* [PATCH 6.3 000/286] 6.3.7-rc1 review
@ 2023-06-07 20:11 Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 001/286] RDMA/bnxt_re: Fix the page_size used during the MR creation Greg Kroah-Hartman
` (294 more replies)
0 siblings, 295 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
This is the start of the stable review cycle for the 6.3.7 release.
There are 286 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.3.7-rc1
Theodore Ts'o <tytso@mit.edu>
ext4: enable the lazy init thread when remounting read/write
Nathan Chancellor <nathan@kernel.org>
riscv: vmlinux.lds.S: Explicitly handle '.got' section
Darrick J. Wong <djwong@kernel.org>
xfs: verify buffer contents when we skip log replay
Vasant Hegde <vasant.hegde@amd.com>
iommu/amd/pgtbl_v2: Fix domain max address
Lino Sanfilippo <l.sanfilippo@kunbus.com>
tpm, tpm_tis: Request threaded interrupt handler
Jim Wylder <jwylder@google.com>
regmap: Account for register length when chunking
Roberto Sassu <roberto.sassu@huawei.com>
KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
Kuan-Ting Chen <h3xrabbit@gmail.com>
ksmbd: fix multiple out-of-bounds read during context decoding
Kuan-Ting Chen <h3xrabbit@gmail.com>
ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix incorrect AllocationSize set in smb2_get_info
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix UAF issue from opinfo->conn
Namjae Jeon <linkinjeon@kernel.org>
ksmbd: fix credit count leakage
Sean Christopherson <seanjc@google.com>
KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds
Sean Christopherson <seanjc@google.com>
KVM: x86: Account fastpath-only VM-Exits in vCPU stats
Sean Christopherson <seanjc@google.com>
KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker
Oliver Upton <oliver.upton@linux.dev>
KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed()
Akihiko Odaki <akihiko.odaki@daynix.com>
KVM: arm64: Populate fault info for watchpoint
Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
test_firmware: fix the memory leak of the allocated firmware buffer
Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
test_firmware: fix a memory leak with reqs buffer
Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
test_firmware: prevent race conditions by a correct implementation of locking
Maninder Singh <maninder1.s@samsung.com>
powerpc/xmon: Use KSYM_NAME_LEN in array size
Herve Codina <herve.codina@bootlin.com>
serial: cpm_uart: Fix a COMPILE_TEST dependency
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
Helge Deller <deller@gmx.de>
fbcon: Fix null-ptr-deref in soft_cursor
Theodore Ts'o <tytso@mit.edu>
ext4: add lockdep annotations for i_data_sem for ea_inode's
Theodore Ts'o <tytso@mit.edu>
ext4: disallow ea_inodes with extended attributes
Theodore Ts'o <tytso@mit.edu>
ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
Theodore Ts'o <tytso@mit.edu>
ext4: add EA_INODE checking to ext4_iget()
Paolo Abeni <pabeni@redhat.com>
mptcp: fix active subflow finalization
Paolo Abeni <pabeni@redhat.com>
mptcp: fix connect timeout handling
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: userspace pm: skip if MPTCP is not supported
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: sockopt: skip if MPTCP is not supported
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: simult flows: skip if MPTCP is not supported
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: diag: skip if MPTCP is not supported
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: join: avoid using 'cmp --bytes'
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: join: skip if MPTCP is not supported
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: pm nl: skip if MPTCP is not supported
Matthieu Baerts <matthieu.baerts@tessares.net>
selftests: mptcp: connect: skip if MPTCP is not supported
Pietro Borrello <borrello@diag.uniroma1.it>
tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
Steven Rostedt (Google) <rostedt@goodmis.org>
tracing/histograms: Allow variables to have some modifiers
Daniel Bristot de Oliveira <bristot@kernel.org>
tracing/timerlat: Always wakeup the timerlat thread
Arnd Bergmann <arnd@arndb.de>
mtdchar: mark bits of ioctl handler noinline
Paul Moore <paul@paul-moore.com>
selinux: don't use make's grouped targets feature yet
Ben Noordhuis <info@bnoordhuis.nl>
io_uring: undeprecate epoll_ctl support
Ism Hong <ism.hong@gmail.com>
riscv: perf: Fix callchain parse error with kernel tracepoint events
Peter Rosin <peda@axentia.se>
dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits
Peter Rosin <peda@axentia.se>
dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling
Benjamin Tissoires <benjamin.tissoires@redhat.com>
HID: hidpp: terminate retry loop on success
Sasha Levin <sashal@kernel.org>
btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work
Ekansh Gupta <quic_ekangupt@quicinc.com>
misc: fastrpc: Pass proper scm arguments for secure map request
Elliot Berman <quic_eberman@quicinc.com>
firmware: qcom_scm: Use fixed width src vm bitmap
Lucas De Marchi <lucas.demarchi@intel.com>
module/decompress: Fix error checking on zstd decompression
Lino Sanfilippo <l.sanfilippo@kunbus.com>
tpm, tpm_tis: correct tpm_tis_flags enumeration values
Jon Pan-Doh <pandoh@google.com>
iommu/amd: Fix domain flush size when syncing iotlb
Gaurav Batra <gbatra@linux.vnet.ibm.com>
powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
Damien Le Moal <dlemoal@kernel.org>
block: fix revalidate performance regression
Johan Hovold <johan+linaro@kernel.org>
phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
Johan Hovold <johan+linaro@kernel.org>
phy: qcom-qmp-combo: fix init-count imbalance
pengfuyuan <pengfuyuan@kylinos.cn>
btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
Sherry Sun <sherry.sun@nxp.com>
tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
Marek Vasut <marex@denx.de>
mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
Deren Wu <deren.wu@mediatek.com>
mmc: vub300: fix invalid response handling
Tim Huang <Tim.Huang@amd.com>
drm/amd/pm: reverse mclk and fclk clocks levels for renoir
Tim Huang <Tim.Huang@amd.com>
drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp
Tim Huang <Tim.Huang@amd.com>
drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5
Guchun Chen <guchun.chen@amd.com>
drm/amd/pm: resolve reboot exception for si oland
Tim Huang <Tim.Huang@amd.com>
drm/amd/pm: reverse mclk and fclk clocks levels for vangogh
Tim Huang <Tim.Huang@amd.com>
drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4
Ikshwaku Chauhan <ikshwaku.chauhan@amd.com>
drm/amdgpu: enable tmz by default for GC 11.0.1
Damien Le Moal <dlemoal@kernel.org>
ata: libata-scsi: Use correct device no in ata_find_dev()
Bart Van Assche <bvanassche@acm.org>
scsi: stex: Fix gcc 13 warnings
Richard Acayan <mailingradian@gmail.com>
misc: fastrpc: reject new invocations during device removal
Richard Acayan <mailingradian@gmail.com>
misc: fastrpc: return -EPIPE to invocations on device removal
Ekansh Gupta <quic_ekangupt@quicinc.com>
misc: fastrpc: Reassign memory ownership only for remote heap
Yu Kuai <yukuai3@huawei.com>
md/raid5: fix miscalculation of 'end_sector' in raid5_read_one_chunk()
Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
usb: gadget: f_fs: Add unbind event before functionfs_unbind
Frank Li <Frank.Li@nxp.com>
usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
Marek Vasut <marex@denx.de>
dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type
Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
Lukas Bulwahn <lukas.bulwahn@gmail.com>
iio: dac: build ad5758 driver when AD5758 is selected
Sean Nyekjaer <sean@geanix.com>
iio: adc: stm32-adc: skip adc-diff-channels setup if none is present
Paul Cercueil <paul@crapouillou.net>
iio: adc: ad7192: Change "shorted" channels to differential
Rasmus Villemoes <linux@rasmusvillemoes.dk>
iio: addac: ad74413: fix resistance input processing
Marek Vasut <marex@denx.de>
iio: dac: mcp4725: Fix i2c_master_send() return value handling
Masahiro Honda <honda@mechatrax.com>
iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag
Sean Nyekjaer <sean@geanix.com>
iio: adc: stm32-adc: skip adc-channels setup if none is present
Matti Vaittinen <mazziesaccount@gmail.com>
iio: accel: kx022a fix irq getting
Frank Li <Frank.Li@nxp.com>
iio: light: vcnl4035: fixed chip ID check
Geert Uytterhoeven <geert+renesas@glider.be>
dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value
Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
iio: imu: inv_icm42600: fix timestamp reset
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
HID: wacom: avoid integer overflow in wacom_intuos_inout()
Sung-Chi Li <lschyi@chromium.org>
HID: google: add jewel USB id
ChiaEn Wu <chiaen_wu@richtek.com>
iio: adc: mt6370: Fix ibus and ibat scaling value of some specific vendor ID chips
Lars-Peter Clausen <lars@metafoo.de>
iio: ad4130: Make sure clock provider gets removed
Lars-Peter Clausen <lars@metafoo.de>
iio: tmag5273: Fix runtime PM leak on measurement error
Jiakai Luo <jkluo@hust.edu.cn>
iio: adc: mxs-lradc: fix the order of two cleanup operations
Hans de Goede <hdegoede@redhat.com>
iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method
Aric Cyr <aric.cyr@amd.com>
drm/amd/display: Only wait for blank completion if OTG active
Masami Hiramatsu (Google) <mhiramat@kernel.org>
selftests/ftrace: Choose target function for filter test from samples
Laurent Pinchart <laurent.pinchart@ideasonboard.com>
media: uvcvideo: Don't expose unsupported formats to userspace
Francesco Dolcini <francesco.dolcini@toradex.com>
dt-bindings: serial: 8250_omap: add rs485-rts-active-high
K Prateek Nayak <kprateek.nayak@amd.com>
drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug
K Prateek Nayak <kprateek.nayak@amd.com>
drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
Dan Carpenter <dan.carpenter@linaro.org>
mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
Pin-yen Lin <treapking@chromium.org>
media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats
Fuad Tabba <tabba@google.com>
KVM: arm64: Reload PTE after invoking walker callback on preorder traversal
Like Xu <likexu@tencent.com>
perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS
Gleb Chesnokov <gleb.chesnokov@scst.dev>
scsi: qla2xxx: Fix NULL pointer dereference in target mode
Will Deacon <will@kernel.org>
KVM: arm64: Prevent unconditional donation of unmapped regions from the host
Jean-Philippe Brucker <jean-philippe@linaro.org>
KVM: arm64: vgic: Fix locking comment
Jean-Philippe Brucker <jean-philippe@linaro.org>
KVM: arm64: vgic: Wrap vgic_its_create() with config_lock
Jean-Philippe Brucker <jean-philippe@linaro.org>
KVM: arm64: vgic: Fix a circular locking issue
Dan Carpenter <error27@gmail.com>
iio: adc: imx93: fix a signedness bug in imx93_adc_read_raw()
Loic Poulain <loic.poulain@linaro.org>
block: Deny writable memory mapping if block is read-only
Daniel Smith <dansmith@ds.gy>
nvme-pci: Add quirk for Teamgroup MP33 SSD
Ming Lei <ming.lei@redhat.com>
ublk: fix AB-BA lockdep warning
Guchun Chen <guchun.chen@amd.com>
drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged
Xiubo Li <xiubli@redhat.com>
ceph: silence smatch warning in reconnect_caps_cb()
Arnd Bergmann <arnd@arndb.de>
atm: hide unused procfs functions
Rob Clark <robdclark@chromium.org>
drm/msm: Be more shouty if per-process pgtables aren't working
Arnd Bergmann <arnd@arndb.de>
ALSA: oss: avoid missing-prototype warnings
Maurizio Lombardi <mlombard@redhat.com>
nvme: do not let the user delete a ctrl before a complete initialization
Christoph Hellwig <hch@lst.de>
nvme-multipath: don't call blk_mark_disk_dead in nvme_mpath_remove_disk
Tom Rix <trix@redhat.com>
netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
Kai-Heng Feng <kai.heng.feng@canonical.com>
net: wwan: t7xx: Ensure init is completed before system sleep
Arnd Bergmann <arnd@arndb.de>
wifi: b43: fix incorrect __packed annotation
Wenchao Hao <haowenchao2@huawei.com>
scsi: core: Decrease scsi_device's iorequest_cnt if dispatch failed
Po-Wen Kao <powen.kao@mediatek.com>
scsi: ufs: core: Fix MCQ nr_hw_queues
Po-Wen Kao <powen.kao@mediatek.com>
scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc()
Po-Wen Kao <powen.kao@mediatek.com>
scsi: ufs: core: Fix MCQ tag calculation
Ariel Malamud <ariel.malamud@intel.com>
wifi: iwlwifi: mvm: Add locking to the rate read flow
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: recalc chanctx mindef before assigning
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: consider reserved chanctx for mindef
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: simplify chanctx allocation
Linus Walleij <linus.walleij@linaro.org>
arm64: vdso: Pass (void *) to virt_to_page()
Min-Hua Chen <minhuadotchen@gmail.com>
arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
Dario Binacchi <dario.binacchi@amarulasolutions.com>
ARM: dts: stm32: add pin map for CAN controller on stm32f7
Yun Lu <luyun@kylinos.cn>
wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
Rubén Gómez <mrgommer@proton.me>
ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P
Alexander Gordeev <agordeev@linux.ibm.com>
s390/ipl: fix IPIB virtual vs physical address confusion
Alexander Gordeev <agordeev@linux.ibm.com>
s390/topology: honour nr_cpu_ids when adding CPUs
Holger Dengler <dengler@linux.ibm.com>
s390/pkey: zeroize key blobs
Kai Vehmanen <kai.vehmanen@linux.intel.com>
ASoC: SOF: pm: save io region state in case of errors in resume
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: SOF: pcm: fix pm_runtime imbalance in error handling
Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions
Hyunwoo Kim <v4bel@theori.io>
media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
Takashi Iwai <tiwai@suse.de>
media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
Hyunwoo Kim <imv4bel@gmail.com>
media: dvb-core: Fix use-after-free due to race at dvb_register_device()
Hyunwoo Kim <imv4bel@gmail.com>
media: dvb-core: Fix use-after-free due on race condition at dvb_net
Hyunwoo Kim <imv4bel@gmail.com>
media: dvb-core: Fix use-after-free on race condition at dvb_frontend
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
Hyunwoo Kim <imv4bel@gmail.com>
media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
YongSu Yoo <yongsuyoo0215@gmail.com>
media: dvb_ca_en50221: fix a size write bug
Wei Chen <harperchen1110@gmail.com>
media: netup_unidvb: fix irq init by register it at the end of probe
Wei Chen <harperchen1110@gmail.com>
media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
Wei Chen <harperchen1110@gmail.com>
media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
Zhang Shurong <zhang_shurong@foxmail.com>
media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
Wei Chen <harperchen1110@gmail.com>
media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
Wei Chen <harperchen1110@gmail.com>
media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
Wei Chen <harperchen1110@gmail.com>
media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
YongSu Yoo <yongsuyoo0215@gmail.com>
media: dvb_demux: fix a bug for the continuity counter
Paweł Anikiel <pan@semihalf.com>
ASoC: ssm2602: Add workaround for playback distortions
Alexandru Sorodoc <ealex95@gmail.com>
ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V
Martin Povišer <povik+lin@cutebit.org>
ASoC: dt-bindings: Adjust #sound-dai-cells on TI's single-DAI codecs
Aidan MacDonald <aidanmacdonald.0x0@gmail.com>
ASoC: jz4740-i2s: Make I2S divider calculations more robust
Benedict Wong <benedictwong@google.com>
xfrm: Check if_id in inbound policy/secpath match
Johannes Berg <johannes.berg@intel.com>
um: harddog: fix modular build
V sujith kumar Reddy <Vsujithkumar.Reddy@amd.com>
ASoC: SOF: amd: Fix NULL pointer crash in acp_sof_ipc_msg_data function
Hao Zeng <zenghao@kylinos.cn>
cpupower:Fix resource leaks in sysfs_get_enabled()
Maxim Kochetkov <fido_max@inbox.ru>
ASoC: dwc: limit the number of overrun messages
Jeremy Soller <jeremy@system76.com>
ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12
Adrian Huang <ahuang12@lenovo.com>
nvme-pci: clamp max_hw_sectors based on DMA optimized limitation
Hristo Venev <hristo@venev.name>
nvme-pci: add quirk for missing secondary temperature thresholds
Sagi Grimberg <sagi@grimberg.me>
nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G
Guoqing Jiang <guoqing.jiang@linux.dev>
block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
Ivan Orlov <ivan.orlov0322@gmail.com>
nbd: Fix debugfs_create_dir error checking
Helge Deller <deller@gmx.de>
fbdev: stifb: Fix info entry in sti_struct on error path
Helge Deller <deller@gmx.de>
fbdev: modedb: Add 1920x1080 at 60 Hz video mode
Zheng Wang <zyytlz.wz@163.com>
fbdev: imsttfb: Fix use after free bug in imsttfb_probe
Yifan Zhang <yifan1.zhang@amd.com>
drm/amdgpu: set gfx9 onwards APU atomics support to be true
Thong Thai <thong.thai@amd.com>
drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution
Bob Peterson <rpeterso@redhat.com>
gfs2: Don't deref jdesc in evict
Liming Sun <limings@nvidia.com>
platform/mellanox: fix potential race in mlxbf-tmfifo driver
Julian Winkler <julian.winkler1@web.de>
platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
media: rcar-vin: Fix NV12 size alignment
Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
media: rcar-vin: Gen3 can not scale NV12
Mario Limonciello <mario.limonciello@amd.com>
hwmon: (k10temp) Add PCI ID for family 19, model 78h
Kan Liang <kan.liang@linux.intel.com>
perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG
Haibo Li <haibo.li@mediatek.com>
ARM: 9295/1: unwind:fix unwind abort for uleb128 case
Filipe Manana <fdmanana@suse.com>
btrfs: abort transaction when sibling keys check fails for leaves
Jammy Huang <jammy_huang@aspeedtech.com>
drm/ast: Fix ARM compatibility
Lee Jones <lee@kernel.org>
mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
lyndonli <Lyndon.Li@amd.com>
drm/amdgpu: Use the default reset when loading or reloading the driver
Hans de Goede <hdegoede@redhat.com>
ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet
Qing Zhang <zhangqing@loongson.cn>
LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection
WANG Xuerui <git@xen0n.name>
LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR
Hersen Wu <hersenxs.wu@amd.com>
drm/amd/display: fix memleak in aconnector->timing_requested
jasontao <jasontao@glenfly.com>
ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
Johannes Thumshirn <jth@kernel.org>
watchdog: menz069_wdt: fix watchdog initialisation
Chong Li <chongli2@amd.com>
drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init"
Paolo Abeni <pabeni@redhat.com>
mptcp: add annotations around sk->sk_shutdown accesses
Paolo Abeni <pabeni@redhat.com>
mptcp: fix data race around msk->first access
Paolo Abeni <pabeni@redhat.com>
mptcp: consolidate passive msk socket initialization
Paolo Abeni <pabeni@redhat.com>
mptcp: simplify subflow_syn_recv_sock()
Paolo Abeni <pabeni@redhat.com>
mptcp: avoid unneeded address copy
Paolo Abeni <pabeni@redhat.com>
mptcp: add annotations around msk->subflow accesses
Paolo Abeni <pabeni@redhat.com>
mptcp: avoid unneeded __mptcp_nmpc_socket() usage
Xin Long <lucien.xin@gmail.com>
rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg
Xin Long <lucien.xin@gmail.com>
rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg
Xin Long <lucien.xin@gmail.com>
rtnetlink: call validate_linkmsg in rtnl_create_link
Maciej Fijalkowski <maciej.fijalkowski@intel.com>
ice: recycle/free all of the fragments from multi-buffer frame
Xu Liang <lxu@maxlinear.com>
net: phy: mxl-gpy: extend interrupt fix to all impacted variants
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
net: renesas: rswitch: Fix return value in error path of xmit
Chris Packham <chris.packham@alliedtelesis.co.nz>
mtd: rawnand: marvell: don't set the NAND frequency select
Chris Packham <chris.packham@alliedtelesis.co.nz>
mtd: rawnand: marvell: ensure timing values are written
Andreas Svensson <andreas.svensson@axis.com>
net: dsa: mv88e6xxx: Increase wait after reset deactivation
Bert Karwatzki <spasswolf@web.de>
net: ipa: Use correct value for IPA_STATUS_SIZE
fuyuanli <fuyuanli@didiglobal.com>
tcp: fix mishandling when the sack compression is deferred.
Hangyu Hua <hbh25y@gmail.com>
net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
Chen-Yu Tsai <wenst@chromium.org>
iommu/mediatek: Flush IOTLB completely only if domain has been attached
Edward Cree <ecree.xilinx@gmail.com>
sfc: fix error unwinds in TC offload
Moshe Shemesh <moshe@nvidia.com>
net/mlx5: Read embedded cpu after init bit cleared
Saeed Mahameed <saeedm@nvidia.com>
net/mlx5e: Fix error handling in mlx5e_refresh_tirs
Christoph Hellwig <hch@lst.de>
nvme: fix the name of Zone Append for verbose logging
Bastien Nocera <hadess@hadess.net>
HID: logitech-hidpp: Handle timeout differently from busy
Dan Carpenter <dan.carpenter@linaro.org>
nfsd: fix double fget() bug in __write_ports_addfd()
Vladislav Efanov <VEfanov@ispras.ru>
udp6: Fix race condition in udp6_sendmsg & connect
Pedro Tammela <pctammela@mojatatu.com>
net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
Zhengchao Shao <shaozhengchao@huawei.com>
net: sched: fix NULL pointer dereference in mq_attach
Peilin Ye <peilin.ye@bytedance.com>
net/sched: Prohibit regrafting ingress or clsact Qdiscs
Peilin Ye <peilin.ye@bytedance.com>
net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
Peilin Ye <peilin.ye@bytedance.com>
net/sched: sch_clsact: Only create under TC_H_CLSACT
Peilin Ye <peilin.ye@bytedance.com>
net/sched: sch_ingress: Only create under TC_H_INGRESS
Wen Gu <guwen@linux.alibaba.com>
net/smc: Don't use RMBs not mapped to new link in SMCRv2 ADD LINK
Wen Gu <guwen@linux.alibaba.com>
net/smc: Scan from current RMB list when no position specified
David Howells <dhowells@redhat.com>
rxrpc: Truncate UTS_RELEASE for rxrpc version
Cambda Zhu <cambda@linux.alibaba.com>
tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
Eric Dumazet <edumazet@google.com>
tcp: deny tcp_disconnect() when threads are waiting
Eric Dumazet <edumazet@google.com>
af_packet: do not use READ_ONCE() in packet_bind()
Mustafa Ismail <mustafa.ismail@intel.com>
RDMA/irdma: Fix Local Invalidate fencing
Mustafa Ismail <mustafa.ismail@intel.com>
RDMA/irdma: Prevent QP use after free
Akihiro Suda <suda.kyoto@gmail.com>
efi: Bump stub image version for macOS HVF compatibility
Arnd Bergmann <arnd@arndb.de>
mtd: rawnand: ingenic: fix empty stub helper definitions
Namhyung Kim <namhyung@kernel.org>
perf ftrace latency: Remove unnecessary "--" from --use-nsec option
Raju Rangoju <Raju.Rangoju@amd.com>
amd-xgbe: fix the false linkup in xgbe_phy_status
Jakub Kicinski <kuba@kernel.org>
tls: improve lockless access safety of tls_err_abort()
Kuniyuki Iwashima <kuniyu@amazon.com>
af_packet: Fix data-races of pkt_sk(sk)->num.
Eric Dumazet <edumazet@google.com>
netrom: fix info-leak in nr_write_internal()
Wei Fang <wei.fang@nxp.com>
net: stmmac: fix call trace when stmmac_xdp_xmit() is invoked
Thomas Bogendoerfer <tbogendoerfer@suse.de>
net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure
Jianbo Liu <jianbol@nvidia.com>
net/mlx5e: Move Ethernet driver debugfs to profile init callback
Dmytro Linkin <dlinkin@nvidia.com>
net/mlx5e: Don't attach netdev profile while handling internal error
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Fix post parse infra to only parse every action once
Paul Blakey <paulb@nvidia.com>
net/mlx5e: TC, Remove CT action reordering
Paul Blakey <paulb@nvidia.com>
net/mlx5e: CT: Use per action stats
Dragos Tatulea <dtatulea@nvidia.com>
net/mlx5e: Use query_special_contexts cmd only once per mdev
Shay Drory <shayd@nvidia.com>
net/mlx5: fw_tracer, Fix event handling
Shay Drory <shayd@nvidia.com>
net/mlx5: SF, Drain health before removing device
Shay Drory <shayd@nvidia.com>
net/mlx5: Drain health before unregistering devlink
Maher Sanalla <msanalla@nvidia.com>
net/mlx5e: Do not update SBCM when prio2buffer command is invalid
Maher Sanalla <msanalla@nvidia.com>
net/mlx5e: Consider internal buffers size in port buffer calculations
Chris Mi <cmi@nvidia.com>
net/mlx5e: Prevent encap offload when neigh update is running
Chris Mi <cmi@nvidia.com>
net/mlx5e: Extract remaining tunnel encap code to dedicated file
Paul Blakey <paulb@nvidia.com>
net/mlx5e: TC, Move main flow attribute cleanup to helper func
Paul Blakey <paulb@nvidia.com>
net/mlx5e: TC, Remove unused vf_tun variable
Alexandre Ghiti <alexghiti@rivosinc.com>
riscv: Fix unused variable warning when BUILTIN_DTB is set
Ard Biesheuvel <ardb@kernel.org>
crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors
Randy Dunlap <rdunlap@infradead.org>
dmaengine: pl330: rename _start to prevent build error
Jeff Layton <jlayton@kernel.org>
nfsd: make a copy of struct iattr before calling notify_change
Jason Gunthorpe <jgg@ziepe.ca>
iommu/amd: Add missing domain type checks
Jerry Snitselaar <jsnitsel@redhat.com>
iommu/amd: Fix up merge conflict resolution
Joao Martins <joao.m.martins@oracle.com>
iommu/amd: Handle GALog overflows
Joao Martins <joao.m.martins@oracle.com>
iommu/amd: Don't block updates to GATag if guest mode is on
Chao Wang <D202280639@hust.edu.cn>
iommu/rockchip: Fix unwind goto issue
Randy Dunlap <rdunlap@infradead.org>
iommu: Make IPMMU_VMSA dependencies more strict
Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
RDMA/bnxt_re: Fix a possible memory leak
Dan Carpenter <dan.carpenter@linaro.org>
dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
Yangyang Li <liyangyang20@huawei.com>
RDMA/hns: Modify the value of long message loopback slice
Chengchang Tang <tangchengchang@huawei.com>
RDMA/hns: Fix base address table allocation
Chengchang Tang <tangchengchang@huawei.com>
RDMA/hns: Fix timeout attr in query qp for HIP08
Yonatan Nachum <ynachum@amazon.com>
RDMA/efa: Fix unsupported page sizes in device
Neil Armstrong <neil.armstrong@linaro.org>
phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value
Selvin Xavier <selvin.xavier@broadcom.com>
RDMA/bnxt_re: Fix the page_size used during the MR creation
-------------
Diffstat:
.../bindings/iio/adc/renesas,rcar-gyroadc.yaml | 2 +-
.../devicetree/bindings/serial/8250_omap.yaml | 1 +
.../devicetree/bindings/sound/tas2562.yaml | 6 +-
.../devicetree/bindings/sound/tas2770.yaml | 6 +-
.../devicetree/bindings/sound/tas27xx.yaml | 6 +-
.../devicetree/bindings/usb/snps,dwc3.yaml | 2 +-
Makefile | 4 +-
arch/arm/boot/dts/stm32f7-pinctrl.dtsi | 82 +++++++++
arch/arm/kernel/unwind.c | 25 ++-
arch/arm64/include/asm/kvm_pgtable.h | 6 +-
arch/arm64/kernel/vdso.c | 2 +-
arch/arm64/kvm/hyp/include/hyp/switch.h | 8 +-
arch/arm64/kvm/hyp/nvhe/mem_protect.c | 14 +-
arch/arm64/kvm/hyp/nvhe/switch.c | 2 +
arch/arm64/kvm/hyp/pgtable.c | 17 +-
arch/arm64/kvm/hyp/vhe/switch.c | 1 +
arch/arm64/kvm/vgic/vgic-init.c | 25 ++-
arch/arm64/kvm/vgic/vgic-its.c | 14 +-
arch/arm64/kvm/vgic/vgic-kvm-device.c | 10 +-
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 31 ++--
arch/arm64/kvm/vgic/vgic-mmio.c | 9 +-
arch/arm64/kvm/vgic/vgic-v2.c | 6 -
arch/arm64/kvm/vgic/vgic-v3.c | 7 -
arch/arm64/kvm/vgic/vgic-v4.c | 3 +-
arch/arm64/mm/fault.c | 4 +-
arch/loongarch/Kconfig | 1 +
arch/loongarch/include/asm/inst.h | 26 +++
arch/loongarch/kernel/genex.S | 1 +
arch/loongarch/kernel/traps.c | 92 +++++++++++
arch/powerpc/platforms/pseries/iommu.c | 13 +-
arch/powerpc/xmon/xmon.c | 2 +-
arch/riscv/include/asm/perf_event.h | 7 +
arch/riscv/kernel/vmlinux.lds.S | 2 +
arch/riscv/mm/init.c | 2 +-
arch/s390/kernel/ipl.c | 3 +-
arch/s390/kernel/topology.c | 32 ++--
arch/um/drivers/Makefile | 4 +-
arch/um/drivers/harddog.h | 9 +
arch/um/drivers/harddog_kern.c | 7 +-
arch/um/drivers/harddog_user.c | 1 +
arch/um/drivers/harddog_user_exp.c | 9 +
arch/x86/crypto/aria-aesni-avx-asm_64.S | 2 -
arch/x86/events/intel/core.c | 2 +-
arch/x86/events/intel/ds.c | 56 ++++---
arch/x86/include/asm/perf_event.h | 3 +
arch/x86/kvm/lapic.c | 20 ++-
arch/x86/kvm/mmu/mmu.c | 5 +-
arch/x86/kvm/x86.c | 3 +
block/blk-settings.c | 3 +-
block/fops.c | 12 +-
crypto/asymmetric_keys/public_key.c | 38 +++--
drivers/acpi/resource.c | 12 ++
drivers/ata/libata-scsi.c | 34 +++-
drivers/base/cacheinfo.c | 26 +++
drivers/base/regmap/regmap.c | 6 +-
drivers/block/nbd.c | 4 +-
drivers/block/rnbd/rnbd-proto.h | 2 +-
drivers/block/ublk_drv.c | 9 +-
drivers/char/tpm/tpm_tis_core.c | 7 +-
drivers/char/tpm/tpm_tis_core.h | 8 +-
drivers/dma/at_hdmac.c | 17 +-
drivers/dma/at_xdmac.c | 7 +-
drivers/dma/pl330.c | 8 +-
drivers/firmware/qcom_scm.c | 12 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 45 +++--
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 3 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 3 +-
drivers/gpu/drm/amd/amdgpu/nv.c | 22 ++-
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +-
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 29 ----
drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 10 +-
drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +-
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 5 +-
.../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 5 +-
.../gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 5 +-
drivers/gpu/drm/ast/ast_main.c | 9 +-
drivers/gpu/drm/msm/msm_iommu.c | 7 +-
drivers/hid/hid-google-hammer.c | 2 +
drivers/hid/hid-ids.h | 1 +
drivers/hid/hid-logitech-hidpp.c | 12 +-
drivers/hid/wacom_wac.c | 2 +-
drivers/hwmon/k10temp.c | 1 +
drivers/iio/accel/kionix-kx022a.c | 2 +-
drivers/iio/accel/st_accel_core.c | 4 +-
drivers/iio/adc/ad4130.c | 12 +-
drivers/iio/adc/ad7192.c | 8 +-
drivers/iio/adc/ad_sigma_delta.c | 4 +
drivers/iio/adc/imx93_adc.c | 7 +-
drivers/iio/adc/mt6370-adc.c | 53 +++++-
drivers/iio/adc/mxs-lradc-adc.c | 10 +-
drivers/iio/adc/stm32-adc.c | 61 +++----
drivers/iio/addac/ad74413r.c | 2 +-
drivers/iio/dac/Makefile | 2 +-
drivers/iio/dac/mcp4725.c | 16 +-
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 10 +-
drivers/iio/light/vcnl4035.c | 3 +
drivers/iio/magnetometer/tmag5273.c | 5 +-
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 4 +-
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 11 +-
drivers/infiniband/hw/bnxt_re/qplib_res.c | 12 +-
drivers/infiniband/hw/bnxt_re/qplib_sp.c | 7 +-
drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 25 ++-
drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +
drivers/infiniband/hw/hns/hns_roce_mr.c | 43 +++++
drivers/infiniband/hw/irdma/verbs.c | 12 +-
drivers/iommu/Kconfig | 1 +
drivers/iommu/amd/amd_iommu.h | 4 +-
drivers/iommu/amd/init.c | 24 +++
drivers/iommu/amd/iommu.c | 31 +++-
drivers/iommu/mtk_iommu.c | 3 +-
drivers/iommu/rockchip-iommu.c | 14 +-
drivers/mailbox/mailbox-test.c | 13 +-
drivers/md/raid5.c | 2 +-
drivers/media/dvb-core/dvb_ca_en50221.c | 49 +++++-
drivers/media/dvb-core/dvb_demux.c | 4 +-
drivers/media/dvb-core/dvb_frontend.c | 69 ++++++--
drivers/media/dvb-core/dvb_net.c | 38 ++++-
drivers/media/dvb-core/dvbdev.c | 84 +++++++---
drivers/media/dvb-frontends/mn88443x.c | 2 +-
drivers/media/pci/netup_unidvb/netup_unidvb_core.c | 17 +-
.../mediatek/vcodec/mtk_vcodec_dec_stateful.c | 3 +
drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 21 ++-
drivers/media/usb/dvb-usb-v2/ce6230.c | 8 +
drivers/media/usb/dvb-usb-v2/ec168.c | 12 ++
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 20 +++
drivers/media/usb/dvb-usb/az6027.c | 12 ++
drivers/media/usb/dvb-usb/digitv.c | 4 +
drivers/media/usb/dvb-usb/dw2102.c | 2 +-
drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +-
drivers/media/usb/uvc/uvc_driver.c | 16 +-
drivers/misc/fastrpc.c | 33 +++-
drivers/mmc/core/pwrseq_sd8787.c | 34 +++-
drivers/mmc/host/vub300.c | 3 +
drivers/mtd/mtdchar.c | 8 +-
drivers/mtd/nand/raw/ingenic/ingenic_ecc.h | 8 +-
drivers/mtd/nand/raw/marvell_nand.c | 10 +-
drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 12 +-
drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 +
.../ethernet/mellanox/mlx5/core/en/port_buffer.c | 44 +++--
.../ethernet/mellanox/mlx5/core/en/port_buffer.h | 8 +-
.../ethernet/mellanox/mlx5/core/en/tc/act/act.c | 27 +--
.../ethernet/mellanox/mlx5/core/en/tc/act/act.h | 8 +-
.../net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c | 9 +-
.../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 120 ++++++++++++--
.../ethernet/mellanox/mlx5/core/en/tc_tun_encap.h | 9 +
.../net/ethernet/mellanox/mlx5/core/en_common.c | 11 +-
drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c | 7 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 69 ++++----
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 6 +
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 184 +++++----------------
drivers/net/ethernet/mellanox/mlx5/core/main.c | 9 +-
drivers/net/ethernet/mellanox/mlx5/core/mr.c | 21 +++
.../ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 +
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 13 +-
drivers/net/ethernet/renesas/rswitch.c | 2 +-
drivers/net/ethernet/sfc/tc.c | 4 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c | 6 +
drivers/net/ipa/ipa_endpoint.c | 2 +-
drivers/net/phy/mxl-gpy.c | 16 +-
drivers/net/usb/qmi_wwan.c | 2 +-
drivers/net/wireless/ath/ath10k/qmi.c | 4 +-
drivers/net/wireless/broadcom/b43/b43.h | 2 +-
.../net/wireless/broadcom/b43legacy/b43legacy.h | 2 +-
drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 3 +
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 1 +
.../net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 4 +-
drivers/net/wwan/t7xx/t7xx_pci.c | 18 ++
drivers/net/wwan/t7xx/t7xx_pci.h | 1 +
drivers/nvme/host/constants.c | 2 +-
drivers/nvme/host/core.c | 6 +-
drivers/nvme/host/hwmon.c | 4 +-
drivers/nvme/host/multipath.c | 1 -
drivers/nvme/host/nvme.h | 5 +
drivers/nvme/host/pci.c | 8 +-
.../phy/amlogic/phy-meson-g12a-mipi-dphy-analog.c | 2 +-
drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 5 +-
drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c | 5 +-
drivers/platform/mellanox/mlxbf-tmfifo.c | 11 +-
drivers/platform/x86/intel_scu_pcidrv.c | 1 +
drivers/remoteproc/qcom_q6v5_mss.c | 8 +-
drivers/remoteproc/qcom_q6v5_pas.c | 2 +-
drivers/s390/crypto/pkey_api.c | 3 +
drivers/scsi/qla2xxx/qla_def.h | 1 +
drivers/scsi/qla2xxx/qla_init.c | 3 +
drivers/scsi/qla2xxx/qla_inline.h | 3 +
drivers/scsi/qla2xxx/qla_isr.c | 3 +
drivers/scsi/scsi_lib.c | 2 +
drivers/scsi/stex.c | 4 +
drivers/soc/qcom/rmtfs_mem.c | 2 +-
drivers/tty/serial/8250/8250_tegra.c | 4 +-
drivers/tty/serial/Kconfig | 2 +-
drivers/tty/serial/cpm_uart/cpm_uart.h | 2 -
drivers/tty/serial/fsl_lpuart.c | 44 ++---
drivers/ufs/core/ufs-mcq.c | 5 +-
drivers/ufs/core/ufshcd.c | 10 +-
drivers/usb/cdns3/cdns3-gadget.c | 13 ++
drivers/usb/gadget/function/f_fs.c | 2 +-
drivers/video/fbdev/core/bitblit.c | 3 +
drivers/video/fbdev/core/modedb.c | 5 +
drivers/video/fbdev/imsttfb.c | 15 +-
drivers/video/fbdev/stifb.c | 1 +
drivers/watchdog/menz69_wdt.c | 16 +-
fs/btrfs/bio.c | 2 +-
fs/btrfs/ctree.c | 2 +
fs/btrfs/disk-io.c | 2 +-
fs/ceph/mds_client.c | 3 +-
fs/ext4/ext4.h | 5 +-
fs/ext4/inode.c | 34 +++-
fs/ext4/super.c | 24 +--
fs/ext4/xattr.c | 41 ++---
fs/gfs2/super.c | 8 +
fs/ksmbd/oplock.c | 72 +++++---
fs/ksmbd/smb2pdu.c | 90 +++++-----
fs/nfsd/nfsctl.c | 7 +-
fs/nfsd/vfs.c | 10 +-
fs/xfs/xfs_buf_item_recover.c | 10 ++
include/linux/firmware/qcom/qcom_scm.h | 2 +-
include/linux/mlx5/driver.h | 1 +
include/linux/pe.h | 25 +--
include/linux/sunrpc/svcsock.h | 7 +-
include/media/dvb_frontend.h | 6 +-
include/media/dvb_net.h | 4 +
include/media/dvbdev.h | 15 ++
include/net/sock.h | 4 +
include/net/tcp.h | 1 +
include/ufs/ufshcd.h | 2 +-
io_uring/epoll.c | 4 -
kernel/module/decompress.c | 2 +-
kernel/trace/trace_events_hist.c | 23 ++-
kernel/trace/trace_osnoise.c | 2 +
kernel/trace/trace_probe.h | 2 +-
lib/test_firmware.c | 85 +++++++---
net/atm/resources.c | 2 +
net/core/rtnetlink.c | 54 ++++--
net/core/sock.c | 2 +-
net/ipv4/af_inet.c | 2 +
net/ipv4/inet_connection_sock.c | 1 +
net/ipv4/tcp.c | 9 +-
net/ipv4/tcp_input.c | 2 +-
net/ipv4/tcp_timer.c | 16 +-
net/mac80211/chan.c | 75 +++++----
net/mac80211/ieee80211_i.h | 3 +-
net/mac80211/util.c | 2 +-
net/mptcp/protocol.c | 143 +++++++++-------
net/mptcp/protocol.h | 15 +-
net/mptcp/subflow.c | 63 ++-----
net/netfilter/nf_conntrack_netlink.c | 4 +
net/netlink/af_netlink.c | 2 +-
net/netrom/nr_subr.c | 7 +-
net/packet/af_packet.c | 8 +-
net/packet/diag.c | 2 +-
net/rxrpc/af_rxrpc.c | 1 +
net/rxrpc/ar-internal.h | 1 +
net/rxrpc/local_event.c | 11 +-
net/sched/cls_flower.c | 3 +
net/sched/sch_api.c | 16 +-
net/sched/sch_ingress.c | 16 +-
net/smc/smc_llc.c | 9 +-
net/sunrpc/svcsock.c | 24 +--
net/tls/tls_strp.c | 4 +-
net/tls/tls_sw.c | 4 +-
net/xfrm/xfrm_policy.c | 11 +-
security/selinux/Makefile | 6 +-
sound/core/oss/pcm_plugin.h | 16 +-
sound/pci/hda/hda_intel.c | 21 +++
sound/pci/hda/patch_hdmi.c | 22 +++
sound/pci/hda/patch_realtek.c | 20 +++
sound/soc/amd/yc/acp6x-mach.c | 7 +
sound/soc/codecs/ssm2602.c | 15 ++
sound/soc/dwc/dwc-i2s.c | 4 +-
sound/soc/intel/common/soc-acpi-intel-cht-match.c | 26 +++
sound/soc/jz4740/jz4740-i2s.c | 54 +++++-
sound/soc/sof/amd/acp-ipc.c | 7 +-
sound/soc/sof/debug.c | 4 +-
sound/soc/sof/pcm.c | 17 +-
sound/soc/sof/pm.c | 14 +-
sound/soc/sof/sof-client-probes.c | 14 +-
tools/perf/builtin-ftrace.c | 2 +-
tools/power/cpupower/lib/powercap.c | 23 ++-
.../ftrace/test.d/filter/event-filter-function.tc | 47 +++---
tools/testing/selftests/net/mptcp/Makefile | 2 +-
tools/testing/selftests/net/mptcp/diag.sh | 4 +
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 4 +
tools/testing/selftests/net/mptcp/mptcp_join.sh | 17 +-
tools/testing/selftests/net/mptcp/mptcp_lib.sh | 40 +++++
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 4 +
tools/testing/selftests/net/mptcp/pm_netlink.sh | 4 +
tools/testing/selftests/net/mptcp/simult_flows.sh | 4 +
tools/testing/selftests/net/mptcp/userspace_pm.sh | 4 +
295 files changed, 2806 insertions(+), 1289 deletions(-)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 001/286] RDMA/bnxt_re: Fix the page_size used during the MR creation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 002/286] phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value Greg Kroah-Hartman
` (293 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalesh AP, Kashyap Desai,
Selvin Xavier, Jason Gunthorpe, Sasha Levin
From: Selvin Xavier <selvin.xavier@broadcom.com>
[ Upstream commit 08c7f09356e45d093d1867c7a3c6ac6526e2f98b ]
Driver populates the list of pages used for Memory region wrongly when
page size is more than system page size. This is causing a failure when
some of the applications that creates MR with page size as 2M. Since HW
can support multiple page sizes, pass the correct page size while creating
the MR.
Also, driver need not adjust the number of pages when HW Queues are
created with user memory. It should work with the number of dma blocks
returned by ib_umem_num_dma_blocks. Fix this calculation also.
Fixes: 0c4dcd602817 ("RDMA/bnxt_re: Refactor hardware queue memory allocation")
Fixes: f6919d56388c ("RDMA/bnxt_re: Code refactor while populating user MRs")
Link: https://lore.kernel.org/r/1683484169-9539-1-git-send-email-selvin.xavier@broadcom.com
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_res.c | 12 ++----------
drivers/infiniband/hw/bnxt_re/qplib_sp.c | 7 +++----
2 files changed, 5 insertions(+), 14 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_res.c b/drivers/infiniband/hw/bnxt_re/qplib_res.c
index 126d4f26f75ad..81b0c5e879f9e 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_res.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_res.c
@@ -215,17 +215,9 @@ int bnxt_qplib_alloc_init_hwq(struct bnxt_qplib_hwq *hwq,
return -EINVAL;
hwq_attr->sginfo->npages = npages;
} else {
- unsigned long sginfo_num_pages = ib_umem_num_dma_blocks(
- hwq_attr->sginfo->umem, hwq_attr->sginfo->pgsize);
-
+ npages = ib_umem_num_dma_blocks(hwq_attr->sginfo->umem,
+ hwq_attr->sginfo->pgsize);
hwq->is_user = true;
- npages = sginfo_num_pages;
- npages = (npages * PAGE_SIZE) /
- BIT_ULL(hwq_attr->sginfo->pgshft);
- if ((sginfo_num_pages * PAGE_SIZE) %
- BIT_ULL(hwq_attr->sginfo->pgshft))
- if (!npages)
- npages++;
}
if (npages == MAX_PBL_LVL_0_PGS && !hwq_attr->sginfo->nopte) {
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
index b802981b71716..bae7d89261439 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c
@@ -584,16 +584,15 @@ int bnxt_qplib_reg_mr(struct bnxt_qplib_res *res, struct bnxt_qplib_mrw *mr,
/* Free the hwq if it already exist, must be a rereg */
if (mr->hwq.max_elements)
bnxt_qplib_free_hwq(res, &mr->hwq);
- /* Use system PAGE_SIZE */
hwq_attr.res = res;
hwq_attr.depth = pages;
- hwq_attr.stride = buf_pg_size;
+ hwq_attr.stride = sizeof(dma_addr_t);
hwq_attr.type = HWQ_TYPE_MR;
hwq_attr.sginfo = &sginfo;
hwq_attr.sginfo->umem = umem;
hwq_attr.sginfo->npages = pages;
- hwq_attr.sginfo->pgsize = PAGE_SIZE;
- hwq_attr.sginfo->pgshft = PAGE_SHIFT;
+ hwq_attr.sginfo->pgsize = buf_pg_size;
+ hwq_attr.sginfo->pgshft = ilog2(buf_pg_size);
rc = bnxt_qplib_alloc_init_hwq(&mr->hwq, &hwq_attr);
if (rc) {
dev_err(&res->pdev->dev,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 002/286] phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 001/286] RDMA/bnxt_re: Fix the page_size used during the MR creation Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 003/286] RDMA/efa: Fix unsupported page sizes in device Greg Kroah-Hartman
` (292 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Vinod Koul,
Sasha Levin
From: Neil Armstrong <neil.armstrong@linaro.org>
[ Upstream commit b949193011540bb17cf1da7795ec42af1b875203 ]
Use the same CNTL2_DIF_TX_CTL0 value used by the vendor, it was reported
fixing timings issues.
Fixes: 2a56dc650e54 ("phy: amlogic: Add G12A Analog MIPI D-PHY driver")
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20230512-amlogic-v6-4-upstream-dsi-ccf-vim3-v4-10-2592c29ea263@linaro.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/amlogic/phy-meson-g12a-mipi-dphy-analog.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/phy/amlogic/phy-meson-g12a-mipi-dphy-analog.c b/drivers/phy/amlogic/phy-meson-g12a-mipi-dphy-analog.c
index c14089fa7db49..cabdddbbabfd7 100644
--- a/drivers/phy/amlogic/phy-meson-g12a-mipi-dphy-analog.c
+++ b/drivers/phy/amlogic/phy-meson-g12a-mipi-dphy-analog.c
@@ -70,7 +70,7 @@ static int phy_g12a_mipi_dphy_analog_power_on(struct phy *phy)
HHI_MIPI_CNTL1_BANDGAP);
regmap_write(priv->regmap, HHI_MIPI_CNTL2,
- FIELD_PREP(HHI_MIPI_CNTL2_DIF_TX_CTL0, 0x459) |
+ FIELD_PREP(HHI_MIPI_CNTL2_DIF_TX_CTL0, 0x45a) |
FIELD_PREP(HHI_MIPI_CNTL2_DIF_TX_CTL1, 0x2680));
reg = DSI_LANE_CLK;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 003/286] RDMA/efa: Fix unsupported page sizes in device
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 001/286] RDMA/bnxt_re: Fix the page_size used during the MR creation Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 002/286] phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 004/286] RDMA/hns: Fix timeout attr in query qp for HIP08 Greg Kroah-Hartman
` (291 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Firas Jahjah, Michael Margolin,
Yonatan Nachum, Jason Gunthorpe, Sasha Levin
From: Yonatan Nachum <ynachum@amazon.com>
[ Upstream commit 866422cdddcdf59d8c68e9472d49ba1be29b5fcf ]
Device uses 4KB size blocks for user pages indirect list while the
driver creates those blocks with the size of PAGE_SIZE of the kernel. On
kernels with PAGE_SIZE different than 4KB (ARM RHEL), this leads to a
failure on register MR with indirect list because of the miss
communication between driver and device.
Fixes: 40909f664d27 ("RDMA/efa: Add EFA verbs implementation")
Link: https://lore.kernel.org/r/20230511115103.13876-1-ynachum@amazon.com
Reviewed-by: Firas Jahjah <firasj@amazon.com>
Reviewed-by: Michael Margolin <mrgolin@amazon.com>
Signed-off-by: Yonatan Nachum <ynachum@amazon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/efa/efa_verbs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/infiniband/hw/efa/efa_verbs.c b/drivers/infiniband/hw/efa/efa_verbs.c
index 31454643f8c54..f9526a4c75b26 100644
--- a/drivers/infiniband/hw/efa/efa_verbs.c
+++ b/drivers/infiniband/hw/efa/efa_verbs.c
@@ -1397,7 +1397,7 @@ static int pbl_continuous_initialize(struct efa_dev *dev,
*/
static int pbl_indirect_initialize(struct efa_dev *dev, struct pbl_context *pbl)
{
- u32 size_in_pages = DIV_ROUND_UP(pbl->pbl_buf_size_in_bytes, PAGE_SIZE);
+ u32 size_in_pages = DIV_ROUND_UP(pbl->pbl_buf_size_in_bytes, EFA_CHUNK_PAYLOAD_SIZE);
struct scatterlist *sgl;
int sg_dma_cnt, err;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 004/286] RDMA/hns: Fix timeout attr in query qp for HIP08
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 003/286] RDMA/efa: Fix unsupported page sizes in device Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 005/286] RDMA/hns: Fix base address table allocation Greg Kroah-Hartman
` (290 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengchang Tang, Junxian Huang,
Jason Gunthorpe, Sasha Levin
From: Chengchang Tang <tangchengchang@huawei.com>
[ Upstream commit 58caa2a51ad4fd21763696cc6c4defc9fc1b4b4f ]
On HIP08, the queried timeout attr is different from the timeout attr
configured by the user.
It is found by rdma-core testcase test_rdmacm_async_traffic:
======================================================================
FAIL: test_rdmacm_async_traffic (tests.test_rdmacm.CMTestCase)
----------------------------------------------------------------------
Traceback (most recent call last):
File "./tests/test_rdmacm.py", line 33, in test_rdmacm_async_traffic
self.two_nodes_rdmacm_traffic(CMAsyncConnection, self.rdmacm_traffic,
File "./tests/base.py", line 382, in two_nodes_rdmacm_traffic
raise(res)
AssertionError
Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC")
Link: https://lore.kernel.org/r/20230512092245.344442-2-huangjunxian6@hisilicon.com
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 17 ++++++++++++++---
drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 ++
2 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index dbf97fe5948ff..79954d99dc7a3 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -5093,7 +5093,6 @@ static int hns_roce_v2_set_abs_fields(struct ib_qp *ibqp,
static bool check_qp_timeout_cfg_range(struct hns_roce_dev *hr_dev, u8 *timeout)
{
#define QP_ACK_TIMEOUT_MAX_HIP08 20
-#define QP_ACK_TIMEOUT_OFFSET 10
#define QP_ACK_TIMEOUT_MAX 31
if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08) {
@@ -5102,7 +5101,7 @@ static bool check_qp_timeout_cfg_range(struct hns_roce_dev *hr_dev, u8 *timeout)
"local ACK timeout shall be 0 to 20.\n");
return false;
}
- *timeout += QP_ACK_TIMEOUT_OFFSET;
+ *timeout += HNS_ROCE_V2_QP_ACK_TIMEOUT_OFS_HIP08;
} else if (hr_dev->pci_dev->revision > PCI_REVISION_ID_HIP08) {
if (*timeout > QP_ACK_TIMEOUT_MAX) {
ibdev_warn(&hr_dev->ib_dev,
@@ -5388,6 +5387,18 @@ static int hns_roce_v2_query_qpc(struct hns_roce_dev *hr_dev, u32 qpn,
return ret;
}
+static u8 get_qp_timeout_attr(struct hns_roce_dev *hr_dev,
+ struct hns_roce_v2_qp_context *context)
+{
+ u8 timeout;
+
+ timeout = (u8)hr_reg_read(context, QPC_AT);
+ if (hr_dev->pci_dev->revision == PCI_REVISION_ID_HIP08)
+ timeout -= HNS_ROCE_V2_QP_ACK_TIMEOUT_OFS_HIP08;
+
+ return timeout;
+}
+
static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
int qp_attr_mask,
struct ib_qp_init_attr *qp_init_attr)
@@ -5465,7 +5476,7 @@ static int hns_roce_v2_query_qp(struct ib_qp *ibqp, struct ib_qp_attr *qp_attr,
qp_attr->max_dest_rd_atomic = 1 << hr_reg_read(&context, QPC_RR_MAX);
qp_attr->min_rnr_timer = (u8)hr_reg_read(&context, QPC_MIN_RNR_TIME);
- qp_attr->timeout = (u8)hr_reg_read(&context, QPC_AT);
+ qp_attr->timeout = get_qp_timeout_attr(hr_dev, &context);
qp_attr->retry_cnt = hr_reg_read(&context, QPC_RETRY_NUM_INIT);
qp_attr->rnr_retry = hr_reg_read(&context, QPC_RNR_NUM_INIT);
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
index af9d00225cdf5..b5a336e182f83 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h
@@ -72,6 +72,8 @@
#define HNS_ROCE_V2_IDX_ENTRY_SZ 4
#define HNS_ROCE_V2_SCCC_SZ 32
+#define HNS_ROCE_V2_QP_ACK_TIMEOUT_OFS_HIP08 10
+
#define HNS_ROCE_V3_SCCC_SZ 64
#define HNS_ROCE_V3_GMV_ENTRY_SZ 32
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 005/286] RDMA/hns: Fix base address table allocation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 004/286] RDMA/hns: Fix timeout attr in query qp for HIP08 Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 006/286] RDMA/hns: Modify the value of long message loopback slice Greg Kroah-Hartman
` (289 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengchang Tang, Junxian Huang,
Jason Gunthorpe, Sasha Levin
From: Chengchang Tang <tangchengchang@huawei.com>
[ Upstream commit 7f3969b14f356dd65fa95b3528eb05c32e68bc06 ]
For hns, the specification of an entry like resource (E.g. WQE/CQE/EQE)
depends on BT page size, buf page size and hopnum. For user mode, the buf
page size depends on UMEM. Therefore, the actual specification is
controlled by BT page size and hopnum.
The current BT page size and hopnum are obtained from firmware. This makes
the driver inflexible and introduces unnecessary constraints. Resource
allocation failures occur in many scenarios.
This patch will calculate whether the BT page size set by firmware is
sufficient before allocating BT, and increase the BT page size if it is
insufficient.
Fixes: 1133401412a9 ("RDMA/hns: Optimize base address table config flow for qp buffer")
Link: https://lore.kernel.org/r/20230512092245.344442-3-huangjunxian6@hisilicon.com
Signed-off-by: Chengchang Tang <tangchengchang@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_mr.c | 43 +++++++++++++++++++++++++
1 file changed, 43 insertions(+)
diff --git a/drivers/infiniband/hw/hns/hns_roce_mr.c b/drivers/infiniband/hw/hns/hns_roce_mr.c
index 37a5cf62f88b4..14376490ac226 100644
--- a/drivers/infiniband/hw/hns/hns_roce_mr.c
+++ b/drivers/infiniband/hw/hns/hns_roce_mr.c
@@ -33,6 +33,7 @@
#include <linux/vmalloc.h>
#include <rdma/ib_umem.h>
+#include <linux/math.h>
#include "hns_roce_device.h"
#include "hns_roce_cmd.h"
#include "hns_roce_hem.h"
@@ -909,6 +910,44 @@ static int mtr_init_buf_cfg(struct hns_roce_dev *hr_dev,
return page_cnt;
}
+static u64 cal_pages_per_l1ba(unsigned int ba_per_bt, unsigned int hopnum)
+{
+ return int_pow(ba_per_bt, hopnum - 1);
+}
+
+static unsigned int cal_best_bt_pg_sz(struct hns_roce_dev *hr_dev,
+ struct hns_roce_mtr *mtr,
+ unsigned int pg_shift)
+{
+ unsigned long cap = hr_dev->caps.page_size_cap;
+ struct hns_roce_buf_region *re;
+ unsigned int pgs_per_l1ba;
+ unsigned int ba_per_bt;
+ unsigned int ba_num;
+ int i;
+
+ for_each_set_bit_from(pg_shift, &cap, sizeof(cap) * BITS_PER_BYTE) {
+ if (!(BIT(pg_shift) & cap))
+ continue;
+
+ ba_per_bt = BIT(pg_shift) / BA_BYTE_LEN;
+ ba_num = 0;
+ for (i = 0; i < mtr->hem_cfg.region_count; i++) {
+ re = &mtr->hem_cfg.region[i];
+ if (re->hopnum == 0)
+ continue;
+
+ pgs_per_l1ba = cal_pages_per_l1ba(ba_per_bt, re->hopnum);
+ ba_num += DIV_ROUND_UP(re->count, pgs_per_l1ba);
+ }
+
+ if (ba_num <= ba_per_bt)
+ return pg_shift;
+ }
+
+ return 0;
+}
+
static int mtr_alloc_mtt(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
unsigned int ba_page_shift)
{
@@ -917,6 +956,10 @@ static int mtr_alloc_mtt(struct hns_roce_dev *hr_dev, struct hns_roce_mtr *mtr,
hns_roce_hem_list_init(&mtr->hem_list);
if (!cfg->is_direct) {
+ ba_page_shift = cal_best_bt_pg_sz(hr_dev, mtr, ba_page_shift);
+ if (!ba_page_shift)
+ return -ERANGE;
+
ret = hns_roce_hem_list_request(hr_dev, &mtr->hem_list,
cfg->region, cfg->region_count,
ba_page_shift);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 006/286] RDMA/hns: Modify the value of long message loopback slice
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 005/286] RDMA/hns: Fix base address table allocation Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 007/286] dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() Greg Kroah-Hartman
` (288 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yangyang Li, Junxian Huang,
Jason Gunthorpe, Sasha Levin
From: Yangyang Li <liyangyang20@huawei.com>
[ Upstream commit 56518a603fd2bf74762d176ac980572db84a3e14 ]
Long message loopback slice is used for achieving traffic balance between
QPs. It prevents the problem that QPs with large traffic occupying the
hardware pipeline for a long time and QPs with small traffic cannot be
scheduled.
Currently, its maximum value is set to 16K, which means only after a QP
sends 16K will the second QP be scheduled. This value is too large, which
will lead to unbalanced traffic scheduling, and thus it needs to be
modified.
The setting range of the long message loopback slice is modified to be
from 1024 (the lower limit supported by hardware) to mtu. Actual testing
shows that this value can significantly reduce error in hardware traffic
scheduling.
This solution is compatible with both HIP08 and HIP09. The modified
lp_pktn_ini has a maximum value of 2 (when mtu is 256), so the range
checking code for lp_pktn_ini is no longer necessary and needs to be
deleted.
Fixes: 0e60778efb07 ("RDMA/hns: Modify the value of MAX_LP_MSG_LEN to meet hardware compatibility")
Link: https://lore.kernel.org/r/20230512092245.344442-4-huangjunxian6@hisilicon.com
Signed-off-by: Yangyang Li <liyangyang20@huawei.com>
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 79954d99dc7a3..9369f93afaedd 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -4664,11 +4664,9 @@ static int modify_qp_init_to_rtr(struct ib_qp *ibqp,
mtu = ib_mtu_enum_to_int(ib_mtu);
if (WARN_ON(mtu <= 0))
return -EINVAL;
-#define MAX_LP_MSG_LEN 16384
- /* MTU * (2 ^ LP_PKTN_INI) shouldn't be bigger than 16KB */
- lp_pktn_ini = ilog2(MAX_LP_MSG_LEN / mtu);
- if (WARN_ON(lp_pktn_ini >= 0xF))
- return -EINVAL;
+#define MIN_LP_MSG_LEN 1024
+ /* mtu * (2 ^ lp_pktn_ini) should be in the range of 1024 to mtu */
+ lp_pktn_ini = ilog2(max(mtu, MIN_LP_MSG_LEN) / mtu);
if (attr_mask & IB_QP_PATH_MTU) {
hr_reg_write(context, QPC_MTU, ib_mtu);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 007/286] dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 006/286] RDMA/hns: Modify the value of long message loopback slice Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 008/286] RDMA/bnxt_re: Fix a possible memory leak Greg Kroah-Hartman
` (287 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Tudor Ambarus,
Vinod Koul, Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 4d43acb145c363626d76f49febb4240c488cd1cf ]
There are two place if the at_xdmac_interleaved_queue_desc() fails which
could lead to a NULL dereference where "first" is NULL and we call
list_add_tail(&first->desc_node, ...). In the first caller, the return
is not checked so add a check for that. In the next caller, the return
is checked but if it fails on the first iteration through the loop then
it will lead to a NULL pointer dereference.
Fixes: 4e5385784e69 ("dmaengine: at_xdmac: handle numf > 1")
Fixes: 62b5cb757f1d ("dmaengine: at_xdmac: fix memory leak in interleaved mode")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://lore.kernel.org/r/21282b66-9860-410a-83df-39c17fcf2f1b@kili.mountain
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/at_xdmac.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c
index 96f1b69f8a75e..ab13704f27f11 100644
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -1102,6 +1102,8 @@ at_xdmac_prep_interleaved(struct dma_chan *chan,
NULL,
src_addr, dst_addr,
xt, xt->sgl);
+ if (!first)
+ return NULL;
/* Length of the block is (BLEN+1) microblocks. */
for (i = 0; i < xt->numf - 1; i++)
@@ -1132,8 +1134,9 @@ at_xdmac_prep_interleaved(struct dma_chan *chan,
src_addr, dst_addr,
xt, chunk);
if (!desc) {
- list_splice_tail_init(&first->descs_list,
- &atchan->free_descs_list);
+ if (first)
+ list_splice_tail_init(&first->descs_list,
+ &atchan->free_descs_list);
return NULL;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 008/286] RDMA/bnxt_re: Fix a possible memory leak
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 007/286] dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 009/286] RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx Greg Kroah-Hartman
` (286 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kashyap Desai, Kalesh AP,
Selvin Xavier, Jason Gunthorpe, Sasha Levin
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit 349e3c0cf239cc01d58a1e6c749e171de014cd6a ]
Inside bnxt_qplib_create_cq(), when the check for NULL DPI fails, driver
returns directly without freeing the memory allocated inside
bnxt_qplib_alloc_init_hwq() routine.
Fixed this by moving the check for NULL DPI before invoking
bnxt_qplib_alloc_init_hwq().
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/1684397461-23082-2-git-send-email-selvin.xavier@broadcom.com
Reviewed-by: Kashyap Desai <kashyap.desai@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/qplib_fp.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
index 96e581ced50e2..ab2cc1c67f70b 100644
--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c
+++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c
@@ -2043,6 +2043,12 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
u32 pg_sz_lvl;
int rc;
+ if (!cq->dpi) {
+ dev_err(&rcfw->pdev->dev,
+ "FP: CREATE_CQ failed due to NULL DPI\n");
+ return -EINVAL;
+ }
+
hwq_attr.res = res;
hwq_attr.depth = cq->max_wqe;
hwq_attr.stride = sizeof(struct cq_base);
@@ -2054,11 +2060,6 @@ int bnxt_qplib_create_cq(struct bnxt_qplib_res *res, struct bnxt_qplib_cq *cq)
RCFW_CMD_PREP(req, CREATE_CQ, cmd_flags);
- if (!cq->dpi) {
- dev_err(&rcfw->pdev->dev,
- "FP: CREATE_CQ failed due to NULL DPI\n");
- return -EINVAL;
- }
req.dpi = cpu_to_le32(cq->dpi->dpi);
req.cq_handle = cpu_to_le64(cq->cq_handle);
req.cq_size = cpu_to_le32(cq->hwq.max_elements);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 009/286] RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 008/286] RDMA/bnxt_re: Fix a possible memory leak Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 010/286] iommu: Make IPMMU_VMSA dependencies more strict Greg Kroah-Hartman
` (285 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hongguang Gao, Ajit Khaparde,
Kalesh AP, Selvin Xavier, Jason Gunthorpe, Sasha Levin
From: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
[ Upstream commit 0fa0d520e2a878cb4c94c4dc84395905d3f14f54 ]
bnxt_re_process_raw_qp_pkt_rx() always return 0 and ignores the return
value of bnxt_re_post_send_shadow_qp().
Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver")
Link: https://lore.kernel.org/r/1684397461-23082-3-git-send-email-selvin.xavier@broadcom.com
Reviewed-by: Hongguang Gao <hongguang.gao@broadcom.com>
Reviewed-by: Ajit Khaparde <ajit.khaparde@broadcom.com>
Signed-off-by: Kalesh AP <kalesh-anakkur.purayil@broadcom.com>
Signed-off-by: Selvin Xavier <selvin.xavier@broadcom.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/bnxt_re/ib_verbs.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
index 989edc7896338..94222de1d3719 100644
--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c
+++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c
@@ -3241,9 +3241,7 @@ static int bnxt_re_process_raw_qp_pkt_rx(struct bnxt_re_qp *gsi_qp,
udwr.remote_qkey = gsi_sqp->qplib_qp.qkey;
/* post data received in the send queue */
- rc = bnxt_re_post_send_shadow_qp(rdev, gsi_sqp, swr);
-
- return 0;
+ return bnxt_re_post_send_shadow_qp(rdev, gsi_sqp, swr);
}
static void bnxt_re_process_res_rawqp1_wc(struct ib_wc *wc,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 010/286] iommu: Make IPMMU_VMSA dependencies more strict
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 009/286] RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 011/286] iommu/rockchip: Fix unwind goto issue Greg Kroah-Hartman
` (284 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Geert Uytterhoeven,
Joerg Roedel, Will Deacon, Robin Murphy, iommu, Conor Dooley,
Lad Prabhakar, Joerg Roedel, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit e332003bb216a9f91e08004b9e2de0745f321290 ]
On riscv64, linux-next-20233030 (and for several days earlier),
there is a kconfig warning:
WARNING: unmet direct dependencies detected for IOMMU_IO_PGTABLE_LPAE
Depends on [n]: IOMMU_SUPPORT [=y] && (ARM || ARM64 || COMPILE_TEST [=n]) && !GENERIC_ATOMIC64 [=n]
Selected by [y]:
- IPMMU_VMSA [=y] && IOMMU_SUPPORT [=y] && (ARCH_RENESAS [=y] || COMPILE_TEST [=n]) && !GENERIC_ATOMIC64 [=n]
and build errors:
riscv64-linux-ld: drivers/iommu/io-pgtable-arm.o: in function `.L140':
io-pgtable-arm.c:(.init.text+0x1e8): undefined reference to `alloc_io_pgtable_ops'
riscv64-linux-ld: drivers/iommu/io-pgtable-arm.o: in function `.L168':
io-pgtable-arm.c:(.init.text+0xab0): undefined reference to `free_io_pgtable_ops'
riscv64-linux-ld: drivers/iommu/ipmmu-vmsa.o: in function `.L140':
ipmmu-vmsa.c:(.text+0xbc4): undefined reference to `free_io_pgtable_ops'
riscv64-linux-ld: drivers/iommu/ipmmu-vmsa.o: in function `.L0 ':
ipmmu-vmsa.c:(.text+0x145e): undefined reference to `alloc_io_pgtable_ops'
Add ARM || ARM64 || COMPILE_TEST dependencies to IPMMU_VMSA to prevent
these issues, i.e., so that ARCH_RENESAS on RISC-V is not allowed.
This makes the ARCH dependencies become:
depends on (ARCH_RENESAS && (ARM || ARM64)) || COMPILE_TEST
but that can be a bit hard to read.
Fixes: 8292493c22c8 ("riscv: Kconfig.socs: Add ARCH_RENESAS kconfig option")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: iommu@lists.linux.dev
Cc: Conor Dooley <conor@kernel.org>
Cc: Lad Prabhakar <prabhakar.mahadev-lad.rj@bp.renesas.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20230330165817.21920-1-rdunlap@infradead.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 889c7efd050bc..18e68fbaec884 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -287,6 +287,7 @@ config EXYNOS_IOMMU_DEBUG
config IPMMU_VMSA
bool "Renesas VMSA-compatible IPMMU"
depends on ARCH_RENESAS || COMPILE_TEST
+ depends on ARM || ARM64 || COMPILE_TEST
depends on !GENERIC_ATOMIC64 # for IOMMU_IO_PGTABLE_LPAE
select IOMMU_API
select IOMMU_IO_PGTABLE_LPAE
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 011/286] iommu/rockchip: Fix unwind goto issue
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 010/286] iommu: Make IPMMU_VMSA dependencies more strict Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 012/286] iommu/amd: Dont block updates to GATag if guest mode is on Greg Kroah-Hartman
` (283 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chao Wang, Dongliang Mu,
Heiko Stuebner, Joerg Roedel, Sasha Levin
From: Chao Wang <D202280639@hust.edu.cn>
[ Upstream commit ec014683c564fb74fc68e8f5e84691d3b3839d24 ]
Smatch complains that
drivers/iommu/rockchip-iommu.c:1306 rk_iommu_probe() warn: missing unwind goto?
The rk_iommu_probe function, after obtaining the irq value through
platform_get_irq, directly returns an error if the returned value
is negative, without releasing any resources.
Fix this by adding a new error handling label "err_pm_disable" and
use a goto statement to redirect to the error handling process. In
order to preserve the original semantics, set err to the value of irq.
Fixes: 1aa55ca9b14a ("iommu/rockchip: Move irq request past pm_runtime_enable")
Signed-off-by: Chao Wang <D202280639@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Link: https://lore.kernel.org/r/20230417030421.2777-1-D202280639@hust.edu.cn
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/rockchip-iommu.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/drivers/iommu/rockchip-iommu.c b/drivers/iommu/rockchip-iommu.c
index f30db22ea5d7a..31cd1e2929e9f 100644
--- a/drivers/iommu/rockchip-iommu.c
+++ b/drivers/iommu/rockchip-iommu.c
@@ -1302,20 +1302,22 @@ static int rk_iommu_probe(struct platform_device *pdev)
for (i = 0; i < iommu->num_irq; i++) {
int irq = platform_get_irq(pdev, i);
- if (irq < 0)
- return irq;
+ if (irq < 0) {
+ err = irq;
+ goto err_pm_disable;
+ }
err = devm_request_irq(iommu->dev, irq, rk_iommu_irq,
IRQF_SHARED, dev_name(dev), iommu);
- if (err) {
- pm_runtime_disable(dev);
- goto err_remove_sysfs;
- }
+ if (err)
+ goto err_pm_disable;
}
dma_set_mask_and_coherent(dev, rk_ops->dma_bit_mask);
return 0;
+err_pm_disable:
+ pm_runtime_disable(dev);
err_remove_sysfs:
iommu_device_sysfs_remove(&iommu->iommu);
err_put_group:
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 012/286] iommu/amd: Dont block updates to GATag if guest mode is on
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 011/286] iommu/rockchip: Fix unwind goto issue Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 013/286] iommu/amd: Handle GALog overflows Greg Kroah-Hartman
` (282 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joao Martins, Suravee Suthikulpanit,
Joerg Roedel, Sasha Levin
From: Joao Martins <joao.m.martins@oracle.com>
[ Upstream commit ed8a2f4ddef2eaaf864ab1efbbca9788187036ab ]
On KVM GSI routing table updates, specially those where they have vIOMMUs
with interrupt remapping enabled (to boot >255vcpus setups without relying
on KVM_FEATURE_MSI_EXT_DEST_ID), a VMM may update the backing VF MSIs
with a new VCPU affinity.
On AMD with AVIC enabled, the new vcpu affinity info is updated via:
avic_pi_update_irte()
irq_set_vcpu_affinity()
amd_ir_set_vcpu_affinity()
amd_iommu_{de}activate_guest_mode()
Where the IRTE[GATag] is updated with the new vcpu affinity. The GATag
contains VM ID and VCPU ID, and is used by IOMMU hardware to signal KVM
(via GALog) when interrupt cannot be delivered due to vCPU is in
blocking state.
The issue is that amd_iommu_activate_guest_mode() will essentially
only change IRTE fields on transitions from non-guest-mode to guest-mode
and otherwise returns *with no changes to IRTE* on already configured
guest-mode interrupts. To the guest this means that the VF interrupts
remain affined to the first vCPU they were first configured, and guest
will be unable to issue VF interrupts and receive messages like this
from spurious interrupts (e.g. from waking the wrong vCPU in GALog):
[ 167.759472] __common_interrupt: 3.34 No irq handler for vector
[ 230.680927] mlx5_core 0000:00:02.0: mlx5_cmd_eq_recover:247:(pid
3122): Recovered 1 EQEs on cmd_eq
[ 230.681799] mlx5_core 0000:00:02.0:
wait_func_handle_exec_timeout:1113:(pid 3122): cmd[0]: CREATE_CQ(0x400)
recovered after timeout
[ 230.683266] __common_interrupt: 3.34 No irq handler for vector
Given the fact that amd_ir_set_vcpu_affinity() uses
amd_iommu_activate_guest_mode() underneath it essentially means that VCPU
affinity changes of IRTEs are nops. Fix it by dropping the check for
guest-mode at amd_iommu_activate_guest_mode(). Same thing is applicable to
amd_iommu_deactivate_guest_mode() although, even if the IRTE doesn't change
underlying DestID on the host, the VFIO IRQ handler will still be able to
poke at the right guest-vCPU.
Fixes: b9c6ff94e43a ("iommu/amd: Re-factor guest virtual APIC (de-)activation code")
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Link: https://lore.kernel.org/r/20230419201154.83880-2-joao.m.martins@oracle.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/iommu.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 167da5b1a5e31..99ec06b0e09f6 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -3482,8 +3482,7 @@ int amd_iommu_activate_guest_mode(void *data)
struct irte_ga *entry = (struct irte_ga *) ir_data->entry;
u64 valid;
- if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) ||
- !entry || entry->lo.fields_vapic.guest_mode)
+ if (!AMD_IOMMU_GUEST_IR_VAPIC(amd_iommu_guest_ir) || !entry)
return 0;
valid = entry->lo.fields_vapic.valid;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 013/286] iommu/amd: Handle GALog overflows
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 012/286] iommu/amd: Dont block updates to GATag if guest mode is on Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 014/286] iommu/amd: Fix up merge conflict resolution Greg Kroah-Hartman
` (281 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suravee Suthikulpanit, Joao Martins,
Vasant Hegde, Joerg Roedel, Sasha Levin
From: Joao Martins <joao.m.martins@oracle.com>
[ Upstream commit af47b0a24058e56e983881993752f88288ca6511 ]
GALog exists to propagate interrupts into all vCPUs in the system when
interrupts are marked as non running (e.g. when vCPUs aren't running). A
GALog overflow happens when there's in no space in the log to record the
GATag of the interrupt. So when the GALOverflow condition happens, the
GALog queue is processed and the GALog is restarted, as the IOMMU
manual indicates in section "2.7.4 Guest Virtual APIC Log Restart
Procedure":
| * Wait until MMIO Offset 2020h[GALogRun]=0b so that all request
| entries are completed as circumstances allow. GALogRun must be 0b to
| modify the guest virtual APIC log registers safely.
| * Write MMIO Offset 0018h[GALogEn]=0b.
| * As necessary, change the following values (e.g., to relocate or
| resize the guest virtual APIC event log):
| - the Guest Virtual APIC Log Base Address Register
| [MMIO Offset 00E0h],
| - the Guest Virtual APIC Log Head Pointer Register
| [MMIO Offset 2040h][GALogHead], and
| - the Guest Virtual APIC Log Tail Pointer Register
| [MMIO Offset 2048h][GALogTail].
| * Write MMIO Offset 2020h[GALOverflow] = 1b to clear the bit (W1C).
| * Write MMIO Offset 0018h[GALogEn] = 1b, and either set
| MMIO Offset 0018h[GAIntEn] to enable the GA log interrupt or clear
| the bit to disable it.
Failing to handle the GALog overflow means that none of the VFs (in any
guest) will work with IOMMU AVIC forcing the user to power cycle the
host. When handling the event it resumes the GALog without resizing
much like how it is done in the event handler overflow. The
[MMIO Offset 2020h][GALOverflow] bit might be set in status register
without the [MMIO Offset 2020h][GAInt] bit, so when deciding to poll
for GA events (to clear space in the galog), also check the overflow
bit.
[suravee: Check for GAOverflow without GAInt, toggle CONTROL_GAINT_EN]
Co-developed-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Signed-off-by: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Link: https://lore.kernel.org/r/20230419201154.83880-3-joao.m.martins@oracle.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Stable-dep-of: 8ec4e2befef1 ("iommu/amd: Fix up merge conflict resolution")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/amd_iommu.h | 1 +
drivers/iommu/amd/init.c | 24 ++++++++++++++++++++++++
drivers/iommu/amd/iommu.c | 9 ++++++++-
3 files changed, 33 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h
index c160a332ce339..24c7e6c6c0de9 100644
--- a/drivers/iommu/amd/amd_iommu.h
+++ b/drivers/iommu/amd/amd_iommu.h
@@ -15,6 +15,7 @@ extern irqreturn_t amd_iommu_int_thread(int irq, void *data);
extern irqreturn_t amd_iommu_int_handler(int irq, void *data);
extern void amd_iommu_apply_erratum_63(struct amd_iommu *iommu, u16 devid);
extern void amd_iommu_restart_event_logging(struct amd_iommu *iommu);
+extern void amd_iommu_restart_ga_log(struct amd_iommu *iommu);
extern int amd_iommu_init_devices(void);
extern void amd_iommu_uninit_devices(void);
extern void amd_iommu_init_notifier(void);
diff --git a/drivers/iommu/amd/init.c b/drivers/iommu/amd/init.c
index 19a46b9f73574..fd487c33b28aa 100644
--- a/drivers/iommu/amd/init.c
+++ b/drivers/iommu/amd/init.c
@@ -751,6 +751,30 @@ void amd_iommu_restart_event_logging(struct amd_iommu *iommu)
iommu_feature_enable(iommu, CONTROL_EVT_LOG_EN);
}
+/*
+ * This function restarts event logging in case the IOMMU experienced
+ * an GA log overflow.
+ */
+void amd_iommu_restart_ga_log(struct amd_iommu *iommu)
+{
+ u32 status;
+
+ status = readl(iommu->mmio_base + MMIO_STATUS_OFFSET);
+ if (status & MMIO_STATUS_GALOG_RUN_MASK)
+ return;
+
+ pr_info_ratelimited("IOMMU GA Log restarting\n");
+
+ iommu_feature_disable(iommu, CONTROL_GALOG_EN);
+ iommu_feature_disable(iommu, CONTROL_GAINT_EN);
+
+ writel(MMIO_STATUS_GALOG_OVERFLOW_MASK,
+ iommu->mmio_base + MMIO_STATUS_OFFSET);
+
+ iommu_feature_enable(iommu, CONTROL_GAINT_EN);
+ iommu_feature_enable(iommu, CONTROL_GALOG_EN);
+}
+
/*
* This function resets the command buffer if the IOMMU stopped fetching
* commands from it.
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 99ec06b0e09f6..478da9b4a1b14 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -845,6 +845,7 @@ amd_iommu_set_pci_msi_domain(struct device *dev, struct amd_iommu *iommu) { }
(MMIO_STATUS_EVT_OVERFLOW_INT_MASK | \
MMIO_STATUS_EVT_INT_MASK | \
MMIO_STATUS_PPR_INT_MASK | \
+ MMIO_STATUS_GALOG_OVERFLOW_MASK | \
MMIO_STATUS_GALOG_INT_MASK)
irqreturn_t amd_iommu_int_thread(int irq, void *data)
@@ -868,10 +869,16 @@ irqreturn_t amd_iommu_int_thread(int irq, void *data)
}
#ifdef CONFIG_IRQ_REMAP
- if (status & MMIO_STATUS_GALOG_INT_MASK) {
+ if (status & (MMIO_STATUS_GALOG_INT_MASK |
+ MMIO_STATUS_GALOG_OVERFLOW_MASK)) {
pr_devel("Processing IOMMU GA Log\n");
iommu_poll_ga_log(iommu);
}
+
+ if (status & MMIO_STATUS_GALOG_OVERFLOW_MASK) {
+ pr_info_ratelimited("IOMMU GA Log overflow\n");
+ amd_iommu_restart_ga_log(iommu);
+ }
#endif
if (status & MMIO_STATUS_EVT_OVERFLOW_INT_MASK) {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 014/286] iommu/amd: Fix up merge conflict resolution
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 013/286] iommu/amd: Handle GALog overflows Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 015/286] iommu/amd: Add missing domain type checks Greg Kroah-Hartman
` (280 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joerg Roedel, Suravee Suthikulpanit,
Will Deacon, Robin Murphy, Jerry Snitselaar, Vasant Hegde,
Joerg Roedel, Sasha Levin
From: Jerry Snitselaar <jsnitsel@redhat.com>
[ Upstream commit 8ec4e2befef10c7679cd59251956a428e783c0b5 ]
Merge commit e17c6debd4b2 ("Merge branches 'arm/mediatek', 'arm/msm', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'x86/vt-d' and 'x86/amd' into next")
added amd_iommu_init_devices, amd_iommu_uninit_devices,
and amd_iommu_init_notifier back to drivers/iommu/amd/amd_iommu.h.
The only references to them are here, so clean them up.
Fixes: e17c6debd4b2 ("Merge branches 'arm/mediatek', 'arm/msm', 'arm/renesas', 'arm/rockchip', 'arm/smmu', 'x86/vt-d' and 'x86/amd' into next")
Cc: Joerg Roedel <joro@8bytes.org>
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Cc: Will Deacon <will@kernel.org>
Cc: Robin Murphy <robin.murphy@arm.com>
Signed-off-by: Jerry Snitselaar <jsnitsel@redhat.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Link: https://lore.kernel.org/r/20230420192013.733331-1-jsnitsel@redhat.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/amd_iommu.h | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/iommu/amd/amd_iommu.h b/drivers/iommu/amd/amd_iommu.h
index 24c7e6c6c0de9..471f40351f4c8 100644
--- a/drivers/iommu/amd/amd_iommu.h
+++ b/drivers/iommu/amd/amd_iommu.h
@@ -16,9 +16,6 @@ extern irqreturn_t amd_iommu_int_handler(int irq, void *data);
extern void amd_iommu_apply_erratum_63(struct amd_iommu *iommu, u16 devid);
extern void amd_iommu_restart_event_logging(struct amd_iommu *iommu);
extern void amd_iommu_restart_ga_log(struct amd_iommu *iommu);
-extern int amd_iommu_init_devices(void);
-extern void amd_iommu_uninit_devices(void);
-extern void amd_iommu_init_notifier(void);
extern void amd_iommu_set_rlookup_table(struct amd_iommu *iommu, u16 devid);
#ifdef CONFIG_AMD_IOMMU_DEBUGFS
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 015/286] iommu/amd: Add missing domain type checks
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 014/286] iommu/amd: Fix up merge conflict resolution Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 016/286] nfsd: make a copy of struct iattr before calling notify_change Greg Kroah-Hartman
` (279 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jason Gunthorpe, Vasant Hegde,
Kevin Tian, Joerg Roedel, Sasha Levin
From: Jason Gunthorpe <jgg@nvidia.com>
[ Upstream commit 29f54745f24547a84b18582e054df9bea1a7bf3e ]
Drivers are supposed to list the domain types they support in their
domain_alloc() ops so when we add new domain types, like BLOCKING or SVA,
they don't start breaking.
This ended up providing an empty UNMANAGED domain when the core code asked
for a BLOCKING domain, which happens to be the fallback for drivers that
don't support it, but this is completely wrong for SVA.
Check for the DMA types AMD supports and reject every other kind.
Fixes: 136467962e49 ("iommu: Add IOMMU SVA domain support")
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Kevin Tian <kevin.tian@intel.com>
Link: https://lore.kernel.org/r/0-v1-2ac37b893728+da-amd_check_types_jgg@nvidia.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/amd/iommu.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index 478da9b4a1b14..8bd5390808784 100644
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -2065,7 +2065,7 @@ static struct protection_domain *protection_domain_alloc(unsigned int type)
{
struct io_pgtable_ops *pgtbl_ops;
struct protection_domain *domain;
- int pgtable = amd_iommu_pgtable;
+ int pgtable;
int mode = DEFAULT_PGTABLE_LEVEL;
int ret;
@@ -2082,6 +2082,10 @@ static struct protection_domain *protection_domain_alloc(unsigned int type)
mode = PAGE_MODE_NONE;
} else if (type == IOMMU_DOMAIN_UNMANAGED) {
pgtable = AMD_IOMMU_V1;
+ } else if (type == IOMMU_DOMAIN_DMA || type == IOMMU_DOMAIN_DMA_FQ) {
+ pgtable = amd_iommu_pgtable;
+ } else {
+ return NULL;
}
switch (pgtable) {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 016/286] nfsd: make a copy of struct iattr before calling notify_change
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 015/286] iommu/amd: Add missing domain type checks Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 017/286] dmaengine: pl330: rename _start to prevent build error Greg Kroah-Hartman
` (278 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhi Li, Jeff Layton, Chuck Lever,
Sasha Levin
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit d53d70084d27f56bcdf5074328f2c9ec861be596 ]
notify_change can modify the iattr structure. In particular it can
end up setting ATTR_MODE when ATTR_KILL_SUID is already set, causing
a BUG() if the same iattr is passed to notify_change more than once.
Make a copy of the struct iattr before calling notify_change.
Reported-by: Zhi Li <yieli@redhat.com>
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2207969
Tested-by: Zhi Li <yieli@redhat.com>
Fixes: 34b91dda7124 ("NFSD: Make nfsd4_setattr() wait before returning NFS4ERR_DELAY")
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/vfs.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 5783209f17fc5..e4884dde048ce 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -536,7 +536,15 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp,
inode_lock(inode);
for (retries = 1;;) {
- host_err = __nfsd_setattr(dentry, iap);
+ struct iattr attrs;
+
+ /*
+ * notify_change() can alter its iattr argument, making
+ * @iap unsuitable for submission multiple times. Make a
+ * copy for every loop iteration.
+ */
+ attrs = *iap;
+ host_err = __nfsd_setattr(dentry, &attrs);
if (host_err != -EAGAIN || !retries--)
break;
if (!nfsd_wait_for_delegreturn(rqstp, inode))
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 017/286] dmaengine: pl330: rename _start to prevent build error
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 016/286] nfsd: make a copy of struct iattr before calling notify_change Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 018/286] crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors Greg Kroah-Hartman
` (277 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Jaswinder Singh,
Boojin Kim, Krzysztof Kozlowski, Russell King, Vinod Koul,
dmaengine, linux-riscv, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit a1a5f2c887252dec161c1e12e04303ca9ba56fa9 ]
"_start" is used in several arches and proably should be reserved
for ARCH usage. Using it in a driver for a private symbol can cause
a build error when it conflicts with ARCH usage of the same symbol.
Therefore rename pl330's "_start" to "pl330_start_thread" so that there
is no conflict and no build error.
drivers/dma/pl330.c:1053:13: error: '_start' redeclared as different kind of symbol
1053 | static bool _start(struct pl330_thread *thrd)
| ^~~~~~
In file included from ../include/linux/interrupt.h:21,
from ../drivers/dma/pl330.c:18:
arch/riscv/include/asm/sections.h:11:13: note: previous declaration of '_start' with type 'char[]'
11 | extern char _start[];
| ^~~~~~
Fixes: b7d861d93945 ("DMA: PL330: Merge PL330 driver into drivers/dma/")
Fixes: ae43b3289186 ("ARM: 8202/1: dmaengine: pl330: Add runtime Power Management support v12")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Jaswinder Singh <jassisinghbrar@gmail.com>
Cc: Boojin Kim <boojin.kim@samsung.com>
Cc: Krzysztof Kozlowski <krzk@kernel.org>
Cc: Russell King <rmk+kernel@arm.linux.org.uk>
Cc: Vinod Koul <vkoul@kernel.org>
Cc: dmaengine@vger.kernel.org
Cc: linux-riscv@lists.infradead.org
Link: https://lore.kernel.org/r/20230524045310.27923-1-rdunlap@infradead.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/pl330.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c
index 0d9257fbdfb0d..b4731fe6bbc14 100644
--- a/drivers/dma/pl330.c
+++ b/drivers/dma/pl330.c
@@ -1050,7 +1050,7 @@ static bool _trigger(struct pl330_thread *thrd)
return true;
}
-static bool _start(struct pl330_thread *thrd)
+static bool pl330_start_thread(struct pl330_thread *thrd)
{
switch (_state(thrd)) {
case PL330_STATE_FAULT_COMPLETING:
@@ -1702,7 +1702,7 @@ static int pl330_update(struct pl330_dmac *pl330)
thrd->req_running = -1;
/* Get going again ASAP */
- _start(thrd);
+ pl330_start_thread(thrd);
/* For now, just make a list of callbacks to be done */
list_add_tail(&descdone->rqd, &pl330->req_done);
@@ -2089,7 +2089,7 @@ static void pl330_tasklet(struct tasklet_struct *t)
} else {
/* Make sure the PL330 Channel thread is active */
spin_lock(&pch->thread->dmac->lock);
- _start(pch->thread);
+ pl330_start_thread(pch->thread);
spin_unlock(&pch->thread->dmac->lock);
}
@@ -2107,7 +2107,7 @@ static void pl330_tasklet(struct tasklet_struct *t)
if (power_down) {
pch->active = true;
spin_lock(&pch->thread->dmac->lock);
- _start(pch->thread);
+ pl330_start_thread(pch->thread);
spin_unlock(&pch->thread->dmac->lock);
power_down = false;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 018/286] crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 017/286] dmaengine: pl330: rename _start to prevent build error Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 019/286] riscv: Fix unused variable warning when BUILTIN_DTB is set Greg Kroah-Hartman
` (276 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Taehee Yoo,
syzbot+a6abcf08bad8b18fd198, Ard Biesheuvel, Herbert Xu,
Sasha Levin
From: Ard Biesheuvel <ardb@kernel.org>
[ Upstream commit 6ab39f99927eed605728b02d512438d828183c97 ]
The GFNI routines in the AVX version of the ARIA implementation now use
explicit VMOVDQA instructions to load the constant input vectors, which
means they must be 16 byte aligned. So ensure that this is the case, by
dropping the section split and the incorrect .align 8 directive, and
emitting the constants into the 16-byte aligned section instead.
Note that the AVX2 version of this code deviates from this pattern, and
does not require a similar fix, given that it loads these contants as
8-byte memory operands, for which AVX2 permits any alignment.
Cc: Taehee Yoo <ap420073@gmail.com>
Fixes: 8b84475318641c2b ("crypto: x86/aria-avx - Do not use avx2 instructions")
Reported-by: syzbot+a6abcf08bad8b18fd198@syzkaller.appspotmail.com
Tested-by: syzbot+a6abcf08bad8b18fd198@syzkaller.appspotmail.com
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/crypto/aria-aesni-avx-asm_64.S | 2 --
1 file changed, 2 deletions(-)
diff --git a/arch/x86/crypto/aria-aesni-avx-asm_64.S b/arch/x86/crypto/aria-aesni-avx-asm_64.S
index 9243f6289d34b..ed6c22fb16720 100644
--- a/arch/x86/crypto/aria-aesni-avx-asm_64.S
+++ b/arch/x86/crypto/aria-aesni-avx-asm_64.S
@@ -773,8 +773,6 @@
.octa 0x3F893781E95FE1576CDA64D2BA0CB204
#ifdef CONFIG_AS_GFNI
-.section .rodata.cst8, "aM", @progbits, 8
-.align 8
/* AES affine: */
#define tf_aff_const BV8(1, 1, 0, 0, 0, 1, 1, 0)
.Ltf_aff_bitmatrix:
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 019/286] riscv: Fix unused variable warning when BUILTIN_DTB is set
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 018/286] crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 020/286] net/mlx5e: TC, Remove unused vf_tun variable Greg Kroah-Hartman
` (275 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Ghiti, Conor Dooley,
Palmer Dabbelt, Sasha Levin
From: Alexandre Ghiti <alexghiti@rivosinc.com>
[ Upstream commit 33d418da6f476b15e4510e0a590062583f63cd36 ]
commit ef69d2559fe9 ("riscv: Move early dtb mapping into the fixmap
region") wrongly moved the #ifndef CONFIG_BUILTIN_DTB surrounding the pa
variable definition in create_fdt_early_page_table(), so move it back to
its right place to quiet the following warning:
../arch/riscv/mm/init.c: In function ‘create_fdt_early_page_table’:
../arch/riscv/mm/init.c:925:12: warning: unused variable ‘pa’ [-Wunused-variable]
925 | uintptr_t pa = dtb_pa & ~(PMD_SIZE - 1);
Fixes: ef69d2559fe9 ("riscv: Move early dtb mapping into the fixmap region")
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Link: https://lore.kernel.org/r/20230519131311.391960-1-alexghiti@rivosinc.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/mm/init.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/riscv/mm/init.c b/arch/riscv/mm/init.c
index 6ebb75a9a6b9f..dc1793bf01796 100644
--- a/arch/riscv/mm/init.c
+++ b/arch/riscv/mm/init.c
@@ -846,9 +846,9 @@ static void __init create_kernel_page_table(pgd_t *pgdir, bool early)
static void __init create_fdt_early_page_table(uintptr_t fix_fdt_va,
uintptr_t dtb_pa)
{
+#ifndef CONFIG_BUILTIN_DTB
uintptr_t pa = dtb_pa & ~(PMD_SIZE - 1);
-#ifndef CONFIG_BUILTIN_DTB
/* Make sure the fdt fixmap address is always aligned on PMD size */
BUILD_BUG_ON(FIX_FDT % (PMD_SIZE / PAGE_SIZE));
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 020/286] net/mlx5e: TC, Remove unused vf_tun variable
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 019/286] riscv: Fix unused variable warning when BUILTIN_DTB is set Greg Kroah-Hartman
@ 2023-06-07 20:11 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 021/286] net/mlx5e: TC, Move main flow attribute cleanup to helper func Greg Kroah-Hartman
` (274 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:11 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Blakey, Roi Dayan,
Saeed Mahameed, Sasha Levin
From: Paul Blakey <paulb@nvidia.com>
[ Upstream commit 7195d9a0c8df0ab78c9d7a587809d16b00432426 ]
vf_tun is being assigned but never being used so remove it.
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 37c3b9fa7ccf ("net/mlx5e: Prevent encap offload when neigh update is running")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 15 +++------------
1 file changed, 3 insertions(+), 12 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 53acd9a8a4c35..d9e651d33f8b8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1792,8 +1792,7 @@ set_encap_dests(struct mlx5e_priv *priv,
static void
clean_encap_dests(struct mlx5e_priv *priv,
struct mlx5e_tc_flow *flow,
- struct mlx5_flow_attr *attr,
- bool *vf_tun)
+ struct mlx5_flow_attr *attr)
{
struct mlx5_esw_flow_attr *esw_attr;
int out_index;
@@ -1802,17 +1801,11 @@ clean_encap_dests(struct mlx5e_priv *priv,
return;
esw_attr = attr->esw_attr;
- *vf_tun = false;
for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
if (!(esw_attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP))
continue;
- if (esw_attr->dests[out_index].flags &
- MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE &&
- !esw_attr->dest_int_port)
- *vf_tun = true;
-
mlx5e_detach_encap(priv, flow, attr, out_index);
kfree(attr->parse_attr->tun_info[out_index]);
}
@@ -2046,7 +2039,6 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
struct mlx5_flow_attr *attr = flow->attr;
struct mlx5_esw_flow_attr *esw_attr;
- bool vf_tun;
esw_attr = attr->esw_attr;
mlx5e_put_flow_tunnel_id(flow);
@@ -2068,7 +2060,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
if (flow->decap_route)
mlx5e_detach_decap_route(priv, flow);
- clean_encap_dests(priv, flow, attr, &vf_tun);
+ clean_encap_dests(priv, flow, attr);
mlx5_tc_ct_match_del(get_ct_priv(priv), &flow->attr->ct_attr);
@@ -4452,7 +4444,6 @@ static void
mlx5_free_flow_attr(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr)
{
struct mlx5_core_dev *counter_dev = get_flow_counter_dev(flow);
- bool vf_tun;
if (!attr)
return;
@@ -4460,7 +4451,7 @@ mlx5_free_flow_attr(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr)
if (attr->post_act_handle)
mlx5e_tc_post_act_del(get_post_action(flow->priv), attr->post_act_handle);
- clean_encap_dests(flow->priv, flow, attr, &vf_tun);
+ clean_encap_dests(flow->priv, flow, attr);
if (attr->action & MLX5_FLOW_CONTEXT_ACTION_COUNT)
mlx5_fc_destroy(counter_dev, attr->counter);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 021/286] net/mlx5e: TC, Move main flow attribute cleanup to helper func
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-06-07 20:11 ` [PATCH 6.3 020/286] net/mlx5e: TC, Remove unused vf_tun variable Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 022/286] net/mlx5e: Extract remaining tunnel encap code to dedicated file Greg Kroah-Hartman
` (273 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Blakey, Roi Dayan,
Saeed Mahameed, Sasha Levin
From: Paul Blakey <paulb@nvidia.com>
[ Upstream commit a830ec485e8368a29e328d08e2eb28750bbc483f ]
Actions that can be setup per flow attribute (so per split rule)
are cleaned up from mlx5_free_flow_attr(), mlx5e_tc_del_fdb_flow(),
and free_flow_post_acts().
Remove the duplication by re-using the helper function for
the main flow attribute and split rules attributes.
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 37c3b9fa7ccf ("net/mlx5e: Prevent encap offload when neigh update is running")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 27 +++++++------------
1 file changed, 9 insertions(+), 18 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index d9e651d33f8b8..3827dbc2b39c5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -183,7 +183,8 @@ static struct lock_class_key tc_ht_wq_key;
static void mlx5e_put_flow_tunnel_id(struct mlx5e_tc_flow *flow);
static void free_flow_post_acts(struct mlx5e_tc_flow *flow);
-static void mlx5_free_flow_attr(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr);
+static void mlx5_free_flow_attr_actions(struct mlx5e_tc_flow *flow,
+ struct mlx5_flow_attr *attr);
void
mlx5e_tc_match_to_reg_match(struct mlx5_flow_spec *spec,
@@ -2028,7 +2029,7 @@ static void free_branch_attr(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *
if (!attr)
return;
- mlx5_free_flow_attr(flow, attr);
+ mlx5_free_flow_attr_actions(flow, attr);
kvfree(attr->parse_attr);
kfree(attr);
}
@@ -2060,18 +2061,8 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
if (flow->decap_route)
mlx5e_detach_decap_route(priv, flow);
- clean_encap_dests(priv, flow, attr);
-
mlx5_tc_ct_match_del(get_ct_priv(priv), &flow->attr->ct_attr);
- if (attr->action & MLX5_FLOW_CONTEXT_ACTION_MOD_HDR) {
- mlx5e_mod_hdr_dealloc(&attr->parse_attr->mod_hdr_acts);
- mlx5e_tc_detach_mod_hdr(priv, flow, attr);
- }
-
- if (attr->action & MLX5_FLOW_CONTEXT_ACTION_COUNT)
- mlx5_fc_destroy(esw_attr->counter_dev, attr->counter);
-
if (esw_attr->int_port)
mlx5e_tc_int_port_put(mlx5e_get_int_port_priv(priv), esw_attr->int_port);
@@ -2084,8 +2075,7 @@ static void mlx5e_tc_del_fdb_flow(struct mlx5e_priv *priv,
mlx5e_tc_act_stats_del_flow(get_act_stats_handle(priv), flow);
free_flow_post_acts(flow);
- free_branch_attr(flow, attr->branch_true);
- free_branch_attr(flow, attr->branch_false);
+ mlx5_free_flow_attr_actions(flow, attr);
kvfree(attr->esw_attr->rx_tun_attr);
kvfree(attr->parse_attr);
@@ -3804,9 +3794,7 @@ free_flow_post_acts(struct mlx5e_tc_flow *flow)
if (list_is_last(&attr->list, &flow->attrs))
break;
- mlx5_free_flow_attr(flow, attr);
- free_branch_attr(flow, attr->branch_true);
- free_branch_attr(flow, attr->branch_false);
+ mlx5_free_flow_attr_actions(flow, attr);
list_del(&attr->list);
kvfree(attr->parse_attr);
@@ -4441,7 +4429,7 @@ mlx5_alloc_flow_attr(enum mlx5_flow_namespace_type type)
}
static void
-mlx5_free_flow_attr(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr)
+mlx5_free_flow_attr_actions(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr)
{
struct mlx5_core_dev *counter_dev = get_flow_counter_dev(flow);
@@ -4460,6 +4448,9 @@ mlx5_free_flow_attr(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *attr)
mlx5e_mod_hdr_dealloc(&attr->parse_attr->mod_hdr_acts);
mlx5e_tc_detach_mod_hdr(flow->priv, flow, attr);
}
+
+ free_branch_attr(flow, attr->branch_true);
+ free_branch_attr(flow, attr->branch_false);
}
static int
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 022/286] net/mlx5e: Extract remaining tunnel encap code to dedicated file
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 021/286] net/mlx5e: TC, Move main flow attribute cleanup to helper func Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 023/286] net/mlx5e: Prevent encap offload when neigh update is running Greg Kroah-Hartman
` (272 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chris Mi, Saeed Mahameed,
Sasha Levin
From: Chris Mi <cmi@nvidia.com>
[ Upstream commit e2ab5aa11f191b54514f063a5b5c29f3559f4ab7 ]
Move set_encap_dests() and clean_encap_dests() to the tunnel encap
dedicated file. And rename them to mlx5e_tc_tun_encap_dests_set()
and mlx5e_tc_tun_encap_dests_unset().
No functional change in this patch. It is needed in the next patch.
Signed-off-by: Chris Mi <cmi@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 37c3b9fa7ccf ("net/mlx5e: Prevent encap offload when neigh update is running")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/tc_tun_encap.c | 83 +++++++++++++++++
.../mellanox/mlx5/core/en/tc_tun_encap.h | 9 ++
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 89 +------------------
3 files changed, 94 insertions(+), 87 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
index fbb392d54fa51..7655526222570 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
@@ -985,6 +985,89 @@ int mlx5e_attach_decap(struct mlx5e_priv *priv,
return err;
}
+int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
+ struct mlx5e_tc_flow *flow,
+ struct mlx5_flow_attr *attr,
+ struct netlink_ext_ack *extack,
+ bool *vf_tun)
+{
+ struct mlx5e_tc_flow_parse_attr *parse_attr;
+ struct mlx5_esw_flow_attr *esw_attr;
+ struct net_device *encap_dev = NULL;
+ struct mlx5e_rep_priv *rpriv;
+ struct mlx5e_priv *out_priv;
+ int out_index;
+ int err = 0;
+
+ if (!mlx5e_is_eswitch_flow(flow))
+ return 0;
+
+ parse_attr = attr->parse_attr;
+ esw_attr = attr->esw_attr;
+ *vf_tun = false;
+
+ for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
+ struct net_device *out_dev;
+ int mirred_ifindex;
+
+ if (!(esw_attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP))
+ continue;
+
+ mirred_ifindex = parse_attr->mirred_ifindex[out_index];
+ out_dev = dev_get_by_index(dev_net(priv->netdev), mirred_ifindex);
+ if (!out_dev) {
+ NL_SET_ERR_MSG_MOD(extack, "Requested mirred device not found");
+ err = -ENODEV;
+ goto out;
+ }
+ err = mlx5e_attach_encap(priv, flow, attr, out_dev, out_index,
+ extack, &encap_dev);
+ dev_put(out_dev);
+ if (err)
+ goto out;
+
+ if (esw_attr->dests[out_index].flags &
+ MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE &&
+ !esw_attr->dest_int_port)
+ *vf_tun = true;
+
+ out_priv = netdev_priv(encap_dev);
+ rpriv = out_priv->ppriv;
+ esw_attr->dests[out_index].rep = rpriv->rep;
+ esw_attr->dests[out_index].mdev = out_priv->mdev;
+ }
+
+ if (*vf_tun && esw_attr->out_count > 1) {
+ NL_SET_ERR_MSG_MOD(extack, "VF tunnel encap with mirroring is not supported");
+ err = -EOPNOTSUPP;
+ goto out;
+ }
+
+out:
+ return err;
+}
+
+void mlx5e_tc_tun_encap_dests_unset(struct mlx5e_priv *priv,
+ struct mlx5e_tc_flow *flow,
+ struct mlx5_flow_attr *attr)
+{
+ struct mlx5_esw_flow_attr *esw_attr;
+ int out_index;
+
+ if (!mlx5e_is_eswitch_flow(flow))
+ return;
+
+ esw_attr = attr->esw_attr;
+
+ for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
+ if (!(esw_attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP))
+ continue;
+
+ mlx5e_detach_encap(flow->priv, flow, attr, out_index);
+ kfree(attr->parse_attr->tun_info[out_index]);
+ }
+}
+
static int cmp_route_info(struct mlx5e_route_key *a,
struct mlx5e_route_key *b)
{
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h
index 8ad273dde40ee..5d7d67687cbcd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.h
@@ -30,6 +30,15 @@ int mlx5e_attach_decap_route(struct mlx5e_priv *priv,
void mlx5e_detach_decap_route(struct mlx5e_priv *priv,
struct mlx5e_tc_flow *flow);
+int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
+ struct mlx5e_tc_flow *flow,
+ struct mlx5_flow_attr *attr,
+ struct netlink_ext_ack *extack,
+ bool *vf_tun);
+void mlx5e_tc_tun_encap_dests_unset(struct mlx5e_priv *priv,
+ struct mlx5e_tc_flow *flow,
+ struct mlx5_flow_attr *attr);
+
struct ip_tunnel_info *mlx5e_dup_tun_info(const struct ip_tunnel_info *tun_info);
int mlx5e_tc_set_attr_rx_tun(struct mlx5e_tc_flow *flow,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 3827dbc2b39c5..b5d23b159f345 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -1727,91 +1727,6 @@ int mlx5e_tc_query_route_vport(struct net_device *out_dev, struct net_device *ro
return mlx5_eswitch_vhca_id_to_vport(esw, vhca_id, vport);
}
-static int
-set_encap_dests(struct mlx5e_priv *priv,
- struct mlx5e_tc_flow *flow,
- struct mlx5_flow_attr *attr,
- struct netlink_ext_ack *extack,
- bool *vf_tun)
-{
- struct mlx5e_tc_flow_parse_attr *parse_attr;
- struct mlx5_esw_flow_attr *esw_attr;
- struct net_device *encap_dev = NULL;
- struct mlx5e_rep_priv *rpriv;
- struct mlx5e_priv *out_priv;
- int out_index;
- int err = 0;
-
- if (!mlx5e_is_eswitch_flow(flow))
- return 0;
-
- parse_attr = attr->parse_attr;
- esw_attr = attr->esw_attr;
- *vf_tun = false;
-
- for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
- struct net_device *out_dev;
- int mirred_ifindex;
-
- if (!(esw_attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP))
- continue;
-
- mirred_ifindex = parse_attr->mirred_ifindex[out_index];
- out_dev = dev_get_by_index(dev_net(priv->netdev), mirred_ifindex);
- if (!out_dev) {
- NL_SET_ERR_MSG_MOD(extack, "Requested mirred device not found");
- err = -ENODEV;
- goto out;
- }
- err = mlx5e_attach_encap(priv, flow, attr, out_dev, out_index,
- extack, &encap_dev);
- dev_put(out_dev);
- if (err)
- goto out;
-
- if (esw_attr->dests[out_index].flags &
- MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE &&
- !esw_attr->dest_int_port)
- *vf_tun = true;
-
- out_priv = netdev_priv(encap_dev);
- rpriv = out_priv->ppriv;
- esw_attr->dests[out_index].rep = rpriv->rep;
- esw_attr->dests[out_index].mdev = out_priv->mdev;
- }
-
- if (*vf_tun && esw_attr->out_count > 1) {
- NL_SET_ERR_MSG_MOD(extack, "VF tunnel encap with mirroring is not supported");
- err = -EOPNOTSUPP;
- goto out;
- }
-
-out:
- return err;
-}
-
-static void
-clean_encap_dests(struct mlx5e_priv *priv,
- struct mlx5e_tc_flow *flow,
- struct mlx5_flow_attr *attr)
-{
- struct mlx5_esw_flow_attr *esw_attr;
- int out_index;
-
- if (!mlx5e_is_eswitch_flow(flow))
- return;
-
- esw_attr = attr->esw_attr;
-
- for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
- if (!(esw_attr->dests[out_index].flags & MLX5_ESW_DEST_ENCAP))
- continue;
-
- mlx5e_detach_encap(priv, flow, attr, out_index);
- kfree(attr->parse_attr->tun_info[out_index]);
- }
-}
-
static int
verify_attr_actions(u32 actions, struct netlink_ext_ack *extack)
{
@@ -1848,7 +1763,7 @@ post_process_attr(struct mlx5e_tc_flow *flow,
if (err)
goto err_out;
- err = set_encap_dests(flow->priv, flow, attr, extack, &vf_tun);
+ err = mlx5e_tc_tun_encap_dests_set(flow->priv, flow, attr, extack, &vf_tun);
if (err)
goto err_out;
@@ -4439,7 +4354,7 @@ mlx5_free_flow_attr_actions(struct mlx5e_tc_flow *flow, struct mlx5_flow_attr *a
if (attr->post_act_handle)
mlx5e_tc_post_act_del(get_post_action(flow->priv), attr->post_act_handle);
- clean_encap_dests(flow->priv, flow, attr);
+ mlx5e_tc_tun_encap_dests_unset(flow->priv, flow, attr);
if (attr->action & MLX5_FLOW_CONTEXT_ACTION_COUNT)
mlx5_fc_destroy(counter_dev, attr->counter);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 023/286] net/mlx5e: Prevent encap offload when neigh update is running
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 022/286] net/mlx5e: Extract remaining tunnel encap code to dedicated file Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 024/286] net/mlx5e: Consider internal buffers size in port buffer calculations Greg Kroah-Hartman
` (271 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mi, Roi Dayan, Vlad Buslov,
Saeed Mahameed, Sasha Levin
From: Chris Mi <cmi@nvidia.com>
[ Upstream commit 37c3b9fa7ccf5caad6d87ba4d42bf00be46be1cf ]
The cited commit adds a compeletion to remove dependency on rtnl
lock. But it causes a deadlock for multiple encapsulations:
crash> bt ffff8aece8a64000
PID: 1514557 TASK: ffff8aece8a64000 CPU: 3 COMMAND: "tc"
#0 [ffffa6d14183f368] __schedule at ffffffffb8ba7f45
#1 [ffffa6d14183f3f8] schedule at ffffffffb8ba8418
#2 [ffffa6d14183f418] schedule_preempt_disabled at ffffffffb8ba8898
#3 [ffffa6d14183f428] __mutex_lock at ffffffffb8baa7f8
#4 [ffffa6d14183f4d0] mutex_lock_nested at ffffffffb8baabeb
#5 [ffffa6d14183f4e0] mlx5e_attach_encap at ffffffffc0f48c17 [mlx5_core]
#6 [ffffa6d14183f628] mlx5e_tc_add_fdb_flow at ffffffffc0f39680 [mlx5_core]
#7 [ffffa6d14183f688] __mlx5e_add_fdb_flow at ffffffffc0f3b636 [mlx5_core]
#8 [ffffa6d14183f6f0] mlx5e_tc_add_flow at ffffffffc0f3bcdf [mlx5_core]
#9 [ffffa6d14183f728] mlx5e_configure_flower at ffffffffc0f3c1d1 [mlx5_core]
#10 [ffffa6d14183f790] mlx5e_rep_setup_tc_cls_flower at ffffffffc0f3d529 [mlx5_core]
#11 [ffffa6d14183f7a0] mlx5e_rep_setup_tc_cb at ffffffffc0f3d714 [mlx5_core]
#12 [ffffa6d14183f7b0] tc_setup_cb_add at ffffffffb8931bb8
#13 [ffffa6d14183f810] fl_hw_replace_filter at ffffffffc0dae901 [cls_flower]
#14 [ffffa6d14183f8d8] fl_change at ffffffffc0db5c57 [cls_flower]
#15 [ffffa6d14183f970] tc_new_tfilter at ffffffffb8936047
#16 [ffffa6d14183fac8] rtnetlink_rcv_msg at ffffffffb88c7c31
#17 [ffffa6d14183fb50] netlink_rcv_skb at ffffffffb8942853
#18 [ffffa6d14183fbc0] rtnetlink_rcv at ffffffffb88c1835
#19 [ffffa6d14183fbd0] netlink_unicast at ffffffffb8941f27
#20 [ffffa6d14183fc18] netlink_sendmsg at ffffffffb8942245
#21 [ffffa6d14183fc98] sock_sendmsg at ffffffffb887d482
#22 [ffffa6d14183fcb8] ____sys_sendmsg at ffffffffb887d81a
#23 [ffffa6d14183fd38] ___sys_sendmsg at ffffffffb88806e2
#24 [ffffa6d14183fe90] __sys_sendmsg at ffffffffb88807a2
#25 [ffffa6d14183ff28] __x64_sys_sendmsg at ffffffffb888080f
#26 [ffffa6d14183ff38] do_syscall_64 at ffffffffb8b9b6a8
#27 [ffffa6d14183ff50] entry_SYSCALL_64_after_hwframe at ffffffffb8c0007c
crash> bt 0xffff8aeb07544000
PID: 1110766 TASK: ffff8aeb07544000 CPU: 0 COMMAND: "kworker/u20:9"
#0 [ffffa6d14e6b7bd8] __schedule at ffffffffb8ba7f45
#1 [ffffa6d14e6b7c68] schedule at ffffffffb8ba8418
#2 [ffffa6d14e6b7c88] schedule_timeout at ffffffffb8baef88
#3 [ffffa6d14e6b7d10] wait_for_completion at ffffffffb8ba968b
#4 [ffffa6d14e6b7d60] mlx5e_take_all_encap_flows at ffffffffc0f47ec4 [mlx5_core]
#5 [ffffa6d14e6b7da0] mlx5e_rep_update_flows at ffffffffc0f3e734 [mlx5_core]
#6 [ffffa6d14e6b7df8] mlx5e_rep_neigh_update at ffffffffc0f400bb [mlx5_core]
#7 [ffffa6d14e6b7e50] process_one_work at ffffffffb80acc9c
#8 [ffffa6d14e6b7ed0] worker_thread at ffffffffb80ad012
#9 [ffffa6d14e6b7f10] kthread at ffffffffb80b615d
#10 [ffffa6d14e6b7f50] ret_from_fork at ffffffffb8001b2f
After the first encap is attached, flow will be added to encap
entry's flows list. If neigh update is running at this time, the
following encaps of the flow can't hold the encap_tbl_lock and
sleep. If neigh update thread is waiting for that flow's init_done,
deadlock happens.
Fix it by holding lock outside of the for loop. If neigh update is
running, prevent encap flows from offloading. Since the lock is held
outside of the for loop, concurrent creation of encap entries is not
allowed. So remove unnecessary wait_for_completion call for res_ready.
Fixes: 95435ad7999b ("net/mlx5e: Only access fully initialized flows in neigh update")
Signed-off-by: Chris Mi <cmi@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/tc_tun_encap.c | 37 ++++++++++---------
1 file changed, 20 insertions(+), 17 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
index 7655526222570..bbab164eab546 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
@@ -492,6 +492,19 @@ void mlx5e_encap_put(struct mlx5e_priv *priv, struct mlx5e_encap_entry *e)
mlx5e_encap_dealloc(priv, e);
}
+static void mlx5e_encap_put_locked(struct mlx5e_priv *priv, struct mlx5e_encap_entry *e)
+{
+ struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
+
+ lockdep_assert_held(&esw->offloads.encap_tbl_lock);
+
+ if (!refcount_dec_and_test(&e->refcnt))
+ return;
+ list_del(&e->route_list);
+ hash_del_rcu(&e->encap_hlist);
+ mlx5e_encap_dealloc(priv, e);
+}
+
static void mlx5e_decap_put(struct mlx5e_priv *priv, struct mlx5e_decap_entry *d)
{
struct mlx5_eswitch *esw = priv->mdev->priv.eswitch;
@@ -785,6 +798,8 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
uintptr_t hash_key;
int err = 0;
+ lockdep_assert_held(&esw->offloads.encap_tbl_lock);
+
parse_attr = attr->parse_attr;
tun_info = parse_attr->tun_info[out_index];
mpls_info = &parse_attr->mpls_info[out_index];
@@ -798,7 +813,6 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
hash_key = hash_encap_info(&key);
- mutex_lock(&esw->offloads.encap_tbl_lock);
e = mlx5e_encap_get(priv, &key, hash_key);
/* must verify if encap is valid or not */
@@ -809,15 +823,6 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
goto out_err;
}
- mutex_unlock(&esw->offloads.encap_tbl_lock);
- wait_for_completion(&e->res_ready);
-
- /* Protect against concurrent neigh update. */
- mutex_lock(&esw->offloads.encap_tbl_lock);
- if (e->compl_result < 0) {
- err = -EREMOTEIO;
- goto out_err;
- }
goto attach_flow;
}
@@ -846,15 +851,12 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
INIT_LIST_HEAD(&e->flows);
hash_add_rcu(esw->offloads.encap_tbl, &e->encap_hlist, hash_key);
tbl_time_before = mlx5e_route_tbl_get_last_update(priv);
- mutex_unlock(&esw->offloads.encap_tbl_lock);
if (family == AF_INET)
err = mlx5e_tc_tun_create_header_ipv4(priv, mirred_dev, e);
else if (family == AF_INET6)
err = mlx5e_tc_tun_create_header_ipv6(priv, mirred_dev, e);
- /* Protect against concurrent neigh update. */
- mutex_lock(&esw->offloads.encap_tbl_lock);
complete_all(&e->res_ready);
if (err) {
e->compl_result = err;
@@ -889,18 +891,15 @@ int mlx5e_attach_encap(struct mlx5e_priv *priv,
} else {
flow_flag_set(flow, SLOW);
}
- mutex_unlock(&esw->offloads.encap_tbl_lock);
return err;
out_err:
- mutex_unlock(&esw->offloads.encap_tbl_lock);
if (e)
- mlx5e_encap_put(priv, e);
+ mlx5e_encap_put_locked(priv, e);
return err;
out_err_init:
- mutex_unlock(&esw->offloads.encap_tbl_lock);
kfree(tun_info);
kfree(e);
return err;
@@ -996,6 +995,7 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
struct net_device *encap_dev = NULL;
struct mlx5e_rep_priv *rpriv;
struct mlx5e_priv *out_priv;
+ struct mlx5_eswitch *esw;
int out_index;
int err = 0;
@@ -1006,6 +1006,8 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
esw_attr = attr->esw_attr;
*vf_tun = false;
+ esw = priv->mdev->priv.eswitch;
+ mutex_lock(&esw->offloads.encap_tbl_lock);
for (out_index = 0; out_index < MLX5_MAX_FLOW_FWD_VPORTS; out_index++) {
struct net_device *out_dev;
int mirred_ifindex;
@@ -1044,6 +1046,7 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
}
out:
+ mutex_unlock(&esw->offloads.encap_tbl_lock);
return err;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 024/286] net/mlx5e: Consider internal buffers size in port buffer calculations
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 023/286] net/mlx5e: Prevent encap offload when neigh update is running Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 025/286] net/mlx5e: Do not update SBCM when prio2buffer command is invalid Greg Kroah-Hartman
` (270 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit 81fe2be062915e2a2fdc494c3cd90e946e946c25 ]
Currently, when a user triggers a change in port buffer headroom
(buffers 0-7), the driver checks that the requested headroom does
not exceed the total port buffer size. However, this check does not
take into account the internal buffers (buffers 8-9), which are also
part of the total port buffer. This can result in treating invalid port
buffer change requests as valid, causing unintended changes to the shared
buffer.
To address this, include the internal buffers size in the calculation of
available port buffer space which ensures that port buffer requests do not
exceed the correct limit.
Furthermore, remove internal buffers (8-9) size from the total_size
calculation as these buffers are reserved for internal use and are not
exposed to the user.
While at it, add verbosity to the debug prints in
mlx5e_port_query_buffer() function to ease future debugging.
Fixes: ecdf2dadee8e ("net/mlx5e: Receive buffer support for DCBX")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/port_buffer.c | 42 ++++++++++++-------
.../mellanox/mlx5/core/en/port_buffer.h | 8 ++--
.../ethernet/mellanox/mlx5/core/en_dcbnl.c | 7 ++--
3 files changed, 36 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index 7ac1ad9c46de0..0d78527451bca 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -51,7 +51,7 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
if (err)
goto out;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
buffer = MLX5_ADDR_OF(pbmc_reg, out, buffer[i]);
port_buffer->buffer[i].lossy =
MLX5_GET(bufferx_reg, buffer, lossy);
@@ -73,14 +73,24 @@ int mlx5e_port_query_buffer(struct mlx5e_priv *priv,
port_buffer->buffer[i].lossy);
}
- port_buffer->headroom_size = total_used;
+ port_buffer->internal_buffers_size = 0;
+ for (i = MLX5E_MAX_NETWORK_BUFFER; i < MLX5E_TOTAL_BUFFERS; i++) {
+ buffer = MLX5_ADDR_OF(pbmc_reg, out, buffer[i]);
+ port_buffer->internal_buffers_size +=
+ MLX5_GET(bufferx_reg, buffer, size) * port_buff_cell_sz;
+ }
+
port_buffer->port_buffer_size =
MLX5_GET(pbmc_reg, out, port_buffer_size) * port_buff_cell_sz;
- port_buffer->spare_buffer_size =
- port_buffer->port_buffer_size - total_used;
-
- mlx5e_dbg(HW, priv, "total buffer size=%d, spare buffer size=%d\n",
- port_buffer->port_buffer_size,
+ port_buffer->headroom_size = total_used;
+ port_buffer->spare_buffer_size = port_buffer->port_buffer_size -
+ port_buffer->internal_buffers_size -
+ port_buffer->headroom_size;
+
+ mlx5e_dbg(HW, priv,
+ "total buffer size=%u, headroom buffer size=%u, internal buffers size=%u, spare buffer size=%u\n",
+ port_buffer->port_buffer_size, port_buffer->headroom_size,
+ port_buffer->internal_buffers_size,
port_buffer->spare_buffer_size);
out:
kfree(out);
@@ -206,11 +216,11 @@ static int port_update_pool_cfg(struct mlx5_core_dev *mdev,
if (!MLX5_CAP_GEN(mdev, sbcam_reg))
return 0;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
lossless_buff_count += ((port_buffer->buffer[i].size) &&
(!(port_buffer->buffer[i].lossy)));
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
p = select_sbcm_params(&port_buffer->buffer[i], lossless_buff_count);
err = mlx5e_port_set_sbcm(mdev, 0, i,
MLX5_INGRESS_DIR,
@@ -293,7 +303,7 @@ static int port_set_buffer(struct mlx5e_priv *priv,
if (err)
goto out;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
void *buffer = MLX5_ADDR_OF(pbmc_reg, in, buffer[i]);
u64 size = port_buffer->buffer[i].size;
u64 xoff = port_buffer->buffer[i].xoff;
@@ -351,7 +361,7 @@ static int update_xoff_threshold(struct mlx5e_port_buffer *port_buffer,
{
int i;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
if (port_buffer->buffer[i].lossy) {
port_buffer->buffer[i].xoff = 0;
port_buffer->buffer[i].xon = 0;
@@ -408,7 +418,7 @@ static int update_buffer_lossy(struct mlx5_core_dev *mdev,
int err;
int i;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
prio_count = 0;
lossy_count = 0;
@@ -515,7 +525,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
if (change & MLX5E_PORT_BUFFER_PRIO2BUFFER) {
update_prio2buffer = true;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
mlx5e_dbg(HW, priv, "%s: requested to map prio[%d] to buffer %d\n",
__func__, i, prio2buffer[i]);
@@ -530,7 +540,7 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
}
if (change & MLX5E_PORT_BUFFER_SIZE) {
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
mlx5e_dbg(HW, priv, "%s: buffer[%d]=%d\n", __func__, i, buffer_size[i]);
if (!port_buffer.buffer[i].lossy && !buffer_size[i]) {
mlx5e_dbg(HW, priv, "%s: lossless buffer[%d] size cannot be zero\n",
@@ -544,7 +554,9 @@ int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
mlx5e_dbg(HW, priv, "%s: total buffer requested=%d\n", __func__, total_used);
- if (total_used > port_buffer.port_buffer_size)
+ if (total_used > port_buffer.headroom_size &&
+ (total_used - port_buffer.headroom_size) >
+ port_buffer.spare_buffer_size)
return -EINVAL;
update_buffer = true;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
index a6ef118de758f..f4a19ffbb641c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.h
@@ -35,7 +35,8 @@
#include "en.h"
#include "port.h"
-#define MLX5E_MAX_BUFFER 8
+#define MLX5E_MAX_NETWORK_BUFFER 8
+#define MLX5E_TOTAL_BUFFERS 10
#define MLX5E_DEFAULT_CABLE_LEN 7 /* 7 meters */
#define MLX5_BUFFER_SUPPORTED(mdev) (MLX5_CAP_GEN(mdev, pcam_reg) && \
@@ -60,8 +61,9 @@ struct mlx5e_bufferx_reg {
struct mlx5e_port_buffer {
u32 port_buffer_size;
u32 spare_buffer_size;
- u32 headroom_size;
- struct mlx5e_bufferx_reg buffer[MLX5E_MAX_BUFFER];
+ u32 headroom_size; /* Buffers 0-7 */
+ u32 internal_buffers_size; /* Buffers 8-9 */
+ struct mlx5e_bufferx_reg buffer[MLX5E_MAX_NETWORK_BUFFER];
};
int mlx5e_port_manual_buffer_config(struct mlx5e_priv *priv,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
index 89de92d064836..ebee52a8361aa 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c
@@ -926,9 +926,10 @@ static int mlx5e_dcbnl_getbuffer(struct net_device *dev,
if (err)
return err;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++)
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++)
dcb_buffer->buffer_size[i] = port_buffer.buffer[i].size;
- dcb_buffer->total_size = port_buffer.port_buffer_size;
+ dcb_buffer->total_size = port_buffer.port_buffer_size -
+ port_buffer.internal_buffers_size;
return 0;
}
@@ -970,7 +971,7 @@ static int mlx5e_dcbnl_setbuffer(struct net_device *dev,
if (err)
return err;
- for (i = 0; i < MLX5E_MAX_BUFFER; i++) {
+ for (i = 0; i < MLX5E_MAX_NETWORK_BUFFER; i++) {
if (port_buffer.buffer[i].size != dcb_buffer->buffer_size[i]) {
changed |= MLX5E_PORT_BUFFER_SIZE;
buffer_size = dcb_buffer->buffer_size;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 025/286] net/mlx5e: Do not update SBCM when prio2buffer command is invalid
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 024/286] net/mlx5e: Consider internal buffers size in port buffer calculations Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 026/286] net/mlx5: Drain health before unregistering devlink Greg Kroah-Hartman
` (269 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit 623efc4cbd6115db36716e31037cb6d1f3ce6754 ]
The shared buffer pools configuration which are stored in the SBCM
register are updated when the user changes the prio2buffer mapping.
However, in case the user desired prio2buffer change is invalid,
which can occur due to mapping a lossless priority to a not large enough
buffer, the SBCM update should not be performed, as the user command is
failed.
Thus, Perform the SBCM update only after xoff threshold calculation is
performed and the user prio2buffer mapping is validated.
Fixes: a440030d8946 ("net/mlx5e: Update shared buffer along with device buffer changes")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
index 0d78527451bca..7e8e96cc5cd08 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/port_buffer.c
@@ -442,11 +442,11 @@ static int update_buffer_lossy(struct mlx5_core_dev *mdev,
}
if (changed) {
- err = port_update_pool_cfg(mdev, port_buffer);
+ err = update_xoff_threshold(port_buffer, xoff, max_mtu, port_buff_cell_sz);
if (err)
return err;
- err = update_xoff_threshold(port_buffer, xoff, max_mtu, port_buff_cell_sz);
+ err = port_update_pool_cfg(mdev, port_buffer);
if (err)
return err;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 026/286] net/mlx5: Drain health before unregistering devlink
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 025/286] net/mlx5e: Do not update SBCM when prio2buffer command is invalid Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 027/286] net/mlx5: SF, Drain health before removing device Greg Kroah-Hartman
` (268 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shay Drory, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 824c8dc4a470040bf0e56ba716543839c2498d49 ]
mlx5 health mechanism is using devlink APIs, which are using devlink
notify APIs. After the cited patch, using devlink notify APIs after
devlink is unregistered triggers a WARN_ON().
Hence, drain health WQ before devlink is unregistered.
Fixes: cf530217408e ("devlink: Notify users when objects are accessible")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/main.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 62327b52f1acf..504179dbff9dd 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -1790,14 +1790,15 @@ static void remove_one(struct pci_dev *pdev)
struct devlink *devlink = priv_to_devlink(dev);
set_bit(MLX5_BREAK_FW_WAIT, &dev->intf_state);
- /* mlx5_drain_fw_reset() is using devlink APIs. Hence, we must drain
- * fw_reset before unregistering the devlink.
+ /* mlx5_drain_fw_reset() and mlx5_drain_health_wq() are using
+ * devlink notify APIs.
+ * Hence, we must drain them before unregistering the devlink.
*/
mlx5_drain_fw_reset(dev);
+ mlx5_drain_health_wq(dev);
devlink_unregister(devlink);
mlx5_sriov_disable(pdev);
mlx5_crdump_disable(dev);
- mlx5_drain_health_wq(dev);
mlx5_uninit_one(dev);
mlx5_pci_close(dev);
mlx5_mdev_uninit(dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 027/286] net/mlx5: SF, Drain health before removing device
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 026/286] net/mlx5: Drain health before unregistering devlink Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 028/286] net/mlx5: fw_tracer, Fix event handling Greg Kroah-Hartman
` (267 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shay Drory, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit b4646da0573fae9dfa2b8f1f10936cb6eedd7230 ]
There is no point in recovery during device removal. Also, if health
work started need to wait for it to avoid races and NULL pointer
access.
Hence, drain health WQ before removing device.
Fixes: 1958fc2f0712 ("net/mlx5: SF, Add auxiliary device driver")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
index a7377619ba6f2..2424cdf9cca99 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/sf/dev/driver.c
@@ -63,6 +63,7 @@ static void mlx5_sf_dev_remove(struct auxiliary_device *adev)
struct mlx5_sf_dev *sf_dev = container_of(adev, struct mlx5_sf_dev, adev);
struct devlink *devlink = priv_to_devlink(sf_dev->mdev);
+ mlx5_drain_health_wq(sf_dev->mdev);
devlink_unregister(devlink);
mlx5_uninit_one(sf_dev->mdev);
iounmap(sf_dev->mdev->iseg);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 028/286] net/mlx5: fw_tracer, Fix event handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 027/286] net/mlx5: SF, Drain health before removing device Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 029/286] net/mlx5e: Use query_special_contexts cmd only once per mdev Greg Kroah-Hartman
` (266 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shay Drory, Moshe Shemesh,
Saeed Mahameed, Sasha Levin
From: Shay Drory <shayd@nvidia.com>
[ Upstream commit 341a80de2468f481b1f771683709b5649cbfe513 ]
mlx5 driver needs to parse traces with event_id inside the range of
first_string_trace and num_string_trace. However, mlx5 is parsing all
events with event_id >= first_string_trace.
Fix it by checking for the correct range.
Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling")
Signed-off-by: Shay Drory <shayd@nvidia.com>
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
index f40497823e65f..7c0f2adbea000 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
@@ -490,7 +490,7 @@ static void poll_trace(struct mlx5_fw_tracer *tracer,
(u64)timestamp_low;
break;
default:
- if (tracer_event->event_id >= tracer->str_db.first_string_trace ||
+ if (tracer_event->event_id >= tracer->str_db.first_string_trace &&
tracer_event->event_id <= tracer->str_db.first_string_trace +
tracer->str_db.num_string_trace) {
tracer_event->type = TRACER_EVENT_TYPE_STRING;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 029/286] net/mlx5e: Use query_special_contexts cmd only once per mdev
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 028/286] net/mlx5: fw_tracer, Fix event handling Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 030/286] net/mlx5e: CT: Use per action stats Greg Kroah-Hartman
` (265 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dragos Tatulea, Or Har-Toov,
Tariq Toukan, Saeed Mahameed, Sasha Levin
From: Dragos Tatulea <dtatulea@nvidia.com>
[ Upstream commit 1db1f21caebbb1b6e9b1e7657df613616be3fb49 ]
Don't query the firmware so many times (num rqs * num wqes * wqe frags)
because it slows down linearly the interface creation time when the
product is larger. Do it only once per mdev and store the result in
mlx5e_param.
Due to helper function being called from different files, move it to
an appropriate location. Rename the function with a proper prefix and
add a small cleanup.
This fix applies only for legacy rq.
Fixes: 1b1e4868836a ("net/mlx5e: Use query_special_contexts for mkeys")
Signed-off-by: Dragos Tatulea <dtatulea@nvidia.com>
Reviewed-by: Or Har-Toov <ohartoov@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 +
.../net/ethernet/mellanox/mlx5/core/en_main.c | 24 +++----------------
drivers/net/ethernet/mellanox/mlx5/core/mr.c | 21 ++++++++++++++++
include/linux/mlx5/driver.h | 1 +
4 files changed, 26 insertions(+), 21 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h
index 4a19ef4a98110..5ee90a394fff9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h
@@ -327,6 +327,7 @@ struct mlx5e_params {
unsigned int sw_mtu;
int hard_mtu;
bool ptp_rx;
+ __be32 terminate_lkey_be;
};
static inline u8 mlx5e_get_dcb_num_tc(struct mlx5e_params *params)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index 579c2d217fdc6..ff579d7d8432c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -668,26 +668,6 @@ static void mlx5e_rq_free_shampo(struct mlx5e_rq *rq)
mlx5e_rq_shampo_hd_free(rq);
}
-static __be32 mlx5e_get_terminate_scatter_list_mkey(struct mlx5_core_dev *dev)
-{
- u32 out[MLX5_ST_SZ_DW(query_special_contexts_out)] = {};
- u32 in[MLX5_ST_SZ_DW(query_special_contexts_in)] = {};
- int res;
-
- if (!MLX5_CAP_GEN(dev, terminate_scatter_list_mkey))
- return MLX5_TERMINATE_SCATTER_LIST_LKEY;
-
- MLX5_SET(query_special_contexts_in, in, opcode,
- MLX5_CMD_OP_QUERY_SPECIAL_CONTEXTS);
- res = mlx5_cmd_exec_inout(dev, query_special_contexts, in, out);
- if (res)
- return MLX5_TERMINATE_SCATTER_LIST_LKEY;
-
- res = MLX5_GET(query_special_contexts_out, out,
- terminate_scatter_list_mkey);
- return cpu_to_be32(res);
-}
-
static int mlx5e_alloc_rq(struct mlx5e_params *params,
struct mlx5e_xsk_param *xsk,
struct mlx5e_rq_param *rqp,
@@ -852,7 +832,7 @@ static int mlx5e_alloc_rq(struct mlx5e_params *params,
/* check if num_frags is not a pow of two */
if (rq->wqe.info.num_frags < (1 << rq->wqe.info.log_num_frags)) {
wqe->data[f].byte_count = 0;
- wqe->data[f].lkey = mlx5e_get_terminate_scatter_list_mkey(mdev);
+ wqe->data[f].lkey = params->terminate_lkey_be;
wqe->data[f].addr = 0;
}
}
@@ -4973,6 +4953,8 @@ void mlx5e_build_nic_params(struct mlx5e_priv *priv, struct mlx5e_xsk *xsk, u16
/* RQ */
mlx5e_build_rq_params(mdev, params);
+ params->terminate_lkey_be = mlx5_core_get_terminate_scatter_list_mkey(mdev);
+
params->packet_merge.timeout = mlx5e_choose_lro_timeout(mdev, MLX5E_DEFAULT_LRO_TIMEOUT);
/* CQ moderation params */
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/mr.c b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
index 9d735c343a3b8..678f0be813752 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/mr.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/mr.c
@@ -32,6 +32,7 @@
#include <linux/kernel.h>
#include <linux/mlx5/driver.h>
+#include <linux/mlx5/qp.h>
#include "mlx5_core.h"
int mlx5_core_create_mkey(struct mlx5_core_dev *dev, u32 *mkey, u32 *in,
@@ -122,3 +123,23 @@ int mlx5_core_destroy_psv(struct mlx5_core_dev *dev, int psv_num)
return mlx5_cmd_exec_in(dev, destroy_psv, in);
}
EXPORT_SYMBOL(mlx5_core_destroy_psv);
+
+__be32 mlx5_core_get_terminate_scatter_list_mkey(struct mlx5_core_dev *dev)
+{
+ u32 out[MLX5_ST_SZ_DW(query_special_contexts_out)] = {};
+ u32 in[MLX5_ST_SZ_DW(query_special_contexts_in)] = {};
+ u32 mkey;
+
+ if (!MLX5_CAP_GEN(dev, terminate_scatter_list_mkey))
+ return MLX5_TERMINATE_SCATTER_LIST_LKEY;
+
+ MLX5_SET(query_special_contexts_in, in, opcode,
+ MLX5_CMD_OP_QUERY_SPECIAL_CONTEXTS);
+ if (mlx5_cmd_exec_inout(dev, query_special_contexts, in, out))
+ return MLX5_TERMINATE_SCATTER_LIST_LKEY;
+
+ mkey = MLX5_GET(query_special_contexts_out, out,
+ terminate_scatter_list_mkey);
+ return cpu_to_be32(mkey);
+}
+EXPORT_SYMBOL(mlx5_core_get_terminate_scatter_list_mkey);
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 7e225e41d55b8..68a3183d5d589 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -1088,6 +1088,7 @@ void mlx5_cmdif_debugfs_cleanup(struct mlx5_core_dev *dev);
int mlx5_core_create_psv(struct mlx5_core_dev *dev, u32 pdn,
int npsvs, u32 *sig_index);
int mlx5_core_destroy_psv(struct mlx5_core_dev *dev, int psv_num);
+__be32 mlx5_core_get_terminate_scatter_list_mkey(struct mlx5_core_dev *dev);
void mlx5_core_put_rsc(struct mlx5_core_rsc_common *common);
int mlx5_query_odp_caps(struct mlx5_core_dev *dev,
struct mlx5_odp_caps *odp_caps);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 030/286] net/mlx5e: CT: Use per action stats
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 029/286] net/mlx5e: Use query_special_contexts cmd only once per mdev Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 031/286] net/mlx5e: TC, Remove CT action reordering Greg Kroah-Hartman
` (264 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Blakey, Roi Dayan,
Saeed Mahameed, Sasha Levin
From: Paul Blakey <paulb@nvidia.com>
[ Upstream commit 13aca17b450e87a8de4e4a3b3ad454efbc576740 ]
CT action can miss in a middle of an action list, use
per action stats to correctly report stats for missed
packets.
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 5d862ec631f3 ("net/mlx5: Fix post parse infra to only parse every action once")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/tc/act/act.h | 2 ++
.../mellanox/mlx5/core/en/tc/act/ct.c | 9 ++++++++-
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 19 +++++++++++++++++--
3 files changed, 27 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
index 8346557eeaf63..cdcddf6e1b08b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
@@ -56,6 +56,8 @@ struct mlx5e_tc_act {
const struct flow_action_entry *act,
struct mlx5_flow_attr *attr);
+ bool (*is_missable)(const struct flow_action_entry *act);
+
int (*offload_action)(struct mlx5e_priv *priv,
struct flow_offload_action *fl_act,
struct flow_action_entry *act);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c
index a829c94289c10..fce1c0fd24535 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c
@@ -95,10 +95,17 @@ tc_act_is_multi_table_act_ct(struct mlx5e_priv *priv,
return true;
}
+static bool
+tc_act_is_missable_ct(const struct flow_action_entry *act)
+{
+ return !(act->ct.action & TCA_CT_ACT_CLEAR);
+}
+
struct mlx5e_tc_act mlx5e_tc_act_ct = {
.can_offload = tc_act_can_offload_ct,
.parse_action = tc_act_parse_ct,
- .is_multi_table_act = tc_act_is_multi_table_act_ct,
.post_parse = tc_act_post_parse_ct,
+ .is_multi_table_act = tc_act_is_multi_table_act_ct,
+ .is_missable = tc_act_is_missable_ct,
};
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index b5d23b159f345..82b76dcc05ac1 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -3974,7 +3974,9 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
enum mlx5_flow_namespace_type ns_type;
struct mlx5e_priv *priv = flow->priv;
struct flow_action_entry *act, **_act;
+ struct mlx5_flow_attr *prev_attr;
struct mlx5e_tc_act *tc_act;
+ bool is_missable;
int err, i;
flow_action_reorder.num_entries = flow_action->num_entries;
@@ -3991,6 +3993,9 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
flow_action_for_each(i, _act, &flow_action_reorder) {
jump_state.jump_target = false;
act = *_act;
+ is_missable = false;
+ prev_attr = attr;
+
tc_act = mlx5e_tc_act_get(act->id, ns_type);
if (!tc_act) {
NL_SET_ERR_MSG_MOD(extack, "Not implemented offload action");
@@ -4014,14 +4019,14 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
goto out_free;
parse_state->actions |= attr->action;
- if (!tc_act->stats_action)
- attr->tc_act_cookies[attr->tc_act_cookies_count++] = act->cookie;
/* Split attr for multi table act if not the last act. */
if (jump_state.jump_target ||
(tc_act->is_multi_table_act &&
tc_act->is_multi_table_act(priv, act, attr) &&
i < flow_action_reorder.num_entries - 1)) {
+ is_missable = tc_act->is_missable ? tc_act->is_missable(act) : false;
+
err = mlx5e_tc_act_post_parse(parse_state, flow_action, attr, ns_type);
if (err)
goto out_free;
@@ -4034,6 +4039,16 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
list_add(&attr->list, &flow->attrs);
}
+
+ if (is_missable) {
+ /* Add counter to prev, and assign act to new (next) attr */
+ prev_attr->action |= MLX5_FLOW_CONTEXT_ACTION_COUNT;
+ flow_flag_set(flow, USE_ACT_STATS);
+
+ attr->tc_act_cookies[attr->tc_act_cookies_count++] = act->cookie;
+ } else if (!tc_act->stats_action) {
+ prev_attr->tc_act_cookies[prev_attr->tc_act_cookies_count++] = act->cookie;
+ }
}
kfree(flow_action_reorder.entries);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 031/286] net/mlx5e: TC, Remove CT action reordering
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 030/286] net/mlx5e: CT: Use per action stats Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 032/286] net/mlx5: Fix post parse infra to only parse every action once Greg Kroah-Hartman
` (263 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Blakey, Roi Dayan,
Saeed Mahameed, Sasha Levin
From: Paul Blakey <paulb@nvidia.com>
[ Upstream commit 67efaf45930df662111acf7c706d545c83f83999 ]
CT action reordering was done as a workaround when CT misses
used to restore the relevant filter's tc chain and continuing sw processing
from that chain. As such, there was a need to reorder CT action to be before
any packet modifying actions (e.g mac rewrite).
Currently (after patch "net/mlx5e: TC, Set CT miss to the specific ct
action instance"), CT misses continues from the relevant ct action in
software, and so reordering isn't needed anymore.
Remove the reordering.
Signed-off-by: Paul Blakey <paulb@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Stable-dep-of: 5d862ec631f3 ("net/mlx5: Fix post parse infra to only parse every action once")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/tc/act/act.c | 20 ------------
.../mellanox/mlx5/core/en/tc/act/act.h | 4 ---
.../net/ethernet/mellanox/mlx5/core/en_tc.c | 32 ++++++-------------
3 files changed, 9 insertions(+), 47 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
index eba0c86989263..fc923a99b6a48 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
@@ -82,26 +82,6 @@ mlx5e_tc_act_init_parse_state(struct mlx5e_tc_act_parse_state *parse_state,
parse_state->flow_action = flow_action;
}
-void
-mlx5e_tc_act_reorder_flow_actions(struct flow_action *flow_action,
- struct mlx5e_tc_flow_action *flow_action_reorder)
-{
- struct flow_action_entry *act;
- int i, j = 0;
-
- flow_action_for_each(i, act, flow_action) {
- /* Add CT action to be first. */
- if (act->id == FLOW_ACTION_CT)
- flow_action_reorder->entries[j++] = act;
- }
-
- flow_action_for_each(i, act, flow_action) {
- if (act->id == FLOW_ACTION_CT)
- continue;
- flow_action_reorder->entries[j++] = act;
- }
-}
-
int
mlx5e_tc_act_post_parse(struct mlx5e_tc_act_parse_state *parse_state,
struct flow_action *flow_action,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
index cdcddf6e1b08b..d7615e329e6d9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
@@ -112,10 +112,6 @@ mlx5e_tc_act_init_parse_state(struct mlx5e_tc_act_parse_state *parse_state,
struct flow_action *flow_action,
struct netlink_ext_ack *extack);
-void
-mlx5e_tc_act_reorder_flow_actions(struct flow_action *flow_action,
- struct mlx5e_tc_flow_action *flow_action_reorder);
-
int
mlx5e_tc_act_post_parse(struct mlx5e_tc_act_parse_state *parse_state,
struct flow_action *flow_action,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 82b76dcc05ac1..a78e201fd883b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -3967,32 +3967,22 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
struct flow_action *flow_action)
{
struct netlink_ext_ack *extack = parse_state->extack;
- struct mlx5e_tc_flow_action flow_action_reorder;
struct mlx5e_tc_flow *flow = parse_state->flow;
struct mlx5e_tc_jump_state jump_state = {};
struct mlx5_flow_attr *attr = flow->attr;
enum mlx5_flow_namespace_type ns_type;
struct mlx5e_priv *priv = flow->priv;
- struct flow_action_entry *act, **_act;
struct mlx5_flow_attr *prev_attr;
+ struct flow_action_entry *act;
struct mlx5e_tc_act *tc_act;
bool is_missable;
int err, i;
- flow_action_reorder.num_entries = flow_action->num_entries;
- flow_action_reorder.entries = kcalloc(flow_action->num_entries,
- sizeof(flow_action), GFP_KERNEL);
- if (!flow_action_reorder.entries)
- return -ENOMEM;
-
- mlx5e_tc_act_reorder_flow_actions(flow_action, &flow_action_reorder);
-
ns_type = mlx5e_get_flow_namespace(flow);
list_add(&attr->list, &flow->attrs);
- flow_action_for_each(i, _act, &flow_action_reorder) {
+ flow_action_for_each(i, act, flow_action) {
jump_state.jump_target = false;
- act = *_act;
is_missable = false;
prev_attr = attr;
@@ -4000,23 +3990,23 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
if (!tc_act) {
NL_SET_ERR_MSG_MOD(extack, "Not implemented offload action");
err = -EOPNOTSUPP;
- goto out_free;
+ goto out_free_post_acts;
}
if (!tc_act->can_offload(parse_state, act, i, attr)) {
err = -EOPNOTSUPP;
- goto out_free;
+ goto out_free_post_acts;
}
err = tc_act->parse_action(parse_state, act, priv, attr);
if (err)
- goto out_free;
+ goto out_free_post_acts;
dec_jump_count(act, tc_act, attr, priv, &jump_state);
err = parse_branch_ctrl(act, tc_act, flow, attr, &jump_state, extack);
if (err)
- goto out_free;
+ goto out_free_post_acts;
parse_state->actions |= attr->action;
@@ -4024,17 +4014,17 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
if (jump_state.jump_target ||
(tc_act->is_multi_table_act &&
tc_act->is_multi_table_act(priv, act, attr) &&
- i < flow_action_reorder.num_entries - 1)) {
+ i < flow_action->num_entries - 1)) {
is_missable = tc_act->is_missable ? tc_act->is_missable(act) : false;
err = mlx5e_tc_act_post_parse(parse_state, flow_action, attr, ns_type);
if (err)
- goto out_free;
+ goto out_free_post_acts;
attr = mlx5e_clone_flow_attr_for_post_act(flow->attr, ns_type);
if (!attr) {
err = -ENOMEM;
- goto out_free;
+ goto out_free_post_acts;
}
list_add(&attr->list, &flow->attrs);
@@ -4051,8 +4041,6 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
}
}
- kfree(flow_action_reorder.entries);
-
err = mlx5e_tc_act_post_parse(parse_state, flow_action, attr, ns_type);
if (err)
goto out_free_post_acts;
@@ -4063,8 +4051,6 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
return 0;
-out_free:
- kfree(flow_action_reorder.entries);
out_free_post_acts:
free_flow_post_acts(flow);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 032/286] net/mlx5: Fix post parse infra to only parse every action once
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 031/286] net/mlx5e: TC, Remove CT action reordering Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 033/286] net/mlx5e: Dont attach netdev profile while handling internal error Greg Kroah-Hartman
` (262 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Buslov, Roi Dayan,
Saeed Mahameed, Sasha Levin
From: Vlad Buslov <vladbu@nvidia.com>
[ Upstream commit 5d862ec631f3d3cc3b4f8cdb5b9fc5879663f1d3 ]
Caller of mlx5e_tc_act_post_parse() needs it to parse only the subset of
actions starting after previous split and ending at the current action.
However, that range is not provided as arguments and
mlx5e_tc_act_post_parse() uses generic flow_action_for_each() that iterates
over all flow actions. Not only this is redundant, it also causes a bug
when mlx5e_tc_act->post_parse() callback is not idempotent since it will be
called for every split. For example, ct action tc_act_post_parse_ct()
callback obtains a reference to mlx5_ct_ft instance and calling it several
times during parsing stage will cause reference counter imbalance.
Fix the issue by providing a proper action range of the current split
subset to mlx5e_tc_act_post_parse() and only calling
mlx5e_tc_act->post_parse() for actions inside the subset range.
Fixes: 8300f225268b ("net/mlx5e: Create new flow attr for multi table actions")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c | 7 ++++++-
drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 8 +++++---
3 files changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
index fc923a99b6a48..0380a04c3691c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.c
@@ -84,7 +84,7 @@ mlx5e_tc_act_init_parse_state(struct mlx5e_tc_act_parse_state *parse_state,
int
mlx5e_tc_act_post_parse(struct mlx5e_tc_act_parse_state *parse_state,
- struct flow_action *flow_action,
+ struct flow_action *flow_action, int from, int to,
struct mlx5_flow_attr *attr,
enum mlx5_flow_namespace_type ns_type)
{
@@ -96,6 +96,11 @@ mlx5e_tc_act_post_parse(struct mlx5e_tc_act_parse_state *parse_state,
priv = parse_state->flow->priv;
flow_action_for_each(i, act, flow_action) {
+ if (i < from)
+ continue;
+ else if (i > to)
+ break;
+
tc_act = mlx5e_tc_act_get(act->id, ns_type);
if (!tc_act || !tc_act->post_parse)
continue;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
index d7615e329e6d9..84c78d5f5bed8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h
@@ -114,7 +114,7 @@ mlx5e_tc_act_init_parse_state(struct mlx5e_tc_act_parse_state *parse_state,
int
mlx5e_tc_act_post_parse(struct mlx5e_tc_act_parse_state *parse_state,
- struct flow_action *flow_action,
+ struct flow_action *flow_action, int from, int to,
struct mlx5_flow_attr *attr,
enum mlx5_flow_namespace_type ns_type);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index a78e201fd883b..82b96196e97b7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -3975,8 +3975,8 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
struct mlx5_flow_attr *prev_attr;
struct flow_action_entry *act;
struct mlx5e_tc_act *tc_act;
+ int err, i, i_split = 0;
bool is_missable;
- int err, i;
ns_type = mlx5e_get_flow_namespace(flow);
list_add(&attr->list, &flow->attrs);
@@ -4017,7 +4017,8 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
i < flow_action->num_entries - 1)) {
is_missable = tc_act->is_missable ? tc_act->is_missable(act) : false;
- err = mlx5e_tc_act_post_parse(parse_state, flow_action, attr, ns_type);
+ err = mlx5e_tc_act_post_parse(parse_state, flow_action, i_split, i, attr,
+ ns_type);
if (err)
goto out_free_post_acts;
@@ -4027,6 +4028,7 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
goto out_free_post_acts;
}
+ i_split = i + 1;
list_add(&attr->list, &flow->attrs);
}
@@ -4041,7 +4043,7 @@ parse_tc_actions(struct mlx5e_tc_act_parse_state *parse_state,
}
}
- err = mlx5e_tc_act_post_parse(parse_state, flow_action, attr, ns_type);
+ err = mlx5e_tc_act_post_parse(parse_state, flow_action, i_split, i, attr, ns_type);
if (err)
goto out_free_post_acts;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 033/286] net/mlx5e: Dont attach netdev profile while handling internal error
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 032/286] net/mlx5: Fix post parse infra to only parse every action once Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 034/286] net/mlx5e: Move Ethernet driver debugfs to profile init callback Greg Kroah-Hartman
` (261 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmytro Linkin, Saeed Mahameed,
Sasha Levin
From: Dmytro Linkin <dlinkin@nvidia.com>
[ Upstream commit bdf274750fca17b289404ef03453c4070725302c ]
As part of switchdev mode disablement, driver changes port netdevice
profile from uplink to nic. If this process is triggered by health
recovery flow (PCI reset, for ex.) profile attach would fail because all
fw commands aborted when internal error flag is set. As a result, nic
netdevice profile is not attached and driver fails to rollback to uplink
profile, which leave driver in broken state and cause crash later.
To handle broken state do netdevice profile initialization only instead
of full attachment and release mdev resources on driver suspend as
expected. Actual netdevice attachment is done during driver load.
Fixes: c4d7eb57687f ("net/mxl5e: Add change profile method")
Signed-off-by: Dmytro Linkin <dlinkin@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlx5/core/en_main.c | 35 ++++++++++++++++---
1 file changed, 31 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index ff579d7d8432c..a60610c7a7bb7 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -5798,8 +5798,8 @@ void mlx5e_detach_netdev(struct mlx5e_priv *priv)
}
static int
-mlx5e_netdev_attach_profile(struct net_device *netdev, struct mlx5_core_dev *mdev,
- const struct mlx5e_profile *new_profile, void *new_ppriv)
+mlx5e_netdev_init_profile(struct net_device *netdev, struct mlx5_core_dev *mdev,
+ const struct mlx5e_profile *new_profile, void *new_ppriv)
{
struct mlx5e_priv *priv = netdev_priv(netdev);
int err;
@@ -5815,6 +5815,25 @@ mlx5e_netdev_attach_profile(struct net_device *netdev, struct mlx5_core_dev *mde
err = new_profile->init(priv->mdev, priv->netdev);
if (err)
goto priv_cleanup;
+
+ return 0;
+
+priv_cleanup:
+ mlx5e_priv_cleanup(priv);
+ return err;
+}
+
+static int
+mlx5e_netdev_attach_profile(struct net_device *netdev, struct mlx5_core_dev *mdev,
+ const struct mlx5e_profile *new_profile, void *new_ppriv)
+{
+ struct mlx5e_priv *priv = netdev_priv(netdev);
+ int err;
+
+ err = mlx5e_netdev_init_profile(netdev, mdev, new_profile, new_ppriv);
+ if (err)
+ return err;
+
err = mlx5e_attach_netdev(priv);
if (err)
goto profile_cleanup;
@@ -5822,7 +5841,6 @@ mlx5e_netdev_attach_profile(struct net_device *netdev, struct mlx5_core_dev *mde
profile_cleanup:
new_profile->cleanup(priv);
-priv_cleanup:
mlx5e_priv_cleanup(priv);
return err;
}
@@ -5841,6 +5859,12 @@ int mlx5e_netdev_change_profile(struct mlx5e_priv *priv,
priv->profile->cleanup(priv);
mlx5e_priv_cleanup(priv);
+ if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+ mlx5e_netdev_init_profile(netdev, mdev, new_profile, new_ppriv);
+ set_bit(MLX5E_STATE_DESTROYING, &priv->state);
+ return -EIO;
+ }
+
err = mlx5e_netdev_attach_profile(netdev, mdev, new_profile, new_ppriv);
if (err) { /* roll back to original profile */
netdev_warn(netdev, "%s: new profile init failed, %d\n", __func__, err);
@@ -5902,8 +5926,11 @@ static int mlx5e_suspend(struct auxiliary_device *adev, pm_message_t state)
struct net_device *netdev = priv->netdev;
struct mlx5_core_dev *mdev = priv->mdev;
- if (!netif_device_present(netdev))
+ if (!netif_device_present(netdev)) {
+ if (test_bit(MLX5E_STATE_DESTROYING, &priv->state))
+ mlx5e_destroy_mdev_resources(mdev);
return -ENODEV;
+ }
mlx5e_detach_netdev(priv);
mlx5e_destroy_mdev_resources(mdev);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 034/286] net/mlx5e: Move Ethernet driver debugfs to profile init callback
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 033/286] net/mlx5e: Dont attach netdev profile while handling internal error Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 035/286] net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure Greg Kroah-Hartman
` (260 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jianbo Liu, Saeed Mahameed,
Sasha Levin
From: Jianbo Liu <jianbol@nvidia.com>
[ Upstream commit c4c24fc30cc417ace332ceceaba4f70f81dcd521 ]
As priv->dfs_root is cleared, and therefore missed, when change
eswitch mode, move the creation of the root debugfs to the init
callback of mlx5e_nic_profile and mlx5e_uplink_rep_profile, and
the destruction to the cleanup callback for symmeter.
Fixes: 288eca60cc31 ("net/mlx5e: Add Ethernet driver debugfs")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 10 +++++-----
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 6 ++++++
2 files changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index a60610c7a7bb7..7c72bed7f81aa 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
@@ -5226,12 +5226,16 @@ static int mlx5e_nic_init(struct mlx5_core_dev *mdev,
mlx5e_timestamp_init(priv);
+ priv->dfs_root = debugfs_create_dir("nic",
+ mlx5_debugfs_get_dev_root(mdev));
+
fs = mlx5e_fs_init(priv->profile, mdev,
!test_bit(MLX5E_STATE_DESTROYING, &priv->state),
priv->dfs_root);
if (!fs) {
err = -ENOMEM;
mlx5_core_err(mdev, "FS initialization failed, %d\n", err);
+ debugfs_remove_recursive(priv->dfs_root);
return err;
}
priv->fs = fs;
@@ -5252,6 +5256,7 @@ static void mlx5e_nic_cleanup(struct mlx5e_priv *priv)
mlx5e_health_destroy_reporters(priv);
mlx5e_ktls_cleanup(priv);
mlx5e_fs_cleanup(priv->fs);
+ debugfs_remove_recursive(priv->dfs_root);
priv->fs = NULL;
}
@@ -5976,9 +5981,6 @@ static int mlx5e_probe(struct auxiliary_device *adev,
priv->profile = profile;
priv->ppriv = NULL;
- priv->dfs_root = debugfs_create_dir("nic",
- mlx5_debugfs_get_dev_root(priv->mdev));
-
err = profile->init(mdev, netdev);
if (err) {
mlx5_core_err(mdev, "mlx5e_nic_profile init failed, %d\n", err);
@@ -6007,7 +6009,6 @@ static int mlx5e_probe(struct auxiliary_device *adev,
err_profile_cleanup:
profile->cleanup(priv);
err_destroy_netdev:
- debugfs_remove_recursive(priv->dfs_root);
mlx5e_destroy_netdev(priv);
err_devlink_port_unregister:
mlx5e_devlink_port_unregister(mlx5e_dev);
@@ -6027,7 +6028,6 @@ static void mlx5e_remove(struct auxiliary_device *adev)
unregister_netdev(priv->netdev);
mlx5e_suspend(adev, state);
priv->profile->cleanup(priv);
- debugfs_remove_recursive(priv->dfs_root);
mlx5e_destroy_netdev(priv);
mlx5e_devlink_port_unregister(mlx5e_dev);
mlx5e_destroy_devlink(mlx5e_dev);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 6e18d91c3d766..992f3f9c11925 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -30,6 +30,7 @@
* SOFTWARE.
*/
+#include <linux/debugfs.h>
#include <linux/mlx5/fs.h>
#include <net/switchdev.h>
#include <net/pkt_cls.h>
@@ -811,11 +812,15 @@ static int mlx5e_init_ul_rep(struct mlx5_core_dev *mdev,
{
struct mlx5e_priv *priv = netdev_priv(netdev);
+ priv->dfs_root = debugfs_create_dir("nic",
+ mlx5_debugfs_get_dev_root(mdev));
+
priv->fs = mlx5e_fs_init(priv->profile, mdev,
!test_bit(MLX5E_STATE_DESTROYING, &priv->state),
priv->dfs_root);
if (!priv->fs) {
netdev_err(priv->netdev, "FS allocation failed\n");
+ debugfs_remove_recursive(priv->dfs_root);
return -ENOMEM;
}
@@ -828,6 +833,7 @@ static int mlx5e_init_ul_rep(struct mlx5_core_dev *mdev,
static void mlx5e_cleanup_rep(struct mlx5e_priv *priv)
{
mlx5e_fs_cleanup(priv->fs);
+ debugfs_remove_recursive(priv->dfs_root);
priv->fs = NULL;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 035/286] net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 034/286] net/mlx5e: Move Ethernet driver debugfs to profile init callback Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 036/286] net: stmmac: fix call trace when stmmac_xdp_xmit() is invoked Greg Kroah-Hartman
` (259 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Bogendoerfer, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Thomas Bogendoerfer <tbogendoerfer@suse.de>
[ Upstream commit d68cb7cf1fd0ef4287bc0ecd1ed0b6ae8e05fc70 ]
Do skb_put() after a new skb has been successfully allocated otherwise
the reused skb leads to skb_panics or incorrect packet sizes.
Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
Signed-off-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230524194908.147145-1-tbogendoerfer@suse.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
index afa3b92a6905f..0d5a41a2ae010 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
@@ -245,12 +245,6 @@ static bool mlxbf_gige_rx_packet(struct mlxbf_gige *priv, int *rx_pkts)
skb = priv->rx_skb[rx_pi_rem];
- skb_put(skb, datalen);
-
- skb->ip_summed = CHECKSUM_NONE; /* device did not checksum packet */
-
- skb->protocol = eth_type_trans(skb, netdev);
-
/* Alloc another RX SKB for this same index */
rx_skb = mlxbf_gige_alloc_skb(priv, MLXBF_GIGE_DEFAULT_BUF_SZ,
&rx_buf_dma, DMA_FROM_DEVICE);
@@ -259,6 +253,13 @@ static bool mlxbf_gige_rx_packet(struct mlxbf_gige *priv, int *rx_pkts)
priv->rx_skb[rx_pi_rem] = rx_skb;
dma_unmap_single(priv->dev, *rx_wqe_addr,
MLXBF_GIGE_DEFAULT_BUF_SZ, DMA_FROM_DEVICE);
+
+ skb_put(skb, datalen);
+
+ skb->ip_summed = CHECKSUM_NONE; /* device did not checksum packet */
+
+ skb->protocol = eth_type_trans(skb, netdev);
+
*rx_wqe_addr = rx_buf_dma;
} else if (rx_cqe & MLXBF_GIGE_RX_CQE_PKT_STATUS_MAC_ERR) {
priv->stats.rx_mac_errors++;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 036/286] net: stmmac: fix call trace when stmmac_xdp_xmit() is invoked
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 035/286] net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 037/286] netrom: fix info-leak in nr_write_internal() Greg Kroah-Hartman
` (258 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Fang, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Wei Fang <wei.fang@nxp.com>
[ Upstream commit ffb3322181d9e8db880202e4f00991764a35d812 ]
We encountered a kernel call trace issue which was related to
ndo_xdp_xmit callback on our i.MX8MP platform. The reproduce
steps show as follows.
1. The FEC port (eth0) connects to a PC port, and the PC uses
pktgen_sample03_burst_single_flow.sh to generate packets and
send these packets to the FEC port. Notice that the script must
be executed before step 2.
2. Run the "./xdp_redirect eth0 eth1" command on i.MX8MP, the
eth1 interface is the dwmac. Then there will be a call trace
issue soon. Please see the log for more details.
The root cause is that the NETDEV_XDP_ACT_NDO_XMIT feature is
enabled by default, so when the step 2 command is exexcuted
and packets have already been sent to eth0, the stmmac_xdp_xmit()
starts running before the stmmac_xdp_set_prog() finishes. To
resolve this issue, we disable the NETDEV_XDP_ACT_NDO_XMIT
feature by default and turn on/off this feature when the bpf
program is installed/uninstalled which just like the other
ethernet drivers.
Call Trace log:
[ 306.311271] ------------[ cut here ]------------
[ 306.315910] WARNING: CPU: 0 PID: 15 at lib/timerqueue.c:55 timerqueue_del+0x68/0x70
[ 306.323590] Modules linked in:
[ 306.326654] CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.4.0-rc1+ #37
[ 306.333277] Hardware name: NXP i.MX8MPlus EVK board (DT)
[ 306.338591] pstate: 600000c5 (nZCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 306.345561] pc : timerqueue_del+0x68/0x70
[ 306.349577] lr : __remove_hrtimer+0x5c/0xa0
[ 306.353777] sp : ffff80000b7c3920
[ 306.357094] x29: ffff80000b7c3920 x28: 0000000000000000 x27: 0000000000000001
[ 306.364244] x26: ffff80000a763a40 x25: ffff0000d0285a00 x24: 0000000000000001
[ 306.371390] x23: 0000000000000001 x22: ffff000179389a40 x21: 0000000000000000
[ 306.378537] x20: ffff000179389aa0 x19: ffff0000d2951308 x18: 0000000000001000
[ 306.385686] x17: f1d3000000000000 x16: 00000000c39c1000 x15: 55e99bbe00001a00
[ 306.392835] x14: 09000900120aa8c0 x13: e49af1d300000000 x12: 000000000000c39c
[ 306.399987] x11: 100055e99bbe0000 x10: ffff8000090b1048 x9 : ffff8000081603fc
[ 306.407133] x8 : 000000000000003c x7 : 000000000000003c x6 : 0000000000000001
[ 306.414284] x5 : ffff0000d2950980 x4 : 0000000000000000 x3 : 0000000000000000
[ 306.421432] x2 : 0000000000000001 x1 : ffff0000d2951308 x0 : ffff0000d2951308
[ 306.428585] Call trace:
[ 306.431035] timerqueue_del+0x68/0x70
[ 306.434706] __remove_hrtimer+0x5c/0xa0
[ 306.438549] hrtimer_start_range_ns+0x2bc/0x370
[ 306.443089] stmmac_xdp_xmit+0x174/0x1b0
[ 306.447021] bq_xmit_all+0x194/0x4b0
[ 306.450612] __dev_flush+0x4c/0x98
[ 306.454024] xdp_do_flush+0x18/0x38
[ 306.457522] fec_enet_rx_napi+0x6c8/0xc68
[ 306.461539] __napi_poll+0x40/0x220
[ 306.465038] net_rx_action+0xf8/0x240
[ 306.468707] __do_softirq+0x128/0x3a8
[ 306.472378] run_ksoftirqd+0x40/0x58
[ 306.475961] smpboot_thread_fn+0x1c4/0x288
[ 306.480068] kthread+0x124/0x138
[ 306.483305] ret_from_fork+0x10/0x20
[ 306.486889] ---[ end trace 0000000000000000 ]---
Fixes: 66c0e13ad236 ("drivers: net: turn on XDP features")
Signed-off-by: Wei Fang <wei.fang@nxp.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230524125714.357337-1-wei.fang@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +--
drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c | 6 ++++++
2 files changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index f9cd063f1fe30..71f8f78ce0090 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -7176,8 +7176,7 @@ int stmmac_dvr_probe(struct device *device,
ndev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
NETIF_F_RXCSUM;
ndev->xdp_features = NETDEV_XDP_ACT_BASIC | NETDEV_XDP_ACT_REDIRECT |
- NETDEV_XDP_ACT_XSK_ZEROCOPY |
- NETDEV_XDP_ACT_NDO_XMIT;
+ NETDEV_XDP_ACT_XSK_ZEROCOPY;
ret = stmmac_tc_init(priv, priv);
if (!ret) {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
index 9d4d8c3dad0a3..aa6f16d3df649 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_xdp.c
@@ -117,6 +117,9 @@ int stmmac_xdp_set_prog(struct stmmac_priv *priv, struct bpf_prog *prog,
return -EOPNOTSUPP;
}
+ if (!prog)
+ xdp_features_clear_redirect_target(dev);
+
need_update = !!priv->xdp_prog != !!prog;
if (if_running && need_update)
stmmac_xdp_release(dev);
@@ -131,5 +134,8 @@ int stmmac_xdp_set_prog(struct stmmac_priv *priv, struct bpf_prog *prog,
if (if_running && need_update)
stmmac_xdp_open(dev);
+ if (prog)
+ xdp_features_set_redirect_target(dev, false);
+
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 037/286] netrom: fix info-leak in nr_write_internal()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 036/286] net: stmmac: fix call trace when stmmac_xdp_xmit() is invoked Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 038/286] af_packet: Fix data-races of pkt_sk(sk)->num Greg Kroah-Hartman
` (257 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Simon Kapadia, Eric Dumazet,
Simon Horman, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 31642e7089df8fd3f54ca7843f7ee2952978cad1 ]
Simon Kapadia reported the following issue:
<quote>
The Online Amateur Radio Community (OARC) has recently been experimenting
with building a nationwide packet network in the UK.
As part of our experimentation, we have been testing out packet on 300bps HF,
and playing with net/rom. For HF packet at this baud rate you really need
to make sure that your MTU is relatively low; AX.25 suggests a PACLEN of 60,
and a net/rom PACLEN of 40 to go with that.
However the Linux net/rom support didn't work with a low PACLEN;
the mkiss module would truncate packets if you set the PACLEN below about 200 or so, e.g.:
Apr 19 14:00:51 radio kernel: [12985.747310] mkiss: ax1: truncating oversized transmit packet!
This didn't make any sense to me (if the packets are smaller why would they
be truncated?) so I started investigating.
I looked at the packets using ethereal, and found that many were just huge
compared to what I would expect.
A simple net/rom connection request packet had the request and then a bunch
of what appeared to be random data following it:
</quote>
Simon provided a patch that I slightly revised:
Not only we must not use skb_tailroom(), we also do
not want to count NR_NETWORK_LEN twice.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-Developed-by: Simon Kapadia <szymon@kapadia.pl>
Signed-off-by: Simon Kapadia <szymon@kapadia.pl>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Simon Kapadia <szymon@kapadia.pl>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230524141456.1045467-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netrom/nr_subr.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/net/netrom/nr_subr.c b/net/netrom/nr_subr.c
index 3f99b432ea707..e2d2af924cff4 100644
--- a/net/netrom/nr_subr.c
+++ b/net/netrom/nr_subr.c
@@ -123,7 +123,7 @@ void nr_write_internal(struct sock *sk, int frametype)
unsigned char *dptr;
int len, timeout;
- len = NR_NETWORK_LEN + NR_TRANSPORT_LEN;
+ len = NR_TRANSPORT_LEN;
switch (frametype & 0x0F) {
case NR_CONNREQ:
@@ -141,7 +141,8 @@ void nr_write_internal(struct sock *sk, int frametype)
return;
}
- if ((skb = alloc_skb(len, GFP_ATOMIC)) == NULL)
+ skb = alloc_skb(NR_NETWORK_LEN + len, GFP_ATOMIC);
+ if (!skb)
return;
/*
@@ -149,7 +150,7 @@ void nr_write_internal(struct sock *sk, int frametype)
*/
skb_reserve(skb, NR_NETWORK_LEN);
- dptr = skb_put(skb, skb_tailroom(skb));
+ dptr = skb_put(skb, len);
switch (frametype & 0x0F) {
case NR_CONNREQ:
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 038/286] af_packet: Fix data-races of pkt_sk(sk)->num.
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 037/286] netrom: fix info-leak in nr_write_internal() Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 039/286] tls: improve lockless access safety of tls_err_abort() Greg Kroah-Hartman
` (256 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzkaller, Kuniyuki Iwashima,
Willem de Bruijn, Jakub Kicinski, Sasha Levin
From: Kuniyuki Iwashima <kuniyu@amazon.com>
[ Upstream commit 822b5a1c17df7e338b9f05d1cfe5764e37c7f74f ]
syzkaller found a data race of pkt_sk(sk)->num.
The value is changed under lock_sock() and po->bind_lock, so we
need READ_ONCE() to access pkt_sk(sk)->num without these locks in
packet_bind_spkt(), packet_bind(), and sk_diag_fill().
Note that WRITE_ONCE() is already added by commit c7d2ef5dd4b0
("net/packet: annotate accesses to po->bind").
BUG: KCSAN: data-race in packet_bind / packet_do_bind
write (marked) to 0xffff88802ffd1cee of 2 bytes by task 7322 on cpu 0:
packet_do_bind+0x446/0x640 net/packet/af_packet.c:3236
packet_bind+0x99/0xe0 net/packet/af_packet.c:3321
__sys_bind+0x19b/0x1e0 net/socket.c:1803
__do_sys_bind net/socket.c:1814 [inline]
__se_sys_bind net/socket.c:1812 [inline]
__x64_sys_bind+0x40/0x50 net/socket.c:1812
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
read to 0xffff88802ffd1cee of 2 bytes by task 7318 on cpu 1:
packet_bind+0xbf/0xe0 net/packet/af_packet.c:3322
__sys_bind+0x19b/0x1e0 net/socket.c:1803
__do_sys_bind net/socket.c:1814 [inline]
__se_sys_bind net/socket.c:1812 [inline]
__x64_sys_bind+0x40/0x50 net/socket.c:1812
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x72/0xdc
value changed: 0x0300 -> 0x0000
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 7318 Comm: syz-executor.4 Not tainted 6.3.0-13380-g7fddb5b5300c #4
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014
Fixes: 96ec6327144e ("packet: Diag core and basic socket info dumping")
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Link: https://lore.kernel.org/r/20230524232934.50950-1-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/packet/af_packet.c | 4 ++--
net/packet/diag.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index db9c2fa71c50c..f3513316743ad 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3291,7 +3291,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data_min));
name[sizeof(uaddr->sa_data_min)] = 0;
- return packet_do_bind(sk, name, 0, pkt_sk(sk)->num);
+ return packet_do_bind(sk, name, 0, READ_ONCE(pkt_sk(sk)->num));
}
static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
@@ -3309,7 +3309,7 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len
return -EINVAL;
return packet_do_bind(sk, NULL, sll->sll_ifindex,
- sll->sll_protocol ? : pkt_sk(sk)->num);
+ sll->sll_protocol ? : READ_ONCE(pkt_sk(sk)->num));
}
static struct proto packet_proto = {
diff --git a/net/packet/diag.c b/net/packet/diag.c
index d704c7bf51b20..a68a84574c739 100644
--- a/net/packet/diag.c
+++ b/net/packet/diag.c
@@ -143,7 +143,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
rp = nlmsg_data(nlh);
rp->pdiag_family = AF_PACKET;
rp->pdiag_type = sk->sk_type;
- rp->pdiag_num = ntohs(po->num);
+ rp->pdiag_num = ntohs(READ_ONCE(po->num));
rp->pdiag_ino = sk_ino;
sock_diag_save_cookie(sk, rp->pdiag_cookie);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 039/286] tls: improve lockless access safety of tls_err_abort()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 038/286] af_packet: Fix data-races of pkt_sk(sk)->num Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 040/286] amd-xgbe: fix the false linkup in xgbe_phy_status Greg Kroah-Hartman
` (255 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jakub Kicinski, Simon Horman,
David S. Miller, Sasha Levin
From: Jakub Kicinski <kuba@kernel.org>
[ Upstream commit 8a0d57df8938e9fd2e99d47a85b7f37d86f91097 ]
Most protos' poll() methods insert a memory barrier between
writes to sk_err and sk_error_report(). This dates back to
commit a4d258036ed9 ("tcp: Fix race in tcp_poll").
I guess we should do the same thing in TLS, tcp_poll() does
not hold the socket lock.
Fixes: 3c4d7559159b ("tls: kernel TLS support")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/tls/tls_strp.c | 4 +++-
net/tls/tls_sw.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c
index da95abbb7ea32..f37f4a0fcd3c2 100644
--- a/net/tls/tls_strp.c
+++ b/net/tls/tls_strp.c
@@ -20,7 +20,9 @@ static void tls_strp_abort_strp(struct tls_strparser *strp, int err)
strp->stopped = 1;
/* Report an error on the lower socket */
- strp->sk->sk_err = -err;
+ WRITE_ONCE(strp->sk->sk_err, -err);
+ /* Paired with smp_rmb() in tcp_poll() */
+ smp_wmb();
sk_error_report(strp->sk);
}
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 6e6a7c37d685c..1a53c8f481e9a 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -70,7 +70,9 @@ noinline void tls_err_abort(struct sock *sk, int err)
{
WARN_ON_ONCE(err >= 0);
/* sk->sk_err should contain a positive error code. */
- sk->sk_err = -err;
+ WRITE_ONCE(sk->sk_err, -err);
+ /* Paired with smp_rmb() in tcp_poll() */
+ smp_wmb();
sk_error_report(sk);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 040/286] amd-xgbe: fix the false linkup in xgbe_phy_status
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 039/286] tls: improve lockless access safety of tls_err_abort() Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 041/286] perf ftrace latency: Remove unnecessary "--" from --use-nsec option Greg Kroah-Hartman
` (254 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sudheesh Mavila, Simon Horman,
Shyam Sundar S K, Raju Rangoju, David S. Miller, Sasha Levin
From: Raju Rangoju <Raju.Rangoju@amd.com>
[ Upstream commit dc362e20cd6ab7a93d1b09669730c406f0910c35 ]
In the event of a change in XGBE mode, the current auto-negotiation
needs to be reset and the AN cycle needs to be re-triggerred. However,
the current code ignores the return value of xgbe_set_mode(), leading to
false information as the link is declared without checking the status
register.
Fix this by propagating the mode switch status information to
xgbe_phy_status().
Fixes: e57f7a3feaef ("amd-xgbe: Prepare for working with more than one type of phy")
Co-developed-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Signed-off-by: Sudheesh Mavila <sudheesh.mavila@amd.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Acked-by: Shyam Sundar S K <Shyam-sundar.S-k@amd.com>
Signed-off-by: Raju Rangoju <Raju.Rangoju@amd.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
index 33a9574e9e043..32d2c6fac6526 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
@@ -1329,7 +1329,7 @@ static enum xgbe_mode xgbe_phy_status_aneg(struct xgbe_prv_data *pdata)
return pdata->phy_if.phy_impl.an_outcome(pdata);
}
-static void xgbe_phy_status_result(struct xgbe_prv_data *pdata)
+static bool xgbe_phy_status_result(struct xgbe_prv_data *pdata)
{
struct ethtool_link_ksettings *lks = &pdata->phy.lks;
enum xgbe_mode mode;
@@ -1367,8 +1367,13 @@ static void xgbe_phy_status_result(struct xgbe_prv_data *pdata)
pdata->phy.duplex = DUPLEX_FULL;
- if (xgbe_set_mode(pdata, mode) && pdata->an_again)
+ if (!xgbe_set_mode(pdata, mode))
+ return false;
+
+ if (pdata->an_again)
xgbe_phy_reconfig_aneg(pdata);
+
+ return true;
}
static void xgbe_phy_status(struct xgbe_prv_data *pdata)
@@ -1398,7 +1403,8 @@ static void xgbe_phy_status(struct xgbe_prv_data *pdata)
return;
}
- xgbe_phy_status_result(pdata);
+ if (xgbe_phy_status_result(pdata))
+ return;
if (test_bit(XGBE_LINK_INIT, &pdata->dev_state))
clear_bit(XGBE_LINK_INIT, &pdata->dev_state);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 041/286] perf ftrace latency: Remove unnecessary "--" from --use-nsec option
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 040/286] amd-xgbe: fix the false linkup in xgbe_phy_status Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 042/286] mtd: rawnand: ingenic: fix empty stub helper definitions Greg Kroah-Hartman
` (253 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Namhyung Kim,
Arnaldo Carvalho de Melo, Adrian Hunter, Changbin Du, Ian Rogers,
Ingo Molnar, Jiri Olsa, Peter Zijlstra, Sasha Levin
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 8d73259ef23f449329294dc187932f7470268126 ]
The option name should not have the dashes. Current version shows four
dashes for the option.
$ perf ftrace latency -h
Usage: perf ftrace [<options>] [<command>]
or: perf ftrace [<options>] -- [<command>] [<options>]
or: perf ftrace {trace|latency} [<options>] [<command>]
or: perf ftrace {trace|latency} [<options>] -- [<command>] [<options>]
-b, --use-bpf Use BPF to measure function latency
-n, ----use-nsec Use nano-second histogram
-T, --trace-funcs <func>
Show latency of given function
Fixes: 84005bb6148618cc ("perf ftrace latency: Add -n/--use-nsec option")
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Changbin Du <changbin.du@huawei.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20230525212038.3535851-1-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/builtin-ftrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/builtin-ftrace.c b/tools/perf/builtin-ftrace.c
index fb1b66ef2e167..ce482ef58e6f2 100644
--- a/tools/perf/builtin-ftrace.c
+++ b/tools/perf/builtin-ftrace.c
@@ -1175,7 +1175,7 @@ int cmd_ftrace(int argc, const char **argv)
OPT_BOOLEAN('b', "use-bpf", &ftrace.target.use_bpf,
"Use BPF to measure function latency"),
#endif
- OPT_BOOLEAN('n', "--use-nsec", &ftrace.use_nsec,
+ OPT_BOOLEAN('n', "use-nsec", &ftrace.use_nsec,
"Use nano-second histogram"),
OPT_PARENT(common_options),
};
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 042/286] mtd: rawnand: ingenic: fix empty stub helper definitions
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 041/286] perf ftrace latency: Remove unnecessary "--" from --use-nsec option Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 043/286] efi: Bump stub image version for macOS HVF compatibility Greg Kroah-Hartman
` (252 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Paul Cercueil,
Miquel Raynal, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 650a8884a364ff2568b51cde9009cfd43cdae6ad ]
A few functions provide an empty interface definition when
CONFIG_MTD_NAND_INGENIC_ECC is disabled, but they are accidentally
defined as global functions in the header:
drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:39:5: error: no previous prototype for 'ingenic_ecc_calculate'
drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:46:5: error: no previous prototype for 'ingenic_ecc_correct'
drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:53:6: error: no previous prototype for 'ingenic_ecc_release'
drivers/mtd/nand/raw/ingenic/ingenic_ecc.h:57:21: error: no previous prototype for 'of_ingenic_ecc_get'
Turn them into 'static inline' definitions instead.
Fixes: 15de8c6efd0e ("mtd: rawnand: ingenic: Separate top-level and SoC specific code")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Paul Cercueil <paul@crapouillou.net>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230516202133.559488-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/ingenic/ingenic_ecc.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h b/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h
index 2cda439b5e11b..017868f59f222 100644
--- a/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h
+++ b/drivers/mtd/nand/raw/ingenic/ingenic_ecc.h
@@ -36,25 +36,25 @@ int ingenic_ecc_correct(struct ingenic_ecc *ecc,
void ingenic_ecc_release(struct ingenic_ecc *ecc);
struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *np);
#else /* CONFIG_MTD_NAND_INGENIC_ECC */
-int ingenic_ecc_calculate(struct ingenic_ecc *ecc,
+static inline int ingenic_ecc_calculate(struct ingenic_ecc *ecc,
struct ingenic_ecc_params *params,
const u8 *buf, u8 *ecc_code)
{
return -ENODEV;
}
-int ingenic_ecc_correct(struct ingenic_ecc *ecc,
+static inline int ingenic_ecc_correct(struct ingenic_ecc *ecc,
struct ingenic_ecc_params *params, u8 *buf,
u8 *ecc_code)
{
return -ENODEV;
}
-void ingenic_ecc_release(struct ingenic_ecc *ecc)
+static inline void ingenic_ecc_release(struct ingenic_ecc *ecc)
{
}
-struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *np)
+static inline struct ingenic_ecc *of_ingenic_ecc_get(struct device_node *np)
{
return ERR_PTR(-ENODEV);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 043/286] efi: Bump stub image version for macOS HVF compatibility
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 042/286] mtd: rawnand: ingenic: fix empty stub helper definitions Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 044/286] RDMA/irdma: Prevent QP use after free Greg Kroah-Hartman
` (251 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Akihiro Suda, Ard Biesheuvel,
Sasha Levin
From: Akihiro Suda <suda.kyoto@gmail.com>
[ Upstream commit 36e4fc57fc1619f462e669e939209c45763bc8f5 ]
The macOS hypervisor framework includes a host-side VMM called
VZLinuxBootLoader [1] which implements native support for booting the
Linux kernel inside a guest directly (instead of, e.g., via GRUB
installed inside the guest). On x86, it incorporates a BIOS style loader
that does not implement or expose EFI to the loaded kernel. However,
this loader appears to fail when the 'image minor version' field in the
kernel image's PE/COFF header (which is generally only used by EFI based
bootloaders) is set to any value other than 0x0. [2]
Commit e346bebbd36b1576 ("efi: libstub: Always enable initrd command
line loader and bump version") incremented the EFI stub image minor
version to convey that all EFI stub kernels now implement support for
the initrd= command line option, and do so in a way where it can load
initrd images from any filesystem known to the EFI firmware (as opposed
to prior implementations that could only load initrds from the same
volume that the kernel image was loaded from).
Unfortunately, bumping the version to v1.1 triggers this issue in
VZLinuxBootLoader, breaking the boot on x86. So let's keep the image
minor version at 0x0, and bump the image major version instead.
While at it, convert this field to a bit field, so that individual
features are discoverable from it, as suggested by Linus. So let's bump
the major version to v3, and document the initrd= command line loading
feature as being represented by bit 1 in the mask.
Note that, due to the prior interpretation as a monotonically increasing
version field, loaders are still permitted to assume that the LoadFile2
initrd loading feature is supported for any major version value >= 1,
even if bit 0 is not set.
[1] https://developer.apple.com/documentation/virtualization/vzlinuxbootloader
[2] https://lore.kernel.org/linux-efi/CAG8fp8Teu4G9JuenQrqGndFt2Gy+V4YgJ=hN1xX7AD940YKf3A@mail.gmail.com/
Fixes: e346bebbd36b1576 ("efi: libstub: Always enable initrd command ...")
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217485
Signed-off-by: Akihiro Suda <suda.kyoto@gmail.com>
[ardb: rewrite comment and commit log]
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/pe.h | 25 +++++++++++++------------
1 file changed, 13 insertions(+), 12 deletions(-)
diff --git a/include/linux/pe.h b/include/linux/pe.h
index 6ffabf1e6d039..16754fb2f954a 100644
--- a/include/linux/pe.h
+++ b/include/linux/pe.h
@@ -11,25 +11,26 @@
#include <linux/types.h>
/*
- * Linux EFI stub v1.0 adds the following functionality:
- * - Loading initrd from the LINUX_EFI_INITRD_MEDIA_GUID device path,
- * - Loading/starting the kernel from firmware that targets a different
- * machine type, via the entrypoint exposed in the .compat PE/COFF section.
+ * Starting from version v3.0, the major version field should be interpreted as
+ * a bit mask of features supported by the kernel's EFI stub:
+ * - 0x1: initrd loading from the LINUX_EFI_INITRD_MEDIA_GUID device path,
+ * - 0x2: initrd loading using the initrd= command line option, where the file
+ * may be specified using device path notation, and is not required to
+ * reside on the same volume as the loaded kernel image.
*
* The recommended way of loading and starting v1.0 or later kernels is to use
* the LoadImage() and StartImage() EFI boot services, and expose the initrd
* via the LINUX_EFI_INITRD_MEDIA_GUID device path.
*
- * Versions older than v1.0 support initrd loading via the image load options
- * (using initrd=, limited to the volume from which the kernel itself was
- * loaded), or via arch specific means (bootparams, DT, etc).
+ * Versions older than v1.0 may support initrd loading via the image load
+ * options (using initrd=, limited to the volume from which the kernel itself
+ * was loaded), or only via arch specific means (bootparams, DT, etc).
*
- * On x86, LoadImage() and StartImage() can be omitted if the EFI handover
- * protocol is implemented, which can be inferred from the version,
- * handover_offset and xloadflags fields in the bootparams structure.
+ * The minor version field must remain 0x0.
+ * (https://lore.kernel.org/all/efd6f2d4-547c-1378-1faa-53c044dbd297@gmail.com/)
*/
-#define LINUX_EFISTUB_MAJOR_VERSION 0x1
-#define LINUX_EFISTUB_MINOR_VERSION 0x1
+#define LINUX_EFISTUB_MAJOR_VERSION 0x3
+#define LINUX_EFISTUB_MINOR_VERSION 0x0
/*
* LINUX_PE_MAGIC appears at offset 0x38 into the MS-DOS header of EFI bootable
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 044/286] RDMA/irdma: Prevent QP use after free
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 043/286] efi: Bump stub image version for macOS HVF compatibility Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 045/286] RDMA/irdma: Fix Local Invalidate fencing Greg Kroah-Hartman
` (250 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mustafa Ismail, Shiraz Saleem,
Jason Gunthorpe, Sasha Levin
From: Mustafa Ismail <mustafa.ismail@intel.com>
[ Upstream commit c8f304d75f6c6cc679a73f89591f9a915da38f09 ]
There is a window where the poll cq may use a QP that has been freed.
This can happen if a CQE is polled before irdma_clean_cqes() can clear the
CQE's related to the QP and the destroy QP races to free the QP memory.
then the QP structures are used in irdma_poll_cq. Fix this by moving the
clearing of CQE's before the reference is removed and the QP is destroyed.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Link: https://lore.kernel.org/r/20230522155654.1309-3-shiraz.saleem@intel.com
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 1b2e3e800c9a6..446a0ab3faaa5 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -522,11 +522,6 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
if (!iwqp->user_mode)
cancel_delayed_work_sync(&iwqp->dwork_flush);
- irdma_qp_rem_ref(&iwqp->ibqp);
- wait_for_completion(&iwqp->free_qp);
- irdma_free_lsmm_rsrc(iwqp);
- irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp);
-
if (!iwqp->user_mode) {
if (iwqp->iwscq) {
irdma_clean_cqes(iwqp, iwqp->iwscq);
@@ -534,6 +529,12 @@ static int irdma_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata)
irdma_clean_cqes(iwqp, iwqp->iwrcq);
}
}
+
+ irdma_qp_rem_ref(&iwqp->ibqp);
+ wait_for_completion(&iwqp->free_qp);
+ irdma_free_lsmm_rsrc(iwqp);
+ irdma_cqp_qp_destroy_cmd(&iwdev->rf->sc_dev, &iwqp->sc_qp);
+
irdma_remove_push_mmap_entries(iwqp);
irdma_free_qp_rsrc(iwqp);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 045/286] RDMA/irdma: Fix Local Invalidate fencing
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 044/286] RDMA/irdma: Prevent QP use after free Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 046/286] af_packet: do not use READ_ONCE() in packet_bind() Greg Kroah-Hartman
` (249 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mustafa Ismail, Shiraz Saleem,
Jason Gunthorpe, Sasha Levin
From: Mustafa Ismail <mustafa.ismail@intel.com>
[ Upstream commit 5842d1d9c1b0d17e0c29eae65ae1f245f83682dd ]
If the local invalidate fence is indicated in the WR, only the read fence
is currently being set in WQE. Fix this to set both the read and local
fence in the WQE.
Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs")
Link: https://lore.kernel.org/r/20230522155654.1309-4-shiraz.saleem@intel.com
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/irdma/verbs.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/infiniband/hw/irdma/verbs.c b/drivers/infiniband/hw/irdma/verbs.c
index 446a0ab3faaa5..d0bb21d3007c2 100644
--- a/drivers/infiniband/hw/irdma/verbs.c
+++ b/drivers/infiniband/hw/irdma/verbs.c
@@ -3297,6 +3297,7 @@ static int irdma_post_send(struct ib_qp *ibqp,
break;
case IB_WR_LOCAL_INV:
info.op_type = IRDMA_OP_TYPE_INV_STAG;
+ info.local_fence = info.read_fence;
info.op.inv_local_stag.target_stag = ib_wr->ex.invalidate_rkey;
err = irdma_uk_stag_local_invalidate(ukqp, &info, true);
break;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 046/286] af_packet: do not use READ_ONCE() in packet_bind()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 045/286] RDMA/irdma: Fix Local Invalidate fencing Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 047/286] tcp: deny tcp_disconnect() when threads are waiting Greg Kroah-Hartman
` (248 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Willem de Bruijn,
Jiri Pirko, Kuniyuki Iwashima, Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 6ffc57ea004234d9373c57b204fd10370a69f392 ]
A recent patch added READ_ONCE() in packet_bind() and packet_bind_spkt()
This is better handled by reading pkt_sk(sk)->num later
in packet_do_bind() while appropriate lock is held.
READ_ONCE() in writers are often an evidence of something being wrong.
Fixes: 822b5a1c17df ("af_packet: Fix data-races of pkt_sk(sk)->num.")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://lore.kernel.org/r/20230526154342.2533026-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/packet/af_packet.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f3513316743ad..b79d2fa788061 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -3193,6 +3193,9 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
lock_sock(sk);
spin_lock(&po->bind_lock);
+ if (!proto)
+ proto = po->num;
+
rcu_read_lock();
if (po->fanout) {
@@ -3291,7 +3294,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr,
memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data_min));
name[sizeof(uaddr->sa_data_min)] = 0;
- return packet_do_bind(sk, name, 0, READ_ONCE(pkt_sk(sk)->num));
+ return packet_do_bind(sk, name, 0, 0);
}
static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
@@ -3308,8 +3311,7 @@ static int packet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len
if (sll->sll_family != AF_PACKET)
return -EINVAL;
- return packet_do_bind(sk, NULL, sll->sll_ifindex,
- sll->sll_protocol ? : READ_ONCE(pkt_sk(sk)->num));
+ return packet_do_bind(sk, NULL, sll->sll_ifindex, sll->sll_protocol);
}
static struct proto packet_proto = {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 047/286] tcp: deny tcp_disconnect() when threads are waiting
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 046/286] af_packet: do not use READ_ONCE() in packet_bind() Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 048/286] tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set Greg Kroah-Hartman
` (247 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Paolo Abeni, Eric Dumazet,
Jakub Kicinski, Sasha Levin
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 4faeee0cf8a5d88d63cdbc3bab124fb0e6aed08c ]
Historically connect(AF_UNSPEC) has been abused by syzkaller
and other fuzzers to trigger various bugs.
A recent one triggers a divide-by-zero [1], and Paolo Abeni
was able to diagnose the issue.
tcp_recvmsg_locked() has tests about sk_state being not TCP_LISTEN
and TCP REPAIR mode being not used.
Then later if socket lock is released in sk_wait_data(),
another thread can call connect(AF_UNSPEC), then make this
socket a TCP listener.
When recvmsg() is resumed, it can eventually call tcp_cleanup_rbuf()
and attempt a divide by 0 in tcp_rcv_space_adjust() [1]
This patch adds a new socket field, counting number of threads
blocked in sk_wait_event() and inet_wait_for_connect().
If this counter is not zero, tcp_disconnect() returns an error.
This patch adds code in blocking socket system calls, thus should
not hurt performance of non blocking ones.
Note that we probably could revert commit 499350a5a6e7 ("tcp:
initialize rcv_mss to TCP_MIN_MSS instead of 0") to restore
original tcpi_rcv_mss meaning (was 0 if no payload was ever
received on a socket)
[1]
divide error: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 13832 Comm: syz-executor.5 Not tainted 6.3.0-rc4-syzkaller-00224-g00c7b5f4ddc5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/02/2023
RIP: 0010:tcp_rcv_space_adjust+0x36e/0x9d0 net/ipv4/tcp_input.c:740
Code: 00 00 00 00 fc ff df 4c 89 64 24 48 8b 44 24 04 44 89 f9 41 81 c7 80 03 00 00 c1 e1 04 44 29 f0 48 63 c9 48 01 e9 48 0f af c1 <49> f7 f6 48 8d 04 41 48 89 44 24 40 48 8b 44 24 30 48 c1 e8 03 48
RSP: 0018:ffffc900033af660 EFLAGS: 00010206
RAX: 4a66b76cbade2c48 RBX: ffff888076640cc0 RCX: 00000000c334e4ac
RDX: 0000000000000000 RSI: dffffc0000000000 RDI: 0000000000000001
RBP: 00000000c324e86c R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880766417f8
R13: ffff888028fbb980 R14: 0000000000000000 R15: 0000000000010344
FS: 00007f5bffbfe700(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32f25000 CR3: 000000007ced0000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
tcp_recvmsg_locked+0x100e/0x22e0 net/ipv4/tcp.c:2616
tcp_recvmsg+0x117/0x620 net/ipv4/tcp.c:2681
inet6_recvmsg+0x114/0x640 net/ipv6/af_inet6.c:670
sock_recvmsg_nosec net/socket.c:1017 [inline]
sock_recvmsg+0xe2/0x160 net/socket.c:1038
____sys_recvmsg+0x210/0x5a0 net/socket.c:2720
___sys_recvmsg+0xf2/0x180 net/socket.c:2762
do_recvmmsg+0x25e/0x6e0 net/socket.c:2856
__sys_recvmmsg net/socket.c:2935 [inline]
__do_sys_recvmmsg net/socket.c:2958 [inline]
__se_sys_recvmmsg net/socket.c:2951 [inline]
__x64_sys_recvmmsg+0x20f/0x260 net/socket.c:2951
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5c0108c0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5bffbfe168 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f5c011ac050 RCX: 00007f5c0108c0f9
RDX: 0000000000000001 RSI: 0000000020000bc0 RDI: 0000000000000003
RBP: 00007f5c010e7b39 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000122 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f5c012cfb1f R14: 00007f5bffbfe300 R15: 0000000000022000
</TASK>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: Paolo Abeni <pabeni@redhat.com>
Diagnosed-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/20230526163458.2880232-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 4 ++++
net/ipv4/af_inet.c | 2 ++
net/ipv4/inet_connection_sock.c | 1 +
net/ipv4/tcp.c | 6 ++++++
4 files changed, 13 insertions(+)
diff --git a/include/net/sock.h b/include/net/sock.h
index 9cd0354221507..45e46a1c4afc6 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -336,6 +336,7 @@ struct sk_filter;
* @sk_cgrp_data: cgroup data for this cgroup
* @sk_memcg: this socket's memory cgroup association
* @sk_write_pending: a write to stream socket waits to start
+ * @sk_wait_pending: number of threads blocked on this socket
* @sk_state_change: callback to indicate change in the state of the sock
* @sk_data_ready: callback to indicate there is data to be processed
* @sk_write_space: callback to indicate there is bf sending space available
@@ -428,6 +429,7 @@ struct sock {
unsigned int sk_napi_id;
#endif
int sk_rcvbuf;
+ int sk_wait_pending;
struct sk_filter __rcu *sk_filter;
union {
@@ -1174,6 +1176,7 @@ static inline void sock_rps_reset_rxhash(struct sock *sk)
#define sk_wait_event(__sk, __timeo, __condition, __wait) \
({ int __rc; \
+ __sk->sk_wait_pending++; \
release_sock(__sk); \
__rc = __condition; \
if (!__rc) { \
@@ -1183,6 +1186,7 @@ static inline void sock_rps_reset_rxhash(struct sock *sk)
} \
sched_annotate_sleep(); \
lock_sock(__sk); \
+ __sk->sk_wait_pending--; \
__rc = __condition; \
__rc; \
})
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 70fd769f1174b..daeec363b0976 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -586,6 +586,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
add_wait_queue(sk_sleep(sk), &wait);
sk->sk_write_pending += writebias;
+ sk->sk_wait_pending++;
/* Basic assumption: if someone sets sk->sk_err, he _must_
* change state of the socket from TCP_SYN_*.
@@ -601,6 +602,7 @@ static long inet_wait_for_connect(struct sock *sk, long timeo, int writebias)
}
remove_wait_queue(sk_sleep(sk), &wait);
sk->sk_write_pending -= writebias;
+ sk->sk_wait_pending--;
return timeo;
}
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 65ad4251f6fd8..1386787eaf1a5 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1142,6 +1142,7 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
if (newsk) {
struct inet_connection_sock *newicsk = inet_csk(newsk);
+ newsk->sk_wait_pending = 0;
inet_sk_set_state(newsk, TCP_SYN_RECV);
newicsk->icsk_bind_hash = NULL;
newicsk->icsk_bind2_hash = NULL;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ed63ee8f0d7e3..f4b243cc7f4a5 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -3080,6 +3080,12 @@ int tcp_disconnect(struct sock *sk, int flags)
int old_state = sk->sk_state;
u32 seq;
+ /* Deny disconnect if other threads are blocked in sk_wait_event()
+ * or inet_wait_for_connect().
+ */
+ if (sk->sk_wait_pending)
+ return -EBUSY;
+
if (old_state != TCP_CLOSE)
tcp_set_state(sk, TCP_CLOSE);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 048/286] tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 047/286] tcp: deny tcp_disconnect() when threads are waiting Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 049/286] rxrpc: Truncate UTS_RELEASE for rxrpc version Greg Kroah-Hartman
` (246 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jack Yang, Eric Dumazet, Cambda Zhu,
Jason Xing, Jakub Kicinski, Sasha Levin
From: Cambda Zhu <cambda@linux.alibaba.com>
[ Upstream commit 34dfde4ad87b84d21278a7e19d92b5b2c68e6c4d ]
This patch replaces the tp->mss_cache check in getting TCP_MAXSEG
with tp->rx_opt.user_mss check for CLOSE/LISTEN sock. Since
tp->mss_cache is initialized with TCP_MSS_DEFAULT, checking if
it's zero is probably a bug.
With this change, getting TCP_MAXSEG before connecting will return
default MSS normally, and return user_mss if user_mss is set.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Jack Yang <mingliang@linux.alibaba.com>
Suggested-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/netdev/CANn89i+3kL9pYtkxkwxwNMzvC_w3LNUum_2=3u+UyLBmGmifHA@mail.gmail.com/#t
Signed-off-by: Cambda Zhu <cambda@linux.alibaba.com>
Link: https://lore.kernel.org/netdev/14D45862-36EA-4076-974C-EA67513C92F6@linux.alibaba.com/
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230527040317.68247-1-cambda@linux.alibaba.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv4/tcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index f4b243cc7f4a5..6bb8eb8031051 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4077,7 +4077,8 @@ int do_tcp_getsockopt(struct sock *sk, int level,
switch (optname) {
case TCP_MAXSEG:
val = tp->mss_cache;
- if (!val && ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
+ if (tp->rx_opt.user_mss &&
+ ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)))
val = tp->rx_opt.user_mss;
if (tp->repair)
val = tp->rx_opt.mss_clamp;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 049/286] rxrpc: Truncate UTS_RELEASE for rxrpc version
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 048/286] tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 050/286] net/smc: Scan from current RMB list when no position specified Greg Kroah-Hartman
` (245 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kenny Ho, David Howells, Marc Dionne,
Andrew Lunn, David Laight, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, linux-afs, netdev, Simon Horman,
Jeffrey Altman, Sasha Levin
From: David Howells <dhowells@redhat.com>
[ Upstream commit 020c69c1a793ed29d28793808eddd75210c858dd ]
UTS_RELEASE has a maximum length of 64 which can cause rxrpc_version to
exceed the 65 byte message limit.
Per the rx spec[1]: "If a server receives a packet with a type value of 13,
and the client-initiated flag set, it should respond with a 65-byte payload
containing a string that identifies the version of AFS software it is
running."
The current implementation causes a compile error when WERROR is turned on
and/or UTS_RELEASE exceeds the length of 49 (making the version string more
than 64 characters).
Fix this by generating the string during module initialisation and limiting
the UTS_RELEASE segment of the string does not exceed 49 chars. We need to
make sure that the 64 bytes includes "linux-" at the front and " AF_RXRPC"
at the back as this may be used in pattern matching.
Fixes: 44ba06987c0b ("RxRPC: Handle VERSION Rx protocol packets")
Reported-by: Kenny Ho <Kenny.Ho@amd.com>
Link: https://lore.kernel.org/r/20230523223944.691076-1-Kenny.Ho@amd.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Kenny Ho <Kenny.Ho@amd.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Andrew Lunn <andrew@lunn.ch>
cc: David Laight <David.Laight@ACULAB.COM>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
Link: https://web.mit.edu/kolya/afs/rx/rx-spec [1]
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
Link: https://lore.kernel.org/r/654974.1685100894@warthog.procyon.org.uk
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rxrpc/af_rxrpc.c | 1 +
net/rxrpc/ar-internal.h | 1 +
net/rxrpc/local_event.c | 11 ++++++++++-
3 files changed, 12 insertions(+), 1 deletion(-)
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index a6f0d29f35ef9..f5d1fc1266a5a 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -967,6 +967,7 @@ static int __init af_rxrpc_init(void)
BUILD_BUG_ON(sizeof(struct rxrpc_skb_priv) > sizeof_field(struct sk_buff, cb));
ret = -ENOMEM;
+ rxrpc_gen_version_string();
rxrpc_call_jar = kmem_cache_create(
"rxrpc_call_jar", sizeof(struct rxrpc_call), 0,
SLAB_HWCACHE_ALIGN, NULL);
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 5d44dc08f66d0..e8e14c6f904d9 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -1068,6 +1068,7 @@ int rxrpc_get_server_data_key(struct rxrpc_connection *, const void *, time64_t,
/*
* local_event.c
*/
+void rxrpc_gen_version_string(void);
void rxrpc_send_version_request(struct rxrpc_local *local,
struct rxrpc_host_header *hdr,
struct sk_buff *skb);
diff --git a/net/rxrpc/local_event.c b/net/rxrpc/local_event.c
index 5e69ea6b233da..993c69f97488c 100644
--- a/net/rxrpc/local_event.c
+++ b/net/rxrpc/local_event.c
@@ -16,7 +16,16 @@
#include <generated/utsrelease.h>
#include "ar-internal.h"
-static const char rxrpc_version_string[65] = "linux-" UTS_RELEASE " AF_RXRPC";
+static char rxrpc_version_string[65]; // "linux-" UTS_RELEASE " AF_RXRPC";
+
+/*
+ * Generate the VERSION packet string.
+ */
+void rxrpc_gen_version_string(void)
+{
+ snprintf(rxrpc_version_string, sizeof(rxrpc_version_string),
+ "linux-%.49s AF_RXRPC", UTS_RELEASE);
+}
/*
* Reply to a version request
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 050/286] net/smc: Scan from current RMB list when no position specified
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 049/286] rxrpc: Truncate UTS_RELEASE for rxrpc version Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 051/286] net/smc: Dont use RMBs not mapped to new link in SMCRv2 ADD LINK Greg Kroah-Hartman
` (244 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wen Gu, Paolo Abeni, Sasha Levin
From: Wen Gu <guwen@linux.alibaba.com>
[ Upstream commit b24aa141c2ff26c919237aee61ea1818fc6780d9 ]
When finding the first RMB of link group, it should start from the
current RMB list whose index is 0. So fix it.
Fixes: b4ba4652b3f8 ("net/smc: extend LLC layer for SMC-Rv2")
Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_llc.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index a0840b8c935b8..8423e8e0063f4 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -578,7 +578,10 @@ static struct smc_buf_desc *smc_llc_get_next_rmb(struct smc_link_group *lgr,
{
struct smc_buf_desc *buf_next;
- if (!buf_pos || list_is_last(&buf_pos->list, &lgr->rmbs[*buf_lst])) {
+ if (!buf_pos)
+ return _smc_llc_get_next_rmb(lgr, buf_lst);
+
+ if (list_is_last(&buf_pos->list, &lgr->rmbs[*buf_lst])) {
(*buf_lst)++;
return _smc_llc_get_next_rmb(lgr, buf_lst);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 051/286] net/smc: Dont use RMBs not mapped to new link in SMCRv2 ADD LINK
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 050/286] net/smc: Scan from current RMB list when no position specified Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 052/286] net/sched: sch_ingress: Only create under TC_H_INGRESS Greg Kroah-Hartman
` (243 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wen Gu, Paolo Abeni, Sasha Levin
From: Wen Gu <guwen@linux.alibaba.com>
[ Upstream commit 71c6aa0305e3d2365d3bfd0134b4025d9e7ba388 ]
We encountered a crash when using SMCRv2. It is caused by a logical
error in smc_llc_fill_ext_v2().
BUG: kernel NULL pointer dereference, address: 0000000000000014
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP PTI
CPU: 7 PID: 453 Comm: kworker/7:4 Kdump: loaded Tainted: G W E 6.4.0-rc3+ #44
Workqueue: events smc_llc_add_link_work [smc]
RIP: 0010:smc_llc_fill_ext_v2+0x117/0x280 [smc]
RSP: 0018:ffffacb5c064bd88 EFLAGS: 00010282
RAX: ffff9a6bc1c3c02c RBX: ffff9a6be3558000 RCX: 0000000000000000
RDX: 0000000000000002 RSI: 0000000000000002 RDI: 000000000000000a
RBP: ffffacb5c064bdb8 R08: 0000000000000040 R09: 000000000000000c
R10: ffff9a6bc0910300 R11: 0000000000000002 R12: 0000000000000000
R13: 0000000000000002 R14: ffff9a6bc1c3c02c R15: ffff9a6be3558250
FS: 0000000000000000(0000) GS:ffff9a6eefdc0000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000014 CR3: 000000010b078003 CR4: 00000000003706e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
smc_llc_send_add_link+0x1ae/0x2f0 [smc]
smc_llc_srv_add_link+0x2c9/0x5a0 [smc]
? cc_mkenc+0x40/0x60
smc_llc_add_link_work+0xb8/0x140 [smc]
process_one_work+0x1e5/0x3f0
worker_thread+0x4d/0x2f0
? __pfx_worker_thread+0x10/0x10
kthread+0xe5/0x120
? __pfx_kthread+0x10/0x10
ret_from_fork+0x2c/0x50
</TASK>
When an alernate RNIC is available in system, SMC will try to add a new
link based on the RNIC for resilience. All the RMBs in use will be mapped
to the new link. Then the RMBs' MRs corresponding to the new link will be
filled into SMCRv2 LLC ADD LINK messages.
However, smc_llc_fill_ext_v2() mistakenly accesses to unused RMBs which
haven't been mapped to the new link and have no valid MRs, thus causing
a crash. So this patch fixes the logic.
Fixes: b4ba4652b3f8 ("net/smc: extend LLC layer for SMC-Rv2")
Signed-off-by: Wen Gu <guwen@linux.alibaba.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/smc/smc_llc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c
index 8423e8e0063f4..7a8d9163d186e 100644
--- a/net/smc/smc_llc.c
+++ b/net/smc/smc_llc.c
@@ -617,6 +617,8 @@ static int smc_llc_fill_ext_v2(struct smc_llc_msg_add_link_v2_ext *ext,
goto out;
buf_pos = smc_llc_get_first_rmb(lgr, &buf_lst);
for (i = 0; i < ext->num_rkeys; i++) {
+ while (buf_pos && !(buf_pos)->used)
+ buf_pos = smc_llc_get_next_rmb(lgr, &buf_lst, buf_pos);
if (!buf_pos)
break;
rmb = buf_pos;
@@ -626,8 +628,6 @@ static int smc_llc_fill_ext_v2(struct smc_llc_msg_add_link_v2_ext *ext,
cpu_to_be64((uintptr_t)rmb->cpu_addr) :
cpu_to_be64((u64)sg_dma_address(rmb->sgt[lnk_idx].sgl));
buf_pos = smc_llc_get_next_rmb(lgr, &buf_lst, buf_pos);
- while (buf_pos && !(buf_pos)->used)
- buf_pos = smc_llc_get_next_rmb(lgr, &buf_lst, buf_pos);
}
len += i * sizeof(ext->rt[0]);
out:
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 052/286] net/sched: sch_ingress: Only create under TC_H_INGRESS
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 051/286] net/smc: Dont use RMBs not mapped to new link in SMCRv2 ADD LINK Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 053/286] net/sched: sch_clsact: Only create under TC_H_CLSACT Greg Kroah-Hartman
` (242 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b53a9c0d1ea4ad62da8b,
Pedro Tammela, Jamal Hadi Salim, Vlad Buslov, Peilin Ye,
Jakub Kicinski, Sasha Levin
From: Peilin Ye <peilin.ye@bytedance.com>
[ Upstream commit c7cfbd115001f94de9e4053657946a383147e803 ]
ingress Qdiscs are only supposed to be created under TC_H_INGRESS.
Return -EOPNOTSUPP if 'parent' is not TC_H_INGRESS, similar to
mq_init().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+b53a9c0d1ea4ad62da8b@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/r/0000000000006cf87705f79acf1a@google.com/
Tested-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_ingress.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 84838128b9c5b..f9ef6deb27709 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -80,6 +80,9 @@ static int ingress_init(struct Qdisc *sch, struct nlattr *opt,
struct net_device *dev = qdisc_dev(sch);
int err;
+ if (sch->parent != TC_H_INGRESS)
+ return -EOPNOTSUPP;
+
net_inc_ingress_queue();
mini_qdisc_pair_init(&q->miniqp, sch, &dev->miniq_ingress);
@@ -101,6 +104,9 @@ static void ingress_destroy(struct Qdisc *sch)
{
struct ingress_sched_data *q = qdisc_priv(sch);
+ if (sch->parent != TC_H_INGRESS)
+ return;
+
tcf_block_put_ext(q->block, sch, &q->block_info);
net_dec_ingress_queue();
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 053/286] net/sched: sch_clsact: Only create under TC_H_CLSACT
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 052/286] net/sched: sch_ingress: Only create under TC_H_INGRESS Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 054/286] net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs Greg Kroah-Hartman
` (241 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pedro Tammela, Jamal Hadi Salim,
Vlad Buslov, Peilin Ye, Jakub Kicinski, Sasha Levin
From: Peilin Ye <peilin.ye@bytedance.com>
[ Upstream commit 5eeebfe6c493192b10d516abfd72742900f2a162 ]
clsact Qdiscs are only supposed to be created under TC_H_CLSACT (which
equals TC_H_INGRESS). Return -EOPNOTSUPP if 'parent' is not
TC_H_CLSACT.
Fixes: 1f211a1b929c ("net, sched: add clsact qdisc")
Tested-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_ingress.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index f9ef6deb27709..35963929e1178 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -225,6 +225,9 @@ static int clsact_init(struct Qdisc *sch, struct nlattr *opt,
struct net_device *dev = qdisc_dev(sch);
int err;
+ if (sch->parent != TC_H_CLSACT)
+ return -EOPNOTSUPP;
+
net_inc_ingress_queue();
net_inc_egress_queue();
@@ -254,6 +257,9 @@ static void clsact_destroy(struct Qdisc *sch)
{
struct clsact_sched_data *q = qdisc_priv(sch);
+ if (sch->parent != TC_H_CLSACT)
+ return;
+
tcf_block_put_ext(q->egress_block, sch, &q->egress_block_info);
tcf_block_put_ext(q->ingress_block, sch, &q->ingress_block_info);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 054/286] net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 053/286] net/sched: sch_clsact: Only create under TC_H_CLSACT Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 055/286] net/sched: Prohibit regrafting ingress or clsact Qdiscs Greg Kroah-Hartman
` (240 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pedro Tammela, Jamal Hadi Salim,
Vlad Buslov, Peilin Ye, Jakub Kicinski, Sasha Levin
From: Peilin Ye <peilin.ye@bytedance.com>
[ Upstream commit f85fa45d4a9408d98c46c8fa45ba2e3b2f4bf219 ]
Currently it is possible to add e.g. an HTB Qdisc under ffff:fff1
(TC_H_INGRESS, TC_H_CLSACT):
$ ip link add name ifb0 type ifb
$ tc qdisc add dev ifb0 parent ffff:fff1 htb
$ tc qdisc add dev ifb0 clsact
Error: Exclusivity flag on, cannot modify.
$ drgn
...
>>> ifb0 = netdev_get_by_name(prog, "ifb0")
>>> qdisc = ifb0.ingress_queue.qdisc_sleeping
>>> print(qdisc.ops.id.string_().decode())
htb
>>> qdisc.flags.value_() # TCQ_F_INGRESS
2
Only allow ingress and clsact Qdiscs under ffff:fff1. Return -EINVAL
for everything else. Make TCQ_F_INGRESS a static flag of ingress and
clsact Qdiscs.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 1f211a1b929c ("net, sched: add clsact qdisc")
Tested-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_api.c | 7 ++++++-
net/sched/sch_ingress.c | 4 ++--
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index aba789c30a2eb..b7c230f9c5b19 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1250,7 +1250,12 @@ static struct Qdisc *qdisc_create(struct net_device *dev,
sch->parent = parent;
if (handle == TC_H_INGRESS) {
- sch->flags |= TCQ_F_INGRESS;
+ if (!(sch->flags & TCQ_F_INGRESS)) {
+ NL_SET_ERR_MSG(extack,
+ "Specified parent ID is reserved for ingress and clsact Qdiscs");
+ err = -EINVAL;
+ goto err_out3;
+ }
handle = TC_H_MAKE(TC_H_INGRESS, 0);
} else {
if (handle == 0) {
diff --git a/net/sched/sch_ingress.c b/net/sched/sch_ingress.c
index 35963929e1178..e43a454993723 100644
--- a/net/sched/sch_ingress.c
+++ b/net/sched/sch_ingress.c
@@ -140,7 +140,7 @@ static struct Qdisc_ops ingress_qdisc_ops __read_mostly = {
.cl_ops = &ingress_class_ops,
.id = "ingress",
.priv_size = sizeof(struct ingress_sched_data),
- .static_flags = TCQ_F_CPUSTATS,
+ .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS,
.init = ingress_init,
.destroy = ingress_destroy,
.dump = ingress_dump,
@@ -281,7 +281,7 @@ static struct Qdisc_ops clsact_qdisc_ops __read_mostly = {
.cl_ops = &clsact_class_ops,
.id = "clsact",
.priv_size = sizeof(struct clsact_sched_data),
- .static_flags = TCQ_F_CPUSTATS,
+ .static_flags = TCQ_F_INGRESS | TCQ_F_CPUSTATS,
.init = clsact_init,
.destroy = clsact_destroy,
.dump = ingress_dump,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 055/286] net/sched: Prohibit regrafting ingress or clsact Qdiscs
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 054/286] net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 056/286] net: sched: fix NULL pointer dereference in mq_attach Greg Kroah-Hartman
` (239 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pedro Tammela, Jamal Hadi Salim,
Vlad Buslov, Peilin Ye, Jakub Kicinski, Sasha Levin
From: Peilin Ye <peilin.ye@bytedance.com>
[ Upstream commit 9de95df5d15baa956c2b70b9e794842e790a8a13 ]
Currently, after creating an ingress (or clsact) Qdisc and grafting it
under TC_H_INGRESS (TC_H_CLSACT), it is possible to graft it again under
e.g. a TBF Qdisc:
$ ip link add ifb0 type ifb
$ tc qdisc add dev ifb0 handle 1: root tbf rate 20kbit buffer 1600 limit 3000
$ tc qdisc add dev ifb0 clsact
$ tc qdisc link dev ifb0 handle ffff: parent 1:1
$ tc qdisc show dev ifb0
qdisc tbf 1: root refcnt 2 rate 20Kbit burst 1600b lat 560.0ms
qdisc clsact ffff: parent ffff:fff1 refcnt 2
^^^^^^^^
clsact's refcount has increased: it is now grafted under both
TC_H_CLSACT and 1:1.
ingress and clsact Qdiscs should only be used under TC_H_INGRESS
(TC_H_CLSACT). Prohibit regrafting them.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: 1f211a1b929c ("net, sched: add clsact qdisc")
Tested-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Peilin Ye <peilin.ye@bytedance.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_api.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index b7c230f9c5b19..a686d7cae5130 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1594,6 +1594,11 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
NL_SET_ERR_MSG(extack, "Invalid qdisc name");
return -EINVAL;
}
+ if (q->flags & TCQ_F_INGRESS) {
+ NL_SET_ERR_MSG(extack,
+ "Cannot regraft ingress or clsact Qdiscs");
+ return -EINVAL;
+ }
if (q == p ||
(p && check_loop(q, p, 0))) {
NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected");
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 056/286] net: sched: fix NULL pointer dereference in mq_attach
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 055/286] net/sched: Prohibit regrafting ingress or clsact Qdiscs Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 057/286] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report Greg Kroah-Hartman
` (238 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengchao Shao, Peilin Ye,
Jamal Hadi Salim, Jakub Kicinski, Sasha Levin
From: Zhengchao Shao <shaozhengchao@huawei.com>
[ Upstream commit 36eec020fab668719b541f34d97f44e232ffa165 ]
When use the following command to test:
1)ip link add bond0 type bond
2)ip link set bond0 up
3)tc qdisc add dev bond0 root handle ffff: mq
4)tc qdisc replace dev bond0 parent ffff:fff1 handle ffff: mq
The kernel reports NULL pointer dereference issue. The stack information
is as follows:
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
Internal error: Oops: 0000000096000006 [#1] SMP
Modules linked in:
pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : mq_attach+0x44/0xa0
lr : qdisc_graft+0x20c/0x5cc
sp : ffff80000e2236a0
x29: ffff80000e2236a0 x28: ffff0000c0e59d80 x27: ffff0000c0be19c0
x26: ffff0000cae3e800 x25: 0000000000000010 x24: 00000000fffffff1
x23: 0000000000000000 x22: ffff0000cae3e800 x21: ffff0000c9df4000
x20: ffff0000c9df4000 x19: 0000000000000000 x18: ffff80000a934000
x17: ffff8000f5b56000 x16: ffff80000bb08000 x15: 0000000000000000
x14: 0000000000000000 x13: 6b6b6b6b6b6b6b6b x12: 6b6b6b6b00000001
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000c0be0730 x7 : bbbbbbbbbbbbbbbb x6 : 0000000000000008
x5 : ffff0000cae3e864 x4 : 0000000000000000 x3 : 0000000000000001
x2 : 0000000000000001 x1 : ffff8000090bc23c x0 : 0000000000000000
Call trace:
mq_attach+0x44/0xa0
qdisc_graft+0x20c/0x5cc
tc_modify_qdisc+0x1c4/0x664
rtnetlink_rcv_msg+0x354/0x440
netlink_rcv_skb+0x64/0x144
rtnetlink_rcv+0x28/0x34
netlink_unicast+0x1e8/0x2a4
netlink_sendmsg+0x308/0x4a0
sock_sendmsg+0x64/0xac
____sys_sendmsg+0x29c/0x358
___sys_sendmsg+0x90/0xd0
__sys_sendmsg+0x7c/0xd0
__arm64_sys_sendmsg+0x2c/0x38
invoke_syscall+0x54/0x114
el0_svc_common.constprop.1+0x90/0x174
do_el0_svc+0x3c/0xb0
el0_svc+0x24/0xec
el0t_64_sync_handler+0x90/0xb4
el0t_64_sync+0x174/0x178
This is because when mq is added for the first time, qdiscs in mq is set
to NULL in mq_attach(). Therefore, when replacing mq after adding mq, we
need to initialize qdiscs in the mq before continuing to graft. Otherwise,
it will couse NULL pointer dereference issue in mq_attach(). And the same
issue will occur in the attach functions of mqprio, taprio and htb.
ffff:fff1 means that the repalce qdisc is ingress. Ingress does not allow
any qdisc to be attached. Therefore, ffff:fff1 is incorrectly used, and
the command should be dropped.
Fixes: 6ec1c69a8f64 ("net_sched: add classful multiqueue dummy scheduler")
Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>
Tested-by: Peilin Ye <peilin.ye@bytedance.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20230527093747.3583502-1-shaozhengchao@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/sch_api.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index a686d7cae5130..7045b67b5533e 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1604,6 +1604,10 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n,
NL_SET_ERR_MSG(extack, "Qdisc parent/child loop detected");
return -ELOOP;
}
+ if (clid == TC_H_INGRESS) {
+ NL_SET_ERR_MSG(extack, "Ingress cannot graft directly");
+ return -EINVAL;
+ }
qdisc_refcount_inc(q);
goto graft;
} else {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 057/286] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 056/286] net: sched: fix NULL pointer dereference in mq_attach Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 058/286] udp6: Fix race condition in udp6_sendmsg & connect Greg Kroah-Hartman
` (237 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pedro Tammela, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Pedro Tammela <pctammela@mojatatu.com>
[ Upstream commit f4e4534850a9d18c250a93f8d7fbb51310828110 ]
The current code for the length calculation wrongly truncates the reported
length of the groups array, causing an under report of the subscribed
groups. To fix this, use 'BITS_TO_BYTES()' which rounds up the
division by 8.
Fixes: b42be38b2778 ("netlink: add API to retrieve all group memberships")
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230529153335.389815-1-pctammela@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netlink/af_netlink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 45d47b39de225..717e27a4b66a0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1779,7 +1779,7 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
break;
}
}
- if (put_user(ALIGN(nlk->ngroups / 8, sizeof(u32)), optlen))
+ if (put_user(ALIGN(BITS_TO_BYTES(nlk->ngroups), sizeof(u32)), optlen))
err = -EFAULT;
netlink_unlock_table();
return err;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 058/286] udp6: Fix race condition in udp6_sendmsg & connect
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 057/286] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 059/286] nfsd: fix double fget() bug in __write_ports_addfd() Greg Kroah-Hartman
` (236 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladislav Efanov, Paolo Abeni,
David S. Miller, Sasha Levin
From: Vladislav Efanov <VEfanov@ispras.ru>
[ Upstream commit 448a5ce1120c5bdbce1f1ccdabcd31c7d029f328 ]
Syzkaller got the following report:
BUG: KASAN: use-after-free in sk_setup_caps+0x621/0x690 net/core/sock.c:2018
Read of size 8 at addr ffff888027f82780 by task syz-executor276/3255
The function sk_setup_caps (called by ip6_sk_dst_store_flow->
ip6_dst_store) referenced already freed memory as this memory was
freed by parallel task in udpv6_sendmsg->ip6_sk_dst_lookup_flow->
sk_dst_check.
task1 (connect) task2 (udp6_sendmsg)
sk_setup_caps->sk_dst_set |
| sk_dst_check->
| sk_dst_set
| dst_release
sk_setup_caps references |
to already freed dst_entry|
The reason for this race condition is: sk_setup_caps() keeps using
the dst after transferring the ownership to the dst cache.
Found by Linux Verification Center (linuxtesting.org) with syzkaller.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Vladislav Efanov <VEfanov@ispras.ru>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/sock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/sock.c b/net/core/sock.c
index c258887953905..3fd71f343c9f2 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2386,7 +2386,6 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
{
u32 max_segs = 1;
- sk_dst_set(sk, dst);
sk->sk_route_caps = dst->dev->features;
if (sk_is_tcp(sk))
sk->sk_route_caps |= NETIF_F_GSO;
@@ -2405,6 +2404,7 @@ void sk_setup_caps(struct sock *sk, struct dst_entry *dst)
}
}
sk->sk_gso_max_segs = max_segs;
+ sk_dst_set(sk, dst);
}
EXPORT_SYMBOL_GPL(sk_setup_caps);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 059/286] nfsd: fix double fget() bug in __write_ports_addfd()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 058/286] udp6: Fix race condition in udp6_sendmsg & connect Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 060/286] HID: logitech-hidpp: Handle timeout differently from busy Greg Kroah-Hartman
` (235 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, NeilBrown,
Jeff Layton, Chuck Lever, Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit c034203b6a9dae6751ef4371c18cb77983e30c28 ]
The bug here is that you cannot rely on getting the same socket
from multiple calls to fget() because userspace can influence
that. This is a kind of double fetch bug.
The fix is to delete the svc_alien_sock() function and instead do
the checking inside the svc_addsock() function.
Fixes: 3064639423c4 ("nfsd: check passed socket's net matches NFSd superblock's one")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: NeilBrown <neilb@suse.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfsd/nfsctl.c | 7 +------
include/linux/sunrpc/svcsock.h | 7 +++----
net/sunrpc/svcsock.c | 24 ++++++------------------
3 files changed, 10 insertions(+), 28 deletions(-)
diff --git a/fs/nfsd/nfsctl.c b/fs/nfsd/nfsctl.c
index 7b8f17ee52243..ba07757f3cd0a 100644
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -702,16 +702,11 @@ static ssize_t __write_ports_addfd(char *buf, struct net *net, const struct cred
if (err != 0 || fd < 0)
return -EINVAL;
- if (svc_alien_sock(net, fd)) {
- printk(KERN_ERR "%s: socket net is different to NFSd's one\n", __func__);
- return -EINVAL;
- }
-
err = nfsd_create_serv(net);
if (err != 0)
return err;
- err = svc_addsock(nn->nfsd_serv, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
+ err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
if (err >= 0 &&
!nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
diff --git a/include/linux/sunrpc/svcsock.h b/include/linux/sunrpc/svcsock.h
index bcc555c7ae9c6..13aff355d5a13 100644
--- a/include/linux/sunrpc/svcsock.h
+++ b/include/linux/sunrpc/svcsock.h
@@ -59,10 +59,9 @@ int svc_recv(struct svc_rqst *, long);
int svc_send(struct svc_rqst *);
void svc_drop(struct svc_rqst *);
void svc_sock_update_bufs(struct svc_serv *serv);
-bool svc_alien_sock(struct net *net, int fd);
-int svc_addsock(struct svc_serv *serv, const int fd,
- char *name_return, const size_t len,
- const struct cred *cred);
+int svc_addsock(struct svc_serv *serv, struct net *net,
+ const int fd, char *name_return, const size_t len,
+ const struct cred *cred);
void svc_init_xprt_sock(void);
void svc_cleanup_xprt_sock(void);
struct svc_xprt *svc_sock_create(struct svc_serv *serv, int prot);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index bf2d2cdca1185..e2a94589dd5df 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1340,25 +1340,10 @@ static struct svc_sock *svc_setup_socket(struct svc_serv *serv,
return svsk;
}
-bool svc_alien_sock(struct net *net, int fd)
-{
- int err;
- struct socket *sock = sockfd_lookup(fd, &err);
- bool ret = false;
-
- if (!sock)
- goto out;
- if (sock_net(sock->sk) != net)
- ret = true;
- sockfd_put(sock);
-out:
- return ret;
-}
-EXPORT_SYMBOL_GPL(svc_alien_sock);
-
/**
* svc_addsock - add a listener socket to an RPC service
* @serv: pointer to RPC service to which to add a new listener
+ * @net: caller's network namespace
* @fd: file descriptor of the new listener
* @name_return: pointer to buffer to fill in with name of listener
* @len: size of the buffer
@@ -1368,8 +1353,8 @@ EXPORT_SYMBOL_GPL(svc_alien_sock);
* Name is terminated with '\n'. On error, returns a negative errno
* value.
*/
-int svc_addsock(struct svc_serv *serv, const int fd, char *name_return,
- const size_t len, const struct cred *cred)
+int svc_addsock(struct svc_serv *serv, struct net *net, const int fd,
+ char *name_return, const size_t len, const struct cred *cred)
{
int err = 0;
struct socket *so = sockfd_lookup(fd, &err);
@@ -1380,6 +1365,9 @@ int svc_addsock(struct svc_serv *serv, const int fd, char *name_return,
if (!so)
return err;
+ err = -EINVAL;
+ if (sock_net(so->sk) != net)
+ goto out;
err = -EAFNOSUPPORT;
if ((so->sk->sk_family != PF_INET) && (so->sk->sk_family != PF_INET6))
goto out;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 060/286] HID: logitech-hidpp: Handle timeout differently from busy
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 059/286] nfsd: fix double fget() bug in __write_ports_addfd() Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 061/286] nvme: fix the name of Zone Append for verbose logging Greg Kroah-Hartman
` (234 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bastien Nocera, Mark Lord,
Jiri Kosina, Sasha Levin
From: Bastien Nocera <hadess@hadess.net>
[ Upstream commit 6199d23c91ce53bfed455f09a8c5ed170d516824 ]
If an attempt at contacting a receiver or a device fails because the
receiver or device never responds, don't restart the communication, only
restart it if the receiver or device answers that it's busy, as originally
intended.
This was the behaviour on communication timeout before commit 586e8fede795
("HID: logitech-hidpp: Retry commands when device is busy").
This fixes some overly long waits in a critical path on boot, when
checking whether the device is connected by getting its HID++ version.
Signed-off-by: Bastien Nocera <hadess@hadess.net>
Suggested-by: Mark Lord <mlord@pobox.com>
Fixes: 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-logitech-hidpp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hid/hid-logitech-hidpp.c b/drivers/hid/hid-logitech-hidpp.c
index da89e84c9cbeb..0853114e16a08 100644
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -311,6 +311,7 @@ static int hidpp_send_message_sync(struct hidpp_device *hidpp,
dbg_hid("%s:timeout waiting for response\n", __func__);
memset(response, 0, sizeof(struct hidpp_report));
ret = -ETIMEDOUT;
+ goto exit;
}
if (response->report_id == REPORT_ID_HIDPP_SHORT &&
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 061/286] nvme: fix the name of Zone Append for verbose logging
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 060/286] HID: logitech-hidpp: Handle timeout differently from busy Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 062/286] net/mlx5e: Fix error handling in mlx5e_refresh_tirs Greg Kroah-Hartman
` (233 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Alan Adamson,
Keith Busch, Sasha Levin
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 856303797724d28f1d65b702f0eadcee1ea7abf5 ]
No Management involved in Zone Appened.
Fixes: bd83fe6f2cd2 ("nvme: add verbose error logging")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Alan Adamson <alan.adamson@oracle.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/constants.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/constants.c b/drivers/nvme/host/constants.c
index bc523ca022548..5e4f8848dce08 100644
--- a/drivers/nvme/host/constants.c
+++ b/drivers/nvme/host/constants.c
@@ -21,7 +21,7 @@ static const char * const nvme_ops[] = {
[nvme_cmd_resv_release] = "Reservation Release",
[nvme_cmd_zone_mgmt_send] = "Zone Management Send",
[nvme_cmd_zone_mgmt_recv] = "Zone Management Receive",
- [nvme_cmd_zone_append] = "Zone Management Append",
+ [nvme_cmd_zone_append] = "Zone Append",
};
static const char * const nvme_admin_ops[] = {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 062/286] net/mlx5e: Fix error handling in mlx5e_refresh_tirs
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 061/286] nvme: fix the name of Zone Append for verbose logging Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 063/286] net/mlx5: Read embedded cpu after init bit cleared Greg Kroah-Hartman
` (232 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Saeed Mahameed, Sasha Levin
From: Saeed Mahameed <saeedm@nvidia.com>
[ Upstream commit b6193d7030e3c59f1d4c75648c9c8fa40cad2bcd ]
Allocation failure is outside the critical lock section and should
return immediately rather than jumping to the unlock section.
Also unlock as soon as required and remove the now redundant jump label.
Fixes: 80a2a9026b24 ("net/mlx5e: Add a lock on tir list")
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_common.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
index 993af4c12d909..21cd232c2c20c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_common.c
@@ -149,10 +149,8 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb,
inlen = MLX5_ST_SZ_BYTES(modify_tir_in);
in = kvzalloc(inlen, GFP_KERNEL);
- if (!in) {
- err = -ENOMEM;
- goto out;
- }
+ if (!in)
+ return -ENOMEM;
if (enable_uc_lb)
lb_flags = MLX5_TIRC_SELF_LB_BLOCK_BLOCK_UNICAST;
@@ -170,14 +168,13 @@ int mlx5e_refresh_tirs(struct mlx5e_priv *priv, bool enable_uc_lb,
tirn = tir->tirn;
err = mlx5_core_modify_tir(mdev, tirn, in);
if (err)
- goto out;
+ break;
}
+ mutex_unlock(&mdev->mlx5e_res.hw_objs.td.list_lock);
-out:
kvfree(in);
if (err)
netdev_err(priv->netdev, "refresh tir(0x%x) failed, %d\n", tirn, err);
- mutex_unlock(&mdev->mlx5e_res.hw_objs.td.list_lock);
return err;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 063/286] net/mlx5: Read embedded cpu after init bit cleared
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 062/286] net/mlx5e: Fix error handling in mlx5e_refresh_tirs Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 064/286] sfc: fix error unwinds in TC offload Greg Kroah-Hartman
` (231 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moshe Shemesh, Shay Drory,
Saeed Mahameed, Sasha Levin
From: Moshe Shemesh <moshe@nvidia.com>
[ Upstream commit bbfa4b58997e3d38ba629c9f6fc0bd1c163aaf43 ]
During driver load it reads embedded_cpu bit from initialization
segment, but the initialization segment is readable only after
initialization bit is cleared.
Move the call to mlx5_read_embedded_cpu() right after initialization bit
cleared.
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Fixes: 591905ba9679 ("net/mlx5: Introduce Mellanox SmartNIC and modify page management logic")
Reviewed-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
index 504179dbff9dd..9058fa8c5b657 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
@@ -913,7 +913,6 @@ static int mlx5_pci_init(struct mlx5_core_dev *dev, struct pci_dev *pdev,
}
mlx5_pci_vsc_init(dev);
- dev->caps.embedded_cpu = mlx5_read_embedded_cpu(dev);
return 0;
err_clr_master:
@@ -1147,6 +1146,7 @@ static int mlx5_function_setup(struct mlx5_core_dev *dev, bool boot, u64 timeout
goto err_cmd_cleanup;
}
+ dev->caps.embedded_cpu = mlx5_read_embedded_cpu(dev);
mlx5_cmd_set_state(dev, MLX5_CMDIF_STATE_UP);
mlx5_start_health_poll(dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 064/286] sfc: fix error unwinds in TC offload
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 063/286] net/mlx5: Read embedded cpu after init bit cleared Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 065/286] iommu/mediatek: Flush IOTLB completely only if domain has been attached Greg Kroah-Hartman
` (230 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Edward Cree, Simon Horman, Jakub Kicinski, Sasha Levin
From: Edward Cree <ecree.xilinx@gmail.com>
[ Upstream commit 622ab656344a288acf4fb03d628c3bb5dd241f34 ]
Failure ladders weren't exactly unwinding what the function had done up
to that point; most seriously, when we encountered an already offloaded
rule, the failure path tried to remove the new rule from the hashtable,
which would in fact remove the already-present 'old' rule (since it has
the same key) from the table, and leak its resources.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202305200745.xmIlkqjH-lkp@intel.com/
Fixes: d902e1a737d4 ("sfc: bare bones TC offload on EF100")
Fixes: 17654d84b47c ("sfc: add offloading of 'foreign' TC (decap) rules")
Signed-off-by: Edward Cree <ecree.xilinx@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230530202527.53115-1-edward.cree@amd.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/sfc/tc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/sfc/tc.c b/drivers/net/ethernet/sfc/tc.c
index deeaab9ee761d..217f3876af722 100644
--- a/drivers/net/ethernet/sfc/tc.c
+++ b/drivers/net/ethernet/sfc/tc.c
@@ -379,9 +379,9 @@ static int efx_tc_flower_replace(struct efx_nic *efx,
if (old) {
netif_dbg(efx, drv, efx->net_dev,
"Already offloaded rule (cookie %lx)\n", tc->cookie);
- rc = -EEXIST;
NL_SET_ERR_MSG_MOD(extack, "Rule already offloaded");
- goto release;
+ kfree(rule);
+ return -EEXIST;
}
/* Parse actions */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 065/286] iommu/mediatek: Flush IOTLB completely only if domain has been attached
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 064/286] sfc: fix error unwinds in TC offload Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 066/286] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Greg Kroah-Hartman
` (229 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Yong Wu,
AngeloGioacchino Del Regno, Joerg Roedel, Sasha Levin
From: Chen-Yu Tsai <wenst@chromium.org>
[ Upstream commit b3fc95709c54ffbe80f16801e0a792a4d2b3d55e ]
If an IOMMU domain was never attached, it lacks any linkage to the
actual IOMMU hardware. Attempting to do flush_iotlb_all() on it will
result in a NULL pointer dereference. This seems to happen after the
recent IOMMU core rework in v6.4-rc1.
Unable to handle kernel read from unreadable memory at virtual address 0000000000000018
Call trace:
mtk_iommu_flush_iotlb_all+0x20/0x80
iommu_create_device_direct_mappings.part.0+0x13c/0x230
iommu_setup_default_domain+0x29c/0x4d0
iommu_probe_device+0x12c/0x190
of_iommu_configure+0x140/0x208
of_dma_configure_id+0x19c/0x3c0
platform_dma_configure+0x38/0x88
really_probe+0x78/0x2c0
Check if the "bank" field has been filled in before actually attempting
the IOTLB flush to avoid it. The IOTLB is also flushed when the device
comes out of runtime suspend, so it should have a clean initial state.
Fixes: 08500c43d4f7 ("iommu/mediatek: Adjust the structure")
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Yong Wu <yong.wu@mediatek.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20230526085402.394239-1-wenst@chromium.org
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iommu/mtk_iommu.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c
index 6a00ce208dc2b..248b8c2bc4071 100644
--- a/drivers/iommu/mtk_iommu.c
+++ b/drivers/iommu/mtk_iommu.c
@@ -738,7 +738,8 @@ static void mtk_iommu_flush_iotlb_all(struct iommu_domain *domain)
{
struct mtk_iommu_domain *dom = to_mtk_domain(domain);
- mtk_iommu_tlb_flush_all(dom->bank->parent_data);
+ if (dom->bank)
+ mtk_iommu_tlb_flush_all(dom->bank->parent_data);
}
static void mtk_iommu_iotlb_sync(struct iommu_domain *domain,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 066/286] net/sched: flower: fix possible OOB write in fl_set_geneve_opt()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 065/286] iommu/mediatek: Flush IOTLB completely only if domain has been attached Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 067/286] tcp: fix mishandling when the sack compression is deferred Greg Kroah-Hartman
` (228 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangyu Hua, Simon Horman,
Pieter Jansen van Vuuren, Paolo Abeni, Sasha Levin
From: Hangyu Hua <hbh25y@gmail.com>
[ Upstream commit 4d56304e5827c8cc8cc18c75343d283af7c4825c ]
If we send two TCA_FLOWER_KEY_ENC_OPTS_GENEVE packets and their total
size is 252 bytes(key->enc_opts.len = 252) then
key->enc_opts.len = opt->length = data_len / 4 = 0 when the third
TCA_FLOWER_KEY_ENC_OPTS_GENEVE packet enters fl_set_geneve_opt. This
bypasses the next bounds check and results in an out-of-bounds.
Fixes: 0a6e77784f49 ("net/sched: allow flower to match tunnel options")
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Reviewed-by: Pieter Jansen van Vuuren <pieter.jansen-van-vuuren@amd.com>
Link: https://lore.kernel.org/r/20230531102805.27090-1-hbh25y@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/cls_flower.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index a1c4ee2e0be22..fd5dc47cb2134 100644
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -1153,6 +1153,9 @@ static int fl_set_geneve_opt(const struct nlattr *nla, struct fl_flow_key *key,
if (option_len > sizeof(struct geneve_opt))
data_len = option_len - sizeof(struct geneve_opt);
+ if (key->enc_opts.len > FLOW_DIS_TUN_OPTS_MAX - 4)
+ return -ERANGE;
+
opt = (struct geneve_opt *)&key->enc_opts.data[key->enc_opts.len];
memset(opt, 0xff, option_len);
opt->length = data_len / 4;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 067/286] tcp: fix mishandling when the sack compression is deferred.
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 066/286] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 068/286] net: ipa: Use correct value for IPA_STATUS_SIZE Greg Kroah-Hartman
` (227 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, fuyuanli, Jason Xing,
Paolo Abeni, Sasha Levin
From: fuyuanli <fuyuanli@didiglobal.com>
[ Upstream commit 30c6f0bf9579debce27e45fac34fdc97e46acacc ]
In this patch, we mainly try to handle sending a compressed ack
correctly if it's deferred.
Here are more details in the old logic:
When sack compression is triggered in the tcp_compressed_ack_kick(),
if the sock is owned by user, it will set TCP_DELACK_TIMER_DEFERRED
and then defer to the release cb phrase. Later once user releases
the sock, tcp_delack_timer_handler() should send a ack as expected,
which, however, cannot happen due to lack of ICSK_ACK_TIMER flag.
Therefore, the receiver would not sent an ack until the sender's
retransmission timeout. It definitely increases unnecessary latency.
Fixes: 5d9f4262b7ea ("tcp: add SACK compression")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: fuyuanli <fuyuanli@didiglobal.com>
Signed-off-by: Jason Xing <kerneljasonxing@gmail.com>
Link: https://lore.kernel.org/netdev/20230529113804.GA20300@didi-ThinkCentre-M920t-N000/
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20230531080150.GA20424@didi-ThinkCentre-M920t-N000
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/tcp.h | 1 +
net/ipv4/tcp_input.c | 2 +-
net/ipv4/tcp_timer.c | 16 +++++++++++++---
3 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/include/net/tcp.h b/include/net/tcp.h
index 76bf0a11bdc77..99c74fc300839 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -632,6 +632,7 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb);
void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb);
void tcp_fin(struct sock *sk);
void tcp_check_space(struct sock *sk);
+void tcp_sack_compress_send_ack(struct sock *sk);
/* tcp_timer.c */
void tcp_init_xmit_timers(struct sock *);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 10776c54ff784..dee174c40e874 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4530,7 +4530,7 @@ static void tcp_sack_maybe_coalesce(struct tcp_sock *tp)
}
}
-static void tcp_sack_compress_send_ack(struct sock *sk)
+void tcp_sack_compress_send_ack(struct sock *sk)
{
struct tcp_sock *tp = tcp_sk(sk);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index cb79127f45c34..0b5d0a2867a8c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -290,9 +290,19 @@ static int tcp_write_timeout(struct sock *sk)
void tcp_delack_timer_handler(struct sock *sk)
{
struct inet_connection_sock *icsk = inet_csk(sk);
+ struct tcp_sock *tp = tcp_sk(sk);
- if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ||
- !(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
+ if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
+ return;
+
+ /* Handling the sack compression case */
+ if (tp->compressed_ack) {
+ tcp_mstamp_refresh(tp);
+ tcp_sack_compress_send_ack(sk);
+ return;
+ }
+
+ if (!(icsk->icsk_ack.pending & ICSK_ACK_TIMER))
return;
if (time_after(icsk->icsk_ack.timeout, jiffies)) {
@@ -312,7 +322,7 @@ void tcp_delack_timer_handler(struct sock *sk)
inet_csk_exit_pingpong_mode(sk);
icsk->icsk_ack.ato = TCP_ATO_MIN;
}
- tcp_mstamp_refresh(tcp_sk(sk));
+ tcp_mstamp_refresh(tp);
tcp_send_ack(sk);
__NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKS);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 068/286] net: ipa: Use correct value for IPA_STATUS_SIZE
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 067/286] tcp: fix mishandling when the sack compression is deferred Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 069/286] net: dsa: mv88e6xxx: Increase wait after reset deactivation Greg Kroah-Hartman
` (226 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bert Karwatzki, Simon Horman,
Paolo Abeni, Sasha Levin
From: Bert Karwatzki <spasswolf@web.de>
[ Upstream commit be7f8012a513f5099916ee2da28420156cbb8cf3 ]
IPA_STATUS_SIZE was introduced in commit b8dc7d0eea5a as a replacement
for the size of the removed struct ipa_status which had size
sizeof(__le32[8]). Use this value as IPA_STATUS_SIZE.
Fixes: b8dc7d0eea5a ("net: ipa: stop using sizeof(status)")
Signed-off-by: Bert Karwatzki <spasswolf@web.de>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230531103618.102608-1-spasswolf@web.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ipa/ipa_endpoint.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ipa/ipa_endpoint.c b/drivers/net/ipa/ipa_endpoint.c
index 2ee80ed140b72..afa1d56d9095c 100644
--- a/drivers/net/ipa/ipa_endpoint.c
+++ b/drivers/net/ipa/ipa_endpoint.c
@@ -119,7 +119,7 @@ enum ipa_status_field_id {
};
/* Size in bytes of an IPA packet status structure */
-#define IPA_STATUS_SIZE sizeof(__le32[4])
+#define IPA_STATUS_SIZE sizeof(__le32[8])
/* IPA status structure decoder; looks up field values for a structure */
static u32 ipa_status_extract(struct ipa *ipa, const void *data,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 069/286] net: dsa: mv88e6xxx: Increase wait after reset deactivation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 068/286] net: ipa: Use correct value for IPA_STATUS_SIZE Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 070/286] mtd: rawnand: marvell: ensure timing values are written Greg Kroah-Hartman
` (225 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andreas Svensson, Andrew Lunn,
Paolo Abeni, Sasha Levin
From: Andreas Svensson <andreas.svensson@axis.com>
[ Upstream commit 3c27f3d53d588618d81d30d6712459a3cc9489b8 ]
A switch held in reset by default needs to wait longer until we can
reliably detect it.
An issue was observed when testing on the Marvell 88E6393X (Link Street).
The driver failed to detect the switch on some upstarts. Increasing the
wait time after reset deactivation solves this issue.
The updated wait time is now also the same as the wait time in the
mv88e6xxx_hardware_reset function.
Fixes: 7b75e49de424 ("net: dsa: mv88e6xxx: wait after reset deactivation")
Signed-off-by: Andreas Svensson <andreas.svensson@axis.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/20230530145223.1223993-1-andreas.svensson@axis.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/mv88e6xxx/chip.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index 902f407213404..39770a5b74e2e 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c
@@ -7158,7 +7158,7 @@ static int mv88e6xxx_probe(struct mdio_device *mdiodev)
goto out;
}
if (chip->reset)
- usleep_range(1000, 2000);
+ usleep_range(10000, 20000);
/* Detect if the device is configured in single chip addressing mode,
* otherwise continue with address specific smi init/detection.
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 070/286] mtd: rawnand: marvell: ensure timing values are written
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 069/286] net: dsa: mv88e6xxx: Increase wait after reset deactivation Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 071/286] mtd: rawnand: marvell: dont set the NAND frequency select Greg Kroah-Hartman
` (224 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Chris Packham,
Sasha Levin
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
[ Upstream commit 8a6f4d346f3bad9c68b4a87701eb3f7978542d57 ]
When new timing values are calculated in marvell_nfc_setup_interface()
ensure that they will be applied in marvell_nfc_select_target() by
clearing the selected_chip pointer.
Fixes: b25251414f6e ("mtd: rawnand: marvell: Stop implementing ->select_chip()")
Suggested-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230525003154.2303012-1-chris.packham@alliedtelesis.co.nz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 3034916d2e252..52342f2c126da 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2457,6 +2457,12 @@ static int marvell_nfc_setup_interface(struct nand_chip *chip, int chipnr,
NDTR1_WAIT_MODE;
}
+ /*
+ * Reset nfc->selected_chip so the next command will cause the timing
+ * registers to be updated in marvell_nfc_select_target().
+ */
+ nfc->selected_chip = NULL;
+
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 071/286] mtd: rawnand: marvell: dont set the NAND frequency select
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 070/286] mtd: rawnand: marvell: ensure timing values are written Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 072/286] net: renesas: rswitch: Fix return value in error path of xmit Greg Kroah-Hartman
` (223 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Packham, Miquel Raynal,
Sasha Levin
From: Chris Packham <chris.packham@alliedtelesis.co.nz>
[ Upstream commit c4d28e30a8d0b979e4029465ab8f312ab6ce2644 ]
marvell_nfc_setup_interface() uses the frequency retrieved from the
clock associated with the nand interface to determine the timings that
will be used. By changing the NAND frequency select without reflecting
this in the clock configuration this means that the timings calculated
don't correctly meet the requirements of the NAND chip. This hasn't been
an issue up to now because of a different bug that was stopping the
timings being updated after they were initially set.
Fixes: b25251414f6e ("mtd: rawnand: marvell: Stop implementing ->select_chip()")
Signed-off-by: Chris Packham <chris.packham@alliedtelesis.co.nz>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230525003154.2303012-2-chris.packham@alliedtelesis.co.nz
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/mtd/nand/raw/marvell_nand.c b/drivers/mtd/nand/raw/marvell_nand.c
index 52342f2c126da..2d34c2cb0f7ae 100644
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -2900,10 +2900,6 @@ static int marvell_nfc_init(struct marvell_nfc *nfc)
regmap_update_bits(sysctrl_base, GENCONF_CLK_GATING_CTRL,
GENCONF_CLK_GATING_CTRL_ND_GATE,
GENCONF_CLK_GATING_CTRL_ND_GATE);
-
- regmap_update_bits(sysctrl_base, GENCONF_ND_CLK_CTRL,
- GENCONF_ND_CLK_CTRL_EN,
- GENCONF_ND_CLK_CTRL_EN);
}
/* Configure the DMA if appropriate */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 072/286] net: renesas: rswitch: Fix return value in error path of xmit
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 071/286] mtd: rawnand: marvell: dont set the NAND frequency select Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 073/286] net: phy: mxl-gpy: extend interrupt fix to all impacted variants Greg Kroah-Hartman
` (222 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yoshihiro Shimoda, Jakub Kicinski,
Sasha Levin
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
[ Upstream commit a60caf039e96d806b1ced893242bae82ba3ccf0d ]
Fix return value in the error path of rswitch_start_xmit(). If TX
queues are full, this function should return NETDEV_TX_BUSY.
Fixes: 3590918b5d07 ("net: ethernet: renesas: Add support for "Ethernet Switch"")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://lore.kernel.org/r/20230529073817.1145208-1-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/renesas/rswitch.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/renesas/rswitch.c b/drivers/net/ethernet/renesas/rswitch.c
index c4f93d24c6a42..7855d9ef81eb1 100644
--- a/drivers/net/ethernet/renesas/rswitch.c
+++ b/drivers/net/ethernet/renesas/rswitch.c
@@ -1487,7 +1487,7 @@ static netdev_tx_t rswitch_start_xmit(struct sk_buff *skb, struct net_device *nd
if (rswitch_get_num_cur_queues(gq) >= gq->ring_size - 1) {
netif_stop_subqueue(ndev, 0);
- return ret;
+ return NETDEV_TX_BUSY;
}
if (skb_put_padto(skb, ETH_ZLEN))
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 073/286] net: phy: mxl-gpy: extend interrupt fix to all impacted variants
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 072/286] net: renesas: rswitch: Fix return value in error path of xmit Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 074/286] ice: recycle/free all of the fragments from multi-buffer frame Greg Kroah-Hartman
` (221 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xu Liang, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Xu Liang <lxu@maxlinear.com>
[ Upstream commit 519d6487640835d19461817c75907e6308074a73 ]
The interrupt fix in commit 97a89ed101bb should be applied on all variants
of GPY2xx PHY and GPY115C.
Fixes: 97a89ed101bb ("net: phy: mxl-gpy: disable interrupts on GPY215 by default")
Signed-off-by: Xu Liang <lxu@maxlinear.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Link: https://lore.kernel.org/r/20230531074822.39136-1-lxu@maxlinear.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/mxl-gpy.c | 16 +++-------------
1 file changed, 3 insertions(+), 13 deletions(-)
diff --git a/drivers/net/phy/mxl-gpy.c b/drivers/net/phy/mxl-gpy.c
index e5972b4ef6e8f..4041ebd7ad9b3 100644
--- a/drivers/net/phy/mxl-gpy.c
+++ b/drivers/net/phy/mxl-gpy.c
@@ -267,13 +267,6 @@ static int gpy_config_init(struct phy_device *phydev)
return ret < 0 ? ret : 0;
}
-static bool gpy_has_broken_mdint(struct phy_device *phydev)
-{
- /* At least these PHYs are known to have broken interrupt handling */
- return phydev->drv->phy_id == PHY_ID_GPY215B ||
- phydev->drv->phy_id == PHY_ID_GPY215C;
-}
-
static int gpy_probe(struct phy_device *phydev)
{
struct device *dev = &phydev->mdio.dev;
@@ -293,8 +286,7 @@ static int gpy_probe(struct phy_device *phydev)
phydev->priv = priv;
mutex_init(&priv->mbox_lock);
- if (gpy_has_broken_mdint(phydev) &&
- !device_property_present(dev, "maxlinear,use-broken-interrupts"))
+ if (!device_property_present(dev, "maxlinear,use-broken-interrupts"))
phydev->dev_flags |= PHY_F_NO_IRQ;
fw_version = phy_read(phydev, PHY_FWV);
@@ -652,11 +644,9 @@ static irqreturn_t gpy_handle_interrupt(struct phy_device *phydev)
* frame. Therefore, polling is the best we can do and won't do any more
* harm.
* It was observed that this bug happens on link state and link speed
- * changes on a GPY215B and GYP215C independent of the firmware version
- * (which doesn't mean that this list is exhaustive).
+ * changes independent of the firmware version.
*/
- if (gpy_has_broken_mdint(phydev) &&
- (reg & (PHY_IMASK_LSTC | PHY_IMASK_LSPC))) {
+ if (reg & (PHY_IMASK_LSTC | PHY_IMASK_LSPC)) {
reg = gpy_mbox_read(phydev, REG_GPIO0_OUT);
if (reg < 0) {
phy_error(phydev);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 074/286] ice: recycle/free all of the fragments from multi-buffer frame
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 073/286] net: phy: mxl-gpy: extend interrupt fix to all impacted variants Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 075/286] rtnetlink: call validate_linkmsg in rtnl_create_link Greg Kroah-Hartman
` (220 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Fijalkowski, Simon Horman,
Tony Nguyen, Jakub Kicinski, Sasha Levin, Chandan Kumar Rout
From: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
[ Upstream commit abaf8d51b0cedb16af51fb6b2189370d7515977c ]
The ice driver caches next_to_clean value at the beginning of
ice_clean_rx_irq() in order to remember the first buffer that has to be
freed/recycled after main Rx processing loop. The end boundary is
indicated by first descriptor of frame that Rx processing loop has ended
its duties. Note that if mentioned loop ended in the middle of gathering
multi-buffer frame, next_to_clean would be pointing to the descriptor in
the middle of the frame BUT freeing/recycling stage will stop at the
first descriptor. This means that next iteration of ice_clean_rx_irq()
will miss the (first_desc, next_to_clean - 1) entries.
When running various 9K MTU workloads, such splats were observed:
[ 540.780716] BUG: kernel NULL pointer dereference, address: 0000000000000000
[ 540.787787] #PF: supervisor read access in kernel mode
[ 540.793002] #PF: error_code(0x0000) - not-present page
[ 540.798218] PGD 0 P4D 0
[ 540.800801] Oops: 0000 [#1] PREEMPT SMP NOPTI
[ 540.805231] CPU: 18 PID: 3984 Comm: xskxceiver Tainted: G W 6.3.0-rc7+ #96
[ 540.813619] Hardware name: Intel Corporation S2600WFT/S2600WFT, BIOS SE5C620.86B.02.01.0008.031920191559 03/19/2019
[ 540.824209] RIP: 0010:ice_clean_rx_irq+0x2b6/0xf00 [ice]
[ 540.829678] Code: 74 24 10 e9 aa 00 00 00 8b 55 78 41 31 57 10 41 09 c4 4d 85 ff 0f 84 83 00 00 00 49 8b 57 08 41 8b 4f 1c 65 8b 35 1a fa 4b 3f <48> 8b 02 48 c1 e8 3a 39 c6 0f 85 a2 00 00 00 f6 42 08 02 0f 85 98
[ 540.848717] RSP: 0018:ffffc9000f42fc50 EFLAGS: 00010282
[ 540.854029] RAX: 0000000000000004 RBX: 0000000000000002 RCX: 000000000000fffe
[ 540.861272] RDX: 0000000000000000 RSI: 0000000000000001 RDI: 00000000ffffffff
[ 540.868519] RBP: ffff88984a05ac00 R08: 0000000000000000 R09: dead000000000100
[ 540.875760] R10: ffff88983fffcd00 R11: 000000000010f2b8 R12: 0000000000000004
[ 540.883008] R13: 0000000000000003 R14: 0000000000000800 R15: ffff889847a10040
[ 540.890253] FS: 00007f6ddf7fe640(0000) GS:ffff88afdf800000(0000) knlGS:0000000000000000
[ 540.898465] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 540.904299] CR2: 0000000000000000 CR3: 000000010d3da001 CR4: 00000000007706e0
[ 540.911542] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 540.918789] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 540.926032] PKRU: 55555554
[ 540.928790] Call Trace:
[ 540.931276] <TASK>
[ 540.933418] ice_napi_poll+0x4ca/0x6d0 [ice]
[ 540.937804] ? __pfx_ice_napi_poll+0x10/0x10 [ice]
[ 540.942716] napi_busy_loop+0xd7/0x320
[ 540.946537] xsk_recvmsg+0x143/0x170
[ 540.950178] sock_recvmsg+0x99/0xa0
[ 540.953729] __sys_recvfrom+0xa8/0x120
[ 540.957543] ? do_futex+0xbd/0x1d0
[ 540.961008] ? __x64_sys_futex+0x73/0x1d0
[ 540.965083] __x64_sys_recvfrom+0x20/0x30
[ 540.969155] do_syscall_64+0x38/0x90
[ 540.972796] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 540.977934] RIP: 0033:0x7f6de5f27934
To fix this, set cached_ntc to first_desc so that at the end, when
freeing/recycling buffers, descriptors from first to ntc are not missed.
Fixes: 2fba7dc5157b ("ice: Add support for XDP multi-buffer on Rx side")
Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Link: https://lore.kernel.org/r/20230531154457.3216621-1-anthony.l.nguyen@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index 059bd911c51d8..52d0a126eb616 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -1152,11 +1152,11 @@ int ice_clean_rx_irq(struct ice_rx_ring *rx_ring, int budget)
unsigned int total_rx_bytes = 0, total_rx_pkts = 0;
unsigned int offset = rx_ring->rx_offset;
struct xdp_buff *xdp = &rx_ring->xdp;
+ u32 cached_ntc = rx_ring->first_desc;
struct ice_tx_ring *xdp_ring = NULL;
struct bpf_prog *xdp_prog = NULL;
u32 ntc = rx_ring->next_to_clean;
u32 cnt = rx_ring->count;
- u32 cached_ntc = ntc;
u32 xdp_xmit = 0;
u32 cached_ntu;
bool failure;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 075/286] rtnetlink: call validate_linkmsg in rtnl_create_link
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 074/286] ice: recycle/free all of the fragments from multi-buffer frame Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 076/286] rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg Greg Kroah-Hartman
` (219 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit b0ad3c179059089d809b477a1d445c1183a7b8fe ]
validate_linkmsg() was introduced by commit 1840bb13c22f5b ("[RTNL]:
Validate hardware and broadcast address attribute for RTM_NEWLINK")
to validate tb[IFLA_ADDRESS/BROADCAST] for existing links. The same
check should also be done for newly created links.
This patch adds validate_linkmsg() call in rtnl_create_link(), to
avoid the invalid address set when creating some devices like:
# ip link add dummy0 type dummy
# ip link add link dummy0 name mac0 address 01:02 type macsec
Fixes: 0e06877c6fdb ("[RTNETLINK]: rtnl_link: allow specifying initial device address")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 6e44e92ebdf5d..f37deb18dd02e 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -3282,6 +3282,7 @@ struct net_device *rtnl_create_link(struct net *net, const char *ifname,
struct net_device *dev;
unsigned int num_tx_queues = 1;
unsigned int num_rx_queues = 1;
+ int err;
if (tb[IFLA_NUM_TX_QUEUES])
num_tx_queues = nla_get_u32(tb[IFLA_NUM_TX_QUEUES]);
@@ -3317,13 +3318,18 @@ struct net_device *rtnl_create_link(struct net *net, const char *ifname,
if (!dev)
return ERR_PTR(-ENOMEM);
+ err = validate_linkmsg(dev, tb, extack);
+ if (err < 0) {
+ free_netdev(dev);
+ return ERR_PTR(err);
+ }
+
dev_net_set(dev, net);
dev->rtnl_link_ops = ops;
dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
if (tb[IFLA_MTU]) {
u32 mtu = nla_get_u32(tb[IFLA_MTU]);
- int err;
err = dev_validate_mtu(dev, mtu, extack);
if (err) {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 076/286] rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 075/286] rtnetlink: call validate_linkmsg in rtnl_create_link Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 077/286] rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg Greg Kroah-Hartman
` (218 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xin Long, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit fef5b228dd38378148bc850f7e69a7783f3b95a4 ]
These IFLA_GSO_* tb check should also be done for the new created link,
otherwise, they can be set to a huge value when creating links:
# ip link add dummy1 gso_max_size 4294967295 type dummy
# ip -d link show dummy1
dummy addrgenmode eui64 ... gso_max_size 4294967295
Fixes: 46e6b992c250 ("rtnetlink: allow GSO maximums to be set on device creation")
Fixes: 9eefedd58ae1 ("net: add gso_ipv4_max_size and gro_ipv4_max_size per device")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 34 +++++++++++++++++++---------------
1 file changed, 19 insertions(+), 15 deletions(-)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f37deb18dd02e..7094569009b14 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2382,6 +2382,25 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[],
if (tb[IFLA_BROADCAST] &&
nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
return -EINVAL;
+
+ if (tb[IFLA_GSO_MAX_SIZE] &&
+ nla_get_u32(tb[IFLA_GSO_MAX_SIZE]) > dev->tso_max_size) {
+ NL_SET_ERR_MSG(extack, "too big gso_max_size");
+ return -EINVAL;
+ }
+
+ if (tb[IFLA_GSO_MAX_SEGS] &&
+ (nla_get_u32(tb[IFLA_GSO_MAX_SEGS]) > GSO_MAX_SEGS ||
+ nla_get_u32(tb[IFLA_GSO_MAX_SEGS]) > dev->tso_max_segs)) {
+ NL_SET_ERR_MSG(extack, "too big gso_max_segs");
+ return -EINVAL;
+ }
+
+ if (tb[IFLA_GSO_IPV4_MAX_SIZE] &&
+ nla_get_u32(tb[IFLA_GSO_IPV4_MAX_SIZE]) > dev->tso_max_size) {
+ NL_SET_ERR_MSG(extack, "too big gso_ipv4_max_size");
+ return -EINVAL;
+ }
}
if (tb[IFLA_AF_SPEC]) {
@@ -2855,11 +2874,6 @@ static int do_setlink(const struct sk_buff *skb,
if (tb[IFLA_GSO_MAX_SIZE]) {
u32 max_size = nla_get_u32(tb[IFLA_GSO_MAX_SIZE]);
- if (max_size > dev->tso_max_size) {
- err = -EINVAL;
- goto errout;
- }
-
if (dev->gso_max_size ^ max_size) {
netif_set_gso_max_size(dev, max_size);
status |= DO_SETLINK_MODIFIED;
@@ -2869,11 +2883,6 @@ static int do_setlink(const struct sk_buff *skb,
if (tb[IFLA_GSO_MAX_SEGS]) {
u32 max_segs = nla_get_u32(tb[IFLA_GSO_MAX_SEGS]);
- if (max_segs > GSO_MAX_SEGS || max_segs > dev->tso_max_segs) {
- err = -EINVAL;
- goto errout;
- }
-
if (dev->gso_max_segs ^ max_segs) {
netif_set_gso_max_segs(dev, max_segs);
status |= DO_SETLINK_MODIFIED;
@@ -2892,11 +2901,6 @@ static int do_setlink(const struct sk_buff *skb,
if (tb[IFLA_GSO_IPV4_MAX_SIZE]) {
u32 max_size = nla_get_u32(tb[IFLA_GSO_IPV4_MAX_SIZE]);
- if (max_size > dev->tso_max_size) {
- err = -EINVAL;
- goto errout;
- }
-
if (dev->gso_ipv4_max_size ^ max_size) {
netif_set_gso_ipv4_max_size(dev, max_size);
status |= DO_SETLINK_MODIFIED;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 077/286] rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 076/286] rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 078/286] mptcp: avoid unneeded __mptcp_nmpc_socket() usage Greg Kroah-Hartman
` (217 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiumei Mu, Xin Long, Simon Horman,
Jakub Kicinski, Sasha Levin
From: Xin Long <lucien.xin@gmail.com>
[ Upstream commit 65d6914e253f3d83b724a9bbfc889ae95711e512 ]
This fixes the issue that dev gro_max_size and gso_ipv4_max_size
can be set to a huge value:
# ip link add dummy1 type dummy
# ip link set dummy1 gro_max_size 4294967295
# ip -d link show dummy1
dummy addrgenmode eui64 ... gro_max_size 4294967295
Fixes: 0fe79f28bfaf ("net: allow gro_max_size to exceed 65536")
Fixes: 9eefedd58ae1 ("net: add gso_ipv4_max_size and gro_ipv4_max_size per device")
Reported-by: Xiumei Mu <xmu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/rtnetlink.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 7094569009b14..f235cc6832767 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2396,11 +2396,23 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[],
return -EINVAL;
}
+ if (tb[IFLA_GRO_MAX_SIZE] &&
+ nla_get_u32(tb[IFLA_GRO_MAX_SIZE]) > GRO_MAX_SIZE) {
+ NL_SET_ERR_MSG(extack, "too big gro_max_size");
+ return -EINVAL;
+ }
+
if (tb[IFLA_GSO_IPV4_MAX_SIZE] &&
nla_get_u32(tb[IFLA_GSO_IPV4_MAX_SIZE]) > dev->tso_max_size) {
NL_SET_ERR_MSG(extack, "too big gso_ipv4_max_size");
return -EINVAL;
}
+
+ if (tb[IFLA_GRO_IPV4_MAX_SIZE] &&
+ nla_get_u32(tb[IFLA_GRO_IPV4_MAX_SIZE]) > GRO_MAX_SIZE) {
+ NL_SET_ERR_MSG(extack, "too big gro_ipv4_max_size");
+ return -EINVAL;
+ }
}
if (tb[IFLA_AF_SPEC]) {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 078/286] mptcp: avoid unneeded __mptcp_nmpc_socket() usage
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 077/286] rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 079/286] mptcp: add annotations around msk->subflow accesses Greg Kroah-Hartman
` (216 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts,
David S. Miller, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 617612316953093bc859890e405e1b550c27d840 ]
In a few spots, the mptcp code invokes the __mptcp_nmpc_socket() helper
multiple times under the same socket lock scope. Additionally, in such
places, the socket status ensures that there is no MP capable handshake
running.
Under the above condition we can replace the later __mptcp_nmpc_socket()
helper invocation with direct access to the msk->subflow pointer and
better document such access is not supposed to fail with WARN().
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 5b825727d087 ("mptcp: add annotations around msk->subflow accesses")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index b998e9df53cef..676a6d24b4b71 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3157,7 +3157,7 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
struct socket *listener;
struct sock *newsk;
- listener = __mptcp_nmpc_socket(msk);
+ listener = msk->subflow;
if (WARN_ON_ONCE(!listener)) {
*err = -EINVAL;
return NULL;
@@ -3377,7 +3377,7 @@ static int mptcp_get_port(struct sock *sk, unsigned short snum)
struct mptcp_sock *msk = mptcp_sk(sk);
struct socket *ssock;
- ssock = __mptcp_nmpc_socket(msk);
+ ssock = msk->subflow;
pr_debug("msk=%p, subflow=%p", msk, ssock);
if (WARN_ON_ONCE(!ssock))
return -EINVAL;
@@ -3723,7 +3723,10 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
pr_debug("msk=%p", msk);
- ssock = __mptcp_nmpc_socket(msk);
+ /* buggy applications can call accept on socket states other then LISTEN
+ * but no need to allocate the first subflow just to error out.
+ */
+ ssock = msk->subflow;
if (!ssock)
return -EINVAL;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 079/286] mptcp: add annotations around msk->subflow accesses
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 078/286] mptcp: avoid unneeded __mptcp_nmpc_socket() usage Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 080/286] mptcp: avoid unneeded address copy Greg Kroah-Hartman
` (215 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Paasch, Mat Martineau,
Paolo Abeni, Jakub Kicinski, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 5b825727d0871b23e8867f6371183e61628b4a26 ]
The MPTCP can access the first subflow socket in a few spots
outside the socket lock scope. That is actually safe, as MPTCP
will delete the socket itself only after the msk sock close().
Still the such accesses causes a few KCSAN splats, as reported
by Christoph. Silence the harmless warning adding a few annotation
around the relevant accesses.
Fixes: 71ba088ce0aa ("mptcp: cleanup accept and poll")
Reported-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/402
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 18 ++++++++++--------
net/mptcp/protocol.h | 6 +++++-
2 files changed, 15 insertions(+), 9 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 676a6d24b4b71..f5c0a56f0f0ca 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -103,7 +103,7 @@ static int __mptcp_socket_create(struct mptcp_sock *msk)
return err;
msk->first = ssock->sk;
- msk->subflow = ssock;
+ WRITE_ONCE(msk->subflow, ssock);
subflow = mptcp_subflow_ctx(ssock->sk);
list_add(&subflow->node, &msk->conn_list);
sock_hold(ssock->sk);
@@ -2254,7 +2254,7 @@ static void mptcp_dispose_initial_subflow(struct mptcp_sock *msk)
{
if (msk->subflow) {
iput(SOCK_INODE(msk->subflow));
- msk->subflow = NULL;
+ WRITE_ONCE(msk->subflow, NULL);
}
}
@@ -3109,7 +3109,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
msk = mptcp_sk(nsk);
msk->local_key = subflow_req->local_key;
msk->token = subflow_req->token;
- msk->subflow = NULL;
+ WRITE_ONCE(msk->subflow, NULL);
msk->in_accept_queue = 1;
WRITE_ONCE(msk->fully_established, false);
if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)
@@ -3157,7 +3157,7 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
struct socket *listener;
struct sock *newsk;
- listener = msk->subflow;
+ listener = READ_ONCE(msk->subflow);
if (WARN_ON_ONCE(!listener)) {
*err = -EINVAL;
return NULL;
@@ -3723,10 +3723,10 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
pr_debug("msk=%p", msk);
- /* buggy applications can call accept on socket states other then LISTEN
+ /* Buggy applications can call accept on socket states other then LISTEN
* but no need to allocate the first subflow just to error out.
*/
- ssock = msk->subflow;
+ ssock = READ_ONCE(msk->subflow);
if (!ssock)
return -EINVAL;
@@ -3800,10 +3800,12 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
state = inet_sk_state_load(sk);
pr_debug("msk=%p state=%d flags=%lx", msk, state, msk->flags);
if (state == TCP_LISTEN) {
- if (WARN_ON_ONCE(!msk->subflow || !msk->subflow->sk))
+ struct socket *ssock = READ_ONCE(msk->subflow);
+
+ if (WARN_ON_ONCE(!ssock || !ssock->sk))
return 0;
- return inet_csk_listen_poll(msk->subflow->sk);
+ return inet_csk_listen_poll(ssock->sk);
}
if (state != TCP_SYN_SENT && state != TCP_SYN_RECV) {
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index d6469b6ab38e3..84427b3697d89 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -306,7 +306,11 @@ struct mptcp_sock {
struct list_head rtx_queue;
struct mptcp_data_frag *first_pending;
struct list_head join_list;
- struct socket *subflow; /* outgoing connect/listener/!mp_capable */
+ struct socket *subflow; /* outgoing connect/listener/!mp_capable
+ * The mptcp ops can safely dereference, using suitable
+ * ONCE annotation, the subflow outside the socket
+ * lock as such sock is freed after close().
+ */
struct sock *first;
struct mptcp_pm_data pm;
struct {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 080/286] mptcp: avoid unneeded address copy
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 079/286] mptcp: add annotations around msk->subflow accesses Greg Kroah-Hartman
@ 2023-06-07 20:12 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 081/286] mptcp: simplify subflow_syn_recv_sock() Greg Kroah-Hartman
` (214 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:12 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts,
David S. Miller, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 2bb9a37f0e194ed95c70603b0efc7898a5a0d9b4 ]
In the syn_recv fallback path, the msk is unused. We can skip
setting the socket address.
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 7e8b88ec35ee ("mptcp: consolidate passive msk socket initialization")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/subflow.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 281c1cc8dc8dc..8a6bd2782dc97 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -823,8 +823,6 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
goto dispose_child;
}
- if (new_msk)
- mptcp_copy_inaddrs(new_msk, child);
mptcp_subflow_drop_ctx(child);
goto out;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 081/286] mptcp: simplify subflow_syn_recv_sock()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-06-07 20:12 ` [PATCH 6.3 080/286] mptcp: avoid unneeded address copy Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 082/286] mptcp: consolidate passive msk socket initialization Greg Kroah-Hartman
` (213 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts,
David S. Miller, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit a88d0092b24b8cddce57fe0e88e60a9e29e0b515 ]
Postpone the msk cloning to the child process creation
so that we can avoid a bunch of conditionals.
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/61
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 7e8b88ec35ee ("mptcp: consolidate passive msk socket initialization")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/subflow.c | 41 +++++++++++++----------------------------
1 file changed, 13 insertions(+), 28 deletions(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 8a6bd2782dc97..3b8abd79bfbd5 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -695,14 +695,6 @@ static bool subflow_hmac_valid(const struct request_sock *req,
return !crypto_memneq(hmac, mp_opt->hmac, MPTCPOPT_HMAC_LEN);
}
-static void mptcp_force_close(struct sock *sk)
-{
- /* the msk is not yet exposed to user-space, and refcount is 2 */
- inet_sk_state_store(sk, TCP_CLOSE);
- sk_common_release(sk);
- sock_put(sk);
-}
-
static void subflow_ulp_fallback(struct sock *sk,
struct mptcp_subflow_context *old_ctx)
{
@@ -757,7 +749,6 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
struct mptcp_subflow_request_sock *subflow_req;
struct mptcp_options_received mp_opt;
bool fallback, fallback_is_fatal;
- struct sock *new_msk = NULL;
struct mptcp_sock *owner;
struct sock *child;
@@ -786,14 +777,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
* options.
*/
mptcp_get_options(skb, &mp_opt);
- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC)) {
+ if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC))
fallback = true;
- goto create_child;
- }
- new_msk = mptcp_sk_clone(listener->conn, &mp_opt, req);
- if (!new_msk)
- fallback = true;
} else if (subflow_req->mp_join) {
mptcp_get_options(skb, &mp_opt);
if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ) ||
@@ -822,21 +808,23 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
goto dispose_child;
}
-
- mptcp_subflow_drop_ctx(child);
- goto out;
+ goto fallback;
}
/* ssk inherits options of listener sk */
ctx->setsockopt_seq = listener->setsockopt_seq;
if (ctx->mp_capable) {
- owner = mptcp_sk(new_msk);
+ ctx->conn = mptcp_sk_clone(listener->conn, &mp_opt, req);
+ if (!ctx->conn)
+ goto fallback;
+
+ owner = mptcp_sk(ctx->conn);
/* this can't race with mptcp_close(), as the msk is
* not yet exposted to user-space
*/
- inet_sk_state_store((void *)new_msk, TCP_ESTABLISHED);
+ inet_sk_state_store(ctx->conn, TCP_ESTABLISHED);
/* record the newly created socket as the first msk
* subflow, but don't link it yet into conn_list
@@ -846,11 +834,9 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
/* new mpc subflow takes ownership of the newly
* created mptcp socket
*/
- mptcp_sk(new_msk)->setsockopt_seq = ctx->setsockopt_seq;
+ owner->setsockopt_seq = ctx->setsockopt_seq;
mptcp_pm_new_connection(owner, child, 1);
mptcp_token_accept(subflow_req, owner);
- ctx->conn = new_msk;
- new_msk = NULL;
/* set msk addresses early to ensure mptcp_pm_get_local_id()
* uses the correct data
@@ -900,11 +886,6 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
}
}
-out:
- /* dispose of the left over mptcp master, if any */
- if (unlikely(new_msk))
- mptcp_force_close(new_msk);
-
/* check for expected invariant - should never trigger, just help
* catching eariler subtle bugs
*/
@@ -922,6 +903,10 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
/* The last child reference will be released by the caller */
return child;
+
+fallback:
+ mptcp_subflow_drop_ctx(child);
+ return child;
}
static struct inet_connection_sock_af_ops subflow_specific __ro_after_init;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 082/286] mptcp: consolidate passive msk socket initialization
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 081/286] mptcp: simplify subflow_syn_recv_sock() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 083/286] mptcp: fix data race around msk->first access Greg Kroah-Hartman
` (212 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau, Paolo Abeni,
Jakub Kicinski, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 7e8b88ec35eef363040e08d99536d2bebef83774 ]
When the msk socket is cloned at MPC handshake time, a few
fields are initialized in a racy way outside mptcp_sk_clone()
and the msk socket lock.
The above is due historical reasons: before commit a88d0092b24b
("mptcp: simplify subflow_syn_recv_sock()") as the first subflow socket
carrying all the needed date was not available yet at msk creation
time
We can now refactor the code moving the missing initialization bit
under the socket lock, removing the init race and avoiding some
code duplication.
This will also simplify the next patch, as all msk->first write
access are now under the msk socket lock.
Fixes: 0397c6d85f9c ("mptcp: keep unaccepted MPC subflow into join list")
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 35 ++++++++++++++++++++++++++++-------
net/mptcp/protocol.h | 8 ++++----
net/mptcp/subflow.c | 28 +---------------------------
3 files changed, 33 insertions(+), 38 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index f5c0a56f0f0ca..8d0c03091c409 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3011,7 +3011,7 @@ static void mptcp_close(struct sock *sk, long timeout)
sock_put(sk);
}
-void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)
+static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)
{
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
const struct ipv6_pinfo *ssk6 = inet6_sk(ssk);
@@ -3088,9 +3088,10 @@ static struct ipv6_pinfo *mptcp_inet6_sk(const struct sock *sk)
}
#endif
-struct sock *mptcp_sk_clone(const struct sock *sk,
- const struct mptcp_options_received *mp_opt,
- struct request_sock *req)
+struct sock *mptcp_sk_clone_init(const struct sock *sk,
+ const struct mptcp_options_received *mp_opt,
+ struct sock *ssk,
+ struct request_sock *req)
{
struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
struct sock *nsk = sk_clone_lock(sk, GFP_ATOMIC);
@@ -3122,10 +3123,30 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
msk->setsockopt_seq = mptcp_sk(sk)->setsockopt_seq;
sock_reset_flag(nsk, SOCK_RCU_FREE);
- /* will be fully established after successful MPC subflow creation */
- inet_sk_state_store(nsk, TCP_SYN_RECV);
-
security_inet_csk_clone(nsk, req);
+
+ /* this can't race with mptcp_close(), as the msk is
+ * not yet exposted to user-space
+ */
+ inet_sk_state_store(nsk, TCP_ESTABLISHED);
+
+ /* The msk maintain a ref to each subflow in the connections list */
+ WRITE_ONCE(msk->first, ssk);
+ list_add(&mptcp_subflow_ctx(ssk)->node, &msk->conn_list);
+ sock_hold(ssk);
+
+ /* new mpc subflow takes ownership of the newly
+ * created mptcp socket
+ */
+ mptcp_token_accept(subflow_req, msk);
+
+ /* set msk addresses early to ensure mptcp_pm_get_local_id()
+ * uses the correct data
+ */
+ mptcp_copy_inaddrs(nsk, ssk);
+ mptcp_propagate_sndbuf(nsk, ssk);
+
+ mptcp_rcv_space_init(msk, ssk);
bh_unlock_sock(nsk);
/* note: the newly allocated socket refcount is 2 now */
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 84427b3697d89..426b43d7ae642 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -620,7 +620,6 @@ int mptcp_is_checksum_enabled(const struct net *net);
int mptcp_allow_join_id0(const struct net *net);
unsigned int mptcp_stale_loss_cnt(const struct net *net);
int mptcp_get_pm_type(const struct net *net);
-void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk);
void mptcp_subflow_fully_established(struct mptcp_subflow_context *subflow,
const struct mptcp_options_received *mp_opt);
bool __mptcp_retransmit_pending_data(struct sock *sk);
@@ -690,9 +689,10 @@ void __init mptcp_proto_init(void);
int __init mptcp_proto_v6_init(void);
#endif
-struct sock *mptcp_sk_clone(const struct sock *sk,
- const struct mptcp_options_received *mp_opt,
- struct request_sock *req);
+struct sock *mptcp_sk_clone_init(const struct sock *sk,
+ const struct mptcp_options_received *mp_opt,
+ struct sock *ssk,
+ struct request_sock *req);
void mptcp_get_options(const struct sk_buff *skb,
struct mptcp_options_received *mp_opt);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 3b8abd79bfbd5..bb0301398d3b4 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -815,38 +815,12 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
ctx->setsockopt_seq = listener->setsockopt_seq;
if (ctx->mp_capable) {
- ctx->conn = mptcp_sk_clone(listener->conn, &mp_opt, req);
+ ctx->conn = mptcp_sk_clone_init(listener->conn, &mp_opt, child, req);
if (!ctx->conn)
goto fallback;
owner = mptcp_sk(ctx->conn);
-
- /* this can't race with mptcp_close(), as the msk is
- * not yet exposted to user-space
- */
- inet_sk_state_store(ctx->conn, TCP_ESTABLISHED);
-
- /* record the newly created socket as the first msk
- * subflow, but don't link it yet into conn_list
- */
- WRITE_ONCE(owner->first, child);
-
- /* new mpc subflow takes ownership of the newly
- * created mptcp socket
- */
- owner->setsockopt_seq = ctx->setsockopt_seq;
mptcp_pm_new_connection(owner, child, 1);
- mptcp_token_accept(subflow_req, owner);
-
- /* set msk addresses early to ensure mptcp_pm_get_local_id()
- * uses the correct data
- */
- mptcp_copy_inaddrs(ctx->conn, child);
- mptcp_propagate_sndbuf(ctx->conn, child);
-
- mptcp_rcv_space_init(owner, child);
- list_add(&ctx->node, &owner->conn_list);
- sock_hold(child);
/* with OoO packets we can reach here without ingress
* mpc option
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 083/286] mptcp: fix data race around msk->first access
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 082/286] mptcp: consolidate passive msk socket initialization Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 084/286] mptcp: add annotations around sk->sk_shutdown accesses Greg Kroah-Hartman
` (211 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau, Paolo Abeni,
Jakub Kicinski, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 1b1b43ee7a208096ecd79e626f2fc90d4a321111 ]
The first subflow socket is accessed outside the msk socket lock
by mptcp_subflow_fail(), we need to annotate each write access
with WRITE_ONCE, but a few spots still lacks it.
Fixes: 76a13b315709 ("mptcp: invoke MP_FAIL response when needed")
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 8d0c03091c409..64d4910e337ea 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -102,7 +102,7 @@ static int __mptcp_socket_create(struct mptcp_sock *msk)
if (err)
return err;
- msk->first = ssock->sk;
+ WRITE_ONCE(msk->first, ssock->sk);
WRITE_ONCE(msk->subflow, ssock);
subflow = mptcp_subflow_ctx(ssock->sk);
list_add(&subflow->node, &msk->conn_list);
@@ -2391,7 +2391,7 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk,
sock_put(ssk);
if (ssk == msk->first)
- msk->first = NULL;
+ WRITE_ONCE(msk->first, NULL);
out:
if (ssk == msk->last_snd)
@@ -2692,7 +2692,7 @@ static int __mptcp_init_sock(struct sock *sk)
WRITE_ONCE(msk->rmem_released, 0);
msk->timer_ival = TCP_RTO_MIN;
- msk->first = NULL;
+ WRITE_ONCE(msk->first, NULL);
inet_csk(sk)->icsk_sync_mss = mptcp_sync_mss;
WRITE_ONCE(msk->csum_enabled, mptcp_is_checksum_enabled(sock_net(sk)));
WRITE_ONCE(msk->allow_infinite_fallback, true);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 084/286] mptcp: add annotations around sk->sk_shutdown accesses
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 083/286] mptcp: fix data race around msk->first access Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 085/286] drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" Greg Kroah-Hartman
` (210 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Paasch, Mat Martineau,
Paolo Abeni, Jakub Kicinski, Sasha Levin
From: Paolo Abeni <pabeni@redhat.com>
[ Upstream commit 6b9831bfd9322b297eb6d44257808cc055fdc586 ]
Christoph reported the mptcp variant of a recently addressed plain
TCP issue. Similar to commit e14cadfd80d7 ("tcp: add annotations around
sk->sk_shutdown accesses") add READ/WRITE ONCE annotations to silence
KCSAN reports around lockless sk_shutdown access.
Fixes: 71ba088ce0aa ("mptcp: cleanup accept and poll")
Reported-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/401
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/protocol.c | 29 ++++++++++++++++-------------
1 file changed, 16 insertions(+), 13 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 64d4910e337ea..17793aa733fd9 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -590,7 +590,7 @@ static bool mptcp_check_data_fin(struct sock *sk)
WRITE_ONCE(msk->ack_seq, msk->ack_seq + 1);
WRITE_ONCE(msk->rcv_data_fin, 0);
- sk->sk_shutdown |= RCV_SHUTDOWN;
+ WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | RCV_SHUTDOWN);
smp_mb__before_atomic(); /* SHUTDOWN must be visible first */
switch (sk->sk_state) {
@@ -897,7 +897,7 @@ static void mptcp_check_for_eof(struct mptcp_sock *msk)
/* hopefully temporary hack: propagate shutdown status
* to msk, when all subflows agree on it
*/
- sk->sk_shutdown |= RCV_SHUTDOWN;
+ WRITE_ONCE(sk->sk_shutdown, sk->sk_shutdown | RCV_SHUTDOWN);
smp_mb__before_atomic(); /* SHUTDOWN must be visible first */
sk->sk_data_ready(sk);
@@ -2498,7 +2498,7 @@ static void mptcp_check_fastclose(struct mptcp_sock *msk)
}
inet_sk_state_store(sk, TCP_CLOSE);
- sk->sk_shutdown = SHUTDOWN_MASK;
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
smp_mb__before_atomic(); /* SHUTDOWN must be visible first */
set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags);
@@ -2934,7 +2934,7 @@ bool __mptcp_close(struct sock *sk, long timeout)
bool do_cancel_work = false;
int subflows_alive = 0;
- sk->sk_shutdown = SHUTDOWN_MASK;
+ WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) {
mptcp_listen_inuse_dec(sk);
@@ -3074,7 +3074,7 @@ static int mptcp_disconnect(struct sock *sk, int flags)
mptcp_pm_data_reset(msk);
mptcp_ca_reset(sk);
- sk->sk_shutdown = 0;
+ WRITE_ONCE(sk->sk_shutdown, 0);
sk_error_report(sk);
return 0;
}
@@ -3793,9 +3793,6 @@ static __poll_t mptcp_check_writeable(struct mptcp_sock *msk)
{
struct sock *sk = (struct sock *)msk;
- if (unlikely(sk->sk_shutdown & SEND_SHUTDOWN))
- return EPOLLOUT | EPOLLWRNORM;
-
if (sk_stream_is_writeable(sk))
return EPOLLOUT | EPOLLWRNORM;
@@ -3813,6 +3810,7 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
struct sock *sk = sock->sk;
struct mptcp_sock *msk;
__poll_t mask = 0;
+ u8 shutdown;
int state;
msk = mptcp_sk(sk);
@@ -3829,17 +3827,22 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
return inet_csk_listen_poll(ssock->sk);
}
+ shutdown = READ_ONCE(sk->sk_shutdown);
+ if (shutdown == SHUTDOWN_MASK || state == TCP_CLOSE)
+ mask |= EPOLLHUP;
+ if (shutdown & RCV_SHUTDOWN)
+ mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
+
if (state != TCP_SYN_SENT && state != TCP_SYN_RECV) {
mask |= mptcp_check_readable(msk);
- mask |= mptcp_check_writeable(msk);
+ if (shutdown & SEND_SHUTDOWN)
+ mask |= EPOLLOUT | EPOLLWRNORM;
+ else
+ mask |= mptcp_check_writeable(msk);
} else if (state == TCP_SYN_SENT && inet_sk(sk)->defer_connect) {
/* cf tcp_poll() note about TFO */
mask |= EPOLLOUT | EPOLLWRNORM;
}
- if (sk->sk_shutdown == SHUTDOWN_MASK || state == TCP_CLOSE)
- mask |= EPOLLHUP;
- if (sk->sk_shutdown & RCV_SHUTDOWN)
- mask |= EPOLLIN | EPOLLRDNORM | EPOLLRDHUP;
/* This barrier is coupled with smp_wmb() in __mptcp_error_report() */
smp_rmb();
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 085/286] drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init"
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 084/286] mptcp: add annotations around sk->sk_shutdown accesses Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 086/286] watchdog: menz069_wdt: fix watchdog initialisation Greg Kroah-Hartman
` (209 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chong Li, JingWen.Chen2,
Alex Deucher, Sasha Levin
From: Chong Li <chongli2@amd.com>
[ Upstream commit 38eecbe086a4e52f54b2bbda8feba65d44addbef ]
[WHY]
Function "amdgpu_irq_update()" called by "amdgpu_device_ip_late_init()" is an atomic context.
We shouldn't access registers through KIQ since "msleep()" may be called in "amdgpu_kiq_rreg()".
[HOW]
Move function "amdgpu_virt_release_full_gpu()" after function "amdgpu_device_ip_late_init()",
to ensure that registers be accessed through RLCG instead of KIQ.
Call Trace:
<TASK>
show_stack+0x52/0x69
dump_stack_lvl+0x49/0x6d
dump_stack+0x10/0x18
__schedule_bug.cold+0x4f/0x6b
__schedule+0x473/0x5d0
? __wake_up_klogd.part.0+0x40/0x70
? vprintk_emit+0xbe/0x1f0
schedule+0x68/0x110
schedule_timeout+0x87/0x160
? timer_migration_handler+0xa0/0xa0
msleep+0x2d/0x50
amdgpu_kiq_rreg+0x18d/0x1f0 [amdgpu]
amdgpu_device_rreg.part.0+0x59/0xd0 [amdgpu]
amdgpu_device_rreg+0x3a/0x50 [amdgpu]
amdgpu_sriov_rreg+0x3c/0xb0 [amdgpu]
gfx_v10_0_set_gfx_eop_interrupt_state.constprop.0+0x16c/0x190 [amdgpu]
gfx_v10_0_set_eop_interrupt_state+0xa5/0xb0 [amdgpu]
amdgpu_irq_update+0x53/0x80 [amdgpu]
amdgpu_irq_get+0x7c/0xb0 [amdgpu]
amdgpu_fence_driver_hw_init+0x58/0x90 [amdgpu]
amdgpu_device_init.cold+0x16b7/0x2022 [amdgpu]
Signed-off-by: Chong Li <chongli2@amd.com>
Reviewed-by: JingWen.Chen2@amd.com
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 32 ++++++++++++----------
1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index aa46726dfdb01..464f0abc855e6 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -2523,8 +2523,6 @@ static int amdgpu_device_ip_init(struct amdgpu_device *adev)
amdgpu_fru_get_product_info(adev);
init_failed:
- if (amdgpu_sriov_vf(adev))
- amdgpu_virt_release_full_gpu(adev, true);
return r;
}
@@ -3841,18 +3839,6 @@ int amdgpu_device_init(struct amdgpu_device *adev,
r = amdgpu_device_ip_init(adev);
if (r) {
- /* failed in exclusive mode due to timeout */
- if (amdgpu_sriov_vf(adev) &&
- !amdgpu_sriov_runtime(adev) &&
- amdgpu_virt_mmio_blocked(adev) &&
- !amdgpu_virt_wait_reset(adev)) {
- dev_err(adev->dev, "VF exclusive mode timeout\n");
- /* Don't send request since VF is inactive. */
- adev->virt.caps &= ~AMDGPU_SRIOV_CAPS_RUNTIME;
- adev->virt.ops = NULL;
- r = -EAGAIN;
- goto release_ras_con;
- }
dev_err(adev->dev, "amdgpu_device_ip_init failed\n");
amdgpu_vf_error_put(adev, AMDGIM_ERROR_VF_AMDGPU_INIT_FAIL, 0, 0);
goto release_ras_con;
@@ -3924,8 +3910,10 @@ int amdgpu_device_init(struct amdgpu_device *adev,
msecs_to_jiffies(AMDGPU_RESUME_MS));
}
- if (amdgpu_sriov_vf(adev))
+ if (amdgpu_sriov_vf(adev)) {
+ amdgpu_virt_release_full_gpu(adev, true);
flush_delayed_work(&adev->delayed_init_work);
+ }
r = sysfs_create_files(&adev->dev->kobj, amdgpu_dev_attributes);
if (r)
@@ -3965,6 +3953,20 @@ int amdgpu_device_init(struct amdgpu_device *adev,
return 0;
release_ras_con:
+ if (amdgpu_sriov_vf(adev))
+ amdgpu_virt_release_full_gpu(adev, true);
+
+ /* failed in exclusive mode due to timeout */
+ if (amdgpu_sriov_vf(adev) &&
+ !amdgpu_sriov_runtime(adev) &&
+ amdgpu_virt_mmio_blocked(adev) &&
+ !amdgpu_virt_wait_reset(adev)) {
+ dev_err(adev->dev, "VF exclusive mode timeout\n");
+ /* Don't send request since VF is inactive. */
+ adev->virt.caps &= ~AMDGPU_SRIOV_CAPS_RUNTIME;
+ adev->virt.ops = NULL;
+ r = -EAGAIN;
+ }
amdgpu_release_ras_context(adev);
failed:
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 086/286] watchdog: menz069_wdt: fix watchdog initialisation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 085/286] drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 087/286] ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs Greg Kroah-Hartman
` (208 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
From: Johannes Thumshirn <jth@kernel.org>
[ Upstream commit 87b22656ca6a896d0378e9e60ffccb0c82f48b08 ]
Doing a 'cat /dev/watchdog0' with menz069_wdt as watchdog0 will result in
a NULL pointer dereference.
This happens because we're passing the wrong pointer to
watchdog_register_device(). Fix this by getting rid of the static
watchdog_device structure and use the one embedded into the driver's
per-instance private data.
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230418172531.177349-2-jth@kernel.org
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/menz69_wdt.c | 16 ++++++----------
1 file changed, 6 insertions(+), 10 deletions(-)
diff --git a/drivers/watchdog/menz69_wdt.c b/drivers/watchdog/menz69_wdt.c
index 8973f98bc6a56..bca0938f3429f 100644
--- a/drivers/watchdog/menz69_wdt.c
+++ b/drivers/watchdog/menz69_wdt.c
@@ -98,14 +98,6 @@ static const struct watchdog_ops men_z069_ops = {
.set_timeout = men_z069_wdt_set_timeout,
};
-static struct watchdog_device men_z069_wdt = {
- .info = &men_z069_info,
- .ops = &men_z069_ops,
- .timeout = MEN_Z069_DEFAULT_TIMEOUT,
- .min_timeout = 1,
- .max_timeout = MEN_Z069_WDT_COUNTER_MAX / MEN_Z069_TIMER_FREQ,
-};
-
static int men_z069_probe(struct mcb_device *dev,
const struct mcb_device_id *id)
{
@@ -125,15 +117,19 @@ static int men_z069_probe(struct mcb_device *dev,
goto release_mem;
drv->mem = mem;
+ drv->wdt.info = &men_z069_info;
+ drv->wdt.ops = &men_z069_ops;
+ drv->wdt.timeout = MEN_Z069_DEFAULT_TIMEOUT;
+ drv->wdt.min_timeout = 1;
+ drv->wdt.max_timeout = MEN_Z069_WDT_COUNTER_MAX / MEN_Z069_TIMER_FREQ;
- drv->wdt = men_z069_wdt;
watchdog_init_timeout(&drv->wdt, 0, &dev->dev);
watchdog_set_nowayout(&drv->wdt, nowayout);
watchdog_set_drvdata(&drv->wdt, drv);
drv->wdt.parent = &dev->dev;
mcb_set_drvdata(dev, drv);
- return watchdog_register_device(&men_z069_wdt);
+ return watchdog_register_device(&drv->wdt);
release_mem:
mcb_release_mem(mem);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 087/286] ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs.
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 086/286] watchdog: menz069_wdt: fix watchdog initialisation Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 088/286] drm/amd/display: fix memleak in aconnector->timing_requested Greg Kroah-Hartman
` (207 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, jasontao, Reaper Li, Takashi Iwai,
Sasha Levin
From: jasontao <jasontao@glenfly.com>
[ Upstream commit c51e431052e2eacfb23fbf6b39bc6c8770d9827a ]
Add a set of HD Audio PCI IDS, and the HDMI codec vendor IDs for
Glenfly Gpus.
- In default_bdl_pos_adj, set bdl to 128 as Glenfly Gpus have hardware
limitation, need to increase hdac interrupt interval.
- In azx_first_init, enable polling mode for Glenfly Gpu. When the codec
complete the command, it sends interrupt and writes response entries to
memory, howerver, the write requests sometimes are not actually
synchronized to memory when driver handle hdac interrupt on Glenfly Gpus.
If the RIRB status is not updated in the interrupt handler,
azx_rirb_get_response keeps trying to recevie a response from rirb until
1s timeout. Enabling polling mode for Glenfly Gpu can fix the issue.
- In patch_gf_hdmi, set Glenlfy Gpu Codec's no_sticky_stream as it need
driver to do actual clean-ups for the linked codec when switch from one
codec to another.
Signed-off-by: jasontao <jasontao@glenfly.com>
Signed-off-by: Reaper Li <reaperlioc@glenfly.com>
Link: https://lore.kernel.org/r/20230426013059.4329-1-reaperlioc@glenfly.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/hda_intel.c | 21 +++++++++++++++++++++
sound/pci/hda/patch_hdmi.c | 22 ++++++++++++++++++++++
2 files changed, 43 insertions(+)
diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
index 881b2f3a1551f..3226691ac923c 100644
--- a/sound/pci/hda/hda_intel.c
+++ b/sound/pci/hda/hda_intel.c
@@ -227,6 +227,7 @@ enum {
AZX_DRIVER_ATI,
AZX_DRIVER_ATIHDMI,
AZX_DRIVER_ATIHDMI_NS,
+ AZX_DRIVER_GFHDMI,
AZX_DRIVER_VIA,
AZX_DRIVER_SIS,
AZX_DRIVER_ULI,
@@ -349,6 +350,7 @@ static const char * const driver_short_names[] = {
[AZX_DRIVER_ATI] = "HDA ATI SB",
[AZX_DRIVER_ATIHDMI] = "HDA ATI HDMI",
[AZX_DRIVER_ATIHDMI_NS] = "HDA ATI HDMI",
+ [AZX_DRIVER_GFHDMI] = "HDA GF HDMI",
[AZX_DRIVER_VIA] = "HDA VIA VT82xx",
[AZX_DRIVER_SIS] = "HDA SIS966",
[AZX_DRIVER_ULI] = "HDA ULI M5461",
@@ -1743,6 +1745,12 @@ static int default_bdl_pos_adj(struct azx *chip)
}
switch (chip->driver_type) {
+ /*
+ * increase the bdl size for Glenfly Gpus for hardware
+ * limitation on hdac interrupt interval
+ */
+ case AZX_DRIVER_GFHDMI:
+ return 128;
case AZX_DRIVER_ICH:
case AZX_DRIVER_PCH:
return 1;
@@ -1858,6 +1866,12 @@ static int azx_first_init(struct azx *chip)
pci_write_config_dword(pci, PCI_BASE_ADDRESS_1, 0);
}
#endif
+ /*
+ * Fix response write request not synced to memory when handle
+ * hdac interrupt on Glenfly Gpus
+ */
+ if (chip->driver_type == AZX_DRIVER_GFHDMI)
+ bus->polling_mode = 1;
err = pcim_iomap_regions(pci, 1 << 0, "ICH HD audio");
if (err < 0)
@@ -1959,6 +1973,7 @@ static int azx_first_init(struct azx *chip)
chip->playback_streams = ATIHDMI_NUM_PLAYBACK;
chip->capture_streams = ATIHDMI_NUM_CAPTURE;
break;
+ case AZX_DRIVER_GFHDMI:
case AZX_DRIVER_GENERIC:
default:
chip->playback_streams = ICH6_NUM_PLAYBACK;
@@ -2727,6 +2742,12 @@ static const struct pci_device_id azx_ids[] = {
{ PCI_DEVICE(0x1002, 0xab38),
.driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS |
AZX_DCAPS_PM_RUNTIME },
+ /* GLENFLY */
+ { PCI_DEVICE(0x6766, PCI_ANY_ID),
+ .class = PCI_CLASS_MULTIMEDIA_HD_AUDIO << 8,
+ .class_mask = 0xffffff,
+ .driver_data = AZX_DRIVER_GFHDMI | AZX_DCAPS_POSFIX_LPIB |
+ AZX_DCAPS_NO_MSI | AZX_DCAPS_NO_64BIT },
/* VIA VT8251/VT8237A */
{ PCI_DEVICE(0x1106, 0x3288), .driver_data = AZX_DRIVER_VIA },
/* VIA GFX VT7122/VX900 */
diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
index be2c6cff77011..7b5e09070ab9b 100644
--- a/sound/pci/hda/patch_hdmi.c
+++ b/sound/pci/hda/patch_hdmi.c
@@ -4489,6 +4489,22 @@ static int patch_via_hdmi(struct hda_codec *codec)
return patch_simple_hdmi(codec, VIAHDMI_CVT_NID, VIAHDMI_PIN_NID);
}
+static int patch_gf_hdmi(struct hda_codec *codec)
+{
+ int err;
+
+ err = patch_generic_hdmi(codec);
+ if (err)
+ return err;
+
+ /*
+ * Glenfly GPUs have two codecs, stream switches from one codec to
+ * another, need to do actual clean-ups in codec_cleanup_stream
+ */
+ codec->no_sticky_stream = 1;
+ return 0;
+}
+
/*
* patch entries
*/
@@ -4584,6 +4600,12 @@ HDA_CODEC_ENTRY(0x10de00a6, "GPU a6 HDMI/DP", patch_nvhdmi),
HDA_CODEC_ENTRY(0x10de00a7, "GPU a7 HDMI/DP", patch_nvhdmi),
HDA_CODEC_ENTRY(0x10de8001, "MCP73 HDMI", patch_nvhdmi_2ch),
HDA_CODEC_ENTRY(0x10de8067, "MCP67/68 HDMI", patch_nvhdmi_2ch),
+HDA_CODEC_ENTRY(0x67663d82, "Arise 82 HDMI/DP", patch_gf_hdmi),
+HDA_CODEC_ENTRY(0x67663d83, "Arise 83 HDMI/DP", patch_gf_hdmi),
+HDA_CODEC_ENTRY(0x67663d84, "Arise 84 HDMI/DP", patch_gf_hdmi),
+HDA_CODEC_ENTRY(0x67663d85, "Arise 85 HDMI/DP", patch_gf_hdmi),
+HDA_CODEC_ENTRY(0x67663d86, "Arise 86 HDMI/DP", patch_gf_hdmi),
+HDA_CODEC_ENTRY(0x67663d87, "Arise 87 HDMI/DP", patch_gf_hdmi),
HDA_CODEC_ENTRY(0x11069f80, "VX900 HDMI/DP", patch_via_hdmi),
HDA_CODEC_ENTRY(0x11069f81, "VX900 HDMI/DP", patch_via_hdmi),
HDA_CODEC_ENTRY(0x11069f84, "VX11 HDMI/DP", patch_generic_hdmi),
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 088/286] drm/amd/display: fix memleak in aconnector->timing_requested
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 087/286] ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 089/286] LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR Greg Kroah-Hartman
` (206 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qingqing Zhuo, Qingqing Zhuo,
Hersen Wu, Daniel Wheeler, Alex Deucher, Sasha Levin
From: Hersen Wu <hersenxs.wu@amd.com>
[ Upstream commit 025ce392b5f213696ca0af3e07735d0fae020694 ]
[Why]
when amdgpu_dm_update_connector_after_detect is called
two times successively with valid sink, memory allocated of
aconnector->timing_requested for the first call is not free.
this causes memeleak.
[How]
allocate memory only when aconnector->timing_requested
is null.
Reviewed-by: Qingqing Zhuo <Qingqing.Zhuo@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Hersen Wu <hersenxs.wu@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index 0695c7c3d489d..ce46f3a061c44 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -3095,9 +3095,12 @@ void amdgpu_dm_update_connector_after_detect(
aconnector->edid);
}
- aconnector->timing_requested = kzalloc(sizeof(struct dc_crtc_timing), GFP_KERNEL);
- if (!aconnector->timing_requested)
- dm_error("%s: failed to create aconnector->requested_timing\n", __func__);
+ if (!aconnector->timing_requested) {
+ aconnector->timing_requested =
+ kzalloc(sizeof(struct dc_crtc_timing), GFP_KERNEL);
+ if (!aconnector->timing_requested)
+ dm_error("failed to create aconnector->requested_timing\n");
+ }
drm_connector_update_edid_property(connector, aconnector->edid);
amdgpu_dm_update_freesync_caps(connector, aconnector->edid);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 089/286] LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 088/286] drm/amd/display: fix memleak in aconnector->timing_requested Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 090/286] LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection Greg Kroah-Hartman
` (205 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, WANG Xuerui, Huacai Chen,
Sasha Levin
From: WANG Xuerui <git@xen0n.name>
[ Upstream commit c23e7f01cf621290770069d968ca4c8356a50d00 ]
SEGV_BNDERR was introduced initially for supporting the Intel MPX, but
fell into disuse after the MPX support was removed. The LoongArch
bounds-checking instructions behave very differently than MPX, but
overall the interface is still kind of suitable for conveying the
information to userland when bounds-checking assertions trigger, so we
wouldn't have to invent more UAPI. Specifically, when the BCE triggers,
a SEGV_BNDERR is sent to userland, with si_addr set to the out-of-bounds
address or value (in asrt{gt,le}'s case), and one of si_lower or
si_upper set to the configured bound depending on the faulting
instruction. The other bound is set to either 0 or ULONG_MAX to resemble
a range with both lower and upper bounds.
Note that it is possible to have si_addr == si_lower in case of a
failing asrtgt or {ld,st}gt, because those instructions test for strict
greater-than relationship. This should not pose a problem for userland,
though, because the faulting PC is available for the application to
associate back to the exact instruction for figuring out the
expectation.
Example exception context generated by a faulting `asrtgt.d t0, t1`
(assert t0 > t1 or BCE) with t0=100 and t1=200:
> pc 00005555558206a4 ra 00007ffff2d854fc tp 00007ffff2f2f180 sp 00007ffffbf9fb80
> a0 0000000000000002 a1 00007ffffbf9fce8 a2 00007ffffbf9fd00 a3 00007ffff2ed4558
> a4 0000000000000000 a5 00007ffff2f044c8 a6 00007ffffbf9fce0 a7 fffffffffffff000
> t0 0000000000000064 t1 00000000000000c8 t2 00007ffffbfa2d5e t3 00007ffff2f12aa0
> t4 00007ffff2ed6158 t5 00007ffff2ed6158 t6 000000000000002e t7 0000000003d8f538
> t8 0000000000000005 u0 0000000000000000 s9 0000000000000000 s0 00007ffffbf9fce8
> s1 0000000000000002 s2 0000000000000000 s3 00007ffff2f2c038 s4 0000555555820610
> s5 00007ffff2ed5000 s6 0000555555827e38 s7 00007ffffbf9fd00 s8 0000555555827e38
> ra: 00007ffff2d854fc
> ERA: 00005555558206a4
> CRMD: 000000b0 (PLV0 -IE -DA +PG DACF=CC DACM=CC -WE)
> PRMD: 00000007 (PPLV3 +PIE -PWE)
> EUEN: 00000000 (-FPE -SXE -ASXE -BTE)
> ECFG: 0007181c (LIE=2-4,11-12 VS=7)
> ESTAT: 000a0000 [BCE] (IS= ECode=10 EsubCode=0)
> PRID: 0014c010 (Loongson-64bit, Loongson-3A5000)
Signed-off-by: WANG Xuerui <git@xen0n.name>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/include/asm/inst.h | 26 +++++++++
arch/loongarch/kernel/genex.S | 1 +
arch/loongarch/kernel/traps.c | 92 +++++++++++++++++++++++++++++++
3 files changed, 119 insertions(+)
diff --git a/arch/loongarch/include/asm/inst.h b/arch/loongarch/include/asm/inst.h
index a04fe755d7193..b09887ffcd15d 100644
--- a/arch/loongarch/include/asm/inst.h
+++ b/arch/loongarch/include/asm/inst.h
@@ -121,6 +121,8 @@ enum reg2bstrd_op {
};
enum reg3_op {
+ asrtle_op = 0x02,
+ asrtgt_op = 0x03,
addw_op = 0x20,
addd_op = 0x21,
subw_op = 0x22,
@@ -176,6 +178,30 @@ enum reg3_op {
amord_op = 0x70c7,
amxorw_op = 0x70c8,
amxord_op = 0x70c9,
+ fldgts_op = 0x70e8,
+ fldgtd_op = 0x70e9,
+ fldles_op = 0x70ea,
+ fldled_op = 0x70eb,
+ fstgts_op = 0x70ec,
+ fstgtd_op = 0x70ed,
+ fstles_op = 0x70ee,
+ fstled_op = 0x70ef,
+ ldgtb_op = 0x70f0,
+ ldgth_op = 0x70f1,
+ ldgtw_op = 0x70f2,
+ ldgtd_op = 0x70f3,
+ ldleb_op = 0x70f4,
+ ldleh_op = 0x70f5,
+ ldlew_op = 0x70f6,
+ ldled_op = 0x70f7,
+ stgtb_op = 0x70f8,
+ stgth_op = 0x70f9,
+ stgtw_op = 0x70fa,
+ stgtd_op = 0x70fb,
+ stleb_op = 0x70fc,
+ stleh_op = 0x70fd,
+ stlew_op = 0x70fe,
+ stled_op = 0x70ff,
};
enum reg3sa2_op {
diff --git a/arch/loongarch/kernel/genex.S b/arch/loongarch/kernel/genex.S
index 44ff1ff642601..78f0663846575 100644
--- a/arch/loongarch/kernel/genex.S
+++ b/arch/loongarch/kernel/genex.S
@@ -82,6 +82,7 @@ SYM_FUNC_END(except_vec_cex)
BUILD_HANDLER ade ade badv
BUILD_HANDLER ale ale badv
+ BUILD_HANDLER bce bce none
BUILD_HANDLER bp bp none
BUILD_HANDLER fpe fpe fcsr
BUILD_HANDLER fpu fpu none
diff --git a/arch/loongarch/kernel/traps.c b/arch/loongarch/kernel/traps.c
index de8ebe20b666c..03ebfd2a4392f 100644
--- a/arch/loongarch/kernel/traps.c
+++ b/arch/loongarch/kernel/traps.c
@@ -35,6 +35,7 @@
#include <asm/break.h>
#include <asm/cpu.h>
#include <asm/fpu.h>
+#include <asm/inst.h>
#include <asm/loongarch.h>
#include <asm/mmu_context.h>
#include <asm/pgtable.h>
@@ -50,6 +51,7 @@
extern asmlinkage void handle_ade(void);
extern asmlinkage void handle_ale(void);
+extern asmlinkage void handle_bce(void);
extern asmlinkage void handle_sys(void);
extern asmlinkage void handle_bp(void);
extern asmlinkage void handle_ri(void);
@@ -430,6 +432,95 @@ static void bug_handler(struct pt_regs *regs)
}
}
+asmlinkage void noinstr do_bce(struct pt_regs *regs)
+{
+ bool user = user_mode(regs);
+ unsigned long era = exception_era(regs);
+ u64 badv = 0, lower = 0, upper = ULONG_MAX;
+ union loongarch_instruction insn;
+ irqentry_state_t state = irqentry_enter(regs);
+
+ if (regs->csr_prmd & CSR_PRMD_PIE)
+ local_irq_enable();
+
+ current->thread.trap_nr = read_csr_excode();
+
+ die_if_kernel("Bounds check error in kernel code", regs);
+
+ /*
+ * Pull out the address that failed bounds checking, and the lower /
+ * upper bound, by minimally looking at the faulting instruction word
+ * and reading from the correct register.
+ */
+ if (__get_inst(&insn.word, (u32 *)era, user))
+ goto bad_era;
+
+ switch (insn.reg3_format.opcode) {
+ case asrtle_op:
+ if (insn.reg3_format.rd != 0)
+ break; /* not asrtle */
+ badv = regs->regs[insn.reg3_format.rj];
+ upper = regs->regs[insn.reg3_format.rk];
+ break;
+
+ case asrtgt_op:
+ if (insn.reg3_format.rd != 0)
+ break; /* not asrtgt */
+ badv = regs->regs[insn.reg3_format.rj];
+ lower = regs->regs[insn.reg3_format.rk];
+ break;
+
+ case ldleb_op:
+ case ldleh_op:
+ case ldlew_op:
+ case ldled_op:
+ case stleb_op:
+ case stleh_op:
+ case stlew_op:
+ case stled_op:
+ case fldles_op:
+ case fldled_op:
+ case fstles_op:
+ case fstled_op:
+ badv = regs->regs[insn.reg3_format.rj];
+ upper = regs->regs[insn.reg3_format.rk];
+ break;
+
+ case ldgtb_op:
+ case ldgth_op:
+ case ldgtw_op:
+ case ldgtd_op:
+ case stgtb_op:
+ case stgth_op:
+ case stgtw_op:
+ case stgtd_op:
+ case fldgts_op:
+ case fldgtd_op:
+ case fstgts_op:
+ case fstgtd_op:
+ badv = regs->regs[insn.reg3_format.rj];
+ lower = regs->regs[insn.reg3_format.rk];
+ break;
+ }
+
+ force_sig_bnderr((void __user *)badv, (void __user *)lower, (void __user *)upper);
+
+out:
+ if (regs->csr_prmd & CSR_PRMD_PIE)
+ local_irq_disable();
+
+ irqentry_exit(regs, state);
+ return;
+
+bad_era:
+ /*
+ * Cannot pull out the instruction word, hence cannot provide more
+ * info than a regular SIGSEGV in this case.
+ */
+ force_sig(SIGSEGV);
+ goto out;
+}
+
asmlinkage void noinstr do_bp(struct pt_regs *regs)
{
bool user = user_mode(regs);
@@ -797,6 +888,7 @@ void __init trap_init(void)
set_handler(EXCCODE_ADE * VECSIZE, handle_ade, VECSIZE);
set_handler(EXCCODE_ALE * VECSIZE, handle_ale, VECSIZE);
+ set_handler(EXCCODE_BCE * VECSIZE, handle_bce, VECSIZE);
set_handler(EXCCODE_SYS * VECSIZE, handle_sys, VECSIZE);
set_handler(EXCCODE_BP * VECSIZE, handle_bp, VECSIZE);
set_handler(EXCCODE_INE * VECSIZE, handle_ri, VECSIZE);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 090/286] LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 089/286] LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 091/286] ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet Greg Kroah-Hartman
` (204 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Qing Zhang, Huacai Chen, Sasha Levin
From: Qing Zhang <zhangqing@loongson.cn>
[ Upstream commit d4c937c2a57bbba24790be6fe7a791456f5fbb60 ]
FORTIFY_SOURCE could detect various overflows at compile and run time.
ARCH_HAS_FORTIFY_SOURCE means that the architecture can be built and run
with CONFIG_FORTIFY_SOURCE. So select it in LoongArch.
See more about this feature from commit 6974f0c4555e285 ("include/linux/
string.h: add the option of fortified string.h functions").
Signed-off-by: Qing Zhang <zhangqing@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/loongarch/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/loongarch/Kconfig b/arch/loongarch/Kconfig
index 3ddde336e6a56..3e5d6acbf2409 100644
--- a/arch/loongarch/Kconfig
+++ b/arch/loongarch/Kconfig
@@ -10,6 +10,7 @@ config LOONGARCH
select ARCH_ENABLE_MEMORY_HOTPLUG
select ARCH_ENABLE_MEMORY_HOTREMOVE
select ARCH_HAS_ACPI_TABLE_UPGRADE if ACPI
+ select ARCH_HAS_FORTIFY_SOURCE
select ARCH_HAS_NMI_SAFE_THIS_CPU_OPS
select ARCH_HAS_PTE_SPECIAL
select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 091/286] ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 090/286] LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 092/286] drm/amdgpu: Use the default reset when loading or reloading the driver Greg Kroah-Hartman
` (203 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Pierre-Louis Bossart,
Mark Brown, Sasha Levin
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit ec6f82b4c63cc68f8dc03316e725106d242706be ]
The Nextbook Ares 8A tablet which has Android as factory OS, has a buggy
DSDT with both ESSX8316 and 10EC5651 ACPI devices.
This tablet actually uses an rt5651 codec, but the matching code ends up
picking the ESSX8316 device, add a quirk to ignote the ESSX8316 device
on this tablet.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Message-Id: <20230429104721.7176-1-hdegoede@redhat.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../intel/common/soc-acpi-intel-cht-match.c | 26 +++++++++++++++++++
1 file changed, 26 insertions(+)
diff --git a/sound/soc/intel/common/soc-acpi-intel-cht-match.c b/sound/soc/intel/common/soc-acpi-intel-cht-match.c
index 6beb00858c33f..cdcbf04b8832f 100644
--- a/sound/soc/intel/common/soc-acpi-intel-cht-match.c
+++ b/sound/soc/intel/common/soc-acpi-intel-cht-match.c
@@ -50,6 +50,31 @@ static struct snd_soc_acpi_mach *cht_quirk(void *arg)
return mach;
}
+/*
+ * Some tablets with Android factory OS have buggy DSDTs with an ESSX8316 device
+ * in the ACPI tables. While they are not using an ESS8316 codec. These DSDTs
+ * also have an ACPI device for the correct codec, ignore the ESSX8316.
+ */
+static const struct dmi_system_id cht_ess8316_not_present_table[] = {
+ {
+ /* Nextbook Ares 8A */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Insyde"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "CherryTrail"),
+ DMI_MATCH(DMI_BIOS_VERSION, "M882"),
+ },
+ },
+ { }
+};
+
+static struct snd_soc_acpi_mach *cht_ess8316_quirk(void *arg)
+{
+ if (dmi_check_system(cht_ess8316_not_present_table))
+ return NULL;
+
+ return arg;
+}
+
static const struct snd_soc_acpi_codecs rt5640_comp_ids = {
.num_codecs = 2,
.codecs = { "10EC5640", "10EC3276" },
@@ -113,6 +138,7 @@ struct snd_soc_acpi_mach snd_soc_acpi_intel_cherrytrail_machines[] = {
.drv_name = "bytcht_es8316",
.fw_filename = "intel/fw_sst_22a8.bin",
.board = "bytcht_es8316",
+ .machine_quirk = cht_ess8316_quirk,
.sof_tplg_filename = "sof-cht-es8316.tplg",
},
/* some CHT-T platforms rely on RT5640, use Baytrail machine driver */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 092/286] drm/amdgpu: Use the default reset when loading or reloading the driver
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 091/286] ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 093/286] mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() Greg Kroah-Hartman
` (202 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, lyndonli, Yunxiang Li, Feifei Xu,
Kenneth Feng, Alex Deucher, Sasha Levin
From: lyndonli <Lyndon.Li@amd.com>
[ Upstream commit 4eea7fb980dc44545a32eec92e2662053b34cd9d ]
Below call trace and errors are observed when reloading
amdgpu driver with the module parameter reset_method=3.
It should do a default reset when loading or reloading the
driver, regardless of the module parameter reset_method.
v2: add comments inside and modify commit messages.
[ +2.180243] [drm] psp gfx command ID_LOAD_TOC(0x20) failed
and response status is (0x0)
[ +0.000011] [drm:psp_hw_start [amdgpu]] *ERROR* Failed to load toc
[ +0.000890] [drm:psp_hw_start [amdgpu]] *ERROR* PSP tmr init failed!
[ +0.020683] [drm:amdgpu_fill_buffer [amdgpu]] *ERROR* Trying to
clear memory with ring turned off.
[ +0.000003] RIP: 0010:amdgpu_bo_release_notify+0x1ef/0x210 [amdgpu]
[ +0.000004] Call Trace:
[ +0.000003] <TASK>
[ +0.000008] ttm_bo_release+0x2c4/0x330 [amdttm]
[ +0.000026] amdttm_bo_put+0x3c/0x70 [amdttm]
[ +0.000020] amdgpu_bo_free_kernel+0xe6/0x140 [amdgpu]
[ +0.000728] psp_v11_0_ring_destroy+0x34/0x60 [amdgpu]
[ +0.000826] psp_hw_init+0xe7/0x2f0 [amdgpu]
[ +0.000813] amdgpu_device_fw_loading+0x1ad/0x2d0 [amdgpu]
[ +0.000731] amdgpu_device_init.cold+0x108e/0x2002 [amdgpu]
[ +0.001071] ? do_pci_enable_device+0xe1/0x110
[ +0.000011] amdgpu_driver_load_kms+0x1a/0x160 [amdgpu]
[ +0.000729] amdgpu_pci_probe+0x179/0x3a0 [amdgpu]
Signed-off-by: lyndonli <Lyndon.Li@amd.com>
Signed-off-by: Yunxiang Li <Yunxiang.Li@amd.com>
Reviewed-by: Feifei Xu <Feifei.Xu@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 464f0abc855e6..412cb3f1f8826 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3558,6 +3558,7 @@ int amdgpu_device_init(struct amdgpu_device *adev,
int r, i;
bool px = false;
u32 max_MBps;
+ int tmp;
adev->shutdown = false;
adev->flags = flags;
@@ -3779,7 +3780,13 @@ int amdgpu_device_init(struct amdgpu_device *adev,
}
}
} else {
+ tmp = amdgpu_reset_method;
+ /* It should do a default reset when loading or reloading the driver,
+ * regardless of the module parameter reset_method.
+ */
+ amdgpu_reset_method = AMD_RESET_METHOD_NONE;
r = amdgpu_asic_reset(adev);
+ amdgpu_reset_method = tmp;
if (r) {
dev_err(adev->dev, "asic reset on init failed\n");
goto failed;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 093/286] mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 092/286] drm/amdgpu: Use the default reset when loading or reloading the driver Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 094/286] drm/ast: Fix ARM compatibility Greg Kroah-Hartman
` (201 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lee Jones, Jassi Brar, Sasha Levin
From: Lee Jones <lee@kernel.org>
[ Upstream commit 2d1e952a2b8e5e92d8d55ac88a7cf7ca5ea591ad ]
If a user can make copy_from_user() fail, there is a potential for
UAF/DF due to a lack of locking around the allocation, use and freeing
of the data buffers.
This issue is not theoretical. I managed to author a POC for it:
BUG: KASAN: double-free in kfree+0x5c/0xac
Free of addr ffff29280be5de00 by task poc/356
CPU: 1 PID: 356 Comm: poc Not tainted 6.1.0-00001-g961aa6552c04-dirty #20
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace.part.0+0xe0/0xf0
show_stack+0x18/0x40
dump_stack_lvl+0x64/0x80
print_report+0x188/0x48c
kasan_report_invalid_free+0xa0/0xc0
____kasan_slab_free+0x174/0x1b0
__kasan_slab_free+0x18/0x24
__kmem_cache_free+0x130/0x2e0
kfree+0x5c/0xac
mbox_test_message_write+0x208/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Allocated by task 356:
kasan_save_stack+0x3c/0x70
kasan_set_track+0x2c/0x40
kasan_save_alloc_info+0x24/0x34
__kasan_kmalloc+0xb8/0xc0
kmalloc_trace+0x58/0x70
mbox_test_message_write+0x6c/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Freed by task 357:
kasan_save_stack+0x3c/0x70
kasan_set_track+0x2c/0x40
kasan_save_free_info+0x38/0x5c
____kasan_slab_free+0x13c/0x1b0
__kasan_slab_free+0x18/0x24
__kmem_cache_free+0x130/0x2e0
kfree+0x5c/0xac
mbox_test_message_write+0x208/0x29c
full_proxy_write+0x90/0xf0
vfs_write+0x154/0x440
ksys_write+0xcc/0x180
__arm64_sys_write+0x44/0x60
invoke_syscall+0x60/0x190
el0_svc_common.constprop.0+0x7c/0x160
do_el0_svc+0x40/0xf0
el0_svc+0x2c/0x6c
el0t_64_sync_handler+0xf4/0x120
el0t_64_sync+0x18c/0x190
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-test.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
index 4555d678fadda..6dd5b9614452b 100644
--- a/drivers/mailbox/mailbox-test.c
+++ b/drivers/mailbox/mailbox-test.c
@@ -12,6 +12,7 @@
#include <linux/kernel.h>
#include <linux/mailbox_client.h>
#include <linux/module.h>
+#include <linux/mutex.h>
#include <linux/of.h>
#include <linux/platform_device.h>
#include <linux/poll.h>
@@ -38,6 +39,7 @@ struct mbox_test_device {
char *signal;
char *message;
spinlock_t lock;
+ struct mutex mutex;
wait_queue_head_t waitq;
struct fasync_struct *async_queue;
struct dentry *root_debugfs_dir;
@@ -110,6 +112,8 @@ static ssize_t mbox_test_message_write(struct file *filp,
return -EINVAL;
}
+ mutex_lock(&tdev->mutex);
+
tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
if (!tdev->message)
return -ENOMEM;
@@ -144,6 +148,8 @@ static ssize_t mbox_test_message_write(struct file *filp,
kfree(tdev->message);
tdev->signal = NULL;
+ mutex_unlock(&tdev->mutex);
+
return ret < 0 ? ret : count;
}
@@ -392,6 +398,7 @@ static int mbox_test_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, tdev);
spin_lock_init(&tdev->lock);
+ mutex_init(&tdev->mutex);
if (tdev->rx_channel) {
tdev->rx_buffer = devm_kzalloc(&pdev->dev,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 094/286] drm/ast: Fix ARM compatibility
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 093/286] mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 095/286] btrfs: abort transaction when sibling keys check fails for leaves Greg Kroah-Hartman
` (200 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jammy Huang, Thomas Zimmermann,
Sasha Levin
From: Jammy Huang <jammy_huang@aspeedtech.com>
[ Upstream commit 4327a6137ed43a091d900b1ac833345d60f32228 ]
ARM architecture only has 'memory', so all devices are accessed by
MMIO if possible.
Signed-off-by: Jammy Huang <jammy_huang@aspeedtech.com>
Reviewed-by: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20230421003354.27767-1-jammy_huang@aspeedtech.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/ast/ast_main.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
index f83ce77127cb4..a6d0ee4da2b88 100644
--- a/drivers/gpu/drm/ast/ast_main.c
+++ b/drivers/gpu/drm/ast/ast_main.c
@@ -425,11 +425,12 @@ struct ast_private *ast_device_create(const struct drm_driver *drv,
return ERR_PTR(-EIO);
/*
- * If we don't have IO space at all, use MMIO now and
- * assume the chip has MMIO enabled by default (rev 0x20
- * and higher).
+ * After AST2500, MMIO is enabled by default, and it should be adopted
+ * to be compatible with Arm.
*/
- if (!(pci_resource_flags(pdev, 2) & IORESOURCE_IO)) {
+ if (pdev->revision >= 0x40) {
+ ast->ioregs = ast->regs + AST_IO_MM_OFFSET;
+ } else if (!(pci_resource_flags(pdev, 2) & IORESOURCE_IO)) {
drm_info(dev, "platform has no IO space, trying MMIO\n");
ast->ioregs = ast->regs + AST_IO_MM_OFFSET;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 095/286] btrfs: abort transaction when sibling keys check fails for leaves
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 094/286] drm/ast: Fix ARM compatibility Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 096/286] ARM: 9295/1: unwind:fix unwind abort for uleb128 case Greg Kroah-Hartman
` (199 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Filipe Manana,
David Sterba, Sasha Levin
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 9ae5afd02a03d4e22a17a9609b19400b77c36273 ]
If the sibling keys check fails before we move keys from one sibling
leaf to another, we are not aborting the transaction - we leave that to
some higher level caller of btrfs_search_slot() (or anything else that
uses it to insert items into a b+tree).
This means that the transaction abort will provide a stack trace that
omits the b+tree modification call chain. So change this to immediately
abort the transaction and therefore get a more useful stack trace that
shows us the call chain in the bt+tree modification code.
It's also important to immediately abort the transaction just in case
some higher level caller is not doing it, as this indicates a very
serious corruption and we should stop the possibility of doing further
damage.
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ctree.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 26bb10b6ca85d..986827370d8e1 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -3222,6 +3222,7 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
if (check_sibling_keys(left, right)) {
ret = -EUCLEAN;
+ btrfs_abort_transaction(trans, ret);
btrfs_tree_unlock(right);
free_extent_buffer(right);
return ret;
@@ -3444,6 +3445,7 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
if (check_sibling_keys(left, right)) {
ret = -EUCLEAN;
+ btrfs_abort_transaction(trans, ret);
goto out;
}
return __push_leaf_left(trans, path, min_data_size, empty, left,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 096/286] ARM: 9295/1: unwind:fix unwind abort for uleb128 case
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 095/286] btrfs: abort transaction when sibling keys check fails for leaves Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 097/286] perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG Greg Kroah-Hartman
` (198 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haibo Li, Linus Walleij,
Alexandre Mergnat, AngeloGioacchino Del Regno,
Russell King (Oracle), Sasha Levin
From: Haibo Li <haibo.li@mediatek.com>
[ Upstream commit fa3eeb638de0c1a9d2d860e5b48259facdd65176 ]
When unwind instruction is 0xb2,the subsequent instructions
are uleb128 bytes.
For now,it uses only the first uleb128 byte in code.
For vsp increments of 0x204~0x400,use one uleb128 byte like below:
0xc06a00e4 <unwind_test_work>: 0x80b27fac
Compact model index: 0
0xb2 0x7f vsp = vsp + 1024
0xac pop {r4, r5, r6, r7, r8, r14}
For vsp increments larger than 0x400,use two uleb128 bytes like below:
0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c
Compact model index: 1
0xb2 0x81 0x01 vsp = vsp + 1032
0xac pop {r4, r5, r6, r7, r8, r14}
The unwind works well since the decoded uleb128 byte is also 0x81.
For vsp increments larger than 0x600,use two uleb128 bytes like below:
0xc06a00e4 <unwind_test_work>: @0xc0cc9e0c
Compact model index: 1
0xb2 0x81 0x02 vsp = vsp + 1544
0xac pop {r4, r5, r6, r7, r8, r14}
In this case,the decoded uleb128 result is 0x101(vsp=0x204+(0x101<<2)).
While the uleb128 used in code is 0x81(vsp=0x204+(0x81<<2)).
The unwind aborts at this frame since it gets incorrect vsp.
To fix this,add uleb128 decode to cover all the above case.
Signed-off-by: Haibo Li <haibo.li@mediatek.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/kernel/unwind.c | 25 ++++++++++++++++++++++++-
1 file changed, 24 insertions(+), 1 deletion(-)
diff --git a/arch/arm/kernel/unwind.c b/arch/arm/kernel/unwind.c
index 53be7ea6181b3..9d2192156087b 100644
--- a/arch/arm/kernel/unwind.c
+++ b/arch/arm/kernel/unwind.c
@@ -308,6 +308,29 @@ static int unwind_exec_pop_subset_r0_to_r3(struct unwind_ctrl_block *ctrl,
return URC_OK;
}
+static unsigned long unwind_decode_uleb128(struct unwind_ctrl_block *ctrl)
+{
+ unsigned long bytes = 0;
+ unsigned long insn;
+ unsigned long result = 0;
+
+ /*
+ * unwind_get_byte() will advance `ctrl` one instruction at a time, so
+ * loop until we get an instruction byte where bit 7 is not set.
+ *
+ * Note: This decodes a maximum of 4 bytes to output 28 bits data where
+ * max is 0xfffffff: that will cover a vsp increment of 1073742336, hence
+ * it is sufficient for unwinding the stack.
+ */
+ do {
+ insn = unwind_get_byte(ctrl);
+ result |= (insn & 0x7f) << (bytes * 7);
+ bytes++;
+ } while (!!(insn & 0x80) && (bytes != sizeof(result)));
+
+ return result;
+}
+
/*
* Execute the current unwind instruction.
*/
@@ -361,7 +384,7 @@ static int unwind_exec_insn(struct unwind_ctrl_block *ctrl)
if (ret)
goto error;
} else if (insn == 0xb2) {
- unsigned long uleb128 = unwind_get_byte(ctrl);
+ unsigned long uleb128 = unwind_decode_uleb128(ctrl);
ctrl->vrs[SP] += 0x204 + (uleb128 << 2);
} else {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 097/286] perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 096/286] ARM: 9295/1: unwind:fix unwind abort for uleb128 case Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 098/286] hwmon: (k10temp) Add PCI ID for family 19, model 78h Greg Kroah-Hartman
` (197 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephane Eranian,
Peter Zijlstra (Intel), Kan Liang, Sasha Levin
From: Kan Liang <kan.liang@linux.intel.com>
[ Upstream commit b752ea0c28e3f7f0aaaad6abf84f735eebc37a60 ]
Several similar kernel warnings can be triggered,
[56605.607840] CPU0 PEBS record size 0, expected 32, config 0 cpuc->record_size=208
when the below commands are running in parallel for a while on SPR.
while true;
do
perf record --no-buildid -a --intr-regs=AX \
-e cpu/event=0xd0,umask=0x81/pp \
-c 10003 -o /dev/null ./triad;
done &
while true;
do
perf record -o /tmp/out -W -d \
-e '{ld_blocks.store_forward:period=1000000, \
MEM_TRANS_RETIRED.LOAD_LATENCY:u:precise=2:ldlat=4}' \
-c 1037 ./triad;
done
The triad program is just the generation of loads/stores.
The warnings are triggered when an unexpected PEBS record (with a
different config and size) is found.
A system-wide PEBS event with the large PEBS config may be enabled
during a context switch. Some PEBS records for the system-wide PEBS
may be generated while the old task is sched out but the new one
hasn't been sched in yet. When the new task is sched in, the
cpuc->pebs_record_size may be updated for the per-task PEBS events. So
the existing system-wide PEBS records have a different size from the
later PEBS records.
The PEBS buffer should be flushed right before the hardware is
reprogrammed. The new size and threshold should be updated after the
old buffer has been flushed.
Reported-by: Stephane Eranian <eranian@google.com>
Suggested-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20230421184529.3320912-1-kan.liang@linux.intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/ds.c | 56 ++++++++++++++++++-------------
arch/x86/include/asm/perf_event.h | 3 ++
2 files changed, 35 insertions(+), 24 deletions(-)
diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index a2e566e53076e..df88576d6b2a5 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -1229,12 +1229,14 @@ pebs_update_state(bool needed_cb, struct cpu_hw_events *cpuc,
struct perf_event *event, bool add)
{
struct pmu *pmu = event->pmu;
+
/*
* Make sure we get updated with the first PEBS
* event. It will trigger also during removal, but
* that does not hurt:
*/
- bool update = cpuc->n_pebs == 1;
+ if (cpuc->n_pebs == 1)
+ cpuc->pebs_data_cfg = PEBS_UPDATE_DS_SW;
if (needed_cb != pebs_needs_sched_cb(cpuc)) {
if (!needed_cb)
@@ -1242,7 +1244,7 @@ pebs_update_state(bool needed_cb, struct cpu_hw_events *cpuc,
else
perf_sched_cb_dec(pmu);
- update = true;
+ cpuc->pebs_data_cfg |= PEBS_UPDATE_DS_SW;
}
/*
@@ -1252,24 +1254,13 @@ pebs_update_state(bool needed_cb, struct cpu_hw_events *cpuc,
if (x86_pmu.intel_cap.pebs_baseline && add) {
u64 pebs_data_cfg;
- /* Clear pebs_data_cfg and pebs_record_size for first PEBS. */
- if (cpuc->n_pebs == 1) {
- cpuc->pebs_data_cfg = 0;
- cpuc->pebs_record_size = sizeof(struct pebs_basic);
- }
-
pebs_data_cfg = pebs_update_adaptive_cfg(event);
-
- /* Update pebs_record_size if new event requires more data. */
- if (pebs_data_cfg & ~cpuc->pebs_data_cfg) {
- cpuc->pebs_data_cfg |= pebs_data_cfg;
- adaptive_pebs_record_size_update();
- update = true;
- }
+ /*
+ * Be sure to update the thresholds when we change the record.
+ */
+ if (pebs_data_cfg & ~cpuc->pebs_data_cfg)
+ cpuc->pebs_data_cfg |= pebs_data_cfg | PEBS_UPDATE_DS_SW;
}
-
- if (update)
- pebs_update_threshold(cpuc);
}
void intel_pmu_pebs_add(struct perf_event *event)
@@ -1326,9 +1317,17 @@ static void intel_pmu_pebs_via_pt_enable(struct perf_event *event)
wrmsrl(base + idx, value);
}
+static inline void intel_pmu_drain_large_pebs(struct cpu_hw_events *cpuc)
+{
+ if (cpuc->n_pebs == cpuc->n_large_pebs &&
+ cpuc->n_pebs != cpuc->n_pebs_via_pt)
+ intel_pmu_drain_pebs_buffer();
+}
+
void intel_pmu_pebs_enable(struct perf_event *event)
{
struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
+ u64 pebs_data_cfg = cpuc->pebs_data_cfg & ~PEBS_UPDATE_DS_SW;
struct hw_perf_event *hwc = &event->hw;
struct debug_store *ds = cpuc->ds;
unsigned int idx = hwc->idx;
@@ -1344,11 +1343,22 @@ void intel_pmu_pebs_enable(struct perf_event *event)
if (x86_pmu.intel_cap.pebs_baseline) {
hwc->config |= ICL_EVENTSEL_ADAPTIVE;
- if (cpuc->pebs_data_cfg != cpuc->active_pebs_data_cfg) {
- wrmsrl(MSR_PEBS_DATA_CFG, cpuc->pebs_data_cfg);
- cpuc->active_pebs_data_cfg = cpuc->pebs_data_cfg;
+ if (pebs_data_cfg != cpuc->active_pebs_data_cfg) {
+ /*
+ * drain_pebs() assumes uniform record size;
+ * hence we need to drain when changing said
+ * size.
+ */
+ intel_pmu_drain_large_pebs(cpuc);
+ adaptive_pebs_record_size_update();
+ wrmsrl(MSR_PEBS_DATA_CFG, pebs_data_cfg);
+ cpuc->active_pebs_data_cfg = pebs_data_cfg;
}
}
+ if (cpuc->pebs_data_cfg & PEBS_UPDATE_DS_SW) {
+ cpuc->pebs_data_cfg = pebs_data_cfg;
+ pebs_update_threshold(cpuc);
+ }
if (idx >= INTEL_PMC_IDX_FIXED) {
if (x86_pmu.intel_cap.pebs_format < 5)
@@ -1391,9 +1401,7 @@ void intel_pmu_pebs_disable(struct perf_event *event)
struct cpu_hw_events *cpuc = this_cpu_ptr(&cpu_hw_events);
struct hw_perf_event *hwc = &event->hw;
- if (cpuc->n_pebs == cpuc->n_large_pebs &&
- cpuc->n_pebs != cpuc->n_pebs_via_pt)
- intel_pmu_drain_pebs_buffer();
+ intel_pmu_drain_large_pebs(cpuc);
cpuc->pebs_enabled &= ~(1ULL << hwc->idx);
diff --git a/arch/x86/include/asm/perf_event.h b/arch/x86/include/asm/perf_event.h
index 8fc15ed5e60bb..abf09882f58b6 100644
--- a/arch/x86/include/asm/perf_event.h
+++ b/arch/x86/include/asm/perf_event.h
@@ -121,6 +121,9 @@
#define PEBS_DATACFG_LBRS BIT_ULL(3)
#define PEBS_DATACFG_LBR_SHIFT 24
+/* Steal the highest bit of pebs_data_cfg for SW usage */
+#define PEBS_UPDATE_DS_SW BIT_ULL(63)
+
/*
* Intel "Architectural Performance Monitoring" CPUID
* detection/enumeration details:
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 098/286] hwmon: (k10temp) Add PCI ID for family 19, model 78h
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 097/286] perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 099/286] media: rcar-vin: Gen3 can not scale NV12 Greg Kroah-Hartman
` (196 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mario Limonciello,
Borislav Petkov (AMD), Guenter Roeck, Sasha Levin
From: Mario Limonciello <mario.limonciello@amd.com>
[ Upstream commit 7d8accfaa0ab65e4282c8e58950f7d688342cd86 ]
Enable k10temp on this system.
[ bp: Massage. ]
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20230427053338.16653-3-mario.limonciello@amd.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/k10temp.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
index be8bbb1c3a02d..823d0ca1d6059 100644
--- a/drivers/hwmon/k10temp.c
+++ b/drivers/hwmon/k10temp.c
@@ -507,6 +507,7 @@ static const struct pci_device_id k10temp_id_table[] = {
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M50H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M60H_DF_F3) },
{ PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M70H_DF_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_19H_M78H_DF_F3) },
{ PCI_VDEVICE(HYGON, PCI_DEVICE_ID_AMD_17H_DF_F3) },
{}
};
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 099/286] media: rcar-vin: Gen3 can not scale NV12
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 098/286] hwmon: (k10temp) Add PCI ID for family 19, model 78h Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 100/286] media: rcar-vin: Fix NV12 size alignment Greg Kroah-Hartman
` (195 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Hans Verkuil,
Sasha Levin
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit 879c5a458e532b95783ce27f704d1b21573066f7 ]
The VIN modules on Gen3 can not scale NV12, fail format validation if
the user tries. Currently no frames are produced if this is attempted.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
index 98bfd445a649b..cc6b59e5621ae 100644
--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
@@ -1312,6 +1312,11 @@ static int rvin_mc_validate_format(struct rvin_dev *vin, struct v4l2_subdev *sd,
}
if (rvin_scaler_needed(vin)) {
+ /* Gen3 can't scale NV12 */
+ if (vin->info->model == RCAR_GEN3 &&
+ vin->format.pixelformat == V4L2_PIX_FMT_NV12)
+ return -EPIPE;
+
if (!vin->scaler)
return -EPIPE;
} else {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 100/286] media: rcar-vin: Fix NV12 size alignment
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 099/286] media: rcar-vin: Gen3 can not scale NV12 Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 101/286] media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE Greg Kroah-Hartman
` (194 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Hans Verkuil,
Sasha Levin
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit cb88d8289fc222bd21b7a7f99b055e7e73e316f4 ]
When doing format validation for NV12 the width and height should be
aligned to 32 pixels.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 12 +++++++++---
1 file changed, 9 insertions(+), 3 deletions(-)
diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
index cc6b59e5621ae..23598e22adc72 100644
--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
@@ -1320,9 +1320,15 @@ static int rvin_mc_validate_format(struct rvin_dev *vin, struct v4l2_subdev *sd,
if (!vin->scaler)
return -EPIPE;
} else {
- if (fmt.format.width != vin->format.width ||
- fmt.format.height != vin->format.height)
- return -EPIPE;
+ if (vin->format.pixelformat == V4L2_PIX_FMT_NV12) {
+ if (ALIGN(fmt.format.width, 32) != vin->format.width ||
+ ALIGN(fmt.format.height, 32) != vin->format.height)
+ return -EPIPE;
+ } else {
+ if (fmt.format.width != vin->format.width ||
+ fmt.format.height != vin->format.height)
+ return -EPIPE;
+ }
}
if (fmt.format.code != vin->mbus_code)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 101/286] media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 100/286] media: rcar-vin: Fix NV12 size alignment Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 102/286] platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield Greg Kroah-Hartman
` (193 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Söderlund, Hans Verkuil,
Sasha Levin
From: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
[ Upstream commit e10707d5865c90d3dfe4ef589ce02ff4287fef85 ]
When adding proper support for V4L2_FIELD_ALTERNATE it was missed that
this field format should trigger an interrupt for each field, not just
for the whole frame. Fix this by marking it as progressive in the
capture setup, which will then select the correct interrupt mode.
Tested on both Gen2 and Gen3 with the result of a doubling of the frame
rate for V4L2_FIELD_ALTERNATE. From a PAL video source the frame rate is
now 50, which is expected for alternate field capture.
Signed-off-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/renesas/rcar-vin/rcar-dma.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
index 23598e22adc72..2a77353f10b59 100644
--- a/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
+++ b/drivers/media/platform/renesas/rcar-vin/rcar-dma.c
@@ -728,11 +728,9 @@ static int rvin_setup(struct rvin_dev *vin)
case V4L2_FIELD_SEQ_TB:
case V4L2_FIELD_SEQ_BT:
case V4L2_FIELD_NONE:
- vnmc = VNMC_IM_ODD_EVEN;
- progressive = true;
- break;
case V4L2_FIELD_ALTERNATE:
vnmc = VNMC_IM_ODD_EVEN;
+ progressive = true;
break;
default:
vnmc = VNMC_IM_ODD;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 102/286] platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 101/286] media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 103/286] platform/mellanox: fix potential race in mlxbf-tmfifo driver Greg Kroah-Hartman
` (192 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Winkler, Hans de Goede,
Sasha Levin
From: Julian Winkler <julian.winkler1@web.de>
[ Upstream commit 4a9b6850c794e4394cad99e2b863d75f5bc8e92f ]
This id was removed in commit b47018a778c1 ("platform/x86: intel_scu_ipc:
Remove Lincroft support"), saying it is only used on Moorestown,
but apparently the same id is also used on Medfield.
Tested on the Medfield based Motorola RAZR i smartphone.
Signed-off-by: Julian Winkler <julian.winkler1@web.de>
Link: https://lore.kernel.org/r/20230416154932.6579-1-julian.winkler1@web.de
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel_scu_pcidrv.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/platform/x86/intel_scu_pcidrv.c b/drivers/platform/x86/intel_scu_pcidrv.c
index 80abc708e4f2f..d904fad499aa5 100644
--- a/drivers/platform/x86/intel_scu_pcidrv.c
+++ b/drivers/platform/x86/intel_scu_pcidrv.c
@@ -34,6 +34,7 @@ static int intel_scu_pci_probe(struct pci_dev *pdev,
static const struct pci_device_id pci_ids[] = {
{ PCI_VDEVICE(INTEL, 0x080e) },
+ { PCI_VDEVICE(INTEL, 0x082a) },
{ PCI_VDEVICE(INTEL, 0x08ea) },
{ PCI_VDEVICE(INTEL, 0x0a94) },
{ PCI_VDEVICE(INTEL, 0x11a0) },
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 103/286] platform/mellanox: fix potential race in mlxbf-tmfifo driver
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 102/286] platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 104/286] gfs2: Dont deref jdesc in evict Greg Kroah-Hartman
` (191 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liming Sun, Vadim Pasternak,
Hans de Goede, Sasha Levin
From: Liming Sun <limings@nvidia.com>
[ Upstream commit 3d43f9f639542fadfb28f40b509bf147a6624d48 ]
This commit adds memory barrier for the 'vq' update in function
mlxbf_tmfifo_virtio_find_vqs() to avoid potential race due to
out-of-order memory write. It also adds barrier for the 'is_ready'
flag to make sure the initializations are visible before this flag
is checked.
Signed-off-by: Liming Sun <limings@nvidia.com>
Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
Link: https://lore.kernel.org/r/b98c0ab61d644ba38fa9b3fd1607b138b0dd820b.1682518748.git.limings@nvidia.com
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/mellanox/mlxbf-tmfifo.c | 11 +++++++++--
1 file changed, 9 insertions(+), 2 deletions(-)
diff --git a/drivers/platform/mellanox/mlxbf-tmfifo.c b/drivers/platform/mellanox/mlxbf-tmfifo.c
index 91a077c35b8b8..a79318e90a139 100644
--- a/drivers/platform/mellanox/mlxbf-tmfifo.c
+++ b/drivers/platform/mellanox/mlxbf-tmfifo.c
@@ -784,7 +784,7 @@ static void mlxbf_tmfifo_rxtx(struct mlxbf_tmfifo_vring *vring, bool is_rx)
fifo = vring->fifo;
/* Return if vdev is not ready. */
- if (!fifo->vdev[devid])
+ if (!fifo || !fifo->vdev[devid])
return;
/* Return if another vring is running. */
@@ -980,9 +980,13 @@ static int mlxbf_tmfifo_virtio_find_vqs(struct virtio_device *vdev,
vq->num_max = vring->num;
+ vq->priv = vring;
+
+ /* Make vq update visible before using it. */
+ virtio_mb(false);
+
vqs[i] = vq;
vring->vq = vq;
- vq->priv = vring;
}
return 0;
@@ -1302,6 +1306,9 @@ static int mlxbf_tmfifo_probe(struct platform_device *pdev)
mod_timer(&fifo->timer, jiffies + MLXBF_TMFIFO_TIMER_INTERVAL);
+ /* Make all updates visible before setting the 'is_ready' flag. */
+ virtio_mb(false);
+
fifo->is_ready = true;
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 104/286] gfs2: Dont deref jdesc in evict
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 103/286] platform/mellanox: fix potential race in mlxbf-tmfifo driver Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 105/286] drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution Greg Kroah-Hartman
` (190 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Lan, Bob Peterson,
Andreas Gruenbacher, Sasha Levin
From: Bob Peterson <rpeterso@redhat.com>
[ Upstream commit 504a10d9e46bc37b23d0a1ae2f28973c8516e636 ]
On corrupt gfs2 file systems the evict code can try to reference the
journal descriptor structure, jdesc, after it has been freed and set to
NULL. The sequence of events is:
init_journal()
...
fail_jindex:
gfs2_jindex_free(sdp); <------frees journals, sets jdesc = NULL
if (gfs2_holder_initialized(&ji_gh))
gfs2_glock_dq_uninit(&ji_gh);
fail:
iput(sdp->sd_jindex); <--references jdesc in evict_linked_inode
evict()
gfs2_evict_inode()
evict_linked_inode()
ret = gfs2_trans_begin(sdp, 0, sdp->sd_jdesc->jd_blocks);
<------references the now freed/zeroed sd_jdesc pointer.
The call to gfs2_trans_begin is done because the truncate_inode_pages
call can cause gfs2 events that require a transaction, such as removing
journaled data (jdata) blocks from the journal.
This patch fixes the problem by adding a check for sdp->sd_jdesc to
function gfs2_evict_inode. In theory, this should only happen to corrupt
gfs2 file systems, when gfs2 detects the problem, reports it, then tries
to evict all the system inodes it has read in up to that point.
Reported-by: Yang Lan <lanyang0908@gmail.com>
Signed-off-by: Bob Peterson <rpeterso@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/super.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/fs/gfs2/super.c b/fs/gfs2/super.c
index a83fa62106f0e..7891f331082aa 100644
--- a/fs/gfs2/super.c
+++ b/fs/gfs2/super.c
@@ -1410,6 +1410,14 @@ static void gfs2_evict_inode(struct inode *inode)
if (inode->i_nlink || sb_rdonly(sb) || !ip->i_no_addr)
goto out;
+ /*
+ * In case of an incomplete mount, gfs2_evict_inode() may be called for
+ * system files without having an active journal to write to. In that
+ * case, skip the filesystem evict.
+ */
+ if (!sdp->sd_jdesc)
+ goto out;
+
gfs2_holder_mark_uninitialized(&gh);
ret = evict_should_delete(inode, &gh);
if (ret == SHOULD_DEFER_EVICTION)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 105/286] drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 104/286] gfs2: Dont deref jdesc in evict Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 106/286] drm/amdgpu: set gfx9 onwards APU atomics support to be true Greg Kroah-Hartman
` (189 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thong Thai, Ruijing Dong,
Alex Deucher, Sasha Levin
From: Thong Thai <thong.thai@amd.com>
[ Upstream commit 476ac50fc30540e29191615a26aaf5f9dee91c49 ]
Update the maximum resolution reported for HEVC encoding on VCN 3
devices to reflect its 8K encoding capability.
v2: Also update the max height for H.264 encoding to match spec.
(Ruijing)
Signed-off-by: Thong Thai <thong.thai@amd.com>
Reviewed-by: Ruijing Dong <ruijing.dong@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/nv.c | 22 ++++++++++++++++------
1 file changed, 16 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/nv.c b/drivers/gpu/drm/amd/amdgpu/nv.c
index ebe0e2d7dbd1b..aa7f82b3fd6a9 100644
--- a/drivers/gpu/drm/amd/amdgpu/nv.c
+++ b/drivers/gpu/drm/amd/amdgpu/nv.c
@@ -98,6 +98,16 @@ static const struct amdgpu_video_codecs nv_video_codecs_decode =
};
/* Sienna Cichlid */
+static const struct amdgpu_video_codec_info sc_video_codecs_encode_array[] = {
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2160, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 7680, 4352, 0)},
+};
+
+static const struct amdgpu_video_codecs sc_video_codecs_encode = {
+ .codec_count = ARRAY_SIZE(sc_video_codecs_encode_array),
+ .codec_array = sc_video_codecs_encode_array,
+};
+
static const struct amdgpu_video_codec_info sc_video_codecs_decode_array_vcn0[] =
{
{codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG2, 4096, 4096, 3)},
@@ -136,8 +146,8 @@ static const struct amdgpu_video_codecs sc_video_codecs_decode_vcn1 =
/* SRIOV Sienna Cichlid, not const since data is controlled by host */
static struct amdgpu_video_codec_info sriov_sc_video_codecs_encode_array[] =
{
- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2304, 0)},
- {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 4096, 2304, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_MPEG4_AVC, 4096, 2160, 0)},
+ {codec_info_build(AMDGPU_INFO_VIDEO_CAPS_CODEC_IDX_HEVC, 7680, 4352, 0)},
};
static struct amdgpu_video_codec_info sriov_sc_video_codecs_decode_array_vcn0[] =
@@ -237,12 +247,12 @@ static int nv_query_video_codecs(struct amdgpu_device *adev, bool encode,
} else {
if (adev->vcn.harvest_config & AMDGPU_VCN_HARVEST_VCN0) {
if (encode)
- *codecs = &nv_video_codecs_encode;
+ *codecs = &sc_video_codecs_encode;
else
*codecs = &sc_video_codecs_decode_vcn1;
} else {
if (encode)
- *codecs = &nv_video_codecs_encode;
+ *codecs = &sc_video_codecs_encode;
else
*codecs = &sc_video_codecs_decode_vcn0;
}
@@ -251,14 +261,14 @@ static int nv_query_video_codecs(struct amdgpu_device *adev, bool encode,
case IP_VERSION(3, 0, 16):
case IP_VERSION(3, 0, 2):
if (encode)
- *codecs = &nv_video_codecs_encode;
+ *codecs = &sc_video_codecs_encode;
else
*codecs = &sc_video_codecs_decode_vcn0;
return 0;
case IP_VERSION(3, 1, 1):
case IP_VERSION(3, 1, 2):
if (encode)
- *codecs = &nv_video_codecs_encode;
+ *codecs = &sc_video_codecs_encode;
else
*codecs = &yc_video_codecs_decode;
return 0;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 106/286] drm/amdgpu: set gfx9 onwards APU atomics support to be true
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 105/286] drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 107/286] fbdev: imsttfb: Fix use after free bug in imsttfb_probe Greg Kroah-Hartman
` (188 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yifan Zhang, Lang Yu, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Yifan Zhang <yifan1.zhang@amd.com>
[ Upstream commit af7828fbceed4f9e503034111066a0adef3db383 ]
APUs w/ gfx9 onwards doesn't reply on PCIe atomics, rather
it is internal path w/ native atomic support. Set have_atomics_support
to true.
Signed-off-by: Yifan Zhang <yifan1.zhang@amd.com>
Reviewed-by: Lang Yu <lang.yu@amd.com>
Acked-by: Felix Kuehling <Felix.Kuehling@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
index 412cb3f1f8826..31413a604d0ae 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -3737,6 +3737,12 @@ int amdgpu_device_init(struct amdgpu_device *adev,
adev->have_atomics_support = ((struct amd_sriov_msg_pf2vf_info *)
adev->virt.fw_reserve.p_pf2vf)->pcie_atomic_ops_support_flags ==
(PCI_EXP_DEVCAP2_ATOMIC_COMP32 | PCI_EXP_DEVCAP2_ATOMIC_COMP64);
+ /* APUs w/ gfx9 onwards doesn't reply on PCIe atomics, rather it is a
+ * internal path natively support atomics, set have_atomics_support to true.
+ */
+ else if ((adev->flags & AMD_IS_APU) &&
+ (adev->ip_versions[GC_HWIP][0] > IP_VERSION(9, 0, 0)))
+ adev->have_atomics_support = true;
else
adev->have_atomics_support =
!pci_enable_atomic_ops_to_root(adev->pdev,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 107/286] fbdev: imsttfb: Fix use after free bug in imsttfb_probe
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 106/286] drm/amdgpu: set gfx9 onwards APU atomics support to be true Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 108/286] fbdev: modedb: Add 1920x1080 at 60 Hz video mode Greg Kroah-Hartman
` (187 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zheng Wang, Helge Deller,
Sasha Levin
From: Zheng Wang <zyytlz.wz@163.com>
[ Upstream commit c75f5a55061091030a13fef71b9995b89bc86213 ]
A use-after-free bug may occur if init_imstt invokes framebuffer_release
and free the info ptr. The caller, imsttfb_probe didn't notice that and
still keep the ptr as private data in pdev.
If we remove the driver which will call imsttfb_remove to make cleanup,
UAF happens.
Fix it by return error code if bad case happens in init_imstt.
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/imsttfb.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/video/fbdev/imsttfb.c b/drivers/video/fbdev/imsttfb.c
index bea45647184e1..975dd682fae4b 100644
--- a/drivers/video/fbdev/imsttfb.c
+++ b/drivers/video/fbdev/imsttfb.c
@@ -1347,7 +1347,7 @@ static const struct fb_ops imsttfb_ops = {
.fb_ioctl = imsttfb_ioctl,
};
-static void init_imstt(struct fb_info *info)
+static int init_imstt(struct fb_info *info)
{
struct imstt_par *par = info->par;
__u32 i, tmp, *ip, *end;
@@ -1420,7 +1420,7 @@ static void init_imstt(struct fb_info *info)
|| !(compute_imstt_regvals(par, info->var.xres, info->var.yres))) {
printk("imsttfb: %ux%ux%u not supported\n", info->var.xres, info->var.yres, info->var.bits_per_pixel);
framebuffer_release(info);
- return;
+ return -ENODEV;
}
sprintf(info->fix.id, "IMS TT (%s)", par->ramdac == IBM ? "IBM" : "TVP");
@@ -1456,12 +1456,13 @@ static void init_imstt(struct fb_info *info)
if (register_framebuffer(info) < 0) {
framebuffer_release(info);
- return;
+ return -ENODEV;
}
tmp = (read_reg_le32(par->dc_regs, SSTATUS) & 0x0f00) >> 8;
fb_info(info, "%s frame buffer; %uMB vram; chip version %u\n",
info->fix.id, info->fix.smem_len >> 20, tmp);
+ return 0;
}
static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
@@ -1529,10 +1530,10 @@ static int imsttfb_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
if (!par->cmap_regs)
goto error;
info->pseudo_palette = par->palette;
- init_imstt(info);
-
- pci_set_drvdata(pdev, info);
- return 0;
+ ret = init_imstt(info);
+ if (!ret)
+ pci_set_drvdata(pdev, info);
+ return ret;
error:
if (par->dc_regs)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 108/286] fbdev: modedb: Add 1920x1080 at 60 Hz video mode
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 107/286] fbdev: imsttfb: Fix use after free bug in imsttfb_probe Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 109/286] fbdev: stifb: Fix info entry in sti_struct on error path Greg Kroah-Hartman
` (186 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller, Sasha Levin
From: Helge Deller <deller@gmx.de>
[ Upstream commit c8902258b2b8ecaa1b8d88c312853c5b14c2553d ]
Add typical resolution for Full-HD monitors.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/core/modedb.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/video/fbdev/core/modedb.c b/drivers/video/fbdev/core/modedb.c
index 6473e0dfe1464..e78ec7f728463 100644
--- a/drivers/video/fbdev/core/modedb.c
+++ b/drivers/video/fbdev/core/modedb.c
@@ -257,6 +257,11 @@ static const struct fb_videomode modedb[] = {
{ NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3, 0,
FB_VMODE_DOUBLE },
+ /* 1920x1080 @ 60 Hz, 67.3 kHz hsync */
+ { NULL, 60, 1920, 1080, 6734, 148, 88, 36, 4, 44, 5, 0,
+ FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
+ FB_VMODE_NONINTERLACED },
+
/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
{ NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 109/286] fbdev: stifb: Fix info entry in sti_struct on error path
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 108/286] fbdev: modedb: Add 1920x1080 at 60 Hz video mode Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 110/286] nbd: Fix debugfs_create_dir error checking Greg Kroah-Hartman
` (185 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Helge Deller, Sasha Levin
From: Helge Deller <deller@gmx.de>
[ Upstream commit 0bdf1ad8d10bd4e50a8b1a2c53d15984165f7fea ]
Minor fix to reset the info field to NULL in case of error.
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/video/fbdev/stifb.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/video/fbdev/stifb.c b/drivers/video/fbdev/stifb.c
index ef8a4c5fc6875..63f51783352dc 100644
--- a/drivers/video/fbdev/stifb.c
+++ b/drivers/video/fbdev/stifb.c
@@ -1413,6 +1413,7 @@ static int __init stifb_init_fb(struct sti_struct *sti, int bpp_pref)
iounmap(info->screen_base);
out_err0:
kfree(fb);
+ sti->info = NULL;
return -ENXIO;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 110/286] nbd: Fix debugfs_create_dir error checking
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 109/286] fbdev: stifb: Fix info entry in sti_struct on error path Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 111/286] block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE Greg Kroah-Hartman
` (184 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ivan Orlov, Jens Axboe, Sasha Levin
From: Ivan Orlov <ivan.orlov0322@gmail.com>
[ Upstream commit 4913cfcf014c95f0437db2df1734472fd3e15098 ]
The debugfs_create_dir function returns ERR_PTR in case of error, and the
only correct way to check if an error occurred is 'IS_ERR' inline function.
This patch will replace the null-comparison with IS_ERR.
Signed-off-by: Ivan Orlov <ivan.orlov0322@gmail.com>
Link: https://lore.kernel.org/r/20230512130533.98709-1-ivan.orlov0322@gmail.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/nbd.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index e1c954094b6c0..dd0adcf745ff5 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -1666,7 +1666,7 @@ static int nbd_dev_dbg_init(struct nbd_device *nbd)
return -EIO;
dir = debugfs_create_dir(nbd_name(nbd), nbd_dbg_dir);
- if (!dir) {
+ if (IS_ERR(dir)) {
dev_err(nbd_to_dev(nbd), "Failed to create debugfs dir for '%s'\n",
nbd_name(nbd));
return -EIO;
@@ -1692,7 +1692,7 @@ static int nbd_dbg_init(void)
struct dentry *dbg_dir;
dbg_dir = debugfs_create_dir("nbd", NULL);
- if (!dbg_dir)
+ if (IS_ERR(dbg_dir))
return -EIO;
nbd_dbg_dir = dbg_dir;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 111/286] block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 110/286] nbd: Fix debugfs_create_dir error checking Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 112/286] nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G Greg Kroah-Hartman
` (183 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Christoph Hellwig,
Chaitanya Kulkarni, Jens Axboe, Sasha Levin
From: Guoqing Jiang <guoqing.jiang@linux.dev>
[ Upstream commit 5e6e08087a4acb4ee3574cea32dbff0f63c7f608 ]
Since flush bios are implemented as writes with no data and
the preflush flag per Christoph's comment [1].
And we need to change it in rnbd accordingly. Otherwise, I
got splatting when create fs from rnbd client.
[ 464.028545] ------------[ cut here ]------------
[ 464.028553] WARNING: CPU: 0 PID: 65 at block/blk-core.c:751 submit_bio_noacct+0x32c/0x5d0
[ ... ]
[ 464.028668] CPU: 0 PID: 65 Comm: kworker/0:1H Tainted: G OE 6.4.0-rc1 #9
[ 464.028671] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014
[ 464.028673] Workqueue: ib-comp-wq ib_cq_poll_work [ib_core]
[ 464.028717] RIP: 0010:submit_bio_noacct+0x32c/0x5d0
[ 464.028720] Code: 03 0f 85 51 fe ff ff 48 8b 43 18 8b 88 04 03 00 00 85 c9 0f 85 3f fe ff ff e9 be fd ff ff 0f b6 d0 3c 0d 74 26 83 fa 01 74 21 <0f> 0b b8 0a 00 00 00 e9 56 fd ff ff 4c 89 e7 e8 70 a1 03 00 84 c0
[ 464.028722] RSP: 0018:ffffaf3680b57c68 EFLAGS: 00010202
[ 464.028724] RAX: 0000000000060802 RBX: ffffa09dcc18bf00 RCX: 0000000000000000
[ 464.028726] RDX: 0000000000000002 RSI: 0000000000000000 RDI: ffffa09dde081d00
[ 464.028727] RBP: ffffaf3680b57c98 R08: ffffa09dde081d00 R09: ffffa09e38327200
[ 464.028729] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa09dde081d00
[ 464.028730] R13: ffffa09dcb06e1e8 R14: 0000000000000000 R15: 0000000000200000
[ 464.028733] FS: 0000000000000000(0000) GS:ffffa09e3bc00000(0000) knlGS:0000000000000000
[ 464.028735] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 464.028736] CR2: 000055a4e8206c40 CR3: 0000000119f06000 CR4: 00000000003506f0
[ 464.028738] Call Trace:
[ 464.028740] <TASK>
[ 464.028746] submit_bio+0x1b/0x80
[ 464.028748] rnbd_srv_rdma_ev+0x50d/0x10c0 [rnbd_server]
[ 464.028754] ? percpu_ref_get_many.constprop.0+0x55/0x140 [rtrs_server]
[ 464.028760] ? __this_cpu_preempt_check+0x13/0x20
[ 464.028769] process_io_req+0x1dc/0x450 [rtrs_server]
[ 464.028775] rtrs_srv_inv_rkey_done+0x67/0xb0 [rtrs_server]
[ 464.028780] __ib_process_cq+0xbc/0x1f0 [ib_core]
[ 464.028793] ib_cq_poll_work+0x2b/0xa0 [ib_core]
[ 464.028804] process_one_work+0x2a9/0x580
[1]. https://lore.kernel.org/all/ZFHgefWofVt24tRl@infradead.org/
Signed-off-by: Guoqing Jiang <guoqing.jiang@linux.dev>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Link: https://lore.kernel.org/r/20230512034631.28686-1-guoqing.jiang@linux.dev
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/rnbd/rnbd-proto.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/block/rnbd/rnbd-proto.h b/drivers/block/rnbd/rnbd-proto.h
index ea7ac8bca63cf..da1d0542d7e2c 100644
--- a/drivers/block/rnbd/rnbd-proto.h
+++ b/drivers/block/rnbd/rnbd-proto.h
@@ -241,7 +241,7 @@ static inline blk_opf_t rnbd_to_bio_flags(u32 rnbd_opf)
bio_opf = REQ_OP_WRITE;
break;
case RNBD_OP_FLUSH:
- bio_opf = REQ_OP_FLUSH | REQ_PREFLUSH;
+ bio_opf = REQ_OP_WRITE | REQ_PREFLUSH;
break;
case RNBD_OP_DISCARD:
bio_opf = REQ_OP_DISCARD;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 112/286] nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 111/286] block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 113/286] nvme-pci: add quirk for missing secondary temperature thresholds Greg Kroah-Hartman
` (182 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrey God, Sagi Grimberg,
Christoph Hellwig, Sasha Levin
From: Sagi Grimberg <sagi@grimberg.me>
[ Upstream commit 1616d6c3717bae9041a4240d381ec56ccdaafedc ]
Add a quirk to fix HS-SSD-FUTURE 2048G SSD drives reporting duplicate
nsids.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217384
Reported-by: Andrey God <andreygod83@protonmail.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/pci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index cd7873de31215..bbf96567365cd 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3445,6 +3445,8 @@ static const struct pci_device_id nvme_id_table[] = {
NVME_QUIRK_IGNORE_DEV_SUBNQN, },
{ PCI_DEVICE(0x10ec, 0x5763), /* TEAMGROUP T-FORCE CARDEA ZERO Z330 SSD */
.driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x1e4b, 0x1602), /* HS-SSD-FUTURE 2048G */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
.driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065),
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 113/286] nvme-pci: add quirk for missing secondary temperature thresholds
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 112/286] nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 114/286] nvme-pci: clamp max_hw_sectors based on DMA optimized limitation Greg Kroah-Hartman
` (181 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hristo Venev, Guenter Roeck,
Christoph Hellwig, Sasha Levin
From: Hristo Venev <hristo@venev.name>
[ Upstream commit bd375feeaf3408ed00e08c3bc918d6be15f691ad ]
On Kingston KC3000 and Kingston FURY Renegade (both have the same PCI
IDs) accessing temp3_{min,max} fails with an invalid field error (note
that there is no problem setting the thresholds for temp1).
This contradicts the NVM Express Base Specification 2.0b, page 292:
The over temperature threshold and under temperature threshold
features shall be implemented for all implemented temperature sensors
(i.e., all Temperature Sensor fields that report a non-zero value).
Define NVME_QUIRK_NO_SECONDARY_TEMP_THRESH that disables the thresholds
for all but the composite temperature and set it for this device.
Signed-off-by: Hristo Venev <hristo@venev.name>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/hwmon.c | 4 +++-
drivers/nvme/host/nvme.h | 5 +++++
drivers/nvme/host/pci.c | 2 ++
3 files changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/hwmon.c b/drivers/nvme/host/hwmon.c
index 9e6e56c20ec99..316f3e4ca7cc6 100644
--- a/drivers/nvme/host/hwmon.c
+++ b/drivers/nvme/host/hwmon.c
@@ -163,7 +163,9 @@ static umode_t nvme_hwmon_is_visible(const void *_data,
case hwmon_temp_max:
case hwmon_temp_min:
if ((!channel && data->ctrl->wctemp) ||
- (channel && data->log->temp_sensor[channel - 1])) {
+ (channel && data->log->temp_sensor[channel - 1] &&
+ !(data->ctrl->quirks &
+ NVME_QUIRK_NO_SECONDARY_TEMP_THRESH))) {
if (data->ctrl->quirks &
NVME_QUIRK_NO_TEMP_THRESH_CHANGE)
return 0444;
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index bf46f122e9e1e..a2d4f59e0535a 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -149,6 +149,11 @@ enum nvme_quirks {
* Reports garbage in the namespace identifiers (eui64, nguid, uuid).
*/
NVME_QUIRK_BOGUS_NID = (1 << 18),
+
+ /*
+ * No temperature thresholds for channels other than 0 (Composite).
+ */
+ NVME_QUIRK_NO_SECONDARY_TEMP_THRESH = (1 << 19),
};
/*
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index bbf96567365cd..a7772c0194d5a 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3406,6 +3406,8 @@ static const struct pci_device_id nvme_id_table[] = {
.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
{ PCI_DEVICE(0x2646, 0x2263), /* KINGSTON A2000 NVMe SSD */
.driver_data = NVME_QUIRK_NO_DEEPEST_PS, },
+ { PCI_DEVICE(0x2646, 0x5013), /* Kingston KC3000, Kingston FURY Renegade */
+ .driver_data = NVME_QUIRK_NO_SECONDARY_TEMP_THRESH, },
{ PCI_DEVICE(0x2646, 0x5018), /* KINGSTON OM8SFP4xxxxP OS21012 NVMe SSD */
.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
{ PCI_DEVICE(0x2646, 0x5016), /* KINGSTON OM3PGP4xxxxP OS21011 NVMe SSD */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 114/286] nvme-pci: clamp max_hw_sectors based on DMA optimized limitation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 113/286] nvme-pci: add quirk for missing secondary temperature thresholds Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 115/286] ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12 Greg Kroah-Hartman
` (180 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keith Busch, Adrian Huang,
Christoph Hellwig, Sasha Levin, Jiwei Sun
From: Adrian Huang <ahuang12@lenovo.com>
[ Upstream commit 3710e2b056cb92ad816e4d79fa54a6a5b6ad8cbd ]
When running the fio test on a 448-core AMD server + a NVME disk,
a soft lockup or a hard lockup call trace is shown:
[soft lockup]
watchdog: BUG: soft lockup - CPU#126 stuck for 23s! [swapper/126:0]
RIP: 0010:_raw_spin_unlock_irqrestore+0x21/0x50
...
Call Trace:
<IRQ>
fq_flush_timeout+0x7d/0xd0
? __pfx_fq_flush_timeout+0x10/0x10
call_timer_fn+0x2e/0x150
run_timer_softirq+0x48a/0x560
? __pfx_fq_flush_timeout+0x10/0x10
? clockevents_program_event+0xaf/0x130
__do_softirq+0xf1/0x335
irq_exit_rcu+0x9f/0xd0
sysvec_apic_timer_interrupt+0xb4/0xd0
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1f/0x30
...
Obvisouly, fq_flush_timeout spends over 20 seconds. Here is ftrace log:
| fq_flush_timeout() {
| fq_ring_free() {
| put_pages_list() {
0.170 us | free_unref_page_list();
0.810 us | }
| free_iova_fast() {
| free_iova() {
* 85622.66 us | _raw_spin_lock_irqsave();
2.860 us | remove_iova();
0.600 us | _raw_spin_unlock_irqrestore();
0.470 us | lock_info_report();
2.420 us | free_iova_mem.part.0();
* 85638.27 us | }
* 85638.84 us | }
| put_pages_list() {
0.230 us | free_unref_page_list();
0.470 us | }
... ...
$ 31017069 us | }
Most of cores are under lock contention for acquiring iova_rbtree_lock due
to the iova flush queue mechanism.
[hard lockup]
NMI watchdog: Watchdog detected hard LOCKUP on cpu 351
RIP: 0010:native_queued_spin_lock_slowpath+0x2d8/0x330
Call Trace:
<IRQ>
_raw_spin_lock_irqsave+0x4f/0x60
free_iova+0x27/0xd0
free_iova_fast+0x4d/0x1d0
fq_ring_free+0x9b/0x150
iommu_dma_free_iova+0xb4/0x2e0
__iommu_dma_unmap+0x10b/0x140
iommu_dma_unmap_sg+0x90/0x110
dma_unmap_sg_attrs+0x4a/0x50
nvme_unmap_data+0x5d/0x120 [nvme]
nvme_pci_complete_batch+0x77/0xc0 [nvme]
nvme_irq+0x2ee/0x350 [nvme]
? __pfx_nvme_pci_complete_batch+0x10/0x10 [nvme]
__handle_irq_event_percpu+0x53/0x1a0
handle_irq_event_percpu+0x19/0x60
handle_irq_event+0x3d/0x60
handle_edge_irq+0xb3/0x210
__common_interrupt+0x7f/0x150
common_interrupt+0xc5/0xf0
</IRQ>
<TASK>
asm_common_interrupt+0x2b/0x40
...
ftrace shows fq_ring_free spends over 10 seconds [1]. Again, most of
cores are under lock contention for acquiring iova_rbtree_lock due
to the iova flush queue mechanism.
[Root Cause]
The root cause is that the max_hw_sectors_kb of nvme disk (mdts=10)
is 4096kb, which streaming DMA mappings cannot benefit from the
scalable IOVA mechanism introduced by the commit 9257b4a206fc
("iommu/iova: introduce per-cpu caching to iova allocation") if
the length is greater than 128kb.
To fix the lock contention issue, clamp max_hw_sectors based on
DMA optimized limitation in order to leverage scalable IOVA mechanism.
Note: The issue does not happen with another NVME disk (mdts = 5
and max_hw_sectors_kb = 128)
[1] https://gist.github.com/AdrianHuang/bf8ec7338204837631fbdaed25d19cc4
Suggested-by: Keith Busch <kbusch@kernel.org>
Reported-and-tested-by: Jiwei Sun <sunjw10@lenovo.com>
Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
Reviewed-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/pci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index a7772c0194d5a..a389f1ea0b151 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -2960,7 +2960,7 @@ static struct nvme_dev *nvme_pci_alloc_dev(struct pci_dev *pdev,
* over a single page.
*/
dev->ctrl.max_hw_sectors = min_t(u32,
- NVME_MAX_KB_SZ << 1, dma_max_mapping_size(&pdev->dev) >> 9);
+ NVME_MAX_KB_SZ << 1, dma_opt_mapping_size(&pdev->dev) >> 9);
dev->ctrl.max_segments = NVME_MAX_SEGS;
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 115/286] ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 114/286] nvme-pci: clamp max_hw_sectors based on DMA optimized limitation Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 116/286] ASoC: dwc: limit the number of overrun messages Greg Kroah-Hartman
` (179 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Jeremy Soller <jeremy@system76.com>
[ Upstream commit 7b9891ad25246b18b5ccc19518da7abc7763aa0a ]
Add pang12 quirk to enable the internal microphone.
Signed-off-by: Jeremy Soller <jeremy@system76.com
Signed-off-by: Tim Crawford <tcrawford@system76.com
Link: https://lore.kernel.org/r/20230505161458.19676-1-tcrawford@system76.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/amd/yc/acp6x-mach.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/sound/soc/amd/yc/acp6x-mach.c b/sound/soc/amd/yc/acp6x-mach.c
index b9958e5553674..84b401b685f7f 100644
--- a/sound/soc/amd/yc/acp6x-mach.c
+++ b/sound/soc/amd/yc/acp6x-mach.c
@@ -297,6 +297,13 @@ static const struct dmi_system_id yc_acp_quirk_table[] = {
DMI_MATCH(DMI_BOARD_NAME, "8A22"),
}
},
+ {
+ .driver_data = &acp6x_card,
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "System76"),
+ DMI_MATCH(DMI_PRODUCT_VERSION, "pang12"),
+ }
+ },
{}
};
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 116/286] ASoC: dwc: limit the number of overrun messages
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 115/286] ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12 Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 117/286] cpupower:Fix resource leaks in sysfs_get_enabled() Greg Kroah-Hartman
` (178 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Maxim Kochetkov <fido_max@inbox.ru>
[ Upstream commit ab6ecfbf40fccf74b6ec2ba7ed6dd2fc024c3af2 ]
On slow CPU (FPGA/QEMU emulated) printing overrun messages from
interrupt handler to uart console may leads to more overrun errors.
So use dev_err_ratelimited to limit the number of error messages.
Signed-off-by: Maxim Kochetkov <fido_max@inbox.ru
Link: https://lore.kernel.org/r/20230505062820.21840-1-fido_max@inbox.ru
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/dwc/dwc-i2s.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/dwc/dwc-i2s.c b/sound/soc/dwc/dwc-i2s.c
index 7f7dd07c63b2f..3496301582b22 100644
--- a/sound/soc/dwc/dwc-i2s.c
+++ b/sound/soc/dwc/dwc-i2s.c
@@ -132,13 +132,13 @@ static irqreturn_t i2s_irq_handler(int irq, void *dev_id)
/* Error Handling: TX */
if (isr[i] & ISR_TXFO) {
- dev_err(dev->dev, "TX overrun (ch_id=%d)\n", i);
+ dev_err_ratelimited(dev->dev, "TX overrun (ch_id=%d)\n", i);
irq_valid = true;
}
/* Error Handling: TX */
if (isr[i] & ISR_RXFO) {
- dev_err(dev->dev, "RX overrun (ch_id=%d)\n", i);
+ dev_err_ratelimited(dev->dev, "RX overrun (ch_id=%d)\n", i);
irq_valid = true;
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 117/286] cpupower:Fix resource leaks in sysfs_get_enabled()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 116/286] ASoC: dwc: limit the number of overrun messages Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 118/286] ASoC: SOF: amd: Fix NULL pointer crash in acp_sof_ipc_msg_data function Greg Kroah-Hartman
` (177 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hao Zeng, Shuah Khan, Sasha Levin
From: Hao Zeng <zenghao@kylinos.cn>
[ Upstream commit e652be0f59d4ba4d5c636b1f7f4dcb73aae049fa ]
The sysfs_get_enabled() opened file processor not closed,
may cause a file handle leak.
Putting error handling and resource cleanup code together
makes the code easy to maintain and read.
Removed the unnecessary else if branch from the original
function, as it should return an error in cases other than '0'.
Signed-off-by: Hao Zeng <zenghao@kylinos.cn>
Suggested-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/power/cpupower/lib/powercap.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
diff --git a/tools/power/cpupower/lib/powercap.c b/tools/power/cpupower/lib/powercap.c
index 0ce29ee4c2e46..a7a59c6bacda8 100644
--- a/tools/power/cpupower/lib/powercap.c
+++ b/tools/power/cpupower/lib/powercap.c
@@ -40,25 +40,34 @@ static int sysfs_get_enabled(char *path, int *mode)
{
int fd;
char yes_no;
+ int ret = 0;
*mode = 0;
fd = open(path, O_RDONLY);
- if (fd == -1)
- return -1;
+ if (fd == -1) {
+ ret = -1;
+ goto out;
+ }
if (read(fd, &yes_no, 1) != 1) {
- close(fd);
- return -1;
+ ret = -1;
+ goto out_close;
}
if (yes_no == '1') {
*mode = 1;
- return 0;
+ goto out_close;
} else if (yes_no == '0') {
- return 0;
+ goto out_close;
+ } else {
+ ret = -1;
+ goto out_close;
}
- return -1;
+out_close:
+ close(fd);
+out:
+ return ret;
}
int powercap_get_enabled(int *mode)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 118/286] ASoC: SOF: amd: Fix NULL pointer crash in acp_sof_ipc_msg_data function
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 117/286] cpupower:Fix resource leaks in sysfs_get_enabled() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 119/286] um: harddog: fix modular build Greg Kroah-Hartman
` (176 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: V sujith kumar Reddy <Vsujithkumar.Reddy@amd.com>
[ Upstream commit 051d71e073614a72ad423d6dacba37a7eeff274d ]
Check substream and runtime variables before assigning.
Signed-off-by: V sujith kumar Reddy <Vsujithkumar.Reddy@amd.com
Link: https://lore.kernel.org/r/20230508070510.6100-1-Vsujithkumar.Reddy@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/amd/acp-ipc.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/sound/soc/sof/amd/acp-ipc.c b/sound/soc/sof/amd/acp-ipc.c
index 4e0c48a361599..749e856dc6011 100644
--- a/sound/soc/sof/amd/acp-ipc.c
+++ b/sound/soc/sof/amd/acp-ipc.c
@@ -209,7 +209,12 @@ int acp_sof_ipc_msg_data(struct snd_sof_dev *sdev, struct snd_sof_pcm_stream *sp
acp_mailbox_read(sdev, offset, p, sz);
} else {
struct snd_pcm_substream *substream = sps->substream;
- struct acp_dsp_stream *stream = substream->runtime->private_data;
+ struct acp_dsp_stream *stream;
+
+ if (!substream || !substream->runtime)
+ return -ESTRPIPE;
+
+ stream = substream->runtime->private_data;
if (!stream)
return -ESTRPIPE;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 119/286] um: harddog: fix modular build
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 118/286] ASoC: SOF: amd: Fix NULL pointer crash in acp_sof_ipc_msg_data function Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 120/286] xfrm: Check if_id in inbound policy/secpath match Greg Kroah-Hartman
` (175 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Johannes Berg,
Richard Weinberger, Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 73a23d7710331a530e972903318528b75e5a5f58 ]
Since we no longer (want to) export any libc symbols the
_user portions of any drivers need to be built into image
rather than the module. I missed this for the watchdog.
Fix the watchdog accordingly.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/um/drivers/Makefile | 4 +++-
arch/um/drivers/harddog.h | 9 +++++++++
arch/um/drivers/harddog_kern.c | 7 +------
arch/um/drivers/harddog_user.c | 1 +
arch/um/drivers/harddog_user_exp.c | 9 +++++++++
5 files changed, 23 insertions(+), 7 deletions(-)
create mode 100644 arch/um/drivers/harddog.h
create mode 100644 arch/um/drivers/harddog_user_exp.c
diff --git a/arch/um/drivers/Makefile b/arch/um/drivers/Makefile
index dee6f66353b33..a461a950f0518 100644
--- a/arch/um/drivers/Makefile
+++ b/arch/um/drivers/Makefile
@@ -16,7 +16,8 @@ mconsole-objs := mconsole_kern.o mconsole_user.o
hostaudio-objs := hostaudio_kern.o
ubd-objs := ubd_kern.o ubd_user.o
port-objs := port_kern.o port_user.o
-harddog-objs := harddog_kern.o harddog_user.o
+harddog-objs := harddog_kern.o
+harddog-builtin-$(CONFIG_UML_WATCHDOG) := harddog_user.o harddog_user_exp.o
rtc-objs := rtc_kern.o rtc_user.o
LDFLAGS_pcap.o = $(shell $(CC) $(KBUILD_CFLAGS) -print-file-name=libpcap.a)
@@ -60,6 +61,7 @@ obj-$(CONFIG_PTY_CHAN) += pty.o
obj-$(CONFIG_TTY_CHAN) += tty.o
obj-$(CONFIG_XTERM_CHAN) += xterm.o xterm_kern.o
obj-$(CONFIG_UML_WATCHDOG) += harddog.o
+obj-y += $(harddog-builtin-y) $(harddog-builtin-m)
obj-$(CONFIG_BLK_DEV_COW_COMMON) += cow_user.o
obj-$(CONFIG_UML_RANDOM) += random.o
obj-$(CONFIG_VIRTIO_UML) += virtio_uml.o
diff --git a/arch/um/drivers/harddog.h b/arch/um/drivers/harddog.h
new file mode 100644
index 0000000000000..6d9ea60e7133e
--- /dev/null
+++ b/arch/um/drivers/harddog.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+#ifndef UM_WATCHDOG_H
+#define UM_WATCHDOG_H
+
+int start_watchdog(int *in_fd_ret, int *out_fd_ret, char *sock);
+void stop_watchdog(int in_fd, int out_fd);
+int ping_watchdog(int fd);
+
+#endif /* UM_WATCHDOG_H */
diff --git a/arch/um/drivers/harddog_kern.c b/arch/um/drivers/harddog_kern.c
index e6d4f43deba82..60d1c6cab8a95 100644
--- a/arch/um/drivers/harddog_kern.c
+++ b/arch/um/drivers/harddog_kern.c
@@ -47,6 +47,7 @@
#include <linux/spinlock.h>
#include <linux/uaccess.h>
#include "mconsole.h"
+#include "harddog.h"
MODULE_LICENSE("GPL");
@@ -60,8 +61,6 @@ static int harddog_out_fd = -1;
* Allow only one person to hold it open
*/
-extern int start_watchdog(int *in_fd_ret, int *out_fd_ret, char *sock);
-
static int harddog_open(struct inode *inode, struct file *file)
{
int err = -EBUSY;
@@ -92,8 +91,6 @@ static int harddog_open(struct inode *inode, struct file *file)
return err;
}
-extern void stop_watchdog(int in_fd, int out_fd);
-
static int harddog_release(struct inode *inode, struct file *file)
{
/*
@@ -112,8 +109,6 @@ static int harddog_release(struct inode *inode, struct file *file)
return 0;
}
-extern int ping_watchdog(int fd);
-
static ssize_t harddog_write(struct file *file, const char __user *data, size_t len,
loff_t *ppos)
{
diff --git a/arch/um/drivers/harddog_user.c b/arch/um/drivers/harddog_user.c
index 070468d22e394..9ed89304975ed 100644
--- a/arch/um/drivers/harddog_user.c
+++ b/arch/um/drivers/harddog_user.c
@@ -7,6 +7,7 @@
#include <unistd.h>
#include <errno.h>
#include <os.h>
+#include "harddog.h"
struct dog_data {
int stdin_fd;
diff --git a/arch/um/drivers/harddog_user_exp.c b/arch/um/drivers/harddog_user_exp.c
new file mode 100644
index 0000000000000..c74d4b815d143
--- /dev/null
+++ b/arch/um/drivers/harddog_user_exp.c
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/export.h>
+#include "harddog.h"
+
+#if IS_MODULE(CONFIG_UML_WATCHDOG)
+EXPORT_SYMBOL(start_watchdog);
+EXPORT_SYMBOL(stop_watchdog);
+EXPORT_SYMBOL(ping_watchdog);
+#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 120/286] xfrm: Check if_id in inbound policy/secpath match
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 119/286] um: harddog: fix modular build Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 121/286] ASoC: jz4740-i2s: Make I2S divider calculations more robust Greg Kroah-Hartman
` (174 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benedict Wong, Steffen Klassert,
Sasha Levin
From: Benedict Wong <benedictwong@google.com>
[ Upstream commit 8680407b6f8f5fba59e8f1d63c869abc280f04df ]
This change ensures that if configured in the policy, the if_id set in
the policy and secpath states match during the inbound policy check.
Without this, there is potential for ambiguity where entries in the
secpath differing by only the if_id could be mismatched.
Notably, this is checked in the outbound direction when resolving
templates to SAs, but not on the inbound path when matching SAs and
policies.
Test: Tested against Android kernel unit tests & CTS
Signed-off-by: Benedict Wong <benedictwong@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_policy.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 21a3a1cd3d6de..6d15788b51231 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -3312,7 +3312,7 @@ xfrm_secpath_reject(int idx, struct sk_buff *skb, const struct flowi *fl)
static inline int
xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
- unsigned short family)
+ unsigned short family, u32 if_id)
{
if (xfrm_state_kern(x))
return tmpl->optional && !xfrm_state_addr_cmp(tmpl, x, tmpl->encap_family);
@@ -3323,7 +3323,8 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
(tmpl->allalgs || (tmpl->aalgos & (1<<x->props.aalgo)) ||
!(xfrm_id_proto_match(tmpl->id.proto, IPSEC_PROTO_ANY))) &&
!(x->props.mode != XFRM_MODE_TRANSPORT &&
- xfrm_state_addr_cmp(tmpl, x, family));
+ xfrm_state_addr_cmp(tmpl, x, family)) &&
+ (if_id == 0 || if_id == x->if_id);
}
/*
@@ -3335,7 +3336,7 @@ xfrm_state_ok(const struct xfrm_tmpl *tmpl, const struct xfrm_state *x,
*/
static inline int
xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int start,
- unsigned short family)
+ unsigned short family, u32 if_id)
{
int idx = start;
@@ -3345,7 +3346,7 @@ xfrm_policy_ok(const struct xfrm_tmpl *tmpl, const struct sec_path *sp, int star
} else
start = -1;
for (; idx < sp->len; idx++) {
- if (xfrm_state_ok(tmpl, sp->xvec[idx], family))
+ if (xfrm_state_ok(tmpl, sp->xvec[idx], family, if_id))
return ++idx;
if (sp->xvec[idx]->props.mode != XFRM_MODE_TRANSPORT) {
if (start == -1)
@@ -3724,7 +3725,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
* are implied between each two transformations.
*/
for (i = xfrm_nr-1, k = 0; i >= 0; i--) {
- k = xfrm_policy_ok(tpp[i], sp, k, family);
+ k = xfrm_policy_ok(tpp[i], sp, k, family, if_id);
if (k < 0) {
if (k < -1)
/* "-2 - errored_index" returned */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 121/286] ASoC: jz4740-i2s: Make I2S divider calculations more robust
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 120/286] xfrm: Check if_id in inbound policy/secpath match Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 122/286] ASoC: dt-bindings: Adjust #sound-dai-cells on TIs single-DAI codecs Greg Kroah-Hartman
` (173 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Aidan MacDonald <aidanmacdonald.0x0@gmail.com>
[ Upstream commit ad721bc919edfd8b4b06977458a412011e2f0c50 ]
When the CPU supplies bit/frame clocks, the system clock (clk_i2s)
is divided to produce the bit clock. This is a simple 1/N divider
with a fairly limited range, so for a given system clock frequency
only a few sample rates can be produced. Usually a wider range of
sample rates is supported by varying the system clock frequency.
The old calculation method was not very robust and could easily
produce the wrong clock rate, especially with non-standard rates.
For example, if the system clock is 1.99x the target bit clock
rate, the divider would be calculated as 1 instead of the more
accurate 2.
Instead, use a more accurate method that considers two adjacent
divider settings and selects the one that produces the least error
versus the requested rate. If the error is 5% or higher then the
rate setting is rejected to prevent garbled audio.
Skip divider calculation when the codec is supplying both the bit
and frame clock; in that case, the divider outputs are unused and
we don't want to constrain the sample rate.
Signed-off-by: Aidan MacDonald <aidanmacdonald.0x0@gmail.com
Link: https://lore.kernel.org/r/20230509125134.208129-1-aidanmacdonald.0x0@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/jz4740/jz4740-i2s.c | 54 ++++++++++++++++++++++++++++++++---
1 file changed, 50 insertions(+), 4 deletions(-)
diff --git a/sound/soc/jz4740/jz4740-i2s.c b/sound/soc/jz4740/jz4740-i2s.c
index 6d9cfe0a50411..d0f6c945d9aee 100644
--- a/sound/soc/jz4740/jz4740-i2s.c
+++ b/sound/soc/jz4740/jz4740-i2s.c
@@ -218,18 +218,48 @@ static int jz4740_i2s_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
return 0;
}
+static int jz4740_i2s_get_i2sdiv(unsigned long mclk, unsigned long rate,
+ unsigned long i2sdiv_max)
+{
+ unsigned long div, rate1, rate2, err1, err2;
+
+ div = mclk / (64 * rate);
+ if (div == 0)
+ div = 1;
+
+ rate1 = mclk / (64 * div);
+ rate2 = mclk / (64 * (div + 1));
+
+ err1 = abs(rate1 - rate);
+ err2 = abs(rate2 - rate);
+
+ /*
+ * Choose the divider that produces the smallest error in the
+ * output rate and reject dividers with a 5% or higher error.
+ * In the event that both dividers are outside the acceptable
+ * error margin, reject the rate to prevent distorted audio.
+ * (The number 5% is arbitrary.)
+ */
+ if (div <= i2sdiv_max && err1 <= err2 && err1 < rate/20)
+ return div;
+ if (div < i2sdiv_max && err2 < rate/20)
+ return div + 1;
+
+ return -EINVAL;
+}
+
static int jz4740_i2s_hw_params(struct snd_pcm_substream *substream,
struct snd_pcm_hw_params *params, struct snd_soc_dai *dai)
{
struct jz4740_i2s *i2s = snd_soc_dai_get_drvdata(dai);
struct regmap_field *div_field;
+ unsigned long i2sdiv_max;
unsigned int sample_size;
- uint32_t ctrl;
- int div;
+ uint32_t ctrl, conf;
+ int div = 1;
regmap_read(i2s->regmap, JZ_REG_AIC_CTRL, &ctrl);
-
- div = clk_get_rate(i2s->clk_i2s) / (64 * params_rate(params));
+ regmap_read(i2s->regmap, JZ_REG_AIC_CONF, &conf);
switch (params_format(params)) {
case SNDRV_PCM_FORMAT_S8:
@@ -258,11 +288,27 @@ static int jz4740_i2s_hw_params(struct snd_pcm_substream *substream,
ctrl &= ~JZ_AIC_CTRL_MONO_TO_STEREO;
div_field = i2s->field_i2sdiv_playback;
+ i2sdiv_max = GENMASK(i2s->soc_info->field_i2sdiv_playback.msb,
+ i2s->soc_info->field_i2sdiv_playback.lsb);
} else {
ctrl &= ~JZ_AIC_CTRL_INPUT_SAMPLE_SIZE;
ctrl |= FIELD_PREP(JZ_AIC_CTRL_INPUT_SAMPLE_SIZE, sample_size);
div_field = i2s->field_i2sdiv_capture;
+ i2sdiv_max = GENMASK(i2s->soc_info->field_i2sdiv_capture.msb,
+ i2s->soc_info->field_i2sdiv_capture.lsb);
+ }
+
+ /*
+ * Only calculate I2SDIV if we're supplying the bit or frame clock.
+ * If the codec is supplying both clocks then the divider output is
+ * unused, and we don't want it to limit the allowed sample rates.
+ */
+ if (conf & (JZ_AIC_CONF_BIT_CLK_MASTER | JZ_AIC_CONF_SYNC_CLK_MASTER)) {
+ div = jz4740_i2s_get_i2sdiv(clk_get_rate(i2s->clk_i2s),
+ params_rate(params), i2sdiv_max);
+ if (div < 0)
+ return div;
}
regmap_write(i2s->regmap, JZ_REG_AIC_CTRL, ctrl);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 122/286] ASoC: dt-bindings: Adjust #sound-dai-cells on TIs single-DAI codecs
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 121/286] ASoC: jz4740-i2s: Make I2S divider calculations more robust Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 123/286] ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V Greg Kroah-Hartman
` (172 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Martin Povišer <povik+lin@cutebit.org>
[ Upstream commit efb2bfd7b3d210c479b9361c176d7426e5eb8663 ]
A bunch of TI's codecs have binding schemas which force #sound-dai-cells
to one despite those codecs only having a single DAI. Allow for bindings
with zero DAI cells and deprecate the former non-zero value.
Signed-off-by: Martin Povišer <povik+lin@cutebit.org
Link: https://lore.kernel.org/r/20230509153412.62847-1-povik+lin@cutebit.org
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/sound/tas2562.yaml | 6 ++++--
Documentation/devicetree/bindings/sound/tas2770.yaml | 6 ++++--
Documentation/devicetree/bindings/sound/tas27xx.yaml | 6 ++++--
3 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/Documentation/devicetree/bindings/sound/tas2562.yaml b/Documentation/devicetree/bindings/sound/tas2562.yaml
index 1085592cefccc..81218c07079a8 100644
--- a/Documentation/devicetree/bindings/sound/tas2562.yaml
+++ b/Documentation/devicetree/bindings/sound/tas2562.yaml
@@ -55,7 +55,9 @@ properties:
description: TDM TX current sense time slot.
'#sound-dai-cells':
- const: 1
+ # The codec has a single DAI, the #sound-dai-cells=<1>; case is left in for backward
+ # compatibility but is deprecated.
+ enum: [0, 1]
required:
- compatible
@@ -72,7 +74,7 @@ examples:
codec: codec@4c {
compatible = "ti,tas2562";
reg = <0x4c>;
- #sound-dai-cells = <1>;
+ #sound-dai-cells = <0>;
interrupt-parent = <&gpio1>;
interrupts = <14>;
shutdown-gpios = <&gpio1 15 0>;
diff --git a/Documentation/devicetree/bindings/sound/tas2770.yaml b/Documentation/devicetree/bindings/sound/tas2770.yaml
index 982949ba8a4be..cdb493db47f9b 100644
--- a/Documentation/devicetree/bindings/sound/tas2770.yaml
+++ b/Documentation/devicetree/bindings/sound/tas2770.yaml
@@ -57,7 +57,9 @@ properties:
- 1 # Falling edge
'#sound-dai-cells':
- const: 1
+ # The codec has a single DAI, the #sound-dai-cells=<1>; case is left in for backward
+ # compatibility but is deprecated.
+ enum: [0, 1]
required:
- compatible
@@ -74,7 +76,7 @@ examples:
codec: codec@41 {
compatible = "ti,tas2770";
reg = <0x41>;
- #sound-dai-cells = <1>;
+ #sound-dai-cells = <0>;
interrupt-parent = <&gpio1>;
interrupts = <14>;
reset-gpio = <&gpio1 15 0>;
diff --git a/Documentation/devicetree/bindings/sound/tas27xx.yaml b/Documentation/devicetree/bindings/sound/tas27xx.yaml
index 0957dd435bb4b..2ef05aacc167a 100644
--- a/Documentation/devicetree/bindings/sound/tas27xx.yaml
+++ b/Documentation/devicetree/bindings/sound/tas27xx.yaml
@@ -50,7 +50,9 @@ properties:
description: TDM TX voltage sense time slot.
'#sound-dai-cells':
- const: 1
+ # The codec has a single DAI, the #sound-dai-cells=<1>; case is left in for backward
+ # compatibility but is deprecated.
+ enum: [0, 1]
required:
- compatible
@@ -67,7 +69,7 @@ examples:
codec: codec@38 {
compatible = "ti,tas2764";
reg = <0x38>;
- #sound-dai-cells = <1>;
+ #sound-dai-cells = <0>;
interrupt-parent = <&gpio1>;
interrupts = <14>;
reset-gpios = <&gpio1 15 0>;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 123/286] ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 122/286] ASoC: dt-bindings: Adjust #sound-dai-cells on TIs single-DAI codecs Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 124/286] ASoC: ssm2602: Add workaround for playback distortions Greg Kroah-Hartman
` (171 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandru Sorodoc, Takashi Iwai,
Sasha Levin
From: Alexandru Sorodoc <ealex95@gmail.com>
[ Upstream commit 4b963ae1df6426f0e51de64133d379d9bde50c48 ]
These models use 2 CS35L41 amplifiers using SPI for down-facing
speakers.
alc285_fixup_speaker2_to_dac1 is needed to fix volume control of the
down-facing speakers.
Pin configs are needed to enable headset mic detection.
Note that these models lack the ACPI _DSD properties needed to
initialize the amplifiers. They can be added during boot to get working
sound out of the speakers:
https://gist.github.com/lamperez/862763881c0e1c812392b5574727f6ff
Signed-off-by: Alexandru Sorodoc <ealex95@gmail.com>
Link: https://lore.kernel.org/r/20230511161510.315170-1-ealex95@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 379f216158ab4..7b5f194513c7b 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -7063,6 +7063,8 @@ enum {
ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
ALC295_FIXUP_DISABLE_DAC3,
ALC285_FIXUP_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1,
+ ALC285_FIXUP_ASUS_HEADSET_MIC,
ALC280_FIXUP_HP_HEADSET_MIC,
ALC221_FIXUP_HP_FRONT_MIC,
ALC292_FIXUP_TPT460,
@@ -8033,6 +8035,22 @@ static const struct hda_fixup alc269_fixups[] = {
.chained = true,
.chain_id = ALC269_FIXUP_THINKPAD_ACPI
},
+ [ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1] = {
+ .type = HDA_FIXUP_FUNC,
+ .v.func = alc285_fixup_speaker2_to_dac1,
+ .chained = true,
+ .chain_id = ALC245_FIXUP_CS35L41_SPI_2
+ },
+ [ALC285_FIXUP_ASUS_HEADSET_MIC] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x19, 0x03a11050 },
+ { 0x1b, 0x03a11c30 },
+ { }
+ },
+ .chained = true,
+ .chain_id = ALC285_FIXUP_ASUS_SPEAKER2_TO_DAC1
+ },
[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -9507,6 +9525,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1043, 0x1313, "Asus K42JZ", ALC269VB_FIXUP_ASUS_MIC_NO_PRESENCE),
SND_PCI_QUIRK(0x1043, 0x13b0, "ASUS Z550SA", ALC256_FIXUP_ASUS_MIC),
SND_PCI_QUIRK(0x1043, 0x1427, "Asus Zenbook UX31E", ALC269VB_FIXUP_ASUS_ZENBOOK),
+ SND_PCI_QUIRK(0x1043, 0x1473, "ASUS GU604V", ALC285_FIXUP_ASUS_HEADSET_MIC),
+ SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
SND_PCI_QUIRK(0x1043, 0x1683, "ASUS UM3402YAR", ALC287_FIXUP_CS35L41_I2C_2),
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 124/286] ASoC: ssm2602: Add workaround for playback distortions
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 123/286] ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 125/286] media: dvb_demux: fix a bug for the continuity counter Greg Kroah-Hartman
` (170 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Paweł Anikiel <pan@semihalf.com>
[ Upstream commit f63550e2b165208a2f382afcaf5551df9569e1d4 ]
Apply a workaround for what appears to be a hardware quirk.
The problem seems to happen when enabling "whole chip power" (bit D7
register R6) for the very first time after the chip receives power. If
either "output" (D4) or "DAC" (D3) aren't powered on at that time,
playback becomes very distorted later on.
This happens on the Google Chameleon v3, as well as on a ZYBO Z7-10:
https://ez.analog.com/audio/f/q-a/543726/solved-ssm2603-right-output-offset-issue/480229
I suspect this happens only when using an external MCLK signal (which
is the case for both of these boards).
Here are some experiments run on a Google Chameleon v3. These were run
in userspace using a wrapper around the i2cset utility:
ssmset() {
i2cset -y 0 0x1a $(($1*2)) $2
}
For each of the following sequences, we apply power to the ssm2603
chip, set the configuration registers R0-R5 and R7-R8, run the selected
sequence, and check for distortions on playback.
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # chip, out, dac
OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x87 # out, dac
ssmset 0x06 0x07 # chip
OK
(disable MCLK)
ssmset 0x09 0x01 # core
ssmset 0x06 0x1f # chip
ssmset 0x06 0x07 # out, dac
(enable MCLK)
OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x1f # chip
ssmset 0x06 0x07 # out, dac
NOT OK
ssmset 0x06 0x1f # chip
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # out, dac
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x0f # chip, out
ssmset 0x06 0x07 # dac
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x17 # chip, dac
ssmset 0x06 0x07 # out
NOT OK
For each of the following sequences, we apply power to the ssm2603
chip, run the selected sequence, issue a reset with R15, configure
R0-R5 and R7-R8, run one of the NOT OK sequences from above, and check
for distortions.
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # chip, out, dac
OK
(disable MCLK)
ssmset 0x09 0x01 # core
ssmset 0x06 0x07 # chip, out, dac
(enable MCLK after reset)
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x17 # chip, dac
NOT OK
ssmset 0x09 0x01 # core
ssmset 0x06 0x0f # chip, out
NOT OK
ssmset 0x06 0x07 # chip, out, dac
NOT OK
Signed-off-by: Paweł Anikiel <pan@semihalf.com
Link: https://lore.kernel.org/r/20230508113037.137627-8-pan@semihalf.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/ssm2602.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c
index cbbe83b85adaf..cf7927222be15 100644
--- a/sound/soc/codecs/ssm2602.c
+++ b/sound/soc/codecs/ssm2602.c
@@ -53,6 +53,18 @@ static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM] = {
{ .reg = 0x09, .def = 0x0000 }
};
+/*
+ * ssm2602 register patch
+ * Workaround for playback distortions after power up: activates digital
+ * core, and then powers on output, DAC, and whole chip at the same time
+ */
+
+static const struct reg_sequence ssm2602_patch[] = {
+ { SSM2602_ACTIVE, 0x01 },
+ { SSM2602_PWR, 0x07 },
+ { SSM2602_RESET, 0x00 },
+};
+
/*Appending several "None"s just for OSS mixer use*/
static const char *ssm2602_input_select[] = {
@@ -589,6 +601,9 @@ static int ssm260x_component_probe(struct snd_soc_component *component)
return ret;
}
+ regmap_register_patch(ssm2602->regmap, ssm2602_patch,
+ ARRAY_SIZE(ssm2602_patch));
+
/* set the update bits */
regmap_update_bits(ssm2602->regmap, SSM2602_LINVOL,
LINVOL_LRIN_BOTH, LINVOL_LRIN_BOTH);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 125/286] media: dvb_demux: fix a bug for the continuity counter
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 124/286] ASoC: ssm2602: Add workaround for playback distortions Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 126/286] media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() Greg Kroah-Hartman
` (169 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YongSu Yoo, Mauro Carvalho Chehab,
Sasha Levin
From: YongSu Yoo <yongsuyoo0215@gmail.com>
[ Upstream commit 7efb10d8dc70ea3000cc70dca53407c52488acd1 ]
In dvb_demux.c, some logics exist which compare the expected
continuity counter and the real continuity counter. If they
are not matched each other, both of the expected continuity
counter and the real continuity counter should be printed.
But there exists a bug that the expected continuity counter
is not correctly printed. The expected continuity counter is
replaced with the real countinuity counter + 1 so that
the epected continuity counter is not correclty printed.
This is wrong. This bug is fixed.
Link: https://lore.kernel.org/linux-media/20230305212519.499-1-yongsuyoo0215@gmail.com
Signed-off-by: YongSu Yoo <yongsuyoo0215@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvb_demux.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/media/dvb-core/dvb_demux.c b/drivers/media/dvb-core/dvb_demux.c
index 398c86279b5b0..7c4d86bfdd6c9 100644
--- a/drivers/media/dvb-core/dvb_demux.c
+++ b/drivers/media/dvb-core/dvb_demux.c
@@ -115,12 +115,12 @@ static inline int dvb_dmx_swfilter_payload(struct dvb_demux_feed *feed,
cc = buf[3] & 0x0f;
ccok = ((feed->cc + 1) & 0x0f) == cc;
- feed->cc = cc;
if (!ccok) {
set_buf_flags(feed, DMX_BUFFER_FLAG_DISCONTINUITY_DETECTED);
dprintk_sect_loss("missed packet: %d instead of %d!\n",
cc, (feed->cc + 1) & 0x0f);
}
+ feed->cc = cc;
if (buf[1] & 0x40) // PUSI ?
feed->peslen = 0xfffa;
@@ -300,7 +300,6 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
cc = buf[3] & 0x0f;
ccok = ((feed->cc + 1) & 0x0f) == cc;
- feed->cc = cc;
if (buf[3] & 0x20) {
/* adaption field present, check for discontinuity_indicator */
@@ -336,6 +335,7 @@ static int dvb_dmx_swfilter_section_packet(struct dvb_demux_feed *feed,
feed->pusi_seen = false;
dvb_dmx_swfilter_section_new(feed);
}
+ feed->cc = cc;
if (buf[1] & 0x40) {
/* PUSI=1 (is set), section boundary is here */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 126/286] media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 125/286] media: dvb_demux: fix a bug for the continuity counter Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 127/286] media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() Greg Kroah-Hartman
` (168 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Chen, Mauro Carvalho Chehab,
Sasha Levin
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit 858e97d7956d17a2cb56a9413468704a4d5abfe1 ]
In az6027_i2c_xfer, msg is controlled by user. When msg[i].buf is null,
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in
az6027_i2c_xfer()") fix the null-ptr-deref bug when msg[i].addr is 0x99.
However, null-ptr-deref also happens when msg[i].addr is 0xd0 and 0xc0.
We add check on msg[i].len to prevent null-ptr-deref.
Link: https://lore.kernel.org/linux-media/20230310165604.3093483-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/az6027.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/media/usb/dvb-usb/az6027.c b/drivers/media/usb/dvb-usb/az6027.c
index 7d78ee09be5e1..a31c6f82f4e90 100644
--- a/drivers/media/usb/dvb-usb/az6027.c
+++ b/drivers/media/usb/dvb-usb/az6027.c
@@ -988,6 +988,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
/* write/read request */
if (i + 1 < num && (msg[i + 1].flags & I2C_M_RD)) {
req = 0xB9;
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
value = msg[i].addr + (msg[i].len << 8);
length = msg[i + 1].len + 6;
@@ -1001,6 +1005,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
/* demod 16bit addr */
req = 0xBD;
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
index = (((msg[i].buf[0] << 8) & 0xff00) | (msg[i].buf[1] & 0x00ff));
value = msg[i].addr + (2 << 8);
length = msg[i].len - 2;
@@ -1026,6 +1034,10 @@ static int az6027_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[], int n
} else {
req = 0xBD;
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
index = msg[i].buf[0] & 0x00FF;
value = msg[i].addr + (1 << 8);
length = msg[i].len - 1;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 127/286] media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 126/286] media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 128/286] media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() Greg Kroah-Hartman
` (167 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Chen, Mauro Carvalho Chehab,
Sasha Levin
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit a6dcefcc08eca1bf4e3d213c97c3cfb75f377935 ]
In ec168_i2c_xfer, msg is controlled by user. When msg[i].buf is null
and msg[i].len is zero, former checks on msg[i].buf would be passed.
If accessing msg[i].buf[0] without sanity check, null pointer deref
would happen. We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Link: https://lore.kernel.org/linux-media/20230313085853.3252349-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/ec168.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/ec168.c b/drivers/media/usb/dvb-usb-v2/ec168.c
index 7ed0ab9e429b1..0e4773fc025c9 100644
--- a/drivers/media/usb/dvb-usb-v2/ec168.c
+++ b/drivers/media/usb/dvb-usb-v2/ec168.c
@@ -115,6 +115,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
while (i < num) {
if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
if (msg[i].addr == ec168_ec100_config.demod_address) {
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
req.cmd = READ_DEMOD;
req.value = 0;
req.index = 0xff00 + msg[i].buf[0]; /* reg */
@@ -131,6 +135,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
}
} else {
if (msg[i].addr == ec168_ec100_config.demod_address) {
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
req.cmd = WRITE_DEMOD;
req.value = msg[i].buf[1]; /* val */
req.index = 0xff00 + msg[i].buf[0]; /* reg */
@@ -139,6 +147,10 @@ static int ec168_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
ret = ec168_ctrl_msg(d, &req);
i += 1;
} else {
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
req.cmd = WRITE_I2C;
req.value = msg[i].buf[0]; /* val */
req.index = 0x0100 + msg[i].addr; /* I2C addr */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 128/286] media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 127/286] media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 129/286] media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer Greg Kroah-Hartman
` (166 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Chen, Mauro Carvalho Chehab,
Sasha Levin
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit dff919090155fb22679869e8469168f270dcd97f ]
In ce6230_i2c_master_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach ce6230_i2c_master_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen. We add
check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Link: https://lore.kernel.org/linux-media/20230313092751.209496-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/ce6230.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/ce6230.c b/drivers/media/usb/dvb-usb-v2/ce6230.c
index 44540de1a2066..d3b5cb4a24daf 100644
--- a/drivers/media/usb/dvb-usb-v2/ce6230.c
+++ b/drivers/media/usb/dvb-usb-v2/ce6230.c
@@ -101,6 +101,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap,
if (num > i + 1 && (msg[i+1].flags & I2C_M_RD)) {
if (msg[i].addr ==
ce6230_zl10353_config.demod_address) {
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
req.cmd = DEMOD_READ;
req.value = msg[i].addr >> 1;
req.index = msg[i].buf[0];
@@ -117,6 +121,10 @@ static int ce6230_i2c_master_xfer(struct i2c_adapter *adap,
} else {
if (msg[i].addr ==
ce6230_zl10353_config.demod_address) {
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
req.cmd = DEMOD_WRITE;
req.value = msg[i].addr >> 1;
req.index = msg[i].buf[0];
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 129/286] media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 128/286] media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 130/286] media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() Greg Kroah-Hartman
` (165 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Shurong, Mauro Carvalho Chehab,
Sasha Levin
From: Zhang Shurong <zhang_shurong@foxmail.com>
[ Upstream commit aa4a447b81b84f69c1a89ad899df157f386d7636 ]
In rtl28xxu_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach rtl28xxu_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen.
We add check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a
("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Link: https://lore.kernel.org/linux-media/tencent_3623572106754AC2F266B316798B0F6CCA05@qq.com
Signed-off-by: Zhang Shurong <zhang_shurong@foxmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb-v2/rtl28xxu.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
index 795a012d40200..f7884bb56fccf 100644
--- a/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
+++ b/drivers/media/usb/dvb-usb-v2/rtl28xxu.c
@@ -176,6 +176,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
ret = -EOPNOTSUPP;
goto err_mutex_unlock;
} else if (msg[0].addr == 0x10) {
+ if (msg[0].len < 1 || msg[1].len < 1) {
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ }
/* method 1 - integrated demod */
if (msg[0].buf[0] == 0x00) {
/* return demod page from driver cache */
@@ -189,6 +193,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
ret = rtl28xxu_ctrl_msg(d, &req);
}
} else if (msg[0].len < 2) {
+ if (msg[0].len < 1) {
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ }
/* method 2 - old I2C */
req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1);
req.index = CMD_I2C_RD;
@@ -217,8 +225,16 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
ret = -EOPNOTSUPP;
goto err_mutex_unlock;
} else if (msg[0].addr == 0x10) {
+ if (msg[0].len < 1) {
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ }
/* method 1 - integrated demod */
if (msg[0].buf[0] == 0x00) {
+ if (msg[0].len < 2) {
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ }
/* save demod page for later demod access */
dev->page = msg[0].buf[1];
ret = 0;
@@ -231,6 +247,10 @@ static int rtl28xxu_i2c_xfer(struct i2c_adapter *adap, struct i2c_msg msg[],
ret = rtl28xxu_ctrl_msg(d, &req);
}
} else if ((msg[0].len < 23) && (!dev->new_i2c_write)) {
+ if (msg[0].len < 1) {
+ ret = -EOPNOTSUPP;
+ goto err_mutex_unlock;
+ }
/* method 2 - old I2C */
req.value = (msg[0].buf[0] << 8) | (msg[0].addr << 1);
req.index = CMD_I2C_WR;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 130/286] media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 129/286] media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 131/286] media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address Greg Kroah-Hartman
` (164 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Chen, Mauro Carvalho Chehab,
Sasha Levin
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit 9ded5bd2a49ce3015b7c936743eec0a0e6e11f0c ]
In digitv_i2c_xfer, msg is controlled by user. When msg[i].buf
is null and msg[i].len is zero, former checks on msg[i].buf would be
passed. Malicious data finally reach digitv_i2c_xfer. If accessing
msg[i].buf[0] without sanity check, null ptr deref would happen. We add
check on msg[i].len to prevent crash.
Similar commit:
commit 0ed554fd769a ("media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer()")
Link: https://lore.kernel.org/linux-media/20230313095008.1039689-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/digitv.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/media/usb/dvb-usb/digitv.c b/drivers/media/usb/dvb-usb/digitv.c
index 2756815a780bc..32134be169148 100644
--- a/drivers/media/usb/dvb-usb/digitv.c
+++ b/drivers/media/usb/dvb-usb/digitv.c
@@ -63,6 +63,10 @@ static int digitv_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num
warn("more than 2 i2c messages at a time is not handled yet. TODO.");
for (i = 0; i < num; i++) {
+ if (msg[i].len < 1) {
+ i = -EOPNOTSUPP;
+ break;
+ }
/* write/read request */
if (i+1 < num && (msg[i+1].flags & I2C_M_RD)) {
if (digitv_ctrl_msg(d, USB_READ_COFDM, msg[i].buf[0], NULL, 0,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 131/286] media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 130/286] media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 132/286] media: netup_unidvb: fix irq init by register it at the end of probe Greg Kroah-Hartman
` (163 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Chen, Mauro Carvalho Chehab,
Sasha Levin
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit a3fd1ef27aa686d871cefe207bd6168c4b0cd29e ]
In su3000_read_mac_address, if i2c_transfer fails to execute two
messages, array mac address will not be initialized. Without handling
such error, later in function dvb_usb_adapter_dvb_init, proposed_mac
is accessed before initialization.
Fix this error by returning a negative value if message execution fails.
Link: https://lore.kernel.org/linux-media/20230328124416.560889-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/dvb-usb/dw2102.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/usb/dvb-usb/dw2102.c b/drivers/media/usb/dvb-usb/dw2102.c
index 0ca764282c767..8747960e61461 100644
--- a/drivers/media/usb/dvb-usb/dw2102.c
+++ b/drivers/media/usb/dvb-usb/dw2102.c
@@ -946,7 +946,7 @@ static int su3000_read_mac_address(struct dvb_usb_device *d, u8 mac[6])
for (i = 0; i < 6; i++) {
obuf[1] = 0xf0 + i;
if (i2c_transfer(&d->i2c_adap, msg, 2) != 2)
- break;
+ return -1;
else
mac[i] = ibuf[0];
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 132/286] media: netup_unidvb: fix irq init by register it at the end of probe
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 131/286] media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 133/286] media: dvb_ca_en50221: fix a size write bug Greg Kroah-Hartman
` (162 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Chen, Mauro Carvalho Chehab,
Sasha Levin
From: Wei Chen <harperchen1110@gmail.com>
[ Upstream commit e6ad6233592593079db5c8fa592c298e51bc1356 ]
IRQ handler netup_spi_interrupt() takes spinlock spi->lock. The lock
is initialized in netup_spi_init(). However, irq handler is registered
before initializing the lock.
Spinlock dma->lock and i2c->lock suffer from the same problem.
Fix this by registering the irq at the end of probe.
Link: https://lore.kernel.org/linux-media/20230315134518.1074497-1-harperchen1110@gmail.com
Signed-off-by: Wei Chen <harperchen1110@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/pci/netup_unidvb/netup_unidvb_core.c | 17 +++++++++--------
1 file changed, 9 insertions(+), 8 deletions(-)
diff --git a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
index aaa1d2dedebdd..d85bfbb77a250 100644
--- a/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
+++ b/drivers/media/pci/netup_unidvb/netup_unidvb_core.c
@@ -887,12 +887,7 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
ndev->lmmio0, (u32)pci_resource_len(pci_dev, 0),
ndev->lmmio1, (u32)pci_resource_len(pci_dev, 1),
pci_dev->irq);
- if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED,
- "netup_unidvb", pci_dev) < 0) {
- dev_err(&pci_dev->dev,
- "%s(): can't get IRQ %d\n", __func__, pci_dev->irq);
- goto irq_request_err;
- }
+
ndev->dma_size = 2 * 188 *
NETUP_DMA_BLOCKS_COUNT * NETUP_DMA_PACKETS_COUNT;
ndev->dma_virt = dma_alloc_coherent(&pci_dev->dev,
@@ -933,6 +928,14 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
dev_err(&pci_dev->dev, "netup_unidvb: DMA setup failed\n");
goto dma_setup_err;
}
+
+ if (request_irq(pci_dev->irq, netup_unidvb_isr, IRQF_SHARED,
+ "netup_unidvb", pci_dev) < 0) {
+ dev_err(&pci_dev->dev,
+ "%s(): can't get IRQ %d\n", __func__, pci_dev->irq);
+ goto dma_setup_err;
+ }
+
dev_info(&pci_dev->dev,
"netup_unidvb: device has been initialized\n");
return 0;
@@ -951,8 +954,6 @@ static int netup_unidvb_initdev(struct pci_dev *pci_dev,
dma_free_coherent(&pci_dev->dev, ndev->dma_size,
ndev->dma_virt, ndev->dma_phys);
dma_alloc_err:
- free_irq(pci_dev->irq, pci_dev);
-irq_request_err:
iounmap(ndev->lmmio1);
pci_bar1_error:
iounmap(ndev->lmmio0);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 133/286] media: dvb_ca_en50221: fix a size write bug
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 132/286] media: netup_unidvb: fix irq init by register it at the end of probe Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 134/286] media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() Greg Kroah-Hartman
` (161 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, YongSu Yoo, Mauro Carvalho Chehab,
Sasha Levin
From: YongSu Yoo <yongsuyoo0215@gmail.com>
[ Upstream commit a4315e5be7020aac9b24a8151caf4bb85224cd0e ]
The function of "dvb_ca_en50221_write_data" at source/drivers/media
/dvb-core/dvb_ca_en50221.c is used for two cases.
The first case is for writing APDU data in the function of
"dvb_ca_en50221_io_write" at source/drivers/media/dvb-core/
dvb_ca_en50221.c.
The second case is for writing the host link buf size on the
Command Register in the function of "dvb_ca_en50221_link_init"
at source/drivers/media/dvb-core/dvb_ca_en50221.c.
In the second case, there exists a bug like following.
In the function of the "dvb_ca_en50221_link_init",
after a TV host calculates the host link buf_size,
the TV host writes the calculated host link buf_size on the
Size Register.
Accroding to the en50221 Spec (the page 60 of
https://dvb.org/wp-content/uploads/2020/02/En50221.V1.pdf),
before this writing operation, the "SW(CMDREG_SW)" flag in the
Command Register should be set. We can see this setting operation
in the function of the "dvb_ca_en50221_link_init" like below.
...
if ((ret = ca->pub->write_cam_control(ca->pub, slot,
CTRLIF_COMMAND, IRQEN | CMDREG_SW)) != 0)
return ret;
...
But, after that, the real writing operation is implemented using
the function of the "dvb_ca_en50221_write_data" in the function of
"dvb_ca_en50221_link_init", and the "dvb_ca_en50221_write_data"
includes the function of "ca->pub->write_cam_control",
and the function of the "ca->pub->write_cam_control" in the
function of the "dvb_ca_en50221_wrte_data" does not include
"CMDREG_SW" flag like below.
...
if ((status = ca->pub->write_cam_control(ca->pub, slot,
CTRLIF_COMMAND, IRQEN | CMDREG_HC)) != 0)
...
In the above source code, we can see only the "IRQEN | CMDREG_HC",
but we cannot see the "CMDREG_SW".
The "CMDREG_SW" flag which was set in the function of the
"dvb_ca_en50221_link_init" was rollbacked by the follwoing function
of the "dvb_ca_en50221_write_data".
This is a bug. and this bug causes that the calculated host link buf_size
is not properly written in the CI module.
Through this patch, we fix this bug.
Link: https://lore.kernel.org/linux-media/20220818125027.1131-1-yongsuyoo0215@gmail.com
Signed-off-by: YongSu Yoo <yongsuyoo0215@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvb_ca_en50221.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index c2d2792227f86..b6ca29dfb184a 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -187,7 +187,7 @@ static void dvb_ca_en50221_thread_wakeup(struct dvb_ca_private *ca);
static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
u8 *ebuf, int ecount);
static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
- u8 *ebuf, int ecount);
+ u8 *ebuf, int ecount, int size_write_flag);
/**
* findstr - Safely find needle in haystack.
@@ -370,7 +370,7 @@ static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
ret = dvb_ca_en50221_wait_if_status(ca, slot, STATUSREG_FR, HZ / 10);
if (ret)
return ret;
- ret = dvb_ca_en50221_write_data(ca, slot, buf, 2);
+ ret = dvb_ca_en50221_write_data(ca, slot, buf, 2, CMDREG_SW);
if (ret != 2)
return -EIO;
ret = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND, IRQEN);
@@ -778,11 +778,13 @@ static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
* @buf: The data in this buffer is treated as a complete link-level packet to
* be written.
* @bytes_write: Size of ebuf.
+ * @size_write_flag: A flag on Command Register which says whether the link size
+ * information will be writen or not.
*
* return: Number of bytes written, or < 0 on error.
*/
static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
- u8 *buf, int bytes_write)
+ u8 *buf, int bytes_write, int size_write_flag)
{
struct dvb_ca_slot *sl = &ca->slot_info[slot];
int status;
@@ -817,7 +819,7 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
/* OK, set HC bit */
status = ca->pub->write_cam_control(ca->pub, slot, CTRLIF_COMMAND,
- IRQEN | CMDREG_HC);
+ IRQEN | CMDREG_HC | size_write_flag);
if (status)
goto exit;
@@ -1508,7 +1510,7 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
mutex_lock(&sl->slot_lock);
status = dvb_ca_en50221_write_data(ca, slot, fragbuf,
- fraglen + 2);
+ fraglen + 2, 0);
mutex_unlock(&sl->slot_lock);
if (status == (fraglen + 2)) {
written = 1;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 134/286] media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 133/286] media: dvb_ca_en50221: fix a size write bug Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 135/286] media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table Greg Kroah-Hartman
` (160 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Mauro Carvalho Chehab,
Sasha Levin
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 517a281338322ff8293f988771c98aaa7205e457 ]
Since dvb_frontend_detach() is not called in ttusb_dec_exit_dvb(),
which is called when the device is disconnected, dvb_frontend_free()
is not finally called.
This causes a memory leak just by repeatedly plugging and
unplugging the device.
Fix this issue by adding dvb_frontend_detach() to ttusb_dec_exit_dvb().
Link: https://lore.kernel.org/linux-media/20221117045925.14297-5-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/ttusb-dec/ttusb_dec.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/media/usb/ttusb-dec/ttusb_dec.c b/drivers/media/usb/ttusb-dec/ttusb_dec.c
index 38822cedd93a9..c4474d4c44e28 100644
--- a/drivers/media/usb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/usb/ttusb-dec/ttusb_dec.c
@@ -1544,8 +1544,7 @@ static void ttusb_dec_exit_dvb(struct ttusb_dec *dec)
dvb_dmx_release(&dec->demux);
if (dec->fe) {
dvb_unregister_frontend(dec->fe);
- if (dec->fe->ops.release)
- dec->fe->ops.release(dec->fe);
+ dvb_frontend_detach(dec->fe);
}
dvb_unregister_adapter(&dec->adapter);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 135/286] media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 134/286] media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend Greg Kroah-Hartman
` (159 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Mauro Carvalho Chehab, Sasha Levin
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit ae11c0efaec32fb45130ee9886689f467232eebc ]
The driver will match mostly by DT table (even thought there is regular
ID table) so there is little benefit in of_match_ptr (this also allows
ACPI matching via PRP0001, even though it might not be relevant here).
This also fixes !CONFIG_OF error:
drivers/media/dvb-frontends/mn88443x.c:782:34: error: ‘mn88443x_of_match’ defined but not used [-Werror=unused-const-variable=]
Link: https://lore.kernel.org/linux-media/20230312131318.351173-28-krzysztof.kozlowski@linaro.org
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/mn88443x.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/media/dvb-frontends/mn88443x.c b/drivers/media/dvb-frontends/mn88443x.c
index 1f1753f2ab1a3..0782f8377eb2f 100644
--- a/drivers/media/dvb-frontends/mn88443x.c
+++ b/drivers/media/dvb-frontends/mn88443x.c
@@ -798,7 +798,7 @@ MODULE_DEVICE_TABLE(i2c, mn88443x_i2c_id);
static struct i2c_driver mn88443x_driver = {
.driver = {
.name = "mn88443x",
- .of_match_table = of_match_ptr(mn88443x_of_match),
+ .of_match_table = mn88443x_of_match,
},
.probe_new = mn88443x_probe,
.remove = mn88443x_remove,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 135/286] media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-13 3:33 ` Stefan Lippers-Hollmann
2023-06-07 20:13 ` [PATCH 6.3 137/286] media: dvb-core: Fix use-after-free due on race condition at dvb_net Greg Kroah-Hartman
` (158 subsequent siblings)
294 siblings, 1 reply; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Mauro Carvalho Chehab,
Sasha Levin
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f ]
If the device node of dvb_frontend is open() and the device is
disconnected, many kinds of UAFs may occur when calling close()
on the device node.
The root cause of this is that wake_up() for dvbdev->wait_queue
is implemented in the dvb_frontend_release() function, but
wait_event() is not implemented in the dvb_frontend_stop() function.
So, implement wait_event() function in dvb_frontend_stop() and
add 'remove_mutex' which prevents race condition for 'fe->exit'.
[mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvb_frontend.c | 53 ++++++++++++++++++++++-----
include/media/dvb_frontend.h | 6 ++-
2 files changed, 49 insertions(+), 10 deletions(-)
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index cc0a789f09ae5..947b61959b2b8 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -809,15 +809,26 @@ static void dvb_frontend_stop(struct dvb_frontend *fe)
dev_dbg(fe->dvb->device, "%s:\n", __func__);
+ mutex_lock(&fe->remove_mutex);
+
if (fe->exit != DVB_FE_DEVICE_REMOVED)
fe->exit = DVB_FE_NORMAL_EXIT;
mb();
- if (!fepriv->thread)
+ if (!fepriv->thread) {
+ mutex_unlock(&fe->remove_mutex);
return;
+ }
kthread_stop(fepriv->thread);
+ mutex_unlock(&fe->remove_mutex);
+
+ if (fepriv->dvbdev->users < -1) {
+ wait_event(fepriv->dvbdev->wait_queue,
+ fepriv->dvbdev->users == -1);
+ }
+
sema_init(&fepriv->sem, 1);
fepriv->state = FESTATE_IDLE;
@@ -2761,9 +2772,13 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
struct dvb_adapter *adapter = fe->dvb;
int ret;
+ mutex_lock(&fe->remove_mutex);
+
dev_dbg(fe->dvb->device, "%s:\n", __func__);
- if (fe->exit == DVB_FE_DEVICE_REMOVED)
- return -ENODEV;
+ if (fe->exit == DVB_FE_DEVICE_REMOVED) {
+ ret = -ENODEV;
+ goto err_remove_mutex;
+ }
if (adapter->mfe_shared == 2) {
mutex_lock(&adapter->mfe_lock);
@@ -2771,7 +2786,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
if (adapter->mfe_dvbdev &&
!adapter->mfe_dvbdev->writers) {
mutex_unlock(&adapter->mfe_lock);
- return -EBUSY;
+ ret = -EBUSY;
+ goto err_remove_mutex;
}
adapter->mfe_dvbdev = dvbdev;
}
@@ -2794,8 +2810,10 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
while (mferetry-- && (mfedev->users != -1 ||
mfepriv->thread)) {
if (msleep_interruptible(500)) {
- if (signal_pending(current))
- return -EINTR;
+ if (signal_pending(current)) {
+ ret = -EINTR;
+ goto err_remove_mutex;
+ }
}
}
@@ -2807,7 +2825,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
if (mfedev->users != -1 ||
mfepriv->thread) {
mutex_unlock(&adapter->mfe_lock);
- return -EBUSY;
+ ret = -EBUSY;
+ goto err_remove_mutex;
}
adapter->mfe_dvbdev = dvbdev;
}
@@ -2866,6 +2885,8 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
if (adapter->mfe_shared)
mutex_unlock(&adapter->mfe_lock);
+
+ mutex_unlock(&fe->remove_mutex);
return ret;
err3:
@@ -2887,6 +2908,9 @@ static int dvb_frontend_open(struct inode *inode, struct file *file)
err0:
if (adapter->mfe_shared)
mutex_unlock(&adapter->mfe_lock);
+
+err_remove_mutex:
+ mutex_unlock(&fe->remove_mutex);
return ret;
}
@@ -2897,6 +2921,8 @@ static int dvb_frontend_release(struct inode *inode, struct file *file)
struct dvb_frontend_private *fepriv = fe->frontend_priv;
int ret;
+ mutex_lock(&fe->remove_mutex);
+
dev_dbg(fe->dvb->device, "%s:\n", __func__);
if ((file->f_flags & O_ACCMODE) != O_RDONLY) {
@@ -2918,10 +2944,18 @@ static int dvb_frontend_release(struct inode *inode, struct file *file)
}
mutex_unlock(&fe->dvb->mdev_lock);
#endif
- if (fe->exit != DVB_FE_NO_EXIT)
- wake_up(&dvbdev->wait_queue);
if (fe->ops.ts_bus_ctrl)
fe->ops.ts_bus_ctrl(fe, 0);
+
+ if (fe->exit != DVB_FE_NO_EXIT) {
+ mutex_unlock(&fe->remove_mutex);
+ wake_up(&dvbdev->wait_queue);
+ } else {
+ mutex_unlock(&fe->remove_mutex);
+ }
+
+ } else {
+ mutex_unlock(&fe->remove_mutex);
}
dvb_frontend_put(fe);
@@ -3022,6 +3056,7 @@ int dvb_register_frontend(struct dvb_adapter *dvb,
fepriv = fe->frontend_priv;
kref_init(&fe->refcount);
+ mutex_init(&fe->remove_mutex);
/*
* After initialization, there need to be two references: one
diff --git a/include/media/dvb_frontend.h b/include/media/dvb_frontend.h
index e7c44870f20de..367d5381217b5 100644
--- a/include/media/dvb_frontend.h
+++ b/include/media/dvb_frontend.h
@@ -686,7 +686,10 @@ struct dtv_frontend_properties {
* @id: Frontend ID
* @exit: Used to inform the DVB core that the frontend
* thread should exit (usually, means that the hardware
- * got disconnected.
+ * got disconnected).
+ * @remove_mutex: mutex that avoids a race condition between a callback
+ * called when the hardware is disconnected and the
+ * file_operations of dvb_frontend.
*/
struct dvb_frontend {
@@ -704,6 +707,7 @@ struct dvb_frontend {
int (*callback)(void *adapter_priv, int component, int cmd, int arg);
int id;
unsigned int exit;
+ struct mutex remove_mutex;
};
/**
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 137/286] media: dvb-core: Fix use-after-free due on race condition at dvb_net
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 138/286] media: dvb-core: Fix use-after-free due to race at dvb_register_device() Greg Kroah-Hartman
` (157 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Mauro Carvalho Chehab,
Sasha Levin
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 4172385b0c9ac366dcab78eda48c26814b87ed1a ]
A race condition may occur between the .disconnect function, which
is called when the device is disconnected, and the dvb_device_open()
function, which is called when the device node is open()ed.
This results in several types of UAFs.
The root cause of this is that you use the dvb_device_open() function,
which does not implement a conditional statement
that checks 'dvbnet->exit'.
So, add 'remove_mutex` to protect 'dvbnet->exit' and use
locked_dvb_net_open() function to check 'dvbnet->exit'.
[mchehab: fix a checkpatch warning]
Link: https://lore.kernel.org/linux-media/20221117045925.14297-3-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvb_net.c | 38 +++++++++++++++++++++++++++++---
include/media/dvb_net.h | 4 ++++
2 files changed, 39 insertions(+), 3 deletions(-)
diff --git a/drivers/media/dvb-core/dvb_net.c b/drivers/media/dvb-core/dvb_net.c
index 8a2febf33ce28..8bb8dd34c223e 100644
--- a/drivers/media/dvb-core/dvb_net.c
+++ b/drivers/media/dvb-core/dvb_net.c
@@ -1564,15 +1564,43 @@ static long dvb_net_ioctl(struct file *file,
return dvb_usercopy(file, cmd, arg, dvb_net_do_ioctl);
}
+static int locked_dvb_net_open(struct inode *inode, struct file *file)
+{
+ struct dvb_device *dvbdev = file->private_data;
+ struct dvb_net *dvbnet = dvbdev->priv;
+ int ret;
+
+ if (mutex_lock_interruptible(&dvbnet->remove_mutex))
+ return -ERESTARTSYS;
+
+ if (dvbnet->exit) {
+ mutex_unlock(&dvbnet->remove_mutex);
+ return -ENODEV;
+ }
+
+ ret = dvb_generic_open(inode, file);
+
+ mutex_unlock(&dvbnet->remove_mutex);
+
+ return ret;
+}
+
static int dvb_net_close(struct inode *inode, struct file *file)
{
struct dvb_device *dvbdev = file->private_data;
struct dvb_net *dvbnet = dvbdev->priv;
+ mutex_lock(&dvbnet->remove_mutex);
+
dvb_generic_release(inode, file);
- if(dvbdev->users == 1 && dvbnet->exit == 1)
+ if (dvbdev->users == 1 && dvbnet->exit == 1) {
+ mutex_unlock(&dvbnet->remove_mutex);
wake_up(&dvbdev->wait_queue);
+ } else {
+ mutex_unlock(&dvbnet->remove_mutex);
+ }
+
return 0;
}
@@ -1580,7 +1608,7 @@ static int dvb_net_close(struct inode *inode, struct file *file)
static const struct file_operations dvb_net_fops = {
.owner = THIS_MODULE,
.unlocked_ioctl = dvb_net_ioctl,
- .open = dvb_generic_open,
+ .open = locked_dvb_net_open,
.release = dvb_net_close,
.llseek = noop_llseek,
};
@@ -1599,10 +1627,13 @@ void dvb_net_release (struct dvb_net *dvbnet)
{
int i;
+ mutex_lock(&dvbnet->remove_mutex);
dvbnet->exit = 1;
+ mutex_unlock(&dvbnet->remove_mutex);
+
if (dvbnet->dvbdev->users < 1)
wait_event(dvbnet->dvbdev->wait_queue,
- dvbnet->dvbdev->users==1);
+ dvbnet->dvbdev->users == 1);
dvb_unregister_device(dvbnet->dvbdev);
@@ -1621,6 +1652,7 @@ int dvb_net_init (struct dvb_adapter *adap, struct dvb_net *dvbnet,
int i;
mutex_init(&dvbnet->ioctl_mutex);
+ mutex_init(&dvbnet->remove_mutex);
dvbnet->demux = dmx;
for (i=0; i<DVB_NET_DEVICES_MAX; i++)
diff --git a/include/media/dvb_net.h b/include/media/dvb_net.h
index 5e31d37f25fac..cc01dffcc9f35 100644
--- a/include/media/dvb_net.h
+++ b/include/media/dvb_net.h
@@ -41,6 +41,9 @@
* @exit: flag to indicate when the device is being removed.
* @demux: pointer to &struct dmx_demux.
* @ioctl_mutex: protect access to this struct.
+ * @remove_mutex: mutex that avoids a race condition between a callback
+ * called when the hardware is disconnected and the
+ * file_operations of dvb_net.
*
* Currently, the core supports up to %DVB_NET_DEVICES_MAX (10) network
* devices.
@@ -53,6 +56,7 @@ struct dvb_net {
unsigned int exit:1;
struct dmx_demux *demux;
struct mutex ioctl_mutex;
+ struct mutex remove_mutex;
};
/**
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 138/286] media: dvb-core: Fix use-after-free due to race at dvb_register_device()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 137/286] media: dvb-core: Fix use-after-free due on race condition at dvb_net Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 139/286] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() Greg Kroah-Hartman
` (156 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, kernel test robot,
Dan Carpenter, Mauro Carvalho Chehab, Sasha Levin
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 627bb528b086b4136315c25d6a447a98ea9448d3 ]
dvb_register_device() dynamically allocates fops with kmemdup()
to set the fops->owner.
And these fops are registered in 'file->f_ops' using replace_fops()
in the dvb_device_open() process, and kfree()d in dvb_free_device().
However, it is not common to use dynamically allocated fops instead
of 'static const' fops as an argument of replace_fops(),
and UAF may occur.
These UAFs can occur on any dvb type using dvb_register_device(),
such as dvb_dvr, dvb_demux, dvb_frontend, dvb_net, etc.
So, instead of kfree() the fops dynamically allocated in
dvb_register_device() in dvb_free_device() called during the
.disconnect() process, kfree() it collectively in exit_dvbdev()
called when the dvbdev.c module is removed.
Link: https://lore.kernel.org/linux-media/20221117045925.14297-4-imv4bel@gmail.com
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvbdev.c | 84 ++++++++++++++++++++++++---------
include/media/dvbdev.h | 15 ++++++
2 files changed, 78 insertions(+), 21 deletions(-)
diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index 0ed087caf7f3b..73d296f27ff92 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -27,6 +27,7 @@
#include <media/tuner.h>
static DEFINE_MUTEX(dvbdev_mutex);
+static LIST_HEAD(dvbdevfops_list);
static int dvbdev_debug;
module_param(dvbdev_debug, int, 0644);
@@ -453,14 +454,15 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
enum dvb_device_type type, int demux_sink_pads)
{
struct dvb_device *dvbdev;
- struct file_operations *dvbdevfops;
+ struct file_operations *dvbdevfops = NULL;
+ struct dvbdevfops_node *node = NULL, *new_node = NULL;
struct device *clsdev;
int minor;
int id, ret;
mutex_lock(&dvbdev_register_lock);
- if ((id = dvbdev_get_free_id (adap, type)) < 0){
+ if ((id = dvbdev_get_free_id (adap, type)) < 0) {
mutex_unlock(&dvbdev_register_lock);
*pdvbdev = NULL;
pr_err("%s: couldn't find free device id\n", __func__);
@@ -468,18 +470,45 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
}
*pdvbdev = dvbdev = kzalloc(sizeof(*dvbdev), GFP_KERNEL);
-
if (!dvbdev){
mutex_unlock(&dvbdev_register_lock);
return -ENOMEM;
}
- dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);
+ /*
+ * When a device of the same type is probe()d more than once,
+ * the first allocated fops are used. This prevents memory leaks
+ * that can occur when the same device is probe()d repeatedly.
+ */
+ list_for_each_entry(node, &dvbdevfops_list, list_head) {
+ if (node->fops->owner == adap->module &&
+ node->type == type &&
+ node->template == template) {
+ dvbdevfops = node->fops;
+ break;
+ }
+ }
- if (!dvbdevfops){
- kfree (dvbdev);
- mutex_unlock(&dvbdev_register_lock);
- return -ENOMEM;
+ if (dvbdevfops == NULL) {
+ dvbdevfops = kmemdup(template->fops, sizeof(*dvbdevfops), GFP_KERNEL);
+ if (!dvbdevfops) {
+ kfree(dvbdev);
+ mutex_unlock(&dvbdev_register_lock);
+ return -ENOMEM;
+ }
+
+ new_node = kzalloc(sizeof(struct dvbdevfops_node), GFP_KERNEL);
+ if (!new_node) {
+ kfree(dvbdevfops);
+ kfree(dvbdev);
+ mutex_unlock(&dvbdev_register_lock);
+ return -ENOMEM;
+ }
+
+ new_node->fops = dvbdevfops;
+ new_node->type = type;
+ new_node->template = template;
+ list_add_tail (&new_node->list_head, &dvbdevfops_list);
}
memcpy(dvbdev, template, sizeof(struct dvb_device));
@@ -490,20 +519,20 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
dvbdev->priv = priv;
dvbdev->fops = dvbdevfops;
init_waitqueue_head (&dvbdev->wait_queue);
-
dvbdevfops->owner = adap->module;
-
list_add_tail (&dvbdev->list_head, &adap->device_list);
-
down_write(&minor_rwsem);
#ifdef CONFIG_DVB_DYNAMIC_MINORS
for (minor = 0; minor < MAX_DVB_MINORS; minor++)
if (dvb_minors[minor] == NULL)
break;
-
if (minor == MAX_DVB_MINORS) {
+ if (new_node) {
+ list_del (&new_node->list_head);
+ kfree(dvbdevfops);
+ kfree(new_node);
+ }
list_del (&dvbdev->list_head);
- kfree(dvbdevfops);
kfree(dvbdev);
up_write(&minor_rwsem);
mutex_unlock(&dvbdev_register_lock);
@@ -512,41 +541,47 @@ int dvb_register_device(struct dvb_adapter *adap, struct dvb_device **pdvbdev,
#else
minor = nums2minor(adap->num, type, id);
#endif
-
dvbdev->minor = minor;
dvb_minors[minor] = dvb_device_get(dvbdev);
up_write(&minor_rwsem);
-
ret = dvb_register_media_device(dvbdev, type, minor, demux_sink_pads);
if (ret) {
pr_err("%s: dvb_register_media_device failed to create the mediagraph\n",
__func__);
-
+ if (new_node) {
+ list_del (&new_node->list_head);
+ kfree(dvbdevfops);
+ kfree(new_node);
+ }
dvb_media_device_free(dvbdev);
list_del (&dvbdev->list_head);
- kfree(dvbdevfops);
kfree(dvbdev);
mutex_unlock(&dvbdev_register_lock);
return ret;
}
- mutex_unlock(&dvbdev_register_lock);
-
clsdev = device_create(dvb_class, adap->device,
MKDEV(DVB_MAJOR, minor),
dvbdev, "dvb%d.%s%d", adap->num, dnames[type], id);
if (IS_ERR(clsdev)) {
pr_err("%s: failed to create device dvb%d.%s%d (%ld)\n",
__func__, adap->num, dnames[type], id, PTR_ERR(clsdev));
+ if (new_node) {
+ list_del (&new_node->list_head);
+ kfree(dvbdevfops);
+ kfree(new_node);
+ }
dvb_media_device_free(dvbdev);
list_del (&dvbdev->list_head);
- kfree(dvbdevfops);
kfree(dvbdev);
+ mutex_unlock(&dvbdev_register_lock);
return PTR_ERR(clsdev);
}
+
dprintk("DVB: register adapter%d/%s%d @ minor: %i (0x%02x)\n",
adap->num, dnames[type], id, minor, minor);
+ mutex_unlock(&dvbdev_register_lock);
return 0;
}
EXPORT_SYMBOL(dvb_register_device);
@@ -575,7 +610,6 @@ static void dvb_free_device(struct kref *ref)
{
struct dvb_device *dvbdev = container_of(ref, struct dvb_device, ref);
- kfree (dvbdev->fops);
kfree (dvbdev);
}
@@ -1081,9 +1115,17 @@ static int __init init_dvbdev(void)
static void __exit exit_dvbdev(void)
{
+ struct dvbdevfops_node *node, *next;
+
class_destroy(dvb_class);
cdev_del(&dvb_device_cdev);
unregister_chrdev_region(MKDEV(DVB_MAJOR, 0), MAX_DVB_MINORS);
+
+ list_for_each_entry_safe(node, next, &dvbdevfops_list, list_head) {
+ list_del (&node->list_head);
+ kfree(node->fops);
+ kfree(node);
+ }
}
subsys_initcall(init_dvbdev);
diff --git a/include/media/dvbdev.h b/include/media/dvbdev.h
index 29d25c8a6f13f..8958e5e2fc5b7 100644
--- a/include/media/dvbdev.h
+++ b/include/media/dvbdev.h
@@ -193,6 +193,21 @@ struct dvb_device {
void *priv;
};
+/**
+ * struct dvbdevfops_node - fops nodes registered in dvbdevfops_list
+ *
+ * @fops: Dynamically allocated fops for ->owner registration
+ * @type: type of dvb_device
+ * @template: dvb_device used for registration
+ * @list_head: list_head for dvbdevfops_list
+ */
+struct dvbdevfops_node {
+ struct file_operations *fops;
+ enum dvb_device_type type;
+ const struct dvb_device *template;
+ struct list_head list_head;
+};
+
/**
* dvb_device_get - Increase dvb_device reference
*
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 139/286] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 138/286] media: dvb-core: Fix use-after-free due to race at dvb_register_device() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 140/286] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 Greg Kroah-Hartman
` (155 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yu Hao, Takashi Iwai,
Mauro Carvalho Chehab, Sasha Levin
From: Takashi Iwai <tiwai@suse.de>
[ Upstream commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 ]
Using a semaphore in the wait_event*() condition is no good idea.
It hits a kernel WARN_ON() at prepare_to_wait_event() like:
do not call blocking ops when !TASK_RUNNING; state=1 set at
prepare_to_wait_event+0x6d/0x690
For avoiding the potential deadlock, rewrite to an open-coded loop
instead. Unlike the loop in wait_event*(), this uses wait_woken()
after the condition check, hence the task state stays consistent.
CVE-2023-31084 was assigned to this bug.
Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KAUw@mail.gmail.com/
Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de
Reported-by: Yu Hao <yhao016@ucr.edu>
Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvb_frontend.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c
index 947b61959b2b8..bc6950a5740f6 100644
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@ -293,14 +293,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe,
}
if (events->eventw == events->eventr) {
- int ret;
+ struct wait_queue_entry wait;
+ int ret = 0;
if (flags & O_NONBLOCK)
return -EWOULDBLOCK;
- ret = wait_event_interruptible(events->wait_queue,
- dvb_frontend_test_event(fepriv, events));
-
+ init_waitqueue_entry(&wait, current);
+ add_wait_queue(&events->wait_queue, &wait);
+ while (!dvb_frontend_test_event(fepriv, events)) {
+ wait_woken(&wait, TASK_INTERRUPTIBLE, 0);
+ if (signal_pending(current)) {
+ ret = -ERESTARTSYS;
+ break;
+ }
+ }
+ remove_wait_queue(&events->wait_queue, &wait);
if (ret < 0)
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 140/286] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 139/286] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() Greg Kroah-Hartman
@ 2023-06-07 20:13 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 141/286] ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions Greg Kroah-Hartman
` (154 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:13 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Mauro Carvalho Chehab,
Sasha Levin
From: Hyunwoo Kim <v4bel@theori.io>
[ Upstream commit 280a8ab81733da8bc442253c700a52c4c0886ffd ]
If the device node of dvb_ca_en50221 is open() and the
device is disconnected, a UAF may occur when calling
close() on the device node.
The root cause is that wake_up() and wait_event() for
dvbdev->wait_queue are not implemented.
So implement wait_event() function in dvb_ca_en50221_release()
and add 'remove_mutex' which prevents race condition
for 'ca->exit'.
[mchehab: fix a checkpatch warning]
Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++-
1 file changed, 36 insertions(+), 1 deletion(-)
diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c
index b6ca29dfb184a..baf64540dc00a 100644
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@ -151,6 +151,12 @@ struct dvb_ca_private {
/* mutex serializing ioctls */
struct mutex ioctl_mutex;
+
+ /* A mutex used when a device is disconnected */
+ struct mutex remove_mutex;
+
+ /* Whether the device is disconnected */
+ int exit;
};
static void dvb_ca_private_free(struct dvb_ca_private *ca)
@@ -1711,12 +1717,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
dprintk("%s\n", __func__);
- if (!try_module_get(ca->pub->owner))
+ mutex_lock(&ca->remove_mutex);
+
+ if (ca->exit) {
+ mutex_unlock(&ca->remove_mutex);
+ return -ENODEV;
+ }
+
+ if (!try_module_get(ca->pub->owner)) {
+ mutex_unlock(&ca->remove_mutex);
return -EIO;
+ }
err = dvb_generic_open(inode, file);
if (err < 0) {
module_put(ca->pub->owner);
+ mutex_unlock(&ca->remove_mutex);
return err;
}
@@ -1741,6 +1757,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
dvb_ca_private_get(ca);
+ mutex_unlock(&ca->remove_mutex);
return 0;
}
@@ -1760,6 +1777,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
dprintk("%s\n", __func__);
+ mutex_lock(&ca->remove_mutex);
+
/* mark the CA device as closed */
ca->open = 0;
dvb_ca_en50221_thread_update_delay(ca);
@@ -1770,6 +1789,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
dvb_ca_private_put(ca);
+ if (dvbdev->users == 1 && ca->exit == 1) {
+ mutex_unlock(&ca->remove_mutex);
+ wake_up(&dvbdev->wait_queue);
+ } else {
+ mutex_unlock(&ca->remove_mutex);
+ }
+
return err;
}
@@ -1893,6 +1919,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
}
mutex_init(&ca->ioctl_mutex);
+ mutex_init(&ca->remove_mutex);
if (signal_pending(current)) {
ret = -EINTR;
@@ -1935,6 +1962,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
dprintk("%s\n", __func__);
+ mutex_lock(&ca->remove_mutex);
+ ca->exit = 1;
+ mutex_unlock(&ca->remove_mutex);
+
+ if (ca->dvbdev->users < 1)
+ wait_event(ca->dvbdev->wait_queue,
+ ca->dvbdev->users == 1);
+
/* shutdown the thread if there was one */
kthread_stop(ca->thread);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 141/286] ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-06-07 20:13 ` [PATCH 6.3 140/286] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 142/286] ASoC: SOF: pcm: fix pm_runtime imbalance in error handling Greg Kroah-Hartman
` (153 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
[ Upstream commit 3de975862f985f1c9e225a0d13aa3d501373f7c3 ]
When a firmware IPC error happens during a pm_runtime suspend, we
ignore the error and suspend anyways. However, the code
unconditionally increases the runtime_pm counter. This results in a
confusing configuration where the code will suspend, resume but never
suspend again due to the use of pm_runtime_get_noresume().
The intent of the counter increase was to prevent entry in D3, but if
that transition to D3 is already started it cannot be stopped. In
addition, there's no point in that case in trying to prevent anything,
the firmware error is handled and the next resume will re-initialize
the firmware completely.
This patch changes the logic to prevent suspend when the device is
pm_runtime active and has a use_count > 0.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com
Link: https://lore.kernel.org/r/20230512103315.8921-2-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/debug.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/sof/debug.c b/sound/soc/sof/debug.c
index ade0507328af4..5042312b1b98d 100644
--- a/sound/soc/sof/debug.c
+++ b/sound/soc/sof/debug.c
@@ -437,8 +437,8 @@ void snd_sof_handle_fw_exception(struct snd_sof_dev *sdev, const char *msg)
/* should we prevent DSP entering D3 ? */
if (!sdev->ipc_dump_printed)
dev_info(sdev->dev,
- "preventing DSP entering D3 state to preserve context\n");
- pm_runtime_get_noresume(sdev->dev);
+ "Attempting to prevent DSP from entering D3 state to preserve context\n");
+ pm_runtime_get_if_in_use(sdev->dev);
}
/* dump vital information to the logs */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 142/286] ASoC: SOF: pcm: fix pm_runtime imbalance in error handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 141/286] ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 143/286] ASoC: SOF: sof-client-probes: " Greg Kroah-Hartman
` (152 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
[ Upstream commit da0fe8fd515a471d373acc3682bfb5522cca4d55 ]
When an error occurs, we need to make sure the device can pm_runtime
suspend instead of keeping it active.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com
Link: https://lore.kernel.org/r/20230512103315.8921-3-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/pcm.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/sound/soc/sof/pcm.c b/sound/soc/sof/pcm.c
index 445acb5c3a21b..2570f33db9f3e 100644
--- a/sound/soc/sof/pcm.c
+++ b/sound/soc/sof/pcm.c
@@ -616,16 +616,17 @@ static int sof_pcm_probe(struct snd_soc_component *component)
"%s/%s",
plat_data->tplg_filename_prefix,
plat_data->tplg_filename);
- if (!tplg_filename)
- return -ENOMEM;
+ if (!tplg_filename) {
+ ret = -ENOMEM;
+ goto pm_error;
+ }
ret = snd_sof_load_topology(component, tplg_filename);
- if (ret < 0) {
+ if (ret < 0)
dev_err(component->dev, "error: failed to load DSP topology %d\n",
ret);
- return ret;
- }
+pm_error:
pm_runtime_mark_last_busy(component->dev);
pm_runtime_put_autosuspend(component->dev);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 143/286] ASoC: SOF: sof-client-probes: fix pm_runtime imbalance in error handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 142/286] ASoC: SOF: pcm: fix pm_runtime imbalance in error handling Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 144/286] ASoC: SOF: pm: save io region state in case of errors in resume Greg Kroah-Hartman
` (151 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
[ Upstream commit bc424273c74c1565c459c8f2a6ed95caee368d0a ]
When an error occurs, we need to make sure the device can pm_runtime
suspend instead of keeping it active.
Signed-off-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com
Link: https://lore.kernel.org/r/20230512103315.8921-4-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/sof-client-probes.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
diff --git a/sound/soc/sof/sof-client-probes.c b/sound/soc/sof/sof-client-probes.c
index fff126808bc04..8d9e9d5f40e45 100644
--- a/sound/soc/sof/sof-client-probes.c
+++ b/sound/soc/sof/sof-client-probes.c
@@ -218,12 +218,7 @@ static ssize_t sof_probes_dfs_points_read(struct file *file, char __user *to,
ret = ipc->points_info(cdev, &desc, &num_desc);
if (ret < 0)
- goto exit;
-
- pm_runtime_mark_last_busy(dev);
- err = pm_runtime_put_autosuspend(dev);
- if (err < 0)
- dev_err_ratelimited(dev, "debugfs read failed to idle %d\n", err);
+ goto pm_error;
for (i = 0; i < num_desc; i++) {
offset = strlen(buf);
@@ -241,6 +236,13 @@ static ssize_t sof_probes_dfs_points_read(struct file *file, char __user *to,
ret = simple_read_from_buffer(to, count, ppos, buf, strlen(buf));
kfree(desc);
+
+pm_error:
+ pm_runtime_mark_last_busy(dev);
+ err = pm_runtime_put_autosuspend(dev);
+ if (err < 0)
+ dev_err_ratelimited(dev, "debugfs read failed to idle %d\n", err);
+
exit:
kfree(buf);
return ret;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 144/286] ASoC: SOF: pm: save io region state in case of errors in resume
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 143/286] ASoC: SOF: sof-client-probes: " Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 145/286] s390/pkey: zeroize key blobs Greg Kroah-Hartman
` (150 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
From: Kai Vehmanen <kai.vehmanen@linux.intel.com>
[ Upstream commit 171b53be635ac15d4feafeb33946035649b1ca14 ]
If there are failures in DSP runtime resume, the device state will not
reach active and this makes it impossible e.g. to retrieve a possible
DSP panic dump via "exception" debugfs node. If
CONFIG_SND_SOC_SOF_DEBUG_ENABLE_DEBUGFS_CACHE=y is set, the data in
cache is stale. If debugfs cache is not used, the region simply cannot
be read.
To allow debugging these scenarios, update the debugfs cache contents in
resume error handler. User-space can then later retrieve DSP panic and
other state via debugfs (requires SOF debugfs cache to be enabled in
build).
Reported-by: Curtis Malainey <cujomalainey@chromium.org
Link: https://github.com/thesofproject/linux/issues/4274
Signed-off-by: Kai Vehmanen <kai.vehmanen@linux.intel.com
Reviewed-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com
Reviewed-by: Ranjani Sridharan <ranjani.sridharan@linux.intel.com
Reviewed-by: Curtis Malainey <cujomalainey@chromium.org
Reviewed-by: Péter Ujfalusi <peter.ujfalusi@linux.intel.com
Signed-off-by: Peter Ujfalusi <peter.ujfalusi@linux.intel.com
Link: https://lore.kernel.org/r/20230512104638.21376-1-peter.ujfalusi@linux.intel.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/sof/pm.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/sound/soc/sof/pm.c b/sound/soc/sof/pm.c
index 85412aeb1ca16..40f392efd8246 100644
--- a/sound/soc/sof/pm.c
+++ b/sound/soc/sof/pm.c
@@ -159,7 +159,7 @@ static int sof_resume(struct device *dev, bool runtime_resume)
ret = tplg_ops->set_up_all_pipelines(sdev, false);
if (ret < 0) {
dev_err(sdev->dev, "Failed to restore pipeline after resume %d\n", ret);
- return ret;
+ goto setup_fail;
}
}
@@ -173,6 +173,18 @@ static int sof_resume(struct device *dev, bool runtime_resume)
dev_err(sdev->dev, "ctx_restore IPC error during resume: %d\n", ret);
}
+setup_fail:
+#if IS_ENABLED(CONFIG_SND_SOC_SOF_DEBUG_ENABLE_DEBUGFS_CACHE)
+ if (ret < 0) {
+ /*
+ * Debugfs cannot be read in runtime suspend, so cache
+ * the contents upon failure. This allows to capture
+ * possible DSP coredump information.
+ */
+ sof_cache_debugfs(sdev);
+ }
+#endif
+
return ret;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 145/286] s390/pkey: zeroize key blobs
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 144/286] ASoC: SOF: pm: save io region state in case of errors in resume Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 146/286] s390/topology: honour nr_cpu_ids when adding CPUs Greg Kroah-Hartman
` (149 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Harald Freudenberger, Holger Dengler,
Alexander Gordeev, Sasha Levin
From: Holger Dengler <dengler@linux.ibm.com>
[ Upstream commit 844cf829e5f33e00b279230470c8c93b58b8c16f ]
Key blobs for the IOCTLs PKEY_KBLOB2PROTK[23] may contain clear key
material. Zeroize the copies of these keys in kernel memory after
creating the protected key.
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/crypto/pkey_api.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/s390/crypto/pkey_api.c b/drivers/s390/crypto/pkey_api.c
index 5a05d1cdfec20..a8def50c149bd 100644
--- a/drivers/s390/crypto/pkey_api.c
+++ b/drivers/s390/crypto/pkey_api.c
@@ -1293,6 +1293,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
return PTR_ERR(kkey);
rc = pkey_keyblob2pkey(kkey, ktp.keylen, &ktp.protkey);
DEBUG_DBG("%s pkey_keyblob2pkey()=%d\n", __func__, rc);
+ memzero_explicit(kkey, ktp.keylen);
kfree(kkey);
if (rc)
break;
@@ -1426,6 +1427,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
kkey, ktp.keylen, &ktp.protkey);
DEBUG_DBG("%s pkey_keyblob2pkey2()=%d\n", __func__, rc);
kfree(apqns);
+ memzero_explicit(kkey, ktp.keylen);
kfree(kkey);
if (rc)
break;
@@ -1552,6 +1554,7 @@ static long pkey_unlocked_ioctl(struct file *filp, unsigned int cmd,
protkey, &protkeylen);
DEBUG_DBG("%s pkey_keyblob2pkey3()=%d\n", __func__, rc);
kfree(apqns);
+ memzero_explicit(kkey, ktp.keylen);
kfree(kkey);
if (rc) {
kfree(protkey);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 146/286] s390/topology: honour nr_cpu_ids when adding CPUs
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 145/286] s390/pkey: zeroize key blobs Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 147/286] s390/ipl: fix IPIB virtual vs physical address confusion Greg Kroah-Hartman
` (148 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Alexander Gordeev,
Sasha Levin
From: Alexander Gordeev <agordeev@linux.ibm.com>
[ Upstream commit a33239be2d38ff5a44427db1707c08787508d34a ]
When SMT thread CPUs are added to CPU masks the nr_cpu_ids
limit is not checked and could be exceeded. This leads to
a warning for example if CONFIG_DEBUG_PER_CPU_MAPS is set
and the command line parameter nr_cpus is set to 1.
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/topology.c | 32 +++++++++++++++++---------------
1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/arch/s390/kernel/topology.c b/arch/s390/kernel/topology.c
index c6eecd4a5302d..10b20aeb27d3b 100644
--- a/arch/s390/kernel/topology.c
+++ b/arch/s390/kernel/topology.c
@@ -95,7 +95,7 @@ static void cpu_group_map(cpumask_t *dst, struct mask_info *info, unsigned int c
static void cpu_thread_map(cpumask_t *dst, unsigned int cpu)
{
static cpumask_t mask;
- int i;
+ unsigned int max_cpu;
cpumask_clear(&mask);
if (!cpumask_test_cpu(cpu, &cpu_setup_mask))
@@ -104,9 +104,10 @@ static void cpu_thread_map(cpumask_t *dst, unsigned int cpu)
if (topology_mode != TOPOLOGY_MODE_HW)
goto out;
cpu -= cpu % (smp_cpu_mtid + 1);
- for (i = 0; i <= smp_cpu_mtid; i++) {
- if (cpumask_test_cpu(cpu + i, &cpu_setup_mask))
- cpumask_set_cpu(cpu + i, &mask);
+ max_cpu = min(cpu + smp_cpu_mtid, nr_cpu_ids - 1);
+ for (; cpu <= max_cpu; cpu++) {
+ if (cpumask_test_cpu(cpu, &cpu_setup_mask))
+ cpumask_set_cpu(cpu, &mask);
}
out:
cpumask_copy(dst, &mask);
@@ -123,25 +124,26 @@ static void add_cpus_to_mask(struct topology_core *tl_core,
unsigned int core;
for_each_set_bit(core, &tl_core->mask, TOPOLOGY_CORE_BITS) {
- unsigned int rcore;
- int lcpu, i;
+ unsigned int max_cpu, rcore;
+ int cpu;
rcore = TOPOLOGY_CORE_BITS - 1 - core + tl_core->origin;
- lcpu = smp_find_processor_id(rcore << smp_cpu_mt_shift);
- if (lcpu < 0)
+ cpu = smp_find_processor_id(rcore << smp_cpu_mt_shift);
+ if (cpu < 0)
continue;
- for (i = 0; i <= smp_cpu_mtid; i++) {
- topo = &cpu_topology[lcpu + i];
+ max_cpu = min(cpu + smp_cpu_mtid, nr_cpu_ids - 1);
+ for (; cpu <= max_cpu; cpu++) {
+ topo = &cpu_topology[cpu];
topo->drawer_id = drawer->id;
topo->book_id = book->id;
topo->socket_id = socket->id;
topo->core_id = rcore;
- topo->thread_id = lcpu + i;
+ topo->thread_id = cpu;
topo->dedicated = tl_core->d;
- cpumask_set_cpu(lcpu + i, &drawer->mask);
- cpumask_set_cpu(lcpu + i, &book->mask);
- cpumask_set_cpu(lcpu + i, &socket->mask);
- smp_cpu_set_polarization(lcpu + i, tl_core->pp);
+ cpumask_set_cpu(cpu, &drawer->mask);
+ cpumask_set_cpu(cpu, &book->mask);
+ cpumask_set_cpu(cpu, &socket->mask);
+ smp_cpu_set_polarization(cpu, tl_core->pp);
}
}
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 147/286] s390/ipl: fix IPIB virtual vs physical address confusion
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 146/286] s390/topology: honour nr_cpu_ids when adding CPUs Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 148/286] ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P Greg Kroah-Hartman
` (147 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Alexander Gordeev,
Sasha Levin
From: Alexander Gordeev <agordeev@linux.ibm.com>
[ Upstream commit 2facd5d3980f3a26c04fe6ec8689a1d019a5812c ]
The pointer to IPL Parameter Information Block is stored
in the absolute lowcore for later use by dump tools. That
pointer is a virtual address, though it should be physical
instead.
Note, this does not fix a real issue, since virtual and
physical addresses are currently the same.
Suggested-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/kernel/ipl.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c
index 5f0f5c86963a9..e43ee9becbbb9 100644
--- a/arch/s390/kernel/ipl.c
+++ b/arch/s390/kernel/ipl.c
@@ -1936,14 +1936,13 @@ static struct shutdown_action __refdata dump_action = {
static void dump_reipl_run(struct shutdown_trigger *trigger)
{
- unsigned long ipib = (unsigned long) reipl_block_actual;
struct lowcore *abs_lc;
unsigned int csum;
csum = (__force unsigned int)
csum_partial(reipl_block_actual, reipl_block_actual->hdr.len, 0);
abs_lc = get_abs_lowcore();
- abs_lc->ipib = ipib;
+ abs_lc->ipib = __pa(reipl_block_actual);
abs_lc->ipib_checksum = csum;
put_abs_lowcore(abs_lc);
dump_run(trigger);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 148/286] ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 147/286] s390/ipl: fix IPIB virtual vs physical address confusion Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 149/286] wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value Greg Kroah-Hartman
` (146 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rubén Gómez Agudo,
Rafael J. Wysocki, Sasha Levin
From: Rubén Gómez <mrgommer@proton.me>
[ Upstream commit 71a485624c4cbb144169852d7bb8ca8c0667d7a3 ]
Add an ACPI IRQ override quirk for LG UltraPC 17U70P to address the
internal keyboard problem on it.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=213031
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216983
Signed-off-by: Rubén Gómez Agudo <mrgommer@proton.me>
[ rjw: Subject, changelog, white space damage fixes ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index e8492b3a393ab..0800a9d775580 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -516,6 +516,17 @@ static const struct dmi_system_id maingear_laptop[] = {
{ }
};
+static const struct dmi_system_id lg_laptop[] = {
+ {
+ .ident = "LG Electronics 17U70P",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "LG Electronics"),
+ DMI_MATCH(DMI_BOARD_NAME, "17U70P"),
+ },
+ },
+ { }
+};
+
struct irq_override_cmp {
const struct dmi_system_id *system;
unsigned char irq;
@@ -532,6 +543,7 @@ static const struct irq_override_cmp override_table[] = {
{ lenovo_laptop, 10, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, true },
{ tongfang_gm_rg, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
{ maingear_laptop, 1, ACPI_EDGE_SENSITIVE, ACPI_ACTIVE_LOW, 1, true },
+ { lg_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0, false },
};
static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 149/286] wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 148/286] ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 150/286] ARM: dts: stm32: add pin map for CAN controller on stm32f7 Greg Kroah-Hartman
` (145 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yun Lu, Kalle Valo, Sasha Levin
From: Yun Lu <luyun@kylinos.cn>
[ Upstream commit 20429444e653ee8242dfbf815c0c37866beb371b ]
When using rtl8192cu with rtl8xxxu driver to connect wifi, there is a
probability of failure, which shows "authentication with ... timed out".
Through debugging, it was found that the RCR register has been inexplicably
modified to an incorrect value, resulting in the nic not being able to
receive authenticated frames.
To fix this problem, add regrcr in rtl8xxxu_priv struct, and store
the RCR value every time the register is written, and use it the next
time the register need to be modified.
Signed-off-by: Yun Lu <luyun@kylinos.cn>
Link: https://lore.kernel.org/all/20230427020512.1221062-1-luyun_611@163.com
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230512012055.2990472-1-luyun_611@163.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h | 1 +
drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c | 4 +++-
2 files changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
index c8cee4a247551..4088aaa1c618d 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.h
@@ -1518,6 +1518,7 @@ struct rtl8xxxu_priv {
u32 rege9c;
u32 regeb4;
u32 regebc;
+ u32 regrcr;
int next_mbox;
int nr_out_eps;
diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
index 54ca6f2ced3f3..74ff5130971e2 100644
--- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu_core.c
@@ -4049,6 +4049,7 @@ static int rtl8xxxu_init_device(struct ieee80211_hw *hw)
RCR_ACCEPT_MGMT_FRAME | RCR_HTC_LOC_CTRL |
RCR_APPEND_PHYSTAT | RCR_APPEND_ICV | RCR_APPEND_MIC;
rtl8xxxu_write32(priv, REG_RCR, val32);
+ priv->regrcr = val32;
if (priv->rtl_chip == RTL8188F) {
/* Accept all data frames */
@@ -6269,7 +6270,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw,
unsigned int *total_flags, u64 multicast)
{
struct rtl8xxxu_priv *priv = hw->priv;
- u32 rcr = rtl8xxxu_read32(priv, REG_RCR);
+ u32 rcr = priv->regrcr;
dev_dbg(&priv->udev->dev, "%s: changed_flags %08x, total_flags %08x\n",
__func__, changed_flags, *total_flags);
@@ -6315,6 +6316,7 @@ static void rtl8xxxu_configure_filter(struct ieee80211_hw *hw,
*/
rtl8xxxu_write32(priv, REG_RCR, rcr);
+ priv->regrcr = rcr;
*total_flags &= (FIF_ALLMULTI | FIF_FCSFAIL | FIF_BCN_PRBRESP_PROMISC |
FIF_CONTROL | FIF_OTHER_BSS | FIF_PSPOLL |
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 150/286] ARM: dts: stm32: add pin map for CAN controller on stm32f7
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 149/286] wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 151/286] arm64/mm: mark private VM_FAULT_X defines as vm_fault_t Greg Kroah-Hartman
` (144 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dario Binacchi, Marc Kleine-Budde,
Sasha Levin
From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[ Upstream commit 011644249686f2675e142519cd59e81e04cfc231 ]
Add pin configurations for using CAN controller on stm32f7.
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Link: https://lore.kernel.org/all/20230427204540.3126234-4-dario.binacchi@amarulasolutions.com
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/stm32f7-pinctrl.dtsi | 82 ++++++++++++++++++++++++++
1 file changed, 82 insertions(+)
diff --git a/arch/arm/boot/dts/stm32f7-pinctrl.dtsi b/arch/arm/boot/dts/stm32f7-pinctrl.dtsi
index c8e6c52fb248e..9f65403295ca0 100644
--- a/arch/arm/boot/dts/stm32f7-pinctrl.dtsi
+++ b/arch/arm/boot/dts/stm32f7-pinctrl.dtsi
@@ -283,6 +283,88 @@
slew-rate = <2>;
};
};
+
+ can1_pins_a: can1-0 {
+ pins1 {
+ pinmux = <STM32_PINMUX('A', 12, AF9)>; /* CAN1_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('A', 11, AF9)>; /* CAN1_RX */
+ bias-pull-up;
+ };
+ };
+
+ can1_pins_b: can1-1 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 9, AF9)>; /* CAN1_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('B', 8, AF9)>; /* CAN1_RX */
+ bias-pull-up;
+ };
+ };
+
+ can1_pins_c: can1-2 {
+ pins1 {
+ pinmux = <STM32_PINMUX('D', 1, AF9)>; /* CAN1_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('D', 0, AF9)>; /* CAN1_RX */
+ bias-pull-up;
+
+ };
+ };
+
+ can1_pins_d: can1-3 {
+ pins1 {
+ pinmux = <STM32_PINMUX('H', 13, AF9)>; /* CAN1_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('H', 14, AF9)>; /* CAN1_RX */
+ bias-pull-up;
+
+ };
+ };
+
+ can2_pins_a: can2-0 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 6, AF9)>; /* CAN2_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('B', 5, AF9)>; /* CAN2_RX */
+ bias-pull-up;
+ };
+ };
+
+ can2_pins_b: can2-1 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 13, AF9)>; /* CAN2_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('B', 12, AF9)>; /* CAN2_RX */
+ bias-pull-up;
+ };
+ };
+
+ can3_pins_a: can3-0 {
+ pins1 {
+ pinmux = <STM32_PINMUX('A', 15, AF11)>; /* CAN3_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('A', 8, AF11)>; /* CAN3_RX */
+ bias-pull-up;
+ };
+ };
+
+ can3_pins_b: can3-1 {
+ pins1 {
+ pinmux = <STM32_PINMUX('B', 4, AF11)>; /* CAN3_TX */
+ };
+ pins2 {
+ pinmux = <STM32_PINMUX('B', 3, AF11)>; /* CAN3_RX */
+ bias-pull-up;
+ };
+ };
};
};
};
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 151/286] arm64/mm: mark private VM_FAULT_X defines as vm_fault_t
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 150/286] ARM: dts: stm32: add pin map for CAN controller on stm32f7 Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 152/286] arm64: vdso: Pass (void *) to virt_to_page() Greg Kroah-Hartman
` (143 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Min-Hua Chen,
Will Deacon, Sasha Levin
From: Min-Hua Chen <minhuadotchen@gmail.com>
[ Upstream commit d91d580878064b880f3574ac35b98d8b70ee8620 ]
This patch fixes several sparse warnings for fault.c:
arch/arm64/mm/fault.c:493:24: sparse: warning: incorrect type in return expression (different base types)
arch/arm64/mm/fault.c:493:24: sparse: expected restricted vm_fault_t
arch/arm64/mm/fault.c:493:24: sparse: got int
arch/arm64/mm/fault.c:501:32: sparse: warning: incorrect type in return expression (different base types)
arch/arm64/mm/fault.c:501:32: sparse: expected restricted vm_fault_t
arch/arm64/mm/fault.c:501:32: sparse: got int
arch/arm64/mm/fault.c:503:32: sparse: warning: incorrect type in return expression (different base types)
arch/arm64/mm/fault.c:503:32: sparse: expected restricted vm_fault_t
arch/arm64/mm/fault.c:503:32: sparse: got int
arch/arm64/mm/fault.c:511:24: sparse: warning: incorrect type in return expression (different base types)
arch/arm64/mm/fault.c:511:24: sparse: expected restricted vm_fault_t
arch/arm64/mm/fault.c:511:24: sparse: got int
arch/arm64/mm/fault.c:670:13: sparse: warning: restricted vm_fault_t degrades to integer
arch/arm64/mm/fault.c:670:13: sparse: warning: restricted vm_fault_t degrades to integer
arch/arm64/mm/fault.c:713:39: sparse: warning: restricted vm_fault_t degrades to integer
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Min-Hua Chen <minhuadotchen@gmail.com>
Link: https://lore.kernel.org/r/20230502151909.128810-1-minhuadotchen@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/mm/fault.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c
index f4cb0f85ccf49..d1136259b7b85 100644
--- a/arch/arm64/mm/fault.c
+++ b/arch/arm64/mm/fault.c
@@ -480,8 +480,8 @@ static void do_bad_area(unsigned long far, unsigned long esr,
}
}
-#define VM_FAULT_BADMAP 0x010000
-#define VM_FAULT_BADACCESS 0x020000
+#define VM_FAULT_BADMAP ((__force vm_fault_t)0x010000)
+#define VM_FAULT_BADACCESS ((__force vm_fault_t)0x020000)
static vm_fault_t __do_page_fault(struct mm_struct *mm, unsigned long addr,
unsigned int mm_flags, unsigned long vm_flags,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 152/286] arm64: vdso: Pass (void *) to virt_to_page()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 151/286] arm64/mm: mark private VM_FAULT_X defines as vm_fault_t Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 153/286] wifi: mac80211: simplify chanctx allocation Greg Kroah-Hartman
` (142 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Linus Walleij, Will Deacon,
Sasha Levin
From: Linus Walleij <linus.walleij@linaro.org>
[ Upstream commit b0abde80620f42d1ceb3de5e4c1a49cdd5628229 ]
Like the other calls in this function virt_to_page() expects
a pointer, not an integer.
However since many architectures implement virt_to_pfn() as
a macro, this function becomes polymorphic and accepts both a
(unsigned long) and a (void *).
Fix this up with an explicit cast.
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: http://lists.infradead.org/pipermail/linux-arm-kernel/2023-May/832583.html
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kernel/vdso.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/kernel/vdso.c b/arch/arm64/kernel/vdso.c
index 0119dc91abb5d..d9e1355730ef5 100644
--- a/arch/arm64/kernel/vdso.c
+++ b/arch/arm64/kernel/vdso.c
@@ -288,7 +288,7 @@ static int aarch32_alloc_kuser_vdso_page(void)
memcpy((void *)(vdso_page + 0x1000 - kuser_sz), __kuser_helper_start,
kuser_sz);
- aarch32_vectors_page = virt_to_page(vdso_page);
+ aarch32_vectors_page = virt_to_page((void *)vdso_page);
return 0;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 153/286] wifi: mac80211: simplify chanctx allocation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 152/286] arm64: vdso: Pass (void *) to virt_to_page() Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 154/286] wifi: mac80211: consider reserved chanctx for mindef Greg Kroah-Hartman
` (141 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 860e1b43da94551cd1e73adc36b3c64cc3e5dc01 ]
There's no need to call ieee80211_recalc_chanctx_min_def()
since it cannot and won't call the driver anyway; just use
_ieee80211_recalc_chanctx_min_def() instead.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230504134511.828474-3-gregory.greenman@intel.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/chan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index dbc34fbe7c8f4..d23d1a7b4cc39 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -638,7 +638,7 @@ ieee80211_alloc_chanctx(struct ieee80211_local *local,
ctx->conf.rx_chains_dynamic = 1;
ctx->mode = mode;
ctx->conf.radar_enabled = false;
- ieee80211_recalc_chanctx_min_def(local, ctx);
+ _ieee80211_recalc_chanctx_min_def(local, ctx);
return ctx;
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 154/286] wifi: mac80211: consider reserved chanctx for mindef
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 153/286] wifi: mac80211: simplify chanctx allocation Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 155/286] wifi: mac80211: recalc chanctx mindef before assigning Greg Kroah-Hartman
` (140 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit b72a455a2409fd94d6d9b4eb51d659a88213243b ]
When a chanctx is reserved for a new vif and we recalculate
the minimal definition for it, we need to consider the new
interface it's being reserved for before we assign it, so it
can be used directly with the correct min channel width.
Fix the code to - optionally - consider that, and use that
option just before doing the reassignment.
Also, when considering channel context reservations, we
should only consider the one link we're currently working with.
Change the boolean argument to a link pointer to do that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230504134511.828474-4-gregory.greenman@intel.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/chan.c | 72 +++++++++++++++++++++++---------------
net/mac80211/ieee80211_i.h | 3 +-
net/mac80211/util.c | 2 +-
3 files changed, 47 insertions(+), 30 deletions(-)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index d23d1a7b4cc39..1b182cf9d6610 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -258,7 +258,8 @@ ieee80211_get_max_required_bw(struct ieee80211_sub_if_data *sdata,
static enum nl80211_chan_width
ieee80211_get_chanctx_vif_max_required_bw(struct ieee80211_sub_if_data *sdata,
- struct ieee80211_chanctx_conf *conf)
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_link_data *rsvd_for)
{
enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT;
struct ieee80211_vif *vif = &sdata->vif;
@@ -267,13 +268,14 @@ ieee80211_get_chanctx_vif_max_required_bw(struct ieee80211_sub_if_data *sdata,
rcu_read_lock();
for (link_id = 0; link_id < ARRAY_SIZE(sdata->link); link_id++) {
enum nl80211_chan_width width = NL80211_CHAN_WIDTH_20_NOHT;
- struct ieee80211_bss_conf *link_conf =
- rcu_dereference(sdata->vif.link_conf[link_id]);
+ struct ieee80211_link_data *link =
+ rcu_dereference(sdata->link[link_id]);
- if (!link_conf)
+ if (!link)
continue;
- if (rcu_access_pointer(link_conf->chanctx_conf) != conf)
+ if (link != rsvd_for &&
+ rcu_access_pointer(link->conf->chanctx_conf) != &ctx->conf)
continue;
switch (vif->type) {
@@ -287,7 +289,7 @@ ieee80211_get_chanctx_vif_max_required_bw(struct ieee80211_sub_if_data *sdata,
* point, so take the width from the chandef, but
* account also for TDLS peers
*/
- width = max(link_conf->chandef.width,
+ width = max(link->conf->chandef.width,
ieee80211_get_max_required_bw(sdata, link_id));
break;
case NL80211_IFTYPE_P2P_DEVICE:
@@ -296,7 +298,7 @@ ieee80211_get_chanctx_vif_max_required_bw(struct ieee80211_sub_if_data *sdata,
case NL80211_IFTYPE_ADHOC:
case NL80211_IFTYPE_MESH_POINT:
case NL80211_IFTYPE_OCB:
- width = link_conf->chandef.width;
+ width = link->conf->chandef.width;
break;
case NL80211_IFTYPE_WDS:
case NL80211_IFTYPE_UNSPECIFIED:
@@ -316,7 +318,8 @@ ieee80211_get_chanctx_vif_max_required_bw(struct ieee80211_sub_if_data *sdata,
static enum nl80211_chan_width
ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
- struct ieee80211_chanctx_conf *conf)
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_link_data *rsvd_for)
{
struct ieee80211_sub_if_data *sdata;
enum nl80211_chan_width max_bw = NL80211_CHAN_WIDTH_20_NOHT;
@@ -328,7 +331,8 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
if (!ieee80211_sdata_running(sdata))
continue;
- width = ieee80211_get_chanctx_vif_max_required_bw(sdata, conf);
+ width = ieee80211_get_chanctx_vif_max_required_bw(sdata, ctx,
+ rsvd_for);
max_bw = max(max_bw, width);
}
@@ -336,8 +340,8 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
/* use the configured bandwidth in case of monitor interface */
sdata = rcu_dereference(local->monitor_sdata);
if (sdata &&
- rcu_access_pointer(sdata->vif.bss_conf.chanctx_conf) == conf)
- max_bw = max(max_bw, conf->def.width);
+ rcu_access_pointer(sdata->vif.bss_conf.chanctx_conf) == &ctx->conf)
+ max_bw = max(max_bw, ctx->conf.def.width);
rcu_read_unlock();
@@ -349,8 +353,10 @@ ieee80211_get_chanctx_max_required_bw(struct ieee80211_local *local,
* the max of min required widths of all the interfaces bound to this
* channel context.
*/
-static u32 _ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
- struct ieee80211_chanctx *ctx)
+static u32
+_ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_link_data *rsvd_for)
{
enum nl80211_chan_width max_bw;
struct cfg80211_chan_def min_def;
@@ -370,7 +376,7 @@ static u32 _ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
return 0;
}
- max_bw = ieee80211_get_chanctx_max_required_bw(local, &ctx->conf);
+ max_bw = ieee80211_get_chanctx_max_required_bw(local, ctx, rsvd_for);
/* downgrade chandef up to max_bw */
min_def = ctx->conf.def;
@@ -448,9 +454,10 @@ static void ieee80211_chan_bw_change(struct ieee80211_local *local,
* channel context.
*/
void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
- struct ieee80211_chanctx *ctx)
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_link_data *rsvd_for)
{
- u32 changed = _ieee80211_recalc_chanctx_min_def(local, ctx);
+ u32 changed = _ieee80211_recalc_chanctx_min_def(local, ctx, rsvd_for);
if (!changed)
return;
@@ -464,10 +471,11 @@ void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
ieee80211_chan_bw_change(local, ctx, false);
}
-static void ieee80211_change_chanctx(struct ieee80211_local *local,
- struct ieee80211_chanctx *ctx,
- struct ieee80211_chanctx *old_ctx,
- const struct cfg80211_chan_def *chandef)
+static void _ieee80211_change_chanctx(struct ieee80211_local *local,
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_chanctx *old_ctx,
+ const struct cfg80211_chan_def *chandef,
+ struct ieee80211_link_data *rsvd_for)
{
u32 changed;
@@ -492,7 +500,7 @@ static void ieee80211_change_chanctx(struct ieee80211_local *local,
ieee80211_chan_bw_change(local, old_ctx, true);
if (cfg80211_chandef_identical(&ctx->conf.def, chandef)) {
- ieee80211_recalc_chanctx_min_def(local, ctx);
+ ieee80211_recalc_chanctx_min_def(local, ctx, rsvd_for);
return;
}
@@ -502,7 +510,7 @@ static void ieee80211_change_chanctx(struct ieee80211_local *local,
/* check if min chanctx also changed */
changed = IEEE80211_CHANCTX_CHANGE_WIDTH |
- _ieee80211_recalc_chanctx_min_def(local, ctx);
+ _ieee80211_recalc_chanctx_min_def(local, ctx, rsvd_for);
drv_change_chanctx(local, ctx, changed);
if (!local->use_chanctx) {
@@ -514,6 +522,14 @@ static void ieee80211_change_chanctx(struct ieee80211_local *local,
ieee80211_chan_bw_change(local, old_ctx, false);
}
+static void ieee80211_change_chanctx(struct ieee80211_local *local,
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_chanctx *old_ctx,
+ const struct cfg80211_chan_def *chandef)
+{
+ _ieee80211_change_chanctx(local, ctx, old_ctx, chandef, NULL);
+}
+
static struct ieee80211_chanctx *
ieee80211_find_chanctx(struct ieee80211_local *local,
const struct cfg80211_chan_def *chandef,
@@ -638,7 +654,7 @@ ieee80211_alloc_chanctx(struct ieee80211_local *local,
ctx->conf.rx_chains_dynamic = 1;
ctx->mode = mode;
ctx->conf.radar_enabled = false;
- _ieee80211_recalc_chanctx_min_def(local, ctx);
+ _ieee80211_recalc_chanctx_min_def(local, ctx, NULL);
return ctx;
}
@@ -873,12 +889,12 @@ static int ieee80211_assign_link_chanctx(struct ieee80211_link_data *link,
ieee80211_recalc_chanctx_chantype(local, curr_ctx);
ieee80211_recalc_smps_chanctx(local, curr_ctx);
ieee80211_recalc_radar_chanctx(local, curr_ctx);
- ieee80211_recalc_chanctx_min_def(local, curr_ctx);
+ ieee80211_recalc_chanctx_min_def(local, curr_ctx, NULL);
}
if (new_ctx && ieee80211_chanctx_num_assigned(local, new_ctx) > 0) {
ieee80211_recalc_txpower(sdata, false);
- ieee80211_recalc_chanctx_min_def(local, new_ctx);
+ ieee80211_recalc_chanctx_min_def(local, new_ctx, NULL);
}
if (sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
@@ -1270,7 +1286,7 @@ ieee80211_link_use_reserved_reassign(struct ieee80211_link_data *link)
ieee80211_link_update_chandef(link, &link->reserved_chandef);
- ieee80211_change_chanctx(local, new_ctx, old_ctx, chandef);
+ _ieee80211_change_chanctx(local, new_ctx, old_ctx, chandef, link);
vif_chsw[0].vif = &sdata->vif;
vif_chsw[0].old_ctx = &old_ctx->conf;
@@ -1300,7 +1316,7 @@ ieee80211_link_use_reserved_reassign(struct ieee80211_link_data *link)
if (ieee80211_chanctx_refcount(local, old_ctx) == 0)
ieee80211_free_chanctx(local, old_ctx);
- ieee80211_recalc_chanctx_min_def(local, new_ctx);
+ ieee80211_recalc_chanctx_min_def(local, new_ctx, NULL);
ieee80211_recalc_smps_chanctx(local, new_ctx);
ieee80211_recalc_radar_chanctx(local, new_ctx);
@@ -1665,7 +1681,7 @@ static int ieee80211_vif_use_reserved_switch(struct ieee80211_local *local)
ieee80211_recalc_chanctx_chantype(local, ctx);
ieee80211_recalc_smps_chanctx(local, ctx);
ieee80211_recalc_radar_chanctx(local, ctx);
- ieee80211_recalc_chanctx_min_def(local, ctx);
+ ieee80211_recalc_chanctx_min_def(local, ctx, NULL);
list_for_each_entry_safe(link, link_tmp, &ctx->reserved_links,
reserved_chanctx_list) {
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index e082582e0aa28..eba7ae63fac45 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -2494,7 +2494,8 @@ int ieee80211_chanctx_refcount(struct ieee80211_local *local,
void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
struct ieee80211_chanctx *chanctx);
void ieee80211_recalc_chanctx_min_def(struct ieee80211_local *local,
- struct ieee80211_chanctx *ctx);
+ struct ieee80211_chanctx *ctx,
+ struct ieee80211_link_data *rsvd_for);
bool ieee80211_is_radar_required(struct ieee80211_local *local);
void ieee80211_dfs_cac_timer(unsigned long data);
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index 8c397650b96f6..d7b382866b260 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -3007,7 +3007,7 @@ void ieee80211_recalc_min_chandef(struct ieee80211_sub_if_data *sdata,
chanctx = container_of(chanctx_conf, struct ieee80211_chanctx,
conf);
- ieee80211_recalc_chanctx_min_def(local, chanctx);
+ ieee80211_recalc_chanctx_min_def(local, chanctx, NULL);
}
unlock:
mutex_unlock(&local->chanctx_mtx);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 155/286] wifi: mac80211: recalc chanctx mindef before assigning
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 154/286] wifi: mac80211: consider reserved chanctx for mindef Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 156/286] wifi: iwlwifi: mvm: Add locking to the rate read flow Greg Kroah-Hartman
` (139 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Sasha Levin
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 04312de4ced4b152749614e8179f3978a20a992f ]
When we allocate a new channel context, or find an existing one
that is compatible, we currently assign it to a link before its
mindef is updated. This leads to strange situations, especially
in link switching where you switch to an 80 MHz link and expect
it to be active immediately, but the mindef is still configured
to 20 MHz while assigning. Also, it's strange that the chandef
passed to the assign method's argument is wider than the one in
the context.
Fix this by calculating the mindef with the new link considered
before calling the driver.
In particular, this fixes an iwlwifi problem during link switch
where the firmware would assert because the (link) station that
was added for the AP is configured to transmit at a bandwidth
that's wider than the channel context that it's configured on.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230504134511.828474-5-gregory.greenman@intel.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/chan.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 1b182cf9d6610..77c90ed8f5d7d 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -871,6 +871,9 @@ static int ieee80211_assign_link_chanctx(struct ieee80211_link_data *link,
}
if (new_ctx) {
+ /* recalc considering the link we'll use it for now */
+ ieee80211_recalc_chanctx_min_def(local, new_ctx, link);
+
ret = drv_assign_vif_chanctx(local, sdata, link->conf, new_ctx);
if (ret)
goto out;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 156/286] wifi: iwlwifi: mvm: Add locking to the rate read flow
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 155/286] wifi: mac80211: recalc chanctx mindef before assigning Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 157/286] scsi: ufs: core: Fix MCQ tag calculation Greg Kroah-Hartman
` (138 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ariel Malamud, Gregory Greenman,
Johannes Berg, Sasha Levin
From: Ariel Malamud <ariel.malamud@intel.com>
[ Upstream commit a8938bc881d2a03f9b77f19fae924fe798a01285 ]
The rs_drv_get_rate flow reads the lq_sta to return the optimal rate
for tx frames. This read flow is not protected thereby leaving
a small window, a few instructions wide, open to contention by an
asynchronous rate update. Indeed this race condition was hit and the
update occurred in the middle of the read.
Fix this by locking the lq_sta struct during read.
Signed-off-by: Ariel Malamud <ariel.malamud@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230514120631.b52c9ed5c379.I15290b78e0d966c1b68278263776ca9de841d5fe@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/rs.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
index 0b50b816684a0..2be6801d48aca 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c
@@ -2692,6 +2692,8 @@ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
return;
lq_sta = mvm_sta;
+
+ spin_lock(&lq_sta->pers.lock);
iwl_mvm_hwrate_to_tx_rate_v1(lq_sta->last_rate_n_flags,
info->band, &info->control.rates[0]);
info->control.rates[0].count = 1;
@@ -2706,6 +2708,7 @@ static void rs_drv_get_rate(void *mvm_r, struct ieee80211_sta *sta,
iwl_mvm_hwrate_to_tx_rate_v1(last_ucode_rate, info->band,
&txrc->reported_rate);
}
+ spin_unlock(&lq_sta->pers.lock);
}
static void *rs_drv_alloc_sta(void *mvm_rate, struct ieee80211_sta *sta,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 157/286] scsi: ufs: core: Fix MCQ tag calculation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 156/286] wifi: iwlwifi: mvm: Add locking to the rate read flow Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 158/286] scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc() Greg Kroah-Hartman
` (137 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Po-Wen Kao, Bart Van Assche,
Manivannan Sadhasivam, Stanley Chu, Ziqi Chen, Martin K. Petersen,
Sasha Levin
From: Po-Wen Kao <powen.kao@mediatek.com>
[ Upstream commit 5149452ca66289ef33d13897ee845a2f6f5b680f ]
The transfer command descriptor is allocated in ufshcd_memory_alloc() and
referenced by the transfer request descriptor with stride size
sizeof_utp_transfer_cmd_desc() instead of sizeof(struct
utp_transfer_cmd_desc).
Consequently, computing tag by address offset should also refer to the
same stride.
Signed-off-by: Po-Wen Kao <powen.kao@mediatek.com>
Link: https://lore.kernel.org/r/20230504154454.26654-2-powen.kao@mediatek.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Ziqi Chen <quic_ziqichen@quicinc.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs-mcq.c | 2 +-
drivers/ufs/core/ufshcd.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index 202ff71e1b582..b7c5f39b50e6d 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -265,7 +265,7 @@ static int ufshcd_mcq_get_tag(struct ufs_hba *hba,
addr = (le64_to_cpu(cqe->command_desc_base_addr) & CQE_UCD_BA) -
hba->ucdl_dma_addr;
- return div_u64(addr, sizeof(struct utp_transfer_cmd_desc));
+ return div_u64(addr, sizeof_utp_transfer_cmd_desc(hba));
}
static void ufshcd_mcq_process_cqe(struct ufs_hba *hba,
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 8ac2945e849f4..a80eacbb8ef85 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -8422,7 +8422,7 @@ static void ufshcd_release_sdb_queue(struct ufs_hba *hba, int nutrs)
{
size_t ucdl_size, utrdl_size;
- ucdl_size = sizeof(struct utp_transfer_cmd_desc) * nutrs;
+ ucdl_size = sizeof_utp_transfer_cmd_desc(hba) * nutrs;
dmam_free_coherent(hba->dev, ucdl_size, hba->ucdl_base_addr,
hba->ucdl_dma_addr);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 158/286] scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 157/286] scsi: ufs: core: Fix MCQ tag calculation Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 159/286] scsi: ufs: core: Fix MCQ nr_hw_queues Greg Kroah-Hartman
` (136 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Po-Wen Kao, Manivannan Sadhasivam,
Stanley Chu, Ziqi Chen, Bart Van Assche, Martin K. Petersen,
Sasha Levin
From: Po-Wen Kao <powen.kao@mediatek.com>
[ Upstream commit 06caeb536b2b21668efd2d6fa97c09461957b3a7 ]
Naming the functions after standard operators like sizeof() may cause
confusion. Rename it to ufshcd_get_ucd_size().
Signed-off-by: Po-Wen Kao <powen.kao@mediatek.com>
Link: https://lore.kernel.org/r/20230504154454.26654-3-powen.kao@mediatek.com
Suggested-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Reviewed-by: Ziqi Chen <quic_ziqichen@quicinc.com>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs-mcq.c | 2 +-
drivers/ufs/core/ufshcd.c | 10 +++++-----
include/ufs/ufshcd.h | 2 +-
3 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index b7c5f39b50e6d..937933d3f77c2 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -265,7 +265,7 @@ static int ufshcd_mcq_get_tag(struct ufs_hba *hba,
addr = (le64_to_cpu(cqe->command_desc_base_addr) & CQE_UCD_BA) -
hba->ucdl_dma_addr;
- return div_u64(addr, sizeof_utp_transfer_cmd_desc(hba));
+ return div_u64(addr, ufshcd_get_ucd_size(hba));
}
static void ufshcd_mcq_process_cqe(struct ufs_hba *hba,
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index a80eacbb8ef85..aec74987cb4e0 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -2821,10 +2821,10 @@ static void ufshcd_map_queues(struct Scsi_Host *shost)
static void ufshcd_init_lrb(struct ufs_hba *hba, struct ufshcd_lrb *lrb, int i)
{
struct utp_transfer_cmd_desc *cmd_descp = (void *)hba->ucdl_base_addr +
- i * sizeof_utp_transfer_cmd_desc(hba);
+ i * ufshcd_get_ucd_size(hba);
struct utp_transfer_req_desc *utrdlp = hba->utrdl_base_addr;
dma_addr_t cmd_desc_element_addr = hba->ucdl_dma_addr +
- i * sizeof_utp_transfer_cmd_desc(hba);
+ i * ufshcd_get_ucd_size(hba);
u16 response_offset = offsetof(struct utp_transfer_cmd_desc,
response_upiu);
u16 prdt_offset = offsetof(struct utp_transfer_cmd_desc, prd_table);
@@ -3733,7 +3733,7 @@ static int ufshcd_memory_alloc(struct ufs_hba *hba)
size_t utmrdl_size, utrdl_size, ucdl_size;
/* Allocate memory for UTP command descriptors */
- ucdl_size = sizeof_utp_transfer_cmd_desc(hba) * hba->nutrs;
+ ucdl_size = ufshcd_get_ucd_size(hba) * hba->nutrs;
hba->ucdl_base_addr = dmam_alloc_coherent(hba->dev,
ucdl_size,
&hba->ucdl_dma_addr,
@@ -3833,7 +3833,7 @@ static void ufshcd_host_memory_configure(struct ufs_hba *hba)
prdt_offset =
offsetof(struct utp_transfer_cmd_desc, prd_table);
- cmd_desc_size = sizeof_utp_transfer_cmd_desc(hba);
+ cmd_desc_size = ufshcd_get_ucd_size(hba);
cmd_desc_dma_addr = hba->ucdl_dma_addr;
for (i = 0; i < hba->nutrs; i++) {
@@ -8422,7 +8422,7 @@ static void ufshcd_release_sdb_queue(struct ufs_hba *hba, int nutrs)
{
size_t ucdl_size, utrdl_size;
- ucdl_size = sizeof_utp_transfer_cmd_desc(hba) * nutrs;
+ ucdl_size = ufshcd_get_ucd_size(hba) * nutrs;
dmam_free_coherent(hba->dev, ucdl_size, hba->ucdl_base_addr,
hba->ucdl_dma_addr);
diff --git a/include/ufs/ufshcd.h b/include/ufs/ufshcd.h
index 431c3afb2ce0f..db70944c681aa 100644
--- a/include/ufs/ufshcd.h
+++ b/include/ufs/ufshcd.h
@@ -1138,7 +1138,7 @@ static inline size_t ufshcd_sg_entry_size(const struct ufs_hba *hba)
({ (void)(hba); BUILD_BUG_ON(sg_entry_size != sizeof(struct ufshcd_sg_entry)); })
#endif
-static inline size_t sizeof_utp_transfer_cmd_desc(const struct ufs_hba *hba)
+static inline size_t ufshcd_get_ucd_size(const struct ufs_hba *hba)
{
return sizeof(struct utp_transfer_cmd_desc) + SG_ALL * ufshcd_sg_entry_size(hba);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 159/286] scsi: ufs: core: Fix MCQ nr_hw_queues
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 158/286] scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc() Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 160/286] scsi: core: Decrease scsi_devices iorequest_cnt if dispatch failed Greg Kroah-Hartman
` (135 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Po-Wen Kao, Bean Huo,
Manivannan Sadhasivam, Bart Van Assche, Stanley Chu,
Martin K. Petersen, Sasha Levin
From: Po-Wen Kao <powen.kao@mediatek.com>
[ Upstream commit 72a81bb0b6fc9b759ac0fdaca3ec5884a8b2f304 ]
Since MAXQ is 0-based value, add one to obtain number of hardware queues.
Signed-off-by: Po-Wen Kao <powen.kao@mediatek.com>
Link: https://lore.kernel.org/r/20230504154454.26654-4-powen.kao@mediatek.com
Reviewed-by: Bean Huo <beanhuo@micron.com>
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufs-mcq.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufs-mcq.c b/drivers/ufs/core/ufs-mcq.c
index 937933d3f77c2..51b3c6ae781df 100644
--- a/drivers/ufs/core/ufs-mcq.c
+++ b/drivers/ufs/core/ufs-mcq.c
@@ -150,7 +150,8 @@ static int ufshcd_mcq_config_nr_queues(struct ufs_hba *hba)
u32 hba_maxq, rem, tot_queues;
struct Scsi_Host *host = hba->host;
- hba_maxq = FIELD_GET(MAX_QUEUE_SUP, hba->mcq_capabilities);
+ /* maxq is 0 based value */
+ hba_maxq = FIELD_GET(MAX_QUEUE_SUP, hba->mcq_capabilities) + 1;
tot_queues = UFS_MCQ_NUM_DEV_CMD_QUEUES + read_queues + poll_queues +
rw_queues;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 160/286] scsi: core: Decrease scsi_devices iorequest_cnt if dispatch failed
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 159/286] scsi: ufs: core: Fix MCQ nr_hw_queues Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 161/286] wifi: b43: fix incorrect __packed annotation Greg Kroah-Hartman
` (134 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wenchao Hao, Ming Lei,
Martin K. Petersen, Sasha Levin
From: Wenchao Hao <haowenchao2@huawei.com>
[ Upstream commit 09e797c8641f6ad435c33ae24c223351197ea29a ]
If scsi_dispatch_cmd() failed, the SCSI command was not sent to the target,
scsi_queue_rq() would return BLK_STS_RESOURCE and the related request would
be requeued. The timeout of this request would not fire, no one would
increase iodone_cnt.
The above flow would result the iodone_cnt smaller than iorequest_cnt. So
decrease the iorequest_cnt if dispatch failed to workaround the issue.
Signed-off-by: Wenchao Hao <haowenchao2@huawei.com>
Reported-by: Ming Lei <ming.lei@redhat.com>
Closes: https://lore.kernel.org/r/ZF+zB+bB7iqe0wGd@ovpn-8-17.pek2.redhat.com
Link: https://lore.kernel.org/r/20230515070156.1790181-3-haowenchao2@huawei.com
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_lib.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
index 03964b26f3f27..0226c9279cef6 100644
--- a/drivers/scsi/scsi_lib.c
+++ b/drivers/scsi/scsi_lib.c
@@ -1485,6 +1485,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
*/
SCSI_LOG_MLQUEUE(3, scmd_printk(KERN_INFO, cmd,
"queuecommand : device blocked\n"));
+ atomic_dec(&cmd->device->iorequest_cnt);
return SCSI_MLQUEUE_DEVICE_BUSY;
}
@@ -1517,6 +1518,7 @@ static int scsi_dispatch_cmd(struct scsi_cmnd *cmd)
trace_scsi_dispatch_cmd_start(cmd);
rtn = host->hostt->queuecommand(host, cmd);
if (rtn) {
+ atomic_dec(&cmd->device->iorequest_cnt);
trace_scsi_dispatch_cmd_error(cmd, rtn);
if (rtn != SCSI_MLQUEUE_DEVICE_BUSY &&
rtn != SCSI_MLQUEUE_TARGET_BUSY)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 161/286] wifi: b43: fix incorrect __packed annotation
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 160/286] scsi: core: Decrease scsi_devices iorequest_cnt if dispatch failed Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 162/286] net: wwan: t7xx: Ensure init is completed before system sleep Greg Kroah-Hartman
` (133 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michael Büsch,
kernel test robot, Simon Horman, Larry Finger, Arnd Bergmann,
Kalle Valo, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 212457ccbd60dba34f965e4ffbe62f0e4f970538 ]
clang warns about an unpacked structure inside of a packed one:
drivers/net/wireless/broadcom/b43/b43.h:654:4: error: field data within 'struct b43_iv' is less aligned than 'union (unnamed union at /home/arnd/arm-soc/drivers/net/wireless/broadcom/b43/b43.h:651:2)' and is usually due to 'struct b43_iv' being packed, which can lead to unaligned accesses [-Werror,-Wunaligned-access]
The problem here is that the anonymous union has the default alignment
from its members, apparently because the original author mixed up the
placement of the __packed attribute by placing it next to the struct
member rather than the union definition. As the struct itself is
also marked as __packed, there is no need to mark its members, so just
move the annotation to the inner type instead.
As Michael noted, the same problem is present in b43legacy, so
change both at the same time.
Acked-by: Michael Büsch <m@bues.ch>
Reported-by: kernel test robot <lkp@intel.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
Link: https://lore.kernel.org/oe-kbuild-all/202305160749.ay1HAoyP-lkp@intel.com/
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20230516183442.536589-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/broadcom/b43/b43.h | 2 +-
drivers/net/wireless/broadcom/b43legacy/b43legacy.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/broadcom/b43/b43.h b/drivers/net/wireless/broadcom/b43/b43.h
index 9fc7c088a539e..67b4bac048e58 100644
--- a/drivers/net/wireless/broadcom/b43/b43.h
+++ b/drivers/net/wireless/broadcom/b43/b43.h
@@ -651,7 +651,7 @@ struct b43_iv {
union {
__be16 d16;
__be32 d32;
- } data __packed;
+ } __packed data;
} __packed;
diff --git a/drivers/net/wireless/broadcom/b43legacy/b43legacy.h b/drivers/net/wireless/broadcom/b43legacy/b43legacy.h
index 6b0cec467938f..f49365d14619f 100644
--- a/drivers/net/wireless/broadcom/b43legacy/b43legacy.h
+++ b/drivers/net/wireless/broadcom/b43legacy/b43legacy.h
@@ -379,7 +379,7 @@ struct b43legacy_iv {
union {
__be16 d16;
__be32 d32;
- } data __packed;
+ } __packed data;
} __packed;
#define B43legacy_PHYMODE(phytype) (1 << (phytype))
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 162/286] net: wwan: t7xx: Ensure init is completed before system sleep
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 161/286] wifi: b43: fix incorrect __packed annotation Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 163/286] netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT Greg Kroah-Hartman
` (132 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai-Heng Feng, David S. Miller,
Sasha Levin
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
[ Upstream commit ab87603b251134441a67385ecc9d3371be17b7a7 ]
When the system attempts to sleep while mtk_t7xx is not ready, the driver
cannot put the device to sleep:
[ 12.472918] mtk_t7xx 0000:57:00.0: [PM] Exiting suspend, modem in invalid state
[ 12.472936] mtk_t7xx 0000:57:00.0: PM: pci_pm_suspend(): t7xx_pci_pm_suspend+0x0/0x20 [mtk_t7xx] returns -14
[ 12.473678] mtk_t7xx 0000:57:00.0: PM: dpm_run_callback(): pci_pm_suspend+0x0/0x1b0 returns -14
[ 12.473711] mtk_t7xx 0000:57:00.0: PM: failed to suspend async: error -14
[ 12.764776] PM: Some devices failed to suspend, or early wake event detected
Mediatek confirmed the device can take a rather long time to complete
its initialization, so wait for up to 20 seconds until init is done.
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wwan/t7xx/t7xx_pci.c | 18 ++++++++++++++++++
drivers/net/wwan/t7xx/t7xx_pci.h | 1 +
2 files changed, 19 insertions(+)
diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c
index 226fc1703e90f..91256e005b846 100644
--- a/drivers/net/wwan/t7xx/t7xx_pci.c
+++ b/drivers/net/wwan/t7xx/t7xx_pci.c
@@ -45,6 +45,7 @@
#define T7XX_PCI_IREG_BASE 0
#define T7XX_PCI_EREG_BASE 2
+#define T7XX_INIT_TIMEOUT 20
#define PM_SLEEP_DIS_TIMEOUT_MS 20
#define PM_ACK_TIMEOUT_MS 1500
#define PM_AUTOSUSPEND_MS 20000
@@ -96,6 +97,7 @@ static int t7xx_pci_pm_init(struct t7xx_pci_dev *t7xx_dev)
spin_lock_init(&t7xx_dev->md_pm_lock);
init_completion(&t7xx_dev->sleep_lock_acquire);
init_completion(&t7xx_dev->pm_sr_ack);
+ init_completion(&t7xx_dev->init_done);
atomic_set(&t7xx_dev->md_pm_state, MTK_PM_INIT);
device_init_wakeup(&pdev->dev, true);
@@ -124,6 +126,7 @@ void t7xx_pci_pm_init_late(struct t7xx_pci_dev *t7xx_dev)
pm_runtime_mark_last_busy(&t7xx_dev->pdev->dev);
pm_runtime_allow(&t7xx_dev->pdev->dev);
pm_runtime_put_noidle(&t7xx_dev->pdev->dev);
+ complete_all(&t7xx_dev->init_done);
}
static int t7xx_pci_pm_reinit(struct t7xx_pci_dev *t7xx_dev)
@@ -529,6 +532,20 @@ static void t7xx_pci_shutdown(struct pci_dev *pdev)
__t7xx_pci_pm_suspend(pdev);
}
+static int t7xx_pci_pm_prepare(struct device *dev)
+{
+ struct pci_dev *pdev = to_pci_dev(dev);
+ struct t7xx_pci_dev *t7xx_dev;
+
+ t7xx_dev = pci_get_drvdata(pdev);
+ if (!wait_for_completion_timeout(&t7xx_dev->init_done, T7XX_INIT_TIMEOUT * HZ)) {
+ dev_warn(dev, "Not ready for system sleep.\n");
+ return -ETIMEDOUT;
+ }
+
+ return 0;
+}
+
static int t7xx_pci_pm_suspend(struct device *dev)
{
return __t7xx_pci_pm_suspend(to_pci_dev(dev));
@@ -555,6 +572,7 @@ static int t7xx_pci_pm_runtime_resume(struct device *dev)
}
static const struct dev_pm_ops t7xx_pci_pm_ops = {
+ .prepare = t7xx_pci_pm_prepare,
.suspend = t7xx_pci_pm_suspend,
.resume = t7xx_pci_pm_resume,
.resume_noirq = t7xx_pci_pm_resume_noirq,
diff --git a/drivers/net/wwan/t7xx/t7xx_pci.h b/drivers/net/wwan/t7xx/t7xx_pci.h
index 112efa534eace..f08f1ab744691 100644
--- a/drivers/net/wwan/t7xx/t7xx_pci.h
+++ b/drivers/net/wwan/t7xx/t7xx_pci.h
@@ -69,6 +69,7 @@ struct t7xx_pci_dev {
struct t7xx_modem *md;
struct t7xx_ccmni_ctrl *ccmni_ctlb;
bool rgu_pci_irq_en;
+ struct completion init_done;
/* Low Power Items */
struct list_head md_pm_entities;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 163/286] netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 162/286] net: wwan: t7xx: Ensure init is completed before system sleep Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 164/286] nvme-multipath: dont call blk_mark_disk_dead in nvme_mpath_remove_disk Greg Kroah-Hartman
` (131 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Rix, Simon Horman,
Florian Westphal, Sasha Levin
From: Tom Rix <trix@redhat.com>
[ Upstream commit 224a876e37543eee111bf9b6aa4935080e619335 ]
gcc with W=1 and ! CONFIG_NF_NAT
net/netfilter/nf_conntrack_netlink.c:3463:32: error:
‘exp_nat_nla_policy’ defined but not used [-Werror=unused-const-variable=]
3463 | static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
| ^~~~~~~~~~~~~~~~~~
net/netfilter/nf_conntrack_netlink.c:2979:33: error:
‘any_addr’ defined but not used [-Werror=unused-const-variable=]
2979 | static const union nf_inet_addr any_addr;
| ^~~~~~~~
These variables use is controlled by CONFIG_NF_NAT, so should their definitions.
Signed-off-by: Tom Rix <trix@redhat.com>
Reviewed-by: Simon Horman <simon.horman@corigine.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_conntrack_netlink.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index d40544cd61a6c..69c8c8c7e9b8e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2976,7 +2976,9 @@ static int ctnetlink_exp_dump_mask(struct sk_buff *skb,
return -1;
}
+#if IS_ENABLED(CONFIG_NF_NAT)
static const union nf_inet_addr any_addr;
+#endif
static __be32 nf_expect_get_id(const struct nf_conntrack_expect *exp)
{
@@ -3460,10 +3462,12 @@ ctnetlink_change_expect(struct nf_conntrack_expect *x,
return 0;
}
+#if IS_ENABLED(CONFIG_NF_NAT)
static const struct nla_policy exp_nat_nla_policy[CTA_EXPECT_NAT_MAX+1] = {
[CTA_EXPECT_NAT_DIR] = { .type = NLA_U32 },
[CTA_EXPECT_NAT_TUPLE] = { .type = NLA_NESTED },
};
+#endif
static int
ctnetlink_parse_expect_nat(const struct nlattr *attr,
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 164/286] nvme-multipath: dont call blk_mark_disk_dead in nvme_mpath_remove_disk
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 163/286] netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 165/286] nvme: do not let the user delete a ctrl before a complete initialization Greg Kroah-Hartman
` (130 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Sagi Grimberg,
Keith Busch, Sasha Levin
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 1743e5f6000901a11f4e1cd741bfa9136f3ec9b1 ]
nvme_mpath_remove_disk is called after del_gendisk, at which point a
blk_mark_disk_dead call doesn't make any sense.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/multipath.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/nvme/host/multipath.c b/drivers/nvme/host/multipath.c
index 9171452e2f6d4..2bc159a318ff0 100644
--- a/drivers/nvme/host/multipath.c
+++ b/drivers/nvme/host/multipath.c
@@ -884,7 +884,6 @@ void nvme_mpath_remove_disk(struct nvme_ns_head *head)
{
if (!head->disk)
return;
- blk_mark_disk_dead(head->disk);
/* make sure all pending bios are cleaned up */
kblockd_schedule_work(&head->requeue_work);
flush_work(&head->requeue_work);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 165/286] nvme: do not let the user delete a ctrl before a complete initialization
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 164/286] nvme-multipath: dont call blk_mark_disk_dead in nvme_mpath_remove_disk Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 166/286] ALSA: oss: avoid missing-prototype warnings Greg Kroah-Hartman
` (129 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Sagi Grimberg,
Christoph Hellwig, Keith Busch, Sasha Levin
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit 2eb94dd56a4a4e3fe286def3e2ba207804a37345 ]
If a userspace application performes a "delete_controller" command
early during the ctrl initialization, the delete operation
may race against the init code and the kernel will crash.
nvme nvme5: Connect command failed: host path error
nvme nvme5: failed to connect queue: 0 ret=880
PF: supervisor write access in kernel mode
PF: error_code(0x0002) - not-present page
blk_mq_quiesce_queue+0x18/0x90
nvme_tcp_delete_ctrl+0x24/0x40 [nvme_tcp]
nvme_do_delete_ctrl+0x7f/0x8b [nvme_core]
nvme_sysfs_delete.cold+0x8/0xd [nvme_core]
kernfs_fop_write_iter+0x124/0x1b0
new_sync_write+0xff/0x190
vfs_write+0x1ef/0x280
Fix the crash by checking the NVME_CTRL_STARTED_ONCE bit;
if it's not set it means that the nvme controller is still
in the process of getting initialized and the kernel
will return an -EBUSY error to userspace.
Set the NVME_CTRL_STARTED_ONCE later in the nvme_start_ctrl()
function, after the controller start operation is completed.
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index bdf1601219fc4..c015393beeee8 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -3585,6 +3585,9 @@ static ssize_t nvme_sysfs_delete(struct device *dev,
{
struct nvme_ctrl *ctrl = dev_get_drvdata(dev);
+ if (!test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags))
+ return -EBUSY;
+
if (device_remove_file_self(dev, attr))
nvme_delete_ctrl_sync(ctrl);
return count;
@@ -5045,7 +5048,7 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
* that were missed. We identify persistent discovery controllers by
* checking that they started once before, hence are reconnecting back.
*/
- if (test_and_set_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
+ if (test_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags) &&
nvme_discovery_ctrl(ctrl))
nvme_change_uevent(ctrl, "NVME_EVENT=rediscover");
@@ -5056,6 +5059,7 @@ void nvme_start_ctrl(struct nvme_ctrl *ctrl)
}
nvme_change_uevent(ctrl, "NVME_EVENT=connected");
+ set_bit(NVME_CTRL_STARTED_ONCE, &ctrl->flags);
}
EXPORT_SYMBOL_GPL(nvme_start_ctrl);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 166/286] ALSA: oss: avoid missing-prototype warnings
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 165/286] nvme: do not let the user delete a ctrl before a complete initialization Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 167/286] drm/msm: Be more shouty if per-process pgtables arent working Greg Kroah-Hartman
` (128 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Takashi Iwai,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 040b5a046a9e18098580d3ccd029e2318fca7859 ]
Two functions are defined and used in pcm_oss.c but also optionally
used from io.c, with an optional prototype. If CONFIG_SND_PCM_OSS_PLUGINS
is disabled, this causes a warning as the functions are not static
and have no prototype:
sound/core/oss/pcm_oss.c:1235:19: error: no previous prototype for 'snd_pcm_oss_write3' [-Werror=missing-prototypes]
sound/core/oss/pcm_oss.c:1266:19: error: no previous prototype for 'snd_pcm_oss_read3' [-Werror=missing-prototypes]
Avoid this by making the prototypes unconditional.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230516195046.550584-2-arnd@kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/core/oss/pcm_plugin.h | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/sound/core/oss/pcm_plugin.h b/sound/core/oss/pcm_plugin.h
index 46e273bd4a786..50a6b50f5db4c 100644
--- a/sound/core/oss/pcm_plugin.h
+++ b/sound/core/oss/pcm_plugin.h
@@ -141,6 +141,14 @@ int snd_pcm_area_copy(const struct snd_pcm_channel_area *src_channel,
void *snd_pcm_plug_buf_alloc(struct snd_pcm_substream *plug, snd_pcm_uframes_t size);
void snd_pcm_plug_buf_unlock(struct snd_pcm_substream *plug, void *ptr);
+#else
+
+static inline snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t drv_size) { return drv_size; }
+static inline snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t clt_size) { return clt_size; }
+static inline int snd_pcm_plug_slave_format(int format, const struct snd_mask *format_mask) { return format; }
+
+#endif
+
snd_pcm_sframes_t snd_pcm_oss_write3(struct snd_pcm_substream *substream,
const char *ptr, snd_pcm_uframes_t size,
int in_kernel);
@@ -151,14 +159,6 @@ snd_pcm_sframes_t snd_pcm_oss_writev3(struct snd_pcm_substream *substream,
snd_pcm_sframes_t snd_pcm_oss_readv3(struct snd_pcm_substream *substream,
void **bufs, snd_pcm_uframes_t frames);
-#else
-
-static inline snd_pcm_sframes_t snd_pcm_plug_client_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t drv_size) { return drv_size; }
-static inline snd_pcm_sframes_t snd_pcm_plug_slave_size(struct snd_pcm_substream *handle, snd_pcm_uframes_t clt_size) { return clt_size; }
-static inline int snd_pcm_plug_slave_format(int format, const struct snd_mask *format_mask) { return format; }
-
-#endif
-
#ifdef PLUGIN_DEBUG
#define pdprintf(fmt, args...) printk(KERN_DEBUG "plugin: " fmt, ##args)
#else
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 167/286] drm/msm: Be more shouty if per-process pgtables arent working
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 166/286] ALSA: oss: avoid missing-prototype warnings Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 168/286] atm: hide unused procfs functions Greg Kroah-Hartman
` (127 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rob Clark, Dmitry Baryshkov,
Sasha Levin
From: Rob Clark <robdclark@chromium.org>
[ Upstream commit 5c054db54c43a5fcb5cc81012361f5e3fac37637 ]
Otherwise it is not always obvious if a dt or iommu change is causing us
to fall back to global pgtable.
Signed-off-by: Rob Clark <robdclark@chromium.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/537359/
Link: https://lore.kernel.org/r/20230516222039.907690-2-robdclark@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/msm_iommu.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/msm_iommu.c b/drivers/gpu/drm/msm/msm_iommu.c
index c2507582ecf34..0d6a69cd6f7a5 100644
--- a/drivers/gpu/drm/msm/msm_iommu.c
+++ b/drivers/gpu/drm/msm/msm_iommu.c
@@ -234,7 +234,12 @@ struct msm_mmu *msm_iommu_pagetable_create(struct msm_mmu *parent)
/* Get the pagetable configuration from the domain */
if (adreno_smmu->cookie)
ttbr1_cfg = adreno_smmu->get_ttbr1_cfg(adreno_smmu->cookie);
- if (!ttbr1_cfg)
+
+ /*
+ * If you hit this WARN_ONCE() you are probably missing an entry in
+ * qcom_smmu_impl_of_match[] in arm-smmu-qcom.c
+ */
+ if (WARN_ONCE(!ttbr1_cfg, "No per-process page tables"))
return ERR_PTR(-ENODEV);
/*
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 168/286] atm: hide unused procfs functions
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 167/286] drm/msm: Be more shouty if per-process pgtables arent working Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 169/286] ceph: silence smatch warning in reconnect_caps_cb() Greg Kroah-Hartman
` (126 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Jakub Kicinski,
Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit fb1b7be9b16c1f4626969ba4e95a97da2a452b41 ]
When CONFIG_PROC_FS is disabled, the function declarations for some
procfs functions are hidden, but the definitions are still build,
as shown by this compiler warning:
net/atm/resources.c:403:7: error: no previous prototype for 'atm_dev_seq_start' [-Werror=missing-prototypes]
net/atm/resources.c:409:6: error: no previous prototype for 'atm_dev_seq_stop' [-Werror=missing-prototypes]
net/atm/resources.c:414:7: error: no previous prototype for 'atm_dev_seq_next' [-Werror=missing-prototypes]
Add another #ifdef to leave these out of the build.
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20230516194625.549249-2-arnd@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/atm/resources.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/atm/resources.c b/net/atm/resources.c
index 2b2d33eeaf200..995d29e7fb138 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -400,6 +400,7 @@ int atm_dev_ioctl(unsigned int cmd, void __user *buf, int __user *sioc_len,
return error;
}
+#ifdef CONFIG_PROC_FS
void *atm_dev_seq_start(struct seq_file *seq, loff_t *pos)
{
mutex_lock(&atm_dev_mutex);
@@ -415,3 +416,4 @@ void *atm_dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
{
return seq_list_next(v, &atm_devs, pos);
}
+#endif
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 169/286] ceph: silence smatch warning in reconnect_caps_cb()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 168/286] atm: hide unused procfs functions Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 170/286] drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged Greg Kroah-Hartman
` (125 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Xiubo Li,
Ilya Dryomov, Sasha Levin
From: Xiubo Li <xiubli@redhat.com>
[ Upstream commit 9aaa7eb018661b2da221362d9bacb096bd596f52 ]
Smatch static checker warning:
fs/ceph/mds_client.c:3968 reconnect_caps_cb()
warn: missing error code here? '__get_cap_for_mds()' failed. 'err' = '0'
[ idryomov: Dan says that Smatch considers it intentional only if the
"ret = 0;" assignment is within 4 or 5 lines of the goto. ]
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index 54e3c2ab21d22..1989c8deea55a 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3938,7 +3938,7 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg)
struct dentry *dentry;
struct ceph_cap *cap;
char *path;
- int pathlen = 0, err = 0;
+ int pathlen = 0, err;
u64 pathbase;
u64 snap_follows;
@@ -3961,6 +3961,7 @@ static int reconnect_caps_cb(struct inode *inode, int mds, void *arg)
cap = __get_cap_for_mds(ci, mds);
if (!cap) {
spin_unlock(&ci->i_ceph_lock);
+ err = 0;
goto out_err;
}
dout(" adding %p ino %llx.%llx cap %p %lld %s\n",
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 170/286] drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 169/286] ceph: silence smatch warning in reconnect_caps_cb() Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 171/286] ublk: fix AB-BA lockdep warning Greg Kroah-Hartman
` (124 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guchun Chen, Alex Deucher,
Sasha Levin
From: Guchun Chen <guchun.chen@amd.com>
[ Upstream commit c1a322a7a4a96cd0a3dde32ce37af437a78bf8cd ]
When performing device unbind or halt, we have disabled all irqs at the
very begining like amdgpu_pci_remove or amdgpu_device_halt. So
amdgpu_irq_put for irqs stored in fence driver should not be called
any more, otherwise, below calltrace will arrive.
[ 139.114088] WARNING: CPU: 2 PID: 1550 at drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c:616 amdgpu_irq_put+0xf6/0x110 [amdgpu]
[ 139.114655] Call Trace:
[ 139.114655] <TASK>
[ 139.114657] amdgpu_fence_driver_hw_fini+0x93/0x130 [amdgpu]
[ 139.114836] amdgpu_device_fini_hw+0xb6/0x350 [amdgpu]
[ 139.114955] amdgpu_driver_unload_kms+0x51/0x70 [amdgpu]
[ 139.115075] amdgpu_pci_remove+0x63/0x160 [amdgpu]
[ 139.115193] ? __pm_runtime_resume+0x64/0x90
[ 139.115195] pci_device_remove+0x3a/0xb0
[ 139.115197] device_remove+0x43/0x70
[ 139.115198] device_release_driver_internal+0xbd/0x140
Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
index f52d0ba91a770..a7d250809da99 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_fence.c
@@ -582,7 +582,8 @@ void amdgpu_fence_driver_hw_fini(struct amdgpu_device *adev)
if (r)
amdgpu_fence_driver_force_completion(ring);
- if (ring->fence_drv.irq_src)
+ if (!drm_dev_is_unplugged(adev_to_drm(adev)) &&
+ ring->fence_drv.irq_src)
amdgpu_irq_put(adev, ring->fence_drv.irq_src,
ring->fence_drv.irq_type);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 171/286] ublk: fix AB-BA lockdep warning
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 170/286] drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 172/286] nvme-pci: Add quirk for Teamgroup MP33 SSD Greg Kroah-Hartman
` (123 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Ziyang Zhang,
Ming Lei, Jens Axboe, Sasha Levin
From: Ming Lei <ming.lei@redhat.com>
[ Upstream commit ac5902f84bb546c64aea02c439c2579cbf40318f ]
When handling UBLK_IO_FETCH_REQ, ctx->uring_lock is grabbed first, then
ub->mutex is acquired.
When handling UBLK_CMD_STOP_DEV or UBLK_CMD_DEL_DEV, ub->mutex is
grabbed first, then calling io_uring_cmd_done() for canceling uring
command, in which ctx->uring_lock may be required.
Real deadlock only happens when all the above commands are issued from
same uring context, and in reality different uring contexts are often used
for handing control command and IO command.
Fix the issue by using io_uring_cmd_complete_in_task() to cancel command
in ublk_cancel_dev(ublk_cancel_queue).
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Closes: https://lore.kernel.org/linux-block/becol2g7sawl4rsjq2dztsbc7mqypfqko6wzsyoyazqydoasml@rcxarzwidrhk
Cc: Ziyang Zhang <ZiyangZhang@linux.alibaba.com>
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Tested-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Link: https://lore.kernel.org/r/20230517133408.210944-1-ming.lei@redhat.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/ublk_drv.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/block/ublk_drv.c b/drivers/block/ublk_drv.c
index 41c35ab2c25a1..4db5f1bcac44a 100644
--- a/drivers/block/ublk_drv.c
+++ b/drivers/block/ublk_drv.c
@@ -1122,6 +1122,11 @@ static inline bool ublk_queue_ready(struct ublk_queue *ubq)
return ubq->nr_io_ready == ubq->q_depth;
}
+static void ublk_cmd_cancel_cb(struct io_uring_cmd *cmd, unsigned issue_flags)
+{
+ io_uring_cmd_done(cmd, UBLK_IO_RES_ABORT, 0, issue_flags);
+}
+
static void ublk_cancel_queue(struct ublk_queue *ubq)
{
int i;
@@ -1133,8 +1138,8 @@ static void ublk_cancel_queue(struct ublk_queue *ubq)
struct ublk_io *io = &ubq->ios[i];
if (io->flags & UBLK_IO_FLAG_ACTIVE)
- io_uring_cmd_done(io->cmd, UBLK_IO_RES_ABORT, 0,
- IO_URING_F_UNLOCKED);
+ io_uring_cmd_complete_in_task(io->cmd,
+ ublk_cmd_cancel_cb);
}
/* all io commands are canceled */
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 172/286] nvme-pci: Add quirk for Teamgroup MP33 SSD
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 171/286] ublk: fix AB-BA lockdep warning Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 173/286] block: Deny writable memory mapping if block is read-only Greg Kroah-Hartman
` (122 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Smith, Chaitanya Kulkarni,
Keith Busch, Sasha Levin
From: Daniel Smith <dansmith@ds.gy>
[ Upstream commit 0649728123cf6a5518e154b4e1735fc85ea4f55c ]
Add a quirk for Teamgroup MP33 that reports duplicate ids for disk.
Signed-off-by: Daniel Smith <dansmith@ds.gy>
[kch: patch formatting]
Signed-off-by: Chaitanya Kulkarni <kch@nvidia.com>
Tested-by: Daniel Smith <dansmith@ds.gy>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/pci.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
index a389f1ea0b151..60f51155a6d20 100644
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3449,6 +3449,8 @@ static const struct pci_device_id nvme_id_table[] = {
.driver_data = NVME_QUIRK_BOGUS_NID, },
{ PCI_DEVICE(0x1e4b, 0x1602), /* HS-SSD-FUTURE 2048G */
.driver_data = NVME_QUIRK_BOGUS_NID, },
+ { PCI_DEVICE(0x10ec, 0x5765), /* TEAMGROUP MP33 2TB SSD */
+ .driver_data = NVME_QUIRK_BOGUS_NID, },
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0061),
.driver_data = NVME_QUIRK_DMA_ADDRESS_BITS_48, },
{ PCI_DEVICE(PCI_VENDOR_ID_AMAZON, 0x0065),
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 173/286] block: Deny writable memory mapping if block is read-only
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 172/286] nvme-pci: Add quirk for Teamgroup MP33 SSD Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 174/286] iio: adc: imx93: fix a signedness bug in imx93_adc_read_raw() Greg Kroah-Hartman
` (121 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Loic Poulain, Christoph Hellwig,
Jens Axboe, Sasha Levin
From: Loic Poulain <loic.poulain@linaro.org>
[ Upstream commit 69baa3a623fd2e58624f24f2f23d46f87b817c93 ]
User should not be able to write block device if it is read-only at
block level (e.g force_ro attribute). This is ensured in the regular
fops write operation (blkdev_write_iter) but not when writing via
user mapping (mmap), allowing user to actually write a read-only
block device via a PROT_WRITE mapping.
Example: This can lead to integrity issue of eMMC boot partition
(e.g mmcblk0boot0) which is read-only by default.
To fix this issue, simply deny shared writable mapping if the block
is readonly.
Note: Block remains writable if switch to read-only is performed
after the initial mapping, but this is expected behavior according
to commit a32e236eb93e ("Partially revert "block: fail op_is_write()
requests to read-only partitions"")'.
Signed-off-by: Loic Poulain <loic.poulain@linaro.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230510074223.991297-1-loic.poulain@linaro.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/fops.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/block/fops.c b/block/fops.c
index d2e6be4e3d1c7..58d0aebc7313a 100644
--- a/block/fops.c
+++ b/block/fops.c
@@ -678,6 +678,16 @@ static long blkdev_fallocate(struct file *file, int mode, loff_t start,
return error;
}
+static int blkdev_mmap(struct file *file, struct vm_area_struct *vma)
+{
+ struct inode *bd_inode = bdev_file_inode(file);
+
+ if (bdev_read_only(I_BDEV(bd_inode)))
+ return generic_file_readonly_mmap(file, vma);
+
+ return generic_file_mmap(file, vma);
+}
+
const struct file_operations def_blk_fops = {
.open = blkdev_open,
.release = blkdev_close,
@@ -685,7 +695,7 @@ const struct file_operations def_blk_fops = {
.read_iter = blkdev_read_iter,
.write_iter = blkdev_write_iter,
.iopoll = iocb_bio_iopoll,
- .mmap = generic_file_mmap,
+ .mmap = blkdev_mmap,
.fsync = blkdev_fsync,
.unlocked_ioctl = blkdev_ioctl,
#ifdef CONFIG_COMPAT
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 174/286] iio: adc: imx93: fix a signedness bug in imx93_adc_read_raw()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 173/286] block: Deny writable memory mapping if block is read-only Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 175/286] KVM: arm64: vgic: Fix a circular locking issue Greg Kroah-Hartman
` (120 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Haibo Chen,
Jonathan Cameron, Sasha Levin
From: Dan Carpenter <error27@gmail.com>
[ Upstream commit 20f291b88ecf23f674ee2ed980a4d93b7f16a06f ]
The problem is these lines:
ret = vref_uv = regulator_get_voltage(adc->vref);
if (ret < 0)
The "ret" variable is type long and "vref_uv" is u32 so that means
the condition can never be true on a 64bit system. A negative error
code from regulator_get_voltage() would be cast to a high positive
u32 value and then remain a high positive value when cast to a long.
The "ret" variable only ever stores ints so it should be declared as
an int. We can delete the "vref_uv" variable and use "ret" directly.
Fixes: 7d02296ac8b8 ("iio: adc: add imx93 adc support")
Signed-off-by: Dan Carpenter <error27@gmail.com>
Reviewed-by: Haibo Chen <haibo.chen@nxp.com>
Link: https://lore.kernel.org/r/Y+utEvjfjQRQo2QB@kili
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/imx93_adc.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c
index a775d2e405671..dce9ec91e4a77 100644
--- a/drivers/iio/adc/imx93_adc.c
+++ b/drivers/iio/adc/imx93_adc.c
@@ -236,8 +236,7 @@ static int imx93_adc_read_raw(struct iio_dev *indio_dev,
{
struct imx93_adc *adc = iio_priv(indio_dev);
struct device *dev = adc->dev;
- long ret;
- u32 vref_uv;
+ int ret;
switch (mask) {
case IIO_CHAN_INFO_RAW:
@@ -253,10 +252,10 @@ static int imx93_adc_read_raw(struct iio_dev *indio_dev,
return IIO_VAL_INT;
case IIO_CHAN_INFO_SCALE:
- ret = vref_uv = regulator_get_voltage(adc->vref);
+ ret = regulator_get_voltage(adc->vref);
if (ret < 0)
return ret;
- *val = vref_uv / 1000;
+ *val = ret / 1000;
*val2 = 12;
return IIO_VAL_FRACTIONAL_LOG2;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 175/286] KVM: arm64: vgic: Fix a circular locking issue
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 174/286] iio: adc: imx93: fix a signedness bug in imx93_adc_read_raw() Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 176/286] KVM: arm64: vgic: Wrap vgic_its_create() with config_lock Greg Kroah-Hartman
` (119 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Philippe Brucker, Oliver Upton,
Marc Zyngier, Sasha Levin
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
[ Upstream commit 59112e9c390be595224e427827475a6cd3726021 ]
Lockdep reports a circular lock dependency between the srcu and the
config_lock:
[ 262.179917] -> #1 (&kvm->srcu){.+.+}-{0:0}:
[ 262.182010] __synchronize_srcu+0xb0/0x224
[ 262.183422] synchronize_srcu_expedited+0x24/0x34
[ 262.184554] kvm_io_bus_register_dev+0x324/0x50c
[ 262.185650] vgic_register_redist_iodev+0x254/0x398
[ 262.186740] vgic_v3_set_redist_base+0x3b0/0x724
[ 262.188087] kvm_vgic_addr+0x364/0x600
[ 262.189189] vgic_set_common_attr+0x90/0x544
[ 262.190278] vgic_v3_set_attr+0x74/0x9c
[ 262.191432] kvm_device_ioctl+0x2a0/0x4e4
[ 262.192515] __arm64_sys_ioctl+0x7ac/0x1ba8
[ 262.193612] invoke_syscall.constprop.0+0x70/0x1e0
[ 262.195006] do_el0_svc+0xe4/0x2d4
[ 262.195929] el0_svc+0x44/0x8c
[ 262.196917] el0t_64_sync_handler+0xf4/0x120
[ 262.198238] el0t_64_sync+0x190/0x194
[ 262.199224]
[ 262.199224] -> #0 (&kvm->arch.config_lock){+.+.}-{3:3}:
[ 262.201094] __lock_acquire+0x2b70/0x626c
[ 262.202245] lock_acquire+0x454/0x778
[ 262.203132] __mutex_lock+0x190/0x8b4
[ 262.204023] mutex_lock_nested+0x24/0x30
[ 262.205100] vgic_mmio_write_v3_misc+0x5c/0x2a0
[ 262.206178] dispatch_mmio_write+0xd8/0x258
[ 262.207498] __kvm_io_bus_write+0x1e0/0x350
[ 262.208582] kvm_io_bus_write+0xe0/0x1cc
[ 262.209653] io_mem_abort+0x2ac/0x6d8
[ 262.210569] kvm_handle_guest_abort+0x9b8/0x1f88
[ 262.211937] handle_exit+0xc4/0x39c
[ 262.212971] kvm_arch_vcpu_ioctl_run+0x90c/0x1c04
[ 262.214154] kvm_vcpu_ioctl+0x450/0x12f8
[ 262.215233] __arm64_sys_ioctl+0x7ac/0x1ba8
[ 262.216402] invoke_syscall.constprop.0+0x70/0x1e0
[ 262.217774] do_el0_svc+0xe4/0x2d4
[ 262.218758] el0_svc+0x44/0x8c
[ 262.219941] el0t_64_sync_handler+0xf4/0x120
[ 262.221110] el0t_64_sync+0x190/0x194
Note that the current report, which can be triggered by the vgic_irq
kselftest, is a triple chain that includes slots_lock, but after
inverting the slots_lock/config_lock dependency, the actual problem
reported above remains.
In several places, the vgic code calls kvm_io_bus_register_dev(), which
synchronizes the srcu, while holding config_lock (#1). And the MMIO
handler takes the config_lock while holding the srcu read lock (#0).
Break dependency #1, by registering the distributor and redistributors
without holding config_lock. The ITS also uses kvm_io_bus_register_dev()
but already relies on slots_lock to serialize calls.
The distributor iodev is created on the first KVM_RUN call. Multiple
threads will race for vgic initialization, and only the first one will
see !vgic_ready() under the lock. To serialize those threads, rely on
slots_lock rather than config_lock.
Redistributors are created earlier, through KVM_DEV_ARM_VGIC_GRP_ADDR
ioctls and vCPU creation. Similarly, serialize the iodev creation with
slots_lock, and the rest with config_lock.
Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230518100914.2837292-2-jean-philippe@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-init.c | 25 ++++++++++++++++-----
arch/arm64/kvm/vgic/vgic-kvm-device.c | 10 +++++++--
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 31 ++++++++++++++++++---------
arch/arm64/kvm/vgic/vgic-mmio.c | 9 ++------
arch/arm64/kvm/vgic/vgic-v2.c | 6 ------
arch/arm64/kvm/vgic/vgic-v3.c | 7 ------
6 files changed, 51 insertions(+), 37 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-init.c b/arch/arm64/kvm/vgic/vgic-init.c
index 9d42c7cb2b588..c199ba2f192ef 100644
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -235,9 +235,9 @@ int kvm_vgic_vcpu_init(struct kvm_vcpu *vcpu)
* KVM io device for the redistributor that belongs to this VCPU.
*/
if (dist->vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
- mutex_lock(&vcpu->kvm->arch.config_lock);
+ mutex_lock(&vcpu->kvm->slots_lock);
ret = vgic_register_redist_iodev(vcpu);
- mutex_unlock(&vcpu->kvm->arch.config_lock);
+ mutex_unlock(&vcpu->kvm->slots_lock);
}
return ret;
}
@@ -446,11 +446,13 @@ int vgic_lazy_init(struct kvm *kvm)
int kvm_vgic_map_resources(struct kvm *kvm)
{
struct vgic_dist *dist = &kvm->arch.vgic;
+ gpa_t dist_base;
int ret = 0;
if (likely(vgic_ready(kvm)))
return 0;
+ mutex_lock(&kvm->slots_lock);
mutex_lock(&kvm->arch.config_lock);
if (vgic_ready(kvm))
goto out;
@@ -463,13 +465,26 @@ int kvm_vgic_map_resources(struct kvm *kvm)
else
ret = vgic_v3_map_resources(kvm);
- if (ret)
+ if (ret) {
__kvm_vgic_destroy(kvm);
- else
- dist->ready = true;
+ goto out;
+ }
+ dist->ready = true;
+ dist_base = dist->vgic_dist_base;
+ mutex_unlock(&kvm->arch.config_lock);
+
+ ret = vgic_register_dist_iodev(kvm, dist_base,
+ kvm_vgic_global_state.type);
+ if (ret) {
+ kvm_err("Unable to register VGIC dist MMIO regions\n");
+ kvm_vgic_destroy(kvm);
+ }
+ mutex_unlock(&kvm->slots_lock);
+ return ret;
out:
mutex_unlock(&kvm->arch.config_lock);
+ mutex_unlock(&kvm->slots_lock);
return ret;
}
diff --git a/arch/arm64/kvm/vgic/vgic-kvm-device.c b/arch/arm64/kvm/vgic/vgic-kvm-device.c
index 07e727023deb7..bf4b3d9631ce1 100644
--- a/arch/arm64/kvm/vgic/vgic-kvm-device.c
+++ b/arch/arm64/kvm/vgic/vgic-kvm-device.c
@@ -102,7 +102,11 @@ static int kvm_vgic_addr(struct kvm *kvm, struct kvm_device_attr *attr, bool wri
if (get_user(addr, uaddr))
return -EFAULT;
- mutex_lock(&kvm->arch.config_lock);
+ /*
+ * Since we can't hold config_lock while registering the redistributor
+ * iodevs, take the slots_lock immediately.
+ */
+ mutex_lock(&kvm->slots_lock);
switch (attr->attr) {
case KVM_VGIC_V2_ADDR_TYPE_DIST:
r = vgic_check_type(kvm, KVM_DEV_TYPE_ARM_VGIC_V2);
@@ -182,6 +186,7 @@ static int kvm_vgic_addr(struct kvm *kvm, struct kvm_device_attr *attr, bool wri
if (r)
goto out;
+ mutex_lock(&kvm->arch.config_lock);
if (write) {
r = vgic_check_iorange(kvm, *addr_ptr, addr, alignment, size);
if (!r)
@@ -189,9 +194,10 @@ static int kvm_vgic_addr(struct kvm *kvm, struct kvm_device_attr *attr, bool wri
} else {
addr = *addr_ptr;
}
+ mutex_unlock(&kvm->arch.config_lock);
out:
- mutex_unlock(&kvm->arch.config_lock);
+ mutex_unlock(&kvm->slots_lock);
if (!r && !write)
r = put_user(addr, uaddr);
diff --git a/arch/arm64/kvm/vgic/vgic-mmio-v3.c b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
index 472b18ac92a24..188d2187eede9 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -769,10 +769,13 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
struct vgic_io_device *rd_dev = &vcpu->arch.vgic_cpu.rd_iodev;
struct vgic_redist_region *rdreg;
gpa_t rd_base;
- int ret;
+ int ret = 0;
+
+ lockdep_assert_held(&kvm->slots_lock);
+ mutex_lock(&kvm->arch.config_lock);
if (!IS_VGIC_ADDR_UNDEF(vgic_cpu->rd_iodev.base_addr))
- return 0;
+ goto out_unlock;
/*
* We may be creating VCPUs before having set the base address for the
@@ -782,10 +785,12 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
*/
rdreg = vgic_v3_rdist_free_slot(&vgic->rd_regions);
if (!rdreg)
- return 0;
+ goto out_unlock;
- if (!vgic_v3_check_base(kvm))
- return -EINVAL;
+ if (!vgic_v3_check_base(kvm)) {
+ ret = -EINVAL;
+ goto out_unlock;
+ }
vgic_cpu->rdreg = rdreg;
vgic_cpu->rdreg_index = rdreg->free_index;
@@ -799,16 +804,20 @@ int vgic_register_redist_iodev(struct kvm_vcpu *vcpu)
rd_dev->nr_regions = ARRAY_SIZE(vgic_v3_rd_registers);
rd_dev->redist_vcpu = vcpu;
- mutex_lock(&kvm->slots_lock);
+ mutex_unlock(&kvm->arch.config_lock);
+
ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, rd_base,
2 * SZ_64K, &rd_dev->dev);
- mutex_unlock(&kvm->slots_lock);
-
if (ret)
return ret;
+ /* Protected by slots_lock */
rdreg->free_index++;
return 0;
+
+out_unlock:
+ mutex_unlock(&kvm->arch.config_lock);
+ return ret;
}
static void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu)
@@ -834,12 +843,10 @@ static int vgic_register_all_redist_iodevs(struct kvm *kvm)
/* The current c failed, so iterate over the previous ones. */
int i;
- mutex_lock(&kvm->slots_lock);
for (i = 0; i < c; i++) {
vcpu = kvm_get_vcpu(kvm, i);
vgic_unregister_redist_iodev(vcpu);
}
- mutex_unlock(&kvm->slots_lock);
}
return ret;
@@ -938,7 +945,9 @@ int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
{
int ret;
+ mutex_lock(&kvm->arch.config_lock);
ret = vgic_v3_alloc_redist_region(kvm, index, addr, count);
+ mutex_unlock(&kvm->arch.config_lock);
if (ret)
return ret;
@@ -950,8 +959,10 @@ int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count)
if (ret) {
struct vgic_redist_region *rdreg;
+ mutex_lock(&kvm->arch.config_lock);
rdreg = vgic_v3_rdist_region_from_index(kvm, index);
vgic_v3_free_redist_region(rdreg);
+ mutex_unlock(&kvm->arch.config_lock);
return ret;
}
diff --git a/arch/arm64/kvm/vgic/vgic-mmio.c b/arch/arm64/kvm/vgic/vgic-mmio.c
index 1939c94e0b248..ff558c05e990c 100644
--- a/arch/arm64/kvm/vgic/vgic-mmio.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio.c
@@ -1096,7 +1096,6 @@ int vgic_register_dist_iodev(struct kvm *kvm, gpa_t dist_base_address,
enum vgic_type type)
{
struct vgic_io_device *io_device = &kvm->arch.vgic.dist_iodev;
- int ret = 0;
unsigned int len;
switch (type) {
@@ -1114,10 +1113,6 @@ int vgic_register_dist_iodev(struct kvm *kvm, gpa_t dist_base_address,
io_device->iodev_type = IODEV_DIST;
io_device->redist_vcpu = NULL;
- mutex_lock(&kvm->slots_lock);
- ret = kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, dist_base_address,
- len, &io_device->dev);
- mutex_unlock(&kvm->slots_lock);
-
- return ret;
+ return kvm_io_bus_register_dev(kvm, KVM_MMIO_BUS, dist_base_address,
+ len, &io_device->dev);
}
diff --git a/arch/arm64/kvm/vgic/vgic-v2.c b/arch/arm64/kvm/vgic/vgic-v2.c
index 645648349c99b..7e9cdb78f7ce8 100644
--- a/arch/arm64/kvm/vgic/vgic-v2.c
+++ b/arch/arm64/kvm/vgic/vgic-v2.c
@@ -312,12 +312,6 @@ int vgic_v2_map_resources(struct kvm *kvm)
return ret;
}
- ret = vgic_register_dist_iodev(kvm, dist->vgic_dist_base, VGIC_V2);
- if (ret) {
- kvm_err("Unable to register VGIC MMIO regions\n");
- return ret;
- }
-
if (!static_branch_unlikely(&vgic_v2_cpuif_trap)) {
ret = kvm_phys_addr_ioremap(kvm, dist->vgic_cpu_base,
kvm_vgic_global_state.vcpu_base,
diff --git a/arch/arm64/kvm/vgic/vgic-v3.c b/arch/arm64/kvm/vgic/vgic-v3.c
index 469d816f356f3..76af07e66d731 100644
--- a/arch/arm64/kvm/vgic/vgic-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-v3.c
@@ -539,7 +539,6 @@ int vgic_v3_map_resources(struct kvm *kvm)
{
struct vgic_dist *dist = &kvm->arch.vgic;
struct kvm_vcpu *vcpu;
- int ret = 0;
unsigned long c;
kvm_for_each_vcpu(c, vcpu, kvm) {
@@ -569,12 +568,6 @@ int vgic_v3_map_resources(struct kvm *kvm)
return -EBUSY;
}
- ret = vgic_register_dist_iodev(kvm, dist->vgic_dist_base, VGIC_V3);
- if (ret) {
- kvm_err("Unable to register VGICv3 dist MMIO regions\n");
- return ret;
- }
-
if (kvm_vgic_global_state.has_gicv4_1)
vgic_v4_configure_vsgis(kvm);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 176/286] KVM: arm64: vgic: Wrap vgic_its_create() with config_lock
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 175/286] KVM: arm64: vgic: Fix a circular locking issue Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 177/286] KVM: arm64: vgic: Fix locking comment Greg Kroah-Hartman
` (118 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Philippe Brucker, Oliver Upton,
Marc Zyngier, Sasha Levin
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
[ Upstream commit 9cf2f840c439b6b23bd99f584f2917ca425ae406 ]
vgic_its_create() changes the vgic state without holding the
config_lock, which triggers a lockdep warning in vgic_v4_init():
[ 358.667941] WARNING: CPU: 3 PID: 178 at arch/arm64/kvm/vgic/vgic-v4.c:245 vgic_v4_init+0x15c/0x7a8
...
[ 358.707410] vgic_v4_init+0x15c/0x7a8
[ 358.708550] vgic_its_create+0x37c/0x4a4
[ 358.709640] kvm_vm_ioctl+0x1518/0x2d80
[ 358.710688] __arm64_sys_ioctl+0x7ac/0x1ba8
[ 358.711960] invoke_syscall.constprop.0+0x70/0x1e0
[ 358.713245] do_el0_svc+0xe4/0x2d4
[ 358.714289] el0_svc+0x44/0x8c
[ 358.715329] el0t_64_sync_handler+0xf4/0x120
[ 358.716615] el0t_64_sync+0x190/0x194
Wrap the whole of vgic_its_create() with config_lock since, in addition
to calling vgic_v4_init(), it also modifies the global kvm->arch.vgic
state.
Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230518100914.2837292-3-jean-philippe@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-its.c | 14 ++++++++++----
1 file changed, 10 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/kvm/vgic/vgic-its.c b/arch/arm64/kvm/vgic/vgic-its.c
index 750e51e3779a3..5fe2365a629f2 100644
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -1936,6 +1936,7 @@ void vgic_lpi_translation_cache_destroy(struct kvm *kvm)
static int vgic_its_create(struct kvm_device *dev, u32 type)
{
+ int ret;
struct vgic_its *its;
if (type != KVM_DEV_TYPE_ARM_VGIC_ITS)
@@ -1945,9 +1946,12 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
if (!its)
return -ENOMEM;
+ mutex_lock(&dev->kvm->arch.config_lock);
+
if (vgic_initialized(dev->kvm)) {
- int ret = vgic_v4_init(dev->kvm);
+ ret = vgic_v4_init(dev->kvm);
if (ret < 0) {
+ mutex_unlock(&dev->kvm->arch.config_lock);
kfree(its);
return ret;
}
@@ -1960,12 +1964,10 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
/* Yep, even more trickery for lock ordering... */
#ifdef CONFIG_LOCKDEP
- mutex_lock(&dev->kvm->arch.config_lock);
mutex_lock(&its->cmd_lock);
mutex_lock(&its->its_lock);
mutex_unlock(&its->its_lock);
mutex_unlock(&its->cmd_lock);
- mutex_unlock(&dev->kvm->arch.config_lock);
#endif
its->vgic_its_base = VGIC_ADDR_UNDEF;
@@ -1986,7 +1988,11 @@ static int vgic_its_create(struct kvm_device *dev, u32 type)
dev->private = its;
- return vgic_its_set_abi(its, NR_ITS_ABIS - 1);
+ ret = vgic_its_set_abi(its, NR_ITS_ABIS - 1);
+
+ mutex_unlock(&dev->kvm->arch.config_lock);
+
+ return ret;
}
static void vgic_its_destroy(struct kvm_device *kvm_dev)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 177/286] KVM: arm64: vgic: Fix locking comment
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 176/286] KVM: arm64: vgic: Wrap vgic_its_create() with config_lock Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 178/286] KVM: arm64: Prevent unconditional donation of unmapped regions from the host Greg Kroah-Hartman
` (117 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Philippe Brucker, Oliver Upton,
Marc Zyngier, Sasha Levin
From: Jean-Philippe Brucker <jean-philippe@linaro.org>
[ Upstream commit c38b8400aef99d63be2b1ff131bb993465dcafe1 ]
It is now config_lock that must be held, not kvm lock. Replace the
comment with a lockdep annotation.
Fixes: f00327731131 ("KVM: arm64: Use config_lock to protect vgic state")
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230518100914.2837292-4-jean-philippe@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/vgic/vgic-v4.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/arm64/kvm/vgic/vgic-v4.c b/arch/arm64/kvm/vgic/vgic-v4.c
index 3bb0034780605..c1c28fe680ba3 100644
--- a/arch/arm64/kvm/vgic/vgic-v4.c
+++ b/arch/arm64/kvm/vgic/vgic-v4.c
@@ -184,13 +184,14 @@ static void vgic_v4_disable_vsgis(struct kvm_vcpu *vcpu)
}
}
-/* Must be called with the kvm lock held */
void vgic_v4_configure_vsgis(struct kvm *kvm)
{
struct vgic_dist *dist = &kvm->arch.vgic;
struct kvm_vcpu *vcpu;
unsigned long i;
+ lockdep_assert_held(&kvm->arch.config_lock);
+
kvm_arm_halt_guest(kvm);
kvm_for_each_vcpu(i, vcpu, kvm) {
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 178/286] KVM: arm64: Prevent unconditional donation of unmapped regions from the host
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 177/286] KVM: arm64: vgic: Fix locking comment Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 179/286] scsi: qla2xxx: Fix NULL pointer dereference in target mode Greg Kroah-Hartman
` (116 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quentin Perret, Will Deacon,
Marc Zyngier, Sasha Levin
From: Will Deacon <will@kernel.org>
[ Upstream commit 09cce60bddd6461a93a5bf434265a47827d1bc6f ]
Since host stage-2 mappings are created lazily, we cannot rely solely on
the pte in order to recover the target physical address when checking a
host-initiated memory transition as this permits donation of unmapped
regions corresponding to MMIO or "no-map" memory.
Instead of inspecting the pte, move the addr_is_allowed_memory() check
into the host callback function where it is passed the physical address
directly from the walker.
Cc: Quentin Perret <qperret@google.com>
Fixes: e82edcc75c4e ("KVM: arm64: Implement do_share() helper for sharing memory")
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230518095844.1178-1-will@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/kvm/hyp/nvhe/mem_protect.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
diff --git a/arch/arm64/kvm/hyp/nvhe/mem_protect.c b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
index 552653fa18be3..dab14d3ca7bb6 100644
--- a/arch/arm64/kvm/hyp/nvhe/mem_protect.c
+++ b/arch/arm64/kvm/hyp/nvhe/mem_protect.c
@@ -568,7 +568,7 @@ struct pkvm_mem_donation {
struct check_walk_data {
enum pkvm_page_state desired;
- enum pkvm_page_state (*get_page_state)(kvm_pte_t pte);
+ enum pkvm_page_state (*get_page_state)(kvm_pte_t pte, u64 addr);
};
static int __check_page_state_visitor(const struct kvm_pgtable_visit_ctx *ctx,
@@ -576,10 +576,7 @@ static int __check_page_state_visitor(const struct kvm_pgtable_visit_ctx *ctx,
{
struct check_walk_data *d = ctx->arg;
- if (kvm_pte_valid(ctx->old) && !addr_is_allowed_memory(kvm_pte_to_phys(ctx->old)))
- return -EINVAL;
-
- return d->get_page_state(ctx->old) == d->desired ? 0 : -EPERM;
+ return d->get_page_state(ctx->old, ctx->addr) == d->desired ? 0 : -EPERM;
}
static int check_page_state_range(struct kvm_pgtable *pgt, u64 addr, u64 size,
@@ -594,8 +591,11 @@ static int check_page_state_range(struct kvm_pgtable *pgt, u64 addr, u64 size,
return kvm_pgtable_walk(pgt, addr, size, &walker);
}
-static enum pkvm_page_state host_get_page_state(kvm_pte_t pte)
+static enum pkvm_page_state host_get_page_state(kvm_pte_t pte, u64 addr)
{
+ if (!addr_is_allowed_memory(addr))
+ return PKVM_NOPAGE;
+
if (!kvm_pte_valid(pte) && pte)
return PKVM_NOPAGE;
@@ -702,7 +702,7 @@ static int host_complete_donation(u64 addr, const struct pkvm_mem_transition *tx
return host_stage2_set_owner_locked(addr, size, host_id);
}
-static enum pkvm_page_state hyp_get_page_state(kvm_pte_t pte)
+static enum pkvm_page_state hyp_get_page_state(kvm_pte_t pte, u64 addr)
{
if (!kvm_pte_valid(pte))
return PKVM_NOPAGE;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 179/286] scsi: qla2xxx: Fix NULL pointer dereference in target mode
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 178/286] KVM: arm64: Prevent unconditional donation of unmapped regions from the host Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 180/286] perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS Greg Kroah-Hartman
` (115 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gleb Chesnokov, Himanshu Madhani,
Martin K. Petersen, Sasha Levin
From: Gleb Chesnokov <gleb.chesnokov@scst.dev>
[ Upstream commit d54820b22e404b06b2b65877ff802cc7b31688bc ]
When target mode is enabled, the pci_irq_get_affinity() function may return
a NULL value in qla_mapq_init_qp_cpu_map() due to the qla24xx_enable_msix()
code that handles IRQ settings for target mode. This leads to a crash due
to a NULL pointer dereference.
This patch fixes the issue by adding a check for the NULL value returned by
pci_irq_get_affinity() and introducing a 'cpu_mapped' boolean flag to the
qla_qpair structure, ensuring that the qpair's CPU affinity is updated when
it has not been mapped to a CPU.
Fixes: 1d201c81d4cc ("scsi: qla2xxx: Select qpair depending on which CPU post_cmd() gets called")
Signed-off-by: Gleb Chesnokov <gleb.chesnokov@scst.dev>
Link: https://lore.kernel.org/r/56b416f2-4e0f-b6cf-d6d5-b7c372e3c6a2@scst.dev
Reviewed-by: Himanshu Madhani <himanshu.madhani@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/qla2xxx/qla_def.h | 1 +
drivers/scsi/qla2xxx/qla_init.c | 3 +++
drivers/scsi/qla2xxx/qla_inline.h | 3 +++
drivers/scsi/qla2xxx/qla_isr.c | 3 +++
4 files changed, 10 insertions(+)
diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h
index ec0e987b71fa5..807ae5ede44c6 100644
--- a/drivers/scsi/qla2xxx/qla_def.h
+++ b/drivers/scsi/qla2xxx/qla_def.h
@@ -3797,6 +3797,7 @@ struct qla_qpair {
uint64_t retry_term_jiff;
struct qla_tgt_counters tgt_counters;
uint16_t cpuid;
+ bool cpu_mapped;
struct qla_fw_resources fwres ____cacheline_aligned;
struct qla_buf_pool buf_pool;
u32 cmd_cnt;
diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c
index ec0423ec66817..1a955c3ff3d6c 100644
--- a/drivers/scsi/qla2xxx/qla_init.c
+++ b/drivers/scsi/qla2xxx/qla_init.c
@@ -9426,6 +9426,9 @@ struct qla_qpair *qla2xxx_create_qpair(struct scsi_qla_host *vha, int qos,
qpair->rsp->req = qpair->req;
qpair->rsp->qpair = qpair;
+ if (!qpair->cpu_mapped)
+ qla_cpu_update(qpair, raw_smp_processor_id());
+
if (IS_T10_PI_CAPABLE(ha) && ql2xenabledif) {
if (ha->fw_attributes & BIT_4)
qpair->difdix_supported = 1;
diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h
index cce6e425c1214..7b42558a8839a 100644
--- a/drivers/scsi/qla2xxx/qla_inline.h
+++ b/drivers/scsi/qla2xxx/qla_inline.h
@@ -539,11 +539,14 @@ qla_mapq_init_qp_cpu_map(struct qla_hw_data *ha,
if (!ha->qp_cpu_map)
return;
mask = pci_irq_get_affinity(ha->pdev, msix->vector_base0);
+ if (!mask)
+ return;
qpair->cpuid = cpumask_first(mask);
for_each_cpu(cpu, mask) {
ha->qp_cpu_map[cpu] = qpair;
}
msix->cpuid = qpair->cpuid;
+ qpair->cpu_mapped = true;
}
static inline void
diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c
index 71feda2cdb630..245e3a5d81fd3 100644
--- a/drivers/scsi/qla2xxx/qla_isr.c
+++ b/drivers/scsi/qla2xxx/qla_isr.c
@@ -3770,6 +3770,9 @@ void qla24xx_process_response_queue(struct scsi_qla_host *vha,
if (rsp->qpair->cpuid != smp_processor_id() || !rsp->qpair->rcv_intr) {
rsp->qpair->rcv_intr = 1;
+
+ if (!rsp->qpair->cpu_mapped)
+ qla_cpu_update(rsp->qpair, raw_smp_processor_id());
}
#define __update_rsp_in(_is_shadow_hba, _rsp, _rsp_in) \
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 180/286] perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 179/286] scsi: qla2xxx: Fix NULL pointer dereference in target mode Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 181/286] KVM: arm64: Reload PTE after invoking walker callback on preorder traversal Greg Kroah-Hartman
` (114 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Like Xu, Peter Zijlstra (Intel),
Kan Liang, Sasha Levin
From: Like Xu <likexu@tencent.com>
[ Upstream commit 3c845304d2d723f20d5b91fef5d133ff94825d76 ]
After commit b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing
PEBS_DATA_CFG"), the cpuc->pebs_data_cfg may save some bits that are not
supported by real hardware, such as PEBS_UPDATE_DS_SW. This would cause
the VMX hardware MSR switching mechanism to save/restore invalid values
for PEBS_DATA_CFG MSR, thus crashing the host when PEBS is used for guest.
Fix it by using the active host value from cpuc->active_pebs_data_cfg.
Fixes: b752ea0c28e3 ("perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG")
Signed-off-by: Like Xu <likexu@tencent.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Kan Liang <kan.liang@linux.intel.com>
Link: https://lore.kernel.org/r/20230517133808.67885-1-likexu@tencent.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/events/intel/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c
index a3fb996a86a10..161b8f71eb5a7 100644
--- a/arch/x86/events/intel/core.c
+++ b/arch/x86/events/intel/core.c
@@ -4074,7 +4074,7 @@ static struct perf_guest_switch_msr *intel_guest_get_msrs(int *nr, void *data)
if (x86_pmu.intel_cap.pebs_baseline) {
arr[(*nr)++] = (struct perf_guest_switch_msr){
.msr = MSR_PEBS_DATA_CFG,
- .host = cpuc->pebs_data_cfg,
+ .host = cpuc->active_pebs_data_cfg,
.guest = kvm_pmu->pebs_data_cfg,
};
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 181/286] KVM: arm64: Reload PTE after invoking walker callback on preorder traversal
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 180/286] perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 182/286] media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats Greg Kroah-Hartman
` (113 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Oliver Upton, Fuad Tabba,
Marc Zyngier, Sasha Levin
From: Fuad Tabba <tabba@google.com>
[ Upstream commit a9f0e3d5a089d0844abb679a5e99f15010d53e25 ]
The preorder callback on the kvm_pgtable_stage2_map() path can replace
a table with a block, then recursively free the detached table. The
higher-level walking logic stashes the old page table entry and
then walks the freed table, invoking the leaf callback and
potentially freeing pgtable pages prematurely.
In normal operation, the call to tear down the detached stage-2
is indirected and uses an RCU callback to trigger the freeing.
RCU is not available to pKVM, which is where this bug is
triggered.
Change the behavior of the walker to reload the page table entry
after invoking the walker callback on preorder traversal, as it
does for leaf entries.
Tested on Pixel 6.
Fixes: 5c359cca1faf ("KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make")
Suggested-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Fuad Tabba <tabba@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230522103258.402272-1-tabba@google.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/include/asm/kvm_pgtable.h | 6 +++---
arch/arm64/kvm/hyp/pgtable.c | 14 +++++++++++++-
2 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/include/asm/kvm_pgtable.h b/arch/arm64/include/asm/kvm_pgtable.h
index dc3c072e862f1..93bd0975b15f5 100644
--- a/arch/arm64/include/asm/kvm_pgtable.h
+++ b/arch/arm64/include/asm/kvm_pgtable.h
@@ -632,9 +632,9 @@ int kvm_pgtable_stage2_flush(struct kvm_pgtable *pgt, u64 addr, u64 size);
*
* The walker will walk the page-table entries corresponding to the input
* address range specified, visiting entries according to the walker flags.
- * Invalid entries are treated as leaf entries. Leaf entries are reloaded
- * after invoking the walker callback, allowing the walker to descend into
- * a newly installed table.
+ * Invalid entries are treated as leaf entries. The visited page table entry is
+ * reloaded after invoking the walker callback, allowing the walker to descend
+ * into a newly installed table.
*
* Returning a negative error code from the walker callback function will
* terminate the walk immediately with the same error code.
diff --git a/arch/arm64/kvm/hyp/pgtable.c b/arch/arm64/kvm/hyp/pgtable.c
index 140f82300db5a..faddf1e71c8de 100644
--- a/arch/arm64/kvm/hyp/pgtable.c
+++ b/arch/arm64/kvm/hyp/pgtable.c
@@ -209,14 +209,26 @@ static inline int __kvm_pgtable_visit(struct kvm_pgtable_walk_data *data,
.flags = flags,
};
int ret = 0;
+ bool reload = false;
kvm_pteref_t childp;
bool table = kvm_pte_table(ctx.old, level);
- if (table && (ctx.flags & KVM_PGTABLE_WALK_TABLE_PRE))
+ if (table && (ctx.flags & KVM_PGTABLE_WALK_TABLE_PRE)) {
ret = kvm_pgtable_visitor_cb(data, &ctx, KVM_PGTABLE_WALK_TABLE_PRE);
+ reload = true;
+ }
if (!table && (ctx.flags & KVM_PGTABLE_WALK_LEAF)) {
ret = kvm_pgtable_visitor_cb(data, &ctx, KVM_PGTABLE_WALK_LEAF);
+ reload = true;
+ }
+
+ /*
+ * Reload the page table after invoking the walker callback for leaf
+ * entries or after pre-order traversal, to allow the walker to descend
+ * into a newly installed or replaced table.
+ */
+ if (reload) {
ctx.old = READ_ONCE(*ptep);
table = kvm_pte_table(ctx.old, level);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 182/286] media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 181/286] KVM: arm64: Reload PTE after invoking walker callback on preorder traversal Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 183/286] mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() Greg Kroah-Hartman
` (112 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pin-yen Lin, Chen-Yu Tsai,
Yunfei Dong, Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin
From: Pin-yen Lin <treapking@chromium.org>
[ Upstream commit ed17f89e9502f03af493e130620a9bb74c07cf28 ]
When VCODEC_CAPABILITY_4K_DISABLED is not set in dec_capability, skip
formats that are not MTK_FMT_DEC so only decoder formats is updated in
mtk_init_vdec_params.
Fixes: e25528e1dbe5 ("media: mediatek: vcodec: Use 4K frame size when supported by stateful decoder")
Signed-off-by: Pin-yen Lin <treapking@chromium.org>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: Yunfei Dong <yunfei.dong@mediatek.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c
index 29991551cf614..0fbd030026c72 100644
--- a/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c
+++ b/drivers/media/platform/mediatek/vcodec/mtk_vcodec_dec_stateful.c
@@ -584,6 +584,9 @@ static void mtk_init_vdec_params(struct mtk_vcodec_ctx *ctx)
if (!(ctx->dev->dec_capability & VCODEC_CAPABILITY_4K_DISABLED)) {
for (i = 0; i < num_supported_formats; i++) {
+ if (mtk_video_formats[i].type != MTK_FMT_DEC)
+ continue;
+
mtk_video_formats[i].frmsize.max_width =
VCODEC_DEC_4K_CODED_WIDTH;
mtk_video_formats[i].frmsize.max_height =
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 183/286] mailbox: mailbox-test: fix a locking issue in mbox_test_message_write()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 182/286] media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 184/286] drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug Greg Kroah-Hartman
` (111 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Lee Jones, Jassi Brar,
Sasha Levin
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 8fe72b76db79d694858e872370df49676bc3be8c ]
There was a bug where this code forgot to unlock the tdev->mutex if the
kzalloc() failed. Fix this issue, by moving the allocation outside the
lock.
Fixes: 2d1e952a2b8e ("mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write()")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Lee Jones <lee@kernel.org>
Signed-off-by: Jassi Brar <jaswinder.singh@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mailbox/mailbox-test.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/mailbox/mailbox-test.c b/drivers/mailbox/mailbox-test.c
index 6dd5b9614452b..abcee58e851c2 100644
--- a/drivers/mailbox/mailbox-test.c
+++ b/drivers/mailbox/mailbox-test.c
@@ -97,6 +97,7 @@ static ssize_t mbox_test_message_write(struct file *filp,
size_t count, loff_t *ppos)
{
struct mbox_test_device *tdev = filp->private_data;
+ char *message;
void *data;
int ret;
@@ -112,12 +113,13 @@ static ssize_t mbox_test_message_write(struct file *filp,
return -EINVAL;
}
- mutex_lock(&tdev->mutex);
-
- tdev->message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
- if (!tdev->message)
+ message = kzalloc(MBOX_MAX_MSG_LEN, GFP_KERNEL);
+ if (!message)
return -ENOMEM;
+ mutex_lock(&tdev->mutex);
+
+ tdev->message = message;
ret = copy_from_user(tdev->message, userbuf, count);
if (ret) {
ret = -EFAULT;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 184/286] drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 183/286] mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 185/286] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug Greg Kroah-Hartman
` (110 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, Sudeep Holla,
Sasha Levin
From: K Prateek Nayak <kprateek.nayak@amd.com>
[ Upstream commit 126310c9f669c9a8c875a3e5c2292299ca90225d ]
While building the shared_cpu_map, check if the cache level and cache
type matches. On certain systems that build the cache topology based on
the instance ID, there are cases where the same ID may repeat across
multiple cache levels, leading inaccurate topology.
In event of CPU offlining, the cache_shared_cpu_map_remove() does not
consider if IDs at same level are being compared. As a result, when same
IDs repeat across different cache levels, the CPU going offline is not
removed from all the shared_cpu_map.
Below is the output of cache topology of CPU8 and it's SMT sibling after
CPU8 is offlined on a dual socket 3rd Generation AMD EPYC processor
(2 x 64C/128T) running kernel release v6.3:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# echo 0 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu136/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list: 136
/sys/devices/system/cpu/cpu136/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu136/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list: 9-15,136-143
CPU8 is removed from index0 (L1i) but remains in the shared_cpu_list of
index1 (L1d) and index2 (L2). Since L1i, L1d, and L2 are shared by the
SMT siblings, and they have the same cache instance ID, CPU 2 is only
removed from the first index with matching ID which is index1 (L1i) in
this case. With this fix, the results are as expected when performing
the same experiment on the same system:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# echo 0 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu136/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list: 136
/sys/devices/system/cpu/cpu136/cache/index1/shared_cpu_list: 136
/sys/devices/system/cpu/cpu136/cache/index2/shared_cpu_list: 136
/sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list: 9-15,136-143
When rebuilding topology, the same problem appears as
cache_shared_cpu_map_setup() implements a similar logic. Consider the
same 3rd Generation EPYC processor: CPUs in Core 1, that share the L1
and L2 caches, have L1 and L2 instance ID as 1. For all the CPUs on
the second chiplet, the L3 ID is also 1 leading to grouping on CPUs from
Core 1 (1, 17) and the entire second chiplet (8-15, 24-31) as CPUs
sharing one cache domain. This went undetected since x86 processors
depended on arch specific populate_cache_leaves() method to repopulate
the shared_cpus_map when CPU came back online until kernel release
v6.3-rc5.
Fixes: 198102c9103f ("cacheinfo: Fix shared_cpu_map to handle shared caches at different levels")
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://lore.kernel.org/r/20230508084115.1157-2-kprateek.nayak@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/cacheinfo.c | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index ea8f416852bd9..6351db6ecb57f 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -380,6 +380,16 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)
continue;/* skip if itself or no cacheinfo */
for (sib_index = 0; sib_index < cache_leaves(i); sib_index++) {
sib_leaf = per_cpu_cacheinfo_idx(i, sib_index);
+
+ /*
+ * Comparing cache IDs only makes sense if the leaves
+ * belong to the same cache level of same type. Skip
+ * the check if level and type do not match.
+ */
+ if (sib_leaf->level != this_leaf->level ||
+ sib_leaf->type != this_leaf->type)
+ continue;
+
if (cache_leaves_are_shared(this_leaf, sib_leaf)) {
cpumask_set_cpu(cpu, &sib_leaf->shared_cpu_map);
cpumask_set_cpu(i, &this_leaf->shared_cpu_map);
@@ -411,6 +421,16 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
for (sib_index = 0; sib_index < cache_leaves(sibling); sib_index++) {
sib_leaf = per_cpu_cacheinfo_idx(sibling, sib_index);
+
+ /*
+ * Comparing cache IDs only makes sense if the leaves
+ * belong to the same cache level of same type. Skip
+ * the check if level and type do not match.
+ */
+ if (sib_leaf->level != this_leaf->level ||
+ sib_leaf->type != this_leaf->type)
+ continue;
+
if (cache_leaves_are_shared(this_leaf, sib_leaf)) {
cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 185/286] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 184/286] drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 186/286] dt-bindings: serial: 8250_omap: add rs485-rts-active-high Greg Kroah-Hartman
` (109 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, K Prateek Nayak, Yicong Yang,
Sudeep Holla, Sasha Levin
From: K Prateek Nayak <kprateek.nayak@amd.com>
[ Upstream commit c26fabe73330d983c7ce822c6b6ec0879b4da61f ]
Until commit 5c2712387d48 ("cacheinfo: Fix LLC is not exported through
sysfs"), cacheinfo called populate_cache_leaves() for CPU coming online
which let the arch specific functions handle (at least on x86)
populating the shared_cpu_map. However, with the changes in the
aforementioned commit, populate_cache_leaves() is not called when a CPU
comes online as a result of hotplug since last_level_cache_is_valid()
returns true as the cacheinfo data is not discarded. The CPU coming
online is not present in shared_cpu_map, however, it will not be added
since the cpu_cacheinfo->cpu_map_populated flag is set (it is set in
populate_cache_leaves() when cacheinfo is first populated for x86)
This can lead to inconsistencies in the shared_cpu_map when an offlined
CPU comes online again. Example below depicts the inconsistency in the
shared_cpu_list in cacheinfo when CPU8 is offlined and onlined again on
a 3rd Generation EPYC processor:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# echo 0 > /sys/devices/system/cpu/cpu8/online
# echo 1 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8
# cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
136
# cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
9-15,136-143
Clear the flag when the CPU is removed from shared_cpu_map when
cache_shared_cpu_map_remove() is called during CPU hotplug. This will
allow cache_shared_cpu_map_setup() to add the CPU coming back online in
the shared_cpu_map. Set the flag again when the shared_cpu_map is setup.
Following are results of performing the same test as described above with
the changes:
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# echo 0 > /sys/devices/system/cpu/cpu8/online
# echo 1 > /sys/devices/system/cpu/cpu8/online
# for i in /sys/devices/system/cpu/cpu8/cache/index*/shared_cpu_list; do echo -n "$i: "; cat $i; done
/sys/devices/system/cpu/cpu8/cache/index0/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index1/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index2/shared_cpu_list: 8,136
/sys/devices/system/cpu/cpu8/cache/index3/shared_cpu_list: 8-15,136-143
# cat /sys/devices/system/cpu/cpu136/cache/index0/shared_cpu_list
8,136
# cat /sys/devices/system/cpu/cpu136/cache/index3/shared_cpu_list
8-15,136-143
Fixes: 5c2712387d48 ("cacheinfo: Fix LLC is not exported through sysfs")
Signed-off-by: K Prateek Nayak <kprateek.nayak@amd.com>
Reviewed-by: Yicong Yang <yangyicong@hisilicon.com>
Reviewed-by: Sudeep Holla <sudeep.holla@arm.com>
Link: https://lore.kernel.org/r/20230508084115.1157-3-kprateek.nayak@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/cacheinfo.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
index 6351db6ecb57f..0fc8fbe7b361d 100644
--- a/drivers/base/cacheinfo.c
+++ b/drivers/base/cacheinfo.c
@@ -402,11 +402,14 @@ static int cache_shared_cpu_map_setup(unsigned int cpu)
coherency_max_size = this_leaf->coherency_line_size;
}
+ /* shared_cpu_map is now populated for the cpu */
+ this_cpu_ci->cpu_map_populated = true;
return 0;
}
static void cache_shared_cpu_map_remove(unsigned int cpu)
{
+ struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu);
struct cacheinfo *this_leaf, *sib_leaf;
unsigned int sibling, index, sib_index;
@@ -439,6 +442,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
}
}
}
+
+ /* cpu is no longer populated in the shared map */
+ this_cpu_ci->cpu_map_populated = false;
}
static void free_cache_attributes(unsigned int cpu)
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 186/286] dt-bindings: serial: 8250_omap: add rs485-rts-active-high
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 185/286] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 187/286] media: uvcvideo: Dont expose unsupported formats to userspace Greg Kroah-Hartman
` (108 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini,
Krzysztof Kozlowski, Sasha Levin
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 403e97d6ab2cb6fd0ac1ff968cd7b691771f1613 ]
Add rs485-rts-active-high property, this was removed by mistake.
In general we just use rs485-rts-active-low property, however the OMAP
UART for legacy reason uses the -high one.
Fixes: 767d3467eb60 ("dt-bindings: serial: 8250_omap: drop rs485 properties")
Closes: https://lore.kernel.org/all/ZGefR4mTHHo1iQ7H@francesco-nb.int.toradex.com/
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230531111038.6302-1-francesco@dolcini.it
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
Documentation/devicetree/bindings/serial/8250_omap.yaml | 1 +
1 file changed, 1 insertion(+)
diff --git a/Documentation/devicetree/bindings/serial/8250_omap.yaml b/Documentation/devicetree/bindings/serial/8250_omap.yaml
index eb3488d8f9ee6..6a7be42da523c 100644
--- a/Documentation/devicetree/bindings/serial/8250_omap.yaml
+++ b/Documentation/devicetree/bindings/serial/8250_omap.yaml
@@ -70,6 +70,7 @@ properties:
dsr-gpios: true
rng-gpios: true
dcd-gpios: true
+ rs485-rts-active-high: true
rts-gpio: true
power-domains: true
clock-frequency: true
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 187/286] media: uvcvideo: Dont expose unsupported formats to userspace
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 186/286] dt-bindings: serial: 8250_omap: add rs485-rts-active-high Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 188/286] selftests/ftrace: Choose target function for filter test from samples Greg Kroah-Hartman
` (107 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Ricardo Ribalda,
Mauro Carvalho Chehab, Sasha Levin
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[ Upstream commit 81f3affa19d6ab0c32aef46b053838219eef7e71 ]
When the uvcvideo driver encounters a format descriptor with an unknown
format GUID, it creates a corresponding struct uvc_format instance with
the fcc field set to 0. Since commit 50459f103edf ("media: uvcvideo:
Remove format descriptions"), the driver relies on the V4L2 core to
provide the format description string, which the V4L2 core can't do
without a valid 4CC. This triggers a WARN_ON.
As a format with a zero 4CC can't be selected, it is unusable for
applications. Ignore the format completely without creating a uvc_format
instance, which fixes the warning.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217252
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2180107
Fixes: 50459f103edf ("media: uvcvideo: Remove format descriptions")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/uvc/uvc_driver.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
index 7aefa76a42b31..d631ce4f9f7bb 100644
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -251,14 +251,17 @@ static int uvc_parse_format(struct uvc_device *dev,
/* Find the format descriptor from its GUID. */
fmtdesc = uvc_format_by_guid(&buffer[5]);
- if (fmtdesc != NULL) {
- format->fcc = fmtdesc->fcc;
- } else {
+ if (!fmtdesc) {
+ /*
+ * Unknown video formats are not fatal errors, the
+ * caller will skip this descriptor.
+ */
dev_info(&streaming->intf->dev,
"Unknown video format %pUl\n", &buffer[5]);
- format->fcc = 0;
+ return 0;
}
+ format->fcc = fmtdesc->fcc;
format->bpp = buffer[21];
/*
@@ -675,7 +678,7 @@ static int uvc_parse_streaming(struct uvc_device *dev,
interval = (u32 *)&frame[nframes];
streaming->format = format;
- streaming->nformats = nformats;
+ streaming->nformats = 0;
/* Parse the format descriptors. */
while (buflen > 2 && buffer[1] == USB_DT_CS_INTERFACE) {
@@ -689,7 +692,10 @@ static int uvc_parse_streaming(struct uvc_device *dev,
&interval, buffer, buflen);
if (ret < 0)
goto error;
+ if (!ret)
+ break;
+ streaming->nformats++;
frame += format->nframes;
format++;
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 188/286] selftests/ftrace: Choose target function for filter test from samples
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 187/286] media: uvcvideo: Dont expose unsupported formats to userspace Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 189/286] drm/amd/display: Only wait for blank completion if OTG active Greg Kroah-Hartman
` (106 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Linux Kernel Functional Testing,
Masami Hiramatsu (Google), Steven Rostedt (Google), Sasha Levin
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
[ Upstream commit eb50d0f250e96ede9192d936d220cd97adc93b89 ]
Since the event-filter-function.tc expects the 'exit_mmap()' directly
calls 'kmem_cache_free()', this is vulnerable to code modifications.
Choose the target function for the filter test from the sample
event data so that it can keep test running correctly even if the caller
function name will be changed.
Link: https://lore.kernel.org/linux-trace-kernel/167919441260.1922645.18355804179347364057.stgit@mhiramat.roam.corp.google.com/
Link: https://lore.kernel.org/all/CA+G9fYtF-XEKi9YNGgR=Kf==7iRb2FrmEC7qtwAeQbfyah-UhA@mail.gmail.com/
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Fixes: 7f09d639b8c4 ("tracing/selftests: Add test for event filtering on function name")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../test.d/filter/event-filter-function.tc | 45 +++++++++++--------
1 file changed, 27 insertions(+), 18 deletions(-)
diff --git a/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc b/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc
index e2ff3bf4df80f..2de7c61d1ae30 100644
--- a/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc
+++ b/tools/testing/selftests/ftrace/test.d/filter/event-filter-function.tc
@@ -9,18 +9,33 @@ fail() { #msg
exit_fail
}
-echo "Test event filter function name"
+sample_events() {
+ echo > trace
+ echo 1 > events/kmem/kmem_cache_free/enable
+ echo 1 > tracing_on
+ ls > /dev/null
+ echo 0 > tracing_on
+ echo 0 > events/kmem/kmem_cache_free/enable
+}
+
echo 0 > tracing_on
echo 0 > events/enable
+
+echo "Get the most frequently calling function"
+sample_events
+
+target_func=`cut -d: -f3 trace | sed 's/call_site=\([^+]*\)+0x.*/\1/' | sort | uniq -c | sort | tail -n 1 | sed 's/^[ 0-9]*//'`
+if [ -z "$target_func" ]; then
+ exit_fail
+fi
echo > trace
-echo 'call_site.function == exit_mmap' > events/kmem/kmem_cache_free/filter
-echo 1 > events/kmem/kmem_cache_free/enable
-echo 1 > tracing_on
-ls > /dev/null
-echo 0 > events/kmem/kmem_cache_free/enable
-hitcnt=`grep kmem_cache_free trace| grep exit_mmap | wc -l`
-misscnt=`grep kmem_cache_free trace| grep -v exit_mmap | wc -l`
+echo "Test event filter function name"
+echo "call_site.function == $target_func" > events/kmem/kmem_cache_free/filter
+sample_events
+
+hitcnt=`grep kmem_cache_free trace| grep $target_func | wc -l`
+misscnt=`grep kmem_cache_free trace| grep -v $target_func | wc -l`
if [ $hitcnt -eq 0 ]; then
exit_fail
@@ -30,20 +45,14 @@ if [ $misscnt -gt 0 ]; then
exit_fail
fi
-address=`grep ' exit_mmap$' /proc/kallsyms | cut -d' ' -f1`
+address=`grep " ${target_func}\$" /proc/kallsyms | cut -d' ' -f1`
echo "Test event filter function address"
-echo 0 > tracing_on
-echo 0 > events/enable
-echo > trace
echo "call_site.function == 0x$address" > events/kmem/kmem_cache_free/filter
-echo 1 > events/kmem/kmem_cache_free/enable
-echo 1 > tracing_on
-sleep 1
-echo 0 > events/kmem/kmem_cache_free/enable
+sample_events
-hitcnt=`grep kmem_cache_free trace| grep exit_mmap | wc -l`
-misscnt=`grep kmem_cache_free trace| grep -v exit_mmap | wc -l`
+hitcnt=`grep kmem_cache_free trace| grep $target_func | wc -l`
+misscnt=`grep kmem_cache_free trace| grep -v $target_func | wc -l`
if [ $hitcnt -eq 0 ]; then
exit_fail
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 189/286] drm/amd/display: Only wait for blank completion if OTG active
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 188/286] selftests/ftrace: Choose target function for filter test from samples Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 190/286] iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method Greg Kroah-Hartman
` (105 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alvin Lee, Qingqing Zhuo, Aric Cyr,
Daniel Wheeler, Alex Deucher, Sasha Levin
From: Aric Cyr <aric.cyr@amd.com>
[ Upstream commit 82a10aff9428f1d190de55ef7971fdb84303cc7a ]
[why]
If OTG is not active, waiting for blank completion will always fail and
timeout resulting in unnecessary driver delays.
[how]
Check that OTG is enabled before waiting for blank.
Reviewed-by: Alvin Lee <Alvin.Lee2@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Aric Cyr <aric.cyr@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index d4a1670a54506..f07cba121d010 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -1093,7 +1093,8 @@ static void phantom_pipe_blank(
otg_active_height,
0);
- hws->funcs.wait_for_blank_complete(opp);
+ if (tg->funcs->is_tg_enabled(tg))
+ hws->funcs.wait_for_blank_complete(opp);
}
static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
@@ -1156,6 +1157,7 @@ static void disable_dangling_plane(struct dc *dc, struct dc_state *context)
if (old_stream->mall_stream_config.type == SUBVP_PHANTOM) {
if (tg->funcs->enable_crtc) {
int main_pipe_width, main_pipe_height;
+
main_pipe_width = old_stream->mall_stream_config.paired_stream->dst.width;
main_pipe_height = old_stream->mall_stream_config.paired_stream->dst.height;
phantom_pipe_blank(dc, tg, main_pipe_width, main_pipe_height);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 190/286] iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 189/286] drm/amd/display: Only wait for blank completion if OTG active Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 191/286] iio: adc: mxs-lradc: fix the order of two cleanup operations Greg Kroah-Hartman
` (104 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Linus Walleij,
Marius Hoch, Stable, Jonathan Cameron
From: Hans de Goede <hdegoede@redhat.com>
commit 79b8ded9d9c595db9bd5b2f62f5f738b36de1e22 upstream.
When apply_acpi_orientation() fails, st_accel_common_probe() will fall back
to iio_read_mount_matrix(), which checks for a mount-matrix device property
and if that is not set falls back to the identity matrix.
But when a sensor has no ACPI companion fwnode, or when the ACPI fwnode
does not have a "_ONT" method apply_acpi_orientation() was returning 0,
causing iio_read_mount_matrix() to never get called resulting in an
invalid mount_matrix:
[root@fedora ~]# cat /sys/bus/iio/devices/iio\:device0/mount_matrix
(null), (null), (null); (null), (null), (null); (null), (null), (null)
Fix this by making apply_acpi_orientation() always return an error when
it did not set the mount_matrix.
Fixes: 3d8ad94bb175 ("iio: accel: st_sensors: Support generic mounting matrix")
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Tested-by: Marius Hoch <mail@mariushoch.de>
Link: https://lore.kernel.org/r/20230416212409.310936-1-hdegoede@redhat.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/st_accel_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/accel/st_accel_core.c
+++ b/drivers/iio/accel/st_accel_core.c
@@ -1290,12 +1290,12 @@ static int apply_acpi_orientation(struct
adev = ACPI_COMPANION(indio_dev->dev.parent);
if (!adev)
- return 0;
+ return -ENXIO;
/* Read _ONT data, which should be a package of 6 integers. */
status = acpi_evaluate_object(adev->handle, "_ONT", NULL, &buffer);
if (status == AE_NOT_FOUND) {
- return 0;
+ return -ENXIO;
} else if (ACPI_FAILURE(status)) {
dev_warn(&indio_dev->dev, "failed to execute _ONT: %d\n",
status);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 191/286] iio: adc: mxs-lradc: fix the order of two cleanup operations
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 190/286] iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 192/286] iio: tmag5273: Fix runtime PM leak on measurement error Greg Kroah-Hartman
` (103 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiakai Luo, Dongliang Mu, Stable,
Jonathan Cameron
From: Jiakai Luo <jkluo@hust.edu.cn>
commit 27b2ed5b6d53cd62fc61c3f259ae52f5cac23b66 upstream.
Smatch reports:
drivers/iio/adc/mxs-lradc-adc.c:766 mxs_lradc_adc_probe() warn:
missing unwind goto?
the order of three init operation:
1.mxs_lradc_adc_trigger_init
2.iio_triggered_buffer_setup
3.mxs_lradc_adc_hw_init
thus, the order of three cleanup operation should be:
1.mxs_lradc_adc_hw_stop
2.iio_triggered_buffer_cleanup
3.mxs_lradc_adc_trigger_remove
we exchange the order of two cleanup operations,
introducing the following differences:
1.if mxs_lradc_adc_trigger_init fails, returns directly;
2.if trigger_init succeeds but iio_triggered_buffer_setup fails,
goto err_trig and remove the trigger.
In addition, we also reorder the unwind that goes on in the
remove() callback to match the new ordering.
Fixes: 6dd112b9f85e ("iio: adc: mxs-lradc: Add support for ADC driver")
Signed-off-by: Jiakai Luo <jkluo@hust.edu.cn>
Reviewed-by: Dongliang Mu <dzm91@hust.edu.cn>
Link: https://lore.kernel.org/r/20230422133407.72908-1-jkluo@hust.edu.cn
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/mxs-lradc-adc.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/iio/adc/mxs-lradc-adc.c
+++ b/drivers/iio/adc/mxs-lradc-adc.c
@@ -757,13 +757,13 @@ static int mxs_lradc_adc_probe(struct pl
ret = mxs_lradc_adc_trigger_init(iio);
if (ret)
- goto err_trig;
+ return ret;
ret = iio_triggered_buffer_setup(iio, &iio_pollfunc_store_time,
&mxs_lradc_adc_trigger_handler,
&mxs_lradc_adc_buffer_ops);
if (ret)
- return ret;
+ goto err_trig;
adc->vref_mv = mxs_lradc_adc_vref_mv[lradc->soc];
@@ -801,9 +801,9 @@ static int mxs_lradc_adc_probe(struct pl
err_dev:
mxs_lradc_adc_hw_stop(adc);
- mxs_lradc_adc_trigger_remove(iio);
-err_trig:
iio_triggered_buffer_cleanup(iio);
+err_trig:
+ mxs_lradc_adc_trigger_remove(iio);
return ret;
}
@@ -814,8 +814,8 @@ static int mxs_lradc_adc_remove(struct p
iio_device_unregister(iio);
mxs_lradc_adc_hw_stop(adc);
- mxs_lradc_adc_trigger_remove(iio);
iio_triggered_buffer_cleanup(iio);
+ mxs_lradc_adc_trigger_remove(iio);
return 0;
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 192/286] iio: tmag5273: Fix runtime PM leak on measurement error
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 191/286] iio: adc: mxs-lradc: fix the order of two cleanup operations Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 193/286] iio: ad4130: Make sure clock provider gets removed Greg Kroah-Hartman
` (102 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Gerald Loacker,
Nuno Sa, Stable, Jonathan Cameron
From: Lars-Peter Clausen <lars@metafoo.de>
commit 265c82ea8b172129cb6d4eff41af856c3aff6168 upstream.
The tmag5273 gets a runtime PM reference before reading a measurement and
releases it when done. But if the measurement fails the tmag5273_read_raw()
function exits before releasing the reference.
Make sure that this error path also releases the runtime PM reference.
Fixes: 866a1389174b ("iio: magnetometer: add ti tmag5273 driver")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Gerald Loacker <gerald.loacker@wolfvision.net>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20230414013752.498767-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/tmag5273.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/iio/magnetometer/tmag5273.c
+++ b/drivers/iio/magnetometer/tmag5273.c
@@ -296,12 +296,13 @@ static int tmag5273_read_raw(struct iio_
return ret;
ret = tmag5273_get_measure(data, &t, &x, &y, &z, &angle, &magnitude);
- if (ret)
- return ret;
pm_runtime_mark_last_busy(data->dev);
pm_runtime_put_autosuspend(data->dev);
+ if (ret)
+ return ret;
+
switch (chan->address) {
case TEMPERATURE:
*val = t;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 193/286] iio: ad4130: Make sure clock provider gets removed
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 192/286] iio: tmag5273: Fix runtime PM leak on measurement error Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 194/286] iio: adc: mt6370: Fix ibus and ibat scaling value of some specific vendor ID chips Greg Kroah-Hartman
` (101 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lars-Peter Clausen, Stable,
Jonathan Cameron
From: Lars-Peter Clausen <lars@metafoo.de>
commit 28f73ded19d403697f87473c9b85a27eb8ed9cf2 upstream.
The ad4130 driver registers a clock provider, but never removes it. This
leaves a stale clock provider behind that references freed clocks when the
device is unbound.
Register a managed action to remove the clock provider when the device is
removed.
Fixes: 62094060cf3a ("iio: adc: ad4130: add AD4130 driver")
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Link: https://lore.kernel.org/r/20230414150702.518441-1-lars@metafoo.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad4130.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/iio/adc/ad4130.c
+++ b/drivers/iio/adc/ad4130.c
@@ -1817,6 +1817,11 @@ static const struct clk_ops ad4130_int_c
.unprepare = ad4130_int_clk_unprepare,
};
+static void ad4130_clk_del_provider(void *of_node)
+{
+ of_clk_del_provider(of_node);
+}
+
static int ad4130_setup_int_clk(struct ad4130_state *st)
{
struct device *dev = &st->spi->dev;
@@ -1824,6 +1829,7 @@ static int ad4130_setup_int_clk(struct a
struct clk_init_data init;
const char *clk_name;
struct clk *clk;
+ int ret;
if (st->int_pin_sel == AD4130_INT_PIN_CLK ||
st->mclk_sel != AD4130_MCLK_76_8KHZ)
@@ -1843,7 +1849,11 @@ static int ad4130_setup_int_clk(struct a
if (IS_ERR(clk))
return PTR_ERR(clk);
- return of_clk_add_provider(of_node, of_clk_src_simple_get, clk);
+ ret = of_clk_add_provider(of_node, of_clk_src_simple_get, clk);
+ if (ret)
+ return ret;
+
+ return devm_add_action_or_reset(dev, ad4130_clk_del_provider, of_node);
}
static int ad4130_setup(struct iio_dev *indio_dev)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 194/286] iio: adc: mt6370: Fix ibus and ibat scaling value of some specific vendor ID chips
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 193/286] iio: ad4130: Make sure clock provider gets removed Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 195/286] HID: google: add jewel USB id Greg Kroah-Hartman
` (100 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ChiaEn Wu, Alexandre Mergnat, Stable,
Jonathan Cameron
From: ChiaEn Wu <chiaen_wu@richtek.com>
commit 00ffdd6fa90298522d45ca0c348b23485584dcdc upstream.
The scale value of ibus and ibat on the datasheet is incorrect due to the
customer report after the experimentation with some specific vendor ID
chips.
Fixes: c1404d1b659f ("iio: adc: mt6370: Add MediaTek MT6370 support")
Signed-off-by: ChiaEn Wu <chiaen_wu@richtek.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Link: https://lore.kernel.org/r/1681122862-1994-1-git-send-email-chiaen_wu@richtek.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/mt6370-adc.c | 53 +++++++++++++++++++++++++++++++++++++++++--
1 file changed, 51 insertions(+), 2 deletions(-)
--- a/drivers/iio/adc/mt6370-adc.c
+++ b/drivers/iio/adc/mt6370-adc.c
@@ -19,6 +19,7 @@
#include <dt-bindings/iio/adc/mediatek,mt6370_adc.h>
+#define MT6370_REG_DEV_INFO 0x100
#define MT6370_REG_CHG_CTRL3 0x113
#define MT6370_REG_CHG_CTRL7 0x117
#define MT6370_REG_CHG_ADC 0x121
@@ -27,6 +28,7 @@
#define MT6370_ADC_START_MASK BIT(0)
#define MT6370_ADC_IN_SEL_MASK GENMASK(7, 4)
#define MT6370_AICR_ICHG_MASK GENMASK(7, 2)
+#define MT6370_VENID_MASK GENMASK(7, 4)
#define MT6370_AICR_100_mA 0x0
#define MT6370_AICR_150_mA 0x1
@@ -47,6 +49,10 @@
#define ADC_CONV_TIME_MS 35
#define ADC_CONV_POLLING_TIME_US 1000
+#define MT6370_VID_RT5081 0x8
+#define MT6370_VID_RT5081A 0xA
+#define MT6370_VID_MT6370 0xE
+
struct mt6370_adc_data {
struct device *dev;
struct regmap *regmap;
@@ -55,6 +61,7 @@ struct mt6370_adc_data {
* from being read at the same time.
*/
struct mutex adc_lock;
+ unsigned int vid;
};
static int mt6370_adc_read_channel(struct mt6370_adc_data *priv, int chan,
@@ -98,6 +105,30 @@ adc_unlock:
return ret;
}
+static int mt6370_adc_get_ibus_scale(struct mt6370_adc_data *priv)
+{
+ switch (priv->vid) {
+ case MT6370_VID_RT5081:
+ case MT6370_VID_RT5081A:
+ case MT6370_VID_MT6370:
+ return 3350;
+ default:
+ return 3875;
+ }
+}
+
+static int mt6370_adc_get_ibat_scale(struct mt6370_adc_data *priv)
+{
+ switch (priv->vid) {
+ case MT6370_VID_RT5081:
+ case MT6370_VID_RT5081A:
+ case MT6370_VID_MT6370:
+ return 2680;
+ default:
+ return 3870;
+ }
+}
+
static int mt6370_adc_read_scale(struct mt6370_adc_data *priv,
int chan, int *val1, int *val2)
{
@@ -123,7 +154,7 @@ static int mt6370_adc_read_scale(struct
case MT6370_AICR_250_mA:
case MT6370_AICR_300_mA:
case MT6370_AICR_350_mA:
- *val1 = 3350;
+ *val1 = mt6370_adc_get_ibus_scale(priv);
break;
default:
*val1 = 5000;
@@ -150,7 +181,7 @@ static int mt6370_adc_read_scale(struct
case MT6370_ICHG_600_mA:
case MT6370_ICHG_700_mA:
case MT6370_ICHG_800_mA:
- *val1 = 2680;
+ *val1 = mt6370_adc_get_ibat_scale(priv);
break;
default:
*val1 = 5000;
@@ -251,6 +282,20 @@ static const struct iio_chan_spec mt6370
MT6370_ADC_CHAN(TEMP_JC, IIO_TEMP, 12, BIT(IIO_CHAN_INFO_OFFSET)),
};
+static int mt6370_get_vendor_info(struct mt6370_adc_data *priv)
+{
+ unsigned int dev_info;
+ int ret;
+
+ ret = regmap_read(priv->regmap, MT6370_REG_DEV_INFO, &dev_info);
+ if (ret)
+ return ret;
+
+ priv->vid = FIELD_GET(MT6370_VENID_MASK, dev_info);
+
+ return 0;
+}
+
static int mt6370_adc_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -272,6 +317,10 @@ static int mt6370_adc_probe(struct platf
priv->regmap = regmap;
mutex_init(&priv->adc_lock);
+ ret = mt6370_get_vendor_info(priv);
+ if (ret)
+ return dev_err_probe(dev, ret, "Failed to get vid\n");
+
ret = regmap_write(priv->regmap, MT6370_REG_CHG_ADC, 0);
if (ret)
return dev_err_probe(dev, ret, "Failed to reset ADC\n");
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 195/286] HID: google: add jewel USB id
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 194/286] iio: adc: mt6370: Fix ibus and ibat scaling value of some specific vendor ID chips Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 196/286] HID: wacom: avoid integer overflow in wacom_intuos_inout() Greg Kroah-Hartman
` (99 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sung-Chi Li, Jiri Kosina
From: Sung-Chi Li <lschyi@chromium.org>
commit ed84c4517a5bc536e8572a01dfa11bc22a280d06 upstream.
Add 1 additional hammer-like device.
Signed-off-by: Sung-Chi Li <lschyi@chromium.org>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-google-hammer.c | 2 ++
drivers/hid/hid-ids.h | 1 +
2 files changed, 3 insertions(+)
--- a/drivers/hid/hid-google-hammer.c
+++ b/drivers/hid/hid-google-hammer.c
@@ -587,6 +587,8 @@ static const struct hid_device_id hammer
{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_HAMMER) },
{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
+ USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_JEWEL) },
+ { HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MAGNEMITE) },
{ HID_DEVICE(BUS_USB, HID_GROUP_GENERIC,
USB_VENDOR_ID_GOOGLE, USB_DEVICE_ID_GOOGLE_MASTERBALL) },
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -529,6 +529,7 @@
#define USB_DEVICE_ID_GOOGLE_MOONBALL 0x5044
#define USB_DEVICE_ID_GOOGLE_DON 0x5050
#define USB_DEVICE_ID_GOOGLE_EEL 0x5057
+#define USB_DEVICE_ID_GOOGLE_JEWEL 0x5061
#define USB_VENDOR_ID_GOTOP 0x08f2
#define USB_DEVICE_ID_SUPER_Q2 0x007f
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 196/286] HID: wacom: avoid integer overflow in wacom_intuos_inout()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 195/286] HID: google: add jewel USB id Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 197/286] iio: imu: inv_icm42600: fix timestamp reset Greg Kroah-Hartman
` (98 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Ping Cheng,
Jiri Kosina
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
commit bd249b91977b768ea02bf84d04625d2690ad2b98 upstream.
If high bit is set to 1 in ((data[3] & 0x0f << 28), after all arithmetic
operations and integer promotions are done, high bits in
wacom->serial[idx] will be filled with 1s as well.
Avoid this, albeit unlikely, issue by specifying left operand's __u64
type for the right operand.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 3bea733ab212 ("USB: wacom tablet driver reorganization")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Reviewed-by: Ping Cheng <ping.cheng@wacom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -826,7 +826,7 @@ static int wacom_intuos_inout(struct wac
/* Enter report */
if ((data[1] & 0xfc) == 0xc0) {
/* serial number of the tool */
- wacom->serial[idx] = ((data[3] & 0x0f) << 28) +
+ wacom->serial[idx] = ((__u64)(data[3] & 0x0f) << 28) +
(data[4] << 20) + (data[5] << 12) +
(data[6] << 4) + (data[7] >> 4);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 197/286] iio: imu: inv_icm42600: fix timestamp reset
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 196/286] HID: wacom: avoid integer overflow in wacom_intuos_inout() Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 198/286] dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value Greg Kroah-Hartman
` (97 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit bbaae0c79ebd49f61ad942a8bf9e12bfc7f821bb upstream.
Timestamp reset is not done in the correct place. It must be done
before enabling buffer. The reason is that interrupt timestamping
is always happening when the chip is on, even if the
corresponding sensor is off. When the sensor restarts, timestamp
is wrong if you don't do a reset first.
Fixes: ec74ae9fd37c ("iio: imu: inv_icm42600: add accurate timestamping")
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230509152202.245444-1-inv.git-commit@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_buffer.c
@@ -275,9 +275,14 @@ static int inv_icm42600_buffer_preenable
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
struct device *dev = regmap_get_device(st->map);
+ struct inv_icm42600_timestamp *ts = iio_priv(indio_dev);
pm_runtime_get_sync(dev);
+ mutex_lock(&st->lock);
+ inv_icm42600_timestamp_reset(ts);
+ mutex_unlock(&st->lock);
+
return 0;
}
@@ -375,7 +380,6 @@ static int inv_icm42600_buffer_postdisab
struct device *dev = regmap_get_device(st->map);
unsigned int sensor;
unsigned int *watermark;
- struct inv_icm42600_timestamp *ts;
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
unsigned int sleep_temp = 0;
unsigned int sleep_sensor = 0;
@@ -385,11 +389,9 @@ static int inv_icm42600_buffer_postdisab
if (indio_dev == st->indio_gyro) {
sensor = INV_ICM42600_SENSOR_GYRO;
watermark = &st->fifo.watermark.gyro;
- ts = iio_priv(st->indio_gyro);
} else if (indio_dev == st->indio_accel) {
sensor = INV_ICM42600_SENSOR_ACCEL;
watermark = &st->fifo.watermark.accel;
- ts = iio_priv(st->indio_accel);
} else {
return -EINVAL;
}
@@ -417,8 +419,6 @@ static int inv_icm42600_buffer_postdisab
if (!st->fifo.on)
ret = inv_icm42600_set_temp_conf(st, false, &sleep_temp);
- inv_icm42600_timestamp_reset(ts);
-
out_unlock:
mutex_unlock(&st->lock);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 198/286] dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 197/286] iio: imu: inv_icm42600: fix timestamp reset Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 199/286] iio: light: vcnl4035: fixed chip ID check Greg Kroah-Hartman
` (96 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Marek Vasut,
Krzysztof Kozlowski, Wolfram Sang, Stable, Jonathan Cameron
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 55720d242052e860b9fde445e302e0425722e7f1 upstream.
The conversion to json-schema accidentally dropped the "ad" part prefix
from the compatible value.
Fixes: 8c41245872e2 ("dt-bindings:iio:adc:renesas,rcar-gyroadc: txt to yaml conversion.")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Link: https://lore.kernel.org/r/6b328a3f52657c20759f3a5bb2fe033d47644ba8.1683635404.git.geert+renesas@glider.be
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/iio/adc/renesas,rcar-gyroadc.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/devicetree/bindings/iio/adc/renesas,rcar-gyroadc.yaml
+++ b/Documentation/devicetree/bindings/iio/adc/renesas,rcar-gyroadc.yaml
@@ -86,7 +86,7 @@ patternProperties:
of the MAX chips to the GyroADC, while MISO line of each Maxim
ADC connects to a shared input pin of the GyroADC.
enum:
- - adi,7476
+ - adi,ad7476
- fujitsu,mb88101a
- maxim,max1162
- maxim,max11100
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 199/286] iio: light: vcnl4035: fixed chip ID check
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 198/286] dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 200/286] iio: accel: kx022a fix irq getting Greg Kroah-Hartman
` (95 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li, Stable, Jonathan Cameron
From: Frank Li <Frank.Li@nxp.com>
commit a551c26e8e568fad42120843521529241b9bceec upstream.
VCNL4035 register(0xE) ID_L and ID_M define as:
ID_L: 0x80
ID_H: 7:6 (0:0)
5:4 (0:0) slave address = 0x60 (7-bit)
(0:1) slave address = 0x51 (7-bit)
(1:0) slave address = 0x40 (7-bit)
(1:0) slave address = 0x41 (7-bit)
3:0 Version code default (0:0:0:0)
So just check ID_L.
Fixes: 55707294c4eb ("iio: light: Add support for vishay vcnl4035")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20230501143605.1615549-1-Frank.Li@nxp.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/light/vcnl4035.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/iio/light/vcnl4035.c
+++ b/drivers/iio/light/vcnl4035.c
@@ -8,6 +8,7 @@
* TODO: Proximity
*/
#include <linux/bitops.h>
+#include <linux/bitfield.h>
#include <linux/i2c.h>
#include <linux/module.h>
#include <linux/pm_runtime.h>
@@ -42,6 +43,7 @@
#define VCNL4035_ALS_PERS_MASK GENMASK(3, 2)
#define VCNL4035_INT_ALS_IF_H_MASK BIT(12)
#define VCNL4035_INT_ALS_IF_L_MASK BIT(13)
+#define VCNL4035_DEV_ID_MASK GENMASK(7, 0)
/* Default values */
#define VCNL4035_MODE_ALS_ENABLE BIT(0)
@@ -413,6 +415,7 @@ static int vcnl4035_init(struct vcnl4035
return ret;
}
+ id = FIELD_GET(VCNL4035_DEV_ID_MASK, id);
if (id != VCNL4035_DEV_ID_VAL) {
dev_err(&data->client->dev, "Wrong id, got %x, expected %x\n",
id, VCNL4035_DEV_ID_VAL);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 200/286] iio: accel: kx022a fix irq getting
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 199/286] iio: light: vcnl4035: fixed chip ID check Greg Kroah-Hartman
@ 2023-06-07 20:14 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 201/286] iio: adc: stm32-adc: skip adc-channels setup if none is present Greg Kroah-Hartman
` (94 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:14 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Dan Carpenter,
Matti Vaittinen, Stable, Jonathan Cameron
From: Matti Vaittinen <mazziesaccount@gmail.com>
commit 56cd3d1c5c5b073a1a444eafdcf97d4d866d351a upstream.
The fwnode_irq_get_byname() was returning 0 at device-tree mapping
error. If this occurred, the KX022A driver did abort the probe but
errorneously directly returned the return value from
fwnode_irq_get_byname() from probe. In case of a device-tree mapping
error this indicated success.
The fwnode_irq_get_byname() has since been fixed to not return zero on
error so the check for fwnode_irq_get_byname() can be relaxed to only
treat negative values as errors. This will also do decent fix even when
backported to branches where fwnode_irq_get_byname() can still return
zero on error because KX022A probe should later fail at IRQ requesting
and a prober error handling should follow.
Relax the return value check for fwnode_irq_get_byname() to only treat
negative values as errors.
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <error27@gmail.com>
Closes: https://lore.kernel.org/r/202305110245.MFxC9bUj-lkp@intel.com/
Link: https://lore.kernel.org/r/202305110245.MFxC9bUj-lkp@intel.com/
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer")
Link: https://lore.kernel.org/r/b45b4b638db109c6078d243252df3a7b0485f7d5.1683875389.git.mazziesaccount@gmail.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kionix-kx022a.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/accel/kionix-kx022a.c
+++ b/drivers/iio/accel/kionix-kx022a.c
@@ -1049,7 +1049,7 @@ int kx022a_probe_internal(struct device
data->ien_reg = KX022A_REG_INC4;
} else {
irq = fwnode_irq_get_byname(fwnode, "INT2");
- if (irq <= 0)
+ if (irq < 0)
return dev_err_probe(dev, irq, "No suitable IRQ\n");
data->inc_reg = KX022A_REG_INC5;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 201/286] iio: adc: stm32-adc: skip adc-channels setup if none is present
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-06-07 20:14 ` [PATCH 6.3 200/286] iio: accel: kx022a fix irq getting Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 202/286] iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag Greg Kroah-Hartman
` (93 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sean Nyekjaer, Olivier Moysan,
Stable, Jonathan Cameron
From: Sean Nyekjaer <sean@geanix.com>
commit 3e27ef0ced49f8ae7883c25fadf76a2086e99025 upstream.
If only adc differential channels are defined driver will fail with
stm32-adc: probe of 48003000.adc:adc@0 failed with error -22
Fix this by skipping the initialization if no channels are defined.
This applies only to the legacy way of initializing adc channels.
Fixes: d7705f35448a ("iio: adc: stm32-adc: convert to device properties")
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Reviewed-by: Olivier Moysan <olivier.moysan@foss.st.com>
Link: https://lore.kernel.org/r/20230503162029.3654093-2-sean@geanix.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/stm32-adc.c | 42 +++++++++++++++++++++++-------------------
1 file changed, 23 insertions(+), 19 deletions(-)
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -2037,6 +2037,7 @@ static int stm32_adc_legacy_chan_init(st
struct stm32_adc_diff_channel diff[STM32_ADC_CH_MAX];
struct device *dev = &indio_dev->dev;
u32 num_diff = adc->num_diff;
+ int num_se = nchans - num_diff;
int size = num_diff * sizeof(*diff) / sizeof(u32);
int scan_index = 0, ret, i, c;
u32 smp = 0, smps[STM32_ADC_CH_MAX], chans[STM32_ADC_CH_MAX];
@@ -2063,29 +2064,32 @@ static int stm32_adc_legacy_chan_init(st
scan_index++;
}
}
-
- ret = device_property_read_u32_array(dev, "st,adc-channels", chans,
- nchans);
- if (ret)
- return ret;
-
- for (c = 0; c < nchans; c++) {
- if (chans[c] >= adc_info->max_channels) {
- dev_err(&indio_dev->dev, "Invalid channel %d\n",
- chans[c]);
- return -EINVAL;
+ if (num_se > 0) {
+ ret = device_property_read_u32_array(dev, "st,adc-channels", chans, num_se);
+ if (ret) {
+ dev_err(&indio_dev->dev, "Failed to get st,adc-channels %d\n", ret);
+ return ret;
}
- /* Channel can't be configured both as single-ended & diff */
- for (i = 0; i < num_diff; i++) {
- if (chans[c] == diff[i].vinp) {
- dev_err(&indio_dev->dev, "channel %d misconfigured\n", chans[c]);
+ for (c = 0; c < num_se; c++) {
+ if (chans[c] >= adc_info->max_channels) {
+ dev_err(&indio_dev->dev, "Invalid channel %d\n",
+ chans[c]);
return -EINVAL;
}
+
+ /* Channel can't be configured both as single-ended & diff */
+ for (i = 0; i < num_diff; i++) {
+ if (chans[c] == diff[i].vinp) {
+ dev_err(&indio_dev->dev, "channel %d misconfigured\n",
+ chans[c]);
+ return -EINVAL;
+ }
+ }
+ stm32_adc_chan_init_one(indio_dev, &channels[scan_index],
+ chans[c], 0, scan_index, false);
+ scan_index++;
}
- stm32_adc_chan_init_one(indio_dev, &channels[scan_index],
- chans[c], 0, scan_index, false);
- scan_index++;
}
if (adc->nsmps > 0) {
@@ -2306,7 +2310,7 @@ static int stm32_adc_chan_fw_init(struct
if (legacy)
ret = stm32_adc_legacy_chan_init(indio_dev, adc, channels,
- num_channels);
+ timestamping ? num_channels - 1 : num_channels);
else
ret = stm32_adc_generic_chan_init(indio_dev, adc, channels);
if (ret < 0)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 202/286] iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 201/286] iio: adc: stm32-adc: skip adc-channels setup if none is present Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 203/286] iio: dac: mcp4725: Fix i2c_master_send() return value handling Greg Kroah-Hartman
` (92 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masahiro Honda, Stable,
Jonathan Cameron
From: Masahiro Honda <honda@mechatrax.com>
commit 626d312028bec44209d0ecd5beaa9b1aa8945f7d upstream.
The Sigma-Delta ADCs supported by this driver can use SDO as an interrupt
line to indicate the completion of a conversion. However, some devices
cannot properly detect the completion of a conversion by an interrupt.
This is for the reason mentioned in the following commit.
commit e9849777d0e2 ("genirq: Add flag to force mask in
disable_irq[_nosync]()")
A read operation is performed by an extra interrupt before the completion
of a conversion. At this time, the value read from the ADC data register
is the same as the previous conversion result. This patch fixes the issue
by setting IRQ_DISABLE_UNLAZY flag.
Fixes: 0c6ef985a1fd ("iio: adc: ad7791: fix IRQ flags")
Fixes: 1a913270e57a ("iio: adc: ad7793: Fix IRQ flag")
Fixes: e081102f3077 ("iio: adc: ad7780: Fix IRQ flag")
Fixes: 89a86da5cb8e ("iio: adc: ad7192: Add IRQ flag")
Fixes: 79ef91493f54 ("iio: adc: ad7124: Set IRQ type to falling")
Signed-off-by: Masahiro Honda <honda@mechatrax.com>
Link: https://lore.kernel.org/r/20230518110816.248-1-honda@mechatrax.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad_sigma_delta.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/iio/adc/ad_sigma_delta.c
+++ b/drivers/iio/adc/ad_sigma_delta.c
@@ -584,6 +584,10 @@ static int devm_ad_sd_probe_trigger(stru
init_completion(&sigma_delta->completion);
sigma_delta->irq_dis = true;
+
+ /* the IRQ core clears IRQ_DISABLE_UNLAZY flag when freeing an IRQ */
+ irq_set_status_flags(sigma_delta->spi->irq, IRQ_DISABLE_UNLAZY);
+
ret = devm_request_irq(dev, sigma_delta->spi->irq,
ad_sd_data_rdy_trig_poll,
sigma_delta->info->irq_flags | IRQF_NO_AUTOEN,
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 203/286] iio: dac: mcp4725: Fix i2c_master_send() return value handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 202/286] iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 204/286] iio: addac: ad74413: fix resistance input processing Greg Kroah-Hartman
` (91 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Uwe Kleine-König,
Stable, Jonathan Cameron
From: Marek Vasut <marex@denx.de>
commit 09d3bec7009186bdba77039df01e5834788b3f95 upstream.
The i2c_master_send() returns number of sent bytes on success,
or negative on error. The suspend/resume callbacks expect zero
on success and non-zero on error. Adapt the return value of the
i2c_master_send() to the expectation of the suspend and resume
callbacks, including proper validation of the return value.
Fixes: cf35ad61aca2 ("iio: add mcp4725 I2C DAC driver")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20230511004330.206942-1-marex@denx.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/mcp4725.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/iio/dac/mcp4725.c
+++ b/drivers/iio/dac/mcp4725.c
@@ -47,12 +47,18 @@ static int mcp4725_suspend(struct device
struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
to_i2c_client(dev)));
u8 outbuf[2];
+ int ret;
outbuf[0] = (data->powerdown_mode + 1) << 4;
outbuf[1] = 0;
data->powerdown = true;
- return i2c_master_send(data->client, outbuf, 2);
+ ret = i2c_master_send(data->client, outbuf, 2);
+ if (ret < 0)
+ return ret;
+ else if (ret != 2)
+ return -EIO;
+ return 0;
}
static int mcp4725_resume(struct device *dev)
@@ -60,13 +66,19 @@ static int mcp4725_resume(struct device
struct mcp4725_data *data = iio_priv(i2c_get_clientdata(
to_i2c_client(dev)));
u8 outbuf[2];
+ int ret;
/* restore previous DAC value */
outbuf[0] = (data->dac_value >> 8) & 0xf;
outbuf[1] = data->dac_value & 0xff;
data->powerdown = false;
- return i2c_master_send(data->client, outbuf, 2);
+ ret = i2c_master_send(data->client, outbuf, 2);
+ if (ret < 0)
+ return ret;
+ else if (ret != 2)
+ return -EIO;
+ return 0;
}
static DEFINE_SIMPLE_DEV_PM_OPS(mcp4725_pm_ops, mcp4725_suspend,
mcp4725_resume);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 204/286] iio: addac: ad74413: fix resistance input processing
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 203/286] iio: dac: mcp4725: Fix i2c_master_send() return value handling Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 205/286] iio: adc: ad7192: Change "shorted" channels to differential Greg Kroah-Hartman
` (90 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rasmus Villemoes, Nuno Sa, Stable,
Jonathan Cameron
From: Rasmus Villemoes <linux@rasmusvillemoes.dk>
commit 24febc99ca725dcf42d57168a2f4e8a75a5ade92 upstream.
On success, ad74413r_get_single_adc_result() returns IIO_VAL_INT aka
1. So currently, the IIO_CHAN_INFO_PROCESSED case is effectively
equivalent to the IIO_CHAN_INFO_RAW case, and we never call
ad74413r_adc_to_resistance_result() to convert the adc measurement to
ohms.
Check ret for being negative rather than non-zero.
Fixes: fea251b6a5dbd (iio: addac: add AD74413R driver)
Signed-off-by: Rasmus Villemoes <linux@rasmusvillemoes.dk>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20230503095817.452551-1-linux@rasmusvillemoes.dk
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/addac/ad74413r.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/addac/ad74413r.c
+++ b/drivers/iio/addac/ad74413r.c
@@ -981,7 +981,7 @@ static int ad74413r_read_raw(struct iio_
ret = ad74413r_get_single_adc_result(indio_dev, chan->channel,
val);
- if (ret)
+ if (ret < 0)
return ret;
ad74413r_adc_to_resistance_result(*val, val);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 205/286] iio: adc: ad7192: Change "shorted" channels to differential
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 204/286] iio: addac: ad74413: fix resistance input processing Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 206/286] iio: adc: stm32-adc: skip adc-diff-channels setup if none is present Greg Kroah-Hartman
` (89 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Cercueil, Alisa Roman, Nuno Sa,
Stable, Jonathan Cameron
From: Paul Cercueil <paul@crapouillou.net>
commit e55245d115bb9054cb72cdd5dda5660f4484873a upstream.
The AD7192 provides a specific channel configuration where both negative
and positive inputs are connected to AIN2. This was represented in the
ad7192 driver as a IIO channel with .channel = 2 and .extended_name set
to "shorted".
The problem with this approach, is that the driver provided two IIO
channels with the identifier .channel = 2; one "shorted" and the other
not. This goes against the IIO ABI, as a channel identifier should be
unique.
Address this issue by changing "shorted" channels to being differential
instead, with channel 2 vs. itself, as we're actually measuring AIN2 vs.
itself.
Note that the fix tag is for the commit that moved the driver out of
staging. The bug existed before that, but backporting would become very
complex further down and unlikely to happen.
Fixes: b581f748cce0 ("staging: iio: adc: ad7192: move out of staging")
Signed-off-by: Paul Cercueil <paul@crapouillou.net>
Co-developed-by: Alisa Roman <alisa.roman@analog.com>
Signed-off-by: Alisa Roman <alisa.roman@analog.com>
Reviewed-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20230330102100.17590-1-paul@crapouillou.net
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7192.c | 8 ++------
1 file changed, 2 insertions(+), 6 deletions(-)
--- a/drivers/iio/adc/ad7192.c
+++ b/drivers/iio/adc/ad7192.c
@@ -897,10 +897,6 @@ static const struct iio_info ad7195_info
__AD719x_CHANNEL(_si, _channel1, -1, _address, NULL, IIO_VOLTAGE, \
BIT(IIO_CHAN_INFO_SCALE), ad7192_calibsys_ext_info)
-#define AD719x_SHORTED_CHANNEL(_si, _channel1, _address) \
- __AD719x_CHANNEL(_si, _channel1, -1, _address, "shorted", IIO_VOLTAGE, \
- BIT(IIO_CHAN_INFO_SCALE), ad7192_calibsys_ext_info)
-
#define AD719x_TEMP_CHANNEL(_si, _address) \
__AD719x_CHANNEL(_si, 0, -1, _address, NULL, IIO_TEMP, 0, NULL)
@@ -908,7 +904,7 @@ static const struct iio_chan_spec ad7192
AD719x_DIFF_CHANNEL(0, 1, 2, AD7192_CH_AIN1P_AIN2M),
AD719x_DIFF_CHANNEL(1, 3, 4, AD7192_CH_AIN3P_AIN4M),
AD719x_TEMP_CHANNEL(2, AD7192_CH_TEMP),
- AD719x_SHORTED_CHANNEL(3, 2, AD7192_CH_AIN2P_AIN2M),
+ AD719x_DIFF_CHANNEL(3, 2, 2, AD7192_CH_AIN2P_AIN2M),
AD719x_CHANNEL(4, 1, AD7192_CH_AIN1),
AD719x_CHANNEL(5, 2, AD7192_CH_AIN2),
AD719x_CHANNEL(6, 3, AD7192_CH_AIN3),
@@ -922,7 +918,7 @@ static const struct iio_chan_spec ad7193
AD719x_DIFF_CHANNEL(2, 5, 6, AD7193_CH_AIN5P_AIN6M),
AD719x_DIFF_CHANNEL(3, 7, 8, AD7193_CH_AIN7P_AIN8M),
AD719x_TEMP_CHANNEL(4, AD7193_CH_TEMP),
- AD719x_SHORTED_CHANNEL(5, 2, AD7193_CH_AIN2P_AIN2M),
+ AD719x_DIFF_CHANNEL(5, 2, 2, AD7193_CH_AIN2P_AIN2M),
AD719x_CHANNEL(6, 1, AD7193_CH_AIN1),
AD719x_CHANNEL(7, 2, AD7193_CH_AIN2),
AD719x_CHANNEL(8, 3, AD7193_CH_AIN3),
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 206/286] iio: adc: stm32-adc: skip adc-diff-channels setup if none is present
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 205/286] iio: adc: ad7192: Change "shorted" channels to differential Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 207/286] iio: dac: build ad5758 driver when AD5758 is selected Greg Kroah-Hartman
` (88 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Nyekjaer, Stable,
Jonathan Cameron
From: Sean Nyekjaer <sean@geanix.com>
commit 9c0d6ccd7d6bbd275e390b55a3390b4274291d95 upstream.
If no adc differential channels are defined driver will fail with EINVAL:
stm32-adc: probe of 48003000.adc:adc@0 failed with error -22
Fix this by skipping the initialization if no channels are defined.
This applies only to the legacy way of initializing adc channels.
Fixes: d7705f35448a ("iio: adc: stm32-adc: convert to device properties")
Signed-off-by: Sean Nyekjaer <sean@geanix.com>
Link: https://lore.kernel.org/r/20230503162029.3654093-1-sean@geanix.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/stm32-adc.c | 19 +++++++++----------
1 file changed, 9 insertions(+), 10 deletions(-)
--- a/drivers/iio/adc/stm32-adc.c
+++ b/drivers/iio/adc/stm32-adc.c
@@ -2006,16 +2006,15 @@ static int stm32_adc_get_legacy_chan_cou
* to get the *real* number of channels.
*/
ret = device_property_count_u32(dev, "st,adc-diff-channels");
- if (ret < 0)
- return ret;
-
- ret /= (int)(sizeof(struct stm32_adc_diff_channel) / sizeof(u32));
- if (ret > adc_info->max_channels) {
- dev_err(&indio_dev->dev, "Bad st,adc-diff-channels?\n");
- return -EINVAL;
- } else if (ret > 0) {
- adc->num_diff = ret;
- num_channels += ret;
+ if (ret > 0) {
+ ret /= (int)(sizeof(struct stm32_adc_diff_channel) / sizeof(u32));
+ if (ret > adc_info->max_channels) {
+ dev_err(&indio_dev->dev, "Bad st,adc-diff-channels?\n");
+ return -EINVAL;
+ } else if (ret > 0) {
+ adc->num_diff = ret;
+ num_channels += ret;
+ }
}
/* Optional sample time is provided either for each, or all channels */
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 207/286] iio: dac: build ad5758 driver when AD5758 is selected
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 206/286] iio: adc: stm32-adc: skip adc-diff-channels setup if none is present Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 208/286] net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 Greg Kroah-Hartman
` (87 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lukas Bulwahn, Stable,
Jonathan Cameron
From: Lukas Bulwahn <lukas.bulwahn@gmail.com>
commit a146eccb68be161ae9eab5f3f68bb0ed7c0fbaa8 upstream.
Commit 28d1a7ac2a0d ("iio: dac: Add AD5758 support") adds the config AD5758
and the corresponding driver ad5758.c. In the Makefile, the ad5758 driver
is however included when AD5755 is selected, not when AD5758 is selected.
Probably, this was simply a mistake that happened by copy-and-paste and
forgetting to adjust the actual line. Surprisingly, no one has ever noticed
that this driver is actually only included when AD5755 is selected and that
the config AD5758 has actually no effect on the build.
Fixes: 28d1a7ac2a0d ("iio: dac: Add AD5758 support")
Signed-off-by: Lukas Bulwahn <lukas.bulwahn@gmail.com>
Link: https://lore.kernel.org/r/20230508040208.12033-1-lukas.bulwahn@gmail.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/dac/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/dac/Makefile
+++ b/drivers/iio/dac/Makefile
@@ -17,7 +17,7 @@ obj-$(CONFIG_AD5592R_BASE) += ad5592r-ba
obj-$(CONFIG_AD5592R) += ad5592r.o
obj-$(CONFIG_AD5593R) += ad5593r.o
obj-$(CONFIG_AD5755) += ad5755.o
-obj-$(CONFIG_AD5755) += ad5758.o
+obj-$(CONFIG_AD5758) += ad5758.o
obj-$(CONFIG_AD5761) += ad5761.o
obj-$(CONFIG_AD5764) += ad5764.o
obj-$(CONFIG_AD5766) += ad5766.o
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 208/286] net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 207/286] iio: dac: build ad5758 driver when AD5758 is selected Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 209/286] dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type Greg Kroah-Hartman
` (86 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sebastian Krzyszkowiak,
Bjørn Mork, Jakub Kicinski
From: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
commit 36936a56e1814f6c526fe71fbf980beab4f5577a upstream.
BM818 is based on Qualcomm MDM9607 chipset.
Fixes: 9a07406b00cd ("net: usb: qmi_wwan: Add the BroadMobi BM818 card")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Krzyszkowiak <sebastian.krzyszkowiak@puri.sm>
Acked-by: Bjørn Mork <bjorn@mork.no>
Link: https://lore.kernel.org/r/20230526-bm818-dtr-v1-1-64bbfa6ba8af@puri.sm
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/qmi_wwan.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1325,7 +1325,7 @@ static const struct usb_device_id produc
{QMI_FIXED_INTF(0x2001, 0x7e3d, 4)}, /* D-Link DWM-222 A2 */
{QMI_FIXED_INTF(0x2020, 0x2031, 4)}, /* Olicard 600 */
{QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */
- {QMI_FIXED_INTF(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
+ {QMI_QUIRK_SET_DTR(0x2020, 0x2060, 4)}, /* BroadMobi BM818 */
{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */
{QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
{QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 209/286] dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 208/286] net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 210/286] usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM Greg Kroah-Hartman
` (85 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Krzysztof Kozlowski,
Marek Vasut
From: Marek Vasut <marex@denx.de>
commit 7b32040f6d7f885ffc09a6df7c17992d56d2eab8 upstream.
The "snps,hsphy_interface" is string, not u8. Fix the type.
Fixes: 389d77658801 ("dt-bindings: usb: Convert DWC USB3 bindings to DT schema")
Cc: stable <stable@kernel.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Marek Vasut <marex@denx.de>
Link: https://lore.kernel.org/r/20230515172456.179049-1-marex@denx.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/usb/snps,dwc3.yaml | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
+++ b/Documentation/devicetree/bindings/usb/snps,dwc3.yaml
@@ -270,7 +270,7 @@ properties:
description:
High-Speed PHY interface selection between UTMI+ and ULPI when the
DWC_USB3_HSPHY_INTERFACE has value 3.
- $ref: /schemas/types.yaml#/definitions/uint8
+ $ref: /schemas/types.yaml#/definitions/string
enum: [utmi, ulpi]
snps,quirk-frame-length-adjustment:
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 210/286] usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 209/286] dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 211/286] usb: gadget: f_fs: Add unbind event before functionfs_unbind Greg Kroah-Hartman
` (84 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li
From: Frank Li <Frank.Li@nxp.com>
commit dbe678f6192f27879ac9ff6bc7a1036aad85aae9 upstream.
At iMX8QM platform, enable NCM gadget and run 'iperf3 -s'.
At host, run 'iperf3 -V -c fe80::6863:98ff:feef:3e0%enxc6e147509498'
[ 5] 0.00-1.00 sec 1.55 MBytes 13.0 Mbits/sec 90 4.18 KBytes
[ 5] 1.00-2.00 sec 1.44 MBytes 12.0 Mbits/sec 75 4.18 KBytes
[ 5] 2.00-3.00 sec 1.48 MBytes 12.4 Mbits/sec 75 4.18 KBytes
Expected speed should be bigger than 300Mbits/sec.
The root cause of this performance drop was found to be data corruption
happening at 4K borders in some Ethernet packets, leading to TCP
checksum errors. This corruption occurs from the position
(4K - (address & 0x7F)) to 4K. The u_ether function's allocation of
skb_buff reserves 64B, meaning all RX addresses resemble 0xXXXX0040.
Force trb_burst_size to 16 can fix this problem.
Cc: stable@vger.kernel.org
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20230518154946.3666662-1-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2097,6 +2097,19 @@ int cdns3_ep_config(struct cdns3_endpoin
else
priv_ep->trb_burst_size = 16;
+ /*
+ * In versions preceding DEV_VER_V2, for example, iMX8QM, there exit the bugs
+ * in the DMA. These bugs occur when the trb_burst_size exceeds 16 and the
+ * address is not aligned to 128 Bytes (which is a product of the 64-bit AXI
+ * and AXI maximum burst length of 16 or 0xF+1, dma_axi_ctrl0[3:0]). This
+ * results in data corruption when it crosses the 4K border. The corruption
+ * specifically occurs from the position (4K - (address & 0x7F)) to 4K.
+ *
+ * So force trb_burst_size to 16 at such platform.
+ */
+ if (priv_dev->dev_ver < DEV_VER_V2)
+ priv_ep->trb_burst_size = 16;
+
mult = min_t(u8, mult, EP_CFG_MULT_MAX);
buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX);
maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 211/286] usb: gadget: f_fs: Add unbind event before functionfs_unbind
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 210/286] usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 212/286] md/raid5: fix miscalculation of end_sector in raid5_read_one_chunk() Greg Kroah-Hartman
` (83 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Uttkarsh Aggarwal
From: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
commit efb6b535207395a5c7317993602e2503ca8cb4b3 upstream.
While exercising the unbind path, with the current implementation
the functionfs_unbind would be calling which waits for the ffs->mutex
to be available, however within the same time ffs_ep0_read is invoked
& if no setup packets are pending, it will invoke function
wait_event_interruptible_exclusive_locked_irq which by definition waits
for the ev.count to be increased inside the same mutex for which
functionfs_unbind is waiting.
This creates deadlock situation because the functionfs_unbind won't
get the lock until ev.count is increased which can only happen if
the caller ffs_func_unbind can proceed further.
Following is the illustration:
CPU1 CPU2
ffs_func_unbind() ffs_ep0_read()
mutex_lock(ffs->mutex)
wait_event(ffs->ev.count)
functionfs_unbind()
mutex_lock(ffs->mutex)
mutex_unlock(ffs->mutex)
ffs_event_add()
<deadlock>
Fix this by moving the event unbind before functionfs_unbind
to ensure the ev.count is incrased properly.
Fixes: 6a19da111057 ("usb: gadget: f_fs: Prevent race during ffs_ep0_queue_wait")
Cc: stable <stable@kernel.org>
Signed-off-by: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
Link: https://lore.kernel.org/r/20230525092854.7992-1-quic_uaggarwa@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@ -3620,6 +3620,7 @@ static void ffs_func_unbind(struct usb_c
/* Drain any pending AIO completions */
drain_workqueue(ffs->io_completion_wq);
+ ffs_event_add(ffs, FUNCTIONFS_UNBIND);
if (!--opts->refcnt)
functionfs_unbind(ffs);
@@ -3644,7 +3645,6 @@ static void ffs_func_unbind(struct usb_c
func->function.ssp_descriptors = NULL;
func->interfaces_nums = NULL;
- ffs_event_add(ffs, FUNCTIONFS_UNBIND);
}
static struct usb_function *ffs_alloc(struct usb_function_instance *fi)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 212/286] md/raid5: fix miscalculation of end_sector in raid5_read_one_chunk()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 211/286] usb: gadget: f_fs: Add unbind event before functionfs_unbind Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 213/286] misc: fastrpc: Reassign memory ownership only for remote heap Greg Kroah-Hartman
` (82 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Kuai, Christoph Hellwig, Song Liu
From: Yu Kuai <yukuai3@huawei.com>
commit 8557dc27126949c702bd3aafe8a7e0b7e4fcb44c upstream.
'end_sector' is compared to 'rdev->recovery_offset', which is offset to
rdev, however, commit e82ed3a4fbb5 ("md/raid6: refactor
raid5_read_one_chunk") changes the calculation of 'end_sector' to offset
to the array. Fix this miscalculation.
Fixes: e82ed3a4fbb5 ("md/raid6: refactor raid5_read_one_chunk")
Cc: stable@vger.kernel.org # v5.12+
Signed-off-by: Yu Kuai <yukuai3@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20230524014118.3172781-1-yukuai1@huaweicloud.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -5516,7 +5516,7 @@ static int raid5_read_one_chunk(struct m
sector = raid5_compute_sector(conf, raid_bio->bi_iter.bi_sector, 0,
&dd_idx, NULL);
- end_sector = bio_end_sector(raid_bio);
+ end_sector = sector + bio_sectors(raid_bio);
rcu_read_lock();
if (r5c_big_stripe_cached(conf, sector))
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 213/286] misc: fastrpc: Reassign memory ownership only for remote heap
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 212/286] md/raid5: fix miscalculation of end_sector in raid5_read_one_chunk() Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 214/286] misc: fastrpc: return -EPIPE to invocations on device removal Greg Kroah-Hartman
` (81 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta,
Srinivas Kandagatla
From: Ekansh Gupta <quic_ekangupt@quicinc.com>
commit 3c7d0079a1831118ef232bd9c2f34d058a1f31c2 upstream.
The userspace map request for remote heap allocates CMA memory.
The ownership of this memory needs to be reassigned to proper
owners to allow access from the protection domain running on
DSP. This reassigning of ownership is not correct if done for
any other supported flags.
When any other flag is requested from userspace, fastrpc is
trying to reassign the ownership of memory and this reassignment
is getting skipped for remote heap request which is incorrect.
Add proper flag check to reassign the memory only if remote heap
is requested.
Fixes: 532ad70c6d44 ("misc: fastrpc: Add mmap request assigning for static PD pool")
Cc: stable <stable@kernel.org>
Tested-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 32a5415624bf..a654dc416480 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -1904,7 +1904,7 @@ static int fastrpc_req_mmap(struct fastrpc_user *fl, char __user *argp)
req.vaddrout = rsp_msg.vaddr;
/* Add memory to static PD pool, protection thru hypervisor */
- if (req.flags != ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
+ if (req.flags == ADSP_MMAP_REMOTE_HEAP_ADDR && fl->cctx->vmcount) {
struct qcom_scm_vmperm perm;
perm.vmid = QCOM_SCM_VMID_HLOS;
--
2.41.0
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 214/286] misc: fastrpc: return -EPIPE to invocations on device removal
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 213/286] misc: fastrpc: Reassign memory ownership only for remote heap Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 215/286] misc: fastrpc: reject new invocations during " Greg Kroah-Hartman
` (80 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Richard Acayan,
Srinivas Kandagatla
From: Richard Acayan <mailingradian@gmail.com>
commit b6a062853ddf6b4f653af2d8b75ba45bb9a036ad upstream.
The return value is initialized as -1, or -EPERM. The completion of an
invocation implies that the return value is set appropriately, but
"Permission denied" does not accurately describe the outcome of the
invocation. Set the invocation's return value to a more appropriate
"Broken pipe", as the cleanup breaks the driver's connection with rpmsg.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable <stable@kernel.org>
Signed-off-by: Richard Acayan <mailingradian@gmail.com>
Reviewed-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-4-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -2337,8 +2337,10 @@ static void fastrpc_notify_users(struct
struct fastrpc_invoke_ctx *ctx;
spin_lock(&user->lock);
- list_for_each_entry(ctx, &user->pending, node)
+ list_for_each_entry(ctx, &user->pending, node) {
+ ctx->retval = -EPIPE;
complete(&ctx->work);
+ }
spin_unlock(&user->lock);
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 215/286] misc: fastrpc: reject new invocations during device removal
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 214/286] misc: fastrpc: return -EPIPE to invocations on device removal Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 216/286] scsi: stex: Fix gcc 13 warnings Greg Kroah-Hartman
` (79 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Richard Acayan,
Srinivas Kandagatla
From: Richard Acayan <mailingradian@gmail.com>
commit 46248400d81e2aa0b65cd659d6f40188192a58b6 upstream.
The channel's rpmsg object allows new invocations to be made. After old
invocations are already interrupted, the driver shouldn't try to invoke
anymore. Invalidating the rpmsg at the end of the driver removal
function makes it easy to cause a race condition in userspace. Even
closing a file descriptor before the driver finishes its cleanup can
cause an invocation via fastrpc_release_current_dsp_process() and
subsequent timeout.
Invalidate the channel before the invocations are interrupted to make
sure that no invocations can be created to hang after the device closes.
Fixes: c68cfb718c8f ("misc: fastrpc: Add support for context Invoke method")
Cc: stable <stable@kernel.org>
Signed-off-by: Richard Acayan <mailingradian@gmail.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-5-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/misc/fastrpc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -2351,7 +2351,9 @@ static void fastrpc_rpmsg_remove(struct
struct fastrpc_user *user;
unsigned long flags;
+ /* No invocations past this point */
spin_lock_irqsave(&cctx->lock, flags);
+ cctx->rpdev = NULL;
list_for_each_entry(user, &cctx->users, user)
fastrpc_notify_users(user);
spin_unlock_irqrestore(&cctx->lock, flags);
@@ -2370,7 +2372,6 @@ static void fastrpc_rpmsg_remove(struct
of_platform_depopulate(&rpdev->dev);
- cctx->rpdev = NULL;
fastrpc_channel_ctx_put(cctx);
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 216/286] scsi: stex: Fix gcc 13 warnings
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 215/286] misc: fastrpc: reject new invocations during " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 217/286] ata: libata-scsi: Use correct device no in ata_find_dev() Greg Kroah-Hartman
` (78 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, Bart Van Assche,
Martin K. Petersen
From: Bart Van Assche <bvanassche@acm.org>
commit 6d074ce231772c66e648a61f6bd2245e7129d1f5 upstream.
gcc 13 may assign another type to enumeration constants than gcc 12. Split
the large enum at the top of source file stex.c such that the type of the
constants used in time expressions is changed back to the same type chosen
by gcc 12. This patch suppresses compiler warnings like this one:
In file included from ./include/linux/bitops.h:7,
from ./include/linux/kernel.h:22,
from drivers/scsi/stex.c:13:
drivers/scsi/stex.c: In function ‘stex_common_handshake’:
./include/linux/typecheck.h:12:25: error: comparison of distinct pointer types lacks a cast [-Werror]
12 | (void)(&__dummy == &__dummy2); \
| ^~
./include/linux/jiffies.h:106:10: note: in expansion of macro ‘typecheck’
106 | typecheck(unsigned long, b) && \
| ^~~~~~~~~
drivers/scsi/stex.c:1035:29: note: in expansion of macro ‘time_after’
1035 | if (time_after(jiffies, before + MU_MAX_DELAY * HZ)) {
| ^~~~~~~~~~
See also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107405.
Cc: stable@vger.kernel.org
Acked-by: Randy Dunlap <rdunlap@infradead.org>
Tested-by: Randy Dunlap <rdunlap@infradead.org> # build-tested
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230529195034.3077-1-bvanassche@acm.org
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/stex.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/scsi/stex.c
+++ b/drivers/scsi/stex.c
@@ -109,7 +109,9 @@ enum {
TASK_ATTRIBUTE_HEADOFQUEUE = 0x1,
TASK_ATTRIBUTE_ORDERED = 0x2,
TASK_ATTRIBUTE_ACA = 0x4,
+};
+enum {
SS_STS_NORMAL = 0x80000000,
SS_STS_DONE = 0x40000000,
SS_STS_HANDSHAKE = 0x20000000,
@@ -121,7 +123,9 @@ enum {
SS_I2H_REQUEST_RESET = 0x2000,
SS_MU_OPERATIONAL = 0x80000000,
+};
+enum {
STEX_CDB_LENGTH = 16,
STATUS_VAR_LEN = 128,
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 217/286] ata: libata-scsi: Use correct device no in ata_find_dev()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 216/286] scsi: stex: Fix gcc 13 warnings Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 218/286] drm/amdgpu: enable tmz by default for GC 11.0.1 Greg Kroah-Hartman
` (77 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xingui Yang, Damien Le Moal,
Jason Yan
From: Damien Le Moal <dlemoal@kernel.org>
commit 7f875850f20a42f488840c9df7af91ef7db2d576 upstream.
For devices not attached to a port multiplier and managed directly by
libata, the device number passed to ata_find_dev() must always be lower
than the maximum number of devices returned by ata_link_max_devices().
That is 1 for SATA devices or 2 for an IDE link with master+slave
devices. This device number is the SCSI device ID which matches these
constraints as the IDs are generated per port and so never exceed the
maximum number of devices for the link being used.
However, for libsas managed devices, SCSI device IDs are assigned per
struct scsi_host, leading to device IDs for SATA devices that can be
well in excess of libata per-link maximum number of devices. This
results in ata_find_dev() to always return NULL for libsas managed
devices except for the first device of the target scsi_host with ID
(device number) equal to 0. This issue is visible by executing the
hdparm utility, which fails. E.g.:
hdparm -i /dev/sdX
/dev/sdX:
HDIO_GET_IDENTITY failed: No message of desired type
Fix this by rewriting ata_find_dev() to ignore the device number for
non-PMP attached devices with a link with at most 1 device, that is SATA
devices. For these, the device number 0 is always used to
return the correct pointer to the struct ata_device of the port link.
This change excludes IDE master/slave setups (maximum number of devices
per link is 2) and port-multiplier attached devices. Also, to be
consistant with the fact that SCSI device IDs and channel numbers used
as device numbers are both unsigned int, change the devno argument of
ata_find_dev() to unsigned int.
Reported-by: Xingui Yang <yangxingui@huawei.com>
Fixes: 41bda9c98035 ("libata-link: update hotplug to handle PMP links")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Jason Yan <yanaijie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-scsi.c | 34 ++++++++++++++++++++++++++--------
1 file changed, 26 insertions(+), 8 deletions(-)
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -2694,18 +2694,36 @@ static unsigned int atapi_xlat(struct at
return 0;
}
-static struct ata_device *ata_find_dev(struct ata_port *ap, int devno)
+static struct ata_device *ata_find_dev(struct ata_port *ap, unsigned int devno)
{
- if (!sata_pmp_attached(ap)) {
- if (likely(devno >= 0 &&
- devno < ata_link_max_devices(&ap->link)))
+ /*
+ * For the non-PMP case, ata_link_max_devices() returns 1 (SATA case),
+ * or 2 (IDE master + slave case). However, the former case includes
+ * libsas hosted devices which are numbered per scsi host, leading
+ * to devno potentially being larger than 0 but with each struct
+ * ata_device having its own struct ata_port and struct ata_link.
+ * To accommodate these, ignore devno and always use device number 0.
+ */
+ if (likely(!sata_pmp_attached(ap))) {
+ int link_max_devices = ata_link_max_devices(&ap->link);
+
+ if (link_max_devices == 1)
+ return &ap->link.device[0];
+
+ if (devno < link_max_devices)
return &ap->link.device[devno];
- } else {
- if (likely(devno >= 0 &&
- devno < ap->nr_pmp_links))
- return &ap->pmp_link[devno].device[0];
+
+ return NULL;
}
+ /*
+ * For PMP-attached devices, the device number corresponds to C
+ * (channel) of SCSI [H:C:I:L], indicating the port pmp link
+ * for the device.
+ */
+ if (devno < ap->nr_pmp_links)
+ return &ap->pmp_link[devno].device[0];
+
return NULL;
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 218/286] drm/amdgpu: enable tmz by default for GC 11.0.1
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 217/286] ata: libata-scsi: Use correct device no in ata_find_dev() Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 219/286] drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 Greg Kroah-Hartman
` (76 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ikshwaku Chauhan, Alex Deucher
From: Ikshwaku Chauhan <ikshwaku.chauhan@amd.com>
commit 663b930e24842f3d3bb79418bb5cd8d01b40c559 upstream.
Add IP GC 11.0.1 in the list of target to have
tmz enabled by default.
Signed-off-by: Ikshwaku Chauhan <ikshwaku.chauhan@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.1.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gmc.c
@@ -534,6 +534,8 @@ void amdgpu_gmc_tmz_set(struct amdgpu_de
case IP_VERSION(9, 3, 0):
/* GC 10.3.7 */
case IP_VERSION(10, 3, 7):
+ /* GC 11.0.1 */
+ case IP_VERSION(11, 0, 1):
if (amdgpu_tmz == 0) {
adev->gmc.tmz_enabled = false;
dev_info(adev->dev,
@@ -557,7 +559,6 @@ void amdgpu_gmc_tmz_set(struct amdgpu_de
case IP_VERSION(10, 3, 1):
/* YELLOW_CARP*/
case IP_VERSION(10, 3, 3):
- case IP_VERSION(11, 0, 1):
case IP_VERSION(11, 0, 4):
/* Don't enable it by default yet.
*/
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 219/286] drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 218/286] drm/amdgpu: enable tmz by default for GC 11.0.1 Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 220/286] drm/amd/pm: reverse mclk and fclk clocks levels for vangogh Greg Kroah-Hartman
` (75 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit 6a07826f2057b5fa1c479ba56460195882464270 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk
and pp_dpm_fclk.
On dGPUs and older APUs we expose the levels from lowest clocks
to highest clocks. But for some APUs, the clocks levels that from
the DFPstateTable are given the reversed orders by PMFW. Like the
memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools
and software that talks to the driver then has to know different ways
to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the
driver consistently.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_4_ppt.c
@@ -478,7 +478,7 @@ static int smu_v13_0_4_get_dpm_level_cou
static int smu_v13_0_4_print_clk_levels(struct smu_context *smu,
enum smu_clk_type clk_type, char *buf)
{
- int i, size = 0, ret = 0;
+ int i, idx, size = 0, ret = 0;
uint32_t cur_value = 0, value = 0, count = 0;
uint32_t min, max;
@@ -512,7 +512,8 @@ static int smu_v13_0_4_print_clk_levels(
break;
for (i = 0; i < count; i++) {
- ret = smu_v13_0_4_get_dpm_freq_by_index(smu, clk_type, i, &value);
+ idx = (clk_type == SMU_FCLK || clk_type == SMU_MCLK) ? (count - i - 1) : i;
+ ret = smu_v13_0_4_get_dpm_freq_by_index(smu, clk_type, idx, &value);
if (ret)
break;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 220/286] drm/amd/pm: reverse mclk and fclk clocks levels for vangogh
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 219/286] drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 221/286] drm/amd/pm: resolve reboot exception for si oland Greg Kroah-Hartman
` (74 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit bfc03568d9d81332382c73a1985a90c4506bd36c upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk
and pp_dpm_fclk.
On dGPUs and older APUs we expose the levels from lowest clocks
to highest clocks. But for some APUs, the clocks levels that from
the DFPstateTable are given the reversed orders by PMFW. Like the
memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools
and software that talks to the driver then has to know different ways
to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the
driver consistently.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/vangogh_ppt.c
@@ -580,7 +580,7 @@ static int vangogh_print_legacy_clk_leve
DpmClocks_t *clk_table = smu->smu_table.clocks_table;
SmuMetrics_legacy_t metrics;
struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
- int i, size = 0, ret = 0;
+ int i, idx, size = 0, ret = 0;
uint32_t cur_value = 0, value = 0, count = 0;
bool cur_value_match_level = false;
@@ -654,7 +654,8 @@ static int vangogh_print_legacy_clk_leve
case SMU_MCLK:
case SMU_FCLK:
for (i = 0; i < count; i++) {
- ret = vangogh_get_dpm_clk_limited(smu, clk_type, i, &value);
+ idx = (clk_type == SMU_FCLK || clk_type == SMU_MCLK) ? (count - i - 1) : i;
+ ret = vangogh_get_dpm_clk_limited(smu, clk_type, idx, &value);
if (ret)
return ret;
if (!value)
@@ -681,7 +682,7 @@ static int vangogh_print_clk_levels(stru
DpmClocks_t *clk_table = smu->smu_table.clocks_table;
SmuMetrics_t metrics;
struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
- int i, size = 0, ret = 0;
+ int i, idx, size = 0, ret = 0;
uint32_t cur_value = 0, value = 0, count = 0;
bool cur_value_match_level = false;
uint32_t min, max;
@@ -763,7 +764,8 @@ static int vangogh_print_clk_levels(stru
case SMU_MCLK:
case SMU_FCLK:
for (i = 0; i < count; i++) {
- ret = vangogh_get_dpm_clk_limited(smu, clk_type, i, &value);
+ idx = (clk_type == SMU_FCLK || clk_type == SMU_MCLK) ? (count - i - 1) : i;
+ ret = vangogh_get_dpm_clk_limited(smu, clk_type, idx, &value);
if (ret)
return ret;
if (!value)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 221/286] drm/amd/pm: resolve reboot exception for si oland
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 220/286] drm/amd/pm: reverse mclk and fclk clocks levels for vangogh Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 222/286] drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 Greg Kroah-Hartman
` (73 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhenneng Li, Guchun Chen,
Alex Deucher
From: Guchun Chen <guchun.chen@amd.com>
commit e490d60a2f76bff636c68ce4fe34c1b6c34bbd86 upstream.
During reboot test on arm64 platform, it may failure on boot.
The error message are as follows:
[ 1.706570][ 3] [ T273] [drm:si_thermal_enable_alert [amdgpu]] *ERROR* Could not enable thermal interrupts.
[ 1.716547][ 3] [ T273] [drm:amdgpu_device_ip_late_init [amdgpu]] *ERROR* late_init of IP block <si_dpm> failed -22
[ 1.727064][ 3] [ T273] amdgpu 0000:02:00.0: amdgpu_device_ip_late_init failed
[ 1.734367][ 3] [ T273] amdgpu 0000:02:00.0: Fatal error during GPU init
v2: squash in built warning fix (Alex)
Signed-off-by: Zhenneng Li <lizhenneng@kylinos.cn>
Reviewed-by: Guchun Chen <guchun.chen@amd.com>
Signed-off-by: Guchun Chen <guchun.chen@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c | 29 -----------------------------
1 file changed, 29 deletions(-)
--- a/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/legacy-dpm/si_dpm.c
@@ -6925,23 +6925,6 @@ static int si_dpm_enable(struct amdgpu_d
return 0;
}
-static int si_set_temperature_range(struct amdgpu_device *adev)
-{
- int ret;
-
- ret = si_thermal_enable_alert(adev, false);
- if (ret)
- return ret;
- ret = si_thermal_set_temperature_range(adev, R600_TEMP_RANGE_MIN, R600_TEMP_RANGE_MAX);
- if (ret)
- return ret;
- ret = si_thermal_enable_alert(adev, true);
- if (ret)
- return ret;
-
- return ret;
-}
-
static void si_dpm_disable(struct amdgpu_device *adev)
{
struct rv7xx_power_info *pi = rv770_get_pi(adev);
@@ -7626,18 +7609,6 @@ static int si_dpm_process_interrupt(stru
static int si_dpm_late_init(void *handle)
{
- int ret;
- struct amdgpu_device *adev = (struct amdgpu_device *)handle;
-
- if (!adev->pm.dpm_enabled)
- return 0;
-
- ret = si_set_temperature_range(adev);
- if (ret)
- return ret;
-#if 0 //TODO ?
- si_dpm_powergate_uvd(adev, true);
-#endif
return 0;
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 222/286] drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 221/286] drm/amd/pm: resolve reboot exception for si oland Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 223/286] drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp Greg Kroah-Hartman
` (72 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit c1d35412b3e826ae8119e3fb5f51dd0fa5b6b567 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk.
On dGPUs and older APUs we expose the levels from lowest clocks
to highest clocks. But for some APUs, the clocks levels that from
the DFPstateTable are given the reversed orders by PMFW. Like the
memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools
and software that talks to the driver then has to know different ways
to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the
driver consistently.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_5_ppt.c
@@ -866,7 +866,7 @@ out:
static int smu_v13_0_5_print_clk_levels(struct smu_context *smu,
enum smu_clk_type clk_type, char *buf)
{
- int i, size = 0, ret = 0;
+ int i, idx, size = 0, ret = 0;
uint32_t cur_value = 0, value = 0, count = 0;
uint32_t min = 0, max = 0;
@@ -898,7 +898,8 @@ static int smu_v13_0_5_print_clk_levels(
goto print_clk_out;
for (i = 0; i < count; i++) {
- ret = smu_v13_0_5_get_dpm_freq_by_index(smu, clk_type, i, &value);
+ idx = (clk_type == SMU_MCLK) ? (count - i - 1) : i;
+ ret = smu_v13_0_5_get_dpm_freq_by_index(smu, clk_type, idx, &value);
if (ret)
goto print_clk_out;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 223/286] drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 222/286] drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 224/286] drm/amd/pm: reverse mclk and fclk clocks levels for renoir Greg Kroah-Hartman
` (71 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit f1373a97a41f429e0095d4be388092ffa3c1a157 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk
and pp_dpm_fclk.
On dGPUs and older APUs we expose the levels from lowest clocks
to highest clocks. But for some APUs, the clocks levels that from
the DFPstateTable are given the reversed orders by PMFW. Like the
memory DPM clocks that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools
and software that talks to the driver then has to know different ways
to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the
driver consistently.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/yellow_carp_ppt.c
@@ -1000,7 +1000,7 @@ out:
static int yellow_carp_print_clk_levels(struct smu_context *smu,
enum smu_clk_type clk_type, char *buf)
{
- int i, size = 0, ret = 0;
+ int i, idx, size = 0, ret = 0;
uint32_t cur_value = 0, value = 0, count = 0;
uint32_t min, max;
@@ -1033,7 +1033,8 @@ static int yellow_carp_print_clk_levels(
goto print_clk_out;
for (i = 0; i < count; i++) {
- ret = yellow_carp_get_dpm_freq_by_index(smu, clk_type, i, &value);
+ idx = (clk_type == SMU_FCLK || clk_type == SMU_MCLK) ? (count - i - 1) : i;
+ ret = yellow_carp_get_dpm_freq_by_index(smu, clk_type, idx, &value);
if (ret)
goto print_clk_out;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 224/286] drm/amd/pm: reverse mclk and fclk clocks levels for renoir
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 223/286] drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 225/286] mmc: vub300: fix invalid response handling Greg Kroah-Hartman
` (70 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tim Huang, Alex Deucher
From: Tim Huang <Tim.Huang@amd.com>
commit 55e02c14f9b5fd973ba32a16a715baa42617f9c6 upstream.
This patch reverses the DPM clocks levels output of pp_dpm_mclk
and pp_dpm_fclk for renoir.
On dGPUs and older APUs we expose the levels from lowest clocks
to highest clocks. But for some APUs, the clocks levels are
given the reversed orders by PMFW. Like the memory DPM clocks
that are exposed by pp_dpm_mclk.
It's not intuitive that they are reversed on these APUs. All tools
and software that talks to the driver then has to know different ways
to interpret the data depending on the asic.
So we need to reverse them to expose the clocks levels from the
driver consistently.
Signed-off-by: Tim Huang <Tim.Huang@amd.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu12/renoir_ppt.c
@@ -494,7 +494,7 @@ static int renoir_set_fine_grain_gfx_fre
static int renoir_print_clk_levels(struct smu_context *smu,
enum smu_clk_type clk_type, char *buf)
{
- int i, size = 0, ret = 0;
+ int i, idx, size = 0, ret = 0;
uint32_t cur_value = 0, value = 0, count = 0, min = 0, max = 0;
SmuMetrics_t metrics;
struct smu_dpm_context *smu_dpm_ctx = &(smu->smu_dpm);
@@ -594,7 +594,8 @@ static int renoir_print_clk_levels(struc
case SMU_VCLK:
case SMU_DCLK:
for (i = 0; i < count; i++) {
- ret = renoir_get_dpm_clk_limited(smu, clk_type, i, &value);
+ idx = (clk_type == SMU_FCLK || clk_type == SMU_MCLK) ? (count - i - 1) : i;
+ ret = renoir_get_dpm_clk_limited(smu, clk_type, idx, &value);
if (ret)
return ret;
if (!value)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 225/286] mmc: vub300: fix invalid response handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 224/286] drm/amd/pm: reverse mclk and fclk clocks levels for renoir Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 226/286] mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order Greg Kroah-Hartman
` (69 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Deren Wu, Ulf Hansson
From: Deren Wu <deren.wu@mediatek.com>
commit a99d21cefd351c8aaa20b83a3c942340e5789d45 upstream.
We may get an empty response with zero length at the beginning of
the driver start and get following UBSAN error. Since there is no
content(SDRT_NONE) for the response, just return and skip the response
handling to avoid this problem.
Test pass : SDIO wifi throughput test with this patch
[ 126.980684] UBSAN: array-index-out-of-bounds in drivers/mmc/host/vub300.c:1719:12
[ 126.980709] index -1 is out of range for type 'u32 [4]'
[ 126.980729] CPU: 4 PID: 9 Comm: kworker/u16:0 Tainted: G E 6.3.0-rc4-mtk-local-202304272142 #1
[ 126.980754] Hardware name: Intel(R) Client Systems NUC8i7BEH/NUC8BEB, BIOS BECFL357.86A.0081.2020.0504.1834 05/04/2020
[ 126.980770] Workqueue: kvub300c vub300_cmndwork_thread [vub300]
[ 126.980833] Call Trace:
[ 126.980845] <TASK>
[ 126.980860] dump_stack_lvl+0x48/0x70
[ 126.980895] dump_stack+0x10/0x20
[ 126.980916] ubsan_epilogue+0x9/0x40
[ 126.980944] __ubsan_handle_out_of_bounds+0x70/0x90
[ 126.980979] vub300_cmndwork_thread+0x58e7/0x5e10 [vub300]
[ 126.981018] ? _raw_spin_unlock+0x18/0x40
[ 126.981042] ? finish_task_switch+0x175/0x6f0
[ 126.981070] ? __switch_to+0x42e/0xda0
[ 126.981089] ? __switch_to_asm+0x3a/0x80
[ 126.981129] ? __pfx_vub300_cmndwork_thread+0x10/0x10 [vub300]
[ 126.981174] ? __kasan_check_read+0x11/0x20
[ 126.981204] process_one_work+0x7ee/0x13d0
[ 126.981246] worker_thread+0x53c/0x1240
[ 126.981291] kthread+0x2b8/0x370
[ 126.981312] ? __pfx_worker_thread+0x10/0x10
[ 126.981336] ? __pfx_kthread+0x10/0x10
[ 126.981359] ret_from_fork+0x29/0x50
[ 126.981400] </TASK>
Fixes: 88095e7b473a ("mmc: Add new VUB300 USB-to-SD/SDIO/MMC driver")
Signed-off-by: Deren Wu <deren.wu@mediatek.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/048cd6972c50c33c2e8f81d5228fed928519918b.1683987673.git.deren.wu@mediatek.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/host/vub300.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/mmc/host/vub300.c
+++ b/drivers/mmc/host/vub300.c
@@ -1715,6 +1715,9 @@ static void construct_request_response(s
int bytes = 3 & less_cmd;
int words = less_cmd >> 2;
u8 *r = vub300->resp.response.command_response;
+
+ if (!resp_len)
+ return;
if (bytes == 3) {
cmd->resp[words] = (r[1 + (words << 2)] << 24)
| (r[2 + (words << 2)] << 16)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 226/286] mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 225/286] mmc: vub300: fix invalid response handling Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 227/286] tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK Greg Kroah-Hartman
` (68 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Vasut, Claudiu Beznea,
Ulf Hansson
From: Marek Vasut <marex@denx.de>
commit 0b5d5c436a5c572a45f976cfd34a6741e143e5d9 upstream.
Chapter "5.3 Power-Up/Down Sequence" of WILC1000 [1] and WILC3000 [2]
states that CHIP_EN must be pulled HIGH first, RESETN second. Fix the
order of these signals in the driver.
Use the mmc_pwrseq_ops as driver data as the delay between signals is
specific to SDIO card type anyway.
[1] https://ww1.microchip.com/downloads/aemDocuments/documents/WSG/ProductDocuments/DataSheets/ATWILC1000-MR110XB-IEEE-802.11-b-g-n-Link-Controller-Module-DS70005326E.pdf
[2] https://ww1.microchip.com/downloads/aemDocuments/documents/OTH/ProductDocuments/DataSheets/IEEE-802.11-b-g-n-Link-Controller-Module-with-Integrated-Bluetooth-5.0-DS70005327B.pdf
Fixes: b2832b96fcf5 ("mmc: pwrseq: sd8787: add support for wilc1000")
Signed-off-by: Marek Vasut <marex@denx.de>
Reviewed-by: Claudiu Beznea <claudiu.beznea@microchip.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230513192352.479627-1-marex@denx.de
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/pwrseq_sd8787.c | 34 ++++++++++++++++++++++++++--------
1 file changed, 26 insertions(+), 8 deletions(-)
--- a/drivers/mmc/core/pwrseq_sd8787.c
+++ b/drivers/mmc/core/pwrseq_sd8787.c
@@ -28,7 +28,6 @@ struct mmc_pwrseq_sd8787 {
struct mmc_pwrseq pwrseq;
struct gpio_desc *reset_gpio;
struct gpio_desc *pwrdn_gpio;
- u32 reset_pwrdwn_delay_ms;
};
#define to_pwrseq_sd8787(p) container_of(p, struct mmc_pwrseq_sd8787, pwrseq)
@@ -39,7 +38,7 @@ static void mmc_pwrseq_sd8787_pre_power_
gpiod_set_value_cansleep(pwrseq->reset_gpio, 1);
- msleep(pwrseq->reset_pwrdwn_delay_ms);
+ msleep(300);
gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 1);
}
@@ -51,17 +50,37 @@ static void mmc_pwrseq_sd8787_power_off(
gpiod_set_value_cansleep(pwrseq->reset_gpio, 0);
}
+static void mmc_pwrseq_wilc1000_pre_power_on(struct mmc_host *host)
+{
+ struct mmc_pwrseq_sd8787 *pwrseq = to_pwrseq_sd8787(host->pwrseq);
+
+ /* The pwrdn_gpio is really CHIP_EN, reset_gpio is RESETN */
+ gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 1);
+ msleep(5);
+ gpiod_set_value_cansleep(pwrseq->reset_gpio, 1);
+}
+
+static void mmc_pwrseq_wilc1000_power_off(struct mmc_host *host)
+{
+ struct mmc_pwrseq_sd8787 *pwrseq = to_pwrseq_sd8787(host->pwrseq);
+
+ gpiod_set_value_cansleep(pwrseq->reset_gpio, 0);
+ gpiod_set_value_cansleep(pwrseq->pwrdn_gpio, 0);
+}
+
static const struct mmc_pwrseq_ops mmc_pwrseq_sd8787_ops = {
.pre_power_on = mmc_pwrseq_sd8787_pre_power_on,
.power_off = mmc_pwrseq_sd8787_power_off,
};
-static const u32 sd8787_delay_ms = 300;
-static const u32 wilc1000_delay_ms = 5;
+static const struct mmc_pwrseq_ops mmc_pwrseq_wilc1000_ops = {
+ .pre_power_on = mmc_pwrseq_wilc1000_pre_power_on,
+ .power_off = mmc_pwrseq_wilc1000_power_off,
+};
static const struct of_device_id mmc_pwrseq_sd8787_of_match[] = {
- { .compatible = "mmc-pwrseq-sd8787", .data = &sd8787_delay_ms },
- { .compatible = "mmc-pwrseq-wilc1000", .data = &wilc1000_delay_ms },
+ { .compatible = "mmc-pwrseq-sd8787", .data = &mmc_pwrseq_sd8787_ops },
+ { .compatible = "mmc-pwrseq-wilc1000", .data = &mmc_pwrseq_wilc1000_ops },
{/* sentinel */},
};
MODULE_DEVICE_TABLE(of, mmc_pwrseq_sd8787_of_match);
@@ -77,7 +96,6 @@ static int mmc_pwrseq_sd8787_probe(struc
return -ENOMEM;
match = of_match_node(mmc_pwrseq_sd8787_of_match, pdev->dev.of_node);
- pwrseq->reset_pwrdwn_delay_ms = *(u32 *)match->data;
pwrseq->pwrdn_gpio = devm_gpiod_get(dev, "powerdown", GPIOD_OUT_LOW);
if (IS_ERR(pwrseq->pwrdn_gpio))
@@ -88,7 +106,7 @@ static int mmc_pwrseq_sd8787_probe(struc
return PTR_ERR(pwrseq->reset_gpio);
pwrseq->pwrseq.dev = dev;
- pwrseq->pwrseq.ops = &mmc_pwrseq_sd8787_ops;
+ pwrseq->pwrseq.ops = match->data;
pwrseq->pwrseq.owner = THIS_MODULE;
platform_set_drvdata(pdev, pwrseq);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 227/286] tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 226/286] mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 228/286] btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds Greg Kroah-Hartman
` (67 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Sherry Sun
From: Sherry Sun <sherry.sun@nxp.com>
commit 2474e05467c00f7d51af3039b664de6886325257 upstream.
LPUART IP now has two known bugs, one is that CTS has higher priority
than the break signal, which causes the break signal sending through
UARTCTRL_SBK may impacted by the CTS input if the HW flow control is
enabled. It exists on all platforms we support in this driver.
So we add a workaround patch for this issue: commit c4c81db5cf8b
("tty: serial: fsl_lpuart: disable the CTS when send break signal").
Another IP bug is i.MX8QM LPUART may have an additional break character
being sent after SBK was cleared. It may need to add some delay between
clearing SBK and re-enabling CTS to ensure that the SBK latch are
completely cleared.
But we found that during the delay period before CTS is enabled, there
is still a risk that Bluetooth data in TX FIFO may be sent out during
this period because of break off and CTS disabled(even if BT sets CTS
line deasserted, data is still sent to BT).
Due to this risk, we have to drop the CTS-disabling workaround for SBK
bugs, use TXINV seems to be a better way to replace SBK feature and
avoid above risk. Also need to disable the transmitter to prevent any
data from being sent out during break, then invert the TX line to send
break. Then disable the TXINV when turn off break and re-enable
transmitter.
Fixes: c4c81db5cf8b ("tty: serial: fsl_lpuart: disable the CTS when send break signal")
Cc: stable <stable@kernel.org>
Signed-off-by: Sherry Sun <sherry.sun@nxp.com>
Link: https://lore.kernel.org/r/20230519094751.28948-1-sherry.sun@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/fsl_lpuart.c | 44 +++++++++++++++++----------------
1 file changed, 23 insertions(+), 21 deletions(-)
diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c
index c91916e13648..7486a2b8556c 100644
--- a/drivers/tty/serial/fsl_lpuart.c
+++ b/drivers/tty/serial/fsl_lpuart.c
@@ -1495,34 +1495,36 @@ static void lpuart_break_ctl(struct uart_port *port, int break_state)
static void lpuart32_break_ctl(struct uart_port *port, int break_state)
{
- unsigned long temp, modem;
- struct tty_struct *tty;
- unsigned int cflag = 0;
+ unsigned long temp;
- tty = tty_port_tty_get(&port->state->port);
- if (tty) {
- cflag = tty->termios.c_cflag;
- tty_kref_put(tty);
- }
-
- temp = lpuart32_read(port, UARTCTRL) & ~UARTCTRL_SBK;
- modem = lpuart32_read(port, UARTMODIR);
+ temp = lpuart32_read(port, UARTCTRL);
+ /*
+ * LPUART IP now has two known bugs, one is CTS has higher priority than the
+ * break signal, which causes the break signal sending through UARTCTRL_SBK
+ * may impacted by the CTS input if the HW flow control is enabled. It
+ * exists on all platforms we support in this driver.
+ * Another bug is i.MX8QM LPUART may have an additional break character
+ * being sent after SBK was cleared.
+ * To avoid above two bugs, we use Transmit Data Inversion function to send
+ * the break signal instead of UARTCTRL_SBK.
+ */
if (break_state != 0) {
- temp |= UARTCTRL_SBK;
/*
- * LPUART CTS has higher priority than SBK, need to disable CTS before
- * asserting SBK to avoid any interference if flow control is enabled.
+ * Disable the transmitter to prevent any data from being sent out
+ * during break, then invert the TX line to send break.
*/
- if (cflag & CRTSCTS && modem & UARTMODIR_TXCTSE)
- lpuart32_write(port, modem & ~UARTMODIR_TXCTSE, UARTMODIR);
+ temp &= ~UARTCTRL_TE;
+ lpuart32_write(port, temp, UARTCTRL);
+ temp |= UARTCTRL_TXINV;
+ lpuart32_write(port, temp, UARTCTRL);
} else {
- /* Re-enable the CTS when break off. */
- if (cflag & CRTSCTS && !(modem & UARTMODIR_TXCTSE))
- lpuart32_write(port, modem | UARTMODIR_TXCTSE, UARTMODIR);
+ /* Disable the TXINV to turn off break and re-enable transmitter. */
+ temp &= ~UARTCTRL_TXINV;
+ lpuart32_write(port, temp, UARTCTRL);
+ temp |= UARTCTRL_TE;
+ lpuart32_write(port, temp, UARTCTRL);
}
-
- lpuart32_write(port, temp, UARTCTRL);
}
static void lpuart_setup_watermark(struct lpuart_port *sport)
--
2.41.0
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 228/286] btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 227/286] tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 229/286] phy: qcom-qmp-combo: fix init-count imbalance Greg Kroah-Hartman
` (66 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, pengfuyuan, David Sterba
From: pengfuyuan <pengfuyuan@kylinos.cn>
commit 5ad9b4719fc9bc4715c7e19875a962095b0577e7 upstream.
When compiling on a MIPS 64-bit machine we get these warnings:
In file included from ./arch/mips/include/asm/cacheflush.h:13,
from ./include/linux/cacheflush.h:5,
from ./include/linux/highmem.h:8,
from ./include/linux/bvec.h:10,
from ./include/linux/blk_types.h:10,
from ./include/linux/blkdev.h:9,
from fs/btrfs/disk-io.c:7:
fs/btrfs/disk-io.c: In function ‘csum_tree_block’:
fs/btrfs/disk-io.c:100:34: error: array subscript 1 is above array bounds of ‘struct page *[1]’ [-Werror=array-bounds]
100 | kaddr = page_address(buf->pages[i]);
| ~~~~~~~~~~^~~
./include/linux/mm.h:2135:48: note: in definition of macro ‘page_address’
2135 | #define page_address(page) lowmem_page_address(page)
| ^~~~
cc1: all warnings being treated as errors
We can check if i overflows to solve the problem. However, this doesn't make
much sense, since i == 1 and num_pages == 1 doesn't execute the body of the loop.
In addition, i < num_pages can also ensure that buf->pages[i] will not cross
the boundary. Unfortunately, this doesn't help with the problem observed here:
gcc still complains.
To fix this add a compile-time condition for the extent buffer page
array size limit, which would eventually lead to eliminating the whole
for loop.
CC: stable@vger.kernel.org # 5.10+
Signed-off-by: pengfuyuan <pengfuyuan@kylinos.cn>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/btrfs/disk-io.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -96,7 +96,7 @@ static void csum_tree_block(struct exten
crypto_shash_update(shash, kaddr + BTRFS_CSUM_SIZE,
first_page_part - BTRFS_CSUM_SIZE);
- for (i = 1; i < num_pages; i++) {
+ for (i = 1; i < num_pages && INLINE_EXTENT_BUFFER_PAGES > 1; i++) {
kaddr = page_address(buf->pages[i]);
crypto_shash_update(shash, kaddr, PAGE_SIZE);
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 229/286] phy: qcom-qmp-combo: fix init-count imbalance
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 228/286] btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 230/286] phy: qcom-qmp-pcie-msm8996: " Greg Kroah-Hartman
` (65 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Dmitry Baryshkov,
Vinod Koul
From: Johan Hovold <johan+linaro@kernel.org>
commit 9bf03a0cbd80a256bc1e1c4bcc80bc2b06b8b2b9 upstream.
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation and can lead to the runtime suspend
callback attempting to disable resources that have never been enabled.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable@vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-2-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/qualcomm/phy-qcom-qmp-combo.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-combo.c
@@ -2487,7 +2487,7 @@ static int qmp_combo_com_init(struct qmp
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -2537,7 +2537,8 @@ err_assert_reset:
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 230/286] phy: qcom-qmp-pcie-msm8996: fix init-count imbalance
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 229/286] phy: qcom-qmp-combo: fix init-count imbalance Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 231/286] block: fix revalidate performance regression Greg Kroah-Hartman
` (64 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Dmitry Baryshkov,
Vinod Koul
From: Johan Hovold <johan+linaro@kernel.org>
commit e42f110700ed7293700c26145e1ed07ea05ac3f6 upstream.
The init counter is not decremented on initialisation errors, which
prevents retrying initialisation.
Add the missing decrement on initialisation errors so that the counter
reflects the state of the device.
Fixes: e78f3d15e115 ("phy: qcom-qmp: new qmp phy driver for qcom-chipsets")
Cc: stable@vger.kernel.org # 4.12
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230502103810.12061-3-johan+linaro@kernel.org
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
+++ b/drivers/phy/qualcomm/phy-qcom-qmp-pcie-msm8996.c
@@ -379,7 +379,7 @@ static int qmp_pcie_msm8996_com_init(str
ret = regulator_bulk_enable(cfg->num_vregs, qmp->vregs);
if (ret) {
dev_err(qmp->dev, "failed to enable regulators, err=%d\n", ret);
- goto err_unlock;
+ goto err_decrement_count;
}
ret = reset_control_bulk_assert(cfg->num_resets, qmp->resets);
@@ -409,7 +409,8 @@ err_assert_reset:
reset_control_bulk_assert(cfg->num_resets, qmp->resets);
err_disable_regulators:
regulator_bulk_disable(cfg->num_vregs, qmp->vregs);
-err_unlock:
+err_decrement_count:
+ qmp->init_count--;
mutex_unlock(&qmp->phy_mutex);
return ret;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 231/286] block: fix revalidate performance regression
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 230/286] phy: qcom-qmp-pcie-msm8996: " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 232/286] powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall Greg Kroah-Hartman
` (63 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Ming Lei, Jens Axboe
From: Damien Le Moal <dlemoal@kernel.org>
commit 47fe1c3064c6bc1bfa3c032ff78e603e5dd6e5bc upstream.
The scsi driver function sd_read_block_characteristics() always calls
disk_set_zoned() to a disk zoned model correctly, in case the device
model changed. This is done even for regular disks to set the zoned
model to BLK_ZONED_NONE and free any zone related resources if the drive
previously was zoned.
This behavior significantly impact the time it takes to revalidate disks
on a large system as the call to disk_clear_zone_settings() done from
disk_set_zoned() for the BLK_ZONED_NONE case results in the device
request queued to be frozen, even if there are no zone resources to
free.
Avoid this overhead for non-zoned devices by not calling
disk_clear_zone_settings() in disk_set_zoned() if the device model
was already set to BLK_ZONED_NONE, which is always the case for regular
devices.
Reported by: Brian Bunker <brian@purestorage.com>
Fixes: 508aebb80527 ("block: introduce blk_queue_clear_zone_settings()")
Cc: stable@vger.kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Link: https://lore.kernel.org/r/20230529073237.1339862-1-dlemoal@kernel.org
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/blk-settings.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -915,6 +915,7 @@ static bool disk_has_partitions(struct g
void disk_set_zoned(struct gendisk *disk, enum blk_zoned_model model)
{
struct request_queue *q = disk->queue;
+ unsigned int old_model = q->limits.zoned;
switch (model) {
case BLK_ZONED_HM:
@@ -952,7 +953,7 @@ void disk_set_zoned(struct gendisk *disk
*/
blk_queue_zone_write_granularity(q,
queue_logical_block_size(q));
- } else {
+ } else if (old_model != BLK_ZONED_NONE) {
disk_clear_zone_settings(disk);
}
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 232/286] powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 231/286] block: fix revalidate performance regression Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 233/286] iommu/amd: Fix domain flush size when syncing iotlb Greg Kroah-Hartman
` (62 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gaurav Batra, Brian King,
Michael Ellerman
From: Gaurav Batra <gbatra@linux.vnet.ibm.com>
commit 9d2ccf00bddc268045e3d65a8108d61ada0e4b4e upstream.
Currently in tce_freemulti_pSeriesLP() there is no limit on how many
TCEs are passed to the H_STUFF_TCE hcall. This has not caused an issue
until now, but newer firmware releases have started enforcing a limit of
512 TCEs per call.
The limit is correct per the specification (PAPR v2.12 § 14.5.4.2.3).
The code has been in it's current form since it was initially merged.
Cc: stable@vger.kernel.org
Signed-off-by: Gaurav Batra <gbatra@linux.vnet.ibm.com>
Reviewed-by: Brian King <brking@linux.vnet.ibm.com>
[mpe: Tweak change log wording & add PAPR reference]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230525143454.56878-1-gbatra@linux.vnet.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/platforms/pseries/iommu.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/arch/powerpc/platforms/pseries/iommu.c
+++ b/arch/powerpc/platforms/pseries/iommu.c
@@ -311,13 +311,22 @@ static void tce_free_pSeriesLP(unsigned
static void tce_freemulti_pSeriesLP(struct iommu_table *tbl, long tcenum, long npages)
{
u64 rc;
+ long rpages = npages;
+ unsigned long limit;
if (!firmware_has_feature(FW_FEATURE_STUFF_TCE))
return tce_free_pSeriesLP(tbl->it_index, tcenum,
tbl->it_page_shift, npages);
- rc = plpar_tce_stuff((u64)tbl->it_index,
- (u64)tcenum << tbl->it_page_shift, 0, npages);
+ do {
+ limit = min_t(unsigned long, rpages, 512);
+
+ rc = plpar_tce_stuff((u64)tbl->it_index,
+ (u64)tcenum << tbl->it_page_shift, 0, limit);
+
+ rpages -= limit;
+ tcenum += limit;
+ } while (rpages > 0 && !rc);
if (rc && printk_ratelimit()) {
printk("tce_freemulti_pSeriesLP: plpar_tce_stuff failed\n");
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 233/286] iommu/amd: Fix domain flush size when syncing iotlb
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 232/286] powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 234/286] tpm, tpm_tis: correct tpm_tis_flags enumeration values Greg Kroah-Hartman
` (61 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jon Pan-Doh, Sudheer Dantuluri,
Gary Zibrat, Vasant Hegde, Nadav Amit, Joerg Roedel
From: Jon Pan-Doh <pandoh@google.com>
commit 2212fc2acf3f6ee690ea36506fb882a19d1bfcab upstream.
When running on an AMD vIOMMU, we observed multiple invalidations (of
decreasing power of 2 aligned sizes) when unmapping a single page.
Domain flush takes gather bounds (end-start) as size param. However,
gather->end is defined as the last inclusive address (start + size - 1).
This leads to an off by 1 error.
With this patch, verified that 1 invalidation occurs when unmapping a
single page.
Fixes: a270be1b3fdf ("iommu/amd: Use only natural aligned flushes in a VM")
Cc: stable@vger.kernel.org # >= 5.15
Signed-off-by: Jon Pan-Doh <pandoh@google.com>
Tested-by: Sudheer Dantuluri <dantuluris@google.com>
Suggested-by: Gary Zibrat <gzibrat@google.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Acked-by: Nadav Amit <namit@vmware.com>
Link: https://lore.kernel.org/r/20230426203256.237116-1-pandoh@google.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd/iommu.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -2387,7 +2387,7 @@ static void amd_iommu_iotlb_sync(struct
unsigned long flags;
spin_lock_irqsave(&dom->lock, flags);
- domain_flush_pages(dom, gather->start, gather->end - gather->start, 1);
+ domain_flush_pages(dom, gather->start, gather->end - gather->start + 1, 1);
amd_iommu_domain_flush_complete(dom);
spin_unlock_irqrestore(&dom->lock, flags);
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 234/286] tpm, tpm_tis: correct tpm_tis_flags enumeration values
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 233/286] iommu/amd: Fix domain flush size when syncing iotlb Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 235/286] module/decompress: Fix error checking on zstd decompression Greg Kroah-Hartman
` (60 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pavel Machek, Lino Sanfilippo,
Linus Torvalds
From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
commit 4ecd704a4c51fd95973fcc3a60444e0e24eb9439 upstream.
With commit 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test
for interrupts") bit accessor functions are used to access flags in
tpm_tis_data->flags.
However these functions expect bit numbers, while the flags are defined
as bit masks in enum tpm_tis_flag.
Fix this inconsistency by using numbers instead of masks also for the
flags in the enum.
Reported-by: Pavel Machek <pavel@denx.de>
Fixes: 858e8b792d06 ("tpm, tpm_tis: Avoid cache incoherency in test for interrupts")
Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
Cc: stable@vger.kernel.org
Reviewed-by: Pavel Machek <pavel@denx.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_core.h | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/char/tpm/tpm_tis_core.h
+++ b/drivers/char/tpm/tpm_tis_core.h
@@ -84,10 +84,10 @@ enum tis_defaults {
#define ILB_REMAP_SIZE 0x100
enum tpm_tis_flags {
- TPM_TIS_ITPM_WORKAROUND = BIT(0),
- TPM_TIS_INVALID_STATUS = BIT(1),
- TPM_TIS_DEFAULT_CANCELLATION = BIT(2),
- TPM_TIS_IRQ_TESTED = BIT(3),
+ TPM_TIS_ITPM_WORKAROUND = 0,
+ TPM_TIS_INVALID_STATUS = 1,
+ TPM_TIS_DEFAULT_CANCELLATION = 2,
+ TPM_TIS_IRQ_TESTED = 3,
};
struct tpm_tis_data {
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 235/286] module/decompress: Fix error checking on zstd decompression
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 234/286] tpm, tpm_tis: correct tpm_tis_flags enumeration values Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 236/286] firmware: qcom_scm: Use fixed width src vm bitmap Greg Kroah-Hartman
` (59 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Luis Chamberlain,
Dmitry Torokhov, Stephen Boyd, Lucas De Marchi
From: Lucas De Marchi <lucas.demarchi@intel.com>
commit fadb74f9f2f609238070c7ca1b04933dc9400e4a upstream.
While implementing support for in-kernel decompression in kmod,
finit_module() was returning a very suspicious value:
finit_module(3, "", MODULE_INIT_COMPRESSED_FILE) = 18446744072717407296
It turns out the check for module_get_next_page() failing is wrong,
and hence the decompression was not really taking place. Invert
the condition to fix it.
Fixes: 169a58ad824d ("module/decompress: Support zstd in-kernel decompression")
Cc: stable@kernel.org
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/module/decompress.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/module/decompress.c b/kernel/module/decompress.c
index e97232b125eb..8a5d6d63b06c 100644
--- a/kernel/module/decompress.c
+++ b/kernel/module/decompress.c
@@ -257,7 +257,7 @@ static ssize_t module_zstd_decompress(struct load_info *info,
do {
struct page *page = module_get_next_page(info);
- if (!IS_ERR(page)) {
+ if (IS_ERR(page)) {
retval = PTR_ERR(page);
goto out;
}
--
2.41.0
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 236/286] firmware: qcom_scm: Use fixed width src vm bitmap
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 235/286] module/decompress: Fix error checking on zstd decompression Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 237/286] misc: fastrpc: Pass proper scm arguments for secure map request Greg Kroah-Hartman
` (58 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gokul krishna Krishnakumar,
Elliot Berman, Bjorn Andersson, Sasha Levin, Kalle Valo
From: Elliot Berman <quic_eberman@quicinc.com>
[ Upstream commit 968a26a07f75377afbd4f7bb18ef587a1443c244 ]
The maximum VMID for assign_mem is 63. Use a u64 to represent this
bitmap instead of architecture-dependent "unsigned int" which varies in
size on 32-bit and 64-bit platforms.
Acked-by: Kalle Valo <kvalo@kernel.org> (ath10k)
Tested-by: Gokul krishna Krishnakumar <quic_gokukris@quicinc.com>
Signed-off-by: Elliot Berman <quic_eberman@quicinc.com>
Reviewed-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Link: https://lore.kernel.org/r/20230213181832.3489174-1-quic_eberman@quicinc.com
Stable-dep-of: a6e766dea0a2 ("misc: fastrpc: Pass proper scm arguments for secure map request")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/qcom_scm.c | 12 +++++++-----
drivers/misc/fastrpc.c | 2 +-
drivers/net/wireless/ath/ath10k/qmi.c | 4 ++--
drivers/remoteproc/qcom_q6v5_mss.c | 8 ++++----
drivers/remoteproc/qcom_q6v5_pas.c | 2 +-
drivers/soc/qcom/rmtfs_mem.c | 2 +-
include/linux/firmware/qcom/qcom_scm.h | 2 +-
7 files changed, 17 insertions(+), 15 deletions(-)
diff --git a/drivers/firmware/qcom_scm.c b/drivers/firmware/qcom_scm.c
index 5f281cb1ae6ba..75cf3556b99a1 100644
--- a/drivers/firmware/qcom_scm.c
+++ b/drivers/firmware/qcom_scm.c
@@ -905,7 +905,7 @@ static int __qcom_scm_assign_mem(struct device *dev, phys_addr_t mem_region,
* Return negative errno on failure or 0 on success with @srcvm updated.
*/
int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
- unsigned int *srcvm,
+ u64 *srcvm,
const struct qcom_scm_vmperm *newvm,
unsigned int dest_cnt)
{
@@ -922,9 +922,9 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
__le32 *src;
void *ptr;
int ret, i, b;
- unsigned long srcvm_bits = *srcvm;
+ u64 srcvm_bits = *srcvm;
- src_sz = hweight_long(srcvm_bits) * sizeof(*src);
+ src_sz = hweight64(srcvm_bits) * sizeof(*src);
mem_to_map_sz = sizeof(*mem_to_map);
dest_sz = dest_cnt * sizeof(*destvm);
ptr_sz = ALIGN(src_sz, SZ_64) + ALIGN(mem_to_map_sz, SZ_64) +
@@ -937,8 +937,10 @@ int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
/* Fill source vmid detail */
src = ptr;
i = 0;
- for_each_set_bit(b, &srcvm_bits, BITS_PER_LONG)
- src[i++] = cpu_to_le32(b);
+ for (b = 0; b < BITS_PER_TYPE(u64); b++) {
+ if (srcvm_bits & BIT(b))
+ src[i++] = cpu_to_le32(b);
+ }
/* Fill details of mem buff to map */
mem_to_map = ptr + ALIGN(src_sz, SZ_64);
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index 2be67022263bd..f3f2671d7ac7c 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -262,7 +262,7 @@ struct fastrpc_channel_ctx {
int domain_id;
int sesscount;
int vmcount;
- u32 perms;
+ u64 perms;
struct qcom_scm_vmperm vmperms[FASTRPC_MAX_VMIDS];
struct rpmsg_device *rpdev;
struct fastrpc_session_ctx session[FASTRPC_MAX_SESSIONS];
diff --git a/drivers/net/wireless/ath/ath10k/qmi.c b/drivers/net/wireless/ath/ath10k/qmi.c
index 90f457b8e1feb..038c5903c0dc1 100644
--- a/drivers/net/wireless/ath/ath10k/qmi.c
+++ b/drivers/net/wireless/ath/ath10k/qmi.c
@@ -33,7 +33,7 @@ static int ath10k_qmi_map_msa_permission(struct ath10k_qmi *qmi,
{
struct qcom_scm_vmperm dst_perms[3];
struct ath10k *ar = qmi->ar;
- unsigned int src_perms;
+ u64 src_perms;
u32 perm_count;
int ret;
@@ -65,7 +65,7 @@ static int ath10k_qmi_unmap_msa_permission(struct ath10k_qmi *qmi,
{
struct qcom_scm_vmperm dst_perms;
struct ath10k *ar = qmi->ar;
- unsigned int src_perms;
+ u64 src_perms;
int ret;
src_perms = BIT(QCOM_SCM_VMID_MSS_MSA) | BIT(QCOM_SCM_VMID_WLAN);
diff --git a/drivers/remoteproc/qcom_q6v5_mss.c b/drivers/remoteproc/qcom_q6v5_mss.c
index ab053084f7a22..1ba711bc01000 100644
--- a/drivers/remoteproc/qcom_q6v5_mss.c
+++ b/drivers/remoteproc/qcom_q6v5_mss.c
@@ -235,8 +235,8 @@ struct q6v5 {
bool has_qaccept_regs;
bool has_ext_cntl_regs;
bool has_vq6;
- int mpss_perm;
- int mba_perm;
+ u64 mpss_perm;
+ u64 mba_perm;
const char *hexagon_mdt_image;
int version;
};
@@ -414,7 +414,7 @@ static void q6v5_pds_disable(struct q6v5 *qproc, struct device **pds,
}
}
-static int q6v5_xfer_mem_ownership(struct q6v5 *qproc, int *current_perm,
+static int q6v5_xfer_mem_ownership(struct q6v5 *qproc, u64 *current_perm,
bool local, bool remote, phys_addr_t addr,
size_t size)
{
@@ -967,7 +967,7 @@ static int q6v5_mpss_init_image(struct q6v5 *qproc, const struct firmware *fw,
unsigned long dma_attrs = DMA_ATTR_FORCE_CONTIGUOUS;
dma_addr_t phys;
void *metadata;
- int mdata_perm;
+ u64 mdata_perm;
int xferop_ret;
size_t size;
void *ptr;
diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
index 0871108fb4dc5..c99a205426851 100644
--- a/drivers/remoteproc/qcom_q6v5_pas.c
+++ b/drivers/remoteproc/qcom_q6v5_pas.c
@@ -94,7 +94,7 @@ struct qcom_adsp {
size_t region_assign_size;
int region_assign_idx;
- int region_assign_perms;
+ u64 region_assign_perms;
struct qcom_rproc_glink glink_subdev;
struct qcom_rproc_subdev smd_subdev;
diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
index 538fa182169a4..0d31377f178d5 100644
--- a/drivers/soc/qcom/rmtfs_mem.c
+++ b/drivers/soc/qcom/rmtfs_mem.c
@@ -31,7 +31,7 @@ struct qcom_rmtfs_mem {
unsigned int client_id;
- unsigned int perms;
+ u64 perms;
};
static ssize_t qcom_rmtfs_mem_show(struct device *dev,
diff --git a/include/linux/firmware/qcom/qcom_scm.h b/include/linux/firmware/qcom/qcom_scm.h
index 1e449a5d7f5c1..250ea4efb7cb6 100644
--- a/include/linux/firmware/qcom/qcom_scm.h
+++ b/include/linux/firmware/qcom/qcom_scm.h
@@ -94,7 +94,7 @@ extern int qcom_scm_mem_protect_video_var(u32 cp_start, u32 cp_size,
u32 cp_nonpixel_start,
u32 cp_nonpixel_size);
extern int qcom_scm_assign_mem(phys_addr_t mem_addr, size_t mem_sz,
- unsigned int *src,
+ u64 *src,
const struct qcom_scm_vmperm *newvm,
unsigned int dest_cnt);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 237/286] misc: fastrpc: Pass proper scm arguments for secure map request
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 236/286] firmware: qcom_scm: Use fixed width src vm bitmap Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 238/286] btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work Greg Kroah-Hartman
` (57 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Ekansh Gupta,
Srinivas Kandagatla, Sasha Levin
From: Ekansh Gupta <quic_ekangupt@quicinc.com>
[ Upstream commit a6e766dea0a22918735176e4af862d535962f11e ]
If a map request is made with securemap attribute, the memory
ownership needs to be reassigned to new VMID to allow access
from protection domain. Currently only DSP VMID is passed to
the reassign call which is incorrect as only a combination of
HLOS and DSP VMID is allowed for memory ownership reassignment
and passing only DSP VMID will cause assign call failure.
Also pass proper restoring permissions to HLOS as the source
permission will now carry both HLOS and DSP VMID permission.
Change is also made to get valid physical address from
scatter/gather for this allocation request.
Fixes: e90d91190619 ("misc: fastrpc: Add support to secure memory map")
Cc: stable <stable@kernel.org>
Tested-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Signed-off-by: Ekansh Gupta <quic_ekangupt@quicinc.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20230523152550.438363-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/misc/fastrpc.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
diff --git a/drivers/misc/fastrpc.c b/drivers/misc/fastrpc.c
index f3f2671d7ac7c..30d4d0476248f 100644
--- a/drivers/misc/fastrpc.c
+++ b/drivers/misc/fastrpc.c
@@ -316,12 +316,14 @@ static void fastrpc_free_map(struct kref *ref)
if (map->table) {
if (map->attr & FASTRPC_ATTR_SECUREMAP) {
struct qcom_scm_vmperm perm;
+ int vmid = map->fl->cctx->vmperms[0].vmid;
+ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS) | BIT(vmid);
int err = 0;
perm.vmid = QCOM_SCM_VMID_HLOS;
perm.perm = QCOM_SCM_PERM_RWX;
err = qcom_scm_assign_mem(map->phys, map->size,
- &map->fl->cctx->perms, &perm, 1);
+ &src_perms, &perm, 1);
if (err) {
dev_err(map->fl->sctx->dev, "Failed to assign memory phys 0x%llx size 0x%llx err %d",
map->phys, map->size, err);
@@ -787,8 +789,12 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
goto map_err;
}
- map->phys = sg_dma_address(map->table->sgl);
- map->phys += ((u64)fl->sctx->sid << 32);
+ if (attr & FASTRPC_ATTR_SECUREMAP) {
+ map->phys = sg_phys(map->table->sgl);
+ } else {
+ map->phys = sg_dma_address(map->table->sgl);
+ map->phys += ((u64)fl->sctx->sid << 32);
+ }
map->size = len;
map->va = sg_virt(map->table->sgl);
map->len = len;
@@ -798,9 +804,15 @@ static int fastrpc_map_create(struct fastrpc_user *fl, int fd,
* If subsystem VMIDs are defined in DTSI, then do
* hyp_assign from HLOS to those VM(s)
*/
+ u64 src_perms = BIT(QCOM_SCM_VMID_HLOS);
+ struct qcom_scm_vmperm dst_perms[2] = {0};
+
+ dst_perms[0].vmid = QCOM_SCM_VMID_HLOS;
+ dst_perms[0].perm = QCOM_SCM_PERM_RW;
+ dst_perms[1].vmid = fl->cctx->vmperms[0].vmid;
+ dst_perms[1].perm = QCOM_SCM_PERM_RWX;
map->attr = attr;
- err = qcom_scm_assign_mem(map->phys, (u64)map->size, &fl->cctx->perms,
- fl->cctx->vmperms, fl->cctx->vmcount);
+ err = qcom_scm_assign_mem(map->phys, (u64)map->size, &src_perms, dst_perms, 2);
if (err) {
dev_err(sess->dev, "Failed to assign memory with phys 0x%llx size 0x%llx err %d",
map->phys, map->size, err);
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 238/286] btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 237/286] misc: fastrpc: Pass proper scm arguments for secure map request Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 239/286] HID: hidpp: terminate retry loop on success Greg Kroah-Hartman
` (56 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Thumshirn,
Christoph Hellwig, David Sterba, Sasha Levin
[ Upstream commit 45c2f36871955b51b4ce083c447388d8c72d6b91 ]
When I implemented the storage layer bio splitting, I was under the
assumption that we'll never split metadata bios. But Qu reminded me that
this can actually happen with very old file systems with unaligned
metadata chunks and RAID0.
I still haven't seen such a case in practice, but we better handled this
case, especially as it is fairly easily to do not calling the ->end_іo
method directly in btrfs_end_io_work, and using the proper
btrfs_orig_bbio_end_io helper instead.
In addition to the old file system with unaligned metadata chunks case
documented in the commit log, the combination of the new scrub code
with Johannes pending raid-stripe-tree also triggers this case. We
spent some time debugging it and found that this patch solves
the problem.
Fixes: 103c19723c80 ("btrfs: split the bio submission path into a separate file")
CC: stable@vger.kernel.org # 6.3+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Tested-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/bio.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/bio.c b/fs/btrfs/bio.c
index 726592868e9c5..ada899613486a 100644
--- a/fs/btrfs/bio.c
+++ b/fs/btrfs/bio.c
@@ -307,7 +307,7 @@ static void btrfs_end_bio_work(struct work_struct *work)
/* Metadata reads are checked and repaired by the submitter. */
if (bbio->bio.bi_opf & REQ_META)
- bbio->end_io(bbio);
+ btrfs_orig_bbio_end_io(bbio);
else
btrfs_check_read_bio(bbio, bbio->bio.bi_private);
}
--
2.39.2
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 239/286] HID: hidpp: terminate retry loop on success
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 238/286] btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 240/286] dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling Greg Kroah-Hartman
` (55 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Lord, Benjamin Tissoires,
Jiri Kosina
From: Benjamin Tissoires <benjamin.tissoires@redhat.com>
commit 7c28afd5512e371773dbb2bf95a31ed5625651d9 upstream.
It seems we forgot the normal case to terminate the retry loop,
making us asking 3 times each command, which is probably a little bit
too much.
And remove the ugly "goto exit" that can be replaced by a simpler "break"
Fixes: 586e8fede795 ("HID: logitech-hidpp: Retry commands when device is busy")
Suggested-by: Mark Lord <mlord@pobox.com>
Tested-by: Mark Lord <mlord@pobox.com>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-logitech-hidpp.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -283,7 +283,7 @@ static int hidpp_send_message_sync(struc
struct hidpp_report *message,
struct hidpp_report *response)
{
- int ret;
+ int ret = -1;
int max_retries = 3;
mutex_lock(&hidpp->send_mutex);
@@ -297,13 +297,13 @@ static int hidpp_send_message_sync(struc
*/
*response = *message;
- for (; max_retries != 0; max_retries--) {
+ for (; max_retries != 0 && ret; max_retries--) {
ret = __hidpp_send_report(hidpp->hid_dev, message);
if (ret) {
dbg_hid("__hidpp_send_report returned err: %d\n", ret);
memset(response, 0, sizeof(struct hidpp_report));
- goto exit;
+ break;
}
if (!wait_event_timeout(hidpp->wait, hidpp->answer_available,
@@ -311,14 +311,14 @@ static int hidpp_send_message_sync(struc
dbg_hid("%s:timeout waiting for response\n", __func__);
memset(response, 0, sizeof(struct hidpp_report));
ret = -ETIMEDOUT;
- goto exit;
+ break;
}
if (response->report_id == REPORT_ID_HIDPP_SHORT &&
response->rap.sub_id == HIDPP_ERROR) {
ret = response->rap.params[1];
dbg_hid("%s:got hidpp error %02X\n", __func__, ret);
- goto exit;
+ break;
}
if ((response->report_id == REPORT_ID_HIDPP_LONG ||
@@ -327,13 +327,12 @@ static int hidpp_send_message_sync(struc
ret = response->fap.params[1];
if (ret != HIDPP20_ERROR_BUSY) {
dbg_hid("%s:got hidpp 2.0 error %02X\n", __func__, ret);
- goto exit;
+ break;
}
dbg_hid("%s:got busy hidpp 2.0 error %02X, retrying\n", __func__, ret);
}
}
-exit:
mutex_unlock(&hidpp->send_mutex);
return ret;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 240/286] dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 239/286] HID: hidpp: terminate retry loop on success Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 241/286] dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits Greg Kroah-Hartman
` (54 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Rosin, Tudor Ambarus,
Vinod Koul
From: Peter Rosin <peda@axentia.se>
commit 2a6c7e8cc74e58ba94b8c897035a8ef7f7349f76 upstream.
The MSB part of the peripheral IDs need to go into the ATC_SRC_PER_MSB
and ATC_DST_PER_MSB fields. Not the LSB part.
This fixes a severe regression for TSE-850 devices (compatible
axentia,tse850v3) where output to the audio I2S codec (the main
purpose of the device) simply do not work.
Fixes: d8840a7edcf0 ("dmaengine: at_hdmac: Use bitfield access macros")
Cc: stable@vger.kernel.org
Signed-off-by: Peter Rosin <peda@axentia.se>
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Link: https://lore.kernel.org/r/01e5dae1-d4b0-cf31-516b-423b11b077f1@axentia.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/at_hdmac.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 8858470246e1..6362013b90df 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -153,8 +153,6 @@
#define ATC_AUTO BIT(31) /* Auto multiple buffer tx enable */
/* Bitfields in CFG */
-#define ATC_PER_MSB(h) ((0x30U & (h)) >> 4) /* Extract most significant bits of a handshaking identifier */
-
#define ATC_SRC_PER GENMASK(3, 0) /* Channel src rq associated with periph handshaking ifc h */
#define ATC_DST_PER GENMASK(7, 4) /* Channel dst rq associated with periph handshaking ifc h */
#define ATC_SRC_REP BIT(8) /* Source Replay Mod */
@@ -181,10 +179,15 @@
#define ATC_DPIP_HOLE GENMASK(15, 0)
#define ATC_DPIP_BOUNDARY GENMASK(25, 16)
-#define ATC_SRC_PER_ID(id) (FIELD_PREP(ATC_SRC_PER_MSB, (id)) | \
- FIELD_PREP(ATC_SRC_PER, (id)))
-#define ATC_DST_PER_ID(id) (FIELD_PREP(ATC_DST_PER_MSB, (id)) | \
- FIELD_PREP(ATC_DST_PER, (id)))
+#define ATC_PER_MSB GENMASK(5, 4) /* Extract MSBs of a handshaking identifier */
+#define ATC_SRC_PER_ID(id) \
+ ({ typeof(id) _id = (id); \
+ FIELD_PREP(ATC_SRC_PER_MSB, FIELD_GET(ATC_PER_MSB, _id)) | \
+ FIELD_PREP(ATC_SRC_PER, _id); })
+#define ATC_DST_PER_ID(id) \
+ ({ typeof(id) _id = (id); \
+ FIELD_PREP(ATC_DST_PER_MSB, FIELD_GET(ATC_PER_MSB, _id)) | \
+ FIELD_PREP(ATC_DST_PER, _id); })
--
2.41.0
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 241/286] dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 240/286] dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 242/286] riscv: perf: Fix callchain parse error with kernel tracepoint events Greg Kroah-Hartman
` (53 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tudor Ambarus, Peter Rosin,
Vinod Koul
From: Peter Rosin <peda@axentia.se>
commit e14fd2af7a1d621c167dad761f729135a7a76ff4 upstream.
Some chips have two bits (e.g SAMA5D3), and some have three (e.g.
SAM9G45). A field width of three is compatible as long as valid
values are used for the different chips.
There is no current use of any value needing three bits, so the
fixed bug is relatively benign.
Fixes: d8840a7edcf0 ("dmaengine: at_hdmac: Use bitfield access macros")
Cc: stable@vger.kernel.org
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Peter Rosin <peda@axentia.se>
Link: https://lore.kernel.org/r/e2c898ba-c3a3-5dd3-384b-0585661c79f2@axentia.se
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/at_hdmac.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c
index 6362013b90df..ee3a219e3a89 100644
--- a/drivers/dma/at_hdmac.c
+++ b/drivers/dma/at_hdmac.c
@@ -132,7 +132,7 @@
#define ATC_DST_PIP BIT(12) /* Destination Picture-in-Picture enabled */
#define ATC_SRC_DSCR_DIS BIT(16) /* Src Descriptor fetch disable */
#define ATC_DST_DSCR_DIS BIT(20) /* Dst Descriptor fetch disable */
-#define ATC_FC GENMASK(22, 21) /* Choose Flow Controller */
+#define ATC_FC GENMASK(23, 21) /* Choose Flow Controller */
#define ATC_FC_MEM2MEM 0x0 /* Mem-to-Mem (DMA) */
#define ATC_FC_MEM2PER 0x1 /* Mem-to-Periph (DMA) */
#define ATC_FC_PER2MEM 0x2 /* Periph-to-Mem (DMA) */
--
2.41.0
^ permalink raw reply related [flat|nested] 299+ messages in thread
* [PATCH 6.3 242/286] riscv: perf: Fix callchain parse error with kernel tracepoint events
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 241/286] dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 243/286] io_uring: undeprecate epoll_ctl support Greg Kroah-Hartman
` (52 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ism Hong, Palmer Dabbelt
From: Ism Hong <ism.hong@gmail.com>
commit 9a7e8ec0d4cc64870ea449b4fce5779b77496cbb upstream.
For RISC-V, when tracing with tracepoint events, the IP and status are
set to 0, preventing the perf code parsing the callchain and resolving
the symbols correctly.
./ply 'tracepoint:kmem/kmem_cache_alloc { @[stack]=count(); }'
@:
{ <STACKID4294967282> }: 1
The fix is to implement perf_arch_fetch_caller_regs for riscv, which
fills several necessary registers used for callchain unwinding,
including epc, sp, s0 and status. It's similar to commit b3eac0265bf6
("arm: perf: Fix callchain parse error with kernel tracepoint events")
and commit 5b09a094f2fb ("arm64: perf: Fix callchain parse error with
kernel tracepoint events").
With this patch, callchain can be parsed correctly as:
./ply 'tracepoint:kmem/kmem_cache_alloc { @[stack]=count(); }'
@:
{
__traceiter_kmem_cache_alloc+68
__traceiter_kmem_cache_alloc+68
kmem_cache_alloc+354
__sigqueue_alloc+94
__send_signal_locked+646
send_signal_locked+154
do_send_sig_info+84
__kill_pgrp_info+130
kill_pgrp+60
isig+150
n_tty_receive_signal_char+36
n_tty_receive_buf_standard+2214
n_tty_receive_buf_common+280
n_tty_receive_buf2+26
tty_ldisc_receive_buf+34
tty_port_default_receive_buf+62
flush_to_ldisc+158
process_one_work+458
worker_thread+138
kthread+178
riscv_cpufeature_patch_func+832
}: 1
Signed-off-by: Ism Hong <ism.hong@gmail.com>
Link: https://lore.kernel.org/r/20230601095355.1168910-1-ism.hong@gmail.com
Fixes: 178e9fc47aae ("perf: riscv: preliminary RISC-V support")
Cc: stable@vger.kernel.org
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/include/asm/perf_event.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/riscv/include/asm/perf_event.h
+++ b/arch/riscv/include/asm/perf_event.h
@@ -10,4 +10,11 @@
#include <linux/perf_event.h>
#define perf_arch_bpf_user_pt_regs(regs) (struct user_regs_struct *)regs
+
+#define perf_arch_fetch_caller_regs(regs, __ip) { \
+ (regs)->epc = (__ip); \
+ (regs)->s0 = (unsigned long) __builtin_frame_address(0); \
+ (regs)->sp = current_stack_pointer; \
+ (regs)->status = SR_PP; \
+}
#endif /* _ASM_RISCV_PERF_EVENT_H */
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 243/286] io_uring: undeprecate epoll_ctl support
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 242/286] riscv: perf: Fix callchain parse error with kernel tracepoint events Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 244/286] selinux: dont use makes grouped targets feature yet Greg Kroah-Hartman
` (51 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ben Noordhuis, Jens Axboe
From: Ben Noordhuis <info@bnoordhuis.nl>
commit 4ea0bf4b98d66a7a790abb285539f395596bae92 upstream.
Libuv recently started using it so there is at least one consumer now.
Cc: stable@vger.kernel.org
Fixes: 61a2732af4b0 ("io_uring: deprecate epoll_ctl support")
Link: https://github.com/libuv/libuv/pull/3979
Signed-off-by: Ben Noordhuis <info@bnoordhuis.nl>
Link: https://lore.kernel.org/r/20230506095502.13401-1-info@bnoordhuis.nl
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/epoll.c | 4 ----
1 file changed, 4 deletions(-)
--- a/io_uring/epoll.c
+++ b/io_uring/epoll.c
@@ -25,10 +25,6 @@ int io_epoll_ctl_prep(struct io_kiocb *r
{
struct io_epoll *epoll = io_kiocb_to_cmd(req, struct io_epoll);
- pr_warn_once("%s: epoll_ctl support in io_uring is deprecated and will "
- "be removed in a future Linux kernel version.\n",
- current->comm);
-
if (sqe->buf_index || sqe->splice_fd_in)
return -EINVAL;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 244/286] selinux: dont use makes grouped targets feature yet
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 243/286] io_uring: undeprecate epoll_ctl support Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 245/286] mtdchar: mark bits of ioctl handler noinline Greg Kroah-Hartman
` (50 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Erwan Velu, Luiz Capitulino,
Paul Moore
From: Paul Moore <paul@paul-moore.com>
commit 42c4e97e06a839b07d834f640a10911ad84ec8b3 upstream.
The Linux Kernel currently only requires make v3.82 while the grouped
target functionality requires make v4.3. Removed the grouped target
introduced in 4ce1f694eb5d ("selinux: ensure av_permissions.h is
built when needed") as well as the multiple header file targets in
the make rule. This effectively reverts the problem commit.
We will revisit this change when make >= 4.3 is required by the rest
of the kernel.
Cc: stable@vger.kernel.org
Fixes: 4ce1f694eb5d ("selinux: ensure av_permissions.h is built when needed")
Reported-by: Erwan Velu <e.velu@criteo.com>
Reported-by: Luiz Capitulino <luizcap@amazon.com>
Tested-by: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
security/selinux/Makefile | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/security/selinux/Makefile
+++ b/security/selinux/Makefile
@@ -26,5 +26,9 @@ quiet_cmd_flask = GEN $(obj)/flask.h
cmd_flask = $< $(obj)/flask.h $(obj)/av_permissions.h
targets += flask.h av_permissions.h
-$(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/genheaders/genheaders FORCE
+# once make >= 4.3 is required, we can use grouped targets in the rule below,
+# which basically involves adding both headers and a '&' before the colon, see
+# the example below:
+# $(obj)/flask.h $(obj)/av_permissions.h &: scripts/selinux/...
+$(obj)/flask.h: scripts/selinux/genheaders/genheaders FORCE
$(call if_changed,flask)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 245/286] mtdchar: mark bits of ioctl handler noinline
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 244/286] selinux: dont use makes grouped targets feature yet Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 246/286] tracing/timerlat: Always wakeup the timerlat thread Greg Kroah-Hartman
` (49 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Richard Weinberger,
Miquel Raynal
From: Arnd Bergmann <arnd@arndb.de>
commit 0ea923f443350c8c5cca6eef5b748d52b903f46c upstream.
The addition of the mtdchar_read_ioctl() function caused the stack usage
of mtdchar_ioctl() to grow beyond the warning limit on 32-bit architectures
with gcc-13:
drivers/mtd/mtdchar.c: In function 'mtdchar_ioctl':
drivers/mtd/mtdchar.c:1229:1: error: the frame size of 1488 bytes is larger than 1024 bytes [-Werror=frame-larger-than=]
Mark both the read and write portions as noinline_for_stack to ensure
they don't get inlined and use separate stack slots to reduce the
maximum usage, both in the mtdchar_ioctl() and combined with any
of its callees.
Fixes: 095bb6e44eb1 ("mtdchar: add MEMREAD ioctl")
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230417205654.1982368-1-arnd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/mtdchar.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/mtd/mtdchar.c
+++ b/drivers/mtd/mtdchar.c
@@ -590,8 +590,8 @@ static void adjust_oob_length(struct mtd
(end_page - start_page + 1) * oob_per_page);
}
-static int mtdchar_write_ioctl(struct mtd_info *mtd,
- struct mtd_write_req __user *argp)
+static noinline_for_stack int
+mtdchar_write_ioctl(struct mtd_info *mtd, struct mtd_write_req __user *argp)
{
struct mtd_info *master = mtd_get_master(mtd);
struct mtd_write_req req;
@@ -688,8 +688,8 @@ static int mtdchar_write_ioctl(struct mt
return ret;
}
-static int mtdchar_read_ioctl(struct mtd_info *mtd,
- struct mtd_read_req __user *argp)
+static noinline_for_stack int
+mtdchar_read_ioctl(struct mtd_info *mtd, struct mtd_read_req __user *argp)
{
struct mtd_info *master = mtd_get_master(mtd);
struct mtd_read_req req;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 246/286] tracing/timerlat: Always wakeup the timerlat thread
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 245/286] mtdchar: mark bits of ioctl handler noinline Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 247/286] tracing/histograms: Allow variables to have some modifiers Greg Kroah-Hartman
` (48 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juri Lelli,
Daniel Bristot de Oliveira, Steven Rostedt (Google)
From: Daniel Bristot de Oliveira <bristot@kernel.org>
commit 632478a05821bc1c9b55c3a1dd0fb1be7bfa1acc upstream.
While testing rtla timerlat auto analysis, I reach a condition where
the interface was not receiving tracing data. I was able to manually
reproduce the problem with these steps:
# echo 0 > tracing_on # disable trace
# echo 1 > osnoise/stop_tracing_us # stop trace if timerlat irq > 1 us
# echo timerlat > current_tracer # enable timerlat tracer
# sleep 1 # wait... that is the time when rtla
# apply configs like prio or cgroup
# echo 1 > tracing_on # start tracing
# cat trace
# tracer: timerlat
#
# _-----=> irqs-off
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# ||||| ACTIVATION
# TASK-PID CPU# ||||| TIMESTAMP ID CONTEXT LATENCY
# | | | ||||| | | | |
NOTHING!
Then, trying to enable tracing again with echo 1 > tracing_on resulted
in no change: the trace was still not tracing.
This problem happens because the timerlat IRQ hits the stop tracing
condition while tracing is off, and do not wake up the timerlat thread,
so the timerlat threads are kept sleeping forever, resulting in no
trace, even after re-enabling the tracer.
Avoid this condition by always waking up the threads, even after stopping
tracing, allowing the tracer to return to its normal operating after
a new tracing on.
Link: https://lore.kernel.org/linux-trace-kernel/1ed8f830638b20a39d535d27d908e319a9a3c4e2.1683822622.git.bristot@kernel.org
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: stable@vger.kernel.org
Fixes: a955d7eac177 ("trace: Add timerlat tracer")
Signed-off-by: Daniel Bristot de Oliveira <bristot@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_osnoise.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/trace/trace_osnoise.c
+++ b/kernel/trace/trace_osnoise.c
@@ -1652,6 +1652,8 @@ static enum hrtimer_restart timerlat_irq
osnoise_stop_tracing();
notify_new_max_latency(diff);
+ wake_up_process(tlat->kthread);
+
return HRTIMER_NORESTART;
}
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 247/286] tracing/histograms: Allow variables to have some modifiers
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 246/286] tracing/timerlat: Always wakeup the timerlat thread Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 248/286] tracing/probe: trace_probe_primary_from_call(): checked list_first_entry Greg Kroah-Hartman
` (47 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Tom Zanussi,
Mark Rutland, Steven Rostedt (Google)
From: Steven Rostedt (Google) <rostedt@goodmis.org>
commit e30fbc618e97b38dbb49f1d44dcd0778d3f23b8c upstream.
Modifiers are used to change the behavior of keys. For instance, they
can grouped into buckets, converted to syscall names (from the syscall
identifier), show task->comm of the current pid, be an array of longs
that represent a stacktrace, and more.
It was found that nothing stopped a value from taking a modifier. As
values are simple counters. If this happened, it would call code that
was not expecting a modifier and crash the kernel. This was fixed by
having the ___create_val_field() function test if a modifier was present
and fail if one was. This fixed the crash.
Now there's a problem with variables. Variables are used to pass fields
from one event to another. Variables are allowed to have some modifiers,
as the processing may need to happen at the time of the event (like
stacktraces and comm names of the current pid). The issue is that it too
uses __create_val_field(). Now that fails on modifiers, variables can no
longer use them (this is a regression).
As not all modifiers are for variables, have them use a separate check.
Link: https://lore.kernel.org/linux-trace-kernel/20230523221108.064a5d82@rorschach.local.home
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Tom Zanussi <zanussi@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Fixes: e0213434fe3e4 ("tracing: Do not let histogram values have some modifiers")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_events_hist.c | 23 ++++++++++++++++-------
1 file changed, 16 insertions(+), 7 deletions(-)
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -4238,13 +4238,19 @@ static int __create_val_field(struct his
goto out;
}
- /* Some types cannot be a value */
- if (hist_field->flags & (HIST_FIELD_FL_GRAPH | HIST_FIELD_FL_PERCENT |
- HIST_FIELD_FL_BUCKET | HIST_FIELD_FL_LOG2 |
- HIST_FIELD_FL_SYM | HIST_FIELD_FL_SYM_OFFSET |
- HIST_FIELD_FL_SYSCALL | HIST_FIELD_FL_STACKTRACE)) {
- hist_err(file->tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str));
- ret = -EINVAL;
+ /* values and variables should not have some modifiers */
+ if (hist_field->flags & HIST_FIELD_FL_VAR) {
+ /* Variable */
+ if (hist_field->flags & (HIST_FIELD_FL_GRAPH | HIST_FIELD_FL_PERCENT |
+ HIST_FIELD_FL_BUCKET | HIST_FIELD_FL_LOG2))
+ goto err;
+ } else {
+ /* Value */
+ if (hist_field->flags & (HIST_FIELD_FL_GRAPH | HIST_FIELD_FL_PERCENT |
+ HIST_FIELD_FL_BUCKET | HIST_FIELD_FL_LOG2 |
+ HIST_FIELD_FL_SYM | HIST_FIELD_FL_SYM_OFFSET |
+ HIST_FIELD_FL_SYSCALL | HIST_FIELD_FL_STACKTRACE))
+ goto err;
}
hist_data->fields[val_idx] = hist_field;
@@ -4256,6 +4262,9 @@ static int __create_val_field(struct his
ret = -EINVAL;
out:
return ret;
+ err:
+ hist_err(file->tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str));
+ return -EINVAL;
}
static int create_val_field(struct hist_trigger_data *hist_data,
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 248/286] tracing/probe: trace_probe_primary_from_call(): checked list_first_entry
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 247/286] tracing/histograms: Allow variables to have some modifiers Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 249/286] selftests: mptcp: connect: skip if MPTCP is not supported Greg Kroah-Hartman
` (46 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pietro Borrello,
Steven Rostedt (Google), Masami Hiramatsu (Google), Mukesh Ojha
From: Pietro Borrello <borrello@diag.uniroma1.it>
commit 81d0fa4cb4fc0e1a49c2b22f92c43d9fe972ebcf upstream.
All callers of trace_probe_primary_from_call() check the return
value to be non NULL. However, the function returns
list_first_entry(&tpe->probes, ...) which can never be NULL.
Additionally, it does not check for the list being possibly empty,
possibly causing a type confusion on empty lists.
Use list_first_entry_or_null() which solves both problems.
Link: https://lore.kernel.org/linux-trace-kernel/20230128-list-entry-null-check-v1-1-8bde6a3da2ef@diag.uniroma1.it/
Fixes: 60d53e2c3b75 ("tracing/probe: Split trace_event related data from trace_probe")
Signed-off-by: Pietro Borrello <borrello@diag.uniroma1.it>
Reviewed-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Acked-by: Mukesh Ojha <quic_mojha@quicinc.com>
Cc: stable@vger.kernel.org
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/trace_probe.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/trace/trace_probe.h
+++ b/kernel/trace/trace_probe.h
@@ -308,7 +308,7 @@ trace_probe_primary_from_call(struct tra
{
struct trace_probe_event *tpe = trace_probe_event_from_call(call);
- return list_first_entry(&tpe->probes, struct trace_probe, list);
+ return list_first_entry_or_null(&tpe->probes, struct trace_probe, list);
}
static inline struct list_head *trace_probe_probe_list(struct trace_probe *tp)
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 249/286] selftests: mptcp: connect: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 248/286] tracing/probe: trace_probe_primary_from_call(): checked list_first_entry Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 250/286] selftests: mptcp: pm nl: " Greg Kroah-Hartman
` (45 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit d83013bdf90a7994a474b0e650a7fc94b0d4ded6 upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped". Note that this check can also
mark the test as failed if 'SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES' env
var is set to 1: by doing that, we can make sure a test is not being
skipped by mistake.
A new shared file is added here to be able to re-used the same check in
the different selftests we have.
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: 048d19d444be ("mptcp: add basic kselftest for mptcp")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/Makefile | 2 -
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 4 ++
tools/testing/selftests/net/mptcp/mptcp_lib.sh | 40 +++++++++++++++++++++
3 files changed, 45 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/net/mptcp/mptcp_lib.sh
--- a/tools/testing/selftests/net/mptcp/Makefile
+++ b/tools/testing/selftests/net/mptcp/Makefile
@@ -9,7 +9,7 @@ TEST_PROGS := mptcp_connect.sh pm_netlin
TEST_GEN_FILES = mptcp_connect pm_nl_ctl mptcp_sockopt mptcp_inq
-TEST_FILES := settings
+TEST_FILES := mptcp_lib.sh settings
EXTRA_CLEAN := *.pcap
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
@@ -1,6 +1,8 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+. "$(dirname "${0}")/mptcp_lib.sh"
+
time_start=$(date +%s)
optstring="S:R:d:e:l:r:h4cm:f:tC"
@@ -141,6 +143,8 @@ cleanup()
done
}
+mptcp_lib_check_mptcp
+
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
--- /dev/null
+++ b/tools/testing/selftests/net/mptcp/mptcp_lib.sh
@@ -0,0 +1,40 @@
+#! /bin/bash
+# SPDX-License-Identifier: GPL-2.0
+
+readonly KSFT_FAIL=1
+readonly KSFT_SKIP=4
+
+# SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES env var can be set when validating all
+# features using the last version of the kernel and the selftests to make sure
+# a test is not being skipped by mistake.
+mptcp_lib_expect_all_features() {
+ [ "${SELFTESTS_MPTCP_LIB_EXPECT_ALL_FEATURES:-}" = "1" ]
+}
+
+# $1: msg
+mptcp_lib_fail_if_expected_feature() {
+ if mptcp_lib_expect_all_features; then
+ echo "ERROR: missing feature: ${*}"
+ exit ${KSFT_FAIL}
+ fi
+
+ return 1
+}
+
+# $1: file
+mptcp_lib_has_file() {
+ local f="${1}"
+
+ if [ -f "${f}" ]; then
+ return 0
+ fi
+
+ mptcp_lib_fail_if_expected_feature "${f} file not found"
+}
+
+mptcp_lib_check_mptcp() {
+ if ! mptcp_lib_has_file "/proc/sys/net/mptcp/enabled"; then
+ echo "SKIP: MPTCP support is not available"
+ exit ${KSFT_SKIP}
+ fi
+}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 250/286] selftests: mptcp: pm nl: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 249/286] selftests: mptcp: connect: skip if MPTCP is not supported Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 251/286] selftests: mptcp: join: " Greg Kroah-Hartman
` (44 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit 0f4955a40dafe18a1122e3714d8173e4b018e869 upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped".
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: eedbc685321b ("selftests: add PM netlink functional tests")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/pm_netlink.sh | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/net/mptcp/pm_netlink.sh
+++ b/tools/testing/selftests/net/mptcp/pm_netlink.sh
@@ -1,6 +1,8 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+. "$(dirname "${0}")/mptcp_lib.sh"
+
ksft_skip=4
ret=0
@@ -34,6 +36,8 @@ cleanup()
ip netns del $ns1
}
+mptcp_lib_check_mptcp
+
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 251/286] selftests: mptcp: join: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 250/286] selftests: mptcp: pm nl: " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 252/286] selftests: mptcp: join: avoid using cmp --bytes Greg Kroah-Hartman
` (43 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit 715c78a82e00f848f99ef76e6f6b89216ccba268 upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped".
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: b08fbf241064 ("selftests: add test-cases for MPTCP MP_JOIN")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -6,6 +6,8 @@
# address all other issues detected by shellcheck.
#shellcheck disable=SC2086
+. "$(dirname "${0}")/mptcp_lib.sh"
+
ret=0
sin=""
sinfail=""
@@ -132,6 +134,8 @@ cleanup_partial()
check_tools()
{
+ mptcp_lib_check_mptcp
+
if ! ip -Version &> /dev/null; then
echo "SKIP: Could not run test without ip tool"
exit $ksft_skip
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 252/286] selftests: mptcp: join: avoid using cmp --bytes
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 251/286] selftests: mptcp: join: " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 253/286] selftests: mptcp: diag: skip if MPTCP is not supported Greg Kroah-Hartman
` (42 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Mat Martineau,
Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit d328fe87067480cf2bd0b58dab428a98d31dbb7e upstream.
BusyBox's 'cmp' command doesn't support the '--bytes' parameter.
Some CIs -- i.e. LKFT -- use BusyBox and have the mptcp_join.sh test
failing [1] because their 'cmp' command doesn't support this '--bytes'
option:
cmp: unrecognized option '--bytes=1024'
BusyBox v1.35.0 () multi-call binary.
Usage: cmp [-ls] [-n NUM] FILE1 [FILE2]
Instead, 'head --bytes' can be used as this option is supported by
BusyBox. A temporary file is needed for this operation.
Because it is apparently quite common to use BusyBox, it is certainly
better to backport this fix to impacted kernels.
Fixes: 6bf41020b72b ("selftests: mptcp: update and extend fastclose test-cases")
Cc: stable@vger.kernel.org
Link: https://qa-reports.linaro.org/lkft/linux-mainline-master/build/v6.3-rc5-5-g148341f0a2f5/testrun/16088933/suite/kselftest-net-mptcp/test/net_mptcp_userspace_pm_sh/log [1]
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -15,6 +15,7 @@ sout=""
cin=""
cinfail=""
cinsent=""
+tmpfile=""
cout=""
capout=""
ns1=""
@@ -175,6 +176,7 @@ cleanup()
{
rm -f "$cin" "$cout" "$sinfail"
rm -f "$sin" "$sout" "$cinsent" "$cinfail"
+ rm -f "$tmpfile"
rm -rf $evts_ns1 $evts_ns2
cleanup_partial
}
@@ -382,9 +384,16 @@ check_transfer()
fail_test
return 1
fi
- bytes="--bytes=${bytes}"
+
+ # note: BusyBox's "cmp" command doesn't support --bytes
+ tmpfile=$(mktemp)
+ head --bytes="$bytes" "$in" > "$tmpfile"
+ mv "$tmpfile" "$in"
+ head --bytes="$bytes" "$out" > "$tmpfile"
+ mv "$tmpfile" "$out"
+ tmpfile=""
fi
- cmp -l "$in" "$out" ${bytes} | while read -r i a b; do
+ cmp -l "$in" "$out" | while read -r i a b; do
local sum=$((0${a} + 0${b}))
if [ $check_invert -eq 0 ] || [ $sum -ne $((0xff)) ]; then
echo "[ FAIL ] $what does not match (in, out):"
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 253/286] selftests: mptcp: diag: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 252/286] selftests: mptcp: join: avoid using cmp --bytes Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 254/286] selftests: mptcp: simult flows: " Greg Kroah-Hartman
` (41 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit 46565acdd29facbf418a11e4a3791b3c8967308d upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped".
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: df62f2ec3df6 ("selftests/mptcp: add diag interface tests")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/diag.sh | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/net/mptcp/diag.sh
+++ b/tools/testing/selftests/net/mptcp/diag.sh
@@ -1,6 +1,8 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+. "$(dirname "${0}")/mptcp_lib.sh"
+
sec=$(date +%s)
rndh=$(printf %x $sec)-$(mktemp -u XXXXXX)
ns="ns1-$rndh"
@@ -31,6 +33,8 @@ cleanup()
ip netns del $ns
}
+mptcp_lib_check_mptcp
+
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 254/286] selftests: mptcp: simult flows: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 253/286] selftests: mptcp: diag: skip if MPTCP is not supported Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 255/286] selftests: mptcp: sockopt: " Greg Kroah-Hartman
` (40 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit 9161f21c74a1a0e7bb39eb84ea0c86b23c92fc87 upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped".
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: 1a418cb8e888 ("mptcp: simult flow self-tests")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/simult_flows.sh | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/net/mptcp/simult_flows.sh
+++ b/tools/testing/selftests/net/mptcp/simult_flows.sh
@@ -1,6 +1,8 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+. "$(dirname "${0}")/mptcp_lib.sh"
+
sec=$(date +%s)
rndh=$(printf %x $sec)-$(mktemp -u XXXXXX)
ns1="ns1-$rndh"
@@ -34,6 +36,8 @@ cleanup()
done
}
+mptcp_lib_check_mptcp
+
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 255/286] selftests: mptcp: sockopt: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 254/286] selftests: mptcp: simult flows: " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 256/286] selftests: mptcp: userspace pm: " Greg Kroah-Hartman
` (39 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit cf6f0fda7af7e8e016070bfee6b189e671a0c776 upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped".
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: dc65fe82fb07 ("selftests: mptcp: add packet mark test case")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_sockopt.sh | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_sockopt.sh
@@ -1,6 +1,8 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+. "$(dirname "${0}")/mptcp_lib.sh"
+
ret=0
sin=""
sout=""
@@ -84,6 +86,8 @@ cleanup()
rm -f "$sin" "$sout"
}
+mptcp_lib_check_mptcp
+
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Could not run test without ip tool"
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 256/286] selftests: mptcp: userspace pm: skip if MPTCP is not supported
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 255/286] selftests: mptcp: sockopt: " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 257/286] mptcp: fix connect timeout handling Greg Kroah-Hartman
` (38 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paolo Abeni, Matthieu Baerts
From: Matthieu Baerts <matthieu.baerts@tessares.net>
commit 63212608a92a1ff10ae56dbb14e9fb685f7e4ffa upstream.
Selftests are supposed to run on any kernels, including the old ones not
supporting MPTCP.
A new check is then added to make sure MPTCP is supported. If not, the
test stops and is marked as "skipped".
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/368
Fixes: 259a834fadda ("selftests: mptcp: functional tests for the userspace PM type")
Cc: stable@vger.kernel.org
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/userspace_pm.sh | 4 ++++
1 file changed, 4 insertions(+)
--- a/tools/testing/selftests/net/mptcp/userspace_pm.sh
+++ b/tools/testing/selftests/net/mptcp/userspace_pm.sh
@@ -1,6 +1,10 @@
#!/bin/bash
# SPDX-License-Identifier: GPL-2.0
+. "$(dirname "${0}")/mptcp_lib.sh"
+
+mptcp_lib_check_mptcp
+
ip -Version > /dev/null 2>&1
if [ $? -ne 0 ];then
echo "SKIP: Cannot not run test without ip tool"
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 257/286] mptcp: fix connect timeout handling
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 256/286] selftests: mptcp: userspace pm: " Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 258/286] mptcp: fix active subflow finalization Greg Kroah-Hartman
` (37 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ondrej Mosnacek, Mat Martineau,
Paolo Abeni, Jakub Kicinski
From: Paolo Abeni <pabeni@redhat.com>
commit 786fc12457268cc9b555dde6c22ae7300d4b40e1 upstream.
Ondrej reported a functional issue WRT timeout handling on connect
with a nice reproducer.
The problem is that the current mptcp connect waits for both the
MPTCP socket level timeout, and the first subflow socket timeout.
The latter is not influenced/touched by the exposed setsockopt().
Overall the above makes the SO_SNDTIMEO a no-op on connect.
Since mptcp_connect is invoked via inet_stream_connect and the
latter properly handle the MPTCP level timeout, we can address the
issue making the nested subflow level connect always unblocking.
This also allow simplifying a bit the code, dropping an ugly hack
to handle the fastopen and custom proto_ops connect.
The issues predates the blamed commit below, but the current resolution
requires the infrastructure introduced there.
Fixes: 54f1944ed6d2 ("mptcp: factor out mptcp_connect()")
Reported-by: Ondrej Mosnacek <omosnace@redhat.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/399
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 29 +++++++----------------------
net/mptcp/protocol.h | 1 -
2 files changed, 7 insertions(+), 23 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1671,7 +1671,6 @@ static int mptcp_sendmsg_fastopen(struct
lock_sock(ssk);
msg->msg_flags |= MSG_DONTWAIT;
- msk->connect_flags = O_NONBLOCK;
msk->fastopening = 1;
ret = tcp_sendmsg_fastopen(ssk, msg, copied_syn, len, NULL);
msk->fastopening = 0;
@@ -3610,9 +3609,9 @@ static int mptcp_connect(struct sock *sk
* acquired the subflow socket lock, too.
*/
if (msk->fastopening)
- err = __inet_stream_connect(ssock, uaddr, addr_len, msk->connect_flags, 1);
+ err = __inet_stream_connect(ssock, uaddr, addr_len, O_NONBLOCK, 1);
else
- err = inet_stream_connect(ssock, uaddr, addr_len, msk->connect_flags);
+ err = inet_stream_connect(ssock, uaddr, addr_len, O_NONBLOCK);
inet_sk(sk)->defer_connect = inet_sk(ssock->sk)->defer_connect;
/* on successful connect, the msk state will be moved to established by
@@ -3625,12 +3624,10 @@ static int mptcp_connect(struct sock *sk
mptcp_copy_inaddrs(sk, ssock->sk);
- /* unblocking connect, mptcp-level inet_stream_connect will error out
- * without changing the socket state, update it here.
+ /* silence EINPROGRESS and let the caller inet_stream_connect
+ * handle the connection in progress
*/
- if (err == -EINPROGRESS)
- sk->sk_socket->state = ssock->state;
- return err;
+ return 0;
}
static struct proto mptcp_prot = {
@@ -3689,18 +3686,6 @@ unlock:
return err;
}
-static int mptcp_stream_connect(struct socket *sock, struct sockaddr *uaddr,
- int addr_len, int flags)
-{
- int ret;
-
- lock_sock(sock->sk);
- mptcp_sk(sock->sk)->connect_flags = flags;
- ret = __inet_stream_connect(sock, uaddr, addr_len, flags, 0);
- release_sock(sock->sk);
- return ret;
-}
-
static int mptcp_listen(struct socket *sock, int backlog)
{
struct mptcp_sock *msk = mptcp_sk(sock->sk);
@@ -3857,7 +3842,7 @@ static const struct proto_ops mptcp_stre
.owner = THIS_MODULE,
.release = inet_release,
.bind = mptcp_bind,
- .connect = mptcp_stream_connect,
+ .connect = inet_stream_connect,
.socketpair = sock_no_socketpair,
.accept = mptcp_stream_accept,
.getname = inet_getname,
@@ -3952,7 +3937,7 @@ static const struct proto_ops mptcp_v6_s
.owner = THIS_MODULE,
.release = inet6_release,
.bind = mptcp_bind,
- .connect = mptcp_stream_connect,
+ .connect = inet_stream_connect,
.socketpair = sock_no_socketpair,
.accept = mptcp_stream_accept,
.getname = inet6_getname,
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -297,7 +297,6 @@ struct mptcp_sock {
nodelay:1,
fastopening:1,
in_accept_queue:1;
- int connect_flags;
struct work_struct work;
struct sk_buff *ooo_last_skb;
struct rb_root out_of_order_queue;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 258/286] mptcp: fix active subflow finalization
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 257/286] mptcp: fix connect timeout handling Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 259/286] ext4: add EA_INODE checking to ext4_iget() Greg Kroah-Hartman
` (36 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mat Martineau, Paolo Abeni,
Jakub Kicinski
From: Paolo Abeni <pabeni@redhat.com>
commit 55b47ca7d80814ceb63d64e032e96cd6777811e5 upstream.
Active subflow are inserted into the connection list at creation time.
When the MPJ handshake completes successfully, a new subflow creation
netlink event is generated correctly, but the current code wrongly
avoid initializing a couple of subflow data.
The above will cause misbehavior on a few exceptional events: unneeded
mptcp-level retransmission on msk-level sequence wrap-around and infinite
mapping fallback even when a MPJ socket is present.
Address the issue factoring out the needed initialization in a new helper
and invoking the latter from __mptcp_finish_join() time for passive
subflow and from mptcp_finish_join() for active ones.
Fixes: 0530020a7c8f ("mptcp: track and update contiguous data status")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/mptcp/protocol.c | 23 ++++++++++++++---------
1 file changed, 14 insertions(+), 9 deletions(-)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -812,6 +812,13 @@ void mptcp_data_ready(struct sock *sk, s
mptcp_data_unlock(sk);
}
+static void mptcp_subflow_joined(struct mptcp_sock *msk, struct sock *ssk)
+{
+ mptcp_subflow_ctx(ssk)->map_seq = READ_ONCE(msk->ack_seq);
+ WRITE_ONCE(msk->allow_infinite_fallback, false);
+ mptcp_event(MPTCP_EVENT_SUB_ESTABLISHED, msk, ssk, GFP_ATOMIC);
+}
+
static bool __mptcp_finish_join(struct mptcp_sock *msk, struct sock *ssk)
{
struct sock *sk = (struct sock *)msk;
@@ -826,6 +833,7 @@ static bool __mptcp_finish_join(struct m
mptcp_sock_graft(ssk, sk->sk_socket);
mptcp_sockopt_sync_locked(msk, ssk);
+ mptcp_subflow_joined(msk, ssk);
return true;
}
@@ -3457,14 +3465,16 @@ bool mptcp_finish_join(struct sock *ssk)
return false;
}
- if (!list_empty(&subflow->node))
- goto out;
+ /* active subflow, already present inside the conn_list */
+ if (!list_empty(&subflow->node)) {
+ mptcp_subflow_joined(msk, ssk);
+ return true;
+ }
if (!mptcp_pm_allow_new_subflow(msk))
goto err_prohibited;
- /* active connections are already on conn_list.
- * If we can't acquire msk socket lock here, let the release callback
+ /* If we can't acquire msk socket lock here, let the release callback
* handle it
*/
mptcp_data_lock(parent);
@@ -3487,11 +3497,6 @@ err_prohibited:
return false;
}
- subflow->map_seq = READ_ONCE(msk->ack_seq);
- WRITE_ONCE(msk->allow_infinite_fallback, false);
-
-out:
- mptcp_event(MPTCP_EVENT_SUB_ESTABLISHED, msk, ssk, GFP_ATOMIC);
return true;
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 259/286] ext4: add EA_INODE checking to ext4_iget()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 258/286] mptcp: fix active subflow finalization Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 260/286] ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() Greg Kroah-Hartman
` (35 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+cbb68193bdb95af4340a,
syzbot+62120febbd1ee3c3c860, syzbot+edce54daffee36421b4c, stable,
Theodore Tso
From: Theodore Ts'o <tytso@mit.edu>
commit b3e6bcb94590dea45396b9481e47b809b1be4afa upstream.
Add a new flag, EXT4_IGET_EA_INODE which indicates whether the inode
is expected to have the EA_INODE flag or not. If the flag is not
set/clear as expected, then fail the iget() operation and mark the
file system as corrupted.
This commit also makes the ext4_iget() always perform the
is_bad_inode() check even when the inode is already inode cache. This
allows us to remove the is_bad_inode() check from the callers of
ext4_iget() in the ea_inode code.
Reported-by: syzbot+cbb68193bdb95af4340a@syzkaller.appspotmail.com
Reported-by: syzbot+62120febbd1ee3c3c860@syzkaller.appspotmail.com
Reported-by: syzbot+edce54daffee36421b4c@syzkaller.appspotmail.com
Cc: stable@kernel.org
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230524034951.779531-2-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ext4.h | 3 ++-
fs/ext4/inode.c | 31 ++++++++++++++++++++++++++-----
fs/ext4/xattr.c | 36 +++++++-----------------------------
3 files changed, 35 insertions(+), 35 deletions(-)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -2992,7 +2992,8 @@ typedef enum {
EXT4_IGET_NORMAL = 0,
EXT4_IGET_SPECIAL = 0x0001, /* OK to iget a system inode */
EXT4_IGET_HANDLE = 0x0002, /* Inode # is from a handle */
- EXT4_IGET_BAD = 0x0004 /* Allow to iget a bad inode */
+ EXT4_IGET_BAD = 0x0004, /* Allow to iget a bad inode */
+ EXT4_IGET_EA_INODE = 0x0008 /* Inode should contain an EA value */
} ext4_iget_flags;
extern struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4835,6 +4835,21 @@ static inline void ext4_inode_set_iversi
inode_set_iversion_queried(inode, val);
}
+static const char *check_igot_inode(struct inode *inode, ext4_iget_flags flags)
+
+{
+ if (flags & EXT4_IGET_EA_INODE) {
+ if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL))
+ return "missing EA_INODE flag";
+ } else {
+ if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL))
+ return "unexpected EA_INODE flag";
+ }
+ if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD))
+ return "unexpected bad inode w/o EXT4_IGET_BAD";
+ return NULL;
+}
+
struct inode *__ext4_iget(struct super_block *sb, unsigned long ino,
ext4_iget_flags flags, const char *function,
unsigned int line)
@@ -4844,6 +4859,7 @@ struct inode *__ext4_iget(struct super_b
struct ext4_inode_info *ei;
struct ext4_super_block *es = EXT4_SB(sb)->s_es;
struct inode *inode;
+ const char *err_str;
journal_t *journal = EXT4_SB(sb)->s_journal;
long ret;
loff_t size;
@@ -4871,8 +4887,14 @@ struct inode *__ext4_iget(struct super_b
inode = iget_locked(sb, ino);
if (!inode)
return ERR_PTR(-ENOMEM);
- if (!(inode->i_state & I_NEW))
+ if (!(inode->i_state & I_NEW)) {
+ if ((err_str = check_igot_inode(inode, flags)) != NULL) {
+ ext4_error_inode(inode, function, line, 0, err_str);
+ iput(inode);
+ return ERR_PTR(-EFSCORRUPTED);
+ }
return inode;
+ }
ei = EXT4_I(inode);
iloc.bh = NULL;
@@ -5138,10 +5160,9 @@ struct inode *__ext4_iget(struct super_b
if (IS_CASEFOLDED(inode) && !ext4_has_feature_casefold(inode->i_sb))
ext4_error_inode(inode, function, line, 0,
"casefold flag without casefold feature");
- if (is_bad_inode(inode) && !(flags & EXT4_IGET_BAD)) {
- ext4_error_inode(inode, function, line, 0,
- "bad inode without EXT4_IGET_BAD flag");
- ret = -EUCLEAN;
+ if ((err_str = check_igot_inode(inode, flags)) != NULL) {
+ ext4_error_inode(inode, function, line, 0, err_str);
+ ret = -EFSCORRUPTED;
goto bad_inode;
}
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -433,7 +433,7 @@ static int ext4_xattr_inode_iget(struct
return -EFSCORRUPTED;
}
- inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_NORMAL);
+ inode = ext4_iget(parent->i_sb, ea_ino, EXT4_IGET_EA_INODE);
if (IS_ERR(inode)) {
err = PTR_ERR(inode);
ext4_error(parent->i_sb,
@@ -441,23 +441,6 @@ static int ext4_xattr_inode_iget(struct
err);
return err;
}
-
- if (is_bad_inode(inode)) {
- ext4_error(parent->i_sb,
- "error while reading EA inode %lu is_bad_inode",
- ea_ino);
- err = -EIO;
- goto error;
- }
-
- if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL)) {
- ext4_error(parent->i_sb,
- "EA inode %lu does not have EXT4_EA_INODE_FL flag",
- ea_ino);
- err = -EINVAL;
- goto error;
- }
-
ext4_xattr_inode_set_class(inode);
/*
@@ -478,9 +461,6 @@ static int ext4_xattr_inode_iget(struct
*ea_inode = inode;
return 0;
-error:
- iput(inode);
- return err;
}
/* Remove entry from mbcache when EA inode is getting evicted */
@@ -1557,11 +1537,10 @@ ext4_xattr_inode_cache_find(struct inode
while (ce) {
ea_inode = ext4_iget(inode->i_sb, ce->e_value,
- EXT4_IGET_NORMAL);
- if (!IS_ERR(ea_inode) &&
- !is_bad_inode(ea_inode) &&
- (EXT4_I(ea_inode)->i_flags & EXT4_EA_INODE_FL) &&
- i_size_read(ea_inode) == value_len &&
+ EXT4_IGET_EA_INODE);
+ if (IS_ERR(ea_inode))
+ goto next_entry;
+ if (i_size_read(ea_inode) == value_len &&
!ext4_xattr_inode_read(ea_inode, ea_data, value_len) &&
!ext4_xattr_inode_verify_hashes(ea_inode, NULL, ea_data,
value_len) &&
@@ -1571,9 +1550,8 @@ ext4_xattr_inode_cache_find(struct inode
kvfree(ea_data);
return ea_inode;
}
-
- if (!IS_ERR(ea_inode))
- iput(ea_inode);
+ iput(ea_inode);
+ next_entry:
ce = mb_cache_entry_find_next(ea_inode_cache, ce);
}
kvfree(ea_data);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 260/286] ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 259/286] ext4: add EA_INODE checking to ext4_iget() Greg Kroah-Hartman
@ 2023-06-07 20:15 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 261/286] ext4: disallow ea_inodes with extended attributes Greg Kroah-Hartman
` (34 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:15 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+d4b971e744b1f5439336,
Theodore Tso
From: Theodore Ts'o <tytso@mit.edu>
commit b928dfdcb27d8fa59917b794cfba53052a2f050f upstream.
If the ea_inode has been pushed out of the inode cache while there is
still a reference in the mb_cache, the lockdep subclass will not be
set on the inode, which can lead to some lockdep false positives.
Fixes: 33d201e0277b ("ext4: fix lockdep warning about recursive inode locking")
Cc: stable@kernel.org
Reported-by: syzbot+d4b971e744b1f5439336@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230524034951.779531-3-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/xattr.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -1540,6 +1540,7 @@ ext4_xattr_inode_cache_find(struct inode
EXT4_IGET_EA_INODE);
if (IS_ERR(ea_inode))
goto next_entry;
+ ext4_xattr_inode_set_class(ea_inode);
if (i_size_read(ea_inode) == value_len &&
!ext4_xattr_inode_read(ea_inode, ea_data, value_len) &&
!ext4_xattr_inode_verify_hashes(ea_inode, NULL, ea_data,
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 261/286] ext4: disallow ea_inodes with extended attributes
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2023-06-07 20:15 ` [PATCH 6.3 260/286] ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 262/286] ext4: add lockdep annotations for i_data_sem for ea_inodes Greg Kroah-Hartman
` (33 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+e44749b6ba4d0434cd47,
Theodore Tso
From: Theodore Ts'o <tytso@mit.edu>
commit 2bc7e7c1a3bc9bd0cbf0f71006f6fe7ef24a00c2 upstream.
An ea_inode stores the value of an extended attribute; it can not have
extended attributes itself, or this will cause recursive nightmares.
Add a check in ext4_iget() to make sure this is the case.
Cc: stable@kernel.org
Reported-by: syzbot+e44749b6ba4d0434cd47@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230524034951.779531-4-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/inode.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -4841,6 +4841,9 @@ static const char *check_igot_inode(stru
if (flags & EXT4_IGET_EA_INODE) {
if (!(EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL))
return "missing EA_INODE flag";
+ if (ext4_test_inode_state(inode, EXT4_STATE_XATTR) ||
+ EXT4_I(inode)->i_file_acl)
+ return "ea_inode with extended attributes";
} else {
if ((EXT4_I(inode)->i_flags & EXT4_EA_INODE_FL))
return "unexpected EA_INODE flag";
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 262/286] ext4: add lockdep annotations for i_data_sem for ea_inodes
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 261/286] ext4: disallow ea_inodes with extended attributes Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 263/286] fbcon: Fix null-ptr-deref in soft_cursor Greg Kroah-Hartman
` (32 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, syzbot+298c5d8fb4a128bc27b0,
Theodore Tso
From: Theodore Ts'o <tytso@mit.edu>
commit aff3bea95388299eec63440389b4545c8041b357 upstream.
Treat i_data_sem for ea_inodes as being in their own lockdep class to
avoid lockdep complaints about ext4_setattr's use of inode_lock() on
normal inodes potentially causing lock ordering with i_data_sem on
ea_inodes in ext4_xattr_inode_write(). However, ea_inodes will be
operated on by ext4_setattr(), so this isn't a problem.
Cc: stable@kernel.org
Link: https://syzkaller.appspot.com/bug?extid=298c5d8fb4a128bc27b0
Reported-by: syzbot+298c5d8fb4a128bc27b0@syzkaller.appspotmail.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230524034951.779531-5-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/ext4.h | 2 ++
fs/ext4/xattr.c | 4 ++++
2 files changed, 6 insertions(+)
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1007,11 +1007,13 @@ do { \
* where the second inode has larger inode number
* than the first
* I_DATA_SEM_QUOTA - Used for quota inodes only
+ * I_DATA_SEM_EA - Used for ea_inodes only
*/
enum {
I_DATA_SEM_NORMAL = 0,
I_DATA_SEM_OTHER,
I_DATA_SEM_QUOTA,
+ I_DATA_SEM_EA
};
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c
@@ -125,7 +125,11 @@ ext4_expand_inode_array(struct ext4_xatt
#ifdef CONFIG_LOCKDEP
void ext4_xattr_inode_set_class(struct inode *ea_inode)
{
+ struct ext4_inode_info *ei = EXT4_I(ea_inode);
+
lockdep_set_subclass(&ea_inode->i_rwsem, 1);
+ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */
+ lockdep_set_subclass(&ei->i_data_sem, I_DATA_SEM_EA);
}
#endif
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 263/286] fbcon: Fix null-ptr-deref in soft_cursor
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 262/286] ext4: add lockdep annotations for i_data_sem for ea_inodes Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 264/286] serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() Greg Kroah-Hartman
` (31 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Helge Deller,
syzbot+d910bd780e6efac35869, Sam Ravnborg, stable
From: Helge Deller <deller@gmx.de>
commit d78bd6cc68276bd57f766f7cb98bfe32c23ab327 upstream.
syzbot repored this bug in the softcursor code:
BUG: KASAN: null-ptr-deref in soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
Read of size 16 at addr 0000000000000200 by task kworker/u4:1/12
CPU: 0 PID: 12 Comm: kworker/u4:1 Not tainted 6.4.0-rc3-syzkaller-geb0f1697d729 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
Workqueue: events_power_efficient fb_flashcursor
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233
show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
print_report+0xe4/0x514 mm/kasan/report.c:465
kasan_report+0xd4/0x130 mm/kasan/report.c:572
kasan_check_range+0x264/0x2a4 mm/kasan/generic.c:187
__asan_memcpy+0x3c/0x84 mm/kasan/shadow.c:105
soft_cursor+0x384/0x6b4 drivers/video/fbdev/core/softcursor.c:70
bit_cursor+0x113c/0x1a64 drivers/video/fbdev/core/bitblit.c:377
fb_flashcursor+0x35c/0x54c drivers/video/fbdev/core/fbcon.c:380
process_one_work+0x788/0x12d4 kernel/workqueue.c:2405
worker_thread+0x8e0/0xfe8 kernel/workqueue.c:2552
kthread+0x288/0x310 kernel/kthread.c:379
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:853
This fix let bit_cursor() bail out early when a font bitmap
isn't available yet.
Signed-off-by: Helge Deller <deller@gmx.de>
Reported-by: syzbot+d910bd780e6efac35869@syzkaller.appspotmail.com
Acked-by: Sam Ravnborg <sam@ravnborg.org>
Cc: stable@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/bitblit.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/video/fbdev/core/bitblit.c
+++ b/drivers/video/fbdev/core/bitblit.c
@@ -247,6 +247,9 @@ static void bit_cursor(struct vc_data *v
cursor.set = 0;
+ if (!vc->vc_font.data)
+ return;
+
c = scr_readw((u16 *) vc->vc_pos);
attribute = get_attribute(info, c);
src = vc->vc_font.data + ((c & charmask) * (w * vc->vc_font.height));
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 264/286] serial: 8250_tegra: Fix an error handling path in tegra_uart_probe()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 263/286] fbcon: Fix null-ptr-deref in soft_cursor Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 265/286] serial: cpm_uart: Fix a COMPILE_TEST dependency Greg Kroah-Hartman
` (30 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Christophe JAILLET
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
commit 134f49dec0b6aca3259cd8259de4c572048bd207 upstream.
If an error occurs after reset_control_deassert(), it must be re-asserted,
as already done in the .remove() function.
Fixes: c6825c6395b7 ("serial: 8250_tegra: Create Tegra specific 8250 driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Link: https://lore.kernel.org/r/f8130f35339cc80edc6b9aac4bb2a60b60a226bf.1684063511.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_tegra.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/8250/8250_tegra.c
+++ b/drivers/tty/serial/8250/8250_tegra.c
@@ -112,13 +112,15 @@ static int tegra_uart_probe(struct platf
ret = serial8250_register_8250_port(&port8250);
if (ret < 0)
- goto err_clkdisable;
+ goto err_ctrl_assert;
platform_set_drvdata(pdev, uart);
uart->line = ret;
return 0;
+err_ctrl_assert:
+ reset_control_assert(uart->rst);
err_clkdisable:
clk_disable_unprepare(uart->clk);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 265/286] serial: cpm_uart: Fix a COMPILE_TEST dependency
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 264/286] serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 266/286] powerpc/xmon: Use KSYM_NAME_LEN in array size Greg Kroah-Hartman
` (29 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herve Codina, kernel test robot,
stable
From: Herve Codina <herve.codina@bootlin.com>
commit 7183c37fd53eee1e795206e625da12a5d7ec1e1a upstream.
In a COMPILE_TEST configuration, the cpm_uart driver uses symbols from
the cpm_uart_cpm2.c file. This file is compiled only when CONFIG_CPM2 is
set.
Without this dependency, the linker fails with some missing symbols for
COMPILE_TEST configuration that needs SERIAL_CPM without enabling CPM2.
This lead to:
depends on CPM2 || CPM1 || (PPC32 && CPM2 && COMPILE_TEST)
This dependency does not make sense anymore and can be simplified
removing all the COMPILE_TEST part.
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/oe-kbuild-all/202305160221.9XgweObz-lkp@intel.com/
Fixes: e3e7b13bffae ("serial: allow COMPILE_TEST for some drivers")
Cc: stable <stable@kernel.org>
Link: https://lore.kernel.org/r/20230523085902.75837-3-herve.codina@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/Kconfig | 2 +-
drivers/tty/serial/cpm_uart/cpm_uart.h | 2 --
2 files changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/tty/serial/Kconfig
+++ b/drivers/tty/serial/Kconfig
@@ -769,7 +769,7 @@ config SERIAL_PMACZILOG_CONSOLE
config SERIAL_CPM
tristate "CPM SCC/SMC serial port support"
- depends on CPM2 || CPM1 || (PPC32 && COMPILE_TEST)
+ depends on CPM2 || CPM1
select SERIAL_CORE
help
This driver supports the SCC and SMC serial ports on Motorola
--- a/drivers/tty/serial/cpm_uart/cpm_uart.h
+++ b/drivers/tty/serial/cpm_uart/cpm_uart.h
@@ -19,8 +19,6 @@ struct gpio_desc;
#include "cpm_uart_cpm2.h"
#elif defined(CONFIG_CPM1)
#include "cpm_uart_cpm1.h"
-#elif defined(CONFIG_COMPILE_TEST)
-#include "cpm_uart_cpm2.h"
#endif
#define SERIAL_CPM_MAJOR 204
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 266/286] powerpc/xmon: Use KSYM_NAME_LEN in array size
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 265/286] serial: cpm_uart: Fix a COMPILE_TEST dependency Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 267/286] test_firmware: prevent race conditions by a correct implementation of locking Greg Kroah-Hartman
` (28 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Onkarnath, Maninder Singh,
Michael Ellerman
From: Maninder Singh <maninder1.s@samsung.com>
commit 719dfd5925e186e09a2a6f23016936ac436f3d78 upstream.
kallsyms_lookup() which in turn calls kallsyms_lookup_buildid() writes
to index "KSYM_NAME_LEN - 1".
Thus the array passed as namebuf to kallsyms_lookup() should be
KSYM_NAME_LEN in size.
In xmon.c the array was defined to be "128" bytes directly, without
using KSYM_NAME_LEN. Commit b8a94bfb3395 ("kallsyms: increase maximum
kernel symbol length to 512") changed the value to 512, but missed
updating the xmon code.
Fixes: b8a94bfb3395 ("kallsyms: increase maximum kernel symbol length to 512")
Cc: stable@vger.kernel.org # v6.1+
Co-developed-by: Onkarnath <onkarnath.1@samsung.com>
Signed-off-by: Onkarnath <onkarnath.1@samsung.com>
Signed-off-by: Maninder Singh <maninder1.s@samsung.com>
[mpe: Tweak change log wording and fix commit reference]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230529111337.352990-2-maninder1.s@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/xmon/xmon.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/powerpc/xmon/xmon.c
+++ b/arch/powerpc/xmon/xmon.c
@@ -88,7 +88,7 @@ static unsigned long ndump = 64;
static unsigned long nidump = 16;
static unsigned long ncsum = 4096;
static int termch;
-static char tmpstr[128];
+static char tmpstr[KSYM_NAME_LEN];
static int tracing_enabled;
static long bus_error_jmp[JMP_BUF_LEN];
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 267/286] test_firmware: prevent race conditions by a correct implementation of locking
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 266/286] powerpc/xmon: Use KSYM_NAME_LEN in array size Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 268/286] test_firmware: fix a memory leak with reqs buffer Greg Kroah-Hartman
` (27 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Chamberlain, Russ Weight,
Takashi Iwai, Tianfei Zhang, Shuah Khan, Colin Ian King,
Randy Dunlap, linux-kselftest, Dan Carpenter,
Mirsad Goran Todorovac
From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
commit 4acfe3dfde685a5a9eaec5555351918e2d7266a1 upstream.
Dan Carpenter spotted a race condition in a couple of situations like
these in the test_firmware driver:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
u8 val;
int ret;
ret = kstrtou8(buf, 10, &val);
if (ret)
return ret;
mutex_lock(&test_fw_mutex);
*(u8 *)cfg = val;
mutex_unlock(&test_fw_mutex);
/* Always return full write size even if we didn't consume all */
return size;
}
static ssize_t config_num_requests_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t count)
{
int rc;
mutex_lock(&test_fw_mutex);
if (test_fw_config->reqs) {
pr_err("Must call release_all_firmware prior to changing config\n");
rc = -EINVAL;
mutex_unlock(&test_fw_mutex);
goto out;
}
mutex_unlock(&test_fw_mutex);
rc = test_dev_config_update_u8(buf, count,
&test_fw_config->num_requests);
out:
return rc;
}
static ssize_t config_read_fw_idx_store(struct device *dev,
struct device_attribute *attr,
const char *buf, size_t count)
{
return test_dev_config_update_u8(buf, count,
&test_fw_config->read_fw_idx);
}
The function test_dev_config_update_u8() is called from both the locked
and the unlocked context, function config_num_requests_store() and
config_read_fw_idx_store() which can both be called asynchronously as
they are driver's methods, while test_dev_config_update_u8() and siblings
change their argument pointed to by u8 *cfg or similar pointer.
To avoid deadlock on test_fw_mutex, the lock is dropped before calling
test_dev_config_update_u8() and re-acquired within test_dev_config_update_u8()
itself, but alas this creates a race condition.
Having two locks wouldn't assure a race-proof mutual exclusion.
This situation is best avoided by the introduction of a new, unlocked
function __test_dev_config_update_u8() which can be called from the locked
context and reducing test_dev_config_update_u8() to:
static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
int ret;
mutex_lock(&test_fw_mutex);
ret = __test_dev_config_update_u8(buf, size, cfg);
mutex_unlock(&test_fw_mutex);
return ret;
}
doing the locking and calling the unlocked primitive, which enables both
locked and unlocked versions without duplication of code.
The similar approach was applied to all functions called from the locked
and the unlocked context, which safely mitigates both deadlocks and race
conditions in the driver.
__test_dev_config_update_bool(), __test_dev_config_update_u8() and
__test_dev_config_update_size_t() unlocked versions of the functions
were introduced to be called from the locked contexts as a workaround
without releasing the main driver's lock and thereof causing a race
condition.
The test_dev_config_update_bool(), test_dev_config_update_u8() and
test_dev_config_update_size_t() locked versions of the functions
are being called from driver methods without the unnecessary multiplying
of the locking and unlocking code for each method, and complicating
the code with saving of the return value across lock.
Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf")
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Russ Weight <russell.h.weight@intel.com>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Tianfei Zhang <tianfei.zhang@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: linux-kselftest@vger.kernel.org
Cc: stable@vger.kernel.org # v5.4
Suggested-by: Dan Carpenter <error27@gmail.com>
Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Link: https://lore.kernel.org/r/20230509084746.48259-1-mirsad.todorovac@alu.unizg.hr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/test_firmware.c | 52 +++++++++++++++++++++++++++++++++++-----------------
1 file changed, 35 insertions(+), 17 deletions(-)
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -353,16 +353,26 @@ static ssize_t config_test_show_str(char
return len;
}
-static int test_dev_config_update_bool(const char *buf, size_t size,
+static inline int __test_dev_config_update_bool(const char *buf, size_t size,
bool *cfg)
{
int ret;
- mutex_lock(&test_fw_mutex);
if (kstrtobool(buf, cfg) < 0)
ret = -EINVAL;
else
ret = size;
+
+ return ret;
+}
+
+static int test_dev_config_update_bool(const char *buf, size_t size,
+ bool *cfg)
+{
+ int ret;
+
+ mutex_lock(&test_fw_mutex);
+ ret = __test_dev_config_update_bool(buf, size, cfg);
mutex_unlock(&test_fw_mutex);
return ret;
@@ -373,7 +383,8 @@ static ssize_t test_dev_config_show_bool
return snprintf(buf, PAGE_SIZE, "%d\n", val);
}
-static int test_dev_config_update_size_t(const char *buf,
+static int __test_dev_config_update_size_t(
+ const char *buf,
size_t size,
size_t *cfg)
{
@@ -384,9 +395,7 @@ static int test_dev_config_update_size_t
if (ret)
return ret;
- mutex_lock(&test_fw_mutex);
*(size_t *)cfg = new;
- mutex_unlock(&test_fw_mutex);
/* Always return full write size even if we didn't consume all */
return size;
@@ -402,7 +411,7 @@ static ssize_t test_dev_config_show_int(
return snprintf(buf, PAGE_SIZE, "%d\n", val);
}
-static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
+static int __test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
{
u8 val;
int ret;
@@ -411,14 +420,23 @@ static int test_dev_config_update_u8(con
if (ret)
return ret;
- mutex_lock(&test_fw_mutex);
*(u8 *)cfg = val;
- mutex_unlock(&test_fw_mutex);
/* Always return full write size even if we didn't consume all */
return size;
}
+static int test_dev_config_update_u8(const char *buf, size_t size, u8 *cfg)
+{
+ int ret;
+
+ mutex_lock(&test_fw_mutex);
+ ret = __test_dev_config_update_u8(buf, size, cfg);
+ mutex_unlock(&test_fw_mutex);
+
+ return ret;
+}
+
static ssize_t test_dev_config_show_u8(char *buf, u8 val)
{
return snprintf(buf, PAGE_SIZE, "%u\n", val);
@@ -471,10 +489,10 @@ static ssize_t config_num_requests_store
mutex_unlock(&test_fw_mutex);
goto out;
}
- mutex_unlock(&test_fw_mutex);
- rc = test_dev_config_update_u8(buf, count,
- &test_fw_config->num_requests);
+ rc = __test_dev_config_update_u8(buf, count,
+ &test_fw_config->num_requests);
+ mutex_unlock(&test_fw_mutex);
out:
return rc;
@@ -518,10 +536,10 @@ static ssize_t config_buf_size_store(str
mutex_unlock(&test_fw_mutex);
goto out;
}
- mutex_unlock(&test_fw_mutex);
- rc = test_dev_config_update_size_t(buf, count,
- &test_fw_config->buf_size);
+ rc = __test_dev_config_update_size_t(buf, count,
+ &test_fw_config->buf_size);
+ mutex_unlock(&test_fw_mutex);
out:
return rc;
@@ -548,10 +566,10 @@ static ssize_t config_file_offset_store(
mutex_unlock(&test_fw_mutex);
goto out;
}
- mutex_unlock(&test_fw_mutex);
- rc = test_dev_config_update_size_t(buf, count,
- &test_fw_config->file_offset);
+ rc = __test_dev_config_update_size_t(buf, count,
+ &test_fw_config->file_offset);
+ mutex_unlock(&test_fw_mutex);
out:
return rc;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 268/286] test_firmware: fix a memory leak with reqs buffer
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 267/286] test_firmware: prevent race conditions by a correct implementation of locking Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 269/286] test_firmware: fix the memory leak of the allocated firmware buffer Greg Kroah-Hartman
` (26 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Chamberlain, Russ Weight,
Tianfei Zhang, Shuah Khan, Colin Ian King, Randy Dunlap,
linux-kselftest, Dan Carpenter, Takashi Iwai,
Mirsad Goran Todorovac, Dan Carpenter
From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
commit be37bed754ed90b2655382f93f9724b3c1aae847 upstream.
Dan Carpenter spotted that test_fw_config->reqs will be leaked if
trigger_batched_requests_store() is called two or more times.
The same appears with trigger_batched_requests_async_store().
This bug wasn't trigger by the tests, but observed by Dan's visual
inspection of the code.
The recommended workaround was to return -EBUSY if test_fw_config->reqs
is already allocated.
Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf")
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Russ Weight <russell.h.weight@intel.com>
Cc: Tianfei Zhang <tianfei.zhang@intel.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Randy Dunlap <rdunlap@infradead.org>
Cc: linux-kselftest@vger.kernel.org
Cc: stable@vger.kernel.org # v5.4
Suggested-by: Dan Carpenter <error27@gmail.com>
Suggested-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Acked-by: Luis Chamberlain <mcgrof@kernel.org>
Link: https://lore.kernel.org/r/20230509084746.48259-2-mirsad.todorovac@alu.unizg.hr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/test_firmware.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -913,6 +913,11 @@ static ssize_t trigger_batched_requests_
mutex_lock(&test_fw_mutex);
+ if (test_fw_config->reqs) {
+ rc = -EBUSY;
+ goto out_bail;
+ }
+
test_fw_config->reqs =
vzalloc(array3_size(sizeof(struct test_batched_req),
test_fw_config->num_requests, 2));
@@ -1011,6 +1016,11 @@ ssize_t trigger_batched_requests_async_s
mutex_lock(&test_fw_mutex);
+ if (test_fw_config->reqs) {
+ rc = -EBUSY;
+ goto out_bail;
+ }
+
test_fw_config->reqs =
vzalloc(array3_size(sizeof(struct test_batched_req),
test_fw_config->num_requests, 2));
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 269/286] test_firmware: fix the memory leak of the allocated firmware buffer
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 268/286] test_firmware: fix a memory leak with reqs buffer Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 270/286] KVM: arm64: Populate fault info for watchpoint Greg Kroah-Hartman
` (25 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirsad Goran Todorovac,
Dan Carpenter, Takashi Iwai, Luis Chamberlain, Russ Weight,
Tianfei zhang, Christophe JAILLET, Zhengchao Shao, Colin Ian King,
linux-kernel, Kees Cook, Scott Branden, linux-kselftest
From: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
commit 48e156023059e57a8fc68b498439832f7600ffff upstream.
The following kernel memory leak was noticed after running
tools/testing/selftests/firmware/fw_run_tests.sh:
[root@pc-mtodorov firmware]# cat /sys/kernel/debug/kmemleak
.
.
.
unreferenced object 0xffff955389bc3400 (size 1024):
comm "test_firmware-0", pid 5451, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
unreferenced object 0xffff9553c334b400 (size 1024):
comm "test_firmware-1", pid 5452, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
unreferenced object 0xffff9553c334f000 (size 1024):
comm "test_firmware-2", pid 5453, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
unreferenced object 0xffff9553c3348400 (size 1024):
comm "test_firmware-3", pid 5454, jiffies 4294944822 (age 65.652s)
hex dump (first 32 bytes):
47 48 34 35 36 37 0a 00 00 00 00 00 00 00 00 00 GH4567..........
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff962f5dec>] slab_post_alloc_hook+0x8c/0x3c0
[<ffffffff962fcca4>] __kmem_cache_alloc_node+0x184/0x240
[<ffffffff962704de>] kmalloc_trace+0x2e/0xc0
[<ffffffff9665b42d>] test_fw_run_batch_request+0x9d/0x180
[<ffffffff95fd813b>] kthread+0x10b/0x140
[<ffffffff95e033e9>] ret_from_fork+0x29/0x50
[root@pc-mtodorov firmware]#
Note that the size 1024 corresponds to the size of the test firmware
buffer. The actual number of the buffers leaked is around 70-110,
depending on the test run.
The cause of the leak is the following:
request_partial_firmware_into_buf() and request_firmware_into_buf()
provided firmware buffer isn't released on release_firmware(), we
have allocated it and we are responsible for deallocating it manually.
This is introduced in a number of context where previously only
release_firmware() was called, which was insufficient.
Reported-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Fixes: 7feebfa487b92 ("test_firmware: add support for request_firmware_into_buf")
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Dan Carpenter <error27@gmail.com>
Cc: Takashi Iwai <tiwai@suse.de>
Cc: Luis Chamberlain <mcgrof@kernel.org>
Cc: Russ Weight <russell.h.weight@intel.com>
Cc: Tianfei zhang <tianfei.zhang@intel.com>
Cc: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Cc: Zhengchao Shao <shaozhengchao@huawei.com>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: linux-kernel@vger.kernel.org
Cc: Kees Cook <keescook@chromium.org>
Cc: Scott Branden <sbranden@broadcom.com>
Cc: Luis R. Rodriguez <mcgrof@kernel.org>
Cc: linux-kselftest@vger.kernel.org
Cc: stable@vger.kernel.org # v5.4
Signed-off-by: Mirsad Goran Todorovac <mirsad.todorovac@alu.unizg.hr>
Link: https://lore.kernel.org/r/20230509084746.48259-3-mirsad.todorovac@alu.unizg.hr
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/test_firmware.c | 19 ++++++++++++++++++-
1 file changed, 18 insertions(+), 1 deletion(-)
--- a/lib/test_firmware.c
+++ b/lib/test_firmware.c
@@ -45,6 +45,7 @@ struct test_batched_req {
bool sent;
const struct firmware *fw;
const char *name;
+ const char *fw_buf;
struct completion completion;
struct task_struct *task;
struct device *dev;
@@ -175,8 +176,14 @@ static void __test_release_all_firmware(
for (i = 0; i < test_fw_config->num_requests; i++) {
req = &test_fw_config->reqs[i];
- if (req->fw)
+ if (req->fw) {
+ if (req->fw_buf) {
+ kfree_const(req->fw_buf);
+ req->fw_buf = NULL;
+ }
release_firmware(req->fw);
+ req->fw = NULL;
+ }
}
vfree(test_fw_config->reqs);
@@ -670,6 +677,8 @@ static ssize_t trigger_request_store(str
mutex_lock(&test_fw_mutex);
release_firmware(test_firmware);
+ if (test_fw_config->reqs)
+ __test_release_all_firmware();
test_firmware = NULL;
rc = request_firmware(&test_firmware, name, dev);
if (rc) {
@@ -770,6 +779,8 @@ static ssize_t trigger_async_request_sto
mutex_lock(&test_fw_mutex);
release_firmware(test_firmware);
test_firmware = NULL;
+ if (test_fw_config->reqs)
+ __test_release_all_firmware();
rc = request_firmware_nowait(THIS_MODULE, 1, name, dev, GFP_KERNEL,
NULL, trigger_async_request_cb);
if (rc) {
@@ -812,6 +823,8 @@ static ssize_t trigger_custom_fallback_s
mutex_lock(&test_fw_mutex);
release_firmware(test_firmware);
+ if (test_fw_config->reqs)
+ __test_release_all_firmware();
test_firmware = NULL;
rc = request_firmware_nowait(THIS_MODULE, FW_ACTION_NOUEVENT, name,
dev, GFP_KERNEL, NULL,
@@ -874,6 +887,8 @@ static int test_fw_run_batch_request(voi
test_fw_config->buf_size);
if (!req->fw)
kfree(test_buf);
+ else
+ req->fw_buf = test_buf;
} else {
req->rc = test_fw_config->req_firmware(&req->fw,
req->name,
@@ -934,6 +949,7 @@ static ssize_t trigger_batched_requests_
req->fw = NULL;
req->idx = i;
req->name = test_fw_config->name;
+ req->fw_buf = NULL;
req->dev = dev;
init_completion(&req->completion);
req->task = kthread_run(test_fw_run_batch_request, req,
@@ -1038,6 +1054,7 @@ ssize_t trigger_batched_requests_async_s
for (i = 0; i < test_fw_config->num_requests; i++) {
req = &test_fw_config->reqs[i];
req->name = test_fw_config->name;
+ req->fw_buf = NULL;
req->fw = NULL;
req->idx = i;
init_completion(&req->completion);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 270/286] KVM: arm64: Populate fault info for watchpoint
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 269/286] test_firmware: fix the memory leak of the allocated firmware buffer Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 271/286] KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed() Greg Kroah-Hartman
` (24 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Akihiko Odaki
From: Akihiko Odaki <akihiko.odaki@daynix.com>
commit 811154e234db72f0a11557a84ba9640f8b3bc823 upstream.
When handling ESR_ELx_EC_WATCHPT_LOW, far_el2 member of struct
kvm_vcpu_fault_info will be copied to far member of struct
kvm_debug_exit_arch and exposed to the userspace. The userspace will
see stale values from older faults if the fault info does not get
populated.
Fixes: 8fb2046180a0 ("KVM: arm64: Move early handlers to per-EC handlers")
Suggested-by: Marc Zyngier <maz@kernel.org>
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230530024651.10014-1-akihiko.odaki@daynix.com
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/hyp/include/hyp/switch.h | 8 ++++++--
arch/arm64/kvm/hyp/nvhe/switch.c | 2 ++
arch/arm64/kvm/hyp/vhe/switch.c | 1 +
3 files changed, 9 insertions(+), 2 deletions(-)
--- a/arch/arm64/kvm/hyp/include/hyp/switch.h
+++ b/arch/arm64/kvm/hyp/include/hyp/switch.h
@@ -351,17 +351,21 @@ static bool kvm_hyp_handle_cp15_32(struc
return false;
}
-static bool kvm_hyp_handle_iabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
+static bool kvm_hyp_handle_memory_fault(struct kvm_vcpu *vcpu, u64 *exit_code)
{
if (!__populate_fault_info(vcpu))
return true;
return false;
}
+static bool kvm_hyp_handle_iabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
+ __alias(kvm_hyp_handle_memory_fault);
+static bool kvm_hyp_handle_watchpt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
+ __alias(kvm_hyp_handle_memory_fault);
static bool kvm_hyp_handle_dabt_low(struct kvm_vcpu *vcpu, u64 *exit_code)
{
- if (!__populate_fault_info(vcpu))
+ if (kvm_hyp_handle_memory_fault(vcpu, exit_code))
return true;
if (static_branch_unlikely(&vgic_v2_cpuif_trap)) {
--- a/arch/arm64/kvm/hyp/nvhe/switch.c
+++ b/arch/arm64/kvm/hyp/nvhe/switch.c
@@ -186,6 +186,7 @@ static const exit_handler_fn hyp_exit_ha
[ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd,
[ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low,
[ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low,
+ [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low,
[ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth,
};
@@ -196,6 +197,7 @@ static const exit_handler_fn pvm_exit_ha
[ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd,
[ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low,
[ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low,
+ [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low,
[ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth,
};
--- a/arch/arm64/kvm/hyp/vhe/switch.c
+++ b/arch/arm64/kvm/hyp/vhe/switch.c
@@ -110,6 +110,7 @@ static const exit_handler_fn hyp_exit_ha
[ESR_ELx_EC_FP_ASIMD] = kvm_hyp_handle_fpsimd,
[ESR_ELx_EC_IABT_LOW] = kvm_hyp_handle_iabt_low,
[ESR_ELx_EC_DABT_LOW] = kvm_hyp_handle_dabt_low,
+ [ESR_ELx_EC_WATCHPT_LOW] = kvm_hyp_handle_watchpt_low,
[ESR_ELx_EC_PAC] = kvm_hyp_handle_ptrauth,
};
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 271/286] KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 270/286] KVM: arm64: Populate fault info for watchpoint Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 272/286] KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker Greg Kroah-Hartman
` (23 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yu Zhao, Oliver Upton, Marc Zyngier
From: Oliver Upton <oliver.upton@linux.dev>
commit f6a27d6dc51b288106adaf053cff9c9b9cc12c4e upstream.
The reference count on page table allocations is increased for every
'counted' PTE (valid or donated) in the table in addition to the initial
reference from ->zalloc_page(). kvm_pgtable_stage2_free_removed() fails
to drop the last reference on the root of the table walk, meaning we
leak memory.
Fix it by dropping the last reference after the free walker returns,
at which point all references for 'counted' PTEs have been released.
Cc: stable@vger.kernel.org
Fixes: 5c359cca1faf ("KVM: arm64: Tear down unlinked stage-2 subtree after break-before-make")
Reported-by: Yu Zhao <yuzhao@google.com>
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Tested-by: Yu Zhao <yuzhao@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20230530193213.1663411-1-oliver.upton@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/hyp/pgtable.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/arm64/kvm/hyp/pgtable.c
+++ b/arch/arm64/kvm/hyp/pgtable.c
@@ -1333,4 +1333,7 @@ void kvm_pgtable_stage2_free_removed(str
};
WARN_ON(__kvm_pgtable_walk(&data, mm_ops, ptep, level + 1));
+
+ WARN_ON(mm_ops->page_count(pgtable) != 1);
+ mm_ops->put_page(pgtable);
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 272/286] KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 271/286] KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed() Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 273/286] KVM: x86: Account fastpath-only VM-Exits in vCPU stats Greg Kroah-Hartman
` (22 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Fabio Coatti, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit 817fa998362d6ea9fabd5e97af8e9e2eb5f0e6f2 upstream.
Factor in the address space (non-SMM vs. SMM) of the target shadow page
when recovering potential NX huge pages, otherwise KVM will retrieve the
wrong memslot when zapping shadow pages that were created for SMM. The
bug most visibly manifests as a WARN on the memslot being non-NULL, but
the worst case scenario is that KVM could unaccount the shadow page
without ensuring KVM won't install a huge page, i.e. if the non-SMM slot
is being dirty logged, but the SMM slot is not.
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3911 at arch/x86/kvm/mmu/mmu.c:7015
kvm_nx_huge_page_recovery_worker+0x38c/0x3d0 [kvm]
CPU: 1 PID: 3911 Comm: kvm-nx-lpage-re
RIP: 0010:kvm_nx_huge_page_recovery_worker+0x38c/0x3d0 [kvm]
RSP: 0018:ffff99b284f0be68 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffff99b284edd000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff9271397024e0 R08: 0000000000000000 R09: ffff927139702450
R10: 0000000000000000 R11: 0000000000000001 R12: ffff99b284f0be98
R13: 0000000000000000 R14: ffff9270991fcd80 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff927f9f640000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0aacad3ae0 CR3: 000000088fc2c005 CR4: 00000000003726e0
Call Trace:
<TASK>
__pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [kvm]
kvm_vm_worker_thread+0x106/0x1c0 [kvm]
kthread+0xd9/0x100
ret_from_fork+0x2c/0x50
</TASK>
---[ end trace 0000000000000000 ]---
This bug was exposed by commit edbdb43fc96b ("KVM: x86: Preserve TDP MMU
roots until they are explicitly invalidated"), which allowed KVM to retain
SMM TDP MMU roots effectively indefinitely. Before commit edbdb43fc96b,
KVM would zap all SMM TDP MMU roots and thus all SMM TDP MMU shadow pages
once all vCPUs exited SMM, which made the window where this bug (recovering
an SMM NX huge page) could be encountered quite tiny. To hit the bug, the
NX recovery thread would have to run while at least one vCPU was in SMM.
Most VMs typically only use SMM during boot, and so the problematic shadow
pages were gone by the time the NX recovery thread ran.
Now that KVM preserves TDP MMU roots until they are explicitly invalidated
(e.g. by a memslot deletion), the window to trigger the bug is effectively
never closed because most VMMs don't delete memslots after boot (except
for a handful of special scenarios).
Fixes: eb298605705a ("KVM: x86/mmu: Do not recover dirty-tracked NX Huge Pages")
Reported-by: Fabio Coatti <fabio.coatti@gmail.com>
Closes: https://lore.kernel.org/all/CADpTngX9LESCdHVu_2mQkNGena_Ng2CphWNwsRGSMxzDsTjU2A@mail.gmail.com
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230602010137.784664-1-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/mmu/mmu.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/arch/x86/kvm/mmu/mmu.c
+++ b/arch/x86/kvm/mmu/mmu.c
@@ -7011,7 +7011,10 @@ static void kvm_recover_nx_huge_pages(st
*/
slot = NULL;
if (atomic_read(&kvm->nr_memslots_dirty_logging)) {
- slot = gfn_to_memslot(kvm, sp->gfn);
+ struct kvm_memslots *slots;
+
+ slots = kvm_memslots_for_spte_role(kvm, sp->role);
+ slot = __gfn_to_memslot(slots, sp->gfn);
WARN_ON_ONCE(!slot);
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 273/286] KVM: x86: Account fastpath-only VM-Exits in vCPU stats
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 272/286] KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 274/286] KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds Greg Kroah-Hartman
` (21 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit 8b703a49c9df5e74870381ad7ba9c85d8a74ed2c upstream.
Increment vcpu->stat.exits when handling a fastpath VM-Exit without
going through any part of the "slow" path. Not bumping the exits stat
can result in wildly misleading exit counts, e.g. if the primary reason
the guest is exiting is to program the TSC deadline timer.
Fixes: 404d5d7bff0d ("KVM: X86: Introduce more exit_fastpath_completion enum values")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230602011920.787844-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/x86.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -10682,6 +10682,9 @@ static int vcpu_enter_guest(struct kvm_v
exit_fastpath = EXIT_FASTPATH_EXIT_HANDLED;
break;
}
+
+ /* Note, VM-Exits that go down the "slow" path are accounted below. */
+ ++vcpu->stat.exits;
}
/*
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 274/286] KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 273/286] KVM: x86: Account fastpath-only VM-Exits in vCPU stats Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 275/286] ksmbd: fix credit count leakage Greg Kroah-Hartman
` (20 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michal Luczaj, Sean Christopherson
From: Sean Christopherson <seanjc@google.com>
commit 4364b287982bd05bfafa461c80650c732001974b upstream.
Bail from kvm_recalculate_phys_map() and disable the optimized map if the
target vCPU's x2APIC ID is out-of-bounds, i.e. if the vCPU was added
and/or enabled its local APIC after the map was allocated. This fixes an
out-of-bounds access bug in the !x2apic_format path where KVM would write
beyond the end of phys_map.
Check the x2APIC ID regardless of whether or not x2APIC is enabled,
as KVM's hardcodes x2APIC ID to be the vCPU ID, i.e. it can't change, and
the map allocation in kvm_recalculate_apic_map() doesn't check for x2APIC
being enabled, i.e. the check won't get false postivies.
Note, this also affects the x2apic_format path, which previously just
ignored the "x2apic_id > new->max_apic_id" case. That too is arguably a
bug fix, as ignoring the vCPU meant that KVM would not send interrupts to
the vCPU until the next map recalculation. In practice, that "bug" is
likely benign as a newly present vCPU/APIC would immediately trigger a
recalc. But, there's no functional downside to disabling the map, and
a future patch will gracefully handle the -E2BIG case by retrying instead
of simply disabling the optimized map.
Opportunistically add a sanity check on the xAPIC ID size, along with a
comment explaining why the xAPIC ID is guaranteed to be "good".
Reported-by: Michal Luczaj <mhal@rbox.co>
Fixes: 5b84b0291702 ("KVM: x86: Honor architectural behavior for aliased 8-bit APIC IDs")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230602233250.1014316-2-seanjc@google.com
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/lapic.c | 20 ++++++++++++++++++--
1 file changed, 18 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -229,6 +229,23 @@ static int kvm_recalculate_phys_map(stru
u32 physical_id;
/*
+ * For simplicity, KVM always allocates enough space for all possible
+ * xAPIC IDs. Yell, but don't kill the VM, as KVM can continue on
+ * without the optimized map.
+ */
+ if (WARN_ON_ONCE(xapic_id > new->max_apic_id))
+ return -EINVAL;
+
+ /*
+ * Bail if a vCPU was added and/or enabled its APIC between allocating
+ * the map and doing the actual calculations for the map. Note, KVM
+ * hardcodes the x2APIC ID to vcpu_id, i.e. there's no TOCTOU bug if
+ * the compiler decides to reload x2apic_id after this check.
+ */
+ if (x2apic_id > new->max_apic_id)
+ return -E2BIG;
+
+ /*
* Deliberately truncate the vCPU ID when detecting a mismatched APIC
* ID to avoid false positives if the vCPU ID, i.e. x2APIC ID, is a
* 32-bit value. Any unwanted aliasing due to truncation results will
@@ -253,8 +270,7 @@ static int kvm_recalculate_phys_map(stru
*/
if (vcpu->kvm->arch.x2apic_format) {
/* See also kvm_apic_match_physical_addr(). */
- if ((apic_x2apic_mode(apic) || x2apic_id > 0xff) &&
- x2apic_id <= new->max_apic_id)
+ if (apic_x2apic_mode(apic) || x2apic_id > 0xff)
new->phys_map[x2apic_id] = apic;
if (!apic_x2apic_mode(apic) && !new->phys_map[xapic_id])
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 275/286] ksmbd: fix credit count leakage
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 274/286] KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 276/286] ksmbd: fix UAF issue from opinfo->conn Greg Kroah-Hartman
` (19 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 84c5aa47925a1f40d698b6a6a2bf67e99617433d upstream.
This patch fix the failure from smb2.credits.single_req_credits_granted
test. When client send 8192 credit request, ksmbd return 8191 credit
granted. ksmbd should give maximum possible credits that must be granted
within the range of not exceeding the max credit to client.
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2pdu.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -326,13 +326,9 @@ int smb2_set_rsp_credits(struct ksmbd_wo
if (hdr->Command == SMB2_NEGOTIATE)
aux_max = 1;
else
- aux_max = conn->vals->max_credits - credit_charge;
+ aux_max = conn->vals->max_credits - conn->total_credits;
credits_granted = min_t(unsigned short, credits_requested, aux_max);
- if (conn->vals->max_credits - conn->total_credits < credits_granted)
- credits_granted = conn->vals->max_credits -
- conn->total_credits;
-
conn->total_credits += credits_granted;
work->credits_granted += credits_granted;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 276/286] ksmbd: fix UAF issue from opinfo->conn
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 275/286] ksmbd: fix credit count leakage Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 277/286] ksmbd: fix incorrect AllocationSize set in smb2_get_info Greg Kroah-Hartman
` (18 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Per Forlin, Namjae Jeon,
Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 36322523dddb11107e9f7f528675a0dec2536103 upstream.
If opinfo->conn is another connection and while ksmbd send oplock break
request to cient on current connection, The connection for opinfo->conn
can be disconnect and conn could be freed. When sending oplock break
request, this ksmbd_conn can be used and cause user-after-free issue.
When getting opinfo from the list, ksmbd check connection is being
released. If it is not released, Increase ->r_count to wait that connection
is freed.
Cc: stable@vger.kernel.org
Reported-by: Per Forlin <per.forlin@axis.com>
Tested-by: Per Forlin <per.forlin@axis.com>
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/oplock.c | 72 +++++++++++++++++++++++++++++++++++-------------------
1 file changed, 47 insertions(+), 25 deletions(-)
--- a/fs/ksmbd/oplock.c
+++ b/fs/ksmbd/oplock.c
@@ -157,13 +157,42 @@ static struct oplock_info *opinfo_get_li
rcu_read_lock();
opinfo = list_first_or_null_rcu(&ci->m_op_list, struct oplock_info,
op_entry);
- if (opinfo && !atomic_inc_not_zero(&opinfo->refcount))
- opinfo = NULL;
+ if (opinfo) {
+ if (!atomic_inc_not_zero(&opinfo->refcount))
+ opinfo = NULL;
+ else {
+ atomic_inc(&opinfo->conn->r_count);
+ if (ksmbd_conn_releasing(opinfo->conn)) {
+ atomic_dec(&opinfo->conn->r_count);
+ atomic_dec(&opinfo->refcount);
+ opinfo = NULL;
+ }
+ }
+ }
+
rcu_read_unlock();
return opinfo;
}
+static void opinfo_conn_put(struct oplock_info *opinfo)
+{
+ struct ksmbd_conn *conn;
+
+ if (!opinfo)
+ return;
+
+ conn = opinfo->conn;
+ /*
+ * Checking waitqueue to dropping pending requests on
+ * disconnection. waitqueue_active is safe because it
+ * uses atomic operation for condition.
+ */
+ if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
+ wake_up(&conn->r_count_q);
+ opinfo_put(opinfo);
+}
+
void opinfo_put(struct oplock_info *opinfo)
{
if (!atomic_dec_and_test(&opinfo->refcount))
@@ -666,13 +695,6 @@ static void __smb2_oplock_break_noti(str
out:
ksmbd_free_work_struct(work);
- /*
- * Checking waitqueue to dropping pending requests on
- * disconnection. waitqueue_active is safe because it
- * uses atomic operation for condition.
- */
- if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
- wake_up(&conn->r_count_q);
}
/**
@@ -706,7 +728,6 @@ static int smb2_oplock_break_noti(struct
work->conn = conn;
work->sess = opinfo->sess;
- atomic_inc(&conn->r_count);
if (opinfo->op_state == OPLOCK_ACK_WAIT) {
INIT_WORK(&work->work, __smb2_oplock_break_noti);
ksmbd_queue_work(work);
@@ -776,13 +797,6 @@ static void __smb2_lease_break_noti(stru
out:
ksmbd_free_work_struct(work);
- /*
- * Checking waitqueue to dropping pending requests on
- * disconnection. waitqueue_active is safe because it
- * uses atomic operation for condition.
- */
- if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q))
- wake_up(&conn->r_count_q);
}
/**
@@ -822,7 +836,6 @@ static int smb2_lease_break_noti(struct
work->conn = conn;
work->sess = opinfo->sess;
- atomic_inc(&conn->r_count);
if (opinfo->op_state == OPLOCK_ACK_WAIT) {
list_for_each_safe(tmp, t, &opinfo->interim_list) {
struct ksmbd_work *in_work;
@@ -1144,8 +1157,10 @@ int smb_grant_oplock(struct ksmbd_work *
}
prev_opinfo = opinfo_get_list(ci);
if (!prev_opinfo ||
- (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx))
+ (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx)) {
+ opinfo_conn_put(prev_opinfo);
goto set_lev;
+ }
prev_op_has_lease = prev_opinfo->is_lease;
if (prev_op_has_lease)
prev_op_state = prev_opinfo->o_lease->state;
@@ -1153,19 +1168,19 @@ int smb_grant_oplock(struct ksmbd_work *
if (share_ret < 0 &&
prev_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
err = share_ret;
- opinfo_put(prev_opinfo);
+ opinfo_conn_put(prev_opinfo);
goto err_out;
}
if (prev_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH &&
prev_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
- opinfo_put(prev_opinfo);
+ opinfo_conn_put(prev_opinfo);
goto op_break_not_needed;
}
list_add(&work->interim_entry, &prev_opinfo->interim_list);
err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II);
- opinfo_put(prev_opinfo);
+ opinfo_conn_put(prev_opinfo);
if (err == -ENOENT)
goto set_lev;
/* Check all oplock was freed by close */
@@ -1228,14 +1243,14 @@ static void smb_break_all_write_oplock(s
return;
if (brk_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH &&
brk_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) {
- opinfo_put(brk_opinfo);
+ opinfo_conn_put(brk_opinfo);
return;
}
brk_opinfo->open_trunc = is_trunc;
list_add(&work->interim_entry, &brk_opinfo->interim_list);
oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II);
- opinfo_put(brk_opinfo);
+ opinfo_conn_put(brk_opinfo);
}
/**
@@ -1263,6 +1278,13 @@ void smb_break_all_levII_oplock(struct k
list_for_each_entry_rcu(brk_op, &ci->m_op_list, op_entry) {
if (!atomic_inc_not_zero(&brk_op->refcount))
continue;
+
+ atomic_inc(&brk_op->conn->r_count);
+ if (ksmbd_conn_releasing(brk_op->conn)) {
+ atomic_dec(&brk_op->conn->r_count);
+ continue;
+ }
+
rcu_read_unlock();
if (brk_op->is_lease && (brk_op->o_lease->state &
(~(SMB2_LEASE_READ_CACHING_LE |
@@ -1292,7 +1314,7 @@ void smb_break_all_levII_oplock(struct k
brk_op->open_trunc = is_trunc;
oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE);
next:
- opinfo_put(brk_op);
+ opinfo_conn_put(brk_op);
rcu_read_lock();
}
rcu_read_unlock();
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 277/286] ksmbd: fix incorrect AllocationSize set in smb2_get_info
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 276/286] ksmbd: fix UAF issue from opinfo->conn Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 278/286] ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate Greg Kroah-Hartman
` (17 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Namjae Jeon, Steve French
From: Namjae Jeon <linkinjeon@kernel.org>
commit 6cc2268f5647cbfde3d4fc2e4ee005070ea3a8d2 upstream.
If filesystem support sparse file, ksmbd should return allocated size
using ->i_blocks instead of stat->size. This fix generic/694 xfstests.
Cc: stable@vger.kernel.org
Signed-off-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2pdu.c | 21 +++------------------
1 file changed, 3 insertions(+), 18 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -4380,21 +4380,6 @@ static int get_file_basic_info(struct sm
return 0;
}
-static unsigned long long get_allocation_size(struct inode *inode,
- struct kstat *stat)
-{
- unsigned long long alloc_size = 0;
-
- if (!S_ISDIR(stat->mode)) {
- if ((inode->i_blocks << 9) <= stat->size)
- alloc_size = stat->size;
- else
- alloc_size = inode->i_blocks << 9;
- }
-
- return alloc_size;
-}
-
static void get_file_standard_info(struct smb2_query_info_rsp *rsp,
struct ksmbd_file *fp, void *rsp_org)
{
@@ -4409,7 +4394,7 @@ static void get_file_standard_info(struc
sinfo = (struct smb2_file_standard_info *)rsp->Buffer;
delete_pending = ksmbd_inode_pending_delete(fp);
- sinfo->AllocationSize = cpu_to_le64(get_allocation_size(inode, &stat));
+ sinfo->AllocationSize = cpu_to_le64(inode->i_blocks << 9);
sinfo->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
sinfo->NumberOfLinks = cpu_to_le32(get_nlink(&stat) - delete_pending);
sinfo->DeletePending = delete_pending;
@@ -4474,7 +4459,7 @@ static int get_file_all_info(struct ksmb
file_info->Attributes = fp->f_ci->m_fattr;
file_info->Pad1 = 0;
file_info->AllocationSize =
- cpu_to_le64(get_allocation_size(inode, &stat));
+ cpu_to_le64(inode->i_blocks << 9);
file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
file_info->NumberOfLinks =
cpu_to_le32(get_nlink(&stat) - delete_pending);
@@ -4663,7 +4648,7 @@ static int get_file_network_open_info(st
file_info->ChangeTime = cpu_to_le64(time);
file_info->Attributes = fp->f_ci->m_fattr;
file_info->AllocationSize =
- cpu_to_le64(get_allocation_size(inode, &stat));
+ cpu_to_le64(inode->i_blocks << 9);
file_info->EndOfFile = S_ISDIR(stat.mode) ? 0 : cpu_to_le64(stat.size);
file_info->Reserved = cpu_to_le32(0);
rsp->OutputBufferLength =
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 278/286] ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 277/286] ksmbd: fix incorrect AllocationSize set in smb2_get_info Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 279/286] ksmbd: fix multiple out-of-bounds read during context decoding Greg Kroah-Hartman
` (16 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuan-Ting Chen, Namjae Jeon,
Steve French
From: Kuan-Ting Chen <h3xrabbit@gmail.com>
commit d738950f112c8f40f0515fe967db998e8235a175 upstream.
Check request_buf length first to avoid out-of-bounds read by
req->DialectCount.
[ 3350.990282] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x35d7/0x3e60
[ 3350.990282] Read of size 2 at addr ffff88810ad61346 by task kworker/5:0/276
[ 3351.000406] Workqueue: ksmbd-io handle_ksmbd_work
[ 3351.003499] Call Trace:
[ 3351.006473] <TASK>
[ 3351.006473] dump_stack_lvl+0x8d/0xe0
[ 3351.006473] print_report+0xcc/0x620
[ 3351.006473] kasan_report+0x92/0xc0
[ 3351.006473] smb2_handle_negotiate+0x35d7/0x3e60
[ 3351.014760] ksmbd_smb_negotiate_common+0x7a7/0xf00
[ 3351.014760] handle_ksmbd_work+0x3f7/0x12d0
[ 3351.014760] process_one_work+0xa85/0x1780
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2pdu.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -1081,16 +1081,16 @@ int smb2_handle_negotiate(struct ksmbd_w
return rc;
}
- if (req->DialectCount == 0) {
- pr_err("malformed packet\n");
+ smb2_buf_len = get_rfc1002_len(work->request_buf);
+ smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects);
+ if (smb2_neg_size > smb2_buf_len) {
rsp->hdr.Status = STATUS_INVALID_PARAMETER;
rc = -EINVAL;
goto err_out;
}
- smb2_buf_len = get_rfc1002_len(work->request_buf);
- smb2_neg_size = offsetof(struct smb2_negotiate_req, Dialects);
- if (smb2_neg_size > smb2_buf_len) {
+ if (req->DialectCount == 0) {
+ pr_err("malformed packet\n");
rsp->hdr.Status = STATUS_INVALID_PARAMETER;
rc = -EINVAL;
goto err_out;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 279/286] ksmbd: fix multiple out-of-bounds read during context decoding
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 278/286] ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 280/286] KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() Greg Kroah-Hartman
` (15 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuan-Ting Chen, Namjae Jeon,
Steve French
From: Kuan-Ting Chen <h3xrabbit@gmail.com>
commit 0512a5f89e1fae74251fde6893ff634f1c96c6fb upstream.
Check the remaining data length before accessing the context structure
to ensure that the entire structure is contained within the packet.
Additionally, since the context data length `ctxt_len` has already been
checked against the total packet length `len_of_ctxts`, update the
comparison to use `ctxt_len`.
Cc: stable@vger.kernel.org
Signed-off-by: Kuan-Ting Chen <h3xrabbit@gmail.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ksmbd/smb2pdu.c | 53 ++++++++++++++++++++++++++++++++++-------------------
1 file changed, 34 insertions(+), 19 deletions(-)
--- a/fs/ksmbd/smb2pdu.c
+++ b/fs/ksmbd/smb2pdu.c
@@ -873,13 +873,14 @@ static void assemble_neg_contexts(struct
static __le32 decode_preauth_ctxt(struct ksmbd_conn *conn,
struct smb2_preauth_neg_context *pneg_ctxt,
- int len_of_ctxts)
+ int ctxt_len)
{
/*
* sizeof(smb2_preauth_neg_context) assumes SMB311_SALT_SIZE Salt,
* which may not be present. Only check for used HashAlgorithms[1].
*/
- if (len_of_ctxts < MIN_PREAUTH_CTXT_DATA_LEN)
+ if (ctxt_len <
+ sizeof(struct smb2_neg_context) + MIN_PREAUTH_CTXT_DATA_LEN)
return STATUS_INVALID_PARAMETER;
if (pneg_ctxt->HashAlgorithms != SMB2_PREAUTH_INTEGRITY_SHA512)
@@ -891,15 +892,23 @@ static __le32 decode_preauth_ctxt(struct
static void decode_encrypt_ctxt(struct ksmbd_conn *conn,
struct smb2_encryption_neg_context *pneg_ctxt,
- int len_of_ctxts)
+ int ctxt_len)
{
- int cph_cnt = le16_to_cpu(pneg_ctxt->CipherCount);
- int i, cphs_size = cph_cnt * sizeof(__le16);
+ int cph_cnt;
+ int i, cphs_size;
+
+ if (sizeof(struct smb2_encryption_neg_context) > ctxt_len) {
+ pr_err("Invalid SMB2_ENCRYPTION_CAPABILITIES context size\n");
+ return;
+ }
conn->cipher_type = 0;
+ cph_cnt = le16_to_cpu(pneg_ctxt->CipherCount);
+ cphs_size = cph_cnt * sizeof(__le16);
+
if (sizeof(struct smb2_encryption_neg_context) + cphs_size >
- len_of_ctxts) {
+ ctxt_len) {
pr_err("Invalid cipher count(%d)\n", cph_cnt);
return;
}
@@ -947,15 +956,22 @@ static void decode_compress_ctxt(struct
static void decode_sign_cap_ctxt(struct ksmbd_conn *conn,
struct smb2_signing_capabilities *pneg_ctxt,
- int len_of_ctxts)
+ int ctxt_len)
{
- int sign_algo_cnt = le16_to_cpu(pneg_ctxt->SigningAlgorithmCount);
- int i, sign_alos_size = sign_algo_cnt * sizeof(__le16);
+ int sign_algo_cnt;
+ int i, sign_alos_size;
+
+ if (sizeof(struct smb2_signing_capabilities) > ctxt_len) {
+ pr_err("Invalid SMB2_SIGNING_CAPABILITIES context length\n");
+ return;
+ }
conn->signing_negotiated = false;
+ sign_algo_cnt = le16_to_cpu(pneg_ctxt->SigningAlgorithmCount);
+ sign_alos_size = sign_algo_cnt * sizeof(__le16);
if (sizeof(struct smb2_signing_capabilities) + sign_alos_size >
- len_of_ctxts) {
+ ctxt_len) {
pr_err("Invalid signing algorithm count(%d)\n", sign_algo_cnt);
return;
}
@@ -993,18 +1009,16 @@ static __le32 deassemble_neg_contexts(st
len_of_ctxts = len_of_smb - offset;
while (i++ < neg_ctxt_cnt) {
- int clen;
-
- /* check that offset is not beyond end of SMB */
- if (len_of_ctxts == 0)
- break;
+ int clen, ctxt_len;
if (len_of_ctxts < sizeof(struct smb2_neg_context))
break;
pctx = (struct smb2_neg_context *)((char *)pctx + offset);
clen = le16_to_cpu(pctx->DataLength);
- if (clen + sizeof(struct smb2_neg_context) > len_of_ctxts)
+ ctxt_len = clen + sizeof(struct smb2_neg_context);
+
+ if (ctxt_len > len_of_ctxts)
break;
if (pctx->ContextType == SMB2_PREAUTH_INTEGRITY_CAPABILITIES) {
@@ -1015,7 +1029,7 @@ static __le32 deassemble_neg_contexts(st
status = decode_preauth_ctxt(conn,
(struct smb2_preauth_neg_context *)pctx,
- len_of_ctxts);
+ ctxt_len);
if (status != STATUS_SUCCESS)
break;
} else if (pctx->ContextType == SMB2_ENCRYPTION_CAPABILITIES) {
@@ -1026,7 +1040,7 @@ static __le32 deassemble_neg_contexts(st
decode_encrypt_ctxt(conn,
(struct smb2_encryption_neg_context *)pctx,
- len_of_ctxts);
+ ctxt_len);
} else if (pctx->ContextType == SMB2_COMPRESSION_CAPABILITIES) {
ksmbd_debug(SMB,
"deassemble SMB2_COMPRESSION_CAPABILITIES context\n");
@@ -1045,9 +1059,10 @@ static __le32 deassemble_neg_contexts(st
} else if (pctx->ContextType == SMB2_SIGNING_CAPABILITIES) {
ksmbd_debug(SMB,
"deassemble SMB2_SIGNING_CAPABILITIES context\n");
+
decode_sign_cap_ctxt(conn,
(struct smb2_signing_capabilities *)pctx,
- len_of_ctxts);
+ ctxt_len);
}
/* offsets must be 8 byte aligned */
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 280/286] KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 279/286] ksmbd: fix multiple out-of-bounds read during context decoding Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 281/286] regmap: Account for register length when chunking Greg Kroah-Hartman
` (14 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Roberto Sassu,
Eric Biggers, Stefan Berger
From: Roberto Sassu <roberto.sassu@huawei.com>
commit c3d03e8e35e005e1a614e51bb59053eeb5857f76 upstream.
Commit ac4e97abce9b8 ("scatterlist: sg_set_buf() argument must be in linear
mapping") checks that both the signature and the digest reside in the
linear mapping area.
However, more recently commit ba14a194a434c ("fork: Add generic vmalloced
stack support") made it possible to move the stack in the vmalloc area,
which is not contiguous, and thus not suitable for sg_set_buf() which needs
adjacent pages.
Always make a copy of the signature and digest in the same buffer used to
store the key and its parameters, and pass them to sg_init_one(). Prefer it
to conditionally doing the copy if necessary, to keep the code simple. The
buffer allocated with kmalloc() is in the linear mapping area.
Cc: stable@vger.kernel.org # 4.9.x
Fixes: ba14a194a434 ("fork: Add generic vmalloced stack support")
Link: https://lore.kernel.org/linux-integrity/Y4pIpxbjBdajymBJ@sol.localdomain/
Suggested-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Tested-by: Stefan Berger <stefanb@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
crypto/asymmetric_keys/public_key.c | 38 +++++++++++++++++++-----------------
1 file changed, 21 insertions(+), 17 deletions(-)
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -380,9 +380,10 @@ int public_key_verify_signature(const st
struct crypto_wait cwait;
struct crypto_akcipher *tfm;
struct akcipher_request *req;
- struct scatterlist src_sg[2];
+ struct scatterlist src_sg;
char alg_name[CRYPTO_MAX_ALG_NAME];
- char *key, *ptr;
+ char *buf, *ptr;
+ size_t buf_len;
int ret;
pr_devel("==>%s()\n", __func__);
@@ -420,34 +421,37 @@ int public_key_verify_signature(const st
if (!req)
goto error_free_tfm;
- key = kmalloc(pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
- GFP_KERNEL);
- if (!key)
+ buf_len = max_t(size_t, pkey->keylen + sizeof(u32) * 2 + pkey->paramlen,
+ sig->s_size + sig->digest_size);
+
+ buf = kmalloc(buf_len, GFP_KERNEL);
+ if (!buf)
goto error_free_req;
- memcpy(key, pkey->key, pkey->keylen);
- ptr = key + pkey->keylen;
+ memcpy(buf, pkey->key, pkey->keylen);
+ ptr = buf + pkey->keylen;
ptr = pkey_pack_u32(ptr, pkey->algo);
ptr = pkey_pack_u32(ptr, pkey->paramlen);
memcpy(ptr, pkey->params, pkey->paramlen);
if (pkey->key_is_private)
- ret = crypto_akcipher_set_priv_key(tfm, key, pkey->keylen);
+ ret = crypto_akcipher_set_priv_key(tfm, buf, pkey->keylen);
else
- ret = crypto_akcipher_set_pub_key(tfm, key, pkey->keylen);
+ ret = crypto_akcipher_set_pub_key(tfm, buf, pkey->keylen);
if (ret)
- goto error_free_key;
+ goto error_free_buf;
if (strcmp(pkey->pkey_algo, "sm2") == 0 && sig->data_size) {
ret = cert_sig_digest_update(sig, tfm);
if (ret)
- goto error_free_key;
+ goto error_free_buf;
}
- sg_init_table(src_sg, 2);
- sg_set_buf(&src_sg[0], sig->s, sig->s_size);
- sg_set_buf(&src_sg[1], sig->digest, sig->digest_size);
- akcipher_request_set_crypt(req, src_sg, NULL, sig->s_size,
+ memcpy(buf, sig->s, sig->s_size);
+ memcpy(buf + sig->s_size, sig->digest, sig->digest_size);
+
+ sg_init_one(&src_sg, buf, sig->s_size + sig->digest_size);
+ akcipher_request_set_crypt(req, &src_sg, NULL, sig->s_size,
sig->digest_size);
crypto_init_wait(&cwait);
akcipher_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG |
@@ -455,8 +459,8 @@ int public_key_verify_signature(const st
crypto_req_done, &cwait);
ret = crypto_wait_req(crypto_akcipher_verify(req), &cwait);
-error_free_key:
- kfree(key);
+error_free_buf:
+ kfree(buf);
error_free_req:
akcipher_request_free(req);
error_free_tfm:
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 281/286] regmap: Account for register length when chunking
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 280/286] KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 282/286] tpm, tpm_tis: Request threaded interrupt handler Greg Kroah-Hartman
` (13 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches
From: Jim Wylder <jwylder@google.com>
commit 3981514180c987a79ea98f0ae06a7cbf58a9ac0f upstream.
Currently, when regmap_raw_write() splits the data, it uses the
max_raw_write value defined for the bus. For any bus that includes
the target register address in the max_raw_write value, the chunked
transmission will always exceed the maximum transmission length.
To avoid this problem, subtract the length of the register and the
padding from the maximum transmission.
Signed-off-by: Jim Wylder <jwylder@google.com
Link: https://lore.kernel.org/r/20230517152444.3690870-2-jwylder@google.com
Signed-off-by: Mark Brown <broonie@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -2064,6 +2064,8 @@ int _regmap_raw_write(struct regmap *map
size_t val_count = val_len / val_bytes;
size_t chunk_count, chunk_bytes;
size_t chunk_regs = val_count;
+ size_t max_data = map->max_raw_write - map->format.reg_bytes -
+ map->format.pad_bytes;
int ret, i;
if (!val_count)
@@ -2071,8 +2073,8 @@ int _regmap_raw_write(struct regmap *map
if (map->use_single_write)
chunk_regs = 1;
- else if (map->max_raw_write && val_len > map->max_raw_write)
- chunk_regs = map->max_raw_write / val_bytes;
+ else if (map->max_raw_write && val_len > max_data)
+ chunk_regs = max_data / val_bytes;
chunk_count = val_count / chunk_regs;
chunk_bytes = chunk_regs * val_bytes;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 282/286] tpm, tpm_tis: Request threaded interrupt handler
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 281/286] regmap: Account for register length when chunking Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 283/286] iommu/amd/pgtbl_v2: Fix domain max address Greg Kroah-Hartman
` (12 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lino Sanfilippo,
Michael Niewöhner, Jarkko Sakkinen
From: Lino Sanfilippo <l.sanfilippo@kunbus.com>
commit 0c7e66e5fd69bf21034c9a9b081d7de7c3eb2cea upstream.
The TIS interrupt handler at least has to read and write the interrupt
status register. In case of SPI both operations result in a call to
tpm_tis_spi_transfer() which uses the bus_lock_mutex of the spi device
and thus must only be called from a sleepable context.
To ensure this request a threaded interrupt handler.
Signed-off-by: Lino Sanfilippo <l.sanfilippo@kunbus.com>
Tested-by: Michael Niewöhner <linux@mniewoehner.de>
Tested-by: Jarkko Sakkinen <jarkko@kernel.org>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/char/tpm/tpm_tis_core.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/char/tpm/tpm_tis_core.c
+++ b/drivers/char/tpm/tpm_tis_core.c
@@ -805,8 +805,11 @@ static int tpm_tis_probe_irq_single(stru
int rc;
u32 int_status;
- if (devm_request_irq(chip->dev.parent, irq, tis_int_handler, flags,
- dev_name(&chip->dev), chip) != 0) {
+
+ rc = devm_request_threaded_irq(chip->dev.parent, irq, NULL,
+ tis_int_handler, IRQF_ONESHOT | flags,
+ dev_name(&chip->dev), chip);
+ if (rc) {
dev_info(&chip->dev, "Unable to request irq: %d for probe\n",
irq);
return -1;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 283/286] iommu/amd/pgtbl_v2: Fix domain max address
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 282/286] tpm, tpm_tis: Request threaded interrupt handler Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 284/286] xfs: verify buffer contents when we skip log replay Greg Kroah-Hartman
` (11 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jerry Snitselaar,
Suravee Suthikulpanit, Vasant Hegde, Joerg Roedel, Stable
From: Vasant Hegde <vasant.hegde@amd.com>
commit 11c439a19466e7feaccdbce148a75372fddaf4e9 upstream.
IOMMU v2 page table supports 4 level (47 bit) or 5 level (56 bit) virtual
address space. Current code assumes it can support 64bit IOVA address
space. If IOVA allocator allocates virtual address > 47/56 bit (depending
on page table level) then it will do wrong mapping and cause invalid
translation.
Hence adjust aperture size to use max address supported by the page table.
Reported-by: Jerry Snitselaar <jsnitsel@redhat.com>
Fixes: aaac38f61487 ("iommu/amd: Initial support for AMD IOMMU v2 page table")
Cc: <Stable@vger.kernel.org> # v6.0+
Cc: Suravee Suthikulpanit <suravee.suthikulpanit@amd.com>
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Jerry Snitselaar <jsnitsel@redhat.com>
Link: https://lore.kernel.org/r/20230518054351.9626-1-vasant.hegde@amd.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
[ Modified to work with "V2 with 4 level page table" only - Vasant ]
Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/amd/iommu.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -2118,6 +2118,15 @@ out_err:
return NULL;
}
+static inline u64 dma_max_address(void)
+{
+ if (amd_iommu_pgtable == AMD_IOMMU_V1)
+ return ~0ULL;
+
+ /* V2 with 4 level page table */
+ return ((1ULL << PM_LEVEL_SHIFT(PAGE_MODE_4_LEVEL)) - 1);
+}
+
static struct iommu_domain *amd_iommu_domain_alloc(unsigned type)
{
struct protection_domain *domain;
@@ -2134,7 +2143,7 @@ static struct iommu_domain *amd_iommu_do
return NULL;
domain->domain.geometry.aperture_start = 0;
- domain->domain.geometry.aperture_end = ~0ULL;
+ domain->domain.geometry.aperture_end = dma_max_address();
domain->domain.geometry.force_aperture = true;
return &domain->domain;
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 284/286] xfs: verify buffer contents when we skip log replay
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 283/286] iommu/amd/pgtbl_v2: Fix domain max address Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 285/286] riscv: vmlinux.lds.S: Explicitly handle .got section Greg Kroah-Hartman
` (10 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Darrick J. Wong, Dave Chinner,
Dave Chinner
From: Darrick J. Wong <djwong@kernel.org>
commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 upstream.
syzbot detected a crash during log recovery:
XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791
XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200.
XFS (loop0): Starting recovery (logdev: internal)
==================================================================
BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813
Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074
CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:306
print_report+0x107/0x1f0 mm/kasan/report.c:417
kasan_report+0xcd/0x100 mm/kasan/report.c:517
xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813
xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913
xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713
xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953
xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946
xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930
xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493
xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829
xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933
xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666
get_tree_bdev+0x400/0x620 fs/super.c:1282
vfs_get_tree+0x88/0x270 fs/super.c:1489
do_new_mount+0x289/0xad0 fs/namespace.c:3145
do_mount fs/namespace.c:3488 [inline]
__do_sys_mount fs/namespace.c:3697 [inline]
__se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f89fa3f4aca
Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca
RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10
RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d
R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004
R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50
</TASK>
The fuzzed image contains an AGF with an obviously garbage
agf_refcount_level value of 32, and a dirty log with a buffer log item
for that AGF. The ondisk AGF has a higher LSN than the recovered log
item. xlog_recover_buf_commit_pass2 reads the buffer, compares the
LSNs, and decides to skip replay because the ondisk buffer appears to be
newer.
Unfortunately, the ondisk buffer is corrupt, but recovery just read the
buffer with no buffer ops specified:
error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno,
buf_f->blf_len, buf_flags, &bp, NULL);
Skipping the buffer leaves its contents in memory unverified. This sets
us up for a kernel crash because xfs_refcount_recover_cow_leftovers
reads the buffer (which is still around in XBF_DONE state, so no read
verification) and creates a refcountbt cursor of height 32. This is
impossible so we run off the end of the cursor object and crash.
Fix this by invoking the verifier on all skipped buffers and aborting
log recovery if the ondisk buffer is corrupt. It might be smarter to
force replay the log item atop the buffer and then see if it'll pass the
write verifier (like ext4 does) but for now let's go with the
conservative option where we stop immediately.
Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e
Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/fs/xfs/xfs_buf_item_recover.c
+++ b/fs/xfs/xfs_buf_item_recover.c
@@ -943,6 +943,16 @@ xlog_recover_buf_commit_pass2(
if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) {
trace_xfs_log_recover_buf_skip(log, buf_f);
xlog_recover_validate_buf_type(mp, bp, buf_f, NULLCOMMITLSN);
+
+ /*
+ * We're skipping replay of this buffer log item due to the log
+ * item LSN being behind the ondisk buffer. Verify the buffer
+ * contents since we aren't going to run the write verifier.
+ */
+ if (bp->b_ops) {
+ bp->b_ops->verify_read(bp);
+ error = bp->b_error;
+ }
goto out_release;
}
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 285/286] riscv: vmlinux.lds.S: Explicitly handle .got section
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 284/286] xfs: verify buffer contents when we skip log replay Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 286/286] ext4: enable the lazy init thread when remounting read/write Greg Kroah-Hartman
` (9 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches,
paul.walmsley@sifive.com, aou@eecs.berkeley.edu, ndesaulniers@google.com, trix@redhat.com, stable@vger.kernel.org, linux-riscv@lists.infradead.org, llvm@lists.linux.dev, patches@lists.linux.dev, Nathan Chancellor,
Conor Dooley, Nathan Chancellor
From: Nathan Chancellor <nathan@kernel.org>
This patch is for linux-6.3.y only, it has no direct mainline
equivalent.
LLVM 17 will now use the GOT for extern weak symbols when using the
medany model, which causes a linker orphan section warning on
linux-6.3.y:
ld.lld: warning: <internal>:(.got) is being placed in '.got'
This is not an issue in mainline because handling of the .got section
was added by commit 39b33072941f ("riscv: Introduce CONFIG_RELOCATABLE")
and further extended by commit 26e7aacb83df ("riscv: Allow to downgrade
paging mode from the command line") in 6.4-rc1. Neither of these changes
are suitable for stable, so add explicit handling of the .got section in
a standalone change to align 6.3 and mainline, which addresses the
warning.
This is only an issue for 6.3 because commit f4b71bff8d85 ("riscv:
select ARCH_WANT_LD_ORPHAN_WARN for !XIP_KERNEL") landed in 6.3-rc1, so
earlier releases will not see this warning because it will not be
enabled.
Closes: https://github.com/ClangBuiltLinux/linux/issues/1865
Link: https://github.com/llvm/llvm-project/commit/a178ba9fbd0a27057dc2fa4cb53c76caa013caac
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/riscv/kernel/vmlinux.lds.S | 2 ++
1 file changed, 2 insertions(+)
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -129,6 +129,8 @@ SECTIONS
*(.sdata*)
}
+ .got : { *(.got*) }
+
#ifdef CONFIG_EFI
.pecoff_edata_padding : { BYTE(0); . = ALIGN(PECOFF_FILE_ALIGNMENT); }
__pecoff_data_raw_size = ABSOLUTE(. - __pecoff_text_end);
^ permalink raw reply [flat|nested] 299+ messages in thread
* [PATCH 6.3 286/286] ext4: enable the lazy init thread when remounting read/write
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 285/286] riscv: vmlinux.lds.S: Explicitly handle .got section Greg Kroah-Hartman
@ 2023-06-07 20:16 ` Greg Kroah-Hartman
2023-06-08 1:20 ` [PATCH 6.3 000/286] 6.3.7-rc1 review Shuah Khan
` (8 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Greg Kroah-Hartman @ 2023-06-07 20:16 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Theodore Tso
From: Theodore Ts'o <tytso@mit.edu>
commit eb1f822c76beeaa76ab8b6737ab9dc9f9798408c upstream.
In commit a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting
r/w until quota is re-enabled") we defer clearing tyhe SB_RDONLY flag
in struct super. However, we didn't defer when we checked sb_rdonly()
to determine the lazy itable init thread should be enabled, with the
next result that the lazy inode table initialization would not be
properly started. This can cause generic/231 to fail in ext4's
nojournal mode.
Fix this by moving when we decide to start or stop the lazy itable
init thread to after we clear the SB_RDONLY flag when we are
remounting the file system read/write.
Fixes a44be64bbecb ("ext4: don't clear SB_RDONLY when remounting r/w until...")
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Link: https://lore.kernel.org/r/20230527035729.1001605-1-tytso@mit.edu
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/super.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--- a/fs/ext4/super.c
+++ b/fs/ext4/super.c
@@ -6555,18 +6555,6 @@ static int __ext4_remount(struct fs_cont
}
/*
- * Reinitialize lazy itable initialization thread based on
- * current settings
- */
- if (sb_rdonly(sb) || !test_opt(sb, INIT_INODE_TABLE))
- ext4_unregister_li_request(sb);
- else {
- ext4_group_t first_not_zeroed;
- first_not_zeroed = ext4_has_uninit_itable(sb);
- ext4_register_li_request(sb, first_not_zeroed);
- }
-
- /*
* Handle creation of system zone data early because it can fail.
* Releasing of existing data is done when we are sure remount will
* succeed.
@@ -6603,6 +6591,18 @@ static int __ext4_remount(struct fs_cont
if (enable_rw)
sb->s_flags &= ~SB_RDONLY;
+ /*
+ * Reinitialize lazy itable initialization thread based on
+ * current settings
+ */
+ if (sb_rdonly(sb) || !test_opt(sb, INIT_INODE_TABLE))
+ ext4_unregister_li_request(sb);
+ else {
+ ext4_group_t first_not_zeroed;
+ first_not_zeroed = ext4_has_uninit_itable(sb);
+ ext4_register_li_request(sb, first_not_zeroed);
+ }
+
if (!ext4_has_feature_mmp(sb) || sb_rdonly(sb))
ext4_stop_mmpd(sbi);
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2023-06-07 20:16 ` [PATCH 6.3 286/286] ext4: enable the lazy init thread when remounting read/write Greg Kroah-Hartman
@ 2023-06-08 1:20 ` Shuah Khan
2023-06-08 3:35 ` Florian Fainelli
` (7 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Shuah Khan @ 2023-06-08 1:20 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, Shuah Khan
On 6/7/23 14:11, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
Compiled and booted on my test system. No dmesg regressions.
Tested-by: Shuah Khan <skhan@linuxfoundation.org>
thanks,
-- Shuah
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2023-06-08 1:20 ` [PATCH 6.3 000/286] 6.3.7-rc1 review Shuah Khan
@ 2023-06-08 3:35 ` Florian Fainelli
2023-06-08 6:36 ` Markus Reichelt
` (6 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Florian Fainelli @ 2023-06-08 3:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow
On 6/7/23 13:11, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tseted on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2023-06-08 3:35 ` Florian Fainelli
@ 2023-06-08 6:36 ` Markus Reichelt
2023-06-08 7:23 ` Chris Paterson
` (5 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Markus Reichelt @ 2023-06-08 6:36 UTC (permalink / raw)
To: stable, linux-kernel
* Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
Hi Greg
6.3.7-rc1
compiles, boots and runs here on x86_64
(AMD Ryzen 5 PRO 4650G, Slackware64-15.0)
Tested-by: Markus Reichelt <lkt+2023@mareichelt.com>
^ permalink raw reply [flat|nested] 299+ messages in thread
* RE: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2023-06-08 6:36 ` Markus Reichelt
@ 2023-06-08 7:23 ` Chris Paterson
2023-06-08 9:45 ` Conor Dooley
` (4 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Chris Paterson @ 2023-06-08 7:23 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable@vger.kernel.org
Cc: patches@lists.linux.dev, linux-kernel@vger.kernel.org,
torvalds@linux-foundation.org, akpm@linux-foundation.org,
linux@roeck-us.net, shuah@kernel.org, patches@kernelci.org,
lkft-triage@lists.linaro.org, pavel@denx.de, jonathanh@nvidia.com,
f.fainelli@gmail.com, sudipm.mukherjee@gmail.com,
srw@sladewatkins.net, rwarsow@gmx.de
Hello Greg,
> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Sent: Wednesday, June 7, 2023 9:12 PM
>
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
CIP configurations built and booted okay with Linux 6.3.7-rc1 (78317e11fb00):
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/pipelines/893073623
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/commits/linux-6.3.y
Tested-by: Chris Paterson (CIP) <chris.paterson2@renesas.com>
Kind regards, Chris
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2023-06-08 7:23 ` Chris Paterson
@ 2023-06-08 9:45 ` Conor Dooley
2023-06-08 9:53 ` Ron Economos
` (3 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Conor Dooley @ 2023-06-08 9:45 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
[-- Attachment #1: Type: text/plain, Size: 859 bytes --]
On Wed, Jun 07, 2023 at 10:11:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
> and the diffstat can be found below.
Ditto here, looks good on our RISC-V stuff.
Tested-by: Conor Dooley <conor.dooley@microchip.com>
Cheers,
Conor.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2023-06-08 9:45 ` Conor Dooley
@ 2023-06-08 9:53 ` Ron Economos
2023-06-08 10:51 ` Naresh Kamboju
` (2 subsequent siblings)
294 siblings, 0 replies; 299+ messages in thread
From: Ron Economos @ 2023-06-08 9:53 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow
On 6/7/23 1:11 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2023-06-08 9:53 ` Ron Economos
@ 2023-06-08 10:51 ` Naresh Kamboju
2023-06-08 11:29 ` Bagas Sanjaya
2023-06-08 17:25 ` Justin Forbes
294 siblings, 0 replies; 299+ messages in thread
From: Naresh Kamboju @ 2023-06-08 10:51 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
On Thu, 8 Jun 2023 at 01:52, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 6.3.7-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git branch: linux-6.3.y
* git commit: 78317e11fb00aba0b42e15367d2630a515e4a808
* git describe: v6.3.5-333-g78317e11fb00
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.3.y/build/v6.3.5-333-g78317e11fb00
## Test Regressions (compared to v6.3.5)
## Metric Regressions (compared to v6.3.5)
## Test Fixes (compared to v6.3.5)
## Metric Fixes (compared to v6.3.5)
## Test result summary
total: 138349, pass: 121372, fail: 2111, skip: 14667, xfail: 199
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 140 total, 139 passed, 1 failed
* arm64: 50 total, 50 passed, 0 failed
* i386: 36 total, 35 passed, 1 failed
* mips: 26 total, 26 passed, 0 failed
* parisc: 3 total, 3 passed, 0 failed
* powerpc: 34 total, 34 passed, 0 failed
* riscv: 22 total, 22 passed, 0 failed
* s390: 12 total, 12 passed, 0 failed
* sh: 12 total, 12 passed, 0 failed
* sparc: 6 total, 6 passed, 0 failed
* x86_64: 42 total, 42 passed, 0 failed
## Test suites summary
* boot
* fwts
* igt-gpu-tools
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
* vdso
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2023-06-08 10:51 ` Naresh Kamboju
@ 2023-06-08 11:29 ` Bagas Sanjaya
2023-06-08 17:25 ` Justin Forbes
294 siblings, 0 replies; 299+ messages in thread
From: Bagas Sanjaya @ 2023-06-08 11:29 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow
[-- Attachment #1: Type: text/plain, Size: 558 bytes --]
On Wed, Jun 07, 2023 at 10:11:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
Successfully compiled and installed bindeb-pkgs on my computer (Acer
Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 000/286] 6.3.7-rc1 review
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2023-06-08 11:29 ` Bagas Sanjaya
@ 2023-06-08 17:25 ` Justin Forbes
294 siblings, 0 replies; 299+ messages in thread
From: Justin Forbes @ 2023-06-08 17:25 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow
On Wed, Jun 07, 2023 at 10:11:39PM +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.3.7 release.
> There are 286 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Fri, 09 Jun 2023 20:07:31 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.3.7-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.3.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Tested rc1 against the Fedora build system (aarch64, ppc64le, s390x,
x86_64), and boot tested x86_64. No regressions noted.
Tested-by: Justin M. Forbes <jforbes@fedoraproject.org>
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend
2023-06-07 20:13 ` [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend Greg Kroah-Hartman
@ 2023-06-13 3:33 ` Stefan Lippers-Hollmann
2023-06-13 9:00 ` Stefan Lippers-Hollmann
0 siblings, 1 reply; 299+ messages in thread
From: Stefan Lippers-Hollmann @ 2023-06-13 3:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Hyunwoo Kim, Mauro Carvalho Chehab, Sasha Levin
Hi
On 2023-06-07, Greg Kroah-Hartman wrote:
> From: Hyunwoo Kim <imv4bel@gmail.com>
>
> [ Upstream commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f ]
>
> If the device node of dvb_frontend is open() and the device is
> disconnected, many kinds of UAFs may occur when calling close()
> on the device node.
>
> The root cause of this is that wake_up() for dvbdev->wait_queue
> is implemented in the dvb_frontend_release() function, but
> wait_event() is not implemented in the dvb_frontend_stop() function.
>
> So, implement wait_event() function in dvb_frontend_stop() and
> add 'remove_mutex' which prevents race condition for 'fe->exit'.
>
> [mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]
>
> Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
[...]
I'm noticing a regression relative to kernel v6.3.6 with this change
as part of kernel v6.3.7 on my ivy-bridge system running
Debian/unstable (amd64) with vdr 2.6.0-1.1[0] and two DVB cards
TeVii S480 V2.1 (DVB-S2, dw2102) and an Xbox One Digital TV Tuner
(DVB-T2, dvb_usb_dib0700). The systemd unit starting vdr just times
out and hangs forever, with vdr never coming up and also preventing
a clean system shutdown (hard reset required). Apart from the systemd
unit timing out, there don't really appear to be any further issues
logged.
# systemctl status -l vdr.service | cat
● vdr.service - Video Disk Recorder
Loaded: loaded (/lib/systemd/system/vdr.service; enabled; preset: enabled)
Drop-In: /etc/systemd/system/vdr.service.d
└─override.conf, umask.conf
Active: deactivating (stop-sigterm) (Result: timeout)
Process: 762 ExecStartPre=/bin/sh /usr/lib/vdr/merge-commands.sh commands (code=exited, status=0/SUCCESS)
Process: 1070 ExecStartPre=/bin/sh /usr/lib/vdr/merge-commands.sh reccmds (code=exited, status=0/SUCCESS)
Main PID: 1088 (vdr)
Tasks: 1 (limit: 38073)
Memory: 215.8M
CPU: 738ms
CGroup: /system.slice/vdr.service
└─1088 /usr/bin/vdr
Jun 13 05:15:35 system vdr[1088]: [1088] detected /dev/dvb/adapter1/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] detected /dev/dvb/adapter0/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] probing /dev/dvb/adapter0/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] creating cDvbDevice
Jun 13 05:15:35 system vdr[1088]: [1088] new device number 1 (card index 1)
Jun 13 05:15:35 system vdr[1088]: [1088] DVB API version is 0x050B (VDR was built with 0x050B)
Jun 13 05:15:35 system vdr[1088]: [1088] frontend 0/0 provides DVB-T,DVB-T2,DVB-C with QPSK,QAM16,QAM32,QAM64,QAM128,QAM256 ("Panasonic MN88472")
Jun 13 05:15:35 system vdr[1088]: [1090] epg data reader thread ended (pid=1088, tid=1090)
Jun 13 05:15:37 system vdr[1088]: [1089] video directory scanner thread ended (pid=1088, tid=1089)
Jun 13 05:17:04 system systemd[1]: vdr.service: start operation timed out. Terminating.
TeVii S480 V2.1 (this is effectively a PCIe card with a USB hub and
two TeVii s660 card on the same PCB):
lspci -nn:
04:00.0 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.1 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.2 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.3 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.4 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.5 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.6 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
04:00.7 USB controller [0c03]: MosChip Semiconductor Technology Ltd. MCS9990 PCIe to 4-Port USB 2.0 Host Controller [9710:9990]
lsusb:
Bus 002 Device 003: ID 9022:d660 TeVii Technology Ltd. DVB-S2 S660
Bus 002 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Bus 004 Device 003: ID 9022:d660 TeVii Technology Ltd. DVB-S2 S660
Bus 004 Device 001: ID 1d6b:0002 Linux Foundation 2.0 root hub
Xbox One Digital TV Tuner
lsusb:
Bus 001 Device 005: ID 045e:02d5 Microsoft Corp. Xbox One Digital TV Tuner
dmesg (excerpt):
[ 1.452325] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 2
[ 1.453824] usb 3-1: New USB device found, idVendor=9022, idProduct=d660, bcdDevice= 0.00
[ 1.453829] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1.453831] usb 3-1: Product: DVBS2BOX
[ 1.453833] usb 3-1: Manufacturer: TBS-Tech
...
[ 1.475380] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 2
[ 1.476504] usb 6-1: New USB device found, idVendor=9022, idProduct=d660, bcdDevice= 0.00
[ 1.476510] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1.476513] usb 6-1: Product: DVBS2BOX
[ 1.476515] usb 6-1: Manufacturer: TBS-Tech
[ 1.711179] usb 1-1.5: new full-speed USB device number 3 using ehci-pci
[ 1.719179] usb 2-1.3: new full-speed USB device number 3 using ehci-pci
...
[ 2.209899] usb 2-1.6: New USB device found, idVendor=045e, idProduct=02d5, bcdDevice= 1.10
[ 2.209903] usb 2-1.6: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[ 2.209905] usb 2-1.6: Product: Xbox USB Tuner
[ 2.209907] usb 2-1.6: Manufacturer: Microsoft Corp.
[ 2.209908] usb 2-1.6: SerialNumber: 005099070515
[ 2.256025] usb 1-1.8: New USB device found, idVendor=046d, idProduct=c069, bcdDevice=56.01
[ 2.256030] usb 1-1.8: New USB device strings: Mfr=1, Product=2, SerialNumber=0
...
[ 3.208796] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[ 3.209147] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[ 3.209154] dw2102: start downloading DW210X firmware
[ 3.211830] IR RC6 protocol handler initialized
...
[ 3.221848] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in warm state.
[ 3.221930] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 3.222327] dvbdev: DVB: registering new adapter (Microsoft Xbox One Digital TV Tuner)
[ 3.222333] usb 2-1.6: media controller created
...
[ 3.221848] dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in warm state.
[ 3.221930] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 3.222327] dvbdev: DVB: registering new adapter (Microsoft Xbox One Digital TV Tuner)
[ 3.222333] usb 2-1.6: media controller created
[ 3.222552] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
...
[ 3.367164] dvb-usb: found a 'TeVii S660 USB' in warm state.
[ 3.367241] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 3.367597] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[ 3.367603] usb 3-1: media controller created
[ 3.397279] mn88472 10-0018: Panasonic MN88472 successfully identified
[ 3.400166] tda18250 10-0060: NXP TDA18250BHN/M successfully identified
[ 3.403933] usb 2-1.6: DVB: registering adapter 0 frontend 0 (Panasonic MN88472)...
[ 3.403941] dvbdev: dvb_create_media_entity: media entity 'Panasonic MN88472' registered.
[ 3.404241] dvb-usb: Microsoft Xbox One Digital TV Tuner successfully initialized and connected.
[ 3.404461] usbcore: registered new interface driver dvb_usb_dib0700
[ 3.414990] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=635 'alsactl'
...
[ 3.616707] dvb-usb: MAC address: 00:18:bd:5a:be:8c
[ 3.616946] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 3.628076] DS3000 chip version: 0.192 attached.
[ 3.690739] ts2020 11-0060: Montage Technology TS2020 successfully identified
[ 3.691064] dw2102: Attached ds3000+ts2020!
[ 3.691070] usb 3-1: DVB: registering adapter 1 frontend 0 (Montage Technology DS3000)...
[ 3.691078] dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
[ 3.717182] Registered IR keymap rc-tevii-nec
[ 3.717231] rc rc1: TeVii S660 USB as /devices/pci0000:00/0000:00:1c.5/0000:04:00.3/usb3/3-1/rc/rc1
[ 3.717346] rc rc1: lirc_dev: driver dw2102 registered at minor = 1, scancode receiver, no transmitter
[ 3.717412] input: TeVii S660 USB as /devices/pci0000:00/0000:00:1c.5/0000:04:00.3/usb3/3-1/rc/rc1/input20
[ 3.717480] dvb-usb: schedule remote query interval to 150 msecs.
[ 3.717484] dvb-usb: TeVii S660 USB successfully initialized and connected.
[ 3.717531] dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
[ 3.717566] dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
[ 3.717569] dw2102: start downloading DW210X firmware
[ 3.871216] dvb-usb: found a 'TeVii S660 USB' in warm state.
[ 3.871389] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[ 3.871785] dvbdev: DVB: registering new adapter (TeVii S660 USB)
[ 3.871794] usb 6-1: media controller created
...
[ 4.109692] dvb-usb: MAC address: 00:18:bd:5a:be:8b
[ 4.109930] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[ 4.113052] DS3000 chip version: 0.192 attached.
[ 4.162597] ts2020 12-0060: Montage Technology TS2020 successfully identified
[ 4.162967] dw2102: Attached ds3000+ts2020!
[ 4.162975] usb 6-1: DVB: registering adapter 2 frontend 0 (Montage Technology DS3000)...
[ 4.162984] dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
[ 4.164314] Registered IR keymap rc-tevii-nec
[ 4.164381] rc rc2: TeVii S660 USB as /devices/pci0000:00/0000:00:1c.5/0000:04:00.1/usb6/6-1/rc/rc2
[ 4.164474] rc rc2: lirc_dev: driver dw2102 registered at minor = 2, scancode receiver, no transmitter
[ 4.164578] input: TeVii S660 USB as /devices/pci0000:00/0000:00:1c.5/0000:04:00.1/usb6/6-1/rc/rc2/input21
[ 4.164671] dvb-usb: schedule remote query interval to 150 msecs.
[ 4.164676] dvb-usb: TeVii S660 USB successfully initialized and connected.
[ 4.164756] usbcore: registered new interface driver dw2102
...
journalctl (filtered):
# journalctl -b | grep -i -e dvb -e vdr
Jun 13 05:15:21 system kernel: usb 2-1: Product: DVBS2BOX
Jun 13 05:15:21 system kernel: usb 6-1: Product: DVBS2BOX
Jun 13 05:15:21 system udevadm[415]: systemd-udev-settle.service is deprecated. Please fix vdr.service not to pull it in.
Jun 13 05:15:21 system systemd[1]: Found device dev-vg\x2dsystem-vdr.device - /dev/vg-system/vdr.
Jun 13 05:15:22 system kernel: dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
Jun 13 05:15:22 system kernel: dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
Jun 13 05:15:22 system kernel: dvb-usb: found a 'Microsoft Xbox One Digital TV Tuner' in warm state.
Jun 13 05:15:22 system kernel: dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
Jun 13 05:15:22 system kernel: dvbdev: DVB: registering new adapter (Microsoft Xbox One Digital TV Tuner)
Jun 13 05:15:22 system kernel: dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
Jun 13 05:15:22 system systemd[1]: Starting systemd-fsck@dev-vg\x2dsystem-vdr.service - File System Check on /dev/vg-system/vdr...
Jun 13 05:15:22 system kernel: dvb-usb: found a 'TeVii S660 USB' in warm state.
Jun 13 05:15:22 system kernel: dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
Jun 13 05:15:22 system kernel: dvbdev: DVB: registering new adapter (TeVii S660 USB)
Jun 13 05:15:22 system kernel: usb 3-1.6: DVB: registering adapter 0 frontend 0 (Panasonic MN88472)...
Jun 13 05:15:22 system kernel: dvbdev: dvb_create_media_entity: media entity 'Panasonic MN88472' registered.
Jun 13 05:15:22 system kernel: dvb-usb: Microsoft Xbox One Digital TV Tuner successfully initialized and connected.
Jun 13 05:15:22 system kernel: usbcore: registered new interface driver dvb_usb_dib0700
Jun 13 05:15:22 system systemd-fsck[650]: vdr: clean, 472/19660800 files, 65559385/78643200 blocks
Jun 13 05:15:22 system systemd[1]: Finished systemd-fsck@dev-vg\x2dsystem-vdr.service - File System Check on /dev/vg-system/vdr.
Jun 13 05:15:22 system kernel: dvb-usb: MAC address: 00:18:bd:5a:be:8c
Jun 13 05:15:22 system kernel: dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
Jun 13 05:15:22 system kernel: usb 2-1: DVB: registering adapter 1 frontend 0 (Montage Technology DS3000)...
Jun 13 05:15:22 system kernel: dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
Jun 13 05:15:22 system kernel: dvb-usb: schedule remote query interval to 150 msecs.
Jun 13 05:15:22 system kernel: dvb-usb: TeVii S660 USB successfully initialized and connected.
Jun 13 05:15:22 system kernel: dvb-usb: found a 'TeVii S660 USB' in cold state, will try to load a firmware
Jun 13 05:15:22 system kernel: dvb-usb: downloading firmware from file 'dvb-usb-s660.fw'
Jun 13 05:15:22 system kernel: dvb-usb: found a 'TeVii S660 USB' in warm state.
Jun 13 05:15:22 system kernel: dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
Jun 13 05:15:22 system kernel: dvbdev: DVB: registering new adapter (TeVii S660 USB)
Jun 13 05:15:22 system systemd[1]: Mounting srv-vdr.mount - /srv/vdr...
Jun 13 05:15:22 system systemd[1]: Mounted srv-vdr.mount - /srv/vdr.
Jun 13 05:15:22 system kernel: dvb-usb: MAC address: 00:18:bd:5a:be:8b
Jun 13 05:15:22 system kernel: dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
Jun 13 05:15:22 system kernel: usb 6-1: DVB: registering adapter 2 frontend 0 (Montage Technology DS3000)...
Jun 13 05:15:22 system kernel: dvbdev: dvb_create_media_entity: media entity 'Montage Technology DS3000' registered.
Jun 13 05:15:22 system kernel: dvb-usb: schedule remote query interval to 150 msecs.
Jun 13 05:15:22 system kernel: dvb-usb: TeVii S660 USB successfully initialized and connected.
Jun 13 05:15:28 system systemd[1]: Starting vdr.service - Video Disk Recorder...
Jun 13 05:15:34 system vdr[1088]: [1088] VDR version 2.6.0 started
Jun 13 05:15:34 system vdr[1088]: [1088] switched to user 'vdr'
Jun 13 05:15:34 system vdr[1088]: [1088] codeset is 'UTF-8' - known
Jun 13 05:15:34 system vdr[1088]: [1088] found 28 locales in /usr/share/locale
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'alb,sqi'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'bos'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'bul'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'chi,zho'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'eus,baq'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'iri,gle'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'jpn'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'lav'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'ltz'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'mlt'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'por'
Jun 13 05:15:34 system vdr[1088]: [1088] no locale for language code 'smi'
Jun 13 05:15:34 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-conflictcheckonly.so.2.6.0
Jun 13 05:15:34 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-epgsearch.so.2.6.0
Jun 13 05:15:34 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-epgsearchonly.so.2.6.0
Jun 13 05:15:34 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-femon.so.2.6.0
Jun 13 05:15:34 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-live.so.2.6.0
Jun 13 05:15:35 system vdr[1088]: [1088] live: INFO: validating server ip '0.0.0.0'
Jun 13 05:15:35 system vdr[1088]: INFO: validating live server ip '0.0.0.0'
Jun 13 05:15:35 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-osdteletext.so.2.6.0
Jun 13 05:15:35 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-quickepgsearch.so.2.6.0
Jun 13 05:15:35 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-streamdev-client.so.2.6.0
Jun 13 05:15:35 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-streamdev-server.so.2.6.0
Jun 13 05:15:35 system vdr[1088]: [1088] loading plugin: /usr/lib/vdr/plugins/libvdr-xineliboutput.so.2.6.0
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/setup.conf
Jun 13 05:15:35 system vdr[1088]: [1088] [xine..put] Skipping configuration entry Remote.ListenPort=37890 (overridden in command line)
Jun 13 05:15:35 system vdr[1088]: [1088] [xine..put] Skipping configuration entry RemoteMode=1 (overridden in command line)
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/sources.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/diseqc.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/scr.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/channels.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/timers.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/commands.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/reccmds.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/svdrphosts.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/remote.conf
Jun 13 05:15:35 system vdr[1088]: [1088] loading /var/lib/vdr/keymacros.conf
Jun 13 05:15:35 system vdr[1088]: [1088] registered source parameters for 'A - ATSC'
Jun 13 05:15:35 system vdr[1088]: [1088] registered source parameters for 'C - DVB-C'
Jun 13 05:15:35 system vdr[1088]: [1088] registered source parameters for 'S - DVB-S'
Jun 13 05:15:35 system vdr[1088]: [1089] video directory scanner thread started (pid=1088, tid=1089, prio=low)
Jun 13 05:15:35 system vdr[1088]: [1088] registered source parameters for 'T - DVB-T'
Jun 13 05:15:35 system vdr[1088]: [1090] epg data reader thread started (pid=1088, tid=1090, prio=high)
Jun 13 05:15:35 system vdr[1088]: [1090] reading EPG data from /var/cache/vdr/epg.data
Jun 13 05:15:35 system vdr[1088]: [1088] detected /dev/dvb/adapter2/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] detected /dev/dvb/adapter1/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] detected /dev/dvb/adapter0/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] probing /dev/dvb/adapter0/frontend0
Jun 13 05:15:35 system vdr[1088]: [1088] creating cDvbDevice
Jun 13 05:15:35 system vdr[1088]: [1088] new device number 1 (card index 1)
Jun 13 05:15:35 system kernel: mn88472 10-0018: downloading firmware from file 'dvb-demod-mn88472-02.fw'
Jun 13 05:15:35 system vdr[1088]: [1088] DVB API version is 0x050B (VDR was built with 0x050B)
Jun 13 05:15:35 system vdr[1088]: [1088] frontend 0/0 provides DVB-T,DVB-T2,DVB-C with QPSK,QAM16,QAM32,QAM64,QAM128,QAM256 ("Panasonic MN88472")
Jun 13 05:15:35 system vdr[1088]: [1090] epg data reader thread ended (pid=1088, tid=1090)
Jun 13 05:15:37 system vdr[1088]: [1089] video directory scanner thread ended (pid=1088, tid=1089)
Jun 13 05:17:04 system systemd[1]: vdr.service: start operation timed out. Terminating.
Jun 13 05:18:34 system systemd[1]: vdr.service: State 'stop-sigterm' timed out. Killing.
Jun 13 05:18:34 system systemd[1]: vdr.service: Killing process 1088 (vdr) with signal SIGKILL.
Jun 13 05:20:05 system systemd[1]: vdr.service: Processes still around after SIGKILL. Ignoring.
git bisection:
$ LANG= git bisect log
git bisect start
# Status: warte auf guten und schlechten Commit
# bad: [e282393f9d0cd66cee8c68a80f4936f46c449b2d] Linux 6.3.7
git bisect bad e282393f9d0cd66cee8c68a80f4936f46c449b2d
# Status: warte auf gute(n) Commit(s), schlechter Commit bekannt
# good: [abfd9cf1c3d4d143a889b76af835078897e46c55] Linux 6.3.6
git bisect good abfd9cf1c3d4d143a889b76af835078897e46c55
# bad: [95055e6eb8319d5e929380bb7246362815890b75] ASoC: SOF: pm: save io region state in case of errors in resume
git bisect bad 95055e6eb8319d5e929380bb7246362815890b75
# good: [7a5427ae3f1da6c61e38060a6c1865b0ab2e8f43] mtd: rawnand: marvell: don't set the NAND frequency select
git bisect good 7a5427ae3f1da6c61e38060a6c1865b0ab2e8f43
# good: [8e4aa73e787cbdc9e58ed41ccc44a48ceab2d890] fbdev: modedb: Add 1920x1080 at 60 Hz video mode
git bisect good 8e4aa73e787cbdc9e58ed41ccc44a48ceab2d890
# good: [722993741c696ebe4855a403c98408d720be2386] media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer()
git bisect good 722993741c696ebe4855a403c98408d720be2386
# good: [ec35bef6256ddc24114c7e6749c0baa1b467bcc4] media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table
git bisect good ec35bef6256ddc24114c7e6749c0baa1b467bcc4
# bad: [47dc2e5f5fb45aff7f9c32f10412125ee13cb5ce] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
git bisect bad 47dc2e5f5fb45aff7f9c32f10412125ee13cb5ce
# bad: [8bade849b15b3ecb62893f328b2cc4cdc65ac0c6] media: dvb-core: Fix use-after-free due on race condition at dvb_net
git bisect bad 8bade849b15b3ecb62893f328b2cc4cdc65ac0c6
Reverting just this patch from v6.3.7 and v6.3.8-rc1 fixes the problem
for me, vdr starts up and is fully usable.
Regards
Stefan Lippers-Hollmann
[0] packaging at https://salsa.debian.org/vdr-team/vdr.git
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend
2023-06-13 3:33 ` Stefan Lippers-Hollmann
@ 2023-06-13 9:00 ` Stefan Lippers-Hollmann
2023-06-13 9:27 ` Linux regression tracking (Thorsten Leemhuis)
0 siblings, 1 reply; 299+ messages in thread
From: Stefan Lippers-Hollmann @ 2023-06-13 9:00 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Hyunwoo Kim, Mauro Carvalho Chehab, Sasha Levin
Hi
On 2023-06-13, Stefan Lippers-Hollmann wrote:
> On 2023-06-07, Greg Kroah-Hartman wrote:
> > From: Hyunwoo Kim <imv4bel@gmail.com>
> >
> > [ Upstream commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f ]
> >
> > If the device node of dvb_frontend is open() and the device is
> > disconnected, many kinds of UAFs may occur when calling close()
> > on the device node.
> >
> > The root cause of this is that wake_up() for dvbdev->wait_queue
> > is implemented in the dvb_frontend_release() function, but
> > wait_event() is not implemented in the dvb_frontend_stop() function.
> >
> > So, implement wait_event() function in dvb_frontend_stop() and
> > add 'remove_mutex' which prevents race condition for 'fe->exit'.
> >
> > [mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]
> >
> > Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
> [...]
>
> I'm noticing a regression relative to kernel v6.3.6 with this change
> as part of kernel v6.3.7 on my ivy-bridge system running
> Debian/unstable (amd64) with vdr 2.6.0-1.1[0] and two DVB cards
> TeVii S480 V2.1 (DVB-S2, dw2102) and an Xbox One Digital TV Tuner
> (DVB-T2, dvb_usb_dib0700). The systemd unit starting vdr just times
> out and hangs forever, with vdr never coming up and also preventing
> a clean system shutdown (hard reset required). Apart from the systemd
> unit timing out, there don't really appear to be any further issues
> logged.
[...]
I've now also tested v6.4-rc6-26-gfb054096aea0 and can reproduce
this regression there as well, with the same fix of reverting this
corresponding patch.
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f
Regards
Stefan Lippers-Hollmann
^ permalink raw reply [flat|nested] 299+ messages in thread
* Re: [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend
2023-06-13 9:00 ` Stefan Lippers-Hollmann
@ 2023-06-13 9:27 ` Linux regression tracking (Thorsten Leemhuis)
0 siblings, 0 replies; 299+ messages in thread
From: Linux regression tracking (Thorsten Leemhuis) @ 2023-06-13 9:27 UTC (permalink / raw)
To: Stefan Lippers-Hollmann, Greg Kroah-Hartman
Cc: stable, patches, Hyunwoo Kim, Mauro Carvalho Chehab, Sasha Levin,
Linux kernel regressions list
On 13.06.23 11:00, Stefan Lippers-Hollmann wrote:
> On 2023-06-13, Stefan Lippers-Hollmann wrote:
>> On 2023-06-07, Greg Kroah-Hartman wrote:
>>> From: Hyunwoo Kim <imv4bel@gmail.com>
>>>
>>> [ Upstream commit 6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f ]
>>>
>>> If the device node of dvb_frontend is open() and the device is
>>> disconnected, many kinds of UAFs may occur when calling close()
>>> on the device node.
>>>
>>> The root cause of this is that wake_up() for dvbdev->wait_queue
>>> is implemented in the dvb_frontend_release() function, but
>>> wait_event() is not implemented in the dvb_frontend_stop() function.
>>>
>>> So, implement wait_event() function in dvb_frontend_stop() and
>>> add 'remove_mutex' which prevents race condition for 'fe->exit'.
>>>
>>> [mchehab: fix a couple of checkpatch warnings and some mistakes at the error handling logic]
>>>
>>> Link: https://lore.kernel.org/linux-media/20221117045925.14297-2-imv4bel@gmail.com
>> [...]
>>
>> I'm noticing a regression relative to kernel v6.3.6 with this change
>> as part of kernel v6.3.7 on my ivy-bridge system running
>> Debian/unstable (amd64) with vdr 2.6.0-1.1[0] and two DVB cards
>> TeVii S480 V2.1 (DVB-S2, dw2102) and an Xbox One Digital TV Tuner
>> (DVB-T2, dvb_usb_dib0700). The systemd unit starting vdr just times
>> out and hangs forever, with vdr never coming up and also preventing
>> a clean system shutdown (hard reset required). Apart from the systemd
>> unit timing out, there don't really appear to be any further issues
>> logged.
> [...]
>
> I've now also tested v6.4-rc6-26-gfb054096aea0 and can reproduce
> this regression there as well, with the same fix of reverting this
> corresponding patch.
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6769a0b7ee0c3b31e1b22c3fadff2bfb642de23f
Earlier report about problem due to 6769a0b7ee0c:
https://lore.kernel.org/all/da5382ad-09d6-20ac-0d53-611594b30861@lio96.de/
Proposed revert:
https://lore.kernel.org/all/20230609082238.3671398-1-mchehab@kernel.org/
Mauro, now that the patch made it into a stable tree, could you help
getting the revert quickly to Linus? Or shall we maybe ask him to pick
it up straight from the list?
Ciao, Thorsten (wearing his 'the Linux kernel's regression tracker' hat)
--
Everything you wanna know about Linux kernel regression tracking:
https://linux-regtracking.leemhuis.info/about/#tldr
If I did something stupid, please tell me, as explained on that page.
^ permalink raw reply [flat|nested] 299+ messages in thread
end of thread, other threads:[~2023-06-13 9:27 UTC | newest]
Thread overview: 299+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-06-07 20:11 [PATCH 6.3 000/286] 6.3.7-rc1 review Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 001/286] RDMA/bnxt_re: Fix the page_size used during the MR creation Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 002/286] phy: amlogic: phy-meson-g12a-mipi-dphy-analog: fix CNTL2_DIF_TX_CTL0 value Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 003/286] RDMA/efa: Fix unsupported page sizes in device Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 004/286] RDMA/hns: Fix timeout attr in query qp for HIP08 Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 005/286] RDMA/hns: Fix base address table allocation Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 006/286] RDMA/hns: Modify the value of long message loopback slice Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 007/286] dmaengine: at_xdmac: fix potential Oops in at_xdmac_prep_interleaved() Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 008/286] RDMA/bnxt_re: Fix a possible memory leak Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 009/286] RDMA/bnxt_re: Fix return value of bnxt_re_process_raw_qp_pkt_rx Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 010/286] iommu: Make IPMMU_VMSA dependencies more strict Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 011/286] iommu/rockchip: Fix unwind goto issue Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 012/286] iommu/amd: Dont block updates to GATag if guest mode is on Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 013/286] iommu/amd: Handle GALog overflows Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 014/286] iommu/amd: Fix up merge conflict resolution Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 015/286] iommu/amd: Add missing domain type checks Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 016/286] nfsd: make a copy of struct iattr before calling notify_change Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 017/286] dmaengine: pl330: rename _start to prevent build error Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 018/286] crypto: x86/aria - Use 16 byte alignment for GFNI constant vectors Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 019/286] riscv: Fix unused variable warning when BUILTIN_DTB is set Greg Kroah-Hartman
2023-06-07 20:11 ` [PATCH 6.3 020/286] net/mlx5e: TC, Remove unused vf_tun variable Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 021/286] net/mlx5e: TC, Move main flow attribute cleanup to helper func Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 022/286] net/mlx5e: Extract remaining tunnel encap code to dedicated file Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 023/286] net/mlx5e: Prevent encap offload when neigh update is running Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 024/286] net/mlx5e: Consider internal buffers size in port buffer calculations Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 025/286] net/mlx5e: Do not update SBCM when prio2buffer command is invalid Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 026/286] net/mlx5: Drain health before unregistering devlink Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 027/286] net/mlx5: SF, Drain health before removing device Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 028/286] net/mlx5: fw_tracer, Fix event handling Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 029/286] net/mlx5e: Use query_special_contexts cmd only once per mdev Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 030/286] net/mlx5e: CT: Use per action stats Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 031/286] net/mlx5e: TC, Remove CT action reordering Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 032/286] net/mlx5: Fix post parse infra to only parse every action once Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 033/286] net/mlx5e: Dont attach netdev profile while handling internal error Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 034/286] net/mlx5e: Move Ethernet driver debugfs to profile init callback Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 035/286] net: mellanox: mlxbf_gige: Fix skb_panic splat under memory pressure Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 036/286] net: stmmac: fix call trace when stmmac_xdp_xmit() is invoked Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 037/286] netrom: fix info-leak in nr_write_internal() Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 038/286] af_packet: Fix data-races of pkt_sk(sk)->num Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 039/286] tls: improve lockless access safety of tls_err_abort() Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 040/286] amd-xgbe: fix the false linkup in xgbe_phy_status Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 041/286] perf ftrace latency: Remove unnecessary "--" from --use-nsec option Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 042/286] mtd: rawnand: ingenic: fix empty stub helper definitions Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 043/286] efi: Bump stub image version for macOS HVF compatibility Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 044/286] RDMA/irdma: Prevent QP use after free Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 045/286] RDMA/irdma: Fix Local Invalidate fencing Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 046/286] af_packet: do not use READ_ONCE() in packet_bind() Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 047/286] tcp: deny tcp_disconnect() when threads are waiting Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 048/286] tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 049/286] rxrpc: Truncate UTS_RELEASE for rxrpc version Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 050/286] net/smc: Scan from current RMB list when no position specified Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 051/286] net/smc: Dont use RMBs not mapped to new link in SMCRv2 ADD LINK Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 052/286] net/sched: sch_ingress: Only create under TC_H_INGRESS Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 053/286] net/sched: sch_clsact: Only create under TC_H_CLSACT Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 054/286] net/sched: Reserve TC_H_INGRESS (TC_H_CLSACT) for ingress (clsact) Qdiscs Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 055/286] net/sched: Prohibit regrafting ingress or clsact Qdiscs Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 056/286] net: sched: fix NULL pointer dereference in mq_attach Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 057/286] net/netlink: fix NETLINK_LIST_MEMBERSHIPS length report Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 058/286] udp6: Fix race condition in udp6_sendmsg & connect Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 059/286] nfsd: fix double fget() bug in __write_ports_addfd() Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 060/286] HID: logitech-hidpp: Handle timeout differently from busy Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 061/286] nvme: fix the name of Zone Append for verbose logging Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 062/286] net/mlx5e: Fix error handling in mlx5e_refresh_tirs Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 063/286] net/mlx5: Read embedded cpu after init bit cleared Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 064/286] sfc: fix error unwinds in TC offload Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 065/286] iommu/mediatek: Flush IOTLB completely only if domain has been attached Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 066/286] net/sched: flower: fix possible OOB write in fl_set_geneve_opt() Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 067/286] tcp: fix mishandling when the sack compression is deferred Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 068/286] net: ipa: Use correct value for IPA_STATUS_SIZE Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 069/286] net: dsa: mv88e6xxx: Increase wait after reset deactivation Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 070/286] mtd: rawnand: marvell: ensure timing values are written Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 071/286] mtd: rawnand: marvell: dont set the NAND frequency select Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 072/286] net: renesas: rswitch: Fix return value in error path of xmit Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 073/286] net: phy: mxl-gpy: extend interrupt fix to all impacted variants Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 074/286] ice: recycle/free all of the fragments from multi-buffer frame Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 075/286] rtnetlink: call validate_linkmsg in rtnl_create_link Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 076/286] rtnetlink: move IFLA_GSO_ tb check to validate_linkmsg Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 077/286] rtnetlink: add the missing IFLA_GRO_ tb check in validate_linkmsg Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 078/286] mptcp: avoid unneeded __mptcp_nmpc_socket() usage Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 079/286] mptcp: add annotations around msk->subflow accesses Greg Kroah-Hartman
2023-06-07 20:12 ` [PATCH 6.3 080/286] mptcp: avoid unneeded address copy Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 081/286] mptcp: simplify subflow_syn_recv_sock() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 082/286] mptcp: consolidate passive msk socket initialization Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 083/286] mptcp: fix data race around msk->first access Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 084/286] mptcp: add annotations around sk->sk_shutdown accesses Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 085/286] drm/amdgpu: release gpu full access after "amdgpu_device_ip_late_init" Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 086/286] watchdog: menz069_wdt: fix watchdog initialisation Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 087/286] ALSA: hda: Glenfly: add HD Audio PCI IDs and HDMI Codec Vendor IDs Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 088/286] drm/amd/display: fix memleak in aconnector->timing_requested Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 089/286] LoongArch: Relay BCE exceptions to userland as SIGSEGV with si_code=SEGV_BNDERR Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 090/286] LoongArch: Add ARCH_HAS_FORTIFY_SOURCE selection Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 091/286] ASoC: Intel: soc-acpi-cht: Add quirk for Nextbook Ares 8A tablet Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 092/286] drm/amdgpu: Use the default reset when loading or reloading the driver Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 093/286] mailbox: mailbox-test: Fix potential double-free in mbox_test_message_write() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 094/286] drm/ast: Fix ARM compatibility Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 095/286] btrfs: abort transaction when sibling keys check fails for leaves Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 096/286] ARM: 9295/1: unwind:fix unwind abort for uleb128 case Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 097/286] perf/x86/intel/ds: Flush PEBS DS when changing PEBS_DATA_CFG Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 098/286] hwmon: (k10temp) Add PCI ID for family 19, model 78h Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 099/286] media: rcar-vin: Gen3 can not scale NV12 Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 100/286] media: rcar-vin: Fix NV12 size alignment Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 101/286] media: rcar-vin: Select correct interrupt mode for V4L2_FIELD_ALTERNATE Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 102/286] platform/x86: intel_scu_pcidrv: Add back PCI ID for Medfield Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 103/286] platform/mellanox: fix potential race in mlxbf-tmfifo driver Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 104/286] gfs2: Dont deref jdesc in evict Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 105/286] drm/amdgpu/nv: update VCN 3 max HEVC encoding resolution Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 106/286] drm/amdgpu: set gfx9 onwards APU atomics support to be true Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 107/286] fbdev: imsttfb: Fix use after free bug in imsttfb_probe Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 108/286] fbdev: modedb: Add 1920x1080 at 60 Hz video mode Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 109/286] fbdev: stifb: Fix info entry in sti_struct on error path Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 110/286] nbd: Fix debugfs_create_dir error checking Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 111/286] block/rnbd: replace REQ_OP_FLUSH with REQ_OP_WRITE Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 112/286] nvme-pci: add NVME_QUIRK_BOGUS_NID for HS-SSD-FUTURE 2048G Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 113/286] nvme-pci: add quirk for missing secondary temperature thresholds Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 114/286] nvme-pci: clamp max_hw_sectors based on DMA optimized limitation Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 115/286] ASoC: amd: yc: Add DMI entry to support System76 Pangolin 12 Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 116/286] ASoC: dwc: limit the number of overrun messages Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 117/286] cpupower:Fix resource leaks in sysfs_get_enabled() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 118/286] ASoC: SOF: amd: Fix NULL pointer crash in acp_sof_ipc_msg_data function Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 119/286] um: harddog: fix modular build Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 120/286] xfrm: Check if_id in inbound policy/secpath match Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 121/286] ASoC: jz4740-i2s: Make I2S divider calculations more robust Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 122/286] ASoC: dt-bindings: Adjust #sound-dai-cells on TIs single-DAI codecs Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 123/286] ALSA: hda/realtek: Add quirks for ASUS GU604V and GU603V Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 124/286] ASoC: ssm2602: Add workaround for playback distortions Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 125/286] media: dvb_demux: fix a bug for the continuity counter Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 126/286] media: dvb-usb: az6027: fix three null-ptr-deref in az6027_i2c_xfer() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 127/286] media: dvb-usb-v2: ec168: fix null-ptr-deref in ec168_i2c_xfer() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 128/286] media: dvb-usb-v2: ce6230: fix null-ptr-deref in ce6230_i2c_master_xfer() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 129/286] media: dvb-usb-v2: rtl28xxu: fix null-ptr-deref in rtl28xxu_i2c_xfer Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 130/286] media: dvb-usb: digitv: fix null-ptr-deref in digitv_i2c_xfer() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 131/286] media: dvb-usb: dw2102: fix uninit-value in su3000_read_mac_address Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 132/286] media: netup_unidvb: fix irq init by register it at the end of probe Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 133/286] media: dvb_ca_en50221: fix a size write bug Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 134/286] media: ttusb-dec: fix memory leak in ttusb_dec_exit_dvb() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 135/286] media: mn88443x: fix !CONFIG_OF error by drop of_match_ptr from ID table Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 136/286] media: dvb-core: Fix use-after-free on race condition at dvb_frontend Greg Kroah-Hartman
2023-06-13 3:33 ` Stefan Lippers-Hollmann
2023-06-13 9:00 ` Stefan Lippers-Hollmann
2023-06-13 9:27 ` Linux regression tracking (Thorsten Leemhuis)
2023-06-07 20:13 ` [PATCH 6.3 137/286] media: dvb-core: Fix use-after-free due on race condition at dvb_net Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 138/286] media: dvb-core: Fix use-after-free due to race at dvb_register_device() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 139/286] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*() Greg Kroah-Hartman
2023-06-07 20:13 ` [PATCH 6.3 140/286] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221 Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 141/286] ASoC: SOF: debug: conditionally bump runtime_pm counter on exceptions Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 142/286] ASoC: SOF: pcm: fix pm_runtime imbalance in error handling Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 143/286] ASoC: SOF: sof-client-probes: " Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 144/286] ASoC: SOF: pm: save io region state in case of errors in resume Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 145/286] s390/pkey: zeroize key blobs Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 146/286] s390/topology: honour nr_cpu_ids when adding CPUs Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 147/286] s390/ipl: fix IPIB virtual vs physical address confusion Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 148/286] ACPI: resource: Add IRQ override quirk for LG UltraPC 17U70P Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 149/286] wifi: rtl8xxxu: fix authentication timeout due to incorrect RCR value Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 150/286] ARM: dts: stm32: add pin map for CAN controller on stm32f7 Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 151/286] arm64/mm: mark private VM_FAULT_X defines as vm_fault_t Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 152/286] arm64: vdso: Pass (void *) to virt_to_page() Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 153/286] wifi: mac80211: simplify chanctx allocation Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 154/286] wifi: mac80211: consider reserved chanctx for mindef Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 155/286] wifi: mac80211: recalc chanctx mindef before assigning Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 156/286] wifi: iwlwifi: mvm: Add locking to the rate read flow Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 157/286] scsi: ufs: core: Fix MCQ tag calculation Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 158/286] scsi: ufs: core: Rename symbol sizeof_utp_transfer_cmd_desc() Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 159/286] scsi: ufs: core: Fix MCQ nr_hw_queues Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 160/286] scsi: core: Decrease scsi_devices iorequest_cnt if dispatch failed Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 161/286] wifi: b43: fix incorrect __packed annotation Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 162/286] net: wwan: t7xx: Ensure init is completed before system sleep Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 163/286] netfilter: conntrack: define variables exp_nat_nla_policy and any_addr with CONFIG_NF_NAT Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 164/286] nvme-multipath: dont call blk_mark_disk_dead in nvme_mpath_remove_disk Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 165/286] nvme: do not let the user delete a ctrl before a complete initialization Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 166/286] ALSA: oss: avoid missing-prototype warnings Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 167/286] drm/msm: Be more shouty if per-process pgtables arent working Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 168/286] atm: hide unused procfs functions Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 169/286] ceph: silence smatch warning in reconnect_caps_cb() Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 170/286] drm/amdgpu: skip disabling fence driver src_irqs when device is unplugged Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 171/286] ublk: fix AB-BA lockdep warning Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 172/286] nvme-pci: Add quirk for Teamgroup MP33 SSD Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 173/286] block: Deny writable memory mapping if block is read-only Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 174/286] iio: adc: imx93: fix a signedness bug in imx93_adc_read_raw() Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 175/286] KVM: arm64: vgic: Fix a circular locking issue Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 176/286] KVM: arm64: vgic: Wrap vgic_its_create() with config_lock Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 177/286] KVM: arm64: vgic: Fix locking comment Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 178/286] KVM: arm64: Prevent unconditional donation of unmapped regions from the host Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 179/286] scsi: qla2xxx: Fix NULL pointer dereference in target mode Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 180/286] perf/x86/intel: Save/restore cpuc->active_pebs_data_cfg when using guest PEBS Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 181/286] KVM: arm64: Reload PTE after invoking walker callback on preorder traversal Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 182/286] media: mediatek: vcodec: Only apply 4K frame sizes on decoder formats Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 183/286] mailbox: mailbox-test: fix a locking issue in mbox_test_message_write() Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 184/286] drivers: base: cacheinfo: Fix shared_cpu_map changes in event of CPU hotplug Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 185/286] drivers: base: cacheinfo: Update cpu_map_populated during CPU Hotplug Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 186/286] dt-bindings: serial: 8250_omap: add rs485-rts-active-high Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 187/286] media: uvcvideo: Dont expose unsupported formats to userspace Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 188/286] selftests/ftrace: Choose target function for filter test from samples Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 189/286] drm/amd/display: Only wait for blank completion if OTG active Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 190/286] iio: accel: st_accel: Fix invalid mount_matrix on devices without ACPI _ONT method Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 191/286] iio: adc: mxs-lradc: fix the order of two cleanup operations Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 192/286] iio: tmag5273: Fix runtime PM leak on measurement error Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 193/286] iio: ad4130: Make sure clock provider gets removed Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 194/286] iio: adc: mt6370: Fix ibus and ibat scaling value of some specific vendor ID chips Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 195/286] HID: google: add jewel USB id Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 196/286] HID: wacom: avoid integer overflow in wacom_intuos_inout() Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 197/286] iio: imu: inv_icm42600: fix timestamp reset Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 198/286] dt-bindings: iio: adc: renesas,rcar-gyroadc: Fix adi,ad7476 compatible value Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 199/286] iio: light: vcnl4035: fixed chip ID check Greg Kroah-Hartman
2023-06-07 20:14 ` [PATCH 6.3 200/286] iio: accel: kx022a fix irq getting Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 201/286] iio: adc: stm32-adc: skip adc-channels setup if none is present Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 202/286] iio: adc: ad_sigma_delta: Fix IRQ issue by setting IRQ_DISABLE_UNLAZY flag Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 203/286] iio: dac: mcp4725: Fix i2c_master_send() return value handling Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 204/286] iio: addac: ad74413: fix resistance input processing Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 205/286] iio: adc: ad7192: Change "shorted" channels to differential Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 206/286] iio: adc: stm32-adc: skip adc-diff-channels setup if none is present Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 207/286] iio: dac: build ad5758 driver when AD5758 is selected Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 208/286] net: usb: qmi_wwan: Set DTR quirk for BroadMobi BM818 Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 209/286] dt-bindings: usb: snps,dwc3: Fix "snps,hsphy_interface" type Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 210/286] usb: cdns3: fix NCM gadget RX speed 20x slow than expection at iMX8QM Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 211/286] usb: gadget: f_fs: Add unbind event before functionfs_unbind Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 212/286] md/raid5: fix miscalculation of end_sector in raid5_read_one_chunk() Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 213/286] misc: fastrpc: Reassign memory ownership only for remote heap Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 214/286] misc: fastrpc: return -EPIPE to invocations on device removal Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 215/286] misc: fastrpc: reject new invocations during " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 216/286] scsi: stex: Fix gcc 13 warnings Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 217/286] ata: libata-scsi: Use correct device no in ata_find_dev() Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 218/286] drm/amdgpu: enable tmz by default for GC 11.0.1 Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 219/286] drm/amd/pm: reverse mclk and fclk clocks levels for SMU v13.0.4 Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 220/286] drm/amd/pm: reverse mclk and fclk clocks levels for vangogh Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 221/286] drm/amd/pm: resolve reboot exception for si oland Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 222/286] drm/amd/pm: reverse mclk clocks levels for SMU v13.0.5 Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 223/286] drm/amd/pm: reverse mclk and fclk clocks levels for yellow carp Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 224/286] drm/amd/pm: reverse mclk and fclk clocks levels for renoir Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 225/286] mmc: vub300: fix invalid response handling Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 226/286] mmc: pwrseq: sd8787: Fix WILC CHIP_EN and RESETN toggling order Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 227/286] tty: serial: fsl_lpuart: use UARTCTRL_TXINV to send break instead of UARTCTRL_SBK Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 228/286] btrfs: fix csum_tree_block page iteration to avoid tripping on -Werror=array-bounds Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 229/286] phy: qcom-qmp-combo: fix init-count imbalance Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 230/286] phy: qcom-qmp-pcie-msm8996: " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 231/286] block: fix revalidate performance regression Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 232/286] powerpc/iommu: Limit number of TCEs to 512 for H_STUFF_TCE hcall Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 233/286] iommu/amd: Fix domain flush size when syncing iotlb Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 234/286] tpm, tpm_tis: correct tpm_tis_flags enumeration values Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 235/286] module/decompress: Fix error checking on zstd decompression Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 236/286] firmware: qcom_scm: Use fixed width src vm bitmap Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 237/286] misc: fastrpc: Pass proper scm arguments for secure map request Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 238/286] btrfs: call btrfs_orig_bbio_end_io in btrfs_end_bio_work Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 239/286] HID: hidpp: terminate retry loop on success Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 240/286] dmaengine: at_hdmac: Repair bitfield macros for peripheral ID handling Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 241/286] dmaengine: at_hdmac: Extend the Flow Controller bitfield to three bits Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 242/286] riscv: perf: Fix callchain parse error with kernel tracepoint events Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 243/286] io_uring: undeprecate epoll_ctl support Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 244/286] selinux: dont use makes grouped targets feature yet Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 245/286] mtdchar: mark bits of ioctl handler noinline Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 246/286] tracing/timerlat: Always wakeup the timerlat thread Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 247/286] tracing/histograms: Allow variables to have some modifiers Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 248/286] tracing/probe: trace_probe_primary_from_call(): checked list_first_entry Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 249/286] selftests: mptcp: connect: skip if MPTCP is not supported Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 250/286] selftests: mptcp: pm nl: " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 251/286] selftests: mptcp: join: " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 252/286] selftests: mptcp: join: avoid using cmp --bytes Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 253/286] selftests: mptcp: diag: skip if MPTCP is not supported Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 254/286] selftests: mptcp: simult flows: " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 255/286] selftests: mptcp: sockopt: " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 256/286] selftests: mptcp: userspace pm: " Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 257/286] mptcp: fix connect timeout handling Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 258/286] mptcp: fix active subflow finalization Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 259/286] ext4: add EA_INODE checking to ext4_iget() Greg Kroah-Hartman
2023-06-07 20:15 ` [PATCH 6.3 260/286] ext4: set lockdep subclass for the ea_inode in ext4_xattr_inode_cache_find() Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 261/286] ext4: disallow ea_inodes with extended attributes Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 262/286] ext4: add lockdep annotations for i_data_sem for ea_inodes Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 263/286] fbcon: Fix null-ptr-deref in soft_cursor Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 264/286] serial: 8250_tegra: Fix an error handling path in tegra_uart_probe() Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 265/286] serial: cpm_uart: Fix a COMPILE_TEST dependency Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 266/286] powerpc/xmon: Use KSYM_NAME_LEN in array size Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 267/286] test_firmware: prevent race conditions by a correct implementation of locking Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 268/286] test_firmware: fix a memory leak with reqs buffer Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 269/286] test_firmware: fix the memory leak of the allocated firmware buffer Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 270/286] KVM: arm64: Populate fault info for watchpoint Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 271/286] KVM: arm64: Drop last page ref in kvm_pgtable_stage2_free_removed() Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 272/286] KVM: x86/mmu: Grab memslot for correct address space in NX recovery worker Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 273/286] KVM: x86: Account fastpath-only VM-Exits in vCPU stats Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 274/286] KVM: x86: Bail from kvm_recalculate_phys_map() if x2APIC ID is out-of-bounds Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 275/286] ksmbd: fix credit count leakage Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 276/286] ksmbd: fix UAF issue from opinfo->conn Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 277/286] ksmbd: fix incorrect AllocationSize set in smb2_get_info Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 278/286] ksmbd: fix slab-out-of-bounds read in smb2_handle_negotiate Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 279/286] ksmbd: fix multiple out-of-bounds read during context decoding Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 280/286] KEYS: asymmetric: Copy sig and digest in public_key_verify_signature() Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 281/286] regmap: Account for register length when chunking Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 282/286] tpm, tpm_tis: Request threaded interrupt handler Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 283/286] iommu/amd/pgtbl_v2: Fix domain max address Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 284/286] xfs: verify buffer contents when we skip log replay Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 285/286] riscv: vmlinux.lds.S: Explicitly handle .got section Greg Kroah-Hartman
2023-06-07 20:16 ` [PATCH 6.3 286/286] ext4: enable the lazy init thread when remounting read/write Greg Kroah-Hartman
2023-06-08 1:20 ` [PATCH 6.3 000/286] 6.3.7-rc1 review Shuah Khan
2023-06-08 3:35 ` Florian Fainelli
2023-06-08 6:36 ` Markus Reichelt
2023-06-08 7:23 ` Chris Paterson
2023-06-08 9:45 ` Conor Dooley
2023-06-08 9:53 ` Ron Economos
2023-06-08 10:51 ` Naresh Kamboju
2023-06-08 11:29 ` Bagas Sanjaya
2023-06-08 17:25 ` Justin Forbes
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).