* [PATCH 5.10 000/202] 5.10.199-rc1 review
@ 2023-10-23 10:55 Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 001/202] RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent Greg Kroah-Hartman
` (207 more replies)
0 siblings, 208 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
This is the start of the stable review cycle for the 5.10.199 release.
There are 202 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.10.199-rc1
Zhang Changzhong <zhangchangzhong@huawei.com>
xfrm6: fix inet6_dev refcount underflow problem
Kees Cook <keescook@chromium.org>
Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
Edward AD <twuufnxlz@gmail.com>
Bluetooth: hci_sock: fix slab oob read in create_monitor_event
Tony Lindgren <tony@atomide.com>
phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
Tony Lindgren <tony@atomide.com>
phy: mapphone-mdm6600: Fix runtime PM for remove
Tony Lindgren <tony@atomide.com>
phy: mapphone-mdm6600: Fix runtime disable on probe
Haibo Chen <haibo.chen@nxp.com>
gpio: vf610: mask the gpio irq in system suspend and support wakeup
Alexander Stein <alexander.stein@ew.tq-group.com>
gpio: vf610: make irq_chip immutable
Dan Carpenter <dan.carpenter@linaro.org>
ASoC: pxa: fix a memory leak in probe()
Haibo Chen <haibo.chen@nxp.com>
gpio: vf610: set value before the direction to avoid a glitch
Hans de Goede <hdegoede@redhat.com>
platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
Hans de Goede <hdegoede@redhat.com>
platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
Niklas Schnelle <schnelle@linux.ibm.com>
s390/pci: fix iommu bitmap allocation
Peter Zijlstra <peterz@infradead.org>
perf: Disallow mis-matched inherited group reads
Puliang Lu <puliang.lu@fibocom.com>
USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
Benoît Monin <benoit.monin@gmx.fr>
USB: serial: option: add entry for Sierra EM9191 with new firmware
Fabio Porcedda <fabio.porcedda@gmail.com>
USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
Maurizio Lombardi <mlombard@redhat.com>
nvme-rdma: do not try to stop unallocated queues
Keith Busch <kbusch@kernel.org>
nvme-pci: add BOGUS_NID for Intel 0a54 device
Sunil V L <sunilvl@ventanamicro.com>
ACPI: irq: Fix incorrect return value in acpi_register_gsi()
Trond Myklebust <trond.myklebust@hammerspace.com>
pNFS: Fix a hang in nfs4_evict_inode()
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
Avri Altman <avri.altman@wdc.com>
mmc: core: Capture correct oemid-bits for eMMC cards
Haibo Chen <haibo.chen@nxp.com>
mmc: core: sdio: hold retuning if sdio in 1-bit mode
Geert Uytterhoeven <geert+renesas@glider.be>
mtd: physmap-core: Restore map_rom fallback
Martin Kurbanov <mmkurbanov@sberdevices.ru>
mtd: spinand: micron: correct bitmask for ecc status
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: rawnand: arasan: Ensure program page operations are successful
Miquel Raynal <miquel.raynal@bootlin.com>
mtd: rawnand: marvell: Ensure program page operations are successful
Bibek Kumar Patro <quic_bibekkum@quicinc.com>
mtd: rawnand: qcom: Unmap the right resource upon probe failure
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_event: Fix using memcmp when comparing keys
Maher Sanalla <msanalla@nvidia.com>
net/mlx5: Handle fw tracer change ownership event based on MTRC
Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
Rahul Rameshbabu <sergeantsagara@protonmail.com>
HID: multitouch: Add required quirk for Synaptics 0xcd7e device
Josef Bacik <josef@toxicpanda.com>
btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
Kai Uwe Broulik <foss-linux@broulik.de>
drm: panel-orientation-quirks: Add quirk for One Mix 2S
Hangbin Liu <liuhangbin@gmail.com>
ipv4/fib: send notify when delete source address routes
Kees Cook <keescook@chromium.org>
sky2: Make sure there is at least one frag_addr available
Michał Mirosław <mirq-linux@rere.qmqm.pl>
regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
Benjamin Berg <benjamin.berg@intel.com>
wifi: cfg80211: avoid leaking stack data into trace
Wen Gong <quic_wgong@quicinc.com>
wifi: mac80211: allow transmitting EAPOL frames with tainted key
Ilan Peer <ilan.peer@intel.com>
wifi: cfg80211: Fix 6GHz scan configuration
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_core: Fix build warnings
Ying Hsu <yinghsu@chromium.org>
Bluetooth: Avoid redundant authentication
Ma Ke <make_ruc2021@163.com>
HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
Clément Léger <cleger@rivosinc.com>
tracing: relax trace_event_eval_update() execution with cond_resched()
Damien Le Moal <dlemoal@kernel.org>
ata: libata-eh: Fix compilation warning in ata_eh_link_report()
Chengfeng Ye <dg573847474@gmail.com>
gpio: timberdale: Fix potential deadlock on &tgpio->lock
Jeff Layton <jlayton@kernel.org>
overlayfs: set ctime when setting mtime and atime
Heiner Kallweit <hkallweit1@gmail.com>
i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
Josef Bacik <josef@toxicpanda.com>
btrfs: initialize start_slot in btrfs_log_prealloc_extents
Filipe Manana <fdmanana@suse.com>
btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
Tony Lindgren <tony@atomide.com>
ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
RD Babiera <rdbabiera@google.com>
usb: typec: altmodes/displayport: Signal hpd low when exiting mode
Hans de Goede <hdegoede@redhat.com>
usb: typec: altmodes/displayport: Notify drm subsys of hotplug events
Hans de Goede <hdegoede@redhat.com>
drm/connector: Add support for out-of-band hotplug notification (v3)
Hans de Goede <hdegoede@redhat.com>
drm/connector: Add drm_connector_find_by_fwnode() function (v3)
Hans de Goede <hdegoede@redhat.com>
drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2)
Hans de Goede <hdegoede@redhat.com>
drm/connector: Give connector sysfs devices there own device_type
Daniel Miess <daniel.miess@amd.com>
drm/amd/display: Don't set dpms_off for seamless boot
Yongqiang Sun <yongqiang.sun@amd.com>
drm/amd/display: only check available pipe to disable vbios mode.
Tony Lindgren <tony@atomide.com>
serial: 8250_omap: Fix errors with no_console_suspend
Tony Lindgren <tony@atomide.com>
serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: track port suspend state correctly in unsuccessful resume cases
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: decouple usb2 port resume and get_port_status request handling
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: clear usb2 resume related variables in one place.
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: rename resume_done to resume_timestamp
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: move port specific items such as state completions to port structure
Mathias Nyman <mathias.nyman@linux.intel.com>
xhci: cleanup xhci_hub_control port references
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: core: Track SuperSpeed Plus GenXxY
Juntong Deng <juntong.deng@outlook.com>
selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
Waiman Long <longman@redhat.com>
selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
Hans de Goede <hdegoede@redhat.com>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
Paul Menzel <pmenzel@molgen.mpg.de>
ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
Tamim Khan <tamim@fusetak.com>
ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
Hans de Goede <hdegoede@redhat.com>
ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
Tamim Khan <tamim@fusetak.com>
ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
Kellen Renshaw <kellen.renshaw@canonical.com>
ACPI: resource: Add ASUS model S5402ZA to quirks
Tamim Khan <tamim@fusetak.com>
ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
Hui Wang <hui.wang@canonical.com>
ACPI: resources: Add DMI-based legacy IRQ override quirk
John Garry <john.garry@huawei.com>
ACPI: Drop acpi_dev_irqresource_disabled()
John Garry <john.garry@huawei.com>
resource: Add irqresource_disabled()
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
net: pktgen: Fix interface flags printing
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_set_rbtree: .deactivate fails if element has expired
Geert Uytterhoeven <geert+renesas@glider.be>
neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
Pedro Tammela <pctammela@mojatatu.com>
net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
Jinjie Ruan <ruanjinjie@huawei.com>
net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
Michal Schmidt <mschmidt@redhat.com>
i40e: prevent crash on probe if hw registers have invalid values
Dan Carpenter <dan.carpenter@linaro.org>
net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
Eric Dumazet <edumazet@google.com>
ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
Eric Dumazet <edumazet@google.com>
tun: prevent negative ifindex
Eric Dumazet <edumazet@google.com>
tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
Neal Cardwell <ncardwell@google.com>
tcp: fix excessive TLP and RACK timeouts from HZ rounding
Josua Mayer <josua@solid-run.com>
net: rfkill: gpio: prevent value glitch during probe
Ma Ke <make_ruc2021@163.com>
net: ipv6: fix return value check in esp_remove_trailer
Ma Ke <make_ruc2021@163.com>
net: ipv4: fix return value check in esp_remove_trailer
Eric Dumazet <edumazet@google.com>
xfrm: interface: use DEV_STATS_INC()
Eric Dumazet <edumazet@google.com>
xfrm: fix a data-race in xfrm_gen_index()
Manish Chopra <manishc@marvell.com>
qed: fix LL2 RX buffer allocation
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915: Retry gtt fault when out of fence registers
Sagi Grimberg <sagi@grimberg.me>
nvmet-tcp: Fix a possible UAF in queue intialization setup
Florian Westphal <fw@strlen.de>
netfilter: nft_payload: fix wrong mac header matching
Paolo Abeni <pabeni@redhat.com>
tcp: check mptcp-level constraints for backlog coalescing
Joerg Roedel <jroedel@suse.de>
x86/sev: Check for user-space IOIO pointing to kernel space
Joerg Roedel <jroedel@suse.de>
x86/sev: Check IOBM for IOIO exceptions from user-space
Borislav Petkov (AMD) <bp@alien8.de>
x86/sev: Disable MMIO emulation from user mode
Jim Mattson <jmattson@google.com>
KVM: x86: Mask LVTPC when handling a PMI
Johan Hovold <johan+linaro@kernel.org>
regmap: fix NULL deref on lookup
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
Jesse Brandeburg <jesse.brandeburg@intel.com>
ice: reset first in crash dump kernels
Jesse Brandeburg <jesse.brandeburg@intel.com>
ice: fix over-shifted variable
Arnd Bergmann <arnd@arndb.de>
Bluetooth: avoid memcmp() out of bounds warning
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_event: Fix coding style
Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Bluetooth: vhci: Fix race when opening vhci device
Ziyang Xuan <william.xuanziyang@huawei.com>
Bluetooth: Fix a refcnt underflow problem for hci_conn
Lee, Chun-Yi <jlee@suse.com>
Bluetooth: Reject connection with the device which has same BD_ADDR
Lee, Chun-Yi <jlee@suse.com>
Bluetooth: hci_event: Ignore NULL link key
Ricardo Cañuelo <ricardo.canuelo@collabora.com>
usb: hub: Guard against accesses to uninitialized BOS descriptors
Bagas Sanjaya <bagasdotme@gmail.com>
Documentation: sysctl: align cells in second content column
Liam Mark <lmark@codeaurora.org>
mm/memory_hotplug: rate limit page migration warnings
Hyeonggon Yoo <42.hyeyoo@gmail.com>
lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
Nicolas Dichtel <nicolas.dichtel@6wind.com>
dev_forward_skb: do not scrub skb mark within the same name space
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
ravb: Fix use-after-free issue in ravb_tx_timeout_work()
Bart Van Assche <bvanassche@acm.org>
RDMA/srp: Fix srp_abort()
yangx.jy@fujitsu.com <yangx.jy@fujitsu.com>
RDMA/srp: Set scmnd->result only when scmnd is not NULL
Ren Zhijie <renzhijie2@huawei.com>
arm64: armv8_deprecated: fix unused-function error
Mark Rutland <mark.rutland@arm.com>
arm64: armv8_deprecated: rework deprected instruction handling
Mark Rutland <mark.rutland@arm.com>
arm64: armv8_deprecated: move aarch32 helper earlier
Mark Rutland <mark.rutland@arm.com>
arm64: armv8_deprecated move emulation functions
Mark Rutland <mark.rutland@arm.com>
arm64: armv8_deprecated: fold ops into insn_emulation
Mark Rutland <mark.rutland@arm.com>
arm64: rework EL0 MRS emulation
Mark Rutland <mark.rutland@arm.com>
arm64: factor insn read out of call_undef_hook()
Mark Rutland <mark.rutland@arm.com>
arm64: factor out EL1 SSBS emulation hook
Mark Rutland <mark.rutland@arm.com>
arm64: split EL0/EL1 UNDEF handlers
Mark Rutland <mark.rutland@arm.com>
arm64: allow kprobes on EL0 handlers
Mark Rutland <mark.rutland@arm.com>
arm64: rework BTI exception handling
Mark Rutland <mark.rutland@arm.com>
arm64: rework FPAC exception handling
Mark Rutland <mark.rutland@arm.com>
arm64: consistently pass ESR_ELx to die()
Mark Rutland <mark.rutland@arm.com>
arm64: die(): pass 'err' as long
Mark Rutland <mark.rutland@arm.com>
arm64: report EL1 UNDEFs better
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
x86/alternatives: Disable KASAN in apply_alternatives()
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
Duoming Zhou <duoming@zju.edu.cn>
dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
Krishna Kurapati <quic_kriskura@quicinc.com>
usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
Piyush Mehta <piyush.mehta@amd.com>
usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
Dharma Balasubiramani <dharma.b@microchip.com>
counter: microchip-tcb-capture: Fix the use of internal GCLK logic
Dmitry Torokhov <dmitry.torokhov@gmail.com>
pinctrl: avoid unsafe code pattern in find_pinctrl()
Michal Koutný <mkoutny@suse.com>
cgroup: Remove duplicates in cgroup v1 tasks file
Rijo Thomas <Rijo-john.Thomas@amd.com>
tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
Hans de Goede <hdegoede@redhat.com>
Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
Szilard Fabian <szfabian@bluemarch.art>
Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
Matthias Berndt <matthias_berndt@gmx.de>
Input: xpad - add PXN V900 support
Jeffery Miller <jefferymiller@google.com>
Input: psmouse - fix fast_reconnect function for PS/2 mode
Javier Carrasco <javier.carrasco.cruz@gmail.com>
Input: powermate - fix use-after-free in powermate_config_complete
Dan Carpenter <dan.carpenter@linaro.org>
ceph: fix type promotion bug on 32bit systems
Xiubo Li <xiubli@redhat.com>
ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
Jordan Rife <jrife@google.com>
libceph: use kernel_connect()
Mika Westerberg <mika.westerberg@linux.intel.com>
thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
mcb: remove is_added flag from mcb_device struct
Borislav Petkov (AMD) <bp@alien8.de>
x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
Alexander Zangerl <az@breathe-safe.com>
iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
Lakshmi Yadlapati <lakshmiy@us.ibm.com>
iio: pressure: dps310: Adjust Timeout Settings
Phil Elwell <phil@raspberrypi.com>
iio: pressure: bmp280: Fix NULL pointer exception
Xingxing Luo <xingxing.luo@unisoc.com>
usb: musb: Modify the "HWVers" register address
Xingxing Luo <xingxing.luo@unisoc.com>
usb: musb: Get the musb_qh poniter after musb_giveback
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
usb: dwc3: Soft reset phy on probe for host
Javier Carrasco <javier.carrasco.cruz@gmail.com>
net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
Wesley Cheng <quic_wcheng@quicinc.com>
usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
Amelie Delaunay <amelie.delaunay@foss.st.com>
dmaengine: stm32-mdma: abort resume if no ongoing transfer
Zheng Wang <zyytlz.wz@163.com>
media: mtk-jpeg: Fix use after free bug due to uncanceled work
Patrick Rohr <prohr@google.com>
net: release reference to inet6_dev pointer
Patrick Rohr <prohr@google.com>
net: change accept_ra_min_rtr_lft to affect all RA lifetimes
Patrick Rohr <prohr@google.com>
net: add sysctl accept_ra_min_rtr_lft
Sasha Levin <sashal@kernel.org>
Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe"
Sasha Levin <sashal@kernel.org>
Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure"
Waiman Long <longman@redhat.com>
workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
Jeremy Cline <jeremy@jcline.org>
nfc: nci: assert requested protocol is valid
Ralph Siemsen <ralph.siemsen@linaro.org>
pinctrl: renesas: rzn1: Enable missing PINMUX
Eric Dumazet <edumazet@google.com>
net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
Dan Carpenter <dan.carpenter@linaro.org>
ixgbe: fix crash with empty VF macvlan list
Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
net: phy: mscc: macsec: reject PN update requests
Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
net: macsec: indicate next pn update when offloading
Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
drm/vmwgfx: fix typo of sizeof argument
Björn Töpel <bjorn@rivosinc.com>
riscv, bpf: Sign-extend return values
Pu Lehui <pulehui@huawei.com>
riscv, bpf: Factor out emit_call for kernel and bpf context
Roger Pau Monne <roger.pau@citrix.com>
xen-netback: use default TX queue size for vifs
Dan Carpenter <dan.carpenter@linaro.org>
mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
Dinghao Liu <dinghao.liu@zju.edu.cn>
ieee802154: ca8210: Fix a potential UAF in ca8210_probe
Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
ravb: Fix up dma_free_coherent() call in ravb_remove()
Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
Abhinav Kumar <quic_abhinavk@quicinc.com>
drm/msm/dsi: skip the wait for video mode done if not applicable
Kuogee Hsieh <quic_khsieh@quicinc.com>
drm/msm/dp: do not reinitialize phy unless retry during link training
Jordan Rife <jrife@google.com>
net: prevent address rewrite in kernel_bind()
Jan Kara <jack@suse.cz>
quota: Fix slow quotaoff
Hans de Goede <hdegoede@redhat.com>
HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
lib/test_meminit: fix off-by-one error in test_pages()
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning
Jing Zhang <renyu.zj@linux.alibaba.com>
perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
Artem Chernyshev <artem.chernyshev@red-soft.ru>
RDMA/cxgb4: Check skb value for failure to allocate
Bart Van Assche <bvanassche@acm.org>
RDMA/srp: Do not call scsi_done() from srp_abort()
Bart Van Assche <bvanassche@acm.org>
RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
-------------
Diffstat:
Documentation/admin-guide/sysctl/net.rst | 18 +-
Documentation/networking/ip-sysctl.rst | 8 +
Makefile | 4 +-
arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 +
arch/arm64/include/asm/cpufeature.h | 3 +-
arch/arm64/include/asm/exception.h | 13 +-
arch/arm64/include/asm/spectre.h | 2 +
arch/arm64/include/asm/system_misc.h | 2 +-
arch/arm64/include/asm/traps.h | 19 +-
arch/arm64/kernel/armv8_deprecated.c | 572 ++++++++++-----------
arch/arm64/kernel/cpufeature.c | 23 +-
arch/arm64/kernel/entry-common.c | 36 +-
arch/arm64/kernel/proton-pack.c | 26 +-
arch/arm64/kernel/traps.c | 125 ++---
arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 +
arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +-
arch/powerpc/include/asm/nohash/pgtable.h | 2 +
arch/riscv/net/bpf_jit_comp64.c | 33 +-
arch/s390/pci/pci_dma.c | 15 +-
arch/x86/boot/compressed/sev-es.c | 10 +
arch/x86/include/asm/msr-index.h | 9 +-
arch/x86/kernel/alternative.c | 13 +
arch/x86/kernel/cpu/amd.c | 8 +
arch/x86/kernel/sev-es-shared.c | 53 +-
arch/x86/kernel/sev-es.c | 30 ++
arch/x86/kvm/lapic.c | 8 +-
drivers/acpi/irq.c | 7 +-
drivers/acpi/resource.c | 121 ++++-
drivers/ata/libata-eh.c | 2 +-
drivers/base/regmap/regmap.c | 2 +-
drivers/bluetooth/hci_vhci.c | 3 +
drivers/counter/microchip-tcb-capture.c | 2 +-
drivers/dma/mediatek/mtk-uart-apdma.c | 3 +-
drivers/dma/stm32-mdma.c | 4 +
drivers/gpio/gpio-timberdale.c | 5 +-
drivers/gpio/gpio-vf610.c | 46 +-
drivers/gpu/drm/amd/display/dc/core/dc.c | 9 +-
drivers/gpu/drm/drm_connector.c | 79 +++
drivers/gpu/drm/drm_crtc_internal.h | 2 +
drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 +
drivers/gpu/drm/drm_sysfs.c | 87 +++-
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 +
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 +-
drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 +-
drivers/gpu/drm/msm/dsi/dsi_host.c | 12 +
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
drivers/hid/hid-holtek-kbd.c | 4 +
drivers/hid/hid-logitech-hidpp.c | 3 +-
drivers/hid/hid-multitouch.c | 4 +
drivers/i2c/i2c-mux.c | 2 +-
drivers/iio/pressure/bmp280-core.c | 2 +-
drivers/iio/pressure/dps310.c | 8 +-
drivers/iio/pressure/ms5611_core.c | 2 +-
drivers/infiniband/hw/cxgb4/cm.c | 3 +
drivers/infiniband/ulp/srp/ib_srp.c | 172 +++----
drivers/infiniband/ulp/srp/ib_srp.h | 2 -
drivers/input/joystick/xpad.c | 2 +
drivers/input/misc/powermate.c | 1 +
drivers/input/mouse/elantech.c | 1 +
drivers/input/mouse/synaptics.c | 1 +
drivers/input/serio/i8042-acpipnpio.h | 8 +
drivers/input/touchscreen/goodix.c | 19 +
drivers/mcb/mcb-core.c | 10 +-
drivers/mcb/mcb-parse.c | 2 -
drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 +
drivers/mmc/core/mmc.c | 2 +-
drivers/mmc/core/sdio.c | 8 +-
drivers/mtd/maps/physmap-core.c | 11 +
drivers/mtd/nand/raw/arasan-nand-controller.c | 16 +-
drivers/mtd/nand/raw/marvell_nand.c | 23 +-
drivers/mtd/nand/raw/qcom_nandc.c | 2 +-
drivers/mtd/nand/spi/micron.c | 2 +-
drivers/net/dsa/bcm_sf2.c | 24 +-
drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +-
drivers/net/ethernet/intel/ice/ice_lib.c | 3 +-
drivers/net/ethernet/intel/ice/ice_main.c | 15 +
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +-
drivers/net/ethernet/marvell/sky2.h | 2 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
.../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +-
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +-
drivers/net/ethernet/renesas/ravb_main.c | 6 +-
drivers/net/ieee802154/ca8210.c | 17 +-
drivers/net/macsec.c | 2 +
drivers/net/phy/mscc/mscc_macsec.c | 6 +
drivers/net/tun.c | 7 +-
drivers/net/usb/dm9601.c | 7 +-
drivers/net/usb/smsc95xx.c | 2 +-
drivers/net/xen-netback/interface.c | 3 -
drivers/nvme/host/pci.c | 3 +-
drivers/nvme/host/rdma.c | 3 +
drivers/nvme/target/tcp.c | 7 +-
drivers/perf/arm-cmn.c | 2 +-
drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +-
drivers/pinctrl/renesas/Kconfig | 1 +
drivers/platform/x86/asus-nb-wmi.c | 3 +
drivers/platform/x86/asus-wmi.h | 2 +-
drivers/platform/x86/hp-wmi.c | 8 +-
drivers/platform/x86/touchscreen_dmi.c | 23 +
drivers/regulator/core.c | 6 +-
drivers/spi/spi-zynqmp-gqspi.c | 24 +-
drivers/tee/amdtee/core.c | 10 +-
drivers/thunderbolt/icm.c | 38 +-
drivers/thunderbolt/switch.c | 7 +
drivers/tty/serial/8250/8250_omap.c | 93 ++--
drivers/usb/core/hcd.c | 6 +-
drivers/usb/core/hub.c | 106 +++-
drivers/usb/core/hub.h | 2 +-
drivers/usb/dwc3/core.c | 39 +-
drivers/usb/gadget/function/f_ncm.c | 26 +-
drivers/usb/gadget/udc/udc-xilinx.c | 20 +-
drivers/usb/host/xhci-hub.c | 228 ++++----
drivers/usb/host/xhci-mem.c | 10 +-
drivers/usb/host/xhci-ring.c | 17 +-
drivers/usb/host/xhci.h | 9 +-
drivers/usb/musb/musb_debugfs.c | 2 +-
drivers/usb/musb/musb_host.c | 9 +-
drivers/usb/serial/option.c | 7 +
drivers/usb/typec/altmodes/Kconfig | 1 +
drivers/usb/typec/altmodes/displayport.c | 28 +
fs/btrfs/extent-tree.c | 6 +-
fs/btrfs/ioctl.c | 4 +-
fs/btrfs/tree-log.c | 2 +-
fs/ceph/file.c | 2 +-
fs/ceph/inode.c | 4 +-
fs/nfs/pnfs.c | 33 +-
fs/overlayfs/copy_up.c | 2 +-
fs/quota/dquot.c | 66 ++-
include/drm/drm_connector.h | 25 +
include/linux/ioport.h | 7 +
include/linux/ipv6.h | 1 +
include/linux/mcb.h | 1 -
include/linux/netdevice.h | 2 +-
include/linux/perf_event.h | 1 +
include/linux/quota.h | 4 +-
include/linux/quotaops.h | 2 +-
include/linux/usb.h | 2 +
include/net/bluetooth/hci_core.h | 2 +-
include/net/bluetooth/hci_mon.h | 2 +-
include/net/ip_fib.h | 1 +
include/net/macsec.h | 1 +
include/net/netns/xfrm.h | 1 +
include/net/tcp.h | 3 +
include/trace/events/neigh.h | 4 +-
include/uapi/linux/ipv6.h | 7 +
kernel/cgroup/cgroup-v1.c | 5 +-
kernel/events/core.c | 39 +-
kernel/trace/trace_events.c | 1 +
kernel/workqueue.c | 8 +-
lib/Kconfig.debug | 5 +-
lib/test_meminit.c | 2 +-
mm/memory_hotplug.c | 16 +-
net/bluetooth/hci_conn.c | 72 ++-
net/bluetooth/hci_core.c | 8 +-
net/bluetooth/hci_event.c | 33 +-
net/bluetooth/hci_sock.c | 3 +-
net/ceph/messenger.c | 4 +-
net/core/pktgen.c | 14 +-
net/ipv4/esp4.c | 4 +-
net/ipv4/fib_semantics.c | 15 +-
net/ipv4/fib_trie.c | 4 +
net/ipv4/tcp_ipv4.c | 1 +
net/ipv4/tcp_output.c | 25 +-
net/ipv4/tcp_recovery.c | 2 +-
net/ipv6/addrconf.c | 13 +
net/ipv6/esp6.c | 4 +-
net/ipv6/ndisc.c | 13 +-
net/ipv6/xfrm6_policy.c | 4 +-
net/mac80211/tx.c | 3 +-
net/netfilter/ipvs/ip_vs_sync.c | 4 +-
net/netfilter/nft_payload.c | 2 +-
net/netfilter/nft_set_rbtree.c | 2 +
net/nfc/llcp_core.c | 30 +-
net/nfc/nci/core.c | 5 +
net/nfc/nci/spi.c | 2 +
net/rds/tcp_connect.c | 2 +-
net/rds/tcp_listen.c | 2 +-
net/rfkill/rfkill-gpio.c | 4 +-
net/sched/sch_hfsc.c | 18 +-
net/socket.c | 6 +-
net/wireless/nl80211.c | 2 +-
net/wireless/scan.c | 4 +
net/xfrm/xfrm_interface_core.c | 22 +-
net/xfrm/xfrm_policy.c | 6 +-
sound/soc/pxa/pxa-ssp.c | 2 +-
.../selftests/vm/charge_reserved_hugetlb.sh | 34 +-
.../selftests/vm/hugetlb_reparenting_test.sh | 21 +-
tools/testing/selftests/vm/write_hugetlb_memory.sh | 2 +-
188 files changed, 2126 insertions(+), 1202 deletions(-)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 001/202] RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 002/202] RDMA/srp: Do not call scsi_done() from srp_abort() Greg Kroah-Hartman
` (206 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bart Van Assche, Jason Gunthorpe,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit ad215aaea4f9d637f441566cdbbc610e9849e1fa ]
Define .init_cmd_priv and .exit_cmd_priv callback functions in struct
scsi_host_template. Set .cmd_size such that the SCSI core allocates
per-command private data. Use scsi_cmd_priv() to access that private
data. Remove the req_ring pointer from struct srp_rdma_ch since it is no
longer necessary. Convert srp_alloc_req_data() and srp_free_req_data()
into functions that initialize one instance of the SRP-private command
data. This is a micro-optimization since this patch removes several
pointer dereferences from the hot path.
Note: due to commit e73a5e8e8003 ("scsi: core: Only return started
requests from scsi_host_find_tag()"), it is no longer necessary to protect
the completion path against duplicate responses.
Link: https://lore.kernel.org/r/20210524041211.9480-6-bvanassche@acm.org
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Stable-dep-of: e193b7955dfa ("RDMA/srp: Do not call scsi_done() from srp_abort()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 153 ++++++++++++----------------
drivers/infiniband/ulp/srp/ib_srp.h | 2 -
2 files changed, 63 insertions(+), 92 deletions(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index 9b9b9557ae746..f47d104e6c9d7 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -965,67 +965,52 @@ static void srp_disconnect_target(struct srp_target_port *target)
}
}
-static void srp_free_req_data(struct srp_target_port *target,
- struct srp_rdma_ch *ch)
+static int srp_exit_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
{
+ struct srp_target_port *target = host_to_target(shost);
struct srp_device *dev = target->srp_host->srp_dev;
struct ib_device *ibdev = dev->dev;
- struct srp_request *req;
- int i;
+ struct srp_request *req = scsi_cmd_priv(cmd);
- if (!ch->req_ring)
- return;
-
- for (i = 0; i < target->req_ring_size; ++i) {
- req = &ch->req_ring[i];
- if (dev->use_fast_reg)
- kfree(req->fr_list);
- if (req->indirect_dma_addr) {
- ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
- target->indirect_size,
- DMA_TO_DEVICE);
- }
- kfree(req->indirect_desc);
+ kfree(req->fr_list);
+ if (req->indirect_dma_addr) {
+ ib_dma_unmap_single(ibdev, req->indirect_dma_addr,
+ target->indirect_size,
+ DMA_TO_DEVICE);
}
+ kfree(req->indirect_desc);
- kfree(ch->req_ring);
- ch->req_ring = NULL;
+ return 0;
}
-static int srp_alloc_req_data(struct srp_rdma_ch *ch)
+static int srp_init_cmd_priv(struct Scsi_Host *shost, struct scsi_cmnd *cmd)
{
- struct srp_target_port *target = ch->target;
+ struct srp_target_port *target = host_to_target(shost);
struct srp_device *srp_dev = target->srp_host->srp_dev;
struct ib_device *ibdev = srp_dev->dev;
- struct srp_request *req;
+ struct srp_request *req = scsi_cmd_priv(cmd);
dma_addr_t dma_addr;
- int i, ret = -ENOMEM;
+ int ret = -ENOMEM;
- ch->req_ring = kcalloc(target->req_ring_size, sizeof(*ch->req_ring),
- GFP_KERNEL);
- if (!ch->req_ring)
- goto out;
-
- for (i = 0; i < target->req_ring_size; ++i) {
- req = &ch->req_ring[i];
- if (srp_dev->use_fast_reg) {
- req->fr_list = kmalloc_array(target->mr_per_cmd,
- sizeof(void *), GFP_KERNEL);
- if (!req->fr_list)
- goto out;
- }
- req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
- if (!req->indirect_desc)
- goto out;
-
- dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
- target->indirect_size,
- DMA_TO_DEVICE);
- if (ib_dma_mapping_error(ibdev, dma_addr))
+ if (srp_dev->use_fast_reg) {
+ req->fr_list = kmalloc_array(target->mr_per_cmd, sizeof(void *),
+ GFP_KERNEL);
+ if (!req->fr_list)
goto out;
+ }
+ req->indirect_desc = kmalloc(target->indirect_size, GFP_KERNEL);
+ if (!req->indirect_desc)
+ goto out;
- req->indirect_dma_addr = dma_addr;
+ dma_addr = ib_dma_map_single(ibdev, req->indirect_desc,
+ target->indirect_size,
+ DMA_TO_DEVICE);
+ if (ib_dma_mapping_error(ibdev, dma_addr)) {
+ srp_exit_cmd_priv(shost, cmd);
+ goto out;
}
+
+ req->indirect_dma_addr = dma_addr;
ret = 0;
out:
@@ -1067,10 +1052,6 @@ static void srp_remove_target(struct srp_target_port *target)
}
cancel_work_sync(&target->tl_err_work);
srp_rport_put(target->rport);
- for (i = 0; i < target->ch_count; i++) {
- ch = &target->ch[i];
- srp_free_req_data(target, ch);
- }
kfree(target->ch);
target->ch = NULL;
@@ -1289,22 +1270,32 @@ static void srp_finish_req(struct srp_rdma_ch *ch, struct srp_request *req,
}
}
-static void srp_terminate_io(struct srp_rport *rport)
+struct srp_terminate_context {
+ struct srp_target_port *srp_target;
+ int scsi_result;
+};
+
+static bool srp_terminate_cmd(struct scsi_cmnd *scmnd, void *context_ptr,
+ bool reserved)
{
- struct srp_target_port *target = rport->lld_data;
- struct srp_rdma_ch *ch;
- int i, j;
+ struct srp_terminate_context *context = context_ptr;
+ struct srp_target_port *target = context->srp_target;
+ u32 tag = blk_mq_unique_tag(scmnd->request);
+ struct srp_rdma_ch *ch = &target->ch[blk_mq_unique_tag_to_hwq(tag)];
+ struct srp_request *req = scsi_cmd_priv(scmnd);
- for (i = 0; i < target->ch_count; i++) {
- ch = &target->ch[i];
+ srp_finish_req(ch, req, NULL, context->scsi_result);
- for (j = 0; j < target->req_ring_size; ++j) {
- struct srp_request *req = &ch->req_ring[j];
+ return true;
+}
- srp_finish_req(ch, req, NULL,
- DID_TRANSPORT_FAILFAST << 16);
- }
- }
+static void srp_terminate_io(struct srp_rport *rport)
+{
+ struct srp_target_port *target = rport->lld_data;
+ struct srp_terminate_context context = { .srp_target = target,
+ .scsi_result = DID_TRANSPORT_FAILFAST << 16 };
+
+ scsi_host_busy_iter(target->scsi_host, srp_terminate_cmd, &context);
}
/* Calculate maximum initiator to target information unit length. */
@@ -1360,13 +1351,12 @@ static int srp_rport_reconnect(struct srp_rport *rport)
ch = &target->ch[i];
ret += srp_new_cm_id(ch);
}
- for (i = 0; i < target->ch_count; i++) {
- ch = &target->ch[i];
- for (j = 0; j < target->req_ring_size; ++j) {
- struct srp_request *req = &ch->req_ring[j];
+ {
+ struct srp_terminate_context context = {
+ .srp_target = target, .scsi_result = DID_RESET << 16};
- srp_finish_req(ch, req, NULL, DID_RESET << 16);
- }
+ scsi_host_busy_iter(target->scsi_host, srp_terminate_cmd,
+ &context);
}
for (i = 0; i < target->ch_count; i++) {
ch = &target->ch[i];
@@ -1962,13 +1952,10 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
spin_unlock_irqrestore(&ch->lock, flags);
} else {
scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag);
- if (scmnd && scmnd->host_scribble) {
- req = (void *)scmnd->host_scribble;
+ if (scmnd) {
+ req = scsi_cmd_priv(scmnd);
scmnd = srp_claim_req(ch, req, NULL, scmnd);
} else {
- scmnd = NULL;
- }
- if (!scmnd) {
shost_printk(KERN_ERR, target->scsi_host,
"Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n",
rsp->tag, ch - target->ch, ch->qp->qp_num);
@@ -1996,7 +1983,6 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp)
srp_free_req(ch, req, scmnd,
be32_to_cpu(rsp->req_lim_delta));
- scmnd->host_scribble = NULL;
scmnd->scsi_done(scmnd);
}
}
@@ -2164,13 +2150,12 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
{
struct srp_target_port *target = host_to_target(shost);
struct srp_rdma_ch *ch;
- struct srp_request *req;
+ struct srp_request *req = scsi_cmd_priv(scmnd);
struct srp_iu *iu;
struct srp_cmd *cmd;
struct ib_device *dev;
unsigned long flags;
u32 tag;
- u16 idx;
int len, ret;
scmnd->result = srp_chkready(target->rport);
@@ -2180,10 +2165,6 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
WARN_ON_ONCE(scmnd->request->tag < 0);
tag = blk_mq_unique_tag(scmnd->request);
ch = &target->ch[blk_mq_unique_tag_to_hwq(tag)];
- idx = blk_mq_unique_tag_to_tag(tag);
- WARN_ONCE(idx >= target->req_ring_size, "%s: tag %#x: idx %d >= %d\n",
- dev_name(&shost->shost_gendev), tag, idx,
- target->req_ring_size);
spin_lock_irqsave(&ch->lock, flags);
iu = __srp_get_tx_iu(ch, SRP_IU_CMD);
@@ -2192,13 +2173,10 @@ static int srp_queuecommand(struct Scsi_Host *shost, struct scsi_cmnd *scmnd)
if (!iu)
goto err;
- req = &ch->req_ring[idx];
dev = target->srp_host->srp_dev->dev;
ib_dma_sync_single_for_cpu(dev, iu->dma, ch->max_it_iu_len,
DMA_TO_DEVICE);
- scmnd->host_scribble = (void *) req;
-
cmd = iu->buf;
memset(cmd, 0, sizeof *cmd);
@@ -3075,6 +3053,8 @@ static struct scsi_host_template srp_template = {
.target_alloc = srp_target_alloc,
.slave_configure = srp_slave_configure,
.info = srp_target_info,
+ .init_cmd_priv = srp_init_cmd_priv,
+ .exit_cmd_priv = srp_exit_cmd_priv,
.queuecommand = srp_queuecommand,
.change_queue_depth = srp_change_queue_depth,
.eh_timed_out = srp_timed_out,
@@ -3088,6 +3068,7 @@ static struct scsi_host_template srp_template = {
.cmd_per_lun = SRP_DEFAULT_CMD_SQ_SIZE,
.shost_attrs = srp_host_attrs,
.track_queue_depth = 1,
+ .cmd_size = sizeof(struct srp_request),
};
static int srp_sdev_count(struct Scsi_Host *host)
@@ -3735,8 +3716,6 @@ static ssize_t srp_create_target(struct device *dev,
if (ret)
goto out;
- target->req_ring_size = target->queue_size - SRP_TSK_MGMT_SQ_SIZE;
-
if (!srp_conn_unique(target->srp_host, target)) {
if (target->using_rdma_cm) {
shost_printk(KERN_INFO, target->scsi_host,
@@ -3839,10 +3818,6 @@ static ssize_t srp_create_target(struct device *dev,
if (ret)
goto err_disconnect;
- ret = srp_alloc_req_data(ch);
- if (ret)
- goto err_disconnect;
-
ret = srp_connect_ch(ch, max_iu_len, multich);
if (ret) {
char dst[64];
@@ -3861,7 +3836,6 @@ static ssize_t srp_create_target(struct device *dev,
goto free_ch;
} else {
srp_free_ch_ib(target, ch);
- srp_free_req_data(target, ch);
target->ch_count = ch - target->ch;
goto connected;
}
@@ -3922,7 +3896,6 @@ static ssize_t srp_create_target(struct device *dev,
for (i = 0; i < target->ch_count; i++) {
ch = &target->ch[i];
srp_free_ch_ib(target, ch);
- srp_free_req_data(target, ch);
}
kfree(target->ch);
diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h
index 85bac20d9007d..152242e8f733d 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.h
+++ b/drivers/infiniband/ulp/srp/ib_srp.h
@@ -176,7 +176,6 @@ struct srp_rdma_ch {
struct srp_iu **tx_ring;
struct srp_iu **rx_ring;
- struct srp_request *req_ring;
int comp_vector;
u64 tsk_mgmt_tag;
@@ -222,7 +221,6 @@ struct srp_target_port {
int mr_pool_size;
int mr_per_cmd;
int queue_size;
- int req_ring_size;
int comp_vector;
int tl_retry_count;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 002/202] RDMA/srp: Do not call scsi_done() from srp_abort()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 001/202] RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 003/202] RDMA/cxgb4: Check skb value for failure to allocate Greg Kroah-Hartman
` (205 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bob Pearson, Shinichiro Kawasaki,
Bart Van Assche, Leon Romanovsky, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
[ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ]
After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler
callback, it performs one of the following actions:
* Call scsi_queue_insert().
* Call scsi_finish_command().
* Call scsi_eh_scmd_add().
Hence, SCSI abort handlers must not call scsi_done(). Otherwise all
the above actions would trigger a use-after-free. Hence remove the
scsi_done() call from srp_abort(). Keep the srp_free_req() call
before returning SUCCESS because we may not see the command again if
SUCCESS is returned.
Cc: Bob Pearson <rpearsonhpe@gmail.com>
Cc: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
index f47d104e6c9d7..12bc24ee2d131 100644
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -2781,7 +2781,6 @@ static int srp_abort(struct scsi_cmnd *scmnd)
u32 tag;
u16 ch_idx;
struct srp_rdma_ch *ch;
- int ret;
shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
@@ -2797,19 +2796,14 @@ static int srp_abort(struct scsi_cmnd *scmnd)
shost_printk(KERN_ERR, target->scsi_host,
"Sending SRP abort for tag %#x\n", tag);
if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun,
- SRP_TSK_ABORT_TASK, NULL) == 0)
- ret = SUCCESS;
- else if (target->rport->state == SRP_RPORT_LOST)
- ret = FAST_IO_FAIL;
- else
- ret = FAILED;
- if (ret == SUCCESS) {
+ SRP_TSK_ABORT_TASK, NULL) == 0) {
srp_free_req(ch, req, scmnd, 0);
- scmnd->result = DID_ABORT << 16;
- scmnd->scsi_done(scmnd);
+ return SUCCESS;
}
+ if (target->rport->state == SRP_RPORT_LOST)
+ return FAST_IO_FAIL;
- return ret;
+ return FAILED;
}
static int srp_reset_device(struct scsi_cmnd *scmnd)
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 003/202] RDMA/cxgb4: Check skb value for failure to allocate
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 001/202] RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 002/202] RDMA/srp: Do not call scsi_done() from srp_abort() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 004/202] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 Greg Kroah-Hartman
` (204 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Artem Chernyshev, Leon Romanovsky,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
[ Upstream commit 8fb8a82086f5bda6893ea6557c5a458e4549c6d7 ]
get_skb() can fail to allocate skb, so check it.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 5be78ee924ae ("RDMA/cxgb4: Fix LE hash collision bug for active open connection")
Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Link: https://lore.kernel.org/r/20230905124048.284165-1-artem.chernyshev@red-soft.ru
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/cxgb4/cm.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/infiniband/hw/cxgb4/cm.c b/drivers/infiniband/hw/cxgb4/cm.c
index e42c812e74c3c..8c54b1be04424 100644
--- a/drivers/infiniband/hw/cxgb4/cm.c
+++ b/drivers/infiniband/hw/cxgb4/cm.c
@@ -1965,6 +1965,9 @@ static int send_fw_act_open_req(struct c4iw_ep *ep, unsigned int atid)
int win;
skb = get_skb(NULL, sizeof(*req), GFP_KERNEL);
+ if (!skb)
+ return -ENOMEM;
+
req = __skb_put_zero(skb, sizeof(*req));
req->op_compl = htonl(WR_OP_V(FW_OFLD_CONNECTION_WR));
req->len16_pkd = htonl(FW_WR_LEN16_V(DIV_ROUND_UP(sizeof(*req), 16)));
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 004/202] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 003/202] RDMA/cxgb4: Check skb value for failure to allocate Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 005/202] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Greg Kroah-Hartman
` (203 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jing Zhang, Robin Murphy,
Will Deacon, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jing Zhang <renyu.zj@linux.alibaba.com>
[ Upstream commit 7f949f6f54ff593123ab95b6247bfa4542a65580 ]
The register por_dt_pmovsr Bits[7:0] indicates overflow from counters 7
to 0. But in arm_cmn_handle_irq(), only handled the overflow status of
Bits[3:0] which results in unhandled overflow status of counters 4 to 7.
So let the overflow status of DTC counters 4 to 7 to be handled.
Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver")
Signed-off-by: Jing Zhang <renyu.zj@linux.alibaba.com>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/1695612152-123633-1-git-send-email-renyu.zj@linux.alibaba.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/perf/arm-cmn.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c
index 36061aaf026c8..ac4428e8fae92 100644
--- a/drivers/perf/arm-cmn.c
+++ b/drivers/perf/arm-cmn.c
@@ -1177,7 +1177,7 @@ static irqreturn_t arm_cmn_handle_irq(int irq, void *dev_id)
u64 delta;
int i;
- for (i = 0; i < CMN_DTM_NUM_COUNTERS; i++) {
+ for (i = 0; i < CMN_DT_NUM_COUNTERS; i++) {
if (status & (1U << i)) {
ret = IRQ_HANDLED;
if (WARN_ON(!dtc->counters[i]))
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 005/202] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 004/202] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 006/202] lib/test_meminit: fix off-by-one error in test_pages() Greg Kroah-Hartman
` (202 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Hans de Goede,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 5b44abbc39ca15df80d0da4756078c98c831090f ]
As described in the added code comment, a reference to .exit.text is ok
for drivers registered via module_platform_driver_probe(). Make this
explicit to prevent a section mismatch warning:
WARNING: modpost: drivers/platform/x86/hp/hp-wmi: section mismatch in reference: hp_wmi_driver+0x8 (section: .data) -> hp_wmi_bios_remove (section: .exit.text)
Fixes: c165b80cfecc ("hp-wmi: fix handling of platform device")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20231004111624.2667753-1-u.kleine-koenig@pengutronix.de
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/hp-wmi.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index 6642d09b17b55..364d95cdaf2db 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -986,7 +986,13 @@ static const struct dev_pm_ops hp_wmi_pm_ops = {
.restore = hp_wmi_resume_handler,
};
-static struct platform_driver hp_wmi_driver = {
+/*
+ * hp_wmi_bios_remove() lives in .exit.text. For drivers registered via
+ * module_platform_driver_probe() this is ok because they cannot get unbound at
+ * runtime. So mark the driver struct with __refdata to prevent modpost
+ * triggering a section mismatch warning.
+ */
+static struct platform_driver hp_wmi_driver __refdata = {
.driver = {
.name = "hp-wmi",
.pm = &hp_wmi_pm_ops,
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 006/202] lib/test_meminit: fix off-by-one error in test_pages()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 005/202] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 007/202] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman
` (201 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable, linux-kernel
Cc: Greg Kroah-Hartman, patches, Andrew Donnellan,
Alexander Potapenko, Xiaoke Wang, Andrew Morton
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit efb78fa86e95 ("lib/test_meminit: allocate pages up to order
MAX_ORDER") works great in kernels 6.4 and newer thanks to commit
23baf831a32c ("mm, treewide: redefine MAX_ORDER sanely"), but for older
kernels, the loop is off by one, which causes crashes when the test
runs.
Fix this up by changing "<= MAX_ORDER" "< MAX_ORDER" to allow the test
to work properly for older kernel branches.
Fixes: 2a1cf9fe09d9 ("lib/test_meminit: allocate pages up to order MAX_ORDER")
Cc: Andrew Donnellan <ajd@linux.ibm.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Xiaoke Wang <xkernel.wang@foxmail.com>
Cc: <stable@vger.kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/test_meminit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/lib/test_meminit.c
+++ b/lib/test_meminit.c
@@ -86,7 +86,7 @@ static int __init test_pages(int *total_
int failures = 0, num_tests = 0;
int i;
- for (i = 0; i <= MAX_ORDER; i++)
+ for (i = 0; i < MAX_ORDER; i++)
num_tests += do_alloc_pages_order(i, &failures);
REPORT_FAILURES_IN_FN();
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 007/202] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 006/202] lib/test_meminit: fix off-by-one error in test_pages() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 008/202] quota: Fix slow quotaoff Greg Kroah-Hartman
` (200 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hans de Goede, Benjamin Tissoires
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit dac501397b9d81e4782232c39f94f4307b137452 upstream.
hidpp_connect_event() has *four* time-of-check vs time-of-use (TOCTOU)
races when it races with itself.
hidpp_connect_event() primarily runs from a workqueue but it also runs
on probe() and if a "device-connected" packet is received by the hw
when the thread running hidpp_connect_event() from probe() is waiting on
the hw, then a second thread running hidpp_connect_event() will be
started from the workqueue.
This opens the following races (note the below code is simplified):
1. Retrieving + printing the protocol (harmless race):
if (!hidpp->protocol_major) {
hidpp_root_get_protocol_version()
hidpp->protocol_major = response.rap.params[0];
}
We can actually see this race hit in the dmesg in the abrt output
attached to rhbz#2227968:
[ 3064.624215] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.
[ 3064.658184] logitech-hidpp-device 0003:046D:4071.0049: HID++ 4.5 device connected.
Testing with extra logging added has shown that after this the 2 threads
take turn grabbing the hw access mutex (send_mutex) so they ping-pong
through all the other TOCTOU cases managing to hit all of them:
2. Updating the name to the HIDPP name (harmless race):
if (hidpp->name == hdev->name) {
...
hidpp->name = new_name;
}
3. Initializing the power_supply class for the battery (problematic!):
hidpp_initialize_battery()
{
if (hidpp->battery.ps)
return 0;
probe_battery(); /* Blocks, threads take turns executing this */
hidpp->battery.desc.properties =
devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);
hidpp->battery.ps =
devm_power_supply_register(&hidpp->hid_dev->dev,
&hidpp->battery.desc, cfg);
}
4. Creating delayed input_device (potentially problematic):
if (hidpp->delayed_input)
return;
hidpp->delayed_input = hidpp_allocate_input(hdev);
The really big problem here is 3. Hitting the race leads to the following
sequence:
hidpp->battery.desc.properties =
devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);
hidpp->battery.ps =
devm_power_supply_register(&hidpp->hid_dev->dev,
&hidpp->battery.desc, cfg);
...
hidpp->battery.desc.properties =
devm_kmemdup(dev, hidpp_battery_props, cnt, GFP_KERNEL);
hidpp->battery.ps =
devm_power_supply_register(&hidpp->hid_dev->dev,
&hidpp->battery.desc, cfg);
So now we have registered 2 power supplies for the same battery,
which looks a bit weird from userspace's pov but this is not even
the really big problem.
Notice how:
1. This is all devm-maganaged
2. The hidpp->battery.desc struct is shared between the 2 power supplies
3. hidpp->battery.desc.properties points to the result from the second
devm_kmemdup()
This causes a use after free scenario on USB disconnect of the receiver:
1. The last registered power supply class device gets unregistered
2. The memory from the last devm_kmemdup() call gets freed,
hidpp->battery.desc.properties now points to freed memory
3. The first registered power supply class device gets unregistered,
this involves sending a remove uevent to userspace which invokes
power_supply_uevent() to fill the uevent data
4. power_supply_uevent() uses hidpp->battery.desc.properties which
now points to freed memory leading to backtraces like this one:
Sep 22 20:01:35 eric kernel: BUG: unable to handle page fault for address: ffffb2140e017f08
...
Sep 22 20:01:35 eric kernel: Workqueue: usb_hub_wq hub_event
Sep 22 20:01:35 eric kernel: RIP: 0010:power_supply_uevent+0xee/0x1d0
...
Sep 22 20:01:35 eric kernel: ? asm_exc_page_fault+0x26/0x30
Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0xee/0x1d0
Sep 22 20:01:35 eric kernel: ? power_supply_uevent+0x10d/0x1d0
Sep 22 20:01:35 eric kernel: dev_uevent+0x10f/0x2d0
Sep 22 20:01:35 eric kernel: kobject_uevent_env+0x291/0x680
Sep 22 20:01:35 eric kernel: power_supply_unregister+0x8e/0xa0
Sep 22 20:01:35 eric kernel: release_nodes+0x3d/0xb0
Sep 22 20:01:35 eric kernel: devres_release_group+0xfc/0x130
Sep 22 20:01:35 eric kernel: hid_device_remove+0x56/0xa0
Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200
Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130
Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0
Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440
Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60
Sep 22 20:01:35 eric kernel: logi_dj_remove+0x9a/0x100 [hid_logitech_dj 5c91534a0ead2b65e04dd799a0437e3b99b21bc4]
Sep 22 20:01:35 eric kernel: hid_device_remove+0x44/0xa0
Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200
Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130
Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0
Sep 22 20:01:35 eric kernel: ? __queue_work+0x1df/0x440
Sep 22 20:01:35 eric kernel: hid_destroy_device+0x4b/0x60
Sep 22 20:01:35 eric kernel: usbhid_disconnect+0x47/0x60 [usbhid 727dcc1c0b94e6b4418727a468398ac3bca492f3]
Sep 22 20:01:35 eric kernel: usb_unbind_interface+0x90/0x270
Sep 22 20:01:35 eric kernel: device_release_driver_internal+0x19f/0x200
Sep 22 20:01:35 eric kernel: bus_remove_device+0xc6/0x130
Sep 22 20:01:35 eric kernel: device_del+0x15c/0x3f0
Sep 22 20:01:35 eric kernel: ? kobject_put+0xa0/0x1d0
Sep 22 20:01:35 eric kernel: usb_disable_device+0xcd/0x1e0
Sep 22 20:01:35 eric kernel: usb_disconnect+0xde/0x2c0
Sep 22 20:01:35 eric kernel: usb_disconnect+0xc3/0x2c0
Sep 22 20:01:35 eric kernel: hub_event+0xe80/0x1c10
There have been quite a few bug reports (see Link tags) about this crash.
Fix all the TOCTOU issues, including the really bad power-supply related
system crash on USB disconnect, by making probe() use the workqueue for
running hidpp_connect_event() too, so that it can never run more then once.
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227221
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2227968
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2242189
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217412#c58
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231005182638.3776-1-hdegoede@redhat.com
Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/hid-logitech-hidpp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/hid/hid-logitech-hidpp.c
+++ b/drivers/hid/hid-logitech-hidpp.c
@@ -3936,7 +3936,8 @@ static int hidpp_probe(struct hid_device
goto hid_hw_init_fail;
}
- hidpp_connect_event(hidpp);
+ schedule_work(&hidpp->work);
+ flush_work(&hidpp->work);
if (will_restart) {
/* Reset the HID node state */
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 008/202] quota: Fix slow quotaoff
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 007/202] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 009/202] net: prevent address rewrite in kernel_bind() Greg Kroah-Hartman
` (199 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Whitney, Jan Kara
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Kara <jack@suse.cz>
commit 869b6ea1609f655a43251bf41757aa44e5350a8f upstream.
Eric has reported that commit dabc8b207566 ("quota: fix dqput() to
follow the guarantees dquot_srcu should provide") heavily increases
runtime of generic/270 xfstest for ext4 in nojournal mode. The reason
for this is that ext4 in nojournal mode leaves dquots dirty until the last
dqput() and thus the cleanup done in quota_release_workfn() has to write
them all. Due to the way quota_release_workfn() is written this results
in synchronize_srcu() call for each dirty dquot which makes the dquot
cleanup when turning quotas off extremely slow.
To be able to avoid synchronize_srcu() for each dirty dquot we need to
rework how we track dquots to be cleaned up. Instead of keeping the last
dquot reference while it is on releasing_dquots list, we drop it right
away and mark the dquot with new DQ_RELEASING_B bit instead. This way we
can we can remove dquot from releasing_dquots list when new reference to
it is acquired and thus there's no need to call synchronize_srcu() each
time we drop dq_list_lock.
References: https://lore.kernel.org/all/ZRytn6CxFK2oECUt@debian-BULLSEYE-live-builder-AMD64
Reported-by: Eric Whitney <enwlinux@gmail.com>
Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/quota/dquot.c | 66 +++++++++++++++++++++++++++--------------------
include/linux/quota.h | 4 ++
include/linux/quotaops.h | 2 -
3 files changed, 43 insertions(+), 29 deletions(-)
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -233,19 +233,18 @@ static void put_quota_format(struct quot
* All dquots are placed to the end of inuse_list when first created, and this
* list is used for invalidate operation, which must look at every dquot.
*
- * When the last reference of a dquot will be dropped, the dquot will be
- * added to releasing_dquots. We'd then queue work item which would call
+ * When the last reference of a dquot is dropped, the dquot is added to
+ * releasing_dquots. We'll then queue work item which will call
* synchronize_srcu() and after that perform the final cleanup of all the
- * dquots on the list. Both releasing_dquots and free_dquots use the
- * dq_free list_head in the dquot struct. When a dquot is removed from
- * releasing_dquots, a reference count is always subtracted, and if
- * dq_count == 0 at that point, the dquot will be added to the free_dquots.
+ * dquots on the list. Each cleaned up dquot is moved to free_dquots list.
+ * Both releasing_dquots and free_dquots use the dq_free list_head in the dquot
+ * struct.
*
- * Unused dquots (dq_count == 0) are added to the free_dquots list when freed,
- * and this list is searched whenever we need an available dquot. Dquots are
- * removed from the list as soon as they are used again, and
- * dqstats.free_dquots gives the number of dquots on the list. When
- * dquot is invalidated it's completely released from memory.
+ * Unused and cleaned up dquots are in the free_dquots list and this list is
+ * searched whenever we need an available dquot. Dquots are removed from the
+ * list as soon as they are used again and dqstats.free_dquots gives the number
+ * of dquots on the list. When dquot is invalidated it's completely released
+ * from memory.
*
* Dirty dquots are added to the dqi_dirty_list of quota_info when mark
* dirtied, and this list is searched when writing dirty dquots back to
@@ -323,6 +322,7 @@ static inline void put_dquot_last(struct
static inline void put_releasing_dquots(struct dquot *dquot)
{
list_add_tail(&dquot->dq_free, &releasing_dquots);
+ set_bit(DQ_RELEASING_B, &dquot->dq_flags);
}
static inline void remove_free_dquot(struct dquot *dquot)
@@ -330,8 +330,10 @@ static inline void remove_free_dquot(str
if (list_empty(&dquot->dq_free))
return;
list_del_init(&dquot->dq_free);
- if (!atomic_read(&dquot->dq_count))
+ if (!test_bit(DQ_RELEASING_B, &dquot->dq_flags))
dqstats_dec(DQST_FREE_DQUOTS);
+ else
+ clear_bit(DQ_RELEASING_B, &dquot->dq_flags);
}
static inline void put_inuse(struct dquot *dquot)
@@ -583,12 +585,6 @@ restart:
continue;
/* Wait for dquot users */
if (atomic_read(&dquot->dq_count)) {
- /* dquot in releasing_dquots, flush and retry */
- if (!list_empty(&dquot->dq_free)) {
- spin_unlock(&dq_list_lock);
- goto restart;
- }
-
atomic_inc(&dquot->dq_count);
spin_unlock(&dq_list_lock);
/*
@@ -608,6 +604,15 @@ restart:
goto restart;
}
/*
+ * The last user already dropped its reference but dquot didn't
+ * get fully cleaned up yet. Restart the scan which flushes the
+ * work cleaning up released dquots.
+ */
+ if (test_bit(DQ_RELEASING_B, &dquot->dq_flags)) {
+ spin_unlock(&dq_list_lock);
+ goto restart;
+ }
+ /*
* Quota now has no users and it has been written on last
* dqput()
*/
@@ -698,6 +703,13 @@ int dquot_writeback_dquots(struct super_
dq_dirty);
WARN_ON(!dquot_active(dquot));
+ /* If the dquot is releasing we should not touch it */
+ if (test_bit(DQ_RELEASING_B, &dquot->dq_flags)) {
+ spin_unlock(&dq_list_lock);
+ flush_delayed_work("a_release_work);
+ spin_lock(&dq_list_lock);
+ continue;
+ }
/* Now we have active dquot from which someone is
* holding reference so we can safely just increase
@@ -811,18 +823,18 @@ static void quota_release_workfn(struct
/* Exchange the list head to avoid livelock. */
list_replace_init(&releasing_dquots, &rls_head);
spin_unlock(&dq_list_lock);
+ synchronize_srcu(&dquot_srcu);
restart:
- synchronize_srcu(&dquot_srcu);
spin_lock(&dq_list_lock);
while (!list_empty(&rls_head)) {
dquot = list_first_entry(&rls_head, struct dquot, dq_free);
- /* Dquot got used again? */
- if (atomic_read(&dquot->dq_count) > 1) {
- remove_free_dquot(dquot);
- atomic_dec(&dquot->dq_count);
- continue;
- }
+ WARN_ON_ONCE(atomic_read(&dquot->dq_count));
+ /*
+ * Note that DQ_RELEASING_B protects us from racing with
+ * invalidate_dquots() calls so we are safe to work with the
+ * dquot even after we drop dq_list_lock.
+ */
if (dquot_dirty(dquot)) {
spin_unlock(&dq_list_lock);
/* Commit dquot before releasing */
@@ -836,7 +848,6 @@ restart:
}
/* Dquot is inactive and clean, now move it to free list */
remove_free_dquot(dquot);
- atomic_dec(&dquot->dq_count);
put_dquot_last(dquot);
}
spin_unlock(&dq_list_lock);
@@ -877,6 +888,7 @@ void dqput(struct dquot *dquot)
BUG_ON(!list_empty(&dquot->dq_free));
#endif
put_releasing_dquots(dquot);
+ atomic_dec(&dquot->dq_count);
spin_unlock(&dq_list_lock);
queue_delayed_work(system_unbound_wq, "a_release_work, 1);
}
@@ -965,7 +977,7 @@ we_slept:
dqstats_inc(DQST_LOOKUPS);
}
/* Wait for dq_lock - after this we know that either dquot_release() is
- * already finished or it will be canceled due to dq_count > 1 test */
+ * already finished or it will be canceled due to dq_count > 0 test */
wait_on_dquot(dquot);
/* Read the dquot / allocate space in quota file */
if (!dquot_active(dquot)) {
--- a/include/linux/quota.h
+++ b/include/linux/quota.h
@@ -285,7 +285,9 @@ static inline void dqstats_dec(unsigned
#define DQ_FAKE_B 3 /* no limits only usage */
#define DQ_READ_B 4 /* dquot was read into memory */
#define DQ_ACTIVE_B 5 /* dquot is active (dquot_release not called) */
-#define DQ_LASTSET_B 6 /* Following 6 bits (see QIF_) are reserved\
+#define DQ_RELEASING_B 6 /* dquot is in releasing_dquots list waiting
+ * to be cleaned up */
+#define DQ_LASTSET_B 7 /* Following 6 bits (see QIF_) are reserved\
* for the mask of entries set via SETQUOTA\
* quotactl. They are set under dq_data_lock\
* and the quota format handling dquot can\
--- a/include/linux/quotaops.h
+++ b/include/linux/quotaops.h
@@ -56,7 +56,7 @@ static inline bool dquot_is_busy(struct
{
if (test_bit(DQ_MOD_B, &dquot->dq_flags))
return true;
- if (atomic_read(&dquot->dq_count) > 1)
+ if (atomic_read(&dquot->dq_count) > 0)
return true;
return false;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 009/202] net: prevent address rewrite in kernel_bind()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 008/202] quota: Fix slow quotaoff Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 010/202] drm/msm/dp: do not reinitialize phy unless retry during link training Greg Kroah-Hartman
` (198 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Willem de Bruijn, Jordan Rife,
Simon Horman, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <jrife@google.com>
commit c889a99a21bf124c3db08d09df919f0eccc5ea4c upstream.
Similar to the change in commit 0bdf399342c5("net: Avoid address
overwrite in kernel_connect"), BPF hooks run on bind may rewrite the
address passed to kernel_bind(). This change
1) Makes a copy of the bind address in kernel_bind() to insulate
callers.
2) Replaces direct calls to sock->ops->bind() in net with kernel_bind()
Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/
Fixes: 4fbac77d2d09 ("bpf: Hooks for sys_bind")
Cc: stable@vger.kernel.org
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Jordan Rife <jrife@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/ipvs/ip_vs_sync.c | 4 ++--
net/rds/tcp_connect.c | 2 +-
net/rds/tcp_listen.c | 2 +-
net/socket.c | 6 +++++-
4 files changed, 9 insertions(+), 5 deletions(-)
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1441,7 +1441,7 @@ static int bind_mcastif_addr(struct sock
sin.sin_addr.s_addr = addr;
sin.sin_port = 0;
- return sock->ops->bind(sock, (struct sockaddr*)&sin, sizeof(sin));
+ return kernel_bind(sock, (struct sockaddr *)&sin, sizeof(sin));
}
static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen,
@@ -1548,7 +1548,7 @@ static int make_receive_sock(struct netn
get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id);
sock->sk->sk_bound_dev_if = dev->ifindex;
- result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen);
+ result = kernel_bind(sock, (struct sockaddr *)&mcast_addr, salen);
if (result < 0) {
pr_err("Error binding to the multicast addr\n");
goto error;
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -141,7 +141,7 @@ int rds_tcp_conn_path_connect(struct rds
addrlen = sizeof(sin);
}
- ret = sock->ops->bind(sock, addr, addrlen);
+ ret = kernel_bind(sock, addr, addrlen);
if (ret) {
rdsdebug("bind failed with %d at address %pI6c\n",
ret, &conn->c_laddr);
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -301,7 +301,7 @@ struct socket *rds_tcp_listen_init(struc
addr_len = sizeof(*sin);
}
- ret = sock->ops->bind(sock, (struct sockaddr *)&ss, addr_len);
+ ret = kernel_bind(sock, (struct sockaddr *)&ss, addr_len);
if (ret < 0) {
rdsdebug("could not bind %s listener socket: %d\n",
isv6 ? "IPv6" : "IPv4", ret);
--- a/net/socket.c
+++ b/net/socket.c
@@ -3414,7 +3414,11 @@ static long compat_sock_ioctl(struct fil
int kernel_bind(struct socket *sock, struct sockaddr *addr, int addrlen)
{
- return sock->ops->bind(sock, addr, addrlen);
+ struct sockaddr_storage address;
+
+ memcpy(&address, addr, addrlen);
+
+ return sock->ops->bind(sock, (struct sockaddr *)&address, addrlen);
}
EXPORT_SYMBOL(kernel_bind);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 010/202] drm/msm/dp: do not reinitialize phy unless retry during link training
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 009/202] net: prevent address rewrite in kernel_bind() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 011/202] drm/msm/dsi: skip the wait for video mode done if not applicable Greg Kroah-Hartman
` (197 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuogee Hsieh, Abhinav Kumar,
Stephen Boyd, Dmitry Baryshkov, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kuogee Hsieh <quic_khsieh@quicinc.com>
[ Upstream commit 0c1a2e69bcb506f48ebf94bd199bab0b93f66da2 ]
DP PHY re-initialization done using dp_ctrl_reinitialize_mainlink() will
cause PLL unlocked initially and then PLL gets locked at the end of
initialization. PLL_UNLOCKED interrupt will fire during this time if the
interrupt mask is enabled.
However currently DP driver link training implementation incorrectly
re-initializes PHY unconditionally during link training as the PHY was
already configured in dp_ctrl_enable_mainlink_clocks().
Fix this by re-initializing the PHY only if the previous link training
failed.
[drm:dp_aux_isr] *ERROR* Unexpected DP AUX IRQ 0x01000000 when not busy
Fixes: c943b4948b58 ("drm/msm/dp: add displayPort driver support")
Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/30
Signed-off-by: Kuogee Hsieh <quic_khsieh@quicinc.com>
Tested-by: Abhinav Kumar <quic_abhinavk@quicinc.com> # sc7280
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Tested-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/551847/
Link: https://lore.kernel.org/r/1691533190-19335-1-git-send-email-quic_khsieh@quicinc.com
[quic_abhinavk@quicinc.com: added line break in commit text]
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 ++++++-------
1 file changed, 6 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/msm/dp/dp_ctrl.c b/drivers/gpu/drm/msm/dp/dp_ctrl.c
index 9fac55c24214a..07becbf3c64fc 100644
--- a/drivers/gpu/drm/msm/dp/dp_ctrl.c
+++ b/drivers/gpu/drm/msm/dp/dp_ctrl.c
@@ -1665,13 +1665,6 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
return rc;
while (--link_train_max_retries) {
- rc = dp_ctrl_reinitialize_mainlink(ctrl);
- if (rc) {
- DRM_ERROR("Failed to reinitialize mainlink. rc=%d\n",
- rc);
- break;
- }
-
training_step = DP_TRAINING_NONE;
rc = dp_ctrl_setup_main_link(ctrl, &cr, &training_step);
if (rc == 0) {
@@ -1712,6 +1705,12 @@ int dp_ctrl_on_link(struct dp_ctrl *dp_ctrl)
break; /* lane == 1 already */
}
}
+
+ rc = dp_ctrl_reinitialize_mainlink(ctrl);
+ if (rc) {
+ DRM_ERROR("Failed to reinitialize mainlink. rc=%d\n", rc);
+ break;
+ }
}
if (ctrl->link->sink_request & DP_TEST_LINK_PHY_TEST_PATTERN)
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 011/202] drm/msm/dsi: skip the wait for video mode done if not applicable
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 010/202] drm/msm/dp: do not reinitialize phy unless retry during link training Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 012/202] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow Greg Kroah-Hartman
` (196 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abhinav Kumar, Dmitry Baryshkov,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
[ Upstream commit ab483e3adcc178254eb1ce0fbdfbea65f86f1006 ]
dsi_wait4video_done() API waits for the DSI video mode engine to
become idle so that we can transmit the DCS commands in the
beginning of BLLP. However, with the current sequence, the MDP
timing engine is turned on after the panel's pre_enable() callback
which can send out the DCS commands needed to power up the panel.
During those cases, this API will always timeout and print out the
error spam leading to long bootup times and log flooding.
Fix this by checking if the DSI video engine was actually busy before
waiting for it to become idle otherwise this is a redundant wait.
changes in v2:
- move the reg read below the video mode check
- minor fixes in commit text
Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/34
Fixes: a689554ba6ed ("drm/msm: Initial add DSI connector support")
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Patchwork: https://patchwork.freedesktop.org/patch/557853/
Link: https://lore.kernel.org/r/20230915204426.19011-1-quic_abhinavk@quicinc.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/dsi_host.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c
index 5a76aa1389173..fb7792ca39e2c 100644
--- a/drivers/gpu/drm/msm/dsi/dsi_host.c
+++ b/drivers/gpu/drm/msm/dsi/dsi_host.c
@@ -1075,9 +1075,21 @@ static void dsi_wait4video_done(struct msm_dsi_host *msm_host)
static void dsi_wait4video_eng_busy(struct msm_dsi_host *msm_host)
{
+ u32 data;
+
if (!(msm_host->mode_flags & MIPI_DSI_MODE_VIDEO))
return;
+ data = dsi_read(msm_host, REG_DSI_STATUS0);
+
+ /* if video mode engine is not busy, its because
+ * either timing engine was not turned on or the
+ * DSI controller has finished transmitting the video
+ * data already, so no need to wait in those cases
+ */
+ if (!(data & DSI_STATUS0_VIDEO_MODE_ENGINE_BUSY))
+ return;
+
if (msm_host->power_on && msm_host->enabled) {
dsi_wait4video_done(msm_host);
/* delay 4 ms to skip BLLP */
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 012/202] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 011/202] drm/msm/dsi: skip the wait for video mode done if not applicable Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 013/202] ravb: Fix up dma_free_coherent() call in ravb_remove() Greg Kroah-Hartman
` (195 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Nia Espera,
Abhinav Kumar, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhinav Kumar <quic_abhinavk@quicinc.com>
[ Upstream commit 95e681ca3b65e4ce3d2537b47672d787b7d30375 ]
_dpu_plane_calc_bw() uses integer variables to calculate the bandwidth
used during plane bandwidth calculations. However for high resolution
displays this overflows easily and leads to below errors
[dpu error]crtc83 failed performance check -7
Promote the intermediate variables to u64 to avoid overflow.
changes in v2:
- change to u64 where actually needed in the math
Fixes: c33b7c0389e1 ("drm/msm/dpu: add support for clk and bw scaling for display")
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reported-by: Nia Espera <nespera@igalia.com>
Closes: https://gitlab.freedesktop.org/drm/msm/-/issues/32
Tested-by: Nia Espera <nespera@igalia.com>
Patchwork: https://patchwork.freedesktop.org/patch/556288/
Link: https://lore.kernel.org/r/20230908012616.20654-1-quic_abhinavk@quicinc.com
Signed-off-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
index 7ea90d25a3b69..8aa9f2335f57a 100644
--- a/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
+++ b/drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c
@@ -147,6 +147,7 @@ static void _dpu_plane_calc_bw(struct drm_plane *plane,
const struct dpu_format *fmt = NULL;
struct dpu_kms *dpu_kms = _dpu_plane_get_kms(plane);
int src_width, src_height, dst_height, fps;
+ u64 plane_pixel_rate, plane_bit_rate;
u64 plane_prefill_bw;
u64 plane_bw;
u32 hw_latency_lines;
@@ -168,13 +169,12 @@ static void _dpu_plane_calc_bw(struct drm_plane *plane,
scale_factor = src_height > dst_height ?
mult_frac(src_height, 1, dst_height) : 1;
- plane_bw =
- src_width * mode->vtotal * fps * fmt->bpp *
- scale_factor;
+ plane_pixel_rate = src_width * mode->vtotal * fps;
+ plane_bit_rate = plane_pixel_rate * fmt->bpp;
- plane_prefill_bw =
- src_width * hw_latency_lines * fps * fmt->bpp *
- scale_factor * mode->vtotal;
+ plane_bw = plane_bit_rate * scale_factor;
+
+ plane_prefill_bw = plane_bw * hw_latency_lines;
do_div(plane_prefill_bw, (vbp+vpw));
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 013/202] ravb: Fix up dma_free_coherent() call in ravb_remove()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 012/202] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 014/202] ieee802154: ca8210: Fix a potential UAF in ca8210_probe Greg Kroah-Hartman
` (194 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yoshihiro Shimoda, Sergey Shtylyov,
Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
[ Upstream commit e6864af61493113558c502b5cd0d754c19b93277 ]
In ravb_remove(), dma_free_coherent() should be call after
unregister_netdev(). Otherwise, this controller is possible to use
the freed buffer.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-2-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 410ccd28f6531..a59da6a119769 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -2249,14 +2249,14 @@ static int ravb_remove(struct platform_device *pdev)
if (priv->chip_id != RCAR_GEN2)
ravb_ptp_stop(ndev);
- dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
- priv->desc_bat_dma);
/* Set reset mode */
ravb_write(ndev, CCC_OPC_RESET, CCC);
unregister_netdev(ndev);
netif_napi_del(&priv->napi[RAVB_NC]);
netif_napi_del(&priv->napi[RAVB_BE]);
ravb_mdio_release(priv);
+ dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ priv->desc_bat_dma);
pm_runtime_put_sync(&pdev->dev);
pm_runtime_disable(&pdev->dev);
free_netdev(ndev);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 014/202] ieee802154: ca8210: Fix a potential UAF in ca8210_probe
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 013/202] ravb: Fix up dma_free_coherent() call in ravb_remove() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 015/202] mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Greg Kroah-Hartman
` (193 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dinghao Liu, Stefan Schmidt,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit f990874b1c98fe8e57ee9385669f501822979258 ]
If of_clk_add_provider() fails in ca8210_register_ext_clock(),
it calls clk_unregister() to release priv->clk and returns an
error. However, the caller ca8210_probe() then calls ca8210_remove(),
where priv->clk is freed again in ca8210_unregister_ext_clock(). In
this case, a use-after-free may happen in the second time we call
clk_unregister().
Fix this by removing the first clk_unregister(). Also, priv->clk could
be an error code on failure of clk_register_fixed_rate(). Use
IS_ERR_OR_NULL to catch this case in ca8210_unregister_ext_clock().
Fixes: ded845a781a5 ("ieee802154: Add CA8210 IEEE 802.15.4 device driver")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Message-ID: <20231007033049.22353-1-dinghao.liu@zju.edu.cn>
Signed-off-by: Stefan Schmidt <stefan@datenfreihafen.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ieee802154/ca8210.c | 17 +++--------------
1 file changed, 3 insertions(+), 14 deletions(-)
diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c
index 1c5d70c60354b..0ce426c0c0bf1 100644
--- a/drivers/net/ieee802154/ca8210.c
+++ b/drivers/net/ieee802154/ca8210.c
@@ -2783,7 +2783,6 @@ static int ca8210_register_ext_clock(struct spi_device *spi)
struct device_node *np = spi->dev.of_node;
struct ca8210_priv *priv = spi_get_drvdata(spi);
struct ca8210_platform_data *pdata = spi->dev.platform_data;
- int ret = 0;
if (!np)
return -EFAULT;
@@ -2800,18 +2799,8 @@ static int ca8210_register_ext_clock(struct spi_device *spi)
dev_crit(&spi->dev, "Failed to register external clk\n");
return PTR_ERR(priv->clk);
}
- ret = of_clk_add_provider(np, of_clk_src_simple_get, priv->clk);
- if (ret) {
- clk_unregister(priv->clk);
- dev_crit(
- &spi->dev,
- "Failed to register external clock as clock provider\n"
- );
- } else {
- dev_info(&spi->dev, "External clock set as clock provider\n");
- }
- return ret;
+ return of_clk_add_provider(np, of_clk_src_simple_get, priv->clk);
}
/**
@@ -2823,8 +2812,8 @@ static void ca8210_unregister_ext_clock(struct spi_device *spi)
{
struct ca8210_priv *priv = spi_get_drvdata(spi);
- if (!priv->clk)
- return
+ if (IS_ERR_OR_NULL(priv->clk))
+ return;
of_clk_del_provider(spi->dev.of_node);
clk_unregister(priv->clk);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 015/202] mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 014/202] ieee802154: ca8210: Fix a potential UAF in ca8210_probe Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 016/202] xen-netback: use default TX queue size for vifs Greg Kroah-Hartman
` (192 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Petr Machata,
David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 1e0b72a2a6432c0ef67ee5ce8d9172a7c20bba25 ]
The mlxsw_sp2_nve_vxlan_learning_set() function is supposed to return
zero on success or negative error codes. So it needs to be type int
instead of bool.
Fixes: 4ee70efab68d ("mlxsw: spectrum_nve: Add support for VXLAN on Spectrum-2")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
index 05517c7feaa56..a20ba23f0ed7a 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c
@@ -294,8 +294,8 @@ const struct mlxsw_sp_nve_ops mlxsw_sp1_nve_vxlan_ops = {
.fdb_clear_offload = mlxsw_sp_nve_vxlan_clear_offload,
};
-static bool mlxsw_sp2_nve_vxlan_learning_set(struct mlxsw_sp *mlxsw_sp,
- bool learning_en)
+static int mlxsw_sp2_nve_vxlan_learning_set(struct mlxsw_sp *mlxsw_sp,
+ bool learning_en)
{
char tnpc_pl[MLXSW_REG_TNPC_LEN];
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 016/202] xen-netback: use default TX queue size for vifs
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 015/202] mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 017/202] riscv, bpf: Factor out emit_call for kernel and bpf context Greg Kroah-Hartman
` (191 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Roger Pau Monné, Ross Lagerwall,
Wei Liu, David S. Miller, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Roger Pau Monne <roger.pau@citrix.com>
[ Upstream commit 66cf7435a26917c0c4d6245ad9137e7606e84fdf ]
Do not set netback interfaces (vifs) default TX queue size to the ring size.
The TX queue size is not related to the ring size, and using the ring size (32)
as the queue size can lead to packet drops. Note the TX side of the vif
interface in the netback domain is the one receiving packets to be injected
to the guest.
Do not explicitly set the TX queue length to any value when creating the
interface, and instead use the system default. Note that the queue length can
also be adjusted at runtime.
Fixes: f942dc2552b8 ('xen network backend driver')
Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Ross Lagerwall <ross.lagerwall@citrix.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/xen-netback/interface.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/net/xen-netback/interface.c
+++ b/drivers/net/xen-netback/interface.c
@@ -41,7 +41,6 @@
#include <asm/xen/hypercall.h>
#include <xen/balloon.h>
-#define XENVIF_QUEUE_LENGTH 32
#define XENVIF_NAPI_WEIGHT 64
/* Number of bytes allowed on the internal guest Rx queue. */
@@ -528,8 +527,6 @@ struct xenvif *xenvif_alloc(struct devic
dev->features = dev->hw_features | NETIF_F_RXCSUM;
dev->ethtool_ops = &xenvif_ethtool_ops;
- dev->tx_queue_len = XENVIF_QUEUE_LENGTH;
-
dev->min_mtu = ETH_MIN_MTU;
dev->max_mtu = ETH_MAX_MTU - VLAN_ETH_HLEN;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 017/202] riscv, bpf: Factor out emit_call for kernel and bpf context
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 016/202] xen-netback: use default TX queue size for vifs Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 018/202] riscv, bpf: Sign-extend return values Greg Kroah-Hartman
` (190 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pu Lehui, Daniel Borkmann,
Björn Töpel, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pu Lehui <pulehui@huawei.com>
[ Upstream commit 0fd1fd0104954380477353aea29c347e85dff16d ]
The current emit_call function is not suitable for kernel function call as
it store return value to bpf R0 register. We can separate it out for common
use. Meanwhile, simplify judgment logic, that is, fixed function address
can use jal or auipc+jalr, while the unfixed can use only auipc+jalr.
Signed-off-by: Pu Lehui <pulehui@huawei.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Tested-by: Björn Töpel <bjorn@rivosinc.com>
Acked-by: Björn Töpel <bjorn@rivosinc.com>
Link: https://lore.kernel.org/bpf/20230215135205.1411105-3-pulehui@huaweicloud.com
Stable-dep-of: 2f1b0d3d7331 ("riscv, bpf: Sign-extend return values")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/net/bpf_jit_comp64.c | 30 +++++++++++++-----------------
1 file changed, 13 insertions(+), 17 deletions(-)
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 053dc83e323b6..53d1f520c5890 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -394,12 +394,12 @@ static void emit_sext_32_rd(u8 *rd, struct rv_jit_context *ctx)
*rd = RV_REG_T2;
}
-static int emit_jump_and_link(u8 rd, s64 rvoff, bool force_jalr,
+static int emit_jump_and_link(u8 rd, s64 rvoff, bool fixed_addr,
struct rv_jit_context *ctx)
{
s64 upper, lower;
- if (rvoff && is_21b_int(rvoff) && !force_jalr) {
+ if (rvoff && fixed_addr && is_21b_int(rvoff)) {
emit(rv_jal(rd, rvoff >> 1), ctx);
return 0;
} else if (in_auipc_jalr_range(rvoff)) {
@@ -420,24 +420,17 @@ static bool is_signed_bpf_cond(u8 cond)
cond == BPF_JSGE || cond == BPF_JSLE;
}
-static int emit_call(bool fixed, u64 addr, struct rv_jit_context *ctx)
+static int emit_call(u64 addr, bool fixed_addr, struct rv_jit_context *ctx)
{
s64 off = 0;
u64 ip;
- u8 rd;
- int ret;
if (addr && ctx->insns) {
ip = (u64)(long)(ctx->insns + ctx->ninsns);
off = addr - ip;
}
- ret = emit_jump_and_link(RV_REG_RA, off, !fixed, ctx);
- if (ret)
- return ret;
- rd = bpf_to_rv_reg(BPF_REG_0, ctx);
- emit_mv(rd, RV_REG_A0, ctx);
- return 0;
+ return emit_jump_and_link(RV_REG_RA, off, fixed_addr, ctx);
}
int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
@@ -731,7 +724,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
/* JUMP off */
case BPF_JMP | BPF_JA:
rvoff = rv_offset(i, off, ctx);
- ret = emit_jump_and_link(RV_REG_ZERO, rvoff, false, ctx);
+ ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx);
if (ret)
return ret;
break;
@@ -850,17 +843,20 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
/* function call */
case BPF_JMP | BPF_CALL:
{
- bool fixed;
+ bool fixed_addr;
u64 addr;
mark_call(ctx);
- ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass, &addr,
- &fixed);
+ ret = bpf_jit_get_func_addr(ctx->prog, insn, extra_pass,
+ &addr, &fixed_addr);
if (ret < 0)
return ret;
- ret = emit_call(fixed, addr, ctx);
+
+ ret = emit_call(addr, fixed_addr, ctx);
if (ret)
return ret;
+
+ emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
break;
}
/* tail call */
@@ -875,7 +871,7 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
break;
rvoff = epilogue_offset(ctx);
- ret = emit_jump_and_link(RV_REG_ZERO, rvoff, false, ctx);
+ ret = emit_jump_and_link(RV_REG_ZERO, rvoff, true, ctx);
if (ret)
return ret;
break;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 018/202] riscv, bpf: Sign-extend return values
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 017/202] riscv, bpf: Factor out emit_call for kernel and bpf context Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 019/202] drm/vmwgfx: fix typo of sizeof argument Greg Kroah-Hartman
` (189 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Björn Töpel,
Daniel Borkmann, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Björn Töpel <bjorn@rivosinc.com>
[ Upstream commit 2f1b0d3d733169eb11680bfa97c266ae5e757148 ]
The RISC-V architecture does not expose sub-registers, and hold all
32-bit values in a sign-extended format [1] [2]:
| The compiler and calling convention maintain an invariant that all
| 32-bit values are held in a sign-extended format in 64-bit
| registers. Even 32-bit unsigned integers extend bit 31 into bits
| 63 through 32. Consequently, conversion between unsigned and
| signed 32-bit integers is a no-op, as is conversion from a signed
| 32-bit integer to a signed 64-bit integer.
While BPF, on the other hand, exposes sub-registers, and use
zero-extension (similar to arm64/x86).
This has led to some subtle bugs, where a BPF JITted program has not
sign-extended the a0 register (return value in RISC-V land), passed
the return value up the kernel, e.g.:
| int from_bpf(void);
|
| long foo(void)
| {
| return from_bpf();
| }
Here, a0 would be 0xffff_ffff, instead of the expected
0xffff_ffff_ffff_ffff.
Internally, the RISC-V JIT uses a5 as a dedicated register for BPF
return values.
Keep a5 zero-extended, but explicitly sign-extend a0 (which is used
outside BPF land). Now that a0 (RISC-V ABI) and a5 (BPF ABI) differs,
a0 is only moved to a5 for non-BPF native calls (BPF_PSEUDO_CALL).
Fixes: 2353ecc6f91f ("bpf, riscv: add BPF JIT for RV64G")
Signed-off-by: Björn Töpel <bjorn@rivosinc.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Link: https://github.com/riscv/riscv-isa-manual/releases/download/riscv-isa-release-056b6ff-2023-10-02/unpriv-isa-asciidoc.pdf # [2]
Link: https://github.com/riscv-non-isa/riscv-elf-psabi-doc/releases/download/draft-20230929-e5c800e661a53efe3c2678d71a306323b60eb13b/riscv-abi.pdf # [2]
Link: https://lore.kernel.org/bpf/20231004120706.52848-2-bjorn@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/net/bpf_jit_comp64.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/riscv/net/bpf_jit_comp64.c b/arch/riscv/net/bpf_jit_comp64.c
index 53d1f520c5890..0cc3dd9d32e64 100644
--- a/arch/riscv/net/bpf_jit_comp64.c
+++ b/arch/riscv/net/bpf_jit_comp64.c
@@ -201,7 +201,7 @@ static void __build_epilogue(bool is_tail_call, struct rv_jit_context *ctx)
emit_addi(RV_REG_SP, RV_REG_SP, stack_adjust, ctx);
/* Set return value. */
if (!is_tail_call)
- emit_mv(RV_REG_A0, RV_REG_A5, ctx);
+ emit_addiw(RV_REG_A0, RV_REG_A5, 0, ctx);
emit_jalr(RV_REG_ZERO, is_tail_call ? RV_REG_T3 : RV_REG_RA,
is_tail_call ? 4 : 0, /* skip TCC init */
ctx);
@@ -856,7 +856,8 @@ int bpf_jit_emit_insn(const struct bpf_insn *insn, struct rv_jit_context *ctx,
if (ret)
return ret;
- emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
+ if (insn->src_reg != BPF_PSEUDO_CALL)
+ emit_mv(bpf_to_rv_reg(BPF_REG_0, ctx), RV_REG_A0, ctx);
break;
}
/* tail call */
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 019/202] drm/vmwgfx: fix typo of sizeof argument
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 018/202] riscv, bpf: Sign-extend return values Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 020/202] net: macsec: indicate next pn update when offloading Greg Kroah-Hartman
` (188 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konstantin Meskhidze, Zack Rusin,
Sasha Levin, Ivanov Mikhail
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
[ Upstream commit 39465cac283702a7d4a507a558db81898029c6d3 ]
Since size of 'header' pointer and '*header' structure is equal on 64-bit
machines issue probably didn't cause any wrong behavior. But anyway,
fixing typo is required.
Fixes: 7a73ba7469cb ("drm/vmwgfx: Use TTM handles instead of SIDs as user-space surface handles.")
Co-developed-by: Ivanov Mikhail <ivanov.mikhail1@huawei-partners.com>
Signed-off-by: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Reviewed-by: Zack Rusin <zackr@vmware.com>
Signed-off-by: Zack Rusin <zackr@vmware.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230905100203.1716731-1-konstantin.meskhidze@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
index 4c6c2e5abf95e..00082c679170a 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
@@ -1627,7 +1627,7 @@ static int vmw_cmd_tex_state(struct vmw_private *dev_priv,
{
VMW_DECLARE_CMD_VAR(*cmd, SVGA3dCmdSetTextureState);
SVGA3dTextureState *last_state = (SVGA3dTextureState *)
- ((unsigned long) header + header->size + sizeof(header));
+ ((unsigned long) header + header->size + sizeof(*header));
SVGA3dTextureState *cur_state = (SVGA3dTextureState *)
((unsigned long) header + sizeof(*cmd));
struct vmw_resource *ctx;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 020/202] net: macsec: indicate next pn update when offloading
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 019/202] drm/vmwgfx: fix typo of sizeof argument Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 021/202] net: phy: mscc: macsec: reject PN update requests Greg Kroah-Hartman
` (187 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radu Pirea (NXP OSS),
Sabrina Dubroca, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
[ Upstream commit 0412cc846a1ef38697c3f321f9b174da91ecd3b5 ]
Indicate next PN update using update_pn flag in macsec_context.
Offloaded MACsec implementations does not know whether or not the
MACSEC_SA_ATTR_PN attribute was passed for an SA update and assume
that next PN should always updated, but this is not always true.
The PN can be reset to its initial value using the following command:
$ ip macsec set macsec0 tx sa 0 off #octeontx2-pf case
Or, the update PN command will succeed even if the driver does not support
PN updates.
$ ip macsec set macsec0 tx sa 0 pn 1 on #mscc phy driver case
Comparing the initial PN with the new PN value is not a solution. When
the user updates the PN using its initial value the command will
succeed, even if the driver does not support it. Like this:
$ ip macsec add macsec0 tx sa 0 pn 1 on key 00 \
ead3664f508eb06c40ac7104cdae4ce5
$ ip macsec set macsec0 tx sa 0 pn 1 on #mlx5 case
Signed-off-by: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: e0a8c918daa5 ("net: phy: mscc: macsec: reject PN update requests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/macsec.c | 2 ++
include/net/macsec.h | 1 +
2 files changed, 3 insertions(+)
diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 4fb58fc5ec95a..0ffcef2fa10af 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c
@@ -2414,6 +2414,7 @@ static int macsec_upd_txsa(struct sk_buff *skb, struct genl_info *info)
ctx.sa.assoc_num = assoc_num;
ctx.sa.tx_sa = tx_sa;
+ ctx.sa.update_pn = !!prev_pn.full64;
ctx.secy = secy;
ret = macsec_offload(ops->mdo_upd_txsa, &ctx);
@@ -2507,6 +2508,7 @@ static int macsec_upd_rxsa(struct sk_buff *skb, struct genl_info *info)
ctx.sa.assoc_num = assoc_num;
ctx.sa.rx_sa = rx_sa;
+ ctx.sa.update_pn = !!prev_pn.full64;
ctx.secy = secy;
ret = macsec_offload(ops->mdo_upd_rxsa, &ctx);
diff --git a/include/net/macsec.h b/include/net/macsec.h
index d6fa6b97f6efa..0dc4303329391 100644
--- a/include/net/macsec.h
+++ b/include/net/macsec.h
@@ -240,6 +240,7 @@ struct macsec_context {
struct macsec_secy *secy;
struct macsec_rx_sc *rx_sc;
struct {
+ bool update_pn;
unsigned char assoc_num;
u8 key[MACSEC_MAX_KEY_LEN];
union {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 021/202] net: phy: mscc: macsec: reject PN update requests
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 020/202] net: macsec: indicate next pn update when offloading Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 022/202] ixgbe: fix crash with empty VF macvlan list Greg Kroah-Hartman
` (186 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Radu Pirea (NXP OSS),
Sabrina Dubroca, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
[ Upstream commit e0a8c918daa58700609ebd45e3fcd49965be8bbc ]
Updating the PN is not supported.
Return -EINVAL if update_pn is true.
The following command succeeded, but it should fail because the driver
does not update the PN:
ip macsec set macsec0 tx sa 0 pn 232 on
Fixes: 28c5107aa904 ("net: phy: mscc: macsec support")
Signed-off-by: Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/mscc/mscc_macsec.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/phy/mscc/mscc_macsec.c b/drivers/net/phy/mscc/mscc_macsec.c
index c00eef457b850..bec270785c594 100644
--- a/drivers/net/phy/mscc/mscc_macsec.c
+++ b/drivers/net/phy/mscc/mscc_macsec.c
@@ -880,6 +880,9 @@ static int vsc8584_macsec_upd_rxsa(struct macsec_context *ctx)
{
struct macsec_flow *flow;
+ if (ctx->sa.update_pn)
+ return -EINVAL;
+
flow = vsc8584_macsec_find_flow(ctx, MACSEC_INGR);
if (IS_ERR(flow))
return PTR_ERR(flow);
@@ -929,6 +932,9 @@ static int vsc8584_macsec_upd_txsa(struct macsec_context *ctx)
{
struct macsec_flow *flow;
+ if (ctx->sa.update_pn)
+ return -EINVAL;
+
flow = vsc8584_macsec_find_flow(ctx, MACSEC_EGR);
if (IS_ERR(flow))
return PTR_ERR(flow);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 022/202] ixgbe: fix crash with empty VF macvlan list
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 021/202] net: phy: mscc: macsec: reject PN update requests Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 023/202] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Greg Kroah-Hartman
` (185 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Simon Horman,
Jesse Brandeburg, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 7b5add9af567c44e12196107f0fe106e194034fd ]
The adapter->vf_mvs.l list needs to be initialized even if the list is
empty. Otherwise it will lead to crashes.
Fixes: a1cbb15c1397 ("ixgbe: Add macvlan support for VF")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Link: https://lore.kernel.org/r/ZSADNdIw8zFx1xw2@kadam
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
index 0078ae5926164..5eba086690efa 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c
@@ -28,6 +28,9 @@ static inline void ixgbe_alloc_vf_macvlans(struct ixgbe_adapter *adapter,
struct vf_macvlans *mv_list;
int num_vf_macvlans, i;
+ /* Initialize list of VF macvlans */
+ INIT_LIST_HEAD(&adapter->vf_mvs.l);
+
num_vf_macvlans = hw->mac.num_rar_entries -
(IXGBE_MAX_PF_MACVLANS + 1 + num_vfs);
if (!num_vf_macvlans)
@@ -36,8 +39,6 @@ static inline void ixgbe_alloc_vf_macvlans(struct ixgbe_adapter *adapter,
mv_list = kcalloc(num_vf_macvlans, sizeof(struct vf_macvlans),
GFP_KERNEL);
if (mv_list) {
- /* Initialize list of VF macvlans */
- INIT_LIST_HEAD(&adapter->vf_mvs.l);
for (i = 0; i < num_vf_macvlans; i++) {
mv_list[i].vf = -1;
mv_list[i].free = true;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 023/202] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 022/202] ixgbe: fix crash with empty VF macvlan list Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 024/202] pinctrl: renesas: rzn1: Enable missing PINMUX Greg Kroah-Hartman
` (184 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sili Luo, Eric Dumazet,
Willy Tarreau, Krzysztof Kozlowski, Jakub Kicinski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 31c07dffafce914c1d1543c135382a11ff058d93 ]
Sili Luo reported a race in nfc_llcp_sock_get(), leading to UAF.
Getting a reference on the socket found in a lookup while
holding a lock should happen before releasing the lock.
nfc_llcp_sock_get_sn() has a similar problem.
Finally nfc_llcp_recv_snl() needs to make sure the socket
found by nfc_llcp_sock_from_sn() does not disappear.
Fixes: 8f50020ed9b8 ("NFC: LLCP late binding")
Reported-by: Sili Luo <rootlab@huawei.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willy Tarreau <w@1wt.eu>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231009123110.3735515-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/llcp_core.c | 30 ++++++++++++------------------
1 file changed, 12 insertions(+), 18 deletions(-)
diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
index b1107570eaee8..92f70686bee0a 100644
--- a/net/nfc/llcp_core.c
+++ b/net/nfc/llcp_core.c
@@ -205,17 +205,13 @@ static struct nfc_llcp_sock *nfc_llcp_sock_get(struct nfc_llcp_local *local,
if (tmp_sock->ssap == ssap && tmp_sock->dsap == dsap) {
llcp_sock = tmp_sock;
+ sock_hold(&llcp_sock->sk);
break;
}
}
read_unlock(&local->sockets.lock);
- if (llcp_sock == NULL)
- return NULL;
-
- sock_hold(&llcp_sock->sk);
-
return llcp_sock;
}
@@ -348,7 +344,8 @@ static int nfc_llcp_wks_sap(const char *service_name, size_t service_name_len)
static
struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
- const u8 *sn, size_t sn_len)
+ const u8 *sn, size_t sn_len,
+ bool needref)
{
struct sock *sk;
struct nfc_llcp_sock *llcp_sock, *tmp_sock;
@@ -384,6 +381,8 @@ struct nfc_llcp_sock *nfc_llcp_sock_from_sn(struct nfc_llcp_local *local,
if (memcmp(sn, tmp_sock->service_name, sn_len) == 0) {
llcp_sock = tmp_sock;
+ if (needref)
+ sock_hold(&llcp_sock->sk);
break;
}
}
@@ -425,7 +424,8 @@ u8 nfc_llcp_get_sdp_ssap(struct nfc_llcp_local *local,
* to this service name.
*/
if (nfc_llcp_sock_from_sn(local, sock->service_name,
- sock->service_name_len) != NULL) {
+ sock->service_name_len,
+ false) != NULL) {
mutex_unlock(&local->sdp_lock);
return LLCP_SAP_MAX;
@@ -833,16 +833,7 @@ static struct nfc_llcp_sock *nfc_llcp_connecting_sock_get(struct nfc_llcp_local
static struct nfc_llcp_sock *nfc_llcp_sock_get_sn(struct nfc_llcp_local *local,
const u8 *sn, size_t sn_len)
{
- struct nfc_llcp_sock *llcp_sock;
-
- llcp_sock = nfc_llcp_sock_from_sn(local, sn, sn_len);
-
- if (llcp_sock == NULL)
- return NULL;
-
- sock_hold(&llcp_sock->sk);
-
- return llcp_sock;
+ return nfc_llcp_sock_from_sn(local, sn, sn_len, true);
}
static const u8 *nfc_llcp_connect_sn(const struct sk_buff *skb, size_t *sn_len)
@@ -1307,7 +1298,8 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
}
llcp_sock = nfc_llcp_sock_from_sn(local, service_name,
- service_name_len);
+ service_name_len,
+ true);
if (!llcp_sock) {
sap = 0;
goto add_snl;
@@ -1327,6 +1319,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
if (sap == LLCP_SAP_MAX) {
sap = 0;
+ nfc_llcp_sock_put(llcp_sock);
goto add_snl;
}
@@ -1344,6 +1337,7 @@ static void nfc_llcp_recv_snl(struct nfc_llcp_local *local,
pr_debug("%p %d\n", llcp_sock, sap);
+ nfc_llcp_sock_put(llcp_sock);
add_snl:
sdp = nfc_llcp_build_sdres_tlv(tid, sap);
if (sdp == NULL)
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 024/202] pinctrl: renesas: rzn1: Enable missing PINMUX
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 023/202] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 025/202] nfc: nci: assert requested protocol is valid Greg Kroah-Hartman
` (183 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ralph Siemsen, Miquel Raynal,
Geert Uytterhoeven, Linus Walleij, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ralph Siemsen <ralph.siemsen@linaro.org>
[ Upstream commit f055ff23c331f28aa4ace4b72dc56f63b9a726c8 ]
Enable pin muxing (eg. programmable function), so that the RZ/N1 GPIO
pins will be configured as specified by the pinmux in the DTS.
This used to be enabled implicitly via CONFIG_GENERIC_PINMUX_FUNCTIONS,
however that was removed, since the RZ/N1 driver does not call any of
the generic pinmux functions.
Fixes: 1308fb4e4eae14e6 ("pinctrl: rzn1: Do not select GENERIC_PIN{CTRL_GROUPS,MUX_FUNCTIONS}")
Signed-off-by: Ralph Siemsen <ralph.siemsen@linaro.org>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20231004200008.1306798-1-ralph.siemsen@linaro.org
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/renesas/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/pinctrl/renesas/Kconfig b/drivers/pinctrl/renesas/Kconfig
index e941b8440dbc8..39559ce9d1ed9 100644
--- a/drivers/pinctrl/renesas/Kconfig
+++ b/drivers/pinctrl/renesas/Kconfig
@@ -212,6 +212,7 @@ config PINCTRL_RZN1
depends on OF
depends on ARCH_RZN1 || COMPILE_TEST
select GENERIC_PINCONF
+ select PINMUX
help
This selects pinctrl driver for Renesas RZ/N1 devices.
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 025/202] nfc: nci: assert requested protocol is valid
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 024/202] pinctrl: renesas: rzn1: Enable missing PINMUX Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 026/202] workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Greg Kroah-Hartman
` (182 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeremy Cline, Simon Horman,
Paolo Abeni, Sasha Levin, syzbot+0839b78e119aae1fec78
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremy Cline <jeremy@jcline.org>
[ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ]
The protocol is used in a bit mask to determine if the protocol is
supported. Assert the provided protocol is less than the maximum
defined so it doesn't potentially perform a shift-out-of-bounds and
provide a clearer error for undefined protocols vs unsupported ones.
Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation")
Reported-and-tested-by: syzbot+0839b78e119aae1fec78@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78
Signed-off-by: Jeremy Cline <jeremy@jcline.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/nfc/nci/core.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index ed9019d807c78..4c931bd1c1743 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c
@@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev,
return -EINVAL;
}
+ if (protocol >= NFC_PROTO_MAX) {
+ pr_err("the requested nfc protocol is invalid\n");
+ return -EINVAL;
+ }
+
if (!(nci_target->supported_protocols & (1 << protocol))) {
pr_err("target does not support the requested protocol 0x%x\n",
protocol);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 026/202] workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 025/202] nfc: nci: assert requested protocol is valid Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 027/202] Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure" Greg Kroah-Hartman
` (181 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Waiman Long, Tejun Heo, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
[ Upstream commit ca10d851b9ad0338c19e8e3089e24d565ebfffd7 ]
Commit 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1
to be ordered") enabled implicit ordered attribute to be added to
WQ_UNBOUND workqueues with max_active of 1. This prevented the changing
of attributes to these workqueues leading to fix commit 0a94efb5acbb
("workqueue: implicit ordered attribute should be overridable").
However, workqueue_apply_unbound_cpumask() was not updated at that time.
So sysfs changes to wq_unbound_cpumask has no effect on WQ_UNBOUND
workqueues with implicit ordered attribute. Since not all WQ_UNBOUND
workqueues are visible on sysfs, we are not able to make all the
necessary cpumask changes even if we iterates all the workqueue cpumasks
in sysfs and changing them one by one.
Fix this problem by applying the corresponding change made
to apply_workqueue_attrs_locked() in the fix commit to
workqueue_apply_unbound_cpumask().
Fixes: 5c0338c68706 ("workqueue: restore WQ_UNBOUND/max_active==1 to be ordered")
Signed-off-by: Waiman Long <longman@redhat.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/workqueue.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index fa0a0e59b3851..37d01e44d4837 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5300,9 +5300,13 @@ static int workqueue_apply_unbound_cpumask(void)
list_for_each_entry(wq, &workqueues, list) {
if (!(wq->flags & WQ_UNBOUND))
continue;
+
/* creating multiple pwqs breaks ordering guarantee */
- if (wq->flags & __WQ_ORDERED)
- continue;
+ if (!list_empty(&wq->pwqs)) {
+ if (wq->flags & __WQ_ORDERED_EXPLICIT)
+ continue;
+ wq->flags &= ~__WQ_ORDERED;
+ }
ctx = apply_wqattrs_prepare(wq, wq->unbound_attrs);
if (!ctx) {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 027/202] Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure"
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 026/202] workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 028/202] Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe" Greg Kroah-Hartman
` (180 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 19f3d5d13b756b913be582a9e0d0afdeca9c397e.
Reported issues with backport, revert for now.
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-zynqmp-gqspi.c | 12 ++++--------
1 file changed, 4 insertions(+), 8 deletions(-)
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index 12d9c5d6b9e26..ed68e237314fb 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -1197,9 +1197,9 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
return 0;
clk_dis_all:
- pm_runtime_disable(&pdev->dev);
- pm_runtime_put_noidle(&pdev->dev);
+ pm_runtime_put_sync(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
clk_disable_unprepare(xqspi->refclk);
clk_dis_pclk:
clk_disable_unprepare(xqspi->pclk);
@@ -1223,15 +1223,11 @@ static int zynqmp_qspi_remove(struct platform_device *pdev)
{
struct zynqmp_qspi *xqspi = platform_get_drvdata(pdev);
- pm_runtime_get_sync(&pdev->dev);
-
zynqmp_gqspi_write(xqspi, GQSPI_EN_OFST, 0x0);
-
- pm_runtime_disable(&pdev->dev);
- pm_runtime_put_noidle(&pdev->dev);
- pm_runtime_set_suspended(&pdev->dev);
clk_disable_unprepare(xqspi->refclk);
clk_disable_unprepare(xqspi->pclk);
+ pm_runtime_set_suspended(&pdev->dev);
+ pm_runtime_disable(&pdev->dev);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 028/202] Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe"
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 027/202] Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure" Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 029/202] net: add sysctl accept_ra_min_rtr_lft Greg Kroah-Hartman
` (179 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 2cdec9c13f81313dd9f41f09c7cdecbfa4bea91d.
Reported issues with the backport, revert for now.
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-zynqmp-gqspi.c | 14 ++------------
1 file changed, 2 insertions(+), 12 deletions(-)
diff --git a/drivers/spi/spi-zynqmp-gqspi.c b/drivers/spi/spi-zynqmp-gqspi.c
index ed68e237314fb..3d3ac48243ebd 100644
--- a/drivers/spi/spi-zynqmp-gqspi.c
+++ b/drivers/spi/spi-zynqmp-gqspi.c
@@ -1147,16 +1147,11 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
pm_runtime_set_autosuspend_delay(&pdev->dev, SPI_AUTOSUSPEND_TIMEOUT);
pm_runtime_set_active(&pdev->dev);
pm_runtime_enable(&pdev->dev);
-
- ret = pm_runtime_get_sync(&pdev->dev);
- if (ret < 0) {
- dev_err(&pdev->dev, "Failed to pm_runtime_get_sync: %d\n", ret);
- goto clk_dis_all;
- }
-
/* QSPI controller initializations */
zynqmp_qspi_init_hw(xqspi);
+ pm_runtime_mark_last_busy(&pdev->dev);
+ pm_runtime_put_autosuspend(&pdev->dev);
xqspi->irq = platform_get_irq(pdev, 0);
if (xqspi->irq <= 0) {
ret = -ENXIO;
@@ -1183,7 +1178,6 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
ctlr->mode_bits = SPI_CPOL | SPI_CPHA | SPI_RX_DUAL | SPI_RX_QUAD |
SPI_TX_DUAL | SPI_TX_QUAD;
ctlr->dev.of_node = np;
- ctlr->auto_runtime_pm = true;
ret = devm_spi_register_controller(&pdev->dev, ctlr);
if (ret) {
@@ -1191,13 +1185,9 @@ static int zynqmp_qspi_probe(struct platform_device *pdev)
goto clk_dis_all;
}
- pm_runtime_mark_last_busy(&pdev->dev);
- pm_runtime_put_autosuspend(&pdev->dev);
-
return 0;
clk_dis_all:
- pm_runtime_put_sync(&pdev->dev);
pm_runtime_set_suspended(&pdev->dev);
pm_runtime_disable(&pdev->dev);
clk_disable_unprepare(xqspi->refclk);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 029/202] net: add sysctl accept_ra_min_rtr_lft
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 028/202] Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe" Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 030/202] net: change accept_ra_min_rtr_lft to affect all RA lifetimes Greg Kroah-Hartman
` (178 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Patrick Rohr,
Maciej Żenczykowski, Lorenzo Colitti, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Rohr <prohr@google.com>
commit 1671bcfd76fdc0b9e65153cf759153083755fe4c upstream.
This change adds a new sysctl accept_ra_min_rtr_lft to specify the
minimum acceptable router lifetime in an RA. If the received RA router
lifetime is less than the configured value (and not 0), the RA is
ignored.
This is useful for mobile devices, whose battery life can be impacted
by networks that configure RAs with a short lifetime. On such networks,
the device should never gain IPv6 provisioning and should attempt to
drop RAs via hardware offload, if available.
Signed-off-by: Patrick Rohr <prohr@google.com>
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/networking/ip-sysctl.rst | 8 ++++++++
include/linux/ipv6.h | 1 +
include/uapi/linux/ipv6.h | 7 +++++++
net/ipv6/addrconf.c | 10 ++++++++++
net/ipv6/ndisc.c | 18 ++++++++++++++++--
5 files changed, 42 insertions(+), 2 deletions(-)
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1916,6 +1916,14 @@ accept_ra_min_hop_limit - INTEGER
Default: 1
+accept_ra_min_rtr_lft - INTEGER
+ Minimum acceptable router lifetime in Router Advertisement.
+
+ RAs with a router lifetime less than this value shall be
+ ignored. RAs with a router lifetime of 0 are unaffected.
+
+ Default: 0
+
accept_ra_pinfo - BOOLEAN
Learn Prefix Information in Router Advertisement.
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -32,6 +32,7 @@ struct ipv6_devconf {
__s32 max_addresses;
__s32 accept_ra_defrtr;
__s32 accept_ra_min_hop_limit;
+ __s32 accept_ra_min_rtr_lft;
__s32 accept_ra_pinfo;
__s32 ignore_routes_with_linkdown;
#ifdef CONFIG_IPV6_ROUTER_PREF
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -192,6 +192,13 @@ enum {
DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN,
DEVCONF_NDISC_TCLASS,
DEVCONF_RPL_SEG_ENABLED,
+ DEVCONF_RA_DEFRTR_METRIC,
+ DEVCONF_IOAM6_ENABLED,
+ DEVCONF_IOAM6_ID,
+ DEVCONF_IOAM6_ID_WIDE,
+ DEVCONF_NDISC_EVICT_NOCARRIER,
+ DEVCONF_ACCEPT_UNTRACKED_NA,
+ DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
DEVCONF_MAX
};
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -207,6 +207,7 @@ static struct ipv6_devconf ipv6_devconf
.accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
.accept_ra_min_hop_limit= 1,
+ .accept_ra_min_rtr_lft = 0,
.accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1,
@@ -262,6 +263,7 @@ static struct ipv6_devconf ipv6_devconf_
.accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
.accept_ra_min_hop_limit= 1,
+ .accept_ra_min_rtr_lft = 0,
.accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1,
@@ -5559,6 +5561,7 @@ static inline void ipv6_store_devconf(st
array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
+ array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
}
static inline size_t inet6_ifla6_size(void)
@@ -6715,6 +6718,13 @@ static const struct ctl_table addrconf_s
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
+ },
+ {
+ .procname = "accept_ra_min_rtr_lft",
+ .data = &ipv6_devconf.accept_ra_min_rtr_lft,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec,
},
{
.procname = "accept_ra_pinfo",
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,6 +1222,8 @@ static void ndisc_router_discovery(struc
return;
}
+ lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+
if (!ipv6_accept_ra(in6_dev)) {
ND_PRINTK(2, info,
"RA: %s, did not accept ra for dev: %s\n",
@@ -1229,6 +1231,13 @@ static void ndisc_router_discovery(struc
goto skip_linkparms;
}
+ if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+ ND_PRINTK(2, info,
+ "RA: router lifetime (%ds) is too short: %s\n",
+ lifetime, skb->dev->name);
+ goto skip_linkparms;
+ }
+
#ifdef CONFIG_IPV6_NDISC_NODETYPE
/* skip link-specific parameters from interior routers */
if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1281,8 +1290,6 @@ static void ndisc_router_discovery(struc
goto skip_defrtr;
}
- lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
#ifdef CONFIG_IPV6_ROUTER_PREF
pref = ra_msg->icmph.icmp6_router_pref;
/* 10b is handled as if it were 00b (medium) */
@@ -1429,6 +1436,13 @@ skip_linkparms:
goto out;
}
+ if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
+ ND_PRINTK(2, info,
+ "RA: router lifetime (%ds) is too short: %s\n",
+ lifetime, skb->dev->name);
+ goto out;
+ }
+
#ifdef CONFIG_IPV6_ROUTE_INFO
if (!in6_dev->cnf.accept_ra_from_local &&
ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 030/202] net: change accept_ra_min_rtr_lft to affect all RA lifetimes
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 029/202] net: add sysctl accept_ra_min_rtr_lft Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 031/202] net: release reference to inet6_dev pointer Greg Kroah-Hartman
` (177 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Colitti, Patrick Rohr,
Maciej Żenczykowski, David Ahern, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Rohr <prohr@google.com>
commit 5027d54a9c30bc7ec808360378e2b4753f053f25 upstream.
accept_ra_min_rtr_lft only considered the lifetime of the default route
and discarded entire RAs accordingly.
This change renames accept_ra_min_rtr_lft to accept_ra_min_lft, and
applies the value to individual RA sections; in particular, router
lifetime, PIO preferred lifetime, and RIO lifetime. If any of those
lifetimes are lower than the configured value, the specific RA section
is ignored.
In order for the sysctl to be useful to Android, it should really apply
to all lifetimes in the RA, since that is what determines the minimum
frequency at which RAs must be processed by the kernel. Android uses
hardware offloads to drop RAs for a fraction of the minimum of all
lifetimes present in the RA (some networks have very frequent RAs (5s)
with high lifetimes (2h)). Despite this, we have encountered networks
that set the router lifetime to 30s which results in very frequent CPU
wakeups. Instead of disabling IPv6 (and dropping IPv6 ethertype in the
WiFi firmware) entirely on such networks, it seems better to ignore the
misconfigured routers while still processing RAs from other IPv6 routers
on the same network (i.e. to support IoT applications).
The previous implementation dropped the entire RA based on router
lifetime. This turned out to be hard to expand to the other lifetimes
present in the RA in a consistent manner; dropping the entire RA based
on RIO/PIO lifetimes would essentially require parsing the whole thing
twice.
Fixes: 1671bcfd76fd ("net: add sysctl accept_ra_min_rtr_lft")
Cc: Lorenzo Colitti <lorenzo@google.com>
Signed-off-by: Patrick Rohr <prohr@google.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230726230701.919212-1-prohr@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/networking/ip-sysctl.rst | 8 ++++----
include/linux/ipv6.h | 2 +-
include/uapi/linux/ipv6.h | 2 +-
net/ipv6/addrconf.c | 13 ++++++++-----
net/ipv6/ndisc.c | 27 +++++++++++----------------
5 files changed, 25 insertions(+), 27 deletions(-)
--- a/Documentation/networking/ip-sysctl.rst
+++ b/Documentation/networking/ip-sysctl.rst
@@ -1916,11 +1916,11 @@ accept_ra_min_hop_limit - INTEGER
Default: 1
-accept_ra_min_rtr_lft - INTEGER
- Minimum acceptable router lifetime in Router Advertisement.
+accept_ra_min_lft - INTEGER
+ Minimum acceptable lifetime value in Router Advertisement.
- RAs with a router lifetime less than this value shall be
- ignored. RAs with a router lifetime of 0 are unaffected.
+ RA sections with a lifetime less than this value shall be
+ ignored. Zero lifetimes stay unaffected.
Default: 0
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -32,7 +32,7 @@ struct ipv6_devconf {
__s32 max_addresses;
__s32 accept_ra_defrtr;
__s32 accept_ra_min_hop_limit;
- __s32 accept_ra_min_rtr_lft;
+ __s32 accept_ra_min_lft;
__s32 accept_ra_pinfo;
__s32 ignore_routes_with_linkdown;
#ifdef CONFIG_IPV6_ROUTER_PREF
--- a/include/uapi/linux/ipv6.h
+++ b/include/uapi/linux/ipv6.h
@@ -198,7 +198,7 @@ enum {
DEVCONF_IOAM6_ID_WIDE,
DEVCONF_NDISC_EVICT_NOCARRIER,
DEVCONF_ACCEPT_UNTRACKED_NA,
- DEVCONF_ACCEPT_RA_MIN_RTR_LFT,
+ DEVCONF_ACCEPT_RA_MIN_LFT,
DEVCONF_MAX
};
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -207,7 +207,7 @@ static struct ipv6_devconf ipv6_devconf
.accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
.accept_ra_min_hop_limit= 1,
- .accept_ra_min_rtr_lft = 0,
+ .accept_ra_min_lft = 0,
.accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1,
@@ -263,7 +263,7 @@ static struct ipv6_devconf ipv6_devconf_
.accept_ra_defrtr = 1,
.accept_ra_from_local = 0,
.accept_ra_min_hop_limit= 1,
- .accept_ra_min_rtr_lft = 0,
+ .accept_ra_min_lft = 0,
.accept_ra_pinfo = 1,
#ifdef CONFIG_IPV6_ROUTER_PREF
.accept_ra_rtr_pref = 1,
@@ -2726,6 +2726,9 @@ void addrconf_prefix_rcv(struct net_devi
return;
}
+ if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
+ return;
+
/*
* Two things going on here:
* 1) Add routes for on-link prefixes
@@ -5561,7 +5564,7 @@ static inline void ipv6_store_devconf(st
array[DEVCONF_DISABLE_POLICY] = cnf->disable_policy;
array[DEVCONF_NDISC_TCLASS] = cnf->ndisc_tclass;
array[DEVCONF_RPL_SEG_ENABLED] = cnf->rpl_seg_enabled;
- array[DEVCONF_ACCEPT_RA_MIN_RTR_LFT] = cnf->accept_ra_min_rtr_lft;
+ array[DEVCONF_ACCEPT_RA_MIN_LFT] = cnf->accept_ra_min_lft;
}
static inline size_t inet6_ifla6_size(void)
@@ -6720,8 +6723,8 @@ static const struct ctl_table addrconf_s
.proc_handler = proc_dointvec,
},
{
- .procname = "accept_ra_min_rtr_lft",
- .data = &ipv6_devconf.accept_ra_min_rtr_lft,
+ .procname = "accept_ra_min_lft",
+ .data = &ipv6_devconf.accept_ra_min_lft,
.maxlen = sizeof(int),
.mode = 0644,
.proc_handler = proc_dointvec,
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1222,8 +1222,6 @@ static void ndisc_router_discovery(struc
return;
}
- lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
-
if (!ipv6_accept_ra(in6_dev)) {
ND_PRINTK(2, info,
"RA: %s, did not accept ra for dev: %s\n",
@@ -1231,13 +1229,6 @@ static void ndisc_router_discovery(struc
goto skip_linkparms;
}
- if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
- ND_PRINTK(2, info,
- "RA: router lifetime (%ds) is too short: %s\n",
- lifetime, skb->dev->name);
- goto skip_linkparms;
- }
-
#ifdef CONFIG_IPV6_NDISC_NODETYPE
/* skip link-specific parameters from interior routers */
if (skb->ndisc_nodetype == NDISC_NODETYPE_NODEFAULT) {
@@ -1278,6 +1269,14 @@ static void ndisc_router_discovery(struc
goto skip_defrtr;
}
+ lifetime = ntohs(ra_msg->icmph.icmp6_rt_lifetime);
+ if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_lft) {
+ ND_PRINTK(2, info,
+ "RA: router lifetime (%ds) is too short: %s\n",
+ lifetime, skb->dev->name);
+ goto skip_defrtr;
+ }
+
/* Do not accept RA with source-addr found on local machine unless
* accept_ra_from_local is set to true.
*/
@@ -1436,13 +1435,6 @@ skip_linkparms:
goto out;
}
- if (lifetime != 0 && lifetime < in6_dev->cnf.accept_ra_min_rtr_lft) {
- ND_PRINTK(2, info,
- "RA: router lifetime (%ds) is too short: %s\n",
- lifetime, skb->dev->name);
- goto out;
- }
-
#ifdef CONFIG_IPV6_ROUTE_INFO
if (!in6_dev->cnf.accept_ra_from_local &&
ipv6_chk_addr(dev_net(in6_dev->dev), &ipv6_hdr(skb)->saddr,
@@ -1467,6 +1459,9 @@ skip_linkparms:
if (ri->prefix_len == 0 &&
!in6_dev->cnf.accept_ra_defrtr)
continue;
+ if (ri->lifetime != 0 &&
+ ntohl(ri->lifetime) < in6_dev->cnf.accept_ra_min_lft)
+ continue;
if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
continue;
if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 031/202] net: release reference to inet6_dev pointer
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 030/202] net: change accept_ra_min_rtr_lft to affect all RA lifetimes Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 032/202] media: mtk-jpeg: Fix use after free bug due to uncanceled work Greg Kroah-Hartman
` (176 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Żenczykowski,
Lorenzo Colitti, David Ahern, Simon Horman, Patrick Rohr,
Leon Romanovsky, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Rohr <prohr@google.com>
commit 5cb249686e67dbef3ffe53887fa725eefc5a7144 upstream.
addrconf_prefix_rcv returned early without releasing the inet6_dev
pointer when the PIO lifetime is less than accept_ra_min_lft.
Fixes: 5027d54a9c30 ("net: change accept_ra_min_rtr_lft to affect all RA lifetimes")
Cc: Maciej Żenczykowski <maze@google.com>
Cc: Lorenzo Colitti <lorenzo@google.com>
Cc: David Ahern <dsahern@kernel.org>
Cc: Simon Horman <horms@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: Patrick Rohr <prohr@google.com>
Reviewed-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/addrconf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2727,7 +2727,7 @@ void addrconf_prefix_rcv(struct net_devi
}
if (valid_lft != 0 && valid_lft < in6_dev->cnf.accept_ra_min_lft)
- return;
+ goto put;
/*
* Two things going on here:
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 032/202] media: mtk-jpeg: Fix use after free bug due to uncanceled work
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 031/202] net: release reference to inet6_dev pointer Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 033/202] dmaengine: stm32-mdma: abort resume if no ongoing transfer Greg Kroah-Hartman
` (175 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Wang, Alexandre Mergnat,
Chen-Yu Tsai, AngeloGioacchino Del Regno, Hans Verkuil
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Wang <zyytlz.wz@163.com>
commit c677d7ae83141d390d1253abebafa49c962afb52 upstream.
In mtk_jpeg_probe, &jpeg->job_timeout_work is bound with
mtk_jpeg_job_timeout_work. Then mtk_jpeg_dec_device_run
and mtk_jpeg_enc_device_run may be called to start the
work.
If we remove the module which will call mtk_jpeg_remove
to make cleanup, there may be a unfinished work. The
possible sequence is as follows, which will cause a
typical UAF bug.
Fix it by canceling the work before cleanup in the mtk_jpeg_remove
CPU0 CPU1
|mtk_jpeg_job_timeout_work
mtk_jpeg_remove |
v4l2_m2m_release |
kfree(m2m_dev); |
|
| v4l2_m2m_get_curr_priv
| m2m_dev->curr_ctx //use
Fixes: b2f0d2724ba4 ("[media] vcodec: mediatek: Add Mediatek JPEG Decoder Driver")
Signed-off-by: Zheng Wang <zyytlz.wz@163.com>
Reviewed-by: Alexandre Mergnat <amergnat@baylibre.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c
@@ -1455,6 +1455,7 @@ static int mtk_jpeg_remove(struct platfo
{
struct mtk_jpeg_dev *jpeg = platform_get_drvdata(pdev);
+ cancel_delayed_work_sync(&jpeg->job_timeout_work);
pm_runtime_disable(&pdev->dev);
video_unregister_device(jpeg->vdev);
video_device_release(jpeg->vdev);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 033/202] dmaengine: stm32-mdma: abort resume if no ongoing transfer
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 032/202] media: mtk-jpeg: Fix use after free bug due to uncanceled work Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 034/202] usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Greg Kroah-Hartman
` (174 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Amelie Delaunay, Vinod Koul
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amelie Delaunay <amelie.delaunay@foss.st.com>
commit 81337b9a72dc58a5fa0ae8a042e8cb59f9bdec4a upstream.
chan->desc can be null, if transfer is terminated when resume is called,
leading to a NULL pointer when retrieving the hwdesc.
To avoid this case, check that chan->desc is not null and channel is
disabled (transfer previously paused or terminated).
Fixes: a4ffb13c8946 ("dmaengine: Add STM32 MDMA driver")
Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231004163531.2864160-1-amelie.delaunay@foss.st.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/stm32-mdma.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/dma/stm32-mdma.c
+++ b/drivers/dma/stm32-mdma.c
@@ -1206,6 +1206,10 @@ static int stm32_mdma_resume(struct dma_
unsigned long flags;
u32 status, reg;
+ /* Transfer can be terminated */
+ if (!chan->desc || (stm32_mdma_read(dmadev, STM32_MDMA_CCR(chan->id)) & STM32_MDMA_CCR_EN))
+ return -EPERM;
+
hwdesc = chan->desc->node[chan->curr_hwdesc].hwdesc;
spin_lock_irqsave(&chan->vchan.lock, flags);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 034/202] usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 033/202] dmaengine: stm32-mdma: abort resume if no ongoing transfer Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 035/202] net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Greg Kroah-Hartman
` (173 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wesley Cheng, Mathias Nyman
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wesley Cheng <quic_wcheng@quicinc.com>
commit 41a43013d2366db5b88b42bbcd8e8f040b6ccf21 upstream.
As mentioned in:
commit 474ed23a6257 ("xhci: align the last trb before link if it is
easily splittable.")
A bounce buffer is utilized for ensuring that transfers that span across
ring segments are aligned to the EP's max packet size. However, the device
that is used to map the DMA buffer to is currently using the XHCI HCD,
which does not carry any DMA operations in certain configrations.
Migration to using the sysdev entry was introduced for DWC3 based
implementations where the IOMMU operations are present.
Replace the reference to the controller device to sysdev instead. This
allows the bounce buffer to be properly mapped to any implementations that
have an IOMMU involved.
cc: stable@vger.kernel.org
Fixes: 4c39d4b949d3 ("usb: xhci: use bus->sysdev for DMA configuration")
Signed-off-by: Wesley Cheng <quic_wcheng@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230915143108.1532163-2-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-ring.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -742,7 +742,7 @@ static void xhci_giveback_urb_in_irq(str
static void xhci_unmap_td_bounce_buffer(struct xhci_hcd *xhci,
struct xhci_ring *ring, struct xhci_td *td)
{
- struct device *dev = xhci_to_hcd(xhci)->self.controller;
+ struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
struct xhci_segment *seg = td->bounce_seg;
struct urb *urb = td->urb;
size_t len;
@@ -3325,7 +3325,7 @@ static u32 xhci_td_remainder(struct xhci
static int xhci_align_td(struct xhci_hcd *xhci, struct urb *urb, u32 enqd_len,
u32 *trb_buff_len, struct xhci_segment *seg)
{
- struct device *dev = xhci_to_hcd(xhci)->self.controller;
+ struct device *dev = xhci_to_hcd(xhci)->self.sysdev;
unsigned int unalign;
unsigned int max_pkt;
u32 new_buff_len;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 035/202] net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 034/202] usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 036/202] usb: dwc3: Soft reset phy on probe for host Greg Kroah-Hartman
` (172 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Peter Korsgaard,
Jakub Kicinski, syzbot+1f53a30781af65d2c955
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit 8f8abb863fa5a4cc18955c6a0e17af0ded3e4a76 upstream.
syzbot has found an uninit-value bug triggered by the dm9601 driver [1].
This error happens because the variable res is not updated if the call
to dm_read_shared_word returns an error. In this particular case -EPROTO
was returned and res stayed uninitialized.
This can be avoided by checking the return value of dm_read_shared_word
and propagating the error if the read operation failed.
[1] https://syzkaller.appspot.com/bug?extid=1f53a30781af65d2c955
Cc: stable@vger.kernel.org
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-and-tested-by: syzbot+1f53a30781af65d2c955@syzkaller.appspotmail.com
Acked-by: Peter Korsgaard <peter@korsgaard.com>
Fixes: d0374f4f9c35cdfbee0 ("USB: Davicom DM9601 usbnet driver")
Link: https://lore.kernel.org/r/20231009-topic-dm9601_uninit_mdio_read-v2-1-f2fe39739b6c@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/dm9601.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/net/usb/dm9601.c
+++ b/drivers/net/usb/dm9601.c
@@ -221,13 +221,18 @@ static int dm9601_mdio_read(struct net_d
struct usbnet *dev = netdev_priv(netdev);
__le16 res;
+ int err;
if (phy_id) {
netdev_dbg(dev->net, "Only internal phy supported\n");
return 0;
}
- dm_read_shared_word(dev, 1, loc, &res);
+ err = dm_read_shared_word(dev, 1, loc, &res);
+ if (err < 0) {
+ netdev_err(dev->net, "MDIO read error: %d\n", err);
+ return err;
+ }
netdev_dbg(dev->net,
"dm9601_mdio_read() phy_id=0x%02x, loc=0x%02x, returns=0x%04x\n",
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 036/202] usb: dwc3: Soft reset phy on probe for host
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 035/202] net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 037/202] usb: musb: Get the musb_qh poniter after musb_giveback Greg Kroah-Hartman
` (171 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kenta Sato, Thinh Nguyen
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 8bea147dfdf823eaa8d3baeccc7aeb041b41944b upstream.
When there's phy initialization, we need to initiate a soft-reset
sequence. That's done through USBCMD.HCRST in the xHCI driver and its
initialization, However, the dwc3 driver may modify core configs before
the soft-reset. This may result in some connection instability. So,
ensure the phy is ready before the controller updates the GCTL.PRTCAPDIR
or other settings by issuing phy soft-reset.
Note that some host-mode configurations may not expose device registers
to initiate the controller soft-reset (via DCTL.CoreSftRst). So we reset
through GUSB3PIPECTL and GUSB2PHYCFG instead.
Cc: stable@vger.kernel.org
Fixes: e835c0a4e23c ("usb: dwc3: don't reset device side if dwc3 was configured as host-only")
Reported-by: Kenta Sato <tosainu.maple@gmail.com>
Closes: https://lore.kernel.org/linux-usb/ZPUciRLUcjDywMVS@debian.me/
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Tested-by: Kenta Sato <tosainu.maple@gmail.com>
Link: https://lore.kernel.org/r/70aea513215d273669152696cc02b20ddcdb6f1a.1694564261.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 39 ++++++++++++++++++++++++++++++++++++++-
1 file changed, 38 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -277,9 +277,46 @@ int dwc3_core_soft_reset(struct dwc3 *dw
* XHCI driver will reset the host block. If dwc3 was configured for
* host-only mode or current role is host, then we can return early.
*/
- if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
+ if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
return 0;
+ /*
+ * If the dr_mode is host and the dwc->current_dr_role is not the
+ * corresponding DWC3_GCTL_PRTCAP_HOST, then the dwc3_core_init_mode
+ * isn't executed yet. Ensure the phy is ready before the controller
+ * updates the GCTL.PRTCAPDIR or other settings by soft-resetting
+ * the phy.
+ *
+ * Note: GUSB3PIPECTL[n] and GUSB2PHYCFG[n] are port settings where n
+ * is port index. If this is a multiport host, then we need to reset
+ * all active ports.
+ */
+ if (dwc->dr_mode == USB_DR_MODE_HOST) {
+ u32 usb3_port;
+ u32 usb2_port;
+
+ usb3_port = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
+ usb3_port |= DWC3_GUSB3PIPECTL_PHYSOFTRST;
+ dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port);
+
+ usb2_port = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
+ usb2_port |= DWC3_GUSB2PHYCFG_PHYSOFTRST;
+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port);
+
+ /* Small delay for phy reset assertion */
+ usleep_range(1000, 2000);
+
+ usb3_port &= ~DWC3_GUSB3PIPECTL_PHYSOFTRST;
+ dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port);
+
+ usb2_port &= ~DWC3_GUSB2PHYCFG_PHYSOFTRST;
+ dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port);
+
+ /* Wait for clock synchronization */
+ msleep(50);
+ return 0;
+ }
+
reg = dwc3_readl(dwc->regs, DWC3_DCTL);
reg |= DWC3_DCTL_CSFTRST;
reg &= ~DWC3_DCTL_RUN_STOP;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 037/202] usb: musb: Get the musb_qh poniter after musb_giveback
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 036/202] usb: dwc3: Soft reset phy on probe for host Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 038/202] usb: musb: Modify the "HWVers" register address Greg Kroah-Hartman
` (170 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xingxing Luo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingxing Luo <xingxing.luo@unisoc.com>
commit 33d7e37232155aadebe4145dcc592f00dabd7a2b upstream.
When multiple threads are performing USB transmission, musb->lock will be
unlocked when musb_giveback is executed. At this time, qh may be released
in the dequeue process in other threads, resulting in a wild pointer, so
it needs to be here get qh again, and judge whether qh is NULL, and when
dequeue, you need to set qh to NULL.
Fixes: dbac5d07d13e ("usb: musb: host: don't start next rx urb if current one failed")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230919033055.14085-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/musb_host.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
--- a/drivers/usb/musb/musb_host.c
+++ b/drivers/usb/musb/musb_host.c
@@ -321,10 +321,16 @@ static void musb_advance_schedule(struct
musb_giveback(musb, urb, status);
qh->is_ready = ready;
+ /*
+ * musb->lock had been unlocked in musb_giveback, so qh may
+ * be freed, need to get it again
+ */
+ qh = musb_ep_get_qh(hw_ep, is_in);
+
/* reclaim resources (and bandwidth) ASAP; deschedule it, and
* invalidate qh as soon as list_empty(&hep->urb_list)
*/
- if (list_empty(&qh->hep->urb_list)) {
+ if (qh && list_empty(&qh->hep->urb_list)) {
struct list_head *head;
struct dma_controller *dma = musb->dma_controller;
@@ -2404,6 +2410,7 @@ static int musb_urb_dequeue(struct usb_h
* and its URB list has emptied, recycle this qh.
*/
if (ready && list_empty(&qh->hep->urb_list)) {
+ musb_ep_set_qh(qh->hw_ep, is_in, NULL);
qh->hep->hcpriv = NULL;
list_del(&qh->ring);
kfree(qh);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 038/202] usb: musb: Modify the "HWVers" register address
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 037/202] usb: musb: Get the musb_qh poniter after musb_giveback Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 039/202] iio: pressure: bmp280: Fix NULL pointer exception Greg Kroah-Hartman
` (169 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xingxing Luo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xingxing Luo <xingxing.luo@unisoc.com>
commit 6658a62e1ddf726483cb2d8bf45ea3f9bd533074 upstream.
musb HWVers rgister address is not 0x69, if we operate the
wrong address 0x69, it will cause a kernel crash, because
there is no register corresponding to this address in the
additional control register of musb. In fact, HWVers has
been defined in musb_register.h, and the name is
"MUSB_HWVERS", so We need to use this macro instead of 0x69.
Fixes: c2365ce5d5a0 ("usb: musb: replace hard coded registers with defines")
Cc: stable@vger.kernel.org
Signed-off-by: Xingxing Luo <xingxing.luo@unisoc.com>
Link: https://lore.kernel.org/r/20230922075929.31074-1-xingxing.luo@unisoc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/musb/musb_debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/musb/musb_debugfs.c
+++ b/drivers/usb/musb/musb_debugfs.c
@@ -39,7 +39,7 @@ static const struct musb_register_map mu
{ "IntrUsbE", MUSB_INTRUSBE, 8 },
{ "DevCtl", MUSB_DEVCTL, 8 },
{ "VControl", 0x68, 32 },
- { "HWVers", 0x69, 16 },
+ { "HWVers", MUSB_HWVERS, 16 },
{ "LinkInfo", MUSB_LINKINFO, 8 },
{ "VPLen", MUSB_VPLEN, 8 },
{ "HS_EOF1", MUSB_HS_EOF1, 8 },
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 039/202] iio: pressure: bmp280: Fix NULL pointer exception
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 038/202] usb: musb: Modify the "HWVers" register address Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 040/202] iio: pressure: dps310: Adjust Timeout Settings Greg Kroah-Hartman
` (168 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Phil Elwell, Linus Walleij,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Elwell <phil@raspberrypi.com>
commit 85dfb43bf69281adb1f345dfd9a39faf2e5a718d upstream.
The bmp085 EOC IRQ support is optional, but the driver's common probe
function queries the IRQ properties whether or not it exists, which
can trigger a NULL pointer exception. Avoid any exception by making
the query conditional on the possession of a valid IRQ.
Fixes: aae953949651 ("iio: pressure: bmp280: add support for BMP085 EOC interrupt")
Signed-off-by: Phil Elwell <phil@raspberrypi.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20230811155829.51208-1-phil@raspberrypi.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/bmp280-core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/pressure/bmp280-core.c
+++ b/drivers/iio/pressure/bmp280-core.c
@@ -1112,7 +1112,7 @@ int bmp280_common_probe(struct device *d
* however as it happens, the BMP085 shares the chip ID of BMP180
* so we look for an IRQ if we have that.
*/
- if (irq > 0 || (chip_id == BMP180_CHIP_ID)) {
+ if (irq > 0 && (chip_id == BMP180_CHIP_ID)) {
ret = bmp085_fetch_eoc_irq(dev, name, irq, data);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 040/202] iio: pressure: dps310: Adjust Timeout Settings
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 039/202] iio: pressure: bmp280: Fix NULL pointer exception Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 041/202] iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Greg Kroah-Hartman
` (167 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lakshmi Yadlapati, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lakshmi Yadlapati <lakshmiy@us.ibm.com>
commit 901a293fd96fb9bab843ba4cc7be3094a5aa7c94 upstream.
The DPS310 sensor chip has been encountering intermittent errors while
reading the sensor device across various system designs. This issue causes
the chip to become "stuck," preventing the indication of "ready" status
for pressure and temperature measurements in the MEAS_CFG register.
To address this issue, this commit fixes the timeout settings to improve
sensor stability:
- After sending a reset command to the chip, the timeout has been extended
from 2.5 ms to 15 ms, aligning with the DPS310 specification.
- The read timeout value of the MEAS_CFG register has been adjusted from
20ms to 30ms to match the specification.
Signed-off-by: Lakshmi Yadlapati <lakshmiy@us.ibm.com>
Fixes: 7b4ab4abcea4 ("iio: pressure: dps310: Reset chip after timeout")
Link: https://lore.kernel.org/r/20230829180222.3431926-2-lakshmiy@us.ibm.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/dps310.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/iio/pressure/dps310.c
+++ b/drivers/iio/pressure/dps310.c
@@ -57,8 +57,8 @@
#define DPS310_RESET_MAGIC 0x09
#define DPS310_COEF_BASE 0x10
-/* Make sure sleep time is <= 20ms for usleep_range */
-#define DPS310_POLL_SLEEP_US(t) min(20000, (t) / 8)
+/* Make sure sleep time is <= 30ms for usleep_range */
+#define DPS310_POLL_SLEEP_US(t) min(30000, (t) / 8)
/* Silently handle error in rate value here */
#define DPS310_POLL_TIMEOUT_US(rc) ((rc) <= 0 ? 1000000 : 1000000 / (rc))
@@ -402,8 +402,8 @@ static int dps310_reset_wait(struct dps3
if (rc)
return rc;
- /* Wait for device chip access: 2.5ms in specification */
- usleep_range(2500, 12000);
+ /* Wait for device chip access: 15ms in specification */
+ usleep_range(15000, 55000);
return 0;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 041/202] iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 040/202] iio: pressure: dps310: Adjust Timeout Settings Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 042/202] x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Greg Kroah-Hartman
` (166 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Zangerl, Stable,
Jonathan Cameron
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Zangerl <az@breathe-safe.com>
commit fd39d9668f2ce9f4b05ad55e8c8d80c098073e0b upstream.
The ms5611 driver falsely rejects lots of MS5607-02BA03-50 chips
with "PROM integrity check failed" because it doesn't accept a prom crc
value of zero as legitimate.
According to the datasheet for this chip (and the manufacturer's
application note about the PROM CRC), none of the possible values for the
CRC are excluded - but the current code in ms5611_prom_is_valid() ends with
return crc_orig != 0x0000 && crc == crc_orig
Discussed with the driver author (Tomasz Duszynski) and he indicated that
at that time (2015) he was dealing with some faulty chip samples which
returned blank data under some circumstances and/or followed example code
which indicated CRC zero being bad.
As far as I can tell this exception should not be applied anymore; We've
got a few hundred custom boards here with this chip where large numbers
of the prom have a legitimate CRC value 0, and do work fine, but which the
current driver code wrongly rejects.
Signed-off-by: Alexander Zangerl <az@breathe-safe.com>
Fixes: c0644160a8b5 ("iio: pressure: add support for MS5611 pressure and temperature sensor")
Link: https://lore.kernel.org/r/2535-1695168070.831792@Ze3y.dhYT.s3fx
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/pressure/ms5611_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/pressure/ms5611_core.c
+++ b/drivers/iio/pressure/ms5611_core.c
@@ -76,7 +76,7 @@ static bool ms5611_prom_is_valid(u16 *pr
crc = (crc >> 12) & 0x000F;
- return crc_orig != 0x0000 && crc == crc_orig;
+ return crc == crc_orig;
}
static int ms5611_read_prom(struct iio_dev *indio_dev)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 042/202] x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 041/202] iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 043/202] mcb: remove is_added flag from mcb_device struct Greg Kroah-Hartman
` (165 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, René Rebe,
Borislav Petkov (AMD), stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Borislav Petkov (AMD) <bp@alien8.de>
commit f454b18e07f518bcd0c05af17a2239138bff52de upstream.
Fix erratum #1485 on Zen4 parts where running with STIBP disabled can
cause an #UD exception. The performance impact of the fix is negligible.
Reported-by: René Rebe <rene@exactcode.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: René Rebe <rene@exactcode.de>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/D99589F4-BC5D-430B-87B2-72C20370CF57@exactcode.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/msr-index.h | 9 +++++++--
arch/x86/kernel/cpu/amd.c | 8 ++++++++
2 files changed, 15 insertions(+), 2 deletions(-)
--- a/arch/x86/include/asm/msr-index.h
+++ b/arch/x86/include/asm/msr-index.h
@@ -541,12 +541,17 @@
#define MSR_AMD64_VIRT_SPEC_CTRL 0xc001011f
-/* Fam 17h MSRs */
-#define MSR_F17H_IRPERF 0xc00000e9
+/* Zen4 */
+#define MSR_ZEN4_BP_CFG 0xc001102e
+#define MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT 5
+/* Zen 2 */
#define MSR_ZEN2_SPECTRAL_CHICKEN 0xc00110e3
#define MSR_ZEN2_SPECTRAL_CHICKEN_BIT BIT_ULL(1)
+/* Fam 17h MSRs */
+#define MSR_F17H_IRPERF 0xc00000e9
+
/* Fam 16h MSRs */
#define MSR_F16H_L2I_PERF_CTL 0xc0010230
#define MSR_F16H_L2I_PERF_CTR 0xc0010231
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -81,6 +81,10 @@ static const int amd_div0[] =
AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x17, 0x00, 0x0, 0x2f, 0xf),
AMD_MODEL_RANGE(0x17, 0x50, 0x0, 0x5f, 0xf));
+static const int amd_erratum_1485[] =
+ AMD_LEGACY_ERRATUM(AMD_MODEL_RANGE(0x19, 0x10, 0x0, 0x1f, 0xf),
+ AMD_MODEL_RANGE(0x19, 0x60, 0x0, 0xaf, 0xf));
+
static bool cpu_has_amd_erratum(struct cpuinfo_x86 *cpu, const int *erratum)
{
int osvw_id = *erratum++;
@@ -1178,6 +1182,10 @@ static void init_amd(struct cpuinfo_x86
pr_notice_once("AMD Zen1 DIV0 bug detected. Disable SMT for full protection.\n");
setup_force_cpu_bug(X86_BUG_DIV0);
}
+
+ if (!cpu_has(c, X86_FEATURE_HYPERVISOR) &&
+ cpu_has_amd_erratum(c, amd_erratum_1485))
+ msr_set_bit(MSR_ZEN4_BP_CFG, MSR_ZEN4_BP_CFG_SHARED_BTB_FIX_BIT);
}
#ifdef CONFIG_X86_32
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 043/202] mcb: remove is_added flag from mcb_device struct
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 042/202] x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 044/202] thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding Greg Kroah-Hartman
` (164 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Jorge Sanjuan Garcia,
Jose Javier Rodriguez Barbarin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
commit 0f28ada1fbf0054557cddcdb93ad17f767105208 upstream.
When calling mcb_bus_add_devices(), both mcb devices and the mcb
bus will attempt to attach a device to a driver because they share
the same bus_type. This causes an issue when trying to cast the
container of the device to mcb_device struct using to_mcb_device(),
leading to a wrong cast when the mcb_bus is added. A crash occurs
when freing the ida resources as the bus numbering of mcb_bus gets
confused with the is_added flag on the mcb_device struct.
The only reason for this cast was to keep an is_added flag on the
mcb_device struct that does not seem necessary. The function
device_attach() handles already bound devices and the mcb subsystem
does nothing special with this is_added flag so remove it completely.
Fixes: 18d288198099 ("mcb: Correctly initialize the bus's device")
Cc: stable <stable@kernel.org>
Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Co-developed-by: Jose Javier Rodriguez Barbarin <JoseJavier.Rodriguez@duagon.com>
Signed-off-by: Jose Javier Rodriguez Barbarin <JoseJavier.Rodriguez@duagon.com>
Link: https://lore.kernel.org/r/20230906114901.63174-2-JoseJavier.Rodriguez@duagon.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mcb/mcb-core.c | 10 +++-------
drivers/mcb/mcb-parse.c | 2 --
include/linux/mcb.h | 1 -
3 files changed, 3 insertions(+), 10 deletions(-)
--- a/drivers/mcb/mcb-core.c
+++ b/drivers/mcb/mcb-core.c
@@ -389,17 +389,13 @@ EXPORT_SYMBOL_NS_GPL(mcb_free_dev, MCB);
static int __mcb_bus_add_devices(struct device *dev, void *data)
{
- struct mcb_device *mdev = to_mcb_device(dev);
int retval;
- if (mdev->is_added)
- return 0;
-
retval = device_attach(dev);
- if (retval < 0)
+ if (retval < 0) {
dev_err(dev, "Error adding device (%d)\n", retval);
-
- mdev->is_added = true;
+ return retval;
+ }
return 0;
}
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -99,8 +99,6 @@ static int chameleon_parse_gdd(struct mc
mdev->mem.end = mdev->mem.start + size - 1;
mdev->mem.flags = IORESOURCE_MEM;
- mdev->is_added = false;
-
ret = mcb_device_register(bus, mdev);
if (ret < 0)
goto err;
--- a/include/linux/mcb.h
+++ b/include/linux/mcb.h
@@ -63,7 +63,6 @@ static inline struct mcb_bus *to_mcb_bus
struct mcb_device {
struct device dev;
struct mcb_bus *bus;
- bool is_added;
struct mcb_driver *driver;
u16 id;
int inst;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 044/202] thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 043/202] mcb: remove is_added flag from mcb_device struct Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 045/202] libceph: use kernel_connect() Greg Kroah-Hartman
` (163 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marek Šanta, Mika Westerberg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
commit a9fdf5f933a6f2b358fad0194b1287b67f6704b1 upstream.
Marek reported that when BlackMagic UltraStudio device is connected the
kernel repeatedly tries to enable lane bonding without success making
the device non-functional. It looks like the device does not have lane 1
connected at all so even though it is enabled we should not try to bond
the lanes. For this reason check that lane 1 is in fact CL0 (connected,
active) before attempting to bond the lanes.
Reported-by: Marek Šanta <teslan223@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217737
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/switch.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/thunderbolt/switch.c
+++ b/drivers/thunderbolt/switch.c
@@ -2303,6 +2303,13 @@ int tb_switch_lane_bonding_enable(struct
!tb_port_is_width_supported(down, 2))
return 0;
+ /*
+ * Both lanes need to be in CL0. Here we assume lane 0 already be in
+ * CL0 and check just for lane 1.
+ */
+ if (tb_wait_for_port(down->dual_link_port, false) <= 0)
+ return -ENOTCONN;
+
ret = tb_port_lane_bonding_enable(up);
if (ret) {
tb_port_warn(up, "failed to enable lane bonding\n");
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 045/202] libceph: use kernel_connect()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 044/202] thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 046/202] ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Greg Kroah-Hartman
` (162 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jordan Rife, Ilya Dryomov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rife <jrife@google.com>
commit 7563cf17dce0a875ba3d872acdc63a78ea344019 upstream.
Direct calls to ops->connect() can overwrite the address parameter when
used in conjunction with BPF SOCK_ADDR hooks. Recent changes to
kernel_connect() ensure that callers are insulated from such side
effects. This patch wraps the direct call to ops->connect() with
kernel_connect() to prevent unexpected changes to the address passed to
ceph_tcp_connect().
This change was originally part of a larger patch targeting the net tree
addressing all instances of unprotected calls to ops->connect()
throughout the kernel, but this change was split up into several patches
targeting various trees.
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20230821100007.559638-1-jrife@google.com/
Link: https://lore.kernel.org/netdev/9944248dba1bce861375fcce9de663934d933ba9.camel@redhat.com/
Fixes: d74bad4e74ee ("bpf: Hooks for sys_connect")
Signed-off-by: Jordan Rife <jrife@google.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/messenger.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -477,8 +477,8 @@ static int ceph_tcp_connect(struct ceph_
dout("connect %s\n", ceph_pr_addr(&con->peer_addr));
con_sock_state_connecting(con);
- ret = sock->ops->connect(sock, (struct sockaddr *)&ss, sizeof(ss),
- O_NONBLOCK);
+ ret = kernel_connect(sock, (struct sockaddr *)&ss, sizeof(ss),
+ O_NONBLOCK);
if (ret == -EINPROGRESS) {
dout("connect %s EINPROGRESS sk_state = %u\n",
ceph_pr_addr(&con->peer_addr),
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 046/202] ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 045/202] libceph: use kernel_connect() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 047/202] ceph: fix type promotion bug on 32bit systems Greg Kroah-Hartman
` (161 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiubo Li, Milind Changire,
Ilya Dryomov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiubo Li <xiubli@redhat.com>
commit 15c0a870dc44ed14e01efbdd319d232234ee639f upstream.
When truncating the inode the MDS will acquire the xlock for the
ifile Locker, which will revoke the 'Frwsxl' caps from the clients.
But when the client just releases and flushes the 'Fw' caps to MDS,
for exmaple, and once the MDS receives the caps flushing msg it
just thought the revocation has finished. Then the MDS will continue
truncating the inode and then issued the truncate notification to
all the clients. While just before the clients receives the cap
flushing ack they receive the truncation notification, the clients
will detecte that the 'issued | dirty' is still holding the 'Fw'
caps.
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/56693
Fixes: b0d7c2231015 ("ceph: introduce i_truncate_mutex")
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Milind Changire <mchangir@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/inode.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/fs/ceph/inode.c
+++ b/fs/ceph/inode.c
@@ -635,9 +635,7 @@ int ceph_fill_file_size(struct inode *in
ci->i_truncate_seq = truncate_seq;
/* the MDS should have revoked these caps */
- WARN_ON_ONCE(issued & (CEPH_CAP_FILE_EXCL |
- CEPH_CAP_FILE_RD |
- CEPH_CAP_FILE_WR |
+ WARN_ON_ONCE(issued & (CEPH_CAP_FILE_RD |
CEPH_CAP_FILE_LAZYIO));
/*
* If we hold relevant caps, or in the case where we're
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 047/202] ceph: fix type promotion bug on 32bit systems
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 046/202] ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 048/202] Input: powermate - fix use-after-free in powermate_config_complete Greg Kroah-Hartman
` (160 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Xiubo Li,
Ilya Dryomov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 07bb00ef00ace88dd6f695fadbba76565756e55c upstream.
In this code "ret" is type long and "src_objlen" is unsigned int. The
problem is that on 32bit systems, when we do the comparison signed longs
are type promoted to unsigned int. So negative error codes from
do_splice_direct() are treated as success instead of failure.
Cc: stable@vger.kernel.org
Fixes: 1b0c3b9f91f0 ("ceph: re-org copy_file_range and fix some error paths")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/ceph/file.c
+++ b/fs/ceph/file.c
@@ -2428,7 +2428,7 @@ static ssize_t __ceph_copy_file_range(st
ret = do_splice_direct(src_file, &src_off, dst_file,
&dst_off, src_objlen, flags);
/* Abort on short copies or on error */
- if (ret < src_objlen) {
+ if (ret < (long)src_objlen) {
dout("Failed partial copy (%zd)\n", ret);
goto out;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 048/202] Input: powermate - fix use-after-free in powermate_config_complete
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 047/202] ceph: fix type promotion bug on 32bit systems Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 049/202] Input: psmouse - fix fast_reconnect function for PS/2 mode Greg Kroah-Hartman
` (159 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Carrasco,
syzbot+0434ac83f907a1dbdd1e, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit 5c15c60e7be615f05a45cd905093a54b11f461bc upstream.
syzbot has found a use-after-free bug [1] in the powermate driver. This
happens when the device is disconnected, which leads to a memory free from
the powermate_device struct. When an asynchronous control message
completes after the kfree and its callback is invoked, the lock does not
exist anymore and hence the bug.
Use usb_kill_urb() on pm->config to cancel any in-progress requests upon
device disconnection.
[1] https://syzkaller.appspot.com/bug?extid=0434ac83f907a1dbdd1e
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reported-by: syzbot+0434ac83f907a1dbdd1e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/20230916-topic-powermate_use_after_free-v3-1-64412b81a7a2@gmail.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/powermate.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/input/misc/powermate.c
+++ b/drivers/input/misc/powermate.c
@@ -425,6 +425,7 @@ static void powermate_disconnect(struct
pm->requires_update = 0;
usb_kill_urb(pm->irq);
input_unregister_device(pm->input);
+ usb_kill_urb(pm->config);
usb_free_urb(pm->irq);
usb_free_urb(pm->config);
powermate_free_buffers(interface_to_usbdev(intf), pm);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 049/202] Input: psmouse - fix fast_reconnect function for PS/2 mode
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 048/202] Input: powermate - fix use-after-free in powermate_config_complete Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 050/202] Input: xpad - add PXN V900 support Greg Kroah-Hartman
` (158 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thorsten Leemhuis, Jeffery Miller,
Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeffery Miller <jefferymiller@google.com>
commit e2cb5cc822b6c9ee72c56ce1d81671b22c05406a upstream.
When the SMBus connection is attempted psmouse_smbus_init() sets
the fast_reconnect pointer to psmouse_smbus_reconnecti(). If SMBus
initialization fails, elantech_setup_ps2() and synaptics_init_ps2() will
fallback to PS/2 mode, replacing the psmouse private data. This can cause
issues on resume, since psmouse_smbus_reconnect() expects to find an
instance of struct psmouse_smbus_dev in psmouse->private.
The issue was uncovered when in 92e24e0e57f7 ("Input: psmouse - add
delay when deactivating for SMBus mode") psmouse_smbus_reconnect()
started attempting to use more of the data structure. The commit was
since reverted, not because it was at fault, but because there was found
a better way of doing what it was attempting to do.
Fix the problem by resetting the fast_reconnect pointer in psmouse
structure in elantech_setup_ps2() and synaptics_init_ps2() when the PS/2
mode is used.
Reported-by: Thorsten Leemhuis <linux@leemhuis.info>
Tested-by: Thorsten Leemhuis <linux@leemhuis.info>
Signed-off-by: Jeffery Miller <jefferymiller@google.com>
Fixes: bf232e460a35 ("Input: psmouse-smbus - allow to control psmouse_deactivate")
Link: https://lore.kernel.org/r/20231005002249.554877-1-jefferymiller@google.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/elantech.c | 1 +
drivers/input/mouse/synaptics.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -2112,6 +2112,7 @@ static int elantech_setup_ps2(struct psm
psmouse->protocol_handler = elantech_process_byte;
psmouse->disconnect = elantech_disconnect;
psmouse->reconnect = elantech_reconnect;
+ psmouse->fast_reconnect = NULL;
psmouse->pktsize = info->hw_version > 1 ? 6 : 4;
return 0;
--- a/drivers/input/mouse/synaptics.c
+++ b/drivers/input/mouse/synaptics.c
@@ -1619,6 +1619,7 @@ static int synaptics_init_ps2(struct psm
psmouse->set_rate = synaptics_set_rate;
psmouse->disconnect = synaptics_disconnect;
psmouse->reconnect = synaptics_reconnect;
+ psmouse->fast_reconnect = NULL;
psmouse->cleanup = synaptics_reset;
/* Synaptics can usually stay in sync without extra help */
psmouse->resync_time = 0;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 050/202] Input: xpad - add PXN V900 support
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 049/202] Input: psmouse - fix fast_reconnect function for PS/2 mode Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 051/202] Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table Greg Kroah-Hartman
` (157 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matthias Berndt, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthias Berndt <matthias_berndt@gmx.de>
commit a65cd7ef5a864bdbbe037267c327786b7759d4c6 upstream.
Add VID and PID to the xpad_device table to allow driver to use the PXN
V900 steering wheel, which is XTYPE_XBOX360 compatible in xinput mode.
Signed-off-by: Matthias Berndt <matthias_berndt@gmx.de>
Link: https://lore.kernel.org/r/4932699.31r3eYUQgx@fedora
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/xpad.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -252,6 +252,7 @@ static const struct xpad_device {
{ 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
{ 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 },
{ 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 },
+ { 0x11ff, 0x0511, "PXN V900", 0, XTYPE_XBOX360 },
{ 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 },
{ 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 },
@@ -446,6 +447,7 @@ static const struct usb_device_id xpad_t
XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */
XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */
XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */
+ XPAD_XBOX360_VENDOR(0x11ff), /* PXN V900 */
XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */
XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */
XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 051/202] Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 050/202] Input: xpad - add PXN V900 support Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 052/202] Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case Greg Kroah-Hartman
` (156 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Szilard Fabian, Dmitry Torokhov
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Szilard Fabian <szfabian@bluemarch.art>
commit 80f39e1c27ba9e5a1ea7e68e21c569c9d8e46062 upstream.
In the initial boot stage the integrated keyboard of Fujitsu Lifebook E5411
refuses to work and it's not possible to type for example a dm-crypt
passphrase without the help of an external keyboard.
i8042.nomux kernel parameter resolves this issue but using that a PS/2
mouse is detected. This input device is unused even when the i2c-hid-acpi
kernel module is blacklisted making the integrated ELAN touchpad
(04F3:308A) not working at all.
Since the integrated touchpad is managed by the i2c_designware input
driver in the Linux kernel and you can't find a PS/2 mouse port on the
computer I think it's safe to not use the PS/2 mouse port at all.
Signed-off-by: Szilard Fabian <szfabian@bluemarch.art>
Link: https://lore.kernel.org/r/20231004011749.101789-1-szfabian@bluemarch.art
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -610,6 +610,14 @@ static const struct dmi_system_id i8042_
.driver_data = (void *)(SERIO_QUIRK_NOMUX)
},
{
+ /* Fujitsu Lifebook E5411 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU CLIENT COMPUTING LIMITED"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E5411"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOAUX)
+ },
+ {
/* Gigabyte M912 */
.matches = {
DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 052/202] Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 051/202] Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table Greg Kroah-Hartman
@ 2023-10-23 10:55 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 053/202] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session Greg Kroah-Hartman
` (155 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Dmitry Torokhov,
Michael Smith
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 423622a90abb243944d1517b9f57db53729e45c4 upstream.
Add a special case for gpio_count == 1 && gpio_int_idx == 0 to
goodix_add_acpi_gpio_mappings().
It seems that on newer x86/ACPI devices the reset and irq GPIOs are no
longer listed as GPIO resources instead there is only 1 GpioInt resource
and _PS0 does the whole reset sequence for us.
This means that we must call acpi_device_fix_up_power() on these devices
to ensure that the chip is reset before we try to use it.
This part was already fixed in commit 3de93e6ed2df ("Input: goodix - call
acpi_device_fix_up_power() in some cases") by adding a call to
acpi_device_fix_up_power() to the generic "Unexpected ACPI resources"
catch all.
But it turns out that this case on some hw needs some more special
handling. Specifically the firmware may bootup with the IRQ pin in
output mode. The reset sequence from ACPI _PS0 (executed by
acpi_device_fix_up_power()) should put the pin in input mode,
but the GPIO subsystem has cached the direction at bootup, causing
request_irq() to fail due to gpiochip_lock_as_irq() failure:
[ 9.119864] Goodix-TS i2c-GDIX1002:00: Unexpected ACPI resources: gpio_count 1, gpio_int_idx 0
[ 9.317443] Goodix-TS i2c-GDIX1002:00: ID 911, version: 1060
[ 9.321902] input: Goodix Capacitive TouchScreen as /devices/pci0000:00/0000:00:17.0/i2c_designware.4/i2c-5/i2c-GDIX1002:00/input/input8
[ 9.327840] gpio gpiochip0: (INT3453:00): gpiochip_lock_as_irq: tried to flag a GPIO set as output for IRQ
[ 9.327856] gpio gpiochip0: (INT3453:00): unable to lock HW IRQ 26 for IRQ
[ 9.327861] genirq: Failed to request resources for GDIX1002:00 (irq 131) on irqchip intel-gpio
[ 9.327912] Goodix-TS i2c-GDIX1002:00: request IRQ failed: -5
Fix this by adding a special case for gpio_count == 1 && gpio_int_idx == 0
which adds an ACPI GPIO lookup table for the int GPIO even though we cannot
use it for reset purposes (as there is no reset GPIO).
Adding the lookup will make the gpiod_int = gpiod_get(..., GPIOD_IN) call
succeed, which will explicitly set the direction to input fixing the issue.
Note this re-uses the acpi_goodix_int_first_gpios[] lookup table, since
there is only 1 GPIO in the ACPI resources the reset entry in that
lookup table will amount to a no-op.
Reported-and-tested-by: Michael Smith <1973.mjsmith@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231003215144.69527-1-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/goodix.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/drivers/input/touchscreen/goodix.c
+++ b/drivers/input/touchscreen/goodix.c
@@ -820,6 +820,25 @@ static int goodix_add_acpi_gpio_mappings
dev_info(dev, "No ACPI GpioInt resource, assuming that the GPIO order is reset, int\n");
ts->irq_pin_access_method = IRQ_PIN_ACCESS_ACPI_GPIO;
gpio_mapping = acpi_goodix_int_last_gpios;
+ } else if (ts->gpio_count == 1 && ts->gpio_int_idx == 0) {
+ /*
+ * On newer devices there is only 1 GpioInt resource and _PS0
+ * does the whole reset sequence for us.
+ */
+ acpi_device_fix_up_power(ACPI_COMPANION(dev));
+
+ /*
+ * Before the _PS0 call the int GPIO may have been in output
+ * mode and the call should have put the int GPIO in input mode,
+ * but the GPIO subsys cached state may still think it is
+ * in output mode, causing gpiochip_lock_as_irq() failure.
+ *
+ * Add a mapping for the int GPIO to make the
+ * gpiod_int = gpiod_get(..., GPIOD_IN) call succeed,
+ * which will explicitly set the direction to input.
+ */
+ ts->irq_pin_access_method = IRQ_PIN_ACCESS_NONE;
+ gpio_mapping = acpi_goodix_int_first_gpios;
} else {
dev_warn(dev, "Unexpected ACPI resources: gpio_count %d, gpio_int_idx %d\n",
ts->gpio_count, ts->gpio_int_idx);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 053/202] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-10-23 10:55 ` [PATCH 5.10 052/202] Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 054/202] cgroup: Remove duplicates in cgroup v1 tasks file Greg Kroah-Hartman
` (154 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rijo Thomas, Sumit Garg,
Jens Wiklander
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rijo Thomas <Rijo-john.Thomas@amd.com>
commit f4384b3e54ea813868bb81a861bf5b2406e15d8f upstream.
There is a potential race condition in amdtee_close_session that may
cause use-after-free in amdtee_open_session. For instance, if a session
has refcount == 1, and one thread tries to free this session via:
kref_put(&sess->refcount, destroy_session);
the reference count will get decremented, and the next step would be to
call destroy_session(). However, if in another thread,
amdtee_open_session() is called before destroy_session() has completed
execution, alloc_session() may return 'sess' that will be freed up
later in destroy_session() leading to use-after-free in
amdtee_open_session.
To fix this issue, treat decrement of sess->refcount and removal of
'sess' from session list in destroy_session() as a critical section, so
that it is executed atomically.
Fixes: 757cc3e9ff1d ("tee: add AMD-TEE driver")
Cc: stable@vger.kernel.org
Signed-off-by: Rijo Thomas <Rijo-john.Thomas@amd.com>
Reviewed-by: Sumit Garg <sumit.garg@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tee/amdtee/core.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/tee/amdtee/core.c
+++ b/drivers/tee/amdtee/core.c
@@ -217,12 +217,12 @@ unlock:
return rc;
}
+/* mutex must be held by caller */
static void destroy_session(struct kref *ref)
{
struct amdtee_session *sess = container_of(ref, struct amdtee_session,
refcount);
- mutex_lock(&session_list_mutex);
list_del(&sess->list_node);
mutex_unlock(&session_list_mutex);
kfree(sess);
@@ -272,7 +272,8 @@ int amdtee_open_session(struct tee_conte
if (arg->ret != TEEC_SUCCESS) {
pr_err("open_session failed %d\n", arg->ret);
handle_unload_ta(ta_handle);
- kref_put(&sess->refcount, destroy_session);
+ kref_put_mutex(&sess->refcount, destroy_session,
+ &session_list_mutex);
goto out;
}
@@ -290,7 +291,8 @@ int amdtee_open_session(struct tee_conte
pr_err("reached maximum session count %d\n", TEE_NUM_SESSIONS);
handle_close_session(ta_handle, session_info);
handle_unload_ta(ta_handle);
- kref_put(&sess->refcount, destroy_session);
+ kref_put_mutex(&sess->refcount, destroy_session,
+ &session_list_mutex);
rc = -ENOMEM;
goto out;
}
@@ -331,7 +333,7 @@ int amdtee_close_session(struct tee_cont
handle_close_session(ta_handle, session_info);
handle_unload_ta(ta_handle);
- kref_put(&sess->refcount, destroy_session);
+ kref_put_mutex(&sess->refcount, destroy_session, &session_list_mutex);
return 0;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 054/202] cgroup: Remove duplicates in cgroup v1 tasks file
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 053/202] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 055/202] pinctrl: avoid unsafe code pattern in find_pinctrl() Greg Kroah-Hartman
` (153 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Firo Yang, Michal Koutný,
Tejun Heo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Koutný <mkoutny@suse.com>
commit 1ca0b605150501b7dc59f3016271da4eb3e96fce upstream.
One PID may appear multiple times in a preloaded pidlist.
(Possibly due to PID recycling but we have reports of the same
task_struct appearing with different PIDs, thus possibly involving
transfer of PID via de_thread().)
Because v1 seq_file iterator uses PIDs as position, it leads to
a message:
> seq_file: buggy .next function kernfs_seq_next did not update position index
Conservative and quick fix consists of removing duplicates from `tasks`
file (as opposed to removing pidlists altogether). It doesn't affect
correctness (it's sufficient to show a PID once), performance impact
would be hidden by unconditional sorting of the pidlist already in place
(asymptotically).
Link: https://lore.kernel.org/r/20230823174804.23632-1-mkoutny@suse.com/
Suggested-by: Firo Yang <firo.yang@suse.com>
Signed-off-by: Michal Koutný <mkoutny@suse.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup/cgroup-v1.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/kernel/cgroup/cgroup-v1.c
+++ b/kernel/cgroup/cgroup-v1.c
@@ -361,10 +361,9 @@ static int pidlist_array_load(struct cgr
}
css_task_iter_end(&it);
length = n;
- /* now sort & (if procs) strip out duplicates */
+ /* now sort & strip out duplicates (tgids or recycled thread PIDs) */
sort(array, length, sizeof(pid_t), cmppid, NULL);
- if (type == CGROUP_FILE_PROCS)
- length = pidlist_uniq(array, length);
+ length = pidlist_uniq(array, length);
l = cgroup_pidlist_find_create(cgrp, type);
if (!l) {
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 055/202] pinctrl: avoid unsafe code pattern in find_pinctrl()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 054/202] cgroup: Remove duplicates in cgroup v1 tasks file Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 056/202] counter: microchip-tcb-capture: Fix the use of internal GCLK logic Greg Kroah-Hartman
` (152 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dmitry Torokhov, Linus Walleij
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit c153a4edff6ab01370fcac8e46f9c89cca1060c2 upstream.
The code in find_pinctrl() takes a mutex and traverses a list of pinctrl
structures. Later the caller bumps up reference count on the found
structure. Such pattern is not safe as pinctrl that was found may get
deleted before the caller gets around to increasing the reference count.
Fix this by taking the reference count in find_pinctrl(), while it still
holds the mutex.
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Link: https://lore.kernel.org/r/ZQs1RgTKg6VJqmPs@google.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/core.c | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1007,17 +1007,20 @@ static int add_setting(struct pinctrl *p
static struct pinctrl *find_pinctrl(struct device *dev)
{
- struct pinctrl *p;
+ struct pinctrl *entry, *p = NULL;
mutex_lock(&pinctrl_list_mutex);
- list_for_each_entry(p, &pinctrl_list, node)
- if (p->dev == dev) {
- mutex_unlock(&pinctrl_list_mutex);
- return p;
+
+ list_for_each_entry(entry, &pinctrl_list, node) {
+ if (entry->dev == dev) {
+ p = entry;
+ kref_get(&p->users);
+ break;
}
+ }
mutex_unlock(&pinctrl_list_mutex);
- return NULL;
+ return p;
}
static void pinctrl_free(struct pinctrl *p, bool inlist);
@@ -1126,7 +1129,6 @@ struct pinctrl *pinctrl_get(struct devic
p = find_pinctrl(dev);
if (p) {
dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
- kref_get(&p->users);
return p;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 056/202] counter: microchip-tcb-capture: Fix the use of internal GCLK logic
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 055/202] pinctrl: avoid unsafe code pattern in find_pinctrl() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 057/202] usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Greg Kroah-Hartman
` (151 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dharma Balasubiramani,
William Breathitt Gray
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dharma Balasubiramani <dharma.b@microchip.com>
commit df8fdd01c98b99d04915c04f3a5ce73f55456b7c upstream.
As per the datasheet, the clock selection Bits 2:0 – TCCLKS[2:0] should
be set to 0 while using the internal GCLK (TIMER_CLOCK1).
Fixes: 106b104137fd ("counter: Add microchip TCB capture counter")
Signed-off-by: Dharma Balasubiramani <dharma.b@microchip.com>
Link: https://lore.kernel.org/r/20230905100835.315024-1-dharma.b@microchip.com
Signed-off-by: William Breathitt Gray <william.gray@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/counter/microchip-tcb-capture.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/counter/microchip-tcb-capture.c
+++ b/drivers/counter/microchip-tcb-capture.c
@@ -111,7 +111,7 @@ static int mchp_tc_count_function_set(st
priv->qdec_mode = 0;
/* Set highest rate based on whether soc has gclk or not */
bmr &= ~(ATMEL_TC_QDEN | ATMEL_TC_POSEN);
- if (priv->tc_cfg->has_gclk)
+ if (!priv->tc_cfg->has_gclk)
cmr |= ATMEL_TC_TIMER_CLOCK2;
else
cmr |= ATMEL_TC_TIMER_CLOCK1;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 057/202] usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 056/202] counter: microchip-tcb-capture: Fix the use of internal GCLK logic Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 058/202] usb: gadget: ncm: Handle decoding of multiple NTBs in unwrap call Greg Kroah-Hartman
` (150 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, kernel test robot, Piyush Mehta
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Piyush Mehta <piyush.mehta@amd.com>
commit 3061b6491f491197a35e14e49f805d661b02acd4 upstream.
For ARM processor, unaligned access to device memory is not allowed.
Method memcpy does not take care of alignment.
USB detection failure with the unalingned address of memory, with
below kernel crash. To fix the unalingned address kernel panic,
replace memcpy with memcpy_toio method.
Kernel crash:
Unable to handle kernel paging request at virtual address ffff80000c05008a
Mem abort info:
ESR = 0x96000061
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x21: alignment fault
Data abort info:
ISV = 0, ISS = 0x00000061
CM = 0, WnR = 1
swapper pgtable: 4k pages, 48-bit VAs, pgdp=000000000143b000
[ffff80000c05008a] pgd=100000087ffff003, p4d=100000087ffff003,
pud=100000087fffe003, pmd=1000000800bcc003, pte=00680000a0010713
Internal error: Oops: 96000061 [#1] SMP
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.15.19-xilinx-v2022.1 #1
Hardware name: ZynqMP ZCU102 Rev1.0 (DT)
pstate: 200000c5 (nzCv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __memcpy+0x30/0x260
lr : __xudc_ep0_queue+0xf0/0x110
sp : ffff800008003d00
x29: ffff800008003d00 x28: ffff800009474e80 x27: 00000000000000a0
x26: 0000000000000100 x25: 0000000000000012 x24: ffff000800bc8080
x23: 0000000000000001 x22: 0000000000000012 x21: ffff000800bc8080
x20: 0000000000000012 x19: ffff000800bc8080 x18: 0000000000000000
x17: ffff800876482000 x16: ffff800008004000 x15: 0000000000004000
x14: 00001f09785d0400 x13: 0103020101005567 x12: 0781400000000200
x11: 00000000c5672a10 x10: 00000000000008d0 x9 : ffff800009463cf0
x8 : ffff8000094757b0 x7 : 0201010055670781 x6 : 4000000002000112
x5 : ffff80000c05009a x4 : ffff000800a15012 x3 : ffff00080362ad80
x2 : 0000000000000012 x1 : ffff000800a15000 x0 : ffff80000c050088
Call trace:
__memcpy+0x30/0x260
xudc_ep0_queue+0x3c/0x60
usb_ep_queue+0x38/0x44
composite_ep0_queue.constprop.0+0x2c/0xc0
composite_setup+0x8d0/0x185c
configfs_composite_setup+0x74/0xb0
xudc_irq+0x570/0xa40
__handle_irq_event_percpu+0x58/0x170
handle_irq_event+0x60/0x120
handle_fasteoi_irq+0xc0/0x220
handle_domain_irq+0x60/0x90
gic_handle_irq+0x74/0xa0
call_on_irq_stack+0x2c/0x60
do_interrupt_handler+0x54/0x60
el1_interrupt+0x30/0x50
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x78/0x7c
arch_cpu_idle+0x18/0x2c
do_idle+0xdc/0x15c
cpu_startup_entry+0x28/0x60
rest_init+0xc8/0xe0
arch_call_rest_init+0x10/0x1c
start_kernel+0x694/0x6d4
__primary_switched+0xa4/0xac
Fixes: 1f7c51660034 ("usb: gadget: Add xilinx usb2 device support")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/all/202209020044.CX2PfZzM-lkp@intel.com/
Cc: stable@vger.kernel.org
Signed-off-by: Piyush Mehta <piyush.mehta@amd.com>
Link: https://lore.kernel.org/r/20230929121514.13475-1-piyush.mehta@amd.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/udc/udc-xilinx.c | 20 ++++++++++++--------
1 file changed, 12 insertions(+), 8 deletions(-)
--- a/drivers/usb/gadget/udc/udc-xilinx.c
+++ b/drivers/usb/gadget/udc/udc-xilinx.c
@@ -496,11 +496,13 @@ static int xudc_eptxrx(struct xusb_ep *e
/* Get the Buffer address and copy the transmit data.*/
eprambase = (u32 __force *)(udc->addr + ep->rambase);
if (ep->is_in) {
- memcpy(eprambase, bufferptr, bytestosend);
+ memcpy_toio((void __iomem *)eprambase, bufferptr,
+ bytestosend);
udc->write_fn(udc->addr, ep->offset +
XUSB_EP_BUF0COUNT_OFFSET, bufferlen);
} else {
- memcpy(bufferptr, eprambase, bytestosend);
+ memcpy_toio((void __iomem *)bufferptr, eprambase,
+ bytestosend);
}
/*
* Enable the buffer for transmission.
@@ -514,11 +516,13 @@ static int xudc_eptxrx(struct xusb_ep *e
eprambase = (u32 __force *)(udc->addr + ep->rambase +
ep->ep_usb.maxpacket);
if (ep->is_in) {
- memcpy(eprambase, bufferptr, bytestosend);
+ memcpy_toio((void __iomem *)eprambase, bufferptr,
+ bytestosend);
udc->write_fn(udc->addr, ep->offset +
XUSB_EP_BUF1COUNT_OFFSET, bufferlen);
} else {
- memcpy(bufferptr, eprambase, bytestosend);
+ memcpy_toio((void __iomem *)bufferptr, eprambase,
+ bytestosend);
}
/*
* Enable the buffer for transmission.
@@ -1020,7 +1024,7 @@ static int __xudc_ep0_queue(struct xusb_
udc->addr);
length = req->usb_req.actual = min_t(u32, length,
EP0_MAX_PACKET);
- memcpy(corebuf, req->usb_req.buf, length);
+ memcpy_toio((void __iomem *)corebuf, req->usb_req.buf, length);
udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, length);
udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
} else {
@@ -1746,7 +1750,7 @@ static void xudc_handle_setup(struct xus
/* Load up the chapter 9 command buffer.*/
ep0rambase = (u32 __force *) (udc->addr + XUSB_SETUP_PKT_ADDR_OFFSET);
- memcpy(&setup, ep0rambase, 8);
+ memcpy_toio((void __iomem *)&setup, ep0rambase, 8);
udc->setup = setup;
udc->setup.wValue = cpu_to_le16(setup.wValue);
@@ -1833,7 +1837,7 @@ static void xudc_ep0_out(struct xusb_udc
(ep0->rambase << 2));
buffer = req->usb_req.buf + req->usb_req.actual;
req->usb_req.actual = req->usb_req.actual + bytes_to_rx;
- memcpy(buffer, ep0rambase, bytes_to_rx);
+ memcpy_toio((void __iomem *)buffer, ep0rambase, bytes_to_rx);
if (req->usb_req.length == req->usb_req.actual) {
/* Data transfer completed get ready for Status stage */
@@ -1909,7 +1913,7 @@ static void xudc_ep0_in(struct xusb_udc
(ep0->rambase << 2));
buffer = req->usb_req.buf + req->usb_req.actual;
req->usb_req.actual = req->usb_req.actual + length;
- memcpy(ep0rambase, buffer, length);
+ memcpy_toio((void __iomem *)ep0rambase, buffer, length);
}
udc->write_fn(udc->addr, XUSB_EP_BUF0COUNT_OFFSET, count);
udc->write_fn(udc->addr, XUSB_BUFFREADY_OFFSET, 1);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 058/202] usb: gadget: ncm: Handle decoding of multiple NTBs in unwrap call
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 057/202] usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 059/202] dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Greg Kroah-Hartman
` (149 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krishna Kurapati,
Maciej Żenczykowski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krishna Kurapati <quic_kriskura@quicinc.com>
commit 427694cfaafa565a3db5c5ea71df6bc095dca92f upstream.
When NCM is used with hosts like Windows PC, it is observed that there are
multiple NTB's contained in one usb request giveback. Since the driver
unwraps the obtained request data assuming only one NTB is present, we
loose the subsequent NTB's present resulting in data loss.
Fix this by checking the parsed block length with the obtained data
length in usb request and continue parsing after the last byte of current
NTB.
Cc: stable@vger.kernel.org
Fixes: 9f6ce4240a2b ("usb: gadget: f_ncm.c added")
Signed-off-by: Krishna Kurapati <quic_kriskura@quicinc.com>
Reviewed-by: Maciej Żenczykowski <maze@google.com>
Link: https://lore.kernel.org/r/20230927105858.12950-1-quic_kriskura@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/gadget/function/f_ncm.c | 26 +++++++++++++++++++-------
1 file changed, 19 insertions(+), 7 deletions(-)
--- a/drivers/usb/gadget/function/f_ncm.c
+++ b/drivers/usb/gadget/function/f_ncm.c
@@ -1180,7 +1180,8 @@ static int ncm_unwrap_ntb(struct gether
struct sk_buff_head *list)
{
struct f_ncm *ncm = func_to_ncm(&port->func);
- __le16 *tmp = (void *) skb->data;
+ unsigned char *ntb_ptr = skb->data;
+ __le16 *tmp;
unsigned index, index2;
int ndp_index;
unsigned dg_len, dg_len2;
@@ -1193,6 +1194,10 @@ static int ncm_unwrap_ntb(struct gether
const struct ndp_parser_opts *opts = ncm->parser_opts;
unsigned crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
int dgram_counter;
+ int to_process = skb->len;
+
+parse_ntb:
+ tmp = (__le16 *)ntb_ptr;
/* dwSignature */
if (get_unaligned_le32(tmp) != opts->nth_sign) {
@@ -1239,7 +1244,7 @@ static int ncm_unwrap_ntb(struct gether
* walk through NDP
* dwSignature
*/
- tmp = (void *)(skb->data + ndp_index);
+ tmp = (__le16 *)(ntb_ptr + ndp_index);
if (get_unaligned_le32(tmp) != ncm->ndp_sign) {
INFO(port->func.config->cdev, "Wrong NDP SIGN\n");
goto err;
@@ -1296,11 +1301,11 @@ static int ncm_unwrap_ntb(struct gether
if (ncm->is_crc) {
uint32_t crc, crc2;
- crc = get_unaligned_le32(skb->data +
+ crc = get_unaligned_le32(ntb_ptr +
index + dg_len -
crc_len);
crc2 = ~crc32_le(~0,
- skb->data + index,
+ ntb_ptr + index,
dg_len - crc_len);
if (crc != crc2) {
INFO(port->func.config->cdev,
@@ -1327,7 +1332,7 @@ static int ncm_unwrap_ntb(struct gether
dg_len - crc_len);
if (skb2 == NULL)
goto err;
- skb_put_data(skb2, skb->data + index,
+ skb_put_data(skb2, ntb_ptr + index,
dg_len - crc_len);
skb_queue_tail(list, skb2);
@@ -1340,10 +1345,17 @@ static int ncm_unwrap_ntb(struct gether
} while (ndp_len > 2 * (opts->dgram_item_len * 2));
} while (ndp_index);
- dev_consume_skb_any(skb);
-
VDBG(port->func.config->cdev,
"Parsed NTB with %d frames\n", dgram_counter);
+
+ to_process -= block_len;
+ if (to_process != 0) {
+ ntb_ptr = (unsigned char *)(ntb_ptr + block_len);
+ goto parse_ntb;
+ }
+
+ dev_consume_skb_any(skb);
+
return 0;
err:
skb_queue_purge(list);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 059/202] dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 058/202] usb: gadget: ncm: Handle decoding of multiple NTBs in unwrap call Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 060/202] powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Greg Kroah-Hartman
` (148 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Duoming Zhou, Eugen Hristev,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Duoming Zhou <duoming@zju.edu.cn>
[ Upstream commit 01f1ae2733e2bb4de92fefcea5fda847d92aede1 ]
The synchronize_irq(c->irq) will not return until the IRQ handler
mtk_uart_apdma_irq_handler() is completed. If the synchronize_irq()
holds a spin_lock and waits the IRQ handler to complete, but the
IRQ handler also needs the same spin_lock. The deadlock will happen.
The process is shown below:
cpu0 cpu1
mtk_uart_apdma_device_pause() | mtk_uart_apdma_irq_handler()
spin_lock_irqsave() |
| spin_lock_irqsave()
//hold the lock to wait |
synchronize_irq() |
This patch reorders the synchronize_irq(c->irq) outside the spin_lock
in order to mitigate the bug.
Fixes: 9135408c3ace ("dmaengine: mediatek: Add MediaTek UART APDMA support")
Signed-off-by: Duoming Zhou <duoming@zju.edu.cn>
Reviewed-by: Eugen Hristev <eugen.hristev@collabora.com>
Link: https://lore.kernel.org/r/20230806032511.45263-1-duoming@zju.edu.cn
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/dma/mediatek/mtk-uart-apdma.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/dma/mediatek/mtk-uart-apdma.c b/drivers/dma/mediatek/mtk-uart-apdma.c
index a1517ef1f4a01..0acf6a92a4ad3 100644
--- a/drivers/dma/mediatek/mtk-uart-apdma.c
+++ b/drivers/dma/mediatek/mtk-uart-apdma.c
@@ -451,9 +451,8 @@ static int mtk_uart_apdma_device_pause(struct dma_chan *chan)
mtk_uart_apdma_write(c, VFF_EN, VFF_EN_CLR_B);
mtk_uart_apdma_write(c, VFF_INT_EN, VFF_INT_EN_CLR_B);
- synchronize_irq(c->irq);
-
spin_unlock_irqrestore(&c->vc.lock, flags);
+ synchronize_irq(c->irq);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 060/202] powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 059/202] dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 061/202] powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Greg Kroah-Hartman
` (147 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Michael Ellerman,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 5d9cea8a552ee122e21fbd5a3c5d4eb85f648e06 ]
On 8xx, PAGE_NONE is handled by setting _PAGE_NA instead of clearing
_PAGE_USER.
But then pte_user() returns 1 also for PAGE_NONE.
As _PAGE_NA prevent reads, add a specific version of pte_read()
that returns 0 when _PAGE_NA is set instead of always returning 1.
Fixes: 351750331fc1 ("powerpc/mm: Introduce _PAGE_NA")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/57bcfbe578e43123f9ed73e040229b80f1ad56ec.1695659959.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 +++++++
arch/powerpc/include/asm/nohash/pgtable.h | 2 ++
2 files changed, 9 insertions(+)
diff --git a/arch/powerpc/include/asm/nohash/32/pte-8xx.h b/arch/powerpc/include/asm/nohash/32/pte-8xx.h
index 1581204467e1d..2b06da0ffd2d2 100644
--- a/arch/powerpc/include/asm/nohash/32/pte-8xx.h
+++ b/arch/powerpc/include/asm/nohash/32/pte-8xx.h
@@ -94,6 +94,13 @@ static inline pte_t pte_wrprotect(pte_t pte)
#define pte_wrprotect pte_wrprotect
+static inline int pte_read(pte_t pte)
+{
+ return (pte_val(pte) & _PAGE_RO) != _PAGE_NA;
+}
+
+#define pte_read pte_read
+
static inline int pte_write(pte_t pte)
{
return !(pte_val(pte) & _PAGE_RO);
diff --git a/arch/powerpc/include/asm/nohash/pgtable.h b/arch/powerpc/include/asm/nohash/pgtable.h
index ac75f4ab0dba1..7ad1d1b042a60 100644
--- a/arch/powerpc/include/asm/nohash/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/pgtable.h
@@ -45,7 +45,9 @@ static inline int pte_write(pte_t pte)
return pte_val(pte) & _PAGE_RW;
}
#endif
+#ifndef pte_read
static inline int pte_read(pte_t pte) { return 1; }
+#endif
static inline int pte_dirty(pte_t pte) { return pte_val(pte) & _PAGE_DIRTY; }
static inline int pte_special(pte_t pte) { return pte_val(pte) & _PAGE_SPECIAL; }
static inline int pte_none(pte_t pte) { return (pte_val(pte) & ~_PTE_NONE_MASK) == 0; }
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 061/202] powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 060/202] powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 062/202] x86/alternatives: Disable KASAN in apply_alternatives() Greg Kroah-Hartman
` (146 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Michael Ellerman,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 5ea0bbaa32e8f54e9a57cfee4a3b8769b80be0d2 ]
Commit 45201c879469 ("powerpc/nohash: Remove hash related code from
nohash headers.") replaced:
if ((pte_val(*ptep) & (_PAGE_ACCESSED | _PAGE_HASHPTE)) == 0)
return 0;
By:
if (pte_young(*ptep))
return 0;
But it should be:
if (!pte_young(*ptep))
return 0;
Fix it.
Fixes: 45201c879469 ("powerpc/nohash: Remove hash related code from nohash headers.")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/8bb7f06494e21adada724ede47a4c3d97e879d40.1695659959.git.christophe.leroy@csgroup.eu
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/include/asm/nohash/64/pgtable.h b/arch/powerpc/include/asm/nohash/64/pgtable.h
index a4d475c0fc2c0..6075fac882862 100644
--- a/arch/powerpc/include/asm/nohash/64/pgtable.h
+++ b/arch/powerpc/include/asm/nohash/64/pgtable.h
@@ -216,7 +216,7 @@ static inline int __ptep_test_and_clear_young(struct mm_struct *mm,
{
unsigned long old;
- if (pte_young(*ptep))
+ if (!pte_young(*ptep))
return 0;
old = pte_update(mm, addr, ptep, _PAGE_ACCESSED, 0, 0);
return (old & _PAGE_ACCESSED) != 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 062/202] x86/alternatives: Disable KASAN in apply_alternatives()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 061/202] powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 063/202] arm64: report EL1 UNDEFs better Greg Kroah-Hartman
` (145 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fei Yang, Kirill A. Shutemov,
Ingo Molnar, Peter Zijlstra (Intel), Linus Torvalds
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit d35652a5fc9944784f6f50a5c979518ff8dacf61 upstream.
Fei has reported that KASAN triggers during apply_alternatives() on
a 5-level paging machine:
BUG: KASAN: out-of-bounds in rcu_is_watching()
Read of size 4 at addr ff110003ee6419a0 by task swapper/0/0
...
__asan_load4()
rcu_is_watching()
trace_hardirqs_on()
text_poke_early()
apply_alternatives()
...
On machines with 5-level paging, cpu_feature_enabled(X86_FEATURE_LA57)
gets patched. It includes KASAN code, where KASAN_SHADOW_START depends on
__VIRTUAL_MASK_SHIFT, which is defined with cpu_feature_enabled().
KASAN gets confused when apply_alternatives() patches the
KASAN_SHADOW_START users. A test patch that makes KASAN_SHADOW_START
static, by replacing __VIRTUAL_MASK_SHIFT with 56, works around the issue.
Fix it for real by disabling KASAN while the kernel is patching alternatives.
[ mingo: updated the changelog ]
Fixes: 6657fca06e3f ("x86/mm: Allow to boot without LA57 if CONFIG_X86_5LEVEL=y")
Reported-by: Fei Yang <fei.yang@intel.com>
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20231012100424.1456-1-kirill.shutemov@linux.intel.com
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/alternative.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -424,6 +424,17 @@ void __init_or_module noinline apply_alt
u8 insn_buff[MAX_PATCH_LEN];
DPRINTK("alt table %px, -> %px", start, end);
+
+ /*
+ * In the case CONFIG_X86_5LEVEL=y, KASAN_SHADOW_START is defined using
+ * cpu_feature_enabled(X86_FEATURE_LA57) and is therefore patched here.
+ * During the process, KASAN becomes confused seeing partial LA57
+ * conversion and triggers a false-positive out-of-bound report.
+ *
+ * Disable KASAN until the patching is complete.
+ */
+ kasan_disable_current();
+
/*
* The scan order should be from start to end. A later scanned
* alternative code can overwrite previously scanned alternative code.
@@ -491,6 +502,8 @@ void __init_or_module noinline apply_alt
next:
optimize_nops(instr, a->instrlen);
}
+
+ kasan_enable_current();
}
#if defined(CONFIG_RETPOLINE) && defined(CONFIG_STACK_VALIDATION)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 063/202] arm64: report EL1 UNDEFs better
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 062/202] x86/alternatives: Disable KASAN in apply_alternatives() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 064/202] arm64: die(): pass err as long Greg Kroah-Hartman
` (144 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland, Mark Brown,
Alexandru Elisei, Amit Daniel Kachhap, James Morse, Will Deacon,
Anshuman Khandual, Catalin Marinas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit b502c87d2a26c349acbc231ff2acd6f17147926b upstream.
If an UNDEFINED exception is taken from EL1, and do_undefinstr() doesn't
find any suitable undef_hook, it will call:
BUG_ON(!user_mode(regs))
... and the kernel will report a failure witin do_undefinstr() rather
than reporting the original context that the UNDEFINED exception was
taken from. The pt_regs and ESR value reported within the BUG() handler
will be from within do_undefinstr() and the code dump will be for the
BRK in BUG_ON(), which isn't sufficient to debug the cause of the
original exception.
This patch makes the reporting better by having do_undefinstr() call
die() directly in this case to report the original context from which
the UNDEFINED exception was taken.
Prior to this patch, an undefined instruction is reported as:
| kernel BUG at arch/arm64/kernel/traps.c:497!
| Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 0 Comm: swapper Not tainted 5.19.0-rc3-00127-geff044f1b04e-dirty #3
| Hardware name: linux,dummy-virt (DT)
| pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : do_undefinstr+0x28c/0x2ac
| lr : do_undefinstr+0x298/0x2ac
| sp : ffff800009f63bc0
| x29: ffff800009f63bc0 x28: ffff800009f73c00 x27: ffff800009644a70
| x26: ffff8000096778a8 x25: 0000000000000040 x24: 0000000000000000
| x23: 00000000800000c5 x22: ffff800009894060 x21: ffff800009f63d90
| x20: 0000000000000000 x19: ffff800009f63c40 x18: 0000000000000006
| x17: 0000000000403000 x16: 00000000bfbfd000 x15: ffff800009f63830
| x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000019
| x11: 0101010101010101 x10: 0000000000161b98 x9 : 0000000000000000
| x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
| x5 : ffff800009f761d0 x4 : 0000000000000000 x3 : ffff80000a2b80f8
| x2 : 0000000000000000 x1 : ffff800009f73c00 x0 : 00000000800000c5
| Call trace:
| do_undefinstr+0x28c/0x2ac
| el1_undef+0x2c/0x4c
| el1h_64_sync_handler+0x84/0xd0
| el1h_64_sync+0x64/0x68
| setup_arch+0x550/0x598
| start_kernel+0x88/0x6ac
| __primary_switched+0xb8/0xc0
| Code: 17ffff95 a9425bf5 17ffffb8 a9025bf5 (d4210000)
With this patch applied, an undefined instruction is reported as:
| Internal error: Oops - Undefined instruction: 0 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 0 Comm: swapper Not tainted 5.19.0-rc3-00128-gf27cfcc80e52-dirty #5
| Hardware name: linux,dummy-virt (DT)
| pstate: 800000c5 (Nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : setup_arch+0x550/0x598
| lr : setup_arch+0x50c/0x598
| sp : ffff800009f63d90
| x29: ffff800009f63d90 x28: 0000000081000200 x27: ffff800009644a70
| x26: ffff8000096778c8 x25: 0000000000000040 x24: 0000000000000000
| x23: 0000000000000100 x22: ffff800009f69a58 x21: ffff80000a2b80b8
| x20: 0000000000000000 x19: 0000000000000000 x18: 0000000000000006
| x17: 0000000000403000 x16: 00000000bfbfd000 x15: ffff800009f63830
| x14: ffffffffffffffff x13: 0000000000000000 x12: 0000000000000019
| x11: 0101010101010101 x10: 0000000000161b98 x9 : 0000000000000000
| x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000
| x5 : 0000000000000008 x4 : 0000000000000010 x3 : 0000000000000000
| x2 : 0000000000000000 x1 : 0000000000000000 x0 : 0000000000000000
| Call trace:
| setup_arch+0x550/0x598
| start_kernel+0x88/0x6ac
| __primary_switched+0xb8/0xc0
| Code: b4000080 90ffed80 912ac000 97db745f (00000000)
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Link: https://lore.kernel.org/r/20220913101732.3925290-2-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/traps.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -404,7 +404,9 @@ void do_undefinstr(struct pt_regs *regs)
if (call_undef_hook(regs) == 0)
return;
- BUG_ON(!user_mode(regs));
+ if (!user_mode(regs))
+ die("Oops - Undefined instruction", regs, 0);
+
force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
}
NOKPROBE_SYMBOL(do_undefinstr);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 064/202] arm64: die(): pass err as long
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 063/202] arm64: report EL1 UNDEFs better Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 065/202] arm64: consistently pass ESR_ELx to die() Greg Kroah-Hartman
` (143 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland, Mark Brown,
Anshuman Khandual, Alexandru Elisei, Amit Daniel Kachhap,
James Morse, Will Deacon, Catalin Marinas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 18906ff9af6517c20763ed63dab602a4150794f7 upstream.
Recently, we reworked a lot of code to consistentlt pass ESR_ELx as a
64-bit quantity. However, we missed that this can be passed into die()
and __die() as the 'err' parameter where it is truncated to a 32-bit
int.
As notify_die() already takes 'err' as a long, this patch changes die()
and __die() to also take 'err' as a long, ensuring that the full value
of ESR_ELx is retained.
At the same time, die() is updated to consistently log 'err' as a
zero-padded 64-bit quantity.
Subsequent patches will pass the ESR_ELx value to die() for a number of
exceptions.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-3-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/system_misc.h | 2 +-
arch/arm64/kernel/traps.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/arch/arm64/include/asm/system_misc.h
+++ b/arch/arm64/include/asm/system_misc.h
@@ -18,7 +18,7 @@
struct pt_regs;
-void die(const char *msg, struct pt_regs *regs, int err);
+void die(const char *msg, struct pt_regs *regs, long err);
struct siginfo;
void arm64_notify_die(const char *str, struct pt_regs *regs,
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -90,12 +90,12 @@ static void dump_kernel_instr(const char
#define S_SMP " SMP"
-static int __die(const char *str, int err, struct pt_regs *regs)
+static int __die(const char *str, long err, struct pt_regs *regs)
{
static int die_counter;
int ret;
- pr_emerg("Internal error: %s: %x [#%d]" S_PREEMPT S_SMP "\n",
+ pr_emerg("Internal error: %s: %016lx [#%d]" S_PREEMPT S_SMP "\n",
str, err, ++die_counter);
/* trap and error numbers are mostly meaningless on ARM */
@@ -116,7 +116,7 @@ static DEFINE_RAW_SPINLOCK(die_lock);
/*
* This function is protected against re-entrancy.
*/
-void die(const char *str, struct pt_regs *regs, int err)
+void die(const char *str, struct pt_regs *regs, long err)
{
int ret;
unsigned long flags;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 065/202] arm64: consistently pass ESR_ELx to die()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 064/202] arm64: die(): pass err as long Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 066/202] arm64: rework FPAC exception handling Greg Kroah-Hartman
` (142 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland, Mark Brown,
Alexandru Elisei, Amit Daniel Kachhap, James Morse, Will Deacon,
Anshuman Khandual, Catalin Marinas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 0f2cb928a1547ae8f89e80a4b8df2c6c02ae5f96 upstream.
Currently, bug_handler() and kasan_handler() call die() with '0' as the
'err' value, whereas die_kernel_fault() passes the ESR_ELx value.
For consistency, this patch ensures we always pass the ESR_ELx value to
die(). As this is only called for exceptions taken from kernel mode,
there should be no user-visible change as a result of this patch.
For UNDEFINED exceptions, I've had to modify do_undefinstr() and its
callers to pass the ESR_ELx value. In all cases the ESR_ELx value had
already been read and was available.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Mark Brown <broonie@kernel.org>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-4-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/exception.h | 2 +-
arch/arm64/kernel/entry-common.c | 14 +++++++-------
arch/arm64/kernel/traps.c | 14 +++++++-------
3 files changed, 15 insertions(+), 15 deletions(-)
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -33,7 +33,7 @@ asmlinkage void exit_to_user_mode(void);
void arm64_enter_nmi(struct pt_regs *regs);
void arm64_exit_nmi(struct pt_regs *regs);
void do_mem_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-void do_undefinstr(struct pt_regs *regs);
+void do_undefinstr(struct pt_regs *regs, unsigned long esr);
void do_bti(struct pt_regs *regs);
asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr);
void do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr,
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -132,11 +132,11 @@ static void noinstr el1_pc(struct pt_reg
exit_to_kernel_mode(regs);
}
-static void noinstr el1_undef(struct pt_regs *regs)
+static void noinstr el1_undef(struct pt_regs *regs, unsigned long esr)
{
enter_from_kernel_mode(regs);
local_daif_inherit(regs);
- do_undefinstr(regs);
+ do_undefinstr(regs, esr);
local_daif_mask();
exit_to_kernel_mode(regs);
}
@@ -210,7 +210,7 @@ asmlinkage void noinstr el1_sync_handler
break;
case ESR_ELx_EC_SYS64:
case ESR_ELx_EC_UNKNOWN:
- el1_undef(regs);
+ el1_undef(regs, esr);
break;
case ESR_ELx_EC_BREAKPT_CUR:
case ESR_ELx_EC_SOFTSTP_CUR:
@@ -316,11 +316,11 @@ static void noinstr el0_sp(struct pt_reg
do_sp_pc_abort(regs->sp, esr, regs);
}
-static void noinstr el0_undef(struct pt_regs *regs)
+static void noinstr el0_undef(struct pt_regs *regs, unsigned long esr)
{
enter_from_user_mode();
local_daif_restore(DAIF_PROCCTX);
- do_undefinstr(regs);
+ do_undefinstr(regs, esr);
}
static void noinstr el0_bti(struct pt_regs *regs)
@@ -394,7 +394,7 @@ asmlinkage void noinstr el0_sync_handler
el0_pc(regs, esr);
break;
case ESR_ELx_EC_UNKNOWN:
- el0_undef(regs);
+ el0_undef(regs, esr);
break;
case ESR_ELx_EC_BTI:
el0_bti(regs);
@@ -454,7 +454,7 @@ asmlinkage void noinstr el0_sync_compat_
case ESR_ELx_EC_CP14_MR:
case ESR_ELx_EC_CP14_LS:
case ESR_ELx_EC_CP14_64:
- el0_undef(regs);
+ el0_undef(regs, esr);
break;
case ESR_ELx_EC_CP15_32:
case ESR_ELx_EC_CP15_64:
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -395,7 +395,7 @@ void arm64_notify_segfault(unsigned long
force_signal_inject(SIGSEGV, code, addr, 0);
}
-void do_undefinstr(struct pt_regs *regs)
+void do_undefinstr(struct pt_regs *regs, unsigned long esr)
{
/* check for AArch32 breakpoint instructions */
if (!aarch32_break_handler(regs))
@@ -405,7 +405,7 @@ void do_undefinstr(struct pt_regs *regs)
return;
if (!user_mode(regs))
- die("Oops - Undefined instruction", regs, 0);
+ die("Oops - Undefined instruction", regs, esr);
force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
}
@@ -663,7 +663,7 @@ void do_cp15instr(unsigned int esr, stru
hook_base = cp15_64_hooks;
break;
default:
- do_undefinstr(regs);
+ do_undefinstr(regs, esr);
return;
}
@@ -678,7 +678,7 @@ void do_cp15instr(unsigned int esr, stru
* EL0. Fall back to our usual undefined instruction handler
* so that we handle these consistently.
*/
- do_undefinstr(regs);
+ do_undefinstr(regs, esr);
}
NOKPROBE_SYMBOL(do_cp15instr);
#endif
@@ -698,7 +698,7 @@ void do_sysinstr(unsigned int esr, struc
* back to our usual undefined instruction handler so that we handle
* these consistently.
*/
- do_undefinstr(regs);
+ do_undefinstr(regs, esr);
}
NOKPROBE_SYMBOL(do_sysinstr);
@@ -901,7 +901,7 @@ static int bug_handler(struct pt_regs *r
{
switch (report_bug(regs->pc, regs)) {
case BUG_TRAP_TYPE_BUG:
- die("Oops - BUG", regs, 0);
+ die("Oops - BUG", regs, esr);
break;
case BUG_TRAP_TYPE_WARN:
@@ -969,7 +969,7 @@ static int kasan_handler(struct pt_regs
* This is something that might be fixed at some point in the future.
*/
if (!recover)
- die("Oops - KASAN", regs, 0);
+ die("Oops - KASAN", regs, esr);
/* If thread survives, skip over the brk instruction and continue: */
arm64_skip_faulting_instruction(regs, AARCH64_INSN_SIZE);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 066/202] arm64: rework FPAC exception handling
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 065/202] arm64: consistently pass ESR_ELx to die() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 067/202] arm64: rework BTI " Greg Kroah-Hartman
` (141 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland, Mark Brown,
Anshuman Khandual, Alexandru Elisei, Amit Daniel Kachhap,
James Morse, Will Deacon, Catalin Marinas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit a1fafa3b24a70461bbf3e5c0770893feb0a49292 upstream.
If an FPAC exception is taken from EL1, the entry code will call
do_ptrauth_fault(), where due to:
BUG_ON(!user_mode(regs))
... the kernel will report a problem within do_ptrauth_fault() rather
than reporting the original context the FPAC exception was taken from.
The pt_regs and ESR value reported will be from within
do_ptrauth_fault() and the code dump will be for the BRK in BUG_ON(),
which isn't sufficient to debug the cause of the original exception.
This patch makes the reporting better by having separate EL0 and EL1
FPAC exception handlers, with the latter calling die() directly to
report the original context the FPAC exception was taken from.
Note that we only need to prevent kprobes of the EL1 FPAC handler, since
the EL0 FPAC handler cannot be called recursively.
For consistency with do_el0_svc*(), I've named the split functions
do_el{0,1}_fpac() rather than do_el{0,1}_ptrauth_fault(). I've also
clarified the comment to not imply there are casues other than FPAC
exceptions.
Prior to this patch FPAC exceptions are reported as:
| kernel BUG at arch/arm64/kernel/traps.c:517!
| Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00130-g9c8a180a1cdf-dirty #12
| Hardware name: FVP Base RevC (DT)
| pstate: 00400009 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : do_ptrauth_fault+0x3c/0x40
| lr : el1_fpac+0x34/0x54
| sp : ffff80000a3bbc80
| x29: ffff80000a3bbc80 x28: ffff0008001d8000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: 0000000020400009 x22: ffff800008f70fa4 x21: ffff80000a3bbe00
| x20: 0000000072000000 x19: ffff80000a3bbcb0 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000081a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000080000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000783
| x5 : ffff80000a3bbcb0 x4 : ffff0008001d8000 x3 : 0000000072000000
| x2 : 0000000000000000 x1 : 0000000020400009 x0 : ffff80000a3bbcb0
| Call trace:
| do_ptrauth_fault+0x3c/0x40
| el1h_64_sync_handler+0xc4/0xd0
| el1h_64_sync+0x64/0x68
| test_pac+0x8/0x10
| smp_init+0x7c/0x8c
| kernel_init_freeable+0x128/0x28c
| kernel_init+0x28/0x13c
| ret_from_fork+0x10/0x20
| Code: 97fffe5e a8c17bfd d50323bf d65f03c0 (d4210000)
With this patch applied FPAC exceptions are reported as:
| Internal error: Oops - FPAC: 0000000072000000 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00132-g78846e1c4757-dirty #11
| Hardware name: FVP Base RevC (DT)
| pstate: 20400009 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
| pc : test_pac+0x8/0x10
| lr : 0x0
| sp : ffff80000a3bbe00
| x29: ffff80000a3bbe00 x28: 0000000000000000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: ffff80000a2c8000 x22: 0000000000000000 x21: 0000000000000000
| x20: ffff8000099fa5b0 x19: ffff80000a007000 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000081a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000080000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000783
| x5 : ffff80000a2c6000 x4 : ffff0008001d8000 x3 : ffff800009f88378
| x2 : 0000000000000000 x1 : 0000000080210000 x0 : ffff000001a90000
| Call trace:
| test_pac+0x8/0x10
| smp_init+0x7c/0x8c
| kernel_init_freeable+0x128/0x28c
| kernel_init+0x28/0x13c
| ret_from_fork+0x10/0x20
| Code: d50323bf d65f03c0 d503233f aa1f03fe (d50323bf)
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-5-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/exception.h | 3 ++-
arch/arm64/kernel/entry-common.c | 4 ++--
arch/arm64/kernel/traps.c | 16 ++++++++++------
3 files changed, 14 insertions(+), 9 deletions(-)
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -47,5 +47,6 @@ void bad_el0_sync(struct pt_regs *regs,
void do_cp15instr(unsigned int esr, struct pt_regs *regs);
void do_el0_svc(struct pt_regs *regs);
void do_el0_svc_compat(struct pt_regs *regs);
-void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr);
+void do_el0_fpac(struct pt_regs *regs, unsigned long esr);
+void do_el1_fpac(struct pt_regs *regs, unsigned long esr);
#endif /* __ASM_EXCEPTION_H */
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -187,7 +187,7 @@ static void noinstr el1_fpac(struct pt_r
{
enter_from_kernel_mode(regs);
local_daif_inherit(regs);
- do_ptrauth_fault(regs, esr);
+ do_el1_fpac(regs, esr);
local_daif_mask();
exit_to_kernel_mode(regs);
}
@@ -357,7 +357,7 @@ static void noinstr el0_fpac(struct pt_r
{
enter_from_user_mode();
local_daif_restore(DAIF_PROCCTX);
- do_ptrauth_fault(regs, esr);
+ do_el0_fpac(regs, esr);
}
asmlinkage void noinstr el0_sync_handler(struct pt_regs *regs)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -418,16 +418,20 @@ void do_bti(struct pt_regs *regs)
}
NOKPROBE_SYMBOL(do_bti);
-void do_ptrauth_fault(struct pt_regs *regs, unsigned int esr)
+void do_el0_fpac(struct pt_regs *regs, unsigned long esr)
+{
+ force_signal_inject(SIGILL, ILL_ILLOPN, regs->pc, esr);
+}
+
+void do_el1_fpac(struct pt_regs *regs, unsigned long esr)
{
/*
- * Unexpected FPAC exception or pointer authentication failure in
- * the kernel: kill the task before it does any more harm.
+ * Unexpected FPAC exception in the kernel: kill the task before it
+ * does any more harm.
*/
- BUG_ON(!user_mode(regs));
- force_signal_inject(SIGILL, ILL_ILLOPN, regs->pc, esr);
+ die("Oops - FPAC", regs, esr);
}
-NOKPROBE_SYMBOL(do_ptrauth_fault);
+NOKPROBE_SYMBOL(do_el1_fpac);
#define __user_cache_maint(insn, address, res) \
if (address >= user_addr_max()) { \
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 067/202] arm64: rework BTI exception handling
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 066/202] arm64: rework FPAC exception handling Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 068/202] arm64: allow kprobes on EL0 handlers Greg Kroah-Hartman
` (140 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland, Mark Brown,
Anshuman Khandual, Alexandru Elisei, Amit Daniel Kachhap,
James Morse, Will Deacon, Catalin Marinas
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 830a2a4d853f2c4a1e4606aa03341b7f273b0e9b upstream.
If a BTI exception is taken from EL1, the entry code will treat this as
an unhandled exception and will panic() the kernel. This is inconsistent
with the way we handle FPAC exceptions, which have a dedicated handler
and only necessarily kill the thread from which the exception was taken
from, and we don't log all the information that could be relevant to
debug the issue.
The code in do_bti() has:
BUG_ON(!user_mode(regs));
... and it seems like the intent was to call this for EL1 BTI
exceptions, as with FPAC, but this was omitted due to an oversight.
This patch adds separate EL0 and EL1 BTI exception handlers, with the
latter calling die() directly to report the original context the BTI
exception was taken from. This matches our handling of FPAC exceptions.
Prior to this patch, a BTI failure is reported as:
| Unhandled 64-bit el1h sync exception on CPU0, ESR 0x0000000034000002 -- BTI
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00131-g7d937ff0221d-dirty #9
| Hardware name: linux,dummy-virt (DT)
| pstate: 20400809 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c)
| pc : test_bti_callee+0x4/0x10
| lr : test_bti_caller+0x1c/0x28
| sp : ffff80000800bdf0
| x29: ffff80000800bdf0 x28: 0000000000000000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: ffff80000a2b8000 x22: 0000000000000000 x21: 0000000000000000
| x20: ffff8000099fa5b0 x19: ffff800009ff7000 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000041a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000040000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000f83
| x5 : ffff80000a2b6000 x4 : ffff0000028d0000 x3 : ffff800009f78378
| x2 : 0000000000000000 x1 : 0000000040210000 x0 : ffff8000080257e4
| Kernel panic - not syncing: Unhandled exception
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00131-g7d937ff0221d-dirty #9
| Hardware name: linux,dummy-virt (DT)
| Call trace:
| dump_backtrace.part.0+0xcc/0xe0
| show_stack+0x18/0x5c
| dump_stack_lvl+0x64/0x80
| dump_stack+0x18/0x34
| panic+0x170/0x360
| arm64_exit_nmi.isra.0+0x0/0x80
| el1h_64_sync_handler+0x64/0xd0
| el1h_64_sync+0x64/0x68
| test_bti_callee+0x4/0x10
| smp_cpus_done+0xb0/0xbc
| smp_init+0x7c/0x8c
| kernel_init_freeable+0x128/0x28c
| kernel_init+0x28/0x13c
| ret_from_fork+0x10/0x20
With this patch applied, a BTI failure is reported as:
| Internal error: Oops - BTI: 0000000034000002 [#1] PREEMPT SMP
| Modules linked in:
| CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-rc3-00132-g0ad98265d582-dirty #8
| Hardware name: linux,dummy-virt (DT)
| pstate: 20400809 (nzCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=-c)
| pc : test_bti_callee+0x4/0x10
| lr : test_bti_caller+0x1c/0x28
| sp : ffff80000800bdf0
| x29: ffff80000800bdf0 x28: 0000000000000000 x27: 0000000000000000
| x26: 0000000000000000 x25: 0000000000000000 x24: 0000000000000000
| x23: ffff80000a2b8000 x22: 0000000000000000 x21: 0000000000000000
| x20: ffff8000099fa5b0 x19: ffff800009ff7000 x18: fffffbfffda37000
| x17: 3120676e696d7573 x16: 7361202c6e6f6974 x15: 0000000041a90000
| x14: 0040000000000041 x13: 0040000000000001 x12: ffff000001a90000
| x11: fffffbfffda37480 x10: 0068000000000703 x9 : 0001000040000000
| x8 : 0000000000090000 x7 : 0068000000000f03 x6 : 0060000000000f83
| x5 : ffff80000a2b6000 x4 : ffff0000028d0000 x3 : ffff800009f78378
| x2 : 0000000000000000 x1 : 0000000040210000 x0 : ffff800008025804
| Call trace:
| test_bti_callee+0x4/0x10
| smp_cpus_done+0xb0/0xbc
| smp_init+0x7c/0x8c
| kernel_init_freeable+0x128/0x28c
| kernel_init+0x28/0x13c
| ret_from_fork+0x10/0x20
| Code: d50323bf d53cd040 d65f03c0 d503233f (d50323bf)
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Mark Brown <broonie@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Alexandru Elisei <alexandru.elisei@arm.com>
Cc: Amit Daniel Kachhap <amit.kachhap@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20220913101732.3925290-6-mark.rutland@arm.com
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/exception.h | 3 ++-
arch/arm64/kernel/entry-common.c | 14 +++++++++++++-
arch/arm64/kernel/traps.c | 10 +++++++---
3 files changed, 22 insertions(+), 5 deletions(-)
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -34,7 +34,8 @@ void arm64_enter_nmi(struct pt_regs *reg
void arm64_exit_nmi(struct pt_regs *regs);
void do_mem_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
void do_undefinstr(struct pt_regs *regs, unsigned long esr);
-void do_bti(struct pt_regs *regs);
+void do_el0_bti(struct pt_regs *regs);
+void do_el1_bti(struct pt_regs *regs, unsigned long esr);
asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr);
void do_debug_exception(unsigned long addr_if_watchpoint, unsigned int esr,
struct pt_regs *regs);
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -141,6 +141,15 @@ static void noinstr el1_undef(struct pt_
exit_to_kernel_mode(regs);
}
+static void noinstr el1_bti(struct pt_regs *regs, unsigned long esr)
+{
+ enter_from_kernel_mode(regs);
+ local_daif_inherit(regs);
+ do_el1_bti(regs, esr);
+ local_daif_mask();
+ exit_to_kernel_mode(regs);
+}
+
static void noinstr el1_inv(struct pt_regs *regs, unsigned long esr)
{
enter_from_kernel_mode(regs);
@@ -212,6 +221,9 @@ asmlinkage void noinstr el1_sync_handler
case ESR_ELx_EC_UNKNOWN:
el1_undef(regs, esr);
break;
+ case ESR_ELx_EC_BTI:
+ el1_bti(regs, esr);
+ break;
case ESR_ELx_EC_BREAKPT_CUR:
case ESR_ELx_EC_SOFTSTP_CUR:
case ESR_ELx_EC_WATCHPT_CUR:
@@ -327,7 +339,7 @@ static void noinstr el0_bti(struct pt_re
{
enter_from_user_mode();
local_daif_restore(DAIF_PROCCTX);
- do_bti(regs);
+ do_el0_bti(regs);
}
static void noinstr el0_inv(struct pt_regs *regs, unsigned long esr)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -411,12 +411,16 @@ void do_undefinstr(struct pt_regs *regs,
}
NOKPROBE_SYMBOL(do_undefinstr);
-void do_bti(struct pt_regs *regs)
+void do_el0_bti(struct pt_regs *regs)
{
- BUG_ON(!user_mode(regs));
force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
}
-NOKPROBE_SYMBOL(do_bti);
+
+void do_el1_bti(struct pt_regs *regs, unsigned long esr)
+{
+ die("Oops - BTI", regs, esr);
+}
+NOKPROBE_SYMBOL(do_el1_bti);
void do_el0_fpac(struct pt_regs *regs, unsigned long esr)
{
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 068/202] arm64: allow kprobes on EL0 handlers
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 067/202] arm64: rework BTI " Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 069/202] arm64: split EL0/EL1 UNDEF handlers Greg Kroah-Hartman
` (139 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit b3a0c010e900a9f89dcd99f10bd8f7538d21b0a9 upstream.
Currently do_sysinstr() and do_cp15instr() are marked with
NOKPROBE_SYMBOL(). However, these are only called for exceptions taken
from EL0, and there is no risk of recursion in kprobes, so this is not
necessary.
Remove the NOKPROBE_SYMBOL() annotation, and rename the two functions to
more clearly indicate that these are solely for exceptions taken from
EL0, better matching the names used by the lower level entry points in
entry-common.c.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-2-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/exception.h | 4 ++--
arch/arm64/kernel/entry-common.c | 4 ++--
arch/arm64/kernel/traps.c | 6 ++----
3 files changed, 6 insertions(+), 8 deletions(-)
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -42,10 +42,10 @@ void do_debug_exception(unsigned long ad
void do_fpsimd_acc(unsigned int esr, struct pt_regs *regs);
void do_sve_acc(unsigned int esr, struct pt_regs *regs);
void do_fpsimd_exc(unsigned int esr, struct pt_regs *regs);
-void do_sysinstr(unsigned int esr, struct pt_regs *regs);
+void do_el0_sys(unsigned long esr, struct pt_regs *regs);
void do_sp_pc_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
void bad_el0_sync(struct pt_regs *regs, int reason, unsigned int esr);
-void do_cp15instr(unsigned int esr, struct pt_regs *regs);
+void do_el0_cp15(unsigned long esr, struct pt_regs *regs);
void do_el0_svc(struct pt_regs *regs);
void do_el0_svc_compat(struct pt_regs *regs);
void do_el0_fpac(struct pt_regs *regs, unsigned long esr);
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -306,7 +306,7 @@ static void noinstr el0_sys(struct pt_re
{
enter_from_user_mode();
local_daif_restore(DAIF_PROCCTX);
- do_sysinstr(esr, regs);
+ do_el0_sys(esr, regs);
}
static void noinstr el0_pc(struct pt_regs *regs, unsigned long esr)
@@ -430,7 +430,7 @@ static void noinstr el0_cp15(struct pt_r
{
enter_from_user_mode();
local_daif_restore(DAIF_PROCCTX);
- do_cp15instr(esr, regs);
+ do_el0_cp15(esr, regs);
}
static void noinstr el0_svc_compat(struct pt_regs *regs)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -650,7 +650,7 @@ static const struct sys64_hook cp15_64_h
{},
};
-void do_cp15instr(unsigned int esr, struct pt_regs *regs)
+void do_el0_cp15(unsigned long esr, struct pt_regs *regs)
{
const struct sys64_hook *hook, *hook_base;
@@ -688,10 +688,9 @@ void do_cp15instr(unsigned int esr, stru
*/
do_undefinstr(regs, esr);
}
-NOKPROBE_SYMBOL(do_cp15instr);
#endif
-void do_sysinstr(unsigned int esr, struct pt_regs *regs)
+void do_el0_sys(unsigned long esr, struct pt_regs *regs)
{
const struct sys64_hook *hook;
@@ -708,7 +707,6 @@ void do_sysinstr(unsigned int esr, struc
*/
do_undefinstr(regs, esr);
}
-NOKPROBE_SYMBOL(do_sysinstr);
static const char *esr_class_str[] = {
[0 ... ESR_ELx_EC_MAX] = "UNRECOGNIZED EC",
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 069/202] arm64: split EL0/EL1 UNDEF handlers
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 068/202] arm64: allow kprobes on EL0 handlers Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 070/202] arm64: factor out EL1 SSBS emulation hook Greg Kroah-Hartman
` (138 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 61d64a376ea80f9097e7ea599bcd68671b836dc6 upstream.
In general, exceptions taken from EL1 need to be handled separately from
exceptions taken from EL0, as the logic to handle the two cases can be
significantly divergent, and exceptions taken from EL1 typically have
more stringent requirements on locking and instrumentation.
Subsequent patches will rework the way EL1 UNDEFs are handled in order
to address longstanding soundness issues with instrumentation and RCU.
In preparation for that rework, this patch splits the existing
do_undefinstr() handler into separate do_el0_undef() and do_el1_undef()
handlers.
Prior to this patch, do_undefinstr() was marked with NOKPROBE_SYMBOL(),
preventing instrumentation via kprobes. However, do_undefinstr() invokes
other code which can be instrumented, and:
* For UNDEFINED exceptions taken from EL0, there is no risk of recursion
within kprobes. Therefore it is safe for do_el0_undef to be
instrumented with kprobes, and it does not need to be marked with
NOKPROBE_SYMBOL().
* For UNDEFINED exceptions taken from EL1, either:
(a) The exception is has been taken when manipulating SSBS; these cases
are limited and do not occur within code that can be invoked
recursively via kprobes. Hence, in these cases instrumentation
with kprobes is benign.
(b) The exception has been taken for an unknown reason, as other than
manipulating SSBS we do not expect to take UNDEFINED exceptions
from EL1. Any handling of these exception is best-effort.
... and in either case, marking do_el1_undef() with NOKPROBE_SYMBOL()
isn't sufficient to prevent recursion via kprobes as functions it
calls (including die()) are instrumentable via kprobes.
Hence, it's not worthwhile to mark do_el1_undef() with
NOKPROBE_SYMBOL(). The same applies to do_el1_bti() and do_el1_fpac(),
so their NOKPROBE_SYMBOL() annotations are also removed.
Aside from the new instrumentability, there should be no functional
change as a result of this patch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-3-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/exception.h | 3 ++-
arch/arm64/kernel/entry-common.c | 4 ++--
arch/arm64/kernel/traps.c | 22 ++++++++++++----------
3 files changed, 16 insertions(+), 13 deletions(-)
--- a/arch/arm64/include/asm/exception.h
+++ b/arch/arm64/include/asm/exception.h
@@ -33,7 +33,8 @@ asmlinkage void exit_to_user_mode(void);
void arm64_enter_nmi(struct pt_regs *regs);
void arm64_exit_nmi(struct pt_regs *regs);
void do_mem_abort(unsigned long addr, unsigned int esr, struct pt_regs *regs);
-void do_undefinstr(struct pt_regs *regs, unsigned long esr);
+void do_el0_undef(struct pt_regs *regs, unsigned long esr);
+void do_el1_undef(struct pt_regs *regs, unsigned long esr);
void do_el0_bti(struct pt_regs *regs);
void do_el1_bti(struct pt_regs *regs, unsigned long esr);
asmlinkage void bad_mode(struct pt_regs *regs, int reason, unsigned int esr);
--- a/arch/arm64/kernel/entry-common.c
+++ b/arch/arm64/kernel/entry-common.c
@@ -136,7 +136,7 @@ static void noinstr el1_undef(struct pt_
{
enter_from_kernel_mode(regs);
local_daif_inherit(regs);
- do_undefinstr(regs, esr);
+ do_el1_undef(regs, esr);
local_daif_mask();
exit_to_kernel_mode(regs);
}
@@ -332,7 +332,7 @@ static void noinstr el0_undef(struct pt_
{
enter_from_user_mode();
local_daif_restore(DAIF_PROCCTX);
- do_undefinstr(regs, esr);
+ do_el0_undef(regs, esr);
}
static void noinstr el0_bti(struct pt_regs *regs)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -395,7 +395,7 @@ void arm64_notify_segfault(unsigned long
force_signal_inject(SIGSEGV, code, addr, 0);
}
-void do_undefinstr(struct pt_regs *regs, unsigned long esr)
+void do_el0_undef(struct pt_regs *regs, unsigned long esr)
{
/* check for AArch32 breakpoint instructions */
if (!aarch32_break_handler(regs))
@@ -404,12 +404,16 @@ void do_undefinstr(struct pt_regs *regs,
if (call_undef_hook(regs) == 0)
return;
- if (!user_mode(regs))
- die("Oops - Undefined instruction", regs, esr);
-
force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
}
-NOKPROBE_SYMBOL(do_undefinstr);
+
+void do_el1_undef(struct pt_regs *regs, unsigned long esr)
+{
+ if (call_undef_hook(regs) == 0)
+ return;
+
+ die("Oops - Undefined instruction", regs, esr);
+}
void do_el0_bti(struct pt_regs *regs)
{
@@ -420,7 +424,6 @@ void do_el1_bti(struct pt_regs *regs, un
{
die("Oops - BTI", regs, esr);
}
-NOKPROBE_SYMBOL(do_el1_bti);
void do_el0_fpac(struct pt_regs *regs, unsigned long esr)
{
@@ -435,7 +438,6 @@ void do_el1_fpac(struct pt_regs *regs, u
*/
die("Oops - FPAC", regs, esr);
}
-NOKPROBE_SYMBOL(do_el1_fpac);
#define __user_cache_maint(insn, address, res) \
if (address >= user_addr_max()) { \
@@ -671,7 +673,7 @@ void do_el0_cp15(unsigned long esr, stru
hook_base = cp15_64_hooks;
break;
default:
- do_undefinstr(regs, esr);
+ do_el0_undef(regs, esr);
return;
}
@@ -686,7 +688,7 @@ void do_el0_cp15(unsigned long esr, stru
* EL0. Fall back to our usual undefined instruction handler
* so that we handle these consistently.
*/
- do_undefinstr(regs, esr);
+ do_el0_undef(regs, esr);
}
#endif
@@ -705,7 +707,7 @@ void do_el0_sys(unsigned long esr, struc
* back to our usual undefined instruction handler so that we handle
* these consistently.
*/
- do_undefinstr(regs, esr);
+ do_el0_undef(regs, esr);
}
static const char *esr_class_str[] = {
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 070/202] arm64: factor out EL1 SSBS emulation hook
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 069/202] arm64: split EL0/EL1 UNDEF handlers Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 071/202] arm64: factor insn read out of call_undef_hook() Greg Kroah-Hartman
` (137 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit bff8f413c71ffc3cb679dbd9a5632b33af563f9f upstream.
Currently call_undef_hook() is used to handle UNDEFINED exceptions from
EL0 and EL1. As support for deprecated instructions may be enabled
independently, the handlers for individual instructions are organised as
a linked list of struct undef_hook which can be manipulated dynamically.
As this can be manipulated dynamically, the list is protected with a
raw_spinlock which must be acquired when handling UNDEFINED exceptions
or when manipulating the list of handlers.
This locking is unfortunate as it serialises handling of UNDEFINED
exceptions, and requires RCU to be enabled for lockdep, requiring the
use of RCU_NONIDLE() in resume path of cpu_suspend() since commit:
a2c42bbabbe260b7 ("arm64: spectre: Prevent lockdep splat on v4 mitigation enable path")
The list of UNDEFINED handlers largely consist of handlers for
exceptions taken from EL0, and the only handler for exceptions taken
from EL1 handles `MSR SSBS, #imm` on CPUs which feature PSTATE.SSBS but
lack the corresponding MSR (Immediate) instruction. Other than this we
never expect to take an UNDEFINED exception from EL1 in normal
operation.
This patch reworks do_el0_undef() to invoke the EL1 SSBS handler
directly, relegating call_undef_hook() to only handle EL0 UNDEFs. This
removes redundant work to iterate the list for EL1 UNDEFs, and removes
the need for locking, permitting EL1 UNDEFs to be handled in parallel
without contention.
The RCU_NONIDLE() call in cpu_suspend() will be removed in a subsequent
patch, as there are other potential issues with the use of
instrumentable code and RCU in the CPU suspend code.
I've tested this by forcing the detection of SSBS on a CPU that doesn't
have it, and verifying that the try_emulate_el1_ssbs() callback is
invoked.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-4-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/spectre.h | 2 ++
arch/arm64/kernel/proton-pack.c | 26 +++++++-------------------
arch/arm64/kernel/traps.c | 15 ++++++++-------
3 files changed, 17 insertions(+), 26 deletions(-)
--- a/arch/arm64/include/asm/spectre.h
+++ b/arch/arm64/include/asm/spectre.h
@@ -18,6 +18,7 @@ enum mitigation_state {
SPECTRE_VULNERABLE,
};
+struct pt_regs;
struct task_struct;
enum mitigation_state arm64_get_spectre_v2_state(void);
@@ -33,4 +34,5 @@ enum mitigation_state arm64_get_spectre_
bool is_spectre_bhb_affected(const struct arm64_cpu_capabilities *entry, int scope);
u8 spectre_bhb_loop_affected(int scope);
void spectre_bhb_enable_mitigation(const struct arm64_cpu_capabilities *__unused);
+bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr);
#endif /* __ASM_SPECTRE_H */
--- a/arch/arm64/kernel/proton-pack.c
+++ b/arch/arm64/kernel/proton-pack.c
@@ -537,10 +537,13 @@ bool has_spectre_v4(const struct arm64_c
return state != SPECTRE_UNAFFECTED;
}
-static int ssbs_emulation_handler(struct pt_regs *regs, u32 instr)
+bool try_emulate_el1_ssbs(struct pt_regs *regs, u32 instr)
{
- if (user_mode(regs))
- return 1;
+ const u32 instr_mask = ~(1U << PSTATE_Imm_shift);
+ const u32 instr_val = 0xd500401f | PSTATE_SSBS;
+
+ if ((instr & instr_mask) != instr_val)
+ return false;
if (instr & BIT(PSTATE_Imm_shift))
regs->pstate |= PSR_SSBS_BIT;
@@ -548,19 +551,11 @@ static int ssbs_emulation_handler(struct
regs->pstate &= ~PSR_SSBS_BIT;
arm64_skip_faulting_instruction(regs, 4);
- return 0;
+ return true;
}
-static struct undef_hook ssbs_emulation_hook = {
- .instr_mask = ~(1U << PSTATE_Imm_shift),
- .instr_val = 0xd500401f | PSTATE_SSBS,
- .fn = ssbs_emulation_handler,
-};
-
static enum mitigation_state spectre_v4_enable_hw_mitigation(void)
{
- static bool undef_hook_registered = false;
- static DEFINE_RAW_SPINLOCK(hook_lock);
enum mitigation_state state;
/*
@@ -571,13 +566,6 @@ static enum mitigation_state spectre_v4_
if (state != SPECTRE_MITIGATED || !this_cpu_has_cap(ARM64_SSBS))
return state;
- raw_spin_lock(&hook_lock);
- if (!undef_hook_registered) {
- register_undef_hook(&ssbs_emulation_hook);
- undef_hook_registered = true;
- }
- raw_spin_unlock(&hook_lock);
-
if (spectre_v4_mitigations_off()) {
sysreg_clear_set(sctlr_el1, 0, SCTLR_ELx_DSSBS);
asm volatile(SET_PSTATE_SSBS(1));
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -311,12 +311,7 @@ static int call_undef_hook(struct pt_reg
int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
void __user *pc = (void __user *)instruction_pointer(regs);
- if (!user_mode(regs)) {
- __le32 instr_le;
- if (get_kernel_nofault(instr_le, (__force __le32 *)pc))
- goto exit;
- instr = le32_to_cpu(instr_le);
- } else if (compat_thumb_mode(regs)) {
+ if (compat_thumb_mode(regs)) {
/* 16-bit Thumb instruction */
__le16 instr_le;
if (get_user(instr_le, (__le16 __user *)pc))
@@ -409,9 +404,15 @@ void do_el0_undef(struct pt_regs *regs,
void do_el1_undef(struct pt_regs *regs, unsigned long esr)
{
- if (call_undef_hook(regs) == 0)
+ u32 insn;
+
+ if (aarch64_insn_read((void *)regs->pc, &insn))
+ goto out_err;
+
+ if (try_emulate_el1_ssbs(regs, insn))
return;
+out_err:
die("Oops - Undefined instruction", regs, esr);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 071/202] arm64: factor insn read out of call_undef_hook()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 070/202] arm64: factor out EL1 SSBS emulation hook Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 072/202] arm64: rework EL0 MRS emulation Greg Kroah-Hartman
` (136 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit dbfbd87efa79575491af0ba1a87bf567eaea6cae upstream.
Subsequent patches will rework EL0 UNDEF handling, removing the need for
struct undef_hook and call_undef_hook. In preparation for those changes,
this patch factors the logic for reading user instructions out of
call_undef_hook() and into a new user_insn_read() helper, matching the
style of the existing aarch64_insn_read() helper used for reading kernel
instructions.
There should be no functional change as a result of this patch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-5-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/traps.c | 31 ++++++++++++++++++++++---------
1 file changed, 22 insertions(+), 9 deletions(-)
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -303,25 +303,22 @@ void unregister_undef_hook(struct undef_
raw_spin_unlock_irqrestore(&undef_lock, flags);
}
-static int call_undef_hook(struct pt_regs *regs)
+static int user_insn_read(struct pt_regs *regs, u32 *insnp)
{
- struct undef_hook *hook;
- unsigned long flags;
u32 instr;
- int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
void __user *pc = (void __user *)instruction_pointer(regs);
if (compat_thumb_mode(regs)) {
/* 16-bit Thumb instruction */
__le16 instr_le;
if (get_user(instr_le, (__le16 __user *)pc))
- goto exit;
+ return -EFAULT;
instr = le16_to_cpu(instr_le);
if (aarch32_insn_is_wide(instr)) {
u32 instr2;
if (get_user(instr_le, (__le16 __user *)(pc + 2)))
- goto exit;
+ return -EFAULT;
instr2 = le16_to_cpu(instr_le);
instr = (instr << 16) | instr2;
}
@@ -329,10 +326,20 @@ static int call_undef_hook(struct pt_reg
/* 32-bit ARM instruction */
__le32 instr_le;
if (get_user(instr_le, (__le32 __user *)pc))
- goto exit;
+ return -EFAULT;
instr = le32_to_cpu(instr_le);
}
+ *insnp = instr;
+ return 0;
+}
+
+static int call_undef_hook(struct pt_regs *regs, u32 instr)
+{
+ struct undef_hook *hook;
+ unsigned long flags;
+ int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
+
raw_spin_lock_irqsave(&undef_lock, flags);
list_for_each_entry(hook, &undef_hook, node)
if ((instr & hook->instr_mask) == hook->instr_val &&
@@ -340,7 +347,7 @@ static int call_undef_hook(struct pt_reg
fn = hook->fn;
raw_spin_unlock_irqrestore(&undef_lock, flags);
-exit:
+
return fn ? fn(regs, instr) : 1;
}
@@ -392,13 +399,19 @@ void arm64_notify_segfault(unsigned long
void do_el0_undef(struct pt_regs *regs, unsigned long esr)
{
+ u32 insn;
+
/* check for AArch32 breakpoint instructions */
if (!aarch32_break_handler(regs))
return;
- if (call_undef_hook(regs) == 0)
+ if (user_insn_read(regs, &insn))
+ goto out_err;
+
+ if (call_undef_hook(regs, insn) == 0)
return;
+out_err:
force_signal_inject(SIGILL, ILL_ILLOPC, regs->pc, 0);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 072/202] arm64: rework EL0 MRS emulation
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 071/202] arm64: factor insn read out of call_undef_hook() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 073/202] arm64: armv8_deprecated: fold ops into insn_emulation Greg Kroah-Hartman
` (135 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit f5962add74b61f8ae31c6311f75ca35d7e1d2d8f upstream.
On CPUs without FEAT_IDST, ID register emulation is slower than it needs
to be, as all threads contend for the same lock to perform the
emulation. This patch reworks the emulation to avoid this unnecessary
contention.
On CPUs with FEAT_IDST (which is mandatory from ARMv8.4 onwards), EL0
accesses to ID registers result in a SYS trap, and emulation of these is
handled with a sys64_hook. These hooks are statically allocated, and no
locking is required to iterate through the hooks and perform the
emulation, allowing emulation to occur in parallel with no contention.
On CPUs without FEAT_IDST, EL0 accesses to ID registers result in an
UNDEFINED exception, and emulation of these accesses is handled with an
undef_hook. When an EL0 MRS instruction is trapped to EL1, the kernel
finds the relevant handler by iterating through all of the undef_hooks,
requiring undef_lock to be held during this lookup.
This locking is only required to safely traverse the list of undef_hooks
(as it can be concurrently modified), and the actual emulation of the
MRS does not require any mutual exclusion. This locking is an
unfortunate bottleneck, especially given that MRS emulation is enabled
unconditionally and is never disabled.
This patch reworks the non-FEAT_IDST MRS emulation logic so that it can
be invoked directly from do_el0_undef(). This removes the bottleneck,
allowing MRS traps to be handled entirely in parallel, and is a stepping
stone to making all of the undef_hooks lock-free.
I've tested this in a 64-vCPU VM on a 64-CPU ThunderX2 host, with a
benchmark which spawns a number of threads which each try to read
ID_AA64ISAR0_EL1 1000000 times. This is vastly more contention than will
ever be seen in realistic usage, but clearly demonstrates the removal of
the bottleneck:
| Threads || Time (seconds) |
| || Before || After |
| || Real | System || Real | System |
|---------++--------+---------++--------+---------|
| 1 || 0.29 | 0.20 || 0.24 | 0.12 |
| 2 || 0.35 | 0.51 || 0.23 | 0.27 |
| 4 || 1.08 | 3.87 || 0.24 | 0.56 |
| 8 || 4.31 | 33.60 || 0.24 | 1.11 |
| 16 || 9.47 | 149.39 || 0.23 | 2.15 |
| 32 || 19.07 | 605.27 || 0.24 | 4.38 |
| 64 || 65.40 | 3609.09 || 0.33 | 11.27 |
Aside from the speedup, there should be no functional change as a result
of this patch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-6-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/cpufeature.h | 3 ++-
arch/arm64/kernel/cpufeature.c | 23 +++++------------------
arch/arm64/kernel/traps.c | 3 +++
3 files changed, 10 insertions(+), 19 deletions(-)
--- a/arch/arm64/include/asm/cpufeature.h
+++ b/arch/arm64/include/asm/cpufeature.h
@@ -759,7 +759,8 @@ static inline bool system_supports_tlb_r
cpus_have_const_cap(ARM64_HAS_TLB_RANGE);
}
-extern int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt);
+int do_emulate_mrs(struct pt_regs *regs, u32 sys_reg, u32 rt);
+bool try_emulate_mrs(struct pt_regs *regs, u32 isn);
static inline u32 id_aa64mmfr0_parange_to_phys_shift(int parange)
{
--- a/arch/arm64/kernel/cpufeature.c
+++ b/arch/arm64/kernel/cpufeature.c
@@ -2852,35 +2852,22 @@ int do_emulate_mrs(struct pt_regs *regs,
return rc;
}
-static int emulate_mrs(struct pt_regs *regs, u32 insn)
+bool try_emulate_mrs(struct pt_regs *regs, u32 insn)
{
u32 sys_reg, rt;
+ if (compat_user_mode(regs) || !aarch64_insn_is_mrs(insn))
+ return false;
+
/*
* sys_reg values are defined as used in mrs/msr instruction.
* shift the imm value to get the encoding.
*/
sys_reg = (u32)aarch64_insn_decode_immediate(AARCH64_INSN_IMM_16, insn) << 5;
rt = aarch64_insn_decode_register(AARCH64_INSN_REGTYPE_RT, insn);
- return do_emulate_mrs(regs, sys_reg, rt);
-}
-
-static struct undef_hook mrs_hook = {
- .instr_mask = 0xfff00000,
- .instr_val = 0xd5300000,
- .pstate_mask = PSR_AA32_MODE_MASK,
- .pstate_val = PSR_MODE_EL0t,
- .fn = emulate_mrs,
-};
-
-static int __init enable_mrs_emulation(void)
-{
- register_undef_hook(&mrs_hook);
- return 0;
+ return do_emulate_mrs(regs, sys_reg, rt) == 0;
}
-core_initcall(enable_mrs_emulation);
-
ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr,
char *buf)
{
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -408,6 +408,9 @@ void do_el0_undef(struct pt_regs *regs,
if (user_insn_read(regs, &insn))
goto out_err;
+ if (try_emulate_mrs(regs, insn))
+ return;
+
if (call_undef_hook(regs, insn) == 0)
return;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 073/202] arm64: armv8_deprecated: fold ops into insn_emulation
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 072/202] arm64: rework EL0 MRS emulation Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 074/202] arm64: armv8_deprecated move emulation functions Greg Kroah-Hartman
` (134 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit b4453cc8a7ebbd45436a8cd3ffeaa069ceac146f upstream.
The code for emulating deprecated instructions has two related
structures: struct insn_emulation_ops and struct insn_emulation, where
each struct insn_emulation_ops is associated 1-1 with a struct
insn_emulation.
It would be simpler to combine the two into a single structure, removing
the need for (unconditional) dynamic allocation at boot time, and
simplifying some runtime pointer chasing.
This patch merges the two structures together.
There should be no functional change as a result of this patch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-7-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/armv8_deprecated.c | 76 +++++++++++++++--------------------
1 file changed, 33 insertions(+), 43 deletions(-)
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -41,16 +41,12 @@ enum legacy_insn_status {
INSN_OBSOLETE,
};
-struct insn_emulation_ops {
- const char *name;
- enum legacy_insn_status status;
- struct undef_hook *hooks;
- int (*set_hw_mode)(bool enable);
-};
-
struct insn_emulation {
- struct list_head node;
- struct insn_emulation_ops *ops;
+ const char *name;
+ struct list_head node;
+ enum legacy_insn_status status;
+ struct undef_hook *hooks;
+ int (*set_hw_mode)(bool enable);
int current_mode;
int min;
int max;
@@ -61,48 +57,48 @@ static int nr_insn_emulated __initdata;
static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
static DEFINE_MUTEX(insn_emulation_mutex);
-static void register_emulation_hooks(struct insn_emulation_ops *ops)
+static void register_emulation_hooks(struct insn_emulation *insn)
{
struct undef_hook *hook;
- BUG_ON(!ops->hooks);
+ BUG_ON(!insn->hooks);
- for (hook = ops->hooks; hook->instr_mask; hook++)
+ for (hook = insn->hooks; hook->instr_mask; hook++)
register_undef_hook(hook);
- pr_notice("Registered %s emulation handler\n", ops->name);
+ pr_notice("Registered %s emulation handler\n", insn->name);
}
-static void remove_emulation_hooks(struct insn_emulation_ops *ops)
+static void remove_emulation_hooks(struct insn_emulation *insn)
{
struct undef_hook *hook;
- BUG_ON(!ops->hooks);
+ BUG_ON(!insn->hooks);
- for (hook = ops->hooks; hook->instr_mask; hook++)
+ for (hook = insn->hooks; hook->instr_mask; hook++)
unregister_undef_hook(hook);
- pr_notice("Removed %s emulation handler\n", ops->name);
+ pr_notice("Removed %s emulation handler\n", insn->name);
}
static void enable_insn_hw_mode(void *data)
{
struct insn_emulation *insn = (struct insn_emulation *)data;
- if (insn->ops->set_hw_mode)
- insn->ops->set_hw_mode(true);
+ if (insn->set_hw_mode)
+ insn->set_hw_mode(true);
}
static void disable_insn_hw_mode(void *data)
{
struct insn_emulation *insn = (struct insn_emulation *)data;
- if (insn->ops->set_hw_mode)
- insn->ops->set_hw_mode(false);
+ if (insn->set_hw_mode)
+ insn->set_hw_mode(false);
}
/* Run set_hw_mode(mode) on all active CPUs */
static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
{
- if (!insn->ops->set_hw_mode)
+ if (!insn->set_hw_mode)
return -EINVAL;
if (enable)
on_each_cpu(enable_insn_hw_mode, (void *)insn, true);
@@ -126,9 +122,9 @@ static int run_all_insn_set_hw_mode(unsi
raw_spin_lock_irqsave(&insn_emulation_lock, flags);
list_for_each_entry(insn, &insn_emulation, node) {
bool enable = (insn->current_mode == INSN_HW);
- if (insn->ops->set_hw_mode && insn->ops->set_hw_mode(enable)) {
+ if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
pr_warn("CPU[%u] cannot support the emulation of %s",
- cpu, insn->ops->name);
+ cpu, insn->name);
rc = -EINVAL;
}
}
@@ -145,11 +141,11 @@ static int update_insn_emulation_mode(st
case INSN_UNDEF: /* Nothing to be done */
break;
case INSN_EMULATE:
- remove_emulation_hooks(insn->ops);
+ remove_emulation_hooks(insn);
break;
case INSN_HW:
if (!run_all_cpu_set_hw_mode(insn, false))
- pr_notice("Disabled %s support\n", insn->ops->name);
+ pr_notice("Disabled %s support\n", insn->name);
break;
}
@@ -157,31 +153,25 @@ static int update_insn_emulation_mode(st
case INSN_UNDEF:
break;
case INSN_EMULATE:
- register_emulation_hooks(insn->ops);
+ register_emulation_hooks(insn);
break;
case INSN_HW:
ret = run_all_cpu_set_hw_mode(insn, true);
if (!ret)
- pr_notice("Enabled %s support\n", insn->ops->name);
+ pr_notice("Enabled %s support\n", insn->name);
break;
}
return ret;
}
-static void __init register_insn_emulation(struct insn_emulation_ops *ops)
+static void __init register_insn_emulation(struct insn_emulation *insn)
{
unsigned long flags;
- struct insn_emulation *insn;
-
- insn = kzalloc(sizeof(*insn), GFP_KERNEL);
- if (!insn)
- return;
- insn->ops = ops;
insn->min = INSN_UNDEF;
- switch (ops->status) {
+ switch (insn->status) {
case INSN_DEPRECATED:
insn->current_mode = INSN_EMULATE;
/* Disable the HW mode if it was turned on at early boot time */
@@ -247,7 +237,7 @@ static void __init register_insn_emulati
sysctl->mode = 0644;
sysctl->maxlen = sizeof(int);
- sysctl->procname = insn->ops->name;
+ sysctl->procname = insn->name;
sysctl->data = &insn->current_mode;
sysctl->extra1 = &insn->min;
sysctl->extra2 = &insn->max;
@@ -451,7 +441,7 @@ static struct undef_hook swp_hooks[] = {
{ }
};
-static struct insn_emulation_ops swp_ops = {
+static struct insn_emulation insn_swp = {
.name = "swp",
.status = INSN_OBSOLETE,
.hooks = swp_hooks,
@@ -538,7 +528,7 @@ static struct undef_hook cp15_barrier_ho
{ }
};
-static struct insn_emulation_ops cp15_barrier_ops = {
+static struct insn_emulation insn_cp15_barrier = {
.name = "cp15_barrier",
.status = INSN_DEPRECATED,
.hooks = cp15_barrier_hooks,
@@ -611,7 +601,7 @@ static struct undef_hook setend_hooks[]
{}
};
-static struct insn_emulation_ops setend_ops = {
+static struct insn_emulation insn_setend = {
.name = "setend",
.status = INSN_DEPRECATED,
.hooks = setend_hooks,
@@ -625,14 +615,14 @@ static struct insn_emulation_ops setend_
static int __init armv8_deprecated_init(void)
{
if (IS_ENABLED(CONFIG_SWP_EMULATION))
- register_insn_emulation(&swp_ops);
+ register_insn_emulation(&insn_swp);
if (IS_ENABLED(CONFIG_CP15_BARRIER_EMULATION))
- register_insn_emulation(&cp15_barrier_ops);
+ register_insn_emulation(&insn_cp15_barrier);
if (IS_ENABLED(CONFIG_SETEND_EMULATION)) {
if (system_supports_mixed_endian_el0())
- register_insn_emulation(&setend_ops);
+ register_insn_emulation(&insn_setend);
else
pr_info("setend instruction emulation is not supported on this system\n");
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 074/202] arm64: armv8_deprecated move emulation functions
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 073/202] arm64: armv8_deprecated: fold ops into insn_emulation Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 075/202] arm64: armv8_deprecated: move aarch32 helper earlier Greg Kroah-Hartman
` (133 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 25eeac0cfe7c97ade1be07340e11e7143aab57a6 upstream.
Subsequent patches will rework the logic in armv8_deprecated.c.
In preparation for subsequent changes, this patch moves the emulation
logic earlier in the file, and moves the infrastructure later in the
file. This will make subsequent diffs simpler and easier to read.
This is purely a move. There should be no functional change as a result
of this patch.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-8-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/armv8_deprecated.c | 394 +++++++++++++++++------------------
1 file changed, 197 insertions(+), 197 deletions(-)
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -52,203 +52,6 @@ struct insn_emulation {
int max;
};
-static LIST_HEAD(insn_emulation);
-static int nr_insn_emulated __initdata;
-static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
-static DEFINE_MUTEX(insn_emulation_mutex);
-
-static void register_emulation_hooks(struct insn_emulation *insn)
-{
- struct undef_hook *hook;
-
- BUG_ON(!insn->hooks);
-
- for (hook = insn->hooks; hook->instr_mask; hook++)
- register_undef_hook(hook);
-
- pr_notice("Registered %s emulation handler\n", insn->name);
-}
-
-static void remove_emulation_hooks(struct insn_emulation *insn)
-{
- struct undef_hook *hook;
-
- BUG_ON(!insn->hooks);
-
- for (hook = insn->hooks; hook->instr_mask; hook++)
- unregister_undef_hook(hook);
-
- pr_notice("Removed %s emulation handler\n", insn->name);
-}
-
-static void enable_insn_hw_mode(void *data)
-{
- struct insn_emulation *insn = (struct insn_emulation *)data;
- if (insn->set_hw_mode)
- insn->set_hw_mode(true);
-}
-
-static void disable_insn_hw_mode(void *data)
-{
- struct insn_emulation *insn = (struct insn_emulation *)data;
- if (insn->set_hw_mode)
- insn->set_hw_mode(false);
-}
-
-/* Run set_hw_mode(mode) on all active CPUs */
-static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
-{
- if (!insn->set_hw_mode)
- return -EINVAL;
- if (enable)
- on_each_cpu(enable_insn_hw_mode, (void *)insn, true);
- else
- on_each_cpu(disable_insn_hw_mode, (void *)insn, true);
- return 0;
-}
-
-/*
- * Run set_hw_mode for all insns on a starting CPU.
- * Returns:
- * 0 - If all the hooks ran successfully.
- * -EINVAL - At least one hook is not supported by the CPU.
- */
-static int run_all_insn_set_hw_mode(unsigned int cpu)
-{
- int rc = 0;
- unsigned long flags;
- struct insn_emulation *insn;
-
- raw_spin_lock_irqsave(&insn_emulation_lock, flags);
- list_for_each_entry(insn, &insn_emulation, node) {
- bool enable = (insn->current_mode == INSN_HW);
- if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
- pr_warn("CPU[%u] cannot support the emulation of %s",
- cpu, insn->name);
- rc = -EINVAL;
- }
- }
- raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
- return rc;
-}
-
-static int update_insn_emulation_mode(struct insn_emulation *insn,
- enum insn_emulation_mode prev)
-{
- int ret = 0;
-
- switch (prev) {
- case INSN_UNDEF: /* Nothing to be done */
- break;
- case INSN_EMULATE:
- remove_emulation_hooks(insn);
- break;
- case INSN_HW:
- if (!run_all_cpu_set_hw_mode(insn, false))
- pr_notice("Disabled %s support\n", insn->name);
- break;
- }
-
- switch (insn->current_mode) {
- case INSN_UNDEF:
- break;
- case INSN_EMULATE:
- register_emulation_hooks(insn);
- break;
- case INSN_HW:
- ret = run_all_cpu_set_hw_mode(insn, true);
- if (!ret)
- pr_notice("Enabled %s support\n", insn->name);
- break;
- }
-
- return ret;
-}
-
-static void __init register_insn_emulation(struct insn_emulation *insn)
-{
- unsigned long flags;
-
- insn->min = INSN_UNDEF;
-
- switch (insn->status) {
- case INSN_DEPRECATED:
- insn->current_mode = INSN_EMULATE;
- /* Disable the HW mode if it was turned on at early boot time */
- run_all_cpu_set_hw_mode(insn, false);
- insn->max = INSN_HW;
- break;
- case INSN_OBSOLETE:
- insn->current_mode = INSN_UNDEF;
- insn->max = INSN_EMULATE;
- break;
- }
-
- raw_spin_lock_irqsave(&insn_emulation_lock, flags);
- list_add(&insn->node, &insn_emulation);
- nr_insn_emulated++;
- raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-
- /* Register any handlers if required */
- update_insn_emulation_mode(insn, INSN_UNDEF);
-}
-
-static int emulation_proc_handler(struct ctl_table *table, int write,
- void *buffer, size_t *lenp,
- loff_t *ppos)
-{
- int ret = 0;
- struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode);
- enum insn_emulation_mode prev_mode = insn->current_mode;
-
- mutex_lock(&insn_emulation_mutex);
- ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
-
- if (ret || !write || prev_mode == insn->current_mode)
- goto ret;
-
- ret = update_insn_emulation_mode(insn, prev_mode);
- if (ret) {
- /* Mode change failed, revert to previous mode. */
- insn->current_mode = prev_mode;
- update_insn_emulation_mode(insn, INSN_UNDEF);
- }
-ret:
- mutex_unlock(&insn_emulation_mutex);
- return ret;
-}
-
-static void __init register_insn_emulation_sysctl(void)
-{
- unsigned long flags;
- int i = 0;
- struct insn_emulation *insn;
- struct ctl_table *insns_sysctl, *sysctl;
-
- insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
- GFP_KERNEL);
- if (!insns_sysctl)
- return;
-
- raw_spin_lock_irqsave(&insn_emulation_lock, flags);
- list_for_each_entry(insn, &insn_emulation, node) {
- sysctl = &insns_sysctl[i];
-
- sysctl->mode = 0644;
- sysctl->maxlen = sizeof(int);
-
- sysctl->procname = insn->name;
- sysctl->data = &insn->current_mode;
- sysctl->extra1 = &insn->min;
- sysctl->extra2 = &insn->max;
- sysctl->proc_handler = emulation_proc_handler;
- i++;
- }
- raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-
- register_sysctl("abi", insns_sysctl);
-}
-
/*
* Implement emulation of the SWP/SWPB instructions using load-exclusive and
* store-exclusive.
@@ -608,6 +411,203 @@ static struct insn_emulation insn_setend
.set_hw_mode = setend_set_hw_mode,
};
+static LIST_HEAD(insn_emulation);
+static int nr_insn_emulated __initdata;
+static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
+static DEFINE_MUTEX(insn_emulation_mutex);
+
+static void register_emulation_hooks(struct insn_emulation *insn)
+{
+ struct undef_hook *hook;
+
+ BUG_ON(!insn->hooks);
+
+ for (hook = insn->hooks; hook->instr_mask; hook++)
+ register_undef_hook(hook);
+
+ pr_notice("Registered %s emulation handler\n", insn->name);
+}
+
+static void remove_emulation_hooks(struct insn_emulation *insn)
+{
+ struct undef_hook *hook;
+
+ BUG_ON(!insn->hooks);
+
+ for (hook = insn->hooks; hook->instr_mask; hook++)
+ unregister_undef_hook(hook);
+
+ pr_notice("Removed %s emulation handler\n", insn->name);
+}
+
+static void enable_insn_hw_mode(void *data)
+{
+ struct insn_emulation *insn = (struct insn_emulation *)data;
+ if (insn->set_hw_mode)
+ insn->set_hw_mode(true);
+}
+
+static void disable_insn_hw_mode(void *data)
+{
+ struct insn_emulation *insn = (struct insn_emulation *)data;
+ if (insn->set_hw_mode)
+ insn->set_hw_mode(false);
+}
+
+/* Run set_hw_mode(mode) on all active CPUs */
+static int run_all_cpu_set_hw_mode(struct insn_emulation *insn, bool enable)
+{
+ if (!insn->set_hw_mode)
+ return -EINVAL;
+ if (enable)
+ on_each_cpu(enable_insn_hw_mode, (void *)insn, true);
+ else
+ on_each_cpu(disable_insn_hw_mode, (void *)insn, true);
+ return 0;
+}
+
+/*
+ * Run set_hw_mode for all insns on a starting CPU.
+ * Returns:
+ * 0 - If all the hooks ran successfully.
+ * -EINVAL - At least one hook is not supported by the CPU.
+ */
+static int run_all_insn_set_hw_mode(unsigned int cpu)
+{
+ int rc = 0;
+ unsigned long flags;
+ struct insn_emulation *insn;
+
+ raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+ list_for_each_entry(insn, &insn_emulation, node) {
+ bool enable = (insn->current_mode == INSN_HW);
+ if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
+ pr_warn("CPU[%u] cannot support the emulation of %s",
+ cpu, insn->name);
+ rc = -EINVAL;
+ }
+ }
+ raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+ return rc;
+}
+
+static int update_insn_emulation_mode(struct insn_emulation *insn,
+ enum insn_emulation_mode prev)
+{
+ int ret = 0;
+
+ switch (prev) {
+ case INSN_UNDEF: /* Nothing to be done */
+ break;
+ case INSN_EMULATE:
+ remove_emulation_hooks(insn);
+ break;
+ case INSN_HW:
+ if (!run_all_cpu_set_hw_mode(insn, false))
+ pr_notice("Disabled %s support\n", insn->name);
+ break;
+ }
+
+ switch (insn->current_mode) {
+ case INSN_UNDEF:
+ break;
+ case INSN_EMULATE:
+ register_emulation_hooks(insn);
+ break;
+ case INSN_HW:
+ ret = run_all_cpu_set_hw_mode(insn, true);
+ if (!ret)
+ pr_notice("Enabled %s support\n", insn->name);
+ break;
+ }
+
+ return ret;
+}
+
+static void __init register_insn_emulation(struct insn_emulation *insn)
+{
+ unsigned long flags;
+
+ insn->min = INSN_UNDEF;
+
+ switch (insn->status) {
+ case INSN_DEPRECATED:
+ insn->current_mode = INSN_EMULATE;
+ /* Disable the HW mode if it was turned on at early boot time */
+ run_all_cpu_set_hw_mode(insn, false);
+ insn->max = INSN_HW;
+ break;
+ case INSN_OBSOLETE:
+ insn->current_mode = INSN_UNDEF;
+ insn->max = INSN_EMULATE;
+ break;
+ }
+
+ raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+ list_add(&insn->node, &insn_emulation);
+ nr_insn_emulated++;
+ raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+
+ /* Register any handlers if required */
+ update_insn_emulation_mode(insn, INSN_UNDEF);
+}
+
+static int emulation_proc_handler(struct ctl_table *table, int write,
+ void *buffer, size_t *lenp,
+ loff_t *ppos)
+{
+ int ret = 0;
+ struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode);
+ enum insn_emulation_mode prev_mode = insn->current_mode;
+
+ mutex_lock(&insn_emulation_mutex);
+ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos);
+
+ if (ret || !write || prev_mode == insn->current_mode)
+ goto ret;
+
+ ret = update_insn_emulation_mode(insn, prev_mode);
+ if (ret) {
+ /* Mode change failed, revert to previous mode. */
+ insn->current_mode = prev_mode;
+ update_insn_emulation_mode(insn, INSN_UNDEF);
+ }
+ret:
+ mutex_unlock(&insn_emulation_mutex);
+ return ret;
+}
+
+static void __init register_insn_emulation_sysctl(void)
+{
+ unsigned long flags;
+ int i = 0;
+ struct insn_emulation *insn;
+ struct ctl_table *insns_sysctl, *sysctl;
+
+ insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
+ GFP_KERNEL);
+ if (!insns_sysctl)
+ return;
+
+ raw_spin_lock_irqsave(&insn_emulation_lock, flags);
+ list_for_each_entry(insn, &insn_emulation, node) {
+ sysctl = &insns_sysctl[i];
+
+ sysctl->mode = 0644;
+ sysctl->maxlen = sizeof(int);
+
+ sysctl->procname = insn->name;
+ sysctl->data = &insn->current_mode;
+ sysctl->extra1 = &insn->min;
+ sysctl->extra2 = &insn->max;
+ sysctl->proc_handler = emulation_proc_handler;
+ i++;
+ }
+ raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+
+ register_sysctl("abi", insns_sysctl);
+}
+
/*
* Invoked as core_initcall, which guarantees that the instruction
* emulation is ready for userspace.
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 075/202] arm64: armv8_deprecated: move aarch32 helper earlier
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 074/202] arm64: armv8_deprecated move emulation functions Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 076/202] arm64: armv8_deprecated: rework deprected instruction handling Greg Kroah-Hartman
` (132 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 0c5f416219da3795dc8b33e5bb7865a6b3c4e55c upstream.
Subsequent patches will rework the logic in armv8_deprecated.c.
In preparation for subsequent changes, this patch moves some shared logic
earlier in the file. This will make subsequent diffs simpler and easier to
read.
At the same time, drop the `__kprobes` annotation from
aarch32_check_condition(), as this is only used for traps from compat
userspace, and has no risk of recursion within kprobes. As this is the
last kprobes annotation in armve8_deprecated.c, we no longer need to
include <asm/kprobes.h>.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-9-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/armv8_deprecated.c | 39 +++++++++++++++++------------------
1 file changed, 19 insertions(+), 20 deletions(-)
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -17,7 +17,6 @@
#include <asm/sysreg.h>
#include <asm/system_misc.h>
#include <asm/traps.h>
-#include <asm/kprobes.h>
#define CREATE_TRACE_POINTS
#include "trace-events-emulation.h"
@@ -52,6 +51,25 @@ struct insn_emulation {
int max;
};
+#define ARM_OPCODE_CONDTEST_FAIL 0
+#define ARM_OPCODE_CONDTEST_PASS 1
+#define ARM_OPCODE_CONDTEST_UNCOND 2
+
+#define ARM_OPCODE_CONDITION_UNCOND 0xf
+
+static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
+{
+ u32 cc_bits = opcode >> 28;
+
+ if (cc_bits != ARM_OPCODE_CONDITION_UNCOND) {
+ if ((*aarch32_opcode_cond_checks[cc_bits])(psr))
+ return ARM_OPCODE_CONDTEST_PASS;
+ else
+ return ARM_OPCODE_CONDTEST_FAIL;
+ }
+ return ARM_OPCODE_CONDTEST_UNCOND;
+}
+
/*
* Implement emulation of the SWP/SWPB instructions using load-exclusive and
* store-exclusive.
@@ -138,25 +156,6 @@ static int emulate_swpX(unsigned int add
return res;
}
-#define ARM_OPCODE_CONDTEST_FAIL 0
-#define ARM_OPCODE_CONDTEST_PASS 1
-#define ARM_OPCODE_CONDTEST_UNCOND 2
-
-#define ARM_OPCODE_CONDITION_UNCOND 0xf
-
-static unsigned int __kprobes aarch32_check_condition(u32 opcode, u32 psr)
-{
- u32 cc_bits = opcode >> 28;
-
- if (cc_bits != ARM_OPCODE_CONDITION_UNCOND) {
- if ((*aarch32_opcode_cond_checks[cc_bits])(psr))
- return ARM_OPCODE_CONDTEST_PASS;
- else
- return ARM_OPCODE_CONDTEST_FAIL;
- }
- return ARM_OPCODE_CONDTEST_UNCOND;
-}
-
/*
* swp_handler logs the id of calling process, dissects the instruction, sanity
* checks the memory location, calls emulate_swpX for the actual operation and
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 076/202] arm64: armv8_deprecated: rework deprected instruction handling
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 075/202] arm64: armv8_deprecated: move aarch32 helper earlier Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 077/202] arm64: armv8_deprecated: fix unused-function error Greg Kroah-Hartman
` (131 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Mark Rutland,
Catalin Marinas, James Morse, Joey Gouly, Peter Zijlstra,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Rutland <mark.rutland@arm.com>
commit 124c49b1b5d947b7180c5d6cbb09ddf76ea45ea2 upstream.
Support for deprecated instructions can be enabled or disabled at
runtime. To handle this, the code in armv8_deprecated.c registers and
unregisters undef_hooks, and makes cross CPU calls to configure HW
support. This is rather complicated, and the synchronization required to
make this safe ends up serializing the handling of instructions which
have been trapped.
This patch simplifies the deprecated instruction handling by removing
the dynamic registration and unregistration, and changing the trap
handling code to determine whether a handler should be invoked. This
removes the need for dynamic list management, and simplifies the locking
requirements, making it possible to handle trapped instructions entirely
in parallel.
Where changing the emulation state requires a cross-call, this is
serialized by locally disabling interrupts, ensuring that the CPU is not
left in an inconsistent state.
To simplify sysctl management, each insn_emulation is given a separate
sysctl table, permitting these to be registered separately. The core
sysctl code will iterate over all of these when walking sysfs.
I've tested this with userspace programs which use each of the
deprecated instructions, and I've concurrently modified the support
level for each of the features back-and-forth between HW and emulated to
check that there are no spurious SIGILLs sent to userspace when the
support level is changed.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: James Morse <james.morse@arm.com>
Cc: Joey Gouly <joey.gouly@arm.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Will Deacon <will@kernel.org>
Link: https://lore.kernel.org/r/20221019144123.612388-10-mark.rutland@arm.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/include/asm/traps.h | 19 +-
arch/arm64/kernel/armv8_deprecated.c | 291 +++++++++++++++++------------------
arch/arm64/kernel/traps.c | 40 ----
3 files changed, 156 insertions(+), 194 deletions(-)
--- a/arch/arm64/include/asm/traps.h
+++ b/arch/arm64/include/asm/traps.h
@@ -13,17 +13,16 @@
struct pt_regs;
-struct undef_hook {
- struct list_head node;
- u32 instr_mask;
- u32 instr_val;
- u64 pstate_mask;
- u64 pstate_val;
- int (*fn)(struct pt_regs *regs, u32 instr);
-};
+#ifdef CONFIG_ARMV8_DEPRECATED
+bool try_emulate_armv8_deprecated(struct pt_regs *regs, u32 insn);
+#else
+static inline bool
+try_emulate_armv8_deprecated(struct pt_regs *regs, u32 insn)
+{
+ return false;
+}
+#endif /* CONFIG_ARMV8_DEPRECATED */
-void register_undef_hook(struct undef_hook *hook);
-void unregister_undef_hook(struct undef_hook *hook);
void force_signal_inject(int signal, int code, unsigned long address, unsigned int err);
void arm64_notify_segfault(unsigned long addr);
void arm64_force_sig_fault(int signo, int code, void __user *addr, const char *str);
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -38,17 +38,24 @@ enum insn_emulation_mode {
enum legacy_insn_status {
INSN_DEPRECATED,
INSN_OBSOLETE,
+ INSN_UNAVAILABLE,
};
struct insn_emulation {
const char *name;
- struct list_head node;
enum legacy_insn_status status;
- struct undef_hook *hooks;
+ bool (*try_emulate)(struct pt_regs *regs,
+ u32 insn);
int (*set_hw_mode)(bool enable);
+
int current_mode;
int min;
int max;
+
+ /*
+ * sysctl for this emulation + a sentinal entry.
+ */
+ struct ctl_table sysctl[2];
};
#define ARM_OPCODE_CONDTEST_FAIL 0
@@ -70,6 +77,7 @@ static unsigned int aarch32_check_condit
return ARM_OPCODE_CONDTEST_UNCOND;
}
+#ifdef CONFIG_SWP_EMULATION
/*
* Implement emulation of the SWP/SWPB instructions using load-exclusive and
* store-exclusive.
@@ -228,28 +236,27 @@ fault:
return 0;
}
-/*
- * Only emulate SWP/SWPB executed in ARM state/User mode.
- * The kernel must be SWP free and SWP{B} does not exist in Thumb.
- */
-static struct undef_hook swp_hooks[] = {
- {
- .instr_mask = 0x0fb00ff0,
- .instr_val = 0x01000090,
- .pstate_mask = PSR_AA32_MODE_MASK,
- .pstate_val = PSR_AA32_MODE_USR,
- .fn = swp_handler
- },
- { }
-};
+static bool try_emulate_swp(struct pt_regs *regs, u32 insn)
+{
+ /* SWP{B} only exists in ARM state and does not exist in Thumb */
+ if (!compat_user_mode(regs) || compat_thumb_mode(regs))
+ return false;
+
+ if ((insn & 0x0fb00ff0) != 0x01000090)
+ return false;
+
+ return swp_handler(regs, insn) == 0;
+}
static struct insn_emulation insn_swp = {
.name = "swp",
.status = INSN_OBSOLETE,
- .hooks = swp_hooks,
+ .try_emulate = try_emulate_swp,
.set_hw_mode = NULL,
};
+#endif /* CONFIG_SWP_EMULATION */
+#ifdef CONFIG_CP15_BARRIER_EMULATION
static int cp15barrier_handler(struct pt_regs *regs, u32 instr)
{
perf_sw_event(PERF_COUNT_SW_EMULATION_FAULTS, 1, regs, regs->pc);
@@ -312,31 +319,29 @@ static int cp15_barrier_set_hw_mode(bool
return 0;
}
-static struct undef_hook cp15_barrier_hooks[] = {
- {
- .instr_mask = 0x0fff0fdf,
- .instr_val = 0x0e070f9a,
- .pstate_mask = PSR_AA32_MODE_MASK,
- .pstate_val = PSR_AA32_MODE_USR,
- .fn = cp15barrier_handler,
- },
- {
- .instr_mask = 0x0fff0fff,
- .instr_val = 0x0e070f95,
- .pstate_mask = PSR_AA32_MODE_MASK,
- .pstate_val = PSR_AA32_MODE_USR,
- .fn = cp15barrier_handler,
- },
- { }
-};
+static bool try_emulate_cp15_barrier(struct pt_regs *regs, u32 insn)
+{
+ if (!compat_user_mode(regs) || compat_thumb_mode(regs))
+ return false;
+
+ if ((insn & 0x0fff0fdf) == 0x0e070f9a)
+ return cp15barrier_handler(regs, insn) == 0;
+
+ if ((insn & 0x0fff0fff) == 0x0e070f95)
+ return cp15barrier_handler(regs, insn) == 0;
+
+ return false;
+}
static struct insn_emulation insn_cp15_barrier = {
.name = "cp15_barrier",
.status = INSN_DEPRECATED,
- .hooks = cp15_barrier_hooks,
+ .try_emulate = try_emulate_cp15_barrier,
.set_hw_mode = cp15_barrier_set_hw_mode,
};
+#endif /* CONFIG_CP15_BARRIER_EMULATION */
+#ifdef CONFIG_SETEND_EMULATION
static int setend_set_hw_mode(bool enable)
{
if (!cpu_supports_mixed_endian_el0())
@@ -384,60 +389,40 @@ static int t16_setend_handler(struct pt_
return rc;
}
-static struct undef_hook setend_hooks[] = {
- {
- .instr_mask = 0xfffffdff,
- .instr_val = 0xf1010000,
- .pstate_mask = PSR_AA32_MODE_MASK,
- .pstate_val = PSR_AA32_MODE_USR,
- .fn = a32_setend_handler,
- },
- {
- /* Thumb mode */
- .instr_mask = 0xfffffff7,
- .instr_val = 0x0000b650,
- .pstate_mask = (PSR_AA32_T_BIT | PSR_AA32_MODE_MASK),
- .pstate_val = (PSR_AA32_T_BIT | PSR_AA32_MODE_USR),
- .fn = t16_setend_handler,
- },
- {}
-};
+static bool try_emulate_setend(struct pt_regs *regs, u32 insn)
+{
+ if (compat_thumb_mode(regs) &&
+ (insn & 0xfffffff7) == 0x0000b650)
+ return t16_setend_handler(regs, insn) == 0;
+
+ if (compat_user_mode(regs) &&
+ (insn & 0xfffffdff) == 0xf1010000)
+ return a32_setend_handler(regs, insn) == 0;
+
+ return false;
+}
static struct insn_emulation insn_setend = {
.name = "setend",
.status = INSN_DEPRECATED,
- .hooks = setend_hooks,
+ .try_emulate = try_emulate_setend,
.set_hw_mode = setend_set_hw_mode,
};
+#endif /* CONFIG_SETEND_EMULATION */
-static LIST_HEAD(insn_emulation);
-static int nr_insn_emulated __initdata;
-static DEFINE_RAW_SPINLOCK(insn_emulation_lock);
-static DEFINE_MUTEX(insn_emulation_mutex);
-
-static void register_emulation_hooks(struct insn_emulation *insn)
-{
- struct undef_hook *hook;
-
- BUG_ON(!insn->hooks);
-
- for (hook = insn->hooks; hook->instr_mask; hook++)
- register_undef_hook(hook);
-
- pr_notice("Registered %s emulation handler\n", insn->name);
-}
-
-static void remove_emulation_hooks(struct insn_emulation *insn)
-{
- struct undef_hook *hook;
-
- BUG_ON(!insn->hooks);
-
- for (hook = insn->hooks; hook->instr_mask; hook++)
- unregister_undef_hook(hook);
+static struct insn_emulation *insn_emulations[] = {
+#ifdef CONFIG_SWP_EMULATION
+ &insn_swp,
+#endif
+#ifdef CONFIG_CP15_BARRIER_EMULATION
+ &insn_cp15_barrier,
+#endif
+#ifdef CONFIG_SETEND_EMULATION
+ &insn_setend,
+#endif
+};
- pr_notice("Removed %s emulation handler\n", insn->name);
-}
+static DEFINE_MUTEX(insn_emulation_mutex);
static void enable_insn_hw_mode(void *data)
{
@@ -473,20 +458,27 @@ static int run_all_cpu_set_hw_mode(struc
*/
static int run_all_insn_set_hw_mode(unsigned int cpu)
{
+ int i;
int rc = 0;
unsigned long flags;
- struct insn_emulation *insn;
- raw_spin_lock_irqsave(&insn_emulation_lock, flags);
- list_for_each_entry(insn, &insn_emulation, node) {
- bool enable = (insn->current_mode == INSN_HW);
+ /*
+ * Disable IRQs to serialize against an IPI from
+ * run_all_cpu_set_hw_mode(), ensuring the HW is programmed to the most
+ * recent enablement state if the two race with one another.
+ */
+ local_irq_save(flags);
+ for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
+ struct insn_emulation *insn = insn_emulations[i];
+ bool enable = READ_ONCE(insn->current_mode) == INSN_HW;
if (insn->set_hw_mode && insn->set_hw_mode(enable)) {
pr_warn("CPU[%u] cannot support the emulation of %s",
cpu, insn->name);
rc = -EINVAL;
}
}
- raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
+ local_irq_restore(flags);
+
return rc;
}
@@ -499,7 +491,6 @@ static int update_insn_emulation_mode(st
case INSN_UNDEF: /* Nothing to be done */
break;
case INSN_EMULATE:
- remove_emulation_hooks(insn);
break;
case INSN_HW:
if (!run_all_cpu_set_hw_mode(insn, false))
@@ -511,7 +502,6 @@ static int update_insn_emulation_mode(st
case INSN_UNDEF:
break;
case INSN_EMULATE:
- register_emulation_hooks(insn);
break;
case INSN_HW:
ret = run_all_cpu_set_hw_mode(insn, true);
@@ -523,34 +513,6 @@ static int update_insn_emulation_mode(st
return ret;
}
-static void __init register_insn_emulation(struct insn_emulation *insn)
-{
- unsigned long flags;
-
- insn->min = INSN_UNDEF;
-
- switch (insn->status) {
- case INSN_DEPRECATED:
- insn->current_mode = INSN_EMULATE;
- /* Disable the HW mode if it was turned on at early boot time */
- run_all_cpu_set_hw_mode(insn, false);
- insn->max = INSN_HW;
- break;
- case INSN_OBSOLETE:
- insn->current_mode = INSN_UNDEF;
- insn->max = INSN_EMULATE;
- break;
- }
-
- raw_spin_lock_irqsave(&insn_emulation_lock, flags);
- list_add(&insn->node, &insn_emulation);
- nr_insn_emulated++;
- raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
-
- /* Register any handlers if required */
- update_insn_emulation_mode(insn, INSN_UNDEF);
-}
-
static int emulation_proc_handler(struct ctl_table *table, int write,
void *buffer, size_t *lenp,
loff_t *ppos)
@@ -568,7 +530,7 @@ static int emulation_proc_handler(struct
ret = update_insn_emulation_mode(insn, prev_mode);
if (ret) {
/* Mode change failed, revert to previous mode. */
- insn->current_mode = prev_mode;
+ WRITE_ONCE(insn->current_mode, prev_mode);
update_insn_emulation_mode(insn, INSN_UNDEF);
}
ret:
@@ -576,21 +538,34 @@ ret:
return ret;
}
-static void __init register_insn_emulation_sysctl(void)
+static void __init register_insn_emulation(struct insn_emulation *insn)
{
- unsigned long flags;
- int i = 0;
- struct insn_emulation *insn;
- struct ctl_table *insns_sysctl, *sysctl;
-
- insns_sysctl = kcalloc(nr_insn_emulated + 1, sizeof(*sysctl),
- GFP_KERNEL);
- if (!insns_sysctl)
- return;
-
- raw_spin_lock_irqsave(&insn_emulation_lock, flags);
- list_for_each_entry(insn, &insn_emulation, node) {
- sysctl = &insns_sysctl[i];
+ struct ctl_table *sysctl;
+
+ insn->min = INSN_UNDEF;
+
+ switch (insn->status) {
+ case INSN_DEPRECATED:
+ insn->current_mode = INSN_EMULATE;
+ /* Disable the HW mode if it was turned on at early boot time */
+ run_all_cpu_set_hw_mode(insn, false);
+ insn->max = INSN_HW;
+ break;
+ case INSN_OBSOLETE:
+ insn->current_mode = INSN_UNDEF;
+ insn->max = INSN_EMULATE;
+ break;
+ case INSN_UNAVAILABLE:
+ insn->current_mode = INSN_UNDEF;
+ insn->max = INSN_UNDEF;
+ break;
+ }
+
+ /* Program the HW if required */
+ update_insn_emulation_mode(insn, INSN_UNDEF);
+
+ if (insn->status != INSN_UNAVAILABLE) {
+ sysctl = &insn->sysctl[0];
sysctl->mode = 0644;
sysctl->maxlen = sizeof(int);
@@ -600,11 +575,34 @@ static void __init register_insn_emulati
sysctl->extra1 = &insn->min;
sysctl->extra2 = &insn->max;
sysctl->proc_handler = emulation_proc_handler;
- i++;
+
+ register_sysctl("abi", sysctl);
+ }
+}
+
+bool try_emulate_armv8_deprecated(struct pt_regs *regs, u32 insn)
+{
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
+ struct insn_emulation *ie = insn_emulations[i];
+
+ if (ie->status == INSN_UNAVAILABLE)
+ continue;
+
+ /*
+ * A trap may race with the mode being changed
+ * INSN_EMULATE<->INSN_HW. Try to emulate the instruction to
+ * avoid a spurious UNDEF.
+ */
+ if (READ_ONCE(ie->current_mode) == INSN_UNDEF)
+ continue;
+
+ if (ie->try_emulate(regs, insn))
+ return true;
}
- raw_spin_unlock_irqrestore(&insn_emulation_lock, flags);
- register_sysctl("abi", insns_sysctl);
+ return false;
}
/*
@@ -613,24 +611,27 @@ static void __init register_insn_emulati
*/
static int __init armv8_deprecated_init(void)
{
- if (IS_ENABLED(CONFIG_SWP_EMULATION))
- register_insn_emulation(&insn_swp);
+ int i;
- if (IS_ENABLED(CONFIG_CP15_BARRIER_EMULATION))
- register_insn_emulation(&insn_cp15_barrier);
+#ifdef CONFIG_SETEND_EMULATION
+ if (!system_supports_mixed_endian_el0()) {
+ insn_setend.status = INSN_UNAVAILABLE;
+ pr_info("setend instruction emulation is not supported on this system\n");
+ }
- if (IS_ENABLED(CONFIG_SETEND_EMULATION)) {
- if (system_supports_mixed_endian_el0())
- register_insn_emulation(&insn_setend);
- else
- pr_info("setend instruction emulation is not supported on this system\n");
+#endif
+ for (i = 0; i < ARRAY_SIZE(insn_emulations); i++) {
+ struct insn_emulation *ie = insn_emulations[i];
+
+ if (ie->status == INSN_UNAVAILABLE)
+ continue;
+
+ register_insn_emulation(ie);
}
cpuhp_setup_state_nocalls(CPUHP_AP_ARM64_ISNDEP_STARTING,
"arm64/isndep:starting",
run_all_insn_set_hw_mode, NULL);
- register_insn_emulation_sysctl();
-
return 0;
}
--- a/arch/arm64/kernel/traps.c
+++ b/arch/arm64/kernel/traps.c
@@ -282,27 +282,6 @@ void arm64_skip_faulting_instruction(str
regs->pstate &= ~PSR_BTYPE_MASK;
}
-static LIST_HEAD(undef_hook);
-static DEFINE_RAW_SPINLOCK(undef_lock);
-
-void register_undef_hook(struct undef_hook *hook)
-{
- unsigned long flags;
-
- raw_spin_lock_irqsave(&undef_lock, flags);
- list_add(&hook->node, &undef_hook);
- raw_spin_unlock_irqrestore(&undef_lock, flags);
-}
-
-void unregister_undef_hook(struct undef_hook *hook)
-{
- unsigned long flags;
-
- raw_spin_lock_irqsave(&undef_lock, flags);
- list_del(&hook->node);
- raw_spin_unlock_irqrestore(&undef_lock, flags);
-}
-
static int user_insn_read(struct pt_regs *regs, u32 *insnp)
{
u32 instr;
@@ -334,23 +313,6 @@ static int user_insn_read(struct pt_regs
return 0;
}
-static int call_undef_hook(struct pt_regs *regs, u32 instr)
-{
- struct undef_hook *hook;
- unsigned long flags;
- int (*fn)(struct pt_regs *regs, u32 instr) = NULL;
-
- raw_spin_lock_irqsave(&undef_lock, flags);
- list_for_each_entry(hook, &undef_hook, node)
- if ((instr & hook->instr_mask) == hook->instr_val &&
- (regs->pstate & hook->pstate_mask) == hook->pstate_val)
- fn = hook->fn;
-
- raw_spin_unlock_irqrestore(&undef_lock, flags);
-
- return fn ? fn(regs, instr) : 1;
-}
-
void force_signal_inject(int signal, int code, unsigned long address, unsigned int err)
{
const char *desc;
@@ -411,7 +373,7 @@ void do_el0_undef(struct pt_regs *regs,
if (try_emulate_mrs(regs, insn))
return;
- if (call_undef_hook(regs, insn) == 0)
+ if (try_emulate_armv8_deprecated(regs, insn))
return;
out_err:
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 077/202] arm64: armv8_deprecated: fix unused-function error
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 076/202] arm64: armv8_deprecated: rework deprected instruction handling Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 078/202] RDMA/srp: Set scmnd->result only when scmnd is not NULL Greg Kroah-Hartman
` (130 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ruanjinjie, Ren Zhijie, Mark Rutland,
Will Deacon
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Zhijie <renzhijie2@huawei.com>
commit 223d3a0d30b6e9f979f5642e430e1753d3e29f89 upstream.
If CONFIG_SWP_EMULATION is not set and
CONFIG_CP15_BARRIER_EMULATION is not set,
aarch64-linux-gnu complained about unused-function :
arch/arm64/kernel/armv8_deprecated.c:67:21: error: ‘aarch32_check_condition’ defined but not used [-Werror=unused-function]
static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
^~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
To fix this warning, modify aarch32_check_condition() with __maybe_unused.
Fixes: 0c5f416219da ("arm64: armv8_deprecated: move aarch32 helper earlier")
Signed-off-by: Ren Zhijie <renzhijie2@huawei.com>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Link: https://lore.kernel.org/r/20221124022429.19024-1-renzhijie2@huawei.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kernel/armv8_deprecated.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/kernel/armv8_deprecated.c
+++ b/arch/arm64/kernel/armv8_deprecated.c
@@ -64,7 +64,7 @@ struct insn_emulation {
#define ARM_OPCODE_CONDITION_UNCOND 0xf
-static unsigned int aarch32_check_condition(u32 opcode, u32 psr)
+static unsigned int __maybe_unused aarch32_check_condition(u32 opcode, u32 psr)
{
u32 cc_bits = opcode >> 28;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 078/202] RDMA/srp: Set scmnd->result only when scmnd is not NULL
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 077/202] arm64: armv8_deprecated: fix unused-function error Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 079/202] RDMA/srp: Fix srp_abort() Greg Kroah-Hartman
` (129 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Yang, Bart Van Assche,
Leon Romanovsky
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: yangx.jy@fujitsu.com <yangx.jy@fujitsu.com>
commit 12f35199a2c0551187edbf8eb01379f0598659fa upstream.
This change fixes the following kernel NULL pointer dereference
which is reproduced by blktests srp/007 occasionally.
BUG: kernel NULL pointer dereference, address: 0000000000000170
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP NOPTI
CPU: 0 PID: 9 Comm: kworker/0:1H Kdump: loaded Not tainted 6.0.0-rc1+ #37
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.15.0-29-g6a62e0cb0dfe-prebuilt.qemu.org 04/01/2014
Workqueue: 0x0 (kblockd)
RIP: 0010:srp_recv_done+0x176/0x500 [ib_srp]
Code: 00 4d 85 ff 0f 84 52 02 00 00 48 c7 82 80 02 00 00 00 00 00 00 4c 89 df 4c 89 14 24 e8 53 d3 4a f6 4c 8b 14 24 41 0f b6 42 13 <41> 89 87 70 01 00 00 41 0f b6 52 12 f6 c2 02 74 44 41 8b 42 1c b9
RSP: 0018:ffffaef7c0003e28 EFLAGS: 00000282
RAX: 0000000000000000 RBX: ffff9bc9486dea60 RCX: 0000000000000000
RDX: 0000000000000102 RSI: ffffffffb76bbd0e RDI: 00000000ffffffff
RBP: ffff9bc980099a00 R08: 0000000000000001 R09: 0000000000000001
R10: ffff9bca53ef0000 R11: ffff9bc980099a10 R12: ffff9bc956e14000
R13: ffff9bc9836b9cb0 R14: ffff9bc9557b4480 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff9bc97ec00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000170 CR3: 0000000007e04000 CR4: 00000000000006f0
Call Trace:
<IRQ>
__ib_process_cq+0xb7/0x280 [ib_core]
ib_poll_handler+0x2b/0x130 [ib_core]
irq_poll_softirq+0x93/0x150
__do_softirq+0xee/0x4b8
irq_exit_rcu+0xf7/0x130
sysvec_apic_timer_interrupt+0x8e/0xc0
</IRQ>
Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent")
Link: https://lore.kernel.org/r/20220831081626.18712-1-yangx.jy@fujitsu.com
Signed-off-by: Xiao Yang <yangx.jy@fujitsu.com>
Acked-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -1955,7 +1955,8 @@ static void srp_process_rsp(struct srp_r
if (scmnd) {
req = scsi_cmd_priv(scmnd);
scmnd = srp_claim_req(ch, req, NULL, scmnd);
- } else {
+ }
+ if (!scmnd) {
shost_printk(KERN_ERR, target->scsi_host,
"Null scmnd for RSP w/tag %#016llx received on ch %td / QP %#x\n",
rsp->tag, ch - target->ch, ch->qp->qp_num);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 079/202] RDMA/srp: Fix srp_abort()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 078/202] RDMA/srp: Set scmnd->result only when scmnd is not NULL Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 080/202] ravb: Fix use-after-free issue in ravb_tx_timeout_work() Greg Kroah-Hartman
` (128 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Xiao Yang, Bart Van Assche,
Leon Romanovsky
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <bvanassche@acm.org>
commit 6dbe4a8dead84de474483910b02ec9e6a10fc1a9 upstream.
Fix the code for converting a SCSI command pointer into an SRP request
pointer.
Cc: Xiao Yang <yangx.jy@fujitsu.com>
Fixes: ad215aaea4f9 ("RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent")
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Link: https://lore.kernel.org/r/20220908233139.3042628-1-bvanassche@acm.org
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/infiniband/ulp/srp/ib_srp.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
--- a/drivers/infiniband/ulp/srp/ib_srp.c
+++ b/drivers/infiniband/ulp/srp/ib_srp.c
@@ -2778,15 +2778,13 @@ static int srp_send_tsk_mgmt(struct srp_
static int srp_abort(struct scsi_cmnd *scmnd)
{
struct srp_target_port *target = host_to_target(scmnd->device->host);
- struct srp_request *req = (struct srp_request *) scmnd->host_scribble;
+ struct srp_request *req = scsi_cmd_priv(scmnd);
u32 tag;
u16 ch_idx;
struct srp_rdma_ch *ch;
shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n");
- if (!req)
- return SUCCESS;
tag = blk_mq_unique_tag(scmnd->request);
ch_idx = blk_mq_unique_tag_to_hwq(tag);
if (WARN_ON_ONCE(ch_idx >= target->ch_count))
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 080/202] ravb: Fix use-after-free issue in ravb_tx_timeout_work()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 079/202] RDMA/srp: Fix srp_abort() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 081/202] dev_forward_skb: do not scrub skb mark within the same name space Greg Kroah-Hartman
` (127 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Wang, Yoshihiro Shimoda,
Sergey Shtylyov, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
commit 3971442870713de527684398416970cf025b4f89 upstream.
The ravb_stop() should call cancel_work_sync(). Otherwise,
ravb_tx_timeout_work() is possible to use the freed priv after
ravb_remove() was called like below:
CPU0 CPU1
ravb_tx_timeout()
ravb_remove()
unregister_netdev()
free_netdev(ndev)
// free priv
ravb_tx_timeout_work()
// use priv
unregister_netdev() will call .ndo_stop() so that ravb_stop() is
called. And, after phy_stop() is called, netif_carrier_off()
is also called. So that .ndo_tx_timeout() will not be called
after phy_stop().
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Reported-by: Zheng Wang <zyytlz.wz@163.com>
Closes: https://lore.kernel.org/netdev/20230725030026.1664873-1-zyytlz.wz@163.com/
Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231005011201.14368-3-yoshihiro.shimoda.uh@renesas.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1706,6 +1706,8 @@ static int ravb_close(struct net_device
of_phy_deregister_fixed_link(np);
}
+ cancel_work_sync(&priv->work);
+
if (priv->chip_id != RCAR_GEN2) {
free_irq(priv->tx_irqs[RAVB_NC], ndev);
free_irq(priv->rx_irqs[RAVB_NC], ndev);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 081/202] dev_forward_skb: do not scrub skb mark within the same name space
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 080/202] ravb: Fix use-after-free issue in ravb_tx_timeout_work() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 082/202] lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default Greg Kroah-Hartman
` (126 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicolas Dichtel, David S. Miller,
Daniel Borkmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
commit ff70202b2d1ad522275c6aadc8c53519b6a22c57 upstream.
The goal is to keep the mark during a bpf_redirect(), like it is done for
legacy encapsulation / decapsulation, when there is no x-netns.
This was initially done in commit 213dd74aee76 ("skbuff: Do not scrub skb
mark within the same name space").
When the call to skb_scrub_packet() was added in dev_forward_skb() (commit
8b27f27797ca ("skb: allow skb_scrub_packet() to be used by tunnels")), the
second argument (xnet) was set to true to force a call to skb_orphan(). At
this time, the mark was always cleanned up by skb_scrub_packet(), whatever
xnet value was.
This call to skb_orphan() was removed later in commit
9c4c325252c5 ("skbuff: preserve sock reference when scrubbing the skb.").
But this 'true' stayed here without any real reason.
Let's correctly set xnet in ____dev_forward_skb(), this function has access
to the previous interface and to the new interface.
Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/netdevice.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -3972,7 +3972,7 @@ static __always_inline int ____dev_forwa
return NET_RX_DROP;
}
- skb_scrub_packet(skb, true);
+ skb_scrub_packet(skb, !net_eq(dev_net(dev), dev_net(skb->dev)));
skb->priority = 0;
return 0;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 082/202] lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 081/202] dev_forward_skb: do not scrub skb mark within the same name space Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 083/202] mm/memory_hotplug: rate limit page migration warnings Greg Kroah-Hartman
` (125 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyeonggon Yoo, Roman Gushchin,
Mel Gorman, Davidlohr Bueso, Ben Segall, Christoph Lameter,
Daniel Bristot de Oliveira, David Rientjes, Dennis Zhou,
Dietmar Eggemann, Ingo Molnar, Johannes Weiner, Joonsoo Kim,
Juri Lelli, Matthew Wilcox, Muchun Song, Pekka Enberg,
Peter Zijlstra, Shakeel Butt, Steven Rostedt (Google), Tejun Heo,
Valentin Schneider, Vincent Guittot, Vlastimil Babka,
Andrew Morton, Luiz Capitulino
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyeonggon Yoo <42.hyeyoo@gmail.com>
commit cc6003916ed46d7a67d91ee32de0f9138047d55f upstream.
In workloads where this_cpu operations are frequently performed,
enabling DEBUG_PREEMPT may result in significant increase in
runtime overhead due to frequent invocation of
__this_cpu_preempt_check() function.
This can be demonstrated through benchmarks such as hackbench where this
configuration results in a 10% reduction in performance, primarily due to
the added overhead within memcg charging path.
Therefore, do not to enable DEBUG_PREEMPT by default and make users aware
of its potential impact on performance in some workloads.
hackbench-process-sockets
debug_preempt no_debug_preempt
Amean 1 0.4743 ( 0.00%) 0.4295 * 9.45%*
Amean 4 1.4191 ( 0.00%) 1.2650 * 10.86%*
Amean 7 2.2677 ( 0.00%) 2.0094 * 11.39%*
Amean 12 3.6821 ( 0.00%) 3.2115 * 12.78%*
Amean 21 6.6752 ( 0.00%) 5.7956 * 13.18%*
Amean 30 9.6646 ( 0.00%) 8.5197 * 11.85%*
Amean 48 15.3363 ( 0.00%) 13.5559 * 11.61%*
Amean 79 24.8603 ( 0.00%) 22.0597 * 11.27%*
Amean 96 30.1240 ( 0.00%) 26.8073 * 11.01%*
Link: https://lkml.kernel.org/r/20230121033942.350387-1-42.hyeyoo@gmail.com
Signed-off-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Acked-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Cc: Ben Segall <bsegall@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Daniel Bristot de Oliveira <bristot@redhat.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dennis Zhou <dennis@kernel.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Muchun Song <muchun.song@linux.dev>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Steven Rostedt (Google) <rostedt@goodmis.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Valentin Schneider <vschneid@redhat.com>
Cc: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Luiz Capitulino <luizcap@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/Kconfig.debug | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -1136,13 +1136,16 @@ config DEBUG_TIMEKEEPING
config DEBUG_PREEMPT
bool "Debug preemptible kernel"
depends on DEBUG_KERNEL && PREEMPTION && TRACE_IRQFLAGS_SUPPORT
- default y
help
If you say Y here then the kernel will use a debug variant of the
commonly used smp_processor_id() function and will print warnings
if kernel code uses it in a preemption-unsafe way. Also, the kernel
will detect preemption count underflows.
+ This option has potential to introduce high runtime overhead,
+ depending on workload as it triggers debugging routines for each
+ this_cpu operation. It should only be used for debugging purposes.
+
menu "Lock Debugging (spinlocks, mutexes, etc...)"
config LOCK_DEBUGGING_SUPPORT
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 083/202] mm/memory_hotplug: rate limit page migration warnings
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 082/202] lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 084/202] Documentation: sysctl: align cells in second content column Greg Kroah-Hartman
` (124 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam Mark, Georgi Djakov,
David Hildenbrand, Andrew Morton, Linus Torvalds, pjy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liam Mark <lmark@codeaurora.org>
commit 786dee864804f8e851cf0f258df2ccbb4ee03d80 upstream.
When offlining memory the system can attempt to migrate a lot of pages, if
there are problems with migration this can flood the logs. Printing all
the data hogs the CPU and cause some RT threads to run for a long time,
which may have some bad consequences.
Rate limit the page migration warnings in order to avoid this.
Link: https://lkml.kernel.org/r/20210505140542.24935-1-georgi.djakov@linaro.org
Signed-off-by: Liam Mark <lmark@codeaurora.org>
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: <pjy@amazon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memory_hotplug.c | 16 +++++++++++-----
1 file changed, 11 insertions(+), 5 deletions(-)
--- a/mm/memory_hotplug.c
+++ b/mm/memory_hotplug.c
@@ -1279,6 +1279,8 @@ do_migrate_range(unsigned long start_pfn
struct page *page, *head;
int ret = 0;
LIST_HEAD(source);
+ static DEFINE_RATELIMIT_STATE(migrate_rs, DEFAULT_RATELIMIT_INTERVAL,
+ DEFAULT_RATELIMIT_BURST);
for (pfn = start_pfn; pfn < end_pfn; pfn++) {
if (!pfn_valid(pfn))
@@ -1325,8 +1327,10 @@ do_migrate_range(unsigned long start_pfn
page_is_file_lru(page));
} else {
- pr_warn("failed to isolate pfn %lx\n", pfn);
- dump_page(page, "isolation failed");
+ if (__ratelimit(&migrate_rs)) {
+ pr_warn("failed to isolate pfn %lx\n", pfn);
+ dump_page(page, "isolation failed");
+ }
}
put_page(page);
}
@@ -1355,9 +1359,11 @@ do_migrate_range(unsigned long start_pfn
(unsigned long)&mtc, MIGRATE_SYNC, MR_MEMORY_HOTPLUG);
if (ret) {
list_for_each_entry(page, &source, lru) {
- pr_warn("migrating pfn %lx failed ret:%d ",
- page_to_pfn(page), ret);
- dump_page(page, "migration failure");
+ if (__ratelimit(&migrate_rs)) {
+ pr_warn("migrating pfn %lx failed ret:%d\n",
+ page_to_pfn(page), ret);
+ dump_page(page, "migration failure");
+ }
}
putback_movable_pages(&source);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 084/202] Documentation: sysctl: align cells in second content column
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 083/202] mm/memory_hotplug: rate limit page migration warnings Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 085/202] usb: hub: Guard against accesses to uninitialized BOS descriptors Greg Kroah-Hartman
` (123 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Rothwell, Bagas Sanjaya,
Jakub Kicinski, Ben Hutchings
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bagas Sanjaya <bagasdotme@gmail.com>
commit 1faa34672f8a17a3e155e74bde9648564e9480d6 upstream.
Stephen Rothwell reported htmldocs warning when merging net-next tree:
Documentation/admin-guide/sysctl/net.rst:37: WARNING: Malformed table.
Text in column margin in table line 4.
========= =================== = ========== ==================
Directory Content Directory Content
========= =================== = ========== ==================
802 E802 protocol mptcp Multipath TCP
appletalk Appletalk protocol netfilter Network Filter
ax25 AX25 netrom NET/ROM
bridge Bridging rose X.25 PLP layer
core General parameter tipc TIPC
ethernet Ethernet protocol unix Unix domain sockets
ipv4 IP version 4 x25 X.25 protocol
ipv6 IP version 6
========= =================== = ========== ==================
The warning above is caused by cells in second "Content" column of
/proc/sys/net subdirectory table which are in column margin.
Align these cells against the column header to fix the warning.
Link: https://lore.kernel.org/linux-next/20220823134905.57ed08d5@canb.auug.org.au/
Fixes: 1202cdd665315c ("Remove DECnet support from kernel")
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Bagas Sanjaya <bagasdotme@gmail.com>
Link: https://lore.kernel.org/r/20220824035804.204322-1-bagasdotme@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/admin-guide/sysctl/net.rst | 18 +++++++++---------
1 file changed, 9 insertions(+), 9 deletions(-)
--- a/Documentation/admin-guide/sysctl/net.rst
+++ b/Documentation/admin-guide/sysctl/net.rst
@@ -31,18 +31,18 @@ see only some of them, depending on your
Table : Subdirectories in /proc/sys/net
- ========= =================== = ========== ==================
+ ========= =================== = ========== ===================
Directory Content Directory Content
- ========= =================== = ========== ==================
- 802 E802 protocol mptcp Multipath TCP
- appletalk Appletalk protocol netfilter Network Filter
+ ========= =================== = ========== ===================
+ 802 E802 protocol mptcp Multipath TCP
+ appletalk Appletalk protocol netfilter Network Filter
ax25 AX25 netrom NET/ROM
- bridge Bridging rose X.25 PLP layer
- core General parameter tipc TIPC
- ethernet Ethernet protocol unix Unix domain sockets
- ipv4 IP version 4 x25 X.25 protocol
+ bridge Bridging rose X.25 PLP layer
+ core General parameter tipc TIPC
+ ethernet Ethernet protocol unix Unix domain sockets
+ ipv4 IP version 4 x25 X.25 protocol
ipv6 IP version 6
- ========= =================== = ========== ==================
+ ========= =================== = ========== ===================
1. /proc/sys/net/core - Network core options
============================================
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 085/202] usb: hub: Guard against accesses to uninitialized BOS descriptors
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 084/202] Documentation: sysctl: align cells in second content column Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 086/202] Bluetooth: hci_event: Ignore NULL link key Greg Kroah-Hartman
` (122 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ricardo Cañuelo
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
commit f74a7afc224acd5e922c7a2e52244d891bbe44ee upstream.
Many functions in drivers/usb/core/hub.c and drivers/usb/core/hub.h
access fields inside udev->bos without checking if it was allocated and
initialized. If usb_get_bos_descriptor() fails for whatever
reason, udev->bos will be NULL and those accesses will result in a
crash:
BUG: kernel NULL pointer dereference, address: 0000000000000018
PGD 0 P4D 0
Oops: 0000 [#1] PREEMPT SMP NOPTI
CPU: 5 PID: 17818 Comm: kworker/5:1 Tainted: G W 5.15.108-18910-gab0e1cb584e1 #1 <HASH:1f9e 1>
Hardware name: Google Kindred/Kindred, BIOS Google_Kindred.12672.413.0 02/03/2021
Workqueue: usb_hub_wq hub_event
RIP: 0010:hub_port_reset+0x193/0x788
Code: 89 f7 e8 20 f7 15 00 48 8b 43 08 80 b8 96 03 00 00 03 75 36 0f b7 88 92 03 00 00 81 f9 10 03 00 00 72 27 48 8b 80 a8 03 00 00 <48> 83 78 18 00 74 19 48 89 df 48 8b 75 b0 ba 02 00 00 00 4c 89 e9
RSP: 0018:ffffab740c53fcf8 EFLAGS: 00010246
RAX: 0000000000000000 RBX: ffffa1bc5f678000 RCX: 0000000000000310
RDX: fffffffffffffdff RSI: 0000000000000286 RDI: ffffa1be9655b840
RBP: ffffab740c53fd70 R08: 00001b7d5edaa20c R09: ffffffffb005e060
R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
R13: ffffab740c53fd3e R14: 0000000000000032 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffffa1be96540000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000018 CR3: 000000022e80c005 CR4: 00000000003706e0
Call Trace:
hub_event+0x73f/0x156e
? hub_activate+0x5b7/0x68f
process_one_work+0x1a2/0x487
worker_thread+0x11a/0x288
kthread+0x13a/0x152
? process_one_work+0x487/0x487
? kthread_associate_blkcg+0x70/0x70
ret_from_fork+0x1f/0x30
Fall back to a default behavior if the BOS descriptor isn't accessible
and skip all the functionalities that depend on it: LPM support checks,
Super Speed capabilitiy checks, U1/U2 states setup.
Signed-off-by: Ricardo Cañuelo <ricardo.canuelo@collabora.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20230830100418.1952143-1-ricardo.canuelo@collabora.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/hub.c | 28 ++++++++++++++++++++++++----
drivers/usb/core/hub.h | 2 +-
2 files changed, 25 insertions(+), 5 deletions(-)
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -149,6 +149,10 @@ int usb_device_supports_lpm(struct usb_d
if (udev->quirks & USB_QUIRK_NO_LPM)
return 0;
+ /* Skip if the device BOS descriptor couldn't be read */
+ if (!udev->bos)
+ return 0;
+
/* USB 2.1 (and greater) devices indicate LPM support through
* their USB 2.0 Extended Capabilities BOS descriptor.
*/
@@ -325,6 +329,10 @@ static void usb_set_lpm_parameters(struc
if (!udev->lpm_capable || udev->speed < USB_SPEED_SUPER)
return;
+ /* Skip if the device BOS descriptor couldn't be read */
+ if (!udev->bos)
+ return;
+
hub = usb_hub_to_struct_hub(udev->parent);
/* It doesn't take time to transition the roothub into U0, since it
* doesn't have an upstream link.
@@ -2684,7 +2692,8 @@ out_authorized:
}
/*
- * Return 1 if port speed is SuperSpeedPlus, 0 otherwise
+ * Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the
+ * capability couldn't be checked.
* check it from the link protocol field of the current speed ID attribute.
* current speed ID is got from ext port status request. Sublink speed attribute
* table is returned with the hub BOS SSP device capability descriptor
@@ -2694,8 +2703,12 @@ static int port_speed_is_ssp(struct usb_
int ssa_count;
u32 ss_attr;
int i;
- struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;
+ struct usb_ssp_cap_descriptor *ssp_cap;
+ if (!hdev->bos)
+ return 0;
+
+ ssp_cap = hdev->bos->ssp_cap;
if (!ssp_cap)
return 0;
@@ -4114,8 +4127,15 @@ static void usb_enable_link_state(struct
enum usb3_link_state state)
{
int timeout, ret;
- __u8 u1_mel = udev->bos->ss_cap->bU1devExitLat;
- __le16 u2_mel = udev->bos->ss_cap->bU2DevExitLat;
+ __u8 u1_mel;
+ __le16 u2_mel;
+
+ /* Skip if the device BOS descriptor couldn't be read */
+ if (!udev->bos)
+ return;
+
+ u1_mel = udev->bos->ss_cap->bU1devExitLat;
+ u2_mel = udev->bos->ss_cap->bU2DevExitLat;
/* If the device says it doesn't have *any* exit latency to come out of
* U1 or U2, it's probably lying. Assume it doesn't implement that link
--- a/drivers/usb/core/hub.h
+++ b/drivers/usb/core/hub.h
@@ -141,7 +141,7 @@ static inline int hub_is_superspeedplus(
{
return (hdev->descriptor.bDeviceProtocol == USB_HUB_PR_SS &&
le16_to_cpu(hdev->descriptor.bcdUSB) >= 0x0310 &&
- hdev->bos->ssp_cap);
+ hdev->bos && hdev->bos->ssp_cap);
}
static inline unsigned hub_power_on_good_delay(struct usb_hub *hub)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 086/202] Bluetooth: hci_event: Ignore NULL link key
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 085/202] usb: hub: Guard against accesses to uninitialized BOS descriptors Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 087/202] Bluetooth: Reject connection with the device which has same BD_ADDR Greg Kroah-Hartman
` (121 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lee, Chun-Yi, Luiz Augusto von Dentz,
Lee
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee, Chun-Yi <jlee@suse.com>
commit 33155c4aae5260475def6f7438e4e35564f4f3ba upstream.
This change is used to relieve CVE-2020-26555. The description of the
CVE:
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge
of the PIN. [1]
The detail of this attack is in IEEE paper:
BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
[2]
It's a reflection attack. The paper mentioned that attacker can induce
the attacked target to generate null link key (zero key) without PIN
code. In BR/EDR, the key generation is actually handled in the controller
which is below HCI.
Thus, we can ignore null link key in the handler of "Link Key Notification
event" to relieve the attack. A similar implementation also shows in
btstack project. [3]
v3: Drop the connection when null link key be detected.
v2:
- Used Link: tag instead of Closes:
- Used bt_dev_dbg instead of BT_DBG
- Added Fixes: tag
Cc: stable@vger.kernel.org
Fixes: 55ed8ca10f35 ("Bluetooth: Implement link key handling for the management interface")
Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26555 [1]
Link: https://ieeexplore.ieee.org/abstract/document/9474325/authors#authors [2]
Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L3722 [3]
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4065,6 +4065,15 @@ static void hci_link_key_notify_evt(stru
if (!conn)
goto unlock;
+ /* Ignore NULL link key against CVE-2020-26555 */
+ if (!memcmp(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
+ bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
+ &ev->bdaddr);
+ hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
+ hci_conn_drop(conn);
+ goto unlock;
+ }
+
hci_conn_hold(conn);
conn->disc_timeout = HCI_DISCONN_TIMEOUT;
hci_conn_drop(conn);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 087/202] Bluetooth: Reject connection with the device which has same BD_ADDR
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 086/202] Bluetooth: hci_event: Ignore NULL link key Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 088/202] Bluetooth: Fix a refcnt underflow problem for hci_conn Greg Kroah-Hartman
` (120 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lee, Chun-Yi, Luiz Augusto von Dentz,
Lee
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lee, Chun-Yi <jlee@suse.com>
commit 1ffc6f8cc33268731fcf9629fc4438f6db1191fc upstream.
This change is used to relieve CVE-2020-26555. The description of
the CVE:
Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification
1.0B through 5.2 may permit an unauthenticated nearby device to spoof
the BD_ADDR of the peer device to complete pairing without knowledge
of the PIN. [1]
The detail of this attack is in IEEE paper:
BlueMirror: Reflections on Bluetooth Pairing and Provisioning Protocols
[2]
It's a reflection attack. The paper mentioned that attacker can induce
the attacked target to generate null link key (zero key) without PIN
code. In BR/EDR, the key generation is actually handled in the controller
which is below HCI.
A condition of this attack is that attacker should change the
BR_ADDR of his hacking device (Host B) to equal to the BR_ADDR with
the target device being attacked (Host A).
Thus, we reject the connection with device which has same BD_ADDR
both on HCI_Create_Connection and HCI_Connection_Request to prevent
the attack. A similar implementation also shows in btstack project.
[3][4]
Cc: stable@vger.kernel.org
Link: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26555 [1]
Link: https://ieeexplore.ieee.org/abstract/document/9474325/authors#authors [2]
Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L3523 [3]
Link: https://github.com/bluekitchen/btstack/blob/master/src/hci.c#L7297 [4]
Signed-off-by: Lee, Chun-Yi <jlee@suse.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_conn.c | 9 +++++++++
net/bluetooth/hci_event.c | 11 +++++++++++
2 files changed, 20 insertions(+)
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1249,6 +1249,15 @@ struct hci_conn *hci_connect_acl(struct
return ERR_PTR(-EOPNOTSUPP);
}
+ /* Reject outgoing connection to device with same BD ADDR against
+ * CVE-2020-26555
+ */
+ if (!bacmp(&hdev->bdaddr, dst)) {
+ bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
+ dst);
+ return ERR_PTR(-ECONNREFUSED);
+ }
+
acl = hci_conn_hash_lookup_ba(hdev, ACL_LINK, dst);
if (!acl) {
acl = hci_conn_add(hdev, ACL_LINK, dst, HCI_ROLE_MASTER);
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2701,6 +2701,17 @@ static void hci_conn_request_evt(struct
BT_DBG("%s bdaddr %pMR type 0x%x", hdev->name, &ev->bdaddr,
ev->link_type);
+ /* Reject incoming connection from device with same BD ADDR against
+ * CVE-2020-26555
+ */
+ if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
+ {
+ bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
+ &ev->bdaddr);
+ hci_reject_conn(hdev, &ev->bdaddr);
+ return;
+ }
+
mask |= hci_proto_connect_ind(hdev, &ev->bdaddr, ev->link_type,
&flags);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 088/202] Bluetooth: Fix a refcnt underflow problem for hci_conn
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 087/202] Bluetooth: Reject connection with the device which has same BD_ADDR Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 089/202] Bluetooth: vhci: Fix race when opening vhci device Greg Kroah-Hartman
` (119 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ziyang Xuan, Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziyang Xuan <william.xuanziyang@huawei.com>
commit c7f59461f5a78994613afc112cdd73688aef9076 upstream.
Syzbot reports a warning as follows:
WARNING: CPU: 1 PID: 26946 at net/bluetooth/hci_conn.c:619
hci_conn_timeout+0x122/0x210 net/bluetooth/hci_conn.c:619
...
Call Trace:
<TASK>
process_one_work+0x884/0x15c0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
kthread+0x33c/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
</TASK>
It is because the HCI_EV_SIMPLE_PAIR_COMPLETE event handler drops
hci_conn directly without check Simple Pairing whether be enabled. But
the Simple Pairing process can only be used if both sides have the
support enabled in the host stack.
Add hci_conn_ssp_enabled() for hci_conn in HCI_EV_IO_CAPA_REQUEST and
HCI_EV_SIMPLE_PAIR_COMPLETE event handlers to fix the problem.
Fixes: 0493684ed239 ("[Bluetooth] Disable disconnect timer during Simple Pairing")
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -4617,7 +4617,7 @@ static void hci_io_capa_request_evt(stru
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
- if (!conn)
+ if (!conn || !hci_conn_ssp_enabled(conn))
goto unlock;
hci_conn_hold(conn);
@@ -4862,7 +4862,7 @@ static void hci_simple_pair_complete_evt
hci_dev_lock(hdev);
conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &ev->bdaddr);
- if (!conn)
+ if (!conn || !hci_conn_ssp_enabled(conn))
goto unlock;
/* Reset the authentication requirement to unknown */
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 089/202] Bluetooth: vhci: Fix race when opening vhci device
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 088/202] Bluetooth: Fix a refcnt underflow problem for hci_conn Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 090/202] Bluetooth: hci_event: Fix coding style Greg Kroah-Hartman
` (118 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arkadiusz Bokowy,
Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
commit 92d4abd66f7080075793970fc8f241239e58a9e7 upstream.
When the vhci device is opened in the two-step way, i.e.: open device
then write a vendor packet with requested controller type, the device
shall respond with a vendor packet which includes HCI index of created
interface.
When the virtual HCI is created, the host sends a reset request to the
controller. This request is processed by the vhci_send_frame() function.
However, this request is send by a different thread, so it might happen
that this HCI request will be received before the vendor response is
queued in the read queue. This results in the HCI vendor response and
HCI reset request inversion in the read queue which leads to improper
behavior of btvirt:
> dmesg
[1754256.640122] Bluetooth: MGMT ver 1.22
[1754263.023806] Bluetooth: MGMT ver 1.22
[1754265.043775] Bluetooth: hci1: Opcode 0x c03 failed: -110
In order to synchronize vhci two-step open/setup process with virtual
HCI initialization, this patch adds internal lock when queuing data in
the vhci_send_frame() function.
Signed-off-by: Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bluetooth/hci_vhci.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -67,7 +67,10 @@ static int vhci_send_frame(struct hci_de
struct vhci_data *data = hci_get_drvdata(hdev);
memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
+
+ mutex_lock(&data->open_mutex);
skb_queue_tail(&data->readq, skb);
+ mutex_unlock(&data->open_mutex);
wake_up_interruptible(&data->read_wait);
return 0;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 090/202] Bluetooth: hci_event: Fix coding style
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 089/202] Bluetooth: vhci: Fix race when opening vhci device Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 091/202] Bluetooth: avoid memcmp() out of bounds warning Greg Kroah-Hartman
` (117 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 35d91d95a0cd61ebb90e0246dc917fd25e519b8c upstream.
This fixes the following code style problem:
ERROR: that open brace { should be on the previous line
+ if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
+ {
Fixes: 1ffc6f8cc332 ("Bluetooth: Reject connection with the device which has same BD_ADDR")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2704,8 +2704,7 @@ static void hci_conn_request_evt(struct
/* Reject incoming connection from device with same BD ADDR against
* CVE-2020-26555
*/
- if (!bacmp(&hdev->bdaddr, &ev->bdaddr))
- {
+ if (!bacmp(&hdev->bdaddr, &ev->bdaddr)) {
bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
&ev->bdaddr);
hci_reject_conn(hdev, &ev->bdaddr);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 091/202] Bluetooth: avoid memcmp() out of bounds warning
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 090/202] Bluetooth: hci_event: Fix coding style Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 092/202] ice: fix over-shifted variable Greg Kroah-Hartman
` (116 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kees Cook, Lee, Chun-Yi,
Luiz Augusto von Dentz, Marcel Holtmann, Arnd Bergmann
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
commit 9d1a3c74746428102d55371fbf74b484733937d9 upstream.
bacmp() is a wrapper around memcpy(), which contain compile-time
checks for buffer overflow. Since the hci_conn_request_evt() also calls
bt_dev_dbg() with an implicit NULL pointer check, the compiler is now
aware of a case where 'hdev' is NULL and treats this as meaning that
zero bytes are available:
In file included from net/bluetooth/hci_event.c:32:
In function 'bacmp',
inlined from 'hci_conn_request_evt' at net/bluetooth/hci_event.c:3276:7:
include/net/bluetooth/bluetooth.h:364:16: error: 'memcmp' specified bound 6 exceeds source size 0 [-Werror=stringop-overread]
364 | return memcmp(ba1, ba2, sizeof(bdaddr_t));
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Add another NULL pointer check before the bacmp() to ensure the compiler
understands the code flow enough to not warn about it. Since the patch
that introduced the warning is marked for stable backports, this one
should also go that way to avoid introducing build regressions.
Fixes: 1ffc6f8cc332 ("Bluetooth: Reject connection with the device which has same BD_ADDR")
Cc: Kees Cook <keescook@chromium.org>
Cc: "Lee, Chun-Yi" <jlee@suse.com>
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: stable@vger.kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2704,7 +2704,7 @@ static void hci_conn_request_evt(struct
/* Reject incoming connection from device with same BD ADDR against
* CVE-2020-26555
*/
- if (!bacmp(&hdev->bdaddr, &ev->bdaddr)) {
+ if (hdev && !bacmp(&hdev->bdaddr, &ev->bdaddr)) {
bt_dev_dbg(hdev, "Reject connection with same BD_ADDR %pMR\n",
&ev->bdaddr);
hci_reject_conn(hdev, &ev->bdaddr);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 092/202] ice: fix over-shifted variable
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 091/202] Bluetooth: avoid memcmp() out of bounds warning Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 093/202] ice: reset first in crash dump kernels Greg Kroah-Hartman
` (115 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Jesse Brandeburg,
Simon Horman, Jacob Keller, Jakub Kicinski,
Pucha Himasekhar Reddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
commit 242e34500a32631f85c2b4eb6cb42a368a39e54f upstream.
Since the introduction of the ice driver the code has been
double-shifting the RSS enabling field, because the define already has
shifts in it and can't have the regular pattern of "a << shiftval &
mask" applied.
Most places in the code got it right, but one line was still wrong. Fix
this one location for easy backports to stable. An in-progress patch
fixes the defines to "standard" and will be applied as part of the
regular -next process sometime after this one.
Fixes: d76a60ba7afb ("ice: Add support for VLANs and offloads")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
CC: stable@vger.kernel.org
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20231010203101.406248-1-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ice/ice_lib.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -931,8 +931,7 @@ static void ice_set_rss_vsi_ctx(struct i
ctxt->info.q_opt_rss = ((lut_type << ICE_AQ_VSI_Q_OPT_RSS_LUT_S) &
ICE_AQ_VSI_Q_OPT_RSS_LUT_M) |
- ((hash_type << ICE_AQ_VSI_Q_OPT_RSS_HASH_S) &
- ICE_AQ_VSI_Q_OPT_RSS_HASH_M);
+ (hash_type & ICE_AQ_VSI_Q_OPT_RSS_HASH_M);
}
/**
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 093/202] ice: reset first in crash dump kernels
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 092/202] ice: fix over-shifted variable Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 094/202] nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Greg Kroah-Hartman
` (114 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vishal Agrawal, Jay Vosburgh,
Przemek Kitszel, Jesse Brandeburg, Jakub Kicinski,
Pucha Himasekhar Reddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jesse Brandeburg <jesse.brandeburg@intel.com>
commit 0288c3e709e5fabd51e84715c5c798a02f43061a upstream.
When the system boots into the crash dump kernel after a panic, the ice
networking device may still have pending transactions that can cause errors
or machine checks when the device is re-enabled. This can prevent the crash
dump kernel from loading the driver or collecting the crash data.
To avoid this issue, perform a function level reset (FLR) on the ice device
via PCIe config space before enabling it on the crash kernel. This will
clear any outstanding transactions and stop all queues and interrupts.
Restore the config space after the FLR, otherwise it was found in testing
that the driver wouldn't load successfully.
The following sequence causes the original issue:
- Load the ice driver with modprobe ice
- Enable SR-IOV with 2 VFs: echo 2 > /sys/class/net/eth0/device/sriov_num_vfs
- Trigger a crash with echo c > /proc/sysrq-trigger
- Load the ice driver again (or let it load automatically) with modprobe ice
- The system crashes again during pcim_enable_device()
Fixes: 837f08fdecbe ("ice: Add basic driver framework for Intel(R) E800 Series")
Reported-by: Vishal Agrawal <vagrawal@redhat.com>
Reviewed-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Link: https://lore.kernel.org/r/20231011233334.336092-3-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/ice/ice_main.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
--- a/drivers/net/ethernet/intel/ice/ice_main.c
+++ b/drivers/net/ethernet/intel/ice/ice_main.c
@@ -6,6 +6,7 @@
#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
#include <generated/utsrelease.h>
+#include <linux/crash_dump.h>
#include "ice.h"
#include "ice_base.h"
#include "ice_lib.h"
@@ -4025,6 +4026,20 @@ ice_probe(struct pci_dev *pdev, const st
return -EINVAL;
}
+ /* when under a kdump kernel initiate a reset before enabling the
+ * device in order to clear out any pending DMA transactions. These
+ * transactions can cause some systems to machine check when doing
+ * the pcim_enable_device() below.
+ */
+ if (is_kdump_kernel()) {
+ pci_save_state(pdev);
+ pci_clear_master(pdev);
+ err = pcie_flr(pdev);
+ if (err)
+ return err;
+ pci_restore_state(pdev);
+ }
+
/* this driver uses devres, see
* Documentation/driver-api/driver-model/devres.rst
*/
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 094/202] nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 093/202] ice: reset first in crash dump kernels Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 095/202] regmap: fix NULL deref on lookup Greg Kroah-Hartman
` (113 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, 黄思聪,
Krzysztof Kozlowski, Simon Horman, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
commit 7937609cd387246aed994e81aa4fa951358fba41 upstream.
Handle memory allocation failure from nci_skb_alloc() (calling
alloc_skb()) to avoid possible NULL pointer dereference.
Reported-by: 黄思聪 <huangsicong@iie.ac.cn>
Fixes: 391d8a2da787 ("NFC: Add NCI over SPI receive")
Cc: <stable@vger.kernel.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20231013184129.18738-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/nfc/nci/spi.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/nfc/nci/spi.c
+++ b/net/nfc/nci/spi.c
@@ -151,6 +151,8 @@ static int send_acknowledge(struct nci_s
int ret;
skb = nci_skb_alloc(nspi->ndev, 0, GFP_KERNEL);
+ if (!skb)
+ return -ENOMEM;
/* add the NCI SPI header to the start of the buffer */
hdr = skb_push(skb, NCI_SPI_HDR_LEN);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 095/202] regmap: fix NULL deref on lookup
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 094/202] nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 096/202] KVM: x86: Mask LVTPC when handling a PMI Greg Kroah-Hartman
` (112 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marc Kleine-Budde, Johan Hovold,
Mark Brown
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan+linaro@kernel.org>
commit c6df843348d6b71ea986266c12831cb60c2cf325 upstream.
Not all regmaps have a name so make sure to check for that to avoid
dereferencing a NULL pointer when dev_get_regmap() is used to lookup a
named regmap.
Fixes: e84861fec32d ("regmap: dev_get_regmap_match(): fix string comparison")
Cc: stable@vger.kernel.org # 5.8
Cc: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20231006082104.16707-1-johan+linaro@kernel.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/regmap/regmap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/base/regmap/regmap.c
+++ b/drivers/base/regmap/regmap.c
@@ -1511,7 +1511,7 @@ static int dev_get_regmap_match(struct d
/* If the user didn't specify a name match any */
if (data)
- return !strcmp((*r)->name, data);
+ return (*r)->name && !strcmp((*r)->name, data);
else
return 1;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 096/202] KVM: x86: Mask LVTPC when handling a PMI
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 095/202] regmap: fix NULL deref on lookup Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 097/202] x86/sev: Disable MMIO emulation from user mode Greg Kroah-Hartman
` (111 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jim Mattson, Mingwei Zhang,
Sean Christopherson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jim Mattson <jmattson@google.com>
commit a16eb25b09c02a54c1c1b449d4b6cfa2cf3f013a upstream.
Per the SDM, "When the local APIC handles a performance-monitoring
counters interrupt, it automatically sets the mask flag in the LVT
performance counter register." Add this behavior to KVM's local APIC
emulation.
Failure to mask the LVTPC entry results in spurious PMIs, e.g. when
running Linux as a guest, PMI handlers that do a "late_ack" spew a large
number of "dazed and confused" spurious NMI warnings.
Fixes: f5132b01386b ("KVM: Expose a version 2 architectural PMU to a guests")
Cc: stable@vger.kernel.org
Signed-off-by: Jim Mattson <jmattson@google.com>
Tested-by: Mingwei Zhang <mizhang@google.com>
Signed-off-by: Mingwei Zhang <mizhang@google.com>
Link: https://lore.kernel.org/r/20230925173448.3518223-3-mizhang@google.com
[sean: massage changelog, correct Fixes]
Signed-off-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kvm/lapic.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/x86/kvm/lapic.c
+++ b/arch/x86/kvm/lapic.c
@@ -2397,13 +2397,17 @@ int kvm_apic_local_deliver(struct kvm_la
{
u32 reg = kvm_lapic_get_reg(apic, lvt_type);
int vector, mode, trig_mode;
+ int r;
if (kvm_apic_hw_enabled(apic) && !(reg & APIC_LVT_MASKED)) {
vector = reg & APIC_VECTOR_MASK;
mode = reg & APIC_MODE_MASK;
trig_mode = reg & APIC_LVT_LEVEL_TRIGGER;
- return __apic_accept_irq(apic, mode, vector, 1, trig_mode,
- NULL);
+
+ r = __apic_accept_irq(apic, mode, vector, 1, trig_mode, NULL);
+ if (r && lvt_type == APIC_LVTPC)
+ kvm_lapic_set_reg(apic, APIC_LVTPC, reg | APIC_LVT_MASKED);
+ return r;
}
return 0;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 097/202] x86/sev: Disable MMIO emulation from user mode
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 096/202] KVM: x86: Mask LVTPC when handling a PMI Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 098/202] x86/sev: Check IOBM for IOIO exceptions from user-space Greg Kroah-Hartman
` (110 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Dohrmann, Borislav Petkov (AMD),
stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: "Borislav Petkov (AMD)" <bp@alien8.de>
Upstream commit: a37cd2a59d0cb270b1bba568fd3a3b8668b9d3ba
A virt scenario can be constructed where MMIO memory can be user memory.
When that happens, a race condition opens between when the hardware
raises the #VC and when the #VC handler gets to emulate the instruction.
If the MOVS is replaced with a MOVS accessing kernel memory in that
small race window, then write to kernel memory happens as the access
checks are not done at emulation time.
Disable MMIO emulation in user mode temporarily until a sensible use
case appears and justifies properly handling the race window.
Fixes: 0118b604c2c9 ("x86/sev-es: Handle MMIO String Instructions")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Tom Dohrmann <erbse.13@gmx.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/sev-es.c | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -970,6 +970,9 @@ static enum es_result vc_handle_mmio(str
enum es_result ret;
long *reg_data;
+ if (user_mode(ctxt->regs))
+ return ES_UNSUPPORTED;
+
switch (insn->opcode.bytes[0]) {
/* MMIO Write */
case 0x88:
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 098/202] x86/sev: Check IOBM for IOIO exceptions from user-space
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 097/202] x86/sev: Disable MMIO emulation from user mode Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 099/202] x86/sev: Check for user-space IOIO pointing to kernel space Greg Kroah-Hartman
` (109 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Dohrmann, Joerg Roedel,
Borislav Petkov (AMD), stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
Upstream commit: b9cb9c45583b911e0db71d09caa6b56469eb2bdf
Check the IO permission bitmap (if present) before emulating IOIO #VC
exceptions for user-space. These permissions are checked by hardware
already before the #VC is raised, but due to the VC-handler decoding
race it needs to be checked again in software.
Fixes: 25189d08e516 ("x86/sev-es: Add support for handling IOIO exceptions")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Tested-by: Tom Dohrmann <erbse.13@gmx.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/sev-es.c | 5 +++++
arch/x86/kernel/sev-es-shared.c | 22 +++++++++++++++-------
arch/x86/kernel/sev-es.c | 27 +++++++++++++++++++++++++++
3 files changed, 47 insertions(+), 7 deletions(-)
--- a/arch/x86/boot/compressed/sev-es.c
+++ b/arch/x86/boot/compressed/sev-es.c
@@ -106,6 +106,11 @@ static enum es_result vc_read_mem(struct
return ES_OK;
}
+static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)
+{
+ return ES_OK;
+}
+
#undef __init
#undef __pa
#define __init
--- a/arch/x86/kernel/sev-es-shared.c
+++ b/arch/x86/kernel/sev-es-shared.c
@@ -281,6 +281,9 @@ static enum es_result vc_insn_string_wri
static enum es_result vc_ioio_exitinfo(struct es_em_ctxt *ctxt, u64 *exitinfo)
{
struct insn *insn = &ctxt->insn;
+ size_t size;
+ u64 port;
+
*exitinfo = 0;
switch (insn->opcode.bytes[0]) {
@@ -289,7 +292,7 @@ static enum es_result vc_ioio_exitinfo(s
case 0x6d:
*exitinfo |= IOIO_TYPE_INS;
*exitinfo |= IOIO_SEG_ES;
- *exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+ port = ctxt->regs->dx & 0xffff;
break;
/* OUTS opcodes */
@@ -297,41 +300,43 @@ static enum es_result vc_ioio_exitinfo(s
case 0x6f:
*exitinfo |= IOIO_TYPE_OUTS;
*exitinfo |= IOIO_SEG_DS;
- *exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+ port = ctxt->regs->dx & 0xffff;
break;
/* IN immediate opcodes */
case 0xe4:
case 0xe5:
*exitinfo |= IOIO_TYPE_IN;
- *exitinfo |= (u8)insn->immediate.value << 16;
+ port = (u8)insn->immediate.value & 0xffff;
break;
/* OUT immediate opcodes */
case 0xe6:
case 0xe7:
*exitinfo |= IOIO_TYPE_OUT;
- *exitinfo |= (u8)insn->immediate.value << 16;
+ port = (u8)insn->immediate.value & 0xffff;
break;
/* IN register opcodes */
case 0xec:
case 0xed:
*exitinfo |= IOIO_TYPE_IN;
- *exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+ port = ctxt->regs->dx & 0xffff;
break;
/* OUT register opcodes */
case 0xee:
case 0xef:
*exitinfo |= IOIO_TYPE_OUT;
- *exitinfo |= (ctxt->regs->dx & 0xffff) << 16;
+ port = ctxt->regs->dx & 0xffff;
break;
default:
return ES_DECODE_FAILED;
}
+ *exitinfo |= port << 16;
+
switch (insn->opcode.bytes[0]) {
case 0x6c:
case 0x6e:
@@ -341,12 +346,15 @@ static enum es_result vc_ioio_exitinfo(s
case 0xee:
/* Single byte opcodes */
*exitinfo |= IOIO_DATA_8;
+ size = 1;
break;
default:
/* Length determined by instruction parsing */
*exitinfo |= (insn->opnd_bytes == 2) ? IOIO_DATA_16
: IOIO_DATA_32;
+ size = (insn->opnd_bytes == 2) ? 2 : 4;
}
+
switch (insn->addr_bytes) {
case 2:
*exitinfo |= IOIO_ADDR_16;
@@ -362,7 +370,7 @@ static enum es_result vc_ioio_exitinfo(s
if (insn_has_rep_prefix(insn))
*exitinfo |= IOIO_REP;
- return ES_OK;
+ return vc_ioio_check(ctxt, (u16)port, size);
}
static enum es_result vc_handle_ioio(struct ghcb *ghcb, struct es_em_ctxt *ctxt)
--- a/arch/x86/kernel/sev-es.c
+++ b/arch/x86/kernel/sev-es.c
@@ -448,6 +448,33 @@ static enum es_result vc_slow_virt_to_ph
return ES_OK;
}
+static enum es_result vc_ioio_check(struct es_em_ctxt *ctxt, u16 port, size_t size)
+{
+ BUG_ON(size > 4);
+
+ if (user_mode(ctxt->regs)) {
+ struct thread_struct *t = ¤t->thread;
+ struct io_bitmap *iobm = t->io_bitmap;
+ size_t idx;
+
+ if (!iobm)
+ goto fault;
+
+ for (idx = port; idx < port + size; ++idx) {
+ if (test_bit(idx, iobm->bitmap))
+ goto fault;
+ }
+ }
+
+ return ES_OK;
+
+fault:
+ ctxt->fi.vector = X86_TRAP_GP;
+ ctxt->fi.error_code = 0;
+
+ return ES_EXCEPTION;
+}
+
/* Include code shared with pre-decompression boot stage */
#include "sev-es-shared.c"
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 099/202] x86/sev: Check for user-space IOIO pointing to kernel space
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 098/202] x86/sev: Check IOBM for IOIO exceptions from user-space Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 100/202] tcp: check mptcp-level constraints for backlog coalescing Greg Kroah-Hartman
` (108 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Dohrmann, Joerg Roedel,
Borislav Petkov (AMD), stable
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joerg Roedel <jroedel@suse.de>
Upstream commit: 63e44bc52047f182601e7817da969a105aa1f721
Check the memory operand of INS/OUTS before emulating the instruction.
The #VC exception can get raised from user-space, but the memory operand
can be manipulated to access kernel memory before the emulation actually
begins and after the exception handler has run.
[ bp: Massage commit message. ]
Fixes: 597cfe48212a ("x86/boot/compressed/64: Setup a GHCB-based VC Exception handler")
Reported-by: Tom Dohrmann <erbse.13@gmx.de>
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Cc: <stable@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/boot/compressed/sev-es.c | 5 +++++
arch/x86/kernel/sev-es-shared.c | 31 +++++++++++++++++++++++++++++--
2 files changed, 34 insertions(+), 2 deletions(-)
--- a/arch/x86/boot/compressed/sev-es.c
+++ b/arch/x86/boot/compressed/sev-es.c
@@ -111,6 +111,11 @@ static enum es_result vc_ioio_check(stru
return ES_OK;
}
+static bool fault_in_kernel_space(unsigned long address)
+{
+ return false;
+}
+
#undef __init
#undef __pa
#define __init
--- a/arch/x86/kernel/sev-es-shared.c
+++ b/arch/x86/kernel/sev-es-shared.c
@@ -217,6 +217,23 @@ fail:
asm volatile("hlt\n");
}
+static enum es_result vc_insn_string_check(struct es_em_ctxt *ctxt,
+ unsigned long address,
+ bool write)
+{
+ if (user_mode(ctxt->regs) && fault_in_kernel_space(address)) {
+ ctxt->fi.vector = X86_TRAP_PF;
+ ctxt->fi.error_code = X86_PF_USER;
+ ctxt->fi.cr2 = address;
+ if (write)
+ ctxt->fi.error_code |= X86_PF_WRITE;
+
+ return ES_EXCEPTION;
+ }
+
+ return ES_OK;
+}
+
static enum es_result vc_insn_string_read(struct es_em_ctxt *ctxt,
void *src, char *buf,
unsigned int data_size,
@@ -224,7 +241,12 @@ static enum es_result vc_insn_string_rea
bool backwards)
{
int i, b = backwards ? -1 : 1;
- enum es_result ret = ES_OK;
+ unsigned long address = (unsigned long)src;
+ enum es_result ret;
+
+ ret = vc_insn_string_check(ctxt, address, false);
+ if (ret != ES_OK)
+ return ret;
for (i = 0; i < count; i++) {
void *s = src + (i * data_size * b);
@@ -245,7 +267,12 @@ static enum es_result vc_insn_string_wri
bool backwards)
{
int i, s = backwards ? -1 : 1;
- enum es_result ret = ES_OK;
+ unsigned long address = (unsigned long)dst;
+ enum es_result ret;
+
+ ret = vc_insn_string_check(ctxt, address, true);
+ if (ret != ES_OK)
+ return ret;
for (i = 0; i < count; i++) {
void *d = dst + (i * data_size * s);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 100/202] tcp: check mptcp-level constraints for backlog coalescing
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 099/202] x86/sev: Check for user-space IOIO pointing to kernel space Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 101/202] netfilter: nft_payload: fix wrong mac header matching Greg Kroah-Hartman
` (107 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Paasch, Mat Martineau,
Paolo Abeni, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paolo Abeni <pabeni@redhat.com>
commit 6db8a37dfc541e059851652cfd4f0bb13b8ff6af upstream.
The MPTCP protocol can acquire the subflow-level socket lock and
cause the tcp backlog usage. When inserting new skbs into the
backlog, the stack will try to coalesce them.
Currently, we have no check in place to ensure that such coalescing
will respect the MPTCP-level DSS, and that may cause data stream
corruption, as reported by Christoph.
Address the issue by adding the relevant admission check for coalescing
in tcp_add_backlog().
Note the issue is not easy to reproduce, as the MPTCP protocol tries
hard to avoid acquiring the subflow-level socket lock.
Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path")
Cc: stable@vger.kernel.org
Reported-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/420
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20231018-send-net-20231018-v1-2-17ecb002e41d@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_ipv4.c | 1 +
1 file changed, 1 insertion(+)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1832,6 +1832,7 @@ bool tcp_add_backlog(struct sock *sk, st
#ifdef CONFIG_TLS_DEVICE
tail->decrypted != skb->decrypted ||
#endif
+ !mptcp_skb_can_collapse(tail, skb) ||
thtail->doff != th->doff ||
memcmp(thtail + 1, th + 1, hdrlen - sizeof(*th)))
goto no_coalesce;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 101/202] netfilter: nft_payload: fix wrong mac header matching
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 100/202] tcp: check mptcp-level constraints for backlog coalescing Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 102/202] nvmet-tcp: Fix a possible UAF in queue intialization setup Greg Kroah-Hartman
` (106 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Blažej Krajňák,
Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit d351c1ea2de3e36e608fc355d8ae7d0cc80e6cd6 upstream.
mcast packets get looped back to the local machine.
Such packets have a 0-length mac header, we should treat
this like "mac header not set" and abort rule evaluation.
As-is, we just copy data from the network header instead.
Fixes: 96518518cc41 ("netfilter: add nftables")
Reported-by: Blažej Krajňák <krajnak@levonet.sk>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_payload.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nft_payload.c
+++ b/net/netfilter/nft_payload.c
@@ -93,7 +93,7 @@ void nft_payload_eval(const struct nft_e
switch (priv->base) {
case NFT_PAYLOAD_LL_HEADER:
- if (!skb_mac_header_was_set(skb))
+ if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) == 0)
goto err;
if (skb_vlan_tag_present(skb)) {
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 102/202] nvmet-tcp: Fix a possible UAF in queue intialization setup
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 101/202] netfilter: nft_payload: fix wrong mac header matching Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 103/202] drm/i915: Retry gtt fault when out of fence registers Greg Kroah-Hartman
` (105 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alon Zahavi, Sagi Grimberg,
Christoph Hellwig, Chaitanya Kulkarni, Keith Busch
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sagi Grimberg <sagi@grimberg.me>
commit d920abd1e7c4884f9ecd0749d1921b7ab19ddfbd upstream.
>From Alon:
"Due to a logical bug in the NVMe-oF/TCP subsystem in the Linux kernel,
a malicious user can cause a UAF and a double free, which may lead to
RCE (may also lead to an LPE in case the attacker already has local
privileges)."
Hence, when a queue initialization fails after the ahash requests are
allocated, it is guaranteed that the queue removal async work will be
called, hence leave the deallocation to the queue removal.
Also, be extra careful not to continue processing the socket, so set
queue rcv_state to NVMET_TCP_RECV_ERR upon a socket error.
Cc: stable@vger.kernel.org
Reported-by: Alon Zahavi <zahavi.alon@gmail.com>
Tested-by: Alon Zahavi <zahavi.alon@gmail.com>
Signed-off-by: Sagi Grimberg <sagi@grimberg.me>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/target/tcp.c | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -336,6 +336,7 @@ static void nvmet_tcp_fatal_error(struct
static void nvmet_tcp_socket_error(struct nvmet_tcp_queue *queue, int status)
{
+ queue->rcv_state = NVMET_TCP_RECV_ERR;
if (status == -EPIPE || status == -ECONNRESET)
kernel_sock_shutdown(queue->sock, SHUT_RDWR);
else
@@ -882,15 +883,11 @@ static int nvmet_tcp_handle_icreq(struct
iov.iov_len = sizeof(*icresp);
ret = kernel_sendmsg(queue->sock, &msg, &iov, 1, iov.iov_len);
if (ret < 0)
- goto free_crypto;
+ return ret; /* queue removal will cleanup */
queue->state = NVMET_TCP_Q_LIVE;
nvmet_prepare_receive_pdu(queue);
return 0;
-free_crypto:
- if (queue->hdr_digest || queue->data_digest)
- nvmet_tcp_free_crypto(queue);
- return ret;
}
static void nvmet_tcp_handle_req_failure(struct nvmet_tcp_queue *queue,
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 103/202] drm/i915: Retry gtt fault when out of fence registers
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 102/202] nvmet-tcp: Fix a possible UAF in queue intialization setup Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 104/202] qed: fix LL2 RX buffer allocation Greg Kroah-Hartman
` (104 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Andi Shyti,
Rodrigo Vivi
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
commit e339c6d628fe66c9b64bf31040a55770952aec57 upstream.
If we can't find a free fence register to handle a fault in the GMADR
range just return VM_FAULT_NOPAGE without populating the PTE so that
userspace will retry the access and trigger another fault. Eventually
we should find a free fence and the fault will get properly handled.
A further improvement idea might be to reserve a fence (or one per CPU?)
for the express purpose of handling faults without having to retry. But
that would require some additional work.
Looks like this may have gotten broken originally by
commit 39965b376601 ("drm/i915: don't trash the gtt when running out of fences")
as that changed the errno to -EDEADLK which wasn't handle by the gtt
fault code either. But later in commit 2feeb52859fc ("drm/i915/gt: Fix
-EDEADLK handling regression") I changed it again to -ENOBUFS as -EDEADLK
was now getting used for the ww mutex dance. So this fix only makes
sense after that last commit.
Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9479
Fixes: 2feeb52859fc ("drm/i915/gt: Fix -EDEADLK handling regression")
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231012132801.16292-1-ville.syrjala@linux.intel.com
Reviewed-by: Andi Shyti <andi.shyti@linux.intel.com>
(cherry picked from commit 7f403caabe811b88ab0de3811ff3f4782c415761)
Signed-off-by: Rodrigo Vivi <rodrigo.vivi@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c
+++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c
@@ -222,6 +222,7 @@ static vm_fault_t i915_error_to_vmf_faul
case 0:
case -EAGAIN:
case -ENOSPC: /* transient failure to evict? */
+ case -ENOBUFS: /* temporarily out of fences? */
case -ERESTARTSYS:
case -EINTR:
case -EBUSY:
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 104/202] qed: fix LL2 RX buffer allocation
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 103/202] drm/i915: Retry gtt fault when out of fence registers Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 105/202] xfrm: fix a data-race in xfrm_gen_index() Greg Kroah-Hartman
` (103 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David S. Miller, Manish Chopra
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Manish Chopra <manishc@marvell.com>
commit 2f3389c73832ad90b63208c0fc281ad080114c7a upstream.
Driver allocates the LL2 rx buffers from kmalloc()
area to construct the skb using slab_build_skb()
The required size allocation seems to have overlooked
for accounting both skb_shared_info size and device
placement padding bytes which results into the below
panic when doing skb_put() for a standard MTU sized frame.
skbuff: skb_over_panic: text:ffffffffc0b0225f len:1514 put:1514
head:ff3dabceaf39c000 data:ff3dabceaf39c042 tail:0x62c end:0x566
dev:<NULL>
…
skb_panic+0x48/0x4a
skb_put.cold+0x10/0x10
qed_ll2b_complete_rx_packet+0x14f/0x260 [qed]
qed_ll2_rxq_handle_completion.constprop.0+0x169/0x200 [qed]
qed_ll2_rxq_completion+0xba/0x320 [qed]
qed_int_sp_dpc+0x1a7/0x1e0 [qed]
This patch fixes this by accouting skb_shared_info and device
placement padding size bytes when allocating the buffers.
Cc: David S. Miller <davem@davemloft.net>
Fixes: 0a7fb11c23c0 ("qed: Add Light L2 support")
Signed-off-by: Manish Chopra <manishc@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
@@ -87,7 +87,10 @@ static void qed_ll2b_complete_tx_packet(
static int qed_ll2_alloc_buffer(struct qed_dev *cdev,
u8 **data, dma_addr_t *phys_addr)
{
- *data = kmalloc(cdev->ll2->rx_size, GFP_ATOMIC);
+ size_t size = cdev->ll2->rx_size + NET_SKB_PAD +
+ SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
+
+ *data = kmalloc(size, GFP_ATOMIC);
if (!(*data)) {
DP_INFO(cdev, "Failed to allocate LL2 buffer data\n");
return -ENOMEM;
@@ -2541,7 +2544,7 @@ static int qed_ll2_start(struct qed_dev
INIT_LIST_HEAD(&cdev->ll2->list);
spin_lock_init(&cdev->ll2->lock);
- cdev->ll2->rx_size = NET_SKB_PAD + ETH_HLEN +
+ cdev->ll2->rx_size = PRM_DMA_PAD_BYTES_NUM + ETH_HLEN +
L1_CACHE_BYTES + params->mtu;
/* Allocate memory for LL2.
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 105/202] xfrm: fix a data-race in xfrm_gen_index()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 104/202] qed: fix LL2 RX buffer allocation Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 106/202] xfrm: interface: use DEV_STATS_INC() Greg Kroah-Hartman
` (102 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Steffen Klassert, Herbert Xu
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 3e4bc23926b83c3c67e5f61ae8571602754131a6 upstream.
xfrm_gen_index() mutual exclusion uses net->xfrm.xfrm_policy_lock.
This means we must use a per-netns idx_generator variable,
instead of a static one.
Alternative would be to use an atomic variable.
syzbot reported:
BUG: KCSAN: data-race in xfrm_sk_policy_insert / xfrm_sk_policy_insert
write to 0xffffffff87005938 of 4 bytes by task 29466 on cpu 0:
xfrm_gen_index net/xfrm/xfrm_policy.c:1385 [inline]
xfrm_sk_policy_insert+0x262/0x640 net/xfrm/xfrm_policy.c:2347
xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
__sys_setsockopt+0x1c9/0x230 net/socket.c:2263
__do_sys_setsockopt net/socket.c:2274 [inline]
__se_sys_setsockopt net/socket.c:2271 [inline]
__x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read to 0xffffffff87005938 of 4 bytes by task 29460 on cpu 1:
xfrm_sk_policy_insert+0x13e/0x640
xfrm_user_policy+0x413/0x540 net/xfrm/xfrm_state.c:2639
do_ipv6_setsockopt+0x1317/0x2ce0 net/ipv6/ipv6_sockglue.c:943
ipv6_setsockopt+0x57/0x130 net/ipv6/ipv6_sockglue.c:1012
rawv6_setsockopt+0x21e/0x410 net/ipv6/raw.c:1054
sock_common_setsockopt+0x61/0x70 net/core/sock.c:3697
__sys_setsockopt+0x1c9/0x230 net/socket.c:2263
__do_sys_setsockopt net/socket.c:2274 [inline]
__se_sys_setsockopt net/socket.c:2271 [inline]
__x64_sys_setsockopt+0x66/0x80 net/socket.c:2271
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x00006ad8 -> 0x00006b18
Reported by Kernel Concurrency Sanitizer on:
CPU: 1 PID: 29460 Comm: syz-executor.1 Not tainted 6.5.0-rc5-syzkaller-00243-g9106536c1aa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Fixes: 1121994c803f ("netns xfrm: policy insertion in netns")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/netns/xfrm.h | 1 +
net/xfrm/xfrm_policy.c | 6 ++----
2 files changed, 3 insertions(+), 4 deletions(-)
--- a/include/net/netns/xfrm.h
+++ b/include/net/netns/xfrm.h
@@ -49,6 +49,7 @@ struct netns_xfrm {
struct list_head policy_all;
struct hlist_head *policy_byidx;
unsigned int policy_idx_hmask;
+ unsigned int idx_generator;
struct hlist_head policy_inexact[XFRM_POLICY_MAX];
struct xfrm_policy_hash policy_bydst[XFRM_POLICY_MAX];
unsigned int policy_count[XFRM_POLICY_MAX * 2];
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1371,8 +1371,6 @@ EXPORT_SYMBOL(xfrm_policy_hash_rebuild);
* of an absolute inpredictability of ordering of rules. This will not pass. */
static u32 xfrm_gen_index(struct net *net, int dir, u32 index)
{
- static u32 idx_generator;
-
for (;;) {
struct hlist_head *list;
struct xfrm_policy *p;
@@ -1380,8 +1378,8 @@ static u32 xfrm_gen_index(struct net *ne
int found;
if (!index) {
- idx = (idx_generator | dir);
- idx_generator += 8;
+ idx = (net->xfrm.idx_generator | dir);
+ net->xfrm.idx_generator += 8;
} else {
idx = index;
index = 0;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 106/202] xfrm: interface: use DEV_STATS_INC()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 105/202] xfrm: fix a data-race in xfrm_gen_index() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 107/202] net: ipv4: fix return value check in esp_remove_trailer Greg Kroah-Hartman
` (101 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Steffen Klassert
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit f7c4e3e5d4f6609b4725a97451948ca2e425379a upstream.
syzbot/KCSAN reported data-races in xfrm whenever dev->stats fields
are updated.
It appears all of these updates can happen from multiple cpus.
Adopt SMP safe DEV_STATS_INC() to update dev->stats fields.
BUG: KCSAN: data-race in xfrmi_xmit / xfrmi_xmit
read-write to 0xffff88813726b160 of 8 bytes by task 23986 on cpu 1:
xfrmi_xmit+0x74e/0xb20 net/xfrm/xfrm_interface_core.c:583
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
neigh_connected_output+0x231/0x2a0 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:542 [inline]
ip_finish_output2+0x74a/0x850 net/ipv4/ip_output.c:230
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:127 [inline]
ip_send_skb+0x72/0xe0 net/ipv4/ip_output.c:1487
udp_send_skb+0x6a4/0x990 net/ipv4/udp.c:963
udp_sendmsg+0x1249/0x12d0 net/ipv4/udp.c:1246
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:840
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2540
___sys_sendmsg net/socket.c:2594 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2680
__do_sys_sendmmsg net/socket.c:2709 [inline]
__se_sys_sendmmsg net/socket.c:2706 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2706
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
read-write to 0xffff88813726b160 of 8 bytes by task 23987 on cpu 0:
xfrmi_xmit+0x74e/0xb20 net/xfrm/xfrm_interface_core.c:583
__netdev_start_xmit include/linux/netdevice.h:4889 [inline]
netdev_start_xmit include/linux/netdevice.h:4903 [inline]
xmit_one net/core/dev.c:3544 [inline]
dev_hard_start_xmit+0x11b/0x3f0 net/core/dev.c:3560
__dev_queue_xmit+0xeee/0x1de0 net/core/dev.c:4340
dev_queue_xmit include/linux/netdevice.h:3082 [inline]
neigh_connected_output+0x231/0x2a0 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:542 [inline]
ip_finish_output2+0x74a/0x850 net/ipv4/ip_output.c:230
ip_finish_output+0xf4/0x240 net/ipv4/ip_output.c:318
NF_HOOK_COND include/linux/netfilter.h:293 [inline]
ip_output+0xe5/0x1b0 net/ipv4/ip_output.c:432
dst_output include/net/dst.h:458 [inline]
ip_local_out net/ipv4/ip_output.c:127 [inline]
ip_send_skb+0x72/0xe0 net/ipv4/ip_output.c:1487
udp_send_skb+0x6a4/0x990 net/ipv4/udp.c:963
udp_sendmsg+0x1249/0x12d0 net/ipv4/udp.c:1246
inet_sendmsg+0x63/0x80 net/ipv4/af_inet.c:840
sock_sendmsg_nosec net/socket.c:730 [inline]
sock_sendmsg net/socket.c:753 [inline]
____sys_sendmsg+0x37c/0x4d0 net/socket.c:2540
___sys_sendmsg net/socket.c:2594 [inline]
__sys_sendmmsg+0x269/0x500 net/socket.c:2680
__do_sys_sendmmsg net/socket.c:2709 [inline]
__se_sys_sendmmsg net/socket.c:2706 [inline]
__x64_sys_sendmmsg+0x57/0x60 net/socket.c:2706
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
value changed: 0x00000000000010d7 -> 0x00000000000010d8
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 23987 Comm: syz-executor.5 Not tainted 6.5.0-syzkaller-10885-g0468be89b3fa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Fixes: f203b76d7809 ("xfrm: Add virtual xfrm interfaces")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/xfrm/xfrm_interface_core.c | 22 ++++++++++------------
1 file changed, 10 insertions(+), 12 deletions(-)
--- a/net/xfrm/xfrm_interface_core.c
+++ b/net/xfrm/xfrm_interface_core.c
@@ -274,8 +274,8 @@ static int xfrmi_rcv_cb(struct sk_buff *
skb->dev = dev;
if (err) {
- dev->stats.rx_errors++;
- dev->stats.rx_dropped++;
+ DEV_STATS_INC(dev, rx_errors);
+ DEV_STATS_INC(dev, rx_dropped);
return 0;
}
@@ -309,7 +309,6 @@ static int
xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
{
struct xfrm_if *xi = netdev_priv(dev);
- struct net_device_stats *stats = &xi->dev->stats;
struct dst_entry *dst = skb_dst(skb);
unsigned int length = skb->len;
struct net_device *tdev;
@@ -335,7 +334,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct
tdev = dst->dev;
if (tdev == dev) {
- stats->collisions++;
+ DEV_STATS_INC(dev, collisions);
net_warn_ratelimited("%s: Local routing loop detected!\n",
dev->name);
goto tx_err_dst_release;
@@ -378,13 +377,13 @@ xmit:
tstats->tx_packets++;
u64_stats_update_end(&tstats->syncp);
} else {
- stats->tx_errors++;
- stats->tx_aborted_errors++;
+ DEV_STATS_INC(dev, tx_errors);
+ DEV_STATS_INC(dev, tx_aborted_errors);
}
return 0;
tx_err_link_failure:
- stats->tx_carrier_errors++;
+ DEV_STATS_INC(dev, tx_carrier_errors);
dst_link_failure(skb);
tx_err_dst_release:
dst_release(dst);
@@ -394,7 +393,6 @@ tx_err_dst_release:
static netdev_tx_t xfrmi_xmit(struct sk_buff *skb, struct net_device *dev)
{
struct xfrm_if *xi = netdev_priv(dev);
- struct net_device_stats *stats = &xi->dev->stats;
struct dst_entry *dst = skb_dst(skb);
struct flowi fl;
int ret;
@@ -411,7 +409,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_
dst = ip6_route_output(dev_net(dev), NULL, &fl.u.ip6);
if (dst->error) {
dst_release(dst);
- stats->tx_carrier_errors++;
+ DEV_STATS_INC(dev, tx_carrier_errors);
goto tx_err;
}
skb_dst_set(skb, dst);
@@ -427,7 +425,7 @@ static netdev_tx_t xfrmi_xmit(struct sk_
fl.u.ip4.flowi4_flags |= FLOWI_FLAG_ANYSRC;
rt = __ip_route_output_key(dev_net(dev), &fl.u.ip4);
if (IS_ERR(rt)) {
- stats->tx_carrier_errors++;
+ DEV_STATS_INC(dev, tx_carrier_errors);
goto tx_err;
}
skb_dst_set(skb, &rt->dst);
@@ -446,8 +444,8 @@ static netdev_tx_t xfrmi_xmit(struct sk_
return NETDEV_TX_OK;
tx_err:
- stats->tx_errors++;
- stats->tx_dropped++;
+ DEV_STATS_INC(dev, tx_errors);
+ DEV_STATS_INC(dev, tx_dropped);
kfree_skb(skb);
return NETDEV_TX_OK;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 107/202] net: ipv4: fix return value check in esp_remove_trailer
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 106/202] xfrm: interface: use DEV_STATS_INC() Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 108/202] net: ipv6: " Greg Kroah-Hartman
` (100 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Steffen Klassert
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
commit 513f61e2193350c7a345da98559b80f61aec4fa6 upstream.
In esp_remove_trailer(), to avoid an unexpected result returned by
pskb_trim, we should check the return value of pskb_trim().
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/esp4.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -741,7 +741,9 @@ static inline int esp_remove_trailer(str
skb->csum = csum_block_sub(skb->csum, csumdiff,
skb->len - trimlen);
}
- pskb_trim(skb, skb->len - trimlen);
+ ret = pskb_trim(skb, skb->len - trimlen);
+ if (unlikely(ret))
+ return ret;
ret = nexthdr[1];
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 108/202] net: ipv6: fix return value check in esp_remove_trailer
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 107/202] net: ipv4: fix return value check in esp_remove_trailer Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 109/202] net: rfkill: gpio: prevent value glitch during probe Greg Kroah-Hartman
` (99 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Steffen Klassert
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
commit dad4e491e30b20f4dc615c9da65d2142d703b5c2 upstream.
In esp_remove_trailer(), to avoid an unexpected result returned by
pskb_trim, we should check the return value of pskb_trim().
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/esp6.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -776,7 +776,9 @@ static inline int esp_remove_trailer(str
skb->csum = csum_block_sub(skb->csum, csumdiff,
skb->len - trimlen);
}
- pskb_trim(skb, skb->len - trimlen);
+ ret = pskb_trim(skb, skb->len - trimlen);
+ if (unlikely(ret))
+ return ret;
ret = nexthdr[1];
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 109/202] net: rfkill: gpio: prevent value glitch during probe
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 108/202] net: ipv6: " Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 110/202] tcp: fix excessive TLP and RACK timeouts from HZ rounding Greg Kroah-Hartman
` (98 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Josua Mayer, Johannes Berg
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josua Mayer <josua@solid-run.com>
commit b2f750c3a80b285cd60c9346f8c96bd0a2a66cde upstream.
When either reset- or shutdown-gpio have are initially deasserted,
e.g. after a reboot - or when the hardware does not include pull-down,
there will be a short toggle of both IOs to logical 0 and back to 1.
It seems that the rfkill default is unblocked, so the driver should not
glitch to output low during probe.
It can lead e.g. to unexpected lte modem reconnect:
[1] root@localhost:~# dmesg | grep "usb 2-1"
[ 2.136124] usb 2-1: new SuperSpeed USB device number 2 using xhci-hcd
[ 21.215278] usb 2-1: USB disconnect, device number 2
[ 28.833977] usb 2-1: new SuperSpeed USB device number 3 using xhci-hcd
The glitch has been discovered on an arm64 board, now that device-tree
support for the rfkill-gpio driver has finally appeared :).
Change the flags for devm_gpiod_get_optional from GPIOD_OUT_LOW to
GPIOD_ASIS to avoid any glitches.
The rfkill driver will set the intended value during rfkill_sync_work.
Fixes: 7176ba23f8b5 ("net: rfkill: add generic gpio rfkill driver")
Signed-off-by: Josua Mayer <josua@solid-run.com>
Link: https://lore.kernel.org/r/20231004163928.14609-1-josua@solid-run.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rfkill/rfkill-gpio.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -98,13 +98,13 @@ static int rfkill_gpio_probe(struct plat
rfkill->clk = devm_clk_get(&pdev->dev, NULL);
- gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_OUT_LOW);
+ gpio = devm_gpiod_get_optional(&pdev->dev, "reset", GPIOD_ASIS);
if (IS_ERR(gpio))
return PTR_ERR(gpio);
rfkill->reset_gpio = gpio;
- gpio = devm_gpiod_get_optional(&pdev->dev, "shutdown", GPIOD_OUT_LOW);
+ gpio = devm_gpiod_get_optional(&pdev->dev, "shutdown", GPIOD_ASIS);
if (IS_ERR(gpio))
return PTR_ERR(gpio);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 110/202] tcp: fix excessive TLP and RACK timeouts from HZ rounding
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 109/202] net: rfkill: gpio: prevent value glitch during probe Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 111/202] tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Greg Kroah-Hartman
` (97 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Neal Cardwell,
Yuchung Cheng, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Neal Cardwell <ncardwell@google.com>
commit 1c2709cfff1dedbb9591e989e2f001484208d914 upstream.
We discovered from packet traces of slow loss recovery on kernels with
the default HZ=250 setting (and min_rtt < 1ms) that after reordering,
when receiving a SACKed sequence range, the RACK reordering timer was
firing after about 16ms rather than the desired value of roughly
min_rtt/4 + 2ms. The problem is largely due to the RACK reorder timer
calculation adding in TCP_TIMEOUT_MIN, which is 2 jiffies. On kernels
with HZ=250, this is 2*4ms = 8ms. The TLP timer calculation has the
exact same issue.
This commit fixes the TLP transmit timer and RACK reordering timer
floor calculation to more closely match the intended 2ms floor even on
kernels with HZ=250. It does this by adding in a new
TCP_TIMEOUT_MIN_US floor of 2000 us and then converting to jiffies,
instead of the current approach of converting to jiffies and then
adding th TCP_TIMEOUT_MIN value of 2 jiffies.
Our testing has verified that on kernels with HZ=1000, as expected,
this does not produce significant changes in behavior, but on kernels
with the default HZ=250 the latency improvement can be large. For
example, our tests show that for HZ=250 kernels at low RTTs this fix
roughly halves the latency for the RACK reorder timer: instead of
mostly firing at 16ms it mostly fires at 8ms.
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Fixes: bb4d991a28cc ("tcp: adjust tail loss probe timeout")
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231015174700.2206872-1-ncardwell.sw@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/tcp.h | 3 +++
net/ipv4/tcp_output.c | 9 +++++----
net/ipv4/tcp_recovery.c | 2 +-
3 files changed, 9 insertions(+), 5 deletions(-)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -141,6 +141,9 @@ void tcp_time_wait(struct sock *sk, int
#define TCP_RTO_MAX ((unsigned)(120*HZ))
#define TCP_RTO_MIN ((unsigned)(HZ/5))
#define TCP_TIMEOUT_MIN (2U) /* Min timeout for TCP timers in jiffies */
+
+#define TCP_TIMEOUT_MIN_US (2*USEC_PER_MSEC) /* Min TCP timeout in microsecs */
+
#define TCP_TIMEOUT_INIT ((unsigned)(1*HZ)) /* RFC6298 2.1 initial RTO value */
#define TCP_TIMEOUT_FALLBACK ((unsigned)(3*HZ)) /* RFC 1122 initial RTO value, now
* used as a fallback RTO for the
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2727,7 +2727,7 @@ bool tcp_schedule_loss_probe(struct sock
{
struct inet_connection_sock *icsk = inet_csk(sk);
struct tcp_sock *tp = tcp_sk(sk);
- u32 timeout, rto_delta_us;
+ u32 timeout, timeout_us, rto_delta_us;
int early_retrans;
/* Don't do any loss probe on a Fast Open connection before 3WHS
@@ -2751,11 +2751,12 @@ bool tcp_schedule_loss_probe(struct sock
* sample is available then probe after TCP_TIMEOUT_INIT.
*/
if (tp->srtt_us) {
- timeout = usecs_to_jiffies(tp->srtt_us >> 2);
+ timeout_us = tp->srtt_us >> 2;
if (tp->packets_out == 1)
- timeout += TCP_RTO_MIN;
+ timeout_us += tcp_rto_min_us(sk);
else
- timeout += TCP_TIMEOUT_MIN;
+ timeout_us += TCP_TIMEOUT_MIN_US;
+ timeout = usecs_to_jiffies(timeout_us);
} else {
timeout = TCP_TIMEOUT_INIT;
}
--- a/net/ipv4/tcp_recovery.c
+++ b/net/ipv4/tcp_recovery.c
@@ -109,7 +109,7 @@ bool tcp_rack_mark_lost(struct sock *sk)
tp->rack.advanced = 0;
tcp_rack_detect_loss(sk, &timeout);
if (timeout) {
- timeout = usecs_to_jiffies(timeout) + TCP_TIMEOUT_MIN;
+ timeout = usecs_to_jiffies(timeout + TCP_TIMEOUT_MIN_US);
inet_csk_reset_xmit_timer(sk, ICSK_TIME_REO_TIMEOUT,
timeout, inet_csk(sk)->icsk_rto);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 111/202] tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 110/202] tcp: fix excessive TLP and RACK timeouts from HZ rounding Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 112/202] tun: prevent negative ifindex Greg Kroah-Hartman
` (96 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Eric Dumazet,
Neal Cardwell, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit f921a4a5bffa8a0005b190fb9421a7fc1fd716b6 upstream.
In commit 75eefc6c59fd ("tcp: tsq: add a shortcut in tcp_small_queue_check()")
we allowed to send an skb regardless of TSQ limits being hit if rtx queue
was empty or had a single skb, in order to better fill the pipe
when/if TX completions were slow.
Then later, commit 75c119afe14f ("tcp: implement rb-tree based
retransmit queue") accidentally removed the special case for
one skb in rtx queue.
Stefan Wahren reported a regression in single TCP flow throughput
using a 100Mbit fec link, starting from commit 65466904b015 ("tcp: adjust
TSO packet sizes based on min_rtt"). This last commit only made the
regression more visible, because it locked the TCP flow on a particular
behavior where TSQ prevented two skbs being pushed downstream,
adding silences on the wire between each TSO packet.
Many thanks to Stefan for his invaluable help !
Fixes: 75c119afe14f ("tcp: implement rb-tree based retransmit queue")
Link: https://lore.kernel.org/netdev/7f31ddc8-9971-495e-a1f6-819df542e0af@gmx.net/
Reported-by: Stefan Wahren <wahrenst@gmx.net>
Tested-by: Stefan Wahren <wahrenst@gmx.net>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Link: https://lore.kernel.org/r/20231017124526.4060202-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/tcp_output.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2482,6 +2482,18 @@ static bool tcp_pacing_check(struct sock
return true;
}
+static bool tcp_rtx_queue_empty_or_single_skb(const struct sock *sk)
+{
+ const struct rb_node *node = sk->tcp_rtx_queue.rb_node;
+
+ /* No skb in the rtx queue. */
+ if (!node)
+ return true;
+
+ /* Only one skb in rtx queue. */
+ return !node->rb_left && !node->rb_right;
+}
+
/* TCP Small Queues :
* Control number of packets in qdisc/devices to two packets / or ~1 ms.
* (These limits are doubled for retransmits)
@@ -2519,12 +2531,12 @@ static bool tcp_small_queue_check(struct
limit += extra_bytes;
}
if (refcount_read(&sk->sk_wmem_alloc) > limit) {
- /* Always send skb if rtx queue is empty.
+ /* Always send skb if rtx queue is empty or has one skb.
* No need to wait for TX completion to call us back,
* after softirq/tasklet schedule.
* This helps when TX completions are delayed too much.
*/
- if (tcp_rtx_queue_empty(sk))
+ if (tcp_rtx_queue_empty_or_single_skb(sk))
return false;
set_bit(TSQ_THROTTLED, &sk->sk_tsq_flags);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 112/202] tun: prevent negative ifindex
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 111/202] tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Greg Kroah-Hartman
@ 2023-10-23 10:56 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 113/202] ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Greg Kroah-Hartman
` (95 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Willem de Bruijn, Jason Wang, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit cbfbfe3aee718dc4c3c837f5d2463170ee59d78c upstream.
After commit 956db0a13b47 ("net: warn about attempts to register
negative ifindex") syzbot is able to trigger the following splat.
Negative ifindex are not supported.
WARNING: CPU: 1 PID: 6003 at net/core/dev.c:9596 dev_index_reserve+0x104/0x210
Modules linked in:
CPU: 1 PID: 6003 Comm: syz-executor926 Not tainted 6.6.0-rc4-syzkaller-g19af4a4ed414 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : dev_index_reserve+0x104/0x210
lr : dev_index_reserve+0x100/0x210
sp : ffff800096a878e0
x29: ffff800096a87930 x28: ffff0000d04380d0 x27: ffff0000d04380f8
x26: ffff0000d04380f0 x25: 1ffff00012d50f20 x24: 1ffff00012d50f1c
x23: dfff800000000000 x22: ffff8000929c21c0 x21: 00000000ffffffea
x20: ffff0000d04380e0 x19: ffff800096a87900 x18: ffff800096a874c0
x17: ffff800084df5008 x16: ffff80008051f9c4 x15: 0000000000000001
x14: 1fffe0001a087198 x13: 0000000000000000 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000
x8 : ffff0000d41c9bc0 x7 : 0000000000000000 x6 : 0000000000000000
x5 : ffff800091763d88 x4 : 0000000000000000 x3 : ffff800084e04748
x2 : 0000000000000001 x1 : 00000000fead71c7 x0 : 0000000000000000
Call trace:
dev_index_reserve+0x104/0x210
register_netdevice+0x598/0x1074 net/core/dev.c:10084
tun_set_iff+0x630/0xb0c drivers/net/tun.c:2850
__tun_chr_ioctl+0x788/0x2af8 drivers/net/tun.c:3118
tun_chr_ioctl+0x38/0x4c drivers/net/tun.c:3403
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:857
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x58/0x16c arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595
irq event stamp: 11348
hardirqs last enabled at (11347): [<ffff80008a716574>] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:151 [inline]
hardirqs last enabled at (11347): [<ffff80008a716574>] _raw_spin_unlock_irqrestore+0x38/0x98 kernel/locking/spinlock.c:194
hardirqs last disabled at (11348): [<ffff80008a627820>] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:436
softirqs last enabled at (11138): [<ffff8000887ca53c>] spin_unlock_bh include/linux/spinlock.h:396 [inline]
softirqs last enabled at (11138): [<ffff8000887ca53c>] release_sock+0x15c/0x1b0 net/core/sock.c:3531
softirqs last disabled at (11136): [<ffff8000887ca41c>] spin_lock_bh include/linux/spinlock.h:356 [inline]
softirqs last disabled at (11136): [<ffff8000887ca41c>] release_sock+0x3c/0x1b0 net/core/sock.c:3518
Fixes: fb7589a16216 ("tun: Add ability to create tun device with given index")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Link: https://lore.kernel.org/r/20231016180851.3560092-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/tun.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -3064,10 +3064,11 @@ static long __tun_chr_ioctl(struct file
struct net *net = sock_net(&tfile->sk);
struct tun_struct *tun;
void __user* argp = (void __user*)arg;
- unsigned int ifindex, carrier;
+ unsigned int carrier;
struct ifreq ifr;
kuid_t owner;
kgid_t group;
+ int ifindex;
int sndbuf;
int vnet_hdr_sz;
int le;
@@ -3124,7 +3125,9 @@ static long __tun_chr_ioctl(struct file
ret = -EFAULT;
if (copy_from_user(&ifindex, argp, sizeof(ifindex)))
goto unlock;
-
+ ret = -EINVAL;
+ if (ifindex < 0)
+ goto unlock;
ret = 0;
tfile->ifindex = ifindex;
goto unlock;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 113/202] ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-10-23 10:56 ` [PATCH 5.10 112/202] tun: prevent negative ifindex Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 114/202] net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Greg Kroah-Hartman
` (94 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Simon Horman,
David Ahern, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
commit 195374d893681da43a39796e53b30ac4f20400c4 upstream.
syzbot reported a data-race while accessing nh->nh_saddr_genid [1]
Add annotations, but leave the code lazy as intended.
[1]
BUG: KCSAN: data-race in fib_select_path / fib_select_path
write to 0xffff8881387166f0 of 4 bytes by task 6778 on cpu 1:
fib_info_update_nhc_saddr net/ipv4/fib_semantics.c:1334 [inline]
fib_result_prefsrc net/ipv4/fib_semantics.c:1354 [inline]
fib_select_path+0x292/0x330 net/ipv4/fib_semantics.c:2269
ip_route_output_key_hash_rcu+0x659/0x12c0 net/ipv4/route.c:2810
ip_route_output_key_hash net/ipv4/route.c:2644 [inline]
__ip_route_output_key include/net/route.h:134 [inline]
ip_route_output_flow+0xa6/0x150 net/ipv4/route.c:2872
send4+0x1f5/0x520 drivers/net/wireguard/socket.c:61
wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:175
wg_socket_send_buffer_to_peer+0xd6/0x100 drivers/net/wireguard/socket.c:200
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x10c/0x150 drivers/net/wireguard/send.c:51
process_one_work kernel/workqueue.c:2630 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703
worker_thread+0x525/0x730 kernel/workqueue.c:2784
kthread+0x1d7/0x210 kernel/kthread.c:388
ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
read to 0xffff8881387166f0 of 4 bytes by task 6759 on cpu 0:
fib_result_prefsrc net/ipv4/fib_semantics.c:1350 [inline]
fib_select_path+0x1cb/0x330 net/ipv4/fib_semantics.c:2269
ip_route_output_key_hash_rcu+0x659/0x12c0 net/ipv4/route.c:2810
ip_route_output_key_hash net/ipv4/route.c:2644 [inline]
__ip_route_output_key include/net/route.h:134 [inline]
ip_route_output_flow+0xa6/0x150 net/ipv4/route.c:2872
send4+0x1f5/0x520 drivers/net/wireguard/socket.c:61
wg_socket_send_skb_to_peer+0x94/0x130 drivers/net/wireguard/socket.c:175
wg_socket_send_buffer_to_peer+0xd6/0x100 drivers/net/wireguard/socket.c:200
wg_packet_send_handshake_initiation drivers/net/wireguard/send.c:40 [inline]
wg_packet_handshake_send_worker+0x10c/0x150 drivers/net/wireguard/send.c:51
process_one_work kernel/workqueue.c:2630 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2703
worker_thread+0x525/0x730 kernel/workqueue.c:2784
kthread+0x1d7/0x210 kernel/kthread.c:388
ret_from_fork+0x48/0x60 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
value changed: 0x959d3217 -> 0x959d3218
Reported by Kernel Concurrency Sanitizer on:
CPU: 0 PID: 6759 Comm: kworker/u4:15 Not tainted 6.6.0-rc4-syzkaller-00029-gcbf3a2cb156a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker
Fixes: 436c3b66ec98 ("ipv4: Invalidate nexthop cache nh_saddr more correctly.")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20231017192304.82626-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv4/fib_semantics.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1345,15 +1345,18 @@ __be32 fib_info_update_nhc_saddr(struct
unsigned char scope)
{
struct fib_nh *nh;
+ __be32 saddr;
if (nhc->nhc_family != AF_INET)
return inet_select_addr(nhc->nhc_dev, 0, scope);
nh = container_of(nhc, struct fib_nh, nh_common);
- nh->nh_saddr = inet_select_addr(nh->fib_nh_dev, nh->fib_nh_gw4, scope);
- nh->nh_saddr_genid = atomic_read(&net->ipv4.dev_addr_genid);
+ saddr = inet_select_addr(nh->fib_nh_dev, nh->fib_nh_gw4, scope);
- return nh->nh_saddr;
+ WRITE_ONCE(nh->nh_saddr, saddr);
+ WRITE_ONCE(nh->nh_saddr_genid, atomic_read(&net->ipv4.dev_addr_genid));
+
+ return saddr;
}
__be32 fib_result_prefsrc(struct net *net, struct fib_result *res)
@@ -1367,8 +1370,9 @@ __be32 fib_result_prefsrc(struct net *ne
struct fib_nh *nh;
nh = container_of(nhc, struct fib_nh, nh_common);
- if (nh->nh_saddr_genid == atomic_read(&net->ipv4.dev_addr_genid))
- return nh->nh_saddr;
+ if (READ_ONCE(nh->nh_saddr_genid) ==
+ atomic_read(&net->ipv4.dev_addr_genid))
+ return READ_ONCE(nh->nh_saddr);
}
return fib_info_update_nhc_saddr(net, nhc, res->fi->fib_scope);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 114/202] net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 113/202] ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 115/202] i40e: prevent crash on probe if hw registers have invalid values Greg Kroah-Hartman
` (93 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Andrew Lunn,
Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit c53647a5df9e66dd9fedf240198e1fe50d88c286 upstream.
Return a negative error code instead of success.
Fixes: 2f7ca802bdae ("net: Add SMSC LAN9500 USB2.0 10/100 ethernet adapter driver")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lore.kernel.org/r/147927f0-9ada-45cc-81ff-75a19dd30b76@moroto.mountain
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/smsc95xx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -863,7 +863,7 @@ static int smsc95xx_reset(struct usbnet
if (timeout >= 100) {
netdev_warn(dev->net, "timeout waiting for completion of Lite Reset\n");
- return ret;
+ return -ETIMEDOUT;
}
ret = smsc95xx_write_reg(dev, PM_CTRL, PM_CTL_PHY_RST_);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 115/202] i40e: prevent crash on probe if hw registers have invalid values
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 114/202] net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 116/202] net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Greg Kroah-Hartman
` (92 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Schmidt, Simon Horman,
Jakub Kicinski, Pucha Himasekhar Reddy
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
commit fc6f716a5069180c40a8c9b63631e97da34f64a3 upstream.
The hardware provides the indexes of the first and the last available
queue and VF. From the indexes, the driver calculates the numbers of
queues and VFs. In theory, a faulty device might say the last index is
smaller than the first index. In that case, the driver's calculation
would underflow, it would attempt to write to non-existent registers
outside of the ioremapped range and crash.
I ran into this not by having a faulty device, but by an operator error.
I accidentally ran a QE test meant for i40e devices on an ice device.
The test used 'echo i40e > /sys/...ice PCI device.../driver_override',
bound the driver to the device and crashed in one of the wr32 calls in
i40e_clear_hw.
Add checks to prevent underflows in the calculations of num_queues and
num_vfs. With this fix, the wrong device probing reports errors and
returns a failure without crashing.
Fixes: 838d41d92a90 ("i40e: clear all queues and interrupts")
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Link: https://lore.kernel.org/r/20231011233334.336092-2-jacob.e.keller@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/intel/i40e/i40e_common.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/intel/i40e/i40e_common.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_common.c
@@ -1339,7 +1339,7 @@ void i40e_clear_hw(struct i40e_hw *hw)
I40E_PFLAN_QALLOC_FIRSTQ_SHIFT;
j = (val & I40E_PFLAN_QALLOC_LASTQ_MASK) >>
I40E_PFLAN_QALLOC_LASTQ_SHIFT;
- if (val & I40E_PFLAN_QALLOC_VALID_MASK)
+ if (val & I40E_PFLAN_QALLOC_VALID_MASK && j >= base_queue)
num_queues = (j - base_queue) + 1;
else
num_queues = 0;
@@ -1349,7 +1349,7 @@ void i40e_clear_hw(struct i40e_hw *hw)
I40E_PF_VT_PFALLOC_FIRSTVF_SHIFT;
j = (val & I40E_PF_VT_PFALLOC_LASTVF_MASK) >>
I40E_PF_VT_PFALLOC_LASTVF_SHIFT;
- if (val & I40E_PF_VT_PFALLOC_VALID_MASK)
+ if (val & I40E_PF_VT_PFALLOC_VALID_MASK && j >= i)
num_vfs = (j - i) + 1;
else
num_vfs = 0;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 116/202] net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 115/202] i40e: prevent crash on probe if hw registers have invalid values Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 117/202] net/sched: sch_hfsc: upgrade rt to sc when it becomes a inner curve Greg Kroah-Hartman
` (91 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Simon Horman,
Florian Fainelli, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 61b40cefe51af005c72dbdcf975a3d166c6e6406 upstream.
In bcm_sf2_mdio_register(), the class_find_device() will call get_device()
to increment reference count for priv->master_mii_bus->dev if
of_mdio_find_bus() succeeds. If mdiobus_alloc() or mdiobus_register()
fails, it will call get_device() twice without decrement reference count
for the device. And it is the same if bcm_sf2_mdio_register() succeeds but
fails in bcm_sf2_sw_probe(), or if bcm_sf2_sw_probe() succeeds. If the
reference count has not decremented to zero, the dev related resource will
not be freed.
So remove the get_device() in bcm_sf2_mdio_register(), and call
put_device() if mdiobus_alloc() or mdiobus_register() fails and in
bcm_sf2_mdio_unregister() to solve the issue.
And as Simon suggested, unwind from errors for bcm_sf2_mdio_register() and
just return 0 if it succeeds to make it cleaner.
Fixes: 461cd1b03e32 ("net: dsa: bcm_sf2: Register our slave MDIO bus")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Suggested-by: Simon Horman <horms@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231011032419.2423290-1-ruanjinjie@huawei.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/dsa/bcm_sf2.c | 24 +++++++++++++++---------
1 file changed, 15 insertions(+), 9 deletions(-)
--- a/drivers/net/dsa/bcm_sf2.c
+++ b/drivers/net/dsa/bcm_sf2.c
@@ -497,17 +497,16 @@ static int bcm_sf2_mdio_register(struct
dn = of_find_compatible_node(NULL, NULL, "brcm,unimac-mdio");
priv->master_mii_bus = of_mdio_find_bus(dn);
if (!priv->master_mii_bus) {
- of_node_put(dn);
- return -EPROBE_DEFER;
+ err = -EPROBE_DEFER;
+ goto err_of_node_put;
}
- get_device(&priv->master_mii_bus->dev);
priv->master_mii_dn = dn;
priv->slave_mii_bus = mdiobus_alloc();
if (!priv->slave_mii_bus) {
- of_node_put(dn);
- return -ENOMEM;
+ err = -ENOMEM;
+ goto err_put_master_mii_bus_dev;
}
priv->slave_mii_bus->priv = priv;
@@ -564,11 +563,17 @@ static int bcm_sf2_mdio_register(struct
}
err = mdiobus_register(priv->slave_mii_bus);
- if (err && dn) {
- mdiobus_free(priv->slave_mii_bus);
- of_node_put(dn);
- }
+ if (err && dn)
+ goto err_free_slave_mii_bus;
+
+ return 0;
+err_free_slave_mii_bus:
+ mdiobus_free(priv->slave_mii_bus);
+err_put_master_mii_bus_dev:
+ put_device(&priv->master_mii_bus->dev);
+err_of_node_put:
+ of_node_put(dn);
return err;
}
@@ -576,6 +581,7 @@ static void bcm_sf2_mdio_unregister(stru
{
mdiobus_unregister(priv->slave_mii_bus);
mdiobus_free(priv->slave_mii_bus);
+ put_device(&priv->master_mii_bus->dev);
of_node_put(priv->master_mii_dn);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 117/202] net/sched: sch_hfsc: upgrade rt to sc when it becomes a inner curve
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 116/202] net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 118/202] neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Greg Kroah-Hartman
` (90 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian Theune, Budimir Markovic,
Pedro Tammela, Jamal Hadi Salim, Jakub Kicinski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pedro Tammela <pctammela@mojatatu.com>
commit a13b67c9a015c4e21601ef9aa4ec9c5d972df1b4 upstream.
Christian Theune says:
I upgraded from 6.1.38 to 6.1.55 this morning and it broke my traffic shaping script,
leaving me with a non-functional uplink on a remote router.
A 'rt' curve cannot be used as a inner curve (parent class), but we were
allowing such configurations since the qdisc was introduced. Such
configurations would trigger a UAF as Budimir explains:
The parent will have vttree_insert() called on it in init_vf(),
but will not have vttree_remove() called on it in update_vf()
because it does not have the HFSC_FSC flag set.
The qdisc always assumes that inner classes have the HFSC_FSC flag set.
This is by design as it doesn't make sense 'qdisc wise' for an 'rt'
curve to be an inner curve.
Budimir's original patch disallows users to add classes with a 'rt'
parent, but this is too strict as it breaks users that have been using
'rt' as a inner class. Another approach, taken by this patch, is to
upgrade the inner 'rt' into a 'sc', warning the user in the process.
It avoids the UAF reported by Budimir while also being more permissive
to bad scripts/users/code using 'rt' as a inner class.
Users checking the `tc class ls [...]` or `tc class get [...]` dumps would
observe the curve change and are potentially breaking with this change.
v1->v2: https://lore.kernel.org/all/20231013151057.2611860-1-pctammela@mojatatu.com/
- Correct 'Fixes' tag and merge with revert (Jakub)
Cc: Christian Theune <ct@flyingcircus.io>
Cc: Budimir Markovic <markovicbudimir@gmail.com>
Fixes: b3d26c5702c7 ("net/sched: sch_hfsc: Ensure inner classes have fsc curve")
Signed-off-by: Pedro Tammela <pctammela@mojatatu.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Link: https://lore.kernel.org/r/20231017143602.3191556-1-pctammela@mojatatu.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/sched/sch_hfsc.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -903,6 +903,14 @@ hfsc_change_usc(struct hfsc_class *cl, s
cl->cl_flags |= HFSC_USC;
}
+static void
+hfsc_upgrade_rt(struct hfsc_class *cl)
+{
+ cl->cl_fsc = cl->cl_rsc;
+ rtsc_init(&cl->cl_virtual, &cl->cl_fsc, cl->cl_vt, cl->cl_total);
+ cl->cl_flags |= HFSC_FSC;
+}
+
static const struct nla_policy hfsc_policy[TCA_HFSC_MAX + 1] = {
[TCA_HFSC_RSC] = { .len = sizeof(struct tc_service_curve) },
[TCA_HFSC_FSC] = { .len = sizeof(struct tc_service_curve) },
@@ -1012,10 +1020,6 @@ hfsc_change_class(struct Qdisc *sch, u32
if (parent == NULL)
return -ENOENT;
}
- if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
- NL_SET_ERR_MSG(extack, "Invalid parent - parent class must have FSC");
- return -EINVAL;
- }
if (classid == 0 || TC_H_MAJ(classid ^ sch->handle) != 0)
return -EINVAL;
@@ -1068,6 +1072,12 @@ hfsc_change_class(struct Qdisc *sch, u32
cl->cf_tree = RB_ROOT;
sch_tree_lock(sch);
+ /* Check if the inner class is a misconfigured 'rt' */
+ if (!(parent->cl_flags & HFSC_FSC) && parent != &q->root) {
+ NL_SET_ERR_MSG(extack,
+ "Forced curve change on parent 'rt' to 'sc'");
+ hfsc_upgrade_rt(parent);
+ }
qdisc_class_hash_insert(&q->clhash, &cl->cl_common);
list_add_tail(&cl->siblings, &parent->children);
if (parent->level == 0)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 118/202] neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 117/202] net/sched: sch_hfsc: upgrade rt to sc when it becomes a inner curve Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 119/202] netfilter: nft_set_rbtree: .deactivate fails if element has expired Greg Kroah-Hartman
` (89 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Simon Horman,
David Ahern, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 2915240eddba96b37de4c7e9a3d0ac6f9548454b upstream.
When CONFIG_IPV6=n, and building with W=1:
In file included from include/trace/define_trace.h:102,
from include/trace/events/neigh.h:255,
from net/core/net-traces.c:51:
include/trace/events/neigh.h: In function ‘trace_event_raw_event_neigh_create’:
include/trace/events/neigh.h:42:34: error: variable ‘pin6’ set but not used [-Werror=unused-but-set-variable]
42 | struct in6_addr *pin6;
| ^~~~
include/trace/trace_events.h:402:11: note: in definition of macro ‘DECLARE_EVENT_CLASS’
402 | { assign; } \
| ^~~~~~
include/trace/trace_events.h:44:30: note: in expansion of macro ‘PARAMS’
44 | PARAMS(assign), \
| ^~~~~~
include/trace/events/neigh.h:23:1: note: in expansion of macro ‘TRACE_EVENT’
23 | TRACE_EVENT(neigh_create,
| ^~~~~~~~~~~
include/trace/events/neigh.h:41:9: note: in expansion of macro ‘TP_fast_assign’
41 | TP_fast_assign(
| ^~~~~~~~~~~~~~
In file included from include/trace/define_trace.h:103,
from include/trace/events/neigh.h:255,
from net/core/net-traces.c:51:
include/trace/events/neigh.h: In function ‘perf_trace_neigh_create’:
include/trace/events/neigh.h:42:34: error: variable ‘pin6’ set but not used [-Werror=unused-but-set-variable]
42 | struct in6_addr *pin6;
| ^~~~
include/trace/perf.h:51:11: note: in definition of macro ‘DECLARE_EVENT_CLASS’
51 | { assign; } \
| ^~~~~~
include/trace/trace_events.h:44:30: note: in expansion of macro ‘PARAMS’
44 | PARAMS(assign), \
| ^~~~~~
include/trace/events/neigh.h:23:1: note: in expansion of macro ‘TRACE_EVENT’
23 | TRACE_EVENT(neigh_create,
| ^~~~~~~~~~~
include/trace/events/neigh.h:41:9: note: in expansion of macro ‘TP_fast_assign’
41 | TP_fast_assign(
| ^~~~~~~~~~~~~~
Indeed, the variable pin6 is declared and initialized unconditionally,
while it is only used and needlessly re-initialized when support for
IPv6 is enabled.
Fix this by dropping the unused variable initialization, and moving the
variable declaration inside the existing section protected by a check
for CONFIG_IPV6.
Fixes: fc651001d2c5ca4f ("neighbor: Add tracepoint to __neigh_create")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Simon Horman <horms@kernel.org> # build-tested
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/neigh.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/include/trace/events/neigh.h
+++ b/include/trace/events/neigh.h
@@ -39,7 +39,6 @@ TRACE_EVENT(neigh_create,
),
TP_fast_assign(
- struct in6_addr *pin6;
__be32 *p32;
__entry->family = tbl->family;
@@ -47,7 +46,6 @@ TRACE_EVENT(neigh_create,
__entry->entries = atomic_read(&tbl->gc_entries);
__entry->created = n != NULL;
__entry->gc_exempt = exempt_from_gc;
- pin6 = (struct in6_addr *)__entry->primary_key6;
p32 = (__be32 *)__entry->primary_key4;
if (tbl->family == AF_INET)
@@ -57,6 +55,8 @@ TRACE_EVENT(neigh_create,
#if IS_ENABLED(CONFIG_IPV6)
if (tbl->family == AF_INET6) {
+ struct in6_addr *pin6;
+
pin6 = (struct in6_addr *)__entry->primary_key6;
*pin6 = *(struct in6_addr *)pkey;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 119/202] netfilter: nft_set_rbtree: .deactivate fails if element has expired
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 118/202] neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 120/202] net: pktgen: Fix interface flags printing Greg Kroah-Hartman
` (88 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Florian Westphal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit d111692a59c1470ae530cbb39bcf0346c950ecc7 upstream.
This allows to remove an expired element which is not possible in other
existing set backends, this is more noticeable if gc-interval is high so
expired elements remain in the tree. On-demand gc also does not help in
this case, because this is delete element path. Return NULL if element
has expired.
Fixes: 8d8540c4f5e0 ("netfilter: nft_set_rbtree: add timeout support")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_set_rbtree.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c
@@ -570,6 +570,8 @@ static void *nft_rbtree_deactivate(const
nft_rbtree_interval_end(this)) {
parent = parent->rb_right;
continue;
+ } else if (nft_set_elem_expired(&rbe->ext)) {
+ break;
} else if (!nft_set_elem_active(&rbe->ext, genmask)) {
parent = parent->rb_left;
continue;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 120/202] net: pktgen: Fix interface flags printing
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 119/202] netfilter: nft_set_rbtree: .deactivate fails if element has expired Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 121/202] thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge Greg Kroah-Hartman
` (87 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gavrilov Ilia, David S. Miller
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
commit 1d30162f35c7a73fc2f8cdcdcdbd690bedb99d1a upstream.
Device flags are displayed incorrectly:
1) The comparison (i == F_FLOW_SEQ) is always false, because F_FLOW_SEQ
is equal to (1 << FLOW_SEQ_SHIFT) == 2048, and the maximum value
of the 'i' variable is (NR_PKT_FLAG - 1) == 17. It should be compared
with FLOW_SEQ_SHIFT.
2) Similarly to the F_IPSEC flag.
3) Also add spaces to the print end of the string literal "spi:%u"
to prevent the output from merging with the flag that follows.
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with SVACE.
Fixes: 99c6d3d20d62 ("pktgen: Remove brute-force printing of flags")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/pktgen.c | 14 +++++++-------
1 file changed, 7 insertions(+), 7 deletions(-)
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -645,19 +645,19 @@ static int pktgen_if_show(struct seq_fil
seq_puts(seq, " Flags: ");
for (i = 0; i < NR_PKT_FLAGS; i++) {
- if (i == F_FLOW_SEQ)
+ if (i == FLOW_SEQ_SHIFT)
if (!pkt_dev->cflows)
continue;
- if (pkt_dev->flags & (1 << i))
+ if (pkt_dev->flags & (1 << i)) {
seq_printf(seq, "%s ", pkt_flag_names[i]);
- else if (i == F_FLOW_SEQ)
- seq_puts(seq, "FLOW_RND ");
-
#ifdef CONFIG_XFRM
- if (i == F_IPSEC && pkt_dev->spi)
- seq_printf(seq, "spi:%u", pkt_dev->spi);
+ if (i == IPSEC_SHIFT && pkt_dev->spi)
+ seq_printf(seq, "spi:%u ", pkt_dev->spi);
#endif
+ } else if (i == FLOW_SEQ_SHIFT) {
+ seq_puts(seq, "FLOW_RND ");
+ }
}
seq_puts(seq, "\n");
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 121/202] thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 120/202] net: pktgen: Fix interface flags printing Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 122/202] resource: Add irqresource_disabled() Greg Kroah-Hartman
` (86 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Werner Sembach, Konrad J Hambrick,
Calvin Walton, Mika Westerberg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mika Westerberg <mika.westerberg@linux.intel.com>
[ Upstream commit 582620d9f6b352552bc9a3316fe2b1c3acd8742d ]
On some systems the IOMMU blocks the first couple of driver ready
messages to the connection manager firmware as can be seen in below
excerpts:
thunderbolt 0000:06:00.0: AMD-Vi: Event logged [IO_PAGE_FAULT domain=0x0010 address=0xbb0e3400 flags=0x0020]
or
DMAR: DRHD: handling fault status reg 2
DMAR: [DMA Write] Request device [04:00.0] PASID ffffffff fault addr 69974000 [fault reason 05] PTE Write access is not set
The reason is unknown and hard to debug because we were not able to
reproduce this locally. This only happens on certain systems with Intel
Maple Ridge Thunderbolt controller. If there is a device connected when
the driver is loaded the issue does not happen either. Only when there
is nothing connected (so typically when the system is booted up).
We can work this around by sending the driver ready several times. After
a couple of retries the message goes through and the controller works
just fine. For this reason make the number of retries a parameter for
icm_request() and then for Maple Ridge (and Titan Ridge as they us the
same function but this should not matter) increase number of retries
while shortening the timeout accordingly.
Reported-by: Werner Sembach <wse@tuxedocomputers.com>
Reported-by: Konrad J Hambrick <kjhambrick@gmail.com>
Reported-by: Calvin Walton <calvin.walton@kepstin.ca>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=214259
Cc: stable@vger.kernel.org
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/thunderbolt/icm.c | 38 +++++++++++++++++++-------------------
1 file changed, 19 insertions(+), 19 deletions(-)
diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c
index b2fb3397310e4..90f1d9a534614 100644
--- a/drivers/thunderbolt/icm.c
+++ b/drivers/thunderbolt/icm.c
@@ -41,6 +41,7 @@
#define PHY_PORT_CS1_LINK_STATE_SHIFT 26
#define ICM_TIMEOUT 5000 /* ms */
+#define ICM_RETRIES 3
#define ICM_APPROVE_TIMEOUT 10000 /* ms */
#define ICM_MAX_LINK 4
@@ -280,10 +281,9 @@ static bool icm_copy(struct tb_cfg_request *req, const struct ctl_pkg *pkg)
static int icm_request(struct tb *tb, const void *request, size_t request_size,
void *response, size_t response_size, size_t npackets,
- unsigned int timeout_msec)
+ int retries, unsigned int timeout_msec)
{
struct icm *icm = tb_priv(tb);
- int retries = 3;
do {
struct tb_cfg_request *req;
@@ -394,7 +394,7 @@ static int icm_fr_get_route(struct tb *tb, u8 link, u8 depth, u64 *route)
return -ENOMEM;
ret = icm_request(tb, &request, sizeof(request), switches,
- sizeof(*switches), npackets, ICM_TIMEOUT);
+ sizeof(*switches), npackets, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
goto err_free;
@@ -447,7 +447,7 @@ icm_fr_driver_ready(struct tb *tb, enum tb_security_level *security_level,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -472,7 +472,7 @@ static int icm_fr_approve_switch(struct tb *tb, struct tb_switch *sw)
memset(&reply, 0, sizeof(reply));
/* Use larger timeout as establishing tunnels can take some time */
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_APPROVE_TIMEOUT);
+ 1, ICM_RETRIES, ICM_APPROVE_TIMEOUT);
if (ret)
return ret;
@@ -499,7 +499,7 @@ static int icm_fr_add_switch_key(struct tb *tb, struct tb_switch *sw)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -527,7 +527,7 @@ static int icm_fr_challenge_switch_key(struct tb *tb, struct tb_switch *sw,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -559,7 +559,7 @@ static int icm_fr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -996,7 +996,7 @@ icm_tr_driver_ready(struct tb *tb, enum tb_security_level *security_level,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, 20000);
+ 1, 10, 2000);
if (ret)
return ret;
@@ -1026,7 +1026,7 @@ static int icm_tr_approve_switch(struct tb *tb, struct tb_switch *sw)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_APPROVE_TIMEOUT);
+ 1, ICM_RETRIES, ICM_APPROVE_TIMEOUT);
if (ret)
return ret;
@@ -1054,7 +1054,7 @@ static int icm_tr_add_switch_key(struct tb *tb, struct tb_switch *sw)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1083,7 +1083,7 @@ static int icm_tr_challenge_switch_key(struct tb *tb, struct tb_switch *sw,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1115,7 +1115,7 @@ static int icm_tr_approve_xdomain_paths(struct tb *tb, struct tb_xdomain *xd)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1141,7 +1141,7 @@ static int icm_tr_xdomain_tear_down(struct tb *tb, struct tb_xdomain *xd,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1460,7 +1460,7 @@ icm_ar_driver_ready(struct tb *tb, enum tb_security_level *security_level,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1486,7 +1486,7 @@ static int icm_ar_get_route(struct tb *tb, u8 link, u8 depth, u64 *route)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1507,7 +1507,7 @@ static int icm_ar_get_boot_acl(struct tb *tb, uuid_t *uuids, size_t nuuids)
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1568,7 +1568,7 @@ static int icm_ar_set_boot_acl(struct tb *tb, const uuid_t *uuids,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, ICM_TIMEOUT);
+ 1, ICM_RETRIES, ICM_TIMEOUT);
if (ret)
return ret;
@@ -1590,7 +1590,7 @@ icm_icl_driver_ready(struct tb *tb, enum tb_security_level *security_level,
memset(&reply, 0, sizeof(reply));
ret = icm_request(tb, &request, sizeof(request), &reply, sizeof(reply),
- 1, 20000);
+ 1, ICM_RETRIES, 20000);
if (ret)
return ret;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 122/202] resource: Add irqresource_disabled()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 121/202] thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 123/202] ACPI: Drop acpi_dev_irqresource_disabled() Greg Kroah-Hartman
` (85 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Garry, Marc Zyngier,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <john.garry@huawei.com>
[ Upstream commit 9806731db684a475ade1e95d166089b9edbd9da3 ]
Add a common function to set the fields for a irq resource to disabled,
which mimics what is done in acpi_dev_irqresource_disabled(), with a view
to replace that function.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://lore.kernel.org/r/1606905417-183214-3-git-send-email-john.garry@huawei.com
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ioport.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/include/linux/ioport.h b/include/linux/ioport.h
index 5135d4b86cd6a..f9bf374f96336 100644
--- a/include/linux/ioport.h
+++ b/include/linux/ioport.h
@@ -307,6 +307,13 @@ struct resource *devm_request_free_mem_region(struct device *dev,
struct resource *request_free_mem_region(struct resource *base,
unsigned long size, const char *name);
+static inline void irqresource_disabled(struct resource *res, u32 irq)
+{
+ res->start = irq;
+ res->end = irq;
+ res->flags = IORESOURCE_IRQ | IORESOURCE_DISABLED | IORESOURCE_UNSET;
+}
+
#ifdef CONFIG_IO_STRICT_DEVMEM
void revoke_devmem(struct resource *res);
#else
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 123/202] ACPI: Drop acpi_dev_irqresource_disabled()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 122/202] resource: Add irqresource_disabled() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 124/202] ACPI: resources: Add DMI-based legacy IRQ override quirk Greg Kroah-Hartman
` (84 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Garry, Marc Zyngier,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Garry <john.garry@huawei.com>
[ Upstream commit 1c3f69b4543af0aad514c127298e5ea40392575d ]
The functionality of acpi_dev_irqresource_disabled() is same as in common
irqresource_disabled(), so drop acpi_dev_irqresource_disabled() in favour
of that function.
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Link: https://lore.kernel.org/r/1606905417-183214-4-git-send-email-john.garry@huawei.com
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 17 +++++------------
1 file changed, 5 insertions(+), 12 deletions(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index f2f5f1dc7c61d..20a7892c6d3fd 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -380,13 +380,6 @@ unsigned int acpi_dev_get_irq_type(int triggering, int polarity)
}
EXPORT_SYMBOL_GPL(acpi_dev_get_irq_type);
-static void acpi_dev_irqresource_disabled(struct resource *res, u32 gsi)
-{
- res->start = gsi;
- res->end = gsi;
- res->flags = IORESOURCE_IRQ | IORESOURCE_DISABLED | IORESOURCE_UNSET;
-}
-
static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
u8 triggering, u8 polarity, u8 shareable,
bool legacy)
@@ -394,7 +387,7 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
int irq, p, t;
if (!valid_IRQ(gsi)) {
- acpi_dev_irqresource_disabled(res, gsi);
+ irqresource_disabled(res, gsi);
return;
}
@@ -426,7 +419,7 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
res->start = irq;
res->end = irq;
} else {
- acpi_dev_irqresource_disabled(res, gsi);
+ irqresource_disabled(res, gsi);
}
}
@@ -463,7 +456,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
*/
irq = &ares->data.irq;
if (index >= irq->interrupt_count) {
- acpi_dev_irqresource_disabled(res, 0);
+ irqresource_disabled(res, 0);
return false;
}
acpi_dev_get_irqresource(res, irq->interrupts[index],
@@ -473,7 +466,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
case ACPI_RESOURCE_TYPE_EXTENDED_IRQ:
ext_irq = &ares->data.extended_irq;
if (index >= ext_irq->interrupt_count) {
- acpi_dev_irqresource_disabled(res, 0);
+ irqresource_disabled(res, 0);
return false;
}
if (is_gsi(ext_irq))
@@ -481,7 +474,7 @@ bool acpi_dev_resource_interrupt(struct acpi_resource *ares, int index,
ext_irq->triggering, ext_irq->polarity,
ext_irq->shareable, false);
else
- acpi_dev_irqresource_disabled(res, 0);
+ irqresource_disabled(res, 0);
break;
default:
res->flags = 0;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 124/202] ACPI: resources: Add DMI-based legacy IRQ override quirk
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 123/202] ACPI: Drop acpi_dev_irqresource_disabled() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 125/202] ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Greg Kroah-Hartman
` (83 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rafael J. Wysocki, Manuel Krause,
Hui Wang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <hui.wang@canonical.com>
[ Upstream commit 892a012699fc0b91a2ed6309078936191447f480 ]
After the commit 0ec4e55e9f57 ("ACPI: resources: Add checks for ACPI
IRQ override") is reverted, the keyboard on Medion laptops can't
work again.
To fix the keyboard issue, add a DMI-based override check that will
not affect other machines along the lines of prt_quirks[] in
drivers/acpi/pci_irq.c.
If similar issues are seen on other platforms, the quirk table could
be expanded in the future.
BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=213031
BugLink: http://bugs.launchpad.net/bugs/1909814
Suggested-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Reported-by: Manuel Krause <manuelkrause@netscape.net>
Tested-by: Manuel Krause <manuelkrause@netscape.net>
Signed-off-by: Hui Wang <hui.wang@canonical.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 49 +++++++++++++++++++++++++++++++++++++++--
1 file changed, 47 insertions(+), 2 deletions(-)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 20a7892c6d3fd..bf7c2deafb0a9 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -16,6 +16,7 @@
#include <linux/ioport.h>
#include <linux/slab.h>
#include <linux/irq.h>
+#include <linux/dmi.h>
#ifdef CONFIG_X86
#define valid_IRQ(i) (((i) != 0) && ((i) != 2))
@@ -380,9 +381,51 @@ unsigned int acpi_dev_get_irq_type(int triggering, int polarity)
}
EXPORT_SYMBOL_GPL(acpi_dev_get_irq_type);
+static const struct dmi_system_id medion_laptop[] = {
+ {
+ .ident = "MEDION P15651",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "MEDION"),
+ DMI_MATCH(DMI_BOARD_NAME, "M15T"),
+ },
+ },
+ { }
+};
+
+struct irq_override_cmp {
+ const struct dmi_system_id *system;
+ unsigned char irq;
+ unsigned char triggering;
+ unsigned char polarity;
+ unsigned char shareable;
+};
+
+static const struct irq_override_cmp skip_override_table[] = {
+ { medion_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
+};
+
+static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
+ u8 shareable)
+{
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(skip_override_table); i++) {
+ const struct irq_override_cmp *entry = &skip_override_table[i];
+
+ if (dmi_check_system(entry->system) &&
+ entry->irq == gsi &&
+ entry->triggering == triggering &&
+ entry->polarity == polarity &&
+ entry->shareable == shareable)
+ return false;
+ }
+
+ return true;
+}
+
static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
u8 triggering, u8 polarity, u8 shareable,
- bool legacy)
+ bool check_override)
{
int irq, p, t;
@@ -401,7 +444,9 @@ static void acpi_dev_get_irqresource(struct resource *res, u32 gsi,
* using extended IRQ descriptors we take the IRQ configuration
* from _CRS directly.
*/
- if (legacy && !acpi_get_override_irq(gsi, &t, &p)) {
+ if (check_override &&
+ acpi_dev_irq_override(gsi, triggering, polarity, shareable) &&
+ !acpi_get_override_irq(gsi, &t, &p)) {
u8 trig = t ? ACPI_LEVEL_SENSITIVE : ACPI_EDGE_SENSITIVE;
u8 pol = p ? ACPI_ACTIVE_LOW : ACPI_ACTIVE_HIGH;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 125/202] ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 124/202] ACPI: resources: Add DMI-based legacy IRQ override quirk Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 126/202] ACPI: resource: Add ASUS model S5402ZA to quirks Greg Kroah-Hartman
` (82 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hui Wang, Tamim Khan, Sunand,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <tamim@fusetak.com>
[ Upstream commit e12dee3736731e24b1e7367f87d66ac0fcd73ce7 ]
In the ACPI DSDT table for Asus VivoBook K3402ZA/K3502ZA
IRQ 1 is described as ActiveLow; however, the kernel overrides
it to Edge_High. This prevents the internal keyboard from working
on these laptops. In order to fix this add these laptops to the
skip_override_table so that the kernel does not override IRQ 1 to
Edge_High.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
Reviewed-by: Hui Wang <hui.wang@canonical.com>
Tested-by: Tamim Khan <tamim@fusetak.com>
Tested-by: Sunand <sunandchakradhar@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index bf7c2deafb0a9..602c44821fb45 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -392,6 +392,24 @@ static const struct dmi_system_id medion_laptop[] = {
{ }
};
+static const struct dmi_system_id asus_laptop[] = {
+ {
+ .ident = "Asus Vivobook K3402ZA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "K3402ZA"),
+ },
+ },
+ {
+ .ident = "Asus Vivobook K3502ZA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
+ },
+ },
+ { }
+};
+
struct irq_override_cmp {
const struct dmi_system_id *system;
unsigned char irq;
@@ -402,6 +420,7 @@ struct irq_override_cmp {
static const struct irq_override_cmp skip_override_table[] = {
{ medion_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
+ { asus_laptop, 1, ACPI_LEVEL_SENSITIVE, ACPI_ACTIVE_LOW, 0 },
};
static bool acpi_dev_irq_override(u32 gsi, u8 triggering, u8 polarity,
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 126/202] ACPI: resource: Add ASUS model S5402ZA to quirks
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 125/202] ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 127/202] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Greg Kroah-Hartman
` (81 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kellen Renshaw, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kellen Renshaw <kellen.renshaw@canonical.com>
[ Upstream commit 6e5cbe7c4b41824e500acbb42411da692d1435f1 ]
The Asus Vivobook S5402ZA has the same keyboard issue as Asus Vivobook
K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
should be Active_Low.
This patch adds the S5402ZA model to the quirk list.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216158
Tested-by: Kellen Renshaw <kellen.renshaw@canonical.com>
Signed-off-by: Kellen Renshaw <kellen.renshaw@canonical.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 602c44821fb45..50ab81a333cdd 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -407,6 +407,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "K3502ZA"),
},
},
+ {
+ .ident = "Asus Vivobook S5402ZA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
+ },
+ },
{ }
};
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 127/202] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 126/202] ACPI: resource: Add ASUS model S5402ZA to quirks Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 128/202] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Greg Kroah-Hartman
` (80 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dzmitry, Tamim Khan,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <tamim@fusetak.com>
[ Upstream commit b5f9223a105d9b56954ad1ca3eace4eaf26c99ed ]
Like the Asus Vivobook K3402ZA/K3502ZA/S5402ZA Asus Vivobook S5602ZA
has an ACPI DSDT table the describes IRQ 1 as ActiveLow while the kernel
overrides it to Edge_High. This prevents the keyboard on this laptop
from working. To fix this add this laptop to the skip_override_table so
that the kernel does not override IRQ 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216579
Tested-by: Dzmitry <wrkedm@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 50ab81a333cdd..7438e57455d17 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -414,6 +414,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5402ZA"),
},
},
+ {
+ .ident = "Asus Vivobook S5602ZA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
+ },
+ },
{ }
};
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 128/202] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 127/202] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 129/202] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Greg Kroah-Hartman
` (79 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 7203481fd12b1257938519efb2460ea02b9236ee ]
The Asus ExpertBook B2502 has the same keyboard issue as Asus Vivobook
K3402ZA/K3502ZA. The kernel overrides IRQ 1 to Edge_High when it
should be Active_Low.
This patch adds the ExpertBook B2502 model to the existing
quirk list of Asus laptops with this issue.
Fixes: b5f9223a105d ("ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA")
Link: https://bugzilla.redhat.com/show_bug.cgi?id=2142574
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 7438e57455d17..f76147272b333 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B2502",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B2502CBA"),
+ },
+ },
{ }
};
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 129/202] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 128/202] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 130/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Greg Kroah-Hartman
` (78 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, zelenat, Tamim Khan,
Rafael J. Wysocki, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tamim Khan <tamim@fusetak.com>
[ Upstream commit 77c7248882385397cd7dffe9e1437f59f32ce2de ]
Like the Asus Expertbook B2502CBA and various Asus Vivobook laptops,
the Asus Expertbook B2402CBA has an ACPI DSDT table that describes IRQ 1
as ActiveLow while the kernel overrides it to Edge_High. This prevents the
keyboard from working. To fix this issue, add this laptop to the
skip_override_table so that the kernel does not override IRQ 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216864
Tested-by: zelenat <zelenat@gmail.com>
Signed-off-by: Tamim Khan <tamim@fusetak.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index f76147272b333..57e8ba44df741 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B2402CBA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B2402CBA"),
+ },
+ },
{
.ident = "Asus ExpertBook B2502",
.matches = {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 130/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 129/202] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 131/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Greg Kroah-Hartman
` (77 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Menzel, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Menzel <pmenzel@molgen.mpg.de>
[ Upstream commit 05cda427126f30ce3fc8ffd82fd6f5196398d502 ]
Like the ASUS ExpertBook B2502CBA and various ASUS Vivobook laptops, the
ASUS ExpertBook B1502CBA has an ACPI DSDT table that describes IRQ 1 as
ActiveLow while the kernel overrides it to Edge_High.
$ sudo dmesg | grep DMI
DMI: ASUSTeK COMPUTER INC. ASUS EXPERTBOOK B1502CBA_B1502CBA/B1502CBA, BIOS B1502CBA.300 01/18/2023
$ grep -A 40 PS2K dsdt.dsl | grep IRQ -A 1
IRQ (Level, ActiveLow, Exclusive, )
{1}
This prevents the keyboard from working. To fix this issue, add this laptop
to the skip_override_table so that the kernel does not override IRQ 1.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217323
Signed-off-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Stable-dep-of: c1ed72171ed5 ("ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index 57e8ba44df741..a49acf8ddacae 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B1502CBA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B1502CBA"),
+ },
+ },
{
.ident = "Asus ExpertBook B2402CBA",
.matches = {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 131/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 130/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 132/202] selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting Greg Kroah-Hartman
` (76 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Rafael J. Wysocki,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit c1ed72171ed580fbf159e703b77685aa4b0d0df5 ]
Like various other ASUS ExpertBook-s, the ASUS ExpertBook B1402CBA
has an ACPI DSDT table that describes IRQ 1 as ActiveLow while
the kernel overrides it to EdgeHigh.
This prevents the keyboard from working. To fix this issue, add this laptop
to the skip_override_table so that the kernel does not override IRQ 1.
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217901
Cc: stable@vger.kernel.org
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c
index a49acf8ddacae..bfd821173f863 100644
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -421,6 +421,13 @@ static const struct dmi_system_id asus_laptop[] = {
DMI_MATCH(DMI_BOARD_NAME, "S5602ZA"),
},
},
+ {
+ .ident = "Asus ExpertBook B1402CBA",
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."),
+ DMI_MATCH(DMI_BOARD_NAME, "B1402CBA"),
+ },
+ },
{
.ident = "Asus ExpertBook B1502CBA",
.matches = {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 132/202] selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 131/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 133/202] selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Greg Kroah-Hartman
` (75 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Waiman Long, Mina Almasry,
Shuah Khan, Mike Kravetz, Andrew Morton, Linus Torvalds,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Waiman Long <longman@redhat.com>
[ Upstream commit 209376ed2a8431ccb4c40fdcef11194fc1e749b0 ]
The hugetlb cgroup reservation test charge_reserved_hugetlb.sh assume
that no cgroup filesystems are mounted before running the test. That is
not true in many cases. As a result, the test fails to run. Fix that
by querying the current cgroup mount setting and using the existing
cgroup setup instead before attempting to freshly mount a cgroup
filesystem.
Similar change is also made for hugetlb_reparenting_test.sh as well,
though it still has problem if cgroup v2 isn't used.
The patched test scripts were run on a centos 8 based system to verify
that they ran properly.
Link: https://lkml.kernel.org/r/20220106201359.1646575-1-longman@redhat.com
Fixes: 29750f71a9b4 ("hugetlb_cgroup: add hugetlb_cgroup reservation tests")
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Mina Almasry <almasrymina@google.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Stable-dep-of: bbe246f875d0 ("selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/vm/charge_reserved_hugetlb.sh | 34 +++++++++++--------
.../selftests/vm/hugetlb_reparenting_test.sh | 21 +++++++-----
.../selftests/vm/write_hugetlb_memory.sh | 2 +-
3 files changed, 34 insertions(+), 23 deletions(-)
diff --git a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
index 18d33684faade..71d3cf3bf130a 100644
--- a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+++ b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
@@ -21,19 +21,23 @@ if [[ "$1" == "-cgroup-v2" ]]; then
reservation_usage_file=rsvd.current
fi
-cgroup_path=/dev/cgroup/memory
-if [[ ! -e $cgroup_path ]]; then
- mkdir -p $cgroup_path
- if [[ $cgroup2 ]]; then
+if [[ $cgroup2 ]]; then
+ cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+ if [[ -z "$cgroup_path" ]]; then
+ cgroup_path=/dev/cgroup/memory
mount -t cgroup2 none $cgroup_path
- else
+ do_umount=1
+ fi
+ echo "+hugetlb" >$cgroup_path/cgroup.subtree_control
+else
+ cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+ if [[ -z "$cgroup_path" ]]; then
+ cgroup_path=/dev/cgroup/memory
mount -t cgroup memory,hugetlb $cgroup_path
+ do_umount=1
fi
fi
-
-if [[ $cgroup2 ]]; then
- echo "+hugetlb" >/dev/cgroup/memory/cgroup.subtree_control
-fi
+export cgroup_path
function cleanup() {
if [[ $cgroup2 ]]; then
@@ -105,7 +109,7 @@ function setup_cgroup() {
function wait_for_hugetlb_memory_to_get_depleted() {
local cgroup="$1"
- local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
+ local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
# Wait for hugetlbfs memory to get depleted.
while [ $(cat $path) != 0 ]; do
echo Waiting for hugetlb memory to get depleted.
@@ -118,7 +122,7 @@ function wait_for_hugetlb_memory_to_get_reserved() {
local cgroup="$1"
local size="$2"
- local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
+ local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$reservation_usage_file"
# Wait for hugetlbfs memory to get written.
while [ $(cat $path) != $size ]; do
echo Waiting for hugetlb memory reservation to reach size $size.
@@ -131,7 +135,7 @@ function wait_for_hugetlb_memory_to_get_written() {
local cgroup="$1"
local size="$2"
- local path="/dev/cgroup/memory/$cgroup/hugetlb.${MB}MB.$fault_usage_file"
+ local path="$cgroup_path/$cgroup/hugetlb.${MB}MB.$fault_usage_file"
# Wait for hugetlbfs memory to get written.
while [ $(cat $path) != $size ]; do
echo Waiting for hugetlb memory to reach size $size.
@@ -571,5 +575,7 @@ for populate in "" "-o"; do
done # populate
done # method
-umount $cgroup_path
-rmdir $cgroup_path
+if [[ $do_umount ]]; then
+ umount $cgroup_path
+ rmdir $cgroup_path
+fi
diff --git a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
index d11d1febccc3b..54234e12288c9 100644
--- a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+++ b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
@@ -15,19 +15,24 @@ if [[ "$1" == "-cgroup-v2" ]]; then
usage_file=current
fi
-CGROUP_ROOT='/dev/cgroup/memory'
-MNT='/mnt/huge/'
-if [[ ! -e $CGROUP_ROOT ]]; then
- mkdir -p $CGROUP_ROOT
- if [[ $cgroup2 ]]; then
+if [[ $cgroup2 ]]; then
+ CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+ if [[ -z "$CGROUP_ROOT" ]]; then
+ CGROUP_ROOT=/dev/cgroup/memory
mount -t cgroup2 none $CGROUP_ROOT
- sleep 1
- echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
- else
+ do_umount=1
+ fi
+ echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
+else
+ CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+ if [[ -z "$CGROUP_ROOT" ]]; then
+ CGROUP_ROOT=/dev/cgroup/memory
mount -t cgroup memory,hugetlb $CGROUP_ROOT
+ do_umount=1
fi
fi
+MNT='/mnt/huge/'
function get_machine_hugepage_size() {
hpz=$(grep -i hugepagesize /proc/meminfo)
diff --git a/tools/testing/selftests/vm/write_hugetlb_memory.sh b/tools/testing/selftests/vm/write_hugetlb_memory.sh
index d3d0d108924d4..70a02301f4c27 100644
--- a/tools/testing/selftests/vm/write_hugetlb_memory.sh
+++ b/tools/testing/selftests/vm/write_hugetlb_memory.sh
@@ -14,7 +14,7 @@ want_sleep=$8
reserve=$9
echo "Putting task in cgroup '$cgroup'"
-echo $$ > /dev/cgroup/memory/"$cgroup"/cgroup.procs
+echo $$ > ${cgroup_path:-/dev/cgroup/memory}/"$cgroup"/cgroup.procs
echo "Method is $method"
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 133/202] selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 132/202] selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 134/202] usb: core: Track SuperSpeed Plus GenXxY Greg Kroah-Hartman
` (74 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Juntong Deng, Shuah Khan,
Andrew Morton, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Juntong Deng <juntong.deng@outlook.com>
[ Upstream commit bbe246f875d064ecfb872fe4f66152e743dfd22d ]
According to the awk manual, the -e option does not need to be specified
in front of 'program' (unless you need to mix program-file).
The redundant -e option can cause error when users use awk tools other
than gawk (for example, mawk does not support the -e option).
Error Example:
awk: not an option: -e
Link: https://lkml.kernel.org/r/VI1P193MB075228810591AF2FDD7D42C599C3A@VI1P193MB0752.EURP193.PROD.OUTLOOK.COM
Signed-off-by: Juntong Deng <juntong.deng@outlook.com>
Cc: Shuah Khan <shuah@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/vm/charge_reserved_hugetlb.sh | 4 ++--
tools/testing/selftests/vm/hugetlb_reparenting_test.sh | 4 ++--
2 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
index 71d3cf3bf130a..7536ff2f890a1 100644
--- a/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
+++ b/tools/testing/selftests/vm/charge_reserved_hugetlb.sh
@@ -22,7 +22,7 @@ if [[ "$1" == "-cgroup-v2" ]]; then
fi
if [[ $cgroup2 ]]; then
- cgroup_path=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+ cgroup_path=$(mount -t cgroup2 | head -1 | awk '{print $3}')
if [[ -z "$cgroup_path" ]]; then
cgroup_path=/dev/cgroup/memory
mount -t cgroup2 none $cgroup_path
@@ -30,7 +30,7 @@ if [[ $cgroup2 ]]; then
fi
echo "+hugetlb" >$cgroup_path/cgroup.subtree_control
else
- cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+ cgroup_path=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}')
if [[ -z "$cgroup_path" ]]; then
cgroup_path=/dev/cgroup/memory
mount -t cgroup memory,hugetlb $cgroup_path
diff --git a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
index 54234e12288c9..c665b16f1e370 100644
--- a/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
+++ b/tools/testing/selftests/vm/hugetlb_reparenting_test.sh
@@ -17,7 +17,7 @@ fi
if [[ $cgroup2 ]]; then
- CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk -e '{print $3}')
+ CGROUP_ROOT=$(mount -t cgroup2 | head -1 | awk '{print $3}')
if [[ -z "$CGROUP_ROOT" ]]; then
CGROUP_ROOT=/dev/cgroup/memory
mount -t cgroup2 none $CGROUP_ROOT
@@ -25,7 +25,7 @@ if [[ $cgroup2 ]]; then
fi
echo "+hugetlb +memory" >$CGROUP_ROOT/cgroup.subtree_control
else
- CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk -e '{print $3}')
+ CGROUP_ROOT=$(mount -t cgroup | grep ",hugetlb" | awk '{print $3}')
if [[ -z "$CGROUP_ROOT" ]]; then
CGROUP_ROOT=/dev/cgroup/memory
mount -t cgroup memory,hugetlb $CGROUP_ROOT
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 134/202] usb: core: Track SuperSpeed Plus GenXxY
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 133/202] selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 135/202] xhci: cleanup xhci_hub_control port references Greg Kroah-Hartman
` (73 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
[ Upstream commit 0299809be415567366b66f248eed93848b8dc9f3 ]
Introduce ssp_rate field to usb_device structure to capture the
connected SuperSpeed Plus signaling rate generation and lane count with
the corresponding usb_ssp_rate enum.
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/b7805d121e5ae4ad5ae144bd860b6ac04ee47436.1615432770.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: f74a7afc224a ("usb: hub: Guard against accesses to uninitialized BOS descriptors")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/hcd.c | 6 +++-
drivers/usb/core/hub.c | 78 ++++++++++++++++++++++++++++++++++++++++++
include/linux/usb.h | 2 ++
3 files changed, 85 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
index 63bb04d262d84..0a77717d6af20 100644
--- a/drivers/usb/core/hcd.c
+++ b/drivers/usb/core/hcd.c
@@ -2745,6 +2745,7 @@ int usb_add_hcd(struct usb_hcd *hcd,
rhdev->rx_lanes = 1;
rhdev->tx_lanes = 1;
+ rhdev->ssp_rate = USB_SSP_GEN_UNKNOWN;
switch (hcd->speed) {
case HCD_USB11:
@@ -2762,8 +2763,11 @@ int usb_add_hcd(struct usb_hcd *hcd,
case HCD_USB32:
rhdev->rx_lanes = 2;
rhdev->tx_lanes = 2;
- fallthrough;
+ rhdev->ssp_rate = USB_SSP_GEN_2x2;
+ rhdev->speed = USB_SPEED_SUPER_PLUS;
+ break;
case HCD_USB31:
+ rhdev->ssp_rate = USB_SSP_GEN_2x1;
rhdev->speed = USB_SPEED_SUPER_PLUS;
break;
default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index b91b01c2c5dee..cfcd4f2ffffaa 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -31,6 +31,7 @@
#include <linux/pm_qos.h>
#include <linux/kobject.h>
+#include <linux/bitfield.h>
#include <linux/uaccess.h>
#include <asm/byteorder.h>
@@ -2691,6 +2692,81 @@ int usb_authorize_device(struct usb_device *usb_dev)
return result;
}
+/**
+ * get_port_ssp_rate - Match the extended port status to SSP rate
+ * @hdev: The hub device
+ * @ext_portstatus: extended port status
+ *
+ * Match the extended port status speed id to the SuperSpeed Plus sublink speed
+ * capability attributes. Base on the number of connected lanes and speed,
+ * return the corresponding enum usb_ssp_rate.
+ */
+static enum usb_ssp_rate get_port_ssp_rate(struct usb_device *hdev,
+ u32 ext_portstatus)
+{
+ struct usb_ssp_cap_descriptor *ssp_cap = hdev->bos->ssp_cap;
+ u32 attr;
+ u8 speed_id;
+ u8 ssac;
+ u8 lanes;
+ int i;
+
+ if (!ssp_cap)
+ goto out;
+
+ speed_id = ext_portstatus & USB_EXT_PORT_STAT_RX_SPEED_ID;
+ lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
+
+ ssac = le32_to_cpu(ssp_cap->bmAttributes) &
+ USB_SSP_SUBLINK_SPEED_ATTRIBS;
+
+ for (i = 0; i <= ssac; i++) {
+ u8 ssid;
+
+ attr = le32_to_cpu(ssp_cap->bmSublinkSpeedAttr[i]);
+ ssid = FIELD_GET(USB_SSP_SUBLINK_SPEED_SSID, attr);
+ if (speed_id == ssid) {
+ u16 mantissa;
+ u8 lse;
+ u8 type;
+
+ /*
+ * Note: currently asymmetric lane types are only
+ * applicable for SSIC operate in SuperSpeed protocol
+ */
+ type = FIELD_GET(USB_SSP_SUBLINK_SPEED_ST, attr);
+ if (type == USB_SSP_SUBLINK_SPEED_ST_ASYM_RX ||
+ type == USB_SSP_SUBLINK_SPEED_ST_ASYM_TX)
+ goto out;
+
+ if (FIELD_GET(USB_SSP_SUBLINK_SPEED_LP, attr) !=
+ USB_SSP_SUBLINK_SPEED_LP_SSP)
+ goto out;
+
+ lse = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSE, attr);
+ mantissa = FIELD_GET(USB_SSP_SUBLINK_SPEED_LSM, attr);
+
+ /* Convert to Gbps */
+ for (; lse < USB_SSP_SUBLINK_SPEED_LSE_GBPS; lse++)
+ mantissa /= 1000;
+
+ if (mantissa >= 10 && lanes == 1)
+ return USB_SSP_GEN_2x1;
+
+ if (mantissa >= 10 && lanes == 2)
+ return USB_SSP_GEN_2x2;
+
+ if (mantissa >= 5 && lanes == 2)
+ return USB_SSP_GEN_1x2;
+
+ goto out;
+ }
+ }
+
+out:
+ return USB_SSP_GEN_UNKNOWN;
+}
+
/*
* Return 1 if port speed is SuperSpeedPlus, 0 otherwise or if the
* capability couldn't be checked.
@@ -2878,9 +2954,11 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1,
/* extended portstatus Rx and Tx lane count are zero based */
udev->rx_lanes = USB_EXT_PORT_RX_LANES(ext_portstatus) + 1;
udev->tx_lanes = USB_EXT_PORT_TX_LANES(ext_portstatus) + 1;
+ udev->ssp_rate = get_port_ssp_rate(hub->hdev, ext_portstatus);
} else {
udev->rx_lanes = 1;
udev->tx_lanes = 1;
+ udev->ssp_rate = USB_SSP_GEN_UNKNOWN;
}
if (hub_is_wusb(hub))
udev->speed = USB_SPEED_WIRELESS;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index bc59237727033..8bc1119afc317 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -565,6 +565,7 @@ struct usb3_lpm_parameters {
* @speed: device speed: high/full/low (or error)
* @rx_lanes: number of rx lanes in use, USB 3.2 adds dual-lane support
* @tx_lanes: number of tx lanes in use, USB 3.2 adds dual-lane support
+ * @ssp_rate: SuperSpeed Plus phy signaling rate and lane count
* @tt: Transaction Translator info; used with low/full speed dev, highspeed hub
* @ttport: device port on that tt hub
* @toggle: one bit for each endpoint, with ([0] = IN, [1] = OUT) endpoints
@@ -642,6 +643,7 @@ struct usb_device {
enum usb_device_speed speed;
unsigned int rx_lanes;
unsigned int tx_lanes;
+ enum usb_ssp_rate ssp_rate;
struct usb_tt *tt;
int ttport;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 135/202] xhci: cleanup xhci_hub_control port references
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 134/202] usb: core: Track SuperSpeed Plus GenXxY Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 136/202] xhci: move port specific items such as state completions to port structure Greg Kroah-Hartman
` (72 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit faaae0190dcd1e230616c85bbc3b339f27ba5b81 ]
Both port number and port structure of a port are referred to several
times when handing hub requests in xhci.
Use more suitable data types and readable names for these.
Cleanup only, no functional changes
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-6-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 123 ++++++++++++++++++------------------
1 file changed, 63 insertions(+), 60 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 7bb3067418076..c2a8d455eeace 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -1108,11 +1108,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
u16 test_mode = 0;
struct xhci_hub *rhub;
struct xhci_port **ports;
+ struct xhci_port *port;
+ int portnum1;
rhub = xhci_get_rhub(hcd);
ports = rhub->ports;
max_ports = rhub->num_ports;
bus_state = &rhub->bus_state;
+ portnum1 = wIndex & 0xff;
spin_lock_irqsave(&xhci->lock, flags);
switch (typeReq) {
@@ -1146,10 +1149,12 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
spin_unlock_irqrestore(&xhci->lock, flags);
return retval;
case GetPortStatus:
- if (!wIndex || wIndex > max_ports)
+ if (!portnum1 || portnum1 > max_ports)
goto error;
+
wIndex--;
- temp = readl(ports[wIndex]->addr);
+ port = ports[portnum1 - 1];
+ temp = readl(port->addr);
if (temp == ~(u32)0) {
xhci_hc_died(xhci);
retval = -ENODEV;
@@ -1162,7 +1167,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
goto error;
xhci_dbg(xhci, "Get port status %d-%d read: 0x%x, return 0x%x",
- hcd->self.busnum, wIndex + 1, temp, status);
+ hcd->self.busnum, portnum1, temp, status);
put_unaligned(cpu_to_le32(status), (__le32 *) buf);
/* if USB 3.1 extended port status return additional 4 bytes */
@@ -1174,7 +1179,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
retval = -EINVAL;
break;
}
- port_li = readl(ports[wIndex]->addr + PORTLI);
+ port_li = readl(port->addr + PORTLI);
status = xhci_get_ext_port_status(temp, port_li);
put_unaligned_le32(status, &buf[4]);
}
@@ -1188,11 +1193,14 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
test_mode = (wIndex & 0xff00) >> 8;
/* The MSB of wIndex is the U1/U2 timeout */
timeout = (wIndex & 0xff00) >> 8;
+
wIndex &= 0xff;
- if (!wIndex || wIndex > max_ports)
+ if (!portnum1 || portnum1 > max_ports)
goto error;
+
+ port = ports[portnum1 - 1];
wIndex--;
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if (temp == ~(u32)0) {
xhci_hc_died(xhci);
retval = -ENODEV;
@@ -1202,11 +1210,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
/* FIXME: What new port features do we need to support? */
switch (wValue) {
case USB_PORT_FEAT_SUSPEND:
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if ((temp & PORT_PLS_MASK) != XDEV_U0) {
/* Resume the port to U0 first */
- xhci_set_link_state(xhci, ports[wIndex],
- XDEV_U0);
+ xhci_set_link_state(xhci, port, XDEV_U0);
spin_unlock_irqrestore(&xhci->lock, flags);
msleep(10);
spin_lock_irqsave(&xhci->lock, flags);
@@ -1215,16 +1222,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
* a port unless the port reports that it is in the
* enabled (PED = ‘1’,PLS < ‘3’) state.
*/
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if ((temp & PORT_PE) == 0 || (temp & PORT_RESET)
|| (temp & PORT_PLS_MASK) >= XDEV_U3) {
xhci_warn(xhci, "USB core suspending port %d-%d not in U0/U1/U2\n",
- hcd->self.busnum, wIndex + 1);
+ hcd->self.busnum, portnum1);
goto error;
}
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
- wIndex + 1);
+ portnum1);
if (!slot_id) {
xhci_warn(xhci, "slot_id is zero\n");
goto error;
@@ -1234,21 +1241,21 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
xhci_stop_device(xhci, slot_id, 1);
spin_lock_irqsave(&xhci->lock, flags);
- xhci_set_link_state(xhci, ports[wIndex], XDEV_U3);
+ xhci_set_link_state(xhci, port, XDEV_U3);
spin_unlock_irqrestore(&xhci->lock, flags);
msleep(10); /* wait device to enter */
spin_lock_irqsave(&xhci->lock, flags);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
bus_state->suspended_ports |= 1 << wIndex;
break;
case USB_PORT_FEAT_LINK_STATE:
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
/* Disable port */
if (link_state == USB_SS_PORT_LS_SS_DISABLED) {
xhci_dbg(xhci, "Disable port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
+ hcd->self.busnum, portnum1);
temp = xhci_port_state_to_neutral(temp);
/*
* Clear all change bits, so that we get a new
@@ -1257,18 +1264,17 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
temp |= PORT_CSC | PORT_PEC | PORT_WRC |
PORT_OCC | PORT_RC | PORT_PLC |
PORT_CEC;
- writel(temp | PORT_PE, ports[wIndex]->addr);
- temp = readl(ports[wIndex]->addr);
+ writel(temp | PORT_PE, port->addr);
+ temp = readl(port->addr);
break;
}
/* Put link in RxDetect (enable port) */
if (link_state == USB_SS_PORT_LS_RX_DETECT) {
xhci_dbg(xhci, "Enable port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
- xhci_set_link_state(xhci, ports[wIndex],
- link_state);
- temp = readl(ports[wIndex]->addr);
+ hcd->self.busnum, portnum1);
+ xhci_set_link_state(xhci, port, link_state);
+ temp = readl(port->addr);
break;
}
@@ -1298,11 +1304,10 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
}
xhci_dbg(xhci, "Enable compliance mode transition for port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
- xhci_set_link_state(xhci, ports[wIndex],
- link_state);
+ hcd->self.busnum, portnum1);
+ xhci_set_link_state(xhci, port, link_state);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
break;
}
/* Port must be enabled */
@@ -1313,8 +1318,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
/* Can't set port link state above '3' (U3) */
if (link_state > USB_SS_PORT_LS_U3) {
xhci_warn(xhci, "Cannot set port %d-%d link state %d\n",
- hcd->self.busnum, wIndex + 1,
- link_state);
+ hcd->self.busnum, portnum1, link_state);
goto error;
}
@@ -1339,8 +1343,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
reinit_completion(&bus_state->u3exit_done[wIndex]);
}
if (pls <= XDEV_U3) /* U1, U2, U3 */
- xhci_set_link_state(xhci, ports[wIndex],
- USB_SS_PORT_LS_U0);
+ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
if (!wait_u0) {
if (pls > XDEV_U3)
goto error;
@@ -1350,16 +1353,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
msecs_to_jiffies(500)))
xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
- hcd->self.busnum, wIndex + 1);
+ hcd->self.busnum, portnum1);
spin_lock_irqsave(&xhci->lock, flags);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
break;
}
if (link_state == USB_SS_PORT_LS_U3) {
int retries = 16;
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
- wIndex + 1);
+ portnum1);
if (slot_id) {
/* unlock to execute stop endpoint
* commands */
@@ -1368,16 +1371,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
xhci_stop_device(xhci, slot_id, 1);
spin_lock_irqsave(&xhci->lock, flags);
}
- xhci_set_link_state(xhci, ports[wIndex], USB_SS_PORT_LS_U3);
+ xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U3);
spin_unlock_irqrestore(&xhci->lock, flags);
while (retries--) {
usleep_range(4000, 8000);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if ((temp & PORT_PLS_MASK) == XDEV_U3)
break;
}
spin_lock_irqsave(&xhci->lock, flags);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
bus_state->suspended_ports |= 1 << wIndex;
}
break;
@@ -1392,39 +1395,38 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
break;
case USB_PORT_FEAT_RESET:
temp = (temp | PORT_RESET);
- writel(temp, ports[wIndex]->addr);
+ writel(temp, port->addr);
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
xhci_dbg(xhci, "set port reset, actual port %d-%d status = 0x%x\n",
- hcd->self.busnum, wIndex + 1, temp);
+ hcd->self.busnum, portnum1, temp);
break;
case USB_PORT_FEAT_REMOTE_WAKE_MASK:
- xhci_set_remote_wake_mask(xhci, ports[wIndex],
- wake_mask);
- temp = readl(ports[wIndex]->addr);
+ xhci_set_remote_wake_mask(xhci, port, wake_mask);
+ temp = readl(port->addr);
xhci_dbg(xhci, "set port remote wake mask, actual port %d-%d status = 0x%x\n",
- hcd->self.busnum, wIndex + 1, temp);
+ hcd->self.busnum, portnum1, temp);
break;
case USB_PORT_FEAT_BH_PORT_RESET:
temp |= PORT_WR;
- writel(temp, ports[wIndex]->addr);
- temp = readl(ports[wIndex]->addr);
+ writel(temp, port->addr);
+ temp = readl(port->addr);
break;
case USB_PORT_FEAT_U1_TIMEOUT:
if (hcd->speed < HCD_USB3)
goto error;
- temp = readl(ports[wIndex]->addr + PORTPMSC);
+ temp = readl(port->addr + PORTPMSC);
temp &= ~PORT_U1_TIMEOUT_MASK;
temp |= PORT_U1_TIMEOUT(timeout);
- writel(temp, ports[wIndex]->addr + PORTPMSC);
+ writel(temp, port->addr + PORTPMSC);
break;
case USB_PORT_FEAT_U2_TIMEOUT:
if (hcd->speed < HCD_USB3)
goto error;
- temp = readl(ports[wIndex]->addr + PORTPMSC);
+ temp = readl(port->addr + PORTPMSC);
temp &= ~PORT_U2_TIMEOUT_MASK;
temp |= PORT_U2_TIMEOUT(timeout);
- writel(temp, ports[wIndex]->addr + PORTPMSC);
+ writel(temp, port->addr + PORTPMSC);
break;
case USB_PORT_FEAT_TEST:
/* 4.19.6 Port Test Modes (USB2 Test Mode) */
@@ -1440,13 +1442,16 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
goto error;
}
/* unblock any posted writes */
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
break;
case ClearPortFeature:
- if (!wIndex || wIndex > max_ports)
+ if (!portnum1 || portnum1 > max_ports)
goto error;
+
+ port = ports[portnum1 - 1];
+
wIndex--;
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
if (temp == ~(u32)0) {
xhci_hc_died(xhci);
retval = -ENODEV;
@@ -1456,7 +1461,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
temp = xhci_port_state_to_neutral(temp);
switch (wValue) {
case USB_PORT_FEAT_SUSPEND:
- temp = readl(ports[wIndex]->addr);
+ temp = readl(port->addr);
xhci_dbg(xhci, "clear USB_PORT_FEAT_SUSPEND\n");
xhci_dbg(xhci, "PORTSC %04x\n", temp);
if (temp & PORT_RESET)
@@ -1467,20 +1472,18 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
set_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_start_port_resume(&hcd->self, wIndex);
- xhci_set_link_state(xhci, ports[wIndex],
- XDEV_RESUME);
+ xhci_set_link_state(xhci, port, XDEV_RESUME);
spin_unlock_irqrestore(&xhci->lock, flags);
msleep(USB_RESUME_TIMEOUT);
spin_lock_irqsave(&xhci->lock, flags);
- xhci_set_link_state(xhci, ports[wIndex],
- XDEV_U0);
+ xhci_set_link_state(xhci, port, XDEV_U0);
clear_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_end_port_resume(&hcd->self, wIndex);
}
bus_state->port_c_suspend |= 1 << wIndex;
slot_id = xhci_find_slot_id_by_port(hcd, xhci,
- wIndex + 1);
+ portnum1);
if (!slot_id) {
xhci_dbg(xhci, "slot_id is zero\n");
goto error;
@@ -1498,11 +1501,11 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
case USB_PORT_FEAT_C_PORT_LINK_STATE:
case USB_PORT_FEAT_C_PORT_CONFIG_ERROR:
xhci_clear_port_change_bit(xhci, wValue, wIndex,
- ports[wIndex]->addr, temp);
+ port->addr, temp);
break;
case USB_PORT_FEAT_ENABLE:
xhci_disable_port(hcd, xhci, wIndex,
- ports[wIndex]->addr, temp);
+ port->addr, temp);
break;
case USB_PORT_FEAT_POWER:
xhci_set_port_power(xhci, hcd, wIndex, false, &flags);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 136/202] xhci: move port specific items such as state completions to port structure
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 135/202] xhci: cleanup xhci_hub_control port references Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 137/202] xhci: rename resume_done to resume_timestamp Greg Kroah-Hartman
` (71 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit 2996e9fc00c378987c18ecbafe5624581b18c0d6 ]
Now that we have a port structure for each port it makes sense to
move per port variables, timestamps and completions there.
Get rid of storing bitfileds and arrays of port specific items per bus.
Move
unsigned long resume_done;
insigned long rexit_ports
struct completion rexit_done;
struct completion u3exit_done;
Rename rexit_ports to rexit_active, and remove a redundant hcd
speed check while checking if rexit_active is set.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-8-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 31 +++++++++++++++----------------
drivers/usb/host/xhci-mem.c | 10 +++-------
drivers/usb/host/xhci-ring.c | 13 ++++++-------
drivers/usb/host/xhci.h | 9 ++++-----
4 files changed, 28 insertions(+), 35 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index c2a8d455eeace..f836710bcd6e6 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -838,7 +838,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
return -EINVAL;
}
/* did port event handler already start resume timing? */
- if (!bus_state->resume_done[wIndex]) {
+ if (!port->resume_done) {
/* If not, maybe we are in a host initated resume? */
if (test_bit(wIndex, &bus_state->resuming_ports)) {
/* Host initated resume doesn't time the resume
@@ -855,28 +855,27 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(wIndex, &bus_state->resuming_ports);
- bus_state->resume_done[wIndex] = timeout;
+ port->resume_done = timeout;
mod_timer(&hcd->rh_timer, timeout);
usb_hcd_start_port_resume(&hcd->self, wIndex);
}
/* Has resume been signalled for USB_RESUME_TIME yet? */
- } else if (time_after_eq(jiffies, bus_state->resume_done[wIndex])) {
+ } else if (time_after_eq(jiffies, port->resume_done)) {
int time_left;
xhci_dbg(xhci, "resume USB2 port %d-%d\n",
hcd->self.busnum, wIndex + 1);
- bus_state->resume_done[wIndex] = 0;
+ port->resume_done = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
-
- set_bit(wIndex, &bus_state->rexit_ports);
+ port->rexit_active = true;
xhci_test_and_clear_bit(xhci, port, PORT_PLC);
xhci_set_link_state(xhci, port, XDEV_U0);
spin_unlock_irqrestore(&xhci->lock, *flags);
time_left = wait_for_completion_timeout(
- &bus_state->rexit_done[wIndex],
+ &port->rexit_done,
msecs_to_jiffies(XHCI_MAX_REXIT_TIMEOUT_MS));
spin_lock_irqsave(&xhci->lock, *flags);
@@ -895,7 +894,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
hcd->self.busnum, wIndex + 1, port_status);
*status |= USB_PORT_STAT_SUSPEND;
- clear_bit(wIndex, &bus_state->rexit_ports);
+ port->rexit_active = false;
}
usb_hcd_end_port_resume(&hcd->self, wIndex);
@@ -1002,10 +1001,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
if (link_state == XDEV_U2)
*status |= USB_PORT_STAT_L1;
if (link_state == XDEV_U0) {
- if (bus_state->resume_done[portnum])
+ if (port->resume_done)
usb_hcd_end_port_resume(&port->rhub->hcd->self,
portnum);
- bus_state->resume_done[portnum] = 0;
+ port->resume_done = 0;
clear_bit(portnum, &bus_state->resuming_ports);
if (bus_state->suspended_ports & (1 << portnum)) {
bus_state->suspended_ports &= ~(1 << portnum);
@@ -1077,11 +1076,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
* Clear stale usb2 resume signalling variables in case port changed
* state during resume signalling. For example on error
*/
- if ((bus_state->resume_done[wIndex] ||
+ if ((port->resume_done ||
test_bit(wIndex, &bus_state->resuming_ports)) &&
(raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
- bus_state->resume_done[wIndex] = 0;
+ port->resume_done = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_end_port_resume(&hcd->self, wIndex);
}
@@ -1340,7 +1339,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
pls == XDEV_RESUME ||
pls == XDEV_RECOVERY) {
wait_u0 = true;
- reinit_completion(&bus_state->u3exit_done[wIndex]);
+ reinit_completion(&port->u3exit_done);
}
if (pls <= XDEV_U3) /* U1, U2, U3 */
xhci_set_link_state(xhci, port, USB_SS_PORT_LS_U0);
@@ -1350,7 +1349,7 @@ int xhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue,
break;
}
spin_unlock_irqrestore(&xhci->lock, flags);
- if (!wait_for_completion_timeout(&bus_state->u3exit_done[wIndex],
+ if (!wait_for_completion_timeout(&port->u3exit_done,
msecs_to_jiffies(500)))
xhci_dbg(xhci, "missing U0 port change event for port %d-%d\n",
hcd->self.busnum, portnum1);
@@ -1589,8 +1588,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
if ((temp & mask) != 0 ||
(bus_state->port_c_suspend & 1 << i) ||
- (bus_state->resume_done[i] && time_after_eq(
- jiffies, bus_state->resume_done[i]))) {
+ (ports[i]->resume_done && time_after_eq(
+ jiffies, ports[i]->resume_done))) {
buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
status = 1;
}
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index 390bdf823e088..006e1b15fbda9 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -2336,6 +2336,9 @@ static int xhci_setup_port_arrays(struct xhci_hcd *xhci, gfp_t flags)
xhci->hw_ports[i].addr = &xhci->op_regs->port_status_base +
NUM_PORT_REGS * i;
xhci->hw_ports[i].hw_portnum = i;
+
+ init_completion(&xhci->hw_ports[i].rexit_done);
+ init_completion(&xhci->hw_ports[i].u3exit_done);
}
xhci->rh_bw = kcalloc_node(num_ports, sizeof(*xhci->rh_bw), flags,
@@ -2603,13 +2606,6 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
*/
for (i = 0; i < MAX_HC_SLOTS; i++)
xhci->devs[i] = NULL;
- for (i = 0; i < USB_MAXCHILDREN; i++) {
- xhci->usb2_rhub.bus_state.resume_done[i] = 0;
- xhci->usb3_rhub.bus_state.resume_done[i] = 0;
- /* Only the USB 2.0 completions will ever be used. */
- init_completion(&xhci->usb2_rhub.bus_state.rexit_done[i]);
- init_completion(&xhci->usb3_rhub.bus_state.u3exit_done[i]);
- }
if (scratchpad_alloc(xhci, flags))
goto fail;
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index 248bfa3020de3..ada9977c41aa9 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1851,7 +1851,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
goto cleanup;
} else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
xhci_dbg(xhci, "resume HS port %d\n", port_id);
- bus_state->resume_done[hcd_portnum] = jiffies +
+ port->resume_done = jiffies +
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(hcd_portnum, &bus_state->resuming_ports);
/* Do the rest in GetPortStatus after resume time delay.
@@ -1860,7 +1860,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
*/
set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
mod_timer(&hcd->rh_timer,
- bus_state->resume_done[hcd_portnum]);
+ port->resume_done);
usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
bogus_port_status = true;
}
@@ -1872,7 +1872,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
(portsc & PORT_PLS_MASK) == XDEV_U1 ||
(portsc & PORT_PLS_MASK) == XDEV_U2)) {
xhci_dbg(xhci, "resume SS port %d finished\n", port_id);
- complete(&bus_state->u3exit_done[hcd_portnum]);
+ complete(&port->u3exit_done);
/* We've just brought the device into U0/1/2 through either the
* Resume state after a device remote wakeup, or through the
* U3Exit state after a host-initiated resume. If it's a device
@@ -1897,10 +1897,9 @@ static void handle_port_status(struct xhci_hcd *xhci,
* RExit to a disconnect state). If so, let the the driver know it's
* out of the RExit state.
*/
- if (!DEV_SUPERSPEED_ANY(portsc) && hcd->speed < HCD_USB3 &&
- test_and_clear_bit(hcd_portnum,
- &bus_state->rexit_ports)) {
- complete(&bus_state->rexit_done[hcd_portnum]);
+ if (hcd->speed < HCD_USB3 && port->rexit_active) {
+ complete(&port->rexit_done);
+ port->rexit_active = false;
bogus_port_status = true;
goto cleanup;
}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 6a7c05940e661..14eb13a85fce3 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1699,13 +1699,8 @@ struct xhci_bus_state {
u32 port_c_suspend;
u32 suspended_ports;
u32 port_remote_wakeup;
- unsigned long resume_done[USB_MAXCHILDREN];
/* which ports have started to resume */
unsigned long resuming_ports;
- /* Which ports are waiting on RExit to U0 transition. */
- unsigned long rexit_ports;
- struct completion rexit_done[USB_MAXCHILDREN];
- struct completion u3exit_done[USB_MAXCHILDREN];
};
@@ -1729,6 +1724,10 @@ struct xhci_port {
struct xhci_hub *rhub;
struct xhci_port_cap *port_cap;
unsigned int lpm_incapable:1;
+ unsigned long resume_done;
+ bool rexit_active;
+ struct completion rexit_done;
+ struct completion u3exit_done;
};
struct xhci_hub {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 137/202] xhci: rename resume_done to resume_timestamp
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 136/202] xhci: move port specific items such as state completions to port structure Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 138/202] xhci: clear usb2 resume related variables in one place Greg Kroah-Hartman
` (70 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit a909d629ae77b97b6288bc3cfe68560454bf79c6 ]
resume_done is just a timestamp, avoid confusing it with completions
related to port state transitions that are named *_done
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-10-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 20 ++++++++++----------
drivers/usb/host/xhci-ring.c | 4 ++--
drivers/usb/host/xhci.h | 2 +-
3 files changed, 13 insertions(+), 13 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index f836710bcd6e6..39c58b1782d5c 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -838,7 +838,7 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
return -EINVAL;
}
/* did port event handler already start resume timing? */
- if (!port->resume_done) {
+ if (!port->resume_timestamp) {
/* If not, maybe we are in a host initated resume? */
if (test_bit(wIndex, &bus_state->resuming_ports)) {
/* Host initated resume doesn't time the resume
@@ -855,18 +855,18 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(wIndex, &bus_state->resuming_ports);
- port->resume_done = timeout;
+ port->resume_timestamp = timeout;
mod_timer(&hcd->rh_timer, timeout);
usb_hcd_start_port_resume(&hcd->self, wIndex);
}
/* Has resume been signalled for USB_RESUME_TIME yet? */
- } else if (time_after_eq(jiffies, port->resume_done)) {
+ } else if (time_after_eq(jiffies, port->resume_timestamp)) {
int time_left;
xhci_dbg(xhci, "resume USB2 port %d-%d\n",
hcd->self.busnum, wIndex + 1);
- port->resume_done = 0;
+ port->resume_timestamp = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
port->rexit_active = true;
@@ -1001,10 +1001,10 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
if (link_state == XDEV_U2)
*status |= USB_PORT_STAT_L1;
if (link_state == XDEV_U0) {
- if (port->resume_done)
+ if (port->resume_timestamp)
usb_hcd_end_port_resume(&port->rhub->hcd->self,
portnum);
- port->resume_done = 0;
+ port->resume_timestamp = 0;
clear_bit(portnum, &bus_state->resuming_ports);
if (bus_state->suspended_ports & (1 << portnum)) {
bus_state->suspended_ports &= ~(1 << portnum);
@@ -1076,11 +1076,11 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
* Clear stale usb2 resume signalling variables in case port changed
* state during resume signalling. For example on error
*/
- if ((port->resume_done ||
+ if ((port->resume_timestamp ||
test_bit(wIndex, &bus_state->resuming_ports)) &&
(raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
(raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
- port->resume_done = 0;
+ port->resume_timestamp = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
usb_hcd_end_port_resume(&hcd->self, wIndex);
}
@@ -1588,8 +1588,8 @@ int xhci_hub_status_data(struct usb_hcd *hcd, char *buf)
if ((temp & mask) != 0 ||
(bus_state->port_c_suspend & 1 << i) ||
- (ports[i]->resume_done && time_after_eq(
- jiffies, ports[i]->resume_done))) {
+ (ports[i]->resume_timestamp && time_after_eq(
+ jiffies, ports[i]->resume_timestamp))) {
buf[(i + 1) / 8] |= 1 << (i + 1) % 8;
status = 1;
}
diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
index ada9977c41aa9..5ee095a5d38aa 100644
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
@@ -1851,7 +1851,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
goto cleanup;
} else if (!test_bit(hcd_portnum, &bus_state->resuming_ports)) {
xhci_dbg(xhci, "resume HS port %d\n", port_id);
- port->resume_done = jiffies +
+ port->resume_timestamp = jiffies +
msecs_to_jiffies(USB_RESUME_TIMEOUT);
set_bit(hcd_portnum, &bus_state->resuming_ports);
/* Do the rest in GetPortStatus after resume time delay.
@@ -1860,7 +1860,7 @@ static void handle_port_status(struct xhci_hcd *xhci,
*/
set_bit(HCD_FLAG_POLL_RH, &hcd->flags);
mod_timer(&hcd->rh_timer,
- port->resume_done);
+ port->resume_timestamp);
usb_hcd_start_port_resume(&hcd->self, hcd_portnum);
bogus_port_status = true;
}
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index 14eb13a85fce3..bb3c362a194b2 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1724,7 +1724,7 @@ struct xhci_port {
struct xhci_hub *rhub;
struct xhci_port_cap *port_cap;
unsigned int lpm_incapable:1;
- unsigned long resume_done;
+ unsigned long resume_timestamp;
bool rexit_active;
struct completion rexit_done;
struct completion u3exit_done;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 138/202] xhci: clear usb2 resume related variables in one place.
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 137/202] xhci: rename resume_done to resume_timestamp Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 139/202] xhci: decouple usb2 port resume and get_port_status request handling Greg Kroah-Hartman
` (69 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit 0e6275452ce26d7ff274a5c1b15ed581a26f7986 ]
Initially resume related USB2 variables were cleared once port
successfully resumed to U0. Later code was added to clean up
stale resume variables in case of port failed to resume to U0.
Clear the variables in one place after port is no longer resuming
or in suspended U3 state.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-11-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 38 ++++++++++++++++---------------------
1 file changed, 16 insertions(+), 22 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 39c58b1782d5c..0aac8fcd37798 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -985,7 +985,6 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
struct xhci_bus_state *bus_state;
u32 link_state;
u32 portnum;
- int ret;
bus_state = &port->rhub->bus_state;
link_state = portsc & PORT_PLS_MASK;
@@ -1001,23 +1000,30 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
if (link_state == XDEV_U2)
*status |= USB_PORT_STAT_L1;
if (link_state == XDEV_U0) {
- if (port->resume_timestamp)
- usb_hcd_end_port_resume(&port->rhub->hcd->self,
- portnum);
- port->resume_timestamp = 0;
- clear_bit(portnum, &bus_state->resuming_ports);
if (bus_state->suspended_ports & (1 << portnum)) {
bus_state->suspended_ports &= ~(1 << portnum);
bus_state->port_c_suspend |= 1 << portnum;
}
}
if (link_state == XDEV_RESUME) {
- ret = xhci_handle_usb2_port_link_resume(port, status,
- portsc, flags);
- if (ret)
- return;
+ xhci_handle_usb2_port_link_resume(port, status, portsc,
+ flags);
}
}
+
+ /*
+ * Clear usb2 resume signalling variables if port is no longer suspended
+ * or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
+ * error state. Resume related variables should be cleared in all those cases.
+ */
+ if ((link_state != XDEV_U3 &&
+ link_state != XDEV_RESUME) &&
+ (port->resume_timestamp ||
+ test_bit(portnum, &bus_state->resuming_ports))) {
+ port->resume_timestamp = 0;
+ clear_bit(portnum, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ }
}
/*
@@ -1072,18 +1078,6 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd,
else
xhci_get_usb2_port_status(port, &status, raw_port_status,
flags);
- /*
- * Clear stale usb2 resume signalling variables in case port changed
- * state during resume signalling. For example on error
- */
- if ((port->resume_timestamp ||
- test_bit(wIndex, &bus_state->resuming_ports)) &&
- (raw_port_status & PORT_PLS_MASK) != XDEV_U3 &&
- (raw_port_status & PORT_PLS_MASK) != XDEV_RESUME) {
- port->resume_timestamp = 0;
- clear_bit(wIndex, &bus_state->resuming_ports);
- usb_hcd_end_port_resume(&hcd->self, wIndex);
- }
if (bus_state->port_c_suspend & (1 << wIndex))
status |= USB_PORT_STAT_C_SUSPEND << 16;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 139/202] xhci: decouple usb2 port resume and get_port_status request handling
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 138/202] xhci: clear usb2 resume related variables in one place Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 140/202] xhci: track port suspend state correctly in unsuccessful resume cases Greg Kroah-Hartman
` (68 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mathias Nyman, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit b0425784b942fffbbdb804896197f1dbccda37c5 ]
The get port status hub request code in xhci-hub.c will complete usb2
port resume signalling if signalling has been going on for long enough.
The code that completes the resume signalling, and the code that returns
the port status have gotten too intertwined, so separate them a bit.
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230202150505.618915-12-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: d7cdfc319b2b ("xhci: track port suspend state correctly in unsuccessful resume cases")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 47 ++++++++++++++++++++-----------------
1 file changed, 25 insertions(+), 22 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index 0aac8fcd37798..b8dad0a3aab39 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -819,7 +819,7 @@ static void xhci_del_comp_mod_timer(struct xhci_hcd *xhci, u32 status,
}
static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
- u32 *status, u32 portsc,
+ u32 portsc,
unsigned long *flags)
{
struct xhci_bus_state *bus_state;
@@ -834,7 +834,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
wIndex = port->hcd_portnum;
if ((portsc & PORT_RESET) || !(portsc & PORT_PE)) {
- *status = 0xffffffff;
return -EINVAL;
}
/* did port event handler already start resume timing? */
@@ -868,6 +867,8 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
port->resume_timestamp = 0;
clear_bit(wIndex, &bus_state->resuming_ports);
+
+ reinit_completion(&port->rexit_done);
port->rexit_active = true;
xhci_test_and_clear_bit(xhci, port, PORT_PLC);
@@ -884,7 +885,6 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
wIndex + 1);
if (!slot_id) {
xhci_dbg(xhci, "slot_id is zero\n");
- *status = 0xffffffff;
return -ENODEV;
}
xhci_ring_device(xhci, slot_id);
@@ -893,22 +893,19 @@ static int xhci_handle_usb2_port_link_resume(struct xhci_port *port,
xhci_warn(xhci, "Port resume timed out, port %d-%d: 0x%x\n",
hcd->self.busnum, wIndex + 1, port_status);
- *status |= USB_PORT_STAT_SUSPEND;
- port->rexit_active = false;
+ /*
+ * keep rexit_active set if U0 transition failed so we
+ * know to report PORT_STAT_SUSPEND status back to
+ * usbcore. It will be cleared later once the port is
+ * out of RESUME/U3 state
+ */
}
usb_hcd_end_port_resume(&hcd->self, wIndex);
bus_state->port_c_suspend |= 1 << wIndex;
bus_state->suspended_ports &= ~(1 << wIndex);
- } else {
- /*
- * The resume has been signaling for less than
- * USB_RESUME_TIME. Report the port status as SUSPEND,
- * let the usbcore check port status again and clear
- * resume signaling later.
- */
- *status |= USB_PORT_STAT_SUSPEND;
}
+
return 0;
}
@@ -985,6 +982,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
struct xhci_bus_state *bus_state;
u32 link_state;
u32 portnum;
+ int err;
bus_state = &port->rhub->bus_state;
link_state = portsc & PORT_PLS_MASK;
@@ -1006,8 +1004,12 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
}
}
if (link_state == XDEV_RESUME) {
- xhci_handle_usb2_port_link_resume(port, status, portsc,
- flags);
+ err = xhci_handle_usb2_port_link_resume(port, portsc,
+ flags);
+ if (err < 0)
+ *status = 0xffffffff;
+ else if (port->resume_timestamp || port->rexit_active)
+ *status |= USB_PORT_STAT_SUSPEND;
}
}
@@ -1016,13 +1018,14 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
* or resuming. Port either resumed to U0/U1/U2, disconnected, or in a
* error state. Resume related variables should be cleared in all those cases.
*/
- if ((link_state != XDEV_U3 &&
- link_state != XDEV_RESUME) &&
- (port->resume_timestamp ||
- test_bit(portnum, &bus_state->resuming_ports))) {
- port->resume_timestamp = 0;
- clear_bit(portnum, &bus_state->resuming_ports);
- usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ if (link_state != XDEV_U3 && link_state != XDEV_RESUME) {
+ if (port->resume_timestamp ||
+ test_bit(portnum, &bus_state->resuming_ports)) {
+ port->resume_timestamp = 0;
+ clear_bit(portnum, &bus_state->resuming_ports);
+ usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
+ }
+ port->rexit_active = 0;
}
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 140/202] xhci: track port suspend state correctly in unsuccessful resume cases
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 139/202] xhci: decouple usb2 port resume and get_port_status request handling Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 141/202] serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() Greg Kroah-Hartman
` (67 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wesley Cheng, Mathias Nyman,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <mathias.nyman@linux.intel.com>
[ Upstream commit d7cdfc319b2bcf6899ab0a05eec0958bc802a9a1 ]
xhci-hub.c tracks suspended ports in a suspended_port bitfield.
This is checked when responding to a Get_Status(PORT) request to see if a
port in running U0 state was recently resumed, and adds the required
USB_PORT_STAT_C_SUSPEND change bit in those cases.
The suspended_port bit was left uncleared if a device is disconnected
during suspend. The bit remained set even when a new device was connected
and enumerated. The set bit resulted in a incorrect Get_Status(PORT)
response with a bogus USB_PORT_STAT_C_SUSPEND change
bit set once the new device reached U0 link state.
USB_PORT_STAT_C_SUSPEND change bit is only used for USB2 ports, but
xhci-hub keeps track of both USB2 and USB3 suspended ports.
Cc: stable@vger.kernel.org
Reported-by: Wesley Cheng <quic_wcheng@quicinc.com>
Closes: https://lore.kernel.org/linux-usb/d68aa806-b26a-0e43-42fb-b8067325e967@quicinc.com/
Fixes: 1d5810b6923c ("xhci: Rework port suspend structures for limited ports.")
Tested-by: Wesley Cheng <quic_wcheng@quicinc.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20230915143108.1532163-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c
index b8dad0a3aab39..e92f920256b2e 100644
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -957,19 +957,19 @@ static void xhci_get_usb3_port_status(struct xhci_port *port, u32 *status,
*status |= USB_PORT_STAT_C_CONFIG_ERROR << 16;
/* USB3 specific wPortStatus bits */
- if (portsc & PORT_POWER) {
+ if (portsc & PORT_POWER)
*status |= USB_SS_PORT_STAT_POWER;
- /* link state handling */
- if (link_state == XDEV_U0)
- bus_state->suspended_ports &= ~(1 << portnum);
- }
- /* remote wake resume signaling complete */
- if (bus_state->port_remote_wakeup & (1 << portnum) &&
+ /* no longer suspended or resuming */
+ if (link_state != XDEV_U3 &&
link_state != XDEV_RESUME &&
link_state != XDEV_RECOVERY) {
- bus_state->port_remote_wakeup &= ~(1 << portnum);
- usb_hcd_end_port_resume(&hcd->self, portnum);
+ /* remote wake resume signaling complete */
+ if (bus_state->port_remote_wakeup & (1 << portnum)) {
+ bus_state->port_remote_wakeup &= ~(1 << portnum);
+ usb_hcd_end_port_resume(&hcd->self, portnum);
+ }
+ bus_state->suspended_ports &= ~(1 << portnum);
}
xhci_hub_report_usb3_link_state(xhci, status, portsc);
@@ -1026,6 +1026,7 @@ static void xhci_get_usb2_port_status(struct xhci_port *port, u32 *status,
usb_hcd_end_port_resume(&port->rhub->hcd->self, portnum);
}
port->rexit_active = 0;
+ bus_state->suspended_ports &= ~(1 << portnum);
}
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 141/202] serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 140/202] xhci: track port suspend state correctly in unsuccessful resume cases Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 142/202] serial: 8250_omap: Fix errors with no_console_suspend Greg Kroah-Hartman
` (66 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tony Lindgren, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 398cecc24846e867b9f90a0bd22730e3df6b05be ]
We must idle the uart only after serial8250_unregister_port(). Otherwise
unbinding the uart via sysfs while doing cat on the port produces an
imprecise external abort:
mem_serial_in from omap_8250_pm+0x44/0xf4
omap_8250_pm from uart_hangup+0xe0/0x194
uart_hangup from __tty_hangup.part.0+0x37c/0x3a8
__tty_hangup.part.0 from uart_remove_one_port+0x9c/0x22c
uart_remove_one_port from serial8250_unregister_port+0x60/0xe8
serial8250_unregister_port from omap8250_remove+0x6c/0xd0
omap8250_remove from platform_remove+0x28/0x54
Turns out the driver needs to have runtime PM functional before the
driver probe calls serial8250_register_8250_port(). And it needs
runtime PM after driver remove calls serial8250_unregister_port().
On probe, we need to read registers before registering the port in
omap_serial_fill_features_erratas(). We do that with custom uart_read()
already.
On remove, after serial8250_unregister_port(), we need to write to the
uart registers to idle the device. Let's add a custom uart_write() for
that.
Currently the uart register access depends on port->membase to be
initialized, which won't work after serial8250_unregister_port().
Let's use priv->membase instead, and use it for runtime PM related
functions to remove the dependency to port->membase for early and
late register access.
Note that during use, we need to check for a valid port in the runtime PM
related functions. This is needed for the optional wakeup configuration.
We now need to set the drvdata a bit earlier so it's available for the
runtime PM functions.
With the port checks in runtime PM functions, the old checks for priv in
omap8250_runtime_suspend() and omap8250_runtime_resume() functions are no
longer needed and are removed.
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230508082014.23083-3-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 560706eff7c8 ("serial: 8250_omap: Fix errors with no_console_suspend")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 70 ++++++++++++++++-------------
1 file changed, 38 insertions(+), 32 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index e26ac3f42e05c..a6f0a74858eab 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -32,6 +32,7 @@
#include "8250.h"
#define DEFAULT_CLK_SPEED 48000000
+#define OMAP_UART_REGSHIFT 2
#define UART_ERRATA_i202_MDR1_ACCESS (1 << 0)
#define OMAP_UART_WER_HAS_TX_WAKEUP (1 << 1)
@@ -109,6 +110,7 @@
#define UART_OMAP_RX_LVL 0x19
struct omap8250_priv {
+ void __iomem *membase;
int line;
u8 habit;
u8 mdr1;
@@ -152,9 +154,14 @@ static void omap_8250_rx_dma_flush(struct uart_8250_port *p);
static inline void omap_8250_rx_dma_flush(struct uart_8250_port *p) { }
#endif
-static u32 uart_read(struct uart_8250_port *up, u32 reg)
+static u32 uart_read(struct omap8250_priv *priv, u32 reg)
{
- return readl(up->port.membase + (reg << up->port.regshift));
+ return readl(priv->membase + (reg << OMAP_UART_REGSHIFT));
+}
+
+static void uart_write(struct omap8250_priv *priv, u32 reg, u32 val)
+{
+ writel(val, priv->membase + (reg << OMAP_UART_REGSHIFT));
}
/*
@@ -552,7 +559,7 @@ static void omap_serial_fill_features_erratas(struct uart_8250_port *up,
u32 mvr, scheme;
u16 revision, major, minor;
- mvr = uart_read(up, UART_OMAP_MVER);
+ mvr = uart_read(priv, UART_OMAP_MVER);
/* Check revision register scheme */
scheme = mvr >> OMAP_UART_MVR_SCHEME_SHIFT;
@@ -1336,7 +1343,7 @@ static int omap8250_probe(struct platform_device *pdev)
UPF_HARD_FLOW;
up.port.private_data = priv;
- up.port.regshift = 2;
+ up.port.regshift = OMAP_UART_REGSHIFT;
up.port.fifosize = 64;
up.tx_loadsz = 64;
up.capabilities = UART_CAP_FIFO;
@@ -1397,6 +1404,8 @@ static int omap8250_probe(struct platform_device *pdev)
DEFAULT_CLK_SPEED);
}
+ priv->membase = membase;
+ priv->line = -ENODEV;
priv->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
priv->calc_latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
cpu_latency_qos_add_request(&priv->pm_qos_request, priv->latency);
@@ -1404,6 +1413,8 @@ static int omap8250_probe(struct platform_device *pdev)
spin_lock_init(&priv->rx_dma_lock);
+ platform_set_drvdata(pdev, priv);
+
device_init_wakeup(&pdev->dev, true);
pm_runtime_enable(&pdev->dev);
pm_runtime_use_autosuspend(&pdev->dev);
@@ -1465,7 +1476,6 @@ static int omap8250_probe(struct platform_device *pdev)
goto err;
}
priv->line = ret;
- platform_set_drvdata(pdev, priv);
pm_runtime_mark_last_busy(&pdev->dev);
pm_runtime_put_autosuspend(&pdev->dev);
return 0;
@@ -1487,11 +1497,12 @@ static int omap8250_remove(struct platform_device *pdev)
if (err)
return err;
+ serial8250_unregister_port(priv->line);
+ priv->line = -ENODEV;
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_put_sync(&pdev->dev);
flush_work(&priv->qos_work);
pm_runtime_disable(&pdev->dev);
- serial8250_unregister_port(priv->line);
cpu_latency_qos_remove_request(&priv->pm_qos_request);
device_init_wakeup(&pdev->dev, false);
return 0;
@@ -1577,7 +1588,6 @@ static int omap8250_lost_context(struct uart_8250_port *up)
static int omap8250_soft_reset(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
- struct uart_8250_port *up = serial8250_get_port(priv->line);
int timeout = 100;
int sysc;
int syss;
@@ -1591,20 +1601,20 @@ static int omap8250_soft_reset(struct device *dev)
* needing omap8250_soft_reset() quirk. Do it in two writes as
* recommended in the comment for omap8250_update_scr().
*/
- serial_out(up, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
- serial_out(up, UART_OMAP_SCR,
+ uart_write(priv, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1);
+ uart_write(priv, UART_OMAP_SCR,
OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL);
- sysc = serial_in(up, UART_OMAP_SYSC);
+ sysc = uart_read(priv, UART_OMAP_SYSC);
/* softreset the UART */
sysc |= OMAP_UART_SYSC_SOFTRESET;
- serial_out(up, UART_OMAP_SYSC, sysc);
+ uart_write(priv, UART_OMAP_SYSC, sysc);
/* By experiments, 1us enough for reset complete on AM335x */
do {
udelay(1);
- syss = serial_in(up, UART_OMAP_SYSS);
+ syss = uart_read(priv, UART_OMAP_SYSS);
} while (--timeout && !(syss & OMAP_UART_SYSS_RESETDONE));
if (!timeout) {
@@ -1618,13 +1628,10 @@ static int omap8250_soft_reset(struct device *dev)
static int omap8250_runtime_suspend(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
- struct uart_8250_port *up;
-
- /* In case runtime-pm tries this before we are setup */
- if (!priv)
- return 0;
+ struct uart_8250_port *up = NULL;
- up = serial8250_get_port(priv->line);
+ if (priv->line >= 0)
+ up = serial8250_get_port(priv->line);
/*
* When using 'no_console_suspend', the console UART must not be
* suspended. Since driver suspend is managed by runtime suspend,
@@ -1632,7 +1639,7 @@ static int omap8250_runtime_suspend(struct device *dev)
* active during suspend.
*/
if (priv->is_suspending && !console_suspend_enabled) {
- if (uart_console(&up->port))
+ if (up && uart_console(&up->port))
return -EBUSY;
}
@@ -1643,13 +1650,15 @@ static int omap8250_runtime_suspend(struct device *dev)
if (ret)
return ret;
- /* Restore to UART mode after reset (for wakeup) */
- omap8250_update_mdr1(up, priv);
- /* Restore wakeup enable register */
- serial_out(up, UART_OMAP_WER, priv->wer);
+ if (up) {
+ /* Restore to UART mode after reset (for wakeup) */
+ omap8250_update_mdr1(up, priv);
+ /* Restore wakeup enable register */
+ serial_out(up, UART_OMAP_WER, priv->wer);
+ }
}
- if (up->dma && up->dma->rxchan)
+ if (up && up->dma && up->dma->rxchan)
omap_8250_rx_dma_flush(up);
priv->latency = PM_QOS_CPU_LATENCY_DEFAULT_VALUE;
@@ -1661,18 +1670,15 @@ static int omap8250_runtime_suspend(struct device *dev)
static int omap8250_runtime_resume(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
- struct uart_8250_port *up;
-
- /* In case runtime-pm tries this before we are setup */
- if (!priv)
- return 0;
+ struct uart_8250_port *up = NULL;
- up = serial8250_get_port(priv->line);
+ if (priv->line >= 0)
+ up = serial8250_get_port(priv->line);
- if (omap8250_lost_context(up))
+ if (up && omap8250_lost_context(up))
omap8250_restore_regs(up);
- if (up->dma && up->dma->rxchan && !(priv->habit & UART_HAS_EFR2))
+ if (up && up->dma && up->dma->rxchan && !(priv->habit & UART_HAS_EFR2))
omap_8250_rx_dma(up);
priv->latency = priv->calc_latency;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 142/202] serial: 8250_omap: Fix errors with no_console_suspend
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 141/202] serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 143/202] drm/amd/display: only check available pipe to disable vbios mode Greg Kroah-Hartman
` (65 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Udit Kumar, Thomas Richard,
Tony Lindgren, Dhruva Gole, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 560706eff7c8e5621b0d63afe0866e0e1906e87e ]
We now get errors on system suspend if no_console_suspend is set as
reported by Thomas. The errors started with commit 20a41a62618d ("serial:
8250_omap: Use force_suspend and resume for system suspend").
Let's fix the issue by checking for console_suspend_enabled in the system
suspend and resume path.
Note that with this fix the checks for console_suspend_enabled in
omap8250_runtime_suspend() become useless. We now keep runtime PM usage
count for an attached kernel console starting with commit bedb404e91bb
("serial: 8250_port: Don't use power management for kernel console").
Fixes: 20a41a62618d ("serial: 8250_omap: Use force_suspend and resume for system suspend")
Cc: stable <stable@kernel.org>
Cc: Udit Kumar <u-kumar1@ti.com>
Reported-by: Thomas Richard <thomas.richard@bootlin.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Tested-by: Thomas Richard <thomas.richard@bootlin.com>
Reviewed-by: Dhruva Gole <d-gole@ti.com>
Link: https://lore.kernel.org/r/20230926061319.15140-1-tony@atomide.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 25 ++++++++++---------------
1 file changed, 10 insertions(+), 15 deletions(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index a6f0a74858eab..e7e84aa2c5f84 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1532,7 +1532,7 @@ static int omap8250_suspend(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
struct uart_8250_port *up = serial8250_get_port(priv->line);
- int err;
+ int err = 0;
serial8250_suspend_port(priv->line);
@@ -1542,7 +1542,8 @@ static int omap8250_suspend(struct device *dev)
if (!device_may_wakeup(dev))
priv->wer = 0;
serial_out(up, UART_OMAP_WER, priv->wer);
- err = pm_runtime_force_suspend(dev);
+ if (uart_console(&up->port) && console_suspend_enabled)
+ err = pm_runtime_force_suspend(dev);
flush_work(&priv->qos_work);
return err;
@@ -1551,11 +1552,15 @@ static int omap8250_suspend(struct device *dev)
static int omap8250_resume(struct device *dev)
{
struct omap8250_priv *priv = dev_get_drvdata(dev);
+ struct uart_8250_port *up = serial8250_get_port(priv->line);
int err;
- err = pm_runtime_force_resume(dev);
- if (err)
- return err;
+ if (uart_console(&up->port) && console_suspend_enabled) {
+ err = pm_runtime_force_resume(dev);
+ if (err)
+ return err;
+ }
+
serial8250_resume_port(priv->line);
/* Paired with pm_runtime_resume_and_get() in omap8250_suspend() */
pm_runtime_mark_last_busy(dev);
@@ -1632,16 +1637,6 @@ static int omap8250_runtime_suspend(struct device *dev)
if (priv->line >= 0)
up = serial8250_get_port(priv->line);
- /*
- * When using 'no_console_suspend', the console UART must not be
- * suspended. Since driver suspend is managed by runtime suspend,
- * preventing runtime suspend (by returning error) will keep device
- * active during suspend.
- */
- if (priv->is_suspending && !console_suspend_enabled) {
- if (up && uart_console(&up->port))
- return -EBUSY;
- }
if (priv->habit & UART_ERRATA_CLOCK_DISABLE) {
int ret;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 143/202] drm/amd/display: only check available pipe to disable vbios mode.
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 142/202] serial: 8250_omap: Fix errors with no_console_suspend Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 144/202] drm/amd/display: Dont set dpms_off for seamless boot Greg Kroah-Hartman
` (64 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yongqiang Sun, Tony Cheng,
Qingqing Zhuo, Alex Deucher, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yongqiang Sun <yongqiang.sun@amd.com>
[ Upstream commit 850d2fcf3e346a35e4e59e310b867e90e3ef8e5a ]
[Why & How]
1. only need to check first ODM pipe.
2. Only need to check eDP which is on.
Signed-off-by: Yongqiang Sun <yongqiang.sun@amd.com>
Reviewed-by: Tony Cheng <Tony.Cheng@amd.com>
Acked-by: Qingqing Zhuo <qingqing.zhuo@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Stable-dep-of: 23645bca9830 ("drm/amd/display: Don't set dpms_off for seamless boot")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 099542dd31544..9cf287124fe4c 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -862,12 +862,16 @@ static void disable_vbios_mode_if_required(
if (stream == NULL)
continue;
+ // only looking for first odm pipe
+ if (pipe->prev_odm_pipe)
+ continue;
+
if (stream->link->local_sink &&
stream->link->local_sink->sink_signal == SIGNAL_TYPE_EDP) {
link = stream->link;
}
- if (link != NULL) {
+ if (link != NULL && link->link_enc->funcs->is_dig_enabled(link->link_enc)) {
unsigned int enc_inst, tg_inst = 0;
unsigned int pix_clk_100hz;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 144/202] drm/amd/display: Dont set dpms_off for seamless boot
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 143/202] drm/amd/display: only check available pipe to disable vbios mode Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 145/202] drm/connector: Give connector sysfs devices there own device_type Greg Kroah-Hartman
` (63 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charlene Liu, Mario Limonciello,
Alex Deucher, Tom Chung, Daniel Miess, Daniel Wheeler,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Miess <daniel.miess@amd.com>
[ Upstream commit 23645bca98304a2772f0de96f97370dd567d0ae6 ]
[Why]
eDPs fail to light up with seamless boot enabled
[How]
When seamless boot is enabled don't configure dpms_off
in disable_vbios_mode_if_required.
Reviewed-by: Charlene Liu <charlene.liu@amd.com>
Cc: Mario Limonciello <mario.limonciello@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Acked-by: Tom Chung <chiahsuan.chung@amd.com>
Signed-off-by: Daniel Miess <daniel.miess@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd/display/dc/core/dc.c
index 9cf287124fe4c..36a9e9c84ed44 100644
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -862,6 +862,9 @@ static void disable_vbios_mode_if_required(
if (stream == NULL)
continue;
+ if (stream->apply_seamless_boot_optimization)
+ continue;
+
// only looking for first odm pipe
if (pipe->prev_odm_pipe)
continue;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 145/202] drm/connector: Give connector sysfs devices there own device_type
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 144/202] drm/amd/display: Dont set dpms_off for seamless boot Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 146/202] drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) Greg Kroah-Hartman
` (62 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Hans de Goede,
Lyude Paul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 331de7db3012b8e8e8d77beebc8f743e288d4c42 ]
Give connector sysfs devices there own device_type, this allows us to
check if a device passed to functions dealing with generic devices is
a drm_connector or not.
A check like this is necessary in the drm_connector_acpi_bus_match()
function added in the next patch in this series.
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-2-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_sysfs.c | 50 +++++++++++++++++++++++++++----------
1 file changed, 37 insertions(+), 13 deletions(-)
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index f0336c8046392..a3b71478c5904 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -50,6 +50,10 @@ static struct device_type drm_sysfs_device_minor = {
.name = "drm_minor"
};
+static struct device_type drm_sysfs_device_connector = {
+ .name = "drm_connector",
+};
+
struct class *drm_class;
static char *drm_devnode(struct device *dev, umode_t *mode)
@@ -102,6 +106,11 @@ void drm_sysfs_destroy(void)
drm_class = NULL;
}
+static void drm_sysfs_release(struct device *dev)
+{
+ kfree(dev);
+}
+
/*
* Connector properties
*/
@@ -274,27 +283,47 @@ static const struct attribute_group *connector_dev_groups[] = {
int drm_sysfs_connector_add(struct drm_connector *connector)
{
struct drm_device *dev = connector->dev;
+ struct device *kdev;
+ int r;
if (connector->kdev)
return 0;
- connector->kdev =
- device_create_with_groups(drm_class, dev->primary->kdev, 0,
- connector, connector_dev_groups,
- "card%d-%s", dev->primary->index,
- connector->name);
+ kdev = kzalloc(sizeof(*kdev), GFP_KERNEL);
+ if (!kdev)
+ return -ENOMEM;
+
+ device_initialize(kdev);
+ kdev->class = drm_class;
+ kdev->type = &drm_sysfs_device_connector;
+ kdev->parent = dev->primary->kdev;
+ kdev->groups = connector_dev_groups;
+ kdev->release = drm_sysfs_release;
+ dev_set_drvdata(kdev, connector);
+
+ r = dev_set_name(kdev, "card%d-%s", dev->primary->index, connector->name);
+ if (r)
+ goto err_free;
+
DRM_DEBUG("adding \"%s\" to sysfs\n",
connector->name);
- if (IS_ERR(connector->kdev)) {
- DRM_ERROR("failed to register connector device: %ld\n", PTR_ERR(connector->kdev));
- return PTR_ERR(connector->kdev);
+ r = device_add(kdev);
+ if (r) {
+ drm_err(dev, "failed to register connector device: %d\n", r);
+ goto err_free;
}
+ connector->kdev = kdev;
+
if (connector->ddc)
return sysfs_create_link(&connector->kdev->kobj,
&connector->ddc->dev.kobj, "ddc");
return 0;
+
+err_free:
+ put_device(kdev);
+ return r;
}
void drm_sysfs_connector_remove(struct drm_connector *connector)
@@ -375,11 +404,6 @@ void drm_sysfs_connector_status_event(struct drm_connector *connector,
}
EXPORT_SYMBOL(drm_sysfs_connector_status_event);
-static void drm_sysfs_release(struct device *dev)
-{
- kfree(dev);
-}
-
struct device *drm_sysfs_minor_alloc(struct drm_minor *minor)
{
const char *minor_str;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 146/202] drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2)
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 145/202] drm/connector: Give connector sysfs devices there own device_type Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 147/202] drm/connector: Add drm_connector_find_by_fwnode() function (v3) Greg Kroah-Hartman
` (61 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Hans de Goede,
Lyude Paul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 48c429c6d18db115c277b75000152d8fa4cd35d0 ]
Add a fwnode pointer to struct drm_connector and register an acpi_bus_type
for the connectors with the ACPI subsystem (when CONFIG_ACPI is enabled).
The adding of the fwnode pointer allows drivers to associate a fwnode
that represents a connector with that connector.
When the new fwnode pointer points to an ACPI-companion, then the new
acpi_bus_type will cause the ACPI subsys to bind the device instantiated
for the connector with the fwnode by calling acpi_bind_one(). This will
result in a firmware_node symlink under /sys/class/card#-<connecter-name>/
which helps to verify that the fwnode-s and connectors are properly
matched.
Changes in v2:
- Make drm_connector_cleanup() call fwnode_handle_put() on
connector->fwnode and document this
Co-developed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-3-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_connector.c | 2 ++
drivers/gpu/drm/drm_sysfs.c | 37 +++++++++++++++++++++++++++++++++
include/drm/drm_connector.h | 8 +++++++
3 files changed, 47 insertions(+)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index 9c3bbe2c3e6f9..c08501a5620d5 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -471,6 +471,8 @@ void drm_connector_cleanup(struct drm_connector *connector)
drm_mode_object_unregister(dev, &connector->base);
kfree(connector->name);
connector->name = NULL;
+ fwnode_handle_put(connector->fwnode);
+ connector->fwnode = NULL;
spin_lock_irq(&dev->mode_config.connector_list_lock);
list_del(&connector->head);
dev->mode_config.num_connector--;
diff --git a/drivers/gpu/drm/drm_sysfs.c b/drivers/gpu/drm/drm_sysfs.c
index a3b71478c5904..71a0d9596efee 100644
--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
@@ -10,6 +10,7 @@
* Copyright (c) 2003-2004 IBM Corp.
*/
+#include <linux/acpi.h>
#include <linux/device.h>
#include <linux/err.h>
#include <linux/export.h>
@@ -56,6 +57,39 @@ static struct device_type drm_sysfs_device_connector = {
struct class *drm_class;
+#ifdef CONFIG_ACPI
+static bool drm_connector_acpi_bus_match(struct device *dev)
+{
+ return dev->type == &drm_sysfs_device_connector;
+}
+
+static struct acpi_device *drm_connector_acpi_find_companion(struct device *dev)
+{
+ struct drm_connector *connector = to_drm_connector(dev);
+
+ return to_acpi_device_node(connector->fwnode);
+}
+
+static struct acpi_bus_type drm_connector_acpi_bus = {
+ .name = "drm_connector",
+ .match = drm_connector_acpi_bus_match,
+ .find_companion = drm_connector_acpi_find_companion,
+};
+
+static void drm_sysfs_acpi_register(void)
+{
+ register_acpi_bus_type(&drm_connector_acpi_bus);
+}
+
+static void drm_sysfs_acpi_unregister(void)
+{
+ unregister_acpi_bus_type(&drm_connector_acpi_bus);
+}
+#else
+static void drm_sysfs_acpi_register(void) { }
+static void drm_sysfs_acpi_unregister(void) { }
+#endif
+
static char *drm_devnode(struct device *dev, umode_t *mode)
{
return kasprintf(GFP_KERNEL, "dri/%s", dev_name(dev));
@@ -89,6 +123,8 @@ int drm_sysfs_init(void)
}
drm_class->devnode = drm_devnode;
+
+ drm_sysfs_acpi_register();
return 0;
}
@@ -101,6 +137,7 @@ void drm_sysfs_destroy(void)
{
if (IS_ERR_OR_NULL(drm_class))
return;
+ drm_sysfs_acpi_unregister();
class_remove_file(drm_class, &class_attr_version.attr);
class_destroy(drm_class);
drm_class = NULL;
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index 928136556174c..ffad68f775cc6 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1174,6 +1174,14 @@ struct drm_connector {
struct device *kdev;
/** @attr: sysfs attributes */
struct device_attribute *attr;
+ /**
+ * @fwnode: associated fwnode supplied by platform firmware
+ *
+ * Drivers can set this to associate a fwnode with a connector, drivers
+ * are expected to get a reference on the fwnode when setting this.
+ * drm_connector_cleanup() will call fwnode_handle_put() on this.
+ */
+ struct fwnode_handle *fwnode;
/**
* @head:
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 147/202] drm/connector: Add drm_connector_find_by_fwnode() function (v3)
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 146/202] drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 148/202] drm/connector: Add support for out-of-band hotplug notification (v3) Greg Kroah-Hartman
` (60 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Hans de Goede,
Lyude Paul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 3d3f7c1e68691574c1d87cd0f9f2348323bc0199 ]
Add a function to find a connector based on a fwnode.
This will be used by the new drm_connector_oob_hotplug_event()
function which is added by the next patch in this patch-set.
Changes in v2:
- Complete rewrite to use a global connector list in drm_connector.c
rather then using a class-dev-iter in drm_sysfs.c
Changes in v3:
- Add forward declaration for struct fwnode_handle to drm_crtc_internal.h
(fixes warning reported by kernel test robot <lkp@intel.com>)
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-4-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_connector.c | 50 +++++++++++++++++++++++++++++
drivers/gpu/drm/drm_crtc_internal.h | 2 ++
include/drm/drm_connector.h | 8 +++++
3 files changed, 60 insertions(+)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index c08501a5620d5..fc06f73acd3c9 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -64,6 +64,14 @@
* support can instead use e.g. drm_helper_hpd_irq_event().
*/
+/*
+ * Global connector list for drm_connector_find_by_fwnode().
+ * Note drm_connector_[un]register() first take connector->lock and then
+ * take the connector_list_lock.
+ */
+static DEFINE_MUTEX(connector_list_lock);
+static LIST_HEAD(connector_list);
+
struct drm_conn_prop_enum_list {
int type;
const char *name;
@@ -265,6 +273,7 @@ int drm_connector_init(struct drm_device *dev,
goto out_put_type_id;
}
+ INIT_LIST_HEAD(&connector->global_connector_list_entry);
INIT_LIST_HEAD(&connector->probed_modes);
INIT_LIST_HEAD(&connector->modes);
mutex_init(&connector->mutex);
@@ -534,6 +543,9 @@ int drm_connector_register(struct drm_connector *connector)
/* Let userspace know we have a new connector */
drm_sysfs_hotplug_event(connector->dev);
+ mutex_lock(&connector_list_lock);
+ list_add_tail(&connector->global_connector_list_entry, &connector_list);
+ mutex_unlock(&connector_list_lock);
goto unlock;
err_debugfs:
@@ -562,6 +574,10 @@ void drm_connector_unregister(struct drm_connector *connector)
return;
}
+ mutex_lock(&connector_list_lock);
+ list_del_init(&connector->global_connector_list_entry);
+ mutex_unlock(&connector_list_lock);
+
if (connector->funcs->early_unregister)
connector->funcs->early_unregister(connector);
@@ -2464,6 +2480,40 @@ int drm_mode_getconnector(struct drm_device *dev, void *data,
return ret;
}
+/**
+ * drm_connector_find_by_fwnode - Find a connector based on the associated fwnode
+ * @fwnode: fwnode for which to find the matching drm_connector
+ *
+ * This functions looks up a drm_connector based on its associated fwnode. When
+ * a connector is found a reference to the connector is returned. The caller must
+ * call drm_connector_put() to release this reference when it is done with the
+ * connector.
+ *
+ * Returns: A reference to the found connector or an ERR_PTR().
+ */
+struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
+{
+ struct drm_connector *connector, *found = ERR_PTR(-ENODEV);
+
+ if (!fwnode)
+ return ERR_PTR(-ENODEV);
+
+ mutex_lock(&connector_list_lock);
+
+ list_for_each_entry(connector, &connector_list, global_connector_list_entry) {
+ if (connector->fwnode == fwnode ||
+ (connector->fwnode && connector->fwnode->secondary == fwnode)) {
+ drm_connector_get(connector);
+ found = connector;
+ break;
+ }
+ }
+
+ mutex_unlock(&connector_list_lock);
+
+ return found;
+}
+
/**
* DOC: Tile group
diff --git a/drivers/gpu/drm/drm_crtc_internal.h b/drivers/gpu/drm/drm_crtc_internal.h
index da96b2f64d7e4..c3577eaee4164 100644
--- a/drivers/gpu/drm/drm_crtc_internal.h
+++ b/drivers/gpu/drm/drm_crtc_internal.h
@@ -57,6 +57,7 @@ struct drm_property;
struct edid;
struct kref;
struct work_struct;
+struct fwnode_handle;
/* drm_crtc.c */
int drm_mode_crtc_set_obj_prop(struct drm_mode_object *obj,
@@ -182,6 +183,7 @@ int drm_connector_set_obj_prop(struct drm_mode_object *obj,
int drm_connector_create_standard_properties(struct drm_device *dev);
const char *drm_get_connector_force_name(enum drm_connector_force force);
void drm_connector_free_work_fn(struct work_struct *work);
+struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode);
/* IOCTL */
int drm_connector_property_set_ioctl(struct drm_device *dev,
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index ffad68f775cc6..d6c7554f1d405 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1193,6 +1193,14 @@ struct drm_connector {
*/
struct list_head head;
+ /**
+ * @global_connector_list_entry:
+ *
+ * Connector entry in the global connector-list, used by
+ * drm_connector_find_by_fwnode().
+ */
+ struct list_head global_connector_list_entry;
+
/** @base: base KMS object */
struct drm_mode_object base;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 148/202] drm/connector: Add support for out-of-band hotplug notification (v3)
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 147/202] drm/connector: Add drm_connector_find_by_fwnode() function (v3) Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 149/202] usb: typec: altmodes/displayport: Notify drm subsys of hotplug events Greg Kroah-Hartman
` (59 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Hans de Goede,
Lyude Paul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 72ad49682dde3d9de5708b8699dc8e0b44962322 ]
Add a new drm_connector_oob_hotplug_event() function and
oob_hotplug_event drm_connector_funcs member.
On some hardware a hotplug event notification may come from outside the
display driver / device. An example of this is some USB Type-C setups
where the hardware muxes the DisplayPort data and aux-lines but does
not pass the altmode HPD status bit to the GPU's DP HPD pin.
In cases like this the new drm_connector_oob_hotplug_event() function can
be used to report these out-of-band events.
Changes in v2:
- Make drm_connector_oob_hotplug_event() take a fwnode as argument and
have it call drm_connector_find_by_fwnode() internally. This allows
making drm_connector_find_by_fwnode() a drm-internal function and
avoids code outside the drm subsystem potentially holding on the
a drm_connector reference for a longer period.
Changes in v3:
- Drop the data argument to the drm_connector_oob_hotplug_event
function since it is not used atm. This can be re-added later when
a use for it actually arises.
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-5-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_connector.c | 27 +++++++++++++++++++++++++++
include/drm/drm_connector.h | 9 +++++++++
2 files changed, 36 insertions(+)
diff --git a/drivers/gpu/drm/drm_connector.c b/drivers/gpu/drm/drm_connector.c
index fc06f73acd3c9..c4ed4f1b369c1 100644
--- a/drivers/gpu/drm/drm_connector.c
+++ b/drivers/gpu/drm/drm_connector.c
@@ -2514,6 +2514,33 @@ struct drm_connector *drm_connector_find_by_fwnode(struct fwnode_handle *fwnode)
return found;
}
+/**
+ * drm_connector_oob_hotplug_event - Report out-of-band hotplug event to connector
+ * @connector: connector to report the event on
+ *
+ * On some hardware a hotplug event notification may come from outside the display
+ * driver / device. An example of this is some USB Type-C setups where the hardware
+ * muxes the DisplayPort data and aux-lines but does not pass the altmode HPD
+ * status bit to the GPU's DP HPD pin.
+ *
+ * This function can be used to report these out-of-band events after obtaining
+ * a drm_connector reference through calling drm_connector_find_by_fwnode().
+ */
+void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode)
+{
+ struct drm_connector *connector;
+
+ connector = drm_connector_find_by_fwnode(connector_fwnode);
+ if (IS_ERR(connector))
+ return;
+
+ if (connector->funcs->oob_hotplug_event)
+ connector->funcs->oob_hotplug_event(connector);
+
+ drm_connector_put(connector);
+}
+EXPORT_SYMBOL(drm_connector_oob_hotplug_event);
+
/**
* DOC: Tile group
diff --git a/include/drm/drm_connector.h b/include/drm/drm_connector.h
index d6c7554f1d405..03d39532c7080 100644
--- a/include/drm/drm_connector.h
+++ b/include/drm/drm_connector.h
@@ -1030,6 +1030,14 @@ struct drm_connector_funcs {
*/
void (*atomic_print_state)(struct drm_printer *p,
const struct drm_connector_state *state);
+
+ /**
+ * @oob_hotplug_event:
+ *
+ * This will get called when a hotplug-event for a drm-connector
+ * has been received from a source outside the display driver / device.
+ */
+ void (*oob_hotplug_event)(struct drm_connector *connector);
};
/**
@@ -1612,6 +1620,7 @@ drm_connector_is_unregistered(struct drm_connector *connector)
DRM_CONNECTOR_UNREGISTERED;
}
+void drm_connector_oob_hotplug_event(struct fwnode_handle *connector_fwnode);
const char *drm_get_connector_type_name(unsigned int connector_type);
const char *drm_get_connector_status_name(enum drm_connector_status status);
const char *drm_get_subpixel_order_name(enum subpixel_order order);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 149/202] usb: typec: altmodes/displayport: Notify drm subsys of hotplug events
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 148/202] drm/connector: Add support for out-of-band hotplug notification (v3) Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 150/202] usb: typec: altmodes/displayport: Signal hpd low when exiting mode Greg Kroah-Hartman
` (58 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heikki Krogerus, Hans de Goede,
Lyude Paul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 7f811394878535ed9a6849717de8c2959ae38899 ]
Use the new drm_connector_oob_hotplug_event() functions to let drm/kms
drivers know about DisplayPort over Type-C hotplug events.
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Tested-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: Lyude Paul <lyude@redhat.com>
Link: https://lore.kernel.org/r/20210817215201.795062-9-hdegoede@redhat.com
Stable-dep-of: 89434b069e46 ("usb: typec: altmodes/displayport: Signal hpd low when exiting mode")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/altmodes/Kconfig | 1 +
drivers/usb/typec/altmodes/displayport.c | 23 +++++++++++++++++++++++
2 files changed, 24 insertions(+)
diff --git a/drivers/usb/typec/altmodes/Kconfig b/drivers/usb/typec/altmodes/Kconfig
index 60d375e9c3c7c..1a6b5e872b0d9 100644
--- a/drivers/usb/typec/altmodes/Kconfig
+++ b/drivers/usb/typec/altmodes/Kconfig
@@ -4,6 +4,7 @@ menu "USB Type-C Alternate Mode drivers"
config TYPEC_DP_ALTMODE
tristate "DisplayPort Alternate Mode driver"
+ depends on DRM
help
DisplayPort USB Type-C Alternate Mode allows DisplayPort
displays and adapters to be attached to the USB Type-C
diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 0d4b1c0eeefb3..8083d5faf0c98 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -11,8 +11,10 @@
#include <linux/delay.h>
#include <linux/mutex.h>
#include <linux/module.h>
+#include <linux/property.h>
#include <linux/usb/pd_vdo.h>
#include <linux/usb/typec_dp.h>
+#include <drm/drm_connector.h>
#include "displayport.h"
#define DP_HEADER(_dp, cmd) (VDO((_dp)->alt->svid, 1, cmd) | \
@@ -57,11 +59,13 @@ struct dp_altmode {
struct typec_displayport_data data;
enum dp_state state;
+ bool hpd;
struct mutex lock; /* device lock */
struct work_struct work;
struct typec_altmode *alt;
const struct typec_altmode *port;
+ struct fwnode_handle *connector_fwnode;
};
static int dp_altmode_notify(struct dp_altmode *dp)
@@ -122,6 +126,7 @@ static int dp_altmode_configure(struct dp_altmode *dp, u8 con)
static int dp_altmode_status_update(struct dp_altmode *dp)
{
bool configured = !!DP_CONF_GET_PIN_ASSIGN(dp->data.conf);
+ bool hpd = !!(dp->data.status & DP_STATUS_HPD_STATE);
u8 con = DP_STATUS_CONNECTION(dp->data.status);
int ret = 0;
@@ -134,6 +139,11 @@ static int dp_altmode_status_update(struct dp_altmode *dp)
ret = dp_altmode_configure(dp, con);
if (!ret)
dp->state = DP_STATE_CONFIGURE;
+ } else {
+ if (dp->hpd != hpd) {
+ drm_connector_oob_hotplug_event(dp->connector_fwnode);
+ dp->hpd = hpd;
+ }
}
return ret;
@@ -526,6 +536,7 @@ static const struct attribute_group dp_altmode_group = {
int dp_altmode_probe(struct typec_altmode *alt)
{
const struct typec_altmode *port = typec_altmode_get_partner(alt);
+ struct fwnode_handle *fwnode;
struct dp_altmode *dp;
int ret;
@@ -554,6 +565,11 @@ int dp_altmode_probe(struct typec_altmode *alt)
alt->desc = "DisplayPort";
alt->ops = &dp_altmode_ops;
+ fwnode = dev_fwnode(alt->dev.parent->parent); /* typec_port fwnode */
+ dp->connector_fwnode = fwnode_find_reference(fwnode, "displayport", 0);
+ if (IS_ERR(dp->connector_fwnode))
+ dp->connector_fwnode = NULL;
+
typec_altmode_set_drvdata(alt, dp);
dp->state = DP_STATE_ENTER;
@@ -569,6 +585,13 @@ void dp_altmode_remove(struct typec_altmode *alt)
sysfs_remove_group(&alt->dev.kobj, &dp_altmode_group);
cancel_work_sync(&dp->work);
+
+ if (dp->connector_fwnode) {
+ if (dp->hpd)
+ drm_connector_oob_hotplug_event(dp->connector_fwnode);
+
+ fwnode_handle_put(dp->connector_fwnode);
+ }
}
EXPORT_SYMBOL_GPL(dp_altmode_remove);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 150/202] usb: typec: altmodes/displayport: Signal hpd low when exiting mode
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 149/202] usb: typec: altmodes/displayport: Notify drm subsys of hotplug events Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 151/202] ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Greg Kroah-Hartman
` (57 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, RD Babiera, Heikki Krogerus,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <rdbabiera@google.com>
[ Upstream commit 89434b069e460967624903b049e5cf5c9e6b99b9 ]
Upon receiving an ACK for a sent EXIT_MODE message, the DisplayPort
driver currently resets the status and configuration of the port partner.
The hpd signal is not updated despite being part of the status, so the
Display stack can still transmit video despite typec_altmode_exit placing
the lanes in a Safe State.
Set hpd to low when a sent EXIT_MODE message is ACK'ed.
Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode")
Cc: stable@vger.kernel.org
Signed-off-by: RD Babiera <rdbabiera@google.com>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231009210057.3773877-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/typec/altmodes/displayport.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c
index 8083d5faf0c98..def903e9d2ab4 100644
--- a/drivers/usb/typec/altmodes/displayport.c
+++ b/drivers/usb/typec/altmodes/displayport.c
@@ -285,6 +285,11 @@ static int dp_altmode_vdm(struct typec_altmode *alt,
case CMD_EXIT_MODE:
dp->data.status = 0;
dp->data.conf = 0;
+ if (dp->hpd) {
+ drm_connector_oob_hotplug_event(dp->connector_fwnode);
+ dp->hpd = false;
+ sysfs_notify(&dp->alt->dev.kobj, "displayport", "hpd");
+ }
break;
case DP_CMD_STATUS_UPDATE:
dp->data.status = *vdo;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 151/202] ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 150/202] usb: typec: altmodes/displayport: Signal hpd low when exiting mode Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 152/202] btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Greg Kroah-Hartman
` (56 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivaylo Dimitrov, Carl Philipp Klemm,
Merlijn Wajer, Pavel Machek, Sebastian Reichel, Tony Lindgren,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 5ad37b5e30433afa7a5513e3eb61f69fa0976785 ]
On mapphone devices we may get lots of noise on the micro-USB port in debug
uart mode until the phy-cpcap-usb driver probes. Let's limit the noise by
using overrun-throttle-ms.
Note that there is also a related separate issue where the charger cable
connected may cause random sysrq requests until phy-cpcap-usb probes that
still remains.
Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Carl Philipp Klemm <philipp@uvos.xyz>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/boot/dts/motorola-mapphone-common.dtsi b/arch/arm/boot/dts/motorola-mapphone-common.dtsi
index 8cb26b924d3ca..f9392a135d387 100644
--- a/arch/arm/boot/dts/motorola-mapphone-common.dtsi
+++ b/arch/arm/boot/dts/motorola-mapphone-common.dtsi
@@ -765,6 +765,7 @@ &uart1 {
&uart3 {
interrupts-extended = <&wakeupgen GIC_SPI 74 IRQ_TYPE_LEVEL_HIGH
&omap4_pmx_core 0x17c>;
+ overrun-throttle-ms = <500>;
};
&uart4 {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 152/202] btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 151/202] ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 153/202] btrfs: initialize start_slot in btrfs_log_prealloc_extents Greg Kroah-Hartman
` (55 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Filipe Manana,
David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 1bf76df3fee56d6637718e267f7c34ed70d0c7dc ]
When running a delayed tree reference, if we find a ref count different
from 1, we return -EIO. This isn't an IO error, as it indicates either a
bug in the delayed refs code or a memory corruption, so change the error
code from -EIO to -EUCLEAN. Also tag the branch as 'unlikely' as this is
not expected to ever happen, and change the error message to print the
tree block's bytenr without the parenthesis (and there was a missing space
between the 'block' word and the opening parenthesis), for consistency as
that's the style we used everywhere else.
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 4d2f25ebe3048..8f62e171053ba 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -1641,12 +1641,12 @@ static int run_delayed_tree_ref(struct btrfs_trans_handle *trans,
parent = ref->parent;
ref_root = ref->root;
- if (node->ref_mod != 1) {
+ if (unlikely(node->ref_mod != 1)) {
btrfs_err(trans->fs_info,
- "btree block(%llu) has %d references rather than 1: action %d ref_root %llu parent %llu",
+ "btree block %llu has %d references rather than 1: action %d ref_root %llu parent %llu",
node->bytenr, node->ref_mod, node->action, ref_root,
parent);
- return -EIO;
+ return -EUCLEAN;
}
if (node->action == BTRFS_ADD_DELAYED_REF && insert_reserved) {
BUG_ON(!extent_op || !extent_op->update_flags);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 153/202] btrfs: initialize start_slot in btrfs_log_prealloc_extents
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 152/202] btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 154/202] i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Greg Kroah-Hartman
` (54 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Axboe, Josef Bacik,
David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit b4c639f699349880b7918b861e1bd360442ec450 ]
Jens reported a compiler warning when using
CONFIG_CC_OPTIMIZE_FOR_SIZE=y that looks like this
fs/btrfs/tree-log.c: In function ‘btrfs_log_prealloc_extents’:
fs/btrfs/tree-log.c:4828:23: warning: ‘start_slot’ may be used
uninitialized [-Wmaybe-uninitialized]
4828 | ret = copy_items(trans, inode, dst_path, path,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
4829 | start_slot, ins_nr, 1, 0);
| ~~~~~~~~~~~~~~~~~~~~~~~~~
fs/btrfs/tree-log.c:4725:13: note: ‘start_slot’ was declared here
4725 | int start_slot;
| ^~~~~~~~~~
The compiler is incorrect, as we only use this code when ins_len > 0,
and when ins_len > 0 we have start_slot properly initialized. However
we generally find the -Wmaybe-uninitialized warnings valuable, so
initialize start_slot to get rid of the warning.
Reported-by: Jens Axboe <axboe@kernel.dk>
Tested-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 9a8dc16673b43..10a0913ffb492 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -4337,7 +4337,7 @@ static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans,
struct extent_buffer *leaf;
int slot;
int ins_nr = 0;
- int start_slot;
+ int start_slot = 0;
int ret;
if (!(inode->flags & BTRFS_INODE_PREALLOC))
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 154/202] i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 153/202] btrfs: initialize start_slot in btrfs_log_prealloc_extents Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 155/202] overlayfs: set ctime when setting mtime and atime Greg Kroah-Hartman
` (53 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiner Kallweit, Peter Rosin,
Wolfram Sang, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiner Kallweit <hkallweit1@gmail.com>
[ Upstream commit b13e59e74ff71a1004e0508107e91e9a84fd7388 ]
I2C_CLASS_DEPRECATED is a flag and not an actual class.
There's nothing speaking against both, parent and child, having
I2C_CLASS_DEPRECATED set. Therefore exclude it from the check.
Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
Acked-by: Peter Rosin <peda@axentia.se>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/i2c-mux.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/i2c/i2c-mux.c b/drivers/i2c/i2c-mux.c
index 774507b54b57b..c90cec8d9656d 100644
--- a/drivers/i2c/i2c-mux.c
+++ b/drivers/i2c/i2c-mux.c
@@ -340,7 +340,7 @@ int i2c_mux_add_adapter(struct i2c_mux_core *muxc,
priv->adap.lock_ops = &i2c_parent_lock_ops;
/* Sanity check on class */
- if (i2c_mux_parent_classes(parent) & class)
+ if (i2c_mux_parent_classes(parent) & class & ~I2C_CLASS_DEPRECATED)
dev_err(&parent->dev,
"Segment %d behind mux can't share classes with ancestors\n",
chan_id);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 155/202] overlayfs: set ctime when setting mtime and atime
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 154/202] i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 156/202] gpio: timberdale: Fix potential deadlock on &tgpio->lock Greg Kroah-Hartman
` (52 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Jeff Layton,
Christian Brauner, Amir Goldstein, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Layton <jlayton@kernel.org>
[ Upstream commit 03dbab3bba5f009d053635c729d1244f2c8bad38 ]
Nathan reported that he was seeing the new warning in
setattr_copy_mgtime pop when starting podman containers. Overlayfs is
trying to set the atime and mtime via notify_change without also
setting the ctime.
POSIX states that when the atime and mtime are updated via utimes() that
we must also update the ctime to the current time. The situation with
overlayfs copy-up is analogies, so add ATTR_CTIME to the bitmask.
notify_change will fill in the value.
Reported-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Jeff Layton <jlayton@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Acked-by: Christian Brauner <brauner@kernel.org>
Acked-by: Amir Goldstein <amir73il@gmail.com>
Message-Id: <20230913-ctime-v1-1-c6bc509cbc27@kernel.org>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/overlayfs/copy_up.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index 7ef3c87f8a23d..65ac504595ba4 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -243,7 +243,7 @@ static int ovl_set_timestamps(struct dentry *upperdentry, struct kstat *stat)
{
struct iattr attr = {
.ia_valid =
- ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET,
+ ATTR_ATIME | ATTR_MTIME | ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_CTIME,
.ia_atime = stat->atime,
.ia_mtime = stat->mtime,
};
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 156/202] gpio: timberdale: Fix potential deadlock on &tgpio->lock
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 155/202] overlayfs: set ctime when setting mtime and atime Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 157/202] ata: libata-eh: Fix compilation warning in ata_eh_link_report() Greg Kroah-Hartman
` (51 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chengfeng Ye, Andy Shevchenko,
Bartosz Golaszewski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengfeng Ye <dg573847474@gmail.com>
[ Upstream commit 9e8bc2dda5a7a8e2babc9975f4b11c9a6196e490 ]
As timbgpio_irq_enable()/timbgpio_irq_disable() callback could be
executed under irq context, it could introduce double locks on
&tgpio->lock if it preempts other execution units requiring
the same locks.
timbgpio_gpio_set()
--> timbgpio_update_bit()
--> spin_lock(&tgpio->lock)
<interrupt>
--> timbgpio_irq_disable()
--> spin_lock_irqsave(&tgpio->lock)
This flaw was found by an experimental static analysis tool I am
developing for irq-related deadlock.
To prevent the potential deadlock, the patch uses spin_lock_irqsave()
on &tgpio->lock inside timbgpio_gpio_set() to prevent the possible
deadlock scenario.
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-timberdale.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpio/gpio-timberdale.c b/drivers/gpio/gpio-timberdale.c
index de14949a3fe5a..92c1f2baa4bff 100644
--- a/drivers/gpio/gpio-timberdale.c
+++ b/drivers/gpio/gpio-timberdale.c
@@ -43,9 +43,10 @@ static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
unsigned offset, bool enabled)
{
struct timbgpio *tgpio = gpiochip_get_data(gpio);
+ unsigned long flags;
u32 reg;
- spin_lock(&tgpio->lock);
+ spin_lock_irqsave(&tgpio->lock, flags);
reg = ioread32(tgpio->membase + offset);
if (enabled)
@@ -54,7 +55,7 @@ static int timbgpio_update_bit(struct gpio_chip *gpio, unsigned index,
reg &= ~(1 << index);
iowrite32(reg, tgpio->membase + offset);
- spin_unlock(&tgpio->lock);
+ spin_unlock_irqrestore(&tgpio->lock, flags);
return 0;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 157/202] ata: libata-eh: Fix compilation warning in ata_eh_link_report()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 156/202] gpio: timberdale: Fix potential deadlock on &tgpio->lock Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 158/202] tracing: relax trace_event_eval_update() execution with cond_resched() Greg Kroah-Hartman
` (50 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal, Hannes Reinecke,
Geert Uytterhoeven, Martin K. Petersen, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
[ Upstream commit 49728bdc702391902a473b9393f1620eea32acb0 ]
The 6 bytes length of the tries_buf string in ata_eh_link_report() is
too short and results in a gcc compilation warning with W-!:
drivers/ata/libata-eh.c: In function ‘ata_eh_link_report’:
drivers/ata/libata-eh.c:2371:59: warning: ‘%d’ directive output may be truncated writing between 1 and 11 bytes into a region of size 4 [-Wformat-truncation=]
2371 | snprintf(tries_buf, sizeof(tries_buf), " t%d",
| ^~
drivers/ata/libata-eh.c:2371:56: note: directive argument in the range [-2147483648, 4]
2371 | snprintf(tries_buf, sizeof(tries_buf), " t%d",
| ^~~~~~
drivers/ata/libata-eh.c:2371:17: note: ‘snprintf’ output between 4 and 14 bytes into a destination of size 6
2371 | snprintf(tries_buf, sizeof(tries_buf), " t%d",
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2372 | ap->eh_tries);
| ~~~~~~~~~~~~~
Avoid this warning by increasing the string size to 16B.
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ata/libata-eh.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 5fb3eda0a280b..2308c2be85a18 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -2224,7 +2224,7 @@ static void ata_eh_link_report(struct ata_link *link)
struct ata_eh_context *ehc = &link->eh_context;
struct ata_queued_cmd *qc;
const char *frozen, *desc;
- char tries_buf[6] = "";
+ char tries_buf[16] = "";
int tag, nr_failed = 0;
if (ehc->i.flags & ATA_EHI_QUIET)
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 158/202] tracing: relax trace_event_eval_update() execution with cond_resched()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 157/202] ata: libata-eh: Fix compilation warning in ata_eh_link_report() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 159/202] HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Greg Kroah-Hartman
` (49 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu,
Clément Léger, Atish Patra, Steven Rostedt (Google),
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Léger <cleger@rivosinc.com>
[ Upstream commit 23cce5f25491968b23fb9c399bbfb25f13870cd9 ]
When kernel is compiled without preemption, the eval_map_work_func()
(which calls trace_event_eval_update()) will not be preempted up to its
complete execution. This can actually cause a problem since if another
CPU call stop_machine(), the call will have to wait for the
eval_map_work_func() function to finish executing in the workqueue
before being able to be scheduled. This problem was observe on a SMP
system at boot time, when the CPU calling the initcalls executed
clocksource_done_booting() which in the end calls stop_machine(). We
observed a 1 second delay because one CPU was executing
eval_map_work_func() and was not preempted by the stop_machine() task.
Adding a call to cond_resched() in trace_event_eval_update() allows
other tasks to be executed and thus continue working asynchronously
like before without blocking any pending task at boot time.
Link: https://lore.kernel.org/linux-trace-kernel/20230929191637.416931-1-cleger@rivosinc.com
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Signed-off-by: Clément Léger <cleger@rivosinc.com>
Tested-by: Atish Patra <atishp@rivosinc.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_events.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 321cfda1b3338..c7f0a02442e50 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -2451,6 +2451,7 @@ void trace_event_eval_update(struct trace_eval_map **map, int len)
update_event_printk(call, map[i]);
}
}
+ cond_resched();
}
up_write(&trace_event_sem);
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 159/202] HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 158/202] tracing: relax trace_event_eval_update() execution with cond_resched() Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 160/202] Bluetooth: Avoid redundant authentication Greg Kroah-Hartman
` (48 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Jiri Kosina, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make_ruc2021@163.com>
[ Upstream commit ffe3b7837a2bb421df84d0177481db9f52c93a71 ]
There is a slab-out-of-bounds Write bug in hid-holtek-kbd driver.
The problem is the driver assumes the device must have an input
but some malicious devices violate this assumption.
Fix this by checking hid_device's input is non-empty before its usage.
Signed-off-by: Ma Ke <make_ruc2021@163.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-holtek-kbd.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-holtek-kbd.c b/drivers/hid/hid-holtek-kbd.c
index 403506b9697e7..b346d68a06f5a 100644
--- a/drivers/hid/hid-holtek-kbd.c
+++ b/drivers/hid/hid-holtek-kbd.c
@@ -130,6 +130,10 @@ static int holtek_kbd_input_event(struct input_dev *dev, unsigned int type,
return -ENODEV;
boot_hid = usb_get_intfdata(boot_interface);
+ if (list_empty(&boot_hid->inputs)) {
+ hid_err(hid, "no inputs found\n");
+ return -ENODEV;
+ }
boot_hid_input = list_first_entry(&boot_hid->inputs,
struct hid_input, list);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 160/202] Bluetooth: Avoid redundant authentication
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 159/202] HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 161/202] Bluetooth: hci_core: Fix build warnings Greg Kroah-Hartman
` (47 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ying Hsu, Luiz Augusto von Dentz,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Hsu <yinghsu@chromium.org>
[ Upstream commit 1d8e801422d66e4b8c7b187c52196bef94eed887 ]
While executing the Android 13 CTS Verifier Secure Server test on a
ChromeOS device, it was observed that the Bluetooth host initiates
authentication for an RFCOMM connection after SSP completes.
When this happens, some Intel Bluetooth controllers, like AC9560, would
disconnect with "Connection Rejected due to Security Reasons (0x0e)".
Historically, BlueZ did not mandate this authentication while an
authenticated combination key was already in use for the connection.
This behavior was changed since commit 7b5a9241b780
("Bluetooth: Introduce requirements for security level 4").
So, this patch addresses the aforementioned disconnection issue by
restoring the previous behavior.
Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_conn.c | 63 ++++++++++++++++++++++------------------
1 file changed, 35 insertions(+), 28 deletions(-)
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index f93a5ef919d1c..a9f6089a2ae2a 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1435,34 +1435,41 @@ int hci_conn_security(struct hci_conn *conn, __u8 sec_level, __u8 auth_type,
if (!test_bit(HCI_CONN_AUTH, &conn->flags))
goto auth;
- /* An authenticated FIPS approved combination key has sufficient
- * security for security level 4. */
- if (conn->key_type == HCI_LK_AUTH_COMBINATION_P256 &&
- sec_level == BT_SECURITY_FIPS)
- goto encrypt;
-
- /* An authenticated combination key has sufficient security for
- security level 3. */
- if ((conn->key_type == HCI_LK_AUTH_COMBINATION_P192 ||
- conn->key_type == HCI_LK_AUTH_COMBINATION_P256) &&
- sec_level == BT_SECURITY_HIGH)
- goto encrypt;
-
- /* An unauthenticated combination key has sufficient security for
- security level 1 and 2. */
- if ((conn->key_type == HCI_LK_UNAUTH_COMBINATION_P192 ||
- conn->key_type == HCI_LK_UNAUTH_COMBINATION_P256) &&
- (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW))
- goto encrypt;
-
- /* A combination key has always sufficient security for the security
- levels 1 or 2. High security level requires the combination key
- is generated using maximum PIN code length (16).
- For pre 2.1 units. */
- if (conn->key_type == HCI_LK_COMBINATION &&
- (sec_level == BT_SECURITY_MEDIUM || sec_level == BT_SECURITY_LOW ||
- conn->pin_length == 16))
- goto encrypt;
+ switch (conn->key_type) {
+ case HCI_LK_AUTH_COMBINATION_P256:
+ /* An authenticated FIPS approved combination key has
+ * sufficient security for security level 4 or lower.
+ */
+ if (sec_level <= BT_SECURITY_FIPS)
+ goto encrypt;
+ break;
+ case HCI_LK_AUTH_COMBINATION_P192:
+ /* An authenticated combination key has sufficient security for
+ * security level 3 or lower.
+ */
+ if (sec_level <= BT_SECURITY_HIGH)
+ goto encrypt;
+ break;
+ case HCI_LK_UNAUTH_COMBINATION_P192:
+ case HCI_LK_UNAUTH_COMBINATION_P256:
+ /* An unauthenticated combination key has sufficient security
+ * for security level 2 or lower.
+ */
+ if (sec_level <= BT_SECURITY_MEDIUM)
+ goto encrypt;
+ break;
+ case HCI_LK_COMBINATION:
+ /* A combination key has always sufficient security for the
+ * security levels 2 or lower. High security level requires the
+ * combination key is generated using maximum PIN code length
+ * (16). For pre 2.1 units.
+ */
+ if (sec_level <= BT_SECURITY_MEDIUM || conn->pin_length == 16)
+ goto encrypt;
+ break;
+ default:
+ break;
+ }
auth:
if (test_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags))
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 161/202] Bluetooth: hci_core: Fix build warnings
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 160/202] Bluetooth: Avoid redundant authentication Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 162/202] wifi: cfg80211: Fix 6GHz scan configuration Greg Kroah-Hartman
` (46 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit dcda165706b9fbfd685898d46a6749d7d397e0c0 ]
This fixes the following warnings:
net/bluetooth/hci_core.c: In function ‘hci_register_dev’:
net/bluetooth/hci_core.c:2620:54: warning: ‘%d’ directive output may
be truncated writing between 1 and 10 bytes into a region of size 5
[-Wformat-truncation=]
2620 | snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
| ^~
net/bluetooth/hci_core.c:2620:50: note: directive argument in the range
[0, 2147483647]
2620 | snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
| ^~~~~~~
net/bluetooth/hci_core.c:2620:9: note: ‘snprintf’ output between 5 and
14 bytes into a destination of size 8
2620 | snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci_core.h | 2 +-
net/bluetooth/hci_core.c | 8 +++++---
2 files changed, 6 insertions(+), 4 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 11a92bb4d7a9f..e33433ec4a98f 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -287,7 +287,7 @@ struct hci_dev {
struct list_head list;
struct mutex lock;
- char name[8];
+ const char *name;
unsigned long flags;
__u16 id;
__u8 bus;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 46e1e51ff28e3..e33fe4b1c4e29 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -3734,7 +3734,11 @@ int hci_register_dev(struct hci_dev *hdev)
if (id < 0)
return id;
- snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
+ error = dev_set_name(&hdev->dev, "hci%u", id);
+ if (error)
+ return error;
+
+ hdev->name = dev_name(&hdev->dev);
hdev->id = id;
BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
@@ -3756,8 +3760,6 @@ int hci_register_dev(struct hci_dev *hdev)
if (!IS_ERR_OR_NULL(bt_debugfs))
hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
- dev_set_name(&hdev->dev, "%s", hdev->name);
-
error = device_add(&hdev->dev);
if (error < 0)
goto err_wqueue;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 162/202] wifi: cfg80211: Fix 6GHz scan configuration
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 161/202] Bluetooth: hci_core: Fix build warnings Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 163/202] wifi: mac80211: allow transmitting EAPOL frames with tainted key Greg Kroah-Hartman
` (45 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilan Peer, Gregory Greenman,
Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilan Peer <ilan.peer@intel.com>
[ Upstream commit 0914468adf92296c4cba8a2134e06e3dea150f2e ]
When the scan request includes a non broadcast BSSID, when adding the
scan parameters for 6GHz collocated scanning, do not include entries
that do not match the given BSSID.
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Link: https://lore.kernel.org/r/20230918140607.6d31d2a96baf.I6c4e3e3075d1d1878ee41f45190fdc6b86f18708@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/scan.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index f59691936e5b8..1e6dfe204ff36 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -875,6 +875,10 @@ static int cfg80211_scan_6ghz(struct cfg80211_registered_device *rdev)
!cfg80211_find_ssid_match(ap, request))
continue;
+ if (!is_broadcast_ether_addr(request->bssid) &&
+ !ether_addr_equal(request->bssid, ap->bssid))
+ continue;
+
if (!request->n_ssids && ap->multi_bss && !ap->transmitted_bssid)
continue;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 163/202] wifi: mac80211: allow transmitting EAPOL frames with tainted key
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 162/202] wifi: cfg80211: Fix 6GHz scan configuration Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 164/202] wifi: cfg80211: avoid leaking stack data into trace Greg Kroah-Hartman
` (44 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Wen Gong, Johannes Berg, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wen Gong <quic_wgong@quicinc.com>
[ Upstream commit 61304336c67358d49a989e5e0060d8c99bad6ca8 ]
Lower layer device driver stop/wake TX by calling ieee80211_stop_queue()/
ieee80211_wake_queue() while hw scan. Sometimes hw scan and PTK rekey are
running in parallel, when M4 sent from wpa_supplicant arrive while the TX
queue is stopped, then the M4 will pending send, and then new key install
from wpa_supplicant. After TX queue wake up by lower layer device driver,
the M4 will be dropped by below call stack.
When key install started, the current key flag is set KEY_FLAG_TAINTED in
ieee80211_pairwise_rekey(), and then mac80211 wait key install complete by
lower layer device driver. Meanwhile ieee80211_tx_h_select_key() will return
TX_DROP for the M4 in step 12 below, and then ieee80211_free_txskb() called
by ieee80211_tx_dequeue(), so the M4 will not send and free, then the rekey
process failed becaue AP not receive M4. Please see details in steps below.
There are a interval between KEY_FLAG_TAINTED set for current key flag and
install key complete by lower layer device driver, the KEY_FLAG_TAINTED is
set in this interval, all packet including M4 will be dropped in this
interval, the interval is step 8~13 as below.
issue steps:
TX thread install key thread
1. stop_queue -idle-
2. sending M4 -idle-
3. M4 pending -idle-
4. -idle- starting install key from wpa_supplicant
5. -idle- =>ieee80211_key_replace()
6. -idle- =>ieee80211_pairwise_rekey() and set
currently key->flags |= KEY_FLAG_TAINTED
7. -idle- =>ieee80211_key_enable_hw_accel()
8. -idle- =>drv_set_key() and waiting key install
complete from lower layer device driver
9. wake_queue -waiting state-
10. re-sending M4 -waiting state-
11. =>ieee80211_tx_h_select_key() -waiting state-
12. drop M4 by KEY_FLAG_TAINTED -waiting state-
13. -idle- install key complete with success/fail
success: clear flag KEY_FLAG_TAINTED
fail: start disconnect
Hence add check in step 11 above to allow the EAPOL send out in the
interval. If lower layer device driver use the old key/cipher to encrypt
the M4, then AP received/decrypt M4 correctly, after M4 send out, lower
layer device driver install the new key/cipher to hardware and return
success.
If lower layer device driver use new key/cipher to send the M4, then AP
will/should drop the M4, then it is same result with this issue, AP will/
should kick out station as well as this issue.
issue log:
kworker/u16:4-5238 [000] 6456.108926: stop_queue: phy1 queue:0, reason:0
wpa_supplicant-961 [003] 6456.119737: rdev_tx_control_port: wiphy_name=phy1 name=wlan0 ifindex=6 dest=ARRAY[9e, 05, 31, 20, 9b, d0] proto=36488 unencrypted=0
wpa_supplicant-961 [003] 6456.119839: rdev_return_int_cookie: phy1, returned 0, cookie: 504
wpa_supplicant-961 [003] 6456.120287: rdev_add_key: phy1, netdev:wlan0(6), key_index: 0, mode: 0, pairwise: true, mac addr: 9e:05:31:20:9b:d0
wpa_supplicant-961 [003] 6456.120453: drv_set_key: phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 cipher:0xfac04, flags=0x9, keyidx=0, hw_key_idx=0
kworker/u16:9-3829 [001] 6456.168240: wake_queue: phy1 queue:0, reason:0
kworker/u16:9-3829 [001] 6456.168255: drv_wake_tx_queue: phy1 vif:wlan0(2) sta:9e:05:31:20:9b:d0 ac:0 tid:7
kworker/u16:9-3829 [001] 6456.168305: cfg80211_control_port_tx_status: wdev(1), cookie: 504, ack: false
wpa_supplicant-961 [003] 6459.167982: drv_return_int: phy1 - -110
issue call stack:
nl80211_frame_tx_status+0x230/0x340 [cfg80211]
cfg80211_control_port_tx_status+0x1c/0x28 [cfg80211]
ieee80211_report_used_skb+0x374/0x3e8 [mac80211]
ieee80211_free_txskb+0x24/0x40 [mac80211]
ieee80211_tx_dequeue+0x644/0x954 [mac80211]
ath10k_mac_tx_push_txq+0xac/0x238 [ath10k_core]
ath10k_mac_op_wake_tx_queue+0xac/0xe0 [ath10k_core]
drv_wake_tx_queue+0x80/0x168 [mac80211]
__ieee80211_wake_txqs+0xe8/0x1c8 [mac80211]
_ieee80211_wake_txqs+0xb4/0x120 [mac80211]
ieee80211_wake_txqs+0x48/0x80 [mac80211]
tasklet_action_common+0xa8/0x254
tasklet_action+0x2c/0x38
__do_softirq+0xdc/0x384
Signed-off-by: Wen Gong <quic_wgong@quicinc.com>
Link: https://lore.kernel.org/r/20230801064751.25803-1-quic_wgong@quicinc.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/tx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index bbbcc678c655c..788b6a3c14191 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -656,7 +656,8 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
}
if (unlikely(tx->key && tx->key->flags & KEY_FLAG_TAINTED &&
- !ieee80211_is_deauth(hdr->frame_control)))
+ !ieee80211_is_deauth(hdr->frame_control)) &&
+ tx->skb->protocol != tx->sdata->control_port_protocol)
return TX_DROP;
if (!skip_hw && tx->key &&
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 164/202] wifi: cfg80211: avoid leaking stack data into trace
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 163/202] wifi: mac80211: allow transmitting EAPOL frames with tainted key Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 165/202] regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Greg Kroah-Hartman
` (43 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Berg, Johannes Berg,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Berg <benjamin.berg@intel.com>
[ Upstream commit 334bf33eec5701a1e4e967bcb7cc8611a998334b ]
If the structure is not initialized then boolean types might be copied
into the tracing data without being initialised. This causes data from
the stack to leak into the trace and also triggers a UBSAN failure which
can easily be avoided here.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Link: https://lore.kernel.org/r/20230925171855.a9271ef53b05.I8180bae663984c91a3e036b87f36a640ba409817@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/nl80211.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index ea36d8c47b31a..0ac829c8f1888 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -7467,7 +7467,7 @@ static int nl80211_update_mesh_config(struct sk_buff *skb,
struct cfg80211_registered_device *rdev = info->user_ptr[0];
struct net_device *dev = info->user_ptr[1];
struct wireless_dev *wdev = dev->ieee80211_ptr;
- struct mesh_config cfg;
+ struct mesh_config cfg = {};
u32 mask;
int err;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 165/202] regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 164/202] wifi: cfg80211: avoid leaking stack data into trace Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 166/202] sky2: Make sure there is at least one frag_addr available Greg Kroah-Hartman
` (42 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michał Mirosław,
Mark Brown, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michał Mirosław <mirq-linux@rere.qmqm.pl>
[ Upstream commit 6e800968f6a715c0661716d2ec5e1f56ed9f9c08 ]
This reverts commit 5f4b204b6b8153923d5be8002c5f7082985d153f.
Since rdev->dev now has a release() callback, the proper way of freeing
the initialized device can be restored.
Signed-off-by: Michał Mirosław <mirq-linux@rere.qmqm.pl>
Link: https://lore.kernel.org/r/d7f469f3f7b1f0e1d52f9a7ede3f3c5703382090.1695077303.git.mirq-linux@rere.qmqm.pl
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/regulator/core.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index 52b75779dbb7e..51c4f604d3b24 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -5483,15 +5483,11 @@ regulator_register(const struct regulator_desc *regulator_desc,
mutex_lock(®ulator_list_mutex);
regulator_ena_gpio_free(rdev);
mutex_unlock(®ulator_list_mutex);
- put_device(&rdev->dev);
- rdev = NULL;
clean:
if (dangling_of_gpiod)
gpiod_put(config->ena_gpiod);
- if (rdev && rdev->dev.of_node)
- of_node_put(rdev->dev.of_node);
- kfree(rdev);
kfree(config);
+ put_device(&rdev->dev);
rinse:
if (dangling_cfg_gpiod)
gpiod_put(cfg->ena_gpiod);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 166/202] sky2: Make sure there is at least one frag_addr available
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 165/202] regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 167/202] ipv4/fib: send notify when delete source address routes Greg Kroah-Hartman
` (41 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mirko Lindner, Stephen Hemminger,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
netdev, kernel test robot, Alexander Lobakin, Kees Cook,
Gustavo A. R. Silva, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
[ Upstream commit 6a70e5cbedaf8ad10528ac9ac114f3ec20f422df ]
In the pathological case of building sky2 with 16k PAGE_SIZE, the
frag_addr[] array would never be used, so the original code was correct
that size should be 0. But the compiler now gets upset with 0 size arrays
in places where it hasn't eliminated the code that might access such an
array (it can't figure out that in this case an rx skb with fragments
would never be created). To keep the compiler happy, make sure there is
at least 1 frag_addr in struct rx_ring_info:
In file included from include/linux/skbuff.h:28,
from include/net/net_namespace.h:43,
from include/linux/netdevice.h:38,
from drivers/net/ethernet/marvell/sky2.c:18:
drivers/net/ethernet/marvell/sky2.c: In function 'sky2_rx_unmap_skb':
include/linux/dma-mapping.h:416:36: warning: array subscript i is outside array bounds of 'dma_addr_t[0]' {aka 'long long unsigned int[]'} [-Warray-bounds=]
416 | #define dma_unmap_page(d, a, s, r) dma_unmap_page_attrs(d, a, s, r, 0)
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
drivers/net/ethernet/marvell/sky2.c:1257:17: note: in expansion of macro 'dma_unmap_page'
1257 | dma_unmap_page(&pdev->dev, re->frag_addr[i],
| ^~~~~~~~~~~~~~
In file included from drivers/net/ethernet/marvell/sky2.c:41:
drivers/net/ethernet/marvell/sky2.h:2198:25: note: while referencing 'frag_addr'
2198 | dma_addr_t frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
| ^~~~~~~~~
With CONFIG_PAGE_SIZE_16KB=y, PAGE_SHIFT == 14, so:
#define ETH_JUMBO_MTU 9000
causes "ETH_JUMBO_MTU >> PAGE_SHIFT" to be 0. Use "?: 1" to solve this build warning.
Cc: Mirko Lindner <mlindner@marvell.com>
Cc: Stephen Hemminger <stephen@networkplumber.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: netdev@vger.kernel.org
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202309191958.UBw1cjXk-lkp@intel.com/
Reviewed-by: Alexander Lobakin <aleksander.lobakin@intel.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/marvell/sky2.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/marvell/sky2.h b/drivers/net/ethernet/marvell/sky2.h
index b2dddd8a246c8..2bd0a7971ae62 100644
--- a/drivers/net/ethernet/marvell/sky2.h
+++ b/drivers/net/ethernet/marvell/sky2.h
@@ -2195,7 +2195,7 @@ struct rx_ring_info {
struct sk_buff *skb;
dma_addr_t data_addr;
DEFINE_DMA_UNMAP_LEN(data_size);
- dma_addr_t frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT];
+ dma_addr_t frag_addr[ETH_JUMBO_MTU >> PAGE_SHIFT ?: 1];
};
enum flow_control {
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 167/202] ipv4/fib: send notify when delete source address routes
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 166/202] sky2: Make sure there is at least one frag_addr available Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 168/202] drm: panel-orientation-quirks: Add quirk for One Mix 2S Greg Kroah-Hartman
` (40 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Haller, Hangbin Liu,
Nicolas Dichtel, David Ahern, Paolo Abeni, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit 4b2b606075e50cdae62ab2356b0a1e206947c354 ]
After deleting an interface address in fib_del_ifaddr(), the function
scans the fib_info list for stray entries and calls fib_flush() and
fib_table_flush(). Then the stray entries will be deleted silently and no
RTM_DELROUTE notification will be sent.
This lack of notification can make routing daemons, or monitor like
`ip monitor route` miss the routing changes. e.g.
+ ip link add dummy1 type dummy
+ ip link add dummy2 type dummy
+ ip link set dummy1 up
+ ip link set dummy2 up
+ ip addr add 192.168.5.5/24 dev dummy1
+ ip route add 7.7.7.0/24 dev dummy2 src 192.168.5.5
+ ip -4 route
7.7.7.0/24 dev dummy2 scope link src 192.168.5.5
192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
+ ip monitor route
+ ip addr del 192.168.5.5/24 dev dummy1
Deleted 192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
Deleted broadcast 192.168.5.255 dev dummy1 table local proto kernel scope link src 192.168.5.5
Deleted local 192.168.5.5 dev dummy1 table local proto kernel scope host src 192.168.5.5
As Ido reminded, fib_table_flush() isn't only called when an address is
deleted, but also when an interface is deleted or put down. The lack of
notification in these cases is deliberate. And commit 7c6bb7d2faaf
("net/ipv6: Add knob to skip DELROUTE message on device down") introduced
a sysctl to make IPv6 behave like IPv4 in this regard. So we can't send
the route delete notify blindly in fib_table_flush().
To fix this issue, let's add a new flag in "struct fib_info" to track the
deleted prefer source address routes, and only send notify for them.
After update:
+ ip monitor route
+ ip addr del 192.168.5.5/24 dev dummy1
Deleted 192.168.5.0/24 dev dummy1 proto kernel scope link src 192.168.5.5
Deleted broadcast 192.168.5.255 dev dummy1 table local proto kernel scope link src 192.168.5.5
Deleted local 192.168.5.5 dev dummy1 table local proto kernel scope host src 192.168.5.5
Deleted 7.7.7.0/24 dev dummy2 scope link src 192.168.5.5
Suggested-by: Thomas Haller <thaller@redhat.com>
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Acked-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230922075508.848925-1-liuhangbin@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip_fib.h | 1 +
net/ipv4/fib_semantics.c | 1 +
net/ipv4/fib_trie.c | 4 ++++
3 files changed, 6 insertions(+)
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index 088f257cd6fb3..0d3cb34c7abc5 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -151,6 +151,7 @@ struct fib_info {
int fib_nhs;
bool fib_nh_is_v6;
bool nh_updated;
+ bool pfsrc_removed;
struct nexthop *nh;
struct rcu_head rcu;
struct fib_nh fib_nh[];
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 5f786cff2e410..bb5255178d75c 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1908,6 +1908,7 @@ int fib_sync_down_addr(struct net_device *dev, __be32 local)
continue;
if (fi->fib_prefsrc == local) {
fi->fib_flags |= RTNH_F_DEAD;
+ fi->pfsrc_removed = true;
ret++;
}
}
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 456240d2adc11..3f4f6458d40e9 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1977,6 +1977,7 @@ void fib_table_flush_external(struct fib_table *tb)
int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
{
struct trie *t = (struct trie *)tb->tb_data;
+ struct nl_info info = { .nl_net = net };
struct key_vector *pn = t->kv;
unsigned long cindex = 1;
struct hlist_node *tmp;
@@ -2039,6 +2040,9 @@ int fib_table_flush(struct net *net, struct fib_table *tb, bool flush_all)
fib_notify_alias_delete(net, n->key, &n->leaf, fa,
NULL);
+ if (fi->pfsrc_removed)
+ rtmsg_fib(RTM_DELROUTE, htonl(n->key), fa,
+ KEYLENGTH - fa->fa_slen, tb->tb_id, &info, 0);
hlist_del_rcu(&fa->fa_list);
fib_release_info(fa->fa_info);
alias_free_mem_rcu(fa);
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 168/202] drm: panel-orientation-quirks: Add quirk for One Mix 2S
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 167/202] ipv4/fib: send notify when delete source address routes Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 169/202] btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Greg Kroah-Hartman
` (39 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai Uwe Broulik, Hans de Goede,
Liviu Dudau, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai Uwe Broulik <foss-linux@broulik.de>
[ Upstream commit cbb7eb2dbd9472816e42a1b0fdb51af49abbf812 ]
The One Mix 2S is a mini laptop with a 1200x1920 portrait screen
mounted in a landscape oriented clamshell case. Because of the too
generic DMI strings this entry is also doing bios-date matching.
Signed-off-by: Kai Uwe Broulik <foss-linux@broulik.de>
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Liviu Dudau <liviu.dudau@arm.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231001114710.336172-1-foss-linux@broulik.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/drivers/gpu/drm/drm_panel_orientation_quirks.c b/drivers/gpu/drm/drm_panel_orientation_quirks.c
index 6106fa7c43028..43de9dfcba19a 100644
--- a/drivers/gpu/drm/drm_panel_orientation_quirks.c
+++ b/drivers/gpu/drm/drm_panel_orientation_quirks.c
@@ -44,6 +44,14 @@ static const struct drm_dmi_panel_orientation_data gpd_micropc = {
.orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
};
+static const struct drm_dmi_panel_orientation_data gpd_onemix2s = {
+ .width = 1200,
+ .height = 1920,
+ .bios_dates = (const char * const []){ "05/21/2018", "10/26/2018",
+ "03/04/2019", NULL },
+ .orientation = DRM_MODE_PANEL_ORIENTATION_RIGHT_UP,
+};
+
static const struct drm_dmi_panel_orientation_data gpd_pocket = {
.width = 1200,
.height = 1920,
@@ -329,6 +337,14 @@ static const struct dmi_system_id orientation_data[] = {
DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "LTH17"),
},
.driver_data = (void *)&lcd800x1280_rightside_up,
+ }, { /* One Mix 2S (generic strings, also match on bios date) */
+ .matches = {
+ DMI_EXACT_MATCH(DMI_SYS_VENDOR, "Default string"),
+ DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "Default string"),
+ DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Default string"),
+ DMI_EXACT_MATCH(DMI_BOARD_NAME, "Default string"),
+ },
+ .driver_data = (void *)&gpd_onemix2s,
},
{}
};
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 169/202] btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 168/202] drm: panel-orientation-quirks: Add quirk for One Mix 2S Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 170/202] HID: multitouch: Add required quirk for Synaptics 0xcd7e device Greg Kroah-Hartman
` (38 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jens Axboe, Josef Bacik,
David Sterba, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit 9147b9ded499d9853bdf0e9804b7eaa99c4429ed ]
Jens reported the following warnings from -Wmaybe-uninitialized recent
Linus' branch.
In file included from ./include/asm-generic/rwonce.h:26,
from ./arch/arm64/include/asm/rwonce.h:71,
from ./include/linux/compiler.h:246,
from ./include/linux/export.h:5,
from ./include/linux/linkage.h:7,
from ./include/linux/kernel.h:17,
from fs/btrfs/ioctl.c:6:
In function ‘instrument_copy_from_user_before’,
inlined from ‘_copy_from_user’ at ./include/linux/uaccess.h:148:3,
inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:183:7,
inlined from ‘btrfs_ioctl_space_info’ at fs/btrfs/ioctl.c:2999:6,
inlined from ‘btrfs_ioctl’ at fs/btrfs/ioctl.c:4616:10:
./include/linux/kasan-checks.h:38:27: warning: ‘space_args’ may be used
uninitialized [-Wmaybe-uninitialized]
38 | #define kasan_check_write __kasan_check_write
./include/linux/instrumented.h:129:9: note: in expansion of macro
‘kasan_check_write’
129 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~
./include/linux/kasan-checks.h: In function ‘btrfs_ioctl’:
./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const
volatile void *’ to ‘__kasan_check_write’ declared here
20 | bool __kasan_check_write(const volatile void *p, unsigned int
size);
| ^~~~~~~~~~~~~~~~~~~
fs/btrfs/ioctl.c:2981:39: note: ‘space_args’ declared here
2981 | struct btrfs_ioctl_space_args space_args;
| ^~~~~~~~~~
In function ‘instrument_copy_from_user_before’,
inlined from ‘_copy_from_user’ at ./include/linux/uaccess.h:148:3,
inlined from ‘copy_from_user’ at ./include/linux/uaccess.h:183:7,
inlined from ‘_btrfs_ioctl_send’ at fs/btrfs/ioctl.c:4343:9,
inlined from ‘btrfs_ioctl’ at fs/btrfs/ioctl.c:4658:10:
./include/linux/kasan-checks.h:38:27: warning: ‘args32’ may be used
uninitialized [-Wmaybe-uninitialized]
38 | #define kasan_check_write __kasan_check_write
./include/linux/instrumented.h:129:9: note: in expansion of macro
‘kasan_check_write’
129 | kasan_check_write(to, n);
| ^~~~~~~~~~~~~~~~~
./include/linux/kasan-checks.h: In function ‘btrfs_ioctl’:
./include/linux/kasan-checks.h:20:6: note: by argument 1 of type ‘const
volatile void *’ to ‘__kasan_check_write’ declared here
20 | bool __kasan_check_write(const volatile void *p, unsigned int
size);
| ^~~~~~~~~~~~~~~~~~~
fs/btrfs/ioctl.c:4341:49: note: ‘args32’ declared here
4341 | struct btrfs_ioctl_send_args_32 args32;
| ^~~~~~
This was due to his config options and having KASAN turned on,
which adds some extra checks around copy_from_user(), which then
triggered the -Wmaybe-uninitialized checker for these cases.
Fix the warnings by initializing the different structs we're copying
into.
Reported-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ioctl.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 930126b094add..cffd149faf639 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -3518,7 +3518,7 @@ static void get_block_group_info(struct list_head *groups_list,
static long btrfs_ioctl_space_info(struct btrfs_fs_info *fs_info,
void __user *arg)
{
- struct btrfs_ioctl_space_args space_args;
+ struct btrfs_ioctl_space_args space_args = { 0 };
struct btrfs_ioctl_space_info space;
struct btrfs_ioctl_space_info *dest;
struct btrfs_ioctl_space_info *dest_orig;
@@ -4858,7 +4858,7 @@ static int _btrfs_ioctl_send(struct file *file, void __user *argp, bool compat)
if (compat) {
#if defined(CONFIG_64BIT) && defined(CONFIG_COMPAT)
- struct btrfs_ioctl_send_args_32 args32;
+ struct btrfs_ioctl_send_args_32 args32 = { 0 };
ret = copy_from_user(&args32, argp, sizeof(args32));
if (ret)
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 170/202] HID: multitouch: Add required quirk for Synaptics 0xcd7e device
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 169/202] btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 171/202] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Greg Kroah-Hartman
` (37 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rain, Rahul Rameshbabu, Jiri Kosina,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <sergeantsagara@protonmail.com>
[ Upstream commit 1437e4547edf41689d7135faaca4222ef0081bc1 ]
Register the Synaptics device as a special multitouch device with certain
quirks that may improve usability of the touchpad device.
Reported-by: Rain <rain@sunshowers.io>
Closes: https://lore.kernel.org/linux-input/2bbb8e1d-1793-4df1-810f-cb0137341ff4@app.fastmail.com/
Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hid/hid-multitouch.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c
index dc7c33f6b2c4e..84b12599eaf69 100644
--- a/drivers/hid/hid-multitouch.c
+++ b/drivers/hid/hid-multitouch.c
@@ -2058,6 +2058,10 @@ static const struct hid_device_id mt_devices[] = {
USB_DEVICE_ID_MTP_STM)},
/* Synaptics devices */
+ { .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
+ HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
+ USB_VENDOR_ID_SYNAPTICS, 0xcd7e) },
+
{ .driver_data = MT_CLS_WIN_8_FORCE_MULTI_INPUT,
HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8,
USB_VENDOR_ID_SYNAPTICS, 0xce08) },
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 171/202] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 170/202] HID: multitouch: Add required quirk for Synaptics 0xcd7e device Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 172/202] net/mlx5: Handle fw tracer change ownership event based on MTRC Greg Kroah-Hartman
` (36 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Renan Guilherme Lebre Ramos,
Hans de Goede, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
[ Upstream commit aa7dcba3bae6869122828b144a3cfd231718089d ]
Add information for the Positivo C4128B, a notebook/tablet convertible.
Link: https://github.com/onitake/gsl-firmware/pull/217
Signed-off-by: Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
Link: https://lore.kernel.org/r/20231004235900.426240-1-japareaggae@gmail.com
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/touchscreen_dmi.c | 23 +++++++++++++++++++++++
1 file changed, 23 insertions(+)
diff --git a/drivers/platform/x86/touchscreen_dmi.c b/drivers/platform/x86/touchscreen_dmi.c
index 55a18cd0c298f..eedff2ae28511 100644
--- a/drivers/platform/x86/touchscreen_dmi.c
+++ b/drivers/platform/x86/touchscreen_dmi.c
@@ -726,6 +726,21 @@ static const struct ts_dmi_data pipo_w11_data = {
.properties = pipo_w11_props,
};
+static const struct property_entry positivo_c4128b_props[] = {
+ PROPERTY_ENTRY_U32("touchscreen-min-x", 4),
+ PROPERTY_ENTRY_U32("touchscreen-min-y", 13),
+ PROPERTY_ENTRY_U32("touchscreen-size-x", 1915),
+ PROPERTY_ENTRY_U32("touchscreen-size-y", 1269),
+ PROPERTY_ENTRY_STRING("firmware-name", "gsl1680-positivo-c4128b.fw"),
+ PROPERTY_ENTRY_U32("silead,max-fingers", 10),
+ { }
+};
+
+static const struct ts_dmi_data positivo_c4128b_data = {
+ .acpi_name = "MSSL1680:00",
+ .properties = positivo_c4128b_props,
+};
+
static const struct property_entry pov_mobii_wintab_p800w_v20_props[] = {
PROPERTY_ENTRY_U32("touchscreen-min-x", 32),
PROPERTY_ENTRY_U32("touchscreen-min-y", 16),
@@ -1389,6 +1404,14 @@ const struct dmi_system_id touchscreen_dmi_table[] = {
DMI_MATCH(DMI_BIOS_VERSION, "MOMO.G.WI71C.MABMRBA02"),
},
},
+ {
+ /* Positivo C4128B */
+ .driver_data = (void *)&positivo_c4128b_data,
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Positivo Tecnologia SA"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "C4128B-1"),
+ },
+ },
{
/* Point of View mobii wintab p800w (v2.0) */
.driver_data = (void *)&pov_mobii_wintab_p800w_v20_data,
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 172/202] net/mlx5: Handle fw tracer change ownership event based on MTRC
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 171/202] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Greg Kroah-Hartman
@ 2023-10-23 10:57 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 173/202] Bluetooth: hci_event: Fix using memcmp when comparing keys Greg Kroah-Hartman
` (35 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maher Sanalla, Shay Drory,
Saeed Mahameed, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maher Sanalla <msanalla@nvidia.com>
[ Upstream commit 92fd39634541eb0a11bf1bafbc8ba92d6ddb8dba ]
Currently, whenever fw issues a change ownership event, the PF that owns
the fw tracer drops its ownership directly and the other PFs try to pick
up the ownership via what MTRC register suggests.
In some cases, driver releases the ownership of the tracer and reacquires
it later on. Whenever the driver releases ownership of the tracer, fw
issues a change ownership event. This event can be delayed and come after
driver has reacquired ownership of the tracer. Thus the late event will
trigger the tracer owner PF to release the ownership again and lead to a
scenario where no PF is owning the tracer.
To prevent the scenario described above, when handling a change
ownership event, do not drop ownership of the tracer directly, instead
read the fw MTRC register to retrieve the up-to-date owner of the tracer
and set it accordingly in driver level.
Fixes: f53aaa31cce7 ("net/mlx5: FW tracer, implement tracer logic")
Signed-off-by: Maher Sanalla <msanalla@nvidia.com>
Reviewed-by: Shay Drory <shayd@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
index 5273644fb2bf9..86088ccab23aa 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
@@ -821,7 +821,7 @@ static void mlx5_fw_tracer_ownership_change(struct work_struct *work)
mlx5_core_dbg(tracer->dev, "FWTracer: ownership changed, current=(%d)\n", tracer->owner);
if (tracer->owner) {
- tracer->owner = false;
+ mlx5_fw_tracer_ownership_acquire(tracer);
return;
}
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 173/202] Bluetooth: hci_event: Fix using memcmp when comparing keys
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2023-10-23 10:57 ` [PATCH 5.10 172/202] net/mlx5: Handle fw tracer change ownership event based on MTRC Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 174/202] mtd: rawnand: qcom: Unmap the right resource upon probe failure Greg Kroah-Hartman
` (34 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit b541260615f601ae1b5d6d0cc54e790de706303b ]
memcmp is not consider safe to use with cryptographic secrets:
'Do not use memcmp() to compare security critical data, such as
cryptographic secrets, because the required CPU time depends on the
number of equal bytes.'
While usage of memcmp for ZERO_KEY may not be considered a security
critical data, it can lead to more usage of memcmp with pairing keys
which could introduce more security problems.
Fixes: 455c2ff0a558 ("Bluetooth: Fix BR/EDR out-of-band pairing with only initiator data")
Fixes: 33155c4aae52 ("Bluetooth: hci_event: Ignore NULL link key")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index c0a2103241415..ad5294de97594 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -25,6 +25,8 @@
/* Bluetooth HCI event handling. */
#include <asm/unaligned.h>
+#include <linux/crypto.h>
+#include <crypto/algapi.h>
#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
@@ -4076,7 +4078,7 @@ static void hci_link_key_notify_evt(struct hci_dev *hdev, struct sk_buff *skb)
goto unlock;
/* Ignore NULL link key against CVE-2020-26555 */
- if (!memcmp(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
+ if (!crypto_memneq(ev->link_key, ZERO_KEY, HCI_LINK_KEY_SIZE)) {
bt_dev_dbg(hdev, "Ignore NULL link key (ZERO KEY) for %pMR",
&ev->bdaddr);
hci_disconnect(conn, HCI_ERROR_AUTH_FAILURE);
@@ -4588,8 +4590,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
* available, then do not declare that OOB data is
* present.
*/
- if (!memcmp(data->rand256, ZERO_KEY, 16) ||
- !memcmp(data->hash256, ZERO_KEY, 16))
+ if (!crypto_memneq(data->rand256, ZERO_KEY, 16) ||
+ !crypto_memneq(data->hash256, ZERO_KEY, 16))
return 0x00;
return 0x02;
@@ -4599,8 +4601,8 @@ static u8 bredr_oob_data_present(struct hci_conn *conn)
* not supported by the hardware, then check that if
* P-192 data values are present.
*/
- if (!memcmp(data->rand192, ZERO_KEY, 16) ||
- !memcmp(data->hash192, ZERO_KEY, 16))
+ if (!crypto_memneq(data->rand192, ZERO_KEY, 16) ||
+ !crypto_memneq(data->hash192, ZERO_KEY, 16))
return 0x00;
return 0x01;
--
2.40.1
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 174/202] mtd: rawnand: qcom: Unmap the right resource upon probe failure
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 173/202] Bluetooth: hci_event: Fix using memcmp when comparing keys Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 175/202] mtd: rawnand: marvell: Ensure program page operations are successful Greg Kroah-Hartman
` (33 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam,
Bibek Kumar Patro, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
commit 5279f4a9eed3ee7d222b76511ea7a22c89e7eefd upstream.
We currently provide the physical address of the DMA region
rather than the output of dma_map_resource() which is obviously wrong.
Fixes: 7330fc505af4 ("mtd: rawnand: qcom: stop using phys_to_dma()")
Cc: stable@vger.kernel.org
Reviewed-by: Manivannan Sadhasivam <mani@kernel.org>
Signed-off-by: Bibek Kumar Patro <quic_bibekkum@quicinc.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230913070702.12707-1-quic_bibekkum@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/qcom_nandc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/qcom_nandc.c
+++ b/drivers/mtd/nand/raw/qcom_nandc.c
@@ -2996,7 +2996,7 @@ err_nandc_alloc:
err_aon_clk:
clk_disable_unprepare(nandc->core_clk);
err_core_clk:
- dma_unmap_resource(dev, res->start, resource_size(res),
+ dma_unmap_resource(dev, nandc->base_dma, resource_size(res),
DMA_BIDIRECTIONAL, 0);
return ret;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 175/202] mtd: rawnand: marvell: Ensure program page operations are successful
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 174/202] mtd: rawnand: qcom: Unmap the right resource upon probe failure Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 176/202] mtd: rawnand: arasan: " Greg Kroah-Hartman
` (32 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aviram Dali, Miquel Raynal,
Ravi Chandra Minnikanti
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 3e01d5254698ea3d18e09d96b974c762328352cd upstream.
The NAND core complies with the ONFI specification, which itself
mentions that after any program or erase operation, a status check
should be performed to see whether the operation was finished *and*
successful.
The NAND core offers helpers to finish a page write (sending the
"PAGE PROG" command, waiting for the NAND chip to be ready again, and
checking the operation status). But in some cases, advanced controller
drivers might want to optimize this and craft their own page write
helper to leverage additional hardware capabilities, thus not always
using the core facilities.
Some drivers, like this one, do not use the core helper to finish a page
write because the final cycles are automatically managed by the
hardware. In this case, the additional care must be taken to manually
perform the final status check.
Let's read the NAND chip status at the end of the page write helper and
return -EIO upon error.
Cc: stable@vger.kernel.org
Fixes: 02f26ecf8c77 ("mtd: nand: add reworked Marvell NAND controller driver")
Reported-by: Aviram Dali <aviramd@marvell.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Ravi Chandra Minnikanti <rminnikanti@marvell.com>
Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-1-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/marvell_nand.c | 23 ++++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
--- a/drivers/mtd/nand/raw/marvell_nand.c
+++ b/drivers/mtd/nand/raw/marvell_nand.c
@@ -1148,6 +1148,7 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
.ndcb[2] = NDCB2_ADDR5_PAGE(page),
};
unsigned int oob_bytes = lt->spare_bytes + (raw ? lt->ecc_bytes : 0);
+ u8 status;
int ret;
/* NFCv2 needs more information about the operation being executed */
@@ -1181,7 +1182,18 @@ static int marvell_nfc_hw_ecc_hmg_do_wri
ret = marvell_nfc_wait_op(chip,
PSEC_TO_MSEC(sdr->tPROG_max));
- return ret;
+ if (ret)
+ return ret;
+
+ /* Check write status on the chip side */
+ ret = nand_status_op(chip, &status);
+ if (ret)
+ return ret;
+
+ if (status & NAND_STATUS_FAIL)
+ return -EIO;
+
+ return 0;
}
static int marvell_nfc_hw_ecc_hmg_write_page_raw(struct nand_chip *chip,
@@ -1610,6 +1622,7 @@ static int marvell_nfc_hw_ecc_bch_write_
int data_len = lt->data_bytes;
int spare_len = lt->spare_bytes;
int chunk, ret;
+ u8 status;
marvell_nfc_select_target(chip, chip->cur_cs);
@@ -1646,6 +1659,14 @@ static int marvell_nfc_hw_ecc_bch_write_
if (ret)
return ret;
+ /* Check write status on the chip side */
+ ret = nand_status_op(chip, &status);
+ if (ret)
+ return ret;
+
+ if (status & NAND_STATUS_FAIL)
+ return -EIO;
+
return 0;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 176/202] mtd: rawnand: arasan: Ensure program page operations are successful
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 175/202] mtd: rawnand: marvell: Ensure program page operations are successful Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 177/202] mtd: spinand: micron: correct bitmask for ecc status Greg Kroah-Hartman
` (31 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michal Simek, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 3a4a893dbb19e229db3b753f0462520b561dee98 upstream.
The NAND core complies with the ONFI specification, which itself
mentions that after any program or erase operation, a status check
should be performed to see whether the operation was finished *and*
successful.
The NAND core offers helpers to finish a page write (sending the
"PAGE PROG" command, waiting for the NAND chip to be ready again, and
checking the operation status). But in some cases, advanced controller
drivers might want to optimize this and craft their own page write
helper to leverage additional hardware capabilities, thus not always
using the core facilities.
Some drivers, like this one, do not use the core helper to finish a page
write because the final cycles are automatically managed by the
hardware. In this case, the additional care must be taken to manually
perform the final status check.
Let's read the NAND chip status at the end of the page write helper and
return -EIO upon error.
Cc: Michal Simek <michal.simek@amd.com>
Cc: stable@vger.kernel.org
Fixes: 88ffef1b65cf ("mtd: rawnand: arasan: Support the hardware BCH ECC engine")
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Acked-by: Michal Simek <michal.simek@amd.com>
Link: https://lore.kernel.org/linux-mtd/20230717194221.229778-2-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/raw/arasan-nand-controller.c | 16 ++++++++++++++--
1 file changed, 14 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/raw/arasan-nand-controller.c
+++ b/drivers/mtd/nand/raw/arasan-nand-controller.c
@@ -451,6 +451,7 @@ static int anfc_write_page_hw_ecc(struct
struct mtd_info *mtd = nand_to_mtd(chip);
unsigned int len = mtd->writesize + (oob_required ? mtd->oobsize : 0);
dma_addr_t dma_addr;
+ u8 status;
int ret;
struct anfc_op nfc_op = {
.pkt_reg =
@@ -497,10 +498,21 @@ static int anfc_write_page_hw_ecc(struct
}
/* Spare data is not protected */
- if (oob_required)
+ if (oob_required) {
ret = nand_write_oob_std(chip, page);
+ if (ret)
+ return ret;
+ }
+
+ /* Check write status on the chip side */
+ ret = nand_status_op(chip, &status);
+ if (ret)
+ return ret;
+
+ if (status & NAND_STATUS_FAIL)
+ return -EIO;
- return ret;
+ return 0;
}
static int anfc_sel_write_page_hw_ecc(struct nand_chip *chip, const u8 *buf,
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 177/202] mtd: spinand: micron: correct bitmask for ecc status
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 176/202] mtd: rawnand: arasan: " Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 178/202] mtd: physmap-core: Restore map_rom fallback Greg Kroah-Hartman
` (30 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Martin Kurbanov, Frieder Schrempf,
Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin Kurbanov <mmkurbanov@sberdevices.ru>
commit 9836a987860e33943945d4b257729a4f94eae576 upstream.
Valid bitmask is 0x70 in the status register.
Fixes: a508e8875e13 ("mtd: spinand: Add initial support for Micron MT29F2G01ABAGD")
Signed-off-by: Martin Kurbanov <mmkurbanov@sberdevices.ru>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20230905145637.139068-1-mmkurbanov@sberdevices.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/spi/micron.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mtd/nand/spi/micron.c
+++ b/drivers/mtd/nand/spi/micron.c
@@ -12,7 +12,7 @@
#define SPINAND_MFR_MICRON 0x2c
-#define MICRON_STATUS_ECC_MASK GENMASK(7, 4)
+#define MICRON_STATUS_ECC_MASK GENMASK(6, 4)
#define MICRON_STATUS_ECC_NO_BITFLIPS (0 << 4)
#define MICRON_STATUS_ECC_1TO3_BITFLIPS (1 << 4)
#define MICRON_STATUS_ECC_4TO6_BITFLIPS (3 << 4)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 178/202] mtd: physmap-core: Restore map_rom fallback
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 177/202] mtd: spinand: micron: correct bitmask for ecc status Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 179/202] mmc: core: sdio: hold retuning if sdio in 1-bit mode Greg Kroah-Hartman
` (29 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Miquel Raynal
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
commit 6792b7fce610bcd1cf3e07af3607fe7e2c38c1d8 upstream.
When the exact mapping type driver was not available, the old
physmap_of_core driver fell back to mapping the region as ROM.
Unfortunately this feature was lost when the DT and pdata cases were
merged. Revive this useful feature.
Fixes: 642b1e8dbed7bbbf ("mtd: maps: Merge physmap_of.c into physmap-core.c")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/550e8c8c1da4c4baeb3d71ff79b14a18d4194f9e.1693407371.git.geert+renesas@glider.be
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/maps/physmap-core.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/mtd/maps/physmap-core.c
+++ b/drivers/mtd/maps/physmap-core.c
@@ -556,6 +556,17 @@ static int physmap_flash_probe(struct pl
if (info->probe_type) {
info->mtds[i] = do_map_probe(info->probe_type,
&info->maps[i]);
+
+ /* Fall back to mapping region as ROM */
+ if (!info->mtds[i] && IS_ENABLED(CONFIG_MTD_ROM) &&
+ strcmp(info->probe_type, "map_rom")) {
+ dev_warn(&dev->dev,
+ "map_probe() failed for type %s\n",
+ info->probe_type);
+
+ info->mtds[i] = do_map_probe("map_rom",
+ &info->maps[i]);
+ }
} else {
int j;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 179/202] mmc: core: sdio: hold retuning if sdio in 1-bit mode
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 178/202] mtd: physmap-core: Restore map_rom fallback Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 180/202] mmc: core: Capture correct oemid-bits for eMMC cards Greg Kroah-Hartman
` (28 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haibo Chen, Adrian Hunter,
Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <haibo.chen@nxp.com>
commit 32a9cdb8869dc111a0c96cf8e1762be9684af15b upstream.
tuning only support in 4-bit mode or 8 bit mode, so in 1-bit mode,
need to hold retuning.
Find this issue when use manual tuning method on imx93. When system
resume back, SDIO WIFI try to switch back to 4 bit mode, first will
trigger retuning, and all tuning command failed.
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Acked-by: Adrian Hunter <adrian.hunter@intel.com>
Fixes: dfa13ebbe334 ("mmc: host: Add facility to support re-tuning")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230830093922.3095850-1-haibo.chen@nxp.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/sdio.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/mmc/core/sdio.c
+++ b/drivers/mmc/core/sdio.c
@@ -1075,8 +1075,14 @@ static int mmc_sdio_resume(struct mmc_ho
}
err = mmc_sdio_reinit_card(host);
} else if (mmc_card_wake_sdio_irq(host)) {
- /* We may have switched to 1-bit mode during suspend */
+ /*
+ * We may have switched to 1-bit mode during suspend,
+ * need to hold retuning, because tuning only supprt
+ * 4-bit mode or 8 bit mode.
+ */
+ mmc_retune_hold_now(host);
err = sdio_enable_4bit_bus(host->card);
+ mmc_retune_release(host);
}
if (err)
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 180/202] mmc: core: Capture correct oemid-bits for eMMC cards
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 179/202] mmc: core: sdio: hold retuning if sdio in 1-bit mode Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 181/202] Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Greg Kroah-Hartman
` (27 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Avri Altman, Ulf Hansson
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avri Altman <avri.altman@wdc.com>
commit 84ee19bffc9306128cd0f1c650e89767079efeff upstream.
The OEMID is an 8-bit binary number rather than 16-bit as the current code
parses for. The OEMID occupies bits [111:104] in the CID register, see the
eMMC spec JESD84-B51 paragraph 7.2.3. It seems that the 16-bit comes from
the legacy MMC specs (v3.31 and before).
Let's fix the parsing by simply move to use 8-bit instead of 16-bit. This
means we ignore the impact on some of those old MMC cards that may be out
there, but on the other hand this shouldn't be a problem as the OEMID seems
not be an important feature for these cards.
Signed-off-by: Avri Altman <avri.altman@wdc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20230927071500.1791882-1-avri.altman@wdc.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/core/mmc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/mmc/core/mmc.c
+++ b/drivers/mmc/core/mmc.c
@@ -95,7 +95,7 @@ static int mmc_decode_cid(struct mmc_car
case 3: /* MMC v3.1 - v3.3 */
case 4: /* MMC v4 */
card->cid.manfid = UNSTUFF_BITS(resp, 120, 8);
- card->cid.oemid = UNSTUFF_BITS(resp, 104, 16);
+ card->cid.oemid = UNSTUFF_BITS(resp, 104, 8);
card->cid.prod_name[0] = UNSTUFF_BITS(resp, 96, 8);
card->cid.prod_name[1] = UNSTUFF_BITS(resp, 88, 8);
card->cid.prod_name[2] = UNSTUFF_BITS(resp, 80, 8);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 181/202] Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 180/202] mmc: core: Capture correct oemid-bits for eMMC cards Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 182/202] pNFS: Fix a hang in nfs4_evict_inode() Greg Kroah-Hartman
` (26 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Linus Walleij
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
commit 62140a1e4dec4594d5d1e1d353747bf2ef434e8b upstream.
The commit breaks MMC enumeration on the Intel Merrifield
plaform.
Before:
[ 36.439057] mmc0: SDHCI controller on PCI [0000:00:01.0] using ADMA
[ 36.450924] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
[ 36.459355] mmc1: SDHCI controller on PCI [0000:00:01.2] using ADMA
[ 36.706399] mmc0: new DDR MMC card at address 0001
[ 37.058972] mmc2: new ultra high speed DDR50 SDIO card at address 0001
[ 37.278977] mmcblk0: mmc0:0001 H4G1d 3.64 GiB
[ 37.297300] mmcblk0: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
After:
[ 36.436704] mmc2: SDHCI controller on PCI [0000:00:01.3] using ADMA
[ 36.436720] mmc1: SDHCI controller on PCI [0000:00:01.0] using ADMA
[ 36.463685] mmc0: SDHCI controller on PCI [0000:00:01.2] using ADMA
[ 36.720627] mmc1: new DDR MMC card at address 0001
[ 37.068181] mmc2: new ultra high speed DDR50 SDIO card at address 0001
[ 37.279998] mmcblk1: mmc1:0001 H4G1d 3.64 GiB
[ 37.302670] mmcblk1: p1 p2 p3 p4 p5 p6 p7 p8 p9 p10
This reverts commit c153a4edff6ab01370fcac8e46f9c89cca1060c2.
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Link: https://lore.kernel.org/r/20231017141806.535191-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/core.c | 16 +++++++---------
1 file changed, 7 insertions(+), 9 deletions(-)
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c
@@ -1007,20 +1007,17 @@ static int add_setting(struct pinctrl *p
static struct pinctrl *find_pinctrl(struct device *dev)
{
- struct pinctrl *entry, *p = NULL;
+ struct pinctrl *p;
mutex_lock(&pinctrl_list_mutex);
-
- list_for_each_entry(entry, &pinctrl_list, node) {
- if (entry->dev == dev) {
- p = entry;
- kref_get(&p->users);
- break;
+ list_for_each_entry(p, &pinctrl_list, node)
+ if (p->dev == dev) {
+ mutex_unlock(&pinctrl_list_mutex);
+ return p;
}
- }
mutex_unlock(&pinctrl_list_mutex);
- return p;
+ return NULL;
}
static void pinctrl_free(struct pinctrl *p, bool inlist);
@@ -1129,6 +1126,7 @@ struct pinctrl *pinctrl_get(struct devic
p = find_pinctrl(dev);
if (p) {
dev_dbg(dev, "obtain a copy of previously claimed pinctrl\n");
+ kref_get(&p->users);
return p;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 182/202] pNFS: Fix a hang in nfs4_evict_inode()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 181/202] Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 183/202] ACPI: irq: Fix incorrect return value in acpi_register_gsi() Greg Kroah-Hartman
` (25 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Anna Schumaker
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
commit f63955721a8020e979b99cc417dcb6da3106aa24 upstream.
We are not allowed to call pnfs_mark_matching_lsegs_return() without
also holding a reference to the layout header, since doing so could lead
to the reference count going to zero when we call
pnfs_layout_remove_lseg(). This again can lead to a hang when we get to
nfs4_evict_inode() and are unable to clear the layout pointer.
pnfs_layout_return_unused_byserver() is guilty of this behaviour, and
has been seen to trigger the refcount warning prior to a hang.
Fixes: b6d49ecd1081 ("NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode")
Cc: stable@vger.kernel.org
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfs/pnfs.c | 33 +++++++++++++++++++++++----------
1 file changed, 23 insertions(+), 10 deletions(-)
--- a/fs/nfs/pnfs.c
+++ b/fs/nfs/pnfs.c
@@ -2633,31 +2633,44 @@ pnfs_should_return_unused_layout(struct
return mode == 0;
}
-static int
-pnfs_layout_return_unused_byserver(struct nfs_server *server, void *data)
+static int pnfs_layout_return_unused_byserver(struct nfs_server *server,
+ void *data)
{
const struct pnfs_layout_range *range = data;
+ const struct cred *cred;
struct pnfs_layout_hdr *lo;
struct inode *inode;
+ nfs4_stateid stateid;
+ enum pnfs_iomode iomode;
+
restart:
rcu_read_lock();
list_for_each_entry_rcu(lo, &server->layouts, plh_layouts) {
- if (!pnfs_layout_can_be_returned(lo) ||
+ inode = lo->plh_inode;
+ if (!inode || !pnfs_layout_can_be_returned(lo) ||
test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags))
continue;
- inode = lo->plh_inode;
spin_lock(&inode->i_lock);
- if (!pnfs_should_return_unused_layout(lo, range)) {
+ if (!lo->plh_inode ||
+ !pnfs_should_return_unused_layout(lo, range)) {
spin_unlock(&inode->i_lock);
continue;
}
+ pnfs_get_layout_hdr(lo);
+ pnfs_set_plh_return_info(lo, range->iomode, 0);
+ if (pnfs_mark_matching_lsegs_return(lo, &lo->plh_return_segs,
+ range, 0) != 0 ||
+ !pnfs_prepare_layoutreturn(lo, &stateid, &cred, &iomode)) {
+ spin_unlock(&inode->i_lock);
+ rcu_read_unlock();
+ pnfs_put_layout_hdr(lo);
+ cond_resched();
+ goto restart;
+ }
spin_unlock(&inode->i_lock);
- inode = pnfs_grab_inode_layout_hdr(lo);
- if (!inode)
- continue;
rcu_read_unlock();
- pnfs_mark_layout_for_return(inode, range);
- iput(inode);
+ pnfs_send_layoutreturn(lo, &stateid, &cred, iomode, false);
+ pnfs_put_layout_hdr(lo);
cond_resched();
goto restart;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 183/202] ACPI: irq: Fix incorrect return value in acpi_register_gsi()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 182/202] pNFS: Fix a hang in nfs4_evict_inode() Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 184/202] nvme-pci: add BOGUS_NID for Intel 0a54 device Greg Kroah-Hartman
` (24 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sunil V L, Rafael J. Wysocki
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sunil V L <sunilvl@ventanamicro.com>
commit 0c21a18d5d6c6a73d098fb9b4701572370942df9 upstream.
acpi_register_gsi() should return a negative value in case of failure.
Currently, it returns the return value from irq_create_fwspec_mapping().
However, irq_create_fwspec_mapping() returns 0 for failure. Fix the
issue by returning -EINVAL if irq_create_fwspec_mapping() returns zero.
Fixes: d44fa3d46079 ("ACPI: Add support for ResourceSource/IRQ domain mapping")
Cc: 4.11+ <stable@vger.kernel.org> # 4.11+
Signed-off-by: Sunil V L <sunilvl@ventanamicro.com>
[ rjw: Rename a new local variable ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/irq.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/acpi/irq.c
+++ b/drivers/acpi/irq.c
@@ -52,6 +52,7 @@ int acpi_register_gsi(struct device *dev
int polarity)
{
struct irq_fwspec fwspec;
+ unsigned int irq;
if (WARN_ON(!acpi_gsi_domain_id)) {
pr_warn("GSI: No registered irqchip, giving up\n");
@@ -63,7 +64,11 @@ int acpi_register_gsi(struct device *dev
fwspec.param[1] = acpi_dev_get_irq_type(trigger, polarity);
fwspec.param_count = 2;
- return irq_create_fwspec_mapping(&fwspec);
+ irq = irq_create_fwspec_mapping(&fwspec);
+ if (!irq)
+ return -EINVAL;
+
+ return irq;
}
EXPORT_SYMBOL_GPL(acpi_register_gsi);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 184/202] nvme-pci: add BOGUS_NID for Intel 0a54 device
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 183/202] ACPI: irq: Fix incorrect return value in acpi_register_gsi() Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 185/202] nvme-rdma: do not try to stop unallocated queues Greg Kroah-Hartman
` (23 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, welsh, Keith Busch
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
commit 5c3f4066462a5f6cac04d3dd81c9f551fabbc6c7 upstream.
These ones claim cmic and nmic capable, so need special consideration to ignore
their duplicate identifiers.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217981
Reported-by: welsh@cassens.com
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/pci.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/nvme/host/pci.c
+++ b/drivers/nvme/host/pci.c
@@ -3181,7 +3181,8 @@ static const struct pci_device_id nvme_i
{ PCI_VDEVICE(INTEL, 0x0a54), /* Intel P4500/P4600 */
.driver_data = NVME_QUIRK_STRIPE_SIZE |
NVME_QUIRK_DEALLOCATE_ZEROES |
- NVME_QUIRK_IGNORE_DEV_SUBNQN, },
+ NVME_QUIRK_IGNORE_DEV_SUBNQN |
+ NVME_QUIRK_BOGUS_NID, },
{ PCI_VDEVICE(INTEL, 0x0a55), /* Dell Express Flash P4600 */
.driver_data = NVME_QUIRK_STRIPE_SIZE |
NVME_QUIRK_DEALLOCATE_ZEROES, },
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 185/202] nvme-rdma: do not try to stop unallocated queues
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 184/202] nvme-pci: add BOGUS_NID for Intel 0a54 device Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 186/202] USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Greg Kroah-Hartman
` (22 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Sagi Grimberg,
Yi Zhang, Keith Busch
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
commit 3820c4fdc247b6f0a4162733bdb8ddf8f2e8a1e4 upstream.
Trying to stop a queue which hasn't been allocated will result
in a warning due to calling mutex_lock() against an uninitialized mutex.
DEBUG_LOCKS_WARN_ON(lock->magic != lock)
WARNING: CPU: 4 PID: 104150 at kernel/locking/mutex.c:579
Call trace:
RIP: 0010:__mutex_lock+0x1173/0x14a0
nvme_rdma_stop_queue+0x1b/0xa0 [nvme_rdma]
nvme_rdma_teardown_io_queues.part.0+0xb0/0x1d0 [nvme_rdma]
nvme_rdma_delete_ctrl+0x50/0x100 [nvme_rdma]
nvme_do_delete_ctrl+0x149/0x158 [nvme_core]
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Tested-by: Yi Zhang <yi.zhang@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvme/host/rdma.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/nvme/host/rdma.c
+++ b/drivers/nvme/host/rdma.c
@@ -644,6 +644,9 @@ static void __nvme_rdma_stop_queue(struc
static void nvme_rdma_stop_queue(struct nvme_rdma_queue *queue)
{
+ if (!test_bit(NVME_RDMA_Q_ALLOCATED, &queue->flags))
+ return;
+
mutex_lock(&queue->queue_lock);
if (test_and_clear_bit(NVME_RDMA_Q_LIVE, &queue->flags))
__nvme_rdma_stop_queue(queue);
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 186/202] USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 185/202] nvme-rdma: do not try to stop unallocated queues Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 187/202] USB: serial: option: add entry for Sierra EM9191 with new firmware Greg Kroah-Hartman
` (21 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabio Porcedda, Daniele Palmas,
Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Porcedda <fabio.porcedda@gmail.com>
commit 6a7be48e9bd18d309ba25c223a27790ad1bf0fa3 upstream.
Add support for the following Telit LE910C4-WWX composition:
0x1035: TTY, TTY, ECM
T: Bus=01 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 5 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=1bc7 ProdID=1035 Rev=00.00
S: Manufacturer=Telit
S: Product=LE910C4-WWX
S: SerialNumber=e1b117c7
C: #Ifs= 4 Cfg#= 1 Atr=e0 MxPwr=500mA
I: If#= 0 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
E: Ad=01(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=fe Prot=ff Driver=option
E: Ad=02(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=83(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
E: Ad=84(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I: If#= 2 Alt= 0 #EPs= 1 Cls=02(commc) Sub=06 Prot=00 Driver=cdc_ether
E: Ad=85(I) Atr=03(Int.) MxPS= 64 Ivl=2ms
I: If#= 3 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E: Ad=03(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Fabio Porcedda <fabio.porcedda@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: Daniele Palmas <dnlplm@gmail.com>
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1290,6 +1290,7 @@ static const struct usb_device_id option
.driver_info = NCTRL(0) | RSVD(3) },
{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1033, 0xff), /* Telit LE910C1-EUX (ECM) */
.driver_info = NCTRL(0) },
+ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1035, 0xff) }, /* Telit LE910C4-WWX (ECM) */
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0),
.driver_info = RSVD(0) | RSVD(1) | NCTRL(2) | RSVD(3) },
{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1),
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 187/202] USB: serial: option: add entry for Sierra EM9191 with new firmware
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 186/202] USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 188/202] USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Greg Kroah-Hartman
` (20 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Benoît Monin, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benoît Monin <benoit.monin@gmx.fr>
commit 064f6e2ba9eb59b2c87b866e1e968e79ccedf9dd upstream.
Following a firmware update of the modem, the interface for the AT
command port changed, so add it back.
T: Bus=08 Lev=01 Prnt=01 Port=01 Cnt=02 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=1199 ProdID=90d3 Rev=00.06
S: Manufacturer=Sierra Wireless, Incorporated
S: Product=Sierra Wireless EM9191
S: SerialNumber=xxxxxxxxxxxxxxxx
C: #Ifs= 4 Cfg#= 1 Atr=a0 MxPwr=896mA
I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I: If#=0x3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=(none)
I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
Signed-off-by: Benoît Monin <benoit.monin@gmx.fr>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2263,6 +2263,7 @@ static const struct usb_device_id option
{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) }, /* GosunCn GM500 ECM/NCM */
{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(UNISOC_VENDOR_ID, TOZED_PRODUCT_LT70C, 0xff, 0, 0) },
{ } /* Terminating entry */
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 188/202] USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 187/202] USB: serial: option: add entry for Sierra EM9191 with new firmware Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 189/202] perf: Disallow mis-matched inherited group reads Greg Kroah-Hartman
` (19 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Puliang Lu, Johan Hovold
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Puliang Lu <puliang.lu@fibocom.com>
commit 52480e1f1a259c93d749ba3961af0bffedfe7a7a upstream.
Update the USB serial option driver support for the Fibocom
FM101R-GL LTE modules as there are actually several different variants.
- VID:PID 413C:8213, FM101R-GL are laptop M.2 cards (with
MBIM interfaces for Linux)
- VID:PID 413C:8215, FM101R-GL ESIM are laptop M.2 cards (with
MBIM interface for Linux)
0x8213: mbim, tty
0x8215: mbim, tty
T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 2 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=413c ProdID=8213 Rev= 5.04
S: Manufacturer=Fibocom Wireless Inc.
S: Product=Fibocom FM101-GL Module
S: SerialNumber=a3b7cbf0
C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
T: Bus=04 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=413c ProdID=8215 Rev= 5.04
S: Manufacturer=Fibocom Wireless Inc.
S: Product=Fibocom FM101-GL Module
S: SerialNumber=a3b7cbf0
C:* #Ifs= 3 Cfg#= 1 Atr=a0 MxPwr=896mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=0e Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=0e Prot=00 Driver=cdc_mbim
E: Ad=81(I) Atr=03(Int.) MxPS= 64 Ivl=32ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=(none)
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
Signed-off-by: Puliang Lu <puliang.lu@fibocom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -203,6 +203,9 @@ static void option_instat_callback(struc
#define DELL_PRODUCT_5829E_ESIM 0x81e4
#define DELL_PRODUCT_5829E 0x81e6
+#define DELL_PRODUCT_FM101R 0x8213
+#define DELL_PRODUCT_FM101R_ESIM 0x8215
+
#define KYOCERA_VENDOR_ID 0x0c88
#define KYOCERA_PRODUCT_KPC650 0x17da
#define KYOCERA_PRODUCT_KPC680 0x180a
@@ -1108,6 +1111,8 @@ static const struct usb_device_id option
.driver_info = RSVD(0) | RSVD(6) },
{ USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM),
.driver_info = RSVD(0) | RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(DELL_VENDOR_ID, DELL_PRODUCT_FM101R, 0xff) },
+ { USB_DEVICE_INTERFACE_CLASS(DELL_VENDOR_ID, DELL_PRODUCT_FM101R_ESIM, 0xff) },
{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */
{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
{ USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 189/202] perf: Disallow mis-matched inherited group reads
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 188/202] USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 190/202] s390/pci: fix iommu bitmap allocation Greg Kroah-Hartman
` (18 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Budimir Markovic,
Peter Zijlstra (Intel)
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 32671e3799ca2e4590773fd0e63aaa4229e50c06 upstream.
Because group consistency is non-atomic between parent (filedesc) and children
(inherited) events, it is possible for PERF_FORMAT_GROUP read() to try and sum
non-matching counter groups -- with non-sensical results.
Add group_generation to distinguish the case where a parent group removes and
adds an event and thus has the same number, but a different configuration of
events as inherited groups.
This became a problem when commit fa8c269353d5 ("perf/core: Invert
perf_read_group() loops") flipped the order of child_list and sibling_list.
Previously it would iterate the group (sibling_list) first, and for each
sibling traverse the child_list. In this order, only the group composition of
the parent is relevant. By flipping the order the group composition of the
child (inherited) events becomes an issue and the mis-match in group
composition becomes evident.
That said; even prior to this commit, while reading of a group that is not
equally inherited was not broken, it still made no sense.
(Ab)use ECHILD as error return to indicate issues with child process group
composition.
Fixes: fa8c269353d5 ("perf/core: Invert perf_read_group() loops")
Reported-by: Budimir Markovic <markovicbudimir@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20231018115654.GK33217@noisy.programming.kicks-ass.net
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/perf_event.h | 1 +
kernel/events/core.c | 39 +++++++++++++++++++++++++++++++++------
2 files changed, 34 insertions(+), 6 deletions(-)
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -659,6 +659,7 @@ struct perf_event {
/* The cumulative AND of all event_caps for events in this group. */
int group_caps;
+ unsigned int group_generation;
struct perf_event *group_leader;
struct pmu *pmu;
void *pmu_private;
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2053,6 +2053,7 @@ static void perf_group_attach(struct per
list_add_tail(&event->sibling_list, &group_leader->sibling_list);
group_leader->nr_siblings++;
+ group_leader->group_generation++;
perf_event__header_size(group_leader);
@@ -2245,6 +2246,7 @@ static void perf_group_detach(struct per
if (leader != event) {
list_del_init(&event->sibling_list);
event->group_leader->nr_siblings--;
+ event->group_leader->group_generation++;
goto out;
}
@@ -5222,7 +5224,7 @@ static int __perf_read_group_add(struct
u64 read_format, u64 *values)
{
struct perf_event_context *ctx = leader->ctx;
- struct perf_event *sub;
+ struct perf_event *sub, *parent;
unsigned long flags;
int n = 1; /* skip @nr */
int ret;
@@ -5232,6 +5234,33 @@ static int __perf_read_group_add(struct
return ret;
raw_spin_lock_irqsave(&ctx->lock, flags);
+ /*
+ * Verify the grouping between the parent and child (inherited)
+ * events is still in tact.
+ *
+ * Specifically:
+ * - leader->ctx->lock pins leader->sibling_list
+ * - parent->child_mutex pins parent->child_list
+ * - parent->ctx->mutex pins parent->sibling_list
+ *
+ * Because parent->ctx != leader->ctx (and child_list nests inside
+ * ctx->mutex), group destruction is not atomic between children, also
+ * see perf_event_release_kernel(). Additionally, parent can grow the
+ * group.
+ *
+ * Therefore it is possible to have parent and child groups in a
+ * different configuration and summing over such a beast makes no sense
+ * what so ever.
+ *
+ * Reject this.
+ */
+ parent = leader->parent;
+ if (parent &&
+ (parent->group_generation != leader->group_generation ||
+ parent->nr_siblings != leader->nr_siblings)) {
+ ret = -ECHILD;
+ goto unlock;
+ }
/*
* Since we co-schedule groups, {enabled,running} times of siblings
@@ -5261,8 +5290,9 @@ static int __perf_read_group_add(struct
values[n++] = primary_event_id(sub);
}
+unlock:
raw_spin_unlock_irqrestore(&ctx->lock, flags);
- return 0;
+ return ret;
}
static int perf_read_group(struct perf_event *event,
@@ -5281,10 +5311,6 @@ static int perf_read_group(struct perf_e
values[0] = 1 + leader->nr_siblings;
- /*
- * By locking the child_mutex of the leader we effectively
- * lock the child list of all siblings.. XXX explain how.
- */
mutex_lock(&leader->child_mutex);
ret = __perf_read_group_add(leader, read_format, values);
@@ -12820,6 +12846,7 @@ static int inherit_group(struct perf_eve
!perf_get_aux_event(child_ctr, leader))
return -EINVAL;
}
+ leader->group_generation = parent_event->group_generation;
return 0;
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 190/202] s390/pci: fix iommu bitmap allocation
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 189/202] perf: Disallow mis-matched inherited group reads Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 191/202] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Greg Kroah-Hartman
` (17 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Rosato, Niklas Schnelle,
Vasily Gorbik
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <schnelle@linux.ibm.com>
commit c1ae1c59c8c6e0b66a718308c623e0cb394dab6b upstream.
Since the fixed commits both zdev->iommu_bitmap and zdev->lazy_bitmap
are allocated as vzalloc(zdev->iommu_pages / 8). The problem is that
zdev->iommu_bitmap is a pointer to unsigned long but the above only
yields an allocation that is a multiple of sizeof(unsigned long) which
is 8 on s390x if the number of IOMMU pages is a multiple of 64.
This in turn is the case only if the effective IOMMU aperture is
a multiple of 64 * 4K = 256K. This is usually the case and so didn't
cause visible issues since both the virt_to_phys(high_memory) reduced
limit and hardware limits use nice numbers.
Under KVM, and in particular with QEMU limiting the IOMMU aperture to
the vfio DMA limit (default 65535), it is possible for the reported
aperture not to be a multiple of 256K however. In this case we end up
with an iommu_bitmap whose allocation is not a multiple of
8 causing bitmap operations to access it out of bounds.
Sadly we can't just fix this in the obvious way and use bitmap_zalloc()
because for large RAM systems (tested on 8 TiB) the zdev->iommu_bitmap
grows too large for kmalloc(). So add our own bitmap_vzalloc() wrapper.
This might be a candidate for common code, but this area of code will
be replaced by the upcoming conversion to use the common code DMA API on
s390 so just add a local routine.
Fixes: 224593215525 ("s390/pci: use virtual memory for iommu bitmap")
Fixes: 13954fd6913a ("s390/pci_dma: improve lazy flush for unmap")
Cc: stable@vger.kernel.org
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/pci/pci_dma.c | 15 +++++++++++++--
1 file changed, 13 insertions(+), 2 deletions(-)
--- a/arch/s390/pci/pci_dma.c
+++ b/arch/s390/pci/pci_dma.c
@@ -541,6 +541,17 @@ static void s390_dma_unmap_sg(struct dev
s->dma_length = 0;
}
}
+
+static unsigned long *bitmap_vzalloc(size_t bits, gfp_t flags)
+{
+ size_t n = BITS_TO_LONGS(bits);
+ size_t bytes;
+
+ if (unlikely(check_mul_overflow(n, sizeof(unsigned long), &bytes)))
+ return NULL;
+
+ return vzalloc(bytes);
+}
int zpci_dma_init_device(struct zpci_dev *zdev)
{
@@ -577,13 +588,13 @@ int zpci_dma_init_device(struct zpci_dev
zdev->end_dma - zdev->start_dma + 1);
zdev->end_dma = zdev->start_dma + zdev->iommu_size - 1;
zdev->iommu_pages = zdev->iommu_size >> PAGE_SHIFT;
- zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8);
+ zdev->iommu_bitmap = bitmap_vzalloc(zdev->iommu_pages, GFP_KERNEL);
if (!zdev->iommu_bitmap) {
rc = -ENOMEM;
goto free_dma_table;
}
if (!s390_iommu_strict) {
- zdev->lazy_bitmap = vzalloc(zdev->iommu_pages / 8);
+ zdev->lazy_bitmap = bitmap_vzalloc(zdev->iommu_pages, GFP_KERNEL);
if (!zdev->lazy_bitmap) {
rc = -ENOMEM;
goto free_bitmap;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 191/202] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 190/202] s390/pci: fix iommu bitmap allocation Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 192/202] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Greg Kroah-Hartman
` (16 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, James John, Hans de Goede
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit f37cc2fc277b371fc491890afb7d8a26e36bb3a1 upstream.
Older Asus laptops change the backlight level themselves and then send
WMI events with different codes for different backlight levels.
The asus-wmi.c code maps the entire range of codes reported on
brightness down keypresses to an internal ASUS_WMI_BRN_DOWN code:
define NOTIFY_BRNUP_MIN 0x11
define NOTIFY_BRNUP_MAX 0x1f
define NOTIFY_BRNDOWN_MIN 0x20
define NOTIFY_BRNDOWN_MAX 0x2e
if (code >= NOTIFY_BRNUP_MIN && code <= NOTIFY_BRNUP_MAX)
code = ASUS_WMI_BRN_UP;
else if (code >= NOTIFY_BRNDOWN_MIN && code <= NOTIFY_BRNDOWN_MAX)
code = ASUS_WMI_BRN_DOWN;
Before this commit all the NOTIFY_BRNDOWN_MIN - NOTIFY_BRNDOWN_MAX
aka 0x20 - 0x2e events were mapped to 0x20.
This mapping is causing issues on new laptop models which actually
send 0x2b events for printscreen presses and 0x2c events for
capslock presses, which get translated into spurious brightness-down
presses.
The plan is disable the 0x11-0x2e special mapping on laptops
where asus-wmi does not register a backlight-device to avoid
the spurious brightness-down keypresses. New laptops always send
0x2e for brightness-down presses, change the special internal
ASUS_WMI_BRN_DOWN value from 0x20 to 0x2e to match this in
preparation for fixing the spurious brightness-down presses.
This change does not have any functional impact since all
of 0x20 - 0x2e is mapped to ASUS_WMI_BRN_DOWN first and only
then checked against the keymap code and the new 0x2e
value is still in the 0x20 - 0x2e range.
Reported-by: James John <me@donjajo.com>
Closes: https://lore.kernel.org/platform-driver-x86/a2c441fe-457e-44cf-a146-0ecd86b037cf@donjajo.com/
Closes: https://bbs.archlinux.org/viewtopic.php?pid=2123716
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231017090725.38163-2-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/asus-wmi.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/platform/x86/asus-wmi.h
+++ b/drivers/platform/x86/asus-wmi.h
@@ -18,7 +18,7 @@
#include <linux/i8042.h>
#define ASUS_WMI_KEY_IGNORE (-1)
-#define ASUS_WMI_BRN_DOWN 0x20
+#define ASUS_WMI_BRN_DOWN 0x2e
#define ASUS_WMI_BRN_UP 0x2f
struct module;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 192/202] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 191/202] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 193/202] gpio: vf610: set value before the direction to avoid a glitch Greg Kroah-Hartman
` (15 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, James John, Hans de Goede
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 235985d1763f7aba92c1c64e5f5aaec26c2c9b18 upstream.
Newer Asus laptops send the following new WMI event codes when some
of the F1 - F12 "media" hotkeys are pressed:
0x2a Screen Capture
0x2b PrintScreen
0x2c CapsLock
Map 0x2a to KEY_SELECTIVE_SCREENSHOT mirroring how similar hotkeys
are mapped on other laptops.
PrintScreem and CapsLock are also reported as normal PS/2 keyboard events,
map these event codes to KE_IGNORE to avoid "Unknown key code 0x%x\n" log
messages.
Reported-by: James John <me@donjajo.com>
Closes: https://lore.kernel.org/platform-driver-x86/a2c441fe-457e-44cf-a146-0ecd86b037cf@donjajo.com/
Closes: https://bbs.archlinux.org/viewtopic.php?pid=2123716
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231017090725.38163-4-hdegoede@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/x86/asus-nb-wmi.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/platform/x86/asus-nb-wmi.c
+++ b/drivers/platform/x86/asus-nb-wmi.c
@@ -475,6 +475,9 @@ static void asus_nb_wmi_quirks(struct as
static const struct key_entry asus_nb_wmi_keymap[] = {
{ KE_KEY, ASUS_WMI_BRN_DOWN, { KEY_BRIGHTNESSDOWN } },
{ KE_KEY, ASUS_WMI_BRN_UP, { KEY_BRIGHTNESSUP } },
+ { KE_KEY, 0x2a, { KEY_SELECTIVE_SCREENSHOT } },
+ { KE_IGNORE, 0x2b, }, /* PrintScreen (also send via PS/2) on newer models */
+ { KE_IGNORE, 0x2c, }, /* CapsLock (also send via PS/2) on newer models */
{ KE_KEY, 0x30, { KEY_VOLUMEUP } },
{ KE_KEY, 0x31, { KEY_VOLUMEDOWN } },
{ KE_KEY, 0x32, { KEY_MUTE } },
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 193/202] gpio: vf610: set value before the direction to avoid a glitch
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 192/202] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 194/202] ASoC: pxa: fix a memory leak in probe() Greg Kroah-Hartman
` (14 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haibo Chen, Bartosz Golaszewski
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <haibo.chen@nxp.com>
commit fc363413ef8ea842ae7a99e3caf5465dafdd3a49 upstream.
We found a glitch when configuring the pad as output high. To avoid this
glitch, move the data value setting before direction config in the
function vf610_gpio_direction_output().
Fixes: 659d8a62311f ("gpio: vf610: add imx7ulp support")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
[Bartosz: tweak the commit message]
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-vf610.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -127,14 +127,14 @@ static int vf610_gpio_direction_output(s
unsigned long mask = BIT(gpio);
u32 val;
+ vf610_gpio_set(chip, gpio, value);
+
if (port->sdata && port->sdata->have_paddr) {
val = vf610_gpio_readl(port->gpio_base + GPIO_PDDR);
val |= mask;
vf610_gpio_writel(val, port->gpio_base + GPIO_PDDR);
}
- vf610_gpio_set(chip, gpio, value);
-
return pinctrl_gpio_direction_output(chip->base + gpio);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 194/202] ASoC: pxa: fix a memory leak in probe()
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 193/202] gpio: vf610: set value before the direction to avoid a glitch Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 195/202] gpio: vf610: make irq_chip immutable Greg Kroah-Hartman
` (13 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Mark Brown,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit aa6464edbd51af4a2f8db43df866a7642b244b5f ]
Free the "priv" pointer before returning the error code.
Fixes: 90eb6b59d311 ("ASoC: pxa-ssp: add support for an external clock in devicetree")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/84ac2313-1420-471a-b2cb-3269a2e12a7c@moroto.mountain
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/pxa/pxa-ssp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/pxa/pxa-ssp.c b/sound/soc/pxa/pxa-ssp.c
index c4e7307a44374..d847263a18b93 100644
--- a/sound/soc/pxa/pxa-ssp.c
+++ b/sound/soc/pxa/pxa-ssp.c
@@ -797,7 +797,7 @@ static int pxa_ssp_probe(struct snd_soc_dai *dai)
if (IS_ERR(priv->extclk)) {
ret = PTR_ERR(priv->extclk);
if (ret == -EPROBE_DEFER)
- return ret;
+ goto err_priv;
priv->extclk = NULL;
}
--
2.42.0
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 195/202] gpio: vf610: make irq_chip immutable
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 194/202] ASoC: pxa: fix a memory leak in probe() Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 196/202] gpio: vf610: mask the gpio irq in system suspend and support wakeup Greg Kroah-Hartman
` (12 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Stein, Andy Shevchenko,
Linus Walleij, Bartosz Golaszewski, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Stein <alexander.stein@ew.tq-group.com>
[ Upstream commit e6ef4f8ede09f4af7cde000717b349b50bc62576 ]
Since recently, the kernel is nagging about mutable irq_chips:
"not an immutable chip, please consider fixing it!"
Drop the unneeded copy, flag it as IRQCHIP_IMMUTABLE, add the new
helper functions and call the appropriate gpiolib functions.
Signed-off-by: Alexander Stein <alexander.stein@ew.tq-group.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Stable-dep-of: 430232619791 ("gpio: vf610: mask the gpio irq in system suspend and support wakeup")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-vf610.c | 41 ++++++++++++++++++++++-----------------
1 file changed, 23 insertions(+), 18 deletions(-)
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index c2c38f13801f5..a548ac3fbb207 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -29,7 +29,6 @@ struct fsl_gpio_soc_data {
struct vf610_gpio_port {
struct gpio_chip gc;
- struct irq_chip ic;
void __iomem *base;
void __iomem *gpio_base;
const struct fsl_gpio_soc_data *sdata;
@@ -206,20 +205,24 @@ static int vf610_gpio_irq_set_type(struct irq_data *d, u32 type)
static void vf610_gpio_irq_mask(struct irq_data *d)
{
- struct vf610_gpio_port *port =
- gpiochip_get_data(irq_data_get_irq_chip_data(d));
- void __iomem *pcr_base = port->base + PORT_PCR(d->hwirq);
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct vf610_gpio_port *port = gpiochip_get_data(gc);
+ irq_hw_number_t gpio_num = irqd_to_hwirq(d);
+ void __iomem *pcr_base = port->base + PORT_PCR(gpio_num);
vf610_gpio_writel(0, pcr_base);
+ gpiochip_disable_irq(gc, gpio_num);
}
static void vf610_gpio_irq_unmask(struct irq_data *d)
{
- struct vf610_gpio_port *port =
- gpiochip_get_data(irq_data_get_irq_chip_data(d));
- void __iomem *pcr_base = port->base + PORT_PCR(d->hwirq);
+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
+ struct vf610_gpio_port *port = gpiochip_get_data(gc);
+ irq_hw_number_t gpio_num = irqd_to_hwirq(d);
+ void __iomem *pcr_base = port->base + PORT_PCR(gpio_num);
- vf610_gpio_writel(port->irqc[d->hwirq] << PORT_PCR_IRQC_OFFSET,
+ gpiochip_enable_irq(gc, gpio_num);
+ vf610_gpio_writel(port->irqc[gpio_num] << PORT_PCR_IRQC_OFFSET,
pcr_base);
}
@@ -236,6 +239,17 @@ static int vf610_gpio_irq_set_wake(struct irq_data *d, u32 enable)
return 0;
}
+static const struct irq_chip vf610_irqchip = {
+ .name = "gpio-vf610",
+ .irq_ack = vf610_gpio_irq_ack,
+ .irq_mask = vf610_gpio_irq_mask,
+ .irq_unmask = vf610_gpio_irq_unmask,
+ .irq_set_type = vf610_gpio_irq_set_type,
+ .irq_set_wake = vf610_gpio_irq_set_wake,
+ .flags = IRQCHIP_IMMUTABLE,
+ GPIOCHIP_IRQ_RESOURCE_HELPERS,
+};
+
static void vf610_gpio_disable_clk(void *data)
{
clk_disable_unprepare(data);
@@ -248,7 +262,6 @@ static int vf610_gpio_probe(struct platform_device *pdev)
struct vf610_gpio_port *port;
struct gpio_chip *gc;
struct gpio_irq_chip *girq;
- struct irq_chip *ic;
int i;
int ret;
@@ -315,14 +328,6 @@ static int vf610_gpio_probe(struct platform_device *pdev)
gc->direction_output = vf610_gpio_direction_output;
gc->set = vf610_gpio_set;
- ic = &port->ic;
- ic->name = "gpio-vf610";
- ic->irq_ack = vf610_gpio_irq_ack;
- ic->irq_mask = vf610_gpio_irq_mask;
- ic->irq_unmask = vf610_gpio_irq_unmask;
- ic->irq_set_type = vf610_gpio_irq_set_type;
- ic->irq_set_wake = vf610_gpio_irq_set_wake;
-
/* Mask all GPIO interrupts */
for (i = 0; i < gc->ngpio; i++)
vf610_gpio_writel(0, port->base + PORT_PCR(i));
@@ -331,7 +336,7 @@ static int vf610_gpio_probe(struct platform_device *pdev)
vf610_gpio_writel(~0, port->base + PORT_ISFR);
girq = &gc->irq;
- girq->chip = ic;
+ gpio_irq_chip_set_chip(girq, &vf610_irqchip);
girq->parent_handler = vf610_gpio_irq_handler;
girq->num_parents = 1;
girq->parents = devm_kcalloc(&pdev->dev, 1,
--
2.42.0
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 196/202] gpio: vf610: mask the gpio irq in system suspend and support wakeup
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 195/202] gpio: vf610: make irq_chip immutable Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 197/202] phy: mapphone-mdm6600: Fix runtime disable on probe Greg Kroah-Hartman
` (11 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haibo Chen, Bartosz Golaszewski,
Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <haibo.chen@nxp.com>
[ Upstream commit 430232619791e7de95191f2cd8ebaa4c380d17d0 ]
Add flag IRQCHIP_MASK_ON_SUSPEND to make sure gpio irq is masked on
suspend, if lack this flag, current irq arctitecture will not mask
the irq, and these unmasked gpio irq will wrongly wakeup the system
even they are not config as wakeup source.
Also add flag IRQCHIP_ENABLE_WAKEUP_ON_SUSPEND to make sure the gpio
irq which is configed as wakeup source can work as expect.
Fixes: 7f2691a19627 ("gpio: vf610: add gpiolib/IRQ chip driver for Vybrid")
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpio-vf610.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpio/gpio-vf610.c b/drivers/gpio/gpio-vf610.c
index a548ac3fbb207..c2883bdeb95fe 100644
--- a/drivers/gpio/gpio-vf610.c
+++ b/drivers/gpio/gpio-vf610.c
@@ -246,7 +246,8 @@ static const struct irq_chip vf610_irqchip = {
.irq_unmask = vf610_gpio_irq_unmask,
.irq_set_type = vf610_gpio_irq_set_type,
.irq_set_wake = vf610_gpio_irq_set_wake,
- .flags = IRQCHIP_IMMUTABLE,
+ .flags = IRQCHIP_IMMUTABLE | IRQCHIP_MASK_ON_SUSPEND
+ | IRQCHIP_ENABLE_WAKEUP_ON_SUSPEND,
GPIOCHIP_IRQ_RESOURCE_HELPERS,
};
--
2.42.0
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 197/202] phy: mapphone-mdm6600: Fix runtime disable on probe
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 196/202] gpio: vf610: mask the gpio irq in system suspend and support wakeup Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 198/202] phy: mapphone-mdm6600: Fix runtime PM for remove Greg Kroah-Hartman
` (10 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivaylo Dimitrov, Merlijn Wajer,
Miaoqian Lin, Pavel Machek, Sebastian Reichel, Tony Lindgren,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 719606154c7033c068a5d4c1dc5f9163b814b3c8 ]
Commit d644e0d79829 ("phy: mapphone-mdm6600: Fix PM error handling in
phy_mdm6600_probe") caused a regression where we now unconditionally
disable runtime PM at the end of the probe while it is only needed on
errors.
Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Miaoqian Lin <linmq006@gmail.com>
Cc: Pavel Machek <pavel@ucw.cz>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Fixes: d644e0d79829 ("phy: mapphone-mdm6600: Fix PM error handling in phy_mdm6600_probe")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20230913060433.48373-1-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/motorola/phy-mapphone-mdm6600.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 3cd4d51c247c3..436b5ab6dc6d5 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -627,10 +627,12 @@ static int phy_mdm6600_probe(struct platform_device *pdev)
pm_runtime_put_autosuspend(ddata->dev);
cleanup:
- if (error < 0)
+ if (error < 0) {
phy_mdm6600_device_power_off(ddata);
- pm_runtime_disable(ddata->dev);
- pm_runtime_dont_use_autosuspend(ddata->dev);
+ pm_runtime_disable(ddata->dev);
+ pm_runtime_dont_use_autosuspend(ddata->dev);
+ }
+
return error;
}
--
2.42.0
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 198/202] phy: mapphone-mdm6600: Fix runtime PM for remove
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 197/202] phy: mapphone-mdm6600: Fix runtime disable on probe Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 199/202] phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Greg Kroah-Hartman
` (9 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivaylo Dimitrov, Merlijn Wajer,
Pavel Machek, Sebastian Reichel, Tony Lindgren, Sebastian Reichel,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit b99e0ba9633af51638e5ee1668da2e33620c134f ]
Otherwise we will get an underflow on remove.
Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Fixes: f7f50b2a7b05 ("phy: mapphone-mdm6600: Add runtime PM support for n_gsm on USB suspend")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20230913060433.48373-2-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/motorola/phy-mapphone-mdm6600.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index 436b5ab6dc6d5..c3e2ab6a2a717 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -641,6 +641,7 @@ static int phy_mdm6600_remove(struct platform_device *pdev)
struct phy_mdm6600 *ddata = platform_get_drvdata(pdev);
struct gpio_desc *reset_gpio = ddata->ctrl_gpios[PHY_MDM6600_RESET];
+ pm_runtime_get_noresume(ddata->dev);
pm_runtime_dont_use_autosuspend(ddata->dev);
pm_runtime_put_sync(ddata->dev);
pm_runtime_disable(ddata->dev);
--
2.42.0
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 199/202] phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 198/202] phy: mapphone-mdm6600: Fix runtime PM for remove Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 200/202] Bluetooth: hci_sock: fix slab oob read in create_monitor_event Greg Kroah-Hartman
` (8 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ivaylo Dimitrov, Merlijn Wajer,
Pavel Machek, Sebastian Reichel, Tony Lindgren, Sebastian Reichel,
Vinod Koul, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
[ Upstream commit 3b384cc74b00b5ac21d18e4c1efc3c1da5300971 ]
Looks like the driver sleep pins configuration is unusable. Adding the
sleep pins causes the usb phy to not respond. We need to use the default
pins in probe, and only set sleep pins at phy_mdm6600_device_power_off().
As the modem can also be booted to a serial port mode for firmware
flashing, let's make the pin changes limited to probe and remove. For
probe, we get the default pins automatically. We only need to set the
sleep pins in phy_mdm6600_device_power_off() to prevent the modem from
waking up because the gpio line glitches.
If it turns out that we need a separate state for phy_mdm6600_power_on()
and phy_mdm6600_power_off(), we can use the pinctrl idle state.
Cc: Ivaylo Dimitrov <ivo.g.dimitrov.75@gmail.com>
Cc: Merlijn Wajer <merlijn@wizzup.org>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Sebastian Reichel <sre@kernel.org>
Fixes: 2ad2af081622 ("phy: mapphone-mdm6600: Improve phy related runtime PM calls")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Reviewed-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Link: https://lore.kernel.org/r/20230913060433.48373-3-tony@atomide.com
Signed-off-by: Vinod Koul <vkoul@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/phy/motorola/phy-mapphone-mdm6600.c | 29 +++++++++------------
1 file changed, 12 insertions(+), 17 deletions(-)
diff --git a/drivers/phy/motorola/phy-mapphone-mdm6600.c b/drivers/phy/motorola/phy-mapphone-mdm6600.c
index c3e2ab6a2a717..67802f9e40ba0 100644
--- a/drivers/phy/motorola/phy-mapphone-mdm6600.c
+++ b/drivers/phy/motorola/phy-mapphone-mdm6600.c
@@ -122,16 +122,10 @@ static int phy_mdm6600_power_on(struct phy *x)
{
struct phy_mdm6600 *ddata = phy_get_drvdata(x);
struct gpio_desc *enable_gpio = ddata->ctrl_gpios[PHY_MDM6600_ENABLE];
- int error;
if (!ddata->enabled)
return -ENODEV;
- error = pinctrl_pm_select_default_state(ddata->dev);
- if (error)
- dev_warn(ddata->dev, "%s: error with default_state: %i\n",
- __func__, error);
-
gpiod_set_value_cansleep(enable_gpio, 1);
/* Allow aggressive PM for USB, it's only needed for n_gsm port */
@@ -160,11 +154,6 @@ static int phy_mdm6600_power_off(struct phy *x)
gpiod_set_value_cansleep(enable_gpio, 0);
- error = pinctrl_pm_select_sleep_state(ddata->dev);
- if (error)
- dev_warn(ddata->dev, "%s: error with sleep_state: %i\n",
- __func__, error);
-
return 0;
}
@@ -456,6 +445,7 @@ static void phy_mdm6600_device_power_off(struct phy_mdm6600 *ddata)
{
struct gpio_desc *reset_gpio =
ddata->ctrl_gpios[PHY_MDM6600_RESET];
+ int error;
ddata->enabled = false;
phy_mdm6600_cmd(ddata, PHY_MDM6600_CMD_BP_SHUTDOWN_REQ);
@@ -471,6 +461,17 @@ static void phy_mdm6600_device_power_off(struct phy_mdm6600 *ddata)
} else {
dev_err(ddata->dev, "Timed out powering down\n");
}
+
+ /*
+ * Keep reset gpio high with padconf internal pull-up resistor to
+ * prevent modem from waking up during deeper SoC idle states. The
+ * gpio bank lines can have glitches if not in the always-on wkup
+ * domain.
+ */
+ error = pinctrl_pm_select_sleep_state(ddata->dev);
+ if (error)
+ dev_warn(ddata->dev, "%s: error with sleep_state: %i\n",
+ __func__, error);
}
static void phy_mdm6600_deferred_power_on(struct work_struct *work)
@@ -571,12 +572,6 @@ static int phy_mdm6600_probe(struct platform_device *pdev)
ddata->dev = &pdev->dev;
platform_set_drvdata(pdev, ddata);
- /* Active state selected in phy_mdm6600_power_on() */
- error = pinctrl_pm_select_sleep_state(ddata->dev);
- if (error)
- dev_warn(ddata->dev, "%s: error with sleep_state: %i\n",
- __func__, error);
-
error = phy_mdm6600_init_lines(ddata);
if (error)
return error;
--
2.42.0
^ permalink raw reply related [flat|nested] 210+ messages in thread
* [PATCH 5.10 200/202] Bluetooth: hci_sock: fix slab oob read in create_monitor_event
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 199/202] phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 201/202] Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Greg Kroah-Hartman
` (7 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+c90849c50ed209d77689,
Edward AD, Luiz Augusto von Dentz
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward AD <twuufnxlz@gmail.com>
commit 18f547f3fc074500ab5d419cf482240324e73a7e upstream.
When accessing hdev->name, the actual string length should prevail
Reported-by: syzbot+c90849c50ed209d77689@syzkaller.appspotmail.com
Fixes: dcda165706b9 ("Bluetooth: hci_core: Fix build warnings")
Signed-off-by: Edward AD <twuufnxlz@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_sock.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -438,7 +438,7 @@ static struct sk_buff *create_monitor_ev
ni->type = hdev->dev_type;
ni->bus = hdev->bus;
bacpy(&ni->bdaddr, &hdev->bdaddr);
- memcpy(ni->name, hdev->name, 8);
+ memcpy(ni->name, hdev->name, strlen(hdev->name));
opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
break;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 201/202] Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 200/202] Bluetooth: hci_sock: fix slab oob read in create_monitor_event Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 202/202] xfrm6: fix inet6_dev refcount underflow problem Greg Kroah-Hartman
` (6 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Edward AD,
Marcel Holtmann, Johan Hedberg, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, linux-bluetooth, netdev, Kees Cook
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kees Cook <keescook@chromium.org>
commit cb3871b1cd135a6662b732fbc6b3db4afcdb4a64 upstream.
The code pattern of memcpy(dst, src, strlen(src)) is almost always
wrong. In this case it is wrong because it leaves memory uninitialized
if it is less than sizeof(ni->name), and overflows ni->name when longer.
Normally strtomem_pad() could be used here, but since ni->name is a
trailing array in struct hci_mon_new_index, compilers that don't support
-fstrict-flex-arrays=3 can't tell how large this array is via
__builtin_object_size(). Instead, open-code the helper and use sizeof()
since it will work correctly.
Additionally mark ni->name as __nonstring since it appears to not be a
%NUL terminated C string.
Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Cc: Edward AD <twuufnxlz@gmail.com>
Cc: Marcel Holtmann <marcel@holtmann.org>
Cc: Johan Hedberg <johan.hedberg@gmail.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: linux-bluetooth@vger.kernel.org
Cc: netdev@vger.kernel.org
Fixes: 18f547f3fc07 ("Bluetooth: hci_sock: fix slab oob read in create_monitor_event")
Link: https://lore.kernel.org/lkml/202310110908.F2639D3276@keescook/
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/hci_mon.h | 2 +-
net/bluetooth/hci_sock.c | 3 ++-
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/include/net/bluetooth/hci_mon.h
+++ b/include/net/bluetooth/hci_mon.h
@@ -56,7 +56,7 @@ struct hci_mon_new_index {
__u8 type;
__u8 bus;
bdaddr_t bdaddr;
- char name[8];
+ char name[8] __nonstring;
} __packed;
#define HCI_MON_NEW_INDEX_SIZE 16
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -438,7 +438,8 @@ static struct sk_buff *create_monitor_ev
ni->type = hdev->dev_type;
ni->bus = hdev->bus;
bacpy(&ni->bdaddr, &hdev->bdaddr);
- memcpy(ni->name, hdev->name, strlen(hdev->name));
+ memcpy_and_pad(ni->name, sizeof(ni->name), hdev->name,
+ strnlen(hdev->name, sizeof(ni->name)), '\0');
opcode = cpu_to_le16(HCI_MON_NEW_INDEX);
break;
^ permalink raw reply [flat|nested] 210+ messages in thread
* [PATCH 5.10 202/202] xfrm6: fix inet6_dev refcount underflow problem
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 201/202] Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Greg Kroah-Hartman
@ 2023-10-23 10:58 ` Greg Kroah-Hartman
2023-10-23 15:29 ` [PATCH 5.10 000/202] 5.10.199-rc1 review Daniel Díaz
` (5 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-23 10:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Changzhong, Xin Long,
Steffen Klassert, Sasha Levin
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Changzhong <zhangchangzhong@huawei.com>
[ Upstream commit cc9b364bb1d58d3dae270c7a931a8cc717dc2b3b ]
There are race conditions that may lead to inet6_dev refcount underflow
in xfrm6_dst_destroy() and rt6_uncached_list_flush_dev().
One of the refcount underflow bugs is shown below:
(cpu 1) | (cpu 2)
xfrm6_dst_destroy() |
... |
in6_dev_put() |
| rt6_uncached_list_flush_dev()
... | ...
| in6_dev_put()
rt6_uncached_list_del() | ...
... |
xfrm6_dst_destroy() calls rt6_uncached_list_del() after in6_dev_put(),
so rt6_uncached_list_flush_dev() has a chance to call in6_dev_put()
again for the same inet6_dev.
Fix it by moving in6_dev_put() after rt6_uncached_list_del() in
xfrm6_dst_destroy().
Fixes: 510c321b5571 ("xfrm: reuse uncached_list to track xdsts")
Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ipv6/xfrm6_policy.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -120,11 +120,11 @@ static void xfrm6_dst_destroy(struct dst
{
struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
- if (likely(xdst->u.rt6.rt6i_idev))
- in6_dev_put(xdst->u.rt6.rt6i_idev);
dst_destroy_metrics_generic(dst);
if (xdst->u.rt6.rt6i_uncached_list)
rt6_uncached_list_del(&xdst->u.rt6);
+ if (likely(xdst->u.rt6.rt6i_idev))
+ in6_dev_put(xdst->u.rt6.rt6i_idev);
xfrm_dst_destroy(xdst);
}
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2023-10-23 10:58 ` [PATCH 5.10 202/202] xfrm6: fix inet6_dev refcount underflow problem Greg Kroah-Hartman
@ 2023-10-23 15:29 ` Daniel Díaz
2023-10-23 18:01 ` Pavel Machek
` (4 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Daniel Díaz @ 2023-10-23 15:29 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee,
rwarsow, conor
Hello!
On 23/10/23 4:55 a. m., Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.199 release.
> There are 202 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Same problem as 5.15 with GPIO and Arm 32-bits:
-----8<-----
/builds/linux/drivers/gpio/gpio-vf610.c:249:18: error: 'IRQCHIP_IMMUTABLE' undeclared here (not in a function); did you mean 'IS_IMMUTABLE'?
249 | .flags = IRQCHIP_IMMUTABLE | IRQCHIP_MASK_ON_SUSPEND
| ^~~~~~~~~~~~~~~~~
| IS_IMMUTABLE
/builds/linux/drivers/gpio/gpio-vf610.c:251:9: error: 'GPIOCHIP_IRQ_RESOURCE_HELPERS' undeclared here (not in a function)
251 | GPIOCHIP_IRQ_RESOURCE_HELPERS,
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
/builds/linux/drivers/gpio/gpio-vf610.c:251:9: warning: excess elements in struct initializer
/builds/linux/drivers/gpio/gpio-vf610.c:251:9: note: (near initialization for 'vf610_irqchip')
/builds/linux/drivers/gpio/gpio-vf610.c: In function 'vf610_gpio_probe':
/builds/linux/drivers/gpio/gpio-vf610.c:340:9: error: implicit declaration of function 'gpio_irq_chip_set_chip' [-Werror=implicit-function-declaration]
340 | gpio_irq_chip_set_chip(girq, &vf610_irqchip);
| ^~~~~~~~~~~~~~~~~~~~~~
cc1: some warnings being treated as errors
make[3]: *** [/builds/linux/scripts/Makefile.build:286: drivers/gpio/gpio-vf610.o] Error 1
make[3]: Target '__build' not remade because of errors.
make[2]: *** [/builds/linux/scripts/Makefile.build:503: drivers/gpio] Error 2
make[2]: Target '__build' not remade because of errors.
make[1]: *** [/builds/linux/Makefile:1832: drivers] Error 2
make[1]: Target '__all' not remade because of errors.
make: *** [Makefile:192: __sub-make] Error 2
----->8-----
Reported-by: Linux Kernel Functional Testing <lkft@linaro.org>
Affected builds:
* clang-17-defconfig arm
* clang-17-lkftconfig arm
* clang-17-lkftconfig-no-kselftest-frag arm
* clang-nightly-lkftconfig-kselftest arm
* gcc-8-defconfig arm
* gcc-8-imx_v6_v7_defconfig arm
* gcc-12-defconfig arm
* gcc-12-imx_v6_v7_defconfig arm
* gcc-12-lkftconfig arm
* gcc-12-lkftconfig-debug arm
* gcc-12-lkftconfig-debug-kmemleak arm
* gcc-12-lkftconfig-kasan arm
* gcc-12-lkftconfig-kselftest arm
* gcc-12-lkftconfig-kselftest-kernel arm
* gcc-12-lkftconfig-kunit arm
* gcc-12-lkftconfig-libgpiod arm
* gcc-12-lkftconfig-no-kselftest-frag arm
* gcc-12-lkftconfig-perf arm
* gcc-12-lkftconfig-perf-kernel arm
* gcc-12-lkftconfig-rcutorture arm
Greetings!
Daniel Díaz
daniel.diaz@linaro.org
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2023-10-23 15:29 ` [PATCH 5.10 000/202] 5.10.199-rc1 review Daniel Díaz
@ 2023-10-23 18:01 ` Pavel Machek
2023-10-23 18:56 ` Florian Fainelli
` (3 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Pavel Machek @ 2023-10-23 18:01 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
[-- Attachment #1: Type: text/plain, Size: 3155 bytes --]
Hi!
> This is the start of the stable review cycle for the 5.10.199 release.
> There are 202 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000.
> Anything received after that time might be too late.
This does not build in our configs:
AR drivers/pci/controller/mobiveil/built-in.a
2158 CC drivers/pci/controller/pci-mvebu.o
2159 CC net/core/failover.o
2160drivers/gpio/gpio-vf610.c:249:11: error: 'IRQCHIP_IMMUTABLE' undeclared here (not in a function); did you mean 'IS_IMMUTABLE'?
2161 249 | .flags = IRQCHIP_IMMUTABLE | IRQCHIP_MASK_ON_SUSPEND
2162 | ^~~~~~~~~~~~~~~~~
2163 | IS_IMMUTABLE
2164drivers/gpio/gpio-vf610.c:251:2: error: 'GPIOCHIP_IRQ_RESOURCE_HELPERS' undeclared here (not in a function)
2165 251 | GPIOCHIP_IRQ_RESOURCE_HELPERS,
2166 | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
2167drivers/gpio/gpio-vf610.c:251:2: warning: excess elements in struct initializer
2168drivers/gpio/gpio-vf610.c:251:2: note: (near initialization for 'vf610_irqchip')
2169 CC fs/ubifs/misc.o
2170drivers/gpio/gpio-vf610.c: In function 'vf610_gpio_probe':
2171drivers/gpio/gpio-vf610.c:340:2: error: implicit declaration of function 'gpio_irq_chip_set_chip' [-Werror=implicit-function-declaration]
2172 340 | gpio_irq_chip_set_chip(girq, &vf610_irqchip);
2173 | ^~~~~~~~~~~~~~~~~~~~~~
2174cc1: some warnings being treated as errors
2175make[2]: *** [scripts/Makefile.build:286: drivers/gpio/gpio-vf610.o] Error 1
2176make[2]: *** Waiting for unfinished jobs....
2177 CC kernel/kexec_core.o
And same error in other config:
CC fs/fat/dir.o
1116 CC crypto/md4.o
1117drivers/gpio/gpio-vf610.c:249:11: error: 'IRQCHIP_IMMUTABLE' undeclared here (not in a function); did you mean 'IS_IMMUTABLE'?
1118 249 | .flags = IRQCHIP_IMMUTABLE | IRQCHIP_MASK_ON_SUSPEND
1119 | ^~~~~~~~~~~~~~~~~
1120 | IS_IMMUTABLE
1121drivers/gpio/gpio-vf610.c:251:2: error: 'GPIOCHIP_IRQ_RESOURCE_HELPERS' undeclared here (not in a function)
1122 251 | GPIOCHIP_IRQ_RESOURCE_HELPERS,
1123 | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
1124drivers/gpio/gpio-vf610.c:251:2: warning: excess elements in struct initializer
1125drivers/gpio/gpio-vf610.c:251:2: note: (near initialization for 'vf610_irqchip')
1126drivers/gpio/gpio-vf610.c: In function 'vf610_gpio_probe':
1127drivers/gpio/gpio-vf610.c:340:2: error: implicit declaration of function 'gpio_irq_chip_set_chip' [-Werror=implicit-function-declaration]
1128 340 | gpio_irq_chip_set_chip(girq, &vf610_irqchip);
1129 | ^~~~~~~~~~~~~~~~~~~~~~
1130cc1: some warnings being treated as errors
1131 CC fs/fat/fatent.o
Details are here:
https://gitlab.com/cip-project/cip-testing/linux-stable-rc-ci/-/tree/linux-5.10.y
Best regards,
Pavel
--
DENX Software Engineering GmbH, Managing Director: Erika Unter
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 195 bytes --]
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2023-10-23 18:01 ` Pavel Machek
@ 2023-10-23 18:56 ` Florian Fainelli
2023-10-24 7:50 ` Dominique Martinet
` (2 subsequent siblings)
207 siblings, 0 replies; 210+ messages in thread
From: Florian Fainelli @ 2023-10-23 18:56 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor
On 10/23/23 03:55, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.199 release.
> There are 202 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2023-10-23 18:56 ` Florian Fainelli
@ 2023-10-24 7:50 ` Dominique Martinet
2023-10-24 8:31 ` Greg Kroah-Hartman
2023-10-24 12:36 ` luomeng
2023-10-25 19:01 ` Jon Hunter
207 siblings, 1 reply; 210+ messages in thread
From: Dominique Martinet @ 2023-10-24 7:50 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
Greg Kroah-Hartman wrote on Mon, Oct 23, 2023 at 12:55:07PM +0200:
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
Not much point in adding to the IRQCHIP_IMMUTABLE errors reports; I went
ahead and reverted these two commits:
da4ad7dba3a1 ("gpio: vf610: mask the gpio irq in system suspend and support wakeup")
90225415cad6 ("gpio: vf610: make irq_chip immutable")
With these two commits out of the way, I could test this 5.10.199-rc1 on
our armv7 and aarch64 boards (respectively Armadillo 640 and Armadillo
G4, which do not use the above gpio driver).
There was no other obvious regression:
Tested-by: Dominique Martinet <dominique.martinet@atmark-techno.com>
--
Dominique Martinet | Asmadeus
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-24 7:50 ` Dominique Martinet
@ 2023-10-24 8:31 ` Greg Kroah-Hartman
0 siblings, 0 replies; 210+ messages in thread
From: Greg Kroah-Hartman @ 2023-10-24 8:31 UTC (permalink / raw)
To: Dominique Martinet
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor
On Tue, Oct 24, 2023 at 04:50:37PM +0900, Dominique Martinet wrote:
> Greg Kroah-Hartman wrote on Mon, Oct 23, 2023 at 12:55:07PM +0200:
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> > and the diffstat can be found below.
>
> Not much point in adding to the IRQCHIP_IMMUTABLE errors reports; I went
> ahead and reverted these two commits:
> da4ad7dba3a1 ("gpio: vf610: mask the gpio irq in system suspend and support wakeup")
> 90225415cad6 ("gpio: vf610: make irq_chip immutable")
Thanks, I'm dropping them now as well.
greg k-h
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2023-10-24 7:50 ` Dominique Martinet
@ 2023-10-24 12:36 ` luomeng
2023-10-25 19:01 ` Jon Hunter
207 siblings, 0 replies; 210+ messages in thread
From: luomeng @ 2023-10-24 12:36 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor
Tested on arm64 and x86 for 5.10.199-rc1,
Kernel
repo:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
Branch: linux-5.10.y
Version: 5.10.198-rc1
Commit: 7019208032fb0ce91e5460806e27530292b9c6ac
Compiler: gcc version 7.3.0 (GCC)
arm64:
--------------------------------------------------------------------
Testcase Result Summary:
total: 9023
passed: 9023
failed: 0
timeout: 0
--------------------------------------------------------------------
x86:
--------------------------------------------------------------------
Testcase Result Summary:
total: 9023
passed: 9023
failed: 0
timeout: 0
--------------------------------------------------------------------
Tested-by: Hulk Robot <hulkrobot@huawei.com>
在 2023/10/23 18:55, Greg Kroah-Hartman 写道:
> This is the start of the stable review cycle for the 5.10.199 release.
> There are 202 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 5.10.199-rc1
>
> Zhang Changzhong <zhangchangzhong@huawei.com>
> xfrm6: fix inet6_dev refcount underflow problem
>
> Kees Cook <keescook@chromium.org>
> Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name
>
> Edward AD <twuufnxlz@gmail.com>
> Bluetooth: hci_sock: fix slab oob read in create_monitor_event
>
> Tony Lindgren <tony@atomide.com>
> phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins
>
> Tony Lindgren <tony@atomide.com>
> phy: mapphone-mdm6600: Fix runtime PM for remove
>
> Tony Lindgren <tony@atomide.com>
> phy: mapphone-mdm6600: Fix runtime disable on probe
>
> Haibo Chen <haibo.chen@nxp.com>
> gpio: vf610: mask the gpio irq in system suspend and support wakeup
>
> Alexander Stein <alexander.stein@ew.tq-group.com>
> gpio: vf610: make irq_chip immutable
>
> Dan Carpenter <dan.carpenter@linaro.org>
> ASoC: pxa: fix a memory leak in probe()
>
> Haibo Chen <haibo.chen@nxp.com>
> gpio: vf610: set value before the direction to avoid a glitch
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events
>
> Hans de Goede <hdegoede@redhat.com>
> platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e
>
> Niklas Schnelle <schnelle@linux.ibm.com>
> s390/pci: fix iommu bitmap allocation
>
> Peter Zijlstra <peterz@infradead.org>
> perf: Disallow mis-matched inherited group reads
>
> Puliang Lu <puliang.lu@fibocom.com>
> USB: serial: option: add Fibocom to DELL custom modem FM101R-GL
>
> Benoît Monin <benoit.monin@gmx.fr>
> USB: serial: option: add entry for Sierra EM9191 with new firmware
>
> Fabio Porcedda <fabio.porcedda@gmail.com>
> USB: serial: option: add Telit LE910C4-WWX 0x1035 composition
>
> Maurizio Lombardi <mlombard@redhat.com>
> nvme-rdma: do not try to stop unallocated queues
>
> Keith Busch <kbusch@kernel.org>
> nvme-pci: add BOGUS_NID for Intel 0a54 device
>
> Sunil V L <sunilvl@ventanamicro.com>
> ACPI: irq: Fix incorrect return value in acpi_register_gsi()
>
> Trond Myklebust <trond.myklebust@hammerspace.com>
> pNFS: Fix a hang in nfs4_evict_inode()
>
> Andy Shevchenko <andriy.shevchenko@linux.intel.com>
> Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()"
>
> Avri Altman <avri.altman@wdc.com>
> mmc: core: Capture correct oemid-bits for eMMC cards
>
> Haibo Chen <haibo.chen@nxp.com>
> mmc: core: sdio: hold retuning if sdio in 1-bit mode
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> mtd: physmap-core: Restore map_rom fallback
>
> Martin Kurbanov <mmkurbanov@sberdevices.ru>
> mtd: spinand: micron: correct bitmask for ecc status
>
> Miquel Raynal <miquel.raynal@bootlin.com>
> mtd: rawnand: arasan: Ensure program page operations are successful
>
> Miquel Raynal <miquel.raynal@bootlin.com>
> mtd: rawnand: marvell: Ensure program page operations are successful
>
> Bibek Kumar Patro <quic_bibekkum@quicinc.com>
> mtd: rawnand: qcom: Unmap the right resource upon probe failure
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: hci_event: Fix using memcmp when comparing keys
>
> Maher Sanalla <msanalla@nvidia.com>
> net/mlx5: Handle fw tracer change ownership event based on MTRC
>
> Renan Guilherme Lebre Ramos <japareaggae@gmail.com>
> platform/x86: touchscreen_dmi: Add info for the Positivo C4128B
>
> Rahul Rameshbabu <sergeantsagara@protonmail.com>
> HID: multitouch: Add required quirk for Synaptics 0xcd7e device
>
> Josef Bacik <josef@toxicpanda.com>
> btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c
>
> Kai Uwe Broulik <foss-linux@broulik.de>
> drm: panel-orientation-quirks: Add quirk for One Mix 2S
>
> Hangbin Liu <liuhangbin@gmail.com>
> ipv4/fib: send notify when delete source address routes
>
> Kees Cook <keescook@chromium.org>
> sky2: Make sure there is at least one frag_addr available
>
> Michał Mirosław <mirq-linux@rere.qmqm.pl>
> regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()"
>
> Benjamin Berg <benjamin.berg@intel.com>
> wifi: cfg80211: avoid leaking stack data into trace
>
> Wen Gong <quic_wgong@quicinc.com>
> wifi: mac80211: allow transmitting EAPOL frames with tainted key
>
> Ilan Peer <ilan.peer@intel.com>
> wifi: cfg80211: Fix 6GHz scan configuration
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: hci_core: Fix build warnings
>
> Ying Hsu <yinghsu@chromium.org>
> Bluetooth: Avoid redundant authentication
>
> Ma Ke <make_ruc2021@163.com>
> HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event
>
> Clément Léger <cleger@rivosinc.com>
> tracing: relax trace_event_eval_update() execution with cond_resched()
>
> Damien Le Moal <dlemoal@kernel.org>
> ata: libata-eh: Fix compilation warning in ata_eh_link_report()
>
> Chengfeng Ye <dg573847474@gmail.com>
> gpio: timberdale: Fix potential deadlock on &tgpio->lock
>
> Jeff Layton <jlayton@kernel.org>
> overlayfs: set ctime when setting mtime and atime
>
> Heiner Kallweit <hkallweit1@gmail.com>
> i2c: mux: Avoid potential false error message in i2c_mux_add_adapter
>
> Josef Bacik <josef@toxicpanda.com>
> btrfs: initialize start_slot in btrfs_log_prealloc_extents
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1
>
> Tony Lindgren <tony@atomide.com>
> ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone
>
> RD Babiera <rdbabiera@google.com>
> usb: typec: altmodes/displayport: Signal hpd low when exiting mode
>
> Hans de Goede <hdegoede@redhat.com>
> usb: typec: altmodes/displayport: Notify drm subsys of hotplug events
>
> Hans de Goede <hdegoede@redhat.com>
> drm/connector: Add support for out-of-band hotplug notification (v3)
>
> Hans de Goede <hdegoede@redhat.com>
> drm/connector: Add drm_connector_find_by_fwnode() function (v3)
>
> Hans de Goede <hdegoede@redhat.com>
> drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2)
>
> Hans de Goede <hdegoede@redhat.com>
> drm/connector: Give connector sysfs devices there own device_type
>
> Daniel Miess <daniel.miess@amd.com>
> drm/amd/display: Don't set dpms_off for seamless boot
>
> Yongqiang Sun <yongqiang.sun@amd.com>
> drm/amd/display: only check available pipe to disable vbios mode.
>
> Tony Lindgren <tony@atomide.com>
> serial: 8250_omap: Fix errors with no_console_suspend
>
> Tony Lindgren <tony@atomide.com>
> serial: 8250: omap: Fix imprecise external abort for omap_8250_pm()
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: track port suspend state correctly in unsuccessful resume cases
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: decouple usb2 port resume and get_port_status request handling
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: clear usb2 resume related variables in one place.
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: rename resume_done to resume_timestamp
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: move port specific items such as state completions to port structure
>
> Mathias Nyman <mathias.nyman@linux.intel.com>
> xhci: cleanup xhci_hub_control port references
>
> Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> usb: core: Track SuperSpeed Plus GenXxY
>
> Juntong Deng <juntong.deng@outlook.com>
> selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error
>
> Waiman Long <longman@redhat.com>
> selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA
>
> Paul Menzel <pmenzel@molgen.mpg.de>
> ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA
>
> Tamim Khan <tamim@fusetak.com>
> ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA
>
> Hans de Goede <hdegoede@redhat.com>
> ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks
>
> Tamim Khan <tamim@fusetak.com>
> ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA
>
> Kellen Renshaw <kellen.renshaw@canonical.com>
> ACPI: resource: Add ASUS model S5402ZA to quirks
>
> Tamim Khan <tamim@fusetak.com>
> ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA
>
> Hui Wang <hui.wang@canonical.com>
> ACPI: resources: Add DMI-based legacy IRQ override quirk
>
> John Garry <john.garry@huawei.com>
> ACPI: Drop acpi_dev_irqresource_disabled()
>
> John Garry <john.garry@huawei.com>
> resource: Add irqresource_disabled()
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge
>
> Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
> net: pktgen: Fix interface flags printing
>
> Pablo Neira Ayuso <pablo@netfilter.org>
> netfilter: nft_set_rbtree: .deactivate fails if element has expired
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section
>
> Pedro Tammela <pctammela@mojatatu.com>
> net/sched: sch_hfsc: upgrade 'rt' to 'sc' when it becomes a inner curve
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register()
>
> Michal Schmidt <mschmidt@redhat.com>
> i40e: prevent crash on probe if hw registers have invalid values
>
> Dan Carpenter <dan.carpenter@linaro.org>
> net: usb: smsc95xx: Fix an error code in smsc95xx_reset()
>
> Eric Dumazet <edumazet@google.com>
> ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr
>
> Eric Dumazet <edumazet@google.com>
> tun: prevent negative ifindex
>
> Eric Dumazet <edumazet@google.com>
> tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb
>
> Neal Cardwell <ncardwell@google.com>
> tcp: fix excessive TLP and RACK timeouts from HZ rounding
>
> Josua Mayer <josua@solid-run.com>
> net: rfkill: gpio: prevent value glitch during probe
>
> Ma Ke <make_ruc2021@163.com>
> net: ipv6: fix return value check in esp_remove_trailer
>
> Ma Ke <make_ruc2021@163.com>
> net: ipv4: fix return value check in esp_remove_trailer
>
> Eric Dumazet <edumazet@google.com>
> xfrm: interface: use DEV_STATS_INC()
>
> Eric Dumazet <edumazet@google.com>
> xfrm: fix a data-race in xfrm_gen_index()
>
> Manish Chopra <manishc@marvell.com>
> qed: fix LL2 RX buffer allocation
>
> Ville Syrjälä <ville.syrjala@linux.intel.com>
> drm/i915: Retry gtt fault when out of fence registers
>
> Sagi Grimberg <sagi@grimberg.me>
> nvmet-tcp: Fix a possible UAF in queue intialization setup
>
> Florian Westphal <fw@strlen.de>
> netfilter: nft_payload: fix wrong mac header matching
>
> Paolo Abeni <pabeni@redhat.com>
> tcp: check mptcp-level constraints for backlog coalescing
>
> Joerg Roedel <jroedel@suse.de>
> x86/sev: Check for user-space IOIO pointing to kernel space
>
> Joerg Roedel <jroedel@suse.de>
> x86/sev: Check IOBM for IOIO exceptions from user-space
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/sev: Disable MMIO emulation from user mode
>
> Jim Mattson <jmattson@google.com>
> KVM: x86: Mask LVTPC when handling a PMI
>
> Johan Hovold <johan+linaro@kernel.org>
> regmap: fix NULL deref on lookup
>
> Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
> nfc: nci: fix possible NULL pointer dereference in send_acknowledge()
>
> Jesse Brandeburg <jesse.brandeburg@intel.com>
> ice: reset first in crash dump kernels
>
> Jesse Brandeburg <jesse.brandeburg@intel.com>
> ice: fix over-shifted variable
>
> Arnd Bergmann <arnd@arndb.de>
> Bluetooth: avoid memcmp() out of bounds warning
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: hci_event: Fix coding style
>
> Arkadiusz Bokowy <arkadiusz.bokowy@gmail.com>
> Bluetooth: vhci: Fix race when opening vhci device
>
> Ziyang Xuan <william.xuanziyang@huawei.com>
> Bluetooth: Fix a refcnt underflow problem for hci_conn
>
> Lee, Chun-Yi <jlee@suse.com>
> Bluetooth: Reject connection with the device which has same BD_ADDR
>
> Lee, Chun-Yi <jlee@suse.com>
> Bluetooth: hci_event: Ignore NULL link key
>
> Ricardo Cañuelo <ricardo.canuelo@collabora.com>
> usb: hub: Guard against accesses to uninitialized BOS descriptors
>
> Bagas Sanjaya <bagasdotme@gmail.com>
> Documentation: sysctl: align cells in second content column
>
> Liam Mark <lmark@codeaurora.org>
> mm/memory_hotplug: rate limit page migration warnings
>
> Hyeonggon Yoo <42.hyeyoo@gmail.com>
> lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default
>
> Nicolas Dichtel <nicolas.dichtel@6wind.com>
> dev_forward_skb: do not scrub skb mark within the same name space
>
> Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> ravb: Fix use-after-free issue in ravb_tx_timeout_work()
>
> Bart Van Assche <bvanassche@acm.org>
> RDMA/srp: Fix srp_abort()
>
> yangx.jy@fujitsu.com <yangx.jy@fujitsu.com>
> RDMA/srp: Set scmnd->result only when scmnd is not NULL
>
> Ren Zhijie <renzhijie2@huawei.com>
> arm64: armv8_deprecated: fix unused-function error
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: armv8_deprecated: rework deprected instruction handling
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: armv8_deprecated: move aarch32 helper earlier
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: armv8_deprecated move emulation functions
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: armv8_deprecated: fold ops into insn_emulation
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: rework EL0 MRS emulation
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: factor insn read out of call_undef_hook()
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: factor out EL1 SSBS emulation hook
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: split EL0/EL1 UNDEF handlers
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: allow kprobes on EL0 handlers
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: rework BTI exception handling
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: rework FPAC exception handling
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: consistently pass ESR_ELx to die()
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: die(): pass 'err' as long
>
> Mark Rutland <mark.rutland@arm.com>
> arm64: report EL1 UNDEFs better
>
> Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
> x86/alternatives: Disable KASAN in apply_alternatives()
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/64e: Fix wrong test in __ptep_test_and_clear_young()
>
> Christophe Leroy <christophe.leroy@csgroup.eu>
> powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE
>
> Duoming Zhou <duoming@zju.edu.cn>
> dmaengine: mediatek: Fix deadlock caused by synchronize_irq()
>
> Krishna Kurapati <quic_kriskura@quicinc.com>
> usb: gadget: ncm: Handle decoding of multiple NTB's in unwrap call
>
> Piyush Mehta <piyush.mehta@amd.com>
> usb: gadget: udc-xilinx: replace memcpy with memcpy_toio
>
> Dharma Balasubiramani <dharma.b@microchip.com>
> counter: microchip-tcb-capture: Fix the use of internal GCLK logic
>
> Dmitry Torokhov <dmitry.torokhov@gmail.com>
> pinctrl: avoid unsafe code pattern in find_pinctrl()
>
> Michal Koutný <mkoutny@suse.com>
> cgroup: Remove duplicates in cgroup v1 tasks file
>
> Rijo Thomas <Rijo-john.Thomas@amd.com>
> tee: amdtee: fix use-after-free vulnerability in amdtee_close_session
>
> Hans de Goede <hdegoede@redhat.com>
> Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case
>
> Szilard Fabian <szfabian@bluemarch.art>
> Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table
>
> Matthias Berndt <matthias_berndt@gmx.de>
> Input: xpad - add PXN V900 support
>
> Jeffery Miller <jefferymiller@google.com>
> Input: psmouse - fix fast_reconnect function for PS/2 mode
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> Input: powermate - fix use-after-free in powermate_config_complete
>
> Dan Carpenter <dan.carpenter@linaro.org>
> ceph: fix type promotion bug on 32bit systems
>
> Xiubo Li <xiubli@redhat.com>
> ceph: fix incorrect revoked caps assert in ceph_fill_file_size()
>
> Jordan Rife <jrife@google.com>
> libceph: use kernel_connect()
>
> Mika Westerberg <mika.westerberg@linux.intel.com>
> thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding
>
> Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
> mcb: remove is_added flag from mcb_device struct
>
> Borislav Petkov (AMD) <bp@alien8.de>
> x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs
>
> Alexander Zangerl <az@breathe-safe.com>
> iio: pressure: ms5611: ms5611_prom_is_valid false negative bug
>
> Lakshmi Yadlapati <lakshmiy@us.ibm.com>
> iio: pressure: dps310: Adjust Timeout Settings
>
> Phil Elwell <phil@raspberrypi.com>
> iio: pressure: bmp280: Fix NULL pointer exception
>
> Xingxing Luo <xingxing.luo@unisoc.com>
> usb: musb: Modify the "HWVers" register address
>
> Xingxing Luo <xingxing.luo@unisoc.com>
> usb: musb: Get the musb_qh poniter after musb_giveback
>
> Thinh Nguyen <Thinh.Nguyen@synopsys.com>
> usb: dwc3: Soft reset phy on probe for host
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read
>
> Wesley Cheng <quic_wcheng@quicinc.com>
> usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer
>
> Amelie Delaunay <amelie.delaunay@foss.st.com>
> dmaengine: stm32-mdma: abort resume if no ongoing transfer
>
> Zheng Wang <zyytlz.wz@163.com>
> media: mtk-jpeg: Fix use after free bug due to uncanceled work
>
> Patrick Rohr <prohr@google.com>
> net: release reference to inet6_dev pointer
>
> Patrick Rohr <prohr@google.com>
> net: change accept_ra_min_rtr_lft to affect all RA lifetimes
>
> Patrick Rohr <prohr@google.com>
> net: add sysctl accept_ra_min_rtr_lft
>
> Sasha Levin <sashal@kernel.org>
> Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe"
>
> Sasha Levin <sashal@kernel.org>
> Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure"
>
> Waiman Long <longman@redhat.com>
> workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask()
>
> Jeremy Cline <jeremy@jcline.org>
> nfc: nci: assert requested protocol is valid
>
> Ralph Siemsen <ralph.siemsen@linaro.org>
> pinctrl: renesas: rzn1: Enable missing PINMUX
>
> Eric Dumazet <edumazet@google.com>
> net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> ixgbe: fix crash with empty VF macvlan list
>
> Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
> net: phy: mscc: macsec: reject PN update requests
>
> Radu Pirea (NXP OSS) <radu-nicolae.pirea@oss.nxp.com>
> net: macsec: indicate next pn update when offloading
>
> Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
> drm/vmwgfx: fix typo of sizeof argument
>
> Björn Töpel <bjorn@rivosinc.com>
> riscv, bpf: Sign-extend return values
>
> Pu Lehui <pulehui@huawei.com>
> riscv, bpf: Factor out emit_call for kernel and bpf context
>
> Roger Pau Monne <roger.pau@citrix.com>
> xen-netback: use default TX queue size for vifs
>
> Dan Carpenter <dan.carpenter@linaro.org>
> mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type
>
> Dinghao Liu <dinghao.liu@zju.edu.cn>
> ieee802154: ca8210: Fix a potential UAF in ca8210_probe
>
> Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
> ravb: Fix up dma_free_coherent() call in ravb_remove()
>
> Abhinav Kumar <quic_abhinavk@quicinc.com>
> drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow
>
> Abhinav Kumar <quic_abhinavk@quicinc.com>
> drm/msm/dsi: skip the wait for video mode done if not applicable
>
> Kuogee Hsieh <quic_khsieh@quicinc.com>
> drm/msm/dp: do not reinitialize phy unless retry during link training
>
> Jordan Rife <jrife@google.com>
> net: prevent address rewrite in kernel_bind()
>
> Jan Kara <jack@suse.cz>
> quota: Fix slow quotaoff
>
> Hans de Goede <hdegoede@redhat.com>
> HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> lib/test_meminit: fix off-by-one error in test_pages()
>
> Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
> platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning
>
> Jing Zhang <renyu.zj@linux.alibaba.com>
> perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7
>
> Artem Chernyshev <artem.chernyshev@red-soft.ru>
> RDMA/cxgb4: Check skb value for failure to allocate
>
> Bart Van Assche <bvanassche@acm.org>
> RDMA/srp: Do not call scsi_done() from srp_abort()
>
> Bart Van Assche <bvanassche@acm.org>
> RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent
>
>
> -------------
>
> Diffstat:
>
> Documentation/admin-guide/sysctl/net.rst | 18 +-
> Documentation/networking/ip-sysctl.rst | 8 +
> Makefile | 4 +-
> arch/arm/boot/dts/motorola-mapphone-common.dtsi | 1 +
> arch/arm64/include/asm/cpufeature.h | 3 +-
> arch/arm64/include/asm/exception.h | 13 +-
> arch/arm64/include/asm/spectre.h | 2 +
> arch/arm64/include/asm/system_misc.h | 2 +-
> arch/arm64/include/asm/traps.h | 19 +-
> arch/arm64/kernel/armv8_deprecated.c | 572 ++++++++++-----------
> arch/arm64/kernel/cpufeature.c | 23 +-
> arch/arm64/kernel/entry-common.c | 36 +-
> arch/arm64/kernel/proton-pack.c | 26 +-
> arch/arm64/kernel/traps.c | 125 ++---
> arch/powerpc/include/asm/nohash/32/pte-8xx.h | 7 +
> arch/powerpc/include/asm/nohash/64/pgtable.h | 2 +-
> arch/powerpc/include/asm/nohash/pgtable.h | 2 +
> arch/riscv/net/bpf_jit_comp64.c | 33 +-
> arch/s390/pci/pci_dma.c | 15 +-
> arch/x86/boot/compressed/sev-es.c | 10 +
> arch/x86/include/asm/msr-index.h | 9 +-
> arch/x86/kernel/alternative.c | 13 +
> arch/x86/kernel/cpu/amd.c | 8 +
> arch/x86/kernel/sev-es-shared.c | 53 +-
> arch/x86/kernel/sev-es.c | 30 ++
> arch/x86/kvm/lapic.c | 8 +-
> drivers/acpi/irq.c | 7 +-
> drivers/acpi/resource.c | 121 ++++-
> drivers/ata/libata-eh.c | 2 +-
> drivers/base/regmap/regmap.c | 2 +-
> drivers/bluetooth/hci_vhci.c | 3 +
> drivers/counter/microchip-tcb-capture.c | 2 +-
> drivers/dma/mediatek/mtk-uart-apdma.c | 3 +-
> drivers/dma/stm32-mdma.c | 4 +
> drivers/gpio/gpio-timberdale.c | 5 +-
> drivers/gpio/gpio-vf610.c | 46 +-
> drivers/gpu/drm/amd/display/dc/core/dc.c | 9 +-
> drivers/gpu/drm/drm_connector.c | 79 +++
> drivers/gpu/drm/drm_crtc_internal.h | 2 +
> drivers/gpu/drm/drm_panel_orientation_quirks.c | 16 +
> drivers/gpu/drm/drm_sysfs.c | 87 +++-
> drivers/gpu/drm/i915/gem/i915_gem_mman.c | 1 +
> drivers/gpu/drm/msm/disp/dpu1/dpu_plane.c | 12 +-
> drivers/gpu/drm/msm/dp/dp_ctrl.c | 13 +-
> drivers/gpu/drm/msm/dsi/dsi_host.c | 12 +
> drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c | 2 +-
> drivers/hid/hid-holtek-kbd.c | 4 +
> drivers/hid/hid-logitech-hidpp.c | 3 +-
> drivers/hid/hid-multitouch.c | 4 +
> drivers/i2c/i2c-mux.c | 2 +-
> drivers/iio/pressure/bmp280-core.c | 2 +-
> drivers/iio/pressure/dps310.c | 8 +-
> drivers/iio/pressure/ms5611_core.c | 2 +-
> drivers/infiniband/hw/cxgb4/cm.c | 3 +
> drivers/infiniband/ulp/srp/ib_srp.c | 172 +++----
> drivers/infiniband/ulp/srp/ib_srp.h | 2 -
> drivers/input/joystick/xpad.c | 2 +
> drivers/input/misc/powermate.c | 1 +
> drivers/input/mouse/elantech.c | 1 +
> drivers/input/mouse/synaptics.c | 1 +
> drivers/input/serio/i8042-acpipnpio.h | 8 +
> drivers/input/touchscreen/goodix.c | 19 +
> drivers/mcb/mcb-core.c | 10 +-
> drivers/mcb/mcb-parse.c | 2 -
> drivers/media/platform/mtk-jpeg/mtk_jpeg_core.c | 1 +
> drivers/mmc/core/mmc.c | 2 +-
> drivers/mmc/core/sdio.c | 8 +-
> drivers/mtd/maps/physmap-core.c | 11 +
> drivers/mtd/nand/raw/arasan-nand-controller.c | 16 +-
> drivers/mtd/nand/raw/marvell_nand.c | 23 +-
> drivers/mtd/nand/raw/qcom_nandc.c | 2 +-
> drivers/mtd/nand/spi/micron.c | 2 +-
> drivers/net/dsa/bcm_sf2.c | 24 +-
> drivers/net/ethernet/intel/i40e/i40e_common.c | 4 +-
> drivers/net/ethernet/intel/ice/ice_lib.c | 3 +-
> drivers/net/ethernet/intel/ice/ice_main.c | 15 +
> drivers/net/ethernet/intel/ixgbe/ixgbe_sriov.c | 5 +-
> drivers/net/ethernet/marvell/sky2.h | 2 +-
> .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
> .../ethernet/mellanox/mlxsw/spectrum_nve_vxlan.c | 4 +-
> drivers/net/ethernet/qlogic/qed/qed_ll2.c | 7 +-
> drivers/net/ethernet/renesas/ravb_main.c | 6 +-
> drivers/net/ieee802154/ca8210.c | 17 +-
> drivers/net/macsec.c | 2 +
> drivers/net/phy/mscc/mscc_macsec.c | 6 +
> drivers/net/tun.c | 7 +-
> drivers/net/usb/dm9601.c | 7 +-
> drivers/net/usb/smsc95xx.c | 2 +-
> drivers/net/xen-netback/interface.c | 3 -
> drivers/nvme/host/pci.c | 3 +-
> drivers/nvme/host/rdma.c | 3 +
> drivers/nvme/target/tcp.c | 7 +-
> drivers/perf/arm-cmn.c | 2 +-
> drivers/phy/motorola/phy-mapphone-mdm6600.c | 38 +-
> drivers/pinctrl/renesas/Kconfig | 1 +
> drivers/platform/x86/asus-nb-wmi.c | 3 +
> drivers/platform/x86/asus-wmi.h | 2 +-
> drivers/platform/x86/hp-wmi.c | 8 +-
> drivers/platform/x86/touchscreen_dmi.c | 23 +
> drivers/regulator/core.c | 6 +-
> drivers/spi/spi-zynqmp-gqspi.c | 24 +-
> drivers/tee/amdtee/core.c | 10 +-
> drivers/thunderbolt/icm.c | 38 +-
> drivers/thunderbolt/switch.c | 7 +
> drivers/tty/serial/8250/8250_omap.c | 93 ++--
> drivers/usb/core/hcd.c | 6 +-
> drivers/usb/core/hub.c | 106 +++-
> drivers/usb/core/hub.h | 2 +-
> drivers/usb/dwc3/core.c | 39 +-
> drivers/usb/gadget/function/f_ncm.c | 26 +-
> drivers/usb/gadget/udc/udc-xilinx.c | 20 +-
> drivers/usb/host/xhci-hub.c | 228 ++++----
> drivers/usb/host/xhci-mem.c | 10 +-
> drivers/usb/host/xhci-ring.c | 17 +-
> drivers/usb/host/xhci.h | 9 +-
> drivers/usb/musb/musb_debugfs.c | 2 +-
> drivers/usb/musb/musb_host.c | 9 +-
> drivers/usb/serial/option.c | 7 +
> drivers/usb/typec/altmodes/Kconfig | 1 +
> drivers/usb/typec/altmodes/displayport.c | 28 +
> fs/btrfs/extent-tree.c | 6 +-
> fs/btrfs/ioctl.c | 4 +-
> fs/btrfs/tree-log.c | 2 +-
> fs/ceph/file.c | 2 +-
> fs/ceph/inode.c | 4 +-
> fs/nfs/pnfs.c | 33 +-
> fs/overlayfs/copy_up.c | 2 +-
> fs/quota/dquot.c | 66 ++-
> include/drm/drm_connector.h | 25 +
> include/linux/ioport.h | 7 +
> include/linux/ipv6.h | 1 +
> include/linux/mcb.h | 1 -
> include/linux/netdevice.h | 2 +-
> include/linux/perf_event.h | 1 +
> include/linux/quota.h | 4 +-
> include/linux/quotaops.h | 2 +-
> include/linux/usb.h | 2 +
> include/net/bluetooth/hci_core.h | 2 +-
> include/net/bluetooth/hci_mon.h | 2 +-
> include/net/ip_fib.h | 1 +
> include/net/macsec.h | 1 +
> include/net/netns/xfrm.h | 1 +
> include/net/tcp.h | 3 +
> include/trace/events/neigh.h | 4 +-
> include/uapi/linux/ipv6.h | 7 +
> kernel/cgroup/cgroup-v1.c | 5 +-
> kernel/events/core.c | 39 +-
> kernel/trace/trace_events.c | 1 +
> kernel/workqueue.c | 8 +-
> lib/Kconfig.debug | 5 +-
> lib/test_meminit.c | 2 +-
> mm/memory_hotplug.c | 16 +-
> net/bluetooth/hci_conn.c | 72 ++-
> net/bluetooth/hci_core.c | 8 +-
> net/bluetooth/hci_event.c | 33 +-
> net/bluetooth/hci_sock.c | 3 +-
> net/ceph/messenger.c | 4 +-
> net/core/pktgen.c | 14 +-
> net/ipv4/esp4.c | 4 +-
> net/ipv4/fib_semantics.c | 15 +-
> net/ipv4/fib_trie.c | 4 +
> net/ipv4/tcp_ipv4.c | 1 +
> net/ipv4/tcp_output.c | 25 +-
> net/ipv4/tcp_recovery.c | 2 +-
> net/ipv6/addrconf.c | 13 +
> net/ipv6/esp6.c | 4 +-
> net/ipv6/ndisc.c | 13 +-
> net/ipv6/xfrm6_policy.c | 4 +-
> net/mac80211/tx.c | 3 +-
> net/netfilter/ipvs/ip_vs_sync.c | 4 +-
> net/netfilter/nft_payload.c | 2 +-
> net/netfilter/nft_set_rbtree.c | 2 +
> net/nfc/llcp_core.c | 30 +-
> net/nfc/nci/core.c | 5 +
> net/nfc/nci/spi.c | 2 +
> net/rds/tcp_connect.c | 2 +-
> net/rds/tcp_listen.c | 2 +-
> net/rfkill/rfkill-gpio.c | 4 +-
> net/sched/sch_hfsc.c | 18 +-
> net/socket.c | 6 +-
> net/wireless/nl80211.c | 2 +-
> net/wireless/scan.c | 4 +
> net/xfrm/xfrm_interface_core.c | 22 +-
> net/xfrm/xfrm_policy.c | 6 +-
> sound/soc/pxa/pxa-ssp.c | 2 +-
> .../selftests/vm/charge_reserved_hugetlb.sh | 34 +-
> .../selftests/vm/hugetlb_reparenting_test.sh | 21 +-
> tools/testing/selftests/vm/write_hugetlb_memory.sh | 2 +-
> 188 files changed, 2126 insertions(+), 1202 deletions(-)
>
>
> .
>
^ permalink raw reply [flat|nested] 210+ messages in thread
* Re: [PATCH 5.10 000/202] 5.10.199-rc1 review
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2023-10-24 12:36 ` luomeng
@ 2023-10-25 19:01 ` Jon Hunter
207 siblings, 0 replies; 210+ messages in thread
From: Jon Hunter @ 2023-10-25 19:01 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, linux-tegra, stable
On Mon, 23 Oct 2023 12:55:07 +0200, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.10.199 release.
> There are 202 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 25 Oct 2023 10:47:57 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.199-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
All tests passing for Tegra ...
Test results for stable-v5.10:
10 builds: 10 pass, 0 fail
26 boots: 26 pass, 0 fail
68 tests: 68 pass, 0 fail
Linux version: 5.10.199-rc1-gf622826e6370
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Tested-by: Jon Hunter <jonathanh@nvidia.com>
Jon
^ permalink raw reply [flat|nested] 210+ messages in thread
end of thread, other threads:[~2023-10-25 19:01 UTC | newest]
Thread overview: 210+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-10-23 10:55 [PATCH 5.10 000/202] 5.10.199-rc1 review Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 001/202] RDMA/srp: Make struct scsi_cmnd and struct srp_request adjacent Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 002/202] RDMA/srp: Do not call scsi_done() from srp_abort() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 003/202] RDMA/cxgb4: Check skb value for failure to allocate Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 004/202] perf/arm-cmn: Fix the unhandled overflow status of counter 4 to 7 Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 005/202] platform/x86: hp-wmi:: Mark driver struct with __refdata to prevent section mismatch warning Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 006/202] lib/test_meminit: fix off-by-one error in test_pages() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 007/202] HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 008/202] quota: Fix slow quotaoff Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 009/202] net: prevent address rewrite in kernel_bind() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 010/202] drm/msm/dp: do not reinitialize phy unless retry during link training Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 011/202] drm/msm/dsi: skip the wait for video mode done if not applicable Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 012/202] drm/msm/dpu: change _dpu_plane_calc_bw() to use u64 to avoid overflow Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 013/202] ravb: Fix up dma_free_coherent() call in ravb_remove() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 014/202] ieee802154: ca8210: Fix a potential UAF in ca8210_probe Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 015/202] mlxsw: fix mlxsw_sp2_nve_vxlan_learning_set() return type Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 016/202] xen-netback: use default TX queue size for vifs Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 017/202] riscv, bpf: Factor out emit_call for kernel and bpf context Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 018/202] riscv, bpf: Sign-extend return values Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 019/202] drm/vmwgfx: fix typo of sizeof argument Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 020/202] net: macsec: indicate next pn update when offloading Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 021/202] net: phy: mscc: macsec: reject PN update requests Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 022/202] ixgbe: fix crash with empty VF macvlan list Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 023/202] net: nfc: fix races in nfc_llcp_sock_get() and nfc_llcp_sock_get_sn() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 024/202] pinctrl: renesas: rzn1: Enable missing PINMUX Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 025/202] nfc: nci: assert requested protocol is valid Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 026/202] workqueue: Override implicit ordered attribute in workqueue_apply_unbound_cpumask() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 027/202] Revert "spi: zynqmp-gqspi: fix clock imbalance on probe failure" Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 028/202] Revert "spi: spi-zynqmp-gqspi: Fix runtime PM imbalance in zynqmp_qspi_probe" Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 029/202] net: add sysctl accept_ra_min_rtr_lft Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 030/202] net: change accept_ra_min_rtr_lft to affect all RA lifetimes Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 031/202] net: release reference to inet6_dev pointer Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 032/202] media: mtk-jpeg: Fix use after free bug due to uncanceled work Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 033/202] dmaengine: stm32-mdma: abort resume if no ongoing transfer Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 034/202] usb: xhci: xhci-ring: Use sysdev for mapping bounce buffer Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 035/202] net: usb: dm9601: fix uninitialized variable use in dm9601_mdio_read Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 036/202] usb: dwc3: Soft reset phy on probe for host Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 037/202] usb: musb: Get the musb_qh poniter after musb_giveback Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 038/202] usb: musb: Modify the "HWVers" register address Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 039/202] iio: pressure: bmp280: Fix NULL pointer exception Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 040/202] iio: pressure: dps310: Adjust Timeout Settings Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 041/202] iio: pressure: ms5611: ms5611_prom_is_valid false negative bug Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 042/202] x86/cpu: Fix AMD erratum #1485 on Zen4-based CPUs Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 043/202] mcb: remove is_added flag from mcb_device struct Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 044/202] thunderbolt: Check that lane 1 is in CL0 before enabling lane bonding Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 045/202] libceph: use kernel_connect() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 046/202] ceph: fix incorrect revoked caps assert in ceph_fill_file_size() Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 047/202] ceph: fix type promotion bug on 32bit systems Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 048/202] Input: powermate - fix use-after-free in powermate_config_complete Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 049/202] Input: psmouse - fix fast_reconnect function for PS/2 mode Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 050/202] Input: xpad - add PXN V900 support Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 051/202] Input: i8042 - add Fujitsu Lifebook E5411 to i8042 quirk table Greg Kroah-Hartman
2023-10-23 10:55 ` [PATCH 5.10 052/202] Input: goodix - ensure int GPIO is in input for gpio_count == 1 && gpio_int_idx == 0 case Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 053/202] tee: amdtee: fix use-after-free vulnerability in amdtee_close_session Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 054/202] cgroup: Remove duplicates in cgroup v1 tasks file Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 055/202] pinctrl: avoid unsafe code pattern in find_pinctrl() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 056/202] counter: microchip-tcb-capture: Fix the use of internal GCLK logic Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 057/202] usb: gadget: udc-xilinx: replace memcpy with memcpy_toio Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 058/202] usb: gadget: ncm: Handle decoding of multiple NTBs in unwrap call Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 059/202] dmaengine: mediatek: Fix deadlock caused by synchronize_irq() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 060/202] powerpc/8xx: Fix pte_access_permitted() for PAGE_NONE Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 061/202] powerpc/64e: Fix wrong test in __ptep_test_and_clear_young() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 062/202] x86/alternatives: Disable KASAN in apply_alternatives() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 063/202] arm64: report EL1 UNDEFs better Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 064/202] arm64: die(): pass err as long Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 065/202] arm64: consistently pass ESR_ELx to die() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 066/202] arm64: rework FPAC exception handling Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 067/202] arm64: rework BTI " Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 068/202] arm64: allow kprobes on EL0 handlers Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 069/202] arm64: split EL0/EL1 UNDEF handlers Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 070/202] arm64: factor out EL1 SSBS emulation hook Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 071/202] arm64: factor insn read out of call_undef_hook() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 072/202] arm64: rework EL0 MRS emulation Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 073/202] arm64: armv8_deprecated: fold ops into insn_emulation Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 074/202] arm64: armv8_deprecated move emulation functions Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 075/202] arm64: armv8_deprecated: move aarch32 helper earlier Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 076/202] arm64: armv8_deprecated: rework deprected instruction handling Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 077/202] arm64: armv8_deprecated: fix unused-function error Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 078/202] RDMA/srp: Set scmnd->result only when scmnd is not NULL Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 079/202] RDMA/srp: Fix srp_abort() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 080/202] ravb: Fix use-after-free issue in ravb_tx_timeout_work() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 081/202] dev_forward_skb: do not scrub skb mark within the same name space Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 082/202] lib/Kconfig.debug: do not enable DEBUG_PREEMPT by default Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 083/202] mm/memory_hotplug: rate limit page migration warnings Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 084/202] Documentation: sysctl: align cells in second content column Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 085/202] usb: hub: Guard against accesses to uninitialized BOS descriptors Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 086/202] Bluetooth: hci_event: Ignore NULL link key Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 087/202] Bluetooth: Reject connection with the device which has same BD_ADDR Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 088/202] Bluetooth: Fix a refcnt underflow problem for hci_conn Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 089/202] Bluetooth: vhci: Fix race when opening vhci device Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 090/202] Bluetooth: hci_event: Fix coding style Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 091/202] Bluetooth: avoid memcmp() out of bounds warning Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 092/202] ice: fix over-shifted variable Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 093/202] ice: reset first in crash dump kernels Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 094/202] nfc: nci: fix possible NULL pointer dereference in send_acknowledge() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 095/202] regmap: fix NULL deref on lookup Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 096/202] KVM: x86: Mask LVTPC when handling a PMI Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 097/202] x86/sev: Disable MMIO emulation from user mode Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 098/202] x86/sev: Check IOBM for IOIO exceptions from user-space Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 099/202] x86/sev: Check for user-space IOIO pointing to kernel space Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 100/202] tcp: check mptcp-level constraints for backlog coalescing Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 101/202] netfilter: nft_payload: fix wrong mac header matching Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 102/202] nvmet-tcp: Fix a possible UAF in queue intialization setup Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 103/202] drm/i915: Retry gtt fault when out of fence registers Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 104/202] qed: fix LL2 RX buffer allocation Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 105/202] xfrm: fix a data-race in xfrm_gen_index() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 106/202] xfrm: interface: use DEV_STATS_INC() Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 107/202] net: ipv4: fix return value check in esp_remove_trailer Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 108/202] net: ipv6: " Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 109/202] net: rfkill: gpio: prevent value glitch during probe Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 110/202] tcp: fix excessive TLP and RACK timeouts from HZ rounding Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 111/202] tcp: tsq: relax tcp_small_queue_check() when rtx queue contains a single skb Greg Kroah-Hartman
2023-10-23 10:56 ` [PATCH 5.10 112/202] tun: prevent negative ifindex Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 113/202] ipv4: fib: annotate races around nh->nh_saddr_genid and nh->nh_saddr Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 114/202] net: usb: smsc95xx: Fix an error code in smsc95xx_reset() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 115/202] i40e: prevent crash on probe if hw registers have invalid values Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 116/202] net: dsa: bcm_sf2: Fix possible memory leak in bcm_sf2_mdio_register() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 117/202] net/sched: sch_hfsc: upgrade rt to sc when it becomes a inner curve Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 118/202] neighbor: tracing: Move pin6 inside CONFIG_IPV6=y section Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 119/202] netfilter: nft_set_rbtree: .deactivate fails if element has expired Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 120/202] net: pktgen: Fix interface flags printing Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 121/202] thunderbolt: Workaround an IOMMU fault on certain systems with Intel Maple Ridge Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 122/202] resource: Add irqresource_disabled() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 123/202] ACPI: Drop acpi_dev_irqresource_disabled() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 124/202] ACPI: resources: Add DMI-based legacy IRQ override quirk Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 125/202] ACPI: resource: Skip IRQ override on Asus Vivobook K3402ZA/K3502ZA Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 126/202] ACPI: resource: Add ASUS model S5402ZA to quirks Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 127/202] ACPI: resource: Skip IRQ override on Asus Vivobook S5602ZA Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 128/202] ACPI: resource: Add Asus ExpertBook B2502 to Asus quirks Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 129/202] ACPI: resource: Skip IRQ override on Asus Expertbook B2402CBA Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 130/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1502CBA Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 131/202] ACPI: resource: Skip IRQ override on ASUS ExpertBook B1402CBA Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 132/202] selftests/vm: make charge_reserved_hugetlb.sh work with existing cgroup setting Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 133/202] selftests/mm: fix awk usage in charge_reserved_hugetlb.sh and hugetlb_reparenting_test.sh that may cause error Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 134/202] usb: core: Track SuperSpeed Plus GenXxY Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 135/202] xhci: cleanup xhci_hub_control port references Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 136/202] xhci: move port specific items such as state completions to port structure Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 137/202] xhci: rename resume_done to resume_timestamp Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 138/202] xhci: clear usb2 resume related variables in one place Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 139/202] xhci: decouple usb2 port resume and get_port_status request handling Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 140/202] xhci: track port suspend state correctly in unsuccessful resume cases Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 141/202] serial: 8250: omap: Fix imprecise external abort for omap_8250_pm() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 142/202] serial: 8250_omap: Fix errors with no_console_suspend Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 143/202] drm/amd/display: only check available pipe to disable vbios mode Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 144/202] drm/amd/display: Dont set dpms_off for seamless boot Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 145/202] drm/connector: Give connector sysfs devices there own device_type Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 146/202] drm/connector: Add a fwnode pointer to drm_connector and register with ACPI (v2) Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 147/202] drm/connector: Add drm_connector_find_by_fwnode() function (v3) Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 148/202] drm/connector: Add support for out-of-band hotplug notification (v3) Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 149/202] usb: typec: altmodes/displayport: Notify drm subsys of hotplug events Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 150/202] usb: typec: altmodes/displayport: Signal hpd low when exiting mode Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 151/202] ARM: dts: ti: omap: Fix noisy serial with overrun-throttle-ms for mapphone Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 152/202] btrfs: return -EUCLEAN for delayed tree ref with a ref count not equals to 1 Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 153/202] btrfs: initialize start_slot in btrfs_log_prealloc_extents Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 154/202] i2c: mux: Avoid potential false error message in i2c_mux_add_adapter Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 155/202] overlayfs: set ctime when setting mtime and atime Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 156/202] gpio: timberdale: Fix potential deadlock on &tgpio->lock Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 157/202] ata: libata-eh: Fix compilation warning in ata_eh_link_report() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 158/202] tracing: relax trace_event_eval_update() execution with cond_resched() Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 159/202] HID: holtek: fix slab-out-of-bounds Write in holtek_kbd_input_event Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 160/202] Bluetooth: Avoid redundant authentication Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 161/202] Bluetooth: hci_core: Fix build warnings Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 162/202] wifi: cfg80211: Fix 6GHz scan configuration Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 163/202] wifi: mac80211: allow transmitting EAPOL frames with tainted key Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 164/202] wifi: cfg80211: avoid leaking stack data into trace Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 165/202] regulator/core: Revert "fix kobject release warning and memory leak in regulator_register()" Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 166/202] sky2: Make sure there is at least one frag_addr available Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 167/202] ipv4/fib: send notify when delete source address routes Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 168/202] drm: panel-orientation-quirks: Add quirk for One Mix 2S Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 169/202] btrfs: fix some -Wmaybe-uninitialized warnings in ioctl.c Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 170/202] HID: multitouch: Add required quirk for Synaptics 0xcd7e device Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 171/202] platform/x86: touchscreen_dmi: Add info for the Positivo C4128B Greg Kroah-Hartman
2023-10-23 10:57 ` [PATCH 5.10 172/202] net/mlx5: Handle fw tracer change ownership event based on MTRC Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 173/202] Bluetooth: hci_event: Fix using memcmp when comparing keys Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 174/202] mtd: rawnand: qcom: Unmap the right resource upon probe failure Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 175/202] mtd: rawnand: marvell: Ensure program page operations are successful Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 176/202] mtd: rawnand: arasan: " Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 177/202] mtd: spinand: micron: correct bitmask for ecc status Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 178/202] mtd: physmap-core: Restore map_rom fallback Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 179/202] mmc: core: sdio: hold retuning if sdio in 1-bit mode Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 180/202] mmc: core: Capture correct oemid-bits for eMMC cards Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 181/202] Revert "pinctrl: avoid unsafe code pattern in find_pinctrl()" Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 182/202] pNFS: Fix a hang in nfs4_evict_inode() Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 183/202] ACPI: irq: Fix incorrect return value in acpi_register_gsi() Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 184/202] nvme-pci: add BOGUS_NID for Intel 0a54 device Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 185/202] nvme-rdma: do not try to stop unallocated queues Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 186/202] USB: serial: option: add Telit LE910C4-WWX 0x1035 composition Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 187/202] USB: serial: option: add entry for Sierra EM9191 with new firmware Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 188/202] USB: serial: option: add Fibocom to DELL custom modem FM101R-GL Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 189/202] perf: Disallow mis-matched inherited group reads Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 190/202] s390/pci: fix iommu bitmap allocation Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 191/202] platform/x86: asus-wmi: Change ASUS_WMI_BRN_DOWN code from 0x20 to 0x2e Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 192/202] platform/x86: asus-wmi: Map 0x2a code, Ignore 0x2b and 0x2c events Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 193/202] gpio: vf610: set value before the direction to avoid a glitch Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 194/202] ASoC: pxa: fix a memory leak in probe() Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 195/202] gpio: vf610: make irq_chip immutable Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 196/202] gpio: vf610: mask the gpio irq in system suspend and support wakeup Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 197/202] phy: mapphone-mdm6600: Fix runtime disable on probe Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 198/202] phy: mapphone-mdm6600: Fix runtime PM for remove Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 199/202] phy: mapphone-mdm6600: Fix pinctrl_pm handling for sleep pins Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 200/202] Bluetooth: hci_sock: fix slab oob read in create_monitor_event Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 201/202] Bluetooth: hci_sock: Correctly bounds check and pad HCI_MON_NEW_INDEX name Greg Kroah-Hartman
2023-10-23 10:58 ` [PATCH 5.10 202/202] xfrm6: fix inet6_dev refcount underflow problem Greg Kroah-Hartman
2023-10-23 15:29 ` [PATCH 5.10 000/202] 5.10.199-rc1 review Daniel Díaz
2023-10-23 18:01 ` Pavel Machek
2023-10-23 18:56 ` Florian Fainelli
2023-10-24 7:50 ` Dominique Martinet
2023-10-24 8:31 ` Greg Kroah-Hartman
2023-10-24 12:36 ` luomeng
2023-10-25 19:01 ` Jon Hunter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).