* [PATCH 6.6 000/156] 6.6.9-rc1 review
@ 2023-12-30 11:57 Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 001/156] bpf: Fix prog_array_map_poke_run map poke update Greg Kroah-Hartman
` (164 more replies)
0 siblings, 165 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
This is the start of the stable review cycle for the 6.6.9 release.
There are 156 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 6.6.9-rc1
Nam Cao <namcao@linutronix.de>
spi: cadence: revert "Add SPI transfer delays"
Thomas Gleixner <tglx@linutronix.de>
x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully
Thomas Gleixner <tglx@linutronix.de>
x86/alternatives: Disable interrupts and sync when optimizing NOPs in place
Thomas Gleixner <tglx@linutronix.de>
x86/alternatives: Sync core before enabling interrupts
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy()
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic: Simplify kvm_vgic_destroy()
Yaxiong Tian <tianyaxiong@kylinos.cn>
thunderbolt: Fix memory leak in margining_port_remove()
Herve Codina <herve.codina@bootlin.com>
lib/vsprintf: Fix %pfwf when current node refcount == 0
xiongxin <xiongxin@kylinos.cn>
gpio: dwapb: mask/unmask IRQ when disable/enale it
Tony Lindgren <tony@atomide.com>
bus: ti-sysc: Flush posted write only after srst_udelay
Nam Cao <namcao@linutronix.de>
pinctrl: starfive: jh7100: ignore disabled device tree nodes
Nam Cao <namcao@linutronix.de>
pinctrl: starfive: jh7110: ignore disabled device tree nodes
Geliang Tang <geliang.tang@linux.dev>
selftests: mptcp: join: fix subflow_send_ack lookup
Mikulas Patocka <mpatocka@redhat.com>
dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
Steven Rostedt (Google) <rostedt@goodmis.org>
tracing / synthetic: Disable events after testing in synth_event_gen_test_init()
Alexander Atanasov <alexander.atanasov@virtuozzo.com>
scsi: core: Always send batch on reset or error handling command
Martin K. Petersen <martin.petersen@oracle.com>
Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
Rafał Miłecki <rafal@milecki.pl>
nvmem: brcm_nvram: store a copy of NVRAM content
Louis Chauvet <louis.chauvet@bootlin.com>
spi: atmel: Fix clock issue when using devices with different polarities
Miquel Raynal <miquel.raynal@bootlin.com>
spi: atmel: Prevent spi transfers from being killed
Miquel Raynal <miquel.raynal@bootlin.com>
spi: atmel: Do not cancel a transfer upon any signal
Steven Rostedt (Google) <rostedt@goodmis.org>
ring-buffer: Fix slowpath of interrupted event
Steven Rostedt (Google) <rostedt@goodmis.org>
ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg()
JP Kobryn <inwardvessel@gmail.com>
9p: prevent read overrun in protocol dump tracepoint
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915/dmc: Don't enable any pipe DMC events
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915: Reject async flips with bigjoiner
Paulo Alcantara <pc@manguebit.com>
smb: client: fix OOB in smbCalcSize()
Paulo Alcantara <pc@manguebit.com>
smb: client: fix OOB in SMB2_query_info_init()
Paulo Alcantara <pc@manguebit.com>
smb: client: fix potential OOB in cifs_dump_detail()
Paulo Alcantara <pc@manguebit.com>
smb: client: fix OOB in cifsd when receiving compounded resps
NeilBrown <neilb@suse.de>
nfsd: call nfsd_last_thread() before final nfsd_put()
Fabio Estevam <festevam@denx.de>
dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
Lai Peter Jun Ann <jun.ann.lai@intel.com>
net: stmmac: fix incorrect flag check in timestamp interrupt
Thomas Weißschuh <linux@weissschuh.net>
net: avoid build bug in skb extension length calculation
Ronald Wahl <ronald.wahl@raritan.com>
net: ks8851: Fix TX stall caused by TX buffer overrun
Rouven Czerwinski <r.czerwinski@pengutronix.de>
net: rfkill: gpio: set GPIO direction
Fedor Pchelkin <pchelkin@ispras.ru>
net: 9p: avoid freeing uninit memory in p9pdu_vreadf
Christoffer Sandberg <cs@tuxedo.de>
Input: soc_button_array - add mapping for airplane mode button
Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
net: usb: ax88179_178a: avoid failed operations when device is disconnected
Dan Carpenter <dan.carpenter@linaro.org>
usb: fotg210-hcd: delete an incorrect bounds test
Johan Hovold <johan+linaro@kernel.org>
usb: typec: ucsi: fix gpio-based orientation detection
Alex Lu <alex_lu@realsil.com.cn>
Bluetooth: Add more enc key size check
Xiao Yao <xiaoyao@rock-chips.com>
Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
Frédéric Danis <frederic.danis@collabora.com>
Bluetooth: L2CAP: Send reject on command corrupted request
Hyunwoo Kim <v4bel@theori.io>
Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
Gergo Koteles <soyer@irl.hu>
ASoC: tas2781: check the validity of prm_no/cfg_no
Clément Villeret <clement.villeret@gmail.com>
ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
Gergo Koteles <soyer@irl.hu>
ALSA: hda/tas2781: select program 0, conf 0 by default
Reinhard Speyerer <rspmn@arcor.de>
USB: serial: option: add Quectel RM500Q R13 firmware support
Slark Xiao <slark_xiao@163.com>
USB: serial: option: add Foxconn T99W265 with new baseline
Alper Ak <alperyasinak1@gmail.com>
USB: serial: option: add Quectel EG912Y module support
Mark Glover <mark.glover@actisense.com>
USB: serial: ftdi_sio: update Actisense PIDs constant names
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: fix certs build to not depend on file order
Chen-Yu Tsai <wens@kernel.org>
wifi: cfg80211: Add my certificate
Felix Fietkau <nbd@nbd.name>
wifi: mt76: fix crash with WED rx support enabled
Tasos Sahanidis <tasos@tasossah.com>
usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
Tony Lindgren <tony@atomide.com>
ARM: dts: Fix occasional boot hang for am3 usb
Jeremie Knuesel <knuesel@gmail.com>
ALSA: usb-audio: Increase delay in MOTU M quirk
David Lechner <dlechner@baylibre.com>
iio: triggered-buffer: prevent possible freeing of wrong buffer
Javier Carrasco <javier.carrasco@wolfvision.net>
iio: tmag5273: fix temperature offset
Wadim Egorov <w.egorov@phytec.de>
iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
Nuno Sa <nuno.sa@analog.com>
iio: imu: adis16475: add spi_device_id table
Javier Carrasco <javier.carrasco.cruz@gmail.com>
iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
Haibo Chen <haibo.chen@nxp.com>
iio: adc: imx93: add four channels for imx93 adc
Matti Vaittinen <mazziesaccount@gmail.com>
iio: kx022a: Fix acceleration value scaling
Can Guo <quic_cang@quicinc.com>
scsi: ufs: core: Let the sq_lock protect sq_tail_slot access
ChanWoo Lee <cw9316.lee@samsung.com>
scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify()
Wei Yongjun <weiyongjun1@huawei.com>
scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
George Stark <gnstark@salutedevices.com>
iio: adc: meson: add separate config for axg SoC family
Haoran Liu <liuhaoran14@163.com>
Input: ipaq-micro-keys - add error handling for devm_kmemdup
Konrad Dybcio <konrad.dybcio@linaro.org>
interconnect: qcom: sm8250: Enable sync_state
Su Hui <suhui@nfschina.com>
iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
Mike Tipton <quic_mdtipton@quicinc.com>
interconnect: Treat xlate() returning NULL node as an error
Maurizio Lombardi <mlombard@redhat.com>
nvme-pci: fix sleeping function called from interrupt context
Kent Gibson <warthog618@gmail.com>
gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()
Alexis Lothoré <alexis.lothore@bootlin.com>
pinctrl: at91-pio4: use dedicated lock class for IRQ
Arnd Bergmann <arnd@arndb.de>
x86/xen: add CPU dependencies for 32-bit build
Quan Nguyen <quan@os.amperecomputing.com>
i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
ZhenGuo Yin <zhenguo.yin@amd.com>
drm/amdgpu: re-create idle bo's PTE during VM state machine reset
Yang Yingliang <yangyingliang@huawei.com>
i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off()
Shengjiu Wang <shengjiu.wang@nxp.com>
ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
Jerome Brunet <jbrunet@baylibre.com>
ASoC: hdmi-codec: fix missing report for jack initial status
Imre Deak <imre.deak@intel.com>
drm/i915/mtl: Fix HDMI/DP PLL clock selection
Karthik Poosa <karthik.poosa@intel.com>
drm/i915/hwmon: Fix static analysis tool reported issues
David Howells <dhowells@redhat.com>
afs: Fix use-after-free due to get/remove race in volume tree
David Howells <dhowells@redhat.com>
afs: Fix overwriting of result of DNS query
David Howells <dhowells@redhat.com>
keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
Eric Dumazet <edumazet@google.com>
net: check dev->gso_max_size in gso_features_check()
David Ahern <dsahern@kernel.org>
net/ipv6: Revert remove expired routes with a separated list of routes
Lorenzo Bianconi <lorenzo@kernel.org>
net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean()
David Howells <dhowells@redhat.com>
afs: Fix dynamic root lookup DNS check
David Howells <dhowells@redhat.com>
afs: Fix the dynamic root's d_delete to always delete unused dentries
Liu Jian <liujian56@huawei.com>
net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
Yury Norov <yury.norov@gmail.com>
net: mana: select PAGE_POOL
Larysa Zaremba <larysa.zaremba@intel.com>
ice: Fix PF with enabled XDP going no-carrier after reset
Dave Ertman <david.m.ertman@intel.com>
ice: alter feature support check for SRIOV and LAG
Jacob Keller <jacob.e.keller@intel.com>
ice: stop trashing VF VSI aggregator node ID information
Daniel Golle <daniel@makrotopia.org>
net: phy: skip LED triggers on PHYs on SFP modules
Andy Gospodarek <andrew.gospodarek@broadcom.com>
bnxt_en: do not map packet buffers twice
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis
Arnd Bergmann <arnd@arndb.de>
Bluetooth: hci_event: shut up a false-positive warning
Ying Hsu <yinghsu@chromium.org>
Bluetooth: Fix deadlock in vhci_send_frame
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: Fix not notifying when connection encryption changes
Eric Dumazet <edumazet@google.com>
net/rose: fix races in rose_kill_by_device()
Zhipeng Lu <alexious@zju.edu.cn>
ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
Eric Dumazet <edumazet@google.com>
net: sched: ife: fix potential use-after-free
Shigeru Yoshida <syoshida@redhat.com>
net: Return error from sk_stream_wait_connect() if sk_wait_event() fails
Suman Ghosh <sumang@marvell.com>
octeontx2-pf: Fix graceful exit during PFC configuration failure
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above
Vladimir Oltean <vladimir.oltean@nxp.com>
net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above
Rahul Rameshbabu <rrameshbabu@nvidia.com>
net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
Rahul Rameshbabu <rrameshbabu@nvidia.com>
net/mlx5e: Correct snprintf truncation handling for fw_version buffer
Dan Carpenter <dan.carpenter@linaro.org>
net/mlx5e: Fix error codes in alloc_branch_attr()
Dan Carpenter <dan.carpenter@linaro.org>
net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get()
Vlad Buslov <vladbu@nvidia.com>
net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num
Moshe Shemesh <moshe@nvidia.com>
net/mlx5: Fix fw tracer first block check
Carolina Jubran <cjubran@nvidia.com>
net/mlx5e: XDP, Drop fragmented packets larger than MTU size
Chris Mi <cmi@nvidia.com>
net/mlx5e: Decrease num_block_tc when unblock tc offload
Jianbo Liu <jianbol@nvidia.com>
net/mlx5e: Fix overrun reported by coverity
Dinghao Liu <dinghao.liu@zju.edu.cn>
net/mlx5e: fix a potential double-free in fs_udp_create_groups
Shifeng Li <lishifeng@sangfor.com.cn>
net/mlx5e: Fix a race in command alloc flow
Shifeng Li <lishifeng@sangfor.com.cn>
net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
Vlad Buslov <vladbu@nvidia.com>
Revert "net/mlx5e: fix double free of encap_header"
Vlad Buslov <vladbu@nvidia.com>
Revert "net/mlx5e: fix double free of encap_header in update funcs"
John Fastabend <john.fastabend@gmail.com>
bpf: syzkaller found null ptr deref in unix_bpf proto add
Michal Schmidt <mschmidt@redhat.com>
ice: fix theoretical out-of-bounds access in ethtool link modes
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: mesh_plink: fix matches_local logic
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: mesh: check element parsing succeeded
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: check defragmentation succeeded
Johannes Berg <johannes.berg@intel.com>
wifi: mac80211: don't re-add debugfs during reconfig
Edward Adam Davis <eadavis@qq.com>
wifi: mac80211: check if the existing link config remains unchanged
Johannes Berg <johannes.berg@intel.com>
wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock
Johannes Berg <johannes.berg@intel.com>
wifi: ieee80211: don't require protected vendor action frames
Chuck Lever <chuck.lever@oracle.com>
SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806
Rajvi Jingar <rajvi.jingar@linux.intel.com>
platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore()
Heiko Carstens <hca@linux.ibm.com>
s390/vx: fix save/restore of fpu kernel context
Geert Uytterhoeven <geert+renesas@glider.be>
reset: Fix crash when freeing non-existent optional resets
Kunwu Chan <chentao@kylinos.cn>
ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
Andrew Davis <afd@ti.com>
ARM: dts: dra7: Fix DRA7 L3 NoC node register size
Chukun Pan <amadeus@jmu.edu.cn>
arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3
Benjamin Bigler <benjamin@bigler.one>
spi: spi-imx: correctly configure burst length when using dma
Lingkai Dong <Lingkai.Dong@arm.com>
drm: Fix FD ownership check in drm_master_check_perm()
Tvrtko Ursulin <tvrtko.ursulin@intel.com>
drm: Update file owner during use
Jani Nikula <jani.nikula@intel.com>
drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915: Introduce crtc_state->enhanced_framing
Ville Syrjälä <ville.syrjala@linux.intel.com>
drm/i915: Fix FEC state dump
Hamza Mahfooz <hamza.mahfooz@amd.com>
drm/amd/display: fix hw rotated modes when PSR-SU is enabled
Boris Burkov <boris@bur.io>
btrfs: free qgroup pertrans reserve on transaction abort
Qu Wenruo <wqu@suse.com>
btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta()
Qu Wenruo <wqu@suse.com>
btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve()
SeongJae Park <sj@kernel.org>
mm/damon/core: make damon_start() waits until kdamond_fn() starts
SeongJae Park <sj@kernel.org>
mm/damon/core: use number of passed access sampling as a timer
Jiri Olsa <jolsa@kernel.org>
bpf: Fix prog_array_map_poke_run map poke update
-------------
Diffstat:
.../devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 +-
Makefile | 4 +-
arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 +
arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +-
arch/arm/mach-omap2/id.c | 5 +
.../dts/allwinner/sun50i-h616-orangepi-zero.dtsi | 3 -
.../dts/allwinner/sun50i-h616-orangepi-zero2.dts | 3 +
.../dts/allwinner/sun50i-h618-orangepi-zero3.dts | 2 +
arch/arm64/kvm/arm.c | 2 +-
arch/arm64/kvm/vgic/vgic-init.c | 47 +++++---
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +-
arch/arm64/kvm/vgic/vgic.h | 1 +
arch/s390/include/asm/fpu/api.h | 2 +-
arch/x86/kernel/alternative.c | 14 ++-
arch/x86/kernel/head_64.S | 16 +++
arch/x86/net/bpf_jit_comp.c | 46 +++++++
arch/x86/xen/Kconfig | 1 +
drivers/bluetooth/hci_vhci.c | 10 +-
drivers/bus/ti-sysc.c | 18 ++-
drivers/gpio/gpio-dwapb.c | 12 +-
drivers/gpio/gpiolib-cdev.c | 16 ++-
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +
drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 +
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 +-
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 +-
drivers/gpu/drm/drm_auth.c | 3 +-
drivers/gpu/drm/drm_debugfs.c | 10 +-
drivers/gpu/drm/drm_file.c | 40 +++++-
drivers/gpu/drm/drm_ioctl.c | 3 +
drivers/gpu/drm/i915/display/g4x_dp.c | 10 +-
drivers/gpu/drm/i915/display/intel_crt.c | 2 +
.../gpu/drm/i915/display/intel_crtc_state_dump.c | 3 +
drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 +-
drivers/gpu/drm/i915/display/intel_ddi.c | 22 ++--
drivers/gpu/drm/i915/display/intel_display.c | 12 ++
drivers/gpu/drm/i915/display/intel_display_types.h | 2 +
drivers/gpu/drm/i915/display/intel_dmc.c | 43 ++++++-
drivers/gpu/drm/i915/display/intel_dp.c | 3 +
.../gpu/drm/i915/display/intel_dp_link_training.c | 35 ++++--
drivers/gpu/drm/i915/i915_hwmon.c | 4 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +-
drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 6 +-
drivers/i2c/busses/i2c-aspeed.c | 48 +++++---
drivers/i2c/busses/i2c-qcom-geni.c | 8 +-
drivers/iio/accel/kionix-kx022a.c | 37 ++++--
drivers/iio/adc/imx93_adc.c | 4 +
drivers/iio/adc/meson_saradc.c | 16 ++-
drivers/iio/adc/ti_am335x_adc.c | 4 +-
drivers/iio/buffer/industrialio-triggered-buffer.c | 10 ++
drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 +-
drivers/iio/imu/adis16475.c | 117 +++++++++++-------
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +-
drivers/iio/magnetometer/tmag5273.c | 2 +-
drivers/input/keyboard/ipaq-micro-keys.c | 3 +
drivers/input/misc/soc_button_array.c | 5 +
drivers/interconnect/core.c | 3 +
drivers/interconnect/qcom/sm8250.c | 1 +
drivers/md/dm-integrity.c | 11 +-
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 +-
drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 +-
drivers/net/ethernet/intel/ice/ice_lag.c | 2 +
drivers/net/ethernet/intel/ice/ice_lib.c | 7 +-
.../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 17 ++-
drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 +
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +-
.../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
.../mellanox/mlx5/core/en/fs_tt_redirect.c | 1 +
.../ethernet/mellanox/mlx5/core/en/tc/act/mirred.c | 5 +-
.../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 30 ++---
.../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 3 +-
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +-
.../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +-
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 10 +-
drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +-
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 31 +++--
.../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 +-
drivers/net/ethernet/micrel/ks8851.h | 3 +
drivers/net/ethernet/micrel/ks8851_common.c | 20 +--
drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++++---
drivers/net/ethernet/microsoft/Kconfig | 1 +
drivers/net/ethernet/mscc/ocelot_stats.c | 16 +--
.../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +-
drivers/net/phy/phy_device.c | 6 +-
drivers/net/usb/ax88179_178a.c | 23 +++-
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 +-
drivers/net/wireless/mediatek/mt76/dma.c | 10 +-
drivers/nvme/host/core.c | 3 +-
drivers/nvmem/brcm_nvram.c | 134 +++++++++++++++------
drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++
drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 4 +-
drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 +-
drivers/platform/x86/intel/pmc/core.c | 2 +-
drivers/reset/core.c | 8 +-
drivers/scsi/aacraid/aacraid.h | 1 -
drivers/scsi/aacraid/commsup.c | 6 +-
drivers/scsi/aacraid/linit.c | 14 ---
drivers/scsi/aacraid/src.c | 25 +---
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +-
drivers/scsi/scsi_error.c | 2 +
drivers/spi/spi-atmel.c | 92 ++++++++++++--
drivers/spi/spi-cadence.c | 1 -
drivers/spi/spi-imx.c | 15 ++-
drivers/thunderbolt/debugfs.c | 2 +-
drivers/ufs/core/ufshcd.c | 3 +-
drivers/ufs/host/ufs-qcom.c | 6 +-
drivers/usb/fotg210/fotg210-hcd.c | 3 -
drivers/usb/serial/ftdi_sio.c | 6 +-
drivers/usb/serial/ftdi_sio_ids.h | 6 +-
drivers/usb/serial/option.c | 5 +
drivers/usb/storage/unusual_devs.h | 11 ++
drivers/usb/typec/ucsi/ucsi_glink.c | 2 +-
fs/afs/cell.c | 6 +-
fs/afs/dynroot.c | 31 ++---
fs/afs/internal.h | 2 +
fs/afs/volume.c | 26 +++-
fs/btrfs/disk-io.c | 28 +++++
fs/btrfs/qgroup.c | 96 +++++++--------
fs/btrfs/qgroup.h | 9 ++
fs/btrfs/transaction.c | 2 -
fs/btrfs/transaction.h | 3 +
fs/nfsd/nfsctl.c | 9 +-
fs/nfsd/nfsd.h | 1 +
fs/nfsd/nfssvc.c | 2 +-
fs/smb/client/cifs_debug.c | 12 +-
fs/smb/client/cifsglob.h | 3 +-
fs/smb/client/connect.c | 7 +-
fs/smb/client/misc.c | 4 +
fs/smb/client/smb2ops.c | 19 +--
fs/smb/client/smb2pdu.c | 29 +++--
include/drm/drm_file.h | 13 +-
include/linux/bpf.h | 3 +
include/linux/damon.h | 16 ++-
include/linux/ieee80211.h | 3 +-
include/linux/key-type.h | 1 +
include/net/bluetooth/hci_core.h | 9 +-
include/net/ip6_fib.h | 64 ++--------
include/net/sock.h | 5 +
include/trace/events/9p.h | 11 +-
kernel/bpf/arraymap.c | 58 ++-------
kernel/trace/ring_buffer.c | 130 ++++++--------------
kernel/trace/synth_event_gen_test.c | 11 ++
lib/vsprintf.c | 11 +-
mm/damon/core.c | 102 ++++++++--------
net/8021q/vlan_core.c | 9 +-
net/9p/protocol.c | 17 ++-
net/bluetooth/af_bluetooth.c | 7 +-
net/bluetooth/hci_event.c | 30 +++--
net/bluetooth/l2cap_core.c | 21 +++-
net/bluetooth/mgmt.c | 25 ++--
net/bluetooth/smp.c | 7 ++
net/core/dev.c | 3 +
net/core/skbuff.c | 2 +
net/core/sock_map.c | 2 +
net/core/stream.c | 2 +-
net/dns_resolver/dns_key.c | 10 +-
net/ife/ife.c | 1 +
net/ipv6/ip6_fib.c | 55 +--------
net/ipv6/route.c | 6 +-
net/mac80211/cfg.c | 4 +-
net/mac80211/driver-ops.c | 6 +-
net/mac80211/mesh_plink.c | 16 +--
net/mac80211/mlme.c | 4 +-
net/rfkill/rfkill-gpio.c | 8 ++
net/rose/af_rose.c | 39 +++++-
net/sunrpc/svc_xprt.c | 5 +-
net/wireless/certs/wens.hex | 87 +++++++++++++
security/keys/gc.c | 31 +++--
security/keys/internal.h | 11 +-
security/keys/key.c | 15 +--
security/keys/proc.c | 2 +-
sound/pci/hda/patch_realtek.c | 1 +
sound/pci/hda/tas2781_hda_i2c.c | 4 +
sound/soc/codecs/hdmi-codec.c | 12 +-
sound/soc/codecs/tas2781-fmwlib.c | 14 ++-
sound/soc/fsl/fsl_sai.c | 3 +
sound/usb/quirks.c | 4 +-
tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 +-
183 files changed, 1677 insertions(+), 907 deletions(-)
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 001/156] bpf: Fix prog_array_map_poke_run map poke update
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 002/156] mm/damon/core: use number of passed access sampling as a timer Greg Kroah-Hartman
` (163 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+97a4fe20470e9bc30810,
Jiri Olsa, Daniel Borkmann, Yonghong Song, Lee Jones,
Maciej Fijalkowski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 4b7de801606e504e69689df71475d27e35336fb3 upstream.
Lee pointed out issue found by syscaller [0] hitting BUG in prog array
map poke update in prog_array_map_poke_run function due to error value
returned from bpf_arch_text_poke function.
There's race window where bpf_arch_text_poke can fail due to missing
bpf program kallsym symbols, which is accounted for with check for
-EINVAL in that BUG_ON call.
The problem is that in such case we won't update the tail call jump
and cause imbalance for the next tail call update check which will
fail with -EBUSY in bpf_arch_text_poke.
I'm hitting following race during the program load:
CPU 0 CPU 1
bpf_prog_load
bpf_check
do_misc_fixups
prog_array_map_poke_track
map_update_elem
bpf_fd_array_map_update_elem
prog_array_map_poke_run
bpf_arch_text_poke returns -EINVAL
bpf_prog_kallsyms_add
After bpf_arch_text_poke (CPU 1) fails to update the tail call jump, the next
poke update fails on expected jump instruction check in bpf_arch_text_poke
with -EBUSY and triggers the BUG_ON in prog_array_map_poke_run.
Similar race exists on the program unload.
Fixing this by moving the update to bpf_arch_poke_desc_update function which
makes sure we call __bpf_arch_text_poke that skips the bpf address check.
Each architecture has slightly different approach wrt looking up bpf address
in bpf_arch_text_poke, so instead of splitting the function or adding new
'checkip' argument in previous version, it seems best to move the whole
map_poke_run update as arch specific code.
[0] https://syzkaller.appspot.com/bug?extid=97a4fe20470e9bc30810
Fixes: ebf7d1f508a7 ("bpf, x64: rework pro/epilogue and tailcall handling in JIT")
Reported-by: syzbot+97a4fe20470e9bc30810@syzkaller.appspotmail.com
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Cc: Lee Jones <lee@kernel.org>
Cc: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://lore.kernel.org/bpf/20231206083041.1306660-2-jolsa@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/net/bpf_jit_comp.c | 46 ++++++++++++++++++++++++++++++++++
include/linux/bpf.h | 3 ++
kernel/bpf/arraymap.c | 58 +++++++-------------------------------------
3 files changed, 59 insertions(+), 48 deletions(-)
--- a/arch/x86/net/bpf_jit_comp.c
+++ b/arch/x86/net/bpf_jit_comp.c
@@ -2929,3 +2929,49 @@ void bpf_jit_free(struct bpf_prog *prog)
bpf_prog_unlock_free(prog);
}
+
+void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke,
+ struct bpf_prog *new, struct bpf_prog *old)
+{
+ u8 *old_addr, *new_addr, *old_bypass_addr;
+ int ret;
+
+ old_bypass_addr = old ? NULL : poke->bypass_addr;
+ old_addr = old ? (u8 *)old->bpf_func + poke->adj_off : NULL;
+ new_addr = new ? (u8 *)new->bpf_func + poke->adj_off : NULL;
+
+ /*
+ * On program loading or teardown, the program's kallsym entry
+ * might not be in place, so we use __bpf_arch_text_poke to skip
+ * the kallsyms check.
+ */
+ if (new) {
+ ret = __bpf_arch_text_poke(poke->tailcall_target,
+ BPF_MOD_JUMP,
+ old_addr, new_addr);
+ BUG_ON(ret < 0);
+ if (!old) {
+ ret = __bpf_arch_text_poke(poke->tailcall_bypass,
+ BPF_MOD_JUMP,
+ poke->bypass_addr,
+ NULL);
+ BUG_ON(ret < 0);
+ }
+ } else {
+ ret = __bpf_arch_text_poke(poke->tailcall_bypass,
+ BPF_MOD_JUMP,
+ old_bypass_addr,
+ poke->bypass_addr);
+ BUG_ON(ret < 0);
+ /* let other CPUs finish the execution of program
+ * so that it will not possible to expose them
+ * to invalid nop, stack unwind, nop state
+ */
+ if (!ret)
+ synchronize_rcu();
+ ret = __bpf_arch_text_poke(poke->tailcall_target,
+ BPF_MOD_JUMP,
+ old_addr, NULL);
+ BUG_ON(ret < 0);
+ }
+}
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -3143,6 +3143,9 @@ enum bpf_text_poke_type {
int bpf_arch_text_poke(void *ip, enum bpf_text_poke_type t,
void *addr1, void *addr2);
+void bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke,
+ struct bpf_prog *new, struct bpf_prog *old);
+
void *bpf_arch_text_copy(void *dst, void *src, size_t len);
int bpf_arch_text_invalidate(void *dst, size_t len);
--- a/kernel/bpf/arraymap.c
+++ b/kernel/bpf/arraymap.c
@@ -1012,11 +1012,16 @@ static void prog_array_map_poke_untrack(
mutex_unlock(&aux->poke_mutex);
}
+void __weak bpf_arch_poke_desc_update(struct bpf_jit_poke_descriptor *poke,
+ struct bpf_prog *new, struct bpf_prog *old)
+{
+ WARN_ON_ONCE(1);
+}
+
static void prog_array_map_poke_run(struct bpf_map *map, u32 key,
struct bpf_prog *old,
struct bpf_prog *new)
{
- u8 *old_addr, *new_addr, *old_bypass_addr;
struct prog_poke_elem *elem;
struct bpf_array_aux *aux;
@@ -1025,7 +1030,7 @@ static void prog_array_map_poke_run(stru
list_for_each_entry(elem, &aux->poke_progs, list) {
struct bpf_jit_poke_descriptor *poke;
- int i, ret;
+ int i;
for (i = 0; i < elem->aux->size_poke_tab; i++) {
poke = &elem->aux->poke_tab[i];
@@ -1044,21 +1049,10 @@ static void prog_array_map_poke_run(stru
* activated, so tail call updates can arrive from here
* while JIT is still finishing its final fixup for
* non-activated poke entries.
- * 3) On program teardown, the program's kallsym entry gets
- * removed out of RCU callback, but we can only untrack
- * from sleepable context, therefore bpf_arch_text_poke()
- * might not see that this is in BPF text section and
- * bails out with -EINVAL. As these are unreachable since
- * RCU grace period already passed, we simply skip them.
- * 4) Also programs reaching refcount of zero while patching
+ * 3) Also programs reaching refcount of zero while patching
* is in progress is okay since we're protected under
* poke_mutex and untrack the programs before the JIT
- * buffer is freed. When we're still in the middle of
- * patching and suddenly kallsyms entry of the program
- * gets evicted, we just skip the rest which is fine due
- * to point 3).
- * 5) Any other error happening below from bpf_arch_text_poke()
- * is a unexpected bug.
+ * buffer is freed.
*/
if (!READ_ONCE(poke->tailcall_target_stable))
continue;
@@ -1068,39 +1062,7 @@ static void prog_array_map_poke_run(stru
poke->tail_call.key != key)
continue;
- old_bypass_addr = old ? NULL : poke->bypass_addr;
- old_addr = old ? (u8 *)old->bpf_func + poke->adj_off : NULL;
- new_addr = new ? (u8 *)new->bpf_func + poke->adj_off : NULL;
-
- if (new) {
- ret = bpf_arch_text_poke(poke->tailcall_target,
- BPF_MOD_JUMP,
- old_addr, new_addr);
- BUG_ON(ret < 0 && ret != -EINVAL);
- if (!old) {
- ret = bpf_arch_text_poke(poke->tailcall_bypass,
- BPF_MOD_JUMP,
- poke->bypass_addr,
- NULL);
- BUG_ON(ret < 0 && ret != -EINVAL);
- }
- } else {
- ret = bpf_arch_text_poke(poke->tailcall_bypass,
- BPF_MOD_JUMP,
- old_bypass_addr,
- poke->bypass_addr);
- BUG_ON(ret < 0 && ret != -EINVAL);
- /* let other CPUs finish the execution of program
- * so that it will not possible to expose them
- * to invalid nop, stack unwind, nop state
- */
- if (!ret)
- synchronize_rcu();
- ret = bpf_arch_text_poke(poke->tailcall_target,
- BPF_MOD_JUMP,
- old_addr, NULL);
- BUG_ON(ret < 0 && ret != -EINVAL);
- }
+ bpf_arch_poke_desc_update(poke, new, old);
}
}
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 002/156] mm/damon/core: use number of passed access sampling as a timer
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 001/156] bpf: Fix prog_array_map_poke_run map poke update Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 003/156] mm/damon/core: make damon_start() waits until kdamond_fn() starts Greg Kroah-Hartman
` (162 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, Andrew Morton,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
[ Upstream commit 4472edf63d6630e6cf65e205b4fc8c3c94d0afe5 ]
DAMON sleeps for sampling interval after each sampling, and check if the
aggregation interval and the ops update interval have passed using
ktime_get_coarse_ts64() and baseline timestamps for the intervals. That
design is for making the operations occur at deterministic timing
regardless of the time that spend for each work. However, it turned out
it is not that useful, and incur not-that-intuitive results.
After all, timer functions, and especially sleep functions that DAMON uses
to wait for specific timing, are not necessarily strictly accurate. It is
legal design, so no problem. However, depending on such inaccuracies, the
nr_accesses can be larger than aggregation interval divided by sampling
interval. For example, with the default setting (5 ms sampling interval
and 100 ms aggregation interval) we frequently show regions having
nr_accesses larger than 20. Also, if the execution of a DAMOS scheme
takes a long time, next aggregation could happen before enough number of
samples are collected. This is not what usual users would intuitively
expect.
Since access check sampling is the smallest unit work of DAMON, using the
number of passed sampling intervals as the DAMON-internal timer can easily
avoid these problems. That is, convert aggregation and ops update
intervals to numbers of sampling intervals that need to be passed before
those operations be executed, count the number of passed sampling
intervals, and invoke the operations as soon as the specific amount of
sampling intervals passed. Make the change.
Note that this could make a behavioral change to settings that using
intervals that not aligned by the sampling interval. For example, if the
sampling interval is 5 ms and the aggregation interval is 12 ms, DAMON
effectively uses 15 ms as its aggregation interval, because it checks
whether the aggregation interval after sleeping the sampling interval.
This change will make DAMON to effectively use 10 ms as aggregation
interval, since it uses 'aggregation interval / sampling interval *
sampling interval' as the effective aggregation interval, and we don't use
floating point types. Usual users would have used aligned intervals, so
this behavioral change is not expected to make any meaningful impact, so
just make this change.
Link: https://lkml.kernel.org/r/20230914021523.60649-1-sj@kernel.org
Signed-off-by: SeongJae Park <sj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Stable-dep-of: 6376a8245956 ("mm/damon/core: make damon_start() waits until kdamond_fn() starts")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/damon.h | 14 ++++++-
mm/damon/core.c | 96 +++++++++++++++++++++----------------------
2 files changed, 59 insertions(+), 51 deletions(-)
diff --git a/include/linux/damon.h b/include/linux/damon.h
index c70cca8a839f7..506118916378b 100644
--- a/include/linux/damon.h
+++ b/include/linux/damon.h
@@ -522,8 +522,18 @@ struct damon_ctx {
struct damon_attrs attrs;
/* private: internal use only */
- struct timespec64 last_aggregation;
- struct timespec64 last_ops_update;
+ /* number of sample intervals that passed since this context started */
+ unsigned long passed_sample_intervals;
+ /*
+ * number of sample intervals that should be passed before next
+ * aggregation
+ */
+ unsigned long next_aggregation_sis;
+ /*
+ * number of sample intervals that should be passed before next ops
+ * update
+ */
+ unsigned long next_ops_update_sis;
/* public: */
struct task_struct *kdamond;
diff --git a/mm/damon/core.c b/mm/damon/core.c
index fd5be73f699f4..30c93de59475f 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -427,8 +427,10 @@ struct damon_ctx *damon_new_ctx(void)
ctx->attrs.aggr_interval = 100 * 1000;
ctx->attrs.ops_update_interval = 60 * 1000 * 1000;
- ktime_get_coarse_ts64(&ctx->last_aggregation);
- ctx->last_ops_update = ctx->last_aggregation;
+ ctx->passed_sample_intervals = 0;
+ /* These will be set from kdamond_init_intervals_sis() */
+ ctx->next_aggregation_sis = 0;
+ ctx->next_ops_update_sis = 0;
mutex_init(&ctx->kdamond_lock);
@@ -542,6 +544,9 @@ static void damon_update_monitoring_results(struct damon_ctx *ctx,
*/
int damon_set_attrs(struct damon_ctx *ctx, struct damon_attrs *attrs)
{
+ unsigned long sample_interval = attrs->sample_interval ?
+ attrs->sample_interval : 1;
+
if (attrs->min_nr_regions < 3)
return -EINVAL;
if (attrs->min_nr_regions > attrs->max_nr_regions)
@@ -549,6 +554,11 @@ int damon_set_attrs(struct damon_ctx *ctx, struct damon_attrs *attrs)
if (attrs->sample_interval > attrs->aggr_interval)
return -EINVAL;
+ ctx->next_aggregation_sis = ctx->passed_sample_intervals +
+ attrs->aggr_interval / sample_interval;
+ ctx->next_ops_update_sis = ctx->passed_sample_intervals +
+ attrs->ops_update_interval / sample_interval;
+
damon_update_monitoring_results(ctx, attrs);
ctx->attrs = *attrs;
return 0;
@@ -722,38 +732,6 @@ int damon_stop(struct damon_ctx **ctxs, int nr_ctxs)
return err;
}
-/*
- * damon_check_reset_time_interval() - Check if a time interval is elapsed.
- * @baseline: the time to check whether the interval has elapsed since
- * @interval: the time interval (microseconds)
- *
- * See whether the given time interval has passed since the given baseline
- * time. If so, it also updates the baseline to current time for next check.
- *
- * Return: true if the time interval has passed, or false otherwise.
- */
-static bool damon_check_reset_time_interval(struct timespec64 *baseline,
- unsigned long interval)
-{
- struct timespec64 now;
-
- ktime_get_coarse_ts64(&now);
- if ((timespec64_to_ns(&now) - timespec64_to_ns(baseline)) <
- interval * 1000)
- return false;
- *baseline = now;
- return true;
-}
-
-/*
- * Check whether it is time to flush the aggregated information
- */
-static bool kdamond_aggregate_interval_passed(struct damon_ctx *ctx)
-{
- return damon_check_reset_time_interval(&ctx->last_aggregation,
- ctx->attrs.aggr_interval);
-}
-
/*
* Reset the aggregated monitoring results ('nr_accesses' of each region).
*/
@@ -1234,18 +1212,6 @@ static void kdamond_split_regions(struct damon_ctx *ctx)
last_nr_regions = nr_regions;
}
-/*
- * Check whether it is time to check and apply the operations-related data
- * structures.
- *
- * Returns true if it is.
- */
-static bool kdamond_need_update_operations(struct damon_ctx *ctx)
-{
- return damon_check_reset_time_interval(&ctx->last_ops_update,
- ctx->attrs.ops_update_interval);
-}
-
/*
* Check whether current monitoring should be stopped
*
@@ -1357,6 +1323,17 @@ static int kdamond_wait_activation(struct damon_ctx *ctx)
return -EBUSY;
}
+static void kdamond_init_intervals_sis(struct damon_ctx *ctx)
+{
+ unsigned long sample_interval = ctx->attrs.sample_interval ?
+ ctx->attrs.sample_interval : 1;
+
+ ctx->passed_sample_intervals = 0;
+ ctx->next_aggregation_sis = ctx->attrs.aggr_interval / sample_interval;
+ ctx->next_ops_update_sis = ctx->attrs.ops_update_interval /
+ sample_interval;
+}
+
/*
* The monitoring daemon that runs as a kernel thread
*/
@@ -1370,6 +1347,8 @@ static int kdamond_fn(void *data)
pr_debug("kdamond (%d) starts\n", current->pid);
+ kdamond_init_intervals_sis(ctx);
+
if (ctx->ops.init)
ctx->ops.init(ctx);
if (ctx->callback.before_start && ctx->callback.before_start(ctx))
@@ -1378,6 +1357,17 @@ static int kdamond_fn(void *data)
sz_limit = damon_region_sz_limit(ctx);
while (!kdamond_need_stop(ctx)) {
+ /*
+ * ctx->attrs and ctx->next_{aggregation,ops_update}_sis could
+ * be changed from after_wmarks_check() or after_aggregation()
+ * callbacks. Read the values here, and use those for this
+ * iteration. That is, damon_set_attrs() updated new values
+ * are respected from next iteration.
+ */
+ unsigned long next_aggregation_sis = ctx->next_aggregation_sis;
+ unsigned long next_ops_update_sis = ctx->next_ops_update_sis;
+ unsigned long sample_interval = ctx->attrs.sample_interval;
+
if (kdamond_wait_activation(ctx))
break;
@@ -1387,12 +1377,17 @@ static int kdamond_fn(void *data)
ctx->callback.after_sampling(ctx))
break;
- kdamond_usleep(ctx->attrs.sample_interval);
+ kdamond_usleep(sample_interval);
+ ctx->passed_sample_intervals++;
if (ctx->ops.check_accesses)
max_nr_accesses = ctx->ops.check_accesses(ctx);
- if (kdamond_aggregate_interval_passed(ctx)) {
+ sample_interval = ctx->attrs.sample_interval ?
+ ctx->attrs.sample_interval : 1;
+ if (ctx->passed_sample_intervals == next_aggregation_sis) {
+ ctx->next_aggregation_sis = next_aggregation_sis +
+ ctx->attrs.aggr_interval / sample_interval;
kdamond_merge_regions(ctx,
max_nr_accesses / 10,
sz_limit);
@@ -1407,7 +1402,10 @@ static int kdamond_fn(void *data)
ctx->ops.reset_aggregated(ctx);
}
- if (kdamond_need_update_operations(ctx)) {
+ if (ctx->passed_sample_intervals == next_ops_update_sis) {
+ ctx->next_ops_update_sis = next_ops_update_sis +
+ ctx->attrs.ops_update_interval /
+ sample_interval;
if (ctx->ops.update)
ctx->ops.update(ctx);
sz_limit = damon_region_sz_limit(ctx);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 003/156] mm/damon/core: make damon_start() waits until kdamond_fn() starts
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 001/156] bpf: Fix prog_array_map_poke_run map poke update Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 002/156] mm/damon/core: use number of passed access sampling as a timer Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 004/156] btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() Greg Kroah-Hartman
` (161 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, SeongJae Park, Jakub Acs,
Changbin Du, Andrew Morton, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: SeongJae Park <sj@kernel.org>
[ Upstream commit 6376a824595607e99d032a39ba3394988b4fce96 ]
The cleanup tasks of kdamond threads including reset of corresponding
DAMON context's ->kdamond field and decrease of global nr_running_ctxs
counter is supposed to be executed by kdamond_fn(). However, commit
0f91d13366a4 ("mm/damon: simplify stop mechanism") made neither
damon_start() nor damon_stop() ensure the corresponding kdamond has
started the execution of kdamond_fn().
As a result, the cleanup can be skipped if damon_stop() is called fast
enough after the previous damon_start(). Especially the skipped reset
of ->kdamond could cause a use-after-free.
Fix it by waiting for start of kdamond_fn() execution from
damon_start().
Link: https://lkml.kernel.org/r/20231208175018.63880-1-sj@kernel.org
Fixes: 0f91d13366a4 ("mm/damon: simplify stop mechanism")
Signed-off-by: SeongJae Park <sj@kernel.org>
Reported-by: Jakub Acs <acsjakub@amazon.de>
Cc: Changbin Du <changbin.du@intel.com>
Cc: Jakub Acs <acsjakub@amazon.de>
Cc: <stable@vger.kernel.org> # 5.15.x
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/damon.h | 2 ++
mm/damon/core.c | 6 ++++++
2 files changed, 8 insertions(+)
diff --git a/include/linux/damon.h b/include/linux/damon.h
index 506118916378b..a953d7083cd59 100644
--- a/include/linux/damon.h
+++ b/include/linux/damon.h
@@ -534,6 +534,8 @@ struct damon_ctx {
* update
*/
unsigned long next_ops_update_sis;
+ /* for waiting until the execution of the kdamond_fn is started */
+ struct completion kdamond_started;
/* public: */
struct task_struct *kdamond;
diff --git a/mm/damon/core.c b/mm/damon/core.c
index 30c93de59475f..aff611b6eafe1 100644
--- a/mm/damon/core.c
+++ b/mm/damon/core.c
@@ -423,6 +423,8 @@ struct damon_ctx *damon_new_ctx(void)
if (!ctx)
return NULL;
+ init_completion(&ctx->kdamond_started);
+
ctx->attrs.sample_interval = 5 * 1000;
ctx->attrs.aggr_interval = 100 * 1000;
ctx->attrs.ops_update_interval = 60 * 1000 * 1000;
@@ -636,11 +638,14 @@ static int __damon_start(struct damon_ctx *ctx)
mutex_lock(&ctx->kdamond_lock);
if (!ctx->kdamond) {
err = 0;
+ reinit_completion(&ctx->kdamond_started);
ctx->kdamond = kthread_run(kdamond_fn, ctx, "kdamond.%d",
nr_running_ctxs);
if (IS_ERR(ctx->kdamond)) {
err = PTR_ERR(ctx->kdamond);
ctx->kdamond = NULL;
+ } else {
+ wait_for_completion(&ctx->kdamond_started);
}
}
mutex_unlock(&ctx->kdamond_lock);
@@ -1347,6 +1352,7 @@ static int kdamond_fn(void *data)
pr_debug("kdamond (%d) starts\n", current->pid);
+ complete(&ctx->kdamond_started);
kdamond_init_intervals_sis(ctx);
if (ctx->ops.init)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 004/156] btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 003/156] mm/damon/core: make damon_start() waits until kdamond_fn() starts Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 005/156] btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() Greg Kroah-Hartman
` (160 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Qu Wenruo,
David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 686c4a5a42635e0d2889e3eb461c554fd0b616b4 ]
Qgroup heavily relies on ulist to go through all the involved
qgroups, but since we're using ulist inside fs_info->qgroup_lock
spinlock, this means we're doing a lot of GFP_ATOMIC allocations.
This patch reduces the GFP_ATOMIC usage for qgroup_reserve() by
eliminating the memory allocation completely.
This is done by moving the needed memory to btrfs_qgroup::iterator
list_head, so that we can put all the involved qgroup into a on-stack
list, thus eliminating the need to allocate memory while holding
spinlock.
The only cost is the slightly higher memory usage, but considering the
reduce GFP_ATOMIC during a hot path, it should still be acceptable.
Function qgroup_reserve() is the perfect start point for this
conversion.
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: b321a52cce06 ("btrfs: free qgroup pertrans reserve on transaction abort")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/qgroup.c | 61 ++++++++++++++++++++++-------------------------
fs/btrfs/qgroup.h | 9 +++++++
2 files changed, 38 insertions(+), 32 deletions(-)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 7c92494381549..32e5defe4eff4 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -208,6 +208,7 @@ static struct btrfs_qgroup *add_qgroup_rb(struct btrfs_fs_info *fs_info,
INIT_LIST_HEAD(&qgroup->groups);
INIT_LIST_HEAD(&qgroup->members);
INIT_LIST_HEAD(&qgroup->dirty);
+ INIT_LIST_HEAD(&qgroup->iterator);
rb_link_node(&qgroup->node, parent, p);
rb_insert_color(&qgroup->node, &fs_info->qgroup_tree);
@@ -1342,6 +1343,24 @@ static void qgroup_dirty(struct btrfs_fs_info *fs_info,
list_add(&qgroup->dirty, &fs_info->dirty_qgroups);
}
+static void qgroup_iterator_add(struct list_head *head, struct btrfs_qgroup *qgroup)
+{
+ if (!list_empty(&qgroup->iterator))
+ return;
+
+ list_add_tail(&qgroup->iterator, head);
+}
+
+static void qgroup_iterator_clean(struct list_head *head)
+{
+ while (!list_empty(head)) {
+ struct btrfs_qgroup *qgroup;
+
+ qgroup = list_first_entry(head, struct btrfs_qgroup, iterator);
+ list_del_init(&qgroup->iterator);
+ }
+}
+
/*
* The easy accounting, we're updating qgroup relationship whose child qgroup
* only has exclusive extents.
@@ -3125,8 +3144,7 @@ static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce,
struct btrfs_fs_info *fs_info = root->fs_info;
u64 ref_root = root->root_key.objectid;
int ret = 0;
- struct ulist_node *unode;
- struct ulist_iterator uiter;
+ LIST_HEAD(qgroup_list);
if (!is_fstree(ref_root))
return 0;
@@ -3146,49 +3164,28 @@ static int qgroup_reserve(struct btrfs_root *root, u64 num_bytes, bool enforce,
if (!qgroup)
goto out;
- /*
- * in a first step, we check all affected qgroups if any limits would
- * be exceeded
- */
- ulist_reinit(fs_info->qgroup_ulist);
- ret = ulist_add(fs_info->qgroup_ulist, qgroup->qgroupid,
- qgroup_to_aux(qgroup), GFP_ATOMIC);
- if (ret < 0)
- goto out;
- ULIST_ITER_INIT(&uiter);
- while ((unode = ulist_next(fs_info->qgroup_ulist, &uiter))) {
- struct btrfs_qgroup *qg;
+ qgroup_iterator_add(&qgroup_list, qgroup);
+ list_for_each_entry(qgroup, &qgroup_list, iterator) {
struct btrfs_qgroup_list *glist;
- qg = unode_aux_to_qgroup(unode);
-
- if (enforce && !qgroup_check_limits(qg, num_bytes)) {
+ if (enforce && !qgroup_check_limits(qgroup, num_bytes)) {
ret = -EDQUOT;
goto out;
}
- list_for_each_entry(glist, &qg->groups, next_group) {
- ret = ulist_add(fs_info->qgroup_ulist,
- glist->group->qgroupid,
- qgroup_to_aux(glist->group), GFP_ATOMIC);
- if (ret < 0)
- goto out;
- }
+ list_for_each_entry(glist, &qgroup->groups, next_group)
+ qgroup_iterator_add(&qgroup_list, glist->group);
}
+
ret = 0;
/*
* no limits exceeded, now record the reservation into all qgroups
*/
- ULIST_ITER_INIT(&uiter);
- while ((unode = ulist_next(fs_info->qgroup_ulist, &uiter))) {
- struct btrfs_qgroup *qg;
-
- qg = unode_aux_to_qgroup(unode);
-
- qgroup_rsv_add(fs_info, qg, num_bytes, type);
- }
+ list_for_each_entry(qgroup, &qgroup_list, iterator)
+ qgroup_rsv_add(fs_info, qgroup, num_bytes, type);
out:
+ qgroup_iterator_clean(&qgroup_list);
spin_unlock(&fs_info->qgroup_lock);
return ret;
}
diff --git a/fs/btrfs/qgroup.h b/fs/btrfs/qgroup.h
index 104c9bd3c3379..1203f06320991 100644
--- a/fs/btrfs/qgroup.h
+++ b/fs/btrfs/qgroup.h
@@ -220,6 +220,15 @@ struct btrfs_qgroup {
struct list_head groups; /* groups this group is member of */
struct list_head members; /* groups that are members of this group */
struct list_head dirty; /* dirty groups */
+
+ /*
+ * For qgroup iteration usage.
+ *
+ * The iteration list should always be empty until qgroup_iterator_add()
+ * is called. And should be reset to empty after the iteration is
+ * finished.
+ */
+ struct list_head iterator;
struct rb_node node; /* tree of qgroups */
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 005/156] btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 004/156] btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 006/156] btrfs: free qgroup pertrans reserve on transaction abort Greg Kroah-Hartman
` (159 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Boris Burkov, Qu Wenruo,
David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qu Wenruo <wqu@suse.com>
[ Upstream commit 0913445082496c2b29668ee26521401b273838b8 ]
With the new qgroup_iterator_add() and qgroup_iterator_clean(), we can
get rid of the ulist and its GFP_ATOMIC memory allocation.
Reviewed-by: Boris Burkov <boris@bur.io>
Signed-off-by: Qu Wenruo <wqu@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: b321a52cce06 ("btrfs: free qgroup pertrans reserve on transaction abort")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/qgroup.c | 32 ++++++++++----------------------
1 file changed, 10 insertions(+), 22 deletions(-)
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 32e5defe4eff4..0d2212fa0ce85 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -4106,9 +4106,7 @@ static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root,
int num_bytes)
{
struct btrfs_qgroup *qgroup;
- struct ulist_node *unode;
- struct ulist_iterator uiter;
- int ret = 0;
+ LIST_HEAD(qgroup_list);
if (num_bytes == 0)
return;
@@ -4119,31 +4117,21 @@ static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root,
qgroup = find_qgroup_rb(fs_info, ref_root);
if (!qgroup)
goto out;
- ulist_reinit(fs_info->qgroup_ulist);
- ret = ulist_add(fs_info->qgroup_ulist, qgroup->qgroupid,
- qgroup_to_aux(qgroup), GFP_ATOMIC);
- if (ret < 0)
- goto out;
- ULIST_ITER_INIT(&uiter);
- while ((unode = ulist_next(fs_info->qgroup_ulist, &uiter))) {
- struct btrfs_qgroup *qg;
- struct btrfs_qgroup_list *glist;
- qg = unode_aux_to_qgroup(unode);
+ qgroup_iterator_add(&qgroup_list, qgroup);
+ list_for_each_entry(qgroup, &qgroup_list, iterator) {
+ struct btrfs_qgroup_list *glist;
- qgroup_rsv_release(fs_info, qg, num_bytes,
+ qgroup_rsv_release(fs_info, qgroup, num_bytes,
BTRFS_QGROUP_RSV_META_PREALLOC);
- qgroup_rsv_add(fs_info, qg, num_bytes,
+ qgroup_rsv_add(fs_info, qgroup, num_bytes,
BTRFS_QGROUP_RSV_META_PERTRANS);
- list_for_each_entry(glist, &qg->groups, next_group) {
- ret = ulist_add(fs_info->qgroup_ulist,
- glist->group->qgroupid,
- qgroup_to_aux(glist->group), GFP_ATOMIC);
- if (ret < 0)
- goto out;
- }
+
+ list_for_each_entry(glist, &qgroup->groups, next_group)
+ qgroup_iterator_add(&qgroup_list, glist->group);
}
out:
+ qgroup_iterator_clean(&qgroup_list);
spin_unlock(&fs_info->qgroup_lock);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 006/156] btrfs: free qgroup pertrans reserve on transaction abort
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 005/156] btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 007/156] drm/amd/display: fix hw rotated modes when PSR-SU is enabled Greg Kroah-Hartman
` (158 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qu Wenruo, Boris Burkov,
David Sterba, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Burkov <boris@bur.io>
[ Upstream commit b321a52cce062ec7ed385333a33905d22159ce36 ]
If we abort a transaction, we never run the code that frees the pertrans
qgroup reservation. This results in warnings on unmount as that
reservation has been leaked. The leak isn't a huge issue since the fs is
read-only, but it's better to clean it up when we know we can/should. Do
it during the cleanup_transaction step of aborting.
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Boris Burkov <boris@bur.io>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/disk-io.c | 28 ++++++++++++++++++++++++++++
fs/btrfs/qgroup.c | 5 +++--
fs/btrfs/transaction.c | 2 --
fs/btrfs/transaction.h | 3 +++
4 files changed, 34 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 71efb6883f307..b79781df70714 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -4836,6 +4836,32 @@ void btrfs_cleanup_dirty_bgs(struct btrfs_transaction *cur_trans,
}
}
+static void btrfs_free_all_qgroup_pertrans(struct btrfs_fs_info *fs_info)
+{
+ struct btrfs_root *gang[8];
+ int i;
+ int ret;
+
+ spin_lock(&fs_info->fs_roots_radix_lock);
+ while (1) {
+ ret = radix_tree_gang_lookup_tag(&fs_info->fs_roots_radix,
+ (void **)gang, 0,
+ ARRAY_SIZE(gang),
+ BTRFS_ROOT_TRANS_TAG);
+ if (ret == 0)
+ break;
+ for (i = 0; i < ret; i++) {
+ struct btrfs_root *root = gang[i];
+
+ btrfs_qgroup_free_meta_all_pertrans(root);
+ radix_tree_tag_clear(&fs_info->fs_roots_radix,
+ (unsigned long)root->root_key.objectid,
+ BTRFS_ROOT_TRANS_TAG);
+ }
+ }
+ spin_unlock(&fs_info->fs_roots_radix_lock);
+}
+
void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
struct btrfs_fs_info *fs_info)
{
@@ -4864,6 +4890,8 @@ void btrfs_cleanup_one_transaction(struct btrfs_transaction *cur_trans,
EXTENT_DIRTY);
btrfs_destroy_pinned_extent(fs_info, &cur_trans->pinned_extents);
+ btrfs_free_all_qgroup_pertrans(fs_info);
+
cur_trans->state =TRANS_STATE_COMPLETED;
wake_up(&cur_trans->commit_wait);
}
diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c
index 0d2212fa0ce85..a006f5160e6b4 100644
--- a/fs/btrfs/qgroup.c
+++ b/fs/btrfs/qgroup.c
@@ -4124,8 +4124,9 @@ static void qgroup_convert_meta(struct btrfs_fs_info *fs_info, u64 ref_root,
qgroup_rsv_release(fs_info, qgroup, num_bytes,
BTRFS_QGROUP_RSV_META_PREALLOC);
- qgroup_rsv_add(fs_info, qgroup, num_bytes,
- BTRFS_QGROUP_RSV_META_PERTRANS);
+ if (!sb_rdonly(fs_info->sb))
+ qgroup_rsv_add(fs_info, qgroup, num_bytes,
+ BTRFS_QGROUP_RSV_META_PERTRANS);
list_for_each_entry(glist, &qgroup->groups, next_group)
qgroup_iterator_add(&qgroup_list, glist->group);
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index c780d37294636..0ac2d191cd34f 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -37,8 +37,6 @@
static struct kmem_cache *btrfs_trans_handle_cachep;
-#define BTRFS_ROOT_TRANS_TAG 0
-
/*
* Transaction states and transitions
*
diff --git a/fs/btrfs/transaction.h b/fs/btrfs/transaction.h
index 93869cda6af99..238a0ab85df9b 100644
--- a/fs/btrfs/transaction.h
+++ b/fs/btrfs/transaction.h
@@ -12,6 +12,9 @@
#include "ctree.h"
#include "misc.h"
+/* Radix-tree tag for roots that are part of the trasaction. */
+#define BTRFS_ROOT_TRANS_TAG 0
+
enum btrfs_trans_state {
TRANS_STATE_RUNNING,
TRANS_STATE_COMMIT_PREP,
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 007/156] drm/amd/display: fix hw rotated modes when PSR-SU is enabled
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 006/156] btrfs: free qgroup pertrans reserve on transaction abort Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 008/156] drm/i915: Fix FEC state dump Greg Kroah-Hartman
` (157 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kai-Heng Feng, Bin Li,
Mario Limonciello, Hamza Mahfooz, Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hamza Mahfooz <hamza.mahfooz@amd.com>
[ Upstream commit f528ee145bd0076cd0ed7e7b2d435893e6329e98 ]
We currently don't support dirty rectangles on hardware rotated modes.
So, if a user is using hardware rotated modes with PSR-SU enabled,
use PSR-SU FFU for all rotated planes (including cursor planes).
Cc: stable@vger.kernel.org
Fixes: 30ebe41582d1 ("drm/amd/display: add FB_DAMAGE_CLIPS support")
Reported-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/2952
Tested-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Tested-by: Bin Li <binli@gnome.org>
Reviewed-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +++
drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 +
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 ++-
drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 ++++++++++--
4 files changed, 16 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
index f5fdb61c821d0..d63360127834b 100644
--- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
+++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c
@@ -5170,6 +5170,9 @@ static void fill_dc_dirty_rects(struct drm_plane *plane,
if (plane->type == DRM_PLANE_TYPE_CURSOR)
return;
+ if (new_plane_state->rotation != DRM_MODE_ROTATE_0)
+ goto ffu;
+
num_clips = drm_plane_get_damage_clips_count(new_plane_state);
clips = drm_plane_get_damage_clips(new_plane_state);
diff --git a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h
index 100d62162b717..99880b08cda0c 100644
--- a/drivers/gpu/drm/amd/display/dc/dc_hw_types.h
+++ b/drivers/gpu/drm/amd/display/dc/dc_hw_types.h
@@ -465,6 +465,7 @@ struct dc_cursor_mi_param {
struct fixed31_32 v_scale_ratio;
enum dc_rotation_angle rotation;
bool mirror;
+ struct dc_stream_state *stream;
};
/* IPP related types */
diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
index 79befa17bb037..13ccb57379c7a 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c
@@ -3407,7 +3407,8 @@ void dcn10_set_cursor_position(struct pipe_ctx *pipe_ctx)
.h_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.horz,
.v_scale_ratio = pipe_ctx->plane_res.scl_data.ratios.vert,
.rotation = pipe_ctx->plane_state->rotation,
- .mirror = pipe_ctx->plane_state->horizontal_mirror
+ .mirror = pipe_ctx->plane_state->horizontal_mirror,
+ .stream = pipe_ctx->stream,
};
bool pipe_split_on = false;
bool odm_combine_on = (pipe_ctx->next_odm_pipe != NULL) ||
diff --git a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
index 4566bc7abf17e..aa252dc263267 100644
--- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
+++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c
@@ -1075,8 +1075,16 @@ void hubp2_cursor_set_position(
if (src_y_offset < 0)
src_y_offset = 0;
/* Save necessary cursor info x, y position. w, h is saved in attribute func. */
- hubp->cur_rect.x = src_x_offset + param->viewport.x;
- hubp->cur_rect.y = src_y_offset + param->viewport.y;
+ if (param->stream->link->psr_settings.psr_version >= DC_PSR_VERSION_SU_1 &&
+ param->rotation != ROTATION_ANGLE_0) {
+ hubp->cur_rect.x = 0;
+ hubp->cur_rect.y = 0;
+ hubp->cur_rect.w = param->stream->timing.h_addressable;
+ hubp->cur_rect.h = param->stream->timing.v_addressable;
+ } else {
+ hubp->cur_rect.x = src_x_offset + param->viewport.x;
+ hubp->cur_rect.y = src_y_offset + param->viewport.y;
+ }
}
void hubp2_clk_cntl(struct hubp *hubp, bool enable)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 008/156] drm/i915: Fix FEC state dump
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 007/156] drm/amd/display: fix hw rotated modes when PSR-SU is enabled Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 009/156] drm/i915: Introduce crtc_state->enhanced_framing Greg Kroah-Hartman
` (156 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Luca Coelho,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
[ Upstream commit 3dfeb80b308882cc6e1f5f6c36fd9a7f4cae5fc6 ]
Stop dumping state while reading it out. We have a proper
place for that stuff.
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230502143906.2401-7-ville.syrjala@linux.intel.com
Reviewed-by: Luca Coelho <luciano.coelho@intel.com>
Stable-dep-of: e6861d8264cd ("drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../gpu/drm/i915/display/intel_crtc_state_dump.c | 2 ++
drivers/gpu/drm/i915/display/intel_ddi.c | 13 +++----------
2 files changed, 5 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c
index 8d4640d0fd346..8b34fa55fa1bd 100644
--- a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c
+++ b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c
@@ -258,6 +258,8 @@ void intel_crtc_state_dump(const struct intel_crtc_state *pipe_config,
intel_dump_m_n_config(pipe_config, "dp m2_n2",
pipe_config->lane_count,
&pipe_config->dp_m2_n2);
+ drm_dbg_kms(&i915->drm, "fec: %s\n",
+ str_enabled_disabled(pipe_config->fec_enable));
}
drm_dbg_kms(&i915->drm, "framestart delay: %d, MSA timing delay: %d\n",
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index 84bbf854337aa..85e2263e688de 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -3724,17 +3724,10 @@ static void intel_ddi_read_func_ctl(struct intel_encoder *encoder,
intel_cpu_transcoder_get_m2_n2(crtc, cpu_transcoder,
&pipe_config->dp_m2_n2);
- if (DISPLAY_VER(dev_priv) >= 11) {
- i915_reg_t dp_tp_ctl = dp_tp_ctl_reg(encoder, pipe_config);
-
+ if (DISPLAY_VER(dev_priv) >= 11)
pipe_config->fec_enable =
- intel_de_read(dev_priv, dp_tp_ctl) & DP_TP_CTL_FEC_ENABLE;
-
- drm_dbg_kms(&dev_priv->drm,
- "[ENCODER:%d:%s] Fec status: %u\n",
- encoder->base.base.id, encoder->base.name,
- pipe_config->fec_enable);
- }
+ intel_de_read(dev_priv,
+ dp_tp_ctl_reg(encoder, pipe_config)) & DP_TP_CTL_FEC_ENABLE;
if (dig_port->lspcon.active && intel_dp_has_hdmi_sink(&dig_port->dp))
pipe_config->infoframes.enable |=
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 009/156] drm/i915: Introduce crtc_state->enhanced_framing
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 008/156] drm/i915: Fix FEC state dump Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 010/156] drm/i915/edp: dont write to DP_LINK_BW_SET when using rate select Greg Kroah-Hartman
` (155 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Luca Coelho,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
[ Upstream commit 3072a24c778a7102d70692af5556e47363114c67 ]
Track DP enhanced framing properly in the crtc state instead
of relying just on the cached DPCD everywhere, and hook it
up into the state check and dump.
v2: Actually set enhanced_framing in .compute_config()
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230503113659.16305-1-ville.syrjala@linux.intel.com
Reviewed-by: Luca Coelho <luciano.coelho@intel.com>
Stable-dep-of: e6861d8264cd ("drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/g4x_dp.c | 10 ++++++++--
drivers/gpu/drm/i915/display/intel_crt.c | 2 ++
drivers/gpu/drm/i915/display/intel_crtc_state_dump.c | 5 +++--
drivers/gpu/drm/i915/display/intel_ddi.c | 11 +++++++++--
drivers/gpu/drm/i915/display/intel_display.c | 1 +
drivers/gpu/drm/i915/display/intel_display_types.h | 2 ++
drivers/gpu/drm/i915/display/intel_dp.c | 3 +++
drivers/gpu/drm/i915/display/intel_dp_link_training.c | 2 +-
8 files changed, 29 insertions(+), 7 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/g4x_dp.c b/drivers/gpu/drm/i915/display/g4x_dp.c
index 4c7187f7913ea..e8ee0a08947e8 100644
--- a/drivers/gpu/drm/i915/display/g4x_dp.c
+++ b/drivers/gpu/drm/i915/display/g4x_dp.c
@@ -141,7 +141,7 @@ static void intel_dp_prepare(struct intel_encoder *encoder,
intel_de_rmw(dev_priv, TRANS_DP_CTL(crtc->pipe),
TRANS_DP_ENH_FRAMING,
- drm_dp_enhanced_frame_cap(intel_dp->dpcd) ?
+ pipe_config->enhanced_framing ?
TRANS_DP_ENH_FRAMING : 0);
} else {
if (IS_G4X(dev_priv) && pipe_config->limited_color_range)
@@ -153,7 +153,7 @@ static void intel_dp_prepare(struct intel_encoder *encoder,
intel_dp->DP |= DP_SYNC_VS_HIGH;
intel_dp->DP |= DP_LINK_TRAIN_OFF;
- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd))
+ if (pipe_config->enhanced_framing)
intel_dp->DP |= DP_ENHANCED_FRAMING;
if (IS_CHERRYVIEW(dev_priv))
@@ -351,6 +351,9 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
u32 trans_dp = intel_de_read(dev_priv,
TRANS_DP_CTL(crtc->pipe));
+ if (trans_dp & TRANS_DP_ENH_FRAMING)
+ pipe_config->enhanced_framing = true;
+
if (trans_dp & TRANS_DP_HSYNC_ACTIVE_HIGH)
flags |= DRM_MODE_FLAG_PHSYNC;
else
@@ -361,6 +364,9 @@ static void intel_dp_get_config(struct intel_encoder *encoder,
else
flags |= DRM_MODE_FLAG_NVSYNC;
} else {
+ if (tmp & DP_ENHANCED_FRAMING)
+ pipe_config->enhanced_framing = true;
+
if (tmp & DP_SYNC_HS_HIGH)
flags |= DRM_MODE_FLAG_PHSYNC;
else
diff --git a/drivers/gpu/drm/i915/display/intel_crt.c b/drivers/gpu/drm/i915/display/intel_crt.c
index d23020eb87f46..4352f90177615 100644
--- a/drivers/gpu/drm/i915/display/intel_crt.c
+++ b/drivers/gpu/drm/i915/display/intel_crt.c
@@ -456,6 +456,8 @@ static int hsw_crt_compute_config(struct intel_encoder *encoder,
/* FDI must always be 2.7 GHz */
pipe_config->port_clock = 135000 * 2;
+ pipe_config->enhanced_framing = true;
+
adjusted_mode->crtc_clock = lpt_iclkip(pipe_config);
return 0;
diff --git a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c
index 8b34fa55fa1bd..66fe880af8f3f 100644
--- a/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c
+++ b/drivers/gpu/drm/i915/display/intel_crtc_state_dump.c
@@ -258,8 +258,9 @@ void intel_crtc_state_dump(const struct intel_crtc_state *pipe_config,
intel_dump_m_n_config(pipe_config, "dp m2_n2",
pipe_config->lane_count,
&pipe_config->dp_m2_n2);
- drm_dbg_kms(&i915->drm, "fec: %s\n",
- str_enabled_disabled(pipe_config->fec_enable));
+ drm_dbg_kms(&i915->drm, "fec: %s, enhanced framing: %s\n",
+ str_enabled_disabled(pipe_config->fec_enable),
+ str_enabled_disabled(pipe_config->enhanced_framing));
}
drm_dbg_kms(&i915->drm, "framestart delay: %d, MSA timing delay: %d\n",
diff --git a/drivers/gpu/drm/i915/display/intel_ddi.c b/drivers/gpu/drm/i915/display/intel_ddi.c
index 85e2263e688de..c7e00f57cb7ab 100644
--- a/drivers/gpu/drm/i915/display/intel_ddi.c
+++ b/drivers/gpu/drm/i915/display/intel_ddi.c
@@ -3432,7 +3432,7 @@ static void mtl_ddi_prepare_link_retrain(struct intel_dp *intel_dp,
dp_tp_ctl |= DP_TP_CTL_MODE_MST;
} else {
dp_tp_ctl |= DP_TP_CTL_MODE_SST;
- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd))
+ if (crtc_state->enhanced_framing)
dp_tp_ctl |= DP_TP_CTL_ENHANCED_FRAME_ENABLE;
}
intel_de_write(dev_priv, dp_tp_ctl_reg(encoder, crtc_state), dp_tp_ctl);
@@ -3489,7 +3489,7 @@ static void intel_ddi_prepare_link_retrain(struct intel_dp *intel_dp,
dp_tp_ctl |= DP_TP_CTL_MODE_MST;
} else {
dp_tp_ctl |= DP_TP_CTL_MODE_SST;
- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd))
+ if (crtc_state->enhanced_framing)
dp_tp_ctl |= DP_TP_CTL_ENHANCED_FRAME_ENABLE;
}
intel_de_write(dev_priv, dp_tp_ctl_reg(encoder, crtc_state), dp_tp_ctl);
@@ -3724,6 +3724,10 @@ static void intel_ddi_read_func_ctl(struct intel_encoder *encoder,
intel_cpu_transcoder_get_m2_n2(crtc, cpu_transcoder,
&pipe_config->dp_m2_n2);
+ pipe_config->enhanced_framing =
+ intel_de_read(dev_priv, dp_tp_ctl_reg(encoder, pipe_config)) &
+ DP_TP_CTL_ENHANCED_FRAME_ENABLE;
+
if (DISPLAY_VER(dev_priv) >= 11)
pipe_config->fec_enable =
intel_de_read(dev_priv,
@@ -3740,6 +3744,9 @@ static void intel_ddi_read_func_ctl(struct intel_encoder *encoder,
if (!HAS_DP20(dev_priv)) {
/* FDI */
pipe_config->output_types |= BIT(INTEL_OUTPUT_ANALOG);
+ pipe_config->enhanced_framing =
+ intel_de_read(dev_priv, dp_tp_ctl_reg(encoder, pipe_config)) &
+ DP_TP_CTL_ENHANCED_FRAME_ENABLE;
break;
}
fallthrough; /* 128b/132b */
diff --git a/drivers/gpu/drm/i915/display/intel_display.c b/drivers/gpu/drm/i915/display/intel_display.c
index 1e2b09ae09b9c..2d9d96ecbb251 100644
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -5255,6 +5255,7 @@ intel_pipe_config_compare(const struct intel_crtc_state *current_config,
PIPE_CONF_CHECK_BOOL(hdmi_scrambling);
PIPE_CONF_CHECK_BOOL(hdmi_high_tmds_clock_ratio);
PIPE_CONF_CHECK_BOOL(has_infoframe);
+ PIPE_CONF_CHECK_BOOL(enhanced_framing);
PIPE_CONF_CHECK_BOOL(fec_enable);
PIPE_CONF_CHECK_BOOL_INCOMPLETE(has_audio);
diff --git a/drivers/gpu/drm/i915/display/intel_display_types.h b/drivers/gpu/drm/i915/display/intel_display_types.h
index 731f2ec04d5cd..7fc92b1474cc4 100644
--- a/drivers/gpu/drm/i915/display/intel_display_types.h
+++ b/drivers/gpu/drm/i915/display/intel_display_types.h
@@ -1362,6 +1362,8 @@ struct intel_crtc_state {
u16 linetime;
u16 ips_linetime;
+ bool enhanced_framing;
+
/* Forward Error correction State */
bool fec_enable;
diff --git a/drivers/gpu/drm/i915/display/intel_dp.c b/drivers/gpu/drm/i915/display/intel_dp.c
index 66e35f8443e1a..b4fb7ce39d06f 100644
--- a/drivers/gpu/drm/i915/display/intel_dp.c
+++ b/drivers/gpu/drm/i915/display/intel_dp.c
@@ -2312,6 +2312,9 @@ intel_dp_compute_config(struct intel_encoder *encoder,
pipe_config->limited_color_range =
intel_dp_limited_color_range(pipe_config, conn_state);
+ pipe_config->enhanced_framing =
+ drm_dp_enhanced_frame_cap(intel_dp->dpcd);
+
if (pipe_config->dsc.compression_enable)
output_bpp = pipe_config->dsc.compressed_bpp;
else
diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_training.c b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
index a263773f4d68a..d09e43a38fa61 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
@@ -655,7 +655,7 @@ intel_dp_update_link_bw_set(struct intel_dp *intel_dp,
/* Write the link configuration data */
link_config[0] = link_bw;
link_config[1] = crtc_state->lane_count;
- if (drm_dp_enhanced_frame_cap(intel_dp->dpcd))
+ if (crtc_state->enhanced_framing)
link_config[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config, 2);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 010/156] drm/i915/edp: dont write to DP_LINK_BW_SET when using rate select
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 009/156] drm/i915: Introduce crtc_state->enhanced_framing Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 011/156] drm: Update file owner during use Greg Kroah-Hartman
` (154 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Animesh Manna, Uma Shankar,
Ville Syrjälä, Jani Nikula, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
[ Upstream commit e6861d8264cd43c5eb20196e53df36fd71ec5698 ]
The eDP 1.5 spec adds a clarification for eDP 1.4x:
> For eDP v1.4x, if the Source device chooses the Main-Link rate by way
> of DPCD 00100h, the Sink device shall ignore DPCD 00115h[2:0].
We write 0 to DP_LINK_BW_SET (DPCD 100h) even when using
DP_LINK_RATE_SET (DPCD 114h). Stop doing that, as it can cause the panel
to ignore the rate set method.
Moreover, 0 is a reserved value for DP_LINK_BW_SET, and should not be
used.
v2: Improve the comments (Ville)
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9081
Tested-by: Animesh Manna <animesh.manna@intel.com>
Reviewed-by: Uma Shankar <uma.shankar@intel.com>
Cc: Ville Syrjälä <ville.syrjala@linux.intel.com>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231205180551.2476228-1-jani.nikula@intel.com
(cherry picked from commit 23b392b94acb0499f69706c5808c099f590ebcf4)
Cc: stable@vger.kernel.org
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../drm/i915/display/intel_dp_link_training.c | 31 +++++++++++++------
1 file changed, 21 insertions(+), 10 deletions(-)
diff --git a/drivers/gpu/drm/i915/display/intel_dp_link_training.c b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
index d09e43a38fa61..a62bca622b0a1 100644
--- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c
+++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c
@@ -650,19 +650,30 @@ intel_dp_update_link_bw_set(struct intel_dp *intel_dp,
const struct intel_crtc_state *crtc_state,
u8 link_bw, u8 rate_select)
{
- u8 link_config[2];
+ u8 lane_count = crtc_state->lane_count;
- /* Write the link configuration data */
- link_config[0] = link_bw;
- link_config[1] = crtc_state->lane_count;
if (crtc_state->enhanced_framing)
- link_config[1] |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
- drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config, 2);
+ lane_count |= DP_LANE_COUNT_ENHANCED_FRAME_EN;
+
+ if (link_bw) {
+ /* DP and eDP v1.3 and earlier link bw set method. */
+ u8 link_config[] = { link_bw, lane_count };
- /* eDP 1.4 rate select method. */
- if (!link_bw)
- drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_RATE_SET,
- &rate_select, 1);
+ drm_dp_dpcd_write(&intel_dp->aux, DP_LINK_BW_SET, link_config,
+ ARRAY_SIZE(link_config));
+ } else {
+ /*
+ * eDP v1.4 and later link rate set method.
+ *
+ * eDP v1.4x sinks shall ignore DP_LINK_RATE_SET if
+ * DP_LINK_BW_SET is set. Avoid writing DP_LINK_BW_SET.
+ *
+ * eDP v1.5 sinks allow choosing either, and the last choice
+ * shall be active.
+ */
+ drm_dp_dpcd_writeb(&intel_dp->aux, DP_LANE_COUNT_SET, lane_count);
+ drm_dp_dpcd_writeb(&intel_dp->aux, DP_LINK_RATE_SET, rate_select);
+ }
}
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 011/156] drm: Update file owner during use
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 010/156] drm/i915/edp: dont write to DP_LINK_BW_SET when using rate select Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 012/156] drm: Fix FD ownership check in drm_master_check_perm() Greg Kroah-Hartman
` (153 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tvrtko Ursulin, Christian König,
Daniel Vetter, Emil Velikov, Rob Clark, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
[ Upstream commit 1c7a387ffef894b1ab3942f0482dac7a6e0a909c ]
With the typical model where the display server opens the file descriptor
and then hands it over to the client(*), we were showing stale data in
debugfs.
Fix it by updating the drm_file->pid on ioctl access from a different
process.
The field is also made RCU protected to allow for lockless readers. Update
side is protected with dev->filelist_mutex.
Before:
$ cat /sys/kernel/debug/dri/0/clients
command pid dev master a uid magic
Xorg 2344 0 y y 0 0
Xorg 2344 0 n y 0 2
Xorg 2344 0 n y 0 3
Xorg 2344 0 n y 0 4
After:
$ cat /sys/kernel/debug/dri/0/clients
command tgid dev master a uid magic
Xorg 830 0 y y 0 0
xfce4-session 880 0 n y 0 1
xfwm4 943 0 n y 0 2
neverball 1095 0 n y 0 3
*)
More detailed and historically accurate description of various handover
implementation kindly provided by Emil Velikov:
"""
The traditional model, the server was the orchestrator managing the
primary device node. From the fd, to the master status and
authentication. But looking at the fd alone, this has varied across
the years.
IIRC in the DRI1 days, Xorg (libdrm really) would have a list of open
fd(s) and reuse those whenever needed, DRI2 the client was responsible
for open() themselves and with DRI3 the fd was passed to the client.
Around the inception of DRI3 and systemd-logind, the latter became
another possible orchestrator. Whereby Xorg and Wayland compositors
could ask it for the fd. For various reasons (hysterical and genuine
ones) Xorg has a fallback path going the open(), whereas Wayland
compositors are moving to solely relying on logind... some never had
fallback even.
Over the past few years, more projects have emerged which provide
functionality similar (be that on API level, Dbus, or otherwise) to
systemd-logind.
"""
v2:
* Fixed typo in commit text and added a fine historical explanation
from Emil.
Signed-off-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: "Christian König" <christian.koenig@amd.com>
Cc: Daniel Vetter <daniel@ffwll.ch>
Acked-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Reviewed-by: Rob Clark <robdclark@gmail.com>
Tested-by: Rob Clark <robdclark@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230621094824.2348732-1-tvrtko.ursulin@linux.intel.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Stable-dep-of: 5a6c9a05e55c ("drm: Fix FD ownership check in drm_master_check_perm()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 ++--
drivers/gpu/drm/drm_auth.c | 3 +-
drivers/gpu/drm/drm_debugfs.c | 10 ++++---
drivers/gpu/drm/drm_file.c | 40 +++++++++++++++++++++++--
drivers/gpu/drm/drm_ioctl.c | 3 ++
drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +++-
drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 6 ++--
include/drm/drm_file.h | 13 ++++++--
8 files changed, 71 insertions(+), 15 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
index ca4d2d430e28c..a1b15d0d6c489 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c
@@ -962,6 +962,7 @@ static int amdgpu_debugfs_gem_info_show(struct seq_file *m, void *unused)
list_for_each_entry(file, &dev->filelist, lhead) {
struct task_struct *task;
struct drm_gem_object *gobj;
+ struct pid *pid;
int id;
/*
@@ -971,8 +972,9 @@ static int amdgpu_debugfs_gem_info_show(struct seq_file *m, void *unused)
* Therefore, we need to protect this ->comm access using RCU.
*/
rcu_read_lock();
- task = pid_task(file->pid, PIDTYPE_TGID);
- seq_printf(m, "pid %8d command %s:\n", pid_nr(file->pid),
+ pid = rcu_dereference(file->pid);
+ task = pid_task(pid, PIDTYPE_TGID);
+ seq_printf(m, "pid %8d command %s:\n", pid_nr(pid),
task ? task->comm : "<unknown>");
rcu_read_unlock();
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index cf92a9ae8034c..2ed2585ded378 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -235,7 +235,8 @@ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
static int
drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv)
{
- if (file_priv->pid == task_pid(current) && file_priv->was_master)
+ if (file_priv->was_master &&
+ rcu_access_pointer(file_priv->pid) == task_pid(current))
return 0;
if (!capable(CAP_SYS_ADMIN))
diff --git a/drivers/gpu/drm/drm_debugfs.c b/drivers/gpu/drm/drm_debugfs.c
index 2de43ff3ce0a4..41b0682c638ef 100644
--- a/drivers/gpu/drm/drm_debugfs.c
+++ b/drivers/gpu/drm/drm_debugfs.c
@@ -92,15 +92,17 @@ static int drm_clients_info(struct seq_file *m, void *data)
*/
mutex_lock(&dev->filelist_mutex);
list_for_each_entry_reverse(priv, &dev->filelist, lhead) {
- struct task_struct *task;
bool is_current_master = drm_is_current_master(priv);
+ struct task_struct *task;
+ struct pid *pid;
- rcu_read_lock(); /* locks pid_task()->comm */
- task = pid_task(priv->pid, PIDTYPE_TGID);
+ rcu_read_lock(); /* Locks priv->pid and pid_task()->comm! */
+ pid = rcu_dereference(priv->pid);
+ task = pid_task(pid, PIDTYPE_TGID);
uid = task ? __task_cred(task)->euid : GLOBAL_ROOT_UID;
seq_printf(m, "%20s %5d %3d %c %c %5d %10u\n",
task ? task->comm : "<unknown>",
- pid_vnr(priv->pid),
+ pid_vnr(pid),
priv->minor->index,
is_current_master ? 'y' : 'n',
priv->authenticated ? 'y' : 'n',
diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c
index 883d83bc0e3d5..e692770ef6d3c 100644
--- a/drivers/gpu/drm/drm_file.c
+++ b/drivers/gpu/drm/drm_file.c
@@ -160,7 +160,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
/* Get a unique identifier for fdinfo: */
file->client_id = atomic64_inc_return(&ident);
- file->pid = get_pid(task_tgid(current));
+ rcu_assign_pointer(file->pid, get_pid(task_tgid(current)));
file->minor = minor;
/* for compatibility root is always authenticated */
@@ -200,7 +200,7 @@ struct drm_file *drm_file_alloc(struct drm_minor *minor)
drm_syncobj_release(file);
if (drm_core_check_feature(dev, DRIVER_GEM))
drm_gem_release(dev, file);
- put_pid(file->pid);
+ put_pid(rcu_access_pointer(file->pid));
kfree(file);
return ERR_PTR(ret);
@@ -291,7 +291,7 @@ void drm_file_free(struct drm_file *file)
WARN_ON(!list_empty(&file->event_list));
- put_pid(file->pid);
+ put_pid(rcu_access_pointer(file->pid));
kfree(file);
}
@@ -505,6 +505,40 @@ int drm_release(struct inode *inode, struct file *filp)
}
EXPORT_SYMBOL(drm_release);
+void drm_file_update_pid(struct drm_file *filp)
+{
+ struct drm_device *dev;
+ struct pid *pid, *old;
+
+ /*
+ * Master nodes need to keep the original ownership in order for
+ * drm_master_check_perm to keep working correctly. (See comment in
+ * drm_auth.c.)
+ */
+ if (filp->was_master)
+ return;
+
+ pid = task_tgid(current);
+
+ /*
+ * Quick unlocked check since the model is a single handover followed by
+ * exclusive repeated use.
+ */
+ if (pid == rcu_access_pointer(filp->pid))
+ return;
+
+ dev = filp->minor->dev;
+ mutex_lock(&dev->filelist_mutex);
+ old = rcu_replace_pointer(filp->pid, pid, 1);
+ mutex_unlock(&dev->filelist_mutex);
+
+ if (pid != old) {
+ get_pid(pid);
+ synchronize_rcu();
+ put_pid(old);
+ }
+}
+
/**
* drm_release_noglobal - release method for DRM file
* @inode: device inode
diff --git a/drivers/gpu/drm/drm_ioctl.c b/drivers/gpu/drm/drm_ioctl.c
index f03ffbacfe9b4..77590b0f38fa3 100644
--- a/drivers/gpu/drm/drm_ioctl.c
+++ b/drivers/gpu/drm/drm_ioctl.c
@@ -776,6 +776,9 @@ long drm_ioctl_kernel(struct file *file, drm_ioctl_t *func, void *kdata,
struct drm_device *dev = file_priv->minor->dev;
int retcode;
+ /* Update drm_file owner if fd was passed along. */
+ drm_file_update_pid(file_priv);
+
if (drm_dev_is_unplugged(dev))
return -ENODEV;
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index 4396f501b16a3..50589f982d1a4 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -1133,7 +1133,10 @@ nouveau_drm_open(struct drm_device *dev, struct drm_file *fpriv)
}
get_task_comm(tmpname, current);
- snprintf(name, sizeof(name), "%s[%d]", tmpname, pid_nr(fpriv->pid));
+ rcu_read_lock();
+ snprintf(name, sizeof(name), "%s[%d]",
+ tmpname, pid_nr(rcu_dereference(fpriv->pid)));
+ rcu_read_unlock();
if (!(cli = kzalloc(sizeof(*cli), GFP_KERNEL))) {
ret = -ENOMEM;
diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
index 8b1eb0061610c..12787bb9c111d 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_gem.c
@@ -244,6 +244,7 @@ static int vmw_debugfs_gem_info_show(struct seq_file *m, void *unused)
list_for_each_entry(file, &dev->filelist, lhead) {
struct task_struct *task;
struct drm_gem_object *gobj;
+ struct pid *pid;
int id;
/*
@@ -253,8 +254,9 @@ static int vmw_debugfs_gem_info_show(struct seq_file *m, void *unused)
* Therefore, we need to protect this ->comm access using RCU.
*/
rcu_read_lock();
- task = pid_task(file->pid, PIDTYPE_TGID);
- seq_printf(m, "pid %8d command %s:\n", pid_nr(file->pid),
+ pid = rcu_dereference(file->pid);
+ task = pid_task(pid, PIDTYPE_TGID);
+ seq_printf(m, "pid %8d command %s:\n", pid_nr(pid),
task ? task->comm : "<unknown>");
rcu_read_unlock();
diff --git a/include/drm/drm_file.h b/include/drm/drm_file.h
index 010239392adfb..9c47a43f42a62 100644
--- a/include/drm/drm_file.h
+++ b/include/drm/drm_file.h
@@ -256,8 +256,15 @@ struct drm_file {
/** @master_lookup_lock: Serializes @master. */
spinlock_t master_lookup_lock;
- /** @pid: Process that opened this file. */
- struct pid *pid;
+ /**
+ * @pid: Process that is using this file.
+ *
+ * Must only be dereferenced under a rcu_read_lock or equivalent.
+ *
+ * Updates are guarded with dev->filelist_mutex and reference must be
+ * dropped after a RCU grace period to accommodate lockless readers.
+ */
+ struct pid __rcu *pid;
/** @client_id: A unique id for fdinfo */
u64 client_id;
@@ -420,6 +427,8 @@ static inline bool drm_is_accel_client(const struct drm_file *file_priv)
return file_priv->minor->type == DRM_MINOR_ACCEL;
}
+void drm_file_update_pid(struct drm_file *);
+
int drm_open(struct inode *inode, struct file *filp);
int drm_open_helper(struct file *filp, struct drm_minor *minor);
ssize_t drm_read(struct file *filp, char __user *buffer,
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 012/156] drm: Fix FD ownership check in drm_master_check_perm()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 011/156] drm: Update file owner during use Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 013/156] spi: spi-imx: correctly configure burst length when using dma Greg Kroah-Hartman
` (152 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lingkai Dong, Christian König,
Tvrtko Ursulin, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lingkai Dong <Lingkai.Dong@arm.com>
[ Upstream commit 5a6c9a05e55cb2972396cc991af9d74c8c15029a ]
The DRM subsystem keeps a record of the owner of a DRM device file
descriptor using thread group ID (TGID) instead of process ID (PID), to
ensures all threads within the same userspace process are considered the
owner. However, the DRM master ownership check compares the current
thread's PID against the record, so the thread is incorrectly considered to
be not the FD owner if the PID is not equal to the TGID. This causes DRM
ioctls to be denied master privileges, even if the same thread that opened
the FD performs an ioctl. Fix this by checking TGID.
Fixes: 4230cea89cafb ("drm: Track clients by tgid and not tid")
Signed-off-by: Lingkai Dong <lingkai.dong@arm.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Reviewed-by: Tvrtko Ursulin <tvrtko.ursulin@intel.com>
Cc: <stable@vger.kernel.org> # v6.4+
Link: https://patchwork.freedesktop.org/patch/msgid/PA6PR08MB107665920BE9A96658CDA04CE8884A@PA6PR08MB10766.eurprd08.prod.outlook.com
Signed-off-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
index 2ed2585ded378..6899b3dc1f12a 100644
--- a/drivers/gpu/drm/drm_auth.c
+++ b/drivers/gpu/drm/drm_auth.c
@@ -236,7 +236,7 @@ static int
drm_master_check_perm(struct drm_device *dev, struct drm_file *file_priv)
{
if (file_priv->was_master &&
- rcu_access_pointer(file_priv->pid) == task_pid(current))
+ rcu_access_pointer(file_priv->pid) == task_tgid(current))
return 0;
if (!capable(CAP_SYS_ADMIN))
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 013/156] spi: spi-imx: correctly configure burst length when using dma
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 012/156] drm: Fix FD ownership check in drm_master_check_perm() Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 014/156] arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Greg Kroah-Hartman
` (151 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Bigler, Mark Brown,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Bigler <benjamin@bigler.one>
[ Upstream commit e9b220aeacf109684cce36a94fc24ed37be92b05 ]
If DMA is used, burst length should be set to the bus width of the DMA.
Otherwise, the SPI hardware will transmit/receive one word per DMA
request.
Since this issue affects both transmission and reception, it cannot be
detected with a loopback test.
Replace magic numbers 512 and 0xfff with MX51_ECSPI_CTRL_MAX_BURST.
Reported-by Stefan Bigler <linux@bigler.io>
Signed-off-by: Benjamin Bigler <benjamin@bigler.one>
Fixes: 15a6af94a277 ("spi: Increase imx51 ecspi burst length based on transfer length")
Link: https://lore.kernel.org/r/8a415902c751cdbb4b20ce76569216ed@mail.infomaniak.com
Link: https://lore.kernel.org/r/20231209222338.5564-1-benjamin@bigler.one
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-imx.c | 15 +++++++++++----
1 file changed, 11 insertions(+), 4 deletions(-)
diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c
index 498e35c8db2c1..272bc871a848b 100644
--- a/drivers/spi/spi-imx.c
+++ b/drivers/spi/spi-imx.c
@@ -659,11 +659,18 @@ static int mx51_ecspi_prepare_transfer(struct spi_imx_data *spi_imx,
ctrl |= (spi_imx->target_burst * 8 - 1)
<< MX51_ECSPI_CTRL_BL_OFFSET;
else {
- if (spi_imx->count >= 512)
- ctrl |= 0xFFF << MX51_ECSPI_CTRL_BL_OFFSET;
- else
- ctrl |= (spi_imx->count * spi_imx->bits_per_word - 1)
+ if (spi_imx->usedma) {
+ ctrl |= (spi_imx->bits_per_word *
+ spi_imx_bytes_per_word(spi_imx->bits_per_word) - 1)
<< MX51_ECSPI_CTRL_BL_OFFSET;
+ } else {
+ if (spi_imx->count >= MX51_ECSPI_CTRL_MAX_BURST)
+ ctrl |= (MX51_ECSPI_CTRL_MAX_BURST - 1)
+ << MX51_ECSPI_CTRL_BL_OFFSET;
+ else
+ ctrl |= (spi_imx->count * spi_imx->bits_per_word - 1)
+ << MX51_ECSPI_CTRL_BL_OFFSET;
+ }
}
/* set clock speed */
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 014/156] arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 013/156] spi: spi-imx: correctly configure burst length when using dma Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 015/156] ARM: dts: dra7: Fix DRA7 L3 NoC node register size Greg Kroah-Hartman
` (150 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chukun Pan, Jernej Skrabec,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chukun Pan <amadeus@jmu.edu.cn>
[ Upstream commit b9622937d95809ef89904583191571a9fa326402 ]
The current emac setting is not suitable for Orange Pi Zero 3,
move it back to Orange Pi Zero 2 DT. Also update phy mode and
delay values for emac on Orange Pi Zero 3.
With these changes, Ethernet now looks stable.
Fixes: 322bf103204b ("arm64: dts: allwinner: h616: Split Orange Pi Zero 2 DT")
Signed-off-by: Chukun Pan <amadeus@jmu.edu.cn>
Reviewed-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Link: https://lore.kernel.org/r/20231029074009.7820-2-amadeus@jmu.edu.cn
Signed-off-by: Jernej Skrabec <jernej.skrabec@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi | 3 ---
arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts | 3 +++
arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts | 2 ++
3 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi
index 15290e6892fca..fc7315b944065 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero.dtsi
@@ -68,10 +68,7 @@
&emac0 {
pinctrl-names = "default";
pinctrl-0 = <&ext_rgmii_pins>;
- phy-mode = "rgmii";
phy-handle = <&ext_rgmii_phy>;
- allwinner,rx-delay-ps = <3100>;
- allwinner,tx-delay-ps = <700>;
status = "okay";
};
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts
index d83852e72f063..b5d713926a341 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h616-orangepi-zero2.dts
@@ -13,6 +13,9 @@
};
&emac0 {
+ allwinner,rx-delay-ps = <3100>;
+ allwinner,tx-delay-ps = <700>;
+ phy-mode = "rgmii";
phy-supply = <®_dcdce>;
};
diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts b/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts
index 00fe28caac939..b3b1b8692125f 100644
--- a/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts
+++ b/arch/arm64/boot/dts/allwinner/sun50i-h618-orangepi-zero3.dts
@@ -13,6 +13,8 @@
};
&emac0 {
+ allwinner,tx-delay-ps = <700>;
+ phy-mode = "rgmii-rxid";
phy-supply = <®_dldo1>;
};
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 015/156] ARM: dts: dra7: Fix DRA7 L3 NoC node register size
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 014/156] arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 016/156] ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Greg Kroah-Hartman
` (149 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrew Davis, Tony Lindgren,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Davis <afd@ti.com>
[ Upstream commit 1e5caee2ba8f1426e8098afb4ca38dc40a0ca71b ]
This node can access any part of the L3 configuration registers space,
including CLK1 and CLK2 which are 0x800000 offset. Restore this area
size to include these areas.
Fixes: 7f2659ce657e ("ARM: dts: Move dra7 l3 noc to a separate node")
Signed-off-by: Andrew Davis <afd@ti.com>
Message-ID: <20231113181604.546444-1-afd@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/ti/omap/dra7.dtsi b/arch/arm/boot/dts/ti/omap/dra7.dtsi
index 3f3e52e3b3752..6509c742fb58c 100644
--- a/arch/arm/boot/dts/ti/omap/dra7.dtsi
+++ b/arch/arm/boot/dts/ti/omap/dra7.dtsi
@@ -147,7 +147,7 @@
l3-noc@44000000 {
compatible = "ti,dra7-l3-noc";
- reg = <0x44000000 0x1000>,
+ reg = <0x44000000 0x1000000>,
<0x45000000 0x1000>;
interrupts-extended = <&crossbar_mpu GIC_SPI 4 IRQ_TYPE_LEVEL_HIGH>,
<&wakeupgen GIC_SPI 10 IRQ_TYPE_LEVEL_HIGH>;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 016/156] ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 015/156] ARM: dts: dra7: Fix DRA7 L3 NoC node register size Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 017/156] reset: Fix crash when freeing non-existent optional resets Greg Kroah-Hartman
` (148 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Tony Lindgren,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit c72b9c33ef9695ad7ce7a6eb39a9df8a01b70796 ]
kasprintf() returns a pointer to dynamically allocated memory which can
be NULL upon failure. When 'soc_dev_attr->family' is NULL,it'll trigger
the null pointer dereference issue, such as in 'soc_info_show'.
And when 'soc_device_register' fails, it's necessary to release
'soc_dev_attr->family' to avoid memory leaks.
Fixes: 6770b2114325 ("ARM: OMAP2+: Export SoC information to userspace")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Message-ID: <20231123145237.609442-1-chentao@kylinos.cn>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-omap2/id.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index 98999aa8cc0c0..7f387706368a6 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -793,11 +793,16 @@ void __init omap_soc_device_init(void)
soc_dev_attr->machine = soc_name;
soc_dev_attr->family = omap_get_family();
+ if (!soc_dev_attr->family) {
+ kfree(soc_dev_attr);
+ return;
+ }
soc_dev_attr->revision = soc_rev;
soc_dev_attr->custom_attr_group = omap_soc_groups[0];
soc_dev = soc_device_register(soc_dev_attr);
if (IS_ERR(soc_dev)) {
+ kfree(soc_dev_attr->family);
kfree(soc_dev_attr);
return;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 017/156] reset: Fix crash when freeing non-existent optional resets
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 016/156] ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 018/156] s390/vx: fix save/restore of fpu kernel context Greg Kroah-Hartman
` (147 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Philipp Zabel,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 4a6756f56bcf8e64c87144a626ce53aea4899c0e ]
When obtaining one or more optional resets, non-existent resets are
stored as NULL pointers, and all related error and cleanup paths need to
take this into account.
Currently only reset_control_put() and reset_control_bulk_put()
get this right. All of __reset_control_bulk_get(),
of_reset_control_array_get(), and reset_control_array_put() lack the
proper checking, causing NULL pointer dereferences on failure or
release.
Fix this by moving the existing check from reset_control_bulk_put() to
__reset_control_put_internal(), so it applies to all callers.
The double check in reset_control_put() doesn't hurt.
Fixes: 17c82e206d2a3cd8 ("reset: Add APIs to manage array of resets")
Fixes: 48d71395896d54ee ("reset: Add reset_control_bulk API")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/2440edae7ca8534628cdbaf559ded288f2998178.1701276806.git.geert+renesas@glider.be
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/reset/core.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/reset/core.c b/drivers/reset/core.c
index f0a076e94118f..92cc13ef3e566 100644
--- a/drivers/reset/core.c
+++ b/drivers/reset/core.c
@@ -807,6 +807,9 @@ static void __reset_control_put_internal(struct reset_control *rstc)
{
lockdep_assert_held(&reset_list_mutex);
+ if (IS_ERR_OR_NULL(rstc))
+ return;
+
kref_put(&rstc->refcnt, __reset_control_release);
}
@@ -1017,11 +1020,8 @@ EXPORT_SYMBOL_GPL(reset_control_put);
void reset_control_bulk_put(int num_rstcs, struct reset_control_bulk_data *rstcs)
{
mutex_lock(&reset_list_mutex);
- while (num_rstcs--) {
- if (IS_ERR_OR_NULL(rstcs[num_rstcs].rstc))
- continue;
+ while (num_rstcs--)
__reset_control_put_internal(rstcs[num_rstcs].rstc);
- }
mutex_unlock(&reset_list_mutex);
}
EXPORT_SYMBOL_GPL(reset_control_bulk_put);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 018/156] s390/vx: fix save/restore of fpu kernel context
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 017/156] reset: Fix crash when freeing non-existent optional resets Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 019/156] platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() Greg Kroah-Hartman
` (146 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Hendrik Brueckner,
Alexander Gordeev, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
[ Upstream commit e6b2dab41888332bf83f592131e7ea07756770a4 ]
The KERNEL_FPR mask only contains a flag for the first eight vector
registers. However floating point registers overlay parts of the first
sixteen vector registers.
This could lead to vector register corruption if a kernel fpu context uses
any of the vector registers 8 to 15 and is interrupted or calls a
KERNEL_FPR context. If that context uses also vector registers 8 to 15,
their contents will be corrupted on return.
Luckily this is currently not a real bug, since the kernel has only one
KERNEL_FPR user with s390_adjust_jiffies() and it is only using floating
point registers 0 to 2.
Fix this by using the correct bits for KERNEL_FPR.
Fixes: 7f79695cc1b6 ("s390/fpu: improve kernel_fpu_[begin|end]")
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/include/asm/fpu/api.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/include/asm/fpu/api.h b/arch/s390/include/asm/fpu/api.h
index b714ed0ef6885..9acf48e53a87f 100644
--- a/arch/s390/include/asm/fpu/api.h
+++ b/arch/s390/include/asm/fpu/api.h
@@ -79,7 +79,7 @@ static inline int test_fp_ctl(u32 fpc)
#define KERNEL_VXR_HIGH (KERNEL_VXR_V16V23|KERNEL_VXR_V24V31)
#define KERNEL_VXR (KERNEL_VXR_LOW|KERNEL_VXR_HIGH)
-#define KERNEL_FPR (KERNEL_FPC|KERNEL_VXR_V0V7)
+#define KERNEL_FPR (KERNEL_FPC|KERNEL_VXR_LOW)
struct kernel_fpu;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 019/156] platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 018/156] s390/vx: fix save/restore of fpu kernel context Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 020/156] SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Greg Kroah-Hartman
` (145 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rajvi Jingar, Ilpo Järvinen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rajvi Jingar <rajvi.jingar@linux.intel.com>
[ Upstream commit fbcf67ce5a9e2831c14bdfb895be05213e611724 ]
For input value 0, PMC stays unassigned which causes crash while trying
to access PMC for register read/write. Include LTR index 0 in pmc_index
and ltr_index calculation.
Fixes: 2bcef4529222 ("platform/x86:intel/pmc: Enable debugfs multiple PMC support")
Signed-off-by: Rajvi Jingar <rajvi.jingar@linux.intel.com>
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Link: https://lore.kernel.org/r/20231216011650.1973941-1-rajvi.jingar@linux.intel.com
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/pmc/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/platform/x86/intel/pmc/core.c b/drivers/platform/x86/intel/pmc/core.c
index 84c175b9721a0..e95d3011b9997 100644
--- a/drivers/platform/x86/intel/pmc/core.c
+++ b/drivers/platform/x86/intel/pmc/core.c
@@ -472,7 +472,7 @@ int pmc_core_send_ltr_ignore(struct pmc_dev *pmcdev, u32 value)
* is based on the contiguous indexes from ltr_show output.
* pmc index and ltr index needs to be calculated from it.
*/
- for (pmc_index = 0; pmc_index < ARRAY_SIZE(pmcdev->pmcs) && ltr_index > 0; pmc_index++) {
+ for (pmc_index = 0; pmc_index < ARRAY_SIZE(pmcdev->pmcs) && ltr_index >= 0; pmc_index++) {
pmc = pmcdev->pmcs[pmc_index];
if (!pmc)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 020/156] SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 019/156] platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 021/156] wifi: ieee80211: dont require protected vendor action frames Greg Kroah-Hartman
` (144 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guillaume Morin, Chuck Lever,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chuck Lever <chuck.lever@oracle.com>
[ Upstream commit bd018b98ba84ca0c80abac1ef23ce726a809e58c ]
Guillaume says:
> I believe commit 5f7fc5d69f6e ("SUNRPC: Resupply rq_pages from
> node-local memory") in Linux 6.5+ is incorrect. It passes
> unconditionally rq_pool->sp_id as the NUMA node.
>
> While the comment in the svc_pool declaration in sunrpc/svc.h says
> that sp_id is also the NUMA node id, it might not be the case if
> the svc is created using svc_create_pooled(). svc_created_pooled()
> can use the per-cpu pool mode therefore in this case sp_id would
> be the cpu id.
Fix this by reverting now. At a later point this minor optimization,
and the deceptive labeling of the sp_id field, can be revisited.
Reported-by: Guillaume Morin <guillaume@morinfr.org>
Closes: https://lore.kernel.org/linux-nfs/ZYC9rsno8qYggVt9@bender.morinfr.org/T/#u
Fixes: 5f7fc5d69f6e ("SUNRPC: Resupply rq_pages from node-local memory")
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sunrpc/svc_xprt.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 4cfe9640df481..5cfe5c7408b74 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -666,9 +666,8 @@ static bool svc_alloc_arg(struct svc_rqst *rqstp)
}
for (filled = 0; filled < pages; filled = ret) {
- ret = alloc_pages_bulk_array_node(GFP_KERNEL,
- rqstp->rq_pool->sp_id,
- pages, rqstp->rq_pages);
+ ret = alloc_pages_bulk_array(GFP_KERNEL, pages,
+ rqstp->rq_pages);
if (ret > filled)
/* Made progress, don't sleep yet */
continue;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 021/156] wifi: ieee80211: dont require protected vendor action frames
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 020/156] SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 022/156] wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock Greg Kroah-Hartman
` (143 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jouni Malinen, Johannes Berg,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 98fb9b9680c9f3895ced02d6a73e27f5d7b5892b ]
For vendor action frames, whether a protected one should be
used or not is clearly up to the individual vendor and frame,
so even though a protected dual is defined, it may not get
used. Thus, don't require protection for vendor action frames
when they're used in a connection.
Since we obviously don't process frames unknown to the kernel
in the kernel, it may makes sense to invert this list to have
all the ones the kernel processes and knows to be requiring
protection, but that'd be a different change.
Fixes: 91535613b609 ("wifi: mac80211: don't drop all unprotected public action frames")
Reported-by: Jouni Malinen <j@w1.fi>
Link: https://msgid.link/20231206223801.f6a2cf4e67ec.Ifa6acc774bd67801d3dafb405278f297683187aa@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/ieee80211.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index b24fb80782c5a..2b0a73cb7cbb0 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -4381,7 +4381,8 @@ ieee80211_is_protected_dual_of_public_action(struct sk_buff *skb)
action != WLAN_PUB_ACTION_LOC_TRACK_NOTI &&
action != WLAN_PUB_ACTION_FTM_REQUEST &&
action != WLAN_PUB_ACTION_FTM_RESPONSE &&
- action != WLAN_PUB_ACTION_FILS_DISCOVERY;
+ action != WLAN_PUB_ACTION_FILS_DISCOVERY &&
+ action != WLAN_PUB_ACTION_VENDOR_SPECIFIC;
}
/**
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 022/156] wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 021/156] wifi: ieee80211: dont require protected vendor action frames Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 023/156] wifi: mac80211: check if the existing link config remains unchanged Greg Kroah-Hartman
` (142 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Brian Norris, Johannes Berg,
Miri Korenblit, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit a4754182dc936b97ec7e9f6b08cdf7ed97ef9069 ]
Evidently I had only looked at all the ones in rx.c, and missed this.
Add bh-disable to this use of the rxq->lock as well.
Fixes: 25edc8f259c7 ("iwlwifi: pcie: properly implement NAPI")
Reported-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231208183100.e79ad3dae649.I8f19713c4383707f8be7fc20ff5cc1ecf12429bb@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index 583d1011963ec..2e23ccd7d7938 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -3088,7 +3088,7 @@ static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans,
struct iwl_rxq *rxq = &trans_pcie->rxq[0];
u32 i, r, j, rb_len = 0;
- spin_lock(&rxq->lock);
+ spin_lock_bh(&rxq->lock);
r = le16_to_cpu(iwl_get_closed_rb_stts(trans, rxq)) & 0x0FFF;
@@ -3112,7 +3112,7 @@ static u32 iwl_trans_pcie_dump_rbs(struct iwl_trans *trans,
*data = iwl_fw_error_next_data(*data);
}
- spin_unlock(&rxq->lock);
+ spin_unlock_bh(&rxq->lock);
return rb_len;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 023/156] wifi: mac80211: check if the existing link config remains unchanged
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 022/156] wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 024/156] wifi: mac80211: dont re-add debugfs during reconfig Greg Kroah-Hartman
` (141 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Edward Adam Davis, Johannes Berg,
Sasha Levin, syzbot+62d7eef57b09bfebcd84
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit c1393c132b906fbdf91f6d1c9eb2ef7a00cce64e ]
[Syz report]
WARNING: CPU: 1 PID: 5067 at net/mac80211/rate.c:48 rate_control_rate_init+0x540/0x690 net/mac80211/rate.c:48
Modules linked in:
CPU: 1 PID: 5067 Comm: syz-executor413 Not tainted 6.7.0-rc3-syzkaller-00014-gdf60cee26a2e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:rate_control_rate_init+0x540/0x690 net/mac80211/rate.c:48
Code: 48 c7 c2 00 46 0c 8c be 08 03 00 00 48 c7 c7 c0 45 0c 8c c6 05 70 79 0b 05 01 e8 1b a0 6f f7 e9 e0 fd ff ff e8 61 b3 8f f7 90 <0f> 0b 90 e9 36 ff ff ff e8 53 b3 8f f7 e8 5e 0b 78 f7 31 ff 89 c3
RSP: 0018:ffffc90003c57248 EFLAGS: 00010293
RAX: 0000000000000000 RBX: ffff888016bc4000 RCX: ffffffff89f7d519
RDX: ffff888076d43b80 RSI: ffffffff89f7d6df RDI: 0000000000000005
RBP: ffff88801daaae20 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000002 R12: 0000000000000001
R13: 0000000000000000 R14: ffff888020030e20 R15: ffff888078f08000
FS: 0000555556b94380(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000005fdeb8 CR3: 0000000076d22000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
sta_apply_auth_flags.constprop.0+0x4b7/0x510 net/mac80211/cfg.c:1674
sta_apply_parameters+0xaf1/0x16c0 net/mac80211/cfg.c:2002
ieee80211_add_station+0x3fa/0x6c0 net/mac80211/cfg.c:2068
rdev_add_station net/wireless/rdev-ops.h:201 [inline]
nl80211_new_station+0x13ba/0x1a70 net/wireless/nl80211.c:7603
genl_family_rcv_msg_doit+0x1fc/0x2e0 net/netlink/genetlink.c:972
genl_family_rcv_msg net/netlink/genetlink.c:1052 [inline]
genl_rcv_msg+0x561/0x800 net/netlink/genetlink.c:1067
netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2545
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1076
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x53b/0x810 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x93c/0xe40 net/netlink/af_netlink.c:1910
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
____sys_sendmsg+0x6ac/0x940 net/socket.c:2584
___sys_sendmsg+0x135/0x1d0 net/socket.c:2638
__sys_sendmsg+0x117/0x1e0 net/socket.c:2667
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
[Analysis]
It is inappropriate to make a link configuration change judgment on an
non-existent and non new link.
[Fix]
Quickly exit when there is a existent link and the link configuration has not
changed.
Fixes: b303835dabe0 ("wifi: mac80211: accept STA changes without link changes")
Reported-and-tested-by: syzbot+62d7eef57b09bfebcd84@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Link: https://msgid.link/tencent_DE67FF86DB92ED465489A36ECD2EDDCC8C06@qq.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/cfg.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 715da615f0359..f7cb50b0dd4ed 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1806,10 +1806,10 @@ static int sta_link_apply_parameters(struct ieee80211_local *local,
lockdep_is_held(&local->sta_mtx));
/*
- * If there are no changes, then accept a link that doesn't exist,
+ * If there are no changes, then accept a link that exist,
* unless it's a new link.
*/
- if (params->link_id < 0 && !new_link &&
+ if (params->link_id >= 0 && !new_link &&
!params->link_mac && !params->txpwr_set &&
!params->supported_rates_len &&
!params->ht_capa && !params->vht_capa &&
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 024/156] wifi: mac80211: dont re-add debugfs during reconfig
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 023/156] wifi: mac80211: check if the existing link config remains unchanged Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 025/156] wifi: mac80211: check defragmentation succeeded Greg Kroah-Hartman
` (140 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Benjamin Berg, Miri Korenblit, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 63bafd9d5421959b2124dd940ed8d7462d99f449 ]
If we're doing reconfig, then we cannot add the debugfs
files that are already there from before the reconfig.
Skip that in drv_change_sta_links() during reconfig.
Fixes: d2caad527c19 ("wifi: mac80211: add API to show the link STAs in debugfs")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
Reviewed-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231211085121.88a950f43e16.Id71181780994649219685887c0fcad33d387cc78@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/driver-ops.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c
index aa37a1410f377..f8af0c3d405ae 100644
--- a/net/mac80211/driver-ops.c
+++ b/net/mac80211/driver-ops.c
@@ -1,7 +1,7 @@
// SPDX-License-Identifier: GPL-2.0-only
/*
* Copyright 2015 Intel Deutschland GmbH
- * Copyright (C) 2022 Intel Corporation
+ * Copyright (C) 2022-2023 Intel Corporation
*/
#include <net/mac80211.h>
#include "ieee80211_i.h"
@@ -564,6 +564,10 @@ int drv_change_sta_links(struct ieee80211_local *local,
if (ret)
return ret;
+ /* during reconfig don't add it to debugfs again */
+ if (local->in_reconfig)
+ return 0;
+
for_each_set_bit(link_id, &links_to_add, IEEE80211_MLD_MAX_NUM_LINKS) {
link_sta = rcu_dereference_protected(info->link[link_id],
lockdep_is_held(&local->sta_mtx));
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 025/156] wifi: mac80211: check defragmentation succeeded
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 024/156] wifi: mac80211: dont re-add debugfs during reconfig Greg Kroah-Hartman
@ 2023-12-30 11:57 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 026/156] wifi: mac80211: mesh: check element parsing succeeded Greg Kroah-Hartman
` (139 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Miri Korenblit,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 98849ba2aa9db46e62720fb686a9d63ed9887806 ]
We need to check that cfg80211_defragment_element()
didn't return an error, since it can fail due to bad
input, and we didn't catch that before.
Fixes: 8eb8dd2ffbbb ("wifi: mac80211: Support link removal using Reconfiguration ML element")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231211085121.8595a6b67fc0.I1225edd8f98355e007f96502e358e476c7971d8c@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mlme.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 0c9198997482b..73f8df03d159c 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -5805,7 +5805,7 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
{
const struct ieee80211_multi_link_elem *ml;
const struct element *sub;
- size_t ml_len;
+ ssize_t ml_len;
unsigned long removed_links = 0;
u16 link_removal_timeout[IEEE80211_MLD_MAX_NUM_LINKS] = {};
u8 link_id;
@@ -5821,6 +5821,8 @@ static void ieee80211_ml_reconfiguration(struct ieee80211_sub_if_data *sdata,
elems->scratch + elems->scratch_len -
elems->scratch_pos,
WLAN_EID_FRAGMENT);
+ if (ml_len < 0)
+ return;
elems->ml_reconf = (const void *)elems->scratch_pos;
elems->ml_reconf_len = ml_len;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 026/156] wifi: mac80211: mesh: check element parsing succeeded
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2023-12-30 11:57 ` [PATCH 6.6 025/156] wifi: mac80211: check defragmentation succeeded Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 027/156] wifi: mac80211: mesh_plink: fix matches_local logic Greg Kroah-Hartman
` (138 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Miri Korenblit,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 1fc4a3eec50d726f4663ad3c0bb0158354d6647a ]
ieee802_11_parse_elems() can return NULL, so we must
check for the return value.
Fixes: 5d24828d05f3 ("mac80211: always allocate struct ieee802_11_elems")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231211085121.93dea364f3d3.Ie87781c6c48979fb25a744b90af4a33dc2d83a28@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mesh_plink.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index a1e526419e9d2..5c8a3ff0ae0cc 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1243,6 +1243,8 @@ void mesh_rx_plink_frame(struct ieee80211_sub_if_data *sdata,
return;
}
elems = ieee802_11_parse_elems(baseaddr, len - baselen, true, NULL);
- mesh_process_plink_frame(sdata, mgmt, elems, rx_status);
- kfree(elems);
+ if (elems) {
+ mesh_process_plink_frame(sdata, mgmt, elems, rx_status);
+ kfree(elems);
+ }
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 027/156] wifi: mac80211: mesh_plink: fix matches_local logic
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 026/156] wifi: mac80211: mesh: check element parsing succeeded Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 028/156] ice: fix theoretical out-of-bounds access in ethtool link modes Greg Kroah-Hartman
` (137 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Miri Korenblit,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 8c386b166e2517cf3a123018e77941ec22625d0f ]
During refactoring the "else" here got lost, add it back.
Fixes: c99a89edb106 ("mac80211: factor out plink event gathering")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231211085121.795480fa0e0b.I017d501196a5bbdcd9afd33338d342d6fe1edd79@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mac80211/mesh_plink.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 5c8a3ff0ae0cc..cc62c2a01f54f 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -1064,8 +1064,8 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata,
case WLAN_SP_MESH_PEERING_OPEN:
if (!matches_local)
event = OPN_RJCT;
- if (!mesh_plink_free_count(sdata) ||
- (sta->mesh->plid && sta->mesh->plid != plid))
+ else if (!mesh_plink_free_count(sdata) ||
+ (sta->mesh->plid && sta->mesh->plid != plid))
event = OPN_IGNR;
else
event = OPN_ACPT;
@@ -1073,9 +1073,9 @@ mesh_plink_get_event(struct ieee80211_sub_if_data *sdata,
case WLAN_SP_MESH_PEERING_CONFIRM:
if (!matches_local)
event = CNF_RJCT;
- if (!mesh_plink_free_count(sdata) ||
- sta->mesh->llid != llid ||
- (sta->mesh->plid && sta->mesh->plid != plid))
+ else if (!mesh_plink_free_count(sdata) ||
+ sta->mesh->llid != llid ||
+ (sta->mesh->plid && sta->mesh->plid != plid))
event = CNF_IGNR;
else
event = CNF_ACPT;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 028/156] ice: fix theoretical out-of-bounds access in ethtool link modes
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 027/156] wifi: mac80211: mesh_plink: fix matches_local logic Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 029/156] bpf: syzkaller found null ptr deref in unix_bpf proto add Greg Kroah-Hartman
` (136 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Michal Schmidt, Przemek Kitszel,
Simon Horman, Tony Nguyen, Sasha Levin, Pucha Himasekhar Reddy
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Schmidt <mschmidt@redhat.com>
[ Upstream commit 91f9181c738101a276d9da333e0ab665ad806e6d ]
To map phy types reported by the hardware to ethtool link mode bits,
ice uses two lookup tables (phy_type_low_lkup, phy_type_high_lkup).
The "low" table has 64 elements to cover every possible bit the hardware
may report, but the "high" table has only 13. If the hardware reports a
higher bit in phy_types_high, the driver would access memory beyond the
lookup table's end.
Instead of iterating through all 64 bits of phy_types_{low,high}, use
the sizes of the respective lookup tables.
Fixes: 9136e1f1e5c3 ("ice: refactor PHY type to ethtool link mode")
Signed-off-by: Michal Schmidt <mschmidt@redhat.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool.c b/drivers/net/ethernet/intel/ice/ice_ethtool.c
index ad4d4702129f0..9be13e9840917 100644
--- a/drivers/net/ethernet/intel/ice/ice_ethtool.c
+++ b/drivers/net/ethernet/intel/ice/ice_ethtool.c
@@ -1757,14 +1757,14 @@ ice_phy_type_to_ethtool(struct net_device *netdev,
linkmode_zero(ks->link_modes.supported);
linkmode_zero(ks->link_modes.advertising);
- for (i = 0; i < BITS_PER_TYPE(u64); i++) {
+ for (i = 0; i < ARRAY_SIZE(phy_type_low_lkup); i++) {
if (phy_types_low & BIT_ULL(i))
ice_linkmode_set_bit(&phy_type_low_lkup[i], ks,
req_speeds, advert_phy_type_lo,
i);
}
- for (i = 0; i < BITS_PER_TYPE(u64); i++) {
+ for (i = 0; i < ARRAY_SIZE(phy_type_high_lkup); i++) {
if (phy_types_high & BIT_ULL(i))
ice_linkmode_set_bit(&phy_type_high_lkup[i], ks,
req_speeds, advert_phy_type_hi,
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 029/156] bpf: syzkaller found null ptr deref in unix_bpf proto add
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 028/156] ice: fix theoretical out-of-bounds access in ethtool link modes Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 030/156] Revert "net/mlx5e: fix double free of encap_header in update funcs" Greg Kroah-Hartman
` (135 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet,
syzbot+e8030702aefd3444fb9e, Jakub Sitnicki, John Fastabend,
Martin KaFai Lau, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Fastabend <john.fastabend@gmail.com>
[ Upstream commit 8d6650646ce49e9a5b8c5c23eb94f74b1749f70f ]
I added logic to track the sock pair for stream_unix sockets so that we
ensure lifetime of the sock matches the time a sockmap could reference
the sock (see fixes tag). I forgot though that we allow af_unix unconnected
sockets into a sock{map|hash} map.
This is problematic because previous fixed expected sk_pair() to exist
and did not NULL check it. Because unconnected sockets have a NULL
sk_pair this resulted in the NULL ptr dereference found by syzkaller.
BUG: KASAN: null-ptr-deref in unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
Write of size 4 at addr 0000000000000080 by task syz-executor360/5073
Call Trace:
<TASK>
...
sock_hold include/net/sock.h:777 [inline]
unix_stream_bpf_update_proto+0x72/0x430 net/unix/unix_bpf.c:171
sock_map_init_proto net/core/sock_map.c:190 [inline]
sock_map_link+0xb87/0x1100 net/core/sock_map.c:294
sock_map_update_common+0xf6/0x870 net/core/sock_map.c:483
sock_map_update_elem_sys+0x5b6/0x640 net/core/sock_map.c:577
bpf_map_update_value+0x3af/0x820 kernel/bpf/syscall.c:167
We considered just checking for the null ptr and skipping taking a ref
on the NULL peer sock. But, if the socket is then connected() after
being added to the sockmap we can cause the original issue again. So
instead this patch blocks adding af_unix sockets that are not in the
ESTABLISHED state.
Reported-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot+e8030702aefd3444fb9e@syzkaller.appspotmail.com
Fixes: 8866730aed51 ("bpf, sockmap: af_unix stream sockets need to hold ref for pair sock")
Acked-by: Jakub Sitnicki <jakub@cloudflare.com>
Signed-off-by: John Fastabend <john.fastabend@gmail.com>
Link: https://lore.kernel.org/r/20231201180139.328529-2-john.fastabend@gmail.com
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/sock.h | 5 +++++
net/core/sock_map.c | 2 ++
2 files changed, 7 insertions(+)
diff --git a/include/net/sock.h b/include/net/sock.h
index 7753354d59c0b..1b7ca8f35dd60 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2798,6 +2798,11 @@ static inline bool sk_is_tcp(const struct sock *sk)
return sk->sk_type == SOCK_STREAM && sk->sk_protocol == IPPROTO_TCP;
}
+static inline bool sk_is_stream_unix(const struct sock *sk)
+{
+ return sk->sk_family == AF_UNIX && sk->sk_type == SOCK_STREAM;
+}
+
/**
* sk_eat_skb - Release a skb if it is no longer needed
* @sk: socket to eat this skb from
diff --git a/net/core/sock_map.c b/net/core/sock_map.c
index 4292c2ed18286..27d733c0f65e1 100644
--- a/net/core/sock_map.c
+++ b/net/core/sock_map.c
@@ -536,6 +536,8 @@ static bool sock_map_sk_state_allowed(const struct sock *sk)
{
if (sk_is_tcp(sk))
return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_LISTEN);
+ if (sk_is_stream_unix(sk))
+ return (1 << sk->sk_state) & TCPF_ESTABLISHED;
return true;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 030/156] Revert "net/mlx5e: fix double free of encap_header in update funcs"
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 029/156] bpf: syzkaller found null ptr deref in unix_bpf proto add Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 031/156] Revert "net/mlx5e: fix double free of encap_header" Greg Kroah-Hartman
` (134 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Buslov, Saeed Mahameed,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <vladbu@nvidia.com>
[ Upstream commit 66ca8d4deca09bce3fc7bcf8ea7997fa1a51c33c ]
This reverts commit 3a4aa3cb83563df942be49d145ee3b7ddf17d6bb.
This patch is causing a null ptr issue, the proper fix is in the next
patch.
Fixes: 3a4aa3cb8356 ("net/mlx5e: fix double free of encap_header in update funcs")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlx5/core/en/tc_tun.c | 20 +++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index 668da5c70e63d..8bca696b6658c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -403,12 +403,16 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv,
if (err)
goto free_encap;
+ e->encap_size = ipv4_encap_size;
+ kfree(e->encap_header);
+ e->encap_header = encap_header;
+
if (!(nud_state & NUD_VALID)) {
neigh_event_send(attr.n, NULL);
/* the encap entry will be made valid on neigh update event
* and not used before that.
*/
- goto free_encap;
+ goto release_neigh;
}
memset(&reformat_params, 0, sizeof(reformat_params));
@@ -422,10 +426,6 @@ int mlx5e_tc_tun_update_header_ipv4(struct mlx5e_priv *priv,
goto free_encap;
}
- e->encap_size = ipv4_encap_size;
- kfree(e->encap_header);
- e->encap_header = encap_header;
-
e->flags |= MLX5_ENCAP_ENTRY_VALID;
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
mlx5e_route_lookup_ipv4_put(&attr);
@@ -669,12 +669,16 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv,
if (err)
goto free_encap;
+ e->encap_size = ipv6_encap_size;
+ kfree(e->encap_header);
+ e->encap_header = encap_header;
+
if (!(nud_state & NUD_VALID)) {
neigh_event_send(attr.n, NULL);
/* the encap entry will be made valid on neigh update event
* and not used before that.
*/
- goto free_encap;
+ goto release_neigh;
}
memset(&reformat_params, 0, sizeof(reformat_params));
@@ -688,10 +692,6 @@ int mlx5e_tc_tun_update_header_ipv6(struct mlx5e_priv *priv,
goto free_encap;
}
- e->encap_size = ipv6_encap_size;
- kfree(e->encap_header);
- e->encap_header = encap_header;
-
e->flags |= MLX5_ENCAP_ENTRY_VALID;
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
mlx5e_route_lookup_ipv6_put(&attr);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 031/156] Revert "net/mlx5e: fix double free of encap_header"
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 030/156] Revert "net/mlx5e: fix double free of encap_header in update funcs" Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 032/156] net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() Greg Kroah-Hartman
` (133 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Buslov, Saeed Mahameed,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <vladbu@nvidia.com>
[ Upstream commit 5d089684dc434a31e08d32f0530066d0025c52e4 ]
This reverts commit 6f9b1a0731662648949a1c0587f6acb3b7f8acf1.
This patch is causing a null ptr issue, the proper fix is in the next
patch.
Fixes: 6f9b1a073166 ("net/mlx5e: fix double free of encap_header")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
index 8bca696b6658c..00a04fdd756f5 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun.c
@@ -300,6 +300,9 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
if (err)
goto destroy_neigh_entry;
+ e->encap_size = ipv4_encap_size;
+ e->encap_header = encap_header;
+
if (!(nud_state & NUD_VALID)) {
neigh_event_send(attr.n, NULL);
/* the encap entry will be made valid on neigh update event
@@ -319,8 +322,6 @@ int mlx5e_tc_tun_create_header_ipv4(struct mlx5e_priv *priv,
goto destroy_neigh_entry;
}
- e->encap_size = ipv4_encap_size;
- e->encap_header = encap_header;
e->flags |= MLX5_ENCAP_ENTRY_VALID;
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
mlx5e_route_lookup_ipv4_put(&attr);
@@ -567,6 +568,9 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
if (err)
goto destroy_neigh_entry;
+ e->encap_size = ipv6_encap_size;
+ e->encap_header = encap_header;
+
if (!(nud_state & NUD_VALID)) {
neigh_event_send(attr.n, NULL);
/* the encap entry will be made valid on neigh update event
@@ -586,8 +590,6 @@ int mlx5e_tc_tun_create_header_ipv6(struct mlx5e_priv *priv,
goto destroy_neigh_entry;
}
- e->encap_size = ipv6_encap_size;
- e->encap_header = encap_header;
e->flags |= MLX5_ENCAP_ENTRY_VALID;
mlx5e_rep_queue_neigh_stats_work(netdev_priv(attr.out_dev));
mlx5e_route_lookup_ipv6_put(&attr);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 032/156] net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 031/156] Revert "net/mlx5e: fix double free of encap_header" Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 033/156] net/mlx5e: Fix a race in command alloc flow Greg Kroah-Hartman
` (132 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ding Hui, Shifeng Li, Simon Horman,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <lishifeng@sangfor.com.cn>
[ Upstream commit ddb38ddff9c71026bad481b791a94d446ee37603 ]
Out_sz that the size of out buffer is calculated using query_nic_vport
_context_in structure when driver query the MAC list. However query_nic
_vport_context_in structure is smaller than query_nic_vport_context_out.
When allowed_list_size is greater than 96, calling ether_addr_copy() will
trigger an slab-out-of-bounds.
[ 1170.055866] BUG: KASAN: slab-out-of-bounds in mlx5_query_nic_vport_mac_list+0x481/0x4d0 [mlx5_core]
[ 1170.055869] Read of size 4 at addr ffff88bdbc57d912 by task kworker/u128:1/461
[ 1170.055870]
[ 1170.055932] Workqueue: mlx5_esw_wq esw_vport_change_handler [mlx5_core]
[ 1170.055936] Call Trace:
[ 1170.055949] dump_stack+0x8b/0xbb
[ 1170.055958] print_address_description+0x6a/0x270
[ 1170.055961] kasan_report+0x179/0x2c0
[ 1170.056061] mlx5_query_nic_vport_mac_list+0x481/0x4d0 [mlx5_core]
[ 1170.056162] esw_update_vport_addr_list+0x2c5/0xcd0 [mlx5_core]
[ 1170.056257] esw_vport_change_handle_locked+0xd08/0x1a20 [mlx5_core]
[ 1170.056377] esw_vport_change_handler+0x6b/0x90 [mlx5_core]
[ 1170.056381] process_one_work+0x65f/0x12d0
[ 1170.056383] worker_thread+0x87/0xb50
[ 1170.056390] kthread+0x2e9/0x3a0
[ 1170.056394] ret_from_fork+0x1f/0x40
Fixes: e16aea2744ab ("net/mlx5: Introduce access functions to modify/query vport mac lists")
Cc: Ding Hui <dinghui@sangfor.com.cn>
Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
index 5a31fb47ffa58..21753f3278685 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c
@@ -277,7 +277,7 @@ int mlx5_query_nic_vport_mac_list(struct mlx5_core_dev *dev,
req_list_size = max_list_size;
}
- out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_in) +
+ out_sz = MLX5_ST_SZ_BYTES(query_nic_vport_context_out) +
req_list_size * MLX5_ST_SZ_BYTES(mac_address_layout);
out = kvzalloc(out_sz, GFP_KERNEL);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 033/156] net/mlx5e: Fix a race in command alloc flow
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 032/156] net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 034/156] net/mlx5e: fix a potential double-free in fs_udp_create_groups Greg Kroah-Hartman
` (131 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moshe Shemesh, Shifeng Li,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shifeng Li <lishifeng@sangfor.com.cn>
[ Upstream commit 8f5100da56b3980276234e812ce98d8f075194cd ]
Fix a cmd->ent use after free due to a race on command entry.
Such race occurs when one of the commands releases its last refcount and
frees its index and entry while another process running command flush
flow takes refcount to this command entry. The process which handles
commands flush may see this command as needed to be flushed if the other
process allocated a ent->idx but didn't set ent to cmd->ent_arr in
cmd_work_handler(). Fix it by moving the assignment of cmd->ent_arr into
the spin lock.
[70013.081955] BUG: KASAN: use-after-free in mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core]
[70013.081967] Write of size 4 at addr ffff88880b1510b4 by task kworker/26:1/1433361
[70013.081968]
[70013.082028] Workqueue: events aer_isr
[70013.082053] Call Trace:
[70013.082067] dump_stack+0x8b/0xbb
[70013.082086] print_address_description+0x6a/0x270
[70013.082102] kasan_report+0x179/0x2c0
[70013.082173] mlx5_cmd_trigger_completions+0x1e2/0x4c0 [mlx5_core]
[70013.082267] mlx5_cmd_flush+0x80/0x180 [mlx5_core]
[70013.082304] mlx5_enter_error_state+0x106/0x1d0 [mlx5_core]
[70013.082338] mlx5_try_fast_unload+0x2ea/0x4d0 [mlx5_core]
[70013.082377] remove_one+0x200/0x2b0 [mlx5_core]
[70013.082409] pci_device_remove+0xf3/0x280
[70013.082439] device_release_driver_internal+0x1c3/0x470
[70013.082453] pci_stop_bus_device+0x109/0x160
[70013.082468] pci_stop_and_remove_bus_device+0xe/0x20
[70013.082485] pcie_do_fatal_recovery+0x167/0x550
[70013.082493] aer_isr+0x7d2/0x960
[70013.082543] process_one_work+0x65f/0x12d0
[70013.082556] worker_thread+0x87/0xb50
[70013.082571] kthread+0x2e9/0x3a0
[70013.082592] ret_from_fork+0x1f/0x40
The logical relationship of this error is as follows:
aer_recover_work | ent->work
-------------------------------------------+------------------------------
aer_recover_work_func |
|- pcie_do_recovery |
|- report_error_detected |
|- mlx5_pci_err_detected |cmd_work_handler
|- mlx5_enter_error_state | |- cmd_alloc_index
|- enter_error_state | |- lock cmd->alloc_lock
|- mlx5_cmd_flush | |- clear_bit
|- mlx5_cmd_trigger_completions| |- unlock cmd->alloc_lock
|- lock cmd->alloc_lock |
|- vector = ~dev->cmd.vars.bitmask
|- for_each_set_bit |
|- cmd_ent_get(cmd->ent_arr[i]) (UAF)
|- unlock cmd->alloc_lock | |- cmd->ent_arr[ent->idx]=ent
The cmd->ent_arr[ent->idx] assignment and the bit clearing are not
protected by the cmd->alloc_lock in cmd_work_handler().
Fixes: 50b2412b7e78 ("net/mlx5: Avoid possible free of command entry while timeout comp handler")
Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
Signed-off-by: Shifeng Li <lishifeng@sangfor.com.cn>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
index c22b0ad0c8701..7013e1c8741a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
@@ -156,15 +156,18 @@ static u8 alloc_token(struct mlx5_cmd *cmd)
return token;
}
-static int cmd_alloc_index(struct mlx5_cmd *cmd)
+static int cmd_alloc_index(struct mlx5_cmd *cmd, struct mlx5_cmd_work_ent *ent)
{
unsigned long flags;
int ret;
spin_lock_irqsave(&cmd->alloc_lock, flags);
ret = find_first_bit(&cmd->vars.bitmask, cmd->vars.max_reg_cmds);
- if (ret < cmd->vars.max_reg_cmds)
+ if (ret < cmd->vars.max_reg_cmds) {
clear_bit(ret, &cmd->vars.bitmask);
+ ent->idx = ret;
+ cmd->ent_arr[ent->idx] = ent;
+ }
spin_unlock_irqrestore(&cmd->alloc_lock, flags);
return ret < cmd->vars.max_reg_cmds ? ret : -ENOMEM;
@@ -977,7 +980,7 @@ static void cmd_work_handler(struct work_struct *work)
sem = ent->page_queue ? &cmd->vars.pages_sem : &cmd->vars.sem;
down(sem);
if (!ent->page_queue) {
- alloc_ret = cmd_alloc_index(cmd);
+ alloc_ret = cmd_alloc_index(cmd, ent);
if (alloc_ret < 0) {
mlx5_core_err_rl(dev, "failed to allocate command entry\n");
if (ent->callback) {
@@ -992,15 +995,14 @@ static void cmd_work_handler(struct work_struct *work)
up(sem);
return;
}
- ent->idx = alloc_ret;
} else {
ent->idx = cmd->vars.max_reg_cmds;
spin_lock_irqsave(&cmd->alloc_lock, flags);
clear_bit(ent->idx, &cmd->vars.bitmask);
+ cmd->ent_arr[ent->idx] = ent;
spin_unlock_irqrestore(&cmd->alloc_lock, flags);
}
- cmd->ent_arr[ent->idx] = ent;
lay = get_inst(cmd, ent->idx);
ent->lay = lay;
memset(lay, 0, sizeof(*lay));
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 034/156] net/mlx5e: fix a potential double-free in fs_udp_create_groups
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 033/156] net/mlx5e: Fix a race in command alloc flow Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 035/156] net/mlx5e: Fix overrun reported by coverity Greg Kroah-Hartman
` (130 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dinghao Liu, Tariq Toukan,
Simon Horman, Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit e75efc6466ae289e599fb12a5a86545dff245c65 ]
When kcalloc() for ft->g succeeds but kvzalloc() for in fails,
fs_udp_create_groups() will free ft->g. However, its caller
fs_udp_create_table() will free ft->g again through calling
mlx5e_destroy_flow_table(), which will lead to a double-free.
Fix this by setting ft->g to NULL in fs_udp_create_groups().
Fixes: 1c80bd684388 ("net/mlx5e: Introduce Flow Steering UDP API")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
index be83ad9db82a4..e1283531e0b81 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/fs_tt_redirect.c
@@ -154,6 +154,7 @@ static int fs_udp_create_groups(struct mlx5e_flow_table *ft, enum fs_udp_type ty
in = kvzalloc(inlen, GFP_KERNEL);
if (!in || !ft->g) {
kfree(ft->g);
+ ft->g = NULL;
kvfree(in);
return -ENOMEM;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 035/156] net/mlx5e: Fix overrun reported by coverity
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 034/156] net/mlx5e: fix a potential double-free in fs_udp_create_groups Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 036/156] net/mlx5e: Decrease num_block_tc when unblock tc offload Greg Kroah-Hartman
` (129 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jianbo Liu, Roi Dayan,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jianbo Liu <jianbol@nvidia.com>
[ Upstream commit da75fa542873e5f7d7f615566c0b00042d8a0437 ]
Coverity Scan reports the following issue. But it's impossible that
mlx5_get_dev_index returns 7 for PF, even if the index is calculated
from PCI FUNC ID. So add the checking to make coverity slience.
CID 610894 (#2 of 2): Out-of-bounds write (OVERRUN)
Overrunning array esw->fdb_table.offloads.peer_miss_rules of 4 8-byte
elements at element index 7 (byte offset 63) using index
mlx5_get_dev_index(peer_dev) (which evaluates to 7).
Fixes: 9bee385a6e39 ("net/mlx5: E-switch, refactor FDB miss rule add/remove")
Signed-off-by: Jianbo Liu <jianbol@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index bb8bcb448ae90..9bd5609cf6597 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -1177,9 +1177,9 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw,
struct mlx5_flow_handle *flow;
struct mlx5_flow_spec *spec;
struct mlx5_vport *vport;
+ int err, pfindex;
unsigned long i;
void *misc;
- int err;
if (!MLX5_VPORT_MANAGER(esw->dev) && !mlx5_core_is_ecpf_esw_manager(esw->dev))
return 0;
@@ -1255,7 +1255,15 @@ static int esw_add_fdb_peer_miss_rules(struct mlx5_eswitch *esw,
flows[vport->index] = flow;
}
}
- esw->fdb_table.offloads.peer_miss_rules[mlx5_get_dev_index(peer_dev)] = flows;
+
+ pfindex = mlx5_get_dev_index(peer_dev);
+ if (pfindex >= MLX5_MAX_PORTS) {
+ esw_warn(esw->dev, "Peer dev index(%d) is over the max num defined(%d)\n",
+ pfindex, MLX5_MAX_PORTS);
+ err = -EINVAL;
+ goto add_ec_vf_flow_err;
+ }
+ esw->fdb_table.offloads.peer_miss_rules[pfindex] = flows;
kvfree(spec);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 036/156] net/mlx5e: Decrease num_block_tc when unblock tc offload
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 035/156] net/mlx5e: Fix overrun reported by coverity Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 037/156] net/mlx5e: XDP, Drop fragmented packets larger than MTU size Greg Kroah-Hartman
` (128 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Mi, Jianbo Liu, Saeed Mahameed,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Mi <cmi@nvidia.com>
[ Upstream commit be86106fd74a145f24c56c9bc18d658e8fe6d4f4 ]
The cited commit increases num_block_tc when unblock tc offload.
Actually should decrease it.
Fixes: c8e350e62fc5 ("net/mlx5e: Make TC and IPsec offloads mutually exclusive on a netdev")
Signed-off-by: Chris Mi <cmi@nvidia.com>
Reviewed-by: Jianbo Liu <jianbol@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
index 03f69c485a006..81e6aa6434cf2 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/ipsec_fs.c
@@ -1866,7 +1866,7 @@ static int mlx5e_ipsec_block_tc_offload(struct mlx5_core_dev *mdev)
static void mlx5e_ipsec_unblock_tc_offload(struct mlx5_core_dev *mdev)
{
- mdev->num_block_tc++;
+ mdev->num_block_tc--;
}
int mlx5e_accel_ipsec_fs_add_rule(struct mlx5e_ipsec_sa_entry *sa_entry)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 037/156] net/mlx5e: XDP, Drop fragmented packets larger than MTU size
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 036/156] net/mlx5e: Decrease num_block_tc when unblock tc offload Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 038/156] net/mlx5: Fix fw tracer first block check Greg Kroah-Hartman
` (127 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Carolina Jubran, Tariq Toukan,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carolina Jubran <cjubran@nvidia.com>
[ Upstream commit bcaf109f794744c14da0e9123b31d1f4571b0a35 ]
XDP transmits fragmented packets that are larger than MTU size instead of
dropping those packets. The drop check that checks whether a packet is larger
than MTU is comparing MTU size against the linear part length only.
Adjust the drop check to compare MTU size against both linear and non-linear
part lengths to avoid transmitting fragmented packets larger than MTU size.
Fixes: 39a1665d16a2 ("net/mlx5e: Implement sending multi buffer XDP frames")
Signed-off-by: Carolina Jubran <cjubran@nvidia.com>
Reviewed-by: Tariq Toukan <tariqt@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
index 8bed17d8fe564..b723ff5e5249c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c
@@ -493,6 +493,7 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd,
dma_addr_t dma_addr = xdptxd->dma_addr;
u32 dma_len = xdptxd->len;
u16 ds_cnt, inline_hdr_sz;
+ unsigned int frags_size;
u8 num_wqebbs = 1;
int num_frags = 0;
bool inline_ok;
@@ -503,8 +504,9 @@ mlx5e_xmit_xdp_frame(struct mlx5e_xdpsq *sq, struct mlx5e_xmit_data *xdptxd,
inline_ok = sq->min_inline_mode == MLX5_INLINE_MODE_NONE ||
dma_len >= MLX5E_XDP_MIN_INLINE;
+ frags_size = xdptxd->has_frags ? xdptxdf->sinfo->xdp_frags_size : 0;
- if (unlikely(!inline_ok || sq->hw_mtu < dma_len)) {
+ if (unlikely(!inline_ok || sq->hw_mtu < dma_len + frags_size)) {
stats->err++;
return false;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 038/156] net/mlx5: Fix fw tracer first block check
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 037/156] net/mlx5e: XDP, Drop fragmented packets larger than MTU size Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 039/156] net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Greg Kroah-Hartman
` (126 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Moshe Shemesh, Feras Daoud,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Moshe Shemesh <moshe@nvidia.com>
[ Upstream commit 4261edf11cb7c9224af713a102e5616329306932 ]
While handling new traces, to verify it is not the first block being
written, last_timestamp is checked. But instead of checking it is non
zero it is verified to be zero. Fix to verify last_timestamp is not
zero.
Fixes: c71ad41ccb0c ("net/mlx5: FW tracer, events handling")
Signed-off-by: Moshe Shemesh <moshe@nvidia.com>
Reviewed-by: Feras Daoud <ferasda@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
index ad789349c06e6..85d3bfa0780c6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/diag/fw_tracer.c
@@ -718,7 +718,7 @@ static void mlx5_fw_tracer_handle_traces(struct work_struct *work)
while (block_timestamp > tracer->last_timestamp) {
/* Check block override if it's not the first block */
- if (!tracer->last_timestamp) {
+ if (tracer->last_timestamp) {
u64 *ts_event;
/* To avoid block override be the HW in case of buffer
* wraparound, the time stamp of the previous block
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 039/156] net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 038/156] net/mlx5: Fix fw tracer first block check Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 040/156] net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() Greg Kroah-Hartman
` (125 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vlad Buslov, Roi Dayan,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vlad Buslov <vladbu@nvidia.com>
[ Upstream commit 04ad04e4fdd10f92ef4f2b3f6227ec9824682197 ]
Currently the destination rep pointer is only used for comparisons or to
obtain vport number from it. Since it is used both during flow creation and
deletion it may point to representor of another eswitch instance which can
be deallocated during driver unload even when there are rules pointing to
it[0]. Refactor the code to store vport number and 'valid' flag instead of
the representor pointer.
[0]:
[176805.886303] ==================================================================
[176805.889433] BUG: KASAN: slab-use-after-free in esw_cleanup_dests+0x390/0x440 [mlx5_core]
[176805.892981] Read of size 2 at addr ffff888155090aa0 by task modprobe/27280
[176805.895462] CPU: 3 PID: 27280 Comm: modprobe Tainted: G B 6.6.0-rc3+ #1
[176805.896771] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014
[176805.898514] Call Trace:
[176805.899026] <TASK>
[176805.899519] dump_stack_lvl+0x33/0x50
[176805.900221] print_report+0xc2/0x610
[176805.900893] ? mlx5_chains_put_table+0x33d/0x8d0 [mlx5_core]
[176805.901897] ? esw_cleanup_dests+0x390/0x440 [mlx5_core]
[176805.902852] kasan_report+0xac/0xe0
[176805.903509] ? esw_cleanup_dests+0x390/0x440 [mlx5_core]
[176805.904461] esw_cleanup_dests+0x390/0x440 [mlx5_core]
[176805.905223] __mlx5_eswitch_del_rule+0x1ae/0x460 [mlx5_core]
[176805.906044] ? esw_cleanup_dests+0x440/0x440 [mlx5_core]
[176805.906822] ? xas_find_conflict+0x420/0x420
[176805.907496] ? down_read+0x11e/0x200
[176805.908046] mlx5e_tc_rule_unoffload+0xc4/0x2a0 [mlx5_core]
[176805.908844] mlx5e_tc_del_fdb_flow+0x7da/0xb10 [mlx5_core]
[176805.909597] mlx5e_flow_put+0x4b/0x80 [mlx5_core]
[176805.910275] mlx5e_delete_flower+0x5b4/0xb70 [mlx5_core]
[176805.911010] tc_setup_cb_reoffload+0x27/0xb0
[176805.911648] fl_reoffload+0x62d/0x900 [cls_flower]
[176805.912313] ? mlx5e_rep_indr_block_unbind+0xd0/0xd0 [mlx5_core]
[176805.913151] ? __fl_put+0x230/0x230 [cls_flower]
[176805.913768] ? filter_irq_stacks+0x90/0x90
[176805.914335] ? kasan_save_stack+0x1e/0x40
[176805.914893] ? kasan_set_track+0x21/0x30
[176805.915484] ? kasan_save_free_info+0x27/0x40
[176805.916105] tcf_block_playback_offloads+0x79/0x1f0
[176805.916773] ? mlx5e_rep_indr_block_unbind+0xd0/0xd0 [mlx5_core]
[176805.917647] tcf_block_unbind+0x12d/0x330
[176805.918239] tcf_block_offload_cmd.isra.0+0x24e/0x320
[176805.918953] ? tcf_block_bind+0x770/0x770
[176805.919551] ? _raw_read_unlock_irqrestore+0x30/0x30
[176805.920236] ? mutex_lock+0x7d/0xd0
[176805.920735] ? mutex_unlock+0x80/0xd0
[176805.921255] tcf_block_offload_unbind+0xa5/0x120
[176805.921909] __tcf_block_put+0xc2/0x2d0
[176805.922467] ingress_destroy+0xf4/0x3d0 [sch_ingress]
[176805.923178] __qdisc_destroy+0x9d/0x280
[176805.923741] dev_shutdown+0x1c6/0x330
[176805.924295] unregister_netdevice_many_notify+0x6ef/0x1500
[176805.925034] ? netdev_freemem+0x50/0x50
[176805.925610] ? _raw_spin_lock_irq+0x7b/0xd0
[176805.926235] ? _raw_spin_lock_bh+0xe0/0xe0
[176805.926849] unregister_netdevice_queue+0x1e0/0x280
[176805.927592] ? unregister_netdevice_many+0x10/0x10
[176805.928275] unregister_netdev+0x18/0x20
[176805.928835] mlx5e_vport_rep_unload+0xc0/0x200 [mlx5_core]
[176805.929608] mlx5_esw_offloads_unload_rep+0x9d/0xc0 [mlx5_core]
[176805.930492] mlx5_eswitch_unload_vf_vports+0x108/0x1a0 [mlx5_core]
[176805.931422] ? mlx5_eswitch_unload_sf_vport+0x50/0x50 [mlx5_core]
[176805.932304] ? rwsem_down_write_slowpath+0x11f0/0x11f0
[176805.932987] mlx5_eswitch_disable_sriov+0x6f9/0xa60 [mlx5_core]
[176805.933807] ? mlx5_core_disable_hca+0xe1/0x130 [mlx5_core]
[176805.934576] ? mlx5_eswitch_disable_locked+0x580/0x580 [mlx5_core]
[176805.935463] mlx5_device_disable_sriov+0x138/0x490 [mlx5_core]
[176805.936308] mlx5_sriov_disable+0x8c/0xb0 [mlx5_core]
[176805.937063] remove_one+0x7f/0x210 [mlx5_core]
[176805.937711] pci_device_remove+0x96/0x1c0
[176805.938289] device_release_driver_internal+0x361/0x520
[176805.938981] ? kobject_put+0x5c/0x330
[176805.939553] driver_detach+0xd7/0x1d0
[176805.940101] bus_remove_driver+0x11f/0x290
[176805.943847] pci_unregister_driver+0x23/0x1f0
[176805.944505] mlx5_cleanup+0xc/0x20 [mlx5_core]
[176805.945189] __x64_sys_delete_module+0x2b3/0x450
[176805.945837] ? module_flags+0x300/0x300
[176805.946377] ? dput+0xc2/0x830
[176805.946848] ? __kasan_record_aux_stack+0x9c/0xb0
[176805.947555] ? __call_rcu_common.constprop.0+0x46c/0xb50
[176805.948338] ? fpregs_assert_state_consistent+0x1d/0xa0
[176805.949055] ? exit_to_user_mode_prepare+0x30/0x120
[176805.949713] do_syscall_64+0x3d/0x90
[176805.950226] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[176805.950904] RIP: 0033:0x7f7f42c3f5ab
[176805.951462] Code: 73 01 c3 48 8b 0d 75 a8 1b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 45 a8 1b 00 f7 d8 64 89 01 48
[176805.953710] RSP: 002b:00007fff07dc9d08 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0
[176805.954691] RAX: ffffffffffffffda RBX: 000055b6e91c01e0 RCX: 00007f7f42c3f5ab
[176805.955691] RDX: 0000000000000000 RSI: 0000000000000800 RDI: 000055b6e91c0248
[176805.956662] RBP: 000055b6e91c01e0 R08: 0000000000000000 R09: 0000000000000000
[176805.957601] R10: 00007f7f42d9eac0 R11: 0000000000000206 R12: 000055b6e91c0248
[176805.958593] R13: 0000000000000000 R14: 000055b6e91bfb38 R15: 0000000000000000
[176805.959599] </TASK>
[176805.960324] Allocated by task 20490:
[176805.960893] kasan_save_stack+0x1e/0x40
[176805.961463] kasan_set_track+0x21/0x30
[176805.962019] __kasan_kmalloc+0x77/0x90
[176805.962554] esw_offloads_init+0x1bb/0x480 [mlx5_core]
[176805.963318] mlx5_eswitch_init+0xc70/0x15c0 [mlx5_core]
[176805.964092] mlx5_init_one_devl_locked+0x366/0x1230 [mlx5_core]
[176805.964902] probe_one+0x6f7/0xc90 [mlx5_core]
[176805.965541] local_pci_probe+0xd7/0x180
[176805.966075] pci_device_probe+0x231/0x6f0
[176805.966631] really_probe+0x1d4/0xb50
[176805.967179] __driver_probe_device+0x18d/0x450
[176805.967810] driver_probe_device+0x49/0x120
[176805.968431] __driver_attach+0x1fb/0x490
[176805.968976] bus_for_each_dev+0xed/0x170
[176805.969560] bus_add_driver+0x21a/0x570
[176805.970124] driver_register+0x133/0x460
[176805.970684] 0xffffffffa0678065
[176805.971180] do_one_initcall+0x92/0x2b0
[176805.971744] do_init_module+0x22d/0x720
[176805.972318] load_module+0x58c3/0x63b0
[176805.972847] init_module_from_file+0xd2/0x130
[176805.973441] __x64_sys_finit_module+0x389/0x7c0
[176805.974045] do_syscall_64+0x3d/0x90
[176805.974556] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[176805.975566] Freed by task 27280:
[176805.976077] kasan_save_stack+0x1e/0x40
[176805.976655] kasan_set_track+0x21/0x30
[176805.977221] kasan_save_free_info+0x27/0x40
[176805.977834] ____kasan_slab_free+0x11a/0x1b0
[176805.978505] __kmem_cache_free+0x163/0x2d0
[176805.979113] esw_offloads_cleanup_reps+0xb8/0x120 [mlx5_core]
[176805.979963] mlx5_eswitch_cleanup+0x182/0x270 [mlx5_core]
[176805.980763] mlx5_cleanup_once+0x9a/0x1e0 [mlx5_core]
[176805.981477] mlx5_uninit_one+0xa9/0x180 [mlx5_core]
[176805.982196] remove_one+0x8f/0x210 [mlx5_core]
[176805.982868] pci_device_remove+0x96/0x1c0
[176805.983461] device_release_driver_internal+0x361/0x520
[176805.984169] driver_detach+0xd7/0x1d0
[176805.984702] bus_remove_driver+0x11f/0x290
[176805.985261] pci_unregister_driver+0x23/0x1f0
[176805.985847] mlx5_cleanup+0xc/0x20 [mlx5_core]
[176805.986483] __x64_sys_delete_module+0x2b3/0x450
[176805.987126] do_syscall_64+0x3d/0x90
[176805.987665] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[176805.988667] Last potentially related work creation:
[176805.989305] kasan_save_stack+0x1e/0x40
[176805.989839] __kasan_record_aux_stack+0x9c/0xb0
[176805.990443] kvfree_call_rcu+0x84/0xa30
[176805.990973] clean_xps_maps+0x265/0x6e0
[176805.991547] netif_reset_xps_queues.part.0+0x3f/0x80
[176805.992226] unregister_netdevice_many_notify+0xfcf/0x1500
[176805.992966] unregister_netdevice_queue+0x1e0/0x280
[176805.993638] unregister_netdev+0x18/0x20
[176805.994205] mlx5e_remove+0xba/0x1e0 [mlx5_core]
[176805.994872] auxiliary_bus_remove+0x52/0x70
[176805.995490] device_release_driver_internal+0x361/0x520
[176805.996196] bus_remove_device+0x1e1/0x3d0
[176805.996767] device_del+0x390/0x980
[176805.997270] mlx5_rescan_drivers_locked.part.0+0x130/0x540 [mlx5_core]
[176805.998195] mlx5_unregister_device+0x77/0xc0 [mlx5_core]
[176805.998989] mlx5_uninit_one+0x41/0x180 [mlx5_core]
[176805.999719] remove_one+0x8f/0x210 [mlx5_core]
[176806.000387] pci_device_remove+0x96/0x1c0
[176806.000938] device_release_driver_internal+0x361/0x520
[176806.001612] unbind_store+0xd8/0xf0
[176806.002108] kernfs_fop_write_iter+0x2c0/0x440
[176806.002748] vfs_write+0x725/0xba0
[176806.003294] ksys_write+0xed/0x1c0
[176806.003823] do_syscall_64+0x3d/0x90
[176806.004357] entry_SYSCALL_64_after_hwframe+0x46/0xb0
[176806.005317] The buggy address belongs to the object at ffff888155090a80
which belongs to the cache kmalloc-64 of size 64
[176806.006774] The buggy address is located 32 bytes inside of
freed 64-byte region [ffff888155090a80, ffff888155090ac0)
[176806.008773] The buggy address belongs to the physical page:
[176806.009480] page:00000000a407e0e6 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155090
[176806.010633] flags: 0x200000000000800(slab|node=0|zone=2)
[176806.011352] page_type: 0xffffffff()
[176806.011905] raw: 0200000000000800 ffff888100042640 ffffea000422b1c0 dead000000000004
[176806.012949] raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
[176806.013933] page dumped because: kasan: bad access detected
[176806.014935] Memory state around the buggy address:
[176806.015601] ffff888155090980: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[176806.016568] ffff888155090a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[176806.017497] >ffff888155090a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[176806.018438] ^
[176806.019007] ffff888155090b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[176806.020001] ffff888155090b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[176806.020996] ==================================================================
Fixes: a508728a4c8b ("net/mlx5e: VF tunnel RX traffic offloading")
Signed-off-by: Vlad Buslov <vladbu@nvidia.com>
Reviewed-by: Roi Dayan <roid@nvidia.com>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlx5/core/en/tc/act/mirred.c | 5 +++--
.../mellanox/mlx5/core/en/tc_tun_encap.c | 3 ++-
.../net/ethernet/mellanox/mlx5/core/eswitch.h | 3 ++-
.../mellanox/mlx5/core/eswitch_offloads.c | 19 +++++++++----------
.../mlx5/core/eswitch_offloads_termtbl.c | 4 ++--
5 files changed, 18 insertions(+), 16 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c
index f63402c480280..1b418095b79a3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/mirred.c
@@ -197,7 +197,7 @@ parse_mirred_encap(struct mlx5e_tc_act_parse_state *parse_state,
}
esw_attr->dests[esw_attr->out_count].flags |= MLX5_ESW_DEST_ENCAP;
esw_attr->out_count++;
- /* attr->dests[].rep is resolved when we handle encap */
+ /* attr->dests[].vport is resolved when we handle encap */
return 0;
}
@@ -270,7 +270,8 @@ parse_mirred(struct mlx5e_tc_act_parse_state *parse_state,
out_priv = netdev_priv(out_dev);
rpriv = out_priv->ppriv;
- esw_attr->dests[esw_attr->out_count].rep = rpriv->rep;
+ esw_attr->dests[esw_attr->out_count].vport_valid = true;
+ esw_attr->dests[esw_attr->out_count].vport = rpriv->rep->vport;
esw_attr->dests[esw_attr->out_count].mdev = out_priv->mdev;
esw_attr->out_count++;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
index b10e40e1a9c14..f1d1e1542e81b 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en/tc_tun_encap.c
@@ -1064,7 +1064,8 @@ int mlx5e_tc_tun_encap_dests_set(struct mlx5e_priv *priv,
out_priv = netdev_priv(encap_dev);
rpriv = out_priv->ppriv;
- esw_attr->dests[out_index].rep = rpriv->rep;
+ esw_attr->dests[out_index].vport_valid = true;
+ esw_attr->dests[out_index].vport = rpriv->rep->vport;
esw_attr->dests[out_index].mdev = out_priv->mdev;
}
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
index b674b57d05aad..b4eb17141edf3 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h
@@ -526,7 +526,8 @@ struct mlx5_esw_flow_attr {
u8 total_vlan;
struct {
u32 flags;
- struct mlx5_eswitch_rep *rep;
+ bool vport_valid;
+ u16 vport;
struct mlx5_pkt_reformat *pkt_reformat;
struct mlx5_core_dev *mdev;
struct mlx5_termtbl_handle *termtbl;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
index 9bd5609cf6597..b0455134c98ef 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c
@@ -287,10 +287,9 @@ static void esw_put_dest_tables_loop(struct mlx5_eswitch *esw, struct mlx5_flow_
for (i = from; i < to; i++)
if (esw_attr->dests[i].flags & MLX5_ESW_DEST_CHAIN_WITH_SRC_PORT_CHANGE)
mlx5_chains_put_table(chains, 0, 1, 0);
- else if (mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].rep->vport,
+ else if (mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].vport,
esw_attr->dests[i].mdev))
- mlx5_esw_indir_table_put(esw, esw_attr->dests[i].rep->vport,
- false);
+ mlx5_esw_indir_table_put(esw, esw_attr->dests[i].vport, false);
}
static bool
@@ -358,8 +357,8 @@ esw_is_indir_table(struct mlx5_eswitch *esw, struct mlx5_flow_attr *attr)
* this criteria.
*/
for (i = esw_attr->split_count; i < esw_attr->out_count; i++) {
- if (esw_attr->dests[i].rep &&
- mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].rep->vport,
+ if (esw_attr->dests[i].vport_valid &&
+ mlx5_esw_indir_table_needed(esw, attr, esw_attr->dests[i].vport,
esw_attr->dests[i].mdev)) {
result = true;
} else {
@@ -388,7 +387,7 @@ esw_setup_indir_table(struct mlx5_flow_destination *dest,
dest[*i].type = MLX5_FLOW_DESTINATION_TYPE_FLOW_TABLE;
dest[*i].ft = mlx5_esw_indir_table_get(esw, attr,
- esw_attr->dests[j].rep->vport, false);
+ esw_attr->dests[j].vport, false);
if (IS_ERR(dest[*i].ft)) {
err = PTR_ERR(dest[*i].ft);
goto err_indir_tbl_get;
@@ -432,11 +431,11 @@ static bool esw_setup_uplink_fwd_ipsec_needed(struct mlx5_eswitch *esw,
int attr_idx)
{
if (esw->offloads.ft_ipsec_tx_pol &&
- esw_attr->dests[attr_idx].rep &&
- esw_attr->dests[attr_idx].rep->vport == MLX5_VPORT_UPLINK &&
+ esw_attr->dests[attr_idx].vport_valid &&
+ esw_attr->dests[attr_idx].vport == MLX5_VPORT_UPLINK &&
/* To be aligned with software, encryption is needed only for tunnel device */
(esw_attr->dests[attr_idx].flags & MLX5_ESW_DEST_ENCAP_VALID) &&
- esw_attr->dests[attr_idx].rep != esw_attr->in_rep &&
+ esw_attr->dests[attr_idx].vport != esw_attr->in_rep->vport &&
esw_same_vhca_id(esw_attr->dests[attr_idx].mdev, esw->dev))
return true;
@@ -469,7 +468,7 @@ esw_setup_dest_fwd_vport(struct mlx5_flow_destination *dest, struct mlx5_flow_ac
int attr_idx, int dest_idx, bool pkt_reformat)
{
dest[dest_idx].type = MLX5_FLOW_DESTINATION_TYPE_VPORT;
- dest[dest_idx].vport.num = esw_attr->dests[attr_idx].rep->vport;
+ dest[dest_idx].vport.num = esw_attr->dests[attr_idx].vport;
if (MLX5_CAP_ESW(esw->dev, merged_eswitch)) {
dest[dest_idx].vport.vhca_id =
MLX5_CAP_GEN(esw_attr->dests[attr_idx].mdev, vhca_id);
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
index edd9102583144..40bdc677f051d 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads_termtbl.c
@@ -233,8 +233,8 @@ mlx5_eswitch_termtbl_required(struct mlx5_eswitch *esw,
/* hairpin */
for (i = esw_attr->split_count; i < esw_attr->out_count; i++)
- if (!esw_attr->dest_int_port && esw_attr->dests[i].rep &&
- esw_attr->dests[i].rep->vport == MLX5_VPORT_UPLINK)
+ if (!esw_attr->dest_int_port && esw_attr->dests[i].vport_valid &&
+ esw_attr->dests[i].vport == MLX5_VPORT_UPLINK)
return true;
return false;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 040/156] net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 039/156] net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 041/156] net/mlx5e: Fix error codes in alloc_branch_attr() Greg Kroah-Hartman
` (124 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Saeed Mahameed,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit 86d5922679f3b6d02a64df66cdd777fdd4ea5c0d ]
Preserve the error code if esw_add_restore_rule() fails. Don't return
success.
Fixes: 6702782845a5 ("net/mlx5e: TC, Set CT miss to the specific ct action instance")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 1bead98f73bf5..2cfbacf77535c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -5734,8 +5734,10 @@ int mlx5e_tc_action_miss_mapping_get(struct mlx5e_priv *priv, struct mlx5_flow_a
esw = priv->mdev->priv.eswitch;
attr->act_id_restore_rule = esw_add_restore_rule(esw, *act_miss_mapping);
- if (IS_ERR(attr->act_id_restore_rule))
+ if (IS_ERR(attr->act_id_restore_rule)) {
+ err = PTR_ERR(attr->act_id_restore_rule);
goto err_rule;
+ }
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 041/156] net/mlx5e: Fix error codes in alloc_branch_attr()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 040/156] net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 042/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer Greg Kroah-Hartman
` (123 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Saeed Mahameed,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit d792e5f7f19b95f5ce41ac49df5ead4d280238f4 ]
Set the error code if set_branch_dest_ft() fails.
Fixes: ccbe33003b10 ("net/mlx5e: TC, Don't offload post action rule if not supported")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
index 2cfbacf77535c..25e44ee5121a9 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
@@ -3776,7 +3776,8 @@ alloc_branch_attr(struct mlx5e_tc_flow *flow,
break;
case FLOW_ACTION_ACCEPT:
case FLOW_ACTION_PIPE:
- if (set_branch_dest_ft(flow->priv, attr))
+ err = set_branch_dest_ft(flow->priv, attr);
+ if (err)
goto out_err;
break;
case FLOW_ACTION_JUMP:
@@ -3786,7 +3787,8 @@ alloc_branch_attr(struct mlx5e_tc_flow *flow,
goto out_err;
}
*jump_count = cond->extval;
- if (set_branch_dest_ft(flow->priv, attr))
+ err = set_branch_dest_ft(flow->priv, attr);
+ if (err)
goto out_err;
break;
default:
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 042/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 041/156] net/mlx5e: Fix error codes in alloc_branch_attr() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 043/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Greg Kroah-Hartman
` (122 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Laight, Rahul Rameshbabu,
Simon Horman, Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
[ Upstream commit ad436b9c1270c40554e274f067f1b78fcc06a004 ]
snprintf returns the length of the formatted string, excluding the trailing
null, without accounting for truncation. This means that is the return
value is greater than or equal to the size parameter, the fw_version string
was truncated.
Reported-by: David Laight <David.Laight@ACULAB.COM>
Closes: https://lore.kernel.org/netdev/81cae734ee1b4cde9b380a9a31006c1a@AcuMS.aculab.com/
Link: https://docs.kernel.org/core-api/kernel-api.html#c.snprintf
Fixes: 41e63c2baa11 ("net/mlx5e: Check return value of snprintf writing to fw_version buffer")
Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
index 7c66bd73ddfa2..38263d5c98b34 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c
@@ -49,7 +49,7 @@ void mlx5e_ethtool_get_drvinfo(struct mlx5e_priv *priv,
count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
"%d.%d.%04d (%.16s)", fw_rev_maj(mdev),
fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id);
- if (count == sizeof(drvinfo->fw_version))
+ if (count >= sizeof(drvinfo->fw_version))
snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
"%d.%d.%04d", fw_rev_maj(mdev),
fw_rev_min(mdev), fw_rev_sub(mdev));
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 043/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 042/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 044/156] net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above Greg Kroah-Hartman
` (121 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rahul Rameshbabu, Simon Horman,
Saeed Mahameed, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rahul Rameshbabu <rrameshbabu@nvidia.com>
[ Upstream commit b13559b76157de9d74f04d3ca0e49d69de3b5675 ]
snprintf returns the length of the formatted string, excluding the trailing
null, without accounting for truncation. This means that is the return
value is greater than or equal to the size parameter, the fw_version string
was truncated.
Link: https://docs.kernel.org/core-api/kernel-api.html#c.snprintf
Fixes: 1b2bd0c0264f ("net/mlx5e: Check return value of snprintf writing to fw_version buffer for representors")
Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Saeed Mahameed <saeedm@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
index 007cb167cabc9..751d3ffcd2f6c 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
@@ -78,7 +78,7 @@ static void mlx5e_rep_get_drvinfo(struct net_device *dev,
count = snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
"%d.%d.%04d (%.16s)", fw_rev_maj(mdev),
fw_rev_min(mdev), fw_rev_sub(mdev), mdev->board_id);
- if (count == sizeof(drvinfo->fw_version))
+ if (count >= sizeof(drvinfo->fw_version))
snprintf(drvinfo->fw_version, sizeof(drvinfo->fw_version),
"%d.%d.%04d", fw_rev_maj(mdev),
fw_rev_min(mdev), fw_rev_sub(mdev));
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 044/156] net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 043/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 045/156] net: mscc: ocelot: fix pMAC " Greg Kroah-Hartman
` (120 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 52eda4641d041667fa059f4855c5f88dcebd8afe ]
There is a typo in the driver due to which we report incorrect TX RMON
counters for the 256-511 octet bucket and all the other buckets larger
than that.
Bug found with the selftest at
https://patchwork.kernel.org/project/netdevbpf/patch/20231211223346.2497157-9-tobias@waldekranz.com/
Fixes: e32036e1ae7b ("net: mscc: ocelot: add support for all sorts of standardized counters present in DSA")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231214000902.545625-1-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mscc/ocelot_stats.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c
index 5c55197c7327d..f29fa37263dae 100644
--- a/drivers/net/ethernet/mscc/ocelot_stats.c
+++ b/drivers/net/ethernet/mscc/ocelot_stats.c
@@ -582,10 +582,10 @@ static void ocelot_port_rmon_stats_cb(struct ocelot *ocelot, int port, void *pri
rmon_stats->hist_tx[0] = s[OCELOT_STAT_TX_64];
rmon_stats->hist_tx[1] = s[OCELOT_STAT_TX_65_127];
rmon_stats->hist_tx[2] = s[OCELOT_STAT_TX_128_255];
- rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_128_255];
- rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_256_511];
- rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_512_1023];
- rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_1024_1526];
+ rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_256_511];
+ rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_512_1023];
+ rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_1024_1526];
+ rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_1527_MAX];
}
static void ocelot_port_pmac_rmon_stats_cb(struct ocelot *ocelot, int port,
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 045/156] net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 044/156] net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 046/156] octeontx2-pf: Fix graceful exit during PFC configuration failure Greg Kroah-Hartman
` (119 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Oltean, Florian Fainelli,
Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Oltean <vladimir.oltean@nxp.com>
[ Upstream commit 70f010da00f90415296f93fb47a561977eae41cb ]
The typo from ocelot_port_rmon_stats_cb() was also carried over to
ocelot_port_pmac_rmon_stats_cb() as well, leading to incorrect TX RMON
stats for the pMAC too.
Fixes: ab3f97a9610a ("net: mscc: ocelot: export ethtool MAC Merge stats for Felix VSC9959")
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Link: https://lore.kernel.org/r/20231214000902.545625-2-vladimir.oltean@nxp.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mscc/ocelot_stats.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mscc/ocelot_stats.c b/drivers/net/ethernet/mscc/ocelot_stats.c
index f29fa37263dae..c018783757fb2 100644
--- a/drivers/net/ethernet/mscc/ocelot_stats.c
+++ b/drivers/net/ethernet/mscc/ocelot_stats.c
@@ -610,10 +610,10 @@ static void ocelot_port_pmac_rmon_stats_cb(struct ocelot *ocelot, int port,
rmon_stats->hist_tx[0] = s[OCELOT_STAT_TX_PMAC_64];
rmon_stats->hist_tx[1] = s[OCELOT_STAT_TX_PMAC_65_127];
rmon_stats->hist_tx[2] = s[OCELOT_STAT_TX_PMAC_128_255];
- rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_PMAC_128_255];
- rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_PMAC_256_511];
- rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_PMAC_512_1023];
- rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_PMAC_1024_1526];
+ rmon_stats->hist_tx[3] = s[OCELOT_STAT_TX_PMAC_256_511];
+ rmon_stats->hist_tx[4] = s[OCELOT_STAT_TX_PMAC_512_1023];
+ rmon_stats->hist_tx[5] = s[OCELOT_STAT_TX_PMAC_1024_1526];
+ rmon_stats->hist_tx[6] = s[OCELOT_STAT_TX_PMAC_1527_MAX];
}
void ocelot_port_get_rmon_stats(struct ocelot *ocelot, int port,
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 046/156] octeontx2-pf: Fix graceful exit during PFC configuration failure
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 045/156] net: mscc: ocelot: fix pMAC " Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 047/156] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Greg Kroah-Hartman
` (118 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Suman Ghosh, David S. Miller,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Suman Ghosh <sumang@marvell.com>
[ Upstream commit 8c97ab5448f2096daba11edf8d18a44e1eb6f31d ]
During PFC configuration failure the code was not handling a graceful
exit. This patch fixes the same and add proper code for a graceful exit.
Fixes: 99c969a83d82 ("octeontx2-pf: Add egress PFC support")
Signed-off-by: Suman Ghosh <sumang@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 17 ++++++++++++++---
1 file changed, 14 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
index bfddbff7bcdfb..28fb643d2917f 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_dcbnl.c
@@ -399,9 +399,10 @@ static int otx2_dcbnl_ieee_getpfc(struct net_device *dev, struct ieee_pfc *pfc)
static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc)
{
struct otx2_nic *pfvf = netdev_priv(dev);
+ u8 old_pfc_en;
int err;
- /* Save PFC configuration to interface */
+ old_pfc_en = pfvf->pfc_en;
pfvf->pfc_en = pfc->pfc_en;
if (pfvf->hw.tx_queues >= NIX_PF_PFC_PRIO_MAX)
@@ -411,13 +412,17 @@ static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc)
* supported by the tx queue configuration
*/
err = otx2_check_pfc_config(pfvf);
- if (err)
+ if (err) {
+ pfvf->pfc_en = old_pfc_en;
return err;
+ }
process_pfc:
err = otx2_config_priority_flow_ctrl(pfvf);
- if (err)
+ if (err) {
+ pfvf->pfc_en = old_pfc_en;
return err;
+ }
/* Request Per channel Bpids */
if (pfc->pfc_en)
@@ -425,6 +430,12 @@ static int otx2_dcbnl_ieee_setpfc(struct net_device *dev, struct ieee_pfc *pfc)
err = otx2_pfc_txschq_update(pfvf);
if (err) {
+ if (pfc->pfc_en)
+ otx2_nix_config_bp(pfvf, false);
+
+ otx2_pfc_txschq_stop(pfvf);
+ pfvf->pfc_en = old_pfc_en;
+ otx2_config_priority_flow_ctrl(pfvf);
dev_err(pfvf->dev, "%s failed to update TX schedulers\n", __func__);
return err;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 047/156] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 046/156] octeontx2-pf: Fix graceful exit during PFC configuration failure Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 048/156] net: sched: ife: fix potential use-after-free Greg Kroah-Hartman
` (117 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shigeru Yoshida, Kuniyuki Iwashima,
syzbot+c71bc336c5061153b502, Eric Dumazet, syzbot,
David S. Miller, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shigeru Yoshida <syoshida@redhat.com>
[ Upstream commit cac23b7d7627915d967ce25436d7aae26e88ed06 ]
The following NULL pointer dereference issue occurred:
BUG: kernel NULL pointer dereference, address: 0000000000000000
<...>
RIP: 0010:ccid_hc_tx_send_packet net/dccp/ccid.h:166 [inline]
RIP: 0010:dccp_write_xmit+0x49/0x140 net/dccp/output.c:356
<...>
Call Trace:
<TASK>
dccp_sendmsg+0x642/0x7e0 net/dccp/proto.c:801
inet_sendmsg+0x63/0x90 net/ipv4/af_inet.c:846
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0x83/0xe0 net/socket.c:745
____sys_sendmsg+0x443/0x510 net/socket.c:2558
___sys_sendmsg+0xe5/0x150 net/socket.c:2612
__sys_sendmsg+0xa6/0x120 net/socket.c:2641
__do_sys_sendmsg net/socket.c:2650 [inline]
__se_sys_sendmsg net/socket.c:2648 [inline]
__x64_sys_sendmsg+0x45/0x50 net/socket.c:2648
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x43/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
sk_wait_event() returns an error (-EPIPE) if disconnect() is called on the
socket waiting for the event. However, sk_stream_wait_connect() returns
success, i.e. zero, even if sk_wait_event() returns -EPIPE, so a function
that waits for a connection with sk_stream_wait_connect() may misbehave.
In the case of the above DCCP issue, dccp_sendmsg() is waiting for the
connection. If disconnect() is called in concurrently, the above issue
occurs.
This patch fixes the issue by returning error from sk_stream_wait_connect()
if sk_wait_event() fails.
Fixes: 419ce133ab92 ("tcp: allow again tcp_disconnect() when threads are waiting")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Reported-by: syzbot+c71bc336c5061153b502@syzkaller.appspotmail.com
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Reported-by: syzkaller <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/stream.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/stream.c b/net/core/stream.c
index 96fbcb9bbb30a..b16dfa568a2d5 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -79,7 +79,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p)
remove_wait_queue(sk_sleep(sk), &wait);
sk->sk_write_pending--;
} while (!done);
- return 0;
+ return done < 0 ? done : 0;
}
EXPORT_SYMBOL(sk_stream_wait_connect);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 048/156] net: sched: ife: fix potential use-after-free
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 047/156] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 049/156] ethernet: atheros: fix a memleak in atl1e_setup_ring_resources Greg Kroah-Hartman
` (116 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Jamal Hadi Salim, Alexander Aring, David S. Miller, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 19391a2ca98baa7b80279306cdf7dd43f81fa595 ]
ife_decode() calls pskb_may_pull() two times, we need to reload
ifehdr after the second one, or risk use-after-free as reported
by syzbot:
BUG: KASAN: slab-use-after-free in __ife_tlv_meta_valid net/ife/ife.c:108 [inline]
BUG: KASAN: slab-use-after-free in ife_tlv_meta_decode+0x1d1/0x210 net/ife/ife.c:131
Read of size 2 at addr ffff88802d7300a4 by task syz-executor.5/22323
CPU: 0 PID: 22323 Comm: syz-executor.5 Not tainted 6.7.0-rc3-syzkaller-00804-g074ac38d5b95 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report+0xda/0x110 mm/kasan/report.c:588
__ife_tlv_meta_valid net/ife/ife.c:108 [inline]
ife_tlv_meta_decode+0x1d1/0x210 net/ife/ife.c:131
tcf_ife_decode net/sched/act_ife.c:739 [inline]
tcf_ife_act+0x4e3/0x1cd0 net/sched/act_ife.c:879
tc_act include/net/tc_wrapper.h:221 [inline]
tcf_action_exec+0x1ac/0x620 net/sched/act_api.c:1079
tcf_exts_exec include/net/pkt_cls.h:344 [inline]
mall_classify+0x201/0x310 net/sched/cls_matchall.c:42
tc_classify include/net/tc_wrapper.h:227 [inline]
__tcf_classify net/sched/cls_api.c:1703 [inline]
tcf_classify+0x82f/0x1260 net/sched/cls_api.c:1800
hfsc_classify net/sched/sch_hfsc.c:1147 [inline]
hfsc_enqueue+0x315/0x1060 net/sched/sch_hfsc.c:1546
dev_qdisc_enqueue+0x3f/0x230 net/core/dev.c:3739
__dev_xmit_skb net/core/dev.c:3828 [inline]
__dev_queue_xmit+0x1de1/0x3d30 net/core/dev.c:4311
dev_queue_xmit include/linux/netdevice.h:3165 [inline]
packet_xmit+0x237/0x350 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3081 [inline]
packet_sendmsg+0x24aa/0x5200 net/packet/af_packet.c:3113
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7fe9acc7cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe9ada450c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fe9acd9bf80 RCX: 00007fe9acc7cae9
RDX: 000000000000fce0 RSI: 00000000200002c0 RDI: 0000000000000003
RBP: 00007fe9accc847a R08: 0000000020000140 R09: 0000000000000014
R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fe9acd9bf80 R15: 00007ffd5427ae78
</TASK>
Allocated by task 22323:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc_node_track_caller+0x5a/0x90 mm/slab_common.c:1027
kmalloc_reserve+0xef/0x260 net/core/skbuff.c:582
__alloc_skb+0x12b/0x330 net/core/skbuff.c:651
alloc_skb include/linux/skbuff.h:1298 [inline]
alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331
sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780
packet_alloc_skb net/packet/af_packet.c:2930 [inline]
packet_snd net/packet/af_packet.c:3024 [inline]
packet_sendmsg+0x1e2a/0x5200 net/packet/af_packet.c:3113
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Freed by task 22323:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826
slab_free mm/slub.c:3809 [inline]
__kmem_cache_free+0xc0/0x180 mm/slub.c:3822
skb_kfree_head net/core/skbuff.c:950 [inline]
skb_free_head+0x110/0x1b0 net/core/skbuff.c:962
pskb_expand_head+0x3c5/0x1170 net/core/skbuff.c:2130
__pskb_pull_tail+0xe1/0x1830 net/core/skbuff.c:2655
pskb_may_pull_reason include/linux/skbuff.h:2685 [inline]
pskb_may_pull include/linux/skbuff.h:2693 [inline]
ife_decode+0x394/0x4f0 net/ife/ife.c:82
tcf_ife_decode net/sched/act_ife.c:727 [inline]
tcf_ife_act+0x43b/0x1cd0 net/sched/act_ife.c:879
tc_act include/net/tc_wrapper.h:221 [inline]
tcf_action_exec+0x1ac/0x620 net/sched/act_api.c:1079
tcf_exts_exec include/net/pkt_cls.h:344 [inline]
mall_classify+0x201/0x310 net/sched/cls_matchall.c:42
tc_classify include/net/tc_wrapper.h:227 [inline]
__tcf_classify net/sched/cls_api.c:1703 [inline]
tcf_classify+0x82f/0x1260 net/sched/cls_api.c:1800
hfsc_classify net/sched/sch_hfsc.c:1147 [inline]
hfsc_enqueue+0x315/0x1060 net/sched/sch_hfsc.c:1546
dev_qdisc_enqueue+0x3f/0x230 net/core/dev.c:3739
__dev_xmit_skb net/core/dev.c:3828 [inline]
__dev_queue_xmit+0x1de1/0x3d30 net/core/dev.c:4311
dev_queue_xmit include/linux/netdevice.h:3165 [inline]
packet_xmit+0x237/0x350 net/packet/af_packet.c:276
packet_snd net/packet/af_packet.c:3081 [inline]
packet_sendmsg+0x24aa/0x5200 net/packet/af_packet.c:3113
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
__do_sys_sendto net/socket.c:2202 [inline]
__se_sys_sendto net/socket.c:2198 [inline]
__x64_sys_sendto+0xe0/0x1b0 net/socket.c:2198
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
entry_SYSCALL_64_after_hwframe+0x63/0x6b
The buggy address belongs to the object at ffff88802d730000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 164 bytes inside of
freed 8192-byte region [ffff88802d730000, ffff88802d732000)
The buggy address belongs to the physical page:
page:ffffea0000b5cc00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2d730
head:ffffea0000b5cc00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888013042280 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080020002 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 22323, tgid 22320 (syz-executor.5), ts 950317230369, free_ts 950233467461
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1544
prep_new_page mm/page_alloc.c:1551 [inline]
get_page_from_freelist+0xa28/0x3730 mm/page_alloc.c:3319
__alloc_pages+0x22e/0x2420 mm/page_alloc.c:4575
alloc_pages_mpol+0x258/0x5f0 mm/mempolicy.c:2133
alloc_slab_page mm/slub.c:1870 [inline]
allocate_slab mm/slub.c:2017 [inline]
new_slab+0x283/0x3c0 mm/slub.c:2070
___slab_alloc+0x979/0x1500 mm/slub.c:3223
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
__kmem_cache_alloc_node+0x131/0x310 mm/slub.c:3517
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc_node_track_caller+0x4a/0x90 mm/slab_common.c:1027
kmalloc_reserve+0xef/0x260 net/core/skbuff.c:582
__alloc_skb+0x12b/0x330 net/core/skbuff.c:651
alloc_skb include/linux/skbuff.h:1298 [inline]
alloc_skb_with_frags+0xe4/0x710 net/core/skbuff.c:6331
sock_alloc_send_pskb+0x7e4/0x970 net/core/sock.c:2780
packet_alloc_skb net/packet/af_packet.c:2930 [inline]
packet_snd net/packet/af_packet.c:3024 [inline]
packet_sendmsg+0x1e2a/0x5200 net/packet/af_packet.c:3113
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg+0xd5/0x180 net/socket.c:745
__sys_sendto+0x255/0x340 net/socket.c:2190
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1144 [inline]
free_unref_page_prepare+0x53c/0xb80 mm/page_alloc.c:2354
free_unref_page+0x33/0x3b0 mm/page_alloc.c:2494
__unfreeze_partials+0x226/0x240 mm/slub.c:2655
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook mm/slab.h:763 [inline]
slab_alloc_node mm/slub.c:3478 [inline]
slab_alloc mm/slub.c:3486 [inline]
__kmem_cache_alloc_lru mm/slub.c:3493 [inline]
kmem_cache_alloc_lru+0x219/0x6f0 mm/slub.c:3509
alloc_inode_sb include/linux/fs.h:2937 [inline]
ext4_alloc_inode+0x28/0x650 fs/ext4/super.c:1408
alloc_inode+0x5d/0x220 fs/inode.c:261
new_inode_pseudo fs/inode.c:1006 [inline]
new_inode+0x22/0x260 fs/inode.c:1032
__ext4_new_inode+0x333/0x5200 fs/ext4/ialloc.c:958
ext4_symlink+0x5d7/0xa20 fs/ext4/namei.c:3398
vfs_symlink fs/namei.c:4464 [inline]
vfs_symlink+0x3e5/0x620 fs/namei.c:4448
do_symlinkat+0x25f/0x310 fs/namei.c:4490
__do_sys_symlinkat fs/namei.c:4506 [inline]
__se_sys_symlinkat fs/namei.c:4503 [inline]
__x64_sys_symlinkat+0x97/0xc0 fs/namei.c:4503
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:82
Fixes: d57493d6d1be ("net: sched: ife: check on metadata length")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Jamal Hadi Salim <jhs@mojatatu.com>
Cc: Alexander Aring <aahringo@redhat.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ife/ife.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ife/ife.c b/net/ife/ife.c
index 13bbf8cb6a396..be05b690b9ef2 100644
--- a/net/ife/ife.c
+++ b/net/ife/ife.c
@@ -82,6 +82,7 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
if (unlikely(!pskb_may_pull(skb, total_pull)))
return NULL;
+ ifehdr = (struct ifeheadr *)(skb->data + skb->dev->hard_header_len);
skb_set_mac_header(skb, total_pull);
__skb_pull(skb, total_pull);
*metalen = ifehdrln - IFE_METAHDRLEN;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 049/156] ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 048/156] net: sched: ife: fix potential use-after-free Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 050/156] net/rose: fix races in rose_kill_by_device() Greg Kroah-Hartman
` (115 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Suman Ghosh,
David S. Miller, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 309fdb1c33fe726d92d0030481346f24e1b01f07 ]
In the error handling of 'offset > adapter->ring_size', the
tx_ring->tx_buffer allocated by kzalloc should be freed,
instead of 'goto failed' instantly.
Fixes: a6a5325239c2 ("atl1e: Atheros L1E Gigabit Ethernet driver")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: Suman Ghosh <sumang@marvell.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
index 5935be190b9e2..5f2a6fcba9670 100644
--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
+++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c
@@ -866,10 +866,13 @@ static int atl1e_setup_ring_resources(struct atl1e_adapter *adapter)
netdev_err(adapter->netdev, "offset(%d) > ring size(%d) !!\n",
offset, adapter->ring_size);
err = -1;
- goto failed;
+ goto free_buffer;
}
return 0;
+free_buffer:
+ kfree(tx_ring->tx_buffer);
+ tx_ring->tx_buffer = NULL;
failed:
if (adapter->ring_vir_addr != NULL) {
dma_free_coherent(&pdev->dev, adapter->ring_size,
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 050/156] net/rose: fix races in rose_kill_by_device()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 049/156] ethernet: atheros: fix a memleak in atl1e_setup_ring_resources Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 051/156] Bluetooth: Fix not notifying when connection encryption changes Greg Kroah-Hartman
` (114 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet, Bernard Pidoux,
David S. Miller, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 64b8bc7d5f1434c636a40bdcfcd42b278d1714be ]
syzbot found an interesting netdev refcounting issue in
net/rose/af_rose.c, thanks to CONFIG_NET_DEV_REFCNT_TRACKER=y [1]
Problem is that rose_kill_by_device() can change rose->device
while other threads do not expect the pointer to be changed.
We have to first collect sockets in a temporary array,
then perform the changes while holding the socket
lock and rose_list_lock spinlock (in this order)
Change rose_release() to also acquire rose_list_lock
before releasing the netdev refcount.
[1]
[ 1185.055088][ T7889] ref_tracker: reference already released.
[ 1185.061476][ T7889] ref_tracker: allocated in:
[ 1185.066081][ T7889] rose_bind+0x4ab/0xd10
[ 1185.070446][ T7889] __sys_bind+0x1ec/0x220
[ 1185.074818][ T7889] __x64_sys_bind+0x72/0xb0
[ 1185.079356][ T7889] do_syscall_64+0x40/0x110
[ 1185.083897][ T7889] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 1185.089835][ T7889] ref_tracker: freed in:
[ 1185.094088][ T7889] rose_release+0x2f5/0x570
[ 1185.098629][ T7889] __sock_release+0xae/0x260
[ 1185.103262][ T7889] sock_close+0x1c/0x20
[ 1185.107453][ T7889] __fput+0x270/0xbb0
[ 1185.111467][ T7889] task_work_run+0x14d/0x240
[ 1185.116085][ T7889] get_signal+0x106f/0x2790
[ 1185.120622][ T7889] arch_do_signal_or_restart+0x90/0x7f0
[ 1185.126205][ T7889] exit_to_user_mode_prepare+0x121/0x240
[ 1185.131846][ T7889] syscall_exit_to_user_mode+0x1e/0x60
[ 1185.137293][ T7889] do_syscall_64+0x4d/0x110
[ 1185.141783][ T7889] entry_SYSCALL_64_after_hwframe+0x63/0x6b
[ 1185.148085][ T7889] ------------[ cut here ]------------
WARNING: CPU: 1 PID: 7889 at lib/ref_tracker.c:255 ref_tracker_free+0x61a/0x810 lib/ref_tracker.c:255
Modules linked in:
CPU: 1 PID: 7889 Comm: syz-executor.2 Not tainted 6.7.0-rc4-syzkaller-00162-g65c95f78917e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
RIP: 0010:ref_tracker_free+0x61a/0x810 lib/ref_tracker.c:255
Code: 00 44 8b 6b 18 31 ff 44 89 ee e8 21 62 f5 fc 45 85 ed 0f 85 a6 00 00 00 e8 a3 66 f5 fc 48 8b 34 24 48 89 ef e8 27 5f f1 05 90 <0f> 0b 90 bb ea ff ff ff e9 52 fd ff ff e8 84 66 f5 fc 4c 8d 6d 44
RSP: 0018:ffffc90004917850 EFLAGS: 00010202
RAX: 0000000000000201 RBX: ffff88802618f4c0 RCX: 0000000000000000
RDX: 0000000000000202 RSI: ffffffff8accb920 RDI: 0000000000000001
RBP: ffff8880269ea5b8 R08: 0000000000000001 R09: fffffbfff23e35f6
R10: ffffffff91f1afb7 R11: 0000000000000001 R12: 1ffff92000922f0c
R13: 0000000005a2039b R14: ffff88802618f4d8 R15: 00000000ffffffff
FS: 00007f0a720ef6c0(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f43a819d988 CR3: 0000000076c64000 CR4: 00000000003506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
netdev_tracker_free include/linux/netdevice.h:4127 [inline]
netdev_put include/linux/netdevice.h:4144 [inline]
netdev_put include/linux/netdevice.h:4140 [inline]
rose_kill_by_device net/rose/af_rose.c:195 [inline]
rose_device_event+0x25d/0x330 net/rose/af_rose.c:218
notifier_call_chain+0xb6/0x3b0 kernel/notifier.c:93
call_netdevice_notifiers_info+0xbe/0x130 net/core/dev.c:1967
call_netdevice_notifiers_extack net/core/dev.c:2005 [inline]
call_netdevice_notifiers net/core/dev.c:2019 [inline]
__dev_notify_flags+0x1f5/0x2e0 net/core/dev.c:8646
dev_change_flags+0x122/0x170 net/core/dev.c:8682
dev_ifsioc+0x9ad/0x1090 net/core/dev_ioctl.c:529
dev_ioctl+0x224/0x1090 net/core/dev_ioctl.c:786
sock_do_ioctl+0x198/0x270 net/socket.c:1234
sock_ioctl+0x22e/0x6b0 net/socket.c:1339
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl fs/ioctl.c:857 [inline]
__x64_sys_ioctl+0x18f/0x210 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f0a7147cba9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f0a720ef0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f0a7159bf80 RCX: 00007f0a7147cba9
RDX: 0000000020000040 RSI: 0000000000008914 RDI: 0000000000000004
RBP: 00007f0a714c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007f0a7159bf80 R15: 00007ffc8bb3a5f8
</TASK>
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Bernard Pidoux <f6bvp@free.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/rose/af_rose.c | 39 ++++++++++++++++++++++++++++++++++-----
1 file changed, 34 insertions(+), 5 deletions(-)
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 4a5c2dc8dd7a9..42e8b9e37516b 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -182,21 +182,47 @@ void rose_kill_by_neigh(struct rose_neigh *neigh)
*/
static void rose_kill_by_device(struct net_device *dev)
{
- struct sock *s;
+ struct sock *sk, *array[16];
+ struct rose_sock *rose;
+ bool rescan;
+ int i, cnt;
+start:
+ rescan = false;
+ cnt = 0;
spin_lock_bh(&rose_list_lock);
- sk_for_each(s, &rose_list) {
- struct rose_sock *rose = rose_sk(s);
+ sk_for_each(sk, &rose_list) {
+ rose = rose_sk(sk);
+ if (rose->device == dev) {
+ if (cnt == ARRAY_SIZE(array)) {
+ rescan = true;
+ break;
+ }
+ sock_hold(sk);
+ array[cnt++] = sk;
+ }
+ }
+ spin_unlock_bh(&rose_list_lock);
+ for (i = 0; i < cnt; i++) {
+ sk = array[cnt];
+ rose = rose_sk(sk);
+ lock_sock(sk);
+ spin_lock_bh(&rose_list_lock);
if (rose->device == dev) {
- rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
+ rose_disconnect(sk, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
if (rose->neighbour)
rose->neighbour->use--;
netdev_put(rose->device, &rose->dev_tracker);
rose->device = NULL;
}
+ spin_unlock_bh(&rose_list_lock);
+ release_sock(sk);
+ sock_put(sk);
+ cond_resched();
}
- spin_unlock_bh(&rose_list_lock);
+ if (rescan)
+ goto start;
}
/*
@@ -656,7 +682,10 @@ static int rose_release(struct socket *sock)
break;
}
+ spin_lock_bh(&rose_list_lock);
netdev_put(rose->device, &rose->dev_tracker);
+ rose->device = NULL;
+ spin_unlock_bh(&rose_list_lock);
sock->sk = NULL;
release_sock(sk);
sock_put(sk);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 051/156] Bluetooth: Fix not notifying when connection encryption changes
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 050/156] net/rose: fix races in rose_kill_by_device() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 052/156] Bluetooth: Fix deadlock in vhci_send_frame Greg Kroah-Hartman
` (113 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit f67eabffb57d0bee379994a18ec5f462b2cbdf86 ]
Some layers such as SMP depend on getting notified about encryption
changes immediately as they only allow certain PDU to be transmitted
over an encrypted link which may cause SMP implementation to reject
valid PDUs received thus causing pairing to fail when it shouldn't.
Fixes: 7aca0ac4792e ("Bluetooth: Wait for HCI_OP_WRITE_AUTH_PAYLOAD_TO to complete")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index f6d3150bcbb03..da756cbf62206 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -820,8 +820,6 @@ static u8 hci_cc_write_auth_payload_timeout(struct hci_dev *hdev, void *data,
if (!rp->status)
conn->auth_payload_timeout = get_unaligned_le16(sent + 2);
- hci_encrypt_cfm(conn, 0);
-
unlock:
hci_dev_unlock(hdev);
@@ -3683,12 +3681,8 @@ static void hci_encrypt_change_evt(struct hci_dev *hdev, void *data,
cp.handle = cpu_to_le16(conn->handle);
cp.timeout = cpu_to_le16(hdev->auth_payload_timeout);
if (hci_send_cmd(conn->hdev, HCI_OP_WRITE_AUTH_PAYLOAD_TO,
- sizeof(cp), &cp)) {
+ sizeof(cp), &cp))
bt_dev_err(hdev, "write auth payload timeout failed");
- goto notify;
- }
-
- goto unlock;
}
notify:
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 052/156] Bluetooth: Fix deadlock in vhci_send_frame
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 051/156] Bluetooth: Fix not notifying when connection encryption changes Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 053/156] Bluetooth: hci_event: shut up a false-positive warning Greg Kroah-Hartman
` (112 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ying Hsu, Luiz Augusto von Dentz,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ying Hsu <yinghsu@chromium.org>
[ Upstream commit 769bf60e17ee1a56a81e7c031192c3928312c52e ]
syzbot found a potential circular dependency leading to a deadlock:
-> #3 (&hdev->req_lock){+.+.}-{3:3}:
__mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599
__mutex_lock kernel/locking/mutex.c:732 [inline]
mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784
hci_dev_do_close+0x3f/0x9f net/bluetooth/hci_core.c:551
hci_rfkill_set_block+0x130/0x1ac net/bluetooth/hci_core.c:935
rfkill_set_block+0x1e6/0x3b8 net/rfkill/core.c:345
rfkill_fop_write+0x2d8/0x672 net/rfkill/core.c:1274
vfs_write+0x277/0xcf5 fs/read_write.c:594
ksys_write+0x19b/0x2bd fs/read_write.c:650
do_syscall_x64 arch/x86/entry/common.c:55 [inline]
do_syscall_64+0x51/0xba arch/x86/entry/common.c:93
entry_SYSCALL_64_after_hwframe+0x61/0xcb
-> #2 (rfkill_global_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599
__mutex_lock kernel/locking/mutex.c:732 [inline]
mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784
rfkill_register+0x30/0x7e3 net/rfkill/core.c:1045
hci_register_dev+0x48f/0x96d net/bluetooth/hci_core.c:2622
__vhci_create_device drivers/bluetooth/hci_vhci.c:341 [inline]
vhci_create_device+0x3ad/0x68f drivers/bluetooth/hci_vhci.c:374
vhci_get_user drivers/bluetooth/hci_vhci.c:431 [inline]
vhci_write+0x37b/0x429 drivers/bluetooth/hci_vhci.c:511
call_write_iter include/linux/fs.h:2109 [inline]
new_sync_write fs/read_write.c:509 [inline]
vfs_write+0xaa8/0xcf5 fs/read_write.c:596
ksys_write+0x19b/0x2bd fs/read_write.c:650
do_syscall_x64 arch/x86/entry/common.c:55 [inline]
do_syscall_64+0x51/0xba arch/x86/entry/common.c:93
entry_SYSCALL_64_after_hwframe+0x61/0xcb
-> #1 (&data->open_mutex){+.+.}-{3:3}:
__mutex_lock_common+0x1b6/0x1bc2 kernel/locking/mutex.c:599
__mutex_lock kernel/locking/mutex.c:732 [inline]
mutex_lock_nested+0x17/0x1c kernel/locking/mutex.c:784
vhci_send_frame+0x68/0x9c drivers/bluetooth/hci_vhci.c:75
hci_send_frame+0x1cc/0x2ff net/bluetooth/hci_core.c:2989
hci_sched_acl_pkt net/bluetooth/hci_core.c:3498 [inline]
hci_sched_acl net/bluetooth/hci_core.c:3583 [inline]
hci_tx_work+0xb94/0x1a60 net/bluetooth/hci_core.c:3654
process_one_work+0x901/0xfb8 kernel/workqueue.c:2310
worker_thread+0xa67/0x1003 kernel/workqueue.c:2457
kthread+0x36a/0x430 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
-> #0 ((work_completion)(&hdev->tx_work)){+.+.}-{0:0}:
check_prev_add kernel/locking/lockdep.c:3053 [inline]
check_prevs_add kernel/locking/lockdep.c:3172 [inline]
validate_chain kernel/locking/lockdep.c:3787 [inline]
__lock_acquire+0x2d32/0x77fa kernel/locking/lockdep.c:5011
lock_acquire+0x273/0x4d5 kernel/locking/lockdep.c:5622
__flush_work+0xee/0x19f kernel/workqueue.c:3090
hci_dev_close_sync+0x32f/0x1113 net/bluetooth/hci_sync.c:4352
hci_dev_do_close+0x47/0x9f net/bluetooth/hci_core.c:553
hci_rfkill_set_block+0x130/0x1ac net/bluetooth/hci_core.c:935
rfkill_set_block+0x1e6/0x3b8 net/rfkill/core.c:345
rfkill_fop_write+0x2d8/0x672 net/rfkill/core.c:1274
vfs_write+0x277/0xcf5 fs/read_write.c:594
ksys_write+0x19b/0x2bd fs/read_write.c:650
do_syscall_x64 arch/x86/entry/common.c:55 [inline]
do_syscall_64+0x51/0xba arch/x86/entry/common.c:93
entry_SYSCALL_64_after_hwframe+0x61/0xcb
This change removes the need for acquiring the open_mutex in
vhci_send_frame, thus eliminating the potential deadlock while
maintaining the required packet ordering.
Fixes: 92d4abd66f70 ("Bluetooth: vhci: Fix race when opening vhci device")
Signed-off-by: Ying Hsu <yinghsu@chromium.org>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/hci_vhci.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/drivers/bluetooth/hci_vhci.c b/drivers/bluetooth/hci_vhci.c
index f3892e9ce800f..572d68d52965f 100644
--- a/drivers/bluetooth/hci_vhci.c
+++ b/drivers/bluetooth/hci_vhci.c
@@ -11,6 +11,7 @@
#include <linux/module.h>
#include <asm/unaligned.h>
+#include <linux/atomic.h>
#include <linux/kernel.h>
#include <linux/init.h>
#include <linux/slab.h>
@@ -44,6 +45,7 @@ struct vhci_data {
bool wakeup;
__u16 msft_opcode;
bool aosp_capable;
+ atomic_t initialized;
};
static int vhci_open_dev(struct hci_dev *hdev)
@@ -75,11 +77,10 @@ static int vhci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
memcpy(skb_push(skb, 1), &hci_skb_pkt_type(skb), 1);
- mutex_lock(&data->open_mutex);
skb_queue_tail(&data->readq, skb);
- mutex_unlock(&data->open_mutex);
- wake_up_interruptible(&data->read_wait);
+ if (atomic_read(&data->initialized))
+ wake_up_interruptible(&data->read_wait);
return 0;
}
@@ -464,7 +465,8 @@ static int __vhci_create_device(struct vhci_data *data, __u8 opcode)
skb_put_u8(skb, 0xff);
skb_put_u8(skb, opcode);
put_unaligned_le16(hdev->id, skb_put(skb, 2));
- skb_queue_tail(&data->readq, skb);
+ skb_queue_head(&data->readq, skb);
+ atomic_inc(&data->initialized);
wake_up_interruptible(&data->read_wait);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 053/156] Bluetooth: hci_event: shut up a false-positive warning
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 052/156] Bluetooth: Fix deadlock in vhci_send_frame Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 054/156] Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Greg Kroah-Hartman
` (111 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann,
Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit a5812c68d849505ea657f653446512b85887f813 ]
Turning on -Wstringop-overflow globally exposed a misleading compiler
warning in bluetooth:
net/bluetooth/hci_event.c: In function 'hci_cc_read_class_of_dev':
net/bluetooth/hci_event.c:524:9: error: 'memcpy' writing 3 bytes into a
region of size 0 overflows the destination [-Werror=stringop-overflow=]
524 | memcpy(hdev->dev_class, rp->dev_class, 3);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
The problem here is the check for hdev being NULL in bt_dev_dbg() that
leads the compiler to conclude that hdev->dev_class might be an invalid
pointer access.
Add another explicit check for the same condition to make sure gcc sees
this cannot happen.
Fixes: a9de9248064b ("[Bluetooth] Switch from OGF+OCF to using only opcodes")
Fixes: 1b56c90018f0 ("Makefile: Enable -Wstringop-overflow globally")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/bluetooth/hci_event.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index da756cbf62206..3661f8cdbab70 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -516,6 +516,9 @@ static u8 hci_cc_read_class_of_dev(struct hci_dev *hdev, void *data,
{
struct hci_rp_read_class_of_dev *rp = data;
+ if (WARN_ON(!hdev))
+ return HCI_ERROR_UNSPECIFIED;
+
bt_dev_dbg(hdev, "status 0x%2.2x", rp->status);
if (rp->status)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 054/156] Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 053/156] Bluetooth: hci_event: shut up a false-positive warning Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice Greg Kroah-Hartman
` (110 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit 50efc63d1a7a7b9a6ed21adae1b9a7123ec8abc0 ]
hci_conn_hash_lookup_cis shall always match the requested CIG and CIS
ids even when they are unset as otherwise it result in not being able
to bind/connect different sockets to the same address as that would
result in having multiple sockets mapping to the same hci_conn which
doesn't really work and prevents BAP audio configuration such as
AC 6(i) when CIG and CIS are left unset.
Fixes: c14516faede3 ("Bluetooth: hci_conn: Fix not matching by CIS ID")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci_core.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 7fa95b72e5c85..22ce39a2aa7bc 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -1227,11 +1227,11 @@ static inline struct hci_conn *hci_conn_hash_lookup_cis(struct hci_dev *hdev,
continue;
/* Match CIG ID if set */
- if (cig != BT_ISO_QOS_CIG_UNSET && cig != c->iso_qos.ucast.cig)
+ if (cig != c->iso_qos.ucast.cig)
continue;
/* Match CIS ID if set */
- if (id != BT_ISO_QOS_CIS_UNSET && id != c->iso_qos.ucast.cis)
+ if (id != c->iso_qos.ucast.cis)
continue;
/* Match destination address if set */
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 054/156] Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2024-01-02 15:22 ` Andy Gospodarek
2023-12-30 11:58 ` [PATCH 6.6 056/156] net: phy: skip LED triggers on PHYs on SFP modules Greg Kroah-Hartman
` (109 subsequent siblings)
164 siblings, 1 reply; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Somnath Kotur, Andy Gospodarek,
Michael Chan, David Wei, Jakub Kicinski, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Gospodarek <andrew.gospodarek@broadcom.com>
[ Upstream commit 23c93c3b6275a59f2a685f4a693944b53c31df4e ]
Remove double-mapping of DMA buffers as it can prevent page pool entries
from being freed. Mapping is managed by page pool infrastructure and
was previously managed by the driver in __bnxt_alloc_rx_page before
allowing the page pool infrastructure to manage it.
Fixes: 578fcfd26e2a ("bnxt_en: Let the page pool manage the DMA mapping")
Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
Signed-off-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Signed-off-by: Michael Chan <michael.chan@broadcom.com>
Reviewed-by: David Wei <dw@davidwei.uk>
Link: https://lore.kernel.org/r/20231214213138.98095-1-michael.chan@broadcom.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 ++---------
1 file changed, 2 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
index 96f5ca778c67d..8cb9a99154aad 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
@@ -59,7 +59,6 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp,
for (i = 0; i < num_frags ; i++) {
skb_frag_t *frag = &sinfo->frags[i];
struct bnxt_sw_tx_bd *frag_tx_buf;
- struct pci_dev *pdev = bp->pdev;
dma_addr_t frag_mapping;
int frag_len;
@@ -73,16 +72,10 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp,
txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)];
frag_len = skb_frag_size(frag);
- frag_mapping = skb_frag_dma_map(&pdev->dev, frag, 0,
- frag_len, DMA_TO_DEVICE);
-
- if (unlikely(dma_mapping_error(&pdev->dev, frag_mapping)))
- return NULL;
-
- dma_unmap_addr_set(frag_tx_buf, mapping, frag_mapping);
-
flags = frag_len << TX_BD_LEN_SHIFT;
txbd->tx_bd_len_flags_type = cpu_to_le32(flags);
+ frag_mapping = page_pool_get_dma_addr(skb_frag_page(frag)) +
+ skb_frag_off(frag);
txbd->tx_bd_haddr = cpu_to_le64(frag_mapping);
len = frag_len;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 056/156] net: phy: skip LED triggers on PHYs on SFP modules
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 057/156] ice: stop trashing VF VSI aggregator node ID information Greg Kroah-Hartman
` (108 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Daniel Golle, Jakub Kicinski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Golle <daniel@makrotopia.org>
[ Upstream commit b1dfc0f76231bbf395c59d20a2070684620d5d0f ]
Calling led_trigger_register() when attaching a PHY located on an SFP
module potentially (and practically) leads into a deadlock.
Fix this by not calling led_trigger_register() for PHYs localted on SFP
modules as such modules actually never got any LEDs.
======================================================
WARNING: possible circular locking dependency detected
6.7.0-rc4-next-20231208+ #0 Tainted: G O
------------------------------------------------------
kworker/u8:2/43 is trying to acquire lock:
ffffffc08108c4e8 (triggers_list_lock){++++}-{3:3}, at: led_trigger_register+0x4c/0x1a8
but task is already holding lock:
ffffff80c5c6f318 (&sfp->sm_mutex){+.+.}-{3:3}, at: cleanup_module+0x2ba8/0x3120 [sfp]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #3 (&sfp->sm_mutex){+.+.}-{3:3}:
__mutex_lock+0x88/0x7a0
mutex_lock_nested+0x20/0x28
cleanup_module+0x2ae0/0x3120 [sfp]
sfp_register_bus+0x5c/0x9c
sfp_register_socket+0x48/0xd4
cleanup_module+0x271c/0x3120 [sfp]
platform_probe+0x64/0xb8
really_probe+0x17c/0x3c0
__driver_probe_device+0x78/0x164
driver_probe_device+0x3c/0xd4
__driver_attach+0xec/0x1f0
bus_for_each_dev+0x60/0xa0
driver_attach+0x20/0x28
bus_add_driver+0x108/0x208
driver_register+0x5c/0x118
__platform_driver_register+0x24/0x2c
init_module+0x28/0xa7c [sfp]
do_one_initcall+0x70/0x2ec
do_init_module+0x54/0x1e4
load_module+0x1b78/0x1c8c
__do_sys_init_module+0x1bc/0x2cc
__arm64_sys_init_module+0x18/0x20
invoke_syscall.constprop.0+0x4c/0xdc
do_el0_svc+0x3c/0xbc
el0_svc+0x34/0x80
el0t_64_sync_handler+0xf8/0x124
el0t_64_sync+0x150/0x154
-> #2 (rtnl_mutex){+.+.}-{3:3}:
__mutex_lock+0x88/0x7a0
mutex_lock_nested+0x20/0x28
rtnl_lock+0x18/0x20
set_device_name+0x30/0x130
netdev_trig_activate+0x13c/0x1ac
led_trigger_set+0x118/0x234
led_trigger_write+0x104/0x17c
sysfs_kf_bin_write+0x64/0x80
kernfs_fop_write_iter+0x128/0x1b4
vfs_write+0x178/0x2a4
ksys_write+0x58/0xd4
__arm64_sys_write+0x18/0x20
invoke_syscall.constprop.0+0x4c/0xdc
do_el0_svc+0x3c/0xbc
el0_svc+0x34/0x80
el0t_64_sync_handler+0xf8/0x124
el0t_64_sync+0x150/0x154
-> #1 (&led_cdev->trigger_lock){++++}-{3:3}:
down_write+0x4c/0x13c
led_trigger_write+0xf8/0x17c
sysfs_kf_bin_write+0x64/0x80
kernfs_fop_write_iter+0x128/0x1b4
vfs_write+0x178/0x2a4
ksys_write+0x58/0xd4
__arm64_sys_write+0x18/0x20
invoke_syscall.constprop.0+0x4c/0xdc
do_el0_svc+0x3c/0xbc
el0_svc+0x34/0x80
el0t_64_sync_handler+0xf8/0x124
el0t_64_sync+0x150/0x154
-> #0 (triggers_list_lock){++++}-{3:3}:
__lock_acquire+0x12a0/0x2014
lock_acquire+0x100/0x2ac
down_write+0x4c/0x13c
led_trigger_register+0x4c/0x1a8
phy_led_triggers_register+0x9c/0x214
phy_attach_direct+0x154/0x36c
phylink_attach_phy+0x30/0x60
phylink_sfp_connect_phy+0x140/0x510
sfp_add_phy+0x34/0x50
init_module+0x15c/0xa7c [sfp]
cleanup_module+0x1d94/0x3120 [sfp]
cleanup_module+0x2bb4/0x3120 [sfp]
process_one_work+0x1f8/0x4ec
worker_thread+0x1e8/0x3d8
kthread+0x104/0x110
ret_from_fork+0x10/0x20
other info that might help us debug this:
Chain exists of:
triggers_list_lock --> rtnl_mutex --> &sfp->sm_mutex
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&sfp->sm_mutex);
lock(rtnl_mutex);
lock(&sfp->sm_mutex);
lock(triggers_list_lock);
*** DEADLOCK ***
4 locks held by kworker/u8:2/43:
#0: ffffff80c000f938 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_one_work+0x150/0x4ec
#1: ffffffc08214bde8 ((work_completion)(&(&sfp->timeout)->work)){+.+.}-{0:0}, at: process_one_work+0x150/0x4ec
#2: ffffffc0810902f8 (rtnl_mutex){+.+.}-{3:3}, at: rtnl_lock+0x18/0x20
#3: ffffff80c5c6f318 (&sfp->sm_mutex){+.+.}-{3:3}, at: cleanup_module+0x2ba8/0x3120 [sfp]
stack backtrace:
CPU: 0 PID: 43 Comm: kworker/u8:2 Tainted: G O 6.7.0-rc4-next-20231208+ #0
Hardware name: Bananapi BPI-R4 (DT)
Workqueue: events_power_efficient cleanup_module [sfp]
Call trace:
dump_backtrace+0xa8/0x10c
show_stack+0x14/0x1c
dump_stack_lvl+0x5c/0xa0
dump_stack+0x14/0x1c
print_circular_bug+0x328/0x430
check_noncircular+0x124/0x134
__lock_acquire+0x12a0/0x2014
lock_acquire+0x100/0x2ac
down_write+0x4c/0x13c
led_trigger_register+0x4c/0x1a8
phy_led_triggers_register+0x9c/0x214
phy_attach_direct+0x154/0x36c
phylink_attach_phy+0x30/0x60
phylink_sfp_connect_phy+0x140/0x510
sfp_add_phy+0x34/0x50
init_module+0x15c/0xa7c [sfp]
cleanup_module+0x1d94/0x3120 [sfp]
cleanup_module+0x2bb4/0x3120 [sfp]
process_one_work+0x1f8/0x4ec
worker_thread+0x1e8/0x3d8
kthread+0x104/0x110
ret_from_fork+0x10/0x20
Signed-off-by: Daniel Golle <daniel@makrotopia.org>
Fixes: 01e5b728e9e4 ("net: phy: Add a binding for PHY LEDs")
Link: https://lore.kernel.org/r/102a9dce38bdf00215735d04cd4704458273ad9c.1702339354.git.daniel@makrotopia.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/phy_device.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 2ce74593d6e4a..a42df2c1bd043 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -1548,7 +1548,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
goto error;
phy_resume(phydev);
- phy_led_triggers_register(phydev);
+ if (!phydev->is_on_sfp_module)
+ phy_led_triggers_register(phydev);
/**
* If the external phy used by current mac interface is managed by
@@ -1817,7 +1818,8 @@ void phy_detach(struct phy_device *phydev)
}
phydev->phylink = NULL;
- phy_led_triggers_unregister(phydev);
+ if (!phydev->is_on_sfp_module)
+ phy_led_triggers_unregister(phydev);
if (phydev->mdio.dev.driver)
module_put(phydev->mdio.dev.driver->owner);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 057/156] ice: stop trashing VF VSI aggregator node ID information
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 056/156] net: phy: skip LED triggers on PHYs on SFP modules Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 058/156] ice: alter feature support check for SRIOV and LAG Greg Kroah-Hartman
` (107 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jacob Keller, Przemek Kitszel,
Simon Horman, Rafal Romanowski, Tony Nguyen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jacob Keller <jacob.e.keller@intel.com>
[ Upstream commit 7d881346121a97756f34e00e6296a5d63f001f7f ]
When creating new VSIs, they are assigned into an aggregator node in the
scheduler tree. Information about which aggregator node a VSI is assigned
into is maintained by the vsi->agg_node structure. In ice_vsi_decfg(), this
information is being destroyed, by overwriting the valid flag and the
agg_id field to zero.
For VF VSIs, this breaks the aggregator node configuration replay, which
depends on this information. This results in VFs being inserted into the
default aggregator node. The resulting configuration will have unexpected
Tx bandwidth sharing behavior.
This was broken by commit 6624e780a577 ("ice: split ice_vsi_setup into
smaller functions"), which added the block to reset the agg_node data.
The vsi->agg_node structure is not managed by the scheduler code, but is
instead a wrapper around an aggregator node ID that is tracked at the VSI
layer. Its been around for a long time, and its primary purpose was for
handling VFs. The SR-IOV VF reset flow does not make use of the standard VSI
rebuild/replay logic, and uses vsi->agg_node as part of its handling to
rebuild the aggregator node configuration.
The logic for aggregator nodes stretches back to early ice driver code from
commit b126bd6bcd67 ("ice: create scheduler aggregator node config and move
VSIs")
The logic in ice_vsi_decfg() which trashes the ice_agg_node data is clearly
wrong. It destroys information that is necessary for handling VF reset,. It
is also not the correct way to actually remove a VSI from an aggregator
node. For that, we need to implement logic in the scheduler code. Further,
non-VF VSIs properly replay their aggregator configuration using existing
scheduler replay logic.
To fix the VF replay logic, remove this broken aggregator node cleanup
logic. This is the simplest way to immediately fix this.
This ensures that VFs will have proper aggregate configuration after a
reset. This is especially important since VFs often perform resets as part
of their reconfiguration flows. Without fixing this, VFs will be placed in
the default aggregator node and Tx bandwidth will not be shared in the
expected and configured manner.
Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions")
Signed-off-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Rafal Romanowski <rafal.romanowski@intel.com>
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_lib.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 73bbf06a76db9..8dbf7a381e49b 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -2633,10 +2633,6 @@ void ice_vsi_decfg(struct ice_vsi *vsi)
if (vsi->type == ICE_VSI_VF &&
vsi->agg_node && vsi->agg_node->valid)
vsi->agg_node->num_vsis--;
- if (vsi->agg_node) {
- vsi->agg_node->valid = false;
- vsi->agg_node->agg_id = 0;
- }
}
/**
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 058/156] ice: alter feature support check for SRIOV and LAG
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 057/156] ice: stop trashing VF VSI aggregator node ID information Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 059/156] ice: Fix PF with enabled XDP going no-carrier after reset Greg Kroah-Hartman
` (106 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jesse Brandeburg, Dave Ertman,
Simon Horman, Tony Nguyen, Sasha Levin, Pucha Himasekhar Reddy
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Ertman <david.m.ertman@intel.com>
[ Upstream commit 4d50fcdc2476eef94c14c6761073af5667bb43b6 ]
Previously, the ice driver had support for using a handler for bonding
netdev events to ensure that conflicting features were not allowed to be
activated at the same time. While this was still in place, additional
support was added to specifically support SRIOV and LAG together. These
both utilized the netdev event handler, but the SRIOV and LAG feature was
behind a capabilities feature check to make sure the current NVM has
support.
The exclusion part of the event handler should be removed since there are
users who have custom made solutions that depend on the non-exclusion of
features.
Wrap the creation/registration and cleanup of the event handler and
associated structs in the probe flow with a feature check so that the
only systems that support the full implementation of LAG features will
initialize support. This will leave other systems unhindered with
functionality as it existed before any LAG code was added.
Fixes: bb52f42acef6 ("ice: Add driver support for firmware changes for LAG")
Reviewed-by: Jesse Brandeburg <jesse.brandeburg@intel.com>
Signed-off-by: Dave Ertman <david.m.ertman@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Pucha Himasekhar Reddy <himasekharx.reddy.pucha@intel.com> (A Contingent worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_lag.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/ethernet/intel/ice/ice_lag.c b/drivers/net/ethernet/intel/ice/ice_lag.c
index d86e2460b5a4d..23e197c3d02a7 100644
--- a/drivers/net/ethernet/intel/ice/ice_lag.c
+++ b/drivers/net/ethernet/intel/ice/ice_lag.c
@@ -1963,6 +1963,8 @@ int ice_init_lag(struct ice_pf *pf)
int n, err;
ice_lag_init_feature_support_flag(pf);
+ if (!ice_is_feature_supported(pf, ICE_F_SRIOV_LAG))
+ return 0;
pf->lag = kzalloc(sizeof(*lag), GFP_KERNEL);
if (!pf->lag)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 059/156] ice: Fix PF with enabled XDP going no-carrier after reset
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 058/156] ice: alter feature support check for SRIOV and LAG Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 060/156] net: mana: select PAGE_POOL Greg Kroah-Hartman
` (105 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Przemek Kitszel, Larysa Zaremba,
Simon Horman, Tony Nguyen, Sasha Levin, Chandan Kumar Rout
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Larysa Zaremba <larysa.zaremba@intel.com>
[ Upstream commit f5728a418945ba53e2fdf38a6e5c5a2670965e85 ]
Commit 6624e780a577fc596788 ("ice: split ice_vsi_setup into smaller
functions") has refactored a bunch of code involved in PFR. In this
process, TC queue number adjustment for XDP was lost. Bring it back.
Lack of such adjustment causes interface to go into no-carrier after a
reset, if XDP program is attached, with the following message:
ice 0000:b1:00.0: Failed to set LAN Tx queue context, error: -22
ice 0000:b1:00.0 ens801f0np0: Failed to open VSI 0x0006 on switch 0x0001
ice 0000:b1:00.0: enable VSI failed, err -22, VSI index 0, type ICE_VSI_PF
ice 0000:b1:00.0: PF VSI rebuild failed: -22
ice 0000:b1:00.0: Rebuild failed, unload and reload driver
Fixes: 6624e780a577 ("ice: split ice_vsi_setup into smaller functions")
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: Larysa Zaremba <larysa.zaremba@intel.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Chandan Kumar Rout <chandanx.rout@intel.com> (A Contingent Worker at Intel)
Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/intel/ice/ice_lib.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/intel/ice/ice_lib.c b/drivers/net/ethernet/intel/ice/ice_lib.c
index 8dbf7a381e49b..a66c3b6ccec1e 100644
--- a/drivers/net/ethernet/intel/ice/ice_lib.c
+++ b/drivers/net/ethernet/intel/ice/ice_lib.c
@@ -2384,6 +2384,9 @@ static int ice_vsi_cfg_tc_lan(struct ice_pf *pf, struct ice_vsi *vsi)
} else {
max_txqs[i] = vsi->alloc_txq;
}
+
+ if (vsi->type == ICE_VSI_PF)
+ max_txqs[i] += vsi->num_xdp_txq;
}
dev_dbg(dev, "vsi->tc_cfg.ena_tc = %d\n", vsi->tc_cfg.ena_tc);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 060/156] net: mana: select PAGE_POOL
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 059/156] ice: Fix PF with enabled XDP going no-carrier after reset Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 061/156] net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Greg Kroah-Hartman
` (104 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yury Norov, Simon Horman,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yury Norov <yury.norov@gmail.com>
[ Upstream commit 340943fbff3d8faa44d2223ca04917df28786a07 ]
Mana uses PAGE_POOL API. x86_64 defconfig doesn't select it:
ld: vmlinux.o: in function `mana_create_page_pool.isra.0':
mana_en.c:(.text+0x9ae36f): undefined reference to `page_pool_create'
ld: vmlinux.o: in function `mana_get_rxfrag':
mana_en.c:(.text+0x9afed1): undefined reference to `page_pool_alloc_pages'
make[3]: *** [/home/yury/work/linux/scripts/Makefile.vmlinux:37: vmlinux] Error 1
make[2]: *** [/home/yury/work/linux/Makefile:1154: vmlinux] Error 2
make[1]: *** [/home/yury/work/linux/Makefile:234: __sub-make] Error 2
make[1]: Leaving directory '/home/yury/work/build-linux-x86_64'
make: *** [Makefile:234: __sub-make] Error 2
So we need to select it explicitly.
Signed-off-by: Yury Norov <yury.norov@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Tested-by: Simon Horman <horms@kernel.org> # build-tested
Fixes: ca9c54d2 ("net: mana: Add a driver for Microsoft Azure Network Adapter")
Link: https://lore.kernel.org/r/20231215203353.635379-1-yury.norov@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/microsoft/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ethernet/microsoft/Kconfig b/drivers/net/ethernet/microsoft/Kconfig
index 090e6b9832431..01eb7445ead95 100644
--- a/drivers/net/ethernet/microsoft/Kconfig
+++ b/drivers/net/ethernet/microsoft/Kconfig
@@ -20,6 +20,7 @@ config MICROSOFT_MANA
depends on PCI_MSI && X86_64
depends on PCI_HYPERV
select AUXILIARY_BUS
+ select PAGE_POOL
help
This driver supports Microsoft Azure Network Adapter (MANA).
So far, the driver is only supported on X86_64.
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 061/156] net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 060/156] net: mana: select PAGE_POOL Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 062/156] afs: Fix the dynamic roots d_delete to always delete unused dentries Greg Kroah-Hartman
` (103 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Liu Jian, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Jian <liujian56@huawei.com>
[ Upstream commit 01a564bab4876007ce35f312e16797dfe40e4823 ]
I got the below warning trace:
WARNING: CPU: 4 PID: 4056 at net/core/dev.c:11066 unregister_netdevice_many_notify
CPU: 4 PID: 4056 Comm: ip Not tainted 6.7.0-rc4+ #15
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
RIP: 0010:unregister_netdevice_many_notify+0x9a4/0x9b0
Call Trace:
rtnl_dellink
rtnetlink_rcv_msg
netlink_rcv_skb
netlink_unicast
netlink_sendmsg
__sock_sendmsg
____sys_sendmsg
___sys_sendmsg
__sys_sendmsg
do_syscall_64
entry_SYSCALL_64_after_hwframe
It can be repoduced via:
ip netns add ns1
ip netns exec ns1 ip link add bond0 type bond mode 0
ip netns exec ns1 ip link add bond_slave_1 type veth peer veth2
ip netns exec ns1 ip link set bond_slave_1 master bond0
[1] ip netns exec ns1 ethtool -K bond0 rx-vlan-filter off
[2] ip netns exec ns1 ip link add link bond_slave_1 name bond_slave_1.0 type vlan id 0
[3] ip netns exec ns1 ip link add link bond0 name bond0.0 type vlan id 0
[4] ip netns exec ns1 ip link set bond_slave_1 nomaster
[5] ip netns exec ns1 ip link del veth2
ip netns del ns1
This is all caused by command [1] turning off the rx-vlan-filter function
of bond0. The reason is the same as commit 01f4fd270870 ("bonding: Fix
incorrect deletion of ETH_P_8021AD protocol vid from slaves"). Commands
[2] [3] add the same vid to slave and master respectively, causing
command [4] to empty slave->vlan_info. The following command [5] triggers
this problem.
To fix this problem, we should add VLAN_FILTER feature checks in
vlan_vids_add_by_dev() and vlan_vids_del_by_dev() to prevent incorrect
addition or deletion of vlan_vid information.
Fixes: 348a1443cc43 ("vlan: introduce functions to do mass addition/deletion of vids by another device")
Signed-off-by: Liu Jian <liujian56@huawei.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/8021q/vlan_core.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c
index 0beb44f2fe1f0..f001582345052 100644
--- a/net/8021q/vlan_core.c
+++ b/net/8021q/vlan_core.c
@@ -407,6 +407,8 @@ int vlan_vids_add_by_dev(struct net_device *dev,
return 0;
list_for_each_entry(vid_info, &vlan_info->vid_list, list) {
+ if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+ continue;
err = vlan_vid_add(dev, vid_info->proto, vid_info->vid);
if (err)
goto unwind;
@@ -417,6 +419,8 @@ int vlan_vids_add_by_dev(struct net_device *dev,
list_for_each_entry_continue_reverse(vid_info,
&vlan_info->vid_list,
list) {
+ if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+ continue;
vlan_vid_del(dev, vid_info->proto, vid_info->vid);
}
@@ -436,8 +440,11 @@ void vlan_vids_del_by_dev(struct net_device *dev,
if (!vlan_info)
return;
- list_for_each_entry(vid_info, &vlan_info->vid_list, list)
+ list_for_each_entry(vid_info, &vlan_info->vid_list, list) {
+ if (!vlan_hw_filter_capable(by_dev, vid_info->proto))
+ continue;
vlan_vid_del(dev, vid_info->proto, vid_info->vid);
+ }
}
EXPORT_SYMBOL(vlan_vids_del_by_dev);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 062/156] afs: Fix the dynamic roots d_delete to always delete unused dentries
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 061/156] net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 063/156] afs: Fix dynamic root lookup DNS check Greg Kroah-Hartman
` (102 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Markus Suvanto,
Marc Dionne, linux-afs, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 71f8b55bc30e82d6355e07811213d847981a32e2 ]
Fix the afs dynamic root's d_delete function to always delete unused
dentries rather than only deleting them if they're positive. With things
as they stand upstream, negative dentries stemming from failed DNS lookups
stick around preventing retries.
Fixes: 66c7e1d319a5 ("afs: Split the dynroot stuff out and give it its own ops tables")
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/dynroot.c | 13 +------------
1 file changed, 1 insertion(+), 12 deletions(-)
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index 8081d68004d05..cec7d8e5ad0c9 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -252,20 +252,9 @@ static int afs_dynroot_d_revalidate(struct dentry *dentry, unsigned int flags)
return 1;
}
-/*
- * Allow the VFS to enquire as to whether a dentry should be unhashed (mustn't
- * sleep)
- * - called from dput() when d_count is going to 0.
- * - return 1 to request dentry be unhashed, 0 otherwise
- */
-static int afs_dynroot_d_delete(const struct dentry *dentry)
-{
- return d_really_is_positive(dentry);
-}
-
const struct dentry_operations afs_dynroot_dentry_operations = {
.d_revalidate = afs_dynroot_d_revalidate,
- .d_delete = afs_dynroot_d_delete,
+ .d_delete = always_delete_dentry,
.d_release = afs_d_release,
.d_automount = afs_d_automount,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 063/156] afs: Fix dynamic root lookup DNS check
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 062/156] afs: Fix the dynamic roots d_delete to always delete unused dentries Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 064/156] net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() Greg Kroah-Hartman
` (101 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Markus Suvanto, David Howells,
Marc Dionne, linux-afs, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 74cef6872ceaefb5b6c5c60641371ea28702d358 ]
In the afs dynamic root directory, the ->lookup() function does a DNS check
on the cell being asked for and if the DNS upcall reports an error it will
report an error back to userspace (typically ENOENT).
However, if a failed DNS upcall returns a new-style result, it will return
a valid result, with the status field set appropriately to indicate the
type of failure - and in that case, dns_query() doesn't return an error and
we let stat() complete with no error - which can cause confusion in
userspace as subsequent calls that trigger d_automount then fail with
ENOENT.
Fix this by checking the status result from a valid dns_query() and
returning an error if it indicates a failure.
Fixes: bbb4c4323a4d ("dns: Allow the dns resolver to retrieve a server set")
Reported-by: Markus Suvanto <markus.suvanto@gmail.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=216637
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/dynroot.c | 18 ++++++++++++++++--
1 file changed, 16 insertions(+), 2 deletions(-)
diff --git a/fs/afs/dynroot.c b/fs/afs/dynroot.c
index cec7d8e5ad0c9..10905a53d5b27 100644
--- a/fs/afs/dynroot.c
+++ b/fs/afs/dynroot.c
@@ -114,6 +114,7 @@ static int afs_probe_cell_name(struct dentry *dentry)
struct afs_net *net = afs_d2net(dentry);
const char *name = dentry->d_name.name;
size_t len = dentry->d_name.len;
+ char *result = NULL;
int ret;
/* Names prefixed with a dot are R/W mounts. */
@@ -131,9 +132,22 @@ static int afs_probe_cell_name(struct dentry *dentry)
}
ret = dns_query(net->net, "afsdb", name, len, "srv=1",
- NULL, NULL, false);
- if (ret == -ENODATA || ret == -ENOKEY)
+ &result, NULL, false);
+ if (ret == -ENODATA || ret == -ENOKEY || ret == 0)
ret = -ENOENT;
+ if (ret > 0 && ret >= sizeof(struct dns_server_list_v1_header)) {
+ struct dns_server_list_v1_header *v1 = (void *)result;
+
+ if (v1->hdr.zero == 0 &&
+ v1->hdr.content == DNS_PAYLOAD_IS_SERVER_LIST &&
+ v1->hdr.version == 1 &&
+ (v1->status != DNS_LOOKUP_GOOD &&
+ v1->status != DNS_LOOKUP_GOOD_WITH_BAD))
+ return -ENOENT;
+
+ }
+
+ kfree(result);
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 064/156] net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 063/156] afs: Fix dynamic root lookup DNS check Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 065/156] net/ipv6: Revert remove expired routes with a separated list of routes Greg Kroah-Hartman
` (100 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lorenzo Bianconi, Simon Horman,
Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lorenzo Bianconi <lorenzo@kernel.org>
[ Upstream commit 7cb8cd4daacfea646cf8b5925ca2c66c98b18480 ]
In order to avoid a NULL pointer dereference, check entry->buf pointer before running
skb_free_frag in mtk_wed_wo_queue_tx_clean routine.
Fixes: 799684448e3e ("net: ethernet: mtk_wed: introduce wed wo support")
Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/3c1262464d215faa8acebfc08869798c81c96f4a.1702827359.git.lorenzo@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/ethernet/mediatek/mtk_wed_wo.c b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
index 3bd51a3d66500..ae44ad5f8ce8a 100644
--- a/drivers/net/ethernet/mediatek/mtk_wed_wo.c
+++ b/drivers/net/ethernet/mediatek/mtk_wed_wo.c
@@ -291,6 +291,9 @@ mtk_wed_wo_queue_tx_clean(struct mtk_wed_wo *wo, struct mtk_wed_wo_queue *q)
for (i = 0; i < q->n_desc; i++) {
struct mtk_wed_wo_queue_entry *entry = &q->entry[i];
+ if (!entry->buf)
+ continue;
+
dma_unmap_single(wo->hw->dev, entry->addr, entry->len,
DMA_TO_DEVICE);
skb_free_frag(entry->buf);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 065/156] net/ipv6: Revert remove expired routes with a separated list of routes
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 064/156] net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 066/156] net: check dev->gso_max_size in gso_features_check() Greg Kroah-Hartman
` (99 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kui-Feng Lee, David Ahern,
Eric Dumazet, Paolo Abeni, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Ahern <dsahern@kernel.org>
[ Upstream commit dade3f6a1e4e35a5ae916d5e78b3229ec34c78ec ]
This reverts commit 3dec89b14d37ee635e772636dad3f09f78f1ab87.
The commit has some race conditions given how expires is managed on a
fib6_info in relation to gc start, adding the entry to the gc list and
setting the timer value leading to UAF. Revert the commit and try again
in a later release.
Fixes: 3dec89b14d37 ("net/ipv6: Remove expired routes with a separated list of routes")
Cc: Kui-Feng Lee <thinker.li@gmail.com>
Signed-off-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231219030243.25687-1-dsahern@kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/ip6_fib.h | 64 +++++++++----------------------------------
net/ipv6/ip6_fib.c | 55 ++++---------------------------------
net/ipv6/route.c | 6 ++--
3 files changed, 22 insertions(+), 103 deletions(-)
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 1ba9f4ddf2f6d..9ba6413fd2e3e 100644
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -179,9 +179,6 @@ struct fib6_info {
refcount_t fib6_ref;
unsigned long expires;
-
- struct hlist_node gc_link;
-
struct dst_metrics *fib6_metrics;
#define fib6_pmtu fib6_metrics->metrics[RTAX_MTU-1]
@@ -250,6 +247,19 @@ static inline bool fib6_requires_src(const struct fib6_info *rt)
return rt->fib6_src.plen > 0;
}
+static inline void fib6_clean_expires(struct fib6_info *f6i)
+{
+ f6i->fib6_flags &= ~RTF_EXPIRES;
+ f6i->expires = 0;
+}
+
+static inline void fib6_set_expires(struct fib6_info *f6i,
+ unsigned long expires)
+{
+ f6i->expires = expires;
+ f6i->fib6_flags |= RTF_EXPIRES;
+}
+
static inline bool fib6_check_expired(const struct fib6_info *f6i)
{
if (f6i->fib6_flags & RTF_EXPIRES)
@@ -257,11 +267,6 @@ static inline bool fib6_check_expired(const struct fib6_info *f6i)
return false;
}
-static inline bool fib6_has_expires(const struct fib6_info *f6i)
-{
- return f6i->fib6_flags & RTF_EXPIRES;
-}
-
/* Function to safely get fn->fn_sernum for passed in rt
* and store result in passed in cookie.
* Return true if we can get cookie safely
@@ -383,7 +388,6 @@ struct fib6_table {
struct inet_peer_base tb6_peers;
unsigned int flags;
unsigned int fib_seq;
- struct hlist_head tb6_gc_hlist; /* GC candidates */
#define RT6_TABLE_HAS_DFLT_ROUTER BIT(0)
};
@@ -500,48 +504,6 @@ void fib6_gc_cleanup(void);
int fib6_init(void);
-/* fib6_info must be locked by the caller, and fib6_info->fib6_table can be
- * NULL.
- */
-static inline void fib6_set_expires_locked(struct fib6_info *f6i,
- unsigned long expires)
-{
- struct fib6_table *tb6;
-
- tb6 = f6i->fib6_table;
- f6i->expires = expires;
- if (tb6 && !fib6_has_expires(f6i))
- hlist_add_head(&f6i->gc_link, &tb6->tb6_gc_hlist);
- f6i->fib6_flags |= RTF_EXPIRES;
-}
-
-/* fib6_info must be locked by the caller, and fib6_info->fib6_table can be
- * NULL. If fib6_table is NULL, the fib6_info will no be inserted into the
- * list of GC candidates until it is inserted into a table.
- */
-static inline void fib6_set_expires(struct fib6_info *f6i,
- unsigned long expires)
-{
- spin_lock_bh(&f6i->fib6_table->tb6_lock);
- fib6_set_expires_locked(f6i, expires);
- spin_unlock_bh(&f6i->fib6_table->tb6_lock);
-}
-
-static inline void fib6_clean_expires_locked(struct fib6_info *f6i)
-{
- if (fib6_has_expires(f6i))
- hlist_del_init(&f6i->gc_link);
- f6i->fib6_flags &= ~RTF_EXPIRES;
- f6i->expires = 0;
-}
-
-static inline void fib6_clean_expires(struct fib6_info *f6i)
-{
- spin_lock_bh(&f6i->fib6_table->tb6_lock);
- fib6_clean_expires_locked(f6i);
- spin_unlock_bh(&f6i->fib6_table->tb6_lock);
-}
-
struct ipv6_route_iter {
struct seq_net_private p;
struct fib6_walker w;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 7772f42ff2b94..4fc2cae0d116c 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -160,8 +160,6 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags, bool with_fib6_nh)
INIT_LIST_HEAD(&f6i->fib6_siblings);
refcount_set(&f6i->fib6_ref, 1);
- INIT_HLIST_NODE(&f6i->gc_link);
-
return f6i;
}
@@ -248,7 +246,6 @@ static struct fib6_table *fib6_alloc_table(struct net *net, u32 id)
net->ipv6.fib6_null_entry);
table->tb6_root.fn_flags = RTN_ROOT | RTN_TL_ROOT | RTN_RTINFO;
inet_peer_base_init(&table->tb6_peers);
- INIT_HLIST_HEAD(&table->tb6_gc_hlist);
}
return table;
@@ -1060,8 +1057,6 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
lockdep_is_held(&table->tb6_lock));
}
}
-
- fib6_clean_expires_locked(rt);
}
/*
@@ -1123,10 +1118,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
if (!(iter->fib6_flags & RTF_EXPIRES))
return -EEXIST;
if (!(rt->fib6_flags & RTF_EXPIRES))
- fib6_clean_expires_locked(iter);
+ fib6_clean_expires(iter);
else
- fib6_set_expires_locked(iter,
- rt->expires);
+ fib6_set_expires(iter, rt->expires);
if (rt->fib6_pmtu)
fib6_metric_set(iter, RTAX_MTU,
@@ -1485,10 +1479,6 @@ int fib6_add(struct fib6_node *root, struct fib6_info *rt,
if (rt->nh)
list_add(&rt->nh_list, &rt->nh->f6i_list);
__fib6_update_sernum_upto_root(rt, fib6_new_sernum(info->nl_net));
-
- if (fib6_has_expires(rt))
- hlist_add_head(&rt->gc_link, &table->tb6_gc_hlist);
-
fib6_start_gc(info->nl_net, rt);
}
@@ -2291,8 +2281,9 @@ static void fib6_flush_trees(struct net *net)
* Garbage collection
*/
-static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)
+static int fib6_age(struct fib6_info *rt, void *arg)
{
+ struct fib6_gc_args *gc_args = arg;
unsigned long now = jiffies;
/*
@@ -2300,7 +2291,7 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)
* Routes are expired even if they are in use.
*/
- if (fib6_has_expires(rt) && rt->expires) {
+ if (rt->fib6_flags & RTF_EXPIRES && rt->expires) {
if (time_after(now, rt->expires)) {
RT6_TRACE("expiring %p\n", rt);
return -1;
@@ -2317,40 +2308,6 @@ static int fib6_age(struct fib6_info *rt, struct fib6_gc_args *gc_args)
return 0;
}
-static void fib6_gc_table(struct net *net,
- struct fib6_table *tb6,
- struct fib6_gc_args *gc_args)
-{
- struct fib6_info *rt;
- struct hlist_node *n;
- struct nl_info info = {
- .nl_net = net,
- .skip_notify = false,
- };
-
- hlist_for_each_entry_safe(rt, n, &tb6->tb6_gc_hlist, gc_link)
- if (fib6_age(rt, gc_args) == -1)
- fib6_del(rt, &info);
-}
-
-static void fib6_gc_all(struct net *net, struct fib6_gc_args *gc_args)
-{
- struct fib6_table *table;
- struct hlist_head *head;
- unsigned int h;
-
- rcu_read_lock();
- for (h = 0; h < FIB6_TABLE_HASHSZ; h++) {
- head = &net->ipv6.fib_table_hash[h];
- hlist_for_each_entry_rcu(table, head, tb6_hlist) {
- spin_lock_bh(&table->tb6_lock);
- fib6_gc_table(net, table, gc_args);
- spin_unlock_bh(&table->tb6_lock);
- }
- }
- rcu_read_unlock();
-}
-
void fib6_run_gc(unsigned long expires, struct net *net, bool force)
{
struct fib6_gc_args gc_args;
@@ -2366,7 +2323,7 @@ void fib6_run_gc(unsigned long expires, struct net *net, bool force)
net->ipv6.sysctl.ip6_rt_gc_interval;
gc_args.more = 0;
- fib6_gc_all(net, &gc_args);
+ fib6_clean_all(net, fib6_age, &gc_args);
now = jiffies;
net->ipv6.ip6_rt_last_gc = now;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 9c687b357e6a4..56525b5b95a2b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3763,10 +3763,10 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
rt->dst_nocount = true;
if (cfg->fc_flags & RTF_EXPIRES)
- fib6_set_expires_locked(rt, jiffies +
- clock_t_to_jiffies(cfg->fc_expires));
+ fib6_set_expires(rt, jiffies +
+ clock_t_to_jiffies(cfg->fc_expires));
else
- fib6_clean_expires_locked(rt);
+ fib6_clean_expires(rt);
if (cfg->fc_protocol == RTPROT_UNSPEC)
cfg->fc_protocol = RTPROT_BOOT;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 066/156] net: check dev->gso_max_size in gso_features_check()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 065/156] net/ipv6: Revert remove expired routes with a separated list of routes Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry Greg Kroah-Hartman
` (98 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Paolo Abeni,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 24ab059d2ebd62fdccc43794796f6ffbabe49ebc ]
Some drivers might misbehave if TSO packets get too big.
GVE for instance uses a 16bit field in its TX descriptor,
and will do bad things if a packet is bigger than 2^16 bytes.
Linux TCP stack honors dev->gso_max_size, but there are
other ways for too big packets to reach an ndo_start_xmit()
handler : virtio_net, af_packet, GRO...
Add a generic check in gso_features_check() and fallback
to GSO when needed.
gso_max_size was added in the blamed commit.
Fixes: 82cc1a7a5687 ("[NET]: Add per-connection option to set max TSO frame size")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/20231219125331.4127498-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/dev.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/net/core/dev.c b/net/core/dev.c
index 9bf90b2a75b6a..e480afb50d4c1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3500,6 +3500,9 @@ static netdev_features_t gso_features_check(const struct sk_buff *skb,
if (gso_segs > READ_ONCE(dev->gso_max_segs))
return features & ~NETIF_F_GSO_MASK;
+ if (unlikely(skb->len >= READ_ONCE(dev->gso_max_size)))
+ return features & ~NETIF_F_GSO_MASK;
+
if (!skb_shinfo(skb)->gso_type) {
skb_warn_bad_offload(skb);
return features & ~NETIF_F_GSO_MASK;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 066/156] net: check dev->gso_max_size in gso_features_check() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2024-01-05 2:13 ` Jeffrey E Altman
2023-12-30 11:58 ` [PATCH 6.6 068/156] afs: Fix overwriting of result of DNS query Greg Kroah-Hartman
` (97 subsequent siblings)
164 siblings, 1 reply; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Markus Suvanto,
Wang Lei, Jeff Layton, Steve French, Marc Dionne, Jarkko Sakkinen,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
linux-afs, linux-cifs, linux-nfs, ceph-devel, keyrings, netdev,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ]
If a key has an expiration time, then when that time passes, the key is
left around for a certain amount of time before being collected (5 mins by
default) so that EKEYEXPIRED can be returned instead of ENOKEY. This is a
problem for DNS keys because we want to redo the DNS lookup immediately at
that point.
Fix this by allowing key types to be marked such that keys of that type
don't have this extra period, but are reclaimed as soon as they expire and
turn this on for dns_resolver-type keys. To make this easier to handle,
key->expiry is changed to be permanent if TIME64_MAX rather than 0.
Furthermore, give such new-style negative DNS results a 1s default expiry
if no other expiry time is set rather than allowing it to stick around
indefinitely. This shouldn't be zero as ls will follow a failing stat call
immediately with a second with AT_SYMLINK_NOFOLLOW added.
Fixes: 1a4240f4764a ("DNS: Separate out CIFS DNS Resolver code")
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Markus Suvanto <markus.suvanto@gmail.com>
cc: Wang Lei <wang840925@gmail.com>
cc: Jeff Layton <jlayton@redhat.com>
cc: Steve French <smfrench@gmail.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: linux-afs@lists.infradead.org
cc: linux-cifs@vger.kernel.org
cc: linux-nfs@vger.kernel.org
cc: ceph-devel@vger.kernel.org
cc: keyrings@vger.kernel.org
cc: netdev@vger.kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/key-type.h | 1 +
net/dns_resolver/dns_key.c | 10 +++++++++-
security/keys/gc.c | 31 +++++++++++++++++++++----------
security/keys/internal.h | 11 ++++++++++-
security/keys/key.c | 15 +++++----------
security/keys/proc.c | 2 +-
6 files changed, 47 insertions(+), 23 deletions(-)
diff --git a/include/linux/key-type.h b/include/linux/key-type.h
index 7d985a1dfe4af..5caf3ce823733 100644
--- a/include/linux/key-type.h
+++ b/include/linux/key-type.h
@@ -73,6 +73,7 @@ struct key_type {
unsigned int flags;
#define KEY_TYPE_NET_DOMAIN 0x00000001 /* Keys of this type have a net namespace domain */
+#define KEY_TYPE_INSTANT_REAP 0x00000002 /* Keys of this type don't have a delay after expiring */
/* vet a description */
int (*vet_description)(const char *description);
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index 01e54b46ae0b9..2a6d363763a2b 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -91,6 +91,7 @@ const struct cred *dns_resolver_cache;
static int
dns_resolver_preparse(struct key_preparsed_payload *prep)
{
+ const struct dns_server_list_v1_header *v1;
const struct dns_payload_header *bin;
struct user_key_payload *upayload;
unsigned long derrno;
@@ -122,6 +123,13 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
return -EINVAL;
}
+ v1 = (const struct dns_server_list_v1_header *)bin;
+ if ((v1->status != DNS_LOOKUP_GOOD &&
+ v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) {
+ if (prep->expiry == TIME64_MAX)
+ prep->expiry = ktime_get_real_seconds() + 1;
+ }
+
result_len = datalen;
goto store_result;
}
@@ -314,7 +322,7 @@ static long dns_resolver_read(const struct key *key,
struct key_type key_type_dns_resolver = {
.name = "dns_resolver",
- .flags = KEY_TYPE_NET_DOMAIN,
+ .flags = KEY_TYPE_NET_DOMAIN | KEY_TYPE_INSTANT_REAP,
.preparse = dns_resolver_preparse,
.free_preparse = dns_resolver_free_preparse,
.instantiate = generic_key_instantiate,
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 3c90807476eb0..eaddaceda14ea 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -66,6 +66,19 @@ void key_schedule_gc(time64_t gc_at)
}
}
+/*
+ * Set the expiration time on a key.
+ */
+void key_set_expiry(struct key *key, time64_t expiry)
+{
+ key->expiry = expiry;
+ if (expiry != TIME64_MAX) {
+ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
+ expiry += key_gc_delay;
+ key_schedule_gc(expiry);
+ }
+}
+
/*
* Schedule a dead links collection run.
*/
@@ -176,7 +189,6 @@ static void key_garbage_collector(struct work_struct *work)
static u8 gc_state; /* Internal persistent state */
#define KEY_GC_REAP_AGAIN 0x01 /* - Need another cycle */
#define KEY_GC_REAPING_LINKS 0x02 /* - We need to reap links */
-#define KEY_GC_SET_TIMER 0x04 /* - We need to restart the timer */
#define KEY_GC_REAPING_DEAD_1 0x10 /* - We need to mark dead keys */
#define KEY_GC_REAPING_DEAD_2 0x20 /* - We need to reap dead key links */
#define KEY_GC_REAPING_DEAD_3 0x40 /* - We need to reap dead keys */
@@ -184,21 +196,17 @@ static void key_garbage_collector(struct work_struct *work)
struct rb_node *cursor;
struct key *key;
- time64_t new_timer, limit;
+ time64_t new_timer, limit, expiry;
kenter("[%lx,%x]", key_gc_flags, gc_state);
limit = ktime_get_real_seconds();
- if (limit > key_gc_delay)
- limit -= key_gc_delay;
- else
- limit = key_gc_delay;
/* Work out what we're going to be doing in this pass */
gc_state &= KEY_GC_REAPING_DEAD_1 | KEY_GC_REAPING_DEAD_2;
gc_state <<= 1;
if (test_and_clear_bit(KEY_GC_KEY_EXPIRED, &key_gc_flags))
- gc_state |= KEY_GC_REAPING_LINKS | KEY_GC_SET_TIMER;
+ gc_state |= KEY_GC_REAPING_LINKS;
if (test_and_clear_bit(KEY_GC_REAP_KEYTYPE, &key_gc_flags))
gc_state |= KEY_GC_REAPING_DEAD_1;
@@ -233,8 +241,11 @@ static void key_garbage_collector(struct work_struct *work)
}
}
- if (gc_state & KEY_GC_SET_TIMER) {
- if (key->expiry > limit && key->expiry < new_timer) {
+ expiry = key->expiry;
+ if (expiry != TIME64_MAX) {
+ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
+ expiry += key_gc_delay;
+ if (expiry > limit && expiry < new_timer) {
kdebug("will expire %x in %lld",
key_serial(key), key->expiry - limit);
new_timer = key->expiry;
@@ -276,7 +287,7 @@ static void key_garbage_collector(struct work_struct *work)
*/
kdebug("pass complete");
- if (gc_state & KEY_GC_SET_TIMER && new_timer != (time64_t)TIME64_MAX) {
+ if (new_timer != TIME64_MAX) {
new_timer += key_gc_delay;
key_schedule_gc(new_timer);
}
diff --git a/security/keys/internal.h b/security/keys/internal.h
index 3c1e7122076b9..ec2ec335b6133 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -174,6 +174,7 @@ extern unsigned key_gc_delay;
extern void keyring_gc(struct key *keyring, time64_t limit);
extern void keyring_restriction_gc(struct key *keyring,
struct key_type *dead_type);
+void key_set_expiry(struct key *key, time64_t expiry);
extern void key_schedule_gc(time64_t gc_at);
extern void key_schedule_gc_links(void);
extern void key_gc_keytype(struct key_type *ktype);
@@ -222,10 +223,18 @@ extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
*/
static inline bool key_is_dead(const struct key *key, time64_t limit)
{
+ time64_t expiry = key->expiry;
+
+ if (expiry != TIME64_MAX) {
+ if (!(key->type->flags & KEY_TYPE_INSTANT_REAP))
+ expiry += key_gc_delay;
+ if (expiry <= limit)
+ return true;
+ }
+
return
key->flags & ((1 << KEY_FLAG_DEAD) |
(1 << KEY_FLAG_INVALIDATED)) ||
- (key->expiry > 0 && key->expiry <= limit) ||
key->domain_tag->removed;
}
diff --git a/security/keys/key.c b/security/keys/key.c
index 5c0c7df833f8a..5f103b2713c64 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -294,6 +294,7 @@ struct key *key_alloc(struct key_type *type, const char *desc,
key->uid = uid;
key->gid = gid;
key->perm = perm;
+ key->expiry = TIME64_MAX;
key->restrict_link = restrict_link;
key->last_used_at = ktime_get_real_seconds();
@@ -463,10 +464,7 @@ static int __key_instantiate_and_link(struct key *key,
if (authkey)
key_invalidate(authkey);
- if (prep->expiry != TIME64_MAX) {
- key->expiry = prep->expiry;
- key_schedule_gc(prep->expiry + key_gc_delay);
- }
+ key_set_expiry(key, prep->expiry);
}
}
@@ -606,8 +604,7 @@ int key_reject_and_link(struct key *key,
atomic_inc(&key->user->nikeys);
mark_key_instantiated(key, -error);
notify_key(key, NOTIFY_KEY_INSTANTIATED, -error);
- key->expiry = ktime_get_real_seconds() + timeout;
- key_schedule_gc(key->expiry + key_gc_delay);
+ key_set_expiry(key, ktime_get_real_seconds() + timeout);
if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags))
awaken = 1;
@@ -722,16 +719,14 @@ struct key_type *key_type_lookup(const char *type)
void key_set_timeout(struct key *key, unsigned timeout)
{
- time64_t expiry = 0;
+ time64_t expiry = TIME64_MAX;
/* make the changes with the locks held to prevent races */
down_write(&key->sem);
if (timeout > 0)
expiry = ktime_get_real_seconds() + timeout;
-
- key->expiry = expiry;
- key_schedule_gc(key->expiry + key_gc_delay);
+ key_set_expiry(key, expiry);
up_write(&key->sem);
}
diff --git a/security/keys/proc.c b/security/keys/proc.c
index d0cde6685627f..4f4e2c1824f18 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -198,7 +198,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
/* come up with a suitable timeout value */
expiry = READ_ONCE(key->expiry);
- if (expiry == 0) {
+ if (expiry == TIME64_MAX) {
memcpy(xbuf, "perm", 5);
} else if (now >= expiry) {
memcpy(xbuf, "expd", 5);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 068/156] afs: Fix overwriting of result of DNS query
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 069/156] afs: Fix use-after-free due to get/remove race in volume tree Greg Kroah-Hartman
` (96 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Jeffrey Altman,
Anastasia Belova, Marc Dionne, linux-afs, lvc-project,
Linus Torvalds, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit a9e01ac8c5ff32669119c40dfdc9e80eb0b7d7aa ]
In afs_update_cell(), ret is the result of the DNS lookup and the errors
are to be handled by a switch - however, the value gets clobbered in
between by setting it to -ENOMEM in case afs_alloc_vlserver_list()
fails.
Fix this by moving the setting of -ENOMEM into the error handling for
OOM failure. Further, only do it if we don't have an alternative error
to return.
Found by Linux Verification Center (linuxtesting.org) with SVACE. Based
on a patch from Anastasia Belova [1].
Fixes: d5c32c89b208 ("afs: Fix cell DNS lookup")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Anastasia Belova <abelova@astralinux.ru>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
cc: lvc-project@linuxtesting.org
Link: https://lore.kernel.org/r/20231221085849.1463-1-abelova@astralinux.ru/ [1]
Link: https://lore.kernel.org/r/1700862.1703168632@warthog.procyon.org.uk/ # v1
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/cell.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/fs/afs/cell.c b/fs/afs/cell.c
index 988c2ac7cecec..926cb1188eba6 100644
--- a/fs/afs/cell.c
+++ b/fs/afs/cell.c
@@ -409,10 +409,12 @@ static int afs_update_cell(struct afs_cell *cell)
if (ret == -ENOMEM)
goto out_wake;
- ret = -ENOMEM;
vllist = afs_alloc_vlserver_list(0);
- if (!vllist)
+ if (!vllist) {
+ if (ret >= 0)
+ ret = -ENOMEM;
goto out_wake;
+ }
switch (ret) {
case -ENODATA:
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 069/156] afs: Fix use-after-free due to get/remove race in volume tree
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 068/156] afs: Fix overwriting of result of DNS query Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 070/156] drm/i915/hwmon: Fix static analysis tool reported issues Greg Kroah-Hartman
` (95 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Howells, Jeffrey Altman,
Marc Dionne, linux-afs, Linus Torvalds, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
[ Upstream commit 9a6b294ab496650e9f270123730df37030911b55 ]
When an afs_volume struct is put, its refcount is reduced to 0 before
the cell->volume_lock is taken and the volume removed from the
cell->volumes tree.
Unfortunately, this means that the lookup code can race and see a volume
with a zero ref in the tree, resulting in a use-after-free:
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 130782 at lib/refcount.c:25 refcount_warn_saturate+0x7a/0xda
...
RIP: 0010:refcount_warn_saturate+0x7a/0xda
...
Call Trace:
afs_get_volume+0x3d/0x55
afs_create_volume+0x126/0x1de
afs_validate_fc+0xfe/0x130
afs_get_tree+0x20/0x2e5
vfs_get_tree+0x1d/0xc9
do_new_mount+0x13b/0x22e
do_mount+0x5d/0x8a
__do_sys_mount+0x100/0x12a
do_syscall_64+0x3a/0x94
entry_SYSCALL_64_after_hwframe+0x62/0x6a
Fix this by:
(1) When putting, use a flag to indicate if the volume has been removed
from the tree and skip the rb_erase if it has.
(2) When looking up, use a conditional ref increment and if it fails
because the refcount is 0, replace the node in the tree and set the
removal flag.
Fixes: 20325960f875 ("afs: Reorganise volume and server trees to be rooted on the cell")
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jeffrey Altman <jaltman@auristor.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: linux-afs@lists.infradead.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/afs/internal.h | 2 ++
fs/afs/volume.c | 26 +++++++++++++++++++++++---
2 files changed, 25 insertions(+), 3 deletions(-)
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 5041eae64423a..c4bf8439bc9c9 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -586,6 +586,7 @@ struct afs_volume {
#define AFS_VOLUME_OFFLINE 4 /* - T if volume offline notice given */
#define AFS_VOLUME_BUSY 5 /* - T if volume busy notice given */
#define AFS_VOLUME_MAYBE_NO_IBULK 6 /* - T if some servers don't have InlineBulkStatus */
+#define AFS_VOLUME_RM_TREE 7 /* - Set if volume removed from cell->volumes */
#ifdef CONFIG_AFS_FSCACHE
struct fscache_volume *cache; /* Caching cookie */
#endif
@@ -1513,6 +1514,7 @@ extern struct afs_vlserver_list *afs_extract_vlserver_list(struct afs_cell *,
extern struct afs_volume *afs_create_volume(struct afs_fs_context *);
extern int afs_activate_volume(struct afs_volume *);
extern void afs_deactivate_volume(struct afs_volume *);
+bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason);
extern struct afs_volume *afs_get_volume(struct afs_volume *, enum afs_volume_trace);
extern void afs_put_volume(struct afs_net *, struct afs_volume *, enum afs_volume_trace);
extern int afs_check_volume_status(struct afs_volume *, struct afs_operation *);
diff --git a/fs/afs/volume.c b/fs/afs/volume.c
index 29d483c802813..115c081a8e2ce 100644
--- a/fs/afs/volume.c
+++ b/fs/afs/volume.c
@@ -32,8 +32,13 @@ static struct afs_volume *afs_insert_volume_into_cell(struct afs_cell *cell,
} else if (p->vid > volume->vid) {
pp = &(*pp)->rb_right;
} else {
- volume = afs_get_volume(p, afs_volume_trace_get_cell_insert);
- goto found;
+ if (afs_try_get_volume(p, afs_volume_trace_get_cell_insert)) {
+ volume = p;
+ goto found;
+ }
+
+ set_bit(AFS_VOLUME_RM_TREE, &volume->flags);
+ rb_replace_node_rcu(&p->cell_node, &volume->cell_node, &cell->volumes);
}
}
@@ -56,7 +61,8 @@ static void afs_remove_volume_from_cell(struct afs_volume *volume)
afs_volume_trace_remove);
write_seqlock(&cell->volume_lock);
hlist_del_rcu(&volume->proc_link);
- rb_erase(&volume->cell_node, &cell->volumes);
+ if (!test_and_set_bit(AFS_VOLUME_RM_TREE, &volume->flags))
+ rb_erase(&volume->cell_node, &cell->volumes);
write_sequnlock(&cell->volume_lock);
}
}
@@ -231,6 +237,20 @@ static void afs_destroy_volume(struct afs_net *net, struct afs_volume *volume)
_leave(" [destroyed]");
}
+/*
+ * Try to get a reference on a volume record.
+ */
+bool afs_try_get_volume(struct afs_volume *volume, enum afs_volume_trace reason)
+{
+ int r;
+
+ if (__refcount_inc_not_zero(&volume->ref, &r)) {
+ trace_afs_volume(volume->vid, r + 1, reason);
+ return true;
+ }
+ return false;
+}
+
/*
* Get a reference on a volume record.
*/
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 070/156] drm/i915/hwmon: Fix static analysis tool reported issues
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 069/156] afs: Fix use-after-free due to get/remove race in volume tree Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 071/156] drm/i915/mtl: Fix HDMI/DP PLL clock selection Greg Kroah-Hartman
` (94 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Badal Nilawar, Anshuman Gupta,
Karthik Poosa, Jani Nikula, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karthik Poosa <karthik.poosa@intel.com>
[ Upstream commit 768f17fd25e4a98bf5166148629ecf6f647d5efc ]
Updated i915 hwmon with fixes for issues reported by static analysis tool.
Fixed integer overflow with upcasting.
v2:
- Added Fixes tag (Badal).
- Updated commit message as per review comments (Anshuman).
Fixes: 4c2572fe0ae7 ("drm/i915/hwmon: Expose power1_max_interval")
Reviewed-by: Badal Nilawar <badal.nilawar@intel.com>
Reviewed-by: Anshuman Gupta <anshuman.gupta@intel.com>
Signed-off-by: Karthik Poosa <karthik.poosa@intel.com>
Signed-off-by: Anshuman Gupta <anshuman.gupta@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231204144809.1518704-1-karthik.poosa@intel.com
(cherry picked from commit ac3420d3d428443a08b923f9118121c170192b62)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/i915_hwmon.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/i915/i915_hwmon.c b/drivers/gpu/drm/i915/i915_hwmon.c
index 975da8e7f2a9f..8c3f443c8347e 100644
--- a/drivers/gpu/drm/i915/i915_hwmon.c
+++ b/drivers/gpu/drm/i915/i915_hwmon.c
@@ -175,7 +175,7 @@ hwm_power1_max_interval_show(struct device *dev, struct device_attribute *attr,
* tau4 = (4 | x) << y
* but add 2 when doing the final right shift to account for units
*/
- tau4 = ((1 << x_w) | x) << y;
+ tau4 = (u64)((1 << x_w) | x) << y;
/* val in hwmon interface units (millisec) */
out = mul_u64_u32_shr(tau4, SF_TIME, hwmon->scl_shift_time + x_w);
@@ -211,7 +211,7 @@ hwm_power1_max_interval_store(struct device *dev,
r = FIELD_PREP(PKG_MAX_WIN, PKG_MAX_WIN_DEFAULT);
x = REG_FIELD_GET(PKG_MAX_WIN_X, r);
y = REG_FIELD_GET(PKG_MAX_WIN_Y, r);
- tau4 = ((1 << x_w) | x) << y;
+ tau4 = (u64)((1 << x_w) | x) << y;
max_win = mul_u64_u32_shr(tau4, SF_TIME, hwmon->scl_shift_time + x_w);
if (val > max_win)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 071/156] drm/i915/mtl: Fix HDMI/DP PLL clock selection
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 070/156] drm/i915/hwmon: Fix static analysis tool reported issues Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 072/156] ASoC: hdmi-codec: fix missing report for jack initial status Greg Kroah-Hartman
` (93 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mika Kahola, Radhakrishna Sripada,
Imre Deak, Jani Nikula, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Imre Deak <imre.deak@intel.com>
[ Upstream commit dbcab554f777390d9bb6a808ed0cd90ee59bb44e ]
Select the HDMI specific PLL clock only for HDMI outputs.
Fixes: 62618c7f117e ("drm/i915/mtl: C20 PLL programming")
Cc: Mika Kahola <mika.kahola@intel.com>
Cc: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Reviewed-by: Radhakrishna Sripada <radhakrishna.sripada@intel.com>
Signed-off-by: Imre Deak <imre.deak@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231213220526.1828827-1-imre.deak@intel.com
(cherry picked from commit 937d02cc79c6828fef28a4d80d8d0ad2f7bf2b62)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/i915/display/intel_cx0_phy.c b/drivers/gpu/drm/i915/display/intel_cx0_phy.c
index 80e4ec6ee4031..048e581fda16c 100644
--- a/drivers/gpu/drm/i915/display/intel_cx0_phy.c
+++ b/drivers/gpu/drm/i915/display/intel_cx0_phy.c
@@ -2420,7 +2420,8 @@ static void intel_program_port_clock_ctl(struct intel_encoder *encoder,
val |= XELPDP_FORWARD_CLOCK_UNGATE;
- if (is_hdmi_frl(crtc_state->port_clock))
+ if (intel_crtc_has_type(crtc_state, INTEL_OUTPUT_HDMI) &&
+ is_hdmi_frl(crtc_state->port_clock))
val |= XELPDP_DDI_CLOCK_SELECT(XELPDP_DDI_CLOCK_SELECT_DIV18CLK);
else
val |= XELPDP_DDI_CLOCK_SELECT(XELPDP_DDI_CLOCK_SELECT_MAXPCLK);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 072/156] ASoC: hdmi-codec: fix missing report for jack initial status
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 071/156] drm/i915/mtl: Fix HDMI/DP PLL clock selection Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 073/156] ASoC: fsl_sai: Fix channel swap issue on i.MX8MP Greg Kroah-Hartman
` (92 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhengqiao Xia, Hsin-Yi Wang,
Jerome Brunet, Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerome Brunet <jbrunet@baylibre.com>
[ Upstream commit 025222a9d6d25eee2ad9a1bb5a8b29b34b5ba576 ]
This fixes a problem introduced while fixing ELD reporting with no jack
set.
Most driver using the hdmi-codec will call the 'plugged_cb' callback
directly when registered to report the initial state of the HDMI connector.
With the commit mentionned, this occurs before jack is ready and the
initial report is lost for platforms actually providing a jack for HDMI.
Fix this by storing the hdmi connector status regardless of jack being set
or not and report the last status when jack gets set.
With this, the initial state is reported correctly even if it is
disconnected. This was not done initially and is also a fix.
Fixes: 15be353d55f9 ("ASoC: hdmi-codec: register hpd callback on component probe")
Reported-by: Zhengqiao Xia <xiazhengqiao@huaqin.corp-partner.google.com>
Closes: https://lore.kernel.org/alsa-devel/CADYyEwTNyY+fR9SgfDa-g6iiDwkU3MUdPVCYexs2_3wbcM8_vg@mail.gmail.com/
Cc: Hsin-Yi Wang <hsinyi@google.com>
Tested-by: Zhengqiao Xia <xiazhengqiao@huaqin.corp-partner.google.com>
Signed-off-by: Jerome Brunet <jbrunet@baylibre.com>
Link: https://msgid.link/r/20231218145655.134929-1-jbrunet@baylibre.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/hdmi-codec.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c
index 20da1eaa4f1c7..0938671700c62 100644
--- a/sound/soc/codecs/hdmi-codec.c
+++ b/sound/soc/codecs/hdmi-codec.c
@@ -850,8 +850,9 @@ static int hdmi_dai_probe(struct snd_soc_dai *dai)
static void hdmi_codec_jack_report(struct hdmi_codec_priv *hcp,
unsigned int jack_status)
{
- if (hcp->jack && jack_status != hcp->jack_status) {
- snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_LINEOUT);
+ if (jack_status != hcp->jack_status) {
+ if (hcp->jack)
+ snd_soc_jack_report(hcp->jack, jack_status, SND_JACK_LINEOUT);
hcp->jack_status = jack_status;
}
}
@@ -880,6 +881,13 @@ static int hdmi_codec_set_jack(struct snd_soc_component *component,
if (hcp->hcd.ops->hook_plugged_cb) {
hcp->jack = jack;
+
+ /*
+ * Report the initial jack status which may have been provided
+ * by the parent hdmi driver while the hpd hook was registered.
+ */
+ snd_soc_jack_report(jack, hcp->jack_status, SND_JACK_LINEOUT);
+
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 073/156] ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 072/156] ASoC: hdmi-codec: fix missing report for jack initial status Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 074/156] i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() Greg Kroah-Hartman
` (91 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shengjiu Wang, Daniel Baluta,
Mark Brown, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shengjiu Wang <shengjiu.wang@nxp.com>
[ Upstream commit 8f0f01647550daf9cd8752c1656dcb0136d79ce1 ]
When flag mclk_with_tere and mclk_direction_output enabled,
The SAI transmitter or receiver will be enabled in very early
stage, that if FSL_SAI_xMR is set by previous case,
for example previous case is one channel, current case is
two channels, then current case started with wrong xMR in
the beginning, then channel swap happen.
The patch is to clear xMR in hw_free() to avoid such
channel swap issue.
Fixes: 3e4a82612998 ("ASoC: fsl_sai: MCLK bind with TX/RX enable bit")
Signed-off-by: Shengjiu Wang <shengjiu.wang@nxp.com>
Reviewed-by: Daniel Baluta <daniel.baluta@nxp.com>
Link: https://msgid.link/r/1702953057-4499-1-git-send-email-shengjiu.wang@nxp.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/fsl/fsl_sai.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/sound/soc/fsl/fsl_sai.c b/sound/soc/fsl/fsl_sai.c
index 3252eefc4bc0e..3d202398c5411 100644
--- a/sound/soc/fsl/fsl_sai.c
+++ b/sound/soc/fsl/fsl_sai.c
@@ -715,6 +715,9 @@ static int fsl_sai_hw_free(struct snd_pcm_substream *substream,
bool tx = substream->stream == SNDRV_PCM_STREAM_PLAYBACK;
unsigned int ofs = sai->soc_data->reg_offset;
+ /* Clear xMR to avoid channel swap with mclk_with_tere enabled case */
+ regmap_write(sai->regmap, FSL_SAI_xMR(tx), 0);
+
regmap_update_bits(sai->regmap, FSL_SAI_xCR3(tx, ofs),
FSL_SAI_CR3_TRCE_MASK, 0);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 074/156] i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 073/156] ASoC: fsl_sai: Fix channel swap issue on i.MX8MP Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 075/156] drm/amdgpu: re-create idle bos PTE during VM state machine reset Greg Kroah-Hartman
` (90 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Andi Shyti,
Wolfram Sang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 043465b66506e8c647cdd38a2db1f2ee0f369a1b ]
Add missing clk_disable_unprepare() and geni_se_resources_off() in the error
path in geni_i2c_probe().
Fixes: 14d02fbadb5d ("i2c: qcom-geni: add desc struct to prepare support for I2C Master Hub variant")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-qcom-geni.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/i2c/busses/i2c-qcom-geni.c b/drivers/i2c/busses/i2c-qcom-geni.c
index 229353e96e095..0a9d389df301b 100644
--- a/drivers/i2c/busses/i2c-qcom-geni.c
+++ b/drivers/i2c/busses/i2c-qcom-geni.c
@@ -857,6 +857,7 @@ static int geni_i2c_probe(struct platform_device *pdev)
ret = geni_se_resources_on(&gi2c->se);
if (ret) {
dev_err(dev, "Error turning on resources %d\n", ret);
+ clk_disable_unprepare(gi2c->core_clk);
return ret;
}
proto = geni_se_read_proto(&gi2c->se);
@@ -876,8 +877,11 @@ static int geni_i2c_probe(struct platform_device *pdev)
/* FIFO is disabled, so we can only use GPI DMA */
gi2c->gpi_mode = true;
ret = setup_gpi_dma(gi2c);
- if (ret)
+ if (ret) {
+ geni_se_resources_off(&gi2c->se);
+ clk_disable_unprepare(gi2c->core_clk);
return dev_err_probe(dev, ret, "Failed to setup GPI DMA mode\n");
+ }
dev_dbg(dev, "Using GPI DMA mode for I2C\n");
} else {
@@ -890,6 +894,8 @@ static int geni_i2c_probe(struct platform_device *pdev)
if (!tx_depth) {
dev_err(dev, "Invalid TX FIFO depth\n");
+ geni_se_resources_off(&gi2c->se);
+ clk_disable_unprepare(gi2c->core_clk);
return -EINVAL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 075/156] drm/amdgpu: re-create idle bos PTE during VM state machine reset
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 074/156] i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 076/156] i2c: aspeed: Handle the coalesced stop conditions with the start conditions Greg Kroah-Hartman
` (89 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhenGuo Yin, Christian König,
Alex Deucher, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhenGuo Yin <zhenguo.yin@amd.com>
[ Upstream commit 4a0057afa35872a5f2e65576785844688dd9fa5e ]
Idle bo's PTE needs to be re-created when resetting VM state machine.
Set idle bo's vm_bo as moved to mark it as invalid.
Fixes: 55bf196f60df ("drm/amdgpu: reset VM when an error is detected")
Signed-off-by: ZhenGuo Yin <zhenguo.yin@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index 89c8e51cd3323..9fe1278fd5861 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
@@ -285,6 +285,7 @@ static void amdgpu_vm_bo_reset_state_machine(struct amdgpu_vm *vm)
list_for_each_entry_safe(vm_bo, tmp, &vm->idle, vm_status) {
struct amdgpu_bo *bo = vm_bo->bo;
+ vm_bo->moved = true;
if (!bo || bo->tbo.type != ttm_bo_type_kernel)
list_move(&vm_bo->vm_status, &vm_bo->vm->moved);
else if (bo->parent)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 076/156] i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 075/156] drm/amdgpu: re-create idle bos PTE during VM state machine reset Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 077/156] x86/xen: add CPU dependencies for 32-bit build Greg Kroah-Hartman
` (88 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Quan Nguyen, Andrew Jeffery,
Andi Shyti, Wolfram Sang, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Quan Nguyen <quan@os.amperecomputing.com>
[ Upstream commit b4cc1cbba5195a4dd497cf2f8f09e7807977d543 ]
Some masters may drive the transfers with low enough latency between
the nak/stop phase of the current command and the start/address phase
of the following command that the interrupts are coalesced by the
time we process them.
Handle the stop conditions before processing SLAVE_MATCH to fix the
complaints that sometimes occur below.
"aspeed-i2c-bus 1e78a040.i2c-bus: irq handled != irq. Expected
0x00000086, but was 0x00000084"
Fixes: f9eb91350bb2 ("i2c: aspeed: added slave support for Aspeed I2C driver")
Signed-off-by: Quan Nguyen <quan@os.amperecomputing.com>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-aspeed.c | 48 ++++++++++++++++++++++-----------
1 file changed, 32 insertions(+), 16 deletions(-)
diff --git a/drivers/i2c/busses/i2c-aspeed.c b/drivers/i2c/busses/i2c-aspeed.c
index 28e2a5fc45282..5511fd46a65ea 100644
--- a/drivers/i2c/busses/i2c-aspeed.c
+++ b/drivers/i2c/busses/i2c-aspeed.c
@@ -249,18 +249,46 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status)
if (!slave)
return 0;
- command = readl(bus->base + ASPEED_I2C_CMD_REG);
+ /*
+ * Handle stop conditions early, prior to SLAVE_MATCH. Some masters may drive
+ * transfers with low enough latency between the nak/stop phase of the current
+ * command and the start/address phase of the following command that the
+ * interrupts are coalesced by the time we process them.
+ */
+ if (irq_status & ASPEED_I2CD_INTR_NORMAL_STOP) {
+ irq_handled |= ASPEED_I2CD_INTR_NORMAL_STOP;
+ bus->slave_state = ASPEED_I2C_SLAVE_STOP;
+ }
+
+ if (irq_status & ASPEED_I2CD_INTR_TX_NAK &&
+ bus->slave_state == ASPEED_I2C_SLAVE_READ_PROCESSED) {
+ irq_handled |= ASPEED_I2CD_INTR_TX_NAK;
+ bus->slave_state = ASPEED_I2C_SLAVE_STOP;
+ }
+
+ /* Propagate any stop conditions to the slave implementation. */
+ if (bus->slave_state == ASPEED_I2C_SLAVE_STOP) {
+ i2c_slave_event(slave, I2C_SLAVE_STOP, &value);
+ bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE;
+ }
- /* Slave was requested, restart state machine. */
+ /*
+ * Now that we've dealt with any potentially coalesced stop conditions,
+ * address any start conditions.
+ */
if (irq_status & ASPEED_I2CD_INTR_SLAVE_MATCH) {
irq_handled |= ASPEED_I2CD_INTR_SLAVE_MATCH;
bus->slave_state = ASPEED_I2C_SLAVE_START;
}
- /* Slave is not currently active, irq was for someone else. */
+ /*
+ * If the slave has been stopped and not started then slave interrupt
+ * handling is complete.
+ */
if (bus->slave_state == ASPEED_I2C_SLAVE_INACTIVE)
return irq_handled;
+ command = readl(bus->base + ASPEED_I2C_CMD_REG);
dev_dbg(bus->dev, "slave irq status 0x%08x, cmd 0x%08x\n",
irq_status, command);
@@ -279,17 +307,6 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status)
irq_handled |= ASPEED_I2CD_INTR_RX_DONE;
}
- /* Slave was asked to stop. */
- if (irq_status & ASPEED_I2CD_INTR_NORMAL_STOP) {
- irq_handled |= ASPEED_I2CD_INTR_NORMAL_STOP;
- bus->slave_state = ASPEED_I2C_SLAVE_STOP;
- }
- if (irq_status & ASPEED_I2CD_INTR_TX_NAK &&
- bus->slave_state == ASPEED_I2C_SLAVE_READ_PROCESSED) {
- irq_handled |= ASPEED_I2CD_INTR_TX_NAK;
- bus->slave_state = ASPEED_I2C_SLAVE_STOP;
- }
-
switch (bus->slave_state) {
case ASPEED_I2C_SLAVE_READ_REQUESTED:
if (unlikely(irq_status & ASPEED_I2CD_INTR_TX_ACK))
@@ -324,8 +341,7 @@ static u32 aspeed_i2c_slave_irq(struct aspeed_i2c_bus *bus, u32 irq_status)
i2c_slave_event(slave, I2C_SLAVE_WRITE_RECEIVED, &value);
break;
case ASPEED_I2C_SLAVE_STOP:
- i2c_slave_event(slave, I2C_SLAVE_STOP, &value);
- bus->slave_state = ASPEED_I2C_SLAVE_INACTIVE;
+ /* Stop event handling is done early. Unreachable. */
break;
case ASPEED_I2C_SLAVE_START:
/* Slave was just started. Waiting for the next event. */;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 077/156] x86/xen: add CPU dependencies for 32-bit build
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 076/156] i2c: aspeed: Handle the coalesced stop conditions with the start conditions Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 078/156] pinctrl: at91-pio4: use dedicated lock class for IRQ Greg Kroah-Hartman
` (87 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Juergen Gross,
Alyssa Ross, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 93cd0597649844a0fe7989839a3202735fb3ae67 ]
Xen only supports modern CPUs even when running a 32-bit kernel, and it now
requires a kernel built for a 64 byte (or larger) cache line:
In file included from <command-line>:
In function 'xen_vcpu_setup',
inlined from 'xen_vcpu_setup_restore' at arch/x86/xen/enlighten.c:111:3,
inlined from 'xen_vcpu_restore' at arch/x86/xen/enlighten.c:141:3:
include/linux/compiler_types.h:435:45: error: call to '__compiletime_assert_287' declared with attribute error: BUILD_BUG_ON failed: sizeof(*vcpup) > SMP_CACHE_BYTES
arch/x86/xen/enlighten.c:166:9: note: in expansion of macro 'BUILD_BUG_ON'
166 | BUILD_BUG_ON(sizeof(*vcpup) > SMP_CACHE_BYTES);
| ^~~~~~~~~~~~
Enforce the dependency with a whitelist of CPU configurations. In normal
distro kernels, CONFIG_X86_GENERIC is enabled, and this works fine. When this
is not set, still allow Xen to be built on kernels that target a 64-bit
capable CPU.
Fixes: db2832309a82 ("x86/xen: fix percpu vcpu_info allocation")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Juergen Gross <jgross@suse.com>
Tested-by: Alyssa Ross <hi@alyssa.is>
Link: https://lore.kernel.org/r/20231204084722.3789473-1-arnd@kernel.org
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/xen/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/x86/xen/Kconfig b/arch/x86/xen/Kconfig
index 9b1ec5d8c99c8..a65fc2ae15b49 100644
--- a/arch/x86/xen/Kconfig
+++ b/arch/x86/xen/Kconfig
@@ -9,6 +9,7 @@ config XEN
select PARAVIRT_CLOCK
select X86_HV_CALLBACK_VECTOR
depends on X86_64 || (X86_32 && X86_PAE)
+ depends on X86_64 || (X86_GENERIC || MPENTIUM4 || MCORE2 || MATOM || MK8)
depends on X86_LOCAL_APIC && X86_TSC
help
This is the Linux Xen port. Enabling this will allow the
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 078/156] pinctrl: at91-pio4: use dedicated lock class for IRQ
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 077/156] x86/xen: add CPU dependencies for 32-bit build Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 079/156] gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() Greg Kroah-Hartman
` (86 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexis Lothoré, Linus Walleij,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexis Lothoré <alexis.lothore@bootlin.com>
[ Upstream commit 14694179e561b5f2f7e56a0f590e2cb49a9cc7ab ]
Trying to suspend to RAM on SAMA5D27 EVK leads to the following lockdep
warning:
============================================
WARNING: possible recursive locking detected
6.7.0-rc5-wt+ #532 Not tainted
--------------------------------------------
sh/92 is trying to acquire lock:
c3cf306c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100
but task is already holding lock:
c3d7c46c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&irq_desc_lock_class);
lock(&irq_desc_lock_class);
*** DEADLOCK ***
May be due to missing lock nesting notation
6 locks held by sh/92:
#0: c3aa0258 (sb_writers#6){.+.+}-{0:0}, at: ksys_write+0xd8/0x178
#1: c4c2df44 (&of->mutex){+.+.}-{3:3}, at: kernfs_fop_write_iter+0x138/0x284
#2: c32684a0 (kn->active){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x148/0x284
#3: c232b6d4 (system_transition_mutex){+.+.}-{3:3}, at: pm_suspend+0x13c/0x4e8
#4: c387b088 (&dev->mutex){....}-{3:3}, at: __device_suspend+0x1e8/0x91c
#5: c3d7c46c (&irq_desc_lock_class){-.-.}-{2:2}, at: __irq_get_desc_lock+0xe8/0x100
stack backtrace:
CPU: 0 PID: 92 Comm: sh Not tainted 6.7.0-rc5-wt+ #532
Hardware name: Atmel SAMA5
unwind_backtrace from show_stack+0x18/0x1c
show_stack from dump_stack_lvl+0x34/0x48
dump_stack_lvl from __lock_acquire+0x19ec/0x3a0c
__lock_acquire from lock_acquire.part.0+0x124/0x2d0
lock_acquire.part.0 from _raw_spin_lock_irqsave+0x5c/0x78
_raw_spin_lock_irqsave from __irq_get_desc_lock+0xe8/0x100
__irq_get_desc_lock from irq_set_irq_wake+0xa8/0x204
irq_set_irq_wake from atmel_gpio_irq_set_wake+0x58/0xb4
atmel_gpio_irq_set_wake from irq_set_irq_wake+0x100/0x204
irq_set_irq_wake from gpio_keys_suspend+0xec/0x2b8
gpio_keys_suspend from dpm_run_callback+0xe4/0x248
dpm_run_callback from __device_suspend+0x234/0x91c
__device_suspend from dpm_suspend+0x224/0x43c
dpm_suspend from dpm_suspend_start+0x9c/0xa8
dpm_suspend_start from suspend_devices_and_enter+0x1e0/0xa84
suspend_devices_and_enter from pm_suspend+0x460/0x4e8
pm_suspend from state_store+0x78/0xe4
state_store from kernfs_fop_write_iter+0x1a0/0x284
kernfs_fop_write_iter from vfs_write+0x38c/0x6f4
vfs_write from ksys_write+0xd8/0x178
ksys_write from ret_fast_syscall+0x0/0x1c
Exception stack(0xc52b3fa8 to 0xc52b3ff0)
3fa0: 00000004 005a0ae8 00000001 005a0ae8 00000004 00000001
3fc0: 00000004 005a0ae8 00000001 00000004 00000004 b6c616c0 00000020 0059d190
3fe0: 00000004 b6c61678 aec5a041 aebf1a26
This warning is raised because pinctrl-at91-pio4 uses chained IRQ. Whenever
a wake up source configures an IRQ through irq_set_irq_wake, it will
lock the corresponding IRQ desc, and then call irq_set_irq_wake on "parent"
IRQ which will do the same on its own IRQ desc, but since those two locks
share the same class, lockdep reports this as an issue.
Fix lockdep false positive by setting a different class for parent and
children IRQ
Fixes: 776180848b57 ("pinctrl: introduce driver for Atmel PIO4 controller")
Signed-off-by: Alexis Lothoré <alexis.lothore@bootlin.com>
Link: https://lore.kernel.org/r/20231215-lockdep_warning-v1-1-8137b2510ed5@bootlin.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c
index 383309e533c3d..a27c01fcbb47e 100644
--- a/drivers/pinctrl/pinctrl-at91-pio4.c
+++ b/drivers/pinctrl/pinctrl-at91-pio4.c
@@ -1068,6 +1068,13 @@ static const struct of_device_id atmel_pctrl_of_match[] = {
}
};
+/*
+ * This lock class allows to tell lockdep that parent IRQ and children IRQ do
+ * not share the same class so it does not raise false positive
+ */
+static struct lock_class_key atmel_lock_key;
+static struct lock_class_key atmel_request_key;
+
static int atmel_pinctrl_probe(struct platform_device *pdev)
{
struct device *dev = &pdev->dev;
@@ -1214,6 +1221,7 @@ static int atmel_pinctrl_probe(struct platform_device *pdev)
irq_set_chip_and_handler(irq, &atmel_gpio_irq_chip,
handle_simple_irq);
irq_set_chip_data(irq, atmel_pioctrl);
+ irq_set_lockdep_class(irq, &atmel_lock_key, &atmel_request_key);
dev_dbg(dev,
"atmel gpio irq domain: hwirq: %d, linux irq: %d\n",
i, irq);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 079/156] gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 078/156] pinctrl: at91-pio4: use dedicated lock class for IRQ Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 080/156] nvme-pci: fix sleeping function called from interrupt context Greg Kroah-Hartman
` (85 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kent Gibson, Bartosz Golaszewski,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kent Gibson <warthog618@gmail.com>
[ Upstream commit 1d656bd259edb89dc1d9938ec5c5389867088546 ]
While the GPIO cdev gpio_ioctl() call is in progress, the kernel can
call gpiochip_remove() which will set gdev->chip to NULL, after which
any subsequent access will cause a crash.
gpio_ioctl() was overlooked by the previous fix to protect syscalls
(bdbbae241a04), so add protection for that.
Fixes: bdbbae241a04 ("gpiolib: protect the GPIO device against being dropped while in use by user-space")
Fixes: d7c51b47ac11 ("gpio: userspace ABI for reading/writing GPIO lines")
Fixes: 3c0d9c635ae2 ("gpiolib: cdev: support GPIO_V2_GET_LINE_IOCTL and GPIO_V2_LINE_GET_VALUES_IOCTL")
Fixes: aad955842d1c ("gpiolib: cdev: support GPIO_V2_GET_LINEINFO_IOCTL and GPIO_V2_GET_LINEINFO_WATCH_IOCTL")
Signed-off-by: Kent Gibson <warthog618@gmail.com>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpio/gpiolib-cdev.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/gpio/gpiolib-cdev.c b/drivers/gpio/gpiolib-cdev.c
index e39d344feb289..4f3e66ece7f78 100644
--- a/drivers/gpio/gpiolib-cdev.c
+++ b/drivers/gpio/gpiolib-cdev.c
@@ -2482,10 +2482,7 @@ static int lineinfo_unwatch(struct gpio_chardev_data *cdev, void __user *ip)
return 0;
}
-/*
- * gpio_ioctl() - ioctl handler for the GPIO chardev
- */
-static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+static long gpio_ioctl_unlocked(struct file *file, unsigned int cmd, unsigned long arg)
{
struct gpio_chardev_data *cdev = file->private_data;
struct gpio_device *gdev = cdev->gdev;
@@ -2522,6 +2519,17 @@ static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
}
}
+/*
+ * gpio_ioctl() - ioctl handler for the GPIO chardev
+ */
+static long gpio_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+{
+ struct gpio_chardev_data *cdev = file->private_data;
+
+ return call_ioctl_locked(file, cmd, arg, cdev->gdev,
+ gpio_ioctl_unlocked);
+}
+
#ifdef CONFIG_COMPAT
static long gpio_ioctl_compat(struct file *file, unsigned int cmd,
unsigned long arg)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 080/156] nvme-pci: fix sleeping function called from interrupt context
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 079/156] gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 081/156] interconnect: Treat xlate() returning NULL node as an error Greg Kroah-Hartman
` (84 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Jens Axboe,
Sagi Grimberg, Keith Busch, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit f6fe0b2d35457c10ec37acc209d19726bdc16dbd ]
the nvme_handle_cqe() interrupt handler calls nvme_complete_async_event()
but the latter may call nvme_auth_stop() which is a blocking function.
Sleeping functions can't be called in interrupt context
BUG: sleeping function called from invalid context
in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 0, name: swapper/15
Call Trace:
<IRQ>
__cancel_work_timer+0x31e/0x460
? nvme_change_ctrl_state+0xcf/0x3c0 [nvme_core]
? nvme_change_ctrl_state+0xcf/0x3c0 [nvme_core]
nvme_complete_async_event+0x365/0x480 [nvme_core]
nvme_poll_cq+0x262/0xe50 [nvme]
Fix the bug by moving nvme_auth_stop() to fw_act_work
(executed by the nvme_wq workqueue)
Fixes: f50fff73d620 ("nvme: implement In-Band authentication")
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index d5c8b0a08d494..b32e3cff37b14 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -4100,6 +4100,8 @@ static void nvme_fw_act_work(struct work_struct *work)
struct nvme_ctrl, fw_act_work);
unsigned long fw_act_timeout;
+ nvme_auth_stop(ctrl);
+
if (ctrl->mtfa)
fw_act_timeout = jiffies +
msecs_to_jiffies(ctrl->mtfa * 100);
@@ -4155,7 +4157,6 @@ static bool nvme_handle_aen_notice(struct nvme_ctrl *ctrl, u32 result)
* firmware activation.
*/
if (nvme_change_ctrl_state(ctrl, NVME_CTRL_RESETTING)) {
- nvme_auth_stop(ctrl);
requeue = false;
queue_work(nvme_wq, &ctrl->fw_act_work);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 081/156] interconnect: Treat xlate() returning NULL node as an error
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 080/156] nvme-pci: fix sleeping function called from interrupt context Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 082/156] iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw Greg Kroah-Hartman
` (83 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mike Tipton, Georgi Djakov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Tipton <quic_mdtipton@quicinc.com>
[ Upstream commit ad2ab1297d0c80899125a842bb7a078abfe1e6ce ]
Currently, if provider->xlate() or provider->xlate_extended()
"successfully" return a NULL node, then of_icc_get_from_provider() won't
consider that an error and will successfully return the NULL node. This
bypasses error handling in of_icc_get_by_index() and leads to NULL
dereferences in path_find().
This could be avoided by ensuring provider callbacks always return an
error for NULL nodes, but it's better to explicitly protect against this
in the common framework.
Fixes: 87e3031b6fbd ("interconnect: Allow endpoints translation via DT")
Signed-off-by: Mike Tipton <quic_mdtipton@quicinc.com>
Link: https://lore.kernel.org/r/20231025145829.11603-1-quic_mdtipton@quicinc.com
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/interconnect/core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/interconnect/core.c b/drivers/interconnect/core.c
index dfab160ca5293..50bac2d79d9b5 100644
--- a/drivers/interconnect/core.c
+++ b/drivers/interconnect/core.c
@@ -395,6 +395,9 @@ struct icc_node_data *of_icc_get_from_provider(struct of_phandle_args *spec)
}
mutex_unlock(&icc_lock);
+ if (!node)
+ return ERR_PTR(-EINVAL);
+
if (IS_ERR(node))
return ERR_CAST(node);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 082/156] iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 081/156] interconnect: Treat xlate() returning NULL node as an error Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 083/156] interconnect: qcom: sm8250: Enable sync_state Greg Kroah-Hartman
` (82 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Jonathan Cameron,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit c3df0e29fb7788c4b3ddf37d5ed87dda2b822943 ]
inv_mpu6050_sensor_show() can return -EINVAL or IIO_VAL_INT. Return the
true value rather than only return IIO_VAL_INT.
Fixes: d5098447147c ("iio: imu: mpu6050: add calibration offset support")
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20231030020218.65728-1-suhui@nfschina.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
index 29f906c884bd8..a9a5fb266ef13 100644
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_core.c
@@ -749,13 +749,13 @@ inv_mpu6050_read_raw(struct iio_dev *indio_dev,
ret = inv_mpu6050_sensor_show(st, st->reg->gyro_offset,
chan->channel2, val);
mutex_unlock(&st->lock);
- return IIO_VAL_INT;
+ return ret;
case IIO_ACCEL:
mutex_lock(&st->lock);
ret = inv_mpu6050_sensor_show(st, st->reg->accl_offset,
chan->channel2, val);
mutex_unlock(&st->lock);
- return IIO_VAL_INT;
+ return ret;
default:
return -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 083/156] interconnect: qcom: sm8250: Enable sync_state
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 082/156] iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 084/156] Input: ipaq-micro-keys - add error handling for devm_kmemdup Greg Kroah-Hartman
` (81 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Georgi Djakov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit bfc7db1cb94ad664546d70212699f8cc6c539e8c ]
Add the generic icc sync_state callback to ensure interconnect votes
are taken into account, instead of being pegged at maximum values.
Fixes: b95b668eaaa2 ("interconnect: qcom: icc-rpmh: Add BCMs to commit list in pre_aggregate")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231130-topic-8250icc_syncstate-v1-1-7ce78ba6e04c@linaro.org
Signed-off-by: Georgi Djakov <djakov@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/interconnect/qcom/sm8250.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/interconnect/qcom/sm8250.c b/drivers/interconnect/qcom/sm8250.c
index 661dc18d99dba..2a2f56b993733 100644
--- a/drivers/interconnect/qcom/sm8250.c
+++ b/drivers/interconnect/qcom/sm8250.c
@@ -1995,6 +1995,7 @@ static struct platform_driver qnoc_driver = {
.driver = {
.name = "qnoc-sm8250",
.of_match_table = qnoc_of_match,
+ .sync_state = icc_sync_state,
},
};
module_platform_driver(qnoc_driver);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 084/156] Input: ipaq-micro-keys - add error handling for devm_kmemdup
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 083/156] interconnect: qcom: sm8250: Enable sync_state Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 085/156] iio: adc: meson: add separate config for axg SoC family Greg Kroah-Hartman
` (80 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Haoran Liu, Dmitry Torokhov,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haoran Liu <liuhaoran14@163.com>
[ Upstream commit 59b6a747e2d39227ac2325c5e29d6ab3bb070c2a ]
Check the return value of i2c_add_adapter. Static analysis revealed that
the function did not properly handle potential failures of
i2c_add_adapter, which could lead to partial initialization of the I2C
adapter and unstable operation.
Signed-off-by: Haoran Liu <liuhaoran14@163.com>
Link: https://lore.kernel.org/r/20231203164653.38983-1-liuhaoran14@163.com
Fixes: d7535ffa427b ("Input: driver for microcontroller keys on the iPaq h3xxx")
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/keyboard/ipaq-micro-keys.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/input/keyboard/ipaq-micro-keys.c b/drivers/input/keyboard/ipaq-micro-keys.c
index 7b509bce2b332..1d71dd79ffd28 100644
--- a/drivers/input/keyboard/ipaq-micro-keys.c
+++ b/drivers/input/keyboard/ipaq-micro-keys.c
@@ -105,6 +105,9 @@ static int micro_key_probe(struct platform_device *pdev)
keys->codes = devm_kmemdup(&pdev->dev, micro_keycodes,
keys->input->keycodesize * keys->input->keycodemax,
GFP_KERNEL);
+ if (!keys->codes)
+ return -ENOMEM;
+
keys->input->keycode = keys->codes;
__set_bit(EV_KEY, keys->input->evbit);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 085/156] iio: adc: meson: add separate config for axg SoC family
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 084/156] Input: ipaq-micro-keys - add error handling for devm_kmemdup Greg Kroah-Hartman
@ 2023-12-30 11:58 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 086/156] scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Greg Kroah-Hartman
` (79 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, George Stark, Neil Armstrong,
Jonathan Cameron, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: George Stark <gnstark@salutedevices.com>
[ Upstream commit 59b75dcb0953813676b5030877f3f37cedaed87d ]
According to Amlogic custom kernels ADC of axg SoC family has
vref_select and requires this setting to work nominally and thus
needs a separate config.
Fixes: 90c6241860bf ("iio: adc: meson: init voltage control bits")
Signed-off-by: George Stark <gnstark@salutedevices.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://lore.kernel.org/r/20231127235558.71995-1-gnstark@salutedevices.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/meson_saradc.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c
index 320e3e7e3d4d4..57cfabe80c826 100644
--- a/drivers/iio/adc/meson_saradc.c
+++ b/drivers/iio/adc/meson_saradc.c
@@ -1239,6 +1239,20 @@ static const struct meson_sar_adc_param meson_sar_adc_gxl_param = {
.cmv_select = 1,
};
+static const struct meson_sar_adc_param meson_sar_adc_axg_param = {
+ .has_bl30_integration = true,
+ .clock_rate = 1200000,
+ .bandgap_reg = MESON_SAR_ADC_REG11,
+ .regmap_config = &meson_sar_adc_regmap_config_gxbb,
+ .resolution = 12,
+ .disable_ring_counter = 1,
+ .has_reg11 = true,
+ .vref_volatge = 1,
+ .has_vref_select = true,
+ .vref_select = VREF_VDDA,
+ .cmv_select = 1,
+};
+
static const struct meson_sar_adc_param meson_sar_adc_g12a_param = {
.has_bl30_integration = false,
.clock_rate = 1200000,
@@ -1283,7 +1297,7 @@ static const struct meson_sar_adc_data meson_sar_adc_gxm_data = {
};
static const struct meson_sar_adc_data meson_sar_adc_axg_data = {
- .param = &meson_sar_adc_gxl_param,
+ .param = &meson_sar_adc_axg_param,
.name = "meson-axg-saradc",
};
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 086/156] scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2023-12-30 11:58 ` [PATCH 6.6 085/156] iio: adc: meson: add separate config for axg SoC family Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 087/156] scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() Greg Kroah-Hartman
` (78 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yongjun, Martin K. Petersen,
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <weiyongjun1@huawei.com>
[ Upstream commit 08c94d80b2da481652fb633e79cbc41e9e326a91 ]
skb_share_check() already drops the reference to the skb when returning
NULL. Using kfree_skb() in the error handling path leads to an skb double
free.
Fix this by removing the variable tmp_skb, and return directly when
skb_share_check() returns NULL.
Fixes: 01a4cc4d0cd6 ("bnx2fc: do not add shared skbs to the fcoe_rx_list")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Link: https://lore.kernel.org/r/20221114110626.526643-1-weiyongjun@huaweicloud.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +++------
1 file changed, 3 insertions(+), 6 deletions(-)
diff --git a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
index 05ddbb9bb7d8a..451a58e0fd969 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_fcoe.c
@@ -429,7 +429,6 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
struct fcoe_ctlr *ctlr;
struct fcoe_rcv_info *fr;
struct fcoe_percpu_s *bg;
- struct sk_buff *tmp_skb;
interface = container_of(ptype, struct bnx2fc_interface,
fcoe_packet_type);
@@ -441,11 +440,9 @@ static int bnx2fc_rcv(struct sk_buff *skb, struct net_device *dev,
goto err;
}
- tmp_skb = skb_share_check(skb, GFP_ATOMIC);
- if (!tmp_skb)
- goto err;
-
- skb = tmp_skb;
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (!skb)
+ return -1;
if (unlikely(eth_hdr(skb)->h_proto != htons(ETH_P_FCOE))) {
printk(KERN_ERR PFX "bnx2fc_rcv: Wrong FC type frame\n");
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 087/156] scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 086/156] scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 088/156] scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Greg Kroah-Hartman
` (77 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Manivannan Sadhasivam, ChanWoo Lee,
Andrew Halaney, Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: ChanWoo Lee <cw9316.lee@samsung.com>
[ Upstream commit 9264fd61e628ce180a168e6b90bde134dd49ec28 ]
In commit 031312dbc695 ("scsi: ufs: ufs-qcom: Remove unnecessary goto
statements") the error handling was accidentally changed, resulting in the
error of ufs_qcom_clk_scale_*() calls not being returned.
This is the case I checked:
ufs_qcom_clk_scale_notify ->
'ufs_qcom_clk_scale_up_/down_pre_change' error ->
return 0;
Make sure those errors are properly returned.
Fixes: 031312dbc695 ("scsi: ufs: ufs-qcom: Remove unnecessary goto statements")
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: ChanWoo Lee <cw9316.lee@samsung.com>
Link: https://lore.kernel.org/r/20231215003812.29650-1-cw9316.lee@samsung.com
Reviewed-by: Andrew Halaney <ahalaney@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/host/ufs-qcom.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/ufs/host/ufs-qcom.c b/drivers/ufs/host/ufs-qcom.c
index b1d720031251e..fc40726e13c26 100644
--- a/drivers/ufs/host/ufs-qcom.c
+++ b/drivers/ufs/host/ufs-qcom.c
@@ -1399,9 +1399,11 @@ static int ufs_qcom_clk_scale_notify(struct ufs_hba *hba,
err = ufs_qcom_clk_scale_up_pre_change(hba);
else
err = ufs_qcom_clk_scale_down_pre_change(hba);
- if (err)
- ufshcd_uic_hibern8_exit(hba);
+ if (err) {
+ ufshcd_uic_hibern8_exit(hba);
+ return err;
+ }
} else {
if (scale_up)
err = ufs_qcom_clk_scale_up_post_change(hba);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 088/156] scsi: ufs: core: Let the sq_lock protect sq_tail_slot access
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 087/156] scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 089/156] iio: kx022a: Fix acceleration value scaling Greg Kroah-Hartman
` (76 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Can Guo, Bart Van Assche,
Martin K. Petersen, Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Can Guo <quic_cang@quicinc.com>
[ Upstream commit 04c116e2bdfc3969f9819d2cebfdf678353c354c ]
When accessing sq_tail_slot without protection from sq_lock, a race
condition can cause multiple SQEs to be copied to duplicate SQE slots. This
can lead to multiple stability issues. Fix this by moving the *dest
initialization in ufshcd_send_command() back under protection from the
sq_lock.
Fixes: 3c85f087faec ("scsi: ufs: mcq: Use pointer arithmetic in ufshcd_send_command()")
Signed-off-by: Can Guo <quic_cang@quicinc.com>
Link: https://lore.kernel.org/r/1702913550-20631-1-git-send-email-quic_cang@quicinc.com
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/ufs/core/ufshcd.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c
index 170fbd5715b21..a885cc177cff7 100644
--- a/drivers/ufs/core/ufshcd.c
+++ b/drivers/ufs/core/ufshcd.c
@@ -2172,9 +2172,10 @@ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag,
if (is_mcq_enabled(hba)) {
int utrd_size = sizeof(struct utp_transfer_req_desc);
struct utp_transfer_req_desc *src = lrbp->utr_descriptor_ptr;
- struct utp_transfer_req_desc *dest = hwq->sqe_base_addr + hwq->sq_tail_slot;
+ struct utp_transfer_req_desc *dest;
spin_lock(&hwq->sq_lock);
+ dest = hwq->sqe_base_addr + hwq->sq_tail_slot;
memcpy(dest, src, utrd_size);
ufshcd_inc_sq_tail(hwq);
spin_unlock(&hwq->sq_lock);
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 089/156] iio: kx022a: Fix acceleration value scaling
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 088/156] scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 090/156] iio: adc: imx93: add four channels for imx93 adc Greg Kroah-Hartman
` (75 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matti Vaittinen, Jagath Jog J,
Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <mazziesaccount@gmail.com>
commit 92bfa4ab1b79be95c4f52d13f5386390f0a513c2 upstream.
The IIO ABI mandates acceleration values from accelerometer to be
emitted in m/s^2. The KX022A was emitting values in micro m/s^2.
Fix driver to report the correct scale values.
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Reported-by: Jagath Jog J <jagathjog1996@gmail.com>
Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer")
Tested-by: Jagath Jog J <jagathjog1996@gmail.com>
Link: https://lore.kernel.org/r/ZTEt7NqfDHPOkm8j@dc78bmyyyyyyyyyyyyydt-3.rev.dnainternet.fi
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kionix-kx022a.c | 37 ++++++++++++++++++++++++++-----------
1 file changed, 26 insertions(+), 11 deletions(-)
--- a/drivers/iio/accel/kionix-kx022a.c
+++ b/drivers/iio/accel/kionix-kx022a.c
@@ -273,17 +273,17 @@ static const unsigned int kx022a_odrs[]
* (range / 2^bits) * g = (range / 2^bits) * 9.80665 m/s^2
* => KX022A uses 16 bit (HiRes mode - assume the low 8 bits are zeroed
* in low-power mode(?) )
- * => +/-2G => 4 / 2^16 * 9,80665 * 10^6 (to scale to micro)
- * => +/-2G - 598.550415
- * +/-4G - 1197.10083
- * +/-8G - 2394.20166
- * +/-16G - 4788.40332
+ * => +/-2G => 4 / 2^16 * 9,80665
+ * => +/-2G - 0.000598550415
+ * +/-4G - 0.00119710083
+ * +/-8G - 0.00239420166
+ * +/-16G - 0.00478840332
*/
static const int kx022a_scale_table[][2] = {
- { 598, 550415 },
- { 1197, 100830 },
- { 2394, 201660 },
- { 4788, 403320 },
+ { 0, 598550 },
+ { 0, 1197101 },
+ { 0, 2394202 },
+ { 0, 4788403 },
};
static int kx022a_read_avail(struct iio_dev *indio_dev,
@@ -302,7 +302,7 @@ static int kx022a_read_avail(struct iio_
*vals = (const int *)kx022a_scale_table;
*length = ARRAY_SIZE(kx022a_scale_table) *
ARRAY_SIZE(kx022a_scale_table[0]);
- *type = IIO_VAL_INT_PLUS_MICRO;
+ *type = IIO_VAL_INT_PLUS_NANO;
return IIO_AVAIL_LIST;
default:
return -EINVAL;
@@ -366,6 +366,20 @@ static int kx022a_turn_on_unlock(struct
return ret;
}
+static int kx022a_write_raw_get_fmt(struct iio_dev *idev,
+ struct iio_chan_spec const *chan,
+ long mask)
+{
+ switch (mask) {
+ case IIO_CHAN_INFO_SCALE:
+ return IIO_VAL_INT_PLUS_NANO;
+ case IIO_CHAN_INFO_SAMP_FREQ:
+ return IIO_VAL_INT_PLUS_MICRO;
+ default:
+ return -EINVAL;
+ }
+}
+
static int kx022a_write_raw(struct iio_dev *idev,
struct iio_chan_spec const *chan,
int val, int val2, long mask)
@@ -510,7 +524,7 @@ static int kx022a_read_raw(struct iio_de
kx022a_reg2scale(regval, val, val2);
- return IIO_VAL_INT_PLUS_MICRO;
+ return IIO_VAL_INT_PLUS_NANO;
}
return -EINVAL;
@@ -712,6 +726,7 @@ static int kx022a_fifo_flush(struct iio_
static const struct iio_info kx022a_info = {
.read_raw = &kx022a_read_raw,
.write_raw = &kx022a_write_raw,
+ .write_raw_get_fmt = &kx022a_write_raw_get_fmt,
.read_avail = &kx022a_read_avail,
.validate_trigger = iio_validate_own_trigger,
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 090/156] iio: adc: imx93: add four channels for imx93 adc
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 089/156] iio: kx022a: Fix acceleration value scaling Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 091/156] iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table Greg Kroah-Hartman
` (74 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Haibo Chen, Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Haibo Chen <haibo.chen@nxp.com>
commit 2475ecdb9b6e177b133cf26e64e8d441d37bebde upstream.
According to the spec, this ADC totally support 8 channels.
i.MX93 contain this ADC with 4 channels connected to pins in
the package. i.MX95 contain this ADC with 8 channels connected
to pins in the package.
Signed-off-by: Haibo Chen <haibo.chen@nxp.com>
Fixes: 7d02296ac8b8 ("iio: adc: add imx93 adc support")
Link: https://lore.kernel.org/r/20231116071026.611269-1-haibo.chen@nxp.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/imx93_adc.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/iio/adc/imx93_adc.c b/drivers/iio/adc/imx93_adc.c
index 9bb1e4ba1aee..4ccf4819f1f1 100644
--- a/drivers/iio/adc/imx93_adc.c
+++ b/drivers/iio/adc/imx93_adc.c
@@ -93,6 +93,10 @@ static const struct iio_chan_spec imx93_adc_iio_channels[] = {
IMX93_ADC_CHAN(1),
IMX93_ADC_CHAN(2),
IMX93_ADC_CHAN(3),
+ IMX93_ADC_CHAN(4),
+ IMX93_ADC_CHAN(5),
+ IMX93_ADC_CHAN(6),
+ IMX93_ADC_CHAN(7),
};
static void imx93_adc_power_down(struct imx93_adc *adc)
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 091/156] iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 090/156] iio: adc: imx93: add four channels for imx93 adc Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 092/156] iio: imu: adis16475: add spi_device_id table Greg Kroah-Hartman
` (73 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit 54cf39ec16335dadbe1ba008d8e5e98dae3e26f8 upstream.
The HTU21 offers 4 sampling frequencies: 20, 40, 70 and 120, which are
associated to an index that is used to select the right measurement
resolution and its corresponding measurement time. The current
implementation selects the measurement resolution and the temperature
measurement time properly, but it does not select the right humidity
measurement time in all cases.
In summary, the 40 and 70 humidity measurement times are swapped.
The reason for that is probably the unusual coding for the measurement
resolution. According to the datasheet, the bits [7,0] of the "user
register" are used as follows to select the bit resolution:
--------------------------------------------------
| Bit 7 | Bit 0 | RH | Temp | Trh (us) | Tt (us) |
--------------------------------------------------
| 0 | 0 | 12 | 14 | 16000 | 50000 |
--------------------------------------------------
| 0 | 1 | 8 | 12 | 3000 | 13000 |
--------------------------------------------------
| 1 | 0 | 10 | 13 | 5000 | 25000 |
--------------------------------------------------
| 1 | 1 | 11 | 11 | 8000 | 7000 |
--------------------------------------------------
*This table is available in the official datasheet, page 13/21. I have
just appended the times provided in the humidity/temperature tables,
pages 3/21, 5/21. Note that always a pair of resolutions is selected.
The sampling frequencies [20, 40, 70, 120] are assigned to a linear
index [0..3] which is then coded as follows [1]:
Index [7,0]
--------------
idx 0 0,0
idx 1 1,0
idx 2 0,1
idx 3 1,1
That is done that way because the temperature measurements are being
used as the reference for the sampling frequency (the frequencies and
the temperature measurement times are correlated), so increasing the
index always reduces the temperature measurement time and its
resolution. Therefore, the temperature measurement time array is as
simple as [50000, 25000, 13000, 7000]
On the other hand, the humidity resolution cannot follow the same
pattern because of the way it is coded in the "user register", where
both resolutions are selected at the same time. The humidity measurement
time array is the following: [16000, 3000, 5000, 8000], which defines
the following assignments:
Index [7,0] Trh
-----------------------
idx 0 0,0 16000 -> right, [0,0] selects 12 bits (Trh = 16000)
idx 1 1,0 3000 -> wrong! [1,0] selects 10 bits (Trh = 5000)
idx 2 0,1 5000 -> wrong! [0,1] selects 8 bits (Trh = 3000)
idx 3 1,1 8000 -> right, [1,1] selects 11 bits (Trh = 8000)
The times have been ordered as if idx = 1 -> [0,1] and idx = 2 -> [1,0],
which is not the case for the reason explained above.
So a simple modification is required to obtain the right humidity
measurement time array, swapping the values in the positions 1 and 2.
The right table should be the following: [16000, 5000, 3000, 8000]
Fix the humidity measurement time array with the right idex/value
coding.
[1] The actual code that makes this coding and assigns it to the current
value of the "user register" is the following:
config_reg &= 0x7E;
config_reg |= ((i & 1) << 7) + ((i & 2) >> 1);
Fixes: d574a87cc311 ("Add meas-spec sensors common part")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/20231026-topic-htu21_conversion_time-v1-1-bd257dc44209@gmail.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/common/ms_sensors/ms_sensors_i2c.c
+++ b/drivers/iio/common/ms_sensors/ms_sensors_i2c.c
@@ -15,8 +15,8 @@
/* Conversion times in us */
static const u16 ms_sensors_ht_t_conversion_time[] = { 50000, 25000,
13000, 7000 };
-static const u16 ms_sensors_ht_h_conversion_time[] = { 16000, 3000,
- 5000, 8000 };
+static const u16 ms_sensors_ht_h_conversion_time[] = { 16000, 5000,
+ 3000, 8000 };
static const u16 ms_sensors_tp_conversion_time[] = { 500, 1100, 2100,
4100, 8220, 16440 };
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 092/156] iio: imu: adis16475: add spi_device_id table
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 091/156] iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 093/156] iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Greg Kroah-Hartman
` (72 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nuno Sa, Stable, Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <nuno.sa@analog.com>
commit ee4d79055aeea27f1b8c42233cc0c90d0a8b5355 upstream.
This prevents the warning message "SPI driver has no spi_device_id for..."
when registering the driver. More importantly, it makes sure that
module autoloading works as spi relies on spi: modaliases and not of.
While at it, move the of_device_id table to it's natural place.
Fixes: fff7352bf7a3c ("iio: imu: Add support for adis16475")
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20231102125258.3284830-1-nuno.sa@analog.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/imu/adis16475.c | 117 +++++++++++++++++++++++++++-----------------
1 file changed, 72 insertions(+), 45 deletions(-)
--- a/drivers/iio/imu/adis16475.c
+++ b/drivers/iio/imu/adis16475.c
@@ -1244,50 +1244,6 @@ static int adis16475_config_irq_pin(stru
return 0;
}
-static const struct of_device_id adis16475_of_match[] = {
- { .compatible = "adi,adis16470",
- .data = &adis16475_chip_info[ADIS16470] },
- { .compatible = "adi,adis16475-1",
- .data = &adis16475_chip_info[ADIS16475_1] },
- { .compatible = "adi,adis16475-2",
- .data = &adis16475_chip_info[ADIS16475_2] },
- { .compatible = "adi,adis16475-3",
- .data = &adis16475_chip_info[ADIS16475_3] },
- { .compatible = "adi,adis16477-1",
- .data = &adis16475_chip_info[ADIS16477_1] },
- { .compatible = "adi,adis16477-2",
- .data = &adis16475_chip_info[ADIS16477_2] },
- { .compatible = "adi,adis16477-3",
- .data = &adis16475_chip_info[ADIS16477_3] },
- { .compatible = "adi,adis16465-1",
- .data = &adis16475_chip_info[ADIS16465_1] },
- { .compatible = "adi,adis16465-2",
- .data = &adis16475_chip_info[ADIS16465_2] },
- { .compatible = "adi,adis16465-3",
- .data = &adis16475_chip_info[ADIS16465_3] },
- { .compatible = "adi,adis16467-1",
- .data = &adis16475_chip_info[ADIS16467_1] },
- { .compatible = "adi,adis16467-2",
- .data = &adis16475_chip_info[ADIS16467_2] },
- { .compatible = "adi,adis16467-3",
- .data = &adis16475_chip_info[ADIS16467_3] },
- { .compatible = "adi,adis16500",
- .data = &adis16475_chip_info[ADIS16500] },
- { .compatible = "adi,adis16505-1",
- .data = &adis16475_chip_info[ADIS16505_1] },
- { .compatible = "adi,adis16505-2",
- .data = &adis16475_chip_info[ADIS16505_2] },
- { .compatible = "adi,adis16505-3",
- .data = &adis16475_chip_info[ADIS16505_3] },
- { .compatible = "adi,adis16507-1",
- .data = &adis16475_chip_info[ADIS16507_1] },
- { .compatible = "adi,adis16507-2",
- .data = &adis16475_chip_info[ADIS16507_2] },
- { .compatible = "adi,adis16507-3",
- .data = &adis16475_chip_info[ADIS16507_3] },
- { },
-};
-MODULE_DEVICE_TABLE(of, adis16475_of_match);
static int adis16475_probe(struct spi_device *spi)
{
@@ -1301,7 +1257,7 @@ static int adis16475_probe(struct spi_de
st = iio_priv(indio_dev);
- st->info = device_get_match_data(&spi->dev);
+ st->info = spi_get_device_match_data(spi);
if (!st->info)
return -EINVAL;
@@ -1341,12 +1297,83 @@ static int adis16475_probe(struct spi_de
return 0;
}
+static const struct of_device_id adis16475_of_match[] = {
+ { .compatible = "adi,adis16470",
+ .data = &adis16475_chip_info[ADIS16470] },
+ { .compatible = "adi,adis16475-1",
+ .data = &adis16475_chip_info[ADIS16475_1] },
+ { .compatible = "adi,adis16475-2",
+ .data = &adis16475_chip_info[ADIS16475_2] },
+ { .compatible = "adi,adis16475-3",
+ .data = &adis16475_chip_info[ADIS16475_3] },
+ { .compatible = "adi,adis16477-1",
+ .data = &adis16475_chip_info[ADIS16477_1] },
+ { .compatible = "adi,adis16477-2",
+ .data = &adis16475_chip_info[ADIS16477_2] },
+ { .compatible = "adi,adis16477-3",
+ .data = &adis16475_chip_info[ADIS16477_3] },
+ { .compatible = "adi,adis16465-1",
+ .data = &adis16475_chip_info[ADIS16465_1] },
+ { .compatible = "adi,adis16465-2",
+ .data = &adis16475_chip_info[ADIS16465_2] },
+ { .compatible = "adi,adis16465-3",
+ .data = &adis16475_chip_info[ADIS16465_3] },
+ { .compatible = "adi,adis16467-1",
+ .data = &adis16475_chip_info[ADIS16467_1] },
+ { .compatible = "adi,adis16467-2",
+ .data = &adis16475_chip_info[ADIS16467_2] },
+ { .compatible = "adi,adis16467-3",
+ .data = &adis16475_chip_info[ADIS16467_3] },
+ { .compatible = "adi,adis16500",
+ .data = &adis16475_chip_info[ADIS16500] },
+ { .compatible = "adi,adis16505-1",
+ .data = &adis16475_chip_info[ADIS16505_1] },
+ { .compatible = "adi,adis16505-2",
+ .data = &adis16475_chip_info[ADIS16505_2] },
+ { .compatible = "adi,adis16505-3",
+ .data = &adis16475_chip_info[ADIS16505_3] },
+ { .compatible = "adi,adis16507-1",
+ .data = &adis16475_chip_info[ADIS16507_1] },
+ { .compatible = "adi,adis16507-2",
+ .data = &adis16475_chip_info[ADIS16507_2] },
+ { .compatible = "adi,adis16507-3",
+ .data = &adis16475_chip_info[ADIS16507_3] },
+ { },
+};
+MODULE_DEVICE_TABLE(of, adis16475_of_match);
+
+static const struct spi_device_id adis16475_ids[] = {
+ { "adis16470", (kernel_ulong_t)&adis16475_chip_info[ADIS16470] },
+ { "adis16475-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_1] },
+ { "adis16475-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_2] },
+ { "adis16475-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16475_3] },
+ { "adis16477-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_1] },
+ { "adis16477-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_2] },
+ { "adis16477-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16477_3] },
+ { "adis16465-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_1] },
+ { "adis16465-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_2] },
+ { "adis16465-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16465_3] },
+ { "adis16467-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_1] },
+ { "adis16467-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_2] },
+ { "adis16467-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16467_3] },
+ { "adis16500", (kernel_ulong_t)&adis16475_chip_info[ADIS16500] },
+ { "adis16505-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_1] },
+ { "adis16505-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_2] },
+ { "adis16505-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16505_3] },
+ { "adis16507-1", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_1] },
+ { "adis16507-2", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_2] },
+ { "adis16507-3", (kernel_ulong_t)&adis16475_chip_info[ADIS16507_3] },
+ { }
+};
+MODULE_DEVICE_TABLE(spi, adis16475_ids);
+
static struct spi_driver adis16475_driver = {
.driver = {
.name = "adis16475",
.of_match_table = adis16475_of_match,
},
.probe = adis16475_probe,
+ .id_table = adis16475_ids,
};
module_spi_driver(adis16475_driver);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 093/156] iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 092/156] iio: imu: adis16475: add spi_device_id table Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 094/156] iio: tmag5273: fix temperature offset Greg Kroah-Hartman
` (71 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wadim Egorov, Bhavya Kapoor, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wadim Egorov <w.egorov@phytec.de>
commit 60576e84c187043cef11f11d015249e71151d35a upstream.
Fix wrong handling of a DMA request where the probing only failed
if -EPROPE_DEFER was returned. Instead, let us fail if a non -ENODEV
value is returned. This makes DMAs explicitly optional. Even if the
DMA request is unsuccessfully, the ADC can still work properly.
We do also handle the defer probe case by making use of dev_err_probe().
Fixes: f438b9da75eb ("drivers: iio: ti_am335x_adc: add dma support")
Signed-off-by: Wadim Egorov <w.egorov@phytec.de>
Reviewed-by: Bhavya Kapoor <b-kapoor@ti.com>
Link: https://lore.kernel.org/r/20230925134427.214556-1-w.egorov@phytec.de
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ti_am335x_adc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/iio/adc/ti_am335x_adc.c
+++ b/drivers/iio/adc/ti_am335x_adc.c
@@ -670,8 +670,10 @@ static int tiadc_probe(struct platform_d
platform_set_drvdata(pdev, indio_dev);
err = tiadc_request_dma(pdev, adc_dev);
- if (err && err == -EPROBE_DEFER)
+ if (err && err != -ENODEV) {
+ dev_err_probe(&pdev->dev, err, "DMA request failed\n");
goto err_dma;
+ }
return 0;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 094/156] iio: tmag5273: fix temperature offset
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 093/156] iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 095/156] iio: triggered-buffer: prevent possible freeing of wrong buffer Greg Kroah-Hartman
` (70 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco@wolfvision.net>
commit 3b8157ec4573e304a29b7bced627e144dbc3dfdb upstream.
The current offset has the scale already applied to it. The ABI
documentation defines the offset parameter as "offset to be added
to <type>[Y]_raw prior to scaling by <type>[Y]_scale in order to
obtain value in the <type> units as specified in <type>[Y]_raw
documentation"
The right value is obtained at 0 degrees Celsius by the formula provided
in the datasheet:
T = Tsens_t0 + (Tadc_t - Tadc_t0) / Tadc_res
where:
T = 0 degrees Celsius
Tsens_t0 (reference temperature) = 25 degrees Celsius
Tadc_t0 (16-bit format for Tsens_t0) = 17508
Tadc_res = 60.1 LSB/degree Celsius
The resulting offset is 16005.5, which has been truncated to 16005 to
provide an integer value with a precision loss smaller than the 1-LSB
measurement precision.
Fix the offset to apply its value prior to scaling.
Signed-off-by: Javier Carrasco <javier.carrasco@wolfvision.net>
Link: https://lore.kernel.org/r/9879beec-05fc-4fc6-af62-d771e238954e@wolfvision.net
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/magnetometer/tmag5273.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/magnetometer/tmag5273.c
+++ b/drivers/iio/magnetometer/tmag5273.c
@@ -356,7 +356,7 @@ static int tmag5273_read_raw(struct iio_
case IIO_CHAN_INFO_OFFSET:
switch (chan->type) {
case IIO_TEMP:
- *val = -266314;
+ *val = -16005;
return IIO_VAL_INT;
default:
return -EINVAL;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 095/156] iio: triggered-buffer: prevent possible freeing of wrong buffer
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 094/156] iio: tmag5273: fix temperature offset Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 096/156] ALSA: usb-audio: Increase delay in MOTU M quirk Greg Kroah-Hartman
` (69 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lechner, Nuno Sa, Stable,
Jonathan Cameron
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lechner <dlechner@baylibre.com>
commit bce61476dc82f114e24e9c2e11fb064781ec563c upstream.
Commit ee708e6baacd ("iio: buffer: introduce support for attaching more
IIO buffers") introduced support for multiple buffers per indio_dev but
left indio_dev->buffer for a few legacy use cases.
In the case of the triggered buffer, iio_triggered_buffer_cleanup()
still assumes that indio_dev->buffer points to the buffer allocated by
iio_triggered_buffer_setup_ext(). However, since
iio_triggered_buffer_setup_ext() now calls iio_device_attach_buffer()
to attach the buffer, indio_dev->buffer will only point to the buffer
allocated by iio_device_attach_buffer() if it the first buffer attached.
This adds a check to make sure that no other buffer has been attached
yet to ensure that indio_dev->buffer will be assigned when
iio_device_attach_buffer() is called.
As per discussion in the review thread, we may want to deal with multiple
triggers per device, but this is a fix for the issue in the meantime and
any such support would be unlikely to be suitable for a backport.
Fixes: ee708e6baacd ("iio: buffer: introduce support for attaching more IIO buffers")
Signed-off-by: David Lechner <dlechner@baylibre.com>
Acked-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20231031210521.1661552-1-dlechner@baylibre.com
Cc: <Stable@vger.kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/buffer/industrialio-triggered-buffer.c | 10 ++++++++++
1 file changed, 10 insertions(+)
--- a/drivers/iio/buffer/industrialio-triggered-buffer.c
+++ b/drivers/iio/buffer/industrialio-triggered-buffer.c
@@ -46,6 +46,16 @@ int iio_triggered_buffer_setup_ext(struc
struct iio_buffer *buffer;
int ret;
+ /*
+ * iio_triggered_buffer_cleanup() assumes that the buffer allocated here
+ * is assigned to indio_dev->buffer but this is only the case if this
+ * function is the first caller to iio_device_attach_buffer(). If
+ * indio_dev->buffer is already set then we can't proceed otherwise the
+ * cleanup function will try to free a buffer that was not allocated here.
+ */
+ if (indio_dev->buffer)
+ return -EADDRINUSE;
+
buffer = iio_kfifo_allocate();
if (!buffer) {
ret = -ENOMEM;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 096/156] ALSA: usb-audio: Increase delay in MOTU M quirk
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 095/156] iio: triggered-buffer: prevent possible freeing of wrong buffer Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 097/156] ARM: dts: Fix occasional boot hang for am3 usb Greg Kroah-Hartman
` (68 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jeremie Knuesel, Alexander Tsoy,
Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeremie Knuesel <knuesel@gmail.com>
commit 48d6b91798a6694fdd6edb62799754b9d3fe0792 upstream.
Increase the quirk delay from 2 seconds to 4 seconds. This reflects a
change in the Windows driver in which the delay was increased to about
3.7 seconds. The larger delay fixes an issue where the device fails to
work unless it was powered up early during boot.
Also clarify in the quirk comment that the quirk is only applied to
older devices (USB ID 07fd:0008).
Signed-off-by: Jeremie Knuesel <knuesel@gmail.com>
Suggested-by: Alexander Tsoy <alexander@tsoy.me>
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=211975
Link: https://lore.kernel.org/r/20231217112243.33409-1-knuesel@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1387,7 +1387,7 @@ free_buf:
static int snd_usb_motu_m_series_boot_quirk(struct usb_device *dev)
{
- msleep(2000);
+ msleep(4000);
return 0;
}
@@ -1630,7 +1630,7 @@ int snd_usb_apply_boot_quirk_once(struct
unsigned int id)
{
switch (id) {
- case USB_ID(0x07fd, 0x0008): /* MOTU M Series */
+ case USB_ID(0x07fd, 0x0008): /* MOTU M Series, 1st hardware version */
return snd_usb_motu_m_series_boot_quirk(dev);
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 097/156] ARM: dts: Fix occasional boot hang for am3 usb
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 096/156] ALSA: usb-audio: Increase delay in MOTU M quirk Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 098/156] usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 Greg Kroah-Hartman
` (67 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tony Lindgren
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit 9b6a51aab5f5f9f71d2fa16e8b4d530e1643dfcb upstream.
With subtle timings changes, we can now sometimes get an external abort on
non-linefetch error booting am3 devices at sysc_reset(). This is because
of a missing reset delay needed for the usb target module.
Looks like we never enabled the delay earlier for am3, although a similar
issue was seen earlier with a similar usb setup for dm814x as described in
commit ebf244148092 ("ARM: OMAP2+: Use srst_udelay for USB on dm814x").
Cc: stable@vger.kernel.org
Fixes: 0782e8572ce4 ("ARM: dts: Probe am335x musb with ti-sysc")
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 +
1 file changed, 1 insertion(+)
--- a/arch/arm/boot/dts/ti/omap/am33xx.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am33xx.dtsi
@@ -359,6 +359,7 @@
<SYSC_IDLE_NO>,
<SYSC_IDLE_SMART>,
<SYSC_IDLE_SMART_WKUP>;
+ ti,sysc-delay-us = <2>;
clocks = <&l3s_clkctrl AM3_L3S_USB_OTG_HS_CLKCTRL 0>;
clock-names = "fck";
#address-cells = <1>;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 098/156] usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 097/156] ARM: dts: Fix occasional boot hang for am3 usb Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 099/156] wifi: mt76: fix crash with WED rx support enabled Greg Kroah-Hartman
` (66 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Tasos Sahanidis, Alan Stern,
Martin K. Petersen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tasos Sahanidis <tasos@tasossah.com>
commit 772685c14743ad565bb271041ad3c262298cd6fc upstream.
This flash drive reports write protect during the first mode sense.
In the past this was not an issue as the kernel called revalidate twice,
thus asking the device for its write protect status twice, with write
protect being disabled in the second mode sense.
However, since commit 1e029397d12f ("scsi: sd: Reorganize DIF/DIX code to
avoid calling revalidate twice") that is no longer the case, thus the
device shows up read only.
[490891.289495] sd 12:0:0:0: [sdl] Write Protect is on
[490891.289497] sd 12:0:0:0: [sdl] Mode Sense: 2b 00 80 08
This does not appear to be a timing issue, as enabling the usbcore quirk
USB_QUIRK_DELAY_INIT has no effect on write protect.
Fixes: 1e029397d12f ("scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice")
Cc: stable <stable@kernel.org>
Signed-off-by: Tasos Sahanidis <tasos@tasossah.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Link: https://lore.kernel.org/r/20231207134441.298131-1-tasos@tasossah.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1306,6 +1306,17 @@ UNUSUAL_DEV( 0x090c, 0x6000, 0x0100, 0x
US_FL_INITIAL_READ10 ),
/*
+ * Patch by Tasos Sahanidis <tasos@tasossah.com>
+ * This flash drive always shows up with write protect enabled
+ * during the first mode sense.
+ */
+UNUSUAL_DEV(0x0951, 0x1697, 0x0100, 0x0100,
+ "Kingston",
+ "DT Ultimate G3",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_WP_DETECT),
+
+/*
* This Pentax still camera is not conformant
* to the USB storage specification: -
* - It does not like the INQUIRY command. So we must handle this command
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 099/156] wifi: mt76: fix crash with WED rx support enabled
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 098/156] usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 100/156] wifi: cfg80211: Add my certificate Greg Kroah-Hartman
` (65 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Felix Fietkau, Lorenzo Bianconi,
Kalle Valo
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felix Fietkau <nbd@nbd.name>
commit cd607f2cbbbec90682b2f6d6b85e1525d0f43b19 upstream.
If WED rx is enabled, rx buffers are added to a buffer pool that can be
filled from multiple page pools. Because buffers freed from rx poll are
not guaranteed to belong to the processed queue's page pool, lockless
caching must not be used in this case.
Cc: stable@vger.kernel.org
Fixes: 2f5c3c77fc9b ("wifi: mt76: switch to page_pool allocator")
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Acked-by: Lorenzo Bianconi <lorenzo@kernel.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231208075004.69843-1-nbd@nbd.name
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/dma.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/net/wireless/mediatek/mt76/dma.c
+++ b/drivers/net/wireless/mediatek/mt76/dma.c
@@ -776,7 +776,7 @@ mt76_dma_rx_reset(struct mt76_dev *dev,
static void
mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data,
- int len, bool more, u32 info)
+ int len, bool more, u32 info, bool allow_direct)
{
struct sk_buff *skb = q->rx_head;
struct skb_shared_info *shinfo = skb_shinfo(skb);
@@ -788,7 +788,7 @@ mt76_add_fragment(struct mt76_dev *dev,
skb_add_rx_frag(skb, nr_frags, page, offset, len, q->buf_size);
} else {
- mt76_put_page_pool_buf(data, true);
+ mt76_put_page_pool_buf(data, allow_direct);
}
if (more)
@@ -808,6 +808,7 @@ mt76_dma_rx_process(struct mt76_dev *dev
struct sk_buff *skb;
unsigned char *data;
bool check_ddone = false;
+ bool allow_direct = !mt76_queue_is_wed_rx(q);
bool more;
if (IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED) &&
@@ -848,7 +849,8 @@ mt76_dma_rx_process(struct mt76_dev *dev
}
if (q->rx_head) {
- mt76_add_fragment(dev, q, data, len, more, info);
+ mt76_add_fragment(dev, q, data, len, more, info,
+ allow_direct);
continue;
}
@@ -877,7 +879,7 @@ mt76_dma_rx_process(struct mt76_dev *dev
continue;
free_frag:
- mt76_put_page_pool_buf(data, true);
+ mt76_put_page_pool_buf(data, allow_direct);
}
mt76_dma_rx_fill(dev, q, true);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 100/156] wifi: cfg80211: Add my certificate
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 099/156] wifi: mt76: fix crash with WED rx support enabled Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 101/156] wifi: cfg80211: fix certs build to not depend on file order Greg Kroah-Hartman
` (64 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai, Seth Forshee,
Johannes Berg
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wens@kernel.org>
commit fb768d3b13ffa325b7e84480d488ac799c9d2cd7 upstream.
As announced [1][2], I have taken over maintainership of the
wireless-regdb project.
Add my certificate so that newer releases are valid to the kernel.
Seth's certificate should be kept around for awhile, at least until
a few new releases by me happen.
This should also be applied to stable trees so that stable kernels
can utilize newly released database binaries.
[1] https://lore.kernel.org/linux-wireless/CAGb2v657baNMPKU3QADijx7hZa=GUcSv2LEDdn6N=QQaFX8r-g@mail.gmail.com/
[2] https://lore.kernel.org/linux-wireless/ZWmRR5ul7EDfxCan@wens.tw/
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wens@kernel.org>
Acked-by: Seth Forshee <sforshee@kernel.org>
Link: https://msgid.link/ZXHGsqs34qZyzZng@wens.tw
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/certs/wens.hex | 87 ++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 87 insertions(+)
create mode 100644 net/wireless/certs/wens.hex
--- /dev/null
+++ b/net/wireless/certs/wens.hex
@@ -0,0 +1,87 @@
+/* Chen-Yu Tsai's regdb certificate */
+0x30, 0x82, 0x02, 0xa7, 0x30, 0x82, 0x01, 0x8f,
+0x02, 0x14, 0x61, 0xc0, 0x38, 0x65, 0x1a, 0xab,
+0xdc, 0xf9, 0x4b, 0xd0, 0xac, 0x7f, 0xf0, 0x6c,
+0x72, 0x48, 0xdb, 0x18, 0xc6, 0x00, 0x30, 0x0d,
+0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d,
+0x01, 0x01, 0x0b, 0x05, 0x00, 0x30, 0x0f, 0x31,
+0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03,
+0x0c, 0x04, 0x77, 0x65, 0x6e, 0x73, 0x30, 0x20,
+0x17, 0x0d, 0x32, 0x33, 0x31, 0x32, 0x30, 0x31,
+0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a, 0x18,
+0x0f, 0x32, 0x31, 0x32, 0x33, 0x31, 0x31, 0x30,
+0x37, 0x30, 0x37, 0x34, 0x31, 0x31, 0x34, 0x5a,
+0x30, 0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03,
+0x55, 0x04, 0x03, 0x0c, 0x04, 0x77, 0x65, 0x6e,
+0x73, 0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06,
+0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x01,
+0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f,
+0x00, 0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01,
+0x01, 0x00, 0xa9, 0x7a, 0x2c, 0x78, 0x4d, 0xa7,
+0x19, 0x2d, 0x32, 0x52, 0xa0, 0x2e, 0x6c, 0xef,
+0x88, 0x7f, 0x15, 0xc5, 0xb6, 0x69, 0x54, 0x16,
+0x43, 0x14, 0x79, 0x53, 0xb7, 0xae, 0x88, 0xfe,
+0xc0, 0xb7, 0x5d, 0x47, 0x8e, 0x1a, 0xe1, 0xef,
+0xb3, 0x90, 0x86, 0xda, 0xd3, 0x64, 0x81, 0x1f,
+0xce, 0x5d, 0x9e, 0x4b, 0x6e, 0x58, 0x02, 0x3e,
+0xb2, 0x6f, 0x5e, 0x42, 0x47, 0x41, 0xf4, 0x2c,
+0xb8, 0xa8, 0xd4, 0xaa, 0xc0, 0x0e, 0xe6, 0x48,
+0xf0, 0xa8, 0xce, 0xcb, 0x08, 0xae, 0x37, 0xaf,
+0xf6, 0x40, 0x39, 0xcb, 0x55, 0x6f, 0x5b, 0x4f,
+0x85, 0x34, 0xe6, 0x69, 0x10, 0x50, 0x72, 0x5e,
+0x4e, 0x9d, 0x4c, 0xba, 0x38, 0x36, 0x0d, 0xce,
+0x73, 0x38, 0xd7, 0x27, 0x02, 0x2a, 0x79, 0x03,
+0xe1, 0xac, 0xcf, 0xb0, 0x27, 0x85, 0x86, 0x93,
+0x17, 0xab, 0xec, 0x42, 0x77, 0x37, 0x65, 0x8a,
+0x44, 0xcb, 0xd6, 0x42, 0x93, 0x92, 0x13, 0xe3,
+0x39, 0x45, 0xc5, 0x6e, 0x00, 0x4a, 0x7f, 0xcb,
+0x42, 0x17, 0x2b, 0x25, 0x8c, 0xb8, 0x17, 0x3b,
+0x15, 0x36, 0x59, 0xde, 0x42, 0xce, 0x21, 0xe6,
+0xb6, 0xc7, 0x6e, 0x5e, 0x26, 0x1f, 0xf7, 0x8a,
+0x57, 0x9e, 0xa5, 0x96, 0x72, 0xb7, 0x02, 0x32,
+0xeb, 0x07, 0x2b, 0x73, 0xe2, 0x4f, 0x66, 0x58,
+0x9a, 0xeb, 0x0f, 0x07, 0xb6, 0xab, 0x50, 0x8b,
+0xc3, 0x8f, 0x17, 0xfa, 0x0a, 0x99, 0xc2, 0x16,
+0x25, 0xbf, 0x2d, 0x6b, 0x1a, 0xaa, 0xe6, 0x3e,
+0x5f, 0xeb, 0x6d, 0x9b, 0x5d, 0x4d, 0x42, 0x83,
+0x2d, 0x39, 0xb8, 0xc9, 0xac, 0xdb, 0x3a, 0x91,
+0x50, 0xdf, 0xbb, 0xb1, 0x76, 0x6d, 0x15, 0x73,
+0xfd, 0xc6, 0xe6, 0x6b, 0x71, 0x9e, 0x67, 0x36,
+0x22, 0x83, 0x79, 0xb1, 0xd6, 0xb8, 0x84, 0x52,
+0xaf, 0x96, 0x5b, 0xc3, 0x63, 0x02, 0x4e, 0x78,
+0x70, 0x57, 0x02, 0x03, 0x01, 0x00, 0x01, 0x30,
+0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86, 0xf7,
+0x0d, 0x01, 0x01, 0x0b, 0x05, 0x00, 0x03, 0x82,
+0x01, 0x01, 0x00, 0x24, 0x28, 0xee, 0x22, 0x74,
+0x7f, 0x7c, 0xfa, 0x6c, 0x1f, 0xb3, 0x18, 0xd1,
+0xc2, 0x3d, 0x7d, 0x29, 0x42, 0x88, 0xad, 0x82,
+0xa5, 0xb1, 0x8a, 0x05, 0xd0, 0xec, 0x5c, 0x91,
+0x20, 0xf6, 0x82, 0xfd, 0xd5, 0x67, 0x60, 0x5f,
+0x31, 0xf5, 0xbd, 0x88, 0x91, 0x70, 0xbd, 0xb8,
+0xb9, 0x8c, 0x88, 0xfe, 0x53, 0xc9, 0x54, 0x9b,
+0x43, 0xc4, 0x7a, 0x43, 0x74, 0x6b, 0xdd, 0xb0,
+0xb1, 0x3b, 0x33, 0x45, 0x46, 0x78, 0xa3, 0x1c,
+0xef, 0x54, 0x68, 0xf7, 0x85, 0x9c, 0xe4, 0x51,
+0x6f, 0x06, 0xaf, 0x81, 0xdb, 0x2a, 0x7b, 0x7b,
+0x6f, 0xa8, 0x9c, 0x67, 0xd8, 0xcb, 0xc9, 0x91,
+0x40, 0x00, 0xae, 0xd9, 0xa1, 0x9f, 0xdd, 0xa6,
+0x43, 0x0e, 0x28, 0x7b, 0xaa, 0x1b, 0xe9, 0x84,
+0xdb, 0x76, 0x64, 0x42, 0x70, 0xc9, 0xc0, 0xeb,
+0xae, 0x84, 0x11, 0x16, 0x68, 0x4e, 0x84, 0x9e,
+0x7e, 0x92, 0x36, 0xee, 0x1c, 0x3b, 0x08, 0x63,
+0xeb, 0x79, 0x84, 0x15, 0x08, 0x9d, 0xaf, 0xc8,
+0x9a, 0xc7, 0x34, 0xd3, 0x94, 0x4b, 0xd1, 0x28,
+0x97, 0xbe, 0xd1, 0x45, 0x75, 0xdc, 0x35, 0x62,
+0xac, 0x1d, 0x1f, 0xb7, 0xb7, 0x15, 0x87, 0xc8,
+0x98, 0xc0, 0x24, 0x31, 0x56, 0x8d, 0xed, 0xdb,
+0x06, 0xc6, 0x46, 0xbf, 0x4b, 0x6d, 0xa6, 0xd5,
+0xab, 0xcc, 0x60, 0xfc, 0xe5, 0x37, 0xb6, 0x53,
+0x7d, 0x58, 0x95, 0xa9, 0x56, 0xc7, 0xf7, 0xee,
+0xc3, 0xa0, 0x76, 0xf7, 0x65, 0x4d, 0x53, 0xfa,
+0xff, 0x5f, 0x76, 0x33, 0x5a, 0x08, 0xfa, 0x86,
+0x92, 0x5a, 0x13, 0xfa, 0x1a, 0xfc, 0xf2, 0x1b,
+0x8c, 0x7f, 0x42, 0x6d, 0xb7, 0x7e, 0xb7, 0xb4,
+0xf0, 0xc7, 0x83, 0xbb, 0xa2, 0x81, 0x03, 0x2d,
+0xd4, 0x2a, 0x63, 0x3f, 0xf7, 0x31, 0x2e, 0x40,
+0x33, 0x5c, 0x46, 0xbc, 0x9b, 0xc1, 0x05, 0xa5,
+0x45, 0x4e, 0xc3
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 101/156] wifi: cfg80211: fix certs build to not depend on file order
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 100/156] wifi: cfg80211: Add my certificate Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 102/156] USB: serial: ftdi_sio: update Actisense PIDs constant names Greg Kroah-Hartman
` (63 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Biju Das, Naresh Kamboju,
Johannes Berg
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
commit 3c2a8ebe3fe66a5f77d4c164a0bea8e2ff37b455 upstream.
The file for the new certificate (Chen-Yu Tsai's) didn't
end with a comma, so depending on the file order in the
build rule, we'd end up with invalid C when concatenating
the (now two) certificates. Fix that.
Cc: stable@vger.kernel.org
Reported-by: Biju Das <biju.das.jz@bp.renesas.com>
Reported-by: Naresh Kamboju <naresh.kamboju@linaro.org>
Fixes: fb768d3b13ff ("wifi: cfg80211: Add my certificate")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/certs/wens.hex | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/wireless/certs/wens.hex
+++ b/net/wireless/certs/wens.hex
@@ -84,4 +84,4 @@
0xf0, 0xc7, 0x83, 0xbb, 0xa2, 0x81, 0x03, 0x2d,
0xd4, 0x2a, 0x63, 0x3f, 0xf7, 0x31, 0x2e, 0x40,
0x33, 0x5c, 0x46, 0xbc, 0x9b, 0xc1, 0x05, 0xa5,
-0x45, 0x4e, 0xc3
+0x45, 0x4e, 0xc3,
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 102/156] USB: serial: ftdi_sio: update Actisense PIDs constant names
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 101/156] wifi: cfg80211: fix certs build to not depend on file order Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 103/156] USB: serial: option: add Quectel EG912Y module support Greg Kroah-Hartman
` (62 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mark Glover, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Glover <mark.glover@actisense.com>
commit 513d88a88e0203188a38f4647dd08170aebd85df upstream.
Update the constant names for unused USB PIDs (product identifiers) to
reflect the new products now using the PIDs.
Signed-off-by: Mark Glover <mark.glover@actisense.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/ftdi_sio.c | 6 +++---
drivers/usb/serial/ftdi_sio_ids.h | 6 +++---
2 files changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -1033,9 +1033,9 @@ static const struct usb_device_id id_tab
{ USB_DEVICE(FTDI_VID, ACTISENSE_USG_PID) },
{ USB_DEVICE(FTDI_VID, ACTISENSE_NGT_PID) },
{ USB_DEVICE(FTDI_VID, ACTISENSE_NGW_PID) },
- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AC_PID) },
- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AD_PID) },
- { USB_DEVICE(FTDI_VID, ACTISENSE_D9AE_PID) },
+ { USB_DEVICE(FTDI_VID, ACTISENSE_UID_PID) },
+ { USB_DEVICE(FTDI_VID, ACTISENSE_USA_PID) },
+ { USB_DEVICE(FTDI_VID, ACTISENSE_NGX_PID) },
{ USB_DEVICE(FTDI_VID, ACTISENSE_D9AF_PID) },
{ USB_DEVICE(FTDI_VID, CHETCO_SEAGAUGE_PID) },
{ USB_DEVICE(FTDI_VID, CHETCO_SEASWITCH_PID) },
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -1568,9 +1568,9 @@
#define ACTISENSE_USG_PID 0xD9A9 /* USG USB Serial Adapter */
#define ACTISENSE_NGT_PID 0xD9AA /* NGT NMEA2000 Interface */
#define ACTISENSE_NGW_PID 0xD9AB /* NGW NMEA2000 Gateway */
-#define ACTISENSE_D9AC_PID 0xD9AC /* Actisense Reserved */
-#define ACTISENSE_D9AD_PID 0xD9AD /* Actisense Reserved */
-#define ACTISENSE_D9AE_PID 0xD9AE /* Actisense Reserved */
+#define ACTISENSE_UID_PID 0xD9AC /* USB Isolating Device */
+#define ACTISENSE_USA_PID 0xD9AD /* USB to Serial Adapter */
+#define ACTISENSE_NGX_PID 0xD9AE /* NGX NMEA2000 Gateway */
#define ACTISENSE_D9AF_PID 0xD9AF /* Actisense Reserved */
#define CHETCO_SEAGAUGE_PID 0xA548 /* SeaGauge USB Adapter */
#define CHETCO_SEASWITCH_PID 0xA549 /* SeaSwitch USB Adapter */
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 103/156] USB: serial: option: add Quectel EG912Y module support
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 102/156] USB: serial: ftdi_sio: update Actisense PIDs constant names Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 104/156] USB: serial: option: add Foxconn T99W265 with new baseline Greg Kroah-Hartman
` (61 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alper Ak, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alper Ak <alperyasinak1@gmail.com>
commit 6d79d9434c69bb8ffa8a631050eb0ad6b83d3e90 upstream.
Add Quectel EG912Y "DIAG, AT, MODEM"
0x6001: ECM / RNDIS + DIAG + AT + MODEM
T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#= 3 Spd=480 MxCh= 0
D: Ver= 2.00 Cls=ef(misc ) Sub=02 Prot=01 MxPS=64 #Cfgs= 1
P: Vendor=2c7c ProdID=6001 Rev= 3.18
S: Manufacturer=Android
S: Product=Android
S: SerialNumber=0000
C:* #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
A: FirstIf#= 0 IfCount= 2 Cls=02(comm.) Sub=06 Prot=00
I:* If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=06 Prot=00 Driver=cdc_ether
E: Ad=87(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
I: If#= 1 Alt= 0 #EPs= 0 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
I:* If#= 1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_ether
E: Ad=83(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0c(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=82(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0b(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=89(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
E: Ad=86(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0f(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=88(I) Atr=03(Int.) MxPS= 64 Ivl=4096ms
E: Ad=81(I) Atr=02(Bulk) MxPS= 512 Ivl=0ms
E: Ad=0a(O) Atr=02(Bulk) MxPS= 512 Ivl=0ms
Signed-off-by: Alper Ak <alperyasinak1@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -272,6 +272,7 @@ static void option_instat_callback(struc
#define QUECTEL_PRODUCT_RM500Q 0x0800
#define QUECTEL_PRODUCT_RM520N 0x0801
#define QUECTEL_PRODUCT_EC200U 0x0901
+#define QUECTEL_PRODUCT_EG912Y 0x6001
#define QUECTEL_PRODUCT_EC200S_CN 0x6002
#define QUECTEL_PRODUCT_EC200A 0x6005
#define QUECTEL_PRODUCT_EM061K_LWW 0x6008
@@ -1244,6 +1245,7 @@ static const struct usb_device_id option
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200U, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200S_CN, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC200T, 0xff, 0, 0) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EG912Y, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500K, 0xff, 0x00, 0x00) },
{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 104/156] USB: serial: option: add Foxconn T99W265 with new baseline
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 103/156] USB: serial: option: add Quectel EG912Y module support Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 105/156] USB: serial: option: add Quectel RM500Q R13 firmware support Greg Kroah-Hartman
` (60 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Slark Xiao, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Slark Xiao <slark_xiao@163.com>
commit 13fde9ac23ca8c6d1ac13cc9eefe1f1ac3ee30a4 upstream.
This ID was added based on latest SDX12 code base line, and we
made some changes with previous 0489:e0db.
Test evidence as below:
T: Bus=02 Lev=01 Prnt=01 Port=00 Cnt=01 Dev#= 3 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=ef(misc ) Sub=02 Prot=01 MxPS= 9 #Cfgs= 2
P: Vendor=0489 ProdID=e0da Rev=05.04
S: Manufacturer=Qualcomm
S: Product=Qualcomm Snapdragon X12
S: SerialNumber=2bda65fb
C: #Ifs= 6 Cfg#= 2 Atr=a0 MxPwr=896mA
I: If#=0x0 Alt= 0 #EPs= 1 Cls=02(commc) Sub=0e Prot=00 Driver=cdc_mbim
I: If#=0x1 Alt= 1 #EPs= 2 Cls=0a(data ) Sub=00 Prot=02 Driver=cdc_mbim
I: If#=0x2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=40 Driver=option
I: If#=0x3 Alt= 0 #EPs= 1 Cls=ff(vend.) Sub=ff Prot=ff Driver=(none)
I: If#=0x4 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
I: If#=0x5 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
0&1: MBIM, 2: Modem, 3:GNSS, 4:Diag, 5:ADB
Signed-off-by: Slark Xiao <slark_xiao@163.com>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -2244,6 +2244,8 @@ static const struct usb_device_id option
.driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
{ USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */
.driver_info = RSVD(0) | RSVD(1) | RSVD(6) },
+ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0da, 0xff), /* Foxconn T99W265 MBIM variant */
+ .driver_info = RSVD(3) | RSVD(5) },
{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */
.driver_info = RSVD(3) },
{ USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0ee, 0xff), /* Foxconn T99W368 MBIM */
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 105/156] USB: serial: option: add Quectel RM500Q R13 firmware support
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 104/156] USB: serial: option: add Foxconn T99W265 with new baseline Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 106/156] ALSA: hda/tas2781: select program 0, conf 0 by default Greg Kroah-Hartman
` (59 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Reinhard Speyerer, Johan Hovold
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Reinhard Speyerer <rspmn@arcor.de>
commit 06f22cd6635bdae7d73566fca9879b2026a08e00 upstream.
Add support for Quectel RM500Q R13 firmware which uses Prot=40 for the
NMEA port:
T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 8 Spd=5000 MxCh= 0
D: Ver= 3.20 Cls=00(>ifc ) Sub=00 Prot=00 MxPS= 9 #Cfgs= 1
P: Vendor=2c7c ProdID=0800 Rev= 4.14
S: Manufacturer=Quectel
S: Product=RM500Q-AE
S: SerialNumber=xxxxxxxx
C:* #Ifs= 5 Cfg#= 1 Atr=a0 MxPwr=896mA
I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=30 Driver=option
E: Ad=81(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=01(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=40 Driver=option
E: Ad=83(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=82(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=02(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=85(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=84(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=03(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
E: Ad=87(I) Atr=03(Int.) MxPS= 10 Ivl=32ms
E: Ad=86(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=04(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
E: Ad=88(I) Atr=03(Int.) MxPS= 8 Ivl=32ms
E: Ad=8e(I) Atr=02(Bulk) MxPS=1024 Ivl=0ms
E: Ad=0f(O) Atr=02(Bulk) MxPS=1024 Ivl=0ms
Signed-off-by: Reinhard Speyerer <rspmn@arcor.de>
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/serial/option.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -1233,6 +1233,7 @@ static const struct usb_device_id option
{ USB_DEVICE_INTERFACE_CLASS(QUECTEL_VENDOR_ID, 0x0700, 0xff), /* BG95 */
.driver_info = RSVD(3) | ZLP },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x30) },
+ { USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0x40) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0, 0) },
{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_RM500Q, 0xff, 0xff, 0x10),
.driver_info = ZLP },
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 106/156] ALSA: hda/tas2781: select program 0, conf 0 by default
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 105/156] USB: serial: option: add Quectel RM500Q R13 firmware support Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 107/156] ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Greg Kroah-Hartman
` (58 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gergo Koteles, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <soyer@irl.hu>
commit ec1de5c214eb5a892fdb7c450748249d5e2840f5 upstream.
Currently, cur_prog/cur_conf remains at the default value (-1), while
program 0 has been loaded into the amplifiers.
In the playback hook, tasdevice_tuning_switch tries to restore the
cur_prog/cur_conf. In the runtime_resume/system_resume,
tasdevice_prmg_load tries to load the cur_prog as well.
Set cur_prog and cur_conf to 0 if available in the firmware.
Fixes: 5be27f1e3ec9 ("ALSA: hda/tas2781: Add tas2781 HDA driver")
CC: stable@vger.kernel.org
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Link: https://lore.kernel.org/r/038add0bdca1f979cc7abcce8f24cbcd3544084b.1702596646.git.soyer@irl.hu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/tas2781_hda_i2c.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/sound/pci/hda/tas2781_hda_i2c.c b/sound/pci/hda/tas2781_hda_i2c.c
index 63a90c7e8976..2fb1a7037c82 100644
--- a/sound/pci/hda/tas2781_hda_i2c.c
+++ b/sound/pci/hda/tas2781_hda_i2c.c
@@ -543,6 +543,10 @@ static void tasdev_fw_ready(const struct firmware *fmw, void *context)
tas_priv->fw_state = TASDEVICE_DSP_FW_ALL_OK;
tasdevice_prmg_load(tas_priv, 0);
+ if (tas_priv->fmw->nr_programs > 0)
+ tas_priv->cur_prog = 0;
+ if (tas_priv->fmw->nr_configurations > 0)
+ tas_priv->cur_conf = 0;
/* If calibrated data occurs error, dsp will still works with default
* calibrated data inside algo.
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 107/156] ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 106/156] ALSA: hda/tas2781: select program 0, conf 0 by default Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 108/156] ASoC: tas2781: check the validity of prm_no/cfg_no Greg Kroah-Hartman
` (57 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Clément Villeret, Takashi Iwai
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Clément Villeret <clement.villeret@gmail.com>
commit 02a460adfc4920d4da775fb59ab3e54036daef22 upstream.
Asus ROG Flowx13 (GV302XA) seems require same patch as others asus products
Signed-off-by: Clément Villeret <clement.villeret@gmail.com>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/0a27bf4b-3056-49ac-9651-ebd7f3e36328@gmail.com
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9864,6 +9864,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x1043, 0x1483, "ASUS GU603V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1493, "ASUS GV601V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1517, "Asus Zenbook UX31A", ALC269VB_FIXUP_ASUS_ZENBOOK_UX31A),
+ SND_PCI_QUIRK(0x1043, 0x1533, "ASUS GV302XA", ALC287_FIXUP_CS35L41_I2C_2),
SND_PCI_QUIRK(0x1043, 0x1573, "ASUS GZ301V", ALC285_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1043, 0x1662, "ASUS GV301QH", ALC294_FIXUP_ASUS_DUAL_SPK),
SND_PCI_QUIRK(0x1043, 0x1663, "ASUS GU603ZV", ALC285_FIXUP_ASUS_HEADSET_MIC),
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 108/156] ASoC: tas2781: check the validity of prm_no/cfg_no
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 107/156] ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 109/156] Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Greg Kroah-Hartman
` (56 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gergo Koteles, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gergo Koteles <soyer@irl.hu>
commit f32c80d34249e1cfb2e647ab3c8ef38a460c787f upstream.
Add additional checks for program/config numbers to avoid loading from
invalid addresses.
If prm_no/cfg_no is negative, skip uploading program/config.
The tas2781-hda driver caused a NULL pointer dereference after loading
module, and before first runtime_suspend.
the state was:
tas_priv->cur_conf = -1;
tas_priv->tasdevice[i].cur_conf = 0;
program = &(tas_fmw->programs[-1]);
BUG: kernel NULL pointer dereference, address: 0000000000000010
Call Trace:
<TASK>
? __die+0x23/0x70
? page_fault_oops+0x171/0x4e0
? vprintk_emit+0x175/0x2b0
? exc_page_fault+0x7f/0x180
? asm_exc_page_fault+0x26/0x30
? tasdevice_load_block_kernel+0x21/0x310 [snd_soc_tas2781_fmwlib]
tasdevice_select_tuningprm_cfg+0x268/0x3a0 [snd_soc_tas2781_fmwlib]
tasdevice_tuning_switch+0x69/0x710 [snd_soc_tas2781_fmwlib]
tas2781_hda_playback_hook+0xd4/0x110 [snd_hda_scodec_tas2781_i2c]
Fixes: 915f5eadebd2 ("ASoC: tas2781: firmware lib")
CC: <stable@vger.kernel.org>
Signed-off-by: Gergo Koteles <soyer@irl.hu>
Link: https://msgid.link/r/523780155bfdca9bc0acd39efc79ed039454818d.1702591356.git.soyer@irl.hu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/codecs/tas2781-fmwlib.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/sound/soc/codecs/tas2781-fmwlib.c
+++ b/sound/soc/codecs/tas2781-fmwlib.c
@@ -2219,11 +2219,11 @@ int tasdevice_select_tuningprm_cfg(void
goto out;
}
- conf = &(tas_fmw->configs[cfg_no]);
for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) {
if (cfg_info[rca_conf_no]->active_dev & (1 << i)) {
- if (tas_priv->tasdevice[i].cur_prog != prm_no
- || tas_priv->force_fwload_status) {
+ if (prm_no >= 0
+ && (tas_priv->tasdevice[i].cur_prog != prm_no
+ || tas_priv->force_fwload_status)) {
tas_priv->tasdevice[i].cur_conf = -1;
tas_priv->tasdevice[i].is_loading = true;
prog_status++;
@@ -2258,7 +2258,8 @@ int tasdevice_select_tuningprm_cfg(void
}
for (i = 0, status = 0; i < tas_priv->ndev; i++) {
- if (tas_priv->tasdevice[i].cur_conf != cfg_no
+ if (cfg_no >= 0
+ && tas_priv->tasdevice[i].cur_conf != cfg_no
&& (cfg_info[rca_conf_no]->active_dev & (1 << i))
&& (tas_priv->tasdevice[i].is_loaderr == false)) {
status++;
@@ -2268,6 +2269,7 @@ int tasdevice_select_tuningprm_cfg(void
}
if (status) {
+ conf = &(tas_fmw->configs[cfg_no]);
status = 0;
tasdevice_load_data(tas_priv, &(conf->dev_data));
for (i = 0; i < tas_priv->ndev; i++) {
@@ -2311,7 +2313,7 @@ int tasdevice_prmg_load(void *context, i
}
for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) {
- if (tas_priv->tasdevice[i].cur_prog != prm_no) {
+ if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) {
tas_priv->tasdevice[i].cur_conf = -1;
tas_priv->tasdevice[i].is_loading = true;
prog_status++;
@@ -2356,7 +2358,7 @@ int tasdevice_prmg_calibdata_load(void *
}
for (i = 0, prog_status = 0; i < tas_priv->ndev; i++) {
- if (tas_priv->tasdevice[i].cur_prog != prm_no) {
+ if (prm_no >= 0 && tas_priv->tasdevice[i].cur_prog != prm_no) {
tas_priv->tasdevice[i].cur_conf = -1;
tas_priv->tasdevice[i].is_loading = true;
prog_status++;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 109/156] Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 108/156] ASoC: tas2781: check the validity of prm_no/cfg_no Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 110/156] Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Greg Kroah-Hartman
` (55 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
commit 99e67d46e5ff3c7c901af6009edec72d3d363be8 upstream.
Before setting HCI_INQUIRY bit check if HCI_OP_INQUIRY was really sent
otherwise the controller maybe be generating invalid events or, more
likely, it is a result of fuzzing tools attempting to test the right
behavior of the stack when unexpected events are generated.
Cc: stable@vger.kernel.org
Link: https://bugzilla.kernel.org/show_bug.cgi?id=218151
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2305,7 +2305,8 @@ static void hci_cs_inquiry(struct hci_de
return;
}
- set_bit(HCI_INQUIRY, &hdev->flags);
+ if (hci_sent_cmd_data(hdev, HCI_OP_INQUIRY))
+ set_bit(HCI_INQUIRY, &hdev->flags);
}
static void hci_cs_create_conn(struct hci_dev *hdev, __u8 status)
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 110/156] Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 109/156] Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 111/156] Bluetooth: L2CAP: Send reject on command corrupted request Greg Kroah-Hartman
` (54 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hyunwoo Kim, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hyunwoo Kim <v4bel@theori.io>
commit 2e07e8348ea454615e268222ae3fc240421be768 upstream.
This can cause a race with bt_sock_ioctl() because
bt_sock_recvmsg() gets the skb from sk->sk_receive_queue
and then frees it without holding lock_sock.
A use-after-free for a skb occurs with the following flow.
```
bt_sock_recvmsg() -> skb_recv_datagram() -> skb_free_datagram()
bt_sock_ioctl() -> skb_peek()
```
Add lock_sock to bt_sock_recvmsg() to fix this issue.
Cc: stable@vger.kernel.org
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <v4bel@theori.io>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/af_bluetooth.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -309,11 +309,14 @@ int bt_sock_recvmsg(struct socket *sock,
if (flags & MSG_OOB)
return -EOPNOTSUPP;
+ lock_sock(sk);
+
skb = skb_recv_datagram(sk, flags, &err);
if (!skb) {
if (sk->sk_shutdown & RCV_SHUTDOWN)
- return 0;
+ err = 0;
+ release_sock(sk);
return err;
}
@@ -343,6 +346,8 @@ int bt_sock_recvmsg(struct socket *sock,
skb_free_datagram(sk, skb);
+ release_sock(sk);
+
if (flags & MSG_TRUNC)
copied = skblen;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 111/156] Bluetooth: L2CAP: Send reject on command corrupted request
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 110/156] Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 112/156] Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Greg Kroah-Hartman
` (53 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frédéric Danis,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frédéric Danis <frederic.danis@collabora.com>
commit 78b99eb1faa7371bf9c534690f26a71b6996622d upstream.
L2CAP/COS/CED/BI-02-C PTS test send a malformed L2CAP signaling packet
with 2 commands in it (a connection request and an unknown command) and
expect to get a connection response packet and a command reject packet.
The second is currently not sent.
Cc: stable@vger.kernel.org
Signed-off-by: Frédéric Danis <frederic.danis@collabora.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/l2cap_core.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6492,6 +6492,14 @@ drop:
kfree_skb(skb);
}
+static inline void l2cap_sig_send_rej(struct l2cap_conn *conn, u16 ident)
+{
+ struct l2cap_cmd_rej_unk rej;
+
+ rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
+ l2cap_send_cmd(conn, ident, L2CAP_COMMAND_REJ, sizeof(rej), &rej);
+}
+
static inline void l2cap_sig_channel(struct l2cap_conn *conn,
struct sk_buff *skb)
{
@@ -6517,23 +6525,24 @@ static inline void l2cap_sig_channel(str
if (len > skb->len || !cmd->ident) {
BT_DBG("corrupted command");
+ l2cap_sig_send_rej(conn, cmd->ident);
break;
}
err = l2cap_bredr_sig_cmd(conn, cmd, len, skb->data);
if (err) {
- struct l2cap_cmd_rej_unk rej;
-
BT_ERR("Wrong link type (%d)", err);
-
- rej.reason = cpu_to_le16(L2CAP_REJ_NOT_UNDERSTOOD);
- l2cap_send_cmd(conn, cmd->ident, L2CAP_COMMAND_REJ,
- sizeof(rej), &rej);
+ l2cap_sig_send_rej(conn, cmd->ident);
}
skb_pull(skb, len);
}
+ if (skb->len > 0) {
+ BT_DBG("corrupted command");
+ l2cap_sig_send_rej(conn, 0);
+ }
+
drop:
kfree_skb(skb);
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 112/156] Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 111/156] Bluetooth: L2CAP: Send reject on command corrupted request Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 113/156] Bluetooth: Add more enc key size check Greg Kroah-Hartman
` (52 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiao Yao, Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Yao <xiaoyao@rock-chips.com>
commit 59b047bc98084f8af2c41483e4d68a5adf2fa7f7 upstream.
If two Bluetooth devices both support BR/EDR and BLE, and also
support Secure Connections, then they only need to pair once.
The LTK generated during the LE pairing process may be converted
into a BR/EDR link key for BR/EDR transport, and conversely, a
link key generated during the BR/EDR SSP pairing process can be
converted into an LTK for LE transport. Hence, the link type of
the link key and LTK is not fixed, they can be either an LE LINK
or an ACL LINK.
Currently, in the mgmt_new_irk/ltk/crsk/link_key functions, the
link type is fixed, which could lead to incorrect address types
being reported to the application layer. Therefore, it is necessary
to add link_type/addr_type to the smp_irk/ltk/crsk and link_key,
to ensure the generation of the correct address type.
SMP over BREDR:
Before Fix:
> ACL Data RX: Handle 11 flags 0x02 dlen 12
BR/EDR SMP: Identity Address Information (0x09) len 7
Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
@ MGMT Event: New Identity Resolving Key (0x0018) plen 30
Random address: 00:00:00:00:00:00 (Non-Resolvable)
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
@ MGMT Event: New Long Term Key (0x000a) plen 37
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
Key type: Authenticated key from P-256 (0x03)
After Fix:
> ACL Data RX: Handle 11 flags 0x02 dlen 12
BR/EDR SMP: Identity Address Information (0x09) len 7
Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
@ MGMT Event: New Identity Resolving Key (0x0018) plen 30
Random address: 00:00:00:00:00:00 (Non-Resolvable)
BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
@ MGMT Event: New Long Term Key (0x000a) plen 37
BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
Key type: Authenticated key from P-256 (0x03)
SMP over LE:
Before Fix:
@ MGMT Event: New Identity Resolving Key (0x0018) plen 30
Random address: 5F:5C:07:37:47:D5 (Resolvable)
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
@ MGMT Event: New Long Term Key (0x000a) plen 37
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
Key type: Authenticated key from P-256 (0x03)
@ MGMT Event: New Link Key (0x0009) plen 26
BR/EDR Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
Key type: Authenticated Combination key from P-256 (0x08)
After Fix:
@ MGMT Event: New Identity Resolving Key (0x0018) plen 30
Random address: 5E:03:1C:00:38:21 (Resolvable)
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
@ MGMT Event: New Long Term Key (0x000a) plen 37
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
Key type: Authenticated key from P-256 (0x03)
@ MGMT Event: New Link Key (0x0009) plen 26
Store hint: Yes (0x01)
LE Address: F8:7D:76:F2:12:F3 (OUI F8-7D-76)
Key type: Authenticated Combination key from P-256 (0x08)
Cc: stable@vger.kernel.org
Signed-off-by: Xiao Yao <xiaoyao@rock-chips.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/net/bluetooth/hci_core.h | 5 +++++
net/bluetooth/mgmt.c | 25 ++++++++++++++++++-------
net/bluetooth/smp.c | 7 +++++++
3 files changed, 30 insertions(+), 7 deletions(-)
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -189,6 +189,7 @@ struct blocked_key {
struct smp_csrk {
bdaddr_t bdaddr;
u8 bdaddr_type;
+ u8 link_type;
u8 type;
u8 val[16];
};
@@ -198,6 +199,7 @@ struct smp_ltk {
struct rcu_head rcu;
bdaddr_t bdaddr;
u8 bdaddr_type;
+ u8 link_type;
u8 authenticated;
u8 type;
u8 enc_size;
@@ -212,6 +214,7 @@ struct smp_irk {
bdaddr_t rpa;
bdaddr_t bdaddr;
u8 addr_type;
+ u8 link_type;
u8 val[16];
};
@@ -219,6 +222,8 @@ struct link_key {
struct list_head list;
struct rcu_head rcu;
bdaddr_t bdaddr;
+ u8 bdaddr_type;
+ u8 link_type;
u8 type;
u8 val[HCI_LINK_KEY_SIZE];
u8 pin_len;
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2897,7 +2897,8 @@ static int load_link_keys(struct sock *s
for (i = 0; i < key_count; i++) {
struct mgmt_link_key_info *key = &cp->keys[i];
- if (key->addr.type != BDADDR_BREDR || key->type > 0x08)
+ /* Considering SMP over BREDR/LE, there is no need to check addr_type */
+ if (key->type > 0x08)
return mgmt_cmd_status(sk, hdev->id,
MGMT_OP_LOAD_LINK_KEYS,
MGMT_STATUS_INVALID_PARAMS);
@@ -7130,6 +7131,7 @@ static int load_irks(struct sock *sk, st
for (i = 0; i < irk_count; i++) {
struct mgmt_irk_info *irk = &cp->irks[i];
+ u8 addr_type = le_addr_type(irk->addr.type);
if (hci_is_blocked_key(hdev,
HCI_BLOCKED_KEY_TYPE_IRK,
@@ -7139,8 +7141,12 @@ static int load_irks(struct sock *sk, st
continue;
}
+ /* When using SMP over BR/EDR, the addr type should be set to BREDR */
+ if (irk->addr.type == BDADDR_BREDR)
+ addr_type = BDADDR_BREDR;
+
hci_add_irk(hdev, &irk->addr.bdaddr,
- le_addr_type(irk->addr.type), irk->val,
+ addr_type, irk->val,
BDADDR_ANY);
}
@@ -7221,6 +7227,7 @@ static int load_long_term_keys(struct so
for (i = 0; i < key_count; i++) {
struct mgmt_ltk_info *key = &cp->keys[i];
u8 type, authenticated;
+ u8 addr_type = le_addr_type(key->addr.type);
if (hci_is_blocked_key(hdev,
HCI_BLOCKED_KEY_TYPE_LTK,
@@ -7255,8 +7262,12 @@ static int load_long_term_keys(struct so
continue;
}
+ /* When using SMP over BR/EDR, the addr type should be set to BREDR */
+ if (key->addr.type == BDADDR_BREDR)
+ addr_type = BDADDR_BREDR;
+
hci_add_ltk(hdev, &key->addr.bdaddr,
- le_addr_type(key->addr.type), type, authenticated,
+ addr_type, type, authenticated,
key->val, key->enc_size, key->ediv, key->rand);
}
@@ -9523,7 +9534,7 @@ void mgmt_new_link_key(struct hci_dev *h
ev.store_hint = persistent;
bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
- ev.key.addr.type = BDADDR_BREDR;
+ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
ev.key.type = key->type;
memcpy(ev.key.val, key->val, HCI_LINK_KEY_SIZE);
ev.key.pin_len = key->pin_len;
@@ -9574,7 +9585,7 @@ void mgmt_new_ltk(struct hci_dev *hdev,
ev.store_hint = persistent;
bacpy(&ev.key.addr.bdaddr, &key->bdaddr);
- ev.key.addr.type = link_to_bdaddr(LE_LINK, key->bdaddr_type);
+ ev.key.addr.type = link_to_bdaddr(key->link_type, key->bdaddr_type);
ev.key.type = mgmt_ltk_type(key);
ev.key.enc_size = key->enc_size;
ev.key.ediv = key->ediv;
@@ -9603,7 +9614,7 @@ void mgmt_new_irk(struct hci_dev *hdev,
bacpy(&ev.rpa, &irk->rpa);
bacpy(&ev.irk.addr.bdaddr, &irk->bdaddr);
- ev.irk.addr.type = link_to_bdaddr(LE_LINK, irk->addr_type);
+ ev.irk.addr.type = link_to_bdaddr(irk->link_type, irk->addr_type);
memcpy(ev.irk.val, irk->val, sizeof(irk->val));
mgmt_event(MGMT_EV_NEW_IRK, hdev, &ev, sizeof(ev), NULL);
@@ -9632,7 +9643,7 @@ void mgmt_new_csrk(struct hci_dev *hdev,
ev.store_hint = persistent;
bacpy(&ev.key.addr.bdaddr, &csrk->bdaddr);
- ev.key.addr.type = link_to_bdaddr(LE_LINK, csrk->bdaddr_type);
+ ev.key.addr.type = link_to_bdaddr(csrk->link_type, csrk->bdaddr_type);
ev.key.type = csrk->type;
memcpy(ev.key.val, csrk->val, sizeof(csrk->val));
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1060,6 +1060,7 @@ static void smp_notify_keys(struct l2cap
}
if (smp->remote_irk) {
+ smp->remote_irk->link_type = hcon->type;
mgmt_new_irk(hdev, smp->remote_irk, persistent);
/* Now that user space can be considered to know the
@@ -1079,24 +1080,28 @@ static void smp_notify_keys(struct l2cap
}
if (smp->csrk) {
+ smp->csrk->link_type = hcon->type;
smp->csrk->bdaddr_type = hcon->dst_type;
bacpy(&smp->csrk->bdaddr, &hcon->dst);
mgmt_new_csrk(hdev, smp->csrk, persistent);
}
if (smp->responder_csrk) {
+ smp->responder_csrk->link_type = hcon->type;
smp->responder_csrk->bdaddr_type = hcon->dst_type;
bacpy(&smp->responder_csrk->bdaddr, &hcon->dst);
mgmt_new_csrk(hdev, smp->responder_csrk, persistent);
}
if (smp->ltk) {
+ smp->ltk->link_type = hcon->type;
smp->ltk->bdaddr_type = hcon->dst_type;
bacpy(&smp->ltk->bdaddr, &hcon->dst);
mgmt_new_ltk(hdev, smp->ltk, persistent);
}
if (smp->responder_ltk) {
+ smp->responder_ltk->link_type = hcon->type;
smp->responder_ltk->bdaddr_type = hcon->dst_type;
bacpy(&smp->responder_ltk->bdaddr, &hcon->dst);
mgmt_new_ltk(hdev, smp->responder_ltk, persistent);
@@ -1116,6 +1121,8 @@ static void smp_notify_keys(struct l2cap
key = hci_add_link_key(hdev, smp->conn->hcon, &hcon->dst,
smp->link_key, type, 0, &persistent);
if (key) {
+ key->link_type = hcon->type;
+ key->bdaddr_type = hcon->dst_type;
mgmt_new_link_key(hdev, key, persistent);
/* Don't keep debug keys around if the relevant
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 113/156] Bluetooth: Add more enc key size check
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 112/156] Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 114/156] usb: typec: ucsi: fix gpio-based orientation detection Greg Kroah-Hartman
` (51 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Lu, Max Chou,
Luiz Augusto von Dentz
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Lu <alex_lu@realsil.com.cn>
commit 04a342cc49a8522e99c9b3346371c329d841dcd2 upstream.
When we are slave role and receives l2cap conn req when encryption has
started, we should check the enc key size to avoid KNOB attack or BLUFFS
attack.
>From SIG recommendation, implementations are advised to reject
service-level connections on an encrypted baseband link with key
strengths below 7 octets.
A simple and clear way to achieve this is to place the enc key size
check in hci_cc_read_enc_key_size()
The btmon log below shows the case that lacks enc key size check.
> HCI Event: Connect Request (0x04) plen 10
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Class: 0x480104
Major class: Computer (desktop, notebook, PDA, organizers)
Minor class: Desktop workstation
Capturing (Scanner, Microphone)
Telephony (Cordless telephony, Modem, Headset)
Link type: ACL (0x01)
< HCI Command: Accept Connection Request (0x01|0x0009) plen 7
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Role: Peripheral (0x01)
> HCI Event: Command Status (0x0f) plen 4
Accept Connection Request (0x01|0x0009) ncmd 2
Status: Success (0x00)
> HCI Event: Connect Complete (0x03) plen 11
Status: Success (0x00)
Handle: 1
Address: BB:22:33:44:55:99 (OUI BB-22-33)
Link type: ACL (0x01)
Encryption: Disabled (0x00)
...
> HCI Event: Encryption Change (0x08) plen 4
Status: Success (0x00)
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Encryption: Enabled with E0 (0x01)
< HCI Command: Read Encryption Key Size (0x05|0x0008) plen 2
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
> HCI Event: Command Complete (0x0e) plen 7
Read Encryption Key Size (0x05|0x0008) ncmd 2
Status: Success (0x00)
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Key size: 6
// We should check the enc key size
...
> ACL Data RX: Handle 1 flags 0x02 dlen 12
L2CAP: Connection Request (0x02) ident 3 len 4
PSM: 25 (0x0019)
Source CID: 64
< ACL Data TX: Handle 1 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 3 len 8
Destination CID: 64
Source CID: 64
Result: Connection pending (0x0001)
Status: Authorization pending (0x0002)
> HCI Event: Number of Completed Packets (0x13) plen 5
Num handles: 1
Handle: 1 Address: BB:22:33:44:55:99 (OUI BB-22-33)
Count: 1
#35: len 16 (25 Kb/s)
Latency: 5 msec (2-7 msec ~4 msec)
< ACL Data TX: Handle 1 flags 0x00 dlen 16
L2CAP: Connection Response (0x03) ident 3 len 8
Destination CID: 64
Source CID: 64
Result: Connection successful (0x0000)
Status: No further information available (0x0000)
Cc: stable@vger.kernel.org
Signed-off-by: Alex Lu <alex_lu@realsil.com.cn>
Signed-off-by: Max Chou <max.chou@realtek.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_event.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -750,9 +750,23 @@ static u8 hci_cc_read_enc_key_size(struc
} else {
conn->enc_key_size = rp->key_size;
status = 0;
+
+ if (conn->enc_key_size < hdev->min_enc_key_size) {
+ /* As slave role, the conn->state has been set to
+ * BT_CONNECTED and l2cap conn req might not be received
+ * yet, at this moment the l2cap layer almost does
+ * nothing with the non-zero status.
+ * So we also clear encrypt related bits, and then the
+ * handler of l2cap conn req will get the right secure
+ * state at a later time.
+ */
+ status = HCI_ERROR_AUTH_FAILURE;
+ clear_bit(HCI_CONN_ENCRYPT, &conn->flags);
+ clear_bit(HCI_CONN_AES_CCM, &conn->flags);
+ }
}
- hci_encrypt_cfm(conn, 0);
+ hci_encrypt_cfm(conn, status);
done:
hci_dev_unlock(hdev);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 114/156] usb: typec: ucsi: fix gpio-based orientation detection
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 113/156] Bluetooth: Add more enc key size check Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 115/156] usb: fotg210-hcd: delete an incorrect bounds test Greg Kroah-Hartman
` (50 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Neil Armstrong, Johan Hovold,
Dmitry Baryshkov, Heikki Krogerus
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan+linaro@kernel.org>
commit c994cb596bf7ef5928f06331c76f46e071b16f09 upstream.
Fix the recently added connector sanity check which was off by one and
prevented orientation notifications from being handled correctly for the
second port when using GPIOs to determine orientation.
Fixes: c6165ed2f425 ("usb: ucsi: glink: use the connector orientation GPIO to provide switch events")
Cc: stable <stable@kernel.org>
Cc: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231208123603.29957-1-johan+linaro@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/ucsi/ucsi_glink.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/typec/ucsi/ucsi_glink.c
+++ b/drivers/usb/typec/ucsi/ucsi_glink.c
@@ -228,7 +228,7 @@ static void pmic_glink_ucsi_notify(struc
con_num = UCSI_CCI_CONNECTOR(cci);
if (con_num) {
- if (con_num < PMIC_GLINK_MAX_PORTS &&
+ if (con_num <= PMIC_GLINK_MAX_PORTS &&
ucsi->port_orientation[con_num - 1]) {
int orientation = gpiod_get_value(ucsi->port_orientation[con_num - 1]);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 115/156] usb: fotg210-hcd: delete an incorrect bounds test
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 114/156] usb: typec: ucsi: fix gpio-based orientation detection Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 116/156] net: usb: ax88179_178a: avoid failed operations when device is disconnected Greg Kroah-Hartman
` (49 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Dan Carpenter, Linus Walleij,
Lee Jones
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
commit 7fbcd195e2b8cc952e4aeaeb50867b798040314c upstream.
Here "temp" is the number of characters that we have written and "size"
is the size of the buffer. The intent was clearly to say that if we have
written to the end of the buffer then stop.
However, for that to work the comparison should have been done on the
original "size" value instead of the "size -= temp" value. Not only
will that not trigger when we want to, but there is a small chance that
it will trigger incorrectly before we want it to and we break from the
loop slightly earlier than intended.
This code was recently changed from using snprintf() to scnprintf(). With
snprintf() we likely would have continued looping and passed a negative
size parameter to snprintf(). This would have triggered an annoying
WARN(). Now that we have converted to scnprintf() "size" will never
drop below 1 and there is no real need for this test. We could change
the condition to "if (temp <= 1) goto done;" but just deleting the test
is cleanest.
Fixes: 7d50195f6c50 ("usb: host: Faraday fotg210-hcd driver")
Cc: stable <stable@kernel.org>
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
Reviewed-by: Lee Jones <lee@kernel.org>
Link: https://lore.kernel.org/r/ZXmwIwHe35wGfgzu@suswa
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/fotg210/fotg210-hcd.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/usb/fotg210/fotg210-hcd.c
+++ b/drivers/usb/fotg210/fotg210-hcd.c
@@ -428,8 +428,6 @@ static void qh_lines(struct fotg210_hcd
temp = size;
size -= temp;
next += temp;
- if (temp == size)
- goto done;
}
temp = snprintf(next, size, "\n");
@@ -439,7 +437,6 @@ static void qh_lines(struct fotg210_hcd
size -= temp;
next += temp;
-done:
*sizep = size;
*nextp = next;
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 116/156] net: usb: ax88179_178a: avoid failed operations when device is disconnected
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 115/156] usb: fotg210-hcd: delete an incorrect bounds test Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 117/156] Input: soc_button_array - add mapping for airplane mode button Greg Kroah-Hartman
` (48 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jose Ignacio Tornos Martinez,
Alan Stern
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
commit aef05e349bfd81c95adb4489639413fadbb74a83 upstream.
When the device is disconnected we get the following messages showing
failed operations:
Nov 28 20:22:11 localhost kernel: usb 2-3: USB disconnect, device number 2
Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: unregister 'ax88179_178a' usb-0000:02:00.0-3, ASIX AX88179 USB 3.0 Gigabit Ethernet
Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: Failed to read reg index 0x0002: -19
Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3: Failed to write reg index 0x0002: -19
Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0002: -19
Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0001: -19
Nov 28 20:22:11 localhost kernel: ax88179_178a 2-3:1.0 enp2s0u3 (unregistered): Failed to write reg index 0x0002: -19
The reason is that although the device is detached, normal stop and
unbind operations are commanded from the driver. These operations are
not necessary in this situation, so avoid these logs when the device is
detached if the result of the operation is -ENODEV and if the new flag
informing about the disconnecting status is enabled.
cc: <stable@vger.kernel.org>
Fixes: e2ca90c276e1f ("ax88179_178a: ASIX AX88179_178A USB 3.0/2.0 to gigabit ethernet adapter driver")
Signed-off-by: Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20231207175007.263907-1-jtornosm@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/ax88179_178a.c | 23 ++++++++++++++++++++---
1 file changed, 20 insertions(+), 3 deletions(-)
diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 4ea0e155bb0d..5a1bf42ce156 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c
@@ -173,6 +173,7 @@ struct ax88179_data {
u8 in_pm;
u32 wol_supported;
u32 wolopts;
+ u8 disconnecting;
};
struct ax88179_int_data {
@@ -208,6 +209,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
{
int ret;
int (*fn)(struct usbnet *, u8, u8, u16, u16, void *, u16);
+ struct ax88179_data *ax179_data = dev->driver_priv;
BUG_ON(!dev);
@@ -219,7 +221,7 @@ static int __ax88179_read_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
ret = fn(dev, cmd, USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
value, index, data, size);
- if (unlikely(ret < 0))
+ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting)))
netdev_warn(dev->net, "Failed to read reg index 0x%04x: %d\n",
index, ret);
@@ -231,6 +233,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
{
int ret;
int (*fn)(struct usbnet *, u8, u8, u16, u16, const void *, u16);
+ struct ax88179_data *ax179_data = dev->driver_priv;
BUG_ON(!dev);
@@ -242,7 +245,7 @@ static int __ax88179_write_cmd(struct usbnet *dev, u8 cmd, u16 value, u16 index,
ret = fn(dev, cmd, USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
value, index, data, size);
- if (unlikely(ret < 0))
+ if (unlikely((ret < 0) && !(ret == -ENODEV && ax179_data->disconnecting)))
netdev_warn(dev->net, "Failed to write reg index 0x%04x: %d\n",
index, ret);
@@ -492,6 +495,20 @@ static int ax88179_resume(struct usb_interface *intf)
return usbnet_resume(intf);
}
+static void ax88179_disconnect(struct usb_interface *intf)
+{
+ struct usbnet *dev = usb_get_intfdata(intf);
+ struct ax88179_data *ax179_data;
+
+ if (!dev)
+ return;
+
+ ax179_data = dev->driver_priv;
+ ax179_data->disconnecting = 1;
+
+ usbnet_disconnect(intf);
+}
+
static void
ax88179_get_wol(struct net_device *net, struct ethtool_wolinfo *wolinfo)
{
@@ -1906,7 +1923,7 @@ static struct usb_driver ax88179_178a_driver = {
.suspend = ax88179_suspend,
.resume = ax88179_resume,
.reset_resume = ax88179_resume,
- .disconnect = usbnet_disconnect,
+ .disconnect = ax88179_disconnect,
.supports_autosuspend = 1,
.disable_hub_initiated_lpm = 1,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 117/156] Input: soc_button_array - add mapping for airplane mode button
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 116/156] net: usb: ax88179_178a: avoid failed operations when device is disconnected Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 118/156] net: 9p: avoid freeing uninit memory in p9pdu_vreadf Greg Kroah-Hartman
` (47 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoffer Sandberg, Werner Sembach,
Dmitry Torokhov
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoffer Sandberg <cs@tuxedo.de>
commit ea3715941a9b7d816a1e9096ac0577900af2a69e upstream.
This add a mapping for the airplane mode button on the TUXEDO Pulse Gen3.
While it is physically a key it behaves more like a switch, sending a key
down on first press and a key up on 2nd press. Therefor the switch event
is used here. Besides this behaviour it uses the HID usage-id 0xc6
(Wireless Radio Button) and not 0xc8 (Wireless Radio Slider Switch), but
since neither 0xc6 nor 0xc8 are currently implemented at all in
soc_button_array this not to standard behaviour is not put behind a quirk
for the moment.
Signed-off-by: Christoffer Sandberg <cs@tuxedo.de>
Signed-off-by: Werner Sembach <wse@tuxedocomputers.com>
Link: https://lore.kernel.org/r/20231215171718.80229-1-wse@tuxedocomputers.com
Cc: stable@vger.kernel.org
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/misc/soc_button_array.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/input/misc/soc_button_array.c
+++ b/drivers/input/misc/soc_button_array.c
@@ -299,6 +299,11 @@ static int soc_button_parse_btn_desc(str
info->name = "power";
info->event_code = KEY_POWER;
info->wakeup = true;
+ } else if (upage == 0x01 && usage == 0xc6) {
+ info->name = "airplane mode switch";
+ info->event_type = EV_SW;
+ info->event_code = SW_RFKILL_ALL;
+ info->active_low = false;
} else if (upage == 0x01 && usage == 0xca) {
info->name = "rotation lock switch";
info->event_type = EV_SW;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 118/156] net: 9p: avoid freeing uninit memory in p9pdu_vreadf
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 117/156] Input: soc_button_array - add mapping for airplane mode button Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 119/156] net: rfkill: gpio: set GPIO direction Greg Kroah-Hartman
` (46 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Simon Horman,
Christian Schoenebeck, Dominique Martinet
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
commit ff49bf1867578f23a5ffdd38f927f6e1e16796c4 upstream.
If some of p9pdu_readf() calls inside case 'T' in p9pdu_vreadf() fails,
the error path is not handled properly. *wnames or members of *wnames
array may be left uninitialized and invalidly freed.
Initialize *wnames to NULL in beginning of case 'T'. Initialize the first
*wnames array element to NULL and nullify the failing *wnames element so
that the error path freeing loop stops on the first NULL element and
doesn't proceed further.
Found by Linux Verification Center (linuxtesting.org).
Fixes: ace51c4dd2f9 ("9p: add new protocol support code")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Message-ID: <20231206200913.16135-1-pchelkin@ispras.ru>
Cc: stable@vger.kernel.org
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/9p/protocol.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -394,6 +394,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
uint16_t *nwname = va_arg(ap, uint16_t *);
char ***wnames = va_arg(ap, char ***);
+ *wnames = NULL;
+
errcode = p9pdu_readf(pdu, proto_version,
"w", nwname);
if (!errcode) {
@@ -403,6 +405,8 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
GFP_NOFS);
if (!*wnames)
errcode = -ENOMEM;
+ else
+ (*wnames)[0] = NULL;
}
if (!errcode) {
@@ -414,8 +418,10 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
proto_version,
"s",
&(*wnames)[i]);
- if (errcode)
+ if (errcode) {
+ (*wnames)[i] = NULL;
break;
+ }
}
}
@@ -423,11 +429,14 @@ p9pdu_vreadf(struct p9_fcall *pdu, int p
if (*wnames) {
int i;
- for (i = 0; i < *nwname; i++)
+ for (i = 0; i < *nwname; i++) {
+ if (!(*wnames)[i])
+ break;
kfree((*wnames)[i]);
+ }
+ kfree(*wnames);
+ *wnames = NULL;
}
- kfree(*wnames);
- *wnames = NULL;
}
}
break;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 119/156] net: rfkill: gpio: set GPIO direction
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 118/156] net: 9p: avoid freeing uninit memory in p9pdu_vreadf Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 120/156] net: ks8851: Fix TX stall caused by TX buffer overrun Greg Kroah-Hartman
` (45 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rouven Czerwinski, Johannes Berg
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rouven Czerwinski <r.czerwinski@pengutronix.de>
commit 23484d817082c3005252d8edfc8292c8a1006b5b upstream.
Fix the undefined usage of the GPIO consumer API after retrieving the
GPIO description with GPIO_ASIS. The API documentation mentions that
GPIO_ASIS won't set a GPIO direction and requires the user to set a
direction before using the GPIO.
This can be confirmed on i.MX6 hardware, where rfkill-gpio is no longer
able to enabled/disable a device, presumably because the GPIO controller
was never configured for the output direction.
Fixes: b2f750c3a80b ("net: rfkill: gpio: prevent value glitch during probe")
Cc: stable@vger.kernel.org
Signed-off-by: Rouven Czerwinski <r.czerwinski@pengutronix.de>
Link: https://msgid.link/20231207075835.3091694-1-r.czerwinski@pengutronix.de
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rfkill/rfkill-gpio.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/net/rfkill/rfkill-gpio.c
+++ b/net/rfkill/rfkill-gpio.c
@@ -126,6 +126,14 @@ static int rfkill_gpio_probe(struct plat
return -EINVAL;
}
+ ret = gpiod_direction_output(rfkill->reset_gpio, true);
+ if (ret)
+ return ret;
+
+ ret = gpiod_direction_output(rfkill->shutdown_gpio, true);
+ if (ret)
+ return ret;
+
rfkill->rfkill_dev = rfkill_alloc(rfkill->name, &pdev->dev,
rfkill->type, &rfkill_gpio_ops,
rfkill);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 120/156] net: ks8851: Fix TX stall caused by TX buffer overrun
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 119/156] net: rfkill: gpio: set GPIO direction Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 121/156] net: avoid build bug in skb extension length calculation Greg Kroah-Hartman
` (44 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Ben Dooks, Tristram Ha, netdev,
Ronald Wahl, Simon Horman
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Wahl <ronald.wahl@raritan.com>
commit 3dc5d44545453de1de9c53cc529cc960a85933da upstream.
There is a bug in the ks8851 Ethernet driver that more data is written
to the hardware TX buffer than actually available. This is caused by
wrong accounting of the free TX buffer space.
The driver maintains a tx_space variable that represents the TX buffer
space that is deemed to be free. The ks8851_start_xmit_spi() function
adds an SKB to a queue if tx_space is large enough and reduces tx_space
by the amount of buffer space it will later need in the TX buffer and
then schedules a work item. If there is not enough space then the TX
queue is stopped.
The worker function ks8851_tx_work() dequeues all the SKBs and writes
the data into the hardware TX buffer. The last packet will trigger an
interrupt after it was send. Here it is assumed that all data fits into
the TX buffer.
In the interrupt routine (which runs asynchronously because it is a
threaded interrupt) tx_space is updated with the current value from the
hardware. Also the TX queue is woken up again.
Now it could happen that after data was sent to the hardware and before
handling the TX interrupt new data is queued in ks8851_start_xmit_spi()
when the TX buffer space had still some space left. When the interrupt
is actually handled tx_space is updated from the hardware but now we
already have new SKBs queued that have not been written to the hardware
TX buffer yet. Since tx_space has been overwritten by the value from the
hardware the space is not accounted for.
Now we have more data queued then buffer space available in the hardware
and ks8851_tx_work() will potentially overrun the hardware TX buffer. In
many cases it will still work because often the buffer is written out
fast enough so that no overrun occurs but for example if the peer
throttles us via flow control then an overrun may happen.
This can be fixed in different ways. The most simple way would be to set
tx_space to 0 before writing data to the hardware TX buffer preventing
the queuing of more SKBs until the TX interrupt has been handled. I have
chosen a slightly more efficient (and still rather simple) way and
track the amount of data that is already queued and not yet written to
the hardware. When new SKBs are to be queued the already queued amount
of data is honoured when checking free TX buffer space.
I tested this with a setup of two linked KS8851 running iperf3 between
the two in bidirectional mode. Before the fix I got a stall after some
minutes. With the fix I saw now issues anymore after hours.
Fixes: 3ba81f3ece3c ("net: Micrel KS8851 SPI network driver")
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Ben Dooks <ben.dooks@codethink.co.uk>
Cc: Tristram Ha <Tristram.Ha@microchip.com>
Cc: netdev@vger.kernel.org
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: Ronald Wahl <ronald.wahl@raritan.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20231214181112.76052-1-rwahl@gmx.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/micrel/ks8851.h | 3 ++
drivers/net/ethernet/micrel/ks8851_common.c | 20 ++++++-------
drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++++++++++++++++++----------
3 files changed, 40 insertions(+), 25 deletions(-)
--- a/drivers/net/ethernet/micrel/ks8851.h
+++ b/drivers/net/ethernet/micrel/ks8851.h
@@ -350,6 +350,8 @@ union ks8851_tx_hdr {
* @rxd: Space for receiving SPI data, in DMA-able space.
* @txd: Space for transmitting SPI data, in DMA-able space.
* @msg_enable: The message flags controlling driver output (see ethtool).
+ * @tx_space: Free space in the hardware TX buffer (cached copy of KS_TXMIR).
+ * @queued_len: Space required in hardware TX buffer for queued packets in txq.
* @fid: Incrementing frame id tag.
* @rc_ier: Cached copy of KS_IER.
* @rc_ccr: Cached copy of KS_CCR.
@@ -399,6 +401,7 @@ struct ks8851_net {
struct work_struct rxctrl_work;
struct sk_buff_head txq;
+ unsigned int queued_len;
struct eeprom_93cx6 eeprom;
struct regulator *vdd_reg;
--- a/drivers/net/ethernet/micrel/ks8851_common.c
+++ b/drivers/net/ethernet/micrel/ks8851_common.c
@@ -362,16 +362,18 @@ static irqreturn_t ks8851_irq(int irq, v
handled |= IRQ_RXPSI;
if (status & IRQ_TXI) {
- handled |= IRQ_TXI;
+ unsigned short tx_space = ks8851_rdreg16(ks, KS_TXMIR);
- /* no lock here, tx queue should have been stopped */
+ netif_dbg(ks, intr, ks->netdev,
+ "%s: txspace %d\n", __func__, tx_space);
- /* update our idea of how much tx space is available to the
- * system */
- ks->tx_space = ks8851_rdreg16(ks, KS_TXMIR);
+ spin_lock(&ks->statelock);
+ ks->tx_space = tx_space;
+ if (netif_queue_stopped(ks->netdev))
+ netif_wake_queue(ks->netdev);
+ spin_unlock(&ks->statelock);
- netif_dbg(ks, intr, ks->netdev,
- "%s: txspace %d\n", __func__, ks->tx_space);
+ handled |= IRQ_TXI;
}
if (status & IRQ_RXI)
@@ -414,9 +416,6 @@ static irqreturn_t ks8851_irq(int irq, v
if (status & IRQ_LCI)
mii_check_link(&ks->mii);
- if (status & IRQ_TXI)
- netif_wake_queue(ks->netdev);
-
return IRQ_HANDLED;
}
@@ -500,6 +499,7 @@ static int ks8851_net_open(struct net_de
ks8851_wrreg16(ks, KS_ISR, ks->rc_ier);
ks8851_wrreg16(ks, KS_IER, ks->rc_ier);
+ ks->queued_len = 0;
netif_start_queue(ks->netdev);
netif_dbg(ks, ifup, ks->netdev, "network device up\n");
--- a/drivers/net/ethernet/micrel/ks8851_spi.c
+++ b/drivers/net/ethernet/micrel/ks8851_spi.c
@@ -287,6 +287,18 @@ static void ks8851_wrfifo_spi(struct ks8
}
/**
+ * calc_txlen - calculate size of message to send packet
+ * @len: Length of data
+ *
+ * Returns the size of the TXFIFO message needed to send
+ * this packet.
+ */
+static unsigned int calc_txlen(unsigned int len)
+{
+ return ALIGN(len + 4, 4);
+}
+
+/**
* ks8851_rx_skb_spi - receive skbuff
* @ks: The device state
* @skb: The skbuff
@@ -305,7 +317,9 @@ static void ks8851_rx_skb_spi(struct ks8
*/
static void ks8851_tx_work(struct work_struct *work)
{
+ unsigned int dequeued_len = 0;
struct ks8851_net_spi *kss;
+ unsigned short tx_space;
struct ks8851_net *ks;
unsigned long flags;
struct sk_buff *txb;
@@ -322,6 +336,8 @@ static void ks8851_tx_work(struct work_s
last = skb_queue_empty(&ks->txq);
if (txb) {
+ dequeued_len += calc_txlen(txb->len);
+
ks8851_wrreg16_spi(ks, KS_RXQCR,
ks->rc_rxqcr | RXQCR_SDA);
ks8851_wrfifo_spi(ks, txb, last);
@@ -332,6 +348,13 @@ static void ks8851_tx_work(struct work_s
}
}
+ tx_space = ks8851_rdreg16_spi(ks, KS_TXMIR);
+
+ spin_lock(&ks->statelock);
+ ks->queued_len -= dequeued_len;
+ ks->tx_space = tx_space;
+ spin_unlock(&ks->statelock);
+
ks8851_unlock_spi(ks, &flags);
}
@@ -347,18 +370,6 @@ static void ks8851_flush_tx_work_spi(str
}
/**
- * calc_txlen - calculate size of message to send packet
- * @len: Length of data
- *
- * Returns the size of the TXFIFO message needed to send
- * this packet.
- */
-static unsigned int calc_txlen(unsigned int len)
-{
- return ALIGN(len + 4, 4);
-}
-
-/**
* ks8851_start_xmit_spi - transmit packet using SPI
* @skb: The buffer to transmit
* @dev: The device used to transmit the packet.
@@ -386,16 +397,17 @@ static netdev_tx_t ks8851_start_xmit_spi
spin_lock(&ks->statelock);
- if (needed > ks->tx_space) {
+ if (ks->queued_len + needed > ks->tx_space) {
netif_stop_queue(dev);
ret = NETDEV_TX_BUSY;
} else {
- ks->tx_space -= needed;
+ ks->queued_len += needed;
skb_queue_tail(&ks->txq, skb);
}
spin_unlock(&ks->statelock);
- schedule_work(&kss->tx_work);
+ if (ret == NETDEV_TX_OK)
+ schedule_work(&kss->tx_work);
return ret;
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 121/156] net: avoid build bug in skb extension length calculation
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 120/156] net: ks8851: Fix TX stall caused by TX buffer overrun Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 122/156] net: stmmac: fix incorrect flag check in timestamp interrupt Greg Kroah-Hartman
` (43 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Arnd Bergmann,
Thomas Weißschuh, Paolo Abeni
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Weißschuh <linux@weissschuh.net>
commit d6e5794b06c0fab74fe6e4fa55d508a5ceb14735 upstream.
GCC seems to incorrectly fail to evaluate skb_ext_total_length() at
compile time under certain conditions.
The issue even occurs if all values in skb_ext_type_len[] are "0",
ruling out the possibility of an actual overflow.
As the patch has been in mainline since v6.6 without triggering the
problem it seems to be a very uncommon occurrence.
As the issue only occurs when -fno-tree-loop-im is specified as part of
CFLAGS_GCOV, disable the BUILD_BUG_ON() only when building with coverage
reporting enabled.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202312171924.4FozI5FG-lkp@intel.com/
Suggested-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/lkml/487cfd35-fe68-416f-9bfd-6bb417f98304@app.fastmail.com/
Fixes: 5d21d0a65b57 ("net: generalize calculation of skb extensions length")
Cc: <stable@vger.kernel.org>
Signed-off-by: Thomas Weißschuh <linux@weissschuh.net>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20231218-net-skbuff-build-bug-v1-1-eefc2fb0a7d3@weissschuh.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4810,7 +4810,9 @@ static __always_inline unsigned int skb_
static void skb_extensions_init(void)
{
BUILD_BUG_ON(SKB_EXT_NUM >= 8);
+#if !IS_ENABLED(CONFIG_KCOV_INSTRUMENT_ALL)
BUILD_BUG_ON(skb_ext_total_length() > 255);
+#endif
skbuff_ext_cache = kmem_cache_create("skbuff_ext_cache",
SKB_EXT_ALIGN_VALUE * skb_ext_total_length(),
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 122/156] net: stmmac: fix incorrect flag check in timestamp interrupt
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 121/156] net: avoid build bug in skb extension length calculation Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 123/156] dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Greg Kroah-Hartman
` (42 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Song Yoong Siang, Lai Peter Jun Ann,
Jacob Keller, Serge Semin, David S. Miller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lai Peter Jun Ann <jun.ann.lai@intel.com>
commit bd7f77dae69532ffc027ee50ff99e3792dc30b7f upstream.
The driver should continue get the timestamp if STMMAC_FLAG_EXT_SNAPSHOT_EN
flag is set.
Fixes: aa5513f5d95f ("net: stmmac: replace the ext_snapshot_en field with a flag")
Cc: <stable@vger.kernel.org> # 6.6
Signed-off-by: Song Yoong Siang <yoong.siang.song@intel.com>
Signed-off-by: Lai Peter Jun Ann <jun.ann.lai@intel.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Reviewed-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
index 540f6a4ec0b8..f05bd757dfe5 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c
@@ -237,7 +237,7 @@ static void timestamp_interrupt(struct stmmac_priv *priv)
*/
ts_status = readl(priv->ioaddr + GMAC_TIMESTAMP_STATUS);
- if (priv->plat->flags & STMMAC_FLAG_EXT_SNAPSHOT_EN)
+ if (!(priv->plat->flags & STMMAC_FLAG_EXT_SNAPSHOT_EN))
return;
num_snapshot = (ts_status & GMAC_TIMESTAMP_ATSNS_MASK) >>
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 123/156] dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 122/156] net: stmmac: fix incorrect flag check in timestamp interrupt Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 124/156] nfsd: call nfsd_last_thread() before final nfsd_put() Greg Kroah-Hartman
` (41 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stable, Fabio Estevam, Conor Dooley,
Srinivas Kandagatla
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fabio Estevam <festevam@denx.de>
commit a2a8aefecbd0f87d6127951cef33b3def8439057 upstream.
Both imx23.dtsi and imx28.dtsi describe the OCOTP nodes in
the format:
compatible = "fsl,imx28-ocotp", "fsl,ocotp";
Document the "fsl,ocotp" entry to fix the following schema
warning:
efuse@8002c000: compatible: ['fsl,imx23-ocotp', 'fsl,ocotp'] is too long
from schema $id: http://devicetree.org/schemas/nvmem/mxs-ocotp.yaml#
Fixes: 2c504460f502 ("dt-bindings: nvmem: Convert MXS OCOTP to json-schema")
Cc: <Stable@vger.kernel.org>
Signed-off-by: Fabio Estevam <festevam@denx.de>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20231215111358.316727-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml
+++ b/Documentation/devicetree/bindings/nvmem/mxs-ocotp.yaml
@@ -14,9 +14,11 @@ allOf:
properties:
compatible:
- enum:
- - fsl,imx23-ocotp
- - fsl,imx28-ocotp
+ items:
+ - enum:
+ - fsl,imx23-ocotp
+ - fsl,imx28-ocotp
+ - const: fsl,ocotp
reg:
maxItems: 1
@@ -34,7 +36,7 @@ unevaluatedProperties: false
examples:
- |
ocotp: efuse@8002c000 {
- compatible = "fsl,imx28-ocotp";
+ compatible = "fsl,imx28-ocotp", "fsl,ocotp";
#address-cells = <1>;
#size-cells = <1>;
reg = <0x8002c000 0x2000>;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 124/156] nfsd: call nfsd_last_thread() before final nfsd_put()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 123/156] dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 125/156] smb: client: fix OOB in cifsd when receiving compounded resps Greg Kroah-Hartman
` (40 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, NeilBrown, Jeff Layton, Chuck Lever
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <neilb@suse.de>
commit 2a501f55cd641eb4d3c16a2eab0d678693fac663 upstream.
If write_ports_addfd or write_ports_addxprt fail, they call nfsd_put()
without calling nfsd_last_thread(). This leaves nn->nfsd_serv pointing
to a structure that has been freed.
So remove 'static' from nfsd_last_thread() and call it when the
nfsd_serv is about to be destroyed.
Fixes: ec52361df99b ("SUNRPC: stop using ->sv_nrthreads as a refcount")
Signed-off-by: NeilBrown <neilb@suse.de>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfsctl.c | 9 +++++++--
fs/nfsd/nfsd.h | 1 +
fs/nfsd/nfssvc.c | 2 +-
3 files changed, 9 insertions(+), 3 deletions(-)
--- a/fs/nfsd/nfsctl.c
+++ b/fs/nfsd/nfsctl.c
@@ -704,8 +704,10 @@ static ssize_t __write_ports_addfd(char
err = svc_addsock(nn->nfsd_serv, net, fd, buf, SIMPLE_TRANSACTION_LIMIT, cred);
- if (err >= 0 &&
- !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
+ if (err < 0 && !nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
+ nfsd_last_thread(net);
+ else if (err >= 0 &&
+ !nn->nfsd_serv->sv_nrthreads && !xchg(&nn->keep_active, 1))
svc_get(nn->nfsd_serv);
nfsd_put(net);
@@ -756,6 +758,9 @@ out_close:
svc_xprt_put(xprt);
}
out_err:
+ if (!nn->nfsd_serv->sv_nrthreads && !nn->keep_active)
+ nfsd_last_thread(net);
+
nfsd_put(net);
return err;
}
--- a/fs/nfsd/nfsd.h
+++ b/fs/nfsd/nfsd.h
@@ -138,6 +138,7 @@ int nfsd_vers(struct nfsd_net *nn, int v
int nfsd_minorversion(struct nfsd_net *nn, u32 minorversion, enum vers_op change);
void nfsd_reset_versions(struct nfsd_net *nn);
int nfsd_create_serv(struct net *net);
+void nfsd_last_thread(struct net *net);
extern int nfsd_max_blksize;
--- a/fs/nfsd/nfssvc.c
+++ b/fs/nfsd/nfssvc.c
@@ -542,7 +542,7 @@ static struct notifier_block nfsd_inet6a
/* Only used under nfsd_mutex, so this atomic may be overkill: */
static atomic_t nfsd_notifier_refcount = ATOMIC_INIT(0);
-static void nfsd_last_thread(struct net *net)
+void nfsd_last_thread(struct net *net)
{
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
struct svc_serv *serv = nn->nfsd_serv;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 125/156] smb: client: fix OOB in cifsd when receiving compounded resps
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 124/156] nfsd: call nfsd_last_thread() before final nfsd_put() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 126/156] smb: client: fix potential OOB in cifs_dump_detail() Greg Kroah-Hartman
` (39 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris,
Paulo Alcantara (SUSE), Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
commit a8f68b11158f09754418de62e6b3e7b9b7a50cc9 upstream.
Validate next header's offset in ->next_header() so that it isn't
smaller than MID_HEADER_SIZE(server) and then standard_receive3() or
->receive() ends up writing off the end of the buffer because
'pdu_length - MID_HEADER_SIZE(server)' wraps up to a huge length:
BUG: KASAN: slab-out-of-bounds in _copy_to_iter+0x4fc/0x840
Write of size 701 at addr ffff88800caf407f by task cifsd/1090
CPU: 0 PID: 1090 Comm: cifsd Not tainted 6.7.0-rc4 #5
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x4a/0x80
print_report+0xcf/0x650
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? __phys_addr+0x46/0x90
kasan_report+0xd8/0x110
? _copy_to_iter+0x4fc/0x840
? _copy_to_iter+0x4fc/0x840
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x3c/0x60
_copy_to_iter+0x4fc/0x840
? srso_alias_return_thunk+0x5/0xfbef5
? hlock_class+0x32/0xc0
? srso_alias_return_thunk+0x5/0xfbef5
? __pfx__copy_to_iter+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? lock_is_held_type+0x90/0x100
? srso_alias_return_thunk+0x5/0xfbef5
? __might_resched+0x278/0x360
? __pfx___might_resched+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
__skb_datagram_iter+0x2c2/0x460
? __pfx_simple_copy_to_iter+0x10/0x10
skb_copy_datagram_iter+0x6c/0x110
tcp_recvmsg_locked+0x9be/0xf40
? __pfx_tcp_recvmsg_locked+0x10/0x10
? mark_held_locks+0x5d/0x90
? srso_alias_return_thunk+0x5/0xfbef5
tcp_recvmsg+0xe2/0x310
? __pfx_tcp_recvmsg+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? lock_acquire+0x14a/0x3a0
? srso_alias_return_thunk+0x5/0xfbef5
inet_recvmsg+0xd0/0x370
? __pfx_inet_recvmsg+0x10/0x10
? __pfx_lock_release+0x10/0x10
? do_raw_spin_trylock+0xd1/0x120
sock_recvmsg+0x10d/0x150
cifs_readv_from_socket+0x25a/0x490 [cifs]
? __pfx_cifs_readv_from_socket+0x10/0x10 [cifs]
? srso_alias_return_thunk+0x5/0xfbef5
cifs_read_from_socket+0xb5/0x100 [cifs]
? __pfx_cifs_read_from_socket+0x10/0x10 [cifs]
? __pfx_lock_release+0x10/0x10
? do_raw_spin_trylock+0xd1/0x120
? _raw_spin_unlock+0x23/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? __smb2_find_mid+0x126/0x230 [cifs]
cifs_demultiplex_thread+0xd39/0x1270 [cifs]
? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
? __pfx_lock_release+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? mark_held_locks+0x1a/0x90
? lockdep_hardirqs_on_prepare+0x136/0x210
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0xce/0xf0
? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
kthread+0x18d/0x1d0
? kthread+0xdb/0x1d0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x34/0x60
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASK>
Fixes: 8ce79ec359ad ("cifs: update multiplex loop to handle compounded responses")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifsglob.h | 3 ++-
fs/smb/client/connect.c | 7 ++++++-
fs/smb/client/smb2ops.c | 19 ++++++++++++-------
3 files changed, 20 insertions(+), 9 deletions(-)
--- a/fs/smb/client/cifsglob.h
+++ b/fs/smb/client/cifsglob.h
@@ -532,7 +532,8 @@ struct smb_version_operations {
struct mid_q_entry **, char **, int *);
enum securityEnum (*select_sectype)(struct TCP_Server_Info *,
enum securityEnum);
- int (*next_header)(char *);
+ int (*next_header)(struct TCP_Server_Info *server, char *buf,
+ unsigned int *noff);
/* ioctl passthrough for query_info */
int (*ioctl_query_info)(const unsigned int xid,
struct cifs_tcon *tcon,
--- a/fs/smb/client/connect.c
+++ b/fs/smb/client/connect.c
@@ -1180,7 +1180,12 @@ next_pdu:
server->total_read += length;
if (server->ops->next_header) {
- next_offset = server->ops->next_header(buf);
+ if (server->ops->next_header(server, buf, &next_offset)) {
+ cifs_dbg(VFS, "%s: malformed response (next_offset=%u)\n",
+ __func__, next_offset);
+ cifs_reconnect(server, true);
+ continue;
+ }
if (next_offset)
server->pdu_size = next_offset;
}
--- a/fs/smb/client/smb2ops.c
+++ b/fs/smb/client/smb2ops.c
@@ -5072,17 +5072,22 @@ smb3_handle_read_data(struct TCP_Server_
NULL, 0, false);
}
-static int
-smb2_next_header(char *buf)
+static int smb2_next_header(struct TCP_Server_Info *server, char *buf,
+ unsigned int *noff)
{
struct smb2_hdr *hdr = (struct smb2_hdr *)buf;
struct smb2_transform_hdr *t_hdr = (struct smb2_transform_hdr *)buf;
- if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM)
- return sizeof(struct smb2_transform_hdr) +
- le32_to_cpu(t_hdr->OriginalMessageSize);
-
- return le32_to_cpu(hdr->NextCommand);
+ if (hdr->ProtocolId == SMB2_TRANSFORM_PROTO_NUM) {
+ *noff = le32_to_cpu(t_hdr->OriginalMessageSize);
+ if (unlikely(check_add_overflow(*noff, sizeof(*t_hdr), noff)))
+ return -EINVAL;
+ } else {
+ *noff = le32_to_cpu(hdr->NextCommand);
+ }
+ if (unlikely(*noff && *noff < MID_HEADER_SIZE(server)))
+ return -EINVAL;
+ return 0;
}
static int
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 126/156] smb: client: fix potential OOB in cifs_dump_detail()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 125/156] smb: client: fix OOB in cifsd when receiving compounded resps Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 127/156] smb: client: fix OOB in SMB2_query_info_init() Greg Kroah-Hartman
` (38 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Paulo Alcantara (SUSE), Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
commit b50492b05fd02887b46aef079592207fb5c97a4c upstream.
Validate SMB message with ->check_message() before calling
->calc_smb_size().
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/cifs_debug.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/fs/smb/client/cifs_debug.c
+++ b/fs/smb/client/cifs_debug.c
@@ -40,11 +40,13 @@ void cifs_dump_detail(void *buf, struct
#ifdef CONFIG_CIFS_DEBUG2
struct smb_hdr *smb = buf;
- cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Flgs2: 0x%x Mid: %d Pid: %d\n",
- smb->Command, smb->Status.CifsError,
- smb->Flags, smb->Flags2, smb->Mid, smb->Pid);
- cifs_dbg(VFS, "smb buf %p len %u\n", smb,
- server->ops->calc_smb_size(smb));
+ cifs_dbg(VFS, "Cmd: %d Err: 0x%x Flags: 0x%x Flgs2: 0x%x Mid: %d Pid: %d Wct: %d\n",
+ smb->Command, smb->Status.CifsError, smb->Flags,
+ smb->Flags2, smb->Mid, smb->Pid, smb->WordCount);
+ if (!server->ops->check_message(buf, server->total_read, server)) {
+ cifs_dbg(VFS, "smb buf %p len %u\n", smb,
+ server->ops->calc_smb_size(smb));
+ }
#endif /* CONFIG_CIFS_DEBUG2 */
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 127/156] smb: client: fix OOB in SMB2_query_info_init()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 126/156] smb: client: fix potential OOB in cifs_dump_detail() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 128/156] smb: client: fix OOB in smbCalcSize() Greg Kroah-Hartman
` (37 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Robert Morris, Paulo Alcantara,
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
commit 33eae65c6f49770fec7a662935d4eb4a6406d24b upstream.
A small CIFS buffer (448 bytes) isn't big enough to hold
SMB2_QUERY_INFO request along with user's input data from
CIFS_QUERY_INFO ioctl. That is, if the user passed an input buffer >
344 bytes, the client will memcpy() off the end of @req->Buffer in
SMB2_query_info_init() thus causing the following KASAN splat:
BUG: KASAN: slab-out-of-bounds in SMB2_query_info_init+0x242/0x250 [cifs]
Write of size 1023 at addr ffff88801308c5a8 by task a.out/1240
CPU: 1 PID: 1240 Comm: a.out Not tainted 6.7.0-rc4 #5
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x4a/0x80
print_report+0xcf/0x650
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? __phys_addr+0x46/0x90
kasan_report+0xd8/0x110
? SMB2_query_info_init+0x242/0x250 [cifs]
? SMB2_query_info_init+0x242/0x250 [cifs]
kasan_check_range+0x105/0x1b0
__asan_memcpy+0x3c/0x60
SMB2_query_info_init+0x242/0x250 [cifs]
? __pfx_SMB2_query_info_init+0x10/0x10 [cifs]
? srso_alias_return_thunk+0x5/0xfbef5
? smb_rqst_len+0xa6/0xc0 [cifs]
smb2_ioctl_query_info+0x4f4/0x9a0 [cifs]
? __pfx_smb2_ioctl_query_info+0x10/0x10 [cifs]
? __pfx_cifsConvertToUTF16+0x10/0x10 [cifs]
? kasan_set_track+0x25/0x30
? srso_alias_return_thunk+0x5/0xfbef5
? __kasan_kmalloc+0x8f/0xa0
? srso_alias_return_thunk+0x5/0xfbef5
? cifs_strndup_to_utf16+0x12d/0x1a0 [cifs]
? __build_path_from_dentry_optional_prefix+0x19d/0x2d0 [cifs]
? __pfx_smb2_ioctl_query_info+0x10/0x10 [cifs]
cifs_ioctl+0x11c7/0x1de0 [cifs]
? __pfx_cifs_ioctl+0x10/0x10 [cifs]
? srso_alias_return_thunk+0x5/0xfbef5
? rcu_is_watching+0x23/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? __rseq_handle_notify_resume+0x6cd/0x850
? __pfx___schedule+0x10/0x10
? blkcg_iostat_update+0x250/0x290
? srso_alias_return_thunk+0x5/0xfbef5
? ksys_write+0xe9/0x170
__x64_sys_ioctl+0xc9/0x100
do_syscall_64+0x47/0xf0
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7f893dde49cf
Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48
89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <89>
c2 3d 00 f0 ff ff 77 18 48 8b 44 24 18 64 48 2b 04 25 28 00 00
RSP: 002b:00007ffc03ff4160 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007ffc03ff4378 RCX: 00007f893dde49cf
RDX: 00007ffc03ff41d0 RSI: 00000000c018cf07 RDI: 0000000000000003
RBP: 00007ffc03ff4260 R08: 0000000000000410 R09: 0000000000000001
R10: 00007f893dce7300 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc03ff4388 R14: 00007f893df15000 R15: 0000000000406de0
</TASK>
Fix this by increasing size of SMB2_QUERY_INFO request buffers and
validating input length to prevent other callers from overflowing @req
in SMB2_query_info_init() as well.
Fixes: f5b05d622a3e ("cifs: add IOCTL for QUERY_INFO passthrough to userspace")
Cc: stable@vger.kernel.org
Reported-by: Robert Morris <rtm@csail.mit.edu>
Signed-off-by: Paulo Alcantara <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/smb2pdu.c | 29 ++++++++++++++++++++++-------
1 file changed, 22 insertions(+), 7 deletions(-)
--- a/fs/smb/client/smb2pdu.c
+++ b/fs/smb/client/smb2pdu.c
@@ -376,10 +376,15 @@ static int __smb2_plain_req_init(__le16
void **request_buf, unsigned int *total_len)
{
/* BB eventually switch this to SMB2 specific small buf size */
- if (smb2_command == SMB2_SET_INFO)
+ switch (smb2_command) {
+ case SMB2_SET_INFO:
+ case SMB2_QUERY_INFO:
*request_buf = cifs_buf_get();
- else
+ break;
+ default:
*request_buf = cifs_small_buf_get();
+ break;
+ }
if (*request_buf == NULL) {
/* BB should we add a retry in here if not a writepage? */
return -ENOMEM;
@@ -3494,8 +3499,13 @@ SMB2_query_info_init(struct cifs_tcon *t
struct smb2_query_info_req *req;
struct kvec *iov = rqst->rq_iov;
unsigned int total_len;
+ size_t len;
int rc;
+ if (unlikely(check_add_overflow(input_len, sizeof(*req), &len) ||
+ len > CIFSMaxBufSize))
+ return -EINVAL;
+
rc = smb2_plain_req_init(SMB2_QUERY_INFO, tcon, server,
(void **) &req, &total_len);
if (rc)
@@ -3517,7 +3527,7 @@ SMB2_query_info_init(struct cifs_tcon *t
iov[0].iov_base = (char *)req;
/* 1 for Buffer */
- iov[0].iov_len = total_len - 1 + input_len;
+ iov[0].iov_len = len;
return 0;
}
@@ -3525,7 +3535,7 @@ void
SMB2_query_info_free(struct smb_rqst *rqst)
{
if (rqst && rqst->rq_iov)
- cifs_small_buf_release(rqst->rq_iov[0].iov_base); /* request */
+ cifs_buf_release(rqst->rq_iov[0].iov_base); /* request */
}
static int
@@ -5392,6 +5402,11 @@ build_qfs_info_req(struct kvec *iov, str
return 0;
}
+static inline void free_qfs_info_req(struct kvec *iov)
+{
+ cifs_buf_release(iov->iov_base);
+}
+
int
SMB311_posix_qfs_info(const unsigned int xid, struct cifs_tcon *tcon,
u64 persistent_fid, u64 volatile_fid, struct kstatfs *fsdata)
@@ -5423,7 +5438,7 @@ SMB311_posix_qfs_info(const unsigned int
rc = cifs_send_recv(xid, ses, server,
&rqst, &resp_buftype, flags, &rsp_iov);
- cifs_small_buf_release(iov.iov_base);
+ free_qfs_info_req(&iov);
if (rc) {
cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
goto posix_qfsinf_exit;
@@ -5474,7 +5489,7 @@ SMB2_QFS_info(const unsigned int xid, st
rc = cifs_send_recv(xid, ses, server,
&rqst, &resp_buftype, flags, &rsp_iov);
- cifs_small_buf_release(iov.iov_base);
+ free_qfs_info_req(&iov);
if (rc) {
cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
goto qfsinf_exit;
@@ -5541,7 +5556,7 @@ SMB2_QFS_attr(const unsigned int xid, st
rc = cifs_send_recv(xid, ses, server,
&rqst, &resp_buftype, flags, &rsp_iov);
- cifs_small_buf_release(iov.iov_base);
+ free_qfs_info_req(&iov);
if (rc) {
cifs_stats_fail_inc(tcon, SMB2_QUERY_INFO_HE);
goto qfsattr_exit;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 128/156] smb: client: fix OOB in smbCalcSize()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 127/156] smb: client: fix OOB in SMB2_query_info_init() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 129/156] drm/i915: Reject async flips with bigjoiner Greg Kroah-Hartman
` (36 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, j51569436, Paulo Alcantara (SUSE),
Steve French
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paulo Alcantara <pc@manguebit.com>
commit b35858b3786ddbb56e1c35138ba25d6adf8d0bef upstream.
Validate @smb->WordCount to avoid reading off the end of @smb and thus
causing the following KASAN splat:
BUG: KASAN: slab-out-of-bounds in smbCalcSize+0x32/0x40 [cifs]
Read of size 2 at addr ffff88801c024ec5 by task cifsd/1328
CPU: 1 PID: 1328 Comm: cifsd Not tainted 6.7.0-rc5 #9
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS
rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x4a/0x80
print_report+0xcf/0x650
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? __phys_addr+0x46/0x90
kasan_report+0xd8/0x110
? smbCalcSize+0x32/0x40 [cifs]
? smbCalcSize+0x32/0x40 [cifs]
kasan_check_range+0x105/0x1b0
smbCalcSize+0x32/0x40 [cifs]
checkSMB+0x162/0x370 [cifs]
? __pfx_checkSMB+0x10/0x10 [cifs]
cifs_handle_standard+0xbc/0x2f0 [cifs]
? srso_alias_return_thunk+0x5/0xfbef5
cifs_demultiplex_thread+0xed1/0x1360 [cifs]
? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
? srso_alias_return_thunk+0x5/0xfbef5
? lockdep_hardirqs_on_prepare+0x136/0x210
? __pfx_lock_release+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? mark_held_locks+0x1a/0x90
? lockdep_hardirqs_on_prepare+0x136/0x210
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? __kthread_parkme+0xce/0xf0
? __pfx_cifs_demultiplex_thread+0x10/0x10 [cifs]
kthread+0x18d/0x1d0
? kthread+0xdb/0x1d0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x34/0x60
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASK>
This fixes CVE-2023-6606.
Reported-by: j51569436@gmail.com
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=218218
Cc: stable@vger.kernel.org
Signed-off-by: Paulo Alcantara (SUSE) <pc@manguebit.com>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/smb/client/misc.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/smb/client/misc.c
+++ b/fs/smb/client/misc.c
@@ -363,6 +363,10 @@ checkSMB(char *buf, unsigned int total_r
cifs_dbg(VFS, "Length less than smb header size\n");
}
return -EIO;
+ } else if (total_read < sizeof(*smb) + 2 * smb->WordCount) {
+ cifs_dbg(VFS, "%s: can't read BCC due to invalid WordCount(%u)\n",
+ __func__, smb->WordCount);
+ return -EIO;
}
/* otherwise, there is enough to get to the BCC */
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 129/156] drm/i915: Reject async flips with bigjoiner
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 128/156] smb: client: fix OOB in smbCalcSize() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 130/156] drm/i915/dmc: Dont enable any pipe DMC events Greg Kroah-Hartman
` (35 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä,
Stanislav Lisovskiy, Jani Nikula
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
commit 88a173e5dd05e788068e8fa20a8c37c44bd8f416 upstream.
Currently async flips are busted when bigjoiner is in use.
As a short term fix simply reject async flips in that case.
Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/9769
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231211081134.2698-1-ville.syrjala@linux.intel.com
Reviewed-by: Stanislav Lisovskiy <stanislav.lisovskiy@intel.com>
(cherry picked from commit e93bffc2ac0a833b42841f31fff955549d38ce98)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_display.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/gpu/drm/i915/display/intel_display.c
+++ b/drivers/gpu/drm/i915/display/intel_display.c
@@ -5977,6 +5977,17 @@ static int intel_async_flip_check_hw(str
return -EINVAL;
}
+ /*
+ * FIXME: Bigjoiner+async flip is busted currently.
+ * Remove this check once the issues are fixed.
+ */
+ if (new_crtc_state->bigjoiner_pipes) {
+ drm_dbg_kms(&i915->drm,
+ "[CRTC:%d:%s] async flip disallowed with bigjoiner\n",
+ crtc->base.base.id, crtc->base.name);
+ return -EINVAL;
+ }
+
for_each_oldnew_intel_plane_in_state(state, plane, old_plane_state,
new_plane_state, i) {
if (plane->pipe != crtc->pipe)
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 130/156] drm/i915/dmc: Dont enable any pipe DMC events
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 129/156] drm/i915: Reject async flips with bigjoiner Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 131/156] 9p: prevent read overrun in protocol dump tracepoint Greg Kroah-Hartman
` (34 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ville Syrjälä, Imre Deak,
Jani Nikula
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Syrjälä <ville.syrjala@linux.intel.com>
commit 49e0a85ec3441edc6c77aa40206d6e5ee4597efc upstream.
The pipe DMC seems to be making a mess of things in ADL. Various weird
symptoms have been observed such as missing vblank irqs, typicalle
happening when using multiple displays.
Keep all pipe DMC event handlers disabled until needed (which is never
atm). This is also what Windows does on ADL+.
We can also drop DG2 from disable_all_flip_queue_events() since
on DG2 the pipe DMC is the one that handles the flip queue events.
Cc: stable@vger.kernel.org
Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/8685
Signed-off-by: Ville Syrjälä <ville.syrjala@linux.intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231211213750.27109-2-ville.syrjala@linux.intel.com
Reviewed-by: Imre Deak <imre.deak@intel.com>
(cherry picked from commit 648d7be8ecf47b0556e32550145c70db153b16fb)
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/i915/display/intel_dmc.c | 43 +++++++++++++++++++++++++++++--
1 file changed, 41 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/i915/display/intel_dmc.c
+++ b/drivers/gpu/drm/i915/display/intel_dmc.c
@@ -389,7 +389,7 @@ disable_all_flip_queue_events(struct drm
enum intel_dmc_id dmc_id;
/* TODO: check if the following applies to all D13+ platforms. */
- if (!IS_DG2(i915) && !IS_TIGERLAKE(i915))
+ if (!IS_TIGERLAKE(i915))
return;
for_each_dmc_id(dmc_id) {
@@ -493,6 +493,45 @@ void intel_dmc_disable_pipe(struct drm_i
intel_de_rmw(i915, PIPEDMC_CONTROL(pipe), PIPEDMC_ENABLE, 0);
}
+static bool is_dmc_evt_ctl_reg(struct drm_i915_private *i915,
+ enum intel_dmc_id dmc_id, i915_reg_t reg)
+{
+ u32 offset = i915_mmio_reg_offset(reg);
+ u32 start = i915_mmio_reg_offset(DMC_EVT_CTL(i915, dmc_id, 0));
+ u32 end = i915_mmio_reg_offset(DMC_EVT_CTL(i915, dmc_id, DMC_EVENT_HANDLER_COUNT_GEN12));
+
+ return offset >= start && offset < end;
+}
+
+static bool disable_dmc_evt(struct drm_i915_private *i915,
+ enum intel_dmc_id dmc_id,
+ i915_reg_t reg, u32 data)
+{
+ if (!is_dmc_evt_ctl_reg(i915, dmc_id, reg))
+ return false;
+
+ /* keep all pipe DMC events disabled by default */
+ if (dmc_id != DMC_FW_MAIN)
+ return true;
+
+ return false;
+}
+
+static u32 dmc_mmiodata(struct drm_i915_private *i915,
+ struct intel_dmc *dmc,
+ enum intel_dmc_id dmc_id, int i)
+{
+ if (disable_dmc_evt(i915, dmc_id,
+ dmc->dmc_info[dmc_id].mmioaddr[i],
+ dmc->dmc_info[dmc_id].mmiodata[i]))
+ return REG_FIELD_PREP(DMC_EVT_CTL_TYPE_MASK,
+ DMC_EVT_CTL_TYPE_EDGE_0_1) |
+ REG_FIELD_PREP(DMC_EVT_CTL_EVENT_ID_MASK,
+ DMC_EVT_CTL_EVENT_ID_FALSE);
+ else
+ return dmc->dmc_info[dmc_id].mmiodata[i];
+}
+
/**
* intel_dmc_load_program() - write the firmware from memory to register.
* @i915: i915 drm device.
@@ -532,7 +571,7 @@ void intel_dmc_load_program(struct drm_i
for_each_dmc_id(dmc_id) {
for (i = 0; i < dmc->dmc_info[dmc_id].mmio_count; i++) {
intel_de_write(i915, dmc->dmc_info[dmc_id].mmioaddr[i],
- dmc->dmc_info[dmc_id].mmiodata[i]);
+ dmc_mmiodata(i915, dmc, dmc_id, i));
}
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 131/156] 9p: prevent read overrun in protocol dump tracepoint
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 130/156] drm/i915/dmc: Dont enable any pipe DMC events Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 132/156] ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() Greg Kroah-Hartman
` (33 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, JP Kobryn, Christian Schoenebeck,
Dominique Martinet
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: JP Kobryn <inwardvessel@gmail.com>
commit a931c6816078af3e306e0f444f492396ce40de31 upstream.
An out of bounds read can occur within the tracepoint 9p_protocol_dump. In
the fast assign, there is a memcpy that uses a constant size of 32 (macro
named P9_PROTO_DUMP_SZ). When the copy is invoked, the source buffer is not
guaranteed match this size. It was found that in some cases the source
buffer size is less than 32, resulting in a read that overruns.
The size of the source buffer seems to be known at the time of the
tracepoint being invoked. The allocations happen within p9_fcall_init(),
where the capacity field is set to the allocated size of the payload
buffer. This patch tries to fix the overrun by changing the fixed array to
a dynamically sized array and using the minimum of the capacity value or
P9_PROTO_DUMP_SZ as its length. The trace log statement is adjusted to
account for this. Note that the trace log no longer splits the payload on
the first 16 bytes. The full payload is now logged to a single line.
To repro the orignal problem, operations to a plan 9 managed resource can
be used. The simplest approach might just be mounting a shared filesystem
(between host and guest vm) using the plan 9 protocol while the tracepoint
is enabled.
mount -t 9p -o trans=virtio <mount_tag> <mount_path>
The bpftrace program below can be used to show the out of bounds read.
Note that a recent version of bpftrace is needed for the raw tracepoint
support. The script was tested using v0.19.0.
/* from include/net/9p/9p.h */
struct p9_fcall {
u32 size;
u8 id;
u16 tag;
size_t offset;
size_t capacity;
struct kmem_cache *cache;
u8 *sdata;
bool zc;
};
tracepoint:9p:9p_protocol_dump
{
/* out of bounds read can happen when this tracepoint is enabled */
}
rawtracepoint:9p_protocol_dump
{
$pdu = (struct p9_fcall *)arg1;
$dump_sz = (uint64)32;
if ($dump_sz > $pdu->capacity) {
printf("reading %zu bytes from src buffer of %zu bytes\n",
$dump_sz, $pdu->capacity);
}
}
Signed-off-by: JP Kobryn <inwardvessel@gmail.com>
Message-ID: <20231204202321.22730-1-inwardvessel@gmail.com>
Fixes: 60ece0833b6c ("net/9p: allocate appropriate reduced message buffers")
Cc: stable@vger.kernel.org
Reviewed-by: Christian Schoenebeck <linux_oss@crudebyte.com>
Signed-off-by: Dominique Martinet <asmadeus@codewreck.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/trace/events/9p.h | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/include/trace/events/9p.h
+++ b/include/trace/events/9p.h
@@ -178,18 +178,21 @@ TRACE_EVENT(9p_protocol_dump,
__field( void *, clnt )
__field( __u8, type )
__field( __u16, tag )
- __array( unsigned char, line, P9_PROTO_DUMP_SZ )
+ __dynamic_array(unsigned char, line,
+ min_t(size_t, pdu->capacity, P9_PROTO_DUMP_SZ))
),
TP_fast_assign(
__entry->clnt = clnt;
__entry->type = pdu->id;
__entry->tag = pdu->tag;
- memcpy(__entry->line, pdu->sdata, P9_PROTO_DUMP_SZ);
+ memcpy(__get_dynamic_array(line), pdu->sdata,
+ __get_dynamic_array_len(line));
),
- TP_printk("clnt %lu %s(tag = %d)\n%.3x: %16ph\n%.3x: %16ph\n",
+ TP_printk("clnt %lu %s(tag = %d)\n%*ph\n",
(unsigned long)__entry->clnt, show_9p_op(__entry->type),
- __entry->tag, 0, __entry->line, 16, __entry->line + 16)
+ __entry->tag, __get_dynamic_array_len(line),
+ __get_dynamic_array(line))
);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 132/156] ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 131/156] 9p: prevent read overrun in protocol dump tracepoint Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() Greg Kroah-Hartman
` (32 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mathieu Desnoyers,
Steven Rostedt (Google), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
[ Upstream commit dec890089bf79a4954b61482715ee2d084364856 ]
The following race can cause rb_time_read() to observe a corrupted time
stamp:
rb_time_cmpxchg()
[...]
if (!rb_time_read_cmpxchg(&t->msb, msb, msb2))
return false;
if (!rb_time_read_cmpxchg(&t->top, top, top2))
return false;
<interrupted before updating bottom>
__rb_time_read()
[...]
do {
c = local_read(&t->cnt);
top = local_read(&t->top);
bottom = local_read(&t->bottom);
msb = local_read(&t->msb);
} while (c != local_read(&t->cnt));
*cnt = rb_time_cnt(top);
/* If top and msb counts don't match, this interrupted a write */
if (*cnt != rb_time_cnt(msb))
return false;
^ this check fails to catch that "bottom" is still not updated.
So the old "bottom" value is returned, which is wrong.
Fix this by checking that all three of msb, top, and bottom 2-bit cnt
values match.
The reason to favor checking all three fields over requiring a specific
update order for both rb_time_set() and rb_time_cmpxchg() is because
checking all three fields is more robust to handle partial failures of
rb_time_cmpxchg() when interrupted by nested rb_time_set().
Link: https://lore.kernel.org/lkml/20231211201324.652870-1-mathieu.desnoyers@efficios.com/
Link: https://lore.kernel.org/linux-trace-kernel/20231212193049.680122-1-mathieu.desnoyers@efficios.com
Fixes: f458a1453424e ("ring-buffer: Test last update in 32bit version of __rb_time_read()")
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index af08a1a411e3d..070566baa0ca4 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -644,8 +644,8 @@ static inline bool __rb_time_read(rb_time_t *t, u64 *ret, unsigned long *cnt)
*cnt = rb_time_cnt(top);
- /* If top and msb counts don't match, this interrupted a write */
- if (*cnt != rb_time_cnt(msb))
+ /* If top, msb or bottom counts don't match, this interrupted a write */
+ if (*cnt != rb_time_cnt(msb) || *cnt != rb_time_cnt(bottom))
return false;
/* The shift to msb will lose its cnt bits */
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 132/156] ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 21:47 ` Steven Rostedt
2023-12-30 11:59 ` [PATCH 6.6 134/156] ring-buffer: Fix slowpath of interrupted event Greg Kroah-Hartman
` (31 subsequent siblings)
164 siblings, 1 reply; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Joel Fernandes, Vincent Donnefort,
Steven Rostedt (Google), Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <rostedt@goodmis.org>
[ Upstream commit 083e9f65bd215582bf8f6a920db729fadf16704f ]
When filtering is enabled, a temporary buffer is created to place the
content of the trace event output so that the filter logic can decide
from the trace event output if the trace event should be filtered out or
not. If it is to be filtered out, the content in the temporary buffer is
simply discarded, otherwise it is written into the trace buffer.
But if an interrupt were to come in while a previous event was using that
temporary buffer, the event written by the interrupt would actually go
into the ring buffer itself to prevent corrupting the data on the
temporary buffer. If the event is to be filtered out, the event in the
ring buffer is discarded, or if it fails to discard because another event
were to have already come in, it is turned into padding.
The update to the write_stamp in the rb_try_to_discard() happens after a
fix was made to force the next event after the discard to use an absolute
timestamp by setting the before_stamp to zero so it does not match the
write_stamp (which causes an event to use the absolute timestamp).
But there's an effort in rb_try_to_discard() to put back the write_stamp
to what it was before the event was added. But this is useless and
wasteful because nothing is going to be using that write_stamp for
calculations as it still will not match the before_stamp.
Remove this useless update, and in doing so, we remove another
cmpxchg64()!
Also update the comments to reflect this change as well as remove some
extra white space in another comment.
Link: https://lore.kernel.org/linux-trace-kernel/20231215081810.1f4f38fe@rorschach.local.home
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Joel Fernandes <joel@joelfernandes.org>
Cc: Vincent Donnefort <vdonnefort@google.com>
Fixes: b2dd797543cf ("ring-buffer: Force absolute timestamp on discard of event")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 47 +++++++++-----------------------------
1 file changed, 11 insertions(+), 36 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 070566baa0ca4..4c97160ab9c15 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2987,25 +2987,6 @@ static unsigned rb_calculate_event_length(unsigned length)
return length;
}
-static u64 rb_time_delta(struct ring_buffer_event *event)
-{
- switch (event->type_len) {
- case RINGBUF_TYPE_PADDING:
- return 0;
-
- case RINGBUF_TYPE_TIME_EXTEND:
- return rb_event_time_stamp(event);
-
- case RINGBUF_TYPE_TIME_STAMP:
- return 0;
-
- case RINGBUF_TYPE_DATA:
- return event->time_delta;
- default:
- return 0;
- }
-}
-
static inline bool
rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
struct ring_buffer_event *event)
@@ -3013,8 +2994,6 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
unsigned long new_index, old_index;
struct buffer_page *bpage;
unsigned long addr;
- u64 write_stamp;
- u64 delta;
new_index = rb_event_index(event);
old_index = new_index + rb_event_ts_length(event);
@@ -3023,14 +3002,10 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
bpage = READ_ONCE(cpu_buffer->tail_page);
- delta = rb_time_delta(event);
-
- if (!rb_time_read(&cpu_buffer->write_stamp, &write_stamp))
- return false;
-
- /* Make sure the write stamp is read before testing the location */
- barrier();
-
+ /*
+ * Make sure the tail_page is still the same and
+ * the next write location is the end of this event
+ */
if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
unsigned long write_mask =
local_read(&bpage->write) & ~RB_WRITE_MASK;
@@ -3041,20 +3016,20 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
* to make sure that the next event adds an absolute
* value and does not rely on the saved write stamp, which
* is now going to be bogus.
+ *
+ * By setting the before_stamp to zero, the next event
+ * is not going to use the write_stamp and will instead
+ * create an absolute timestamp. This means there's no
+ * reason to update the wirte_stamp!
*/
rb_time_set(&cpu_buffer->before_stamp, 0);
- /* Something came in, can't discard */
- if (!rb_time_cmpxchg(&cpu_buffer->write_stamp,
- write_stamp, write_stamp - delta))
- return false;
-
/*
* If an event were to come in now, it would see that the
* write_stamp and the before_stamp are different, and assume
* that this event just added itself before updating
* the write stamp. The interrupting event will fix the
- * write stamp for us, and use the before stamp as its delta.
+ * write stamp for us, and use an absolute timestamp.
*/
/*
@@ -3491,7 +3466,7 @@ static void check_buffer(struct ring_buffer_per_cpu *cpu_buffer,
return;
/*
- * If this interrupted another event,
+ * If this interrupted another event,
*/
if (atomic_inc_return(this_cpu_ptr(&checking)) != 1)
goto out;
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 134/156] ring-buffer: Fix slowpath of interrupted event
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 135/156] spi: atmel: Do not cancel a transfer upon any signal Greg Kroah-Hartman
` (30 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Linus Torvalds, Steven Rostedt (Google),
Sasha Levin
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <rostedt@goodmis.org>
[ Upstream commit b803d7c664d55705831729d2f2e29c874bcd62ea ]
To synchronize the timestamps with the ring buffer reservation, there are
two timestamps that are saved in the buffer meta data.
1. before_stamp
2. write_stamp
When the two are equal, the write_stamp is considered valid, as in, it may
be used to calculate the delta of the next event as the write_stamp is the
timestamp of the previous reserved event on the buffer.
This is done by the following:
/*A*/ w = current position on the ring buffer
before = before_stamp
after = write_stamp
ts = read current timestamp
if (before != after) {
write_stamp is not valid, force adding an absolute
timestamp.
}
/*B*/ before_stamp = ts
/*C*/ write = local_add_return(event length, position on ring buffer)
if (w == write - event length) {
/* Nothing interrupted between A and C */
/*E*/ write_stamp = ts;
delta = ts - after
/*
* If nothing interrupted again,
* before_stamp == write_stamp and write_stamp
* can be used to calculate the delta for
* events that come in after this one.
*/
} else {
/*
* The slow path!
* Was interrupted between A and C.
*/
This is the place that there's a bug. We currently have:
after = write_stamp
ts = read current timestamp
/*F*/ if (write == current position on the ring buffer &&
after < ts && cmpxchg(write_stamp, after, ts)) {
delta = ts - after;
} else {
delta = 0;
}
The assumption is that if the current position on the ring buffer hasn't
moved between C and F, then it also was not interrupted, and that the last
event written has a timestamp that matches the write_stamp. That is the
write_stamp is valid.
But this may not be the case:
If a task context event was interrupted by softirq between B and C.
And the softirq wrote an event that got interrupted by a hard irq between
C and E.
and the hard irq wrote an event (does not need to be interrupted)
We have:
/*B*/ before_stamp = ts of normal context
---> interrupted by softirq
/*B*/ before_stamp = ts of softirq context
---> interrupted by hardirq
/*B*/ before_stamp = ts of hard irq context
/*E*/ write_stamp = ts of hard irq context
/* matches and write_stamp valid */
<----
/*E*/ write_stamp = ts of softirq context
/* No longer matches before_stamp, write_stamp is not valid! */
<---
w != write - length, go to slow path
// Right now the order of events in the ring buffer is:
//
// |-- softirq event --|-- hard irq event --|-- normal context event --|
//
after = write_stamp (this is the ts of softirq)
ts = read current timestamp
if (write == current position on the ring buffer [true] &&
after < ts [true] && cmpxchg(write_stamp, after, ts) [true]) {
delta = ts - after [Wrong!]
The delta is to be between the hard irq event and the normal context
event, but the above logic made the delta between the softirq event and
the normal context event, where the hard irq event is between the two. This
will shift all the remaining event timestamps on the sub-buffer
incorrectly.
The write_stamp is only valid if it matches the before_stamp. The cmpxchg
does nothing to help this.
Instead, the following logic can be done to fix this:
before = before_stamp
ts = read current timestamp
before_stamp = ts
after = write_stamp
if (write == current position on the ring buffer &&
after == before && after < ts) {
delta = ts - after
} else {
delta = 0;
}
The above will only use the write_stamp if it still matches before_stamp
and was tested to not have changed since C.
As a bonus, with this logic we do not need any 64-bit cmpxchg() at all!
This means the 32-bit rb_time_t workaround can finally be removed. But
that's for a later time.
Link: https://lore.kernel.org/linux-trace-kernel/20231218175229.58ec3daf@gandalf.local.home/
Link: https://lore.kernel.org/linux-trace-kernel/20231218230712.3a76b081@gandalf.local.home
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Fixes: dd93942570789 ("ring-buffer: Do not try to put back write_stamp")
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 79 ++++++++++++--------------------------
1 file changed, 24 insertions(+), 55 deletions(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 4c97160ab9c15..783a500e89c58 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -700,48 +700,6 @@ rb_time_read_cmpxchg(local_t *l, unsigned long expect, unsigned long set)
return local_try_cmpxchg(l, &expect, set);
}
-static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set)
-{
- unsigned long cnt, top, bottom, msb;
- unsigned long cnt2, top2, bottom2, msb2;
- u64 val;
-
- /* Any interruptions in this function should cause a failure */
- cnt = local_read(&t->cnt);
-
- /* The cmpxchg always fails if it interrupted an update */
- if (!__rb_time_read(t, &val, &cnt2))
- return false;
-
- if (val != expect)
- return false;
-
- if ((cnt & 3) != cnt2)
- return false;
-
- cnt2 = cnt + 1;
-
- rb_time_split(val, &top, &bottom, &msb);
- msb = rb_time_val_cnt(msb, cnt);
- top = rb_time_val_cnt(top, cnt);
- bottom = rb_time_val_cnt(bottom, cnt);
-
- rb_time_split(set, &top2, &bottom2, &msb2);
- msb2 = rb_time_val_cnt(msb2, cnt);
- top2 = rb_time_val_cnt(top2, cnt2);
- bottom2 = rb_time_val_cnt(bottom2, cnt2);
-
- if (!rb_time_read_cmpxchg(&t->cnt, cnt, cnt2))
- return false;
- if (!rb_time_read_cmpxchg(&t->msb, msb, msb2))
- return false;
- if (!rb_time_read_cmpxchg(&t->top, top, top2))
- return false;
- if (!rb_time_read_cmpxchg(&t->bottom, bottom, bottom2))
- return false;
- return true;
-}
-
#else /* 64 bits */
/* local64_t always succeeds */
@@ -755,11 +713,6 @@ static void rb_time_set(rb_time_t *t, u64 val)
{
local64_set(&t->time, val);
}
-
-static bool rb_time_cmpxchg(rb_time_t *t, u64 expect, u64 set)
-{
- return local64_try_cmpxchg(&t->time, &expect, set);
-}
#endif
/*
@@ -3610,20 +3563,36 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
} else {
u64 ts;
/* SLOW PATH - Interrupted between A and C */
- a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after);
- /* Was interrupted before here, write_stamp must be valid */
+
+ /* Save the old before_stamp */
+ a_ok = rb_time_read(&cpu_buffer->before_stamp, &info->before);
RB_WARN_ON(cpu_buffer, !a_ok);
+
+ /*
+ * Read a new timestamp and update the before_stamp to make
+ * the next event after this one force using an absolute
+ * timestamp. This is in case an interrupt were to come in
+ * between E and F.
+ */
ts = rb_time_stamp(cpu_buffer->buffer);
+ rb_time_set(&cpu_buffer->before_stamp, ts);
+
+ barrier();
+ /*E*/ a_ok = rb_time_read(&cpu_buffer->write_stamp, &info->after);
+ /* Was interrupted before here, write_stamp must be valid */
+ RB_WARN_ON(cpu_buffer, !a_ok);
barrier();
- /*E*/ if (write == (local_read(&tail_page->write) & RB_WRITE_MASK) &&
- info->after < ts &&
- rb_time_cmpxchg(&cpu_buffer->write_stamp,
- info->after, ts)) {
- /* Nothing came after this event between C and E */
+ /*F*/ if (write == (local_read(&tail_page->write) & RB_WRITE_MASK) &&
+ info->after == info->before && info->after < ts) {
+ /*
+ * Nothing came after this event between C and F, it is
+ * safe to use info->after for the delta as it
+ * matched info->before and is still valid.
+ */
info->delta = ts - info->after;
} else {
/*
- * Interrupted between C and E:
+ * Interrupted between C and F:
* Lost the previous events time stamp. Just set the
* delta to zero, and this will be the same time as
* the event this event interrupted. And the events that
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 135/156] spi: atmel: Do not cancel a transfer upon any signal
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 134/156] ring-buffer: Fix slowpath of interrupted event Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 136/156] spi: atmel: Prevent spi transfers from being killed Greg Kroah-Hartman
` (29 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ronald Wahl, Miquel Raynal,
Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 1ca2761a7734928ffe0678f88789266cf3d05362 upstream.
The intended move from wait_for_completion_*() to
wait_for_completion_interruptible_*() was to allow (very) long spi memory
transfers to be stopped upon user request instead of freezing the
machine forever as the timeout value could now be significantly bigger.
However, depending on the user logic, applications can receive many
signals for their own "internal" purpose and have nothing to do with the
requested kernel operations, hence interrupting spi transfers upon any
signal is probably not a wise choice. Instead, let's switch to
wait_for_completion_killable_*() to only catch the "important"
signals. This was likely the intended behavior anyway.
Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers")
Cc: stable@vger.kernel.org
Reported-by: Ronald Wahl <ronald.wahl@raritan.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/r/20231127095842.389631-1-miquel.raynal@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-atmel.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c
index 6aa8adbe4170..2e8860865af9 100644
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1336,8 +1336,8 @@ static int atmel_spi_one_transfer(struct spi_controller *host,
}
dma_timeout = msecs_to_jiffies(spi_controller_xfer_timeout(host, xfer));
- ret_timeout = wait_for_completion_interruptible_timeout(&as->xfer_completion,
- dma_timeout);
+ ret_timeout = wait_for_completion_killable_timeout(&as->xfer_completion,
+ dma_timeout);
if (ret_timeout <= 0) {
dev_err(&spi->dev, "spi transfer %s\n",
!ret_timeout ? "timeout" : "canceled");
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 136/156] spi: atmel: Prevent spi transfers from being killed
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 135/156] spi: atmel: Do not cancel a transfer upon any signal Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 137/156] spi: atmel: Fix clock issue when using devices with different polarities Greg Kroah-Hartman
` (28 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Ronald Wahl,
Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit 890188d2d7e4ac6c131ba166ca116cb315e752ee upstream.
Upstream commit e0205d6203c2 ("spi: atmel: Prevent false timeouts on
long transfers") has tried to mitigate the problem of getting spi
transfers canceled because they were lasting too long. On slow buses,
transfers in the MiB range can take more than one second and thus a
calculation was added to progressively increment the timeout value. In
order to not be too problematic from a user point of view (waiting dozen
of seconds or even minutes), the wait call was turned interruptible.
Turning the wait interruptible was a mistake as what we really wanted to
do was to be able to kill a transfer. Any signal interrupting our
transfer would not be suitable at all so a second attempt was made at
turning the wait killable instead.
Link: https://lore.kernel.org/linux-spi/20231127095842.389631-1-miquel.raynal@bootlin.com/
All being well, it was reported that JFFS2 was showing a splat when
interrupting a transfer. After some more debate about whether JFFS2
should be fixed and how, it was also pointed out that the whole
consistency of the filesystem in case of parallel I/O would be
compromised. Changing JFFS2 behavior would in theory be possible but
nobody has the energy and time and knowledge to do this now, so better
prevent spi transfers to be interrupted by the user.
Partially revert the blamed commit to no longer use the interruptible
nor the killable variant of wait_for_completion().
Fixes: e0205d6203c2 ("spi: atmel: Prevent false timeouts on long transfers")
Cc: <stable@vger.kernel.org>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Tested-by: Ronald Wahl <ronald.wahl@raritan.com>
Link: https://lore.kernel.org/r/20231205083102.16946-1-miquel.raynal@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-atmel.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -1336,12 +1336,10 @@ static int atmel_spi_one_transfer(struct
}
dma_timeout = msecs_to_jiffies(spi_controller_xfer_timeout(host, xfer));
- ret_timeout = wait_for_completion_killable_timeout(&as->xfer_completion,
- dma_timeout);
- if (ret_timeout <= 0) {
- dev_err(&spi->dev, "spi transfer %s\n",
- !ret_timeout ? "timeout" : "canceled");
- as->done_status = ret_timeout < 0 ? ret_timeout : -EIO;
+ ret_timeout = wait_for_completion_timeout(&as->xfer_completion, dma_timeout);
+ if (!ret_timeout) {
+ dev_err(&spi->dev, "spi transfer timeout\n");
+ as->done_status = -EIO;
}
if (as->done_status)
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 137/156] spi: atmel: Fix clock issue when using devices with different polarities
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 136/156] spi: atmel: Prevent spi transfers from being killed Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 138/156] nvmem: brcm_nvram: store a copy of NVRAM content Greg Kroah-Hartman
` (27 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Louis Chauvet, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Louis Chauvet <louis.chauvet@bootlin.com>
commit fc70d643a2f6678cbe0f5c86433c1aeb4d613fcc upstream.
The current Atmel SPI controller driver (v2) behaves incorrectly when
using two SPI devices with different clock polarities and GPIO CS.
When switching from one device to another, the controller driver first
enables the CS and then applies whatever configuration suits the targeted
device (typically, the polarities). The side effect of such order is the
apparition of a spurious clock edge after enabling the CS when the clock
polarity needs to be inverted wrt. the previous configuration of the
controller.
This parasitic clock edge is problematic when the SPI device uses that edge
for internal processing, which is perfectly legitimate given that its CS
was asserted. Indeed, devices such as HVS8080 driven by driver gpio-sr in
the kernel are shift registers and will process this first clock edge to
perform a first register shift. In this case, the first bit gets lost and
the whole data block that will later be read by the kernel is all shifted
by one.
Current behavior:
The actual switching of the clock polarity only occurs after the CS
when the controller sends the first message:
CLK ------------\ /-\ /-\
| | | | | . . .
\---/ \-/ \
CS -----\
|
\------------------
^ ^ ^
| | |
| | Actual clock of the message sent
| |
| Change of clock polarity, which occurs with the first
| write to the bus. This edge occurs when the CS is
| already asserted, and can be interpreted as
| the first clock edge by the receiver.
|
GPIO CS toggle
This issue is specific to this controller because while the SPI core
performs the operations in the right order, the controller however does
not. In practice, the controller only applies the clock configuration right
before the first transmission.
So this is not a problem when using the controller's dedicated CS, as the
controller does things correctly, but it becomes a problem when you need to
change the clock polarity and use an external GPIO for the CS.
One possible approach to solve this problem is to send a dummy message
before actually activating the CS, so that the controller applies the clock
polarity beforehand.
New behavior:
CLK ------\ /-\ /-\ /-\ /-\
| | | ... | | | | ... | |
\------/ \- -/ \------/ \- -/ \------
CS -\/-----------------------\
|| |
\/ \---------------------
^ ^ ^ ^ ^
| | | | |
| | | | Expected clock cycles when
| | | | sending the message
| | | |
| | | Actual GPIO CS activation, occurs inside
| | | the driver
| | |
| | Dummy message, to trigger clock polarity
| | reconfiguration. This message is not received and
| | processed by the device because CS is low.
| |
| Change of clock polarity, forced by the dummy message. This
| time, the edge is not detected by the receiver.
|
This small spike in CS activation is due to the fact that the
spi-core activates the CS gpio before calling the driver's
set_cs callback, which deactivates this gpio again until the
clock polarity is correct.
To avoid having to systematically send a dummy packet, the driver keeps
track of the clock's current polarity. In this way, it only sends the dummy
packet when necessary, ensuring that the clock will have the correct
polarity when the CS is toggled.
There could be two hardware problems with this patch:
1- Maybe the small CS activation peak can confuse SPI devices
2- If on a design, a single wire is used to select two devices depending
on its state, the dummy message may disturb them.
Fixes: 5ee36c989831 ("spi: atmel_spi update chipselect handling")
Cc: <stable@vger.kernel.org>
Signed-off-by: Louis Chauvet <louis.chauvet@bootlin.com>
Link: https://msgid.link/r/20231204154903.11607-1-louis.chauvet@bootlin.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-atmel.c | 82 +++++++++++++++++++++++++++++++++++++++++++++++-
1 file changed, 81 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-atmel.c
+++ b/drivers/spi/spi-atmel.c
@@ -22,6 +22,7 @@
#include <linux/gpio/consumer.h>
#include <linux/pinctrl/consumer.h>
#include <linux/pm_runtime.h>
+#include <linux/iopoll.h>
#include <trace/events/spi.h>
/* SPI register offsets */
@@ -279,6 +280,7 @@ struct atmel_spi {
bool keep_cs;
u32 fifo_size;
+ bool last_polarity;
u8 native_cs_free;
u8 native_cs_for_gpio;
};
@@ -292,6 +294,22 @@ struct atmel_spi_device {
#define INVALID_DMA_ADDRESS 0xffffffff
/*
+ * This frequency can be anything supported by the controller, but to avoid
+ * unnecessary delay, the highest possible frequency is chosen.
+ *
+ * This frequency is the highest possible which is not interfering with other
+ * chip select registers (see Note for Serial Clock Bit Rate configuration in
+ * Atmel-11121F-ATARM-SAMA5D3-Series-Datasheet_02-Feb-16, page 1283)
+ */
+#define DUMMY_MSG_FREQUENCY 0x02
+/*
+ * 8 bits is the minimum data the controller is capable of sending.
+ *
+ * This message can be anything as it should not be treated by any SPI device.
+ */
+#define DUMMY_MSG 0xAA
+
+/*
* Version 2 of the SPI controller has
* - CR.LASTXFER
* - SPI_MR.DIV32 may become FDIV or must-be-zero (here: always zero)
@@ -305,6 +323,43 @@ static bool atmel_spi_is_v2(struct atmel
}
/*
+ * Send a dummy message.
+ *
+ * This is sometimes needed when using a CS GPIO to force clock transition when
+ * switching between devices with different polarities.
+ */
+static void atmel_spi_send_dummy(struct atmel_spi *as, struct spi_device *spi, int chip_select)
+{
+ u32 status;
+ u32 csr;
+
+ /*
+ * Set a clock frequency to allow sending message on SPI bus.
+ * The frequency here can be anything, but is needed for
+ * the controller to send the data.
+ */
+ csr = spi_readl(as, CSR0 + 4 * chip_select);
+ csr = SPI_BFINS(SCBR, DUMMY_MSG_FREQUENCY, csr);
+ spi_writel(as, CSR0 + 4 * chip_select, csr);
+
+ /*
+ * Read all data coming from SPI bus, needed to be able to send
+ * the message.
+ */
+ spi_readl(as, RDR);
+ while (spi_readl(as, SR) & SPI_BIT(RDRF)) {
+ spi_readl(as, RDR);
+ cpu_relax();
+ }
+
+ spi_writel(as, TDR, DUMMY_MSG);
+
+ readl_poll_timeout_atomic(as->regs + SPI_SR, status,
+ (status & SPI_BIT(TXEMPTY)), 1, 1000);
+}
+
+
+/*
* Earlier SPI controllers (e.g. on at91rm9200) have a design bug whereby
* they assume that spi slave device state will not change on deselect, so
* that automagic deselection is OK. ("NPCSx rises if no data is to be
@@ -320,11 +375,17 @@ static bool atmel_spi_is_v2(struct atmel
* Master on Chip Select 0.") No workaround exists for that ... so for
* nCS0 on that chip, we (a) don't use the GPIO, (b) can't support CS_HIGH,
* and (c) will trigger that first erratum in some cases.
+ *
+ * When changing the clock polarity, the SPI controller waits for the next
+ * transmission to enforce the default clock state. This may be an issue when
+ * using a GPIO as Chip Select: the clock level is applied only when the first
+ * packet is sent, once the CS has already been asserted. The workaround is to
+ * avoid this by sending a first (dummy) message before toggling the CS state.
*/
-
static void cs_activate(struct atmel_spi *as, struct spi_device *spi)
{
struct atmel_spi_device *asd = spi->controller_state;
+ bool new_polarity;
int chip_select;
u32 mr;
@@ -353,6 +414,25 @@ static void cs_activate(struct atmel_spi
}
mr = spi_readl(as, MR);
+
+ /*
+ * Ensures the clock polarity is valid before we actually
+ * assert the CS to avoid spurious clock edges to be
+ * processed by the spi devices.
+ */
+ if (spi_get_csgpiod(spi, 0)) {
+ new_polarity = (asd->csr & SPI_BIT(CPOL)) != 0;
+ if (new_polarity != as->last_polarity) {
+ /*
+ * Need to disable the GPIO before sending the dummy
+ * message because it is already set by the spi core.
+ */
+ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), 0);
+ atmel_spi_send_dummy(as, spi, chip_select);
+ as->last_polarity = new_polarity;
+ gpiod_set_value_cansleep(spi_get_csgpiod(spi, 0), 1);
+ }
+ }
} else {
u32 cpol = (spi->mode & SPI_CPOL) ? SPI_BIT(CPOL) : 0;
int i;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 138/156] nvmem: brcm_nvram: store a copy of NVRAM content
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 137/156] spi: atmel: Fix clock issue when using devices with different polarities Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 139/156] Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" Greg Kroah-Hartman
` (26 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stable, Arınç ÜNAL,
Florian Fainelli, Scott Branden, Rafał Miłecki,
Srinivas Kandagatla
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafał Miłecki <rafal@milecki.pl>
commit 1e37bf84afacd5ba17b7a13a18ca2bc78aff05c0 upstream.
This driver uses MMIO access for reading NVRAM from a flash device.
Underneath there is a flash controller that reads data and provides
mapping window.
Using MMIO interface affects controller configuration and may break real
controller driver. It was reported by multiple users of devices with
NVRAM stored on NAND.
Modify driver to read & cache NVRAM content during init and use that
copy to provide NVMEM data when requested. On NAND flashes due to their
alignment NVRAM partitions can be quite big (1 MiB and more) while
actual NVRAM content stays quite small (usually 16 to 32 KiB). To avoid
allocating so much memory check for actual data length.
Link: https://lore.kernel.org/linux-mtd/CACna6rwf3_9QVjYcM+847biTX=K0EoWXuXcSMkJO1Vy_5vmVqA@mail.gmail.com/
Fixes: 3fef9ed0627a ("nvmem: brcm_nvram: new driver exposing Broadcom's NVRAM")
Cc: <Stable@vger.kernel.org>
Cc: Arınç ÜNAL <arinc.unal@arinc9.com>
Cc: Florian Fainelli <florian.fainelli@broadcom.com>
Cc: Scott Branden <scott.branden@broadcom.com>
Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
Acked-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20231215111358.316727-3-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/brcm_nvram.c | 134 +++++++++++++++++++++++++++++++--------------
1 file changed, 94 insertions(+), 40 deletions(-)
--- a/drivers/nvmem/brcm_nvram.c
+++ b/drivers/nvmem/brcm_nvram.c
@@ -17,9 +17,23 @@
#define NVRAM_MAGIC "FLSH"
+/**
+ * struct brcm_nvram - driver state internal struct
+ *
+ * @dev: NVMEM device pointer
+ * @nvmem_size: Size of the whole space available for NVRAM
+ * @data: NVRAM data copy stored to avoid poking underlaying flash controller
+ * @data_len: NVRAM data size
+ * @padding_byte: Padding value used to fill remaining space
+ * @cells: Array of discovered NVMEM cells
+ * @ncells: Number of elements in cells
+ */
struct brcm_nvram {
struct device *dev;
- void __iomem *base;
+ size_t nvmem_size;
+ uint8_t *data;
+ size_t data_len;
+ uint8_t padding_byte;
struct nvmem_cell_info *cells;
int ncells;
};
@@ -36,10 +50,47 @@ static int brcm_nvram_read(void *context
size_t bytes)
{
struct brcm_nvram *priv = context;
- u8 *dst = val;
+ size_t to_copy;
+
+ if (offset + bytes > priv->data_len)
+ to_copy = max_t(ssize_t, (ssize_t)priv->data_len - offset, 0);
+ else
+ to_copy = bytes;
+
+ memcpy(val, priv->data + offset, to_copy);
+
+ memset((uint8_t *)val + to_copy, priv->padding_byte, bytes - to_copy);
+
+ return 0;
+}
+
+static int brcm_nvram_copy_data(struct brcm_nvram *priv, struct platform_device *pdev)
+{
+ struct resource *res;
+ void __iomem *base;
+
+ base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
+ if (IS_ERR(base))
+ return PTR_ERR(base);
+
+ priv->nvmem_size = resource_size(res);
+
+ priv->padding_byte = readb(base + priv->nvmem_size - 1);
+ for (priv->data_len = priv->nvmem_size;
+ priv->data_len;
+ priv->data_len--) {
+ if (readb(base + priv->data_len - 1) != priv->padding_byte)
+ break;
+ }
+ WARN(priv->data_len > SZ_128K, "Unexpected (big) NVRAM size: %zu B\n", priv->data_len);
- while (bytes--)
- *dst++ = readb(priv->base + offset++);
+ priv->data = devm_kzalloc(priv->dev, priv->data_len, GFP_KERNEL);
+ if (!priv->data)
+ return -ENOMEM;
+
+ memcpy_fromio(priv->data, base, priv->data_len);
+
+ bcm47xx_nvram_init_from_iomem(base, priv->data_len);
return 0;
}
@@ -67,8 +118,13 @@ static int brcm_nvram_add_cells(struct b
size_t len)
{
struct device *dev = priv->dev;
- char *var, *value, *eq;
+ char *var, *value;
+ uint8_t tmp;
int idx;
+ int err = 0;
+
+ tmp = priv->data[len - 1];
+ priv->data[len - 1] = '\0';
priv->ncells = 0;
for (var = data + sizeof(struct brcm_nvram_header);
@@ -78,67 +134,68 @@ static int brcm_nvram_add_cells(struct b
}
priv->cells = devm_kcalloc(dev, priv->ncells, sizeof(*priv->cells), GFP_KERNEL);
- if (!priv->cells)
- return -ENOMEM;
+ if (!priv->cells) {
+ err = -ENOMEM;
+ goto out;
+ }
for (var = data + sizeof(struct brcm_nvram_header), idx = 0;
var < (char *)data + len && *var;
var = value + strlen(value) + 1, idx++) {
+ char *eq, *name;
+
eq = strchr(var, '=');
if (!eq)
break;
*eq = '\0';
+ name = devm_kstrdup(dev, var, GFP_KERNEL);
+ *eq = '=';
+ if (!name) {
+ err = -ENOMEM;
+ goto out;
+ }
value = eq + 1;
- priv->cells[idx].name = devm_kstrdup(dev, var, GFP_KERNEL);
- if (!priv->cells[idx].name)
- return -ENOMEM;
+ priv->cells[idx].name = name;
priv->cells[idx].offset = value - (char *)data;
priv->cells[idx].bytes = strlen(value);
priv->cells[idx].np = of_get_child_by_name(dev->of_node, priv->cells[idx].name);
- if (!strcmp(var, "et0macaddr") ||
- !strcmp(var, "et1macaddr") ||
- !strcmp(var, "et2macaddr")) {
+ if (!strcmp(name, "et0macaddr") ||
+ !strcmp(name, "et1macaddr") ||
+ !strcmp(name, "et2macaddr")) {
priv->cells[idx].raw_len = strlen(value);
priv->cells[idx].bytes = ETH_ALEN;
priv->cells[idx].read_post_process = brcm_nvram_read_post_process_macaddr;
}
}
- return 0;
+out:
+ priv->data[len - 1] = tmp;
+ return err;
}
static int brcm_nvram_parse(struct brcm_nvram *priv)
{
+ struct brcm_nvram_header *header = (struct brcm_nvram_header *)priv->data;
struct device *dev = priv->dev;
- struct brcm_nvram_header header;
- uint8_t *data;
size_t len;
int err;
- memcpy_fromio(&header, priv->base, sizeof(header));
-
- if (memcmp(header.magic, NVRAM_MAGIC, 4)) {
+ if (memcmp(header->magic, NVRAM_MAGIC, 4)) {
dev_err(dev, "Invalid NVRAM magic\n");
return -EINVAL;
}
- len = le32_to_cpu(header.len);
-
- data = kzalloc(len, GFP_KERNEL);
- if (!data)
- return -ENOMEM;
-
- memcpy_fromio(data, priv->base, len);
- data[len - 1] = '\0';
-
- err = brcm_nvram_add_cells(priv, data, len);
- if (err) {
- dev_err(dev, "Failed to add cells: %d\n", err);
- return err;
+ len = le32_to_cpu(header->len);
+ if (len > priv->nvmem_size) {
+ dev_err(dev, "NVRAM length (%zd) exceeds mapped size (%zd)\n", len,
+ priv->nvmem_size);
+ return -EINVAL;
}
- kfree(data);
+ err = brcm_nvram_add_cells(priv, priv->data, len);
+ if (err)
+ dev_err(dev, "Failed to add cells: %d\n", err);
return 0;
}
@@ -150,7 +207,6 @@ static int brcm_nvram_probe(struct platf
.reg_read = brcm_nvram_read,
};
struct device *dev = &pdev->dev;
- struct resource *res;
struct brcm_nvram *priv;
int err;
@@ -159,21 +215,19 @@ static int brcm_nvram_probe(struct platf
return -ENOMEM;
priv->dev = dev;
- priv->base = devm_platform_get_and_ioremap_resource(pdev, 0, &res);
- if (IS_ERR(priv->base))
- return PTR_ERR(priv->base);
+ err = brcm_nvram_copy_data(priv, pdev);
+ if (err)
+ return err;
err = brcm_nvram_parse(priv);
if (err)
return err;
- bcm47xx_nvram_init_from_iomem(priv->base, resource_size(res));
-
config.dev = dev;
config.cells = priv->cells;
config.ncells = priv->ncells;
config.priv = priv;
- config.size = resource_size(res);
+ config.size = priv->nvmem_size;
return PTR_ERR_OR_ZERO(devm_nvmem_register(dev, &config));
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 139/156] Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 138/156] nvmem: brcm_nvram: store a copy of NVRAM content Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 140/156] scsi: core: Always send batch on reset or error handling command Greg Kroah-Hartman
` (25 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Martin K. Petersen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Martin K. Petersen <martin.petersen@oracle.com>
commit c5becf57dd5659c687d41d623a69f42d63f59eb2 upstream.
This reverts commit 9dc704dcc09eae7d21b5da0615eb2ed79278f63e.
Several reports have been made indicating that this commit caused
hangs. Numerous attempts at root causing and fixing the issue have
been unsuccessful so let's revert for now.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217599
Cc: <stable@vger.kernel.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/aacraid/aacraid.h | 1 -
drivers/scsi/aacraid/commsup.c | 6 +-----
drivers/scsi/aacraid/linit.c | 14 --------------
drivers/scsi/aacraid/src.c | 25 ++-----------------------
4 files changed, 3 insertions(+), 43 deletions(-)
--- a/drivers/scsi/aacraid/aacraid.h
+++ b/drivers/scsi/aacraid/aacraid.h
@@ -1678,7 +1678,6 @@ struct aac_dev
u32 handle_pci_error;
bool init_reset;
u8 soft_reset_support;
- u8 use_map_queue;
};
#define aac_adapter_interrupt(dev) \
--- a/drivers/scsi/aacraid/commsup.c
+++ b/drivers/scsi/aacraid/commsup.c
@@ -223,12 +223,8 @@ int aac_fib_setup(struct aac_dev * dev)
struct fib *aac_fib_alloc_tag(struct aac_dev *dev, struct scsi_cmnd *scmd)
{
struct fib *fibptr;
- u32 blk_tag;
- int i;
- blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd));
- i = blk_mq_unique_tag_to_tag(blk_tag);
- fibptr = &dev->fibs[i];
+ fibptr = &dev->fibs[scsi_cmd_to_rq(scmd)->tag];
/*
* Null out fields that depend on being zero at the start of
* each I/O
--- a/drivers/scsi/aacraid/linit.c
+++ b/drivers/scsi/aacraid/linit.c
@@ -19,7 +19,6 @@
#include <linux/compat.h>
#include <linux/blkdev.h>
-#include <linux/blk-mq-pci.h>
#include <linux/completion.h>
#include <linux/init.h>
#include <linux/interrupt.h>
@@ -505,15 +504,6 @@ common_config:
return 0;
}
-static void aac_map_queues(struct Scsi_Host *shost)
-{
- struct aac_dev *aac = (struct aac_dev *)shost->hostdata;
-
- blk_mq_pci_map_queues(&shost->tag_set.map[HCTX_TYPE_DEFAULT],
- aac->pdev, 0);
- aac->use_map_queue = true;
-}
-
/**
* aac_change_queue_depth - alter queue depths
* @sdev: SCSI device we are considering
@@ -1498,7 +1488,6 @@ static const struct scsi_host_template a
.bios_param = aac_biosparm,
.shost_groups = aac_host_groups,
.slave_configure = aac_slave_configure,
- .map_queues = aac_map_queues,
.change_queue_depth = aac_change_queue_depth,
.sdev_groups = aac_dev_groups,
.eh_abort_handler = aac_eh_abort,
@@ -1786,8 +1775,6 @@ static int aac_probe_one(struct pci_dev
shost->max_lun = AAC_MAX_LUN;
pci_set_drvdata(pdev, shost);
- shost->nr_hw_queues = aac->max_msix;
- shost->host_tagset = 1;
error = scsi_add_host(shost, &pdev->dev);
if (error)
@@ -1919,7 +1906,6 @@ static void aac_remove_one(struct pci_de
struct aac_dev *aac = (struct aac_dev *)shost->hostdata;
aac_cancel_rescan_worker(aac);
- aac->use_map_queue = false;
scsi_remove_host(shost);
__aac_shutdown(aac);
--- a/drivers/scsi/aacraid/src.c
+++ b/drivers/scsi/aacraid/src.c
@@ -493,10 +493,6 @@ static int aac_src_deliver_message(struc
#endif
u16 vector_no;
- struct scsi_cmnd *scmd;
- u32 blk_tag;
- struct Scsi_Host *shost = dev->scsi_host_ptr;
- struct blk_mq_queue_map *qmap;
atomic_inc(&q->numpending);
@@ -509,25 +505,8 @@ static int aac_src_deliver_message(struc
if ((dev->comm_interface == AAC_COMM_MESSAGE_TYPE3)
&& dev->sa_firmware)
vector_no = aac_get_vector(dev);
- else {
- if (!fib->vector_no || !fib->callback_data) {
- if (shost && dev->use_map_queue) {
- qmap = &shost->tag_set.map[HCTX_TYPE_DEFAULT];
- vector_no = qmap->mq_map[raw_smp_processor_id()];
- }
- /*
- * We hardcode the vector_no for
- * reserved commands as a valid shost is
- * absent during the init
- */
- else
- vector_no = 0;
- } else {
- scmd = (struct scsi_cmnd *)fib->callback_data;
- blk_tag = blk_mq_unique_tag(scsi_cmd_to_rq(scmd));
- vector_no = blk_mq_unique_tag_to_hwq(blk_tag);
- }
- }
+ else
+ vector_no = fib->vector_no;
if (native_hba) {
if (fib->flags & FIB_CONTEXT_FLAG_NATIVE_HBA_TMF) {
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 140/156] scsi: core: Always send batch on reset or error handling command
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 139/156] Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 141/156] tracing / synthetic: Disable events after testing in synth_event_gen_test_init() Greg Kroah-Hartman
` (24 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Atanasov, Ming Lei,
Martin K. Petersen
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Atanasov <alexander.atanasov@virtuozzo.com>
commit 066c5b46b6eaf2f13f80c19500dbb3b84baabb33 upstream.
In commit 8930a6c20791 ("scsi: core: add support for request batching") the
block layer bd->last flag was mapped to SCMD_LAST and used as an indicator
to send the batch for the drivers that implement this feature. However, the
error handling code was not updated accordingly.
scsi_send_eh_cmnd() is used to send error handling commands and request
sense. The problem is that request sense comes as a single command that
gets into the batch queue and times out. As a result the device goes
offline after several failed resets. This was observed on virtio_scsi
during a device resize operation.
[ 496.316946] sd 0:0:4:0: [sdd] tag#117 scsi_eh_0: requesting sense
[ 506.786356] sd 0:0:4:0: [sdd] tag#117 scsi_send_eh_cmnd timeleft: 0
[ 506.787981] sd 0:0:4:0: [sdd] tag#117 abort
To fix this always set SCMD_LAST flag in scsi_send_eh_cmnd() and
scsi_reset_ioctl().
Fixes: 8930a6c20791 ("scsi: core: add support for request batching")
Cc: <stable@vger.kernel.org>
Signed-off-by: Alexander Atanasov <alexander.atanasov@virtuozzo.com>
Link: https://lore.kernel.org/r/20231215121008.2881653-1-alexander.atanasov@virtuozzo.com
Reviewed-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_error.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/scsi/scsi_error.c
+++ b/drivers/scsi/scsi_error.c
@@ -1152,6 +1152,7 @@ retry:
scsi_log_send(scmd);
scmd->submitter = SUBMITTED_BY_SCSI_ERROR_HANDLER;
+ scmd->flags |= SCMD_LAST;
/*
* Lock sdev->state_mutex to avoid that scsi_device_quiesce() can
@@ -2459,6 +2460,7 @@ scsi_ioctl_reset(struct scsi_device *dev
scsi_init_command(dev, scmd);
scmd->submitter = SUBMITTED_BY_SCSI_RESET_IOCTL;
+ scmd->flags |= SCMD_LAST;
memset(&scmd->sdb, 0, sizeof(scmd->sdb));
scmd->cmd_len = 0;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 141/156] tracing / synthetic: Disable events after testing in synth_event_gen_test_init()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 140/156] scsi: core: Always send batch on reset or error handling command Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 142/156] dm-integrity: dont modify bios immutable bio_vec in integrity_metadata() Greg Kroah-Hartman
` (23 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mathieu Desnoyers, Tom Zanussi,
Masami Hiramatsu (Google), Alexander Graf,
Steven Rostedt (Google)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <rostedt@goodmis.org>
commit 88b30c7f5d27e1594d70dc2bd7199b18f2b57fa9 upstream.
The synth_event_gen_test module can be built in, if someone wants to run
the tests at boot up and not have to load them.
The synth_event_gen_test_init() function creates and enables the synthetic
events and runs its tests.
The synth_event_gen_test_exit() disables the events it created and
destroys the events.
If the module is builtin, the events are never disabled. The issue is, the
events should be disable after the tests are run. This could be an issue
if the rest of the boot up tests are enabled, as they expect the events to
be in a known state before testing. That known state happens to be
disabled.
When CONFIG_SYNTH_EVENT_GEN_TEST=y and CONFIG_EVENT_TRACE_STARTUP_TEST=y
a warning will trigger:
Running tests on trace events:
Testing event create_synth_test:
Enabled event during self test!
------------[ cut here ]------------
WARNING: CPU: 2 PID: 1 at kernel/trace/trace_events.c:4150 event_trace_self_tests+0x1c2/0x480
Modules linked in:
CPU: 2 PID: 1 Comm: swapper/0 Not tainted 6.7.0-rc2-test-00031-gb803d7c664d5-dirty #276
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:event_trace_self_tests+0x1c2/0x480
Code: bb e8 a2 ab 5d fc 48 8d 7b 48 e8 f9 3d 99 fc 48 8b 73 48 40 f6 c6 01 0f 84 d6 fe ff ff 48 c7 c7 20 b6 ad bb e8 7f ab 5d fc 90 <0f> 0b 90 48 89 df e8 d3 3d 99 fc 48 8b 1b 4c 39 f3 0f 85 2c ff ff
RSP: 0000:ffffc9000001fdc0 EFLAGS: 00010246
RAX: 0000000000000029 RBX: ffff88810399ca80 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffffb9f19478 RDI: ffff88823c734e64
RBP: ffff88810399f300 R08: 0000000000000000 R09: fffffbfff79eb32a
R10: ffffffffbcf59957 R11: 0000000000000001 R12: ffff888104068090
R13: ffffffffbc89f0a0 R14: ffffffffbc8a0f08 R15: 0000000000000078
FS: 0000000000000000(0000) GS:ffff88823c700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001f6282001 CR4: 0000000000170ef0
Call Trace:
<TASK>
? __warn+0xa5/0x200
? event_trace_self_tests+0x1c2/0x480
? report_bug+0x1f6/0x220
? handle_bug+0x6f/0x90
? exc_invalid_op+0x17/0x50
? asm_exc_invalid_op+0x1a/0x20
? tracer_preempt_on+0x78/0x1c0
? event_trace_self_tests+0x1c2/0x480
? __pfx_event_trace_self_tests_init+0x10/0x10
event_trace_self_tests_init+0x27/0xe0
do_one_initcall+0xd6/0x3c0
? __pfx_do_one_initcall+0x10/0x10
? kasan_set_track+0x25/0x30
? rcu_is_watching+0x38/0x60
kernel_init_freeable+0x324/0x450
? __pfx_kernel_init+0x10/0x10
kernel_init+0x1f/0x1e0
? _raw_spin_unlock_irq+0x33/0x50
ret_from_fork+0x34/0x60
? __pfx_kernel_init+0x10/0x10
ret_from_fork_asm+0x1b/0x30
</TASK>
This is because the synth_event_gen_test_init() left the synthetic events
that it created enabled. By having it disable them after testing, the
other selftests will run fine.
Link: https://lore.kernel.org/linux-trace-kernel/20231220111525.2f0f49b0@gandalf.local.home
Cc: stable@vger.kernel.org
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Tom Zanussi <zanussi@kernel.org>
Fixes: 9fe41efaca084 ("tracing: Add synth event generation test module")
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Reported-by: Alexander Graf <graf@amazon.com>
Tested-by: Alexander Graf <graf@amazon.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/synth_event_gen_test.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/kernel/trace/synth_event_gen_test.c
+++ b/kernel/trace/synth_event_gen_test.c
@@ -477,6 +477,17 @@ static int __init synth_event_gen_test_i
ret = test_trace_synth_event();
WARN_ON(ret);
+
+ /* Disable when done */
+ trace_array_set_clr_event(gen_synth_test->tr,
+ "synthetic",
+ "gen_synth_test", false);
+ trace_array_set_clr_event(empty_synth_test->tr,
+ "synthetic",
+ "empty_synth_test", false);
+ trace_array_set_clr_event(create_synth_test->tr,
+ "synthetic",
+ "create_synth_test", false);
out:
return ret;
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 142/156] dm-integrity: dont modify bios immutable bio_vec in integrity_metadata()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 141/156] tracing / synthetic: Disable events after testing in synth_event_gen_test_init() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 143/156] selftests: mptcp: join: fix subflow_send_ack lookup Greg Kroah-Hartman
` (22 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mikulas Patocka, Mike Snitzer
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mikulas Patocka <mpatocka@redhat.com>
commit b86f4b790c998afdbc88fe1aa55cfe89c4068726 upstream.
__bio_for_each_segment assumes that the first struct bio_vec argument
doesn't change - it calls "bio_advance_iter_single((bio), &(iter),
(bvl).bv_len)" to advance the iterator. Unfortunately, the dm-integrity
code changes the bio_vec with "bv.bv_len -= pos". When this code path
is taken, the iterator would be out of sync and dm-integrity would
report errors. This happens if the machine is out of memory and
"kmalloc" fails.
Fix this bug by making a copy of "bv" and changing the copy instead.
Fixes: 7eada909bfd7 ("dm: add integrity target")
Cc: stable@vger.kernel.org # v4.12+
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-integrity.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/md/dm-integrity.c
+++ b/drivers/md/dm-integrity.c
@@ -1765,11 +1765,12 @@ static void integrity_metadata(struct wo
sectors_to_process = dio->range.n_sectors;
__bio_for_each_segment(bv, bio, iter, dio->bio_details.bi_iter) {
+ struct bio_vec bv_copy = bv;
unsigned int pos;
char *mem, *checksums_ptr;
again:
- mem = bvec_kmap_local(&bv);
+ mem = bvec_kmap_local(&bv_copy);
pos = 0;
checksums_ptr = checksums;
do {
@@ -1778,7 +1779,7 @@ again:
sectors_to_process -= ic->sectors_per_block;
pos += ic->sectors_per_block << SECTOR_SHIFT;
sector += ic->sectors_per_block;
- } while (pos < bv.bv_len && sectors_to_process && checksums != checksums_onstack);
+ } while (pos < bv_copy.bv_len && sectors_to_process && checksums != checksums_onstack);
kunmap_local(mem);
r = dm_integrity_rw_tag(ic, checksums, &dio->metadata_block, &dio->metadata_offset,
@@ -1803,9 +1804,9 @@ again:
if (!sectors_to_process)
break;
- if (unlikely(pos < bv.bv_len)) {
- bv.bv_offset += pos;
- bv.bv_len -= pos;
+ if (unlikely(pos < bv_copy.bv_len)) {
+ bv_copy.bv_offset += pos;
+ bv_copy.bv_len -= pos;
goto again;
}
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 143/156] selftests: mptcp: join: fix subflow_send_ack lookup
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 142/156] dm-integrity: dont modify bios immutable bio_vec in integrity_metadata() Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 144/156] pinctrl: starfive: jh7110: ignore disabled device tree nodes Greg Kroah-Hartman
` (21 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Mat Martineau,
Matthieu Baerts, David S. Miller
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <geliang.tang@linux.dev>
commit c8f021eec5817601dbd25ab7e3ad5c720965c688 upstream.
MPC backups tests will skip unexpected sometimes (For example, when
compiling kernel with an older version of gcc, such as gcc-8), since
static functions like mptcp_subflow_send_ack also be listed in
/proc/kallsyms, with a 't' in front of it, not 'T' ('T' is for a global
function):
> grep "mptcp_subflow_send_ack" /proc/kallsyms
0000000000000000 T __pfx___mptcp_subflow_send_ack
0000000000000000 T __mptcp_subflow_send_ack
0000000000000000 t __pfx_mptcp_subflow_send_ack
0000000000000000 t mptcp_subflow_send_ack
In this case, mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"
will be false, MPC backups tests will skip. This is not what we expected.
The correct logic here should be: if mptcp_subflow_send_ack is not a
global function in /proc/kallsyms, do these MPC backups tests. So a 'T'
must be added in front of mptcp_subflow_send_ack.
Fixes: 632978f0a961 ("selftests: mptcp: join: skip MPC backups tests if not supported")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts <matttbe@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/tools/testing/selftests/net/mptcp/mptcp_join.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_join.sh
@@ -2773,7 +2773,7 @@ backup_tests()
fi
if reset "mpc backup" &&
- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then
+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then
pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup
speed=slow \
run_tests $ns1 $ns2 10.0.1.1
@@ -2782,7 +2782,7 @@ backup_tests()
fi
if reset "mpc backup both sides" &&
- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then
+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then
pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow,backup
pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow,backup
speed=slow \
@@ -2792,7 +2792,7 @@ backup_tests()
fi
if reset "mpc switch to backup" &&
- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then
+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then
pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow
sflags=backup speed=slow \
run_tests $ns1 $ns2 10.0.1.1
@@ -2801,7 +2801,7 @@ backup_tests()
fi
if reset "mpc switch to backup both sides" &&
- continue_if mptcp_lib_kallsyms_doesnt_have "mptcp_subflow_send_ack$"; then
+ continue_if mptcp_lib_kallsyms_doesnt_have "T mptcp_subflow_send_ack$"; then
pm_nl_add_endpoint $ns1 10.0.1.1 flags subflow
pm_nl_add_endpoint $ns2 10.0.1.2 flags subflow
sflags=backup speed=slow \
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 144/156] pinctrl: starfive: jh7110: ignore disabled device tree nodes
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 143/156] selftests: mptcp: join: fix subflow_send_ack lookup Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 145/156] pinctrl: starfive: jh7100: " Greg Kroah-Hartman
` (20 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nam Cao, Linus Walleij
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
commit f6e3b40a2c89c1d832ed9cb031dc9825bbf43b7c upstream.
The driver always registers pin configurations in device tree. This can
cause some inconvenience to users, as pin configurations in the base
device tree cannot be disabled in the device tree overlay, even when the
relevant devices are not used.
Ignore disabled pin configuration nodes in device tree.
Fixes: 447976ab62c5 ("pinctrl: starfive: Add StarFive JH7110 sys controller driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/r/fd8bf044799ae50a6291ae150ef87b4f1923cacb.1701422582.git.namcao@linutronix.de
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
+++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c
@@ -135,7 +135,7 @@ static int jh7110_dt_node_to_map(struct
int ret;
ngroups = 0;
- for_each_child_of_node(np, child)
+ for_each_available_child_of_node(np, child)
ngroups += 1;
nmaps = 2 * ngroups;
@@ -150,7 +150,7 @@ static int jh7110_dt_node_to_map(struct
nmaps = 0;
ngroups = 0;
mutex_lock(&sfp->mutex);
- for_each_child_of_node(np, child) {
+ for_each_available_child_of_node(np, child) {
int npins = of_property_count_u32_elems(child, "pinmux");
int *pins;
u32 *pinmux;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 145/156] pinctrl: starfive: jh7100: ignore disabled device tree nodes
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 144/156] pinctrl: starfive: jh7110: ignore disabled device tree nodes Greg Kroah-Hartman
@ 2023-12-30 11:59 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 146/156] bus: ti-sysc: Flush posted write only after srst_udelay Greg Kroah-Hartman
` (19 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 11:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nam Cao, Linus Walleij
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
commit 5c584f175d32f9cc66c909f851cd905da58b39ea upstream.
The driver always registers pin configurations in device tree. This can
cause some inconvenience to users, as pin configurations in the base
device tree cannot be disabled in the device tree overlay, even when the
relevant devices are not used.
Ignore disabled pin configuration nodes in device tree.
Fixes: ec648f6b7686 ("pinctrl: starfive: Add pinctrl driver for StarFive SoCs")
Cc: <stable@vger.kernel.org>
Signed-off-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/r/fe4c15dcc3074412326b8dc296b0cbccf79c49bf.1701422582.git.namcao@linutronix.de
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c
+++ b/drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c
@@ -492,7 +492,7 @@ static int starfive_dt_node_to_map(struc
nmaps = 0;
ngroups = 0;
- for_each_child_of_node(np, child) {
+ for_each_available_child_of_node(np, child) {
int npinmux = of_property_count_u32_elems(child, "pinmux");
int npins = of_property_count_u32_elems(child, "pins");
@@ -527,7 +527,7 @@ static int starfive_dt_node_to_map(struc
nmaps = 0;
ngroups = 0;
mutex_lock(&sfp->mutex);
- for_each_child_of_node(np, child) {
+ for_each_available_child_of_node(np, child) {
int npins;
int i;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 146/156] bus: ti-sysc: Flush posted write only after srst_udelay
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2023-12-30 11:59 ` [PATCH 6.6 145/156] pinctrl: starfive: jh7100: " Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 147/156] gpio: dwapb: mask/unmask IRQ when disable/enale it Greg Kroah-Hartman
` (18 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tony Lindgren
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit f71f6ff8c1f682a1cae4e8d7bdeed9d7f76b8f75 upstream.
Commit 34539b442b3b ("bus: ti-sysc: Flush posted write on enable before
reset") caused a regression reproducable on omap4 duovero where the ISS
target module can produce interconnect errors on boot. Turns out the
registers are not accessible until after a delay for devices needing
a ti,sysc-delay-us value.
Let's fix this by flushing the posted write only after the reset delay.
We do flushing also for ti,sysc-delay-us using devices as that should
trigger an interconnect error if the delay is not properly configured.
Let's also add some comments while at it.
Fixes: 34539b442b3b ("bus: ti-sysc: Flush posted write on enable before reset")
Cc: stable@vger.kernel.org
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/bus/ti-sysc.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
--- a/drivers/bus/ti-sysc.c
+++ b/drivers/bus/ti-sysc.c
@@ -2158,13 +2158,23 @@ static int sysc_reset(struct sysc *ddata
sysc_val = sysc_read_sysconfig(ddata);
sysc_val |= sysc_mask;
sysc_write(ddata, sysc_offset, sysc_val);
- /* Flush posted write */
+
+ /*
+ * Some devices need a delay before reading registers
+ * after reset. Presumably a srst_udelay is not needed
+ * for devices that use a rstctrl register reset.
+ */
+ if (ddata->cfg.srst_udelay)
+ fsleep(ddata->cfg.srst_udelay);
+
+ /*
+ * Flush posted write. For devices needing srst_udelay
+ * this should trigger an interconnect error if the
+ * srst_udelay value is needed but not configured.
+ */
sysc_val = sysc_read_sysconfig(ddata);
}
- if (ddata->cfg.srst_udelay)
- fsleep(ddata->cfg.srst_udelay);
-
if (ddata->post_reset_quirk)
ddata->post_reset_quirk(ddata);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 147/156] gpio: dwapb: mask/unmask IRQ when disable/enale it
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 146/156] bus: ti-sysc: Flush posted write only after srst_udelay Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 148/156] lib/vsprintf: Fix %pfwf when current node refcount == 0 Greg Kroah-Hartman
` (17 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Riwen Lu, xiongxin,
Serge Semin, Andy Shevchenko, Bartosz Golaszewski
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: xiongxin <xiongxin@kylinos.cn>
commit 1cc3542c76acb5f59001e3e562eba672f1983355 upstream.
In the hardware implementation of the I2C HID driver based on DesignWare
GPIO IRQ chip, when the user continues to use the I2C HID device in the
suspend process, the I2C HID interrupt will be masked after the resume
process is finished.
This is because the disable_irq()/enable_irq() of the DesignWare GPIO
driver does not synchronize the IRQ mask register state. In normal use
of the I2C HID procedure, the GPIO IRQ irq_mask()/irq_unmask() functions
are called in pairs. In case of an exception, i2c_hid_core_suspend()
calls disable_irq() to disable the GPIO IRQ. With low probability, this
causes irq_unmask() to not be called, which causes the GPIO IRQ to be
masked and not unmasked in enable_irq(), raising an exception.
Add synchronization to the masked register state in the
dwapb_irq_enable()/dwapb_irq_disable() function. mask the GPIO IRQ
before disabling it. After enabling the GPIO IRQ, unmask the IRQ.
Fixes: 7779b3455697 ("gpio: add a driver for the Synopsys DesignWare APB GPIO block")
Cc: stable@kernel.org
Co-developed-by: Riwen Lu <luriwen@kylinos.cn>
Signed-off-by: Riwen Lu <luriwen@kylinos.cn>
Signed-off-by: xiongxin <xiongxin@kylinos.cn>
Acked-by: Serge Semin <fancer.lancer@gmail.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Signed-off-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpio/gpio-dwapb.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/gpio/gpio-dwapb.c
+++ b/drivers/gpio/gpio-dwapb.c
@@ -283,13 +283,15 @@ static void dwapb_irq_enable(struct irq_
{
struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
struct dwapb_gpio *gpio = to_dwapb_gpio(gc);
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
unsigned long flags;
u32 val;
raw_spin_lock_irqsave(&gc->bgpio_lock, flags);
- val = dwapb_read(gpio, GPIO_INTEN);
- val |= BIT(irqd_to_hwirq(d));
+ val = dwapb_read(gpio, GPIO_INTEN) | BIT(hwirq);
dwapb_write(gpio, GPIO_INTEN, val);
+ val = dwapb_read(gpio, GPIO_INTMASK) & ~BIT(hwirq);
+ dwapb_write(gpio, GPIO_INTMASK, val);
raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
}
@@ -297,12 +299,14 @@ static void dwapb_irq_disable(struct irq
{
struct gpio_chip *gc = irq_data_get_irq_chip_data(d);
struct dwapb_gpio *gpio = to_dwapb_gpio(gc);
+ irq_hw_number_t hwirq = irqd_to_hwirq(d);
unsigned long flags;
u32 val;
raw_spin_lock_irqsave(&gc->bgpio_lock, flags);
- val = dwapb_read(gpio, GPIO_INTEN);
- val &= ~BIT(irqd_to_hwirq(d));
+ val = dwapb_read(gpio, GPIO_INTMASK) | BIT(hwirq);
+ dwapb_write(gpio, GPIO_INTMASK, val);
+ val = dwapb_read(gpio, GPIO_INTEN) & ~BIT(hwirq);
dwapb_write(gpio, GPIO_INTEN, val);
raw_spin_unlock_irqrestore(&gc->bgpio_lock, flags);
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 148/156] lib/vsprintf: Fix %pfwf when current node refcount == 0
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 147/156] gpio: dwapb: mask/unmask IRQ when disable/enale it Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 149/156] thunderbolt: Fix memory leak in margining_port_remove() Greg Kroah-Hartman
` (16 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herve Codina, Sakari Ailus,
Andy Shevchenko, Petr Mladek
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herve Codina <herve.codina@bootlin.com>
commit 5c47251e8c4903111608ddcba2a77c0c425c247c upstream.
A refcount issue can appeared in __fwnode_link_del() due to the
pr_debug() call:
WARNING: CPU: 0 PID: 901 at lib/refcount.c:25 refcount_warn_saturate+0xe5/0x110
Call Trace:
<TASK>
...
of_node_get+0x1e/0x30
of_fwnode_get+0x28/0x40
fwnode_full_name_string+0x34/0x90
fwnode_string+0xdb/0x140
...
vsnprintf+0x17b/0x630
...
__fwnode_link_del+0x25/0xa0
fwnode_links_purge+0x39/0xb0
of_node_release+0xd9/0x180
...
Indeed, an fwnode (of_node) is being destroyed and so, of_node_release()
is called because the of_node refcount reached 0.
>From of_node_release() several function calls are done and lead to
a pr_debug() calls with %pfwf to print the fwnode full name.
The issue is not present if we change %pfwf to %pfwP.
To print the full name, %pfwf iterates over the current node and its
parents and obtain/drop a reference to all nodes involved.
In order to allow to print the full name (%pfwf) of a node while it is
being destroyed, do not obtain/drop a reference to this current node.
Fixes: a92eb7621b9f ("lib/vsprintf: Make use of fwnode API to obtain node names and separators")
Cc: stable@vger.kernel.org
Signed-off-by: Herve Codina <herve.codina@bootlin.com>
Reviewed-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20231114152655.409331-1-herve.codina@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/vsprintf.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -2110,15 +2110,20 @@ char *fwnode_full_name_string(struct fwn
/* Loop starting from the root node to the current node. */
for (depth = fwnode_count_parents(fwnode); depth >= 0; depth--) {
- struct fwnode_handle *__fwnode =
- fwnode_get_nth_parent(fwnode, depth);
+ /*
+ * Only get a reference for other nodes (i.e. parent nodes).
+ * fwnode refcount may be 0 here.
+ */
+ struct fwnode_handle *__fwnode = depth ?
+ fwnode_get_nth_parent(fwnode, depth) : fwnode;
buf = string(buf, end, fwnode_get_name_prefix(__fwnode),
default_str_spec);
buf = string(buf, end, fwnode_get_name(__fwnode),
default_str_spec);
- fwnode_handle_put(__fwnode);
+ if (depth)
+ fwnode_handle_put(__fwnode);
}
return buf;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 149/156] thunderbolt: Fix memory leak in margining_port_remove()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 148/156] lib/vsprintf: Fix %pfwf when current node refcount == 0 Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 150/156] KVM: arm64: vgic: Simplify kvm_vgic_destroy() Greg Kroah-Hartman
` (15 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yaxiong Tian, Mika Westerberg
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yaxiong Tian <tianyaxiong@kylinos.cn>
commit ac43c9122e4287bbdbe91e980fc2528acb72cc1e upstream.
The dentry returned by debugfs_lookup() needs to be released by calling
dput() which is missing in margining_port_remove(). Fix this by calling
debugfs_lookup_and_remove() that combines both and avoids the memory leak.
Fixes: d0f1e0c2a699 ("thunderbolt: Add support for receiver lane margining")
Cc: stable@vger.kernel.org
Signed-off-by: Yaxiong Tian <tianyaxiong@kylinos.cn>
Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thunderbolt/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/thunderbolt/debugfs.c
+++ b/drivers/thunderbolt/debugfs.c
@@ -959,7 +959,7 @@ static void margining_port_remove(struct
snprintf(dir_name, sizeof(dir_name), "port%d", port->port);
parent = debugfs_lookup(dir_name, port->sw->debugfs_dir);
if (parent)
- debugfs_remove_recursive(debugfs_lookup("margining", parent));
+ debugfs_lookup_and_remove("margining", parent);
kfree(port->usb4->margining);
port->usb4->margining = NULL;
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 150/156] KVM: arm64: vgic: Simplify kvm_vgic_destroy()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 149/156] thunderbolt: Fix memory leak in margining_port_remove() Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 151/156] KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() Greg Kroah-Hartman
` (14 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Oliver Upton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit 01ad29d224ff73bc4e16e0ef9ece17f28598c4a4 upstream.
When destroying a vgic, we have rather cumbersome rules about
when slots_lock and config_lock are held, resulting in fun
buglets.
The first port of call is to simplify kvm_vgic_map_resources()
so that there is only one call to kvm_vgic_destroy() instead of
two, with the second only holding half of the locks.
For that, we kill the non-locking primitive and move the call
outside of the locking altogether. This doesn't change anything
(we re-acquire the locks and teardown the whole vgic), and
simplifies the code significantly.
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20231207151201.3028710-2-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-init.c | 29 ++++++++++++++---------------
1 file changed, 14 insertions(+), 15 deletions(-)
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -382,26 +382,24 @@ void kvm_vgic_vcpu_destroy(struct kvm_vc
vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
}
-static void __kvm_vgic_destroy(struct kvm *kvm)
+void kvm_vgic_destroy(struct kvm *kvm)
{
struct kvm_vcpu *vcpu;
unsigned long i;
- lockdep_assert_held(&kvm->arch.config_lock);
+ mutex_lock(&kvm->slots_lock);
vgic_debug_destroy(kvm);
kvm_for_each_vcpu(i, vcpu, kvm)
kvm_vgic_vcpu_destroy(vcpu);
+ mutex_lock(&kvm->arch.config_lock);
+
kvm_vgic_dist_destroy(kvm);
-}
-void kvm_vgic_destroy(struct kvm *kvm)
-{
- mutex_lock(&kvm->arch.config_lock);
- __kvm_vgic_destroy(kvm);
mutex_unlock(&kvm->arch.config_lock);
+ mutex_unlock(&kvm->slots_lock);
}
/**
@@ -469,25 +467,26 @@ int kvm_vgic_map_resources(struct kvm *k
type = VGIC_V3;
}
- if (ret) {
- __kvm_vgic_destroy(kvm);
+ if (ret)
goto out;
- }
+
dist->ready = true;
dist_base = dist->vgic_dist_base;
mutex_unlock(&kvm->arch.config_lock);
ret = vgic_register_dist_iodev(kvm, dist_base, type);
- if (ret) {
+ if (ret)
kvm_err("Unable to register VGIC dist MMIO regions\n");
- kvm_vgic_destroy(kvm);
- }
- mutex_unlock(&kvm->slots_lock);
- return ret;
+ goto out_slots;
out:
mutex_unlock(&kvm->arch.config_lock);
+out_slots:
mutex_unlock(&kvm->slots_lock);
+
+ if (ret)
+ kvm_vgic_destroy(kvm);
+
return ret;
}
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 151/156] KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy()
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 150/156] KVM: arm64: vgic: Simplify kvm_vgic_destroy() Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 152/156] KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy Greg Kroah-Hartman
` (13 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Oliver Upton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit d26b9cb33c2d1ba68d1f26bb06c40300f16a3799 upstream.
As we are going to need to call into kvm_vgic_vcpu_destroy() without
prior holding of the slots_lock, introduce __kvm_vgic_vcpu_destroy()
as a non-locking primitive of kvm_vgic_vcpu_destroy().
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20231207151201.3028710-3-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-init.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -368,7 +368,7 @@ static void kvm_vgic_dist_destroy(struct
vgic_v4_teardown(kvm);
}
-void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
+static void __kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
{
struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu;
@@ -382,6 +382,15 @@ void kvm_vgic_vcpu_destroy(struct kvm_vc
vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
}
+void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
+{
+ struct kvm *kvm = vcpu->kvm;
+
+ mutex_lock(&kvm->slots_lock);
+ __kvm_vgic_vcpu_destroy(vcpu);
+ mutex_unlock(&kvm->slots_lock);
+}
+
void kvm_vgic_destroy(struct kvm *kvm)
{
struct kvm_vcpu *vcpu;
@@ -392,7 +401,7 @@ void kvm_vgic_destroy(struct kvm *kvm)
vgic_debug_destroy(kvm);
kvm_for_each_vcpu(i, vcpu, kvm)
- kvm_vgic_vcpu_destroy(vcpu);
+ __kvm_vgic_vcpu_destroy(vcpu);
mutex_lock(&kvm->arch.config_lock);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 152/156] KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 151/156] KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 153/156] x86/alternatives: Sync core before enabling interrupts Greg Kroah-Hartman
` (12 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Marc Zyngier, Oliver Upton
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit 02e3858f08faabab9503ae2911cf7c7e27702257 upstream.
When failing to create a vcpu because (for example) it has a
duplicate vcpu_id, we destroy the vcpu. Amusingly, this leaves
the redistributor registered with the KVM_MMIO bus.
This is no good, and we should properly clean the mess. Force
a teardown of the vgic vcpu interface, including the RD device
before returning to the caller.
Cc: stable@vger.kernel.org
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20231207151201.3028710-4-maz@kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/arm.c | 2 +-
arch/arm64/kvm/vgic/vgic-init.c | 5 ++++-
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +-
arch/arm64/kvm/vgic/vgic.h | 1 +
4 files changed, 7 insertions(+), 3 deletions(-)
--- a/arch/arm64/kvm/arm.c
+++ b/arch/arm64/kvm/arm.c
@@ -407,7 +407,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vc
kvm_mmu_free_memory_cache(&vcpu->arch.mmu_page_cache);
kvm_timer_vcpu_terminate(vcpu);
kvm_pmu_vcpu_destroy(vcpu);
-
+ kvm_vgic_vcpu_destroy(vcpu);
kvm_arm_vcpu_destroy(vcpu);
}
--- a/arch/arm64/kvm/vgic/vgic-init.c
+++ b/arch/arm64/kvm/vgic/vgic-init.c
@@ -379,7 +379,10 @@ static void __kvm_vgic_vcpu_destroy(stru
vgic_flush_pending_lpis(vcpu);
INIT_LIST_HEAD(&vgic_cpu->ap_list_head);
- vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
+ if (vcpu->kvm->arch.vgic.vgic_model == KVM_DEV_TYPE_ARM_VGIC_V3) {
+ vgic_unregister_redist_iodev(vcpu);
+ vgic_cpu->rd_iodev.base_addr = VGIC_ADDR_UNDEF;
+ }
}
void kvm_vgic_vcpu_destroy(struct kvm_vcpu *vcpu)
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -820,7 +820,7 @@ out_unlock:
return ret;
}
-static void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu)
+void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu)
{
struct vgic_io_device *rd_dev = &vcpu->arch.vgic_cpu.rd_iodev;
--- a/arch/arm64/kvm/vgic/vgic.h
+++ b/arch/arm64/kvm/vgic/vgic.h
@@ -241,6 +241,7 @@ int vgic_v3_lpi_sync_pending_status(stru
int vgic_v3_save_pending_tables(struct kvm *kvm);
int vgic_v3_set_redist_base(struct kvm *kvm, u32 index, u64 addr, u32 count);
int vgic_register_redist_iodev(struct kvm_vcpu *vcpu);
+void vgic_unregister_redist_iodev(struct kvm_vcpu *vcpu);
bool vgic_v3_check_base(struct kvm *kvm);
void vgic_v3_load(struct kvm_vcpu *vcpu);
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 153/156] x86/alternatives: Sync core before enabling interrupts
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 152/156] KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 154/156] x86/alternatives: Disable interrupts and sync when optimizing NOPs in place Greg Kroah-Hartman
` (11 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Gleixner,
Borislav Petkov (AMD), Peter Zijlstra (Intel), stable
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 3ea1704a92967834bf0e64ca1205db4680d04048 upstream.
text_poke_early() does:
local_irq_save(flags);
memcpy(addr, opcode, len);
local_irq_restore(flags);
sync_core();
That's not really correct because the synchronization should happen before
interrupts are re-enabled to ensure that a pending interrupt observes the
complete update of the opcodes.
It's not entirely clear whether the interrupt entry provides enough
serialization already, but moving the sync_core() invocation into interrupt
disabled region does no harm and is obviously correct.
Fixes: 6fffacb30349 ("x86/alternatives, jumplabel: Use text_poke_early() before mm_init()")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: <stable@kernel.org>
Link: https://lore.kernel.org/r/ZT6narvE%2BLxX%2B7Be@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/alternative.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -1685,8 +1685,8 @@ void __init_or_module text_poke_early(vo
} else {
local_irq_save(flags);
memcpy(addr, opcode, len);
- local_irq_restore(flags);
sync_core();
+ local_irq_restore(flags);
/*
* Could also do a CLFLUSH here to speed up CPU recovery; but
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 154/156] x86/alternatives: Disable interrupts and sync when optimizing NOPs in place
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 153/156] x86/alternatives: Sync core before enabling interrupts Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 155/156] x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Greg Kroah-Hartman
` (10 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Gortmaker, Thomas Gleixner,
Borislav Petkov (AMD), Peter Zijlstra (Intel)
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 2dc4196138055eb0340231aecac4d78c2ec2bea5 upstream.
apply_alternatives() treats alternatives with the ALT_FLAG_NOT flag set
special as it optimizes the existing NOPs in place.
Unfortunately, this happens with interrupts enabled and does not provide any
form of core synchronization.
So an interrupt hitting in the middle of the update and using the affected code
path will observe a half updated NOP and crash and burn. The following
3 NOP sequence was observed to expose this crash halfway reliably under QEMU
32bit:
0x90 0x90 0x90
which is replaced by the optimized 3 byte NOP:
0x8d 0x76 0x00
So an interrupt can observe:
1) 0x90 0x90 0x90 nop nop nop
2) 0x8d 0x90 0x90 undefined
3) 0x8d 0x76 0x90 lea -0x70(%esi),%esi
4) 0x8d 0x76 0x00 lea 0x0(%esi),%esi
Where only #1 and #4 are true NOPs. The same problem exists for 64bit obviously.
Disable interrupts around this NOP optimization and invoke sync_core()
before re-enabling them.
Fixes: 270a69c4485d ("x86/alternative: Support relocations in alternatives")
Reported-by: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/ZT6narvE%2BLxX%2B7Be@windriver.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/alternative.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c
index fd44739828f7..aae7456ece07 100644
--- a/arch/x86/kernel/alternative.c
+++ b/arch/x86/kernel/alternative.c
@@ -255,6 +255,16 @@ static void __init_or_module noinline optimize_nops(u8 *instr, size_t len)
}
}
+static void __init_or_module noinline optimize_nops_inplace(u8 *instr, size_t len)
+{
+ unsigned long flags;
+
+ local_irq_save(flags);
+ optimize_nops(instr, len);
+ sync_core();
+ local_irq_restore(flags);
+}
+
/*
* In this context, "source" is where the instructions are placed in the
* section .altinstr_replacement, for example during kernel build by the
@@ -438,7 +448,7 @@ void __init_or_module noinline apply_alternatives(struct alt_instr *start,
* patch if feature is *NOT* present.
*/
if (!boot_cpu_has(a->cpuid) == !(a->flags & ALT_FLAG_NOT)) {
- optimize_nops(instr, a->instrlen);
+ optimize_nops_inplace(instr, a->instrlen);
continue;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 177+ messages in thread
* [PATCH 6.6 155/156] x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 154/156] x86/alternatives: Disable interrupts and sync when optimizing NOPs in place Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 156/156] spi: cadence: revert "Add SPI transfer delays" Greg Kroah-Hartman
` (9 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Lindee, Thomas Gleixner,
Borislav Petkov (AMD), Ashok Raj
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit 69a7386c1ec25476a0c78ffeb59de08a2a08f495 upstream.
Chris reported that a Dell PowerEdge T340 system stopped to boot when upgrading
to a kernel which contains the parallel hotplug changes. Disabling parallel
hotplug on the kernel command line makes it boot again.
It turns out that the Dell BIOS has x2APIC enabled and the boot CPU comes up in
X2APIC mode, but the APs come up inconsistently in xAPIC mode.
Parallel hotplug requires that the upcoming CPU reads out its APIC ID from the
local APIC in order to map it to the Linux CPU number.
In this particular case the readout on the APs uses the MMIO mapped registers
because the BIOS failed to enable x2APIC mode. That readout results in a page
fault because the kernel does not have the APIC MMIO space mapped when X2APIC
mode was enabled by the BIOS on the boot CPU and the kernel switched to X2APIC
mode early. That page fault can't be handled on the upcoming CPU that early and
results in a silent boot failure.
If parallel hotplug is disabled the system boots because in that case the APIC
ID read is not required as the Linux CPU number is provided to the AP in the
smpboot control word. When the kernel uses x2APIC mode then the APs are
switched to x2APIC mode too slightly later in the bringup process, but there is
no reason to do it that late.
Cure the BIOS bogosity by checking in the parallel bootup path whether the
kernel uses x2APIC mode and if so switching over the APs to x2APIC mode before
the APIC ID readout.
Fixes: 0c7ffa32dbd6 ("x86/smpboot/64: Implement arch_cpuhp_init_parallel_bringup() and enable it")
Reported-by: Chris Lindee <chris.lindee@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Ashok Raj <ashok.raj@intel.com>
Tested-by: Chris Lindee <chris.lindee@gmail.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/CA%2B2tU59853R49EaU_tyvOZuOTDdcU0RshGyydccp9R1NX9bEeQ@mail.gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/head_64.S | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -256,6 +256,22 @@ SYM_INNER_LABEL(secondary_startup_64_no_
testl $X2APIC_ENABLE, %eax
jnz .Lread_apicid_msr
+#ifdef CONFIG_X86_X2APIC
+ /*
+ * If system is in X2APIC mode then MMIO base might not be
+ * mapped causing the MMIO read below to fault. Faults can't
+ * be handled at that point.
+ */
+ cmpl $0, x2apic_mode(%rip)
+ jz .Lread_apicid_mmio
+
+ /* Force the AP into X2APIC mode. */
+ orl $X2APIC_ENABLE, %eax
+ wrmsr
+ jmp .Lread_apicid_msr
+#endif
+
+.Lread_apicid_mmio:
/* Read the APIC ID from the fix-mapped MMIO space. */
movq apic_mmio_base(%rip), %rcx
addq $APIC_ID, %rcx
^ permalink raw reply [flat|nested] 177+ messages in thread
* [PATCH 6.6 156/156] spi: cadence: revert "Add SPI transfer delays"
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 155/156] x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Greg Kroah-Hartman
@ 2023-12-30 12:00 ` Greg Kroah-Hartman
2023-12-30 12:59 ` [PATCH 6.6 000/156] 6.6.9-rc1 review Ricardo B. Marliere
` (8 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-30 12:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nam Cao, Mark Brown
6.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
commit 7a733e060bd20edb63b1f27f0b29cf9b184e0e8b upstream.
The commit 855a40cd8ccc ("spi: cadence: Add SPI transfer delays") adds a
delay after each transfer into the driver's transfer_one(). However,
the delay is already done in SPI core. So this commit unnecessarily
doubles the delay amount. Revert this commit.
Signed-off-by: Nam Cao <namcao@linutronix.de>
Link: https://lore.kernel.org/r/20231206145233.74982-1-namcao@linutronix.de
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-cadence.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/spi/spi-cadence.c
+++ b/drivers/spi/spi-cadence.c
@@ -451,7 +451,6 @@ static int cdns_transfer_one(struct spi_
udelay(10);
cdns_spi_process_fifo(xspi, xspi->tx_fifo_depth, 0);
- spi_transfer_delay_exec(transfer);
cdns_spi_write(xspi, CDNS_SPI_IER, CDNS_SPI_IXR_DEFAULT);
return transfer->len;
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2023-12-30 12:00 ` [PATCH 6.6 156/156] spi: cadence: revert "Add SPI transfer delays" Greg Kroah-Hartman
@ 2023-12-30 12:59 ` Ricardo B. Marliere
2023-12-30 15:05 ` Takeshi Ogasawara
` (7 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Ricardo B. Marliere @ 2023-12-30 12:59 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
On 23/12/30 11:57AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
System runs fine, no noticeable regressions.
[ 0.000000] Linux version 6.6.9-rc1-ktest+ (rbmarliere@debian) (gcc (Debian 13.2.0-9) 13.2.0, GNU ld (GNU Binutils for Debian) 2.41.50.20231227) #1 SMP PREEMPT_DYNAMIC Sat Dec 30 08:42:24 -03 2023
Tested-by: Ricardo B. Marliere <ricardo@marliere.net>
Thanks,
- Ricardo
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2023-12-30 12:59 ` [PATCH 6.6 000/156] 6.6.9-rc1 review Ricardo B. Marliere
@ 2023-12-30 15:05 ` Takeshi Ogasawara
2023-12-30 16:59 ` Florian Fainelli
` (6 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Takeshi Ogasawara @ 2023-12-30 15:05 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
Hi Greg
On Sat, Dec 30, 2023 at 9:01 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
6.6.9-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
[ 0.000000] Linux version 6.6.9-rc1rv
(takeshi@ThinkPadX1Gen10J0764) (gcc (GCC) 13.2.1 20230801, GNU ld (GNU
Binutils) 2.41.0) #1 SMP PREEMPT_DYNAMIC Sat Dec 30 23:43:57 JST 2023
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
@ 2023-12-30 16:57 Ronald Warsow
0 siblings, 0 replies; 177+ messages in thread
From: Ronald Warsow @ 2023-12-30 16:57 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable; +Cc: linux-kernel
Hi Greg
no regressions here on x86_64
(Intel Rocket Lake: i5-11400)
Thanks
Tested-by: Ronald Warsow <rwarsow@gmx.de>
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2023-12-30 15:05 ` Takeshi Ogasawara
@ 2023-12-30 16:59 ` Florian Fainelli
2023-12-30 18:11 ` SeongJae Park
` (5 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Florian Fainelli @ 2023-12-30 16:59 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor, allen.lkml
On 12/30/2023 12:57 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMST using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2023-12-30 16:59 ` Florian Fainelli
@ 2023-12-30 18:11 ` SeongJae Park
2023-12-31 1:03 ` Ron Economos
` (4 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: SeongJae Park @ 2023-12-30 18:11 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml, damon,
SeongJae Park
Hello,
On Sat, 30 Dec 2023 11:57:34 +0000 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine.
Attaching the test results summary below. Please note that I retrieved the
kernel from linux-stable-rc tree[2].
Tested-by: SeongJae Park <sj@kernel.org>
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] ac5757a323d0 ("Linux 6.6.9-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 2 selftests: damon: debugfs_schemes.sh
ok 3 selftests: damon: debugfs_target_ids.sh
ok 4 selftests: damon: debugfs_empty_targets.sh
ok 5 selftests: damon: debugfs_huge_count_read_write.sh
ok 6 selftests: damon: debugfs_duplicate_context_creation.sh
ok 7 selftests: damon: debugfs_rm_non_contexts.sh
ok 8 selftests: damon: sysfs.sh
ok 9 selftests: damon: sysfs_update_removed_scheme_dir.sh
ok 10 selftests: damon: reclaim.sh
ok 11 selftests: damon: lru_sort.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh
ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_i386_idle_flag.sh
ok 13 selftests: damon-tests: build_i386_highpte.sh
ok 14 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
2023-12-30 11:59 ` [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() Greg Kroah-Hartman
@ 2023-12-30 21:47 ` Steven Rostedt
2024-01-03 10:05 ` Greg Kroah-Hartman
0 siblings, 1 reply; 177+ messages in thread
From: Steven Rostedt @ 2023-12-30 21:47 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Joel Fernandes, Vincent Donnefort, Sasha Levin
On Sat, 30 Dec 2023 11:59:47 +0000
Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 6.6-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Steven Rostedt (Google) <rostedt@goodmis.org>
>
> [ Upstream commit 083e9f65bd215582bf8f6a920db729fadf16704f ]
BTW, here's a fix for 6.1 and 5.15
-- Steve
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 61803208706a..dae2d4511d46 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2981,25 +2981,6 @@ static unsigned rb_calculate_event_length(unsigned length)
return length;
}
-static u64 rb_time_delta(struct ring_buffer_event *event)
-{
- switch (event->type_len) {
- case RINGBUF_TYPE_PADDING:
- return 0;
-
- case RINGBUF_TYPE_TIME_EXTEND:
- return rb_event_time_stamp(event);
-
- case RINGBUF_TYPE_TIME_STAMP:
- return 0;
-
- case RINGBUF_TYPE_DATA:
- return event->time_delta;
- default:
- return 0;
- }
-}
-
static inline int
rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
struct ring_buffer_event *event)
@@ -3008,8 +2989,6 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
struct buffer_page *bpage;
unsigned long index;
unsigned long addr;
- u64 write_stamp;
- u64 delta;
new_index = rb_event_index(event);
old_index = new_index + rb_event_ts_length(event);
@@ -3018,14 +2997,10 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
bpage = READ_ONCE(cpu_buffer->tail_page);
- delta = rb_time_delta(event);
-
- if (!rb_time_read(&cpu_buffer->write_stamp, &write_stamp))
- return 0;
-
- /* Make sure the write stamp is read before testing the location */
- barrier();
-
+ /*
+ * Make sure the tail_page is still the same and
+ * the next write location is the end of this event
+ */
if (bpage->page == (void *)addr && rb_page_write(bpage) == old_index) {
unsigned long write_mask =
local_read(&bpage->write) & ~RB_WRITE_MASK;
@@ -3036,20 +3011,20 @@ rb_try_to_discard(struct ring_buffer_per_cpu *cpu_buffer,
* to make sure that the next event adds an absolute
* value and does not rely on the saved write stamp, which
* is now going to be bogus.
+ *
+ * By setting the before_stamp to zero, the next event
+ * is not going to use the write_stamp and will instead
+ * create an absolute timestamp. This means there's no
+ * reason to update the wirte_stamp!
*/
rb_time_set(&cpu_buffer->before_stamp, 0);
- /* Something came in, can't discard */
- if (!rb_time_cmpxchg(&cpu_buffer->write_stamp,
- write_stamp, write_stamp - delta))
- return 0;
-
/*
* If an event were to come in now, it would see that the
* write_stamp and the before_stamp are different, and assume
* that this event just added itself before updating
* the write stamp. The interrupting event will fix the
- * write stamp for us, and use the before stamp as its delta.
+ * write stamp for us, and use an absolute timestamp.
*/
/*
@@ -3488,7 +3463,7 @@ static void check_buffer(struct ring_buffer_per_cpu *cpu_buffer,
return;
/*
- * If this interrupted another event,
+ * If this interrupted another event,
*/
if (atomic_inc_return(this_cpu_ptr(&checking)) != 1)
goto out;
^ permalink raw reply related [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2023-12-30 18:11 ` SeongJae Park
@ 2023-12-31 1:03 ` Ron Economos
2023-12-31 3:18 ` Luna Jernberg
` (3 subsequent siblings)
164 siblings, 0 replies; 177+ messages in thread
From: Ron Economos @ 2023-12-31 1:03 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml
On 12/30/23 3:57 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2023-12-31 1:03 ` Ron Economos
@ 2023-12-31 3:18 ` Luna Jernberg
2023-12-31 9:18 ` Greg Kroah-Hartman
2023-12-31 8:10 ` Bagas Sanjaya
` (2 subsequent siblings)
164 siblings, 1 reply; 177+ messages in thread
From: Luna Jernberg @ 2023-12-31 3:18 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
Did not work for me on Debian testing on a Thinkpad Edge i3 laptop
just booted me to busybox
Den lör 30 dec. 2023 kl 13:01 skrev Greg Kroah-Hartman
<gregkh@linuxfoundation.org>:
>
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.6.9-rc1
>
> Nam Cao <namcao@linutronix.de>
> spi: cadence: revert "Add SPI transfer delays"
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/alternatives: Disable interrupts and sync when optimizing NOPs in place
>
> Thomas Gleixner <tglx@linutronix.de>
> x86/alternatives: Sync core before enabling interrupts
>
> Marc Zyngier <maz@kernel.org>
> KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy
>
> Marc Zyngier <maz@kernel.org>
> KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy()
>
> Marc Zyngier <maz@kernel.org>
> KVM: arm64: vgic: Simplify kvm_vgic_destroy()
>
> Yaxiong Tian <tianyaxiong@kylinos.cn>
> thunderbolt: Fix memory leak in margining_port_remove()
>
> Herve Codina <herve.codina@bootlin.com>
> lib/vsprintf: Fix %pfwf when current node refcount == 0
>
> xiongxin <xiongxin@kylinos.cn>
> gpio: dwapb: mask/unmask IRQ when disable/enale it
>
> Tony Lindgren <tony@atomide.com>
> bus: ti-sysc: Flush posted write only after srst_udelay
>
> Nam Cao <namcao@linutronix.de>
> pinctrl: starfive: jh7100: ignore disabled device tree nodes
>
> Nam Cao <namcao@linutronix.de>
> pinctrl: starfive: jh7110: ignore disabled device tree nodes
>
> Geliang Tang <geliang.tang@linux.dev>
> selftests: mptcp: join: fix subflow_send_ack lookup
>
> Mikulas Patocka <mpatocka@redhat.com>
> dm-integrity: don't modify bio's immutable bio_vec in integrity_metadata()
>
> Steven Rostedt (Google) <rostedt@goodmis.org>
> tracing / synthetic: Disable events after testing in synth_event_gen_test_init()
>
> Alexander Atanasov <alexander.atanasov@virtuozzo.com>
> scsi: core: Always send batch on reset or error handling command
>
> Martin K. Petersen <martin.petersen@oracle.com>
> Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
>
> Rafał Miłecki <rafal@milecki.pl>
> nvmem: brcm_nvram: store a copy of NVRAM content
>
> Louis Chauvet <louis.chauvet@bootlin.com>
> spi: atmel: Fix clock issue when using devices with different polarities
>
> Miquel Raynal <miquel.raynal@bootlin.com>
> spi: atmel: Prevent spi transfers from being killed
>
> Miquel Raynal <miquel.raynal@bootlin.com>
> spi: atmel: Do not cancel a transfer upon any signal
>
> Steven Rostedt (Google) <rostedt@goodmis.org>
> ring-buffer: Fix slowpath of interrupted event
>
> Steven Rostedt (Google) <rostedt@goodmis.org>
> ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
>
> Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
> ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg()
>
> JP Kobryn <inwardvessel@gmail.com>
> 9p: prevent read overrun in protocol dump tracepoint
>
> Ville Syrjälä <ville.syrjala@linux.intel.com>
> drm/i915/dmc: Don't enable any pipe DMC events
>
> Ville Syrjälä <ville.syrjala@linux.intel.com>
> drm/i915: Reject async flips with bigjoiner
>
> Paulo Alcantara <pc@manguebit.com>
> smb: client: fix OOB in smbCalcSize()
>
> Paulo Alcantara <pc@manguebit.com>
> smb: client: fix OOB in SMB2_query_info_init()
>
> Paulo Alcantara <pc@manguebit.com>
> smb: client: fix potential OOB in cifs_dump_detail()
>
> Paulo Alcantara <pc@manguebit.com>
> smb: client: fix OOB in cifsd when receiving compounded resps
>
> NeilBrown <neilb@suse.de>
> nfsd: call nfsd_last_thread() before final nfsd_put()
>
> Fabio Estevam <festevam@denx.de>
> dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp
>
> Lai Peter Jun Ann <jun.ann.lai@intel.com>
> net: stmmac: fix incorrect flag check in timestamp interrupt
>
> Thomas Weißschuh <linux@weissschuh.net>
> net: avoid build bug in skb extension length calculation
>
> Ronald Wahl <ronald.wahl@raritan.com>
> net: ks8851: Fix TX stall caused by TX buffer overrun
>
> Rouven Czerwinski <r.czerwinski@pengutronix.de>
> net: rfkill: gpio: set GPIO direction
>
> Fedor Pchelkin <pchelkin@ispras.ru>
> net: 9p: avoid freeing uninit memory in p9pdu_vreadf
>
> Christoffer Sandberg <cs@tuxedo.de>
> Input: soc_button_array - add mapping for airplane mode button
>
> Jose Ignacio Tornos Martinez <jtornosm@redhat.com>
> net: usb: ax88179_178a: avoid failed operations when device is disconnected
>
> Dan Carpenter <dan.carpenter@linaro.org>
> usb: fotg210-hcd: delete an incorrect bounds test
>
> Johan Hovold <johan+linaro@kernel.org>
> usb: typec: ucsi: fix gpio-based orientation detection
>
> Alex Lu <alex_lu@realsil.com.cn>
> Bluetooth: Add more enc key size check
>
> Xiao Yao <xiaoyao@rock-chips.com>
> Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE
>
> Frédéric Danis <frederic.danis@collabora.com>
> Bluetooth: L2CAP: Send reject on command corrupted request
>
> Hyunwoo Kim <v4bel@theori.io>
> Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent
>
> Gergo Koteles <soyer@irl.hu>
> ASoC: tas2781: check the validity of prm_no/cfg_no
>
> Clément Villeret <clement.villeret@gmail.com>
> ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA
>
> Gergo Koteles <soyer@irl.hu>
> ALSA: hda/tas2781: select program 0, conf 0 by default
>
> Reinhard Speyerer <rspmn@arcor.de>
> USB: serial: option: add Quectel RM500Q R13 firmware support
>
> Slark Xiao <slark_xiao@163.com>
> USB: serial: option: add Foxconn T99W265 with new baseline
>
> Alper Ak <alperyasinak1@gmail.com>
> USB: serial: option: add Quectel EG912Y module support
>
> Mark Glover <mark.glover@actisense.com>
> USB: serial: ftdi_sio: update Actisense PIDs constant names
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: cfg80211: fix certs build to not depend on file order
>
> Chen-Yu Tsai <wens@kernel.org>
> wifi: cfg80211: Add my certificate
>
> Felix Fietkau <nbd@nbd.name>
> wifi: mt76: fix crash with WED rx support enabled
>
> Tasos Sahanidis <tasos@tasossah.com>
> usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3
>
> Tony Lindgren <tony@atomide.com>
> ARM: dts: Fix occasional boot hang for am3 usb
>
> Jeremie Knuesel <knuesel@gmail.com>
> ALSA: usb-audio: Increase delay in MOTU M quirk
>
> David Lechner <dlechner@baylibre.com>
> iio: triggered-buffer: prevent possible freeing of wrong buffer
>
> Javier Carrasco <javier.carrasco@wolfvision.net>
> iio: tmag5273: fix temperature offset
>
> Wadim Egorov <w.egorov@phytec.de>
> iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma()
>
> Nuno Sa <nuno.sa@analog.com>
> iio: imu: adis16475: add spi_device_id table
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table
>
> Haibo Chen <haibo.chen@nxp.com>
> iio: adc: imx93: add four channels for imx93 adc
>
> Matti Vaittinen <mazziesaccount@gmail.com>
> iio: kx022a: Fix acceleration value scaling
>
> Can Guo <quic_cang@quicinc.com>
> scsi: ufs: core: Let the sq_lock protect sq_tail_slot access
>
> ChanWoo Lee <cw9316.lee@samsung.com>
> scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify()
>
> Wei Yongjun <weiyongjun1@huawei.com>
> scsi: bnx2fc: Fix skb double free in bnx2fc_rcv()
>
> George Stark <gnstark@salutedevices.com>
> iio: adc: meson: add separate config for axg SoC family
>
> Haoran Liu <liuhaoran14@163.com>
> Input: ipaq-micro-keys - add error handling for devm_kmemdup
>
> Konrad Dybcio <konrad.dybcio@linaro.org>
> interconnect: qcom: sm8250: Enable sync_state
>
> Su Hui <suhui@nfschina.com>
> iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw
>
> Mike Tipton <quic_mdtipton@quicinc.com>
> interconnect: Treat xlate() returning NULL node as an error
>
> Maurizio Lombardi <mlombard@redhat.com>
> nvme-pci: fix sleeping function called from interrupt context
>
> Kent Gibson <warthog618@gmail.com>
> gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl()
>
> Alexis Lothoré <alexis.lothore@bootlin.com>
> pinctrl: at91-pio4: use dedicated lock class for IRQ
>
> Arnd Bergmann <arnd@arndb.de>
> x86/xen: add CPU dependencies for 32-bit build
>
> Quan Nguyen <quan@os.amperecomputing.com>
> i2c: aspeed: Handle the coalesced stop conditions with the start conditions.
>
> ZhenGuo Yin <zhenguo.yin@amd.com>
> drm/amdgpu: re-create idle bo's PTE during VM state machine reset
>
> Yang Yingliang <yangyingliang@huawei.com>
> i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off()
>
> Shengjiu Wang <shengjiu.wang@nxp.com>
> ASoC: fsl_sai: Fix channel swap issue on i.MX8MP
>
> Jerome Brunet <jbrunet@baylibre.com>
> ASoC: hdmi-codec: fix missing report for jack initial status
>
> Imre Deak <imre.deak@intel.com>
> drm/i915/mtl: Fix HDMI/DP PLL clock selection
>
> Karthik Poosa <karthik.poosa@intel.com>
> drm/i915/hwmon: Fix static analysis tool reported issues
>
> David Howells <dhowells@redhat.com>
> afs: Fix use-after-free due to get/remove race in volume tree
>
> David Howells <dhowells@redhat.com>
> afs: Fix overwriting of result of DNS query
>
> David Howells <dhowells@redhat.com>
> keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
>
> Eric Dumazet <edumazet@google.com>
> net: check dev->gso_max_size in gso_features_check()
>
> David Ahern <dsahern@kernel.org>
> net/ipv6: Revert remove expired routes with a separated list of routes
>
> Lorenzo Bianconi <lorenzo@kernel.org>
> net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean()
>
> David Howells <dhowells@redhat.com>
> afs: Fix dynamic root lookup DNS check
>
> David Howells <dhowells@redhat.com>
> afs: Fix the dynamic root's d_delete to always delete unused dentries
>
> Liu Jian <liujian56@huawei.com>
> net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev()
>
> Yury Norov <yury.norov@gmail.com>
> net: mana: select PAGE_POOL
>
> Larysa Zaremba <larysa.zaremba@intel.com>
> ice: Fix PF with enabled XDP going no-carrier after reset
>
> Dave Ertman <david.m.ertman@intel.com>
> ice: alter feature support check for SRIOV and LAG
>
> Jacob Keller <jacob.e.keller@intel.com>
> ice: stop trashing VF VSI aggregator node ID information
>
> Daniel Golle <daniel@makrotopia.org>
> net: phy: skip LED triggers on PHYs on SFP modules
>
> Andy Gospodarek <andrew.gospodarek@broadcom.com>
> bnxt_en: do not map packet buffers twice
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis
>
> Arnd Bergmann <arnd@arndb.de>
> Bluetooth: hci_event: shut up a false-positive warning
>
> Ying Hsu <yinghsu@chromium.org>
> Bluetooth: Fix deadlock in vhci_send_frame
>
> Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
> Bluetooth: Fix not notifying when connection encryption changes
>
> Eric Dumazet <edumazet@google.com>
> net/rose: fix races in rose_kill_by_device()
>
> Zhipeng Lu <alexious@zju.edu.cn>
> ethernet: atheros: fix a memleak in atl1e_setup_ring_resources
>
> Eric Dumazet <edumazet@google.com>
> net: sched: ife: fix potential use-after-free
>
> Shigeru Yoshida <syoshida@redhat.com>
> net: Return error from sk_stream_wait_connect() if sk_wait_event() fails
>
> Suman Ghosh <sumang@marvell.com>
> octeontx2-pf: Fix graceful exit during PFC configuration failure
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: mscc: ocelot: fix pMAC TX RMON stats for bucket 256-511 and above
>
> Vladimir Oltean <vladimir.oltean@nxp.com>
> net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above
>
> Rahul Rameshbabu <rrameshbabu@nvidia.com>
> net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors
>
> Rahul Rameshbabu <rrameshbabu@nvidia.com>
> net/mlx5e: Correct snprintf truncation handling for fw_version buffer
>
> Dan Carpenter <dan.carpenter@linaro.org>
> net/mlx5e: Fix error codes in alloc_branch_attr()
>
> Dan Carpenter <dan.carpenter@linaro.org>
> net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get()
>
> Vlad Buslov <vladbu@nvidia.com>
> net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num
>
> Moshe Shemesh <moshe@nvidia.com>
> net/mlx5: Fix fw tracer first block check
>
> Carolina Jubran <cjubran@nvidia.com>
> net/mlx5e: XDP, Drop fragmented packets larger than MTU size
>
> Chris Mi <cmi@nvidia.com>
> net/mlx5e: Decrease num_block_tc when unblock tc offload
>
> Jianbo Liu <jianbol@nvidia.com>
> net/mlx5e: Fix overrun reported by coverity
>
> Dinghao Liu <dinghao.liu@zju.edu.cn>
> net/mlx5e: fix a potential double-free in fs_udp_create_groups
>
> Shifeng Li <lishifeng@sangfor.com.cn>
> net/mlx5e: Fix a race in command alloc flow
>
> Shifeng Li <lishifeng@sangfor.com.cn>
> net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list()
>
> Vlad Buslov <vladbu@nvidia.com>
> Revert "net/mlx5e: fix double free of encap_header"
>
> Vlad Buslov <vladbu@nvidia.com>
> Revert "net/mlx5e: fix double free of encap_header in update funcs"
>
> John Fastabend <john.fastabend@gmail.com>
> bpf: syzkaller found null ptr deref in unix_bpf proto add
>
> Michal Schmidt <mschmidt@redhat.com>
> ice: fix theoretical out-of-bounds access in ethtool link modes
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: mac80211: mesh_plink: fix matches_local logic
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: mac80211: mesh: check element parsing succeeded
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: mac80211: check defragmentation succeeded
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: mac80211: don't re-add debugfs during reconfig
>
> Edward Adam Davis <eadavis@qq.com>
> wifi: mac80211: check if the existing link config remains unchanged
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock
>
> Johannes Berg <johannes.berg@intel.com>
> wifi: ieee80211: don't require protected vendor action frames
>
> Chuck Lever <chuck.lever@oracle.com>
> SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806
>
> Rajvi Jingar <rajvi.jingar@linux.intel.com>
> platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore()
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/vx: fix save/restore of fpu kernel context
>
> Geert Uytterhoeven <geert+renesas@glider.be>
> reset: Fix crash when freeing non-existent optional resets
>
> Kunwu Chan <chentao@kylinos.cn>
> ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init
>
> Andrew Davis <afd@ti.com>
> ARM: dts: dra7: Fix DRA7 L3 NoC node register size
>
> Chukun Pan <amadeus@jmu.edu.cn>
> arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3
>
> Benjamin Bigler <benjamin@bigler.one>
> spi: spi-imx: correctly configure burst length when using dma
>
> Lingkai Dong <Lingkai.Dong@arm.com>
> drm: Fix FD ownership check in drm_master_check_perm()
>
> Tvrtko Ursulin <tvrtko.ursulin@intel.com>
> drm: Update file owner during use
>
> Jani Nikula <jani.nikula@intel.com>
> drm/i915/edp: don't write to DP_LINK_BW_SET when using rate select
>
> Ville Syrjälä <ville.syrjala@linux.intel.com>
> drm/i915: Introduce crtc_state->enhanced_framing
>
> Ville Syrjälä <ville.syrjala@linux.intel.com>
> drm/i915: Fix FEC state dump
>
> Hamza Mahfooz <hamza.mahfooz@amd.com>
> drm/amd/display: fix hw rotated modes when PSR-SU is enabled
>
> Boris Burkov <boris@bur.io>
> btrfs: free qgroup pertrans reserve on transaction abort
>
> Qu Wenruo <wqu@suse.com>
> btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta()
>
> Qu Wenruo <wqu@suse.com>
> btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve()
>
> SeongJae Park <sj@kernel.org>
> mm/damon/core: make damon_start() waits until kdamond_fn() starts
>
> SeongJae Park <sj@kernel.org>
> mm/damon/core: use number of passed access sampling as a timer
>
> Jiri Olsa <jolsa@kernel.org>
> bpf: Fix prog_array_map_poke_run map poke update
>
>
> -------------
>
> Diffstat:
>
> .../devicetree/bindings/nvmem/mxs-ocotp.yaml | 10 +-
> Makefile | 4 +-
> arch/arm/boot/dts/ti/omap/am33xx.dtsi | 1 +
> arch/arm/boot/dts/ti/omap/dra7.dtsi | 2 +-
> arch/arm/mach-omap2/id.c | 5 +
> .../dts/allwinner/sun50i-h616-orangepi-zero.dtsi | 3 -
> .../dts/allwinner/sun50i-h616-orangepi-zero2.dts | 3 +
> .../dts/allwinner/sun50i-h618-orangepi-zero3.dts | 2 +
> arch/arm64/kvm/arm.c | 2 +-
> arch/arm64/kvm/vgic/vgic-init.c | 47 +++++---
> arch/arm64/kvm/vgic/vgic-mmio-v3.c | 2 +-
> arch/arm64/kvm/vgic/vgic.h | 1 +
> arch/s390/include/asm/fpu/api.h | 2 +-
> arch/x86/kernel/alternative.c | 14 ++-
> arch/x86/kernel/head_64.S | 16 +++
> arch/x86/net/bpf_jit_comp.c | 46 +++++++
> arch/x86/xen/Kconfig | 1 +
> drivers/bluetooth/hci_vhci.c | 10 +-
> drivers/bus/ti-sysc.c | 18 ++-
> drivers/gpio/gpio-dwapb.c | 12 +-
> drivers/gpio/gpiolib-cdev.c | 16 ++-
> drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c | 6 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 1 +
> drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 +
> drivers/gpu/drm/amd/display/dc/dc_hw_types.h | 1 +
> .../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 3 +-
> drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hubp.c | 12 +-
> drivers/gpu/drm/drm_auth.c | 3 +-
> drivers/gpu/drm/drm_debugfs.c | 10 +-
> drivers/gpu/drm/drm_file.c | 40 +++++-
> drivers/gpu/drm/drm_ioctl.c | 3 +
> drivers/gpu/drm/i915/display/g4x_dp.c | 10 +-
> drivers/gpu/drm/i915/display/intel_crt.c | 2 +
> .../gpu/drm/i915/display/intel_crtc_state_dump.c | 3 +
> drivers/gpu/drm/i915/display/intel_cx0_phy.c | 3 +-
> drivers/gpu/drm/i915/display/intel_ddi.c | 22 ++--
> drivers/gpu/drm/i915/display/intel_display.c | 12 ++
> drivers/gpu/drm/i915/display/intel_display_types.h | 2 +
> drivers/gpu/drm/i915/display/intel_dmc.c | 43 ++++++-
> drivers/gpu/drm/i915/display/intel_dp.c | 3 +
> .../gpu/drm/i915/display/intel_dp_link_training.c | 35 ++++--
> drivers/gpu/drm/i915/i915_hwmon.c | 4 +-
> drivers/gpu/drm/nouveau/nouveau_drm.c | 5 +-
> drivers/gpu/drm/vmwgfx/vmwgfx_gem.c | 6 +-
> drivers/i2c/busses/i2c-aspeed.c | 48 +++++---
> drivers/i2c/busses/i2c-qcom-geni.c | 8 +-
> drivers/iio/accel/kionix-kx022a.c | 37 ++++--
> drivers/iio/adc/imx93_adc.c | 4 +
> drivers/iio/adc/meson_saradc.c | 16 ++-
> drivers/iio/adc/ti_am335x_adc.c | 4 +-
> drivers/iio/buffer/industrialio-triggered-buffer.c | 10 ++
> drivers/iio/common/ms_sensors/ms_sensors_i2c.c | 4 +-
> drivers/iio/imu/adis16475.c | 117 +++++++++++-------
> drivers/iio/imu/inv_mpu6050/inv_mpu_core.c | 4 +-
> drivers/iio/magnetometer/tmag5273.c | 2 +-
> drivers/input/keyboard/ipaq-micro-keys.c | 3 +
> drivers/input/misc/soc_button_array.c | 5 +
> drivers/interconnect/core.c | 3 +
> drivers/interconnect/qcom/sm8250.c | 1 +
> drivers/md/dm-integrity.c | 11 +-
> drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 5 +-
> drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 +-
> drivers/net/ethernet/intel/ice/ice_ethtool.c | 4 +-
> drivers/net/ethernet/intel/ice/ice_lag.c | 2 +
> drivers/net/ethernet/intel/ice/ice_lib.c | 7 +-
> .../ethernet/marvell/octeontx2/nic/otx2_dcbnl.c | 17 ++-
> drivers/net/ethernet/mediatek/mtk_wed_wo.c | 3 +
> drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 12 +-
> .../ethernet/mellanox/mlx5/core/diag/fw_tracer.c | 2 +-
> .../mellanox/mlx5/core/en/fs_tt_redirect.c | 1 +
> .../ethernet/mellanox/mlx5/core/en/tc/act/mirred.c | 5 +-
> .../net/ethernet/mellanox/mlx5/core/en/tc_tun.c | 30 ++---
> .../ethernet/mellanox/mlx5/core/en/tc_tun_encap.c | 3 +-
> drivers/net/ethernet/mellanox/mlx5/core/en/xdp.c | 4 +-
> .../mellanox/mlx5/core/en_accel/ipsec_fs.c | 2 +-
> .../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +-
> drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 2 +-
> drivers/net/ethernet/mellanox/mlx5/core/en_tc.c | 10 +-
> drivers/net/ethernet/mellanox/mlx5/core/eswitch.h | 3 +-
> .../ethernet/mellanox/mlx5/core/eswitch_offloads.c | 31 +++--
> .../mellanox/mlx5/core/eswitch_offloads_termtbl.c | 4 +-
> drivers/net/ethernet/mellanox/mlx5/core/vport.c | 2 +-
> drivers/net/ethernet/micrel/ks8851.h | 3 +
> drivers/net/ethernet/micrel/ks8851_common.c | 20 +--
> drivers/net/ethernet/micrel/ks8851_spi.c | 42 ++++---
> drivers/net/ethernet/microsoft/Kconfig | 1 +
> drivers/net/ethernet/mscc/ocelot_stats.c | 16 +--
> .../net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c | 2 +-
> drivers/net/phy/phy_device.c | 6 +-
> drivers/net/usb/ax88179_178a.c | 23 +++-
> drivers/net/wireless/intel/iwlwifi/pcie/trans.c | 4 +-
> drivers/net/wireless/mediatek/mt76/dma.c | 10 +-
> drivers/nvme/host/core.c | 3 +-
> drivers/nvmem/brcm_nvram.c | 134 +++++++++++++++------
> drivers/pinctrl/pinctrl-at91-pio4.c | 8 ++
> drivers/pinctrl/starfive/pinctrl-starfive-jh7100.c | 4 +-
> drivers/pinctrl/starfive/pinctrl-starfive-jh7110.c | 4 +-
> drivers/platform/x86/intel/pmc/core.c | 2 +-
> drivers/reset/core.c | 8 +-
> drivers/scsi/aacraid/aacraid.h | 1 -
> drivers/scsi/aacraid/commsup.c | 6 +-
> drivers/scsi/aacraid/linit.c | 14 ---
> drivers/scsi/aacraid/src.c | 25 +---
> drivers/scsi/bnx2fc/bnx2fc_fcoe.c | 9 +-
> drivers/scsi/scsi_error.c | 2 +
> drivers/spi/spi-atmel.c | 92 ++++++++++++--
> drivers/spi/spi-cadence.c | 1 -
> drivers/spi/spi-imx.c | 15 ++-
> drivers/thunderbolt/debugfs.c | 2 +-
> drivers/ufs/core/ufshcd.c | 3 +-
> drivers/ufs/host/ufs-qcom.c | 6 +-
> drivers/usb/fotg210/fotg210-hcd.c | 3 -
> drivers/usb/serial/ftdi_sio.c | 6 +-
> drivers/usb/serial/ftdi_sio_ids.h | 6 +-
> drivers/usb/serial/option.c | 5 +
> drivers/usb/storage/unusual_devs.h | 11 ++
> drivers/usb/typec/ucsi/ucsi_glink.c | 2 +-
> fs/afs/cell.c | 6 +-
> fs/afs/dynroot.c | 31 ++---
> fs/afs/internal.h | 2 +
> fs/afs/volume.c | 26 +++-
> fs/btrfs/disk-io.c | 28 +++++
> fs/btrfs/qgroup.c | 96 +++++++--------
> fs/btrfs/qgroup.h | 9 ++
> fs/btrfs/transaction.c | 2 -
> fs/btrfs/transaction.h | 3 +
> fs/nfsd/nfsctl.c | 9 +-
> fs/nfsd/nfsd.h | 1 +
> fs/nfsd/nfssvc.c | 2 +-
> fs/smb/client/cifs_debug.c | 12 +-
> fs/smb/client/cifsglob.h | 3 +-
> fs/smb/client/connect.c | 7 +-
> fs/smb/client/misc.c | 4 +
> fs/smb/client/smb2ops.c | 19 +--
> fs/smb/client/smb2pdu.c | 29 +++--
> include/drm/drm_file.h | 13 +-
> include/linux/bpf.h | 3 +
> include/linux/damon.h | 16 ++-
> include/linux/ieee80211.h | 3 +-
> include/linux/key-type.h | 1 +
> include/net/bluetooth/hci_core.h | 9 +-
> include/net/ip6_fib.h | 64 ++--------
> include/net/sock.h | 5 +
> include/trace/events/9p.h | 11 +-
> kernel/bpf/arraymap.c | 58 ++-------
> kernel/trace/ring_buffer.c | 130 ++++++--------------
> kernel/trace/synth_event_gen_test.c | 11 ++
> lib/vsprintf.c | 11 +-
> mm/damon/core.c | 102 ++++++++--------
> net/8021q/vlan_core.c | 9 +-
> net/9p/protocol.c | 17 ++-
> net/bluetooth/af_bluetooth.c | 7 +-
> net/bluetooth/hci_event.c | 30 +++--
> net/bluetooth/l2cap_core.c | 21 +++-
> net/bluetooth/mgmt.c | 25 ++--
> net/bluetooth/smp.c | 7 ++
> net/core/dev.c | 3 +
> net/core/skbuff.c | 2 +
> net/core/sock_map.c | 2 +
> net/core/stream.c | 2 +-
> net/dns_resolver/dns_key.c | 10 +-
> net/ife/ife.c | 1 +
> net/ipv6/ip6_fib.c | 55 +--------
> net/ipv6/route.c | 6 +-
> net/mac80211/cfg.c | 4 +-
> net/mac80211/driver-ops.c | 6 +-
> net/mac80211/mesh_plink.c | 16 +--
> net/mac80211/mlme.c | 4 +-
> net/rfkill/rfkill-gpio.c | 8 ++
> net/rose/af_rose.c | 39 +++++-
> net/sunrpc/svc_xprt.c | 5 +-
> net/wireless/certs/wens.hex | 87 +++++++++++++
> security/keys/gc.c | 31 +++--
> security/keys/internal.h | 11 +-
> security/keys/key.c | 15 +--
> security/keys/proc.c | 2 +-
> sound/pci/hda/patch_realtek.c | 1 +
> sound/pci/hda/tas2781_hda_i2c.c | 4 +
> sound/soc/codecs/hdmi-codec.c | 12 +-
> sound/soc/codecs/tas2781-fmwlib.c | 14 ++-
> sound/soc/fsl/fsl_sai.c | 3 +
> sound/usb/quirks.c | 4 +-
> tools/testing/selftests/net/mptcp/mptcp_join.sh | 8 +-
> 183 files changed, 1677 insertions(+), 907 deletions(-)
>
>
>
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2023-12-31 3:18 ` Luna Jernberg
@ 2023-12-31 8:10 ` Bagas Sanjaya
2023-12-31 9:19 ` Naresh Kamboju
2023-12-31 16:33 ` Guenter Roeck
164 siblings, 0 replies; 177+ messages in thread
From: Bagas Sanjaya @ 2023-12-31 8:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml
[-- Attachment #1: Type: text/plain, Size: 557 bytes --]
On Sat, Dec 30, 2023 at 11:57:34AM +0000, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
Successfully compiled and installed the kernel on my computer (Acer
Aspire E15, Intel Core i3 Haswell). No noticeable regressions.
Tested-by: Bagas Sanjaya <bagasdotme@gmail.com>
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-31 3:18 ` Luna Jernberg
@ 2023-12-31 9:18 ` Greg Kroah-Hartman
0 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2023-12-31 9:18 UTC (permalink / raw)
To: Luna Jernberg
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
On Sun, Dec 31, 2023 at 04:18:29AM +0100, Luna Jernberg wrote:
> Did not work for me on Debian testing on a Thinkpad Edge i3 laptop
> just booted me to busybox
Did not work in what way? Is this a regression from the last release?
If so, can you do 'git bisect' to find the offending commit?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2023-12-31 8:10 ` Bagas Sanjaya
@ 2023-12-31 9:19 ` Naresh Kamboju
2023-12-31 16:33 ` Guenter Roeck
164 siblings, 0 replies; 177+ messages in thread
From: Naresh Kamboju @ 2023-12-31 9:19 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
On Sat, 30 Dec 2023 at 17:31, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.6.9-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.6.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 6.6.9-rc1
* git: https://gitlab.com/Linaro/lkft/mirrors/stable/linux-stable-rc
* git branch: linux-6.6.y
* git commit: ac5757a323d0d58e1e9f6a43cb374d4fbcd14db5
* git describe: v6.6.8-157-gac5757a323d0
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.6.y/build/v6.6.8-157-gac5757a323d0
## Test Regressions (compared to v6.6.7)
## Metric Regressions (compared to v6.6.7)
## Test Fixes (compared to v6.6.7)
## Metric Fixes (compared to v6.6.7)
## Test result summary
total: 152743, pass: 130798, fail: 2523, skip: 19299, xfail: 123
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 145 total, 144 passed, 1 failed
* arm64: 52 total, 49 passed, 3 failed
* i386: 41 total, 40 passed, 1 failed
* mips: 26 total, 26 passed, 0 failed
* parisc: 4 total, 4 passed, 0 failed
* powerpc: 36 total, 36 passed, 0 failed
* riscv: 25 total, 24 passed, 1 failed
* s390: 13 total, 13 passed, 0 failed
* sh: 10 total, 10 passed, 0 failed
* sparc: 8 total, 8 passed, 0 failed
* x86_64: 46 total, 45 passed, 1 failed
## Test suites summary
* boot
* kselftest-android
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-drivers-dma-buf
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-ir
* kselftest-kcmp
* kselftest-kexec
* kselftest-kvm
* kselftest-lib
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-memory-hotplug
* kselftest-mincore
* kselftest-mount
* kselftest-mqueue
* kselftest-net
* kselftest-net-forwarding
* kselftest-net-mptcp
* kselftest-netfilter
* kselftest-nsfs
* kselftest-openat2
* kselftest-pid_namespace
* kselftest-pidfd
* kselftest-proc
* kselftest-pstore
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-splice
* kselftest-static_keys
* kselftest-sync
* kselftest-sysctl
* kselftest-tc-testing
* kselftest-timens
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user
* kselftest-user_events
* kselftest-vDSO
* kselftest-vm
* kselftest-watchdog
* kselftest-x86
* kselftest-zram
* kunit
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-cap_bounds
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-cpuhotplug
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-fsx
* ltp-hugetlb
* ltp-io
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-securebits
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* network-basic-tests
* perf
* rcutorture
* v4l2-compliance
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 000/156] 6.6.9-rc1 review
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2023-12-31 9:19 ` Naresh Kamboju
@ 2023-12-31 16:33 ` Guenter Roeck
164 siblings, 0 replies; 177+ messages in thread
From: Guenter Roeck @ 2023-12-31 16:33 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml
On Sat, Dec 30, 2023 at 11:57:34AM +0000, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.6.9 release.
> There are 156 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Mon, 01 Jan 2024 11:57:43 +0000.
> Anything received after that time might be too late.
>
Build results:
total: 157 pass: 157 fail: 0
Qemu test results:
total: 545 pass: 545 fail: 0
Tested-by: Guenter Roeck <linux@roeck-us.net>
Guenter
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice
2023-12-30 11:58 ` [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice Greg Kroah-Hartman
@ 2024-01-02 15:22 ` Andy Gospodarek
2024-01-03 10:04 ` Greg Kroah-Hartman
0 siblings, 1 reply; 177+ messages in thread
From: Andy Gospodarek @ 2024-01-02 15:22 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Somnath Kotur, Andy Gospodarek, Michael Chan,
David Wei, Jakub Kicinski, Sasha Levin
On Sat, Dec 30, 2023 at 11:58:29AM +0000, Greg Kroah-Hartman wrote:
> 6.6-stable review patch. If anyone has any objections, please let me know.
>
No objections from me.
For reference I do have an implementation of this functionality to v6.1
if/when it should be added. It is different as the bnxt_en driver did
not use the page pool to manage DMA mapping until v6.6.
The minimally disruptive patch to prevent this memory leak is below:
From dc82f8b57e2692ec987628b53e6446ab9f4fa615 Mon Sep 17 00:00:00 2001
From: Andy Gospodarek <andrew.gospodarek@broadcom.com>
Date: Thu, 7 Dec 2023 16:23:21 -0500
Subject: [PATCH] bnxt_en: unmap frag buffers before returning page to pool
If pages are not unmapped before calling page_pool_recycle_direct they
will not be freed back to the pool. This will lead to a memory leak and
messages like the following in dmesg:
[ 8229.436920] page_pool_release_retry() stalled pool shutdown 340 inflight 5437 sec
Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers")
Signed-off-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
---
drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
index aa56db138d6b..5b4548fad870 100644
--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
@@ -80,6 +80,7 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp,
return NULL;
dma_unmap_addr_set(frag_tx_buf, mapping, frag_mapping);
+ dma_unmap_addr_set(frag_tx_buf, len, frag_len);
flags = frag_len << TX_BD_LEN_SHIFT;
txbd->tx_bd_len_flags_type = cpu_to_le32(flags);
@@ -154,8 +155,14 @@ void bnxt_tx_int_xdp(struct bnxt *bp, struct bnxt_napi *bnapi, int nr_pkts)
frags = tx_buf->nr_frags;
for (j = 0; j < frags; j++) {
+ struct pci_dev *pdev = bp->pdev;
+
tx_cons = NEXT_TX(tx_cons);
tx_buf = &txr->tx_buf_ring[tx_cons];
+ dma_unmap_single(&pdev->dev,
+ dma_unmap_addr(tx_buf, mapping),
+ dma_unmap_len(tx_buf, len),
+ DMA_TO_DEVICE);
page_pool_recycle_direct(rxr->page_pool, tx_buf->page);
}
}
>
> From: Andy Gospodarek <andrew.gospodarek@broadcom.com>
>
> [ Upstream commit 23c93c3b6275a59f2a685f4a693944b53c31df4e ]
>
> Remove double-mapping of DMA buffers as it can prevent page pool entries
> from being freed. Mapping is managed by page pool infrastructure and
> was previously managed by the driver in __bnxt_alloc_rx_page before
> allowing the page pool infrastructure to manage it.
>
> Fixes: 578fcfd26e2a ("bnxt_en: Let the page pool manage the DMA mapping")
> Reviewed-by: Somnath Kotur <somnath.kotur@broadcom.com>
> Signed-off-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> Signed-off-by: Michael Chan <michael.chan@broadcom.com>
> Reviewed-by: David Wei <dw@davidwei.uk>
> Link: https://lore.kernel.org/r/20231214213138.98095-1-michael.chan@broadcom.com
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Signed-off-by: Sasha Levin <sashal@kernel.org>
> ---
> drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 11 ++---------
> 1 file changed, 2 insertions(+), 9 deletions(-)
>
> diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
> index 96f5ca778c67d..8cb9a99154aad 100644
> --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
> +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c
> @@ -59,7 +59,6 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp,
> for (i = 0; i < num_frags ; i++) {
> skb_frag_t *frag = &sinfo->frags[i];
> struct bnxt_sw_tx_bd *frag_tx_buf;
> - struct pci_dev *pdev = bp->pdev;
> dma_addr_t frag_mapping;
> int frag_len;
>
> @@ -73,16 +72,10 @@ struct bnxt_sw_tx_bd *bnxt_xmit_bd(struct bnxt *bp,
> txbd = &txr->tx_desc_ring[TX_RING(prod)][TX_IDX(prod)];
>
> frag_len = skb_frag_size(frag);
> - frag_mapping = skb_frag_dma_map(&pdev->dev, frag, 0,
> - frag_len, DMA_TO_DEVICE);
> -
> - if (unlikely(dma_mapping_error(&pdev->dev, frag_mapping)))
> - return NULL;
> -
> - dma_unmap_addr_set(frag_tx_buf, mapping, frag_mapping);
> -
> flags = frag_len << TX_BD_LEN_SHIFT;
> txbd->tx_bd_len_flags_type = cpu_to_le32(flags);
> + frag_mapping = page_pool_get_dma_addr(skb_frag_page(frag)) +
> + skb_frag_off(frag);
> txbd->tx_bd_haddr = cpu_to_le64(frag_mapping);
>
> len = frag_len;
> --
> 2.43.0
>
>
>
^ permalink raw reply related [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice
2024-01-02 15:22 ` Andy Gospodarek
@ 2024-01-03 10:04 ` Greg Kroah-Hartman
2024-01-04 20:07 ` Andy Gospodarek
0 siblings, 1 reply; 177+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-03 10:04 UTC (permalink / raw)
To: Andy Gospodarek
Cc: stable, patches, Somnath Kotur, Michael Chan, David Wei,
Jakub Kicinski, Sasha Levin
On Tue, Jan 02, 2024 at 10:22:02AM -0500, Andy Gospodarek wrote:
> On Sat, Dec 30, 2023 at 11:58:29AM +0000, Greg Kroah-Hartman wrote:
> > 6.6-stable review patch. If anyone has any objections, please let me know.
> >
>
> No objections from me.
>
> For reference I do have an implementation of this functionality to v6.1
> if/when it should be added. It is different as the bnxt_en driver did
> not use the page pool to manage DMA mapping until v6.6.
>
> The minimally disruptive patch to prevent this memory leak is below:
>
> >From dc82f8b57e2692ec987628b53e6446ab9f4fa615 Mon Sep 17 00:00:00 2001
> From: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> Date: Thu, 7 Dec 2023 16:23:21 -0500
> Subject: [PATCH] bnxt_en: unmap frag buffers before returning page to pool
>
> If pages are not unmapped before calling page_pool_recycle_direct they
> will not be freed back to the pool. This will lead to a memory leak and
> messages like the following in dmesg:
>
> [ 8229.436920] page_pool_release_retry() stalled pool shutdown 340 inflight 5437 sec
>
> Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers")
> Signed-off-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> ---
> drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 7 +++++++
> 1 file changed, 7 insertions(+)
I do not understand, what is this patch for?
Why not submit it for normal inclusion first?
confused,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard()
2023-12-30 21:47 ` Steven Rostedt
@ 2024-01-03 10:05 ` Greg Kroah-Hartman
0 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-03 10:05 UTC (permalink / raw)
To: Steven Rostedt
Cc: stable, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Joel Fernandes, Vincent Donnefort, Sasha Levin
On Sat, Dec 30, 2023 at 04:47:36PM -0500, Steven Rostedt wrote:
> On Sat, 30 Dec 2023 11:59:47 +0000
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>
> > 6.6-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: Steven Rostedt (Google) <rostedt@goodmis.org>
> >
> > [ Upstream commit 083e9f65bd215582bf8f6a920db729fadf16704f ]
>
> BTW, here's a fix for 6.1 and 5.15
Now queued up, thanks.
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice
2024-01-03 10:04 ` Greg Kroah-Hartman
@ 2024-01-04 20:07 ` Andy Gospodarek
2024-01-05 9:52 ` Greg Kroah-Hartman
0 siblings, 1 reply; 177+ messages in thread
From: Andy Gospodarek @ 2024-01-04 20:07 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Andy Gospodarek, stable, patches, Somnath Kotur, Michael Chan,
David Wei, Jakub Kicinski, Sasha Levin
On Wed, Jan 03, 2024 at 11:04:11AM +0100, Greg Kroah-Hartman wrote:
> On Tue, Jan 02, 2024 at 10:22:02AM -0500, Andy Gospodarek wrote:
> > On Sat, Dec 30, 2023 at 11:58:29AM +0000, Greg Kroah-Hartman wrote:
> > > 6.6-stable review patch. If anyone has any objections, please let me know.
> > >
> >
> > No objections from me.
> >
> > For reference I do have an implementation of this functionality to v6.1
> > if/when it should be added. It is different as the bnxt_en driver did
> > not use the page pool to manage DMA mapping until v6.6.
> >
> > The minimally disruptive patch to prevent this memory leak is below:
> >
> > >From dc82f8b57e2692ec987628b53e6446ab9f4fa615 Mon Sep 17 00:00:00 2001
> > From: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> > Date: Thu, 7 Dec 2023 16:23:21 -0500
> > Subject: [PATCH] bnxt_en: unmap frag buffers before returning page to pool
> >
> > If pages are not unmapped before calling page_pool_recycle_direct they
> > will not be freed back to the pool. This will lead to a memory leak and
> > messages like the following in dmesg:
> >
> > [ 8229.436920] page_pool_release_retry() stalled pool shutdown 340 inflight 5437 sec
> >
> > Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers")
> > Signed-off-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> > ---
> > drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 7 +++++++
> > 1 file changed, 7 insertions(+)
>
> I do not understand, what is this patch for?
>
> Why not submit it for normal inclusion first?
Greg,
I wondered if my description was good enough -- it was not. :)
The sole purpose for sending my last email was to let you know that this
problem also occurs on v6.1 but in a different manner.
In the process of fixing this problem on the tip of tree I noted it was also an
issue on older kernels, so that was why I brought it up.
This is a bit confusing as the Fixes: tag was correctly set to changes that
were made for v6.6 as it was the first kernel where this type of leak was
noted.
Hopefully that resolves the confusion.
-andy
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
2023-12-30 11:58 ` [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry Greg Kroah-Hartman
@ 2024-01-05 2:13 ` Jeffrey E Altman
2024-01-05 9:51 ` Greg Kroah-Hartman
0 siblings, 1 reply; 177+ messages in thread
From: Jeffrey E Altman @ 2024-01-05 2:13 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, David Howells, Markus Suvanto, Wang Lei, Jeff Layton,
Steve French, Marc Dionne, Jarkko Sakkinen, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, linux-afs, linux-cifs,
linux-nfs, ceph-devel, keyrings, netdev, Sasha Levin
[-- Attachment #1: Type: text/plain, Size: 1026 bytes --]
On 12/30/2023 6:58 AM, Greg Kroah-Hartman wrote:
> 6.6-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: David Howells <dhowells@redhat.com>
>
> [ Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ]
Greg,
Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ("keys, dns:
Allow key types (eg. DNS) to be reclaimed immediately on expiry") was
subsequently fixed by
commit 1997b3cb4217b09e49659b634c94da47f0340409
Author: Edward Adam Davis <eadavis@qq.com>
Date: Sun Dec 24 00:02:49 2023 +0000
keys, dns: Fix missing size check of V1 server-list header
Fixes: b946001d3bb1 ("keys, dns: Allow key types (eg. DNS) to be
reclaimed immediately on expiry")
If it is not too late, would it be possible to apply 1997b3cb421 to the
branches b946001d3bb1 was cherry-picked to before release?
I believe the complete set of branches are
linux-6.6.y, linux-6.1.y, linux-5.15.y, linux-5.10.y, linux-5.0.y
Thank you.
Jeffrey Altman
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4039 bytes --]
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
2024-01-05 2:13 ` Jeffrey E Altman
@ 2024-01-05 9:51 ` Greg Kroah-Hartman
2024-01-05 10:06 ` Greg Kroah-Hartman
0 siblings, 1 reply; 177+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-05 9:51 UTC (permalink / raw)
To: Jeffrey E Altman
Cc: stable, patches, David Howells, Markus Suvanto, Wang Lei,
Jeff Layton, Steve French, Marc Dionne, Jarkko Sakkinen,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
linux-afs, linux-cifs, linux-nfs, ceph-devel, keyrings, netdev,
Sasha Levin
On Thu, Jan 04, 2024 at 09:13:34PM -0500, Jeffrey E Altman wrote:
> On 12/30/2023 6:58 AM, Greg Kroah-Hartman wrote:
> > 6.6-stable review patch. If anyone has any objections, please let me know.
> >
> > ------------------
> >
> > From: David Howells <dhowells@redhat.com>
> >
> > [ Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ]
> Greg,
>
> Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ("keys, dns: Allow
> key types (eg. DNS) to be reclaimed immediately on expiry") was subsequently
> fixed by
>
> commit 1997b3cb4217b09e49659b634c94da47f0340409
> Author: Edward Adam Davis <eadavis@qq.com>
> Date: Sun Dec 24 00:02:49 2023 +0000
>
> keys, dns: Fix missing size check of V1 server-list header
>
> Fixes: b946001d3bb1 ("keys, dns: Allow key types (eg. DNS) to be reclaimed
> immediately on expiry")
>
> If it is not too late, would it be possible to apply 1997b3cb421 to the
> branches b946001d3bb1 was cherry-picked to before release?
> I believe the complete set of branches are
>
> linux-6.6.y, linux-6.1.y, linux-5.15.y, linux-5.10.y, linux-5.0.y
The stable trees were already released with this change in it, so I'll
queue this up for the next round, thanks.
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice
2024-01-04 20:07 ` Andy Gospodarek
@ 2024-01-05 9:52 ` Greg Kroah-Hartman
0 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-05 9:52 UTC (permalink / raw)
To: Andy Gospodarek
Cc: stable, patches, Somnath Kotur, Michael Chan, David Wei,
Jakub Kicinski, Sasha Levin
On Thu, Jan 04, 2024 at 03:07:18PM -0500, Andy Gospodarek wrote:
> On Wed, Jan 03, 2024 at 11:04:11AM +0100, Greg Kroah-Hartman wrote:
> > On Tue, Jan 02, 2024 at 10:22:02AM -0500, Andy Gospodarek wrote:
> > > On Sat, Dec 30, 2023 at 11:58:29AM +0000, Greg Kroah-Hartman wrote:
> > > > 6.6-stable review patch. If anyone has any objections, please let me know.
> > > >
> > >
> > > No objections from me.
> > >
> > > For reference I do have an implementation of this functionality to v6.1
> > > if/when it should be added. It is different as the bnxt_en driver did
> > > not use the page pool to manage DMA mapping until v6.6.
> > >
> > > The minimally disruptive patch to prevent this memory leak is below:
> > >
> > > >From dc82f8b57e2692ec987628b53e6446ab9f4fa615 Mon Sep 17 00:00:00 2001
> > > From: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> > > Date: Thu, 7 Dec 2023 16:23:21 -0500
> > > Subject: [PATCH] bnxt_en: unmap frag buffers before returning page to pool
> > >
> > > If pages are not unmapped before calling page_pool_recycle_direct they
> > > will not be freed back to the pool. This will lead to a memory leak and
> > > messages like the following in dmesg:
> > >
> > > [ 8229.436920] page_pool_release_retry() stalled pool shutdown 340 inflight 5437 sec
> > >
> > > Fixes: a7559bc8c17c ("bnxt: support transmit and free of aggregation buffers")
> > > Signed-off-by: Andy Gospodarek <andrew.gospodarek@broadcom.com>
> > > ---
> > > drivers/net/ethernet/broadcom/bnxt/bnxt_xdp.c | 7 +++++++
> > > 1 file changed, 7 insertions(+)
> >
> > I do not understand, what is this patch for?
> >
> > Why not submit it for normal inclusion first?
>
> Greg,
>
> I wondered if my description was good enough -- it was not. :)
>
> The sole purpose for sending my last email was to let you know that this
> problem also occurs on v6.1 but in a different manner.
>
> In the process of fixing this problem on the tip of tree I noted it was also an
> issue on older kernels, so that was why I brought it up.
>
> This is a bit confusing as the Fixes: tag was correctly set to changes that
> were made for v6.6 as it was the first kernel where this type of leak was
> noted.
>
> Hopefully that resolves the confusion.
Nope, sorry, I still have no idea what to do with this change at all.
It's not submitted as a "normal" change so what should be done with it?
confused,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
* Re: [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry
2024-01-05 9:51 ` Greg Kroah-Hartman
@ 2024-01-05 10:06 ` Greg Kroah-Hartman
0 siblings, 0 replies; 177+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-05 10:06 UTC (permalink / raw)
To: Jeffrey E Altman
Cc: stable, patches, David Howells, Markus Suvanto, Wang Lei,
Jeff Layton, Steve French, Marc Dionne, Jarkko Sakkinen,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
linux-afs, linux-cifs, linux-nfs, ceph-devel, keyrings, netdev,
Sasha Levin
On Fri, Jan 05, 2024 at 10:51:50AM +0100, Greg Kroah-Hartman wrote:
> On Thu, Jan 04, 2024 at 09:13:34PM -0500, Jeffrey E Altman wrote:
> > On 12/30/2023 6:58 AM, Greg Kroah-Hartman wrote:
> > > 6.6-stable review patch. If anyone has any objections, please let me know.
> > >
> > > ------------------
> > >
> > > From: David Howells <dhowells@redhat.com>
> > >
> > > [ Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ]
> > Greg,
> >
> > Upstream commit 39299bdd2546688d92ed9db4948f6219ca1b9542 ("keys, dns: Allow
> > key types (eg. DNS) to be reclaimed immediately on expiry") was subsequently
> > fixed by
> >
> > commit 1997b3cb4217b09e49659b634c94da47f0340409
> > Author: Edward Adam Davis <eadavis@qq.com>
> > Date: Sun Dec 24 00:02:49 2023 +0000
> >
> > keys, dns: Fix missing size check of V1 server-list header
> >
> > Fixes: b946001d3bb1 ("keys, dns: Allow key types (eg. DNS) to be reclaimed
> > immediately on expiry")
> >
> > If it is not too late, would it be possible to apply 1997b3cb421 to the
> > branches b946001d3bb1 was cherry-picked to before release?
> > I believe the complete set of branches are
> >
> > linux-6.6.y, linux-6.1.y, linux-5.15.y, linux-5.10.y, linux-5.0.y
>
> The stable trees were already released with this change in it, so I'll
> queue this up for the next round, thanks.
Ah, I see what happened, that line:
Fixes: b946001d3bb1 ("keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry")
refers to a commit that is not in Linus's tree, and isn't the sha1 that
you are pointing at here either.
So I'll go add this manually, but this is why our checking scripts
missed this, please be more careful about using the proper SHA1 values
in commits. Using invalid ones is almost worse than not using them at
allm as it gives you the false sense that the markings are correct.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 177+ messages in thread
end of thread, other threads:[~2024-01-05 10:06 UTC | newest]
Thread overview: 177+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2023-12-30 11:57 [PATCH 6.6 000/156] 6.6.9-rc1 review Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 001/156] bpf: Fix prog_array_map_poke_run map poke update Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 002/156] mm/damon/core: use number of passed access sampling as a timer Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 003/156] mm/damon/core: make damon_start() waits until kdamond_fn() starts Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 004/156] btrfs: qgroup: iterate qgroups without memory allocation for qgroup_reserve() Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 005/156] btrfs: qgroup: use qgroup_iterator in qgroup_convert_meta() Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 006/156] btrfs: free qgroup pertrans reserve on transaction abort Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 007/156] drm/amd/display: fix hw rotated modes when PSR-SU is enabled Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 008/156] drm/i915: Fix FEC state dump Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 009/156] drm/i915: Introduce crtc_state->enhanced_framing Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 010/156] drm/i915/edp: dont write to DP_LINK_BW_SET when using rate select Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 011/156] drm: Update file owner during use Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 012/156] drm: Fix FD ownership check in drm_master_check_perm() Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 013/156] spi: spi-imx: correctly configure burst length when using dma Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 014/156] arm64: dts: allwinner: h616: update emac for Orange Pi Zero 3 Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 015/156] ARM: dts: dra7: Fix DRA7 L3 NoC node register size Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 016/156] ARM: OMAP2+: Fix null pointer dereference and memory leak in omap_soc_device_init Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 017/156] reset: Fix crash when freeing non-existent optional resets Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 018/156] s390/vx: fix save/restore of fpu kernel context Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 019/156] platform/x86/intel/pmc: Fix hang in pmc_core_send_ltr_ignore() Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 020/156] SUNRPC: Revert 5f7fc5d69f6e92ec0b38774c387f5cf7812c5806 Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 021/156] wifi: ieee80211: dont require protected vendor action frames Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 022/156] wifi: iwlwifi: pcie: add another missing bh-disable for rxq->lock Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 023/156] wifi: mac80211: check if the existing link config remains unchanged Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 024/156] wifi: mac80211: dont re-add debugfs during reconfig Greg Kroah-Hartman
2023-12-30 11:57 ` [PATCH 6.6 025/156] wifi: mac80211: check defragmentation succeeded Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 026/156] wifi: mac80211: mesh: check element parsing succeeded Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 027/156] wifi: mac80211: mesh_plink: fix matches_local logic Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 028/156] ice: fix theoretical out-of-bounds access in ethtool link modes Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 029/156] bpf: syzkaller found null ptr deref in unix_bpf proto add Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 030/156] Revert "net/mlx5e: fix double free of encap_header in update funcs" Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 031/156] Revert "net/mlx5e: fix double free of encap_header" Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 032/156] net/mlx5e: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 033/156] net/mlx5e: Fix a race in command alloc flow Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 034/156] net/mlx5e: fix a potential double-free in fs_udp_create_groups Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 035/156] net/mlx5e: Fix overrun reported by coverity Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 036/156] net/mlx5e: Decrease num_block_tc when unblock tc offload Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 037/156] net/mlx5e: XDP, Drop fragmented packets larger than MTU size Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 038/156] net/mlx5: Fix fw tracer first block check Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 039/156] net/mlx5: Refactor mlx5_flow_destination->rep pointer to vport num Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 040/156] net/mlx5e: Fix error code in mlx5e_tc_action_miss_mapping_get() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 041/156] net/mlx5e: Fix error codes in alloc_branch_attr() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 042/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 043/156] net/mlx5e: Correct snprintf truncation handling for fw_version buffer used by representors Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 044/156] net: mscc: ocelot: fix eMAC TX RMON stats for bucket 256-511 and above Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 045/156] net: mscc: ocelot: fix pMAC " Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 046/156] octeontx2-pf: Fix graceful exit during PFC configuration failure Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 047/156] net: Return error from sk_stream_wait_connect() if sk_wait_event() fails Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 048/156] net: sched: ife: fix potential use-after-free Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 049/156] ethernet: atheros: fix a memleak in atl1e_setup_ring_resources Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 050/156] net/rose: fix races in rose_kill_by_device() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 051/156] Bluetooth: Fix not notifying when connection encryption changes Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 052/156] Bluetooth: Fix deadlock in vhci_send_frame Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 053/156] Bluetooth: hci_event: shut up a false-positive warning Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 054/156] Bluetooth: hci_core: Fix hci_conn_hash_lookup_cis Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 055/156] bnxt_en: do not map packet buffers twice Greg Kroah-Hartman
2024-01-02 15:22 ` Andy Gospodarek
2024-01-03 10:04 ` Greg Kroah-Hartman
2024-01-04 20:07 ` Andy Gospodarek
2024-01-05 9:52 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 056/156] net: phy: skip LED triggers on PHYs on SFP modules Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 057/156] ice: stop trashing VF VSI aggregator node ID information Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 058/156] ice: alter feature support check for SRIOV and LAG Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 059/156] ice: Fix PF with enabled XDP going no-carrier after reset Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 060/156] net: mana: select PAGE_POOL Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 061/156] net: check vlan filter feature in vlan_vids_add_by_dev() and vlan_vids_del_by_dev() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 062/156] afs: Fix the dynamic roots d_delete to always delete unused dentries Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 063/156] afs: Fix dynamic root lookup DNS check Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 064/156] net: ethernet: mtk_wed: fix possible NULL pointer dereference in mtk_wed_wo_queue_tx_clean() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 065/156] net/ipv6: Revert remove expired routes with a separated list of routes Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 066/156] net: check dev->gso_max_size in gso_features_check() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 067/156] keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry Greg Kroah-Hartman
2024-01-05 2:13 ` Jeffrey E Altman
2024-01-05 9:51 ` Greg Kroah-Hartman
2024-01-05 10:06 ` Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 068/156] afs: Fix overwriting of result of DNS query Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 069/156] afs: Fix use-after-free due to get/remove race in volume tree Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 070/156] drm/i915/hwmon: Fix static analysis tool reported issues Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 071/156] drm/i915/mtl: Fix HDMI/DP PLL clock selection Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 072/156] ASoC: hdmi-codec: fix missing report for jack initial status Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 073/156] ASoC: fsl_sai: Fix channel swap issue on i.MX8MP Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 074/156] i2c: qcom-geni: fix missing clk_disable_unprepare() and geni_se_resources_off() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 075/156] drm/amdgpu: re-create idle bos PTE during VM state machine reset Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 076/156] i2c: aspeed: Handle the coalesced stop conditions with the start conditions Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 077/156] x86/xen: add CPU dependencies for 32-bit build Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 078/156] pinctrl: at91-pio4: use dedicated lock class for IRQ Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 079/156] gpiolib: cdev: add gpio_device locking wrapper around gpio_ioctl() Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 080/156] nvme-pci: fix sleeping function called from interrupt context Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 081/156] interconnect: Treat xlate() returning NULL node as an error Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 082/156] iio: imu: inv_mpu6050: fix an error code problem in inv_mpu6050_read_raw Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 083/156] interconnect: qcom: sm8250: Enable sync_state Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 084/156] Input: ipaq-micro-keys - add error handling for devm_kmemdup Greg Kroah-Hartman
2023-12-30 11:58 ` [PATCH 6.6 085/156] iio: adc: meson: add separate config for axg SoC family Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 086/156] scsi: bnx2fc: Fix skb double free in bnx2fc_rcv() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 087/156] scsi: ufs: qcom: Return ufs_qcom_clk_scale_*() errors in ufs_qcom_clk_scale_notify() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 088/156] scsi: ufs: core: Let the sq_lock protect sq_tail_slot access Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 089/156] iio: kx022a: Fix acceleration value scaling Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 090/156] iio: adc: imx93: add four channels for imx93 adc Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 091/156] iio: common: ms_sensors: ms_sensors_i2c: fix humidity conversion time table Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 092/156] iio: imu: adis16475: add spi_device_id table Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 093/156] iio: adc: ti_am335x_adc: Fix return value check of tiadc_request_dma() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 094/156] iio: tmag5273: fix temperature offset Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 095/156] iio: triggered-buffer: prevent possible freeing of wrong buffer Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 096/156] ALSA: usb-audio: Increase delay in MOTU M quirk Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 097/156] ARM: dts: Fix occasional boot hang for am3 usb Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 098/156] usb-storage: Add quirk for incorrect WP on Kingston DT Ultimate 3.0 G3 Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 099/156] wifi: mt76: fix crash with WED rx support enabled Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 100/156] wifi: cfg80211: Add my certificate Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 101/156] wifi: cfg80211: fix certs build to not depend on file order Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 102/156] USB: serial: ftdi_sio: update Actisense PIDs constant names Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 103/156] USB: serial: option: add Quectel EG912Y module support Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 104/156] USB: serial: option: add Foxconn T99W265 with new baseline Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 105/156] USB: serial: option: add Quectel RM500Q R13 firmware support Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 106/156] ALSA: hda/tas2781: select program 0, conf 0 by default Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 107/156] ALSA: hda/realtek: Add quirk for ASUS ROG GV302XA Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 108/156] ASoC: tas2781: check the validity of prm_no/cfg_no Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 109/156] Bluetooth: hci_event: Fix not checking if HCI_OP_INQUIRY has been sent Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 110/156] Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 111/156] Bluetooth: L2CAP: Send reject on command corrupted request Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 112/156] Bluetooth: MGMT/SMP: Fix address type when using SMP over BREDR/LE Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 113/156] Bluetooth: Add more enc key size check Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 114/156] usb: typec: ucsi: fix gpio-based orientation detection Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 115/156] usb: fotg210-hcd: delete an incorrect bounds test Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 116/156] net: usb: ax88179_178a: avoid failed operations when device is disconnected Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 117/156] Input: soc_button_array - add mapping for airplane mode button Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 118/156] net: 9p: avoid freeing uninit memory in p9pdu_vreadf Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 119/156] net: rfkill: gpio: set GPIO direction Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 120/156] net: ks8851: Fix TX stall caused by TX buffer overrun Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 121/156] net: avoid build bug in skb extension length calculation Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 122/156] net: stmmac: fix incorrect flag check in timestamp interrupt Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 123/156] dt-bindings: nvmem: mxs-ocotp: Document fsl,ocotp Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 124/156] nfsd: call nfsd_last_thread() before final nfsd_put() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 125/156] smb: client: fix OOB in cifsd when receiving compounded resps Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 126/156] smb: client: fix potential OOB in cifs_dump_detail() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 127/156] smb: client: fix OOB in SMB2_query_info_init() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 128/156] smb: client: fix OOB in smbCalcSize() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 129/156] drm/i915: Reject async flips with bigjoiner Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 130/156] drm/i915/dmc: Dont enable any pipe DMC events Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 131/156] 9p: prevent read overrun in protocol dump tracepoint Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 132/156] ring-buffer: Fix 32-bit rb_time_read() race with rb_time_cmpxchg() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 133/156] ring-buffer: Remove useless update to write_stamp in rb_try_to_discard() Greg Kroah-Hartman
2023-12-30 21:47 ` Steven Rostedt
2024-01-03 10:05 ` Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 134/156] ring-buffer: Fix slowpath of interrupted event Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 135/156] spi: atmel: Do not cancel a transfer upon any signal Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 136/156] spi: atmel: Prevent spi transfers from being killed Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 137/156] spi: atmel: Fix clock issue when using devices with different polarities Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 138/156] nvmem: brcm_nvram: store a copy of NVRAM content Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 139/156] Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity" Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 140/156] scsi: core: Always send batch on reset or error handling command Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 141/156] tracing / synthetic: Disable events after testing in synth_event_gen_test_init() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 142/156] dm-integrity: dont modify bios immutable bio_vec in integrity_metadata() Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 143/156] selftests: mptcp: join: fix subflow_send_ack lookup Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 144/156] pinctrl: starfive: jh7110: ignore disabled device tree nodes Greg Kroah-Hartman
2023-12-30 11:59 ` [PATCH 6.6 145/156] pinctrl: starfive: jh7100: " Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 146/156] bus: ti-sysc: Flush posted write only after srst_udelay Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 147/156] gpio: dwapb: mask/unmask IRQ when disable/enale it Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 148/156] lib/vsprintf: Fix %pfwf when current node refcount == 0 Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 149/156] thunderbolt: Fix memory leak in margining_port_remove() Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 150/156] KVM: arm64: vgic: Simplify kvm_vgic_destroy() Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 151/156] KVM: arm64: vgic: Add a non-locking primitive for kvm_vgic_vcpu_destroy() Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 152/156] KVM: arm64: vgic: Force vcpu vgic teardown on vcpu destroy Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 153/156] x86/alternatives: Sync core before enabling interrupts Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 154/156] x86/alternatives: Disable interrupts and sync when optimizing NOPs in place Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 155/156] x86/smpboot/64: Handle X2APIC BIOS inconsistency gracefully Greg Kroah-Hartman
2023-12-30 12:00 ` [PATCH 6.6 156/156] spi: cadence: revert "Add SPI transfer delays" Greg Kroah-Hartman
2023-12-30 12:59 ` [PATCH 6.6 000/156] 6.6.9-rc1 review Ricardo B. Marliere
2023-12-30 15:05 ` Takeshi Ogasawara
2023-12-30 16:59 ` Florian Fainelli
2023-12-30 18:11 ` SeongJae Park
2023-12-31 1:03 ` Ron Economos
2023-12-31 3:18 ` Luna Jernberg
2023-12-31 9:18 ` Greg Kroah-Hartman
2023-12-31 8:10 ` Bagas Sanjaya
2023-12-31 9:19 ` Naresh Kamboju
2023-12-31 16:33 ` Guenter Roeck
-- strict thread matches above, loose matches on Subject: below --
2023-12-30 16:57 Ronald Warsow
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox