1;
- goto confirm;
- }
}
mackey_and_ltk:
@@ -2221,11 +2203,12 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
if (err)
return SMP_UNSPECIFIED;
- confirm_hint = 0;
-
-confirm:
- if (smp->method == JUST_WORKS)
- confirm_hint = 1;
+ /* Always require user confirmation for Just-Works pairing to prevent
+ * impersonation attacks, or in case of a legitimate device that is
+ * repairing use the confirmation as acknowledgment to proceed with the
+ * creation of new keys.
+ */
+ confirm_hint = smp->method == JUST_WORKS ? 1 : 0;
err = mgmt_user_confirm_request(hcon->hdev, &hcon->dst, hcon->type,
hcon->dst_type, passkey, confirm_hint);
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 258/300] net: aquantia: Add missing descriptor cache invalidation on ATL2
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 257/300] Bluetooth: SMP: Fix not generating mackey and ltk when repairing Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 259/300] net/mlx5e: Fix validation logic in rate limiting Greg Kroah-Hartman
` (47 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carol Soto, Kai-Heng Feng,
Simon Horman, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <kaihengf@nvidia.com>
[ Upstream commit 7526183cfdbe352c51c285762f0e15b7c428ea06 ]
ATL2 hardware was missing descriptor cache invalidation in hw_stop(),
causing SMMU translation faults during device shutdown and module removal:
[ 70.355743] arm-smmu-v3 arm-smmu-v3.5.auto: event 0x10 received:
[ 70.361893] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0002060000000010
[ 70.367948] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000020000000000
[ 70.374002] arm-smmu-v3 arm-smmu-v3.5.auto: 0x00000000ff9bc000
[ 70.380055] arm-smmu-v3 arm-smmu-v3.5.auto: 0x0000000000000000
[ 70.386109] arm-smmu-v3 arm-smmu-v3.5.auto: event: F_TRANSLATION client: 0001:06:00.0 sid: 0x20600 ssid: 0x0 iova: 0xff9bc000 ipa: 0x0
[ 70.398531] arm-smmu-v3 arm-smmu-v3.5.auto: unpriv data write s1 "Input address caused fault" stag: 0x0
Commit 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after
driver unbind") and commit ed4d81c4b3f2 ("net: aquantia: when cleaning
hw cache it should be toggled") fixed cache invalidation for ATL B0, but
ATL2 was left with only interrupt disabling. This allowed hardware to
write to cached descriptors after DMA memory was unmapped, triggering
SMMU faults. Once cache invalidation is applied to ATL2, the translation
fault can't be observed anymore.
Add shared aq_hw_invalidate_descriptor_cache() helper and use it in both
ATL B0 and ATL2 hw_stop() implementations for consistent behavior.
Fixes: e54dcf4bba3e ("net: atlantic: basic A2 init/deinit hw_ops")
Tested-by: Carol Soto <csoto@nvidia.com>
Signed-off-by: Kai-Heng Feng <kaihengf@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251120041537.62184-1-kaihengf@nvidia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/aquantia/atlantic/aq_hw_utils.c | 22 +++++++++++++++++++
.../ethernet/aquantia/atlantic/aq_hw_utils.h | 1 +
.../aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +---------------
.../aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +-
4 files changed, 25 insertions(+), 19 deletions(-)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
index 1921741f7311d..18b08277d2e1a 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.c
@@ -15,6 +15,7 @@
#include "aq_hw.h"
#include "aq_nic.h"
+#include "hw_atl/hw_atl_llh.h"
void aq_hw_write_reg_bit(struct aq_hw_s *aq_hw, u32 addr, u32 msk,
u32 shift, u32 val)
@@ -81,6 +82,27 @@ void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value)
lo_hi_writeq(value, hw->mmio + reg);
}
+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw)
+{
+ int err;
+ u32 val;
+
+ /* Invalidate Descriptor Cache to prevent writing to the cached
+ * descriptors and to the data pointer of those descriptors
+ */
+ hw_atl_rdm_rx_dma_desc_cache_init_tgl(hw);
+
+ err = aq_hw_err_from_flags(hw);
+ if (err)
+ goto err_exit;
+
+ readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
+ hw, val, val == 1, 1000U, 10000U);
+
+err_exit:
+ return err;
+}
+
int aq_hw_err_from_flags(struct aq_hw_s *hw)
{
int err = 0;
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
index ffa6e4067c211..d89c63d88e4a4 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw_utils.h
@@ -35,6 +35,7 @@ u32 aq_hw_read_reg(struct aq_hw_s *hw, u32 reg);
void aq_hw_write_reg(struct aq_hw_s *hw, u32 reg, u32 value);
u64 aq_hw_read_reg64(struct aq_hw_s *hw, u32 reg);
void aq_hw_write_reg64(struct aq_hw_s *hw, u32 reg, u64 value);
+int aq_hw_invalidate_descriptor_cache(struct aq_hw_s *hw);
int aq_hw_err_from_flags(struct aq_hw_s *hw);
int aq_hw_num_tcs(struct aq_hw_s *hw);
int aq_hw_q_per_tc(struct aq_hw_s *hw);
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
index 45c17c585d743..2236bc9ba54d2 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
@@ -1198,26 +1198,9 @@ static int hw_atl_b0_hw_interrupt_moderation_set(struct aq_hw_s *self)
static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
{
- int err;
- u32 val;
-
hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
- /* Invalidate Descriptor Cache to prevent writing to the cached
- * descriptors and to the data pointer of those descriptors
- */
- hw_atl_rdm_rx_dma_desc_cache_init_tgl(self);
-
- err = aq_hw_err_from_flags(self);
-
- if (err)
- goto err_exit;
-
- readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
- self, val, val == 1, 1000U, 10000U);
-
-err_exit:
- return err;
+ return aq_hw_invalidate_descriptor_cache(self);
}
int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self, struct aq_ring_s *ring)
diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
index c76ccdc77ba60..98d4ba879dd08 100644
--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
+++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c
@@ -759,7 +759,7 @@ static int hw_atl2_hw_stop(struct aq_hw_s *self)
{
hw_atl_b0_hw_irq_disable(self, HW_ATL2_INT_MASK);
- return 0;
+ return aq_hw_invalidate_descriptor_cache(self);
}
static struct aq_stats_s *hw_atl2_utils_get_hw_stats(struct aq_hw_s *self)
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 259/300] net/mlx5e: Fix validation logic in rate limiting
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 258/300] net: aquantia: Add missing descriptor cache invalidation on ATL2 Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 260/300] net: sxgbe: fix potential NULL dereference in sxgbe_rx() Greg Kroah-Hartman
` (46 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Danielle Costantino, Gal Pressman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Danielle Costantino <dcostantino@meta.com>
[ Upstream commit d2099d9f16dbfa1c5266d4230ff7860047bb0b68 ]
The rate limiting validation condition currently checks the output
variable max_bw_value[i] instead of the input value
maxrate->tc_maxrate[i]. This causes the validation to compare an
uninitialized or stale value rather than the actual requested rate.
The condition should check the input rate to properly validate against
the upper limit:
} else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {
This aligns with the pattern used in the first branch, which correctly
checks maxrate->tc_maxrate[i] against upper_limit_mbps.
The current implementation can lead to unreliable validation behavior:
- For rates between 25.5 Gbps and 255 Gbps, if max_bw_value[i] is 0
from initialization, the GBPS path may be taken regardless of whether
the actual rate is within bounds
- When processing multiple TCs (i > 0), max_bw_value[i] contains the
value computed for the previous TC, affecting the validation logic
- The overflow check for rates exceeding 255 Gbps may not trigger
consistently depending on previous array values
This patch ensures the validation correctly examines the requested rate
value for proper bounds checking.
Fixes: 43b27d1bd88a ("net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps")
Signed-off-by: Danielle Costantino <dcostantino@meta.com>
Reviewed-by: Gal Pressman <gal@nvidia.com>
Link: https://patch.msgid.link/20251124180043.2314428-1-dcostantino@meta.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 5c48a4872f35d..5d0be9703a48e 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -606,7 +606,7 @@ static int mlx5e_dcbnl_ieee_setmaxrate(struct net_device *netdev,
MLX5E_100MB);
max_bw_value[i] = max_bw_value[i] ? max_bw_value[i] : 1;
max_bw_unit[i] = MLX5_100_MBPS_UNIT;
- } else if (max_bw_value[i] <= upper_limit_gbps) {
+ } else if (maxrate->tc_maxrate[i] <= upper_limit_gbps) {
max_bw_value[i] = div_u64(maxrate->tc_maxrate[i],
MLX5E_1GB);
max_bw_unit[i] = MLX5_GBPS_UNIT;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 260/300] net: sxgbe: fix potential NULL dereference in sxgbe_rx()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 259/300] net/mlx5e: Fix validation logic in rate limiting Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 261/300] net: atlantic: fix fragment overflow handling in RX path Greg Kroah-Hartman
` (45 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexey Kodanev, Simon Horman,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
[ Upstream commit f5bce28f6b9125502abec4a67d68eabcd24b3b17 ]
Currently, when skb is null, the driver prints an error and then
dereferences skb on the next line.
To fix this, let's add a 'break' after the error message to switch
to sxgbe_rx_refill(), which is similar to the approach taken by the
other drivers in this particular case, e.g. calxeda with xgmac_rx().
Found during a code review.
Fixes: 1edb9ca69e8a ("net: sxgbe: add basic framework for Samsung 10Gb ethernet driver")
Signed-off-by: Alexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251121123834.97748-1-aleksei.kodanev@bell-sw.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index b1dd6189638b3..9c745d48f54b0 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -1518,8 +1518,10 @@ static int sxgbe_rx(struct sxgbe_priv_data *priv, int limit)
skb = priv->rxq[qnum]->rx_skbuff[entry];
- if (unlikely(!skb))
+ if (unlikely(!skb)) {
netdev_err(priv->dev, "rx descriptor is not consistent\n");
+ break;
+ }
prefetch(skb->data - NET_IP_ALIGN);
priv->rxq[qnum]->rx_skbuff[entry] = NULL;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 261/300] net: atlantic: fix fragment overflow handling in RX path
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 260/300] net: sxgbe: fix potential NULL dereference in sxgbe_rx() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 262/300] mailbox: mailbox-test: Fix debugfs_create_dir error checking Greg Kroah-Hartman
` (44 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiefeng Zhang, Jakub Kicinski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
[ Upstream commit 5ffcb7b890f61541201461580bb6622ace405aec ]
The atlantic driver can receive packets with more than MAX_SKB_FRAGS (17)
fragments when handling large multi-descriptor packets. This causes an
out-of-bounds write in skb_add_rx_frag_netmem() leading to kernel panic.
The issue occurs because the driver doesn't check the total number of
fragments before calling skb_add_rx_frag(). When a packet requires more
than MAX_SKB_FRAGS fragments, the fragment index exceeds the array bounds.
Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,
then all fragments are accounted for. And reusing the existing check to
prevent the overflow earlier in the code path.
This crash occurred in production with an Aquantia AQC113 10G NIC.
Stack trace from production environment:
```
RIP: 0010:skb_add_rx_frag_netmem+0x29/0xd0
Code: 90 f3 0f 1e fa 0f 1f 44 00 00 48 89 f8 41 89
ca 48 89 d7 48 63 ce 8b 90 c0 00 00 00 48 c1 e1 04 48 01 ca 48 03 90
c8 00 00 00 <48> 89 7a 30 44 89 52 3c 44 89 42 38 40 f6 c7 01 75 74 48
89 fa 83
RSP: 0018:ffffa9bec02a8d50 EFLAGS: 00010287
RAX: ffff925b22e80a00 RBX: ffff925ad38d2700 RCX:
fffffffe0a0c8000
RDX: ffff9258ea95bac0 RSI: ffff925ae0a0c800 RDI:
0000000000037a40
RBP: 0000000000000024 R08: 0000000000000000 R09:
0000000000000021
R10: 0000000000000848 R11: 0000000000000000 R12:
ffffa9bec02a8e24
R13: ffff925ad8615570 R14: 0000000000000000 R15:
ffff925b22e80a00
FS: 0000000000000000(0000)
GS:ffff925e47880000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff9258ea95baf0 CR3: 0000000166022004 CR4:
0000000000f72ef0
PKRU: 55555554
Call Trace:
<IRQ>
aq_ring_rx_clean+0x175/0xe60 [atlantic]
? aq_ring_rx_clean+0x14d/0xe60 [atlantic]
? aq_ring_tx_clean+0xdf/0x190 [atlantic]
? kmem_cache_free+0x348/0x450
? aq_vec_poll+0x81/0x1d0 [atlantic]
? __napi_poll+0x28/0x1c0
? net_rx_action+0x337/0x420
```
Fixes: 6aecbba12b5c ("net: atlantic: add check for MAX_SKB_FRAGS")
Changes in v4:
- Add Fixes: tag to satisfy patch validation requirements.
Changes in v3:
- Fix by assuming there will be an extra frag if buff->len > AQ_CFG_RX_HDR_SIZE,
then all fragments are accounted for.
Signed-off-by: Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
Link: https://patch.msgid.link/20251126032249.69358-1-jiefeng.z.zhang@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
index 98e8997f80366..5a85999987b51 100644
--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
+++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
@@ -363,6 +363,11 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
if (!buff->is_eop) {
unsigned int frag_cnt = 0U;
+
+ /* There will be an extra fragment */
+ if (buff->len > AQ_CFG_RX_HDR_SIZE)
+ frag_cnt++;
+
buff_ = buff;
do {
bool is_rsc_completed = true;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 262/300] mailbox: mailbox-test: Fix debugfs_create_dir error checking
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 261/300] net: atlantic: fix fragment overflow handling in RX path Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 263/300] spi: bcm63xx: fix premature CS deassertion on RX-only transactions Greg Kroah-Hartman
` (43 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haotian Zhang, Jassi Brar,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haotian Zhang <vulab@iscas.ac.cn>
[ Upstream commit 3acf1028f5003731977f750a7070f3321a9cb740 ]
The debugfs_create_dir() function returns ERR_PTR() on error, not NULL.
The current null-check fails to catch errors.
Use IS_ERR() to correctly check for errors.
Fixes: 8ea4484d0c2b ("mailbox: Add generic mechanism for testing Mailbox Controllers")
Signed-off-by: Haotian Zhang <vulab@iscas.ac.cn>
Signed-off-by: Jassi Brar <jassisinghbrar@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-test.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
index abcee58e851c2..29c04157b5e88 100644
--- a/drivers/mailbox/mailbox-test.c
+++ b/drivers/mailbox/mailbox-test.c
@@ -267,7 +267,7 @@ static int mbox_test_add_debugfs(struct platform_device *pdev,
return 0;
tdev->root_debugfs_dir = debugfs_create_dir(dev_name(&pdev->dev), NULL);
- if (!tdev->root_debugfs_dir) {
+ if (IS_ERR(tdev->root_debugfs_dir)) {
dev_err(&pdev->dev, "Failed to create Mailbox debugfs\n");
return -EINVAL;
}
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 263/300] spi: bcm63xx: fix premature CS deassertion on RX-only transactions
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 262/300] mailbox: mailbox-test: Fix debugfs_create_dir error checking Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 264/300] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" Greg Kroah-Hartman
` (42 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hang Zhou, Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hang Zhou <929513338@qq.com>
[ Upstream commit fd9862f726aedbc2f29a29916cabed7bcf5cadb6 ]
On BCM6358 (and also observed on BCM6368) the controller appears to
only generate as many SPI clocks as bytes that have been written into
the TX FIFO. For RX-only transfers the driver programs the transfer
length in SPI_MSG_CTL but does not write anything into the FIFO, so
chip select is deasserted early and the RX transfer segment is never
fully clocked in.
A concrete failing case is a three-transfer MAC address read from
SPI-NOR:
- TX 0x03 (read command)
- TX 3-byte address
- RX 6 bytes (MAC)
In contrast, a two-transfer JEDEC-ID read (0x9f + 6-byte RX) works
because the driver uses prepend_len and writes dummy bytes into the
TX FIFO for the RX part.
Fix this by writing 0xff dummy bytes into the TX FIFO for RX-only
segments so that the number of bytes written to the FIFO matches the
total message length seen by the controller.
Fixes: b17de076062a ("spi/bcm63xx: work around inability to keep CS up")
Signed-off-by: Hang Zhou <929513338@qq.com>
Link: https://patch.msgid.link/tencent_7AC88FCB3076489A4A7E6C2163DF1ACF8D06@qq.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-bcm63xx.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/drivers/spi/spi-bcm63xx.c b/drivers/spi/spi-bcm63xx.c
index da559b86f6b17..e05f8913ccda9 100644
--- a/drivers/spi/spi-bcm63xx.c
+++ b/drivers/spi/spi-bcm63xx.c
@@ -257,6 +257,20 @@ static int bcm63xx_txrx_bufs(struct spi_device *spi, struct spi_transfer *first,
if (t->rx_buf) {
do_rx = true;
+
+ /*
+ * In certain hardware implementations, there appears to be a
+ * hidden accumulator that tracks the number of bytes written into
+ * the hardware FIFO, and this accumulator overrides the length in
+ * the SPI_MSG_CTL register.
+ *
+ * Therefore, for read-only transfers, we need to write some dummy
+ * value into the FIFO to keep the accumulator tracking the correct
+ * length.
+ */
+ if (!t->tx_buf)
+ memset_io(bs->tx_io + len, 0xFF, t->len);
+
/* prepend is half-duplex write only */
if (t == first)
prepend_len = 0;
--
2.51.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 264/300] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 263/300] spi: bcm63xx: fix premature CS deassertion on RX-only transactions Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 265/300] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields Greg Kroah-Hartman
` (41 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Liu, Jiri Olsa,
Alexei Starovoitov, Steven Rostedt (Google)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 6d08340d1e354787d6c65a8c3cdd4d41ffb8a5ed upstream.
This reverts commit 83f44ae0f8afcc9da659799db8693f74847e66b3.
Currently we store initial stacktrace entry twice for non-HW ot_regs, which
means callers that fail perf_hw_regs(regs) condition in perf_callchain_kernel.
It's easy to reproduce this bpftrace:
# bpftrace -e 'tracepoint:sched:sched_process_exec { print(kstack()); }'
Attaching 1 probe...
bprm_execve+1767
bprm_execve+1767
do_execveat_common.isra.0+425
__x64_sys_execve+56
do_syscall_64+133
entry_SYSCALL_64_after_hwframe+118
When perf_callchain_kernel calls unwind_start with first_frame, AFAICS
we do not skip regs->ip, but it's added as part of the unwind process.
Hence reverting the extra perf_callchain_store for non-hw regs leg.
I was not able to bisect this, so I'm not really sure why this was needed
in v5.2 and why it's not working anymore, but I could see double entries
as far as v5.10.
I did the test for both ORC and framepointer unwind with and without the
this fix and except for the initial entry the stacktraces are the same.
Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20251104215405.168643-2-jolsa@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/events/core.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2554,13 +2554,13 @@ perf_callchain_kernel(struct perf_callch
return;
}
- if (perf_callchain_store(entry, regs->ip))
- return;
-
- if (perf_hw_regs(regs))
+ if (perf_hw_regs(regs)) {
+ if (perf_callchain_store(entry, regs->ip))
+ return;
unwind_start(&state, current, regs, NULL);
- else
+ } else {
unwind_start(&state, current, NULL, (void *)regs->sp);
+ }
for (; !unwind_done(&state); unwind_next_frame(&state)) {
addr = unwind_get_return_address(&state);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 265/300] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 264/300] Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()" Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 266/300] iio:common:ssp_sensors: Fix an error handling path ssp_probe() Greg Kroah-Hartman
` (40 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Lavra, Lorenzo Bianconi,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Lavra <flavra@baylibre.com>
commit 3af0c1fb1cdc351b64ff1a4bc06d491490c1f10a upstream.
The `decimator` and `batch` fields of struct st_lsm6dsx_settings
are arrays indexed by sensor type, not by sensor hardware
identifier; moreover, the `batch` field is only used for the
accelerometer and gyroscope.
Change the array size for `decimator` from ST_LSM6DSX_MAX_ID to
ST_LSM6DSX_ID_MAX, and change the array size for `batch` from
ST_LSM6DSX_MAX_ID to 2; move the enum st_lsm6dsx_sensor_id
definition so that the ST_LSM6DSX_ID_MAX value is usable within
the struct st_lsm6dsx_settings definition.
Fixes: 801a6e0af0c6c ("iio: imu: st_lsm6dsx: add support to LSM6DSO")
Signed-off-by: Francesco Lavra <flavra@baylibre.com>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 +++++++++++-----------
1 file changed, 11 insertions(+), 11 deletions(-)
--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
+++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h
@@ -221,6 +221,15 @@ struct st_lsm6dsx_event_settings {
u8 wakeup_src_x_mask;
};
+enum st_lsm6dsx_sensor_id {
+ ST_LSM6DSX_ID_GYRO,
+ ST_LSM6DSX_ID_ACC,
+ ST_LSM6DSX_ID_EXT0,
+ ST_LSM6DSX_ID_EXT1,
+ ST_LSM6DSX_ID_EXT2,
+ ST_LSM6DSX_ID_MAX
+};
+
enum st_lsm6dsx_ext_sensor_id {
ST_LSM6DSX_ID_MAGN,
};
@@ -307,23 +316,14 @@ struct st_lsm6dsx_settings {
struct st_lsm6dsx_reg drdy_mask;
struct st_lsm6dsx_odr_table_entry odr_table[2];
struct st_lsm6dsx_fs_table_entry fs_table[2];
- struct st_lsm6dsx_reg decimator[ST_LSM6DSX_MAX_ID];
- struct st_lsm6dsx_reg batch[ST_LSM6DSX_MAX_ID];
+ struct st_lsm6dsx_reg decimator[ST_LSM6DSX_ID_MAX];
+ struct st_lsm6dsx_reg batch[2];
struct st_lsm6dsx_fifo_ops fifo_ops;
struct st_lsm6dsx_hw_ts_settings ts_settings;
struct st_lsm6dsx_shub_settings shub_settings;
struct st_lsm6dsx_event_settings event_settings;
};
-enum st_lsm6dsx_sensor_id {
- ST_LSM6DSX_ID_GYRO,
- ST_LSM6DSX_ID_ACC,
- ST_LSM6DSX_ID_EXT0,
- ST_LSM6DSX_ID_EXT1,
- ST_LSM6DSX_ID_EXT2,
- ST_LSM6DSX_ID_MAX,
-};
-
enum st_lsm6dsx_fifo_mode {
ST_LSM6DSX_FIFO_BYPASS = 0x0,
ST_LSM6DSX_FIFO_CONT = 0x6,
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 266/300] iio:common:ssp_sensors: Fix an error handling path ssp_probe()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 265/300] iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 267/300] MIPS: mm: Prevent a TLB shutdown on initial uniquification Greg Kroah-Hartman
` (39 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Nuno Sá,
Stable, Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 21553258b94861a73d7f2cf15469d69240e1170d upstream.
If an error occurs after a successful mfd_add_devices() call, it should be
undone by a corresponding mfd_remove_devices() call, as already done in the
remove function.
Fixes: 50dd64d57eee ("iio: common: ssp_sensors: Add sensorhub driver")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Nuno Sá <nuno.sa@analog.com>
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/iio/common/ssp_sensors/ssp_dev.c
+++ b/drivers/iio/common/ssp_sensors/ssp_dev.c
@@ -515,7 +515,7 @@ static int ssp_probe(struct spi_device *
ret = spi_setup(spi);
if (ret < 0) {
dev_err(&spi->dev, "Failed to setup spi\n");
- return ret;
+ goto err_setup_spi;
}
data->fw_dl_state = SSP_FW_DL_STATE_NONE;
@@ -580,6 +580,8 @@ err_read_reg:
err_setup_irq:
mutex_destroy(&data->pending_lock);
mutex_destroy(&data->comm_lock);
+err_setup_spi:
+ mfd_remove_devices(&spi->dev);
dev_err(&spi->dev, "Probe failed!\n");
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 267/300] MIPS: mm: Prevent a TLB shutdown on initial uniquification
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 266/300] iio:common:ssp_sensors: Fix an error handling path ssp_probe() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 268/300] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Greg Kroah-Hartman
` (38 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki, Jiaxun Yang,
Thomas Bogendoerfer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej W. Rozycki <macro@orcam.me.uk>
commit 9f048fa487409e364cf866c957cf0b0d782ca5a3 upstream.
Depending on the particular CPU implementation a TLB shutdown may occur
if multiple matching entries are detected upon the execution of a TLBP
or the TLBWI/TLBWR instructions. Given that we don't know what entries
we have been handed we need to be very careful with the initial TLB
setup and avoid all these instructions.
Therefore read all the TLB entries one by one with the TLBR instruction,
bypassing the content addressing logic, and truncate any large pages in
place so as to avoid a case in the second step where an incoming entry
for a large page at a lower address overlaps with a replacement entry
chosen at another index. Then preinitialize the TLB using addresses
outside our usual unique range and avoiding clashes with any entries
received, before making the usual call to local_flush_tlb_all().
This fixes (at least) R4x00 cores if TLBP hits multiple matching TLB
entries (SGI IP22 PROM for examples sets up all TLBs to the same virtual
address).
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Cc: stable@vger.kernel.org
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Tested-by: Jiaxun Yang <jiaxun.yang@flygoat.com> # Boston I6400, M5150 sim
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mm/tlb-r4k.c | 102 ++++++++++++++++++++++++++++++-------------------
1 file changed, 64 insertions(+), 38 deletions(-)
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -15,6 +15,7 @@
#include <linux/mm.h>
#include <linux/hugetlb.h>
#include <linux/export.h>
+#include <linux/sort.h>
#include <asm/cpu.h>
#include <asm/cpu-type.h>
@@ -498,55 +499,79 @@ static int __init set_ntlb(char *str)
__setup("ntlb=", set_ntlb);
-/* Initialise all TLB entries with unique values */
+
+/* Comparison function for EntryHi VPN fields. */
+static int r4k_vpn_cmp(const void *a, const void *b)
+{
+ long v = *(unsigned long *)a - *(unsigned long *)b;
+ int s = sizeof(long) > sizeof(int) ? sizeof(long) * 8 - 1: 0;
+ return s ? (v != 0) | v >> s : v;
+}
+
+/*
+ * Initialise all TLB entries with unique values that do not clash with
+ * what we have been handed over and what we'll be using ourselves.
+ */
static void r4k_tlb_uniquify(void)
{
- int entry = num_wired_entries();
+ unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
+ int tlbsize = current_cpu_data.tlbsize;
+ int start = num_wired_entries();
+ unsigned long vpn_mask;
+ int cnt, ent, idx, i;
+
+ vpn_mask = GENMASK(cpu_vmbits - 1, 13);
+ vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
htw_stop();
- write_c0_entrylo0(0);
- write_c0_entrylo1(0);
- while (entry < current_cpu_data.tlbsize) {
- unsigned long asid_mask = cpu_asid_mask(¤t_cpu_data);
- unsigned long asid = 0;
- int idx;
+ for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
+ unsigned long vpn;
- /* Skip wired MMID to make ginvt_mmid work */
- if (cpu_has_mmid)
- asid = MMID_KERNEL_WIRED + 1;
+ write_c0_index(i);
+ mtc0_tlbr_hazard();
+ tlb_read();
+ tlb_read_hazard();
+ vpn = read_c0_entryhi();
+ vpn &= vpn_mask & PAGE_MASK;
+ tlb_vpns[cnt] = vpn;
- /* Check for match before using UNIQUE_ENTRYHI */
- do {
- if (cpu_has_mmid) {
- write_c0_memorymapid(asid);
- write_c0_entryhi(UNIQUE_ENTRYHI(entry));
- } else {
- write_c0_entryhi(UNIQUE_ENTRYHI(entry) | asid);
- }
- mtc0_tlbw_hazard();
- tlb_probe();
- tlb_probe_hazard();
- idx = read_c0_index();
- /* No match or match is on current entry */
- if (idx < 0 || idx == entry)
- break;
- /*
- * If we hit a match, we need to try again with
- * a different ASID.
- */
- asid++;
- } while (asid < asid_mask);
-
- if (idx >= 0 && idx != entry)
- panic("Unable to uniquify TLB entry %d", idx);
-
- write_c0_index(entry);
+ /* Prevent any large pages from overlapping regular ones. */
+ write_c0_pagemask(read_c0_pagemask() & PM_DEFAULT_MASK);
mtc0_tlbw_hazard();
tlb_write_indexed();
- entry++;
+ tlbw_use_hazard();
}
+ sort(tlb_vpns, cnt, sizeof(tlb_vpns[0]), r4k_vpn_cmp, NULL);
+
+ write_c0_pagemask(PM_DEFAULT_MASK);
+ write_c0_entrylo0(0);
+ write_c0_entrylo1(0);
+
+ idx = 0;
+ ent = tlbsize;
+ for (i = start; i < tlbsize; i++)
+ while (1) {
+ unsigned long entryhi, vpn;
+
+ entryhi = UNIQUE_ENTRYHI(ent);
+ vpn = entryhi & vpn_mask & PAGE_MASK;
+
+ if (idx >= cnt || vpn < tlb_vpns[idx]) {
+ write_c0_entryhi(entryhi);
+ write_c0_index(i);
+ mtc0_tlbw_hazard();
+ tlb_write_indexed();
+ ent++;
+ break;
+ } else if (vpn == tlb_vpns[idx]) {
+ ent++;
+ } else {
+ idx++;
+ }
+ }
+
tlbw_use_hazard();
htw_start();
flush_micro_tlb();
@@ -592,6 +617,7 @@ static void r4k_tlb_configure(void)
/* From this point on the ARC firmware is dead. */
r4k_tlb_uniquify();
+ local_flush_tlb_all();
/* Did I tell you that ARC SUCKS? */
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 268/300] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 267/300] MIPS: mm: Prevent a TLB shutdown on initial uniquification Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 269/300] atm/fore200e: Fix possible data race in fore200e_open() Greg Kroah-Hartman
` (37 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej W. Rozycki, Gregory CLEMENT,
Klara Modin, Thomas Bogendoerfer
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream.
Owing to Config4.MMUSizeExt and VTLB/FTLB MMU features later MIPSr2+
cores can have more than 64 TLB entries. Therefore allocate an array
for uniquification instead of placing too an small array on the stack.
Fixes: 35ad7e181541 ("MIPS: mm: tlb-r4k: Uniquify TLB entries on init")
Co-developed-by: Maciej W. Rozycki <macro@orcam.me.uk>
Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
Cc: stable@vger.kernel.org # v6.17+: 9f048fa48740: MIPS: mm: Prevent a TLB shutdown on initial uniquification
Cc: stable@vger.kernel.org # v6.17+
Tested-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Tested-by: Klara Modin <klarasmodin@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/mips/mm/tlb-r4k.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
--- a/arch/mips/mm/tlb-r4k.c
+++ b/arch/mips/mm/tlb-r4k.c
@@ -12,6 +12,7 @@
#include <linux/init.h>
#include <linux/sched.h>
#include <linux/smp.h>
+#include <linux/memblock.h>
#include <linux/mm.h>
#include <linux/hugetlb.h>
#include <linux/export.h>
@@ -512,17 +513,26 @@ static int r4k_vpn_cmp(const void *a, co
* Initialise all TLB entries with unique values that do not clash with
* what we have been handed over and what we'll be using ourselves.
*/
-static void r4k_tlb_uniquify(void)
+static void __ref r4k_tlb_uniquify(void)
{
- unsigned long tlb_vpns[1 << MIPS_CONF1_TLBS_SIZE];
int tlbsize = current_cpu_data.tlbsize;
+ bool use_slab = slab_is_available();
int start = num_wired_entries();
+ phys_addr_t tlb_vpn_size;
+ unsigned long *tlb_vpns;
unsigned long vpn_mask;
int cnt, ent, idx, i;
vpn_mask = GENMASK(cpu_vmbits - 1, 13);
vpn_mask |= IS_ENABLED(CONFIG_64BIT) ? 3ULL << 62 : 1 << 31;
+ tlb_vpn_size = tlbsize * sizeof(*tlb_vpns);
+ tlb_vpns = (use_slab ?
+ kmalloc(tlb_vpn_size, GFP_KERNEL) :
+ memblock_alloc_raw(tlb_vpn_size, sizeof(*tlb_vpns)));
+ if (WARN_ON(!tlb_vpns))
+ return; /* Pray local_flush_tlb_all() is good enough. */
+
htw_stop();
for (i = start, cnt = 0; i < tlbsize; i++, cnt++) {
@@ -575,6 +585,10 @@ static void r4k_tlb_uniquify(void)
tlbw_use_hazard();
htw_start();
flush_micro_tlb();
+ if (use_slab)
+ kfree(tlb_vpns);
+ else
+ memblock_free(tlb_vpns, tlb_vpn_size);
}
/*
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 269/300] atm/fore200e: Fix possible data race in fore200e_open()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 268/300] MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 270/300] can: sja1000: fix max irq loop handling Greg Kroah-Hartman
` (36 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Simon Horman,
Paolo Abeni
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <hanguidong02@gmail.com>
commit 82fca3d8a4a34667f01ec2351a607135249c9cff upstream.
Protect access to fore200e->available_cell_rate with rate_mtx lock in the
error handling path of fore200e_open() to prevent a data race.
The field fore200e->available_cell_rate is a shared resource used to track
available bandwidth. It is concurrently accessed by fore200e_open(),
fore200e_close(), and fore200e_change_qos().
In fore200e_open(), the lock rate_mtx is correctly held when subtracting
vcc->qos.txtp.max_pcr from available_cell_rate to reserve bandwidth.
However, if the subsequent call to fore200e_activate_vcin() fails, the
function restores the reserved bandwidth by adding back to
available_cell_rate without holding the lock.
This introduces a race condition because available_cell_rate is a global
device resource shared across all VCCs. If the error path in
fore200e_open() executes concurrently with operations like
fore200e_close() or fore200e_change_qos() on other VCCs, a
read-modify-write race occurs.
Specifically, the error path reads the rate without the lock. If another
CPU acquires the lock and modifies the rate (e.g., releasing bandwidth in
fore200e_close()) between this read and the subsequent write, the error
path will overwrite the concurrent update with a stale value. This results
in incorrect bandwidth accounting.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <hanguidong02@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20251120120657.2462194-1-hanguidong02@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/atm/fore200e.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/atm/fore200e.c
+++ b/drivers/atm/fore200e.c
@@ -1379,7 +1379,9 @@ fore200e_open(struct atm_vcc *vcc)
vcc->dev_data = NULL;
+ mutex_lock(&fore200e->rate_mtx);
fore200e->available_cell_rate += vcc->qos.txtp.max_pcr;
+ mutex_unlock(&fore200e->rate_mtx);
kfree(fore200e_vcc);
return -EINVAL;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 270/300] can: sja1000: fix max irq loop handling
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 269/300] atm/fore200e: Fix possible data race in fore200e_open() Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 271/300] can: sun4i_can: sun4i_can_interrupt(): " Greg Kroah-Hartman
` (35 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Mühlbacher,
Oliver Hartkopp, Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Mühlbacher <tmuehlbacher@posteo.net>
commit 30db4451c7f6aabcada029b15859a76962ec0cf8 upstream.
Reading the interrupt register `SJA1000_IR` causes all of its bits to be
reset. If we ever reach the condition of handling more than
`SJA1000_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop
body.
This may, among other issues, cause us to never `netif_wake_queue()`
again after a transmission interrupt.
Fixes: 429da1cc841b ("can: Driver for the SJA1000 CAN controller")
Cc: stable@vger.kernel.org
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20251115153437.11419-1-tmuehlbacher@posteo.net
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/sja1000/sja1000.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/can/sja1000/sja1000.c
+++ b/drivers/net/can/sja1000/sja1000.c
@@ -511,8 +511,8 @@ irqreturn_t sja1000_interrupt(int irq, v
if (priv->read_reg(priv, SJA1000_IER) == IRQ_OFF)
goto out;
- while ((isrc = priv->read_reg(priv, SJA1000_IR)) &&
- (n < SJA1000_MAX_IRQ)) {
+ while ((n < SJA1000_MAX_IRQ) &&
+ (isrc = priv->read_reg(priv, SJA1000_IR))) {
status = priv->read_reg(priv, SJA1000_SR);
/* check for absent controller due to hw unplug */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 271/300] can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 270/300] can: sja1000: fix max irq loop handling Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 272/300] dm-verity: fix unreliable memory allocation Greg Kroah-Hartman
` (34 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Mühlbacher,
Jernej Skrabec, Marc Kleine-Budde
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Kleine-Budde <mkl@pengutronix.de>
commit 76544beea7cfe5bcce6d60f53811657b88ec8be1 upstream.
Reading the interrupt register `SUN4I_REG_INT_ADDR` causes all of its bits
to be reset. If we ever reach the condition of handling more than
`SUN4I_CAN_MAX_IRQ` IRQs, we will have read the register and reset all its
bits but without actually handling the interrupt inside of the loop body.
This may, among other issues, cause us to never `netif_wake_queue()` again
after a transmission interrupt.
Fixes: 0738eff14d81 ("can: Allwinner A10/A20 CAN Controller support - Kernel module")
Cc: stable@vger.kernel.org
Co-developed-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Signed-off-by: Thomas Mühlbacher <tmuehlbacher@posteo.net>
Acked-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://patch.msgid.link/20251116-sun4i-fix-loop-v1-1-3d76d3f81950@pengutronix.de
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/sun4i_can.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/can/sun4i_can.c
+++ b/drivers/net/can/sun4i_can.c
@@ -644,8 +644,8 @@ static irqreturn_t sun4i_can_interrupt(i
u8 isrc, status;
int n = 0;
- while ((isrc = readl(priv->base + SUN4I_REG_INT_ADDR)) &&
- (n < SUN4I_CAN_MAX_IRQ)) {
+ while ((n < SUN4I_CAN_MAX_IRQ) &&
+ (isrc = readl(priv->base + SUN4I_REG_INT_ADDR))) {
n++;
status = readl(priv->base + SUN4I_REG_STA_ADDR);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 272/300] dm-verity: fix unreliable memory allocation
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 271/300] can: sun4i_can: sun4i_can_interrupt(): " Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 273/300] thunderbolt: Add support for Intel Wildcat Lake Greg Kroah-Hartman
` (33 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Eric Biggers
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit fe680d8c747f4e676ac835c8c7fb0f287cd98758 upstream.
GFP_NOWAIT allocation may fail anytime. It needs to be changed to
GFP_NOIO. There's no need to handle an error because mempool_alloc with
GFP_NOIO can't fail.
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Cc: stable@vger.kernel.org
Reviewed-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-verity-fec.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/md/dm-verity-fec.c
+++ b/drivers/md/dm-verity-fec.c
@@ -314,11 +314,7 @@ static int fec_alloc_bufs(struct dm_veri
if (fio->bufs[n])
continue;
- fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOWAIT);
- if (unlikely(!fio->bufs[n])) {
- DMERR("failed to allocate FEC buffer");
- return -ENOMEM;
- }
+ fio->bufs[n] = mempool_alloc(&v->fec->prealloc_pool, GFP_NOIO);
}
/* try to allocate the maximum number of buffers */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 273/300] thunderbolt: Add support for Intel Wildcat Lake
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 272/300] dm-verity: fix unreliable memory allocation Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 274/300] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves Greg Kroah-Hartman
` (32 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alan Borzeszkowski, Mika Westerberg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
commit 3575254546a27210a4b661ea37fbbfb836c0815d upstream.
Intel Wildcat Lake derives its Thunderbolt/USB4 controller from Lunar
Lake platform. Add Wildcat Lake PCI ID to the driver list of supported
devices.
Signed-off-by: Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/nhi.c | 2 ++
drivers/thunderbolt/nhi.h | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/thunderbolt/nhi.c
+++ b/drivers/thunderbolt/nhi.c
@@ -1375,6 +1375,8 @@ static struct pci_device_id nhi_ids[] =
.driver_data = (kernel_ulong_t)&icl_nhi_ops },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_PTL_P_NHI1),
.driver_data = (kernel_ulong_t)&icl_nhi_ops },
+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_WCL_NHI0),
+ .driver_data = (kernel_ulong_t)&icl_nhi_ops },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI) },
{ PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI) },
--- a/drivers/thunderbolt/nhi.h
+++ b/drivers/thunderbolt/nhi.h
@@ -75,6 +75,7 @@ extern const struct tb_nhi_ops icl_nhi_o
#define PCI_DEVICE_ID_INTEL_TITAN_RIDGE_DD_BRIDGE 0x15ef
#define PCI_DEVICE_ID_INTEL_ADL_NHI0 0x463e
#define PCI_DEVICE_ID_INTEL_ADL_NHI1 0x466d
+#define PCI_DEVICE_ID_INTEL_WCL_NHI0 0x4d33
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_80G_NHI 0x5781
#define PCI_DEVICE_ID_INTEL_BARLOW_RIDGE_HOST_40G_NHI 0x5784
#define PCI_DEVICE_ID_INTEL_MTL_M_NHI0 0x7eb2
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 274/300] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 273/300] thunderbolt: Add support for Intel Wildcat Lake Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:27 ` [PATCH 5.10 275/300] firmware: stratix10-svc: fix bug in saving controller data Greg Kroah-Hartman
` (31 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Miaoqian Lin,
Dmitry Baryshkov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit 96cf8500934e0ce2a6c486f1dbc3b1fff12f7a5e upstream.
The function qcom_slim_ngd_notify_slaves() calls of_slim_get_device() which
internally uses device_find_child() to obtain a device reference.
According to the device_find_child() documentation,
the caller must drop the reference with put_device() after use.
Found via static analysis and this is similar to commit 4e65bda8273c
("ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data()")
Fixes: 917809e2280b ("slimbus: ngd: Add qcom SLIMBus NGD driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
Link: https://patch.msgid.link/20251027060601.33228-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/slimbus/qcom-ngd-ctrl.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/slimbus/qcom-ngd-ctrl.c
+++ b/drivers/slimbus/qcom-ngd-ctrl.c
@@ -1149,6 +1149,7 @@ static void qcom_slim_ngd_notify_slaves(
if (slim_get_logical_addr(sbdev))
dev_err(ctrl->dev, "Failed to get logical address\n");
+ put_device(&sbdev->dev);
}
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 275/300] firmware: stratix10-svc: fix bug in saving controller data
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 274/300] slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves Greg Kroah-Hartman
@ 2025-12-03 15:27 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 276/300] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking Greg Kroah-Hartman
` (30 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:27 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ang Tien Sung, Khairul Anuar Romli,
Dinh Nguyen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
commit d0fcf70c680e4d1669fcb3a8632f41400b9a73c2 upstream.
Fix the incorrect usage of platform_set_drvdata and dev_set_drvdata. They
both are of the same data and overrides each other. This resulted in the
rmmod of the svc driver to fail and throw a kernel panic for kthread_stop
and fifo free.
Fixes: b5dc75c915cd ("firmware: stratix10-svc: extend svc to support new RSU features")
Cc: stable@vger.kernel.org # 6.6+
Signed-off-by: Ang Tien Sung <tiensung.ang@altera.com>
Signed-off-by: Khairul Anuar Romli <khairul.anuar.romli@altera.com>
Signed-off-by: Dinh Nguyen <dinguyen@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/stratix10-svc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/firmware/stratix10-svc.c
+++ b/drivers/firmware/stratix10-svc.c
@@ -127,6 +127,7 @@ struct stratix10_svc_data {
* @complete_status: state for completion
* @svc_fifo_lock: protect access to service message data queue
* @invoke_fn: function to issue secure monitor call or hypervisor call
+ * @svc: manages the list of client svc drivers
*
* This struct is used to create communication channels for service clients, to
* handle secure monitor or hypervisor call.
@@ -143,6 +144,7 @@ struct stratix10_svc_controller {
struct completion complete_status;
spinlock_t svc_fifo_lock;
svc_invoke_fn *invoke_fn;
+ struct stratix10_svc *svc;
};
/**
@@ -1038,6 +1040,7 @@ static int stratix10_svc_drv_probe(struc
ret = -ENOMEM;
goto err_free_kfifo;
}
+ controller->svc = svc;
svc->stratix10_svc_rsu = platform_device_alloc(STRATIX10_RSU, 0);
if (!svc->stratix10_svc_rsu) {
@@ -1050,8 +1053,6 @@ static int stratix10_svc_drv_probe(struc
if (ret)
goto err_put_device;
- dev_set_drvdata(dev, svc);
-
pr_info("Intel Service Layer Driver Initialized\n");
return 0;
@@ -1065,8 +1066,8 @@ err_free_kfifo:
static int stratix10_svc_drv_remove(struct platform_device *pdev)
{
- struct stratix10_svc *svc = dev_get_drvdata(&pdev->dev);
struct stratix10_svc_controller *ctrl = platform_get_drvdata(pdev);
+ struct stratix10_svc *svc = ctrl->svc;
platform_device_unregister(svc->stratix10_svc_rsu);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 276/300] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2025-12-03 15:27 ` [PATCH 5.10 275/300] firmware: stratix10-svc: fix bug in saving controller data Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 277/300] most: usb: fix double free on late probe failure Greg Kroah-Hartman
` (29 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Miaoqian Lin,
Gregory CLEMENT
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit eb4917f557d43c7a1c805dd73ffcdfddb2aba39a upstream.
Check for returned DMA addresses using specialized dma_mapping_error()
helper which is generally recommended for this purpose by
Documentation/core-api/dma-api.rst:
"In some circumstances dma_map_single(), ...
will fail to create a mapping. A driver can check for these errors
by testing the returned DMA address with dma_mapping_error()."
Found via static analysis and this is similar to commit fa0308134d26
("ALSA: memalloc: prefer dma_mapping_error() over explicit address checking")
Fixes: 58ac1b379979 ("ARM: PL011: Fix DMA support")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Reviewed-by: Gregory CLEMENT <gregory.clement@bootlin.com>
Link: https://patch.msgid.link/20251027092053.87937-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -636,7 +636,7 @@ static int pl011_dma_tx_refill(struct ua
dmatx->len = count;
dmatx->dma = dma_map_single(dma_dev->dev, dmatx->buf, count,
DMA_TO_DEVICE);
- if (dmatx->dma == DMA_MAPPING_ERROR) {
+ if (dma_mapping_error(dma_dev->dev, dmatx->dma)) {
uap->dmatx.queued = false;
dev_dbg(uap->port.dev, "unable to map TX DMA\n");
return -EBUSY;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 277/300] most: usb: fix double free on late probe failure
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 276/300] serial: amba-pl011: prefer dma_mapping_error() over explicit address checking Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 278/300] usb: cdns3: Fix double resource release in cdns3_pci_probe Greg Kroah-Hartman
` (28 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Gromm, Victoria Votokina,
Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit baadf2a5c26e802a46573eaad331b427b49aaa36 upstream.
The MOST subsystem has a non-standard registration function which frees
the interface on registration failures and on deregistration.
This unsurprisingly leads to bugs in the MOST drivers, and a couple of
recent changes turned a reference underflow and use-after-free in the
USB driver into several double free and a use-after-free on late probe
failures.
Fixes: 723de0f9171e ("staging: most: remove device from interface structure")
Fixes: 4b1270902609 ("most: usb: Fix use-after-free in hdm_disconnect")
Fixes: a8cc9e5fcb0e ("most: usb: hdm_probe: Fix calling put_device() before device initialization")
Cc: stable@vger.kernel.org
Cc: Christian Gromm <christian.gromm@microchip.com>
Cc: Victoria Votokina <Victoria.Votokina@kaspersky.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20251029093029.28922-1-johan@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/most/most_usb.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/most/most_usb.c b/drivers/most/most_usb.c
index 10064d7b7249..41ee169f80c5 100644
--- a/drivers/most/most_usb.c
+++ b/drivers/most/most_usb.c
@@ -1058,7 +1058,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
ret = most_register_interface(&mdev->iface);
if (ret)
- goto err_free_busy_urbs;
+ return ret;
mutex_lock(&mdev->io_mutex);
if (le16_to_cpu(usb_dev->descriptor.idProduct) == USB_DEV_ID_OS81118 ||
@@ -1068,8 +1068,7 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
if (!mdev->dci) {
mutex_unlock(&mdev->io_mutex);
most_deregister_interface(&mdev->iface);
- ret = -ENOMEM;
- goto err_free_busy_urbs;
+ return -ENOMEM;
}
mdev->dci->dev.init_name = "dci";
@@ -1078,18 +1077,15 @@ hdm_probe(struct usb_interface *interface, const struct usb_device_id *id)
mdev->dci->dev.release = release_dci;
if (device_register(&mdev->dci->dev)) {
mutex_unlock(&mdev->io_mutex);
+ put_device(&mdev->dci->dev);
most_deregister_interface(&mdev->iface);
- ret = -ENOMEM;
- goto err_free_dci;
+ return -ENOMEM;
}
mdev->dci->usb_device = mdev->usb_device;
}
mutex_unlock(&mdev->io_mutex);
return 0;
-err_free_dci:
- put_device(&mdev->dci->dev);
-err_free_busy_urbs:
- kfree(mdev->busy_urbs);
+
err_free_ep_address:
kfree(mdev->ep_address);
err_free_cap:
--
2.52.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 278/300] usb: cdns3: Fix double resource release in cdns3_pci_probe
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 277/300] most: usb: fix double free on late probe failure Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 279/300] usb: gadget: f_eem: Fix memory leak in eem_unwrap Greg Kroah-Hartman
` (27 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Miaoqian Lin, Peter Chen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miaoqian Lin <linmq006@gmail.com>
commit 1ec39d2cd88dac2e7cdbac248762f1f057971c5d upstream.
The driver uses pcim_enable_device() to enable the PCI device,
the device will be automatically disabled on driver detach through
the managed device framework. The manual pci_disable_device() calls
in the error paths are therefore redundant and should be removed.
Found via static anlaysis and this is similar to commit 99ca0b57e49f
("thermal: intel: int340x: processor: Fix warning during module unload").
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Miaoqian Lin <linmq006@gmail.com>
Acked-by: Peter Chen <peter.chen@kernel.org>
Link: https://patch.msgid.link/20251026090859.33107-1-linmq006@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/drivers/usb/cdns3/cdns3-pci-wrap.c
+++ b/drivers/usb/cdns3/cdns3-pci-wrap.c
@@ -101,10 +101,8 @@ static int cdns3_pci_probe(struct pci_de
wrap = pci_get_drvdata(func);
} else {
wrap = kzalloc(sizeof(*wrap), GFP_KERNEL);
- if (!wrap) {
- pci_disable_device(pdev);
+ if (!wrap)
return -ENOMEM;
- }
}
res = wrap->dev_res;
@@ -163,7 +161,6 @@ static int cdns3_pci_probe(struct pci_de
/* register platform device */
wrap->plat_dev = platform_device_register_full(&plat_info);
if (IS_ERR(wrap->plat_dev)) {
- pci_disable_device(pdev);
err = PTR_ERR(wrap->plat_dev);
kfree(wrap);
return err;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 279/300] usb: gadget: f_eem: Fix memory leak in eem_unwrap
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 278/300] usb: cdns3: Fix double resource release in cdns3_pci_probe Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 280/300] usb: storage: Fix memory leak in USB bulk transport Greg Kroah-Hartman
` (26 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Kuen-Han Tsai
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuen-Han Tsai <khtsai@google.com>
commit e4f5ce990818d37930cd9fb0be29eee0553c59d9 upstream.
The existing code did not handle the failure case of usb_ep_queue in the
command path, potentially leading to memory leaks.
Improve error handling to free all allocated resources on usb_ep_queue
failure. This patch continues to use goto logic for error handling, as the
existing error handling is complex and not easily adaptable to auto-cleanup
helpers.
kmemleak results:
unreferenced object 0xffffff895a512300 (size 240):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
kmem_cache_alloc+0x1b4/0x358
skb_clone+0x90/0xd8
eem_unwrap+0x1cc/0x36c
unreferenced object 0xffffff8a157f4000 (size 256):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
kmalloc_trace+0x48/0x140
dwc3_gadget_ep_alloc_request+0x58/0x11c
usb_ep_alloc_request+0x40/0xe4
eem_unwrap+0x204/0x36c
unreferenced object 0xffffff8aadbaac00 (size 128):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
__kmalloc+0x64/0x1a8
eem_unwrap+0x218/0x36c
unreferenced object 0xffffff89ccef3500 (size 64):
backtrace:
slab_post_alloc_hook+0xbc/0x3a4
__kmem_cache_alloc_node+0x1b4/0x2dc
kmalloc_trace+0x48/0x140
eem_unwrap+0x238/0x36c
Fixes: 4249d6fbc10f ("usb: gadget: eem: fix echo command packet response issue")
Cc: stable@kernel.org
Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
Link: https://patch.msgid.link/20251103121814.1559719-1-khtsai@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_eem.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_eem.c
+++ b/drivers/usb/gadget/function/f_eem.c
@@ -479,8 +479,13 @@ static int eem_unwrap(struct gether *por
req->complete = eem_cmd_complete;
req->zero = 1;
req->context = ctx;
- if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC))
+ if (usb_ep_queue(port->in_ep, req, GFP_ATOMIC)) {
DBG(cdev, "echo response queue fail\n");
+ kfree(ctx);
+ kfree(req->buf);
+ usb_ep_free_request(ep, req);
+ dev_kfree_skb_any(skb2);
+ }
break;
case 1: /* echo response */
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 280/300] usb: storage: Fix memory leak in USB bulk transport
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 279/300] usb: gadget: f_eem: Fix memory leak in eem_unwrap Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 281/300] USB: storage: Remove subclass and protocol overrides from Novatek quirk Greg Kroah-Hartman
` (25 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Desnes Nunes, Alan Stern
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Desnes Nunes <desnesn@redhat.com>
commit 41e99fe2005182139b1058db71f0d241f8f0078c upstream.
A kernel memory leak was identified by the 'ioctl_sg01' test from Linux
Test Project (LTP). The following bytes were mainly observed: 0x53425355.
When USB storage devices incorrectly skip the data phase with status data,
the code extracts/validates the CSW from the sg buffer, but fails to clear
it afterwards. This leaves status protocol data in srb's transfer buffer,
such as the US_BULK_CS_SIGN 'USBS' signature observed here. Thus, this can
lead to USB protocols leaks to user space through SCSI generic (/dev/sg*)
interfaces, such as the one seen here when the LTP test requested 512 KiB.
Fix the leak by zeroing the CSW data in srb's transfer buffer immediately
after the validation of devices that skip data phase.
Note: Differently from CVE-2018-1000204, which fixed a big leak by zero-
ing pages at allocation time, this leak occurs after allocation, when USB
protocol data is written to already-allocated sg pages.
Fixes: a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()")
Cc: stable <stable@kernel.org>
Signed-off-by: Desnes Nunes <desnesn@redhat.com>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://patch.msgid.link/20251031043436.55929-1-desnesn@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/transport.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -1199,7 +1199,23 @@ int usb_stor_Bulk_transport(struct scsi_
US_BULK_CS_WRAP_LEN &&
bcs->Signature ==
cpu_to_le32(US_BULK_CS_SIGN)) {
+ unsigned char buf[US_BULK_CS_WRAP_LEN];
+
usb_stor_dbg(us, "Device skipped data phase\n");
+
+ /*
+ * Devices skipping data phase might leave CSW data in srb's
+ * transfer buffer. Zero it to prevent USB protocol leakage.
+ */
+ sg = NULL;
+ offset = 0;
+ memset(buf, 0, sizeof(buf));
+ if (usb_stor_access_xfer_buf(buf,
+ US_BULK_CS_WRAP_LEN, srb, &sg,
+ &offset, TO_XFER_BUF) !=
+ US_BULK_CS_WRAP_LEN)
+ usb_stor_dbg(us, "Failed to clear CSW data\n");
+
scsi_set_resid(srb, transfer_length);
goto skipped_data_phase;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 281/300] USB: storage: Remove subclass and protocol overrides from Novatek quirk
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 280/300] usb: storage: Fix memory leak in USB bulk transport Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 282/300] usb: storage: sddr55: Reject out-of-bound new_pba Greg Kroah-Hartman
` (24 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stealth, Alan Stern, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit df5fde297e617041449f603ed5f646861c80000b upstream.
A report from Oleg Smirnov indicates that the unusual_devs quirks
entry for the Novatek camera does not need to override the subclass
and protocol parameters:
[3266355.209532] usb 1-3: new high-speed USB device number 10 using xhci_hcd
[3266355.333031] usb 1-3: New USB device found, idVendor=0603, idProduct=8611, bcdDevice= 1.00
[3266355.333040] usb 1-3: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[3266355.333043] usb 1-3: Product: YICARCAM
[3266355.333045] usb 1-3: Manufacturer: XIAO-YI
[3266355.333047] usb 1-3: SerialNumber: 966110000000100
[3266355.338621] usb-storage 1-3:1.0: USB Mass Storage device detected
[3266355.338817] usb-storage 1-3:1.0: Quirks match for vid 0603 pid 8611: 4000
[3266355.338821] usb-storage 1-3:1.0: This device (0603,8611,0100 S 06 P 50) has unneeded SubClass and Protocol entries in unusual_devs.h (kernel 6.16.10-arch1-1)
Please send a copy of this message to
<linux-usb@vger.kernel.org> and <usb-storage@lists.one-eyed-alien.net>
The overrides are harmless but they do provoke the driver into logging
this annoying message. Update the entry to remove the unneeded entries.
Reported-by: stealth <oleg.smirnov.1988@gmail.com>
Closes: https://lore.kernel.org/CAKxjRRxhC0s19iEWoN=pEMqXJ_z8w_moC0GCXSqSKCcOddnWjQ@mail.gmail.com/
Fixes: 6ca8af3c8fb5 ("USB: storage: Add unusual-devs entry for Novatek NTK96550-based camera")
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/b440f177-f0b8-4d5a-8f7b-10855d4424ee@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index dfa5276a5a43..47f50d7a385c 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -938,7 +938,7 @@ UNUSUAL_DEV( 0x05e3, 0x0723, 0x9451, 0x9451,
UNUSUAL_DEV( 0x0603, 0x8611, 0x0000, 0xffff,
"Novatek",
"NTK96550-based camera",
- USB_SC_SCSI, USB_PR_BULK, NULL,
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_BULK_IGNORE_TAG ),
/*
--
2.52.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 282/300] usb: storage: sddr55: Reject out-of-bound new_pba
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 281/300] USB: storage: Remove subclass and protocol overrides from Novatek quirk Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 283/300] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths Greg Kroah-Hartman
` (23 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tianchu Chen, stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tianchu Chen <flynnnchen@tencent.com>
commit b59d4fda7e7d0aff1043a7f742487cb829f5aac1 upstream.
Discovered by Atuin - Automated Vulnerability Discovery Engine.
new_pba comes from the status packet returned after each write.
A bogus device could report values beyond the block count derived
from info->capacity, letting the driver walk off the end of
pba_to_lba[] and corrupt heap memory.
Reject PBAs that exceed the computed block count and fail the
transfer so we avoid touching out-of-range mapping entries.
Signed-off-by: Tianchu Chen <flynnnchen@tencent.com>
Cc: stable <stable@kernel.org>
Link: https://patch.msgid.link/B2DC73A3EE1E3A1D+202511161322001664687@tencent.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/sddr55.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/usb/storage/sddr55.c
+++ b/drivers/usb/storage/sddr55.c
@@ -469,6 +469,12 @@ static int sddr55_write_data(struct us_d
new_pba = (status[3] + (status[4] << 8) + (status[5] << 16))
>> info->blockshift;
+ /* check if device-reported new_pba is out of range */
+ if (new_pba >= (info->capacity >> (info->blockshift + info->pageshift))) {
+ result = USB_STOR_TRANSPORT_FAILED;
+ goto leave;
+ }
+
/* check status for error */
if (status[0] == 0xff && status[1] == 0x4) {
info->pba_to_lba[new_pba] = BAD_BLOCK;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 283/300] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 282/300] usb: storage: sddr55: Reject out-of-bound new_pba Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 284/300] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host Greg Kroah-Hartman
` (22 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Thinh Nguyen, Manish Nagar
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Nagar <manish.nagar@oss.qualcomm.com>
commit e4037689a366743c4233966f0e74bc455820d316 upstream.
This patch addresses a race condition caused by unsynchronized
execution of multiple call paths invoking `dwc3_remove_requests()`,
leading to premature freeing of USB requests and subsequent crashes.
Three distinct execution paths interact with `dwc3_remove_requests()`:
Path 1:
Triggered via `dwc3_gadget_reset_interrupt()` during USB reset
handling. The call stack includes:
- `dwc3_ep0_reset_state()`
- `dwc3_ep0_stall_and_restart()`
- `dwc3_ep0_out_start()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`
Path 2:
Also initiated from `dwc3_gadget_reset_interrupt()`, but through
`dwc3_stop_active_transfers()`. The call stack includes:
- `dwc3_stop_active_transfers()`
- `dwc3_remove_requests()`
- `dwc3_gadget_del_and_unmap_request()`
Path 3:
Occurs independently during `adb root` execution, which triggers
USB function unbind and bind operations. The sequence includes:
- `gserial_disconnect()`
- `usb_ep_disable()`
- `dwc3_gadget_ep_disable()`
- `dwc3_remove_requests()` with `-ESHUTDOWN` status
Path 3 operates asynchronously and lacks synchronization with Paths
1 and 2. When Path 3 completes, it disables endpoints and frees 'out'
requests. If Paths 1 or 2 are still processing these requests,
accessing freed memory leads to a crash due to use-after-free conditions.
To fix this added check for request completion and skip processing
if already completed and added the request status for ep0 while queue.
Fixes: 72246da40f37 ("usb: Introduce DesignWare USB3 DRD Driver")
Cc: stable <stable@kernel.org>
Suggested-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Acked-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Signed-off-by: Manish Nagar <manish.nagar@oss.qualcomm.com>
Link: https://patch.msgid.link/20251120074435.1983091-1-manish.nagar@oss.qualcomm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/ep0.c | 1 +
drivers/usb/dwc3/gadget.c | 7 +++++++
2 files changed, 8 insertions(+)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -92,6 +92,7 @@ static int __dwc3_gadget_ep0_queue(struc
req->request.actual = 0;
req->request.status = -EINPROGRESS;
req->epnum = dep->number;
+ req->status = DWC3_REQUEST_STATUS_QUEUED;
list_add_tail(&req->list, &dep->pending_list);
--- a/drivers/usb/dwc3/gadget.c
+++ b/drivers/usb/dwc3/gadget.c
@@ -211,6 +211,13 @@ void dwc3_gadget_giveback(struct dwc3_ep
{
struct dwc3 *dwc = dep->dwc;
+ /*
+ * The request might have been processed and completed while the
+ * spinlock was released. Skip processing if already completed.
+ */
+ if (req->status == DWC3_REQUEST_STATUS_COMPLETED)
+ return;
+
dwc3_gadget_del_and_unmap_request(dep, req, status);
req->status = DWC3_REQUEST_STATUS_COMPLETED;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 284/300] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 283/300] usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 285/300] USB: serial: ftdi_sio: add support for u-blox EVK-M101 Greg Kroah-Hartman
` (21 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Łukasz Bartosik, Mathias Nyman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
commit f6bb3b67be9af0cfb90075c60850b6af5338a508 upstream.
Data read from a DbC device may be corrupted due to a race between
ongoing write and write request completion handler both queuing new
transfer blocks (TRBs) if there are remining data in the kfifo.
TRBs may be in incorrct order compared to the data in the kfifo.
Driver fails to keep lock between reading data from kfifo into a
dbc request buffer, and queuing the request to the transfer ring.
This allows completed request to re-queue itself in the middle of
an ongoing transfer loop, forcing itself between a kfifo read and
request TRB write of another request
cpu0 cpu1 (re-queue completed req2)
lock(port_lock)
dbc_start_tx()
kfifo_out(fifo, req1->buffer)
unlock(port_lock)
lock(port_lock)
dbc_write_complete(req2)
dbc_start_tx()
kfifo_out(fifo, req2->buffer)
unlock(port_lock)
lock(port_lock)
req2->trb = ring->enqueue;
ring->enqueue++
unlock(port_lock)
lock(port_lock)
req1->trb = ring->enqueue;
ring->enqueue++
unlock(port_lock)
In the above scenario a kfifo containing "12345678" would read "1234" to
req1 and "5678" to req2, but req2 is queued before req1 leading to
data being transmitted as "56781234"
Solve this by adding a flag that prevents starting a new tx if we
are already mid dbc_start_tx() during the unlocked part.
The already running dbc_do_start_tx() will make sure the newly completed
request gets re-queued as it is added to the request write_pool while
holding the lock.
Cc: stable@vger.kernel.org
Fixes: dfba2174dc42 ("usb: xhci: Add DbC support in xHCI driver")
Tested-by: Łukasz Bartosik <ukaszb@chromium.org>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://patch.msgid.link/20251107162819.1362579-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-dbgcap.h | 1 +
drivers/usb/host/xhci-dbgtty.c | 17 ++++++++++++++++-
2 files changed, 17 insertions(+), 1 deletion(-)
--- a/drivers/usb/host/xhci-dbgcap.h
+++ b/drivers/usb/host/xhci-dbgcap.h
@@ -110,6 +110,7 @@ struct dbc_port {
struct kfifo write_fifo;
bool registered;
+ bool tx_running;
};
struct dbc_driver {
--- a/drivers/usb/host/xhci-dbgtty.c
+++ b/drivers/usb/host/xhci-dbgtty.c
@@ -37,7 +37,7 @@ dbc_send_packet(struct dbc_port *port, c
return size;
}
-static int dbc_start_tx(struct dbc_port *port)
+static int dbc_do_start_tx(struct dbc_port *port)
__releases(&port->port_lock)
__acquires(&port->port_lock)
{
@@ -47,6 +47,8 @@ static int dbc_start_tx(struct dbc_port
bool do_tty_wake = false;
struct list_head *pool = &port->write_pool;
+ port->tx_running = true;
+
while (!list_empty(pool)) {
req = list_entry(pool->next, struct dbc_request, list_pool);
len = dbc_send_packet(port, req->buf, DBC_MAX_PACKET);
@@ -67,12 +69,25 @@ static int dbc_start_tx(struct dbc_port
}
}
+ port->tx_running = false;
+
if (do_tty_wake && port->port.tty)
tty_wakeup(port->port.tty);
return status;
}
+/* must be called with port->port_lock held */
+static int dbc_start_tx(struct dbc_port *port)
+{
+ lockdep_assert_held(&port->port_lock);
+
+ if (port->tx_running)
+ return -EBUSY;
+
+ return dbc_do_start_tx(port);
+}
+
static void dbc_start_rx(struct dbc_port *port)
__releases(&port->port_lock)
__acquires(&port->port_lock)
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 285/300] USB: serial: ftdi_sio: add support for u-blox EVK-M101
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 284/300] xhci: dbgtty: Fix data corruption when transmitting data form DbC to host Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 286/300] USB: serial: option: add support for Rolling RW101R-GL Greg Kroah-Hartman
` (20 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksandr Suvorov, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Suvorov <cryosay@gmail.com>
commit 2d8ab771d5316de64f3bb920b82575c58eb00b1b upstream.
The U-Blox EVK-M101 enumerates as 1546:0506 [1] with four FTDI interfaces:
- EVK-M101 current sensors
- EVK-M101 I2C
- EVK-M101 UART
- EVK-M101 port D
Only the third USB interface is a UART. This change lets ftdi_sio probe
the VID/PID and registers only interface #3 as a TTY, leaving the rest
available for other drivers.
[1]
usb 5-1.3: new high-speed USB device number 11 using xhci_hcd
usb 5-1.3: New USB device found, idVendor=1546, idProduct=0506, bcdDevice= 8.00
usb 5-1.3: New USB device strings: Mfr=1, Product=2, SerialNumber=0
usb 5-1.3: Product: EVK-M101
usb 5-1.3: Manufacturer: u-blox AG
Datasheet: https://content.u-blox.com/sites/default/files/documents/EVK-M10_UserGuide_UBX-21003949.pdf
Signed-off-by: Oleksandr Suvorov <cryosay@gmail.com>
Link: https://lore.kernel.org/20250926060235.3442748-1-cryosay@gmail.com/
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 1 +
drivers/usb/serial/ftdi_sio_ids.h | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1052,6 +1052,7 @@ static const struct usb_device_id id_tab
/* U-Blox devices */
{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ZED_PID) },
{ USB_DEVICE(UBLOX_VID, UBLOX_C099F9P_ODIN_PID) },
+ { USB_DEVICE_INTERFACE_NUMBER(UBLOX_VID, UBLOX_EVK_M101_PID, 2) },
/* FreeCalypso USB adapters */
{ USB_DEVICE(FTDI_VID, FTDI_FALCONIA_JTAG_BUF_PID),
.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1607,6 +1607,7 @@
#define UBLOX_VID 0x1546
#define UBLOX_C099F9P_ZED_PID 0x0502
#define UBLOX_C099F9P_ODIN_PID 0x0503
+#define UBLOX_EVK_M101_PID 0x0506
/*
* GMC devices
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 286/300] USB: serial: option: add support for Rolling RW101R-GL
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 285/300] USB: serial: ftdi_sio: add support for u-blox EVK-M101 Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 287/300] drm: sti: fix device leaks at component probe Greg Kroah-Hartman
` (19 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Vanillan Wang, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vanillan Wang <vanillanwang@163.com>
commit 523bf0a59e674b52e4b5607a2aba655fbfa20ff2 upstream.
- VID:PID 33f8:0301, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x0301: mbim, pipe
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=33f8 ProdID=0301 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:01a8, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x01a8: mbim, diag, AT, ADB, pipe1, pipe2
T: Bus=04 Lev=01 Prnt=01 Port=02 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=33f8 ProdID=01a8 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=88(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:0302, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x0302: mbim, pipe
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 6 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=0302 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
- VID:PID 33f8:01a9, RW101R-GL for laptop debug M.2 cards (with MBIM
interface for Linux/Chrome OS)
0x01a9: mbim, diag, AT, ADB, pipe1, pipe2
T: Bus=03 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 2 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
P: Vendor=33f8 ProdID=01a9 Rev=05.04
S: Manufacturer=Rolling Wireless S.a.r.l.
S: Product=Rolling RW101R-GL Module
S: SerialNumber=3ec4efdf
C: #Ifs= 7 Cfg#= 1 Atr=a0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=8e(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=84(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=85(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=04(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
I: If#= 6 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=05(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=88(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=89(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
Signed-off-by: Vanillan Wang <vanillanwang@163.com>
Cc: stable@vger.kernel.org
[ johan: sort vendor entries, edit commit message slightly ]
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 5de856f65f0d..e9400727ad36 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2424,12 +2424,18 @@ static const struct usb_device_id option_ids[] = {
{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
{ USB_DEVICE(0x33f8, 0x0104), /* Rolling RW101-GL (laptop RMNET) */
.driver_info = RSVD(4) | RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
+ .driver_info = RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) }, /* Rolling RW101-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff), /* Rolling RW101-GL (laptop MBIM) */
.driver_info = RSVD(4) },
- { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff), /* Rolling RW135-GL (laptop MBIM) */
- .driver_info = RSVD(5) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a8, 0xff), /* Rolling RW101R-GL (laptop MBIM) */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a9, 0xff), /* Rolling RW101R-GL (laptop MBIM) */
+ .driver_info = RSVD(4) },
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0301, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
+ { USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0302, 0xff) }, /* Rolling RW101R-GL (laptop MBIM) */
{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0802, 0xff), /* Rolling RW350-GL (laptop MBIM) */
.driver_info = RSVD(5) },
{ USB_DEVICE_AND_INTERFACE_INFO(0x3731, 0x0100, 0xff, 0xff, 0x30) }, /* NetPrisma LCUK54-WWD for Global */
--
2.52.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 287/300] drm: sti: fix device leaks at component probe
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 286/300] USB: serial: option: add support for Rolling RW101R-GL Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 288/300] drm/amd/display: Check NULL before accessing Greg Kroah-Hartman
` (18 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Gaignard, Johan Hovold,
Raphael Gallais-Pou
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan@kernel.org>
commit 620a8f131154250f6a64a07d049a4f235d6451a5 upstream.
Make sure to drop the references taken to the vtg devices by
of_find_device_by_node() when looking up their driver data during
component probe.
Note that holding a reference to a platform device does not prevent its
driver data from going away so there is no point in keeping the
reference after the lookup helper returns.
Fixes: cc6b741c6f63 ("drm: sti: remove useless fields from vtg structure")
Cc: stable@vger.kernel.org # 4.16
Cc: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Link: https://patch.msgid.link/20250922122012.27407-1-johan@kernel.org
Signed-off-by: Raphael Gallais-Pou <raphael.gallais-pou@foss.st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/sti/sti_vtg.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/sti/sti_vtg.c b/drivers/gpu/drm/sti/sti_vtg.c
index ee81691b3203..ce6bc7e7b135 100644
--- a/drivers/gpu/drm/sti/sti_vtg.c
+++ b/drivers/gpu/drm/sti/sti_vtg.c
@@ -143,12 +143,17 @@ struct sti_vtg {
struct sti_vtg *of_vtg_find(struct device_node *np)
{
struct platform_device *pdev;
+ struct sti_vtg *vtg;
pdev = of_find_device_by_node(np);
if (!pdev)
return NULL;
- return (struct sti_vtg *)platform_get_drvdata(pdev);
+ vtg = platform_get_drvdata(pdev);
+
+ put_device(&pdev->dev);
+
+ return vtg;
}
static void vtg_reset(struct sti_vtg *vtg)
--
2.52.0
^ permalink raw reply related [flat|nested] 312+ messages in thread* [PATCH 5.10 288/300] drm/amd/display: Check NULL before accessing
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 287/300] drm: sti: fix device leaks at component probe Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 289/300] libceph: fix potential use-after-free in have_mon_and_osd_map() Greg Kroah-Hartman
` (17 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello, Alex Deucher,
Aurabindo Pillai, Alex Hung
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Hung <alex.hung@amd.com>
commit 3ce62c189693e8ed7b3abe551802bbc67f3ace54 upstream.
[WHAT]
IGT kms_cursor_legacy's long-nonblocking-modeset-vs-cursor-atomic
fails with NULL pointer dereference. This can be reproduced with
both an eDP panel and a DP monitors connected.
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: Oops: 0000 [#1] SMP NOPTI
CPU: 13 UID: 0 PID: 2960 Comm: kms_cursor_lega Not tainted
6.16.0-99-custom #8 PREEMPT(voluntary)
Hardware name: AMD ........
RIP: 0010:dc_stream_get_scanoutpos+0x34/0x130 [amdgpu]
Code: 57 4d 89 c7 41 56 49 89 ce 41 55 49 89 d5 41 54 49
89 fc 53 48 83 ec 18 48 8b 87 a0 64 00 00 48 89 75 d0 48 c7 c6 e0 41 30
c2 <48> 8b 38 48 8b 9f 68 06 00 00 e8 8d d7 fd ff 31 c0 48 81 c3 e0 02
RSP: 0018:ffffd0f3c2bd7608 EFLAGS: 00010292
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffd0f3c2bd7668
RDX: ffffd0f3c2bd7664 RSI: ffffffffc23041e0 RDI: ffff8b32494b8000
RBP: ffffd0f3c2bd7648 R08: ffffd0f3c2bd766c R09: ffffd0f3c2bd7760
R10: ffffd0f3c2bd7820 R11: 0000000000000000 R12: ffff8b32494b8000
R13: ffffd0f3c2bd7664 R14: ffffd0f3c2bd7668 R15: ffffd0f3c2bd766c
FS: 000071f631b68700(0000) GS:ffff8b399f114000(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001b8105000 CR4: 0000000000f50ef0
PKRU: 55555554
Call Trace:
<TASK>
dm_crtc_get_scanoutpos+0xd7/0x180 [amdgpu]
amdgpu_display_get_crtc_scanoutpos+0x86/0x1c0 [amdgpu]
? __pfx_amdgpu_crtc_get_scanout_position+0x10/0x10[amdgpu]
amdgpu_crtc_get_scanout_position+0x27/0x50 [amdgpu]
drm_crtc_vblank_helper_get_vblank_timestamp_internal+0xf7/0x400
drm_crtc_vblank_helper_get_vblank_timestamp+0x1c/0x30
drm_crtc_get_last_vbltimestamp+0x55/0x90
drm_crtc_next_vblank_start+0x45/0xa0
drm_atomic_helper_wait_for_fences+0x81/0x1f0
...
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Aurabindo Pillai <aurabindo.pillai@amd.com>
Signed-off-by: Alex Hung <alex.hung@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
(cherry picked from commit 621e55f1919640acab25383362b96e65f2baea3c)
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc_stream.c
@@ -586,9 +586,14 @@ bool dc_stream_get_scanoutpos(const stru
{
uint8_t i;
bool ret = false;
- struct dc *dc = stream->ctx->dc;
- struct resource_context *res_ctx =
- &dc->current_state->res_ctx;
+ struct dc *dc;
+ struct resource_context *res_ctx;
+
+ if (!stream->ctx)
+ return false;
+
+ dc = stream->ctx->dc;
+ res_ctx = &dc->current_state->res_ctx;
for (i = 0; i < MAX_PIPES; i++) {
struct timing_generator *tg = res_ctx->pipe_ctx[i].stream_res.tg;
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 289/300] libceph: fix potential use-after-free in have_mon_and_osd_map()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 288/300] drm/amd/display: Check NULL before accessing Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 290/300] fs: writeback: fix use-after-free in __mark_inode_dirty() Greg Kroah-Hartman
` (16 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Ilya Dryomov,
Viacheslav Dubeyko
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 076381c261374c587700b3accf410bdd2dba334e upstream.
The wait loop in __ceph_open_session() can race with the client
receiving a new monmap or osdmap shortly after the initial map is
received. Both ceph_monc_handle_map() and handle_one_map() install
a new map immediately after freeing the old one
kfree(monc->monmap);
monc->monmap = monmap;
ceph_osdmap_destroy(osdc->osdmap);
osdc->osdmap = newmap;
under client->monc.mutex and client->osdc.lock respectively, but
because neither is taken in have_mon_and_osd_map() it's possible for
client->monc.monmap->epoch and client->osdc.osdmap->epoch arms in
client->monc.monmap && client->monc.monmap->epoch &&
client->osdc.osdmap && client->osdc.osdmap->epoch;
condition to dereference an already freed map. This happens to be
reproducible with generic/395 and generic/397 with KASAN enabled:
BUG: KASAN: slab-use-after-free in have_mon_and_osd_map+0x56/0x70
Read of size 4 at addr ffff88811012d810 by task mount.ceph/13305
CPU: 2 UID: 0 PID: 13305 Comm: mount.ceph Not tainted 6.14.0-rc2-build2+ #1266
...
Call Trace:
<TASK>
have_mon_and_osd_map+0x56/0x70
ceph_open_session+0x182/0x290
ceph_get_tree+0x333/0x680
vfs_get_tree+0x49/0x180
do_new_mount+0x1a3/0x2d0
path_mount+0x6dd/0x730
do_mount+0x99/0xe0
__do_sys_mount+0x141/0x180
do_syscall_64+0x9f/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Allocated by task 13305:
ceph_osdmap_alloc+0x16/0x130
ceph_osdc_init+0x27a/0x4c0
ceph_create_client+0x153/0x190
create_fs_client+0x50/0x2a0
ceph_get_tree+0xff/0x680
vfs_get_tree+0x49/0x180
do_new_mount+0x1a3/0x2d0
path_mount+0x6dd/0x730
do_mount+0x99/0xe0
__do_sys_mount+0x141/0x180
do_syscall_64+0x9f/0x100
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 9475:
kfree+0x212/0x290
handle_one_map+0x23c/0x3b0
ceph_osdc_handle_map+0x3c9/0x590
mon_dispatch+0x655/0x6f0
ceph_con_process_message+0xc3/0xe0
ceph_con_v1_try_read+0x614/0x760
ceph_con_workfn+0x2de/0x650
process_one_work+0x486/0x7c0
process_scheduled_works+0x73/0x90
worker_thread+0x1c8/0x2a0
kthread+0x2ec/0x300
ret_from_fork+0x24/0x40
ret_from_fork_asm+0x1a/0x30
Rewrite the wait loop to check the above condition directly with
client->monc.mutex and client->osdc.lock taken as appropriate. While
at it, improve the timeout handling (previously mount_timeout could be
exceeded in case wait_event_interruptible_timeout() slept more than
once) and access client->auth_err under client->monc.mutex to match
how it's set in finish_auth().
monmap_show() and osdmap_show() now take the respective lock before
accessing the map as well.
Cc: stable@vger.kernel.org
Reported-by: David Howells <dhowells@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/ceph_common.c | 53 +++++++++++++++++++++++++++++--------------------
net/ceph/debugfs.c | 14 +++++++++---
2 files changed, 42 insertions(+), 25 deletions(-)
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -750,41 +750,52 @@ void ceph_reset_client_addr(struct ceph_
EXPORT_SYMBOL(ceph_reset_client_addr);
/*
- * true if we have the mon map (and have thus joined the cluster)
- */
-static bool have_mon_and_osd_map(struct ceph_client *client)
-{
- return client->monc.monmap && client->monc.monmap->epoch &&
- client->osdc.osdmap && client->osdc.osdmap->epoch;
-}
-
-/*
* mount: join the ceph cluster, and open root directory.
*/
int __ceph_open_session(struct ceph_client *client, unsigned long started)
{
- unsigned long timeout = client->options->mount_timeout;
- long err;
+ DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ long timeout = ceph_timeout_jiffies(client->options->mount_timeout);
+ bool have_monmap, have_osdmap;
+ int err;
/* open session, and wait for mon and osd maps */
err = ceph_monc_open_session(&client->monc);
if (err < 0)
return err;
- while (!have_mon_and_osd_map(client)) {
- if (timeout && time_after_eq(jiffies, started + timeout))
- return -ETIMEDOUT;
+ add_wait_queue(&client->auth_wq, &wait);
+ for (;;) {
+ mutex_lock(&client->monc.mutex);
+ err = client->auth_err;
+ have_monmap = client->monc.monmap && client->monc.monmap->epoch;
+ mutex_unlock(&client->monc.mutex);
+
+ down_read(&client->osdc.lock);
+ have_osdmap = client->osdc.osdmap && client->osdc.osdmap->epoch;
+ up_read(&client->osdc.lock);
+
+ if (err || (have_monmap && have_osdmap))
+ break;
+
+ if (signal_pending(current)) {
+ err = -ERESTARTSYS;
+ break;
+ }
+
+ if (!timeout) {
+ err = -ETIMEDOUT;
+ break;
+ }
/* wait */
dout("mount waiting for mon_map\n");
- err = wait_event_interruptible_timeout(client->auth_wq,
- have_mon_and_osd_map(client) || (client->auth_err < 0),
- ceph_timeout_jiffies(timeout));
- if (err < 0)
- return err;
- if (client->auth_err < 0)
- return client->auth_err;
+ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout);
}
+ remove_wait_queue(&client->auth_wq, &wait);
+
+ if (err)
+ return err;
pr_info("client%llu fsid %pU\n", ceph_client_gid(client),
&client->fsid);
--- a/net/ceph/debugfs.c
+++ b/net/ceph/debugfs.c
@@ -36,8 +36,9 @@ static int monmap_show(struct seq_file *
int i;
struct ceph_client *client = s->private;
+ mutex_lock(&client->monc.mutex);
if (client->monc.monmap == NULL)
- return 0;
+ goto out_unlock;
seq_printf(s, "epoch %d\n", client->monc.monmap->epoch);
for (i = 0; i < client->monc.monmap->num_mon; i++) {
@@ -48,6 +49,9 @@ static int monmap_show(struct seq_file *
ENTITY_NAME(inst->name),
ceph_pr_addr(&inst->addr));
}
+
+out_unlock:
+ mutex_unlock(&client->monc.mutex);
return 0;
}
@@ -56,13 +60,14 @@ static int osdmap_show(struct seq_file *
int i;
struct ceph_client *client = s->private;
struct ceph_osd_client *osdc = &client->osdc;
- struct ceph_osdmap *map = osdc->osdmap;
+ struct ceph_osdmap *map;
struct rb_node *n;
+ down_read(&osdc->lock);
+ map = osdc->osdmap;
if (map == NULL)
- return 0;
+ goto out_unlock;
- down_read(&osdc->lock);
seq_printf(s, "epoch %u barrier %u flags 0x%x\n", map->epoch,
osdc->epoch_barrier, map->flags);
@@ -131,6 +136,7 @@ static int osdmap_show(struct seq_file *
seq_printf(s, "]\n");
}
+out_unlock:
up_read(&osdc->lock);
return 0;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 290/300] fs: writeback: fix use-after-free in __mark_inode_dirty()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 289/300] libceph: fix potential use-after-free in have_mon_and_osd_map() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 291/300] Bluetooth: Add more enc key size check Greg Kroah-Hartman
` (15 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiufei Xue, Jan Kara,
Christian Brauner, Nazar Kalashnikov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiufei Xue <jiufei.xue@samsung.com>
[ Upstream commit d02d2c98d25793902f65803ab853b592c7a96b29 ]
An use-after-free issue occurred when __mark_inode_dirty() get the
bdi_writeback that was in the progress of switching.
CPU: 1 PID: 562 Comm: systemd-random- Not tainted 6.6.56-gb4403bd46a8e #1
......
pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __mark_inode_dirty+0x124/0x418
lr : __mark_inode_dirty+0x118/0x418
sp : ffffffc08c9dbbc0
........
Call trace:
__mark_inode_dirty+0x124/0x418
generic_update_time+0x4c/0x60
file_modified+0xcc/0xd0
ext4_buffered_write_iter+0x58/0x124
ext4_file_write_iter+0x54/0x704
vfs_write+0x1c0/0x308
ksys_write+0x74/0x10c
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x114
el0_svc_common.constprop.0+0xc0/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x40/0xe4
el0t_64_sync_handler+0x120/0x12c
el0t_64_sync+0x194/0x198
Root cause is:
systemd-random-seed kworker
----------------------------------------------------------------------
___mark_inode_dirty inode_switch_wbs_work_fn
spin_lock(&inode->i_lock);
inode_attach_wb
locked_inode_to_wb_and_lock_list
get inode->i_wb
spin_unlock(&inode->i_lock);
spin_lock(&wb->list_lock)
spin_lock(&inode->i_lock)
inode_io_list_move_locked
spin_unlock(&wb->list_lock)
spin_unlock(&inode->i_lock)
spin_lock(&old_wb->list_lock)
inode_do_switch_wbs
spin_lock(&inode->i_lock)
inode->i_wb = new_wb
spin_unlock(&inode->i_lock)
spin_unlock(&old_wb->list_lock)
wb_put_many(old_wb, nr_switched)
cgwb_release
old wb released
wb_wakeup_delayed() accesses wb,
then trigger the use-after-free
issue
Fix this race condition by holding inode spinlock until
wb_wakeup_delayed() finished.
Signed-off-by: Jiufei Xue <jiufei.xue@samsung.com>
Link: https://lore.kernel.org/20250728100715.3863241-1-jiufei.xue@samsung.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Backport fix for CVE-2025-39866
fs/fs-writeback.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -2326,9 +2326,6 @@ void __mark_inode_dirty(struct inode *in
wakeup_bdi = inode_io_list_move_locked(inode, wb,
dirty_list);
- spin_unlock(&wb->list_lock);
- trace_writeback_dirty_inode_enqueue(inode);
-
/*
* If this is the first dirty inode for this bdi,
* we have to wake-up the corresponding bdi thread
@@ -2338,6 +2335,10 @@ void __mark_inode_dirty(struct inode *in
if (wakeup_bdi &&
(wb->bdi->capabilities & BDI_CAP_WRITEBACK))
wb_wakeup_delayed(wb);
+
+ spin_unlock(&wb->list_lock);
+ trace_writeback_dirty_inode_enqueue(inode);
+
return;
}
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 291/300] Bluetooth: Add more enc key size check
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 290/300] fs: writeback: fix use-after-free in __mark_inode_dirty() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 292/300] netfilter: nf_set_pipapo: fix initial map fill Greg Kroah-Hartman
` (14 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Lu, Max Chou,
Luiz Augusto von Dentz, Nazar Kalashnikov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Lu <alex_lu@realsil.com.cn>
[ Upstream commit 04a342cc49a8522e99c9b3346371c329d841dcd2 ]
When we are slave role and receives l2cap conn req when encryption has
started, we should check the enc key size to avoid KNOB attack or BLUFFS
attack.
>From SIG recommendation, implementations are advised to reject
service-level connections on an encrypted baseband link with key
strengths below 7 octets.
A simple and clear way to achieve this is to place the enc key size
check in hci_cc_read_enc_key_size()
The btmon log below shows the case that lacks enc key size check.
> HCI Event: Connect Request (0x04) plen 10
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Class: 0x480104
Major class: Computer (desktop, notebook, PDA, organizers)
Minor class: Desktop workstation
Capturing (Scanner, Microphone)
Telephony (Cordless telephony, Modem, Headset)
Link type: ACL (0x01)
< HCI Command: Accept Connection Request (0x01|0x0009) plen 7
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Role: Peripheral (0x01)
> HCI Event: Command Status (0x0f) plen 4
Accept Connection Request (0x01|0x0009) ncmd 2
Status: Success (0x00)
> HCI Event: Connect Complete (0x03) plen 11
Status: Success (0x00)
Handle: 1
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Link type: ACL (0x01)
Encryption: Disabled (0x00)
...
> HCI Event: Encryption Change (0x08) plen 4
Status: Success (0x00)
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Encryption: Enabled with E0 (0x01)
< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
> HCI Event: Command Complete (0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 2
Status: Success (0x00)
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Key size: 6
// We should check the enc key size
...
> ACL Data RX: Handle 1 flags 0x02 dlen 12
L2CAP: Connection Request (0x02) ident 3 len 4
PSM: 25 (0x0019)
Source CID: 64
< ACL Data TX: Handle 1 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 3 len 8
Destination CID: 64
Source CID: 64
Result: Connection pending (0x0001)
Status: Authorization pending (0x0002)
> HCI Event: Number of Completed Packets (0x13) plen 5
Num handles: 1
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Count: 1
#35: len 16 (25 Kb/s)
Latency: 5 msec (2-7 msec ~4 msec)
< ACL Data TX: Handle 1 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 3 len 8
Destination CID: 64
Source CID: 64
Result: Connection successful (0x0000)
Status: No further information available (0x0000)
Cc: stable@vger.kernel.org
Signed-off-by: Alex Lu <alex_lu@realsil.com.cn>
Signed-off-by: Max Chou <max.chou@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Nazar Kalashnikov: change status to
rp_status due to function parameter conflict ]
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Backport fix for CVE-2023-24023
net/bluetooth/hci_event.c | 21 +++++++++++++++++++--
1 file changed, 19 insertions(+), 2 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3043,6 +3043,7 @@ static void read_enc_key_size_complete(s
const struct hci_rp_read_enc_key_size *rp;
struct hci_conn *conn;
u16 handle;
+ u8 rp_status;
BT_DBG("%s status 0x%02x", hdev->name, status);
@@ -3052,6 +3053,7 @@ static void read_enc_key_size_complete(s
}
rp = (void *)skb->data;
+ rp_status = rp->status;
handle = le16_to_cpu(rp->handle);
hci_dev_lock(hdev);
@@ -3064,15 +3066,30 @@ static void read_enc_key_size_complete(s
* secure approach is to then assume the key size is 0 to force a
* disconnection.
*/
- if (rp->status) {
+ if (rp_status) {
bt_dev_err(hdev, "failed to read key size for handle %u",
handle);
conn->enc_key_size = 0;
} else {
conn->enc_key_size = rp->key_size;
+ rp_status = 0;
+
+ if (conn->enc_key_size < hdev->min_enc_key_size) {
+ /* As slave role, the conn->state has been set to
+ * BT_CONNECTED and l2cap conn req might not be received
+ * yet, at this moment the l2cap layer almost does
+ * nothing with the non-zero status.
+ * So we also clear encrypt related bits, and then the
+ * handler of l2cap conn req will get the right secure
+ * state at a later time.
+ */
+ rp_status = HCI_ERROR_AUTH_FAILURE;
+ clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
+ clear_bit(HCI_CONN_AES_CCM, &conn->flags);
+ }
}
- hci_encrypt_cfm(conn, 0);
+ hci_encrypt_cfm(conn, rp_status);
unlock:
hci_dev_unlock(hdev);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 292/300] netfilter: nf_set_pipapo: fix initial map fill
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 291/300] Bluetooth: Add more enc key size check Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 293/300] scsi: pm80xx: Set phy->enable_completion only when we Greg Kroah-Hartman
` (13 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yi Chen, Stefano Brivio,
Florian Westphal, Pablo Neira Ayuso, Nazar Kalashnikov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 791a615b7ad2258c560f91852be54b0480837c93 ]
The initial buffer has to be inited to all-ones, but it must restrict
it to the size of the first field, not the total field size.
After each round in the map search step, the result and the fill map
are swapped, so if we have a set where f->bsize of the first element
is smaller than m->bsize_max, those one-bits are leaked into future
rounds result map.
This makes pipapo find an incorrect matching results for sets where
first field size is not the largest.
Followup patch adds a test case to nft_concat_range.sh selftest script.
Thanks to Stefano Brivio for pointing out that we need to zero out
the remainder explicitly, only correcting memset() argument isn't enough.
Fixes: 3c4287f62044 ("nf_tables: Add set type for arbitrary concatenation of ranges")
Reported-by: Yi Chen <yiche@redhat.com>
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Backport fix for CVE-2024-57947
net/netfilter/nft_set_pipapo.c | 4 ++--
net/netfilter/nft_set_pipapo.h | 21 +++++++++++++++++++++
net/netfilter/nft_set_pipapo_avx2.c | 10 ++++++----
3 files changed, 29 insertions(+), 6 deletions(-)
--- a/net/netfilter/nft_set_pipapo.c
+++ b/net/netfilter/nft_set_pipapo.c
@@ -432,7 +432,7 @@ bool nft_pipapo_lookup(const struct net
res_map = scratch->map + (map_index ? m->bsize_max : 0);
fill_map = scratch->map + (map_index ? 0 : m->bsize_max);
- memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));
+ pipapo_resmap_init(m, res_map);
nft_pipapo_for_each_field(f, i, m) {
bool last = i == m->field_count - 1;
@@ -536,7 +536,7 @@ static struct nft_pipapo_elem *pipapo_ge
goto out;
}
- memset(res_map, 0xff, m->bsize_max * sizeof(*res_map));
+ pipapo_resmap_init(m, res_map);
nft_pipapo_for_each_field(f, i, m) {
bool last = i == m->field_count - 1;
--- a/net/netfilter/nft_set_pipapo.h
+++ b/net/netfilter/nft_set_pipapo.h
@@ -287,4 +287,25 @@ static u64 pipapo_estimate_size(const st
return size;
}
+/**
+ * pipapo_resmap_init() - Initialise result map before first use
+ * @m: Matching data, including mapping table
+ * @res_map: Result map
+ *
+ * Initialize all bits covered by the first field to one, so that after
+ * the first step, only the matching bits of the first bit group remain.
+ *
+ * If other fields have a large bitmap, set remainder of res_map to 0.
+ */
+static inline void pipapo_resmap_init(const struct nft_pipapo_match *m, unsigned long *res_map)
+{
+ const struct nft_pipapo_field *f = m->f;
+ int i;
+
+ for (i = 0; i < f->bsize; i++)
+ res_map[i] = ULONG_MAX;
+
+ for (i = f->bsize; i < m->bsize_max; i++)
+ res_map[i] = 0ul;
+}
#endif /* _NFT_SET_PIPAPO_H */
--- a/net/netfilter/nft_set_pipapo_avx2.c
+++ b/net/netfilter/nft_set_pipapo_avx2.c
@@ -1028,6 +1028,7 @@ nothing:
/**
* nft_pipapo_avx2_lookup_slow() - Fallback function for uncommon field sizes
+ * @mdata: Matching data, including mapping table
* @map: Previous match result, used as initial bitmap
* @fill: Destination bitmap to be filled with current match result
* @f: Field, containing lookup and mapping tables
@@ -1043,7 +1044,8 @@ nothing:
* Return: -1 on no match, rule index of match if @last, otherwise first long
* word index to be checked next (i.e. first filled word).
*/
-static int nft_pipapo_avx2_lookup_slow(unsigned long *map, unsigned long *fill,
+static int nft_pipapo_avx2_lookup_slow(const struct nft_pipapo_match *mdata,
+ unsigned long *map, unsigned long *fill,
struct nft_pipapo_field *f, int offset,
const u8 *pkt, bool first, bool last)
{
@@ -1053,7 +1055,7 @@ static int nft_pipapo_avx2_lookup_slow(u
lt += offset * NFT_PIPAPO_LONGS_PER_M256;
if (first)
- memset(map, 0xff, bsize * sizeof(*map));
+ pipapo_resmap_init(mdata, map);
for (i = offset; i < bsize; i++) {
if (f->bb == 8)
@@ -1181,7 +1183,7 @@ next_match:
} else if (f->groups == 16) {
NFT_SET_PIPAPO_AVX2_LOOKUP(8, 16);
} else {
- ret = nft_pipapo_avx2_lookup_slow(res, fill, f,
+ ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,
ret, rp,
first, last);
}
@@ -1197,7 +1199,7 @@ next_match:
} else if (f->groups == 32) {
NFT_SET_PIPAPO_AVX2_LOOKUP(4, 32);
} else {
- ret = nft_pipapo_avx2_lookup_slow(res, fill, f,
+ ret = nft_pipapo_avx2_lookup_slow(m, res, fill, f,
ret, rp,
first, last);
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 293/300] scsi: pm80xx: Set phy->enable_completion only when we
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 292/300] netfilter: nf_set_pipapo: fix initial map fill Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 294/300] mptcp: Fix proto fallback detection with BPF Greg Kroah-Hartman
` (12 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Igor Pylypiv, Terrence Adams,
Jack Wang, Martin K. Petersen, Nazar Kalashnikov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Igor Pylypiv <ipylypiv@google.com>
[ Upstream commit e4f949ef1516c0d74745ee54a0f4882c1f6c7aea ]
pm8001_phy_control() populates the enable_completion pointer with a stack
address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and
returns. The problem arises when a phy control response comes late. After
300 ms the pm8001_phy_control() function returns and the passed
enable_completion stack address is no longer valid. Late phy control
response invokes complete() on a dangling enable_completion pointer which
leads to a kernel crash.
Signed-off-by: Igor Pylypiv <ipylypiv@google.com>
Signed-off-by: Terrence Adams <tadamsjr@google.com>
Link: https://lore.kernel.org/r/20240627155924.2361370-2-tadamsjr@google.com
Acked-by: Jack Wang <jinpu.wang@ionos.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Nazar Kalashnikov <sivartiwe@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Backport fix for CVE-2024-47666
drivers/scsi/pm8001/pm8001_sas.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/scsi/pm8001/pm8001_sas.c
+++ b/drivers/scsi/pm8001/pm8001_sas.c
@@ -163,7 +163,6 @@ int pm8001_phy_control(struct asd_sas_ph
unsigned long flags;
pm8001_ha = sas_phy->ha->lldd_ha;
phy = &pm8001_ha->phy[phy_id];
- pm8001_ha->phy[phy_id].enable_completion = &completion;
switch (func) {
case PHY_FUNC_SET_LINK_RATE:
rates = funcdata;
@@ -176,6 +175,7 @@ int pm8001_phy_control(struct asd_sas_ph
rates->maximum_linkrate;
}
if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+ pm8001_ha->phy[phy_id].enable_completion = &completion;
PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
wait_for_completion(&completion);
}
@@ -184,6 +184,7 @@ int pm8001_phy_control(struct asd_sas_ph
break;
case PHY_FUNC_HARD_RESET:
if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+ pm8001_ha->phy[phy_id].enable_completion = &completion;
PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
wait_for_completion(&completion);
}
@@ -192,6 +193,7 @@ int pm8001_phy_control(struct asd_sas_ph
break;
case PHY_FUNC_LINK_RESET:
if (pm8001_ha->phy[phy_id].phy_state == PHY_LINK_DISABLE) {
+ pm8001_ha->phy[phy_id].enable_completion = &completion;
PM8001_CHIP_DISP->phy_start_req(pm8001_ha, phy_id);
wait_for_completion(&completion);
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 294/300] mptcp: Fix proto fallback detection with BPF
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 293/300] scsi: pm80xx: Set phy->enable_completion only when we Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 295/300] smb: client: fix memory leak in cifs_construct_tcon() Greg Kroah-Hartman
` (11 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiayuan Chen, Martin KaFai Lau,
Jakub Sitnicki, Matthieu Baerts (NGI0)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiayuan Chen <jiayuan.chen@linux.dev>
commit c77b3b79a92e3345aa1ee296180d1af4e7031f8f upstream.
The sockmap feature allows bpf syscall from userspace, or based
on bpf sockops, replacing the sk_prot of sockets during protocol stack
processing with sockmap's custom read/write interfaces.
'''
tcp_rcv_state_process()
syn_recv_sock()/subflow_syn_recv_sock()
tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
bpf_skops_established <== sockops
bpf_sock_map_update(sk) <== call bpf helper
tcp_bpf_update_proto() <== update sk_prot
'''
When the server has MPTCP enabled but the client sends a TCP SYN
without MPTCP, subflow_syn_recv_sock() performs a fallback on the
subflow, replacing the subflow sk's sk_prot with the native sk_prot.
'''
subflow_syn_recv_sock()
subflow_ulp_fallback()
subflow_drop_ctx()
mptcp_subflow_ops_undo_override()
'''
Then, this subflow can be normally used by sockmap, which replaces the
native sk_prot with sockmap's custom sk_prot. The issue occurs when the
user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().
Here, it uses sk->sk_prot to compare with the native sk_prot, but this
is incorrect when sockmap is used, as we may incorrectly set
sk->sk_socket->ops.
This fix uses the more generic sk_family for the comparison instead.
Additionally, this also prevents a WARNING from occurring:
result from ./scripts/decode_stacktrace.sh:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
(net/mptcp/protocol.c:4005)
Modules linked in:
...
PKRU: 55555554
Call Trace:
<TASK>
do_accept (net/socket.c:1989)
__sys_accept4 (net/socket.c:2028 net/socket.c:2057)
__x64_sys_accept (net/socket.c:2067)
x64_sys_call (arch/x86/entry/syscall_64.c:41)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
RIP: 0033:0x7f87ac92b83d
---[ end trace 0000000000000000 ]---
Fixes: 0b4f33def7bb ("mptcp: fix tcp fallback crash")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev
[ Conflicts in protocol.c, because commit 8e2b8a9fa512 ("mptcp: don't
overwrite sock_ops in mptcp_is_tcpsk()") is not in this version. It
changes the logic on how and where the sock_ops is overridden in case
of passive fallback. To fix this, mptcp_is_tcpsk() is modified to use
the family, but first, a check of the protocol is required to continue
returning 'false' in case of MPTCP socket. ]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -56,8 +56,13 @@ static struct socket *__mptcp_nmpc_socke
static bool mptcp_is_tcpsk(struct sock *sk)
{
struct socket *sock = sk->sk_socket;
+ unsigned short family;
- if (unlikely(sk->sk_prot == &tcp_prot)) {
+ if (likely(sk->sk_protocol == IPPROTO_MPTCP))
+ return false;
+
+ family = READ_ONCE(sk->sk_family);
+ if (unlikely(family == AF_INET)) {
/* we are being invoked after mptcp_accept() has
* accepted a non-mp-capable flow: sk is a tcp_sk,
* not an mptcp one.
@@ -68,7 +73,7 @@ static bool mptcp_is_tcpsk(struct sock *
sock->ops = &inet_stream_ops;
return true;
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
- } else if (unlikely(sk->sk_prot == &tcpv6_prot)) {
+ } else if (unlikely(family == AF_INET6)) {
sock->ops = &inet6_stream_ops;
return true;
#endif
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 295/300] smb: client: fix memory leak in cifs_construct_tcon()
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 294/300] mptcp: Fix proto fallback detection with BPF Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 296/300] usb: typec: ucsi: psy: Set max current to zero when disconnected Greg Kroah-Hartman
` (10 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (Red Hat),
David Howells, Jay Shin, linux-cifs, Steve French, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.org>
[ Upstream commit 3184b6a5a24ec9ee74087b2a550476f386df7dc2 ]
When having a multiuser mount with domain= specified and using
cifscreds, cifs_set_cifscreds() will end up setting @ctx->domainname,
so it needs to be freed before leaving cifs_construct_tcon().
This fixes the following memory leak reported by kmemleak:
mount.cifs //srv/share /mnt -o domain=ZELDA,multiuser,...
su - testuser
cifscreds add -d ZELDA -u testuser
...
ls /mnt/1
...
umount /mnt
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
unreferenced object 0xffff8881203c3f08 (size 8):
comm "ls", pid 5060, jiffies 4307222943
hex dump (first 8 bytes):
5a 45 4c 44 41 00 cc cc ZELDA...
backtrace (crc d109a8cf):
__kmalloc_node_track_caller_noprof+0x572/0x710
kstrdup+0x3a/0x70
cifs_sb_tlink+0x1209/0x1770 [cifs]
cifs_get_fattr+0xe1/0xf50 [cifs]
cifs_get_inode_info+0xb5/0x240 [cifs]
cifs_revalidate_dentry_attr+0x2d1/0x470 [cifs]
cifs_getattr+0x28e/0x450 [cifs]
vfs_getattr_nosec+0x126/0x180
vfs_statx+0xf6/0x220
do_statx+0xab/0x110
__x64_sys_statx+0xd5/0x130
do_syscall_64+0xbb/0x380
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Fixes: f2aee329a68f ("cifs: set domainName when a domain-key is used in multiuser")
Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.org>
Reviewed-by: David Howells <dhowells@redhat.com>
Cc: Jay Shin <jaeshin@redhat.com>
Cc: stable@vger.kernel.org
Cc: linux-cifs@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
[ Different path + ctx -> vol_info ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/cifs/connect.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -5162,6 +5162,7 @@ cifs_construct_tcon(struct cifs_sb_info
out:
kfree(vol_info->username);
+ kfree(vol_info->domainname);
kfree_sensitive(vol_info->password);
kfree(vol_info);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 296/300] usb: typec: ucsi: psy: Set max current to zero when disconnected
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 295/300] smb: client: fix memory leak in cifs_construct_tcon() Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 297/300] usb: renesas_usbhs: Fix synchronous external abort on unbind Greg Kroah-Hartman
` (9 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jameson Thies, Benson Leung,
Heikki Krogerus, Sebastian Reichel, Kenneth R. Crudup,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jameson Thies <jthies@google.com>
[ Upstream commit 23379a17334fc24c4a9cbd9967d33dcd9323cc7c ]
The ucsi_psy_get_current_max function defaults to 0.1A when it is not
clear how much current the partner device can support. But this does
not check the port is connected, and will report 0.1A max current when
nothing is connected. Update ucsi_psy_get_current_max to report 0A when
there is no connection.
Fixes: af833e7f7db3 ("usb: typec: ucsi: psy: Set current max to 100mA for BC 1.2 and Default")
Cc: stable@vger.kernel.org
Signed-off-by: Jameson Thies <jthies@google.com>
Reviewed-by: Benson Leung <bleung@chromium.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Tested-by: Kenneth R. Crudup <kenny@panix.com>
Rule: add
Link: https://lore.kernel.org/stable/20251017000051.2094101-1-jthies%40google.com
Link: https://patch.msgid.link/20251106011446.2052583-1-jthies@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ adapted UCSI_CONSTAT() macro to direct flag access ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/psy.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/typec/ucsi/psy.c
+++ b/drivers/usb/typec/ucsi/psy.c
@@ -123,6 +123,11 @@ static int ucsi_psy_get_current_max(stru
{
u32 pdo;
+ if (!(con->status.flags & UCSI_CONSTAT_CONNECTED)) {
+ val->intval = 0;
+ return 0;
+ }
+
switch (UCSI_CONSTAT_PWR_OPMODE(con->status.flags)) {
case UCSI_CONSTAT_PWR_OPMODE_PD:
if (con->num_pdos > 0) {
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 297/300] usb: renesas_usbhs: Fix synchronous external abort on unbind
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 296/300] usb: typec: ucsi: psy: Set max current to zero when disconnected Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 298/300] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer Greg Kroah-Hartman
` (8 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Claudiu Beznea, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit eb9ac779830b2235847b72cb15cf07c7e3333c5e ]
A synchronous external abort occurs on the Renesas RZ/G3S SoC if unbind is
executed after the configuration sequence described above:
modprobe usb_f_ecm
modprobe libcomposite
modprobe configfs
cd /sys/kernel/config/usb_gadget
mkdir -p g1
cd g1
echo "0x1d6b" > idVendor
echo "0x0104" > idProduct
mkdir -p strings/0x409
echo "0123456789" > strings/0x409/serialnumber
echo "Renesas." > strings/0x409/manufacturer
echo "Ethernet Gadget" > strings/0x409/product
mkdir -p functions/ecm.usb0
mkdir -p configs/c.1
mkdir -p configs/c.1/strings/0x409
echo "ECM" > configs/c.1/strings/0x409/configuration
if [ ! -L configs/c.1/ecm.usb0 ]; then
ln -s functions/ecm.usb0 configs/c.1
fi
echo 11e20000.usb > UDC
echo 11e20000.usb > /sys/bus/platform/drivers/renesas_usbhs/unbind
The displayed trace is as follows:
Internal error: synchronous external abort: 0000000096000010 [#1] SMP
CPU: 0 UID: 0 PID: 188 Comm: sh Tainted: G M 6.17.0-rc7-next-20250922-00010-g41050493b2bd #55 PREEMPT
Tainted: [M]=MACHINE_CHECK
Hardware name: Renesas SMARC EVK version 2 based on r9a08g045s33 (DT)
pstate: 604000c5 (nZCv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs]
lr : usbhsg_update_pullup+0x3c/0x68 [renesas_usbhs]
sp : ffff8000838b3920
x29: ffff8000838b3920 x28: ffff00000d585780 x27: 0000000000000000
x26: 0000000000000000 x25: 0000000000000000 x24: ffff00000c3e3810
x23: ffff00000d5e5c80 x22: ffff00000d5e5d40 x21: 0000000000000000
x20: 0000000000000000 x19: ffff00000d5e5c80 x18: 0000000000000020
x17: 2e30303230316531 x16: 312d7968703a7968 x15: 3d454d414e5f4344
x14: 000000000000002c x13: 0000000000000000 x12: 0000000000000000
x11: ffff00000f358f38 x10: ffff00000f358db0 x9 : ffff00000b41f418
x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : fefefeff6364626d
x5 : 8080808000000000 x4 : 000000004b5ccb9d x3 : 0000000000000000
x2 : 0000000000000000 x1 : ffff800083790000 x0 : ffff00000d5e5c80
Call trace:
usbhs_sys_function_pullup+0x10/0x40 [renesas_usbhs] (P)
usbhsg_pullup+0x4c/0x7c [renesas_usbhs]
usb_gadget_disconnect_locked+0x48/0xd4
gadget_unbind_driver+0x44/0x114
device_remove+0x4c/0x80
device_release_driver_internal+0x1c8/0x224
device_release_driver+0x18/0x24
bus_remove_device+0xcc/0x10c
device_del+0x14c/0x404
usb_del_gadget+0x88/0xc0
usb_del_gadget_udc+0x18/0x30
usbhs_mod_gadget_remove+0x24/0x44 [renesas_usbhs]
usbhs_mod_remove+0x20/0x30 [renesas_usbhs]
usbhs_remove+0x98/0xdc [renesas_usbhs]
platform_remove+0x20/0x30
device_remove+0x4c/0x80
device_release_driver_internal+0x1c8/0x224
device_driver_detach+0x18/0x24
unbind_store+0xb4/0xb8
drv_attr_store+0x24/0x38
sysfs_kf_write+0x7c/0x94
kernfs_fop_write_iter+0x128/0x1b8
vfs_write+0x2ac/0x350
ksys_write+0x68/0xfc
__arm64_sys_write+0x1c/0x28
invoke_syscall+0x48/0x110
el0_svc_common.constprop.0+0xc0/0xe0
do_el0_svc+0x1c/0x28
el0_svc+0x34/0xf0
el0t_64_sync_handler+0xa0/0xe4
el0t_64_sync+0x198/0x19c
Code: 7100003f 1a9f07e1 531c6c22 f9400001 (79400021)
---[ end trace 0000000000000000 ]---
note: sh[188] exited with irqs disabled
note: sh[188] exited with preempt_count 1
The issue occurs because usbhs_sys_function_pullup(), which accesses the IP
registers, is executed after the USBHS clocks have been disabled. The
problem is reproducible on the Renesas RZ/G3S SoC starting with the
addition of module stop in the clock enable/disable APIs. With module stop
functionality enabled, a bus error is expected if a master accesses a
module whose clock has been stopped and module stop activated.
Disable the IP clocks at the end of remove.
Cc: stable <stable@kernel.org>
Fixes: f1407d5c6624 ("usb: renesas_usbhs: Add Renesas USBHS common code")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Link: https://patch.msgid.link/20251027140741.557198-1-claudiu.beznea.uj@bp.renesas.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Adjust context ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/renesas_usbhs/common.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/drivers/usb/renesas_usbhs/common.c
+++ b/drivers/usb/renesas_usbhs/common.c
@@ -802,19 +802,19 @@ static int usbhs_remove(struct platform_
flush_delayed_work(&priv->notify_hotplug_work);
- /* power off */
- if (!usbhs_get_dparam(priv, runtime_pwctrl))
- usbhsc_power_ctrl(priv, 0);
-
- pm_runtime_disable(&pdev->dev);
-
usbhs_platform_call(priv, hardware_exit, pdev);
- usbhsc_clk_put(priv);
reset_control_assert(priv->rsts);
usbhs_mod_remove(priv);
usbhs_fifo_remove(priv);
usbhs_pipe_remove(priv);
+ /* power off */
+ if (!usbhs_get_dparam(priv, runtime_pwctrl))
+ usbhsc_power_ctrl(priv, 0);
+
+ usbhsc_clk_put(priv);
+ pm_runtime_disable(&pdev->dev);
+
return 0;
}
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 298/300] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 297/300] usb: renesas_usbhs: Fix synchronous external abort on unbind Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 299/300] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up Greg Kroah-Hartman
` (7 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Yu Chen, Owen Gu,
Oliver Neukum, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Owen Gu <guhuinan@xiaomi.com>
[ Upstream commit 26d56a9fcb2014b99e654127960aa0a48a391e3c ]
When a UAS device is unplugged during data transfer, there is
a probability of a system panic occurring. The root cause is
an access to an invalid memory address during URB callback handling.
Specifically, this happens when the dma_direct_unmap_sg() function
is called within the usb_hcd_unmap_urb_for_dma() interface, but the
sg->dma_address field is 0 and the sg data structure has already been
freed.
The SCSI driver sends transfer commands by invoking uas_queuecommand_lck()
in uas.c, using the uas_submit_urbs() function to submit requests to USB.
Within the uas_submit_urbs() implementation, three URBs (sense_urb,
data_urb, and cmd_urb) are sequentially submitted. Device removal may
occur at any point during uas_submit_urbs execution, which may result
in URB submission failure. However, some URBs might have been successfully
submitted before the failure, and uas_submit_urbs will return the -ENODEV
error code in this case. The current error handling directly calls
scsi_done(). In the SCSI driver, this eventually triggers scsi_complete()
to invoke scsi_end_request() for releasing the sgtable. The successfully
submitted URBs, when being unlinked to giveback, call
usb_hcd_unmap_urb_for_dma() in hcd.c, leading to exceptions during sg
unmapping operations since the sg data structure has already been freed.
This patch modifies the error condition check in the uas_submit_urbs()
function. When a UAS device is removed but one or more URBs have already
been successfully submitted to USB, it avoids immediately invoking
scsi_done() and save the cmnd to devinfo->cmnd array. If the successfully
submitted URBs is completed before devinfo->resetting being set, then
the scsi_done() function will be called within uas_try_complete() after
all pending URB operations are finalized. Otherwise, the scsi_done()
function will be called within uas_zap_pending(), which is executed after
usb_kill_anchored_urbs().
The error handling only takes effect when uas_queuecommand_lck() calls
uas_submit_urbs() and returns the error value -ENODEV . In this case,
the device is disconnected, and the flow proceeds to uas_disconnect(),
where uas_zap_pending() is invoked to call uas_try_complete().
Fixes: eb2a86ae8c54 ("USB: UAS: fix disconnect by unplugging a hub")
Cc: stable <stable@kernel.org>
Signed-off-by: Yu Chen <chenyu45@xiaomi.com>
Signed-off-by: Owen Gu <guhuinan@xiaomi.com>
Acked-by: Oliver Neukum <oneukum@suse.com>
Link: https://patch.msgid.link/20251120123336.3328-1-guhuinan@xiaomi.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ adapted scsi_done(cmnd) helper to older cmnd->scsi_done(cmnd) callback API ]
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/uas.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/storage/uas.c
+++ b/drivers/usb/storage/uas.c
@@ -705,7 +705,11 @@ static int uas_queuecommand_lck(struct s
* of queueing, no matter how fatal the error
*/
if (err == -ENODEV) {
- set_host_byte(cmnd, DID_ERROR);
+ if (cmdinfo->state & (COMMAND_INFLIGHT | DATA_IN_URB_INFLIGHT |
+ DATA_OUT_URB_INFLIGHT))
+ goto out;
+
+ set_host_byte(cmnd, DID_NO_CONNECT);
cmnd->scsi_done(cmnd);
goto zombie;
}
@@ -718,6 +722,7 @@ static int uas_queuecommand_lck(struct s
uas_add_work(cmdinfo);
}
+out:
devinfo->cmnd[idx] = cmnd;
zombie:
spin_unlock_irqrestore(&devinfo->lock, flags);
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 299/300] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 298/300] usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 15:28 ` [PATCH 5.10 300/300] netfilter: nf_set_pipapo_avx2: fix initial map fill Greg Kroah-Hartman
` (6 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+316db8a1191938280eb6,
Vasiliy Kovalev, Amir Goldstein, Christian Brauner, Bin Lan
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
[ Upstream commit c84e125fff2615b4d9c259e762596134eddd2f27 ]
The issue was caused by dput(upper) being called before
ovl_dentry_update_reval(), while upper->d_flags was still
accessed in ovl_dentry_remote().
Move dput(upper) after its last use to prevent use-after-free.
BUG: KASAN: slab-use-after-free in ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
BUG: KASAN: slab-use-after-free in ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
ovl_dentry_remote fs/overlayfs/util.c:162 [inline]
ovl_dentry_update_reval+0xd2/0xf0 fs/overlayfs/util.c:167
ovl_link_up fs/overlayfs/copy_up.c:610 [inline]
ovl_copy_up_one+0x2105/0x3490 fs/overlayfs/copy_up.c:1170
ovl_copy_up_flags+0x18d/0x200 fs/overlayfs/copy_up.c:1223
ovl_rename+0x39e/0x18c0 fs/overlayfs/dir.c:1136
vfs_rename+0xf84/0x20a0 fs/namei.c:4893
...
</TASK>
Fixes: b07d5cc93e1b ("ovl: update of dentry revalidate flags after copy up")
Reported-by: syzbot+316db8a1191938280eb6@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=316db8a1191938280eb6
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://lore.kernel.org/r/20250214215148.761147-1-kovalev@altlinux.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
[ Minor context change fixed. ]
Signed-off-by: Bin Lan <lanbincn@qq.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/copy_up.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -469,7 +469,6 @@ static int ovl_link_up(struct ovl_copy_u
err = PTR_ERR(upper);
if (!IS_ERR(upper)) {
err = ovl_do_link(ovl_dentry_upper(c->dentry), udir, upper);
- dput(upper);
if (!err) {
/* Restore timestamps on parent (best effort) */
@@ -477,6 +476,7 @@ static int ovl_link_up(struct ovl_copy_u
ovl_dentry_set_upper_alias(c->dentry);
ovl_dentry_update_reval(c->dentry, upper);
}
+ dput(upper);
}
inode_unlock(udir);
if (err)
^ permalink raw reply [flat|nested] 312+ messages in thread* [PATCH 5.10 300/300] netfilter: nf_set_pipapo_avx2: fix initial map fill
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 299/300] ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up Greg Kroah-Hartman
@ 2025-12-03 15:28 ` Greg Kroah-Hartman
2025-12-03 16:51 ` [PATCH 5.10 000/300] 5.10.247-rc1 review Pavel Machek
` (5 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Greg Kroah-Hartman @ 2025-12-03 15:28 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Stefano Brivio,
Pablo Neira Ayuso
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit ea77c397bff8b6d59f6d83dae1425b08f465e8b5 upstream.
If the first field doesn't cover the entire start map, then we must zero
out the remainder, else we leak those bits into the next match round map.
The early fix was incomplete and did only fix up the generic C
implementation.
A followup patch adds a test case to nft_concat_range.sh.
Fixes: 791a615b7ad2 ("netfilter: nf_set_pipapo: fix initial map fill")
Signed-off-by: Florian Westphal <fw@strlen.de>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_set_pipapo_avx2.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
--- a/net/netfilter/nft_set_pipapo_avx2.c
+++ b/net/netfilter/nft_set_pipapo_avx2.c
@@ -1106,6 +1106,25 @@ bool nft_pipapo_avx2_estimate(const stru
}
/**
+ * pipapo_resmap_init_avx2() - Initialise result map before first use
+ * @m: Matching data, including mapping table
+ * @res_map: Result map
+ *
+ * Like pipapo_resmap_init() but do not set start map bits covered by the first field.
+ */
+static inline void pipapo_resmap_init_avx2(const struct nft_pipapo_match *m, unsigned long *res_map)
+{
+ const struct nft_pipapo_field *f = m->f;
+ int i;
+
+ /* Starting map doesn't need to be set to all-ones for this implementation,
+ * but we do need to zero the remaining bits, if any.
+ */
+ for (i = f->bsize; i < m->bsize_max; i++)
+ res_map[i] = 0ul;
+}
+
+/**
* nft_pipapo_avx2_lookup() - Lookup function for AVX2 implementation
* @net: Network namespace
* @set: nftables API set representation
@@ -1158,7 +1177,7 @@ bool nft_pipapo_avx2_lookup(const struct
res = scratch->map + (map_index ? m->bsize_max : 0);
fill = scratch->map + (map_index ? 0 : m->bsize_max);
- /* Starting map doesn't need to be set for this implementation */
+ pipapo_resmap_init_avx2(m, res);
nft_pipapo_avx2_prepare();
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 000/300] 5.10.247-rc1 review
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2025-12-03 15:28 ` [PATCH 5.10 300/300] netfilter: nf_set_pipapo_avx2: fix initial map fill Greg Kroah-Hartman
@ 2025-12-03 16:51 ` Pavel Machek
2025-12-03 17:33 ` Florian Fainelli
` (4 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Pavel Machek @ 2025-12-03 16:51 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor, hargar, broonie, achill, sr
[-- Attachment #1: Type: text/plain, Size: 58544 bytes --]
Hi!
> This is the start of the stable review cycle for the 5.10.247 release.
> There are 300 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.247-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
Something tagged 5.10.247-rc1 has compile problems in our testing.
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/2194166780
Gitlab says:
"Linux 5.10.247-rc1 (527f7b9e9a2b)
Retry
Failed
Created 1 hour ago by cip-ci, finished 39 minutes ago"
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
CC drivers/soc/tegra/regulators-tegra30.o
2663
drivers/soc/tegra/fuse/fuse-tegra30.c:250:3: error: 'const struct tegra_fuse_soc' has no member named 'cells'
2664
250 | .cells = tegra114_fuse_cells,
2665
| ^~~~~
2666
drivers/soc/tegra/fuse/fuse-tegra30.c:250:11: error: initialization of 'const struct attribute_group *' from incompatible pointer type 'const struct nvmem_cell_info *' [-Werror=incompatible-pointer-types]
2667
250 | .cells = tegra114_fuse_cells,
2668
| ^~~~~~~~~~~~~~~~~~~
2669
drivers/soc/tegra/fuse/fuse-tegra30.c:250:11: note: (near initialization for 'tegra114_fuse_soc.soc_attr_group')
2670
drivers/soc/tegra/fuse/fuse-tegra30.c:251:3: error: 'const struct tegra_fuse_soc' has no member named 'num_cells'
2671
251 | .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
2672
| ^~~~~~~~~
2673
In file included from ./include/asm-generic/bug.h:20,
2674
from ./arch/arm/include/asm/bug.h:60,
2675
from ./include/linux/bug.h:5,
2676
from ./include/linux/thread_info.h:12,
2677
from ./include/asm-generic/current.h:5,
2678
from ./arch/arm/include/generated/asm/current.h:1,
2679
from ./include/linux/sched.h:12,
2680
from ./include/linux/ratelimit.h:6,
2681
from ./include/linux/dev_printk.h:16,
2682
from ./include/linux/device.h:15,
2683
from drivers/soc/tegra/fuse/fuse-tegra30.c:6:
2684
./include/linux/kernel.h:49:25: warning: excess elements in struct initializer
2685
49 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
2686
| ^
2687
drivers/soc/tegra/fuse/fuse-tegra30.c:251:15: note: in expansion of macro 'ARRAY_SIZE'
2688
251 | .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
2689
| ^~~~~~~~~~
2690
./include/linux/kernel.h:49:25: note: (near initialization for 'tegra114_fuse_soc')
2691
49 | #define ARRAY_SIZE(arr) (sizeof(arr) / sizeof((arr)[0]) + __must_be_array(arr))
2692
| ^
2693
drivers/soc/tegra/fuse/fuse-tegra30.c:251:15: note: in expansion of macro 'ARRAY_SIZE'
2694
251 | .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
2695
| ^~~~~~~~~~
2696
cc1: some warnings being treated as errors
2697
make[4]: *** [scripts/Makefile.build:286: drivers/soc/tegra/fuse/fuse-tegra30.o] Error 1
2698
make[4]: *** Waiting for unfinished jobs....
2699
CC drivers/soc/renesas/rcar-sysc.o
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.247-rc1
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_set_pipapo_avx2: fix initial map fill
>
> Vasiliy Kovalev <kovalev@altlinux.org>
> ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up
>
> Owen Gu <guhuinan@xiaomi.com>
> usb: uas: fix urb unmapping issue when the uas device is remove during ongoing data transfer
>
> Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
> usb: renesas_usbhs: Fix synchronous external abort on unbind
>
> Jameson Thies <jthies@google.com>
> usb: typec: ucsi: psy: Set max current to zero when disconnected
>
> Paulo Alcantara <pc@manguebit.org>
> smb: client: fix memory leak in cifs_construct_tcon()
>
> Jiayuan Chen <jiayuan.chen@linux.dev>
> mptcp: Fix proto fallback detection with BPF
>
> Igor Pylypiv <ipylypiv@google.com>
> scsi: pm80xx: Set phy->enable_completion only when we
>
> Florian Westphal <fw@strlen.de>
> netfilter: nf_set_pipapo: fix initial map fill
>
> Alex Lu <alex_lu@realsil.com.cn>
> Bluetooth: Add more enc key size check
>
> Jiufei Xue <jiufei.xue@samsung.com>
> fs: writeback: fix use-after-free in __mark_inode_dirty()
>
> Ilya Dryomov <idryomov@gmail.com>
> libceph: fix potential use-after-free in have_mon_and_osd_map()
>
> Alex Hung <alex.hung@amd.com>
> drm/amd/display: Check NULL before accessing
>
> Johan Hovold <johan@kernel.org>
> drm: sti: fix device leaks at component probe
>
> Vanillan Wang <vanillanwang@163.com>
> USB: serial: option: add support for Rolling RW101R-GL
>
> Oleksandr Suvorov <cryosay@gmail.com>
> USB: serial: ftdi_sio: add support for u-blox EVK-M101
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: dbgtty: Fix data corruption when transmitting data form DbC to host
>
> Manish Nagar <manish.nagar@oss.qualcomm.com>
> usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths
>
> Tianchu Chen <flynnnchen@tencent.com>
> usb: storage: sddr55: Reject out-of-bound new_pba
>
> Alan Stern <stern@rowland.harvard.edu>
> USB: storage: Remove subclass and protocol overrides from Novatek quirk
>
> Desnes Nunes <desnesn@redhat.com>
> usb: storage: Fix memory leak in USB bulk transport
>
> Kuen-Han Tsai <khtsai@google.com>
> usb: gadget: f_eem: Fix memory leak in eem_unwrap
>
> Miaoqian Lin <linmq006@gmail.com>
> usb: cdns3: Fix double resource release in cdns3_pci_probe
>
> Johan Hovold <johan@kernel.org>
> most: usb: fix double free on late probe failure
>
> Miaoqian Lin <linmq006@gmail.com>
> serial: amba-pl011: prefer dma_mapping_error() over explicit address checking
>
> Khairul Anuar Romli <khairul.anuar.romli@altera.com>
> firmware: stratix10-svc: fix bug in saving controller data
>
> Miaoqian Lin <linmq006@gmail.com>
> slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves
>
> Alan Borzeszkowski <alan.borzeszkowski@linux.intel.com>
> thunderbolt: Add support for Intel Wildcat Lake
>
> Mikulas Patocka <mpatocka@redhat.com>
> dm-verity: fix unreliable memory allocation
>
> Marc Kleine-Budde <mkl@pengutronix.de>
> can: sun4i_can: sun4i_can_interrupt(): fix max irq loop handling
>
> Thomas Mühlbacher <tmuehlbacher@posteo.net>
> can: sja1000: fix max irq loop handling
>
> Gui-Dong Han <hanguidong02@gmail.com>
> atm/fore200e: Fix possible data race in fore200e_open()
>
> Thomas Bogendoerfer <tsbogend@alpha.franken.de>
> MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> MIPS: mm: Prevent a TLB shutdown on initial uniquification
>
> Christophe JAILLET <christophe.jaillet@wanadoo.fr>
> iio:common:ssp_sensors: Fix an error handling path ssp_probe()
>
> Francesco Lavra <flavra@baylibre.com>
> iio: imu: st_lsm6dsx: fix array size for st_lsm6dsx_settings fields
>
> Jiri Olsa <jolsa@kernel.org>
> Revert "perf/x86: Always store regs->ip in perf_callchain_kernel()"
>
> Hang Zhou <929513338@qq.com>
> spi: bcm63xx: fix premature CS deassertion on RX-only transactions
>
> Haotian Zhang <vulab@iscas.ac.cn>
> mailbox: mailbox-test: Fix debugfs_create_dir error checking
>
> Jiefeng Zhang <jiefeng.z.zhang@gmail.com>
> net: atlantic: fix fragment overflow handling in RX path
>
> Alexey Kodanev <aleksei.kodanev@bell-sw.com>
> net: sxgbe: fix potential NULL dereference in sxgbe_rx()
>
> Danielle Costantino <dcostantino@meta.com>
> net/mlx5e: Fix validation logic in rate limiting
>
> Kai-Heng Feng <kaihengf@nvidia.com>
> net: aquantia: Add missing descriptor cache invalidation on ATL2
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: SMP: Fix not generating mackey and ltk when repairing
>
> Seungjin Bae <eeodqql09@gmail.com>
> can: kvaser_usb: leaf: Fix potential infinite loop in command parsers
>
> Seungjin Bae <eeodqql09@gmail.com>
> Input: pegasus-notetaker - fix potential out-of-bounds access
>
> Vincent Mailhol <mailhol.vincent@wanadoo.fr>
> Input: remove third argument of usb_maxpacket()
>
> Vincent Mailhol <mailhol.vincent@wanadoo.fr>
> usb: deprecate the third argument of usb_maxpacket()
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: do not fallback when OoO is present
>
> Eric Dumazet <edumazet@google.com>
> mptcp: fix a race in mptcp_pm_del_add_timer()
>
> Vlastimil Babka <vbabka@suse.cz>
> mm/mempool: fix poisoning order>0 pages with HIGHMEM
>
> Fabio M. De Francesco <fabio.maria.de.francesco@linux.intel.com>
> mm/mempool: replace kmap_atomic() with kmap_local_page()
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> dt-bindings: pinctrl: toshiba,visconti: Fix number of items in groups
>
> Eric Dumazet <edumazet@google.com>
> mptcp: fix race condition in mptcp_schedule_work()
>
> Paolo Abeni <pabeni@redhat.com>
> mptcp: introduce mptcp_schedule_work
>
> Niklas Cassel <cassel@kernel.org>
> ata: libata-scsi: Fix system suspend for a security locked drive
>
> Sudeep Holla <sudeep.holla@arm.com>
> pmdomain: arm: scmi: Fix genpd leak on provider registration failure
>
> Miaoqian Lin <linmq006@gmail.com>
> pmdomain: imx: Fix reference count leak in imx_gpc_remove
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Fix potential overflow of PCM transfer buffer
>
> Breno Leitao <leitao@debian.org>
> net: netpoll: fix incorrect refcount handling causing incorrect cleanup
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> Revert "NFS: Don't set NFS_INO_REVAL_PAGECACHE in the inode cache validity"
>
> Nick Desaulniers <ndesaulniers@google.com>
> Makefile.compiler: replace cc-ifversion with compiler-specific macros
>
> Nathan Chancellor <nathan@kernel.org>
> net: qede: Initialize qede_ll_ops with designated initializer
>
> Long Li <longli@microsoft.com>
> uio_hv_generic: Set event for all channels on the device
>
> Nishanth Menon <nm@ti.com>
> net: ethernet: ti: netcp: Standardize knav_dma_open_channel to return NULL on error
>
> René Rebe <rene@exactco.de>
> ALSA: usb-audio: fix uac2 clock source at terminal parser
>
> Isaac J. Manjarres <isaacmanjarres@google.com>
> mm/mm_init: fix hash table order logging in alloc_large_system_hash()
>
> Jakub Horký <jakub.git@horky.net>
> kconfig/nconf: Initialize the default locale at startup
>
> Jakub Horký <jakub.git@horky.net>
> kconfig/mconf: Initialize the default locale at startup
>
> Shahar Shitrit <shshitrit@nvidia.com>
> net: tls: Cancel RX async resync request on rcd_delta overflow
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: core: Fix a regression triggered by scsi_host_busy()
>
> Michal Luczaj <mhal@rbox.co>
> vsock: Ignore signal/timeout on connect() if already established
>
> Aleksei Nikiforov <aleksei.nikiforov@linux.ibm.com>
> s390/ctcm: Fix double-kfree
>
> Ilya Maximets <i.maximets@ovn.org>
> net: openvswitch: remove never-working support for setting nsh fields
>
> Zilin Guan <zilin@seu.edu.cn>
> mlxsw: spectrum: Fix memory leak in mlxsw_sp_flower_stats()
>
> Ma Ke <make24@iscas.ac.cn>
> drm/tegra: dc: Fix reference leak in tegra_dc_couple()
>
> Maciej W. Rozycki <macro@orcam.me.uk>
> MIPS: Malta: Fix !EVA SOC-it PCI MMIO
>
> Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
> scsi: target: tcm_loop: Fix segfault in tcm_loop_tpg_address_show()
>
> Bart Van Assche <bvanassche@acm.org>
> scsi: sg: Do not sleep in atomic context
>
> Ewan D. Milne <emilne@redhat.com>
> nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> Input: imx_sc_key - fix memory corruption on unload
>
> Tzung-Bi Shih <tzungbi@kernel.org>
> Input: cros_ec_keyb - fix an invalid memory access
>
> Andrey Vatoropin <a.vatoropin@crpt.ru>
> be2net: pass wrb_params in case of OS2BMC
>
> Yongpeng Yang <yangyongpeng@xiaomi.com>
> exfat: check return value of sb_min_blocksize in exfat_read_boot_sector
>
> Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
> mtd: rawnand: cadence: fix DMA device NULL pointer dereference
>
> Zhang Heng <zhangheng@kylinos.cn>
> HID: quirks: work around VID/PID conflict for 0x4c4a/0x4155
>
> Abdun Nihaal <nihaal@cse.iitm.ac.in>
> isdn: mISDN: hfcsusb: fix memory leak in hfcsusb_probe()
>
> Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
> EDAC/altera: Use INTTEST register for Ethernet and USB SBE injection
>
> Niravkumar L Rabara <niravkumarlaxmidas.rabara@altera.com>
> EDAC/altera: Handle OCRAM ECC enable after warm reset
>
> Hans de Goede <hansg@kernel.org>
> spi: Try to get ACPI GPIO IRQ earlier
>
> Wei Yang <albinwyang@tencent.com>
> fs/proc: fix uaf in proc_readdir_de()
>
> Chuang Wang <nashuiliang@gmail.com>
> ipv4: route: Prevent rt_bind_exception() from rebinding stale fnhe
>
> Nate Karstens <nate.karstens@garmin.com>
> strparser: Fix signed/unsigned mismatch bug
>
> Peter Oberparleiter <oberpar@linux.ibm.com>
> gcov: add support for GCC 15
>
> Olga Kornievskaia <okorniev@redhat.com>
> NFSD: free copynotify stateid in nfs4_free_ol_stateid()
>
> Masami Ichikawa <masami256@gmail.com>
> HID: hid-ntrig: Prevent memory leak in ntrig_report_version()
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nf_tables: reject duplicate device on updates
>
> Dan Carpenter <dan.carpenter@linaro.org>
> mtd: onenand: Pass correct pointer to IRQ handler
>
> Eric Biggers <ebiggers@kernel.org>
> lib/crypto: arm/curve25519: Disable on CPU_BIG_ENDIAN
>
> Jakub Acs <acsjakub@amazon.de>
> mm/ksm: fix flag-dropping behavior in ksm_madvise
>
> Christoph Hellwig <hch@lst.de>
> fsdax: mark the iomap argument to dax_iomap_sector as const
>
> Haein Lee <lhi0729@kaist.ac.kr>
> ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd
>
> Ian Forbes <ian.forbes@broadcom.com>
> drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE
>
> Haotian Zhang <vulab@iscas.ac.cn>
> ASoC: cs4271: Fix regulator leak on probe failure
>
> Haotian Zhang <vulab@iscas.ac.cn>
> regulator: fixed: fix GPIO descriptor leak on register failure
>
> Chris Morgan <macromorgan@hotmail.com>
> regulator: fixed: use dev_err_probe for register
>
> Shuai Xue <xueshuai@linux.alibaba.com>
> acpi,srat: Fix incorrect device handle check for Generic Initiator
>
> Pauli Virtanen <pav@iki.fi>
> Bluetooth: L2CAP: export l2cap_chan_hold for modules
>
> Felix Maurer <fmaurer@redhat.com>
> hsr: Fix supervision frame sending on HSRv0
>
> Eric Dumazet <edumazet@google.com>
> net_sched: limit try_bulk_dequeue_skb() batches
>
> Gal Pressman <gal@nvidia.com>
> net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps
>
> Gal Pressman <gal@nvidia.com>
> net/mlx5e: Fix maxrate wraparound in threshold between units
>
> Ranganath V N <vnranganath.20@gmail.com>
> net: sched: act_ife: initialize struct tc_ife to fix KMSAN kernel-infoleak
>
> Benjamin Berg <benjamin.berg@intel.com>
> wifi: mac80211: skip rate verification for not captured PSDUs
>
> Buday Csaba <buday.csaba@prolan.hu>
> net: mdio: fix resource leak in mdiobus_register_device()
>
> Kuniyuki Iwashima <kuniyu@google.com>
> tipc: Fix use-after-free in tipc_mon_reinit_self().
>
> D. Wythe <alibuda@linux.alibaba.com>
> net/smc: fix mismatch between CLC header and proposal
>
> Eric Dumazet <edumazet@google.com>
> sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto
>
> Pauli Virtanen <pav@iki.fi>
> Bluetooth: 6lowpan: Don't hold spin lock over sleeping functions
>
> Pauli Virtanen <pav@iki.fi>
> Bluetooth: 6lowpan: fix BDADDR_LE vs ADDR_LE_DEV address type confusion
>
> Pauli Virtanen <pav@iki.fi>
> Bluetooth: 6lowpan: reset link-local header on ipv6 recv path
>
> Raphael Pinsonneault-Thibeault <rpthibeault@gmail.com>
> Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF
>
> Wei Fang <wei.fang@nxp.com>
> net: fec: correct rx_bytes statistic for the case SHIFT16 is set
>
> Sharique Mohammad <sharq0406@gmail.com>
> ASoC: max98090/91: fixed max98091 ALSA widget powering up/down
>
> Tristan Lobb <tristan.lobb@it-lobb.de>
> HID: quirks: avoid Cooler Master MM712 dongle wakeup bug
>
> Joshua Watt <jpewhacker@gmail.com>
> NFS4: Fix state renewals missing after boot
>
> Danil Skrebenkov <danil.skrebenkov@cloudbear.ru>
> RISC-V: clear hot-unplugged cores from all task mm_cpumasks to avoid rfence errors
>
> Peter Zijlstra <peterz@infradead.org>
> compiler_types: Move unused static inline functions warning to W=2
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> extcon: adc-jack: Cleanup wakeup source only if it was enabled
>
> Nathan Chancellor <nathan@kernel.org>
> lib/crypto: curve25519-hacl64: Fix older clang KASAN workaround for GCC
>
> Zilin Guan <zilin@seu.edu.cn>
> tracing: Fix memory leaks in create_field_var()
>
> Qendrim Maxhuni <qendrim.maxhuni@garderos.com>
> net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup
>
> Stefan Wiehler <stefan.wiehler@nokia.com>
> sctp: Hold sock lock while iterating over address list
>
> Xin Long <lucien.xin@gmail.com>
> sctp: hold endpoint before calling cb in sctp_transport_lookup_process
>
> Yajun Deng <yajun.deng@linux.dev>
> net: Use nlmsg_unicast() instead of netlink_unicast()
>
> Lu Wei <luwei32@huawei.com>
> net: sctp: Fix some typos
>
> Stefan Wiehler <stefan.wiehler@nokia.com>
> sctp: Prevent TOCTOU out-of-bounds write
>
> Stefan Wiehler <stefan.wiehler@nokia.com>
> sctp: Hold RCU read lock while iterating over address list
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: stop reading ARL entries if search is done
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix enabling ip multicast
>
> Jonas Gorski <jonas.gorski@gmail.com>
> net: dsa: b53: fix resetting speed and pause on forced link
>
> Hangbin Liu <liuhangbin@gmail.com>
> net: vlan: sync VLAN features with lower device
>
> Josephine Pfeiffer <hi@josie.lol>
> riscv: ptdump: use seq_puts() in pt_dump_seq_puts() macro
>
> Kailang Yang <kailang@realtek.com>
> ALSA: hda/realtek: Audio disappears on HP 15-fc000 after warm boot again
>
> Viacheslav Dubeyko <Slava.Dubeyko@ibm.com>
> ceph: add checking of wait_for_completion_killable() return value
>
> Valerio Setti <vsetti@baylibre.com>
> ASoC: meson: aiu-encoder-i2s: fix bit clock polarity
>
> Albin Babu Varghese <albinbabuvarghese20@gmail.com>
> fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds
>
> Ian Rogers <irogers@google.com>
> tools bitmap: Add missing asm-generic/bitsperlong.h include
>
> Sakari Ailus <sakari.ailus@linux.intel.com>
> ACPI: property: Return present device nodes only on fwnode interface
>
> Randall P. Embry <rpembry@gmail.com>
> 9p: sysfs_init: don't hardcode error to ENOMEM
>
> Randall P. Embry <rpembry@gmail.com>
> 9p: fix /sys/fs/9p/caches overwriting itself
>
> Nicolas Ferre <nicolas.ferre@microchip.com>
> ARM: at91: pm: save and restore ACR during PLL disable/enable
>
> Tiwei Bie <tiwei.btw@antgroup.com>
> um: Fix help message for ssl-non-raw
>
> Yikang Yue <yikangy2@illinois.edu>
> fs/hpfs: Fix error code for new_inode() failure in mkdir/create/mknod/symlink
>
> austinchang <austinchang@synology.com>
> btrfs: mark dirty extent range for out of bound prealloc extents
>
> Saket Dumbre <saket.dumbre@intel.com>
> ACPICA: Update dsmethod.c to get rid of unused variable warning
>
> Mike Marshall <hubcap@omnibond.com>
> orangefs: fix xattr related buffer overflow...
>
> Dragos Tatulea <dtatulea@nvidia.com>
> page_pool: Clamp pool size to max 16K pages
>
> Chi Zhiling <chizhiling@kylinos.cn>
> exfat: limit log print for IO error
>
> Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
> ALSA: usb-audio: add mono main switch to Presonus S1824c
>
> Ivan Pravdin <ipravdin.official@gmail.com>
> Bluetooth: bcsp: receive data only if registered
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: SCO: Fix UAF on sco_conn_free
>
> Théo Lebrun <theo.lebrun@bootlin.com>
> net: macb: avoid dealing with endianness in macb_set_hwaddr()
>
> chuguangqing <chuguangqing@inspur.com>
> fs: ext4: change GFP_KERNEL to GFP_NOFS to avoid deadlock
>
> Al Viro <viro@zeniv.linux.org.uk>
> nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing
>
> Anthony Iliopoulos <ailiop@suse.com>
> NFSv4.1: fix mount hang after CREATE_SESSION failure
>
> Olga Kornievskaia <okorniev@redhat.com>
> NFSv4: handle ERR_GRACE on delegation recalls
>
> Stephan Gerhold <stephan.gerhold@linaro.org>
> remoteproc: qcom: q6v5: Avoid handling handover twice
>
> Koakuma <koachan@protonmail.com>
> sparc/module: Add R_SPARC_UA64 relocation handling
>
> Chen Wang <unicorn_wang@outlook.com>
> PCI: cadence: Check for the existence of cdns_pcie::ops before using it
>
> ChunHao Lin <hau@realtek.com>
> r8169: set EEE speed down ratio to 1
>
> Brahmajit Das <listout@listout.xyz>
> net: intel: fm10k: Fix parameter idx set but not used
>
> Loic Poulain <loic.poulain@oss.qualcomm.com>
> wifi: ath10k: Fix connection after GTK rekeying
>
> Shaurya Rane <ssrane_b23@ee.vjti.ac.in>
> jfs: fix uninitialized waitqueue in transaction manager
>
> Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> jfs: Verify inode mode when loading from disk
>
> Eric Dumazet <edumazet@google.com>
> ipv6: np->rxpmtu race annotation
>
> Krishna Kurapati <krishna.kurapati@oss.qualcomm.com>
> usb: xhci: plat: Facilitate using autosuspend for xhci plat devices
>
> Forest Crossman <cyrozap@gmail.com>
> usb: mon: Increase BUFF_MAX to 64 MiB to support multi-MB URBs
>
> Al Viro <viro@zeniv.linux.org.uk>
> allow finish_no_open(file, ERR_PTR(-E...))
>
> Justin Tee <justin.tee@broadcom.com>
> scsi: lpfc: Define size of debugfs entry for xri rebalancing
>
> Nai-Chen Cheng <bleach1827@gmail.com>
> selftests/Makefile: include $(INSTALL_DEP_TARGETS) in clean target to clean net/lib dependency
>
> Yafang Shao <laoar.shao@gmail.com>
> net/cls_cgroup: Fix task_get_classid() during qdisc run
>
> Alok Tiwari <alok.a.tiwari@oracle.com>
> udp_tunnel: use netdev_warn() instead of netdev_WARN()
>
> David Ahern <dsahern@kernel.org>
> selftests: Replace sleep with slowwait
>
> Daniel Palmer <daniel@thingy.jp>
> eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP
>
> David Ahern <dsahern@kernel.org>
> selftests: Disable dad for ipv6 in fcnal-test.sh
>
> Li RongQing <lirongqing@baidu.com>
> x86/kvm: Prefer native qspinlock for dedicated vCPUs irrespective of PV_UNHALT
>
> Ido Schimmel <idosch@nvidia.com>
> selftests: traceroute: Use require_command()
>
> Qianfeng Rong <rongqianfeng@vivo.com>
> media: redrat3: use int type to store negative error codes
>
> Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
> net: sh_eth: Disable WoL if system can not suspend
>
> Harikrishna Shenoy <h-shenoy@ti.com>
> phy: cadence: cdns-dphy: Enable lower resolutions in dphy
>
> Rohan G Thomas <rohan.g.thomas@altera.com>
> net: phy: marvell: Fix 88e1510 downshift counter errata
>
> William Wu <william.wu@rock-chips.com>
> usb: gadget: f_hid: Fix zero length packet transfer
>
> Ashish Kalra <ashish.kalra@amd.com>
> iommu/amd: Skip enabling command/event buffers for kdump
>
> Eric Dumazet <edumazet@google.com>
> net: call cond_resched() less often in __release_sock()
>
> Cryolitia PukNgae <cryolitia@uniontech.com>
> ALSA: usb-audio: apply quirk for MOONDROP Quark2
>
> Juraj Šarinay <juraj@sarinay.com>
> net: nfc: nci: Increase NCI_DATA_TIMEOUT to 3000 ms
>
> Yue Haibing <yuehaibing@huawei.com>
> ipv6: Add sanity checks on ipv6_devconf.rpl_seg_enabled
>
> Devendra K Verma <devverma@amd.com>
> dmaengine: dw-edma: Set status for callback_result
>
> Rosen Penev <rosenp@gmail.com>
> dmaengine: mv_xor: match alloc_wc and free_wc
>
> Thomas Andreatta <thomasandreatta2000@gmail.com>
> dmaengine: sh: setup_xref error handling
>
> Qianfeng Rong <rongqianfeng@vivo.com>
> scsi: pm8001: Use int instead of u32 to store error codes
>
> Aleksander Jan Bajkowski <olek2@wp.pl>
> mips: lantiq: xway: sysctrl: rename stp clock
>
> Aleksander Jan Bajkowski <olek2@wp.pl>
> mips: lantiq: danube: add missing device_type in pci node
>
> Aleksander Jan Bajkowski <olek2@wp.pl>
> mips: lantiq: danube: add missing properties to cpu node
>
> Chelsy Ratnawat <chelsyratnawat2001@gmail.com>
> media: fix uninitialized symbol warnings
>
> Amber Lin <Amber.Lin@amd.com>
> drm/amdkfd: Tie UNMAP_LATENCY to queue_preemption
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> extcon: adc-jack: Fix wakeup source leaks on device unbind
>
> Francisco Gutierrez <frankramirez@google.com>
> scsi: pm80xx: Fix race condition caused by static variables
>
> Ujwal Kundur <ujwal.kundur@gmail.com>
> rds: Fix endianness annotation for RDS_MPATH_HASH
>
> Takashi Iwai <tiwai@suse.de>
> ALSA: usb-audio: Add validation of UAC2/UAC3 effect units
>
> Sungho Kim <sungho.kim@furiosa.ai>
> PCI/P2PDMA: Fix incorrect pointer usage in devm_kfree() call
>
> Kuniyuki Iwashima <kuniyu@google.com>
> net: Call trace_sock_exceed_buf_limit() for memcg failure with SK_MEM_RECV.
>
> Christoph Paasch <cpaasch@openai.com>
> net: When removing nexthops, don't call synchronize_net if it is not necessary
>
> Zijun Hu <zijun.hu@oss.qualcomm.com>
> char: misc: Does not request module for miscdevice with dynamic minor
>
> raub camaioni <raubcameo@gmail.com>
> usb: gadget: f_ncm: Fix MAC assignment NCM ethernet
>
> Rodrigo Gobbi <rodrigo.gobbi.7@gmail.com>
> iio: adc: spear_adc: mask SPEAR_ADC_STATUS channel and avg sample before setting register
>
> Dmitry Baryshkov <dmitry.baryshkov@oss.qualcomm.com>
> drm/bridge: display-connector: don't set OP_DETECT for DisplayPorts
>
> Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> media: imon: make send_packet() more robust
>
> Charalampos Mitrodimas <charmitro@posteo.net>
> net: ipv6: fix field-spanning memcpy warning in AH output
>
> Ido Schimmel <idosch@nvidia.com>
> bridge: Redirect to backup port when port is administratively down
>
> Niklas Schnelle <schnelle@linux.ibm.com>
> powerpc/eeh: Use result of error_detected() in uevent
>
> Tiezhu Yang <yangtiezhu@loongson.cn>
> net: stmmac: Check stmmac_hw_setup() in stmmac_resume()
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> x86/vsyscall: Do not require X86_PF_INSTR to emulate vsyscall
>
> Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
> drm/tidss: Use the crtc_* timings when programming the HW
>
> Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
> media: pci: ivtv: Don't create fake v4l2_fh
>
> Geoffrey McRae <geoffrey.mcrae@amd.com>
> drm/amdkfd: return -ENOTTY for unsupported IOCTLs
>
> Wake Liu <wakel@google.com>
> selftests/net: Ensure assert() triggers in psock_tpacket.c
>
> Wake Liu <wakel@google.com>
> selftests/net: Replace non-standard __WORDSIZE with sizeof(long) * 8
>
> Marcos Del Sol Vives <marcos@orca.pet>
> PCI: Disable MSI on RDC PCI to PCIe bridges
>
> Seyediman Seyedarab <imandevel@gmail.com>
> drm/nouveau: replace snprintf() with scnprintf() in nvkm_snprintbf()
>
> Sathishkumar S <sathishkumar.sundararaju@amd.com>
> drm/amdgpu/jpeg: Hold pg_lock before jpeg poweroff
>
> Lijo Lazar <lijo.lazar@amd.com>
> drm/amd/pm: Use cached metrics data on arcturus
>
> Jens Kehne <jens.kehne@agilent.com>
> mfd: da9063: Split chip variant reading in two bus transactions
>
> Arnd Bergmann <arnd@arndb.de>
> mfd: madera: Work around false-positive -Wininitialized warning
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> mfd: stmpe-i2c: Add missing MODULE_LICENSE
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> mfd: stmpe: Remove IRQ domain upon removal
>
> Len Brown <len.brown@intel.com>
> tools/power x86_energy_perf_policy: Prefer driver HWP limits
>
> Len Brown <len.brown@intel.com>
> tools/power x86_energy_perf_policy: Enhance HWP enable
>
> Kaushlendra Kumar <kaushlendra.kumar@intel.com>
> tools/power x86_energy_perf_policy: Fix incorrect fopen mode usage
>
> Kaushlendra Kumar <kaushlendra.kumar@intel.com>
> tools/cpupower: Fix incorrect size in cpuidle_state_disable()
>
> Armin Wolf <W_Armin@gmx.de>
> hwmon: (dell-smm) Add support for Dell OptiPlex 7040
>
> Jiri Olsa <jolsa@kernel.org>
> uprobe: Do not emulate/sstep original instruction when ip is changed
>
> Daniel Lezcano <daniel.lezcano@linaro.org>
> clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel
>
> Rafael J. Wysocki <rafael.j.wysocki@intel.com>
> cpuidle: Fail cpuidle device registration if there is one already
>
> Svyatoslav Ryhel <clamor95@gmail.com>
> video: backlight: lp855x_bl: Set correct EPROM start for LP8556
>
> Daniel Wagner <wagi@kernel.org>
> nvme-fc: use lock accessing port_state and rport state
>
> Amirreza Zarrabi <amirreza.zarrabi@oss.qualcomm.com>
> tee: allow a driver to allocate a tee_device without a pool
>
> Hans de Goede <hansg@kernel.org>
> ACPICA: dispatcher: Use acpi_ds_clear_operands() in acpi_ds_call_control_method()
>
> Sarthak Garg <quic_sartgarg@quicinc.com>
> mmc: sdhci-msm: Enable tuning for SDR50 mode for SD card
>
> Svyatoslav Ryhel <clamor95@gmail.com>
> soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
>
> Christian Bruel <christian.bruel@foss.st.com>
> irqchip/gic-v2m: Handle Multiple MSI base IRQ Alignment
>
> Kees Cook <kees@kernel.org>
> arc: Fix __fls() const-foldability via __builtin_clzl()
>
> Dennis Beier <nanovim@gmail.com>
> cpufreq/longhaul: handle NULL policy in longhaul_exit
>
> Ricardo B. Marlière <rbm@suse.com>
> selftests/bpf: Fix bpf_prog_detach2 usage in test_lirc_mode2
>
> Mario Limonciello (AMD) <superm1@kernel.org>
> ACPI: video: force native for Lenovo 82K8
>
> Jiayi Li <lijiayi@kylinos.cn>
> memstick: Add timeout to prevent indefinite waiting
>
> Biju Das <biju.das.jz@bp.renesas.com>
> mmc: host: renesas_sdhi: Fix the actual clock
>
> Chi Zhang <chizhang@asrmicro.com>
> pinctrl: single: fix bias pull up/down handling in pin_config_set
>
> Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> bpf: Don't use %pK through printk
>
> Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> soc: ti: pruss: don't use %pK through printk
>
> Thomas Weißschuh <thomas.weissschuh@linutronix.de>
> spi: loopback-test: Don't use %pK through printk
>
> Jens Reidel <adrian@mainlining.org>
> soc: qcom: smem: Fix endian-unaware access of num_entries
>
> Damien Le Moal <dlemoal@kernel.org>
> block: make REQ_OP_ZONE_OPEN a write operation
>
> Owen Gu <guhuinan@xiaomi.com>
> usb: gadget: f_fs: Fix epfile null pointer access after ep enable.
>
> Matthieu Baerts (NGI0) <matttbe@kernel.org>
> tracing: fix declaration-after-statement warning
>
> Matthieu Baerts (NGI0) <matttbe@kernel.org>
> arch: back to -std=gnu89 in < v5.18
>
> Alexey Dobriyan <adobriyan@gmail.com>
> x86/boot: Compile boot code with -std=gnu11 too
>
> Babu Moger <babu.moger@amd.com>
> x86/resctrl: Fix miscount of bandwidth event when reactivating previously unavailable RMID
>
> Artem Shimko <a.shimko.dev@gmail.com>
> serial: 8250_dw: handle reset control deassert error
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> serial: 8250_dw: Use devm_add_action_or_reset()
>
> Celeste Liu <uwu@coelacanthus.name>
> can: gs_usb: increase max interface to U8_MAX
>
> Maarten Lankhorst <dev@lankhorst.se>
> devcoredump: Fix circular locking dependency with devcd->mutex.
>
> Darrick J. Wong <djwong@kernel.org>
> xfs: always warn about deprecated mount options
>
> Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
> net: ravb: Enforce descriptor type ordering
>
> Emanuele Ghidoli <emanuele.ghidoli@toradex.com>
> net: phy: dp83867: Disable EEE support as not implemented
>
> Alexey Klimov <alexey.klimov@linaro.org>
> regmap: slimbus: fix bus_context pointer in regmap init calls
>
> Damien Le Moal <dlemoal@kernel.org>
> block: fix op_is_zone_mgmt() to handle REQ_OP_ZONE_RESET_ALL
>
> John Smith <itistotalbotnet@gmail.com>
> drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Iceland
>
> John Smith <itistotalbotnet@gmail.com>
> drm/amd/pm/powerplay/smumgr: Fix PCIeBootLinkLevel value on Fiji
>
> Yang Wang <kevinyang.wang@amd.com>
> drm/amd/pm: fix smu table id bound check issue in smu_cmn_update_table()
>
> Tomeu Vizoso <tomeu@tomeuvizoso.net>
> drm/etnaviv: fix flush sequence logic
>
> Lizhi Xu <lizhi.xu@windriver.com>
> usbnet: Prevents free active kevent
>
> Noorain Eqbal <nooraineqbal@gmail.com>
> bpf: Sync pending IRQ work before freeing ring buffer
>
> Roy Vegard Ovesen <roy.vegard.ovesen@gmail.com>
> ALSA: usb-audio: fix control pipe direction
>
> Akhil P Oommen <akhilpo@oss.qualcomm.com>
> drm/msm/a6xx: Fix GMU firmware parser
>
> Loic Poulain <loic.poulain@oss.qualcomm.com>
> wifi: ath10k: Fix memory leak on unsupported WMI command
>
> Srinivas Kandagatla <srinivas.kandagatla@oss.qualcomm.com>
> ASoC: qdsp6: q6asm: do not sleep while atomic
>
> Miaoqian Lin <linmq006@gmail.com>
> fbdev: valkyriefb: Fix reference count leak in valkyriefb_init
>
> Florian Fuchs <fuchsfl@gmail.com>
> fbdev: pvr2fb: Fix leftover reference to ONCHIP_NR_DMA_CHANNELS
>
> Gokul Sivakumar <gokulkumar.sivakumar@infineon.com>
> wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode
>
> Junjie Cao <junjie.cao@intel.com>
> fbdev: bitblit: bound-check glyph index in bit_putcs*
>
> Yuhao Jiang <danisjiang@gmail.com>
> ACPI: video: Fix use-after-free in acpi_video_switch_brightness()
>
> Daniel Palmer <daniel@0x0f.com>
> fbdev: atyfb: Check if pll_ops->init_pll failed
>
> Miaoqian Lin <linmq006@gmail.com>
> net: usb: asix_devices: Check return value of usbnet_get_endpoints
>
> Chuck Lever <chuck.lever@oracle.com>
> NFSD: Fix crash in nfsd4_read_release()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: use smp_mb__after_atomic() when forcing COW in create_pending_snapshot()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: always drop log root tree reference in btrfs_replay_log()
>
> David Kaplan <david.kaplan@amd.com>
> x86/bugs: Fix reporting of LFENCE retpoline
>
> Xiang Mei <xmei5@asu.edu>
> net/sched: sch_qfq: Fix null-deref in agg_dequeue
>
>
> -------------
>
> Diffstat:
>
> .../bindings/pinctrl/toshiba,visconti-pinctrl.yaml | 26 ++--
> Documentation/kbuild/makefiles.rst | 29 +++--
> Makefile | 8 +-
> arch/arc/include/asm/bitops.h | 2 +
> arch/arm/crypto/Kconfig | 2 +-
> arch/arm/mach-at91/pm_suspend.S | 8 +-
> arch/mips/boot/dts/lantiq/danube.dtsi | 6 +
> arch/mips/lantiq/xway/sysctrl.c | 2 +-
> arch/mips/loongson64/Platform | 2 +-
> arch/mips/mm/tlb-r4k.c | 118 ++++++++++++------
> arch/mips/mti-malta/malta-init.c | 20 +--
> arch/parisc/boot/compressed/Makefile | 2 +-
> arch/powerpc/Makefile | 4 +-
> arch/powerpc/kernel/eeh_driver.c | 2 +-
> arch/riscv/kernel/cpu-hotplug.c | 1 +
> arch/riscv/mm/ptdump.c | 2 +-
> arch/s390/Makefile | 6 +-
> arch/s390/purgatory/Makefile | 2 +-
> arch/sparc/include/asm/elf_64.h | 1 +
> arch/sparc/kernel/module.c | 1 +
> arch/um/drivers/ssl.c | 5 +-
> arch/x86/Makefile | 2 +-
> arch/x86/boot/compressed/Makefile | 2 +-
> arch/x86/entry/vsyscall/vsyscall_64.c | 17 ++-
> arch/x86/events/core.c | 10 +-
> arch/x86/kernel/cpu/bugs.c | 5 +-
> arch/x86/kernel/cpu/resctrl/monitor.c | 10 +-
> arch/x86/kernel/kvm.c | 20 +--
> drivers/acpi/acpi_video.c | 4 +-
> drivers/acpi/acpica/dsmethod.c | 10 +-
> drivers/acpi/numa/srat.c | 2 +-
> drivers/acpi/property.c | 24 +++-
> drivers/acpi/video_detect.c | 8 ++
> drivers/ata/libata-scsi.c | 8 ++
> drivers/atm/fore200e.c | 2 +
> drivers/base/devcoredump.c | 138 +++++++++++++--------
> drivers/base/regmap/regmap-slimbus.c | 6 +-
> drivers/bluetooth/btusb.c | 13 +-
> drivers/bluetooth/hci_bcsp.c | 3 +
> drivers/char/misc.c | 8 +-
> drivers/clocksource/timer-vf-pit.c | 22 ++--
> drivers/cpufreq/longhaul.c | 3 +
> drivers/cpuidle/cpuidle.c | 8 +-
> drivers/dma/dw-edma/dw-edma-core.c | 22 ++++
> drivers/dma/mv_xor.c | 4 +-
> drivers/dma/sh/shdma-base.c | 25 +++-
> drivers/dma/sh/shdmac.c | 17 ++-
> drivers/edac/altera_edac.c | 22 +++-
> drivers/extcon/extcon-adc-jack.c | 2 +
> drivers/firmware/arm_scmi/scmi_pm_domain.c | 13 +-
> drivers/firmware/efi/libstub/Makefile | 2 +-
> drivers/firmware/stratix10-svc.c | 7 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_jpeg.c | 6 +-
> drivers/gpu/drm/amd/amdkfd/kfd_chardev.c | 8 +-
> drivers/gpu/drm/amd/amdkfd/kfd_priv.h | 9 +-
> drivers/gpu/drm/amd/display/dc/calcs/Makefile | 2 +-
> drivers/gpu/drm/amd/display/dc/core/dc_stream.c | 11 +-
> drivers/gpu/drm/amd/display/dc/dcn20/Makefile | 2 +-
> drivers/gpu/drm/amd/display/dc/dcn21/Makefile | 2 +-
> drivers/gpu/drm/amd/display/dc/dcn30/Makefile | 2 +-
> drivers/gpu/drm/amd/display/dc/dml/Makefile | 2 +-
> drivers/gpu/drm/amd/display/dc/dsc/Makefile | 2 +-
> .../gpu/drm/amd/pm/powerplay/smumgr/fiji_smumgr.c | 2 +-
> .../drm/amd/pm/powerplay/smumgr/iceland_smumgr.c | 2 +-
> drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 2 +-
> drivers/gpu/drm/amd/pm/swsmu/smu_cmn.c | 2 +-
> drivers/gpu/drm/bridge/display-connector.c | 3 +-
> drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 2 +-
> drivers/gpu/drm/msm/adreno/a6xx_gmu.c | 5 +-
> drivers/gpu/drm/nouveau/nvkm/core/enum.c | 2 +-
> drivers/gpu/drm/sti/sti_vtg.c | 7 +-
> drivers/gpu/drm/tegra/dc.c | 1 +
> drivers/gpu/drm/tidss/tidss_crtc.c | 2 +-
> drivers/gpu/drm/tidss/tidss_dispc.c | 16 +--
> drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 5 +
> drivers/hid/hid-ids.h | 7 +-
> drivers/hid/hid-ntrig.c | 7 +-
> drivers/hid/hid-quirks.c | 14 ++-
> drivers/hwmon/dell-smm-hwmon.c | 7 ++
> drivers/iio/adc/spear_adc.c | 9 +-
> drivers/iio/common/ssp_sensors/ssp_dev.c | 4 +-
> drivers/iio/imu/st_lsm6dsx/st_lsm6dsx.h | 22 ++--
> drivers/input/keyboard/cros_ec_keyb.c | 6 +
> drivers/input/keyboard/imx_sc_key.c | 2 +-
> drivers/input/misc/ati_remote2.c | 2 +-
> drivers/input/misc/cm109.c | 2 +-
> drivers/input/misc/powermate.c | 2 +-
> drivers/input/misc/yealink.c | 2 +-
> drivers/input/tablet/acecad.c | 2 +-
> drivers/input/tablet/pegasus_notetaker.c | 11 +-
> drivers/iommu/amd/init.c | 28 +++--
> drivers/irqchip/irq-gic-v2m.c | 13 +-
> drivers/isdn/hardware/mISDN/hfcsusb.c | 18 ++-
> drivers/mailbox/mailbox-test.c | 2 +-
> drivers/md/dm-verity-fec.c | 6 +-
> drivers/media/i2c/ir-kbd-i2c.c | 6 +-
> drivers/media/pci/ivtv/ivtv-alsa-pcm.c | 2 -
> drivers/media/pci/ivtv/ivtv-driver.h | 3 +-
> drivers/media/pci/ivtv/ivtv-fileops.c | 18 +--
> drivers/media/pci/ivtv/ivtv-irq.c | 4 +-
> drivers/media/rc/imon.c | 61 +++++----
> drivers/media/rc/redrat3.c | 2 +-
> drivers/media/tuners/xc4000.c | 8 +-
> drivers/media/tuners/xc5000.c | 12 +-
> drivers/memstick/core/memstick.c | 8 +-
> drivers/mfd/da9063-i2c.c | 27 +++-
> drivers/mfd/madera-core.c | 4 +-
> drivers/mfd/stmpe-i2c.c | 1 +
> drivers/mfd/stmpe.c | 3 +
> drivers/mmc/host/renesas_sdhi_core.c | 6 +-
> drivers/mmc/host/sdhci-msm.c | 15 +++
> drivers/most/most_usb.c | 14 +--
> drivers/mtd/nand/onenand/onenand_samsung.c | 2 +-
> drivers/mtd/nand/raw/cadence-nand-controller.c | 3 +-
> drivers/net/can/sja1000/sja1000.c | 4 +-
> drivers/net/can/sun4i_can.c | 4 +-
> drivers/net/can/usb/gs_usb.c | 23 ++--
> drivers/net/can/usb/kvaser_usb/kvaser_usb_leaf.c | 4 +-
> drivers/net/dsa/b53/b53_common.c | 15 ++-
> drivers/net/dsa/b53/b53_regs.h | 3 +-
> .../net/ethernet/aquantia/atlantic/aq_hw_utils.c | 22 ++++
> .../net/ethernet/aquantia/atlantic/aq_hw_utils.h | 1 +
> drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 +
> .../ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 19 +--
> .../ethernet/aquantia/atlantic/hw_atl2/hw_atl2.c | 2 +-
> drivers/net/ethernet/cadence/macb_main.c | 4 +-
> drivers/net/ethernet/emulex/benet/be_main.c | 7 +-
> drivers/net/ethernet/freescale/fec_main.c | 2 +
> drivers/net/ethernet/intel/fm10k/fm10k_common.c | 5 +-
> drivers/net/ethernet/intel/fm10k/fm10k_common.h | 2 +-
> drivers/net/ethernet/intel/fm10k/fm10k_pf.c | 2 +-
> drivers/net/ethernet/intel/fm10k/fm10k_vf.c | 2 +-
> drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 15 ++-
> .../net/ethernet/mellanox/mlxsw/spectrum_flower.c | 6 +-
> drivers/net/ethernet/qlogic/qede/qede_main.c | 2 +-
> drivers/net/ethernet/realtek/Kconfig | 2 +-
> drivers/net/ethernet/realtek/r8169_main.c | 6 +-
> drivers/net/ethernet/renesas/ravb_main.c | 16 ++-
> drivers/net/ethernet/renesas/sh_eth.c | 4 +
> drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c | 4 +-
> drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 9 +-
> drivers/net/ethernet/ti/netcp_core.c | 10 +-
> drivers/net/phy/dp83867.c | 6 +
> drivers/net/phy/marvell.c | 39 +++++-
> drivers/net/phy/mdio_bus.c | 5 +-
> drivers/net/usb/asix_devices.c | 12 +-
> drivers/net/usb/qmi_wwan.c | 6 +
> drivers/net/usb/usbnet.c | 2 +
> drivers/net/wireless/ath/ath10k/mac.c | 12 +-
> drivers/net/wireless/ath/ath10k/wmi.c | 1 +
> .../broadcom/brcm80211/brcmfmac/cfg80211.c | 3 +-
> .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 28 ++---
> .../net/wireless/broadcom/brcm80211/brcmfmac/p2p.h | 3 +-
> drivers/nvme/host/fc.c | 12 +-
> drivers/pci/controller/cadence/pcie-cadence-host.c | 2 +-
> drivers/pci/controller/cadence/pcie-cadence.c | 4 +-
> drivers/pci/controller/cadence/pcie-cadence.h | 6 +-
> drivers/pci/p2pdma.c | 2 +-
> drivers/pci/quirks.c | 1 +
> drivers/phy/cadence/cdns-dphy.c | 4 +-
> drivers/pinctrl/pinctrl-single.c | 4 +-
> drivers/regulator/fixed.c | 6 +-
> drivers/remoteproc/qcom_q6v5.c | 5 +
> drivers/s390/net/ctcm_mpc.c | 1 -
> drivers/scsi/hosts.c | 5 +-
> drivers/scsi/lpfc/lpfc_debugfs.h | 3 +
> drivers/scsi/pm8001/pm8001_ctl.c | 24 ++--
> drivers/scsi/pm8001/pm8001_init.c | 1 +
> drivers/scsi/pm8001/pm8001_sas.c | 4 +-
> drivers/scsi/pm8001/pm8001_sas.h | 4 +
> drivers/scsi/sg.c | 10 +-
> drivers/slimbus/qcom-ngd-ctrl.c | 1 +
> drivers/soc/imx/gpc.c | 2 +
> drivers/soc/qcom/smem.c | 2 +-
> drivers/soc/tegra/fuse/fuse-tegra30.c | 122 ++++++++++++++++++
> drivers/soc/ti/knav_dma.c | 14 +--
> drivers/soc/ti/pruss.c | 2 +-
> drivers/spi/spi-bcm63xx.c | 14 +++
> drivers/spi/spi-loopback-test.c | 12 +-
> drivers/spi/spi.c | 10 ++
> drivers/target/loopback/tcm_loop.c | 3 +
> drivers/tee/tee_core.c | 2 +-
> drivers/thunderbolt/nhi.c | 2 +
> drivers/thunderbolt/nhi.h | 1 +
> drivers/tty/serial/8250/8250_dw.c | 67 +++++-----
> drivers/tty/serial/amba-pl011.c | 2 +-
> drivers/uio/uio_hv_generic.c | 21 +++-
> drivers/usb/cdns3/cdns3-pci-wrap.c | 5 +-
> drivers/usb/dwc3/ep0.c | 1 +
> drivers/usb/dwc3/gadget.c | 7 ++
> drivers/usb/gadget/function/f_eem.c | 7 +-
> drivers/usb/gadget/function/f_fs.c | 8 +-
> drivers/usb/gadget/function/f_hid.c | 4 +-
> drivers/usb/gadget/function/f_ncm.c | 3 +-
> drivers/usb/host/xhci-dbgcap.h | 1 +
> drivers/usb/host/xhci-dbgtty.c | 17 ++-
> drivers/usb/host/xhci-plat.c | 1 +
> drivers/usb/mon/mon_bin.c | 14 ++-
> drivers/usb/renesas_usbhs/common.c | 14 +--
> drivers/usb/serial/ftdi_sio.c | 1 +
> drivers/usb/serial/ftdi_sio_ids.h | 1 +
> drivers/usb/serial/option.c | 10 +-
> drivers/usb/storage/sddr55.c | 6 +
> drivers/usb/storage/transport.c | 16 +++
> drivers/usb/storage/uas.c | 7 +-
> drivers/usb/storage/unusual_devs.h | 2 +-
> drivers/usb/typec/ucsi/psy.c | 5 +
> drivers/video/backlight/lp855x_bl.c | 2 +-
> drivers/video/fbdev/aty/atyfb_base.c | 8 +-
> drivers/video/fbdev/core/bitblit.c | 33 ++++-
> drivers/video/fbdev/pvr2fb.c | 2 +-
> drivers/video/fbdev/valkyriefb.c | 2 +
> fs/9p/v9fs.c | 9 +-
> fs/btrfs/disk-io.c | 2 +-
> fs/btrfs/file.c | 10 ++
> fs/btrfs/transaction.c | 2 +-
> fs/btrfs/tree-log.c | 1 -
> fs/ceph/locks.c | 5 +-
> fs/cifs/connect.c | 1 +
> fs/dax.c | 2 +-
> fs/exfat/fatent.c | 11 +-
> fs/exfat/super.c | 5 +-
> fs/ext4/xattr.c | 2 +-
> fs/fs-writeback.c | 7 +-
> fs/hpfs/namei.c | 18 ++-
> fs/jfs/inode.c | 8 +-
> fs/jfs/jfs_txnmgr.c | 9 +-
> fs/nfs/inode.c | 6 +-
> fs/nfs/nfs4client.c | 1 +
> fs/nfs/nfs4proc.c | 7 +-
> fs/nfs/nfs4state.c | 3 +
> fs/nfsd/nfs4proc.c | 7 +-
> fs/nfsd/nfs4state.c | 3 +-
> fs/open.c | 10 +-
> fs/orangefs/xattr.c | 12 +-
> fs/overlayfs/copy_up.c | 2 +-
> fs/proc/generic.c | 12 +-
> fs/xfs/xfs_super.c | 33 +++--
> include/linux/ata.h | 1 +
> include/linux/blk_types.h | 11 +-
> include/linux/compiler_types.h | 5 +-
> include/linux/filter.h | 2 +-
> include/linux/mm.h | 2 +-
> include/linux/shdma-base.h | 2 +-
> include/linux/usb.h | 16 +--
> include/net/cls_cgroup.h | 2 +-
> include/net/nfc/nci_core.h | 2 +-
> include/net/pkt_sched.h | 25 +++-
> include/net/sctp/sctp.h | 3 +-
> include/net/tls.h | 6 +
> kernel/bpf/ringbuf.c | 2 +
> kernel/events/uprobes.c | 7 ++
> kernel/gcov/gcc_4_7.c | 4 +-
> kernel/trace/trace_events_hist.c | 6 +-
> kernel/trace/trace_events_synth.c | 3 +-
> lib/crypto/Makefile | 2 +-
> mm/mempool.c | 32 ++++-
> mm/page_alloc.c | 2 +-
> net/8021q/vlan.c | 2 +
> net/bluetooth/6lowpan.c | 103 ++++++++++-----
> net/bluetooth/hci_event.c | 21 +++-
> net/bluetooth/l2cap_core.c | 1 +
> net/bluetooth/sco.c | 7 ++
> net/bluetooth/smp.c | 31 ++---
> net/bridge/br_forward.c | 3 +-
> net/ceph/ceph_common.c | 53 ++++----
> net/ceph/debugfs.c | 16 ++-
> net/core/netpoll.c | 7 +-
> net/core/page_pool.c | 6 +-
> net/core/sock.c | 15 ++-
> net/hsr/hsr_device.c | 3 +
> net/ipv4/fib_frontend.c | 2 +-
> net/ipv4/inet_diag.c | 5 +-
> net/ipv4/nexthop.c | 6 +
> net/ipv4/raw_diag.c | 7 +-
> net/ipv4/route.c | 5 +
> net/ipv4/udp_diag.c | 6 +-
> net/ipv4/udp_tunnel_nic.c | 2 +-
> net/ipv6/addrconf.c | 4 +-
> net/ipv6/ah6.c | 50 +++++---
> net/ipv6/raw.c | 2 +-
> net/ipv6/udp.c | 2 +-
> net/mac80211/rx.c | 10 +-
> net/mptcp/mptcp_diag.c | 6 +-
> net/mptcp/pm.c | 3 +-
> net/mptcp/pm_netlink.c | 20 +--
> net/mptcp/protocol.c | 59 ++++++---
> net/mptcp/protocol.h | 1 +
> net/netfilter/nf_tables_api.c | 15 +++
> net/netfilter/nft_set_pipapo.c | 4 +-
> net/netfilter/nft_set_pipapo.h | 21 ++++
> net/netfilter/nft_set_pipapo_avx2.c | 31 ++++-
> net/netlink/af_netlink.c | 2 +-
> net/openvswitch/actions.c | 68 +---------
> net/openvswitch/flow_netlink.c | 64 ++--------
> net/openvswitch/flow_netlink.h | 2 -
> net/rds/rds.h | 2 +-
> net/sched/act_ife.c | 12 +-
> net/sched/sch_api.c | 10 --
> net/sched/sch_generic.c | 17 +--
> net/sched/sch_hfsc.c | 16 ---
> net/sched/sch_qfq.c | 2 +-
> net/sctp/diag.c | 73 ++++++-----
> net/sctp/sm_make_chunk.c | 2 +-
> net/sctp/socket.c | 24 ++--
> net/sctp/transport.c | 13 +-
> net/smc/smc_clc.c | 1 +
> net/strparser/strparser.c | 2 +-
> net/tipc/net.c | 2 +
> net/tls/tls_device.c | 4 +-
> net/unix/diag.c | 6 +-
> net/vmw_vsock/af_vsock.c | 40 ++++--
> scripts/Kbuild.include | 10 +-
> scripts/kconfig/mconf.c | 3 +
> scripts/kconfig/nconf.c | 3 +
> sound/pci/hda/patch_realtek.c | 17 +--
> sound/soc/codecs/cs4271.c | 10 +-
> sound/soc/codecs/max98090.c | 6 +-
> sound/soc/meson/aiu-encoder-i2s.c | 9 +-
> sound/soc/qcom/qdsp6/q6asm.c | 2 +-
> sound/usb/endpoint.c | 5 +
> sound/usb/mixer.c | 11 +-
> sound/usb/mixer_s1810c.c | 28 ++++-
> sound/usb/validate.c | 9 +-
> tools/include/linux/bitmap.h | 1 +
> tools/power/cpupower/lib/cpuidle.c | 5 +-
> .../x86_energy_perf_policy.c | 30 +++--
> tools/testing/selftests/Makefile | 2 +-
> tools/testing/selftests/bpf/test_lirc_mode2_user.c | 2 +-
> tools/testing/selftests/net/fcnal-test.sh | 4 +-
> tools/testing/selftests/net/psock_tpacket.c | 4 +-
> tools/testing/selftests/net/traceroute.sh | 13 +-
> 332 files changed, 2243 insertions(+), 1164 deletions(-)
>
>
--
In cooperation with DENX Software Engineering GmbH, HRB 165235 Munich,
Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 000/300] 5.10.247-rc1 review
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2025-12-03 16:51 ` [PATCH 5.10 000/300] 5.10.247-rc1 review Pavel Machek
@ 2025-12-03 17:33 ` Florian Fainelli
2025-12-03 19:49 ` Jon Hunter
` (3 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Florian Fainelli @ 2025-12-03 17:33 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr
On 12/3/25 07:23, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.247 release.
> There are 300 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.247-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
MIPS fails to build with:
arch/mips/mm/tlb-r4k.c: In function 'r4k_tlb_uniquify':
arch/mips/mm/tlb-r4k.c:591:17: error: passing argument 1 of
'memblock_free' makes integer from pointer without a cast
[-Werror=int-conversion]
memblock_free(tlb_vpns, tlb_vpn_size);
^~~~~~~~
In file included from arch/mips/mm/tlb-r4k.c:15:
./include/linux/memblock.h:107:31: note: expected 'phys_addr_t' {aka
'unsigned int'} but argument is of type 'long unsigned int *'
int memblock_free(phys_addr_t base, phys_addr_t size);
~~~~~~~~~~~~^~~~
cc1: all warnings being treated as errors
host-make[4]: *** [scripts/Makefile.build:286: arch/mips/mm/tlb-r4k.o]
Error 1
host-make[4]: *** Waiting for unfinished jobs....
Caused by:
commit 97ddb0e2389b4a53d395ed47ea83540ff495d1b6
Author: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Date: Fri Nov 28 16:53:46 2025 +0000
MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
It seems like we might have to cast to a phys_addr_t before passing that
to memblock_free().
--
Florian
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 000/300] 5.10.247-rc1 review
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2025-12-03 17:33 ` Florian Fainelli
@ 2025-12-03 19:49 ` Jon Hunter
2025-12-04 2:22 ` Dominique Martinet
` (2 subsequent siblings)
305 siblings, 0 replies; 312+ messages in thread
From: Jon Hunter @ 2025-12-03 19:49 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, f.fainelli, sudipm.mukherjee, rwarsow, conor,
hargar, broonie, achill, sr, linux-tegra@vger.kernel.org
On 03/12/2025 15:23, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.247 release.
> There are 300 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.247-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
...
> Vlastimil Babka <vbabka@suse.cz>
> mm/mempool: fix poisoning order>0 pages with HIGHMEM
>
> Fabio M. De Francesco <fabio.maria.de.francesco@linux.intel.com>
> mm/mempool: replace kmap_atomic() with kmap_local_page()
The above two commits are causing the following build errors and
I needed to revert both ...
mm/mempool.c: In function ‘check_element’:
mm/mempool.c:68:17: error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode
68 | for (int i = 0; i < (1 << order); i++) {
| ^~~
mm/mempool.c:68:17: note: use option ‘-std=c99’, ‘-std=gnu99’, ‘-std=c11’ or ‘-std=gnu11’ to compile your code
CC fs/open.o
mm/mempool.c:70:38: error: implicit declaration of function ‘kmap_local_page’; did you mean ‘kmap_to_page’? [-Werror=implicit-function-declaration]
70 | void *addr = kmap_local_page(page + i);
| ^~~~~~~~~~~~~~~
| kmap_to_page
mm/mempool.c:70:38: warning: initialisation of ‘void *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
mm/mempool.c:73:25: error: implicit declaration of function ‘kunmap_local’ [-Werror=implicit-function-declaration]
73 | kunmap_local(addr);
| ^~~~~~~~~~~~
mm/mempool.c: In function ‘poison_element’:
mm/mempool.c:101:17: error: ‘for’ loop initial declarations are only allowed in C99 or C11 mode
101 | for (int i = 0; i < (1 << order); i++) {
| ^~~
mm/mempool.c:103:38: warning: initialisation of ‘void *’ from ‘int’ makes pointer from integer without a cast [-Wint-conversion]
103 | void *addr = kmap_local_page(page + i);
| ^~~~~~~~~~~~~~~
CC arch/arm/mach-tegra/pm-tegra20.o
Cheers,
Jon
--
nvpublic
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 000/300] 5.10.247-rc1 review
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2025-12-03 19:49 ` Jon Hunter
@ 2025-12-04 2:22 ` Dominique Martinet
2025-12-04 7:45 ` Naresh Kamboju
2025-12-04 12:17 ` Mark Brown
305 siblings, 0 replies; 312+ messages in thread
From: Dominique Martinet @ 2025-12-04 2:22 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr
Greg Kroah-Hartman wrote on Wed, Dec 03, 2025 at 04:23:24PM +0100:
> This is the start of the stable review cycle for the 5.10.247 release.
> There are 300 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.247-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
Tested d50f2a03a87b ("Linux 5.10.247-rc1") on:
- arm i.MX6ULL (Armadillo 640)
- arm64 i.MX8MP (Armadillo G4)
No obvious regression in dmesg or basic tests:
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
--
Dominique Martinet
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 000/300] 5.10.247-rc1 review
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2025-12-04 2:22 ` Dominique Martinet
@ 2025-12-04 7:45 ` Naresh Kamboju
2025-12-04 12:17 ` Mark Brown
305 siblings, 0 replies; 312+ messages in thread
From: Naresh Kamboju @ 2025-12-04 7:45 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, broonie, achill, sr,
Fabio M. De Francesco, Thomas Bogendoerfer, Svyatoslav Ryhel,
Dan Carpenter, Arnd Bergmann, Anders Roxell, Ben Copeland
On Wed, 3 Dec 2025 at 21:02, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 5.10.247 release.
> There are 300 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 05 Dec 2025 15:23:16 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.247-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
The arm, mips and powerpc builds failed on the stable-rc 5.10.247-rc1
Build regressions: arm, fuse-tegra30.c:250:10: error: 'const struct
tegra_fuse_soc' has no member named 'cells'
Build regressions: arm, fuse-tegra30.c:250:18: error: initialization
of 'const struct attribute_group *' from incompatible pointer type
'const struct nvmem_cell_info *' [-Werror=incompatible-pointer-types]
Build regressions: arm, fuse-tegra30.c:251:10: error: 'const struct
tegra_fuse_soc' has no member named 'num_cells'
Build regressions: mips, mips/mm/tlb-r4k.c:591:31: error: passing
argument 1 of 'memblock_free' makes integer from pointer without a
cast [-Werror=int-conversion]
Build regressions: powerpc, mm/mempool.c:68:17: error: 'for' loop
initial declarations are only allowed in C99 or C11 mode
Build regressions: powerpc, mm/mempool.c:70:38: error: implicit
declaration of function 'kmap_local_page'; did you mean
'kmap_to_page'? [-Werror=implicit-function-declaration]
Build regressions: powerpc, mm/mempool.c:73:25: error: implicit
declaration of function 'kunmap_local'
[-Werror=implicit-function-declaration]
Build regressions: powerpc, mm/mempool.c:101:17: error: 'for' loop
initial declarations are only allowed in C99 or C11 mode
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Arm build regressions are due to,
soc/tegra: fuse: Add Tegra114 nvmem cells and fuse lookups
[ Upstream commit b9c01adedf38c69abb725a60a05305ef70dbce03 ]
MIPS build regressions are due to,
MIPS: mm: kmalloc tlb_vpn array to avoid stack overflow
commit 841ecc979b18d3227fad5e2d6a1e6f92688776b5 upstream.
Powerpc build regressions are due to,
mm/mempool: replace kmap_atomic() with kmap_local_page()
[ Upstream commit f2bcc99a5e901a13b754648d1dbab60f4adf9375 ]
### arm build error
drivers/soc/tegra/fuse/fuse-tegra30.c:250:10: error: 'const struct
tegra_fuse_soc' has no member named 'cells'
250 | .cells = tegra114_fuse_cells,
| ^~~~~
drivers/soc/tegra/fuse/fuse-tegra30.c:250:18: error: initialization of
'const struct attribute_group *' from incompatible pointer type 'const
struct nvmem_cell_info *' [-Werror=incompatible-pointer-types]
250 | .cells = tegra114_fuse_cells,
| ^~~~~~~~~~~~~~~~~~~
drivers/soc/tegra/fuse/fuse-tegra30.c:250:18: note: (near
initialization for 'tegra114_fuse_soc.soc_attr_group')
drivers/soc/tegra/fuse/fuse-tegra30.c:251:10: error: 'const struct
tegra_fuse_soc' has no member named 'num_cells'
251 | .num_cells = ARRAY_SIZE(tegra114_fuse_cells),
| ^~~~~~~~~
### mips Build error
arch/mips/mm/tlb-r4k.c: In function 'r4k_tlb_uniquify':
arch/mips/mm/tlb-r4k.c:591:31: error: passing argument 1 of
'memblock_free' makes integer from pointer without a cast
[-Werror=int-conversion]
591 | memblock_free(tlb_vpns, tlb_vpn_size);
| ^~~~~~~~
| |
| long unsigned int *
In file included from arch/mips/mm/tlb-r4k.c:15:
include/linux/memblock.h:106:31: note: expected 'phys_addr_t' {aka
'unsigned int'} but argument is of type 'long unsigned int *'
106 | int memblock_free(phys_addr_t base, phys_addr_t size);
| ~~~~~~~~~~~~^~~~
cc1: all warnings being treated as errors
### powerpc build error
builds/linux/mm/mempool.c: In function 'check_element':
mm/mempool.c:68:17: error: 'for' loop initial declarations are only
allowed in C99 or C11 mode
68 | for (int i = 0; i < (1 << order); i++) {
| ^~~
mm/mempool.c:68:17: note: use option '-std=c99', '-std=gnu99',
'-std=c11' or '-std=gnu11' to compile your code
mm/mempool.c:70:38: error: implicit declaration of function
'kmap_local_page'; did you mean 'kmap_to_page'?
[-Werror=implicit-function-declaration]
70 | void *addr = kmap_local_page(page + i);
| ^~~~~~~~~~~~~~~
| kmap_to_page
mm/mempool.c:70:38: warning: initialization of 'void *' from 'int'
makes pointer from integer without a cast [-Wint-conversion]
mm/mempool.c:73:25: error: implicit declaration of function
'kunmap_local' [-Werror=implicit-function-declaration]
73 | kunmap_local(addr);
| ^~~~~~~~~~~~
mm/mempool.c: In function 'poison_element':
mm/mempool.c:101:17: error: 'for' loop initial declarations are only
allowed in C99 or C11 mode
101 | for (int i = 0; i < (1 << order); i++) {
| ^~~
mm/mempool.c:103:38: warning: initialization of 'void *' from 'int'
makes pointer from integer without a cast [-Wint-conversion]
103 | void *addr = kmap_local_page(page + i);
| ^~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
## Build
* kernel: 5.10.247-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: d50f2a03a87b402853207713f5e83c7f07c7ddab
* git describe: v5.10.246-301-gd50f2a03a87b
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-5.10.y/build/v5.10.246-301-gd50f2a03a87b
## Test Regressions (compared to v5.10.245-326-g98417fb6195f)
* arm, build
- clang-21-defconfig
- clang-21-lkftconfig
- clang-21-lkftconfig-no-kselftest-frag
- gcc-12-defconfig
- gcc-12-lkftconfig
- gcc-12-lkftconfig-debug
- gcc-12-lkftconfig-kasan
- gcc-12-lkftconfig-kunit
- gcc-12-lkftconfig-libgpiod
- gcc-12-lkftconfig-no-kselftest-frag
- gcc-12-lkftconfig-perf
- gcc-12-lkftconfig-rcutorture
- gcc-8-defconfig
* mips, build
- clang-21-allnoconfig
- clang-21-defconfig
- clang-21-tinyconfig
- gcc-12-allnoconfig
- gcc-12-ath79_defconfig
- gcc-12-bcm47xx_defconfig
- gcc-12-bcm63xx_defconfig
- gcc-12-cavium_octeon_defconfig
- gcc-12-defconfig
- gcc-12-e55_defconfig
- gcc-12-malta_defconfig
- gcc-12-rt305x_defconfig
- gcc-12-tinyconfig
- gcc-8-allnoconfig
- gcc-8-ath79_defconfig
- gcc-8-bcm47xx_defconfig
- gcc-8-bcm63xx_defconfig
- gcc-8-cavium_octeon_defconfig
- gcc-8-defconfig
- gcc-8-malta_defconfig
- gcc-8-rt305x_defconfig
- gcc-8-tinyconfig
* powerpc, build
- gcc-12-ppc6xx_defconfig
- gcc-8-ppc6xx_defconfig
## Metric Regressions (compared to v5.10.245-326-g98417fb6195f)
## Test Fixes (compared to v5.10.245-326-g98417fb6195f)
## Metric Fixes (compared to v5.10.245-326-g98417fb6195f)
## Test result summary
total: 28943, pass: 21942, fail: 2265, skip: 4545, xfail: 191
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 100 total, 86 passed, 14 failed
* arm64: 28 total, 28 passed, 0 failed
* i386: 20 total, 20 passed, 0 failed
* mips: 22 total, 0 passed, 22 failed
* parisc: 3 total, 0 passed, 3 failed
* powerpc: 21 total, 19 passed, 2 failed
* riscv: 9 total, 9 passed, 0 failed
* s390: 9 total, 9 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 24 total, 24 passed, 0 failed
## Test suites summary
* boot
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-exec
* kselftest-fpu
* kselftest-futex
* kselftest-intel_pstate
* kselftest-kcmp
* kselftest-livepatch
* kselftest-membarrier
* kselftest-mincore
* kselftest-mqueue
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-sigaltstack
* kselftest-size
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-x86
* kunit
* lava
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-build-clang
* log-parser-build-gcc
* log-parser-test
* ltp-capability
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 312+ messages in thread* Re: [PATCH 5.10 000/300] 5.10.247-rc1 review
2025-12-03 15:23 [PATCH 5.10 000/300] 5.10.247-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2025-12-04 7:45 ` Naresh Kamboju
@ 2025-12-04 12:17 ` Mark Brown
305 siblings, 0 replies; 312+ messages in thread
From: Mark Brown @ 2025-12-04 12:17 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, rwarsow, conor, hargar, achill, sr
[-- Attachment #1: Type: text/plain, Size: 347 bytes --]
On Wed, Dec 03, 2025 at 04:23:24PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.247 release.
> There are 300 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 312+ messages in thread