* [PATCH 5.15 000/374] 5.15.148-rc1 review
@ 2024-01-22 23:54 Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 001/374] f2fs: explicitly null-terminate the xattr list Greg Kroah-Hartman
` (374 more replies)
0 siblings, 375 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, linux-kernel, torvalds, akpm, linux,
shuah, patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml
This is the start of the stable review cycle for the 5.15.148 release.
There are 374 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.148-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Linux 5.15.148-rc1
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_quota: copy content when cloning expression
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_last: copy content when cloning expression
Phil Sutter <phil@nwl.cc>
netfilter: nft_limit: Clone packet limits' cost value
Florian Westphal <fw@strlen.de>
netfilter: nft_limit: fix stateful object memory leak
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: typo NULL check in _clone() function
Matthew Wilcox (Oracle) <willy@infradead.org>
block: Remove special-casing of compound pages
Marek Szyprowski <m.szyprowski@samsung.com>
i2c: s3c24xx: fix transferring more than one message in polling mode
Marek Szyprowski <m.szyprowski@samsung.com>
i2c: s3c24xx: fix read transfers in polling mode
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
Amit Cohen <amcohen@nvidia.com>
selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
Ido Schimmel <idosch@nvidia.com>
mlxsw: spectrum_acl_tcam: Fix stack corruption
Ido Schimmel <idosch@nvidia.com>
mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
Ido Schimmel <idosch@nvidia.com>
mlxsw: spectrum_acl_tcam: Make fini symmetric to init
Ido Schimmel <idosch@nvidia.com>
mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
mlxsw: spectrum: Use 'bitmap_zalloc()' when applicable
Amit Cohen <amcohen@nvidia.com>
mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
Ludvig Pärsson <ludvig.parsson@axis.com>
ethtool: netlink: Add missing ethnl_ops_begin/complete
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
kdb: Fix a potential buffer overflow in kdb_local()
Fedor Pchelkin <pchelkin@ispras.ru>
ipvs: avoid stat macros calls from preemptible context
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: skip dead set elements in netlink dump
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: do not allow mismatch field size and set key length
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_limit: do not ignore unsupported flags
Vasily Averin <vasily.averin@linux.dev>
netfilter: nf_tables: memcg accounting for dynamically allocated objects
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_limit: move stateful fields out of expression data
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_limit: rename stateful structure
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_quota: move stateful fields out of expression data
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_last: move stateful fields out of expression data
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nft_connlimit: move stateful fields out of expression data
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: reject invalid set policy
Kunwu Chan <chentao@kylinos.cn>
net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
Hao Sun <sunhao.th@gmail.com>
bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
Qiang Ma <maqianga@uniontech.com>
net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls
Nikita Yushchenko <nikita.yoush@cogentembedded.com>
net: ravb: Fix dma_addr_t truncation in error case
Eric Dumazet <edumazet@google.com>
mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
Eric Dumazet <edumazet@google.com>
mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
Eric Dumazet <edumazet@google.com>
mptcp: strict validation before using mp_opt->hmac
Geliang Tang <geliang.tang@suse.com>
mptcp: drop unused sk in mptcp_get_options
Eric Dumazet <edumazet@google.com>
mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
net: phy: micrel: populate .soft_reset for KSZ9131
Sanjuán García, Jorge <Jorge.SanjuanGarcia@duagon.com>
net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
Lin Ma <linma@zju.edu.cn>
net: qualcomm: rmnet: fix global oob in rmnet_policy
Niklas Schnelle <schnelle@linux.ibm.com>
s390/pci: fix max size calculation in zpci_memcpy_toio()
Siddharth Vadapalli <s-vadapalli@ti.com>
PCI: keystone: Fix race condition when initializing PHYs
Maurizio Lombardi <mlombard@redhat.com>
nvmet-tcp: Fix the H2C expected PDU len calculation
Arnd Bergmann <arnd@arndb.de>
nvmet: re-fix tracing strncpy() warning
Christoph Niedermaier <cniedermaier@dh-electronics.com>
serial: imx: Correct clock error message in function probe()
Chunfeng Yun <chunfeng.yun@mediatek.com>
usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
Fedor Pchelkin <pchelkin@ispras.ru>
apparmor: avoid crash when parsed profile name is empty
Ian Rogers <irogers@google.com>
perf env: Avoid recursively taking env->bpf_progs.lock
Maurizio Lombardi <mlombard@redhat.com>
nvmet-tcp: fix a crash in nvmet_req_complete()
Maurizio Lombardi <mlombard@redhat.com>
nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
Douglas Anderson <dianders@chromium.org>
usb: core: Fix crash w/ usb_choose_configuration() if no driver
Oliver Neukum <oneukum@suse.com>
usb: cdc-acm: return correct error code on unsupported break
Jiri Slaby (SUSE) <jirislaby@kernel.org>
tty: use 'if' in send_break() instead of 'goto'
Jiri Slaby (SUSE) <jirislaby@kernel.org>
tty: don't check for signal_pending() in send_break()
Jiri Slaby (SUSE) <jirislaby@kernel.org>
tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
Jiri Slaby (SUSE) <jirislaby@kernel.org>
tty: change tty_write_lock()'s ndelay parameter to bool
Namhyung Kim <namhyung@kernel.org>
perf genelf: Set ELF program header addresses properly
Nuno Sa <nuno.sa@analog.com>
iio: adc: ad9467: fix scale setting
Nuno Sa <nuno.sa@analog.com>
iio: adc: ad9467: don't ignore error codes
Nuno Sa <nuno.sa@analog.com>
iio: adc: ad9467: fix reset gpio handling
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
Zhao Mengmeng <zhaomengmeng@kylinos.cn>
selftests/sgx: Skip non X86_64 platform
Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
selftests/sgx: Fix uninitialized pointer dereference in error path
Paul Geurts <paul_geurts@live.nl>
serial: imx: fix tx statemachine deadlock
Sakari Ailus <sakari.ailus@linux.intel.com>
software node: Let args be NULL in software_node_get_reference_args
Douglas Anderson <dianders@chromium.org>
r8152: Choose our USB config with choose_configuration() rather than probe()
Douglas Anderson <dianders@chromium.org>
usb: core: Allow subclassed USB drivers to override usb_choose_configuration()
Arnaldo Carvalho de Melo <acme@redhat.com>
libapi: Add missing linux/types.h header to get the __u64 type on io.h
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failed
Su Hui <suhui@nfschina.com>
power: supply: bq256xx: fix some problem in bq256xx_hw_init
Jan Palus <jpalus@fastmail.com>
power: supply: cw2015: correct time_to_empty units in sysfs
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
Alexandre Ghiti <alexghiti@rivosinc.com>
riscv: Fix module_alloc() that did not reset the linear mapping permissions
Alexandre Ghiti <alexghiti@rivosinc.com>
riscv: Check if the code to patch lies in the exit section
Serge Semin <fancer.lancer@gmail.com>
mips: Fix incorrect max_low_pfn adjustment
Serge Semin <fancer.lancer@gmail.com>
mips: dmi: Fix early remap on MIPS32
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
mfd: intel-lpss: Fix the fractional clock divider flags
Dang Huynh <danct12@riseup.net>
leds: aw2013: Select missing dependency REGMAP_I2C
Kunwu Chan <chentao@kylinos.cn>
mfd: syscon: Fix null pointer dereference in of_syscon_register()
Randy Dunlap <rdunlap@infradead.org>
ARM: 9330/1: davinci: also select PINCTRL
Isaac J. Manjarres <isaacmanjarres@google.com>
iommu/dma: Trace bounce buffer usage when mapping buffers
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: set safe default SPI clock frequency
Hugo Villeneuve <hvilleneuve@dimonoff.com>
serial: sc16is7xx: add check for unsupported SPI modes during probe
Jason Gerecke <jason.gerecke@wacom.com>
HID: wacom: Correct behavior when processing some confidence == false touches
Marcelo Schmitt <marcelo.schmitt@analog.com>
iio: adc: ad7091r: Pass iio_dev to event handler
Oliver Upton <oliver.upton@linux.dev>
KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
Marc Zyngier <maz@kernel.org>
KVM: arm64: vgic-v4: Restore pending state on host userspace write
Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
x86/kvm: Do not try to disable kvmclock if it was not enabled
qizhong cheng <qizhong.cheng@mediatek.com>
PCI: mediatek: Clear interrupt status before dispatching handler
Niklas Cassel <niklas.cassel@wdc.com>
PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
David Lin <yu-hao.lin@nxp.com>
wifi: mwifiex: configure BSSID consistently when starting AP
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
Christian Marangi <ansuelsmth@gmail.com>
wifi: mt76: fix broken precal loading from MTD for mt7915
Rob Clark <robdclark@chromium.org>
iommu/arm-smmu-qcom: Add missing GMU entry to match table
Jiri Olsa <olsajiri@gmail.com>
bpf: Fix re-attachment branch in bpf_tracing_prog_attach
Gui-Dong Han <2045gemini@gmail.com>
Bluetooth: Fix atomicity violation in {min,max}_key_size_set
Stefan Berger <stefanb@linux.ibm.com>
rootfs: Fix support for rootfstype= when root= is given
Jens Axboe <axboe@kernel.dk>
io_uring/rw: ensure io->bytes_done is always initialized
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
pwm: jz4740: Don't use dev_err_probe() in .request()
Pablo Neira Ayuso <pablo@netfilter.org>
netfilter: nf_tables: check if catch-all set element is active in next generation
Min Li <min15.li@samsung.com>
block: add check that partition length needs to be aligned with block size
Chandrakanth patil <chandrakanth.patil@broadcom.com>
scsi: mpi3mr: Refresh sdev queue depth after controller reset
Nam Cao <namcao@linutronix.de>
fbdev: flush deferred work in fb_deferred_io_fsync()
Çağhan Demir <caghandemir@marun.edu.tr>
ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
Takashi Iwai <tiwai@suse.de>
ALSA: oxygen: Fix right channel of capture volume mixer
Christoph Niedermaier <cniedermaier@dh-electronics.com>
serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
Gui-Dong Han <2045gemini@gmail.com>
usb: mon: Fix atomicity violation in mon_bin_vma_fault
RD Babiera <rdbabiera@google.com>
usb: typec: class: fix typec_altmode_put_partner to put plugs
Heikki Krogerus <heikki.krogerus@linux.intel.com>
Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
Frank Li <Frank.Li@nxp.com>
usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
Frank Li <Frank.Li@nxp.com>
usb: cdns3: fix iso transfer error when mult is not zero
Frank Li <Frank.Li@nxp.com>
usb: cdns3: fix uvc failure work since sg support enabled
Xu Yang <xu.yang_2@nxp.com>
usb: chipidea: wait controller resume finished for wakeup irq
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Revert "usb: dwc3: don't reset device side if dwc3 was configured as host-only"
Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Revert "usb: dwc3: Soft reset phy on probe for host"
Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
Xu Yang <xu.yang_2@nxp.com>
usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
Heiko Carstens <hca@linux.ibm.com>
tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
Carlos Llamas <cmllamas@google.com>
binder: fix race between mmput() and do_exit()
Jan Beulich <jbeulich@suse.com>
xen-netback: don't produce zero-size SKB frags
Wei Yongjun <weiyongjun1@huawei.com>
virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
Ren Zhijie <renzhijie2@huawei.com>
dma-mapping: Fix build error unused-value
Hans de Goede <hdegoede@redhat.com>
Input: atkbd - use ab83 as id when skipping the getid command
Carlos Llamas <cmllamas@google.com>
binder: fix unused alloc->free_async_space
Carlos Llamas <cmllamas@google.com>
binder: fix async space check for 0-sized buffers
David Howells <dhowells@redhat.com>
keys, dns: Fix size check of V1 server-list header
Jordan Rome <linux@jordanrome.com>
selftests/bpf: Add assert for user stacks in test_task_stack
Geert Uytterhoeven <geert+renesas@glider.be>
of: unittest: Fix of_count_phandle_with_args() expected value message
Christian A. Ehrhardt <lk@c--e.de>
of: Fix double free in of_parse_phandle_with_args_map
Li Nan <linan122@huawei.com>
ksmbd: validate the zero field of packet header
Zhipeng Lu <alexious@zju.edu.cn>
drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
Sergey Gorenko <sergeygo@nvidia.com>
IB/iser: Prevent invalidating wrong MR
Peter Robinson <pbrobinson@gmail.com>
mmc: sdhci_omap: Fix TI SoC dependencies
Peter Robinson <pbrobinson@gmail.com>
mmc: sdhci_am654: Fix TI SoC dependencies
Geoffrey D. Bennett <g@b4.vu>
ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
Geoffrey D. Bennett <g@b4.vu>
ALSA: scarlett2: Add missing error checks to *_ctl_get()
Geoffrey D. Bennett <g@b4.vu>
ALSA: scarlett2: Allow passing any output to line_out_remap()
Geoffrey D. Bennett <g@b4.vu>
ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()
Geoffrey D. Bennett <g@b4.vu>
ALSA: scarlett2: Add missing error check to scarlett2_config_save()
Hans de Goede <hdegoede@redhat.com>
ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
Philipp Zabel <p.zabel@pengutronix.de>
pwm: stm32: Fix enable count for clk in .probe()
Philipp Zabel <p.zabel@pengutronix.de>
pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
Théo Lebrun <theo.lebrun@bootlin.com>
clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: fixed-rate: add devm_clk_hw_register_fixed_rate
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
clk: asm9260: use parent index to link the reference clock
Su Hui <suhui@nfschina.com>
clk: si5341: fix an error code problem in si5341_output_clk_set_rate
Vignesh Raghavendra <vigneshr@ti.com>
watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
Stefan Wahren <wahrenst@gmx.net>
watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
Jerry Hoemann <jerry.hoemann@hpe.com>
watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
Curtis Klein <curtis.klein@hpe.com>
watchdog: set cdev owner before adding
Jay Buddhabhatti <jay.buddhabhatti@amd.com>
drivers: clk: zynqmp: update divider round rate logic
Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
clk: zynqmp: Add a check for NULL pointer
Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
clk: zynqmp: make bestdiv unsigned
Jay Buddhabhatti <jay.buddhabhatti@amd.com>
drivers: clk: zynqmp: calculate closest mux rate
Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
clk: qcom: videocc-sm8150: Add missing PLL config property
Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
clk: qcom: videocc-sm8150: Update the videocc resets
Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
dt-bindings: clock: Update the videocc resets for sm8150
Zhipeng Lu <alexious@zju.edu.cn>
gpu/drm/radeon: fix two memleaks in radeon_vm_init
Zhipeng Lu <alexious@zju.edu.cn>
drivers/amd/pm: fix a use-after-free in kv_parse_power_table
Zhipeng Lu <alexious@zju.edu.cn>
drm/amd/pm: fix a double-free in si_dpm_init
Alex Deucher <alexander.deucher@amd.com>
drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
Dan Carpenter <dan.carpenter@linaro.org>
media: dvbdev: drop refcount on error path in dvb_device_open()
Eric Biggers <ebiggers@google.com>
f2fs: fix the f2fs_file_write_iter tracepoint
Chao Yu <chao@kernel.org>
f2fs: fix to update iostat correctly in f2fs_filemap_fault()
Chao Yu <chao@kernel.org>
f2fs: fix to check compress file in f2fs_move_file_range()
Laurent Pinchart <laurent.pinchart@ideasonboard.com>
media: rkisp1: Disable runtime PM in probe error path
Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
Zhipeng Lu <alexious@zju.edu.cn>
media: cx231xx: fix a memleak in cx231xx_init_isoc
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drm/bridge: tc358767: Fix return value on error case
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
Zhipeng Lu <alexious@zju.edu.cn>
drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
Zhipeng Lu <alexious@zju.edu.cn>
drm/radeon/dpm: fix a memleak in sumo_parse_power_table
Yang Yingliang <yangyingliang@huawei.com>
drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/drv: propagate errors from drm_modeset_register_all()
Konrad Dybcio <konrad.dybcio@linaro.org>
drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
drm/msm/mdp4: flush vblank event on disable
Linus Walleij <linus.walleij@linaro.org>
ASoC: cs35l34: Fix GPIO name and drop legacy include
Linus Walleij <linus.walleij@linaro.org>
ASoC: cs35l33: Fix GPIO name and drop legacy include
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
drm/radeon: check return value of radeon_ring_lock()
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
Nikita Zhandarovich <n.zhandarovich@fintech.ru>
drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
Chao Yu <chao@kernel.org>
f2fs: fix to avoid dirent corruption
Dario Binacchi <dario.binacchi@amarulasolutions.com>
drm/bridge: Fix typo in post_disable() description
Ricardo B. Marliere <ricardo@marliere.net>
media: pvrusb2: fix use after free on context disconnection
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
drm/tilcdc: Fix irq free on unload
Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
Abhinav Singh <singhabhinav9051571833@gmail.com>
drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
Chris Morgan <macromorgan@hotmail.com>
drm/panel-elida-kd35t133: hold panel in reset for unprepare
Junxian Huang <huangjunxian6@hisilicon.com>
RDMA/hns: Fix inappropriate err code for unsupported operations
Leon Romanovsky <leon@kernel.org>
RDMA/usnic: Silence uninitialized symbol smatch warnings
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Revert "drm/omapdrm: Annotate dma-fence critical section in commit path"
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Revert "drm/tidss: Annotate dma-fence critical section in commit path"
Arnd Bergmann <arnd@arndb.de>
ARM: davinci: always select CONFIG_CPU_ARM926T
Eric Dumazet <edumazet@google.com>
ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
Asmaa Mnebhi <asmaa@nvidia.com>
mlxbf_gige: Enable the GigE port in mlxbf_gige_open
Asmaa Mnebhi <asmaa@nvidia.com>
net: mellanox: mlxbf_gige: Replace non-standard interrupt handling
Asmaa Mnebhi <asmaa@nvidia.com>
mlxbf_gige: Fix intermittent no ip issue
Tao Liu <taoliu828@163.com>
net/sched: act_ct: fix skb leak and crash on ooo frags
Christoph Hellwig <hch@lst.de>
null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS
Keith Busch <kbusch@kernel.org>
block: make BLK_DEF_MAX_SECTORS unsigned
Francesco Dolcini <francesco.dolcini@toradex.com>
Bluetooth: btmtkuart: fix recv_buf() return value
Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Bluetooth: Fix bogus check for re-auth no supported with non-ssp
Florian Westphal <fw@strlen.de>
netfilter: nf_tables: mark newset as dead on transaction abort
Johannes Berg <johannes.berg@intel.com>
wifi: iwlwifi: mvm: send TX path flush in rfkill
Johannes Berg <johannes.berg@intel.com>
wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: add calculate_bit_shift()
Konrad Dybcio <konrad.dybcio@linaro.org>
arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
Li Nan <linan122@huawei.com>
block: add check of 'minors' and 'first_minor' in device_add_disk()
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
Atul Dhudase <quic_adhudase@quicinc.com>
soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
Joakim Zhang <joakim.zhang@cixtech.com>
dma-mapping: clear dev->dma_mem to NULL after freeing it
Mark-PK Tsai <mark-pk.tsai@mediatek.com>
dma-mapping: Add dma_release_coherent_memory to DMA API
Arseniy Krasnov <avkrasnov@salutedevices.com>
virtio/vsock: fix logic which reduces credit update messages
Hangbin Liu <liuhangbin@gmail.com>
selftests/net: fix grep checking for fib_nexthop_multiprefix
Yihang Li <liyihang9@huawei.com>
scsi: hisi_sas: Correct the number of global debugfs registers
Yihang Li <liyihang9@huawei.com>
scsi: hisi_sas: Rollback some operations if FLR failed
Yihang Li <liyihang9@huawei.com>
scsi: hisi_sas: Replace with standard error code return value
Qi Liu <liuqi115@huawei.com>
scsi: hisi_sas: Prevent parallel FLR and controller reset
Luo Jiaxing <luojiaxing@huawei.com>
scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT
Li Nan <linan122@huawei.com>
block: Set memalloc_noio to false on device_add_disk() error path
Andrei Matei <andreimatei1@gmail.com>
bpf: Fix verification of indirect var-off stack access
Johan Hovold <johan+linaro@kernel.org>
arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
Artem Chernyshev <artem.chernyshev@red-soft.ru>
scsi: fnic: Return error if vmalloc() failed
Andrii Nakryiko <andrii@kernel.org>
bpf: fix check for attempt to corrupt spilled pointer
Douglas Anderson <dianders@chromium.org>
arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
Douglas Anderson <dianders@chromium.org>
arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
Douglas Anderson <dianders@chromium.org>
arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
Douglas Anderson <dianders@chromium.org>
arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
Douglas Anderson <dianders@chromium.org>
arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
ARM: dts: qcom: sdx65: correct SPMI node name
Andrii Nakryiko <andrii@kernel.org>
bpf: enforce precision of R0 on callback return
Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
Su Hui <suhui@nfschina.com>
wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
Dmitry Rokosov <ddrokosov@sberdevices.ru>
firmware: meson_sm: populate platform devices from sm device tree data
Christophe JAILLET <christophe.jaillet@wanadoo.fr>
firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
Peter Delevoryas <peter@pjd.dev>
net/ncsi: Fix netlink major/minor version numbers
Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
ARM: dts: qcom: apq8064: correct XOADC register address
Arnd Bergmann <arnd@arndb.de>
wifi: libertas: stop selecting wext
Luca Weiss <luca.weiss@fairphone.com>
wifi: ath11k: Defer on rproc_get failure
Jordan Rome <jordalgo@meta.com>
bpf: Add crosstask check to __bpf_get_stack
Florian Lehner <dev@der-flo.net>
bpf, lpm: Fix check prefixlen before walking trie
Chih-Kang Chang <gary.chang@realtek.com>
wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
Trond Myklebust <trond.myklebust@hammerspace.com>
NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
Benjamin Coddington <bcodding@redhat.com>
blocklayoutdriver: Fix reference leak of pnfs_device_node
Chengming Zhou <zhouchengming@bytedance.com>
crypto: scomp - fix req->dst buffer overflow
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - do not resize req->src when doing hash operations
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix processing hash requests with req->nbytes < sg->length
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - improve error handling in sahara_sha_process()
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix wait_for_completion_timeout() error handling
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix ahash reqsize
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - handle zero-length aes requests
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - avoid skcipher fallback code duplication
wangyangxin <wangyangxin1@huawei.com>
crypto: virtio - Wait for tasklet to complete on device remove
Osama Muhammad <osmtendev@gmail.com>
gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
Christian Brauner <brauner@kernel.org>
fs: indicate request originates from old mount API
Sergey Shtylyov <s.shtylyov@omp.ru>
pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix error handling in sahara_hw_descriptor_create()
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix processing requests with cryptlen < sg->length
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix ahash selftest failure
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - fix cbc selftest failure
Ovidiu Panait <ovidiu.panait@windriver.com>
crypto: sahara - remove FLAGS_NEW_KEY logic
Herbert Xu <herbert@gondor.apana.org.au>
crypto: af_alg - Disallow multiple in-flight AIO requests
Dinghao Liu <dinghao.liu@zju.edu.cn>
crypto: ccp - fix memleak in ccp_init_dm_workarea
Chen Ni <nichen@iscas.ac.cn>
crypto: sa2ul - Return crypto_aead_setkey to transfer the error
Gonglei (Arei) <arei.gonglei@huawei.com>
crypto: virtio - Handle dataq logic with tasklet
Mickaël Salaün <mic@digikod.net>
selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
ZhaoLong Wang <wangzhaolong1@huawei.com>
mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
Richard Fitzgerald <rf@opensource.cirrus.com>
kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
Tony Luck <tony.luck@intel.com>
ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
Andy Shevchenko <andriy.shevchenko@linux.intel.com>
ACPI: LPSS: Fix the fractional clock divider flags
Wolfram Sang <wsa+renesas@sang-engineering.com>
spi: sh-msiof: Enforce fixed DTDL for R-Car H3
Ilias Apalodimas <ilias.apalodimas@linaro.org>
efivarfs: force RO when remounting if SetVariable is not supported
Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
calipso: fix memory leak in netlbl_calipso_add_pass()
Alexandra Diupina <adiupina@astralinux.ru>
cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
Rob Herring <robh@kernel.org>
cpufreq: Use of_property_present() for testing DT property presence
Rob Herring <robh@kernel.org>
of: Add of_property_present() helper
Michael Walle <michael@walle.cc>
of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
Nikita Kiryushin <kiryushin@ancud.ru>
ACPI: LPIT: Avoid u32 multiplication overflow
Nikita Kiryushin <kiryushin@ancud.ru>
ACPI: video: check for error while searching for backlight device parent
Ronald Monthero <debug.penguin32@gmail.com>
mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
Kunwu Chan <chentao@kylinos.cn>
powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
Kunwu Chan <chentao@kylinos.cn>
powerpc/powernv: Add a null pointer check in opal_powercap_init()
Kunwu Chan <chentao@kylinos.cn>
powerpc/powernv: Add a null pointer check in opal_event_init()
Kunwu Chan <chentao@kylinos.cn>
powerpc/powernv: Add a null pointer check to scom_debug_init_one()
Michael Ellerman <mpe@ellerman.id.au>
selftests/powerpc: Fix error handling in FPU/VMX preemption tests
Nathan Lynch <nathanl@linux.ibm.com>
powerpc/pseries/memhp: Fix access beyond end of drmem array
Randy Dunlap <rdunlap@infradead.org>
powerpc/44x: select I2C for CURRITUCK
Masahiro Yamada <masahiroy@kernel.org>
powerpc: add crtsavres.o to always-y instead of extra-y
Masahiro Yamada <masahiroy@kernel.org>
powerpc: remove checks for binutils older than 2.25
Alan Modra <amodra@au1.ibm.com>
powerpc/toc: Future proof kernel toc
Christophe Leroy <christophe.leroy@csgroup.eu>
powerpc: Mark .opd section read-only
Arnd Bergmann <arnd@arndb.de>
EDAC/thunderx: Fix possible out-of-bounds string access
Colin Ian King <colin.i.king@gmail.com>
x86/lib: Fix overflow when counting digits
James Clark <james.clark@arm.com>
coresight: etm4x: Fix width of CCITMIN field
LeoLiuoc <LeoLiu-oc@zhaoxin.com>
PCI: Add ACS quirk for more Zhaoxin Root Ports
Florian Eckert <fe@dev.tdt.de>
leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
Cameron Williams <cang1@live.co.uk>
parport: parport_serial: Add Brainboxes device IDs and geometry
Cameron Williams <cang1@live.co.uk>
parport: parport_serial: Add Brainboxes BAR details
Guanghui Feng <guanghuifeng@linux.alibaba.com>
uio: Fix use-after-free in uio_open
Carlos Llamas <cmllamas@google.com>
binder: fix comment on binder_alloc_new_buf() return value
Carlos Llamas <cmllamas@google.com>
binder: fix trivial typo of binder_free_buf_locked()
Carlos Llamas <cmllamas@google.com>
binder: fix use-after-free in shinker's callback
Carlos Llamas <cmllamas@google.com>
binder: use EPOLLERR from eventpoll.h
Junxiao Bi <junxiao.bi@oracle.com>
Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
Masami Hiramatsu (Google) <mhiramat@kernel.org>
kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
Alan Maguire <alan.maguire@oracle.com>
bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
Hans de Goede <hdegoede@redhat.com>
ACPI: resource: Add another DMI match for the TongFang GMxXGxx
Jani Nikula <jani.nikula@intel.com>
drm/crtc: fix uninitialized variable use
Stefan Wahren <wahrenst@gmx.net>
ARM: sun9i: smp: fix return code check of of_property_match_string
Sarannya S <quic_sarannya@quicinc.com>
net: qrtr: ns: Return 0 if server port is not present
Matthew Wilcox (Oracle) <willy@infradead.org>
ida: Fix crash in ida_free when the bitmap is empty
Jensen Huang <jensenhuang@friendlyarm.com>
i2c: rk3x: fix potential spinlock recursion on poll
Hans de Goede <hdegoede@redhat.com>
ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
Luca Weiss <luca@z3ntu.xyz>
Input: xpad - add Razer Wolverine V2 support
Avraham Stern <avraham.stern@intel.com>
wifi: iwlwifi: pcie: avoid a NULL pointer dereference
Vineet Gupta <vgupta@kernel.org>
ARC: fix spare error
Vineeth Vijayan <vneethv@linux.ibm.com>
s390/scm: fix virtual vs physical address confusion
Esther Shimanovich <eshimanovich@chromium.org>
Input: i8042 - add nomux quirk for Acer P459-G2-M
Hans de Goede <hdegoede@redhat.com>
Input: atkbd - skip ATKBD_CMD_GETID in translated mode
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
Steven Rostedt (Google) <rostedt@goodmis.org>
ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
Zheng Yejian <zhengyejian1@huawei.com>
tracing: Fix uaf issue when open the hist or hist_debug file
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
MIPS: dts: loongson: drop incorrect dwmac fallback compatible
Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
stmmac: dwmac-loongson: drop useless check for compatible fallback
Steven Rostedt (Google) <rostedt@goodmis.org>
tracing: Add size check when printing trace_marker output
Steven Rostedt (Google) <rostedt@goodmis.org>
tracing: Have large events show up as '[LINE TOO BIG]' instead of nothing
Ye Bin <yebin10@huawei.com>
jbd2: fix soft lockup in journal_finish_inode_data_buffers()
Hans de Goede <hdegoede@redhat.com>
platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
Judy Hsiao <judyhsiao@chromium.org>
neighbour: Don't let neigh_forced_gc() disable preemption for long
Ziqi Zhao <astrajoan@yahoo.com>
drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
Zhang Yi <yi.zhang@huawei.com>
jbd2: correct the printing of write_flags in jbd2_write_superblock()
Weihao Li <cn.liweihao@gmail.com>
clk: rockchip: rk3128: Fix HCLK_OTG gate register
Armin Wolf <W_Armin@gmx.de>
hwmon: (corsair-psu) Fix probe when built-in
Inki Dae <inki.dae@samsung.com>
drm/exynos: fix a wrong error checking
Xiang Yang <xiangyang3@huawei.com>
drm/exynos: fix a potential error pointer dereference
Lijo Lazar <lijo.lazar@amd.com>
drm/amdgpu: Add NULL checks for function pointers
Keith Busch <kbusch@kernel.org>
nvme: introduce helper function to get ctrl state
Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
ASoC: ops: add correct range check for limiting volume
David Rau <David.Rau.opensource@dm.renesas.com>
ASoC: da7219: Support low DC impedance headset
Thinh Tran <thinhtr@linux.vnet.ibm.com>
net/tg3: fix race condition in tg3_reset_task()
Dave Airlie <airlied@redhat.com>
nouveau/tu102: flush all pdbs on vmm flush
Shuming Fan <shumingf@realtek.com>
ASoC: rt5650: add mutex to avoid the jack detection failure
Maciej Strozek <mstrozek@opensource.cirrus.com>
ASoC: cs43130: Fix incorrect frame delay configuration
Maciej Strozek <mstrozek@opensource.cirrus.com>
ASoC: cs43130: Fix the position of const qualifier
Kamil Duljas <kamil.duljas@gmail.com>
ASoC: Intel: Skylake: mem leak in skl register function
David Lin <CTLIN0@nuvoton.com>
ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
Kamil Duljas <kamil.duljas@gmail.com>
ASoC: Intel: Skylake: Fix mem leak in few functions
Charles Keepax <ckeepax@opensource.cirrus.com>
ASoC: wm8974: Correct boost mixer inputs
Keith Busch <kbusch@kernel.org>
nvme-core: check for too small lba shift
Lu Yao <yaolu@kylinos.cn>
drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
Johannes Berg <johannes.berg@intel.com>
debugfs: fix automount d_fsdata usage
Johannes Berg <johannes.berg@intel.com>
wifi: cfg80211: lock wiphy mutex for rfkill poll
Edward Adam Davis <eadavis@qq.com>
mptcp: fix uninit-value in mptcp_incoming_options
Vasiliy Kovalev <kovalev@altlinux.org>
ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
Charles Keepax <ckeepax@opensource.cirrus.com>
pinctrl: lochnagar: Don't build on MIPS
Eric Biggers <ebiggers@google.com>
f2fs: explicitly null-terminate the xattr list
-------------
Diffstat:
Makefile | 4 +-
arch/arc/kernel/signal.c | 6 +-
arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +-
arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +-
arch/arm/mach-davinci/Kconfig | 2 +
arch/arm/mach-sunxi/mc_smp.c | 4 +-
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
arch/arm64/boot/dts/qcom/sc7280.dtsi | 8 +-
arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 +-
arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +-
arch/arm64/kvm/vgic/vgic-its.c | 5 +
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 27 +-
arch/mips/alchemy/devboards/db1200.c | 2 +-
arch/mips/alchemy/devboards/db1550.c | 2 +-
arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +-
arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +-
arch/mips/include/asm/dmi.h | 2 +-
arch/mips/kernel/setup.c | 4 +-
arch/powerpc/Makefile | 16 +-
arch/powerpc/boot/crt0.S | 2 +-
arch/powerpc/boot/zImage.lds.S | 7 +-
arch/powerpc/include/asm/sections.h | 16 +-
arch/powerpc/kernel/head_64.S | 2 +-
arch/powerpc/kernel/vmlinux.lds.S | 20 +-
arch/powerpc/lib/Makefile | 4 +-
arch/powerpc/perf/imc-pmu.c | 6 +
arch/powerpc/platforms/44x/Kconfig | 1 +
arch/powerpc/platforms/powernv/opal-irqchip.c | 2 +
arch/powerpc/platforms/powernv/opal-powercap.c | 6 +
arch/powerpc/platforms/powernv/opal-xscom.c | 5 +
arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +-
arch/riscv/include/asm/sections.h | 1 +
arch/riscv/kernel/module.c | 3 +-
arch/riscv/kernel/patch.c | 11 +-
arch/riscv/kernel/vmlinux-xip.lds.S | 2 +
arch/riscv/kernel/vmlinux.lds.S | 2 +
arch/s390/include/asm/pci_io.h | 32 ++-
arch/s390/pci/pci_mmio.c | 12 +-
arch/x86/kernel/kvmclock.c | 12 +-
arch/x86/lib/misc.c | 2 +-
block/bio.c | 7 +-
block/blk-settings.c | 2 +-
block/genhd.c | 5 +-
block/ioctl.c | 11 +-
crypto/af_alg.c | 14 +-
crypto/scompress.c | 6 +
drivers/acpi/acpi_extlog.c | 7 +-
drivers/acpi/acpi_lpit.c | 2 +-
drivers/acpi/acpi_lpss.c | 3 +-
drivers/acpi/acpi_video.c | 12 +-
drivers/acpi/resource.c | 7 +
drivers/android/binder.c | 2 +-
drivers/android/binder_alloc.c | 32 +--
drivers/base/swnode.c | 3 +
drivers/block/null_blk/main.c | 13 +-
drivers/bluetooth/btmtkuart.c | 11 +-
drivers/clk/clk-asm9260.c | 29 +-
drivers/clk/clk-fixed-rate.c | 28 +-
drivers/clk/clk-si5341.c | 4 +-
drivers/clk/qcom/gpucc-sm8150.c | 4 +-
drivers/clk/qcom/videocc-sm8150.c | 5 +
drivers/clk/rockchip/clk-rk3128.c | 2 +-
drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +-
drivers/clk/zynqmp/divider.c | 63 +----
drivers/cpufreq/cpufreq-dt-platdev.c | 2 +-
drivers/cpufreq/imx-cpufreq-dt.c | 2 +-
drivers/cpufreq/imx6q-cpufreq.c | 4 +-
drivers/cpufreq/scmi-cpufreq.c | 7 +-
drivers/cpufreq/tegra20-cpufreq.c | 2 +-
drivers/crypto/ccp/ccp-ops.c | 5 +-
drivers/crypto/sa2ul.c | 3 +-
drivers/crypto/sahara.c | 248 ++++++++----------
drivers/crypto/virtio/virtio_crypto_algs.c | 2 +-
drivers/crypto/virtio/virtio_crypto_common.h | 2 +
drivers/crypto/virtio/virtio_crypto_core.c | 26 +-
drivers/edac/thunderx_edac.c | 10 +-
drivers/firmware/meson/meson_sm.c | 5 +-
drivers/firmware/ti_sci.c | 10 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 10 +-
drivers/gpu/drm/amd/amdgpu/soc15.c | 12 +-
.../gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +-
drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 4 +-
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 +-
.../gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 +-
drivers/gpu/drm/bridge/tc358767.c | 2 +-
drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 +-
drivers/gpu/drm/drm_crtc.c | 8 +-
drivers/gpu/drm/drm_drv.c | 10 +-
drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +-
drivers/gpu/drm/exynos/exynos_hdmi.c | 2 +
drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +
drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +-
drivers/gpu/drm/nouveau/nv04_fence.c | 2 +-
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +-
drivers/gpu/drm/omapdrm/omap_drv.c | 9 +-
drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 +
drivers/gpu/drm/radeon/r100.c | 4 +-
drivers/gpu/drm/radeon/r600_cs.c | 4 +-
drivers/gpu/drm/radeon/radeon_display.c | 7 +-
drivers/gpu/drm/radeon/radeon_vm.c | 8 +-
drivers/gpu/drm/radeon/si.c | 4 +
drivers/gpu/drm/radeon/sumo_dpm.c | 4 +-
drivers/gpu/drm/radeon/trinity_dpm.c | 4 +-
drivers/gpu/drm/tidss/tidss_kms.c | 4 -
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +-
drivers/hid/wacom_wac.c | 32 +--
drivers/hwmon/corsair-psu.c | 18 +-
drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
drivers/i2c/busses/i2c-rk3x.c | 13 +-
drivers/i2c/busses/i2c-s3c2410.c | 40 +--
drivers/iio/adc/ad7091r-base.c | 6 +-
drivers/iio/adc/ad9467.c | 114 +++++---
drivers/iio/adc/adi-axi-adc.c | 74 ++----
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +-
drivers/infiniband/hw/mthca/mthca_cmd.c | 4 +-
drivers/infiniband/hw/mthca/mthca_main.c | 2 +-
drivers/infiniband/ulp/iser/iscsi_iser.h | 2 -
drivers/infiniband/ulp/iser/iser_initiator.c | 5 +-
drivers/infiniband/ulp/iser/iser_memory.c | 8 +-
drivers/infiniband/ulp/iser/iser_verbs.c | 1 -
drivers/input/joystick/xpad.c | 1 +
drivers/input/keyboard/atkbd.c | 50 +++-
drivers/input/serio/i8042-acpipnpio.h | 8 +
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 +
drivers/iommu/dma-iommu.c | 3 +
drivers/leds/Kconfig | 1 +
drivers/leds/trigger/ledtrig-tty.c | 4 +
drivers/md/raid5.c | 12 -
drivers/media/dvb-core/dvbdev.c | 2 +
drivers/media/dvb-frontends/m88ds3103.c | 7 +-
.../media/platform/rockchip/rkisp1/rkisp1-dev.c | 3 +-
drivers/media/usb/cx231xx/cx231xx-core.c | 2 +
drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 +-
drivers/mfd/intel-lpss.c | 2 +-
drivers/mfd/syscon.c | 4 +
drivers/mmc/host/Kconfig | 10 +-
drivers/mtd/mtd_blkdevs.c | 4 +-
drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +-
drivers/net/dsa/vitesse-vsc73xx-core.c | 2 +
drivers/net/ethernet/broadcom/tg3.c | 11 +-
drivers/net/ethernet/mellanox/mlxbf_gige/Makefile | 1 -
.../net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 12 -
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c | 212 ---------------
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 48 ++--
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 6 +-
.../ethernet/mellanox/mlxsw/spectrum_acl_atcam.c | 8 +-
.../net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c | 8 +-
.../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 131 +++++-----
drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +-
.../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 11 +-
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +-
drivers/net/ethernet/renesas/ravb_main.c | 2 +-
.../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 -
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
.../net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 10 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 5 +-
drivers/net/phy/micrel.c | 1 +
drivers/net/usb/r8152.c | 16 +-
drivers/net/wireless/ath/ath11k/ahb.c | 4 +-
drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 -
drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +-
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +-
drivers/net/wireless/marvell/libertas/Kconfig | 2 -
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +
drivers/net/wireless/marvell/mwifiex/fw.h | 1 +
drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 +
drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 8 +
drivers/net/wireless/mediatek/mt76/eeprom.c | 2 +-
drivers/net/wireless/realtek/rtlwifi/pci.c | 79 ++----
drivers/net/wireless/realtek/rtlwifi/pci.h | 5 -
.../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 +-
.../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 +-
.../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 -
.../net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +-
.../net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 -
.../net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +-
.../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 15 +-
.../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 +-
.../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 15 +-
.../net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +-
drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +
drivers/net/wireless/realtek/rtw88/mac80211.c | 4 +-
drivers/net/xen-netback/netback.c | 44 +++-
drivers/nvme/host/core.c | 5 +-
drivers/nvme/host/nvme.h | 5 +
drivers/nvme/target/tcp.c | 20 +-
drivers/nvme/target/trace.h | 3 +-
drivers/of/base.c | 1 +
drivers/of/unittest-data/tests-phandle.dtsi | 10 +-
drivers/of/unittest.c | 74 +++---
drivers/parport/parport_serial.c | 64 +++++
drivers/pci/controller/dwc/pci-keystone.c | 9 +
drivers/pci/controller/dwc/pcie-designware-ep.c | 1 +
drivers/pci/controller/pcie-mediatek.c | 10 +-
drivers/pci/quirks.c | 8 +-
drivers/pinctrl/cirrus/Kconfig | 3 +-
drivers/platform/x86/intel/vbtn.c | 19 +-
drivers/power/supply/bq256xx_charger.c | 5 +-
drivers/power/supply/cw2015_battery.c | 2 +-
drivers/pwm/pwm-jz4740.c | 7 +-
drivers/pwm/pwm-stm32.c | 63 ++---
drivers/reset/hisilicon/hi6220_reset.c | 2 +-
drivers/s390/block/scm_blk.c | 7 +-
drivers/scsi/fnic/fnic_debugfs.c | 3 +-
drivers/scsi/hisi_sas/hisi_sas.h | 2 +-
drivers/scsi/hisi_sas/hisi_sas_main.c | 22 +-
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 20 +-
drivers/scsi/mpi3mr/mpi3mr_os.c | 10 +-
drivers/soc/qcom/llcc-qcom.c | 8 +-
drivers/spi/Kconfig | 3 +-
drivers/spi/spi-sh-msiof.c | 17 ++
drivers/tty/serial/8250/8250_omap.c | 2 +-
drivers/tty/serial/imx.c | 29 +-
drivers/tty/serial/sc16is7xx.c | 8 +-
drivers/tty/tty.h | 2 +-
drivers/tty/tty_io.c | 35 +--
drivers/tty/tty_ioctl.c | 2 +-
drivers/uio/uio.c | 7 +-
drivers/usb/cdns3/cdns3-gadget.c | 142 +++++++---
drivers/usb/cdns3/cdns3-gadget.h | 3 +
drivers/usb/chipidea/core.c | 7 +
drivers/usb/class/cdc-acm.c | 3 +
drivers/usb/core/generic.c | 16 ++
drivers/usb/dwc3/core.c | 39 +--
drivers/usb/dwc3/ep0.c | 5 +-
drivers/usb/host/xhci-mtk.c | 40 ++-
drivers/usb/host/xhci-mtk.h | 2 +
drivers/usb/mon/mon_bin.c | 7 +-
drivers/usb/phy/phy-mxs-usb.c | 3 +-
drivers/usb/typec/class.c | 4 +-
drivers/video/fbdev/core/fb_defio.c | 6 +-
drivers/watchdog/bcm2835_wdt.c | 3 +-
drivers/watchdog/hpwdt.c | 2 +-
drivers/watchdog/rti_wdt.c | 13 +-
drivers/watchdog/watchdog_dev.c | 3 +-
fs/debugfs/file.c | 8 +
fs/debugfs/inode.c | 27 +-
fs/debugfs/internal.h | 10 +-
fs/efivarfs/super.c | 12 +
fs/f2fs/file.c | 12 +-
fs/f2fs/namei.c | 2 +-
fs/f2fs/xattr.c | 6 +
fs/gfs2/rgrp.c | 2 +-
fs/jbd2/commit.c | 1 +
fs/jbd2/journal.c | 4 +-
fs/ksmbd/smb_common.c | 6 +-
fs/namespace.c | 11 +
fs/nfs/blocklayout/blocklayout.c | 2 +
fs/nfs/nfs4proc.c | 3 +
fs/pstore/ram_core.c | 2 +-
include/crypto/if_alg.h | 3 +
include/drm/drm_bridge.h | 2 +-
include/dt-bindings/clock/qcom,videocc-sm8150.h | 4 +
include/linux/blkdev.h | 3 +-
include/linux/clk-provider.h | 52 +++-
include/linux/dma-map-ops.h | 3 +
include/linux/iio/adc/adi-axi-adc.h | 4 +
include/linux/of.h | 291 ++++++++++-----------
include/linux/usb.h | 6 +
include/net/bluetooth/hci_core.h | 1 -
include/trace/events/f2fs.h | 12 +-
include/uapi/linux/bpf.h | 3 +
init/do_mounts.c | 9 +-
io_uring/io_uring.c | 9 +-
kernel/bpf/lpm_trie.c | 3 +
kernel/bpf/stackmap.c | 11 +-
kernel/bpf/syscall.c | 9 +
kernel/bpf/verifier.c | 27 +-
kernel/debug/kdb/kdb_main.c | 2 -
kernel/dma/coherent.c | 12 +-
kernel/kprobes.c | 23 +-
kernel/time/tick-sched.c | 5 +
kernel/trace/ring_buffer.c | 6 +
kernel/trace/trace.c | 12 +-
kernel/trace/trace.h | 1 +
kernel/trace/trace_events_hist.c | 12 +-
kernel/trace/trace_output.c | 6 +-
lib/idr.c | 2 +-
lib/kunit/debugfs.c | 4 +-
lib/test_ida.c | 40 +++
net/bluetooth/hci_conn.c | 8 +-
net/bluetooth/hci_debugfs.c | 12 +-
net/bluetooth/hci_event.c | 11 +-
net/core/neighbour.c | 9 +-
net/dns_resolver/dns_key.c | 2 +-
net/ethtool/features.c | 9 +-
net/ipv6/ip6_tunnel.c | 26 +-
net/ipv6/mcast.c | 4 +
net/mptcp/options.c | 12 +-
net/mptcp/protocol.h | 3 +-
net/mptcp/subflow.c | 18 +-
net/ncsi/internal.h | 7 +-
net/ncsi/ncsi-netlink.c | 4 +-
net/ncsi/ncsi-pkt.h | 7 +-
net/ncsi/ncsi-rsp.c | 26 +-
net/netfilter/ipvs/ip_vs_xmit.c | 4 +-
net/netfilter/nf_tables_api.c | 29 +-
net/netfilter/nft_connlimit.c | 37 ++-
net/netfilter/nft_counter.c | 2 +-
net/netfilter/nft_last.c | 73 ++++--
net/netfilter/nft_limit.c | 199 ++++++++++----
net/netfilter/nft_quota.c | 56 +++-
net/netlabel/netlabel_calipso.c | 49 ++--
net/qrtr/ns.c | 4 +-
net/sched/act_ct.c | 12 +-
net/vmw_vsock/virtio_transport_common.c | 13 +-
net/wireless/core.c | 2 +
scripts/Makefile.compiler | 4 -
scripts/pahole-flags.sh | 3 +
security/apparmor/policy_unpack.c | 4 +
security/selinux/hooks.c | 7 +
sound/pci/hda/patch_realtek.c | 11 +
sound/pci/oxygen/oxygen_mixer.c | 2 +-
sound/soc/atmel/sam9g20_wm8731.c | 61 +++++
sound/soc/codecs/cs35l33.c | 4 +-
sound/soc/codecs/cs35l34.c | 4 +-
sound/soc/codecs/cs43130.c | 6 +-
sound/soc/codecs/da7219-aad.c | 2 +-
sound/soc/codecs/nau8822.c | 9 +-
sound/soc/codecs/rt5645.c | 18 +-
sound/soc/codecs/wm8974.c | 6 +-
sound/soc/intel/boards/bytcr_rt5640.c | 12 +
sound/soc/intel/skylake/skl-pcm.c | 9 +-
sound/soc/intel/skylake/skl-sst-ipc.c | 4 +-
sound/soc/soc-ops.c | 2 +-
sound/usb/mixer_scarlett_gen2.c | 223 ++++++++++------
tools/include/uapi/linux/bpf.h | 3 +
tools/lib/api/io.h | 1 +
tools/perf/util/bpf-event.c | 8 +-
tools/perf/util/bpf-event.h | 12 +-
tools/perf/util/env.c | 50 ++--
tools/perf/util/env.h | 4 +
tools/perf/util/genelf.c | 6 +-
tools/perf/util/header.c | 8 +-
tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 2 +
.../selftests/bpf/progs/bpf_iter_task_stack.c | 5 +
.../testing/selftests/drivers/net/mlxsw/qos_pfc.sh | 18 +-
.../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 106 +++++++-
.../selftests/net/fib_nexthop_multiprefix.sh | 4 +-
tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +-
tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 +-
tools/testing/selftests/sgx/Makefile | 2 +-
tools/testing/selftests/sgx/sigstruct.c | 5 +-
352 files changed, 2978 insertions(+), 2010 deletions(-)
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 001/374] f2fs: explicitly null-terminate the xattr list
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 002/374] pinctrl: lochnagar: Dont build on MIPS Greg Kroah-Hartman
` (373 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Chao Yu, Jaegeuk Kim
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
commit e26b6d39270f5eab0087453d9b544189a38c8564 upstream.
When setting an xattr, explicitly null-terminate the xattr list. This
eliminates the fragile assumption that the unused xattr space is always
zeroed.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/xattr.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/fs/f2fs/xattr.c
+++ b/fs/f2fs/xattr.c
@@ -745,6 +745,12 @@ static int __f2fs_setxattr(struct inode
memcpy(pval, value, size);
last->e_value_size = cpu_to_le16(size);
new_hsize += newsize;
+ /*
+ * Explicitly add the null terminator. The unused xattr space
+ * is supposed to always be zeroed, which would make this
+ * unnecessary, but don't depend on that.
+ */
+ *(u32 *)((u8 *)last + newsize) = 0;
}
error = write_all_xattrs(inode, new_hsize, base_addr, ipage);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 002/374] pinctrl: lochnagar: Dont build on MIPS
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 001/374] f2fs: explicitly null-terminate the xattr list Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 003/374] ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro Greg Kroah-Hartman
` (372 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Linus Walleij,
Charles Keepax, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit 6588732445ff19f6183f0fa72ddedf67e5a5be32 ]
MIPS appears to define a RST symbol at a high level, which clashes
with some register naming in the driver. Since there is currently
no case for running this driver on MIPS devices simply cut off the
build of this driver on MIPS.
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311071303.JJMAOjy4-lkp@intel.com/
Suggested-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231115162853.1891940-1-ckeepax@opensource.cirrus.com
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pinctrl/cirrus/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/pinctrl/cirrus/Kconfig b/drivers/pinctrl/cirrus/Kconfig
index 530426a74f75..b3cea8d56c4f 100644
--- a/drivers/pinctrl/cirrus/Kconfig
+++ b/drivers/pinctrl/cirrus/Kconfig
@@ -1,7 +1,8 @@
# SPDX-License-Identifier: GPL-2.0-only
config PINCTRL_LOCHNAGAR
tristate "Cirrus Logic Lochnagar pinctrl driver"
- depends on MFD_LOCHNAGAR
+ # Avoid clash caused by MIPS defining RST, which is used in the driver
+ depends on MFD_LOCHNAGAR && !MIPS
select GPIOLIB
select PINMUX
select PINCONF
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 003/374] ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 001/374] f2fs: explicitly null-terminate the xattr list Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 002/374] pinctrl: lochnagar: Dont build on MIPS Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 004/374] mptcp: fix uninit-value in mptcp_incoming_options Greg Kroah-Hartman
` (371 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasiliy Kovalev, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
[ Upstream commit 7c9caa299335df94ad1c58f70a22f16a540eab60 ]
This patch corrected the speaker and headset mic pin config to the more
appropriate values.
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Link: https://lore.kernel.org/r/20231117170923.106822-1-kovalev@altlinux.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/hda/patch_realtek.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 5e0e19c4b509..87de2cbd7f3e 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -6854,6 +6854,7 @@ enum {
ALC290_FIXUP_SUBWOOFER_HSJACK,
ALC269_FIXUP_THINKPAD_ACPI,
ALC269_FIXUP_DMIC_THINKPAD_ACPI,
+ ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO,
ALC255_FIXUP_ACER_MIC_NO_PRESENCE,
ALC255_FIXUP_ASUS_MIC_NO_PRESENCE,
ALC255_FIXUP_DELL1_MIC_NO_PRESENCE,
@@ -7152,6 +7153,14 @@ static const struct hda_fixup alc269_fixups[] = {
.type = HDA_FIXUP_FUNC,
.v.func = alc269_fixup_pincfg_U7x7_headset_mic,
},
+ [ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO] = {
+ .type = HDA_FIXUP_PINS,
+ .v.pins = (const struct hda_pintbl[]) {
+ { 0x18, 0x03a19020 }, /* headset mic */
+ { 0x1b, 0x90170150 }, /* speaker */
+ { }
+ },
+ },
[ALC269_FIXUP_AMIC] = {
.type = HDA_FIXUP_PINS,
.v.pins = (const struct hda_pintbl[]) {
@@ -9402,6 +9411,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1d72, 0x1945, "Redmi G", ALC256_FIXUP_ASUS_HEADSET_MIC),
SND_PCI_QUIRK(0x1d72, 0x1947, "RedmiBook Air", ALC255_FIXUP_XIAOMI_HEADSET_MIC),
+ SND_PCI_QUIRK(0x2782, 0x0232, "CHUWI CoreBook XPro", ALC269VB_FIXUP_CHUWI_COREBOOK_XPRO),
SND_PCI_QUIRK(0x8086, 0x2074, "Intel NUC 8", ALC233_FIXUP_INTEL_NUC8_DMIC),
SND_PCI_QUIRK(0x8086, 0x2080, "Intel NUC 8 Rugged", ALC256_FIXUP_INTEL_NUC8_RUGGED),
SND_PCI_QUIRK(0x8086, 0x2081, "Intel NUC 10", ALC256_FIXUP_INTEL_NUC10),
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 004/374] mptcp: fix uninit-value in mptcp_incoming_options
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 003/374] ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 005/374] wifi: cfg80211: lock wiphy mutex for rfkill poll Greg Kroah-Hartman
` (370 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+b834a6b2decad004cfa1,
Edward Adam Davis, Paolo Abeni, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Edward Adam Davis <eadavis@qq.com>
[ Upstream commit 237ff253f2d4f6307b7b20434d7cbcc67693298b ]
Added initialization use_ack to mptcp_parse_option().
Reported-by: syzbot+b834a6b2decad004cfa1@syzkaller.appspotmail.com
Signed-off-by: Edward Adam Davis <eadavis@qq.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/options.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index aa4b0cf7c638..012e0e352276 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -103,6 +103,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
mp_opt->suboptions |= OPTION_MPTCP_DSS;
mp_opt->use_map = 1;
mp_opt->mpc_map = 1;
+ mp_opt->use_ack = 0;
mp_opt->data_len = get_unaligned_be16(ptr);
ptr += 2;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 005/374] wifi: cfg80211: lock wiphy mutex for rfkill poll
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 004/374] mptcp: fix uninit-value in mptcp_incoming_options Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 006/374] debugfs: fix automount d_fsdata usage Greg Kroah-Hartman
` (369 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7e59a5bfc7a897247e18,
Johannes Berg, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 8e2f6f2366219b3304b227bdd2f04b64c92e3e12 ]
We want to guarantee the mutex is held for pretty much
all operations, so ensure that here as well.
Reported-by: syzbot+7e59a5bfc7a897247e18@syzkaller.appspotmail.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/wireless/core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index d10686f4bf15..d51d27ff3729 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -216,7 +216,9 @@ static void cfg80211_rfkill_poll(struct rfkill *rfkill, void *data)
{
struct cfg80211_registered_device *rdev = data;
+ wiphy_lock(&rdev->wiphy);
rdev_rfkill_poll(rdev);
+ wiphy_unlock(&rdev->wiphy);
}
void cfg80211_stop_p2p_device(struct cfg80211_registered_device *rdev,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 006/374] debugfs: fix automount d_fsdata usage
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 005/374] wifi: cfg80211: lock wiphy mutex for rfkill poll Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 007/374] drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer Greg Kroah-Hartman
` (368 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Johannes Berg, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 0ed04a1847a10297595ac24dc7d46b35fb35f90a ]
debugfs_create_automount() stores a function pointer in d_fsdata,
but since commit 7c8d469877b1 ("debugfs: add support for more
elaborate ->d_fsdata") debugfs_release_dentry() will free it, now
conditionally on DEBUGFS_FSDATA_IS_REAL_FOPS_BIT, but that's not
set for the function pointer in automount. As a result, removing
an automount dentry would attempt to free the function pointer.
Luckily, the only user of this (tracing) never removes it.
Nevertheless, it's safer if we just handle the fsdata in one way,
namely either DEBUGFS_FSDATA_IS_REAL_FOPS_BIT or allocated. Thus,
change the automount to allocate it, and use the real_fops in the
data to indicate whether or not automount is filled, rather than
adding a type tag. At least for now this isn't actually needed,
but the next changes will require it.
Also check in debugfs_file_get() that it gets only called
on regular files, just to make things clearer.
Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/debugfs/file.c | 8 ++++++++
fs/debugfs/inode.c | 27 ++++++++++++++++++++-------
fs/debugfs/internal.h | 10 ++++++++--
3 files changed, 36 insertions(+), 9 deletions(-)
diff --git a/fs/debugfs/file.c b/fs/debugfs/file.c
index 38930d9b0bb7..df5c2162e729 100644
--- a/fs/debugfs/file.c
+++ b/fs/debugfs/file.c
@@ -84,6 +84,14 @@ int debugfs_file_get(struct dentry *dentry)
struct debugfs_fsdata *fsd;
void *d_fsd;
+ /*
+ * This could only happen if some debugfs user erroneously calls
+ * debugfs_file_get() on a dentry that isn't even a file, let
+ * them know about it.
+ */
+ if (WARN_ON(!d_is_reg(dentry)))
+ return -EINVAL;
+
d_fsd = READ_ONCE(dentry->d_fsdata);
if (!((unsigned long)d_fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)) {
fsd = d_fsd;
diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c
index 26f9cd328291..5290a721a703 100644
--- a/fs/debugfs/inode.c
+++ b/fs/debugfs/inode.c
@@ -214,17 +214,19 @@ static const struct super_operations debugfs_super_operations = {
static void debugfs_release_dentry(struct dentry *dentry)
{
- void *fsd = dentry->d_fsdata;
+ struct debugfs_fsdata *fsd = dentry->d_fsdata;
- if (!((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT))
- kfree(dentry->d_fsdata);
+ if ((unsigned long)fsd & DEBUGFS_FSDATA_IS_REAL_FOPS_BIT)
+ return;
+
+ kfree(fsd);
}
static struct vfsmount *debugfs_automount(struct path *path)
{
- debugfs_automount_t f;
- f = (debugfs_automount_t)path->dentry->d_fsdata;
- return f(path->dentry, d_inode(path->dentry)->i_private);
+ struct debugfs_fsdata *fsd = path->dentry->d_fsdata;
+
+ return fsd->automount(path->dentry, d_inode(path->dentry)->i_private);
}
static const struct dentry_operations debugfs_dops = {
@@ -602,13 +604,23 @@ struct dentry *debugfs_create_automount(const char *name,
void *data)
{
struct dentry *dentry = start_creating(name, parent);
+ struct debugfs_fsdata *fsd;
struct inode *inode;
if (IS_ERR(dentry))
return dentry;
+ fsd = kzalloc(sizeof(*fsd), GFP_KERNEL);
+ if (!fsd) {
+ failed_creating(dentry);
+ return ERR_PTR(-ENOMEM);
+ }
+
+ fsd->automount = f;
+
if (!(debugfs_allow & DEBUGFS_ALLOW_API)) {
failed_creating(dentry);
+ kfree(fsd);
return ERR_PTR(-EPERM);
}
@@ -616,13 +628,14 @@ struct dentry *debugfs_create_automount(const char *name,
if (unlikely(!inode)) {
pr_err("out of free dentries, can not create automount '%s'\n",
name);
+ kfree(fsd);
return failed_creating(dentry);
}
make_empty_dir_inode(inode);
inode->i_flags |= S_AUTOMOUNT;
inode->i_private = data;
- dentry->d_fsdata = (void *)f;
+ dentry->d_fsdata = fsd;
/* directory inodes start off with i_nlink == 2 (for "." entry) */
inc_nlink(inode);
d_instantiate(dentry, inode);
diff --git a/fs/debugfs/internal.h b/fs/debugfs/internal.h
index 92af8ae31313..f7c489b5a368 100644
--- a/fs/debugfs/internal.h
+++ b/fs/debugfs/internal.h
@@ -17,8 +17,14 @@ extern const struct file_operations debugfs_full_proxy_file_operations;
struct debugfs_fsdata {
const struct file_operations *real_fops;
- refcount_t active_users;
- struct completion active_users_drained;
+ union {
+ /* automount_fn is used when real_fops is NULL */
+ debugfs_automount_t automount;
+ struct {
+ refcount_t active_users;
+ struct completion active_users_drained;
+ };
+ };
};
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 007/374] drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 006/374] debugfs: fix automount d_fsdata usage Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 008/374] nvme-core: check for too small lba shift Greg Kroah-Hartman
` (367 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Lu Yao,
Alex Deucher, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lu Yao <yaolu@kylinos.cn>
[ Upstream commit 2161e09cd05a50d80736fe397145340d2e8f6c05 ]
For 'AMDGPU_FAMILY_SI' family cards, in 'si_common_early_init' func, init
'didt_rreg' and 'didt_wreg' to 'NULL'. But in func
'amdgpu_debugfs_regs_didt_read/write', using 'RREG32_DIDT' 'WREG32_DIDT'
lacks of relevant judgment. And other 'amdgpu_ip_block_version' that use
these two definitions won't be added for 'AMDGPU_FAMILY_SI'.
So, add null pointer judgment before calling.
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Lu Yao <yaolu@kylinos.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index beb199d13451..632d8df04ef4 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -342,6 +342,9 @@ static ssize_t amdgpu_debugfs_regs_didt_read(struct file *f, char __user *buf,
if (size & 0x3 || *pos & 0x3)
return -EINVAL;
+ if (!adev->didt_rreg)
+ return -EOPNOTSUPP;
+
r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
if (r < 0) {
pm_runtime_put_autosuspend(adev_to_drm(adev)->dev);
@@ -401,6 +404,9 @@ static ssize_t amdgpu_debugfs_regs_didt_write(struct file *f, const char __user
if (size & 0x3 || *pos & 0x3)
return -EINVAL;
+ if (!adev->didt_wreg)
+ return -EOPNOTSUPP;
+
r = pm_runtime_get_sync(adev_to_drm(adev)->dev);
if (r < 0) {
pm_runtime_put_autosuspend(adev_to_drm(adev)->dev);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 008/374] nvme-core: check for too small lba shift
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 007/374] drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 009/374] ASoC: wm8974: Correct boost mixer inputs Greg Kroah-Hartman
` (366 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Axboe, Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 74fbc88e161424b3b96a22b23a8e3e1edab9d05c ]
The block layer doesn't support logical block sizes smaller than 512
bytes. The nvme spec doesn't support that small either, but the driver
isn't checking to make sure the device responded with usable data.
Failing to catch this will result in a kernel bug, either from a
division by zero when stacking, or a zero length bio.
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/core.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
index 98a7649a0f06..8f06e5c1706b 100644
--- a/drivers/nvme/host/core.c
+++ b/drivers/nvme/host/core.c
@@ -1846,9 +1846,10 @@ static void nvme_update_disk_info(struct gendisk *disk,
/*
* The block layer can't support LBA sizes larger than the page size
- * yet, so catch this early and don't allow block I/O.
+ * or smaller than a sector size yet, so catch this early and don't
+ * allow block I/O.
*/
- if (ns->lba_shift > PAGE_SHIFT) {
+ if (ns->lba_shift > PAGE_SHIFT || ns->lba_shift < SECTOR_SHIFT) {
capacity = 0;
bs = (1 << 9);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 009/374] ASoC: wm8974: Correct boost mixer inputs
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 008/374] nvme-core: check for too small lba shift Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 010/374] ASoC: Intel: Skylake: Fix mem leak in few functions Greg Kroah-Hartman
` (365 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Charles Keepax, Mark Brown,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Charles Keepax <ckeepax@opensource.cirrus.com>
[ Upstream commit 37e6fd0cebf0b9f71afb38fd95b10408799d1f0b ]
Bit 6 of INPPGA (INPPGAMUTE) does not control the Aux path, it controls
the input PGA path, as can been seen from Figure 8 Input Boost Stage in
the datasheet. Update the naming of things in the driver to match this
and update the routing to also reflect this.
Signed-off-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231113155916.1741027-1-ckeepax@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/wm8974.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/wm8974.c b/sound/soc/codecs/wm8974.c
index fdc68ab49742..9eeac3443566 100644
--- a/sound/soc/codecs/wm8974.c
+++ b/sound/soc/codecs/wm8974.c
@@ -186,7 +186,7 @@ SOC_DAPM_SINGLE("PCM Playback Switch", WM8974_MONOMIX, 0, 1, 0),
/* Boost mixer */
static const struct snd_kcontrol_new wm8974_boost_mixer[] = {
-SOC_DAPM_SINGLE("Aux Switch", WM8974_INPPGA, 6, 1, 1),
+SOC_DAPM_SINGLE("PGA Switch", WM8974_INPPGA, 6, 1, 1),
};
/* Input PGA */
@@ -246,8 +246,8 @@ static const struct snd_soc_dapm_route wm8974_dapm_routes[] = {
/* Boost Mixer */
{"ADC", NULL, "Boost Mixer"},
- {"Boost Mixer", "Aux Switch", "Aux Input"},
- {"Boost Mixer", NULL, "Input PGA"},
+ {"Boost Mixer", NULL, "Aux Input"},
+ {"Boost Mixer", "PGA Switch", "Input PGA"},
{"Boost Mixer", NULL, "MICP"},
/* Input PGA */
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 010/374] ASoC: Intel: Skylake: Fix mem leak in few functions
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 009/374] ASoC: wm8974: Correct boost mixer inputs Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 011/374] ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 Greg Kroah-Hartman
` (364 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kamil Duljas,
Amadeusz Sławiński, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Duljas <kamil.duljas@gmail.com>
[ Upstream commit d5c65be34df73fa01ed05611aafb73b440d89e29 ]
The resources should be freed when function return error.
Signed-off-by: Kamil Duljas <kamil.duljas@gmail.com>
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Link: https://lore.kernel.org/r/20231116125150.1436-1-kamil.duljas@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/skylake/skl-pcm.c | 4 +++-
sound/soc/intel/skylake/skl-sst-ipc.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index db41bd717065..0d08b0269a66 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -251,8 +251,10 @@ static int skl_pcm_open(struct snd_pcm_substream *substream,
snd_pcm_set_sync(substream);
mconfig = skl_tplg_fe_get_cpr_module(dai, substream->stream);
- if (!mconfig)
+ if (!mconfig) {
+ kfree(dma_params);
return -EINVAL;
+ }
skl_tplg_d0i3_get(skl, mconfig->d0i3_caps);
diff --git a/sound/soc/intel/skylake/skl-sst-ipc.c b/sound/soc/intel/skylake/skl-sst-ipc.c
index 7a425271b08b..fd9624ad5f72 100644
--- a/sound/soc/intel/skylake/skl-sst-ipc.c
+++ b/sound/soc/intel/skylake/skl-sst-ipc.c
@@ -1003,8 +1003,10 @@ int skl_ipc_get_large_config(struct sst_generic_ipc *ipc,
reply.size = (reply.header >> 32) & IPC_DATA_OFFSET_SZ_MASK;
buf = krealloc(reply.data, reply.size, GFP_KERNEL);
- if (!buf)
+ if (!buf) {
+ kfree(reply.data);
return -ENOMEM;
+ }
*payload = buf;
*bytes = reply.size;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 011/374] ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 010/374] ASoC: Intel: Skylake: Fix mem leak in few functions Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 012/374] ASoC: Intel: Skylake: mem leak in skl register function Greg Kroah-Hartman
` (363 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, David Lin,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lin <CTLIN0@nuvoton.com>
[ Upstream commit c1501f2597dd08601acd42256a4b0a0fc36bf302 ]
This issue is reproduced when W=1 build in compiler gcc-12.
The following are sparse warnings:
sound/soc/codecs/nau8822.c:199:25: sparse: sparse: incorrect type in assignment
sound/soc/codecs/nau8822.c:199:25: sparse: expected unsigned short
sound/soc/codecs/nau8822.c:199:25: sparse: got restricted __be16
sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
sound/soc/codecs/nau8822.c:235:25: sparse: sparse: cast to restricted __be16
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311122320.T1opZVkP-lkp@intel.com/
Signed-off-by: David Lin <CTLIN0@nuvoton.com>
Link: https://lore.kernel.org/r/20231117043011.1747594-1-CTLIN0@nuvoton.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/nau8822.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/sound/soc/codecs/nau8822.c b/sound/soc/codecs/nau8822.c
index b436e532993d..6ffd0f5e3a60 100644
--- a/sound/soc/codecs/nau8822.c
+++ b/sound/soc/codecs/nau8822.c
@@ -184,6 +184,7 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol,
struct soc_bytes_ext *params = (void *)kcontrol->private_value;
int i, reg;
u16 reg_val, *val;
+ __be16 tmp;
val = (u16 *)ucontrol->value.bytes.data;
reg = NAU8822_REG_EQ1;
@@ -192,8 +193,8 @@ static int nau8822_eq_get(struct snd_kcontrol *kcontrol,
/* conversion of 16-bit integers between native CPU format
* and big endian format
*/
- reg_val = cpu_to_be16(reg_val);
- memcpy(val + i, ®_val, sizeof(reg_val));
+ tmp = cpu_to_be16(reg_val);
+ memcpy(val + i, &tmp, sizeof(tmp));
}
return 0;
@@ -216,6 +217,7 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol,
void *data;
u16 *val, value;
int i, reg, ret;
+ __be16 *tmp;
data = kmemdup(ucontrol->value.bytes.data,
params->max, GFP_KERNEL | GFP_DMA);
@@ -228,7 +230,8 @@ static int nau8822_eq_put(struct snd_kcontrol *kcontrol,
/* conversion of 16-bit integers between native CPU format
* and big endian format
*/
- value = be16_to_cpu(*(val + i));
+ tmp = (__be16 *)(val + i);
+ value = be16_to_cpup(tmp);
ret = snd_soc_component_write(component, reg + i, value);
if (ret) {
dev_err(component->dev,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 012/374] ASoC: Intel: Skylake: mem leak in skl register function
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 011/374] ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 013/374] ASoC: cs43130: Fix the position of const qualifier Greg Kroah-Hartman
` (362 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kamil Duljas,
Amadeusz Sławiński, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kamil Duljas <kamil.duljas@gmail.com>
[ Upstream commit f8ba14b780273fd290ddf7ee0d7d7decb44cc365 ]
skl_platform_register() uses krealloc. When krealloc is fail,
then previous memory is not freed. The leak is also when soc
component registration failed.
Signed-off-by: Kamil Duljas <kamil.duljas@gmail.com>
Reviewed-by: Amadeusz Sławiński <amadeuszx.slawinski@linux.intel.com>
Link: https://lore.kernel.org/r/20231116224112.2209-2-kamil.duljas@gmail.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/skylake/skl-pcm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c
index 0d08b0269a66..af5af5be42f6 100644
--- a/sound/soc/intel/skylake/skl-pcm.c
+++ b/sound/soc/intel/skylake/skl-pcm.c
@@ -1467,6 +1467,7 @@ int skl_platform_register(struct device *dev)
dais = krealloc(skl->dais, sizeof(skl_fe_dai) +
sizeof(skl_platform_dai), GFP_KERNEL);
if (!dais) {
+ kfree(skl->dais);
ret = -ENOMEM;
goto err;
}
@@ -1479,8 +1480,10 @@ int skl_platform_register(struct device *dev)
ret = devm_snd_soc_register_component(dev, &skl_component,
skl->dais, num_dais);
- if (ret)
+ if (ret) {
+ kfree(skl->dais);
dev_err(dev, "soc component registration failed %d\n", ret);
+ }
err:
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 013/374] ASoC: cs43130: Fix the position of const qualifier
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 012/374] ASoC: Intel: Skylake: mem leak in skl register function Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 014/374] ASoC: cs43130: Fix incorrect frame delay configuration Greg Kroah-Hartman
` (361 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Strozek, Charles Keepax,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <mstrozek@opensource.cirrus.com>
[ Upstream commit e7f289a59e76a5890a57bc27b198f69f175f75d9 ]
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231117141344.64320-2-mstrozek@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs43130.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c
index 44b20c1ef851..0e2cb54ae192 100644
--- a/sound/soc/codecs/cs43130.c
+++ b/sound/soc/codecs/cs43130.c
@@ -1684,7 +1684,7 @@ static ssize_t hpload_dc_r_show(struct device *dev,
return cs43130_show_dc(dev, buf, HP_RIGHT);
}
-static u16 const cs43130_ac_freq[CS43130_AC_FREQ] = {
+static const u16 cs43130_ac_freq[CS43130_AC_FREQ] = {
24,
43,
93,
@@ -2365,7 +2365,7 @@ static const struct regmap_config cs43130_regmap = {
.use_single_write = true,
};
-static u16 const cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
+static const u16 cs43130_dc_threshold[CS43130_DC_THRESHOLD] = {
50,
120,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 014/374] ASoC: cs43130: Fix incorrect frame delay configuration
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 013/374] ASoC: cs43130: Fix the position of const qualifier Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 015/374] ASoC: rt5650: add mutex to avoid the jack detection failure Greg Kroah-Hartman
` (360 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maciej Strozek, Charles Keepax,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maciej Strozek <mstrozek@opensource.cirrus.com>
[ Upstream commit aa7e8e5e4011571022dc06e4d7a2f108feb53d1a ]
Signed-off-by: Maciej Strozek <mstrozek@opensource.cirrus.com>
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Link: https://lore.kernel.org/r/20231117141344.64320-3-mstrozek@opensource.cirrus.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs43130.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/cs43130.c b/sound/soc/codecs/cs43130.c
index 0e2cb54ae192..d3edc5796d66 100644
--- a/sound/soc/codecs/cs43130.c
+++ b/sound/soc/codecs/cs43130.c
@@ -579,7 +579,7 @@ static int cs43130_set_sp_fmt(int dai_id, unsigned int bitwidth_sclk,
break;
case SND_SOC_DAIFMT_LEFT_J:
hi_size = bitwidth_sclk;
- frm_delay = 2;
+ frm_delay = 0;
frm_phase = 1;
break;
case SND_SOC_DAIFMT_DSP_A:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 015/374] ASoC: rt5650: add mutex to avoid the jack detection failure
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 014/374] ASoC: cs43130: Fix incorrect frame delay configuration Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 016/374] nouveau/tu102: flush all pdbs on vmm flush Greg Kroah-Hartman
` (359 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Shuming Fan, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shuming Fan <shumingf@realtek.com>
[ Upstream commit cdba4301adda7c60a2064bf808e48fccd352aaa9 ]
This patch adds the jd_mutex to protect the jack detection control flow.
And only the headset type could check the button status.
Signed-off-by: Shuming Fan <shumingf@realtek.com>
Link: https://lore.kernel.org/r/20231122100123.2831753-1-shumingf@realtek.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt5645.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 385f2cca939a..e7009f704b99 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -448,6 +448,7 @@ struct rt5645_priv {
struct regulator_bulk_data supplies[ARRAY_SIZE(rt5645_supply_names)];
struct rt5645_eq_param_s *eq_param;
struct timer_list btn_check_timer;
+ struct mutex jd_mutex;
int codec_type;
int sysclk;
@@ -3189,6 +3190,8 @@ static int rt5645_jack_detect(struct snd_soc_component *component, int jack_inse
rt5645_enable_push_button_irq(component, true);
}
} else {
+ if (rt5645->en_button_func)
+ rt5645_enable_push_button_irq(component, false);
snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
snd_soc_dapm_sync(dapm);
rt5645->jack_type = SND_JACK_HEADPHONE;
@@ -3269,6 +3272,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)
if (!rt5645->component)
return;
+ mutex_lock(&rt5645->jd_mutex);
+
switch (rt5645->pdata.jd_mode) {
case 0: /* Not using rt5645 JD */
if (rt5645->gpiod_hp_det) {
@@ -3295,7 +3300,7 @@ static void rt5645_jack_detect_work(struct work_struct *work)
if (!val && (rt5645->jack_type == 0)) { /* jack in */
report = rt5645_jack_detect(rt5645->component, 1);
- } else if (!val && rt5645->jack_type != 0) {
+ } else if (!val && rt5645->jack_type == SND_JACK_HEADSET) {
/* for push button and jack out */
btn_type = 0;
if (snd_soc_component_read(rt5645->component, RT5645_INT_IRQ_ST) & 0x4) {
@@ -3351,6 +3356,8 @@ static void rt5645_jack_detect_work(struct work_struct *work)
rt5645_jack_detect(rt5645->component, 0);
}
+ mutex_unlock(&rt5645->jd_mutex);
+
snd_soc_jack_report(rt5645->hp_jack, report, SND_JACK_HEADPHONE);
snd_soc_jack_report(rt5645->mic_jack, report, SND_JACK_MICROPHONE);
if (rt5645->en_button_func)
@@ -4121,6 +4128,7 @@ static int rt5645_i2c_probe(struct i2c_client *i2c,
}
timer_setup(&rt5645->btn_check_timer, rt5645_btn_check_callback, 0);
+ mutex_init(&rt5645->jd_mutex);
INIT_DELAYED_WORK(&rt5645->jack_detect_work, rt5645_jack_detect_work);
INIT_DELAYED_WORK(&rt5645->rcclock_work, rt5645_rcclock_work);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 016/374] nouveau/tu102: flush all pdbs on vmm flush
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 015/374] ASoC: rt5650: add mutex to avoid the jack detection failure Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 017/374] net/tg3: fix race condition in tg3_reset_task() Greg Kroah-Hartman
` (358 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dave Airlie, Danilo Krummrich,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dave Airlie <airlied@redhat.com>
[ Upstream commit cb9c919364653eeafb49e7ff5cd32f1ad64063ac ]
This is a hack around a bug exposed with the GSP code, I'm not sure
what is happening exactly, but it appears some of our flushes don't
result in proper tlb invalidation for out BAR2 and we get a BAR2
fault from GSP and it all dies.
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Danilo Krummrich <dakr@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231130010852.4034774-1-airlied@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c
index 6cb5eefa45e9..5a08458fe1b7 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/vmmtu102.c
@@ -31,7 +31,7 @@ tu102_vmm_flush(struct nvkm_vmm *vmm, int depth)
type |= 0x00000001; /* PAGE_ALL */
if (atomic_read(&vmm->engref[NVKM_SUBDEV_BAR]))
- type |= 0x00000004; /* HUB_ONLY */
+ type |= 0x00000006; /* HUB_ONLY | ALL PDB (hack) */
mutex_lock(&vmm->mmu->mutex);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 017/374] net/tg3: fix race condition in tg3_reset_task()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 016/374] nouveau/tu102: flush all pdbs on vmm flush Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 018/374] ASoC: da7219: Support low DC impedance headset Greg Kroah-Hartman
` (357 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thinh Tran, Venkata Sai Duggi,
David Christensen, Michael Chan, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Tran <thinhtr@linux.vnet.ibm.com>
[ Upstream commit 16b55b1f2269962fb6b5154b8bf43f37c9a96637 ]
When an EEH error is encountered by a PCI adapter, the EEH driver
modifies the PCI channel's state as shown below:
enum {
/* I/O channel is in normal state */
pci_channel_io_normal = (__force pci_channel_state_t) 1,
/* I/O to channel is blocked */
pci_channel_io_frozen = (__force pci_channel_state_t) 2,
/* PCI card is dead */
pci_channel_io_perm_failure = (__force pci_channel_state_t) 3,
};
If the same EEH error then causes the tg3 driver's transmit timeout
logic to execute, the tg3_tx_timeout() function schedules a reset
task via tg3_reset_task_schedule(), which may cause a race condition
between the tg3 and EEH driver as both attempt to recover the HW via
a reset action.
EEH driver gets error event
--> eeh_set_channel_state()
and set device to one of
error state above scheduler: tg3_reset_task() get
returned error from tg3_init_hw()
--> dev_close() shuts down the interface
tg3_io_slot_reset() and
tg3_io_resume() fail to
reset/resume the device
To resolve this issue, we avoid the race condition by checking the PCI
channel state in the tg3_reset_task() function and skip the tg3 driver
initiated reset when the PCI channel is not in the normal state. (The
driver has no access to tg3 device registers at this point and cannot
even complete the reset task successfully without external assistance.)
We'll leave the reset procedure to be managed by the EEH driver which
calls the tg3_io_error_detected(), tg3_io_slot_reset() and
tg3_io_resume() functions as appropriate.
Adding the same checking in tg3_dump_state() to avoid dumping all
device registers when the PCI channel is not in the normal state.
Signed-off-by: Thinh Tran <thinhtr@linux.vnet.ibm.com>
Tested-by: Venkata Sai Duggi <venkata.sai.duggi@ibm.com>
Reviewed-by: David Christensen <drc@linux.vnet.ibm.com>
Reviewed-by: Michael Chan <michael.chan@broadcom.com>
Link: https://lore.kernel.org/r/20231201001911.656-1-thinhtr@linux.vnet.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/broadcom/tg3.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
index fc487a6f050a..757138c33b75 100644
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@ -6448,6 +6448,14 @@ static void tg3_dump_state(struct tg3 *tp)
int i;
u32 *regs;
+ /* If it is a PCI error, all registers will be 0xffff,
+ * we don't dump them out, just report the error and return
+ */
+ if (tp->pdev->error_state != pci_channel_io_normal) {
+ netdev_err(tp->dev, "PCI channel ERROR!\n");
+ return;
+ }
+
regs = kzalloc(TG3_REG_BLK_SIZE, GFP_ATOMIC);
if (!regs)
return;
@@ -11186,7 +11194,8 @@ static void tg3_reset_task(struct work_struct *work)
rtnl_lock();
tg3_full_lock(tp, 0);
- if (tp->pcierr_recovery || !netif_running(tp->dev)) {
+ if (tp->pcierr_recovery || !netif_running(tp->dev) ||
+ tp->pdev->error_state != pci_channel_io_normal) {
tg3_flag_clear(tp, RESET_TASK_PENDING);
tg3_full_unlock(tp);
rtnl_unlock();
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 018/374] ASoC: da7219: Support low DC impedance headset
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 017/374] net/tg3: fix race condition in tg3_reset_task() Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 019/374] ASoC: ops: add correct range check for limiting volume Greg Kroah-Hartman
` (356 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, David Rau, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rau <David.Rau.opensource@dm.renesas.com>
[ Upstream commit 5f44de697383fcc9a9a1a78f99e09d1838704b90 ]
Change the default MIC detection impedance threshold to 200ohm
to support low mic DC impedance headset.
Signed-off-by: David Rau <David.Rau.opensource@dm.renesas.com>
Link: https://lore.kernel.org/r/20231201042933.26392-1-David.Rau.opensource@dm.renesas.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/da7219-aad.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index 7d18de959439..4dc6eed6c18a 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c
@@ -654,7 +654,7 @@ static struct da7219_aad_pdata *da7219_aad_fw_to_pdata(struct device *dev)
aad_pdata->mic_det_thr =
da7219_aad_fw_mic_det_thr(dev, fw_val32);
else
- aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_500_OHMS;
+ aad_pdata->mic_det_thr = DA7219_AAD_MIC_DET_THR_200_OHMS;
if (fwnode_property_read_u32(aad_np, "dlg,jack-ins-deb", &fw_val32) >= 0)
aad_pdata->jack_ins_deb =
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 019/374] ASoC: ops: add correct range check for limiting volume
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 018/374] ASoC: da7219: Support low DC impedance headset Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 020/374] nvme: introduce helper function to get ctrl state Greg Kroah-Hartman
` (355 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Srinivas Kandagatla, Johan Hovold,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
[ Upstream commit fb9ad24485087e0f00d84bee7a5914640b2b9024 ]
Volume can have ranges that start with negative values, ex: -84dB to
+40dB. Apply correct range check in snd_soc_limit_volume before setting
the platform_max. Without this patch, for example setting a 0dB limit on
a volume range of -84dB to +40dB would fail.
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20231204124736.132185-2-srinivas.kandagatla@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/soc-ops.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/sound/soc/soc-ops.c b/sound/soc/soc-ops.c
index 12effaa59fdb..c56379fac927 100644
--- a/sound/soc/soc-ops.c
+++ b/sound/soc/soc-ops.c
@@ -644,7 +644,7 @@ int snd_soc_limit_volume(struct snd_soc_card *card,
kctl = snd_soc_card_get_kcontrol(card, name);
if (kctl) {
struct soc_mixer_control *mc = (struct soc_mixer_control *)kctl->private_value;
- if (max <= mc->max) {
+ if (max <= mc->max - mc->min) {
mc->platform_max = max;
ret = 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 020/374] nvme: introduce helper function to get ctrl state
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 019/374] ASoC: ops: add correct range check for limiting volume Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 021/374] drm/amdgpu: Add NULL checks for function pointers Greg Kroah-Hartman
` (354 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Keith Busch,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 5c687c287c46fadb14644091823298875a5216aa ]
The controller state is typically written by another CPU, so reading it
should ensure no optimizations are taken. This is a repeated pattern in
the driver, so start with adding a convenience function that returns the
controller state with READ_ONCE().
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/host/nvme.h | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h
index 415b01707599..f9bfd6a549f3 100644
--- a/drivers/nvme/host/nvme.h
+++ b/drivers/nvme/host/nvme.h
@@ -365,6 +365,11 @@ struct nvme_ctrl {
struct nvme_fault_inject fault_inject;
};
+static inline enum nvme_ctrl_state nvme_ctrl_state(struct nvme_ctrl *ctrl)
+{
+ return READ_ONCE(ctrl->state);
+}
+
enum nvme_iopolicy {
NVME_IOPOLICY_NUMA,
NVME_IOPOLICY_RR,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 021/374] drm/amdgpu: Add NULL checks for function pointers
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 020/374] nvme: introduce helper function to get ctrl state Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 022/374] drm/exynos: fix a potential error pointer dereference Greg Kroah-Hartman
` (353 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Hawking Zhang,
Alex Deucher, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
[ Upstream commit 81577503efb49f4ad76af22f9941d72900ef4aab ]
Check if function is implemented before making the call.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Hawking Zhang <Hawking.Zhang@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/soc15.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c
index 529bb6c6ac6f..e8c0e77e1b01 100644
--- a/drivers/gpu/drm/amd/amdgpu/soc15.c
+++ b/drivers/gpu/drm/amd/amdgpu/soc15.c
@@ -1615,9 +1615,11 @@ static void soc15_common_get_clockgating_state(void *handle, u32 *flags)
if (amdgpu_sriov_vf(adev))
*flags = 0;
- adev->nbio.funcs->get_clockgating_state(adev, flags);
+ if (adev->nbio.funcs && adev->nbio.funcs->get_clockgating_state)
+ adev->nbio.funcs->get_clockgating_state(adev, flags);
- adev->hdp.funcs->get_clock_gating_state(adev, flags);
+ if (adev->hdp.funcs && adev->hdp.funcs->get_clock_gating_state)
+ adev->hdp.funcs->get_clock_gating_state(adev, flags);
if (adev->asic_type != CHIP_ALDEBARAN) {
@@ -1633,9 +1635,11 @@ static void soc15_common_get_clockgating_state(void *handle, u32 *flags)
}
/* AMD_CG_SUPPORT_ROM_MGCG */
- adev->smuio.funcs->get_clock_gating_state(adev, flags);
+ if (adev->smuio.funcs && adev->smuio.funcs->get_clock_gating_state)
+ adev->smuio.funcs->get_clock_gating_state(adev, flags);
- adev->df.funcs->get_clockgating_state(adev, flags);
+ if (adev->df.funcs && adev->df.funcs->get_clockgating_state)
+ adev->df.funcs->get_clockgating_state(adev, flags);
}
static int soc15_common_set_powergating_state(void *handle,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 022/374] drm/exynos: fix a potential error pointer dereference
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 021/374] drm/amdgpu: Add NULL checks for function pointers Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 023/374] drm/exynos: fix a wrong error checking Greg Kroah-Hartman
` (352 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiang Yang, Inki Dae, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiang Yang <xiangyang3@huawei.com>
[ Upstream commit 73bf1c9ae6c054c53b8e84452c5e46f86dd28246 ]
Smatch reports the warning below:
drivers/gpu/drm/exynos/exynos_hdmi.c:1864 hdmi_bind()
error: 'crtc' dereferencing possible ERR_PTR()
The return value of exynos_drm_crtc_get_by_type maybe ERR_PTR(-ENODEV),
which can not be used directly. Fix this by checking the return value
before using it.
Signed-off-by: Xiang Yang <xiangyang3@huawei.com>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_hdmi.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/exynos/exynos_hdmi.c b/drivers/gpu/drm/exynos/exynos_hdmi.c
index 7655142a4651..42b6b001405a 100644
--- a/drivers/gpu/drm/exynos/exynos_hdmi.c
+++ b/drivers/gpu/drm/exynos/exynos_hdmi.c
@@ -1861,6 +1861,8 @@ static int hdmi_bind(struct device *dev, struct device *master, void *data)
return ret;
crtc = exynos_drm_crtc_get_by_type(drm_dev, EXYNOS_DISPLAY_TYPE_HDMI);
+ if (IS_ERR(crtc))
+ return PTR_ERR(crtc);
crtc->pipe_clk = &hdata->phy_clk;
ret = hdmi_create_connector(encoder);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 023/374] drm/exynos: fix a wrong error checking
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 022/374] drm/exynos: fix a potential error pointer dereference Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 024/374] hwmon: (corsair-psu) Fix probe when built-in Greg Kroah-Hartman
` (351 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Inki Dae, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Inki Dae <inki.dae@samsung.com>
[ Upstream commit 8d1b7809684c688005706125b804e1f9792d2b1b ]
Fix a wrong error checking in exynos_drm_dma.c module.
In the exynos_drm_register_dma function, both arm_iommu_create_mapping()
and iommu_get_domain_for_dev() functions are expected to return NULL as
an error.
However, the error checking is performed using the statement
if(IS_ERR(mapping)), which doesn't provide a suitable error value.
So check if 'mapping' is NULL, and if it is, return -ENODEV.
This issue[1] was reported by Dan.
Changelog v1:
- fix build warning.
[1] https://lore.kernel.org/all/33e52277-1349-472b-a55b-ab5c3462bfcf@moroto.mountain/
Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Inki Dae <inki.dae@samsung.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/exynos/exynos_drm_dma.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/exynos/exynos_drm_dma.c b/drivers/gpu/drm/exynos/exynos_drm_dma.c
index bf33c3084cb4..6b4d6da3b1f4 100644
--- a/drivers/gpu/drm/exynos/exynos_drm_dma.c
+++ b/drivers/gpu/drm/exynos/exynos_drm_dma.c
@@ -108,18 +108,16 @@ int exynos_drm_register_dma(struct drm_device *drm, struct device *dev,
return 0;
if (!priv->mapping) {
- void *mapping;
+ void *mapping = NULL;
if (IS_ENABLED(CONFIG_ARM_DMA_USE_IOMMU))
mapping = arm_iommu_create_mapping(&platform_bus_type,
EXYNOS_DEV_ADDR_START, EXYNOS_DEV_ADDR_SIZE);
else if (IS_ENABLED(CONFIG_IOMMU_DMA))
mapping = iommu_get_domain_for_dev(priv->dma_dev);
- else
- mapping = ERR_PTR(-ENODEV);
- if (IS_ERR(mapping))
- return PTR_ERR(mapping);
+ if (!mapping)
+ return -ENODEV;
priv->mapping = mapping;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 024/374] hwmon: (corsair-psu) Fix probe when built-in
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 023/374] drm/exynos: fix a wrong error checking Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 025/374] clk: rockchip: rk3128: Fix HCLK_OTG gate register Greg Kroah-Hartman
` (350 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Armin Wolf, Guenter Roeck,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Armin Wolf <W_Armin@gmx.de>
[ Upstream commit 307004e8b254ad28e150b63f299ab9caa4bc7c3e ]
It seems that when the driver is built-in, the HID bus is
initialized after the driver is loaded, which whould cause
module_hid_driver() to fail.
Fix this by registering the driver after the HID bus using
late_initcall() in accordance with other hwmon HID drivers.
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Link: https://lore.kernel.org/r/20231207210723.222552-1-W_Armin@gmx.de
[groeck: Dropped "compile tested" comment; the patch has been tested
but the tester did not provide a Tested-by: tag]
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/hwmon/corsair-psu.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/drivers/hwmon/corsair-psu.c b/drivers/hwmon/corsair-psu.c
index 14389fd7afb8..ae983e715110 100644
--- a/drivers/hwmon/corsair-psu.c
+++ b/drivers/hwmon/corsair-psu.c
@@ -808,7 +808,23 @@ static struct hid_driver corsairpsu_driver = {
.reset_resume = corsairpsu_resume,
#endif
};
-module_hid_driver(corsairpsu_driver);
+
+static int __init corsair_init(void)
+{
+ return hid_register_driver(&corsairpsu_driver);
+}
+
+static void __exit corsair_exit(void)
+{
+ hid_unregister_driver(&corsairpsu_driver);
+}
+
+/*
+ * With module_init() the driver would load before the HID bus when
+ * built-in, so use late_initcall() instead.
+ */
+late_initcall(corsair_init);
+module_exit(corsair_exit);
MODULE_LICENSE("GPL");
MODULE_AUTHOR("Wilken Gottwalt <wilken.gottwalt@posteo.net>");
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 025/374] clk: rockchip: rk3128: Fix HCLK_OTG gate register
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 024/374] hwmon: (corsair-psu) Fix probe when built-in Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 026/374] jbd2: correct the printing of write_flags in jbd2_write_superblock() Greg Kroah-Hartman
` (349 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Weihao Li, Heiko Stuebner,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Weihao Li <cn.liweihao@gmail.com>
[ Upstream commit c6c5a5580dcb6631aa6369dabe12ef3ce784d1d2 ]
The HCLK_OTG gate control is in CRU_CLKGATE5_CON, not CRU_CLKGATE3_CON.
Signed-off-by: Weihao Li <cn.liweihao@gmail.com>
Link: https://lore.kernel.org/r/20231031111816.8777-1-cn.liweihao@gmail.com
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/rockchip/clk-rk3128.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/rockchip/clk-rk3128.c b/drivers/clk/rockchip/clk-rk3128.c
index aa53797dbfc1..7782785a86e6 100644
--- a/drivers/clk/rockchip/clk-rk3128.c
+++ b/drivers/clk/rockchip/clk-rk3128.c
@@ -490,7 +490,7 @@ static struct rockchip_clk_branch common_clk_branches[] __initdata = {
GATE(HCLK_I2S_2CH, "hclk_i2s_2ch", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 2, GFLAGS),
GATE(0, "hclk_usb_peri", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 13, GFLAGS),
GATE(HCLK_HOST2, "hclk_host2", "hclk_peri", 0, RK2928_CLKGATE_CON(7), 3, GFLAGS),
- GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(3), 13, GFLAGS),
+ GATE(HCLK_OTG, "hclk_otg", "hclk_peri", 0, RK2928_CLKGATE_CON(5), 13, GFLAGS),
GATE(0, "hclk_peri_ahb", "hclk_peri", CLK_IGNORE_UNUSED, RK2928_CLKGATE_CON(9), 14, GFLAGS),
GATE(HCLK_SPDIF, "hclk_spdif", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 9, GFLAGS),
GATE(HCLK_TSP, "hclk_tsp", "hclk_peri", 0, RK2928_CLKGATE_CON(10), 12, GFLAGS),
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 026/374] jbd2: correct the printing of write_flags in jbd2_write_superblock()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 025/374] clk: rockchip: rk3128: Fix HCLK_OTG gate register Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 027/374] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Greg Kroah-Hartman
` (348 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhang Yi, Jan Kara, Theodore Tso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhang Yi <yi.zhang@huawei.com>
[ Upstream commit 85559227211020b270728104c3b89918f7af27ac ]
The write_flags print in the trace of jbd2_write_superblock() is not
real, so move the modification before the trace.
Signed-off-by: Zhang Yi <yi.zhang@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20231129114740.2686201-1-yi.zhang@huaweicloud.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/journal.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 11fbc9b6ec5c..b7af1727a016 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1616,9 +1616,11 @@ static int jbd2_write_superblock(journal_t *journal, int write_flags)
return -EIO;
}
- trace_jbd2_write_superblock(journal, write_flags);
if (!(journal->j_flags & JBD2_BARRIER))
write_flags &= ~(REQ_FUA | REQ_PREFLUSH);
+
+ trace_jbd2_write_superblock(journal, write_flags);
+
if (buffer_write_io_error(bh)) {
/*
* Oh, dear. A previous attempt to write the journal
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 027/374] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 026/374] jbd2: correct the printing of write_flags in jbd2_write_superblock() Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 028/374] neighbour: Dont let neigh_forced_gc() disable preemption for long Greg Kroah-Hartman
` (347 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4fad2e57beb6397ab2fc,
Ziqi Zhao, Harshit Mogalapalli, Maxime Ripard, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ziqi Zhao <astrajoan@yahoo.com>
[ Upstream commit 3823119b9c2b5f9e9b760336f75bc989b805cde6 ]
The connector_set contains uninitialized values when allocated with
kmalloc_array. However, in the "out" branch, the logic assumes that any
element in connector_set would be equal to NULL if failed to
initialize, which causes the bug reported by Syzbot. The fix is to use
an extra variable to keep track of how many connectors are initialized
indeed, and use that variable to decrease any refcounts in the "out"
branch.
Reported-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com
Signed-off-by: Ziqi Zhao <astrajoan@yahoo.com>
Reported-and-tested-by: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Link: https://lore.kernel.org/r/20230721161446.8602-1-astrajoan@yahoo.com
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_crtc.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 26a77a735905..8b50ab4c5581 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -643,8 +643,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
struct drm_mode_set set;
uint32_t __user *set_connectors_ptr;
struct drm_modeset_acquire_ctx ctx;
- int ret;
- int i;
+ int ret, i, num_connectors;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -779,6 +778,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
goto out;
}
+ num_connectors = 0;
for (i = 0; i < crtc_req->count_connectors; i++) {
connector_set[i] = NULL;
set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
@@ -799,6 +799,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
connector->name);
connector_set[i] = connector;
+ num_connectors++;
}
}
@@ -807,7 +808,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
set.y = crtc_req->y;
set.mode = mode;
set.connectors = connector_set;
- set.num_connectors = crtc_req->count_connectors;
+ set.num_connectors = num_connectors;
set.fb = fb;
if (drm_drv_uses_atomic_modeset(dev))
@@ -820,7 +821,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
drm_framebuffer_put(fb);
if (connector_set) {
- for (i = 0; i < crtc_req->count_connectors; i++) {
+ for (i = 0; i < num_connectors; i++) {
if (connector_set[i])
drm_connector_put(connector_set[i]);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 028/374] neighbour: Dont let neigh_forced_gc() disable preemption for long
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 027/374] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 029/374] platform/x86: intel-vbtn: Fix missing tablet-mode-switch events Greg Kroah-Hartman
` (346 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Douglas Anderson, Judy Hsiao,
David Ahern, Eric Dumazet, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Judy Hsiao <judyhsiao@chromium.org>
[ Upstream commit e5dc5afff62f3e97e86c3643ec9fcad23de4f2d3 ]
We are seeing cases where neigh_cleanup_and_release() is called by
neigh_forced_gc() many times in a row with preemption turned off.
When running on a low powered CPU at a low CPU frequency, this has
been measured to keep preemption off for ~10 ms. That's not great on a
system with HZ=1000 which expects tasks to be able to schedule in
with ~1ms latency.
Suggested-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Judy Hsiao <judyhsiao@chromium.org>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/core/neighbour.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 927c4db2703f..5829477efbba 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -225,9 +225,11 @@ static int neigh_forced_gc(struct neigh_table *tbl)
{
int max_clean = atomic_read(&tbl->gc_entries) -
READ_ONCE(tbl->gc_thresh2);
+ u64 tmax = ktime_get_ns() + NSEC_PER_MSEC;
unsigned long tref = jiffies - 5 * HZ;
struct neighbour *n, *tmp;
int shrunk = 0;
+ int loop = 0;
NEIGH_CACHE_STAT_INC(tbl, forced_gc_runs);
@@ -250,11 +252,16 @@ static int neigh_forced_gc(struct neigh_table *tbl)
shrunk++;
if (shrunk >= max_clean)
break;
+ if (++loop == 16) {
+ if (ktime_get_ns() > tmax)
+ goto unlock;
+ loop = 0;
+ }
}
}
WRITE_ONCE(tbl->last_flush, jiffies);
-
+unlock:
write_unlock_bh(&tbl->lock);
return shrunk;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 029/374] platform/x86: intel-vbtn: Fix missing tablet-mode-switch events
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 028/374] neighbour: Dont let neigh_forced_gc() disable preemption for long Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 030/374] jbd2: fix soft lockup in journal_finish_inode_data_buffers() Greg Kroah-Hartman
` (345 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnold Gozum, Hans de Goede,
Andy Shevchenko, Ilpo Järvinen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 14c200b7ca46b9a9f4af9e81d258a58274320b6f ]
2 issues have been reported on the Dell Inspiron 7352:
1. Sometimes the tablet-mode-switch stops reporting tablet-mode
change events.
Add a "VBDL" call to notify_handler() to work around this.
2. Sometimes the tablet-mode is incorrect after suspend/resume
Add a detect_tablet_mode() to resume() to fix this.
Reported-by: Arnold Gozum <arngozum@gmail.com>
Closes: https://lore.kernel.org/platform-driver-x86/87271a74-c831-4eec-b7a4-1371d0e42471@gmail.com/
Tested-by: Arnold Gozum <arngozum@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Reviewed-by: Andy Shevchenko <andy@kernel.org>
Link: https://lore.kernel.org/r/20231204150601.46976-1-hdegoede@redhat.com
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/platform/x86/intel/vbtn.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
diff --git a/drivers/platform/x86/intel/vbtn.c b/drivers/platform/x86/intel/vbtn.c
index 15f013af9e62..f5e020840d94 100644
--- a/drivers/platform/x86/intel/vbtn.c
+++ b/drivers/platform/x86/intel/vbtn.c
@@ -73,10 +73,10 @@ struct intel_vbtn_priv {
bool wakeup_mode;
};
-static void detect_tablet_mode(struct platform_device *device)
+static void detect_tablet_mode(struct device *dev)
{
- struct intel_vbtn_priv *priv = dev_get_drvdata(&device->dev);
- acpi_handle handle = ACPI_HANDLE(&device->dev);
+ struct intel_vbtn_priv *priv = dev_get_drvdata(dev);
+ acpi_handle handle = ACPI_HANDLE(dev);
unsigned long long vgbs;
acpi_status status;
int m;
@@ -89,6 +89,8 @@ static void detect_tablet_mode(struct platform_device *device)
input_report_switch(priv->switches_dev, SW_TABLET_MODE, m);
m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0;
input_report_switch(priv->switches_dev, SW_DOCK, m);
+
+ input_sync(priv->switches_dev);
}
/*
@@ -134,7 +136,7 @@ static int intel_vbtn_input_setup(struct platform_device *device)
priv->switches_dev->id.bustype = BUS_HOST;
if (priv->has_switches) {
- detect_tablet_mode(device);
+ detect_tablet_mode(&device->dev);
ret = input_register_device(priv->switches_dev);
if (ret)
@@ -198,6 +200,9 @@ static void notify_handler(acpi_handle handle, u32 event, void *context)
autorelease = val && (!ke_rel || ke_rel->type == KE_IGNORE);
sparse_keymap_report_event(input_dev, event, val, autorelease);
+
+ /* Some devices need this to report further events */
+ acpi_evaluate_object(handle, "VBDL", NULL, NULL);
}
/*
@@ -358,7 +363,13 @@ static void intel_vbtn_pm_complete(struct device *dev)
static int intel_vbtn_pm_resume(struct device *dev)
{
+ struct intel_vbtn_priv *priv = dev_get_drvdata(dev);
+
intel_vbtn_pm_complete(dev);
+
+ if (priv->has_switches)
+ detect_tablet_mode(dev);
+
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 030/374] jbd2: fix soft lockup in journal_finish_inode_data_buffers()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 029/374] platform/x86: intel-vbtn: Fix missing tablet-mode-switch events Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 031/374] tracing: Have large events show up as [LINE TOO BIG] instead of nothing Greg Kroah-Hartman
` (344 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ye Bin, Jan Kara, Theodore Tso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ye Bin <yebin10@huawei.com>
[ Upstream commit 6c02757c936063f0631b4e43fe156f8c8f1f351f ]
There's issue when do io test:
WARN: soft lockup - CPU#45 stuck for 11s! [jbd2/dm-2-8:4170]
CPU: 45 PID: 4170 Comm: jbd2/dm-2-8 Kdump: loaded Tainted: G OE
Call trace:
dump_backtrace+0x0/0x1a0
show_stack+0x24/0x30
dump_stack+0xb0/0x100
watchdog_timer_fn+0x254/0x3f8
__hrtimer_run_queues+0x11c/0x380
hrtimer_interrupt+0xfc/0x2f8
arch_timer_handler_phys+0x38/0x58
handle_percpu_devid_irq+0x90/0x248
generic_handle_irq+0x3c/0x58
__handle_domain_irq+0x68/0xc0
gic_handle_irq+0x90/0x320
el1_irq+0xcc/0x180
queued_spin_lock_slowpath+0x1d8/0x320
jbd2_journal_commit_transaction+0x10f4/0x1c78 [jbd2]
kjournald2+0xec/0x2f0 [jbd2]
kthread+0x134/0x138
ret_from_fork+0x10/0x18
Analyzed informations from vmcore as follows:
(1) There are about 5k+ jbd2_inode in 'commit_transaction->t_inode_list';
(2) Now is processing the 855th jbd2_inode;
(3) JBD2 task has TIF_NEED_RESCHED flag;
(4) There's no pags in address_space around the 855th jbd2_inode;
(5) There are some process is doing drop caches;
(6) Mounted with 'nodioread_nolock' option;
(7) 128 CPUs;
According to informations from vmcore we know 'journal->j_list_lock' spin lock
competition is fierce. So journal_finish_inode_data_buffers() maybe process
slowly. Theoretically, there is scheduling point in the filemap_fdatawait_range_keep_errors().
However, if inode's address_space has no pages which taged with PAGECACHE_TAG_WRITEBACK,
will not call cond_resched(). So may lead to soft lockup.
journal_finish_inode_data_buffers
filemap_fdatawait_range_keep_errors
__filemap_fdatawait_range
while (index <= end)
nr_pages = pagevec_lookup_range_tag(&pvec, mapping, &index, end, PAGECACHE_TAG_WRITEBACK);
if (!nr_pages)
break; --> If 'nr_pages' is equal zero will break, then will not call cond_resched()
for (i = 0; i < nr_pages; i++)
wait_on_page_writeback(page);
cond_resched();
To solve above issue, add scheduling point in the journal_finish_inode_data_buffers();
Signed-off-by: Ye Bin <yebin10@huawei.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20231211112544.3879780-1-yebin10@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/commit.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/jbd2/commit.c b/fs/jbd2/commit.c
index e058ef183937..f858d1152368 100644
--- a/fs/jbd2/commit.c
+++ b/fs/jbd2/commit.c
@@ -300,6 +300,7 @@ static int journal_finish_inode_data_buffers(journal_t *journal,
if (!ret)
ret = err;
}
+ cond_resched();
spin_lock(&journal->j_list_lock);
jinode->i_flags &= ~JI_COMMIT_RUNNING;
smp_mb();
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 031/374] tracing: Have large events show up as [LINE TOO BIG] instead of nothing
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 030/374] jbd2: fix soft lockup in journal_finish_inode_data_buffers() Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 032/374] tracing: Add size check when printing trace_marker output Greg Kroah-Hartman
` (343 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Mathieu Desnoyers,
Masami Hiramatsu (Google), Steven Rostedt (Google), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <rostedt@goodmis.org>
[ Upstream commit b55b0a0d7c4aa2dac3579aa7e6802d1f57445096 ]
If a large event was added to the ring buffer that is larger than what the
trace_seq can handle, it just drops the output:
~# cat /sys/kernel/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<...>-859 [001] ..... 141.118951: tracing_mark_write <...>-859 [001] ..... 141.148201: tracing_mark_write: 78901234
Instead, catch this case and add some context:
~# cat /sys/kernel/tracing/trace
# tracer: nop
#
# entries-in-buffer/entries-written: 2/2 #P:8
#
# _-----=> irqs-off/BH-disabled
# / _----=> need-resched
# | / _---=> hardirq/softirq
# || / _--=> preempt-depth
# ||| / _-=> migrate-disable
# |||| / delay
# TASK-PID CPU# ||||| TIMESTAMP FUNCTION
# | | | ||||| | |
<...>-852 [001] ..... 121.550551: tracing_mark_write[LINE TOO BIG]
<...>-852 [001] ..... 121.550581: tracing_mark_write: 78901234
This now emulates the same output as trace_pipe.
Link: https://lore.kernel.org/linux-trace-kernel/20231209171058.78c1a026@gandalf.local.home
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 91ff118138c8..66322196b256 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4667,7 +4667,11 @@ static int s_show(struct seq_file *m, void *v)
iter->leftover = ret;
} else {
- print_trace_line(iter);
+ ret = print_trace_line(iter);
+ if (ret == TRACE_TYPE_PARTIAL_LINE) {
+ iter->seq.full = 0;
+ trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
+ }
ret = trace_print_seq(m, &iter->seq);
/*
* If we overflow the seq_file buffer, then it will
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 032/374] tracing: Add size check when printing trace_marker output
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 031/374] tracing: Have large events show up as [LINE TOO BIG] instead of nothing Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 033/374] stmmac: dwmac-loongson: drop useless check for compatible fallback Greg Kroah-Hartman
` (342 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Mathieu Desnoyers,
Masami Hiramatsu (Google), Steven Rostedt (Google), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <rostedt@goodmis.org>
[ Upstream commit 60be76eeabb3d83858cc6577fc65c7d0f36ffd42 ]
If for some reason the trace_marker write does not have a nul byte for the
string, it will overflow the print:
trace_seq_printf(s, ": %s", field->buf);
The field->buf could be missing the nul byte. To prevent overflow, add the
max size that the buf can be by using the event size and the field
location.
int max = iter->ent_size - offsetof(struct print_entry, buf);
trace_seq_printf(s, ": %*.s", max, field->buf);
Link: https://lore.kernel.org/linux-trace-kernel/20231212084444.4619b8ce@gandalf.local.home
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Reviewed-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace_output.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c
index 6b4d3f3abdae..4c4b84e507f7 100644
--- a/kernel/trace/trace_output.c
+++ b/kernel/trace/trace_output.c
@@ -1446,11 +1446,12 @@ static enum print_line_t trace_print_print(struct trace_iterator *iter,
{
struct print_entry *field;
struct trace_seq *s = &iter->seq;
+ int max = iter->ent_size - offsetof(struct print_entry, buf);
trace_assign_type(field, iter->ent);
seq_print_ip_sym(s, field->ip, flags);
- trace_seq_printf(s, ": %s", field->buf);
+ trace_seq_printf(s, ": %.*s", max, field->buf);
return trace_handle_return(s);
}
@@ -1459,10 +1460,11 @@ static enum print_line_t trace_print_raw(struct trace_iterator *iter, int flags,
struct trace_event *event)
{
struct print_entry *field;
+ int max = iter->ent_size - offsetof(struct print_entry, buf);
trace_assign_type(field, iter->ent);
- trace_seq_printf(&iter->seq, "# %lx %s", field->ip, field->buf);
+ trace_seq_printf(&iter->seq, "# %lx %.*s", field->ip, max, field->buf);
return trace_handle_return(&iter->seq);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 033/374] stmmac: dwmac-loongson: drop useless check for compatible fallback
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 032/374] tracing: Add size check when printing trace_marker output Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 034/374] MIPS: dts: loongson: drop incorrect dwmac fallback compatible Greg Kroah-Hartman
` (341 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Yanteng Si,
Conor Dooley, Jiaxun Yang, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 31fea092c6f9f8fb2c40a08137907f5fbeae55dd ]
Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS,
so checking for some other compatible does not make sense. It cannot be
bound to unsupported platform.
Drop useless, incorrect (space in between) and undocumented compatible.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Yanteng Si <siyanteng@loongson.cn>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c | 5 -----
1 file changed, 5 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
index cef9734ef259..da7b5d26a589 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c
@@ -59,11 +59,6 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id
return -ENODEV;
}
- if (!of_device_is_compatible(np, "loongson, pci-gmac")) {
- pr_info("dwmac_loongson_pci: Incompatible OF node\n");
- return -ENODEV;
- }
-
plat = devm_kzalloc(&pdev->dev, sizeof(*plat), GFP_KERNEL);
if (!plat)
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 034/374] MIPS: dts: loongson: drop incorrect dwmac fallback compatible
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 033/374] stmmac: dwmac-loongson: drop useless check for compatible fallback Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 035/374] tracing: Fix uaf issue when open the hist or hist_debug file Greg Kroah-Hartman
` (340 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Yanteng Si,
Conor Dooley, Jiaxun Yang, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 4907a3f54b12b8209864572a312cf967befcae80 ]
Device binds to proper PCI ID (LOONGSON, 0x7a03), already listed in DTS,
so checking for some other compatible does not make sense. It cannot be
bound to unsupported platform.
Drop useless, incorrect (space in between) and undocumented compatible.
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Yanteng Si <siyanteng@loongson.cn>
Reviewed-by: Conor Dooley <conor.dooley@microchip.com>
Acked-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi | 3 +--
arch/mips/boot/dts/loongson/ls7a-pch.dtsi | 3 +--
2 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi
index bfc3d3243ee7..d73d8f4fd78e 100644
--- a/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi
+++ b/arch/mips/boot/dts/loongson/loongson64-2k1000.dtsi
@@ -118,8 +118,7 @@ gmac@3,0 {
compatible = "pci0014,7a03.0",
"pci0014,7a03",
"pciclass0c0320",
- "pciclass0c03",
- "loongson, pci-gmac";
+ "pciclass0c03";
reg = <0x1800 0x0 0x0 0x0 0x0>;
interrupts = <12 IRQ_TYPE_LEVEL_LOW>,
diff --git a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
index 2f45fce2cdc4..ed99ee316feb 100644
--- a/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
+++ b/arch/mips/boot/dts/loongson/ls7a-pch.dtsi
@@ -186,8 +186,7 @@ gmac@3,0 {
compatible = "pci0014,7a03.0",
"pci0014,7a03",
"pciclass020000",
- "pciclass0200",
- "loongson, pci-gmac";
+ "pciclass0200";
reg = <0x1800 0x0 0x0 0x0 0x0>;
interrupts = <12 IRQ_TYPE_LEVEL_HIGH>,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 035/374] tracing: Fix uaf issue when open the hist or hist_debug file
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 034/374] MIPS: dts: loongson: drop incorrect dwmac fallback compatible Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 036/374] ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI Greg Kroah-Hartman
` (339 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Steven Rostedt, Zheng Yejian,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <zhengyejian1@huawei.com>
[ Upstream commit 1cc111b9cddc71ce161cd388f11f0e9048edffdb ]
KASAN report following issue. The root cause is when opening 'hist'
file of an instance and accessing 'trace_event_file' in hist_show(),
but 'trace_event_file' has been freed due to the instance being removed.
'hist_debug' file has the same problem. To fix it, call
tracing_{open,release}_file_tr() in file_operations callback to have
the ref count and avoid 'trace_event_file' being freed.
BUG: KASAN: slab-use-after-free in hist_show+0x11e0/0x1278
Read of size 8 at addr ffff242541e336b8 by task head/190
CPU: 4 PID: 190 Comm: head Not tainted 6.7.0-rc5-g26aff849438c #133
Hardware name: linux,dummy-virt (DT)
Call trace:
dump_backtrace+0x98/0xf8
show_stack+0x1c/0x30
dump_stack_lvl+0x44/0x58
print_report+0xf0/0x5a0
kasan_report+0x80/0xc0
__asan_report_load8_noabort+0x1c/0x28
hist_show+0x11e0/0x1278
seq_read_iter+0x344/0xd78
seq_read+0x128/0x1c0
vfs_read+0x198/0x6c8
ksys_read+0xf4/0x1e0
__arm64_sys_read+0x70/0xa8
invoke_syscall+0x70/0x260
el0_svc_common.constprop.0+0xb0/0x280
do_el0_svc+0x44/0x60
el0_svc+0x34/0x68
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x168/0x170
Allocated by task 188:
kasan_save_stack+0x28/0x50
kasan_set_track+0x28/0x38
kasan_save_alloc_info+0x20/0x30
__kasan_slab_alloc+0x6c/0x80
kmem_cache_alloc+0x15c/0x4a8
trace_create_new_event+0x84/0x348
__trace_add_new_event+0x18/0x88
event_trace_add_tracer+0xc4/0x1a0
trace_array_create_dir+0x6c/0x100
trace_array_create+0x2e8/0x568
instance_mkdir+0x48/0x80
tracefs_syscall_mkdir+0x90/0xe8
vfs_mkdir+0x3c4/0x610
do_mkdirat+0x144/0x200
__arm64_sys_mkdirat+0x8c/0xc0
invoke_syscall+0x70/0x260
el0_svc_common.constprop.0+0xb0/0x280
do_el0_svc+0x44/0x60
el0_svc+0x34/0x68
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x168/0x170
Freed by task 191:
kasan_save_stack+0x28/0x50
kasan_set_track+0x28/0x38
kasan_save_free_info+0x34/0x58
__kasan_slab_free+0xe4/0x158
kmem_cache_free+0x19c/0x508
event_file_put+0xa0/0x120
remove_event_file_dir+0x180/0x320
event_trace_del_tracer+0xb0/0x180
__remove_instance+0x224/0x508
instance_rmdir+0x44/0x78
tracefs_syscall_rmdir+0xbc/0x140
vfs_rmdir+0x1cc/0x4c8
do_rmdir+0x220/0x2b8
__arm64_sys_unlinkat+0xc0/0x100
invoke_syscall+0x70/0x260
el0_svc_common.constprop.0+0xb0/0x280
do_el0_svc+0x44/0x60
el0_svc+0x34/0x68
el0t_64_sync_handler+0xb8/0xc0
el0t_64_sync+0x168/0x170
Link: https://lore.kernel.org/linux-trace-kernel/20231214012153.676155-1-zhengyejian1@huawei.com
Suggested-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Zheng Yejian <zhengyejian1@huawei.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/trace.c | 6 ++++++
kernel/trace/trace.h | 1 +
kernel/trace/trace_events_hist.c | 12 ++++++++----
3 files changed, 15 insertions(+), 4 deletions(-)
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 66322196b256..bac5505b243e 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -4904,6 +4904,12 @@ int tracing_release_file_tr(struct inode *inode, struct file *filp)
return 0;
}
+int tracing_single_release_file_tr(struct inode *inode, struct file *filp)
+{
+ tracing_release_file_tr(inode, filp);
+ return single_release(inode, filp);
+}
+
static int tracing_mark_open(struct inode *inode, struct file *filp)
{
stream_open(inode, filp);
diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h
index c6eb116dc279..449a8bd873cf 100644
--- a/kernel/trace/trace.h
+++ b/kernel/trace/trace.h
@@ -593,6 +593,7 @@ int tracing_open_generic(struct inode *inode, struct file *filp);
int tracing_open_generic_tr(struct inode *inode, struct file *filp);
int tracing_open_file_tr(struct inode *inode, struct file *filp);
int tracing_release_file_tr(struct inode *inode, struct file *filp);
+int tracing_single_release_file_tr(struct inode *inode, struct file *filp);
bool tracing_is_disabled(void);
bool tracer_tracing_is_on(struct trace_array *tr);
void tracer_tracing_on(struct trace_array *tr);
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index c32a53f08922..e7799814a3c8 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -4946,10 +4946,12 @@ static int event_hist_open(struct inode *inode, struct file *file)
{
int ret;
- ret = security_locked_down(LOCKDOWN_TRACEFS);
+ ret = tracing_open_file_tr(inode, file);
if (ret)
return ret;
+ /* Clear private_data to avoid warning in single_open() */
+ file->private_data = NULL;
return single_open(file, hist_show, file);
}
@@ -4957,7 +4959,7 @@ const struct file_operations event_hist_fops = {
.open = event_hist_open,
.read = seq_read,
.llseek = seq_lseek,
- .release = single_release,
+ .release = tracing_single_release_file_tr,
};
#ifdef CONFIG_HIST_TRIGGERS_DEBUG
@@ -5218,10 +5220,12 @@ static int event_hist_debug_open(struct inode *inode, struct file *file)
{
int ret;
- ret = security_locked_down(LOCKDOWN_TRACEFS);
+ ret = tracing_open_file_tr(inode, file);
if (ret)
return ret;
+ /* Clear private_data to avoid warning in single_open() */
+ file->private_data = NULL;
return single_open(file, hist_debug_show, file);
}
@@ -5229,7 +5233,7 @@ const struct file_operations event_hist_debug_fops = {
.open = event_hist_debug_open,
.read = seq_read,
.llseek = seq_lseek,
- .release = single_release,
+ .release = tracing_single_release_file_tr,
};
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 036/374] ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 035/374] tracing: Fix uaf issue when open the hist or hist_debug file Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 037/374] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Greg Kroah-Hartman
` (338 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, Steven Rostedt (Google), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steven Rostedt (Google) <rostedt@goodmis.org>
[ Upstream commit 712292308af2265cd9b126aedfa987f10f452a33 ]
As the ring buffer recording requires cmpxchg() to work, if the
architecture does not support cmpxchg in NMI, then do not do any recording
within an NMI.
Link: https://lore.kernel.org/linux-trace-kernel/20231213175403.6fc18540@gandalf.local.home
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 65a728b89574..374cfba6c306 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3603,6 +3603,12 @@ rb_reserve_next_event(struct trace_buffer *buffer,
int nr_loops = 0;
int add_ts_default;
+ /* ring buffer does cmpxchg, make sure it is safe in NMI context */
+ if (!IS_ENABLED(CONFIG_ARCH_HAVE_NMI_SAFE_CMPXCHG) &&
+ (unlikely(in_nmi()))) {
+ return NULL;
+ }
+
rb_start_commit(cpu_buffer);
/* The commit page can not change after this */
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 037/374] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 036/374] ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 038/374] Input: atkbd - skip ATKBD_CMD_GETID in translated mode Greg Kroah-Hartman
` (337 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Philipp Zabel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit b5ec294472794ed9ecba0cb4b8208372842e7e0d ]
'type' is an enum, thus cast of pointer on 64-bit compile test with W=1
causes:
hi6220_reset.c:166:9: error: cast to smaller integer type 'enum hi6220_reset_ctrl_type' from 'const void *' [-Werror,-Wvoid-pointer-to-enum-cast]
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20230810091300.70197-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/reset/hisilicon/hi6220_reset.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/reset/hisilicon/hi6220_reset.c b/drivers/reset/hisilicon/hi6220_reset.c
index 5ca145b64e63..30951914afac 100644
--- a/drivers/reset/hisilicon/hi6220_reset.c
+++ b/drivers/reset/hisilicon/hi6220_reset.c
@@ -164,7 +164,7 @@ static int hi6220_reset_probe(struct platform_device *pdev)
if (!data)
return -ENOMEM;
- type = (enum hi6220_reset_ctrl_type)of_device_get_match_data(dev);
+ type = (uintptr_t)of_device_get_match_data(dev);
regmap = syscon_node_to_regmap(np);
if (IS_ERR(regmap)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 038/374] Input: atkbd - skip ATKBD_CMD_GETID in translated mode
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 037/374] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 039/374] Input: i8042 - add nomux quirk for Acer P459-G2-M Greg Kroah-Hartman
` (336 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shang Ye, gurevitch, Egor Ignatov,
Anton Zhilyaev, Hans de Goede, Dmitry Torokhov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 936e4d49ecbc8c404790504386e1422b599dec39 ]
There have been multiple reports of keyboard issues on recent laptop models
which can be worked around by setting i8042.dumbkbd, with the downside
being this breaks the capslock LED.
It seems that these issues are caused by recent laptops getting confused by
ATKBD_CMD_GETID. Rather then adding and endless growing list of quirks for
this, just skip ATKBD_CMD_GETID alltogether on laptops in translated mode.
The main goal of sending ATKBD_CMD_GETID is to skip binding to ps/2
mice/touchpads and those are never used in translated mode.
Examples of laptop models which benefit from skipping ATKBD_CMD_GETID:
* "HP Laptop 15s-fq2xxx", "HP laptop 15s-fq4xxx" and "HP Laptop 15-dy2xxx"
models the kbd stops working for the first 2 - 5 minutes after boot
(waiting for EC watchdog reset?)
* On "HP Spectre x360 13-aw2xxx" atkbd fails to probe the keyboard
* At least 9 different Lenovo models have issues with ATKBD_CMD_GETID, see:
https://github.com/yescallop/atkbd-nogetid
This has been tested on:
1. A MSI B550M PRO-VDH WIFI desktop, where the i8042 controller is not
in translated mode when no keyboard is plugged in and with a ps/2 kbd
a "AT Translated Set 2 keyboard" /dev/input/event# node shows up
2. A Lenovo ThinkPad X1 Yoga gen 8 (always has a translated set 2 keyboard)
Reported-by: Shang Ye <yesh25@mail2.sysu.edu.cn>
Closes: https://lore.kernel.org/linux-input/886D6167733841AE+20231017135318.11142-1-yesh25@mail2.sysu.edu.cn/
Closes: https://github.com/yescallop/atkbd-nogetid
Reported-by: gurevitch <mail@gurevit.ch>
Closes: https://lore.kernel.org/linux-input/2iAJTwqZV6lQs26cTb38RNYqxvsink6SRmrZ5h0cBUSuf9NT0tZTsf9fEAbbto2maavHJEOP8GA1evlKa6xjKOsaskDhtJWxjcnrgPigzVo=@gurevit.ch/
Reported-by: Egor Ignatov <egori@altlinux.org>
Closes: https://lore.kernel.org/all/20210609073333.8425-1-egori@altlinux.org/
Reported-by: Anton Zhilyaev <anton@cpp.in>
Closes: https://lore.kernel.org/linux-input/20210201160336.16008-1-anton@cpp.in/
Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2086156
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20231115174625.7462-1-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/keyboard/atkbd.c | 46 +++++++++++++++++++++++++++++++---
1 file changed, 42 insertions(+), 4 deletions(-)
diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index fbdef95291e9..8126ab2acd18 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -756,6 +756,44 @@ static void atkbd_deactivate(struct atkbd *atkbd)
ps2dev->serio->phys);
}
+#ifdef CONFIG_X86
+static bool atkbd_is_portable_device(void)
+{
+ static const char * const chassis_types[] = {
+ "8", /* Portable */
+ "9", /* Laptop */
+ "10", /* Notebook */
+ "14", /* Sub-Notebook */
+ "31", /* Convertible */
+ "32", /* Detachable */
+ };
+ int i;
+
+ for (i = 0; i < ARRAY_SIZE(chassis_types); i++)
+ if (dmi_match(DMI_CHASSIS_TYPE, chassis_types[i]))
+ return true;
+
+ return false;
+}
+
+/*
+ * On many modern laptops ATKBD_CMD_GETID may cause problems, on these laptops
+ * the controller is always in translated mode. In this mode mice/touchpads will
+ * not work. So in this case simply assume a keyboard is connected to avoid
+ * confusing some laptop keyboards.
+ *
+ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is
+ * ok in translated mode, only atkbd_select_set() checks atkbd->id and in
+ * translated mode that is a no-op.
+ */
+static bool atkbd_skip_getid(struct atkbd *atkbd)
+{
+ return atkbd->translated && atkbd_is_portable_device();
+}
+#else
+static inline bool atkbd_skip_getid(struct atkbd *atkbd) { return false; }
+#endif
+
/*
* atkbd_probe() probes for an AT keyboard on a serio port.
*/
@@ -785,12 +823,12 @@ static int atkbd_probe(struct atkbd *atkbd)
*/
param[0] = param[1] = 0xa5; /* initialize with invalid values */
- if (ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
+ if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
/*
- * If the get ID command failed, we check if we can at least set the LEDs on
- * the keyboard. This should work on every keyboard out there. It also turns
- * the LEDs off, which we want anyway.
+ * If the get ID command was skipped or failed, we check if we can at least set
+ * the LEDs on the keyboard. This should work on every keyboard out there.
+ * It also turns the LEDs off, which we want anyway.
*/
param[0] = 0;
if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS))
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 039/374] Input: i8042 - add nomux quirk for Acer P459-G2-M
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 038/374] Input: atkbd - skip ATKBD_CMD_GETID in translated mode Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 040/374] s390/scm: fix virtual vs physical address confusion Greg Kroah-Hartman
` (335 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Esther Shimanovich, Dmitry Torokhov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Esther Shimanovich <eshimanovich@chromium.org>
[ Upstream commit 335fe00319e030d481a54d5e0e68d50c5e672c0e ]
After the laptop lid is opened, and the device resumes from S3 deep
sleep, if the user presses a keyboard key while the screen is still black,
the mouse and keyboard become unusable.
Enabling this quirk prevents this behavior from occurring.
Signed-off-by: Esther Shimanovich <eshimanovich@chromium.org>
Link: https://lore.kernel.org/r/20231130195615.v2.1.Ibe78a9df97ecd18dc227a5cff67d3029631d9c11@changeid
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/serio/i8042-acpipnpio.h | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/drivers/input/serio/i8042-acpipnpio.h b/drivers/input/serio/i8042-acpipnpio.h
index 3db87ee0b70c..6af38f53154b 100644
--- a/drivers/input/serio/i8042-acpipnpio.h
+++ b/drivers/input/serio/i8042-acpipnpio.h
@@ -351,6 +351,14 @@ static const struct dmi_system_id i8042_dmi_quirk_table[] __initconst = {
},
.driver_data = (void *)(SERIO_QUIRK_DRITEK)
},
+ {
+ /* Acer TravelMate P459-G2-M */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
+ DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate P459-G2-M"),
+ },
+ .driver_data = (void *)(SERIO_QUIRK_NOMUX)
+ },
{
/* Amoi M636/A737 */
.matches = {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 040/374] s390/scm: fix virtual vs physical address confusion
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 039/374] Input: i8042 - add nomux quirk for Acer P459-G2-M Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 041/374] ARC: fix spare error Greg Kroah-Hartman
` (334 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vineeth Vijayan, Peter Oberparleiter,
Alexander Gordeev, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineeth Vijayan <vneethv@linux.ibm.com>
[ Upstream commit b1a6a1a77f0666a5a6dc0893ab6ec8fcae46f24c ]
Fix virtual vs physical address confusion (which currently are the same).
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/block/scm_blk.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/s390/block/scm_blk.c b/drivers/s390/block/scm_blk.c
index 88cba6212ee2..e36775c14782 100644
--- a/drivers/s390/block/scm_blk.c
+++ b/drivers/s390/block/scm_blk.c
@@ -18,6 +18,7 @@
#include <linux/genhd.h>
#include <linux/slab.h>
#include <linux/list.h>
+#include <linux/io.h>
#include <asm/eadm.h>
#include "scm_blk.h"
@@ -131,7 +132,7 @@ static void scm_request_done(struct scm_request *scmrq)
for (i = 0; i < nr_requests_per_io && scmrq->request[i]; i++) {
msb = &scmrq->aob->msb[i];
- aidaw = msb->data_addr;
+ aidaw = (u64)phys_to_virt(msb->data_addr);
if ((msb->flags & MSB_FLAG_IDA) && aidaw &&
IS_ALIGNED(aidaw, PAGE_SIZE))
@@ -196,12 +197,12 @@ static int scm_request_prepare(struct scm_request *scmrq)
msb->scm_addr = scmdev->address + ((u64) blk_rq_pos(req) << 9);
msb->oc = (rq_data_dir(req) == READ) ? MSB_OC_READ : MSB_OC_WRITE;
msb->flags |= MSB_FLAG_IDA;
- msb->data_addr = (u64) aidaw;
+ msb->data_addr = (u64)virt_to_phys(aidaw);
rq_for_each_segment(bv, req, iter) {
WARN_ON(bv.bv_offset);
msb->blk_count += bv.bv_len >> 12;
- aidaw->data_addr = (u64) page_address(bv.bv_page);
+ aidaw->data_addr = virt_to_phys(page_address(bv.bv_page));
aidaw++;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 041/374] ARC: fix spare error
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 040/374] s390/scm: fix virtual vs physical address confusion Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 042/374] wifi: iwlwifi: pcie: avoid a NULL pointer dereference Greg Kroah-Hartman
` (333 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Vineet Gupta,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@kernel.org>
[ Upstream commit aca02d933f63ba8bc84258bf35f9ffaf6b664336 ]
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202312082320.VDN5A9hb-lkp@intel.com/
Signed-off-by: Vineet Gupta <vgupta@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arc/kernel/signal.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/arch/arc/kernel/signal.c b/arch/arc/kernel/signal.c
index cb2f88502baf..25c16eb1d90b 100644
--- a/arch/arc/kernel/signal.c
+++ b/arch/arc/kernel/signal.c
@@ -61,7 +61,7 @@ struct rt_sigframe {
unsigned int sigret_magic;
};
-static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
+static int save_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs)
{
int err = 0;
#ifndef CONFIG_ISA_ARCOMPACT
@@ -74,12 +74,12 @@ static int save_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
#else
v2abi.r58 = v2abi.r59 = 0;
#endif
- err = __copy_to_user(&mctx->v2abi, &v2abi, sizeof(v2abi));
+ err = __copy_to_user(&mctx->v2abi, (void const *)&v2abi, sizeof(v2abi));
#endif
return err;
}
-static int restore_arcv2_regs(struct sigcontext *mctx, struct pt_regs *regs)
+static int restore_arcv2_regs(struct sigcontext __user *mctx, struct pt_regs *regs)
{
int err = 0;
#ifndef CONFIG_ISA_ARCOMPACT
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 042/374] wifi: iwlwifi: pcie: avoid a NULL pointer dereference
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 041/374] ARC: fix spare error Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 043/374] Input: xpad - add Razer Wolverine V2 support Greg Kroah-Hartman
` (332 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Avraham Stern, Miri Korenblit,
Johannes Berg, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Avraham Stern <avraham.stern@intel.com>
[ Upstream commit ce038edfce43fb345f8dfdca0f7b17f535896701 ]
It possible that while the rx rb is being handled, the transport has
been stopped and re-started. In this case the tx queue pointer is not
yet initialized, which will lead to a NULL pointer dereference.
Fix it.
Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231207044813.cd0898cafd89.I0b84daae753ba9612092bf383f5c6f761446e964@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/pcie/rx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
index 29be7ed76894..17e53c7eb62d 100644
--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c
@@ -1380,7 +1380,7 @@ static void iwl_pcie_rx_handle_rb(struct iwl_trans *trans,
* if it is true then one of the handlers took the page.
*/
- if (reclaim) {
+ if (reclaim && txq) {
u16 sequence = le16_to_cpu(pkt->hdr.sequence);
int index = SEQ_TO_INDEX(sequence);
int cmd_index = iwl_txq_get_cmd_index(txq, index);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 043/374] Input: xpad - add Razer Wolverine V2 support
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 042/374] wifi: iwlwifi: pcie: avoid a NULL pointer dereference Greg Kroah-Hartman
@ 2024-01-22 23:54 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 044/374] ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 Greg Kroah-Hartman
` (331 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:54 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luca Weiss, Dmitry Torokhov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca@z3ntu.xyz>
[ Upstream commit c3d1610345b79cbe29ef6ca04a4780eff0d360c7 ]
Add the VID and PID of Razer Wolverine V2 to xpad_device.
Signed-off-by: Luca Weiss <luca@z3ntu.xyz>
Link: https://lore.kernel.org/r/20231125-razer-wolverine-v2-v1-1-979fe9f9288e@z3ntu.xyz
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/input/joystick/xpad.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
index 3bf5c787f914..1ff0d4e24fe6 100644
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -268,6 +268,7 @@ static const struct xpad_device {
{ 0x146b, 0x0604, "Bigben Interactive DAIJA Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 },
{ 0x1532, 0x0a00, "Razer Atrox Arcade Stick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOXONE },
{ 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE },
+ { 0x1532, 0x0a29, "Razer Wolverine V2", 0, XTYPE_XBOXONE },
{ 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 },
{ 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 },
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 044/374] ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2024-01-22 23:54 ` [PATCH 5.15 043/374] Input: xpad - add Razer Wolverine V2 support Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 045/374] i2c: rk3x: fix potential spinlock recursion on poll Greg Kroah-Hartman
` (330 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans de Goede, Pierre-Louis Bossart,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 99c7bb44f5749373bc01b73af02b50b69bcbf43d ]
Add a quirk for the Medion Lifetab S10346, this BYTCR tablet has no CHAN
package in its ACPI tables and uses SSP0-AIF1 rather then SSP0-AIF2 which
is the default for BYTCR devices.
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Acked-by: Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
Link: https://msgid.link/r/20231217213221.49424-1-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/intel/boards/bytcr_rt5640.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c
index 4df1be8170bb..49dfbd29c545 100644
--- a/sound/soc/intel/boards/bytcr_rt5640.c
+++ b/sound/soc/intel/boards/bytcr_rt5640.c
@@ -870,6 +870,18 @@ static const struct dmi_system_id byt_rt5640_quirk_table[] = {
BYT_RT5640_SSP0_AIF1 |
BYT_RT5640_MCLK_EN),
},
+ {
+ /* Medion Lifetab S10346 */
+ .matches = {
+ DMI_MATCH(DMI_BOARD_VENDOR, "AMI Corporation"),
+ DMI_MATCH(DMI_BOARD_NAME, "Aptio CRB"),
+ /* Above strings are much too generic, also match on BIOS date */
+ DMI_MATCH(DMI_BIOS_DATE, "10/22/2015"),
+ },
+ .driver_data = (void *)(BYTCR_INPUT_DEFAULTS |
+ BYT_RT5640_SSP0_AIF1 |
+ BYT_RT5640_MCLK_EN),
+ },
{ /* Mele PCG03 Mini PC */
.matches = {
DMI_EXACT_MATCH(DMI_BOARD_VENDOR, "Mini PC"),
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 045/374] i2c: rk3x: fix potential spinlock recursion on poll
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 044/374] ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 046/374] ida: Fix crash in ida_free when the bitmap is empty Greg Kroah-Hartman
` (329 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jensen Huang, Heiko Stuebner,
Andi Shyti, Wolfram Sang, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jensen Huang <jensenhuang@friendlyarm.com>
[ Upstream commit 19cde9c92b8d3b7ee555d0da3bcb0232d3a784f4 ]
Possible deadlock scenario (on reboot):
rk3x_i2c_xfer_common(polling)
-> rk3x_i2c_wait_xfer_poll()
-> rk3x_i2c_irq(0, i2c);
--> spin_lock(&i2c->lock);
...
<rk3x i2c interrupt>
-> rk3x_i2c_irq(0, i2c);
--> spin_lock(&i2c->lock); (deadlock here)
Store the IRQ number and disable/enable it around the polling transfer.
This patch has been tested on NanoPC-T4.
Signed-off-by: Jensen Huang <jensenhuang@friendlyarm.com>
Reviewed-by: Heiko Stuebner <heiko@sntech.de>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-rk3x.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c
index 13c14eb175e9..6abcf975a2db 100644
--- a/drivers/i2c/busses/i2c-rk3x.c
+++ b/drivers/i2c/busses/i2c-rk3x.c
@@ -178,6 +178,7 @@ struct rk3x_i2c_soc_data {
* @clk: function clk for rk3399 or function & Bus clks for others
* @pclk: Bus clk for rk3399
* @clk_rate_nb: i2c clk rate change notify
+ * @irq: irq number
* @t: I2C known timing information
* @lock: spinlock for the i2c bus
* @wait: the waitqueue to wait for i2c transfer
@@ -200,6 +201,7 @@ struct rk3x_i2c {
struct clk *clk;
struct clk *pclk;
struct notifier_block clk_rate_nb;
+ int irq;
/* Settings */
struct i2c_timings t;
@@ -1087,13 +1089,18 @@ static int rk3x_i2c_xfer_common(struct i2c_adapter *adap,
spin_unlock_irqrestore(&i2c->lock, flags);
- rk3x_i2c_start(i2c);
-
if (!polling) {
+ rk3x_i2c_start(i2c);
+
timeout = wait_event_timeout(i2c->wait, !i2c->busy,
msecs_to_jiffies(WAIT_TIMEOUT));
} else {
+ disable_irq(i2c->irq);
+ rk3x_i2c_start(i2c);
+
timeout = rk3x_i2c_wait_xfer_poll(i2c);
+
+ enable_irq(i2c->irq);
}
spin_lock_irqsave(&i2c->lock, flags);
@@ -1301,6 +1308,8 @@ static int rk3x_i2c_probe(struct platform_device *pdev)
return ret;
}
+ i2c->irq = irq;
+
platform_set_drvdata(pdev, i2c);
if (i2c->soc_data->calc_timings == rk3x_i2c_v0_calc_timings) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 046/374] ida: Fix crash in ida_free when the bitmap is empty
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 045/374] i2c: rk3x: fix potential spinlock recursion on poll Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 047/374] net: qrtr: ns: Return 0 if server port is not present Greg Kroah-Hartman
` (328 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhenghan Wang,
Matthew Wilcox (Oracle), Linus Torvalds, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <willy@infradead.org>
[ Upstream commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a ]
The IDA usually detects double-frees, but that detection failed to
consider the case when there are no nearby IDs allocated and so we have a
NULL bitmap rather than simply having a clear bit. Add some tests to the
test-suite to be sure we don't inadvertently reintroduce this problem.
Unfortunately they're quite noisy so include a message to disregard
the warnings.
Reported-by: Zhenghan Wang <wzhmmmmm@gmail.com>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/idr.c | 2 +-
lib/test_ida.c | 40 ++++++++++++++++++++++++++++++++++++++++
2 files changed, 41 insertions(+), 1 deletion(-)
diff --git a/lib/idr.c b/lib/idr.c
index 13f2758c2377..da36054c3ca0 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -508,7 +508,7 @@ void ida_free(struct ida *ida, unsigned int id)
goto delete;
xas_store(&xas, xa_mk_value(v));
} else {
- if (!test_bit(bit, bitmap->bitmap))
+ if (!bitmap || !test_bit(bit, bitmap->bitmap))
goto err;
__clear_bit(bit, bitmap->bitmap);
xas_set_mark(&xas, XA_FREE_MARK);
diff --git a/lib/test_ida.c b/lib/test_ida.c
index b06880625961..55105baa19da 100644
--- a/lib/test_ida.c
+++ b/lib/test_ida.c
@@ -150,6 +150,45 @@ static void ida_check_conv(struct ida *ida)
IDA_BUG_ON(ida, !ida_is_empty(ida));
}
+/*
+ * Check various situations where we attempt to free an ID we don't own.
+ */
+static void ida_check_bad_free(struct ida *ida)
+{
+ unsigned long i;
+
+ printk("vvv Ignore \"not allocated\" warnings\n");
+ /* IDA is empty; all of these will fail */
+ ida_free(ida, 0);
+ for (i = 0; i < 31; i++)
+ ida_free(ida, 1 << i);
+
+ /* IDA contains a single value entry */
+ IDA_BUG_ON(ida, ida_alloc_min(ida, 3, GFP_KERNEL) != 3);
+ ida_free(ida, 0);
+ for (i = 0; i < 31; i++)
+ ida_free(ida, 1 << i);
+
+ /* IDA contains a single bitmap */
+ IDA_BUG_ON(ida, ida_alloc_min(ida, 1023, GFP_KERNEL) != 1023);
+ ida_free(ida, 0);
+ for (i = 0; i < 31; i++)
+ ida_free(ida, 1 << i);
+
+ /* IDA contains a tree */
+ IDA_BUG_ON(ida, ida_alloc_min(ida, (1 << 20) - 1, GFP_KERNEL) != (1 << 20) - 1);
+ ida_free(ida, 0);
+ for (i = 0; i < 31; i++)
+ ida_free(ida, 1 << i);
+ printk("^^^ \"not allocated\" warnings over\n");
+
+ ida_free(ida, 3);
+ ida_free(ida, 1023);
+ ida_free(ida, (1 << 20) - 1);
+
+ IDA_BUG_ON(ida, !ida_is_empty(ida));
+}
+
static DEFINE_IDA(ida);
static int ida_checks(void)
@@ -162,6 +201,7 @@ static int ida_checks(void)
ida_check_leaf(&ida, 1024 * 64);
ida_check_max(&ida);
ida_check_conv(&ida);
+ ida_check_bad_free(&ida);
printk("IDA: %u of %u tests passed\n", tests_passed, tests_run);
return (tests_run != tests_passed) ? 0 : -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 047/374] net: qrtr: ns: Return 0 if server port is not present
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 046/374] ida: Fix crash in ida_free when the bitmap is empty Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 048/374] ARM: sun9i: smp: fix return code check of of_property_match_string Greg Kroah-Hartman
` (327 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sarannya Sasikumar, Simon Horman,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sarannya S <quic_sarannya@quicinc.com>
[ Upstream commit 9bf2e9165f90dc9f416af53c902be7e33930f728 ]
When a 'DEL_CLIENT' message is received from the remote, the corresponding
server port gets deleted. A DEL_SERVER message is then announced for this
server. As part of handling the subsequent DEL_SERVER message, the name-
server attempts to delete the server port which results in a '-ENOENT' error.
The return value from server_del() is then propagated back to qrtr_ns_worker,
causing excessive error prints.
To address this, return 0 from control_cmd_del_server() without checking the
return value of server_del(), since the above scenario is not an error case
and hence server_del() doesn't have any other error return value.
Signed-off-by: Sarannya Sasikumar <quic_sarannya@quicinc.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/qrtr/ns.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/qrtr/ns.c b/net/qrtr/ns.c
index 3e40a1ba48f7..4a13b9f7abb4 100644
--- a/net/qrtr/ns.c
+++ b/net/qrtr/ns.c
@@ -569,7 +569,9 @@ static int ctrl_cmd_del_server(struct sockaddr_qrtr *from,
if (!node)
return -ENOENT;
- return server_del(node, port, true);
+ server_del(node, port, true);
+
+ return 0;
}
static int ctrl_cmd_new_lookup(struct sockaddr_qrtr *from,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 048/374] ARM: sun9i: smp: fix return code check of of_property_match_string
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 047/374] net: qrtr: ns: Return 0 if server port is not present Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 049/374] drm/crtc: fix uninitialized variable use Greg Kroah-Hartman
` (326 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nick Desaulniers, Stefan Wahren,
Chen-Yu Tsai, Arnd Bergmann, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <wahrenst@gmx.net>
[ Upstream commit 643fe70e7bcdcc9e2d96952f7fc2bab56385cce5 ]
of_property_match_string returns an int; either an index from 0 or
greater if successful or negative on failure. Even it's very
unlikely that the DT CPU node contains multiple enable-methods
these checks should be fixed.
This patch was inspired by the work of Nick Desaulniers.
Link: https://lore.kernel.org/lkml/20230516-sunxi-v1-1-ac4b9651a8c1@google.com/T/
Cc: Nick Desaulniers <ndesaulniers@google.com>
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Link: https://lore.kernel.org/r/20231228193903.9078-2-wahrenst@gmx.net
Reviewed-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-sunxi/mc_smp.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm/mach-sunxi/mc_smp.c b/arch/arm/mach-sunxi/mc_smp.c
index b2f5f4f28705..f779e386b6e7 100644
--- a/arch/arm/mach-sunxi/mc_smp.c
+++ b/arch/arm/mach-sunxi/mc_smp.c
@@ -804,12 +804,12 @@ static int __init sunxi_mc_smp_init(void)
for (i = 0; i < ARRAY_SIZE(sunxi_mc_smp_data); i++) {
ret = of_property_match_string(node, "enable-method",
sunxi_mc_smp_data[i].enable_method);
- if (!ret)
+ if (ret >= 0)
break;
}
of_node_put(node);
- if (ret)
+ if (ret < 0)
return -ENODEV;
is_a83t = sunxi_mc_smp_data[i].is_a83t;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 049/374] drm/crtc: fix uninitialized variable use
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 048/374] ARM: sun9i: smp: fix return code check of of_property_match_string Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 050/374] ACPI: resource: Add another DMI match for the TongFang GMxXGxx Greg Kroah-Hartman
` (325 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+4fad2e57beb6397ab2fc,
Ziqi Zhao, Maxime Ripard, Maarten Lankhorst, Thomas Zimmermann,
Jani Nikula, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jani Nikula <jani.nikula@intel.com>
[ Upstream commit 6e455f5dcdd15fa28edf0ffb5b44d3508512dccf ]
Commit 3823119b9c2b ("drm/crtc: Fix uninit-value bug in
drm_mode_setcrtc") was supposed to fix use of an uninitialized variable,
but introduced another.
num_connectors is only initialized if crtc_req->count_connectors > 0,
but it's used regardless. Fix it.
Fixes: 3823119b9c2b ("drm/crtc: Fix uninit-value bug in drm_mode_setcrtc")
Cc: syzbot+4fad2e57beb6397ab2fc@syzkaller.appspotmail.com
Cc: Ziqi Zhao <astrajoan@yahoo.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Signed-off-by: Jani Nikula <jani.nikula@intel.com>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231208131238.2924571-1-jani.nikula@intel.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_crtc.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_crtc.c b/drivers/gpu/drm/drm_crtc.c
index 8b50ab4c5581..c5e0c652766c 100644
--- a/drivers/gpu/drm/drm_crtc.c
+++ b/drivers/gpu/drm/drm_crtc.c
@@ -643,7 +643,7 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
struct drm_mode_set set;
uint32_t __user *set_connectors_ptr;
struct drm_modeset_acquire_ctx ctx;
- int ret, i, num_connectors;
+ int ret, i, num_connectors = 0;
if (!drm_core_check_feature(dev, DRIVER_MODESET))
return -EOPNOTSUPP;
@@ -778,7 +778,6 @@ int drm_mode_setcrtc(struct drm_device *dev, void *data,
goto out;
}
- num_connectors = 0;
for (i = 0; i < crtc_req->count_connectors; i++) {
connector_set[i] = NULL;
set_connectors_ptr = (uint32_t __user *)(unsigned long)crtc_req->set_connectors_ptr;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 050/374] ACPI: resource: Add another DMI match for the TongFang GMxXGxx
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 049/374] drm/crtc: fix uninitialized variable use Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 051/374] Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek" Greg Kroah-Hartman
` (324 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luis Acuna, Hans de Goede,
Rafael J. Wysocki
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit df0cced74159c79e36ce7971f0bf250673296d93 upstream.
The TongFang GMxXGxx, which needs IRQ overriding for the keyboard to work,
is also sold as the Eluktronics RP-15 which does not use the standard
TongFang GMxXGxx DMI board_name.
Add an entry for this laptop to the irq1_edge_low_force_override[] DMI
table to make the internal keyboard functional.
Reported-by: Luis Acuna <ldacuna@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/acpi/resource.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/acpi/resource.c
+++ b/drivers/acpi/resource.c
@@ -481,6 +481,13 @@ static const struct dmi_system_id mainge
},
},
{
+ /* TongFang GMxXGxx sold as Eluktronics Inc. RP-15 */
+ .matches = {
+ DMI_MATCH(DMI_SYS_VENDOR, "Eluktronics Inc."),
+ DMI_MATCH(DMI_BOARD_NAME, "RP-15"),
+ },
+ },
+ {
/* TongFang GM6XGxX/TUXEDO Stellaris 16 Gen5 AMD */
.matches = {
DMI_MATCH(DMI_BOARD_NAME, "GM6XGxX"),
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 051/374] Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 050/374] ACPI: resource: Add another DMI match for the TongFang GMxXGxx Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 052/374] bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25 Greg Kroah-Hartman
` (323 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Brown, Codrin Ciubotariu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This reverts commit bc7d0133181e5f33ac33ca4f6bb2bce876c8ad88 which is
commit c775cbf62ed4911e4f0f23880f01815753123690 upstream.
It is reported to cause problems, so drop it from the 5.15.y tree for now.
Link: https://lore.kernel.org/r/845b3053-d47b-4717-9665-79b120da133b@sirena.org.uk
Reported-by: Mark Brown <broonie@kernel.org>
Cc: Codrin Ciubotariu <codrin.ciubotariu@microchip.com>
Cc: Sasha Levin <sashal@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/soc/atmel/sam9g20_wm8731.c | 61 +++++++++++++++++++++++++++++++++++++++
1 file changed, 61 insertions(+)
--- a/sound/soc/atmel/sam9g20_wm8731.c
+++ b/sound/soc/atmel/sam9g20_wm8731.c
@@ -46,6 +46,35 @@
*/
#undef ENABLE_MIC_INPUT
+static struct clk *mclk;
+
+static int at91sam9g20ek_set_bias_level(struct snd_soc_card *card,
+ struct snd_soc_dapm_context *dapm,
+ enum snd_soc_bias_level level)
+{
+ static int mclk_on;
+ int ret = 0;
+
+ switch (level) {
+ case SND_SOC_BIAS_ON:
+ case SND_SOC_BIAS_PREPARE:
+ if (!mclk_on)
+ ret = clk_enable(mclk);
+ if (ret == 0)
+ mclk_on = 1;
+ break;
+
+ case SND_SOC_BIAS_OFF:
+ case SND_SOC_BIAS_STANDBY:
+ if (mclk_on)
+ clk_disable(mclk);
+ mclk_on = 0;
+ break;
+ }
+
+ return ret;
+}
+
static const struct snd_soc_dapm_widget at91sam9g20ek_dapm_widgets[] = {
SND_SOC_DAPM_MIC("Int Mic", NULL),
SND_SOC_DAPM_SPK("Ext Spk", NULL),
@@ -106,6 +135,7 @@ static struct snd_soc_card snd_soc_at91s
.owner = THIS_MODULE,
.dai_link = &at91sam9g20ek_dai,
.num_links = 1,
+ .set_bias_level = at91sam9g20ek_set_bias_level,
.dapm_widgets = at91sam9g20ek_dapm_widgets,
.num_dapm_widgets = ARRAY_SIZE(at91sam9g20ek_dapm_widgets),
@@ -118,6 +148,7 @@ static int at91sam9g20ek_audio_probe(str
{
struct device_node *np = pdev->dev.of_node;
struct device_node *codec_np, *cpu_np;
+ struct clk *pllb;
struct snd_soc_card *card = &snd_soc_at91sam9g20ek;
int ret;
@@ -131,6 +162,31 @@ static int at91sam9g20ek_audio_probe(str
return -EINVAL;
}
+ /*
+ * Codec MCLK is supplied by PCK0 - set it up.
+ */
+ mclk = clk_get(NULL, "pck0");
+ if (IS_ERR(mclk)) {
+ dev_err(&pdev->dev, "Failed to get MCLK\n");
+ ret = PTR_ERR(mclk);
+ goto err;
+ }
+
+ pllb = clk_get(NULL, "pllb");
+ if (IS_ERR(pllb)) {
+ dev_err(&pdev->dev, "Failed to get PLLB\n");
+ ret = PTR_ERR(pllb);
+ goto err_mclk;
+ }
+ ret = clk_set_parent(mclk, pllb);
+ clk_put(pllb);
+ if (ret != 0) {
+ dev_err(&pdev->dev, "Failed to set MCLK parent\n");
+ goto err_mclk;
+ }
+
+ clk_set_rate(mclk, MCLK_RATE);
+
card->dev = &pdev->dev;
/* Parse device node info */
@@ -174,6 +230,9 @@ static int at91sam9g20ek_audio_probe(str
return ret;
+err_mclk:
+ clk_put(mclk);
+ mclk = NULL;
err:
atmel_ssc_put_audio(0);
return ret;
@@ -183,6 +242,8 @@ static int at91sam9g20ek_audio_remove(st
{
struct snd_soc_card *card = platform_get_drvdata(pdev);
+ clk_disable(mclk);
+ mclk = NULL;
snd_soc_unregister_card(card);
atmel_ssc_put_audio(0);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 052/374] bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 051/374] Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek" Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 053/374] kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list Greg Kroah-Hartman
` (322 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Maguire, Jiri Olsa,
Alexei Starovoitov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Maguire <alan.maguire@oracle.com>
commit 7b99f75942da332e3f4f865e55a10fec95a30d4f upstream.
v1.25 of pahole supports filtering out functions with multiple inconsistent
function prototypes or optimized-out parameters from the BTF representation.
These present problems because there is no additional info in BTF saying which
inconsistent prototype matches which function instance to help guide attachment,
and functions with optimized-out parameters can lead to incorrect assumptions
about register contents.
So for now, filter out such functions while adding BTF representations for
functions that have "."-suffixes (foo.isra.0) but not optimized-out parameters.
This patch assumes that below linked changes land in pahole for v1.25.
Issues with pahole filtering being too aggressive in removing functions
appear to be resolved now, but CI and further testing will confirm.
Signed-off-by: Alan Maguire <alan.maguire@oracle.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20230510130241.1696561-1-alan.maguire@oracle.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
[ small context conflict because of not backported --lang_exclude=rust
option, which is not needed in 5.15 ]
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
scripts/pahole-flags.sh | 3 +++
1 file changed, 3 insertions(+)
--- a/scripts/pahole-flags.sh
+++ b/scripts/pahole-flags.sh
@@ -20,5 +20,8 @@ fi
if [ "${pahole_ver}" -ge "124" ]; then
extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_enum64"
fi
+if [ "${pahole_ver}" -ge "125" ]; then
+ extra_paholeopt="${extra_paholeopt} --skip_encoding_btf_inconsistent_proto --btf_gen_optimized"
+fi
echo ${extra_paholeopt}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 053/374] kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 052/374] bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25 Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 054/374] Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" Greg Kroah-Hartman
` (321 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengfei Xu,
Masami Hiramatsu (Google), Steven Rostedt (Google),
Fedor Pchelkin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit 4fbd2f83fda0ca44a2ec6421ca3508b355b31858 upstream.
Since forcibly unoptimized kprobes will be put on the freeing_list directly
in the unoptimize_kprobe(), do_unoptimize_kprobes() must continue to check
the freeing_list even if unoptimizing_list is empty.
This bug can happen if a kprobe is put in an instruction which is in the
middle of the jump-replaced instruction sequence of an optprobe, *and* the
optprobe is recently unregistered and queued on unoptimizing_list.
In this case, the optprobe will be unoptimized forcibly (means immediately)
and put it into the freeing_list, expecting the optprobe will be handled in
do_unoptimize_kprobe().
But if there is no other optprobes on the unoptimizing_list, current code
returns from the do_unoptimize_kprobe() soon and does not handle the
optprobe which is on the freeing_list. Then the optprobe will hit the
WARN_ON_ONCE() in the do_free_cleaned_kprobes(), because it is not handled
in the latter loop of the do_unoptimize_kprobe().
To solve this issue, do not return from do_unoptimize_kprobes() immediately
even if unoptimizing_list is empty.
Moreover, this change affects another case. kill_optimized_kprobes() expects
kprobe_optimizer() will just free the optprobe on freeing_list.
So I changed it to just do list_move() to freeing_list if optprobes are on
unoptimizing list. And the do_unoptimize_kprobe() will skip
arch_disarm_kprobe() if the probe on freeing_list has gone flag.
Link: https://lore.kernel.org/all/Y8URdIfVr3pq2X8w@xpf.sh.intel.com/
Link: https://lore.kernel.org/all/167448024501.3253718.13037333683110512967.stgit@devnote3/
Fixes: e4add247789e ("kprobes: Fix optimize_kprobe()/unoptimize_kprobe() cancellation logic")
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Cc: stable@vger.kernel.org
Acked-by: Steven Rostedt (Google) <rostedt@goodmis.org>
[fp: adjust comment conflict regarding commit 223a76b268c9 ("kprobes: Fix
coding style issues")]
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/kprobes.c | 23 ++++++++++-------------
1 file changed, 10 insertions(+), 13 deletions(-)
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c
@@ -549,17 +549,15 @@ static void do_unoptimize_kprobes(void)
/* See comment in do_optimize_kprobes() */
lockdep_assert_cpus_held();
- /* Unoptimization must be done anytime */
- if (list_empty(&unoptimizing_list))
- return;
+ if (!list_empty(&unoptimizing_list))
+ arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
- arch_unoptimize_kprobes(&unoptimizing_list, &freeing_list);
- /* Loop free_list for disarming */
+ /* Loop on 'freeing_list' for disarming and removing from kprobe hash list */
list_for_each_entry_safe(op, tmp, &freeing_list, list) {
/* Switching from detour code to origin */
op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
- /* Disarm probes if marked disabled */
- if (kprobe_disabled(&op->kp))
+ /* Disarm probes if marked disabled and not gone */
+ if (kprobe_disabled(&op->kp) && !kprobe_gone(&op->kp))
arch_disarm_kprobe(&op->kp);
if (kprobe_unused(&op->kp)) {
/*
@@ -788,14 +786,13 @@ static void kill_optimized_kprobe(struct
op->kp.flags &= ~KPROBE_FLAG_OPTIMIZED;
if (kprobe_unused(p)) {
- /* Enqueue if it is unused */
- list_add(&op->list, &freeing_list);
/*
- * Remove unused probes from the hash list. After waiting
- * for synchronization, this probe is reclaimed.
- * (reclaiming is done by do_free_cleaned_kprobes().)
+ * Unused kprobe is on unoptimizing or freeing list. We move it
+ * to freeing_list and let the kprobe_optimizer() remove it from
+ * the kprobe hash list and free it.
*/
- hlist_del_rcu(&op->kp.hlist);
+ if (optprobe_queued_unopt(op))
+ list_move(&op->list, &freeing_list);
}
/* Don't touch the code, because it is already freed. */
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 054/374] Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 053/374] kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 055/374] binder: use EPOLLERR from eventpoll.h Greg Kroah-Hartman
` (320 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Junxiao Bi, Yu Kuai, Song Liu
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
commit bed9e27baf52a09b7ba2a3714f1e24e17ced386d upstream.
This reverts commit 5e2cf333b7bd5d3e62595a44d598a254c697cd74.
That commit introduced the following race and can cause system hung.
md_write_start: raid5d:
// mddev->in_sync == 1
set "MD_SB_CHANGE_PENDING"
// running before md_write_start wakeup it
waiting "MD_SB_CHANGE_PENDING" cleared
>>>>>>>>> hung
wakeup mddev->thread
...
waiting "MD_SB_CHANGE_PENDING" cleared
>>>> hung, raid5d should clear this flag
but get hung by same flag.
The issue reverted commit fixing is fixed by last patch in a new way.
Fixes: 5e2cf333b7bd ("md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d")
Cc: stable@vger.kernel.org # v5.19+
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Signed-off-by: Song Liu <song@kernel.org>
Link: https://lore.kernel.org/r/20231108182216.73611-2-junxiao.bi@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 12 ------------
1 file changed, 12 deletions(-)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -36,7 +36,6 @@
*/
#include <linux/blkdev.h>
-#include <linux/delay.h>
#include <linux/kthread.h>
#include <linux/raid/pq.h>
#include <linux/async_tx.h>
@@ -6522,18 +6521,7 @@ static void raid5d(struct md_thread *thr
spin_unlock_irq(&conf->device_lock);
md_check_recovery(mddev);
spin_lock_irq(&conf->device_lock);
-
- /*
- * Waiting on MD_SB_CHANGE_PENDING below may deadlock
- * seeing md_check_recovery() is needed to clear
- * the flag when using mdmon.
- */
- continue;
}
-
- wait_event_lock_irq(mddev->sb_wait,
- !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
- conf->device_lock);
}
pr_debug("%d stripes handled\n", handled);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 055/374] binder: use EPOLLERR from eventpoll.h
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 054/374] Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 056/374] binder: fix use-after-free in shinkers callback Greg Kroah-Hartman
` (319 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Eric Biggers, Alice Ryhl,
Carlos Llamas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 6ac061db9c58ca5b9270b1b3940d2464fb3ff183 upstream.
Use EPOLLERR instead of POLLERR to make sure it is cast to the correct
__poll_t type. This fixes the following sparse issue:
drivers/android/binder.c:5030:24: warning: incorrect type in return expression (different base types)
drivers/android/binder.c:5030:24: expected restricted __poll_t
drivers/android/binder.c:5030:24: got int
Fixes: f88982679f54 ("binder: check for binder_thread allocation failure in binder_poll()")
Cc: stable@vger.kernel.org
Cc: Eric Biggers <ebiggers@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -4836,7 +4836,7 @@ static __poll_t binder_poll(struct file
thread = binder_get_thread(proc);
if (!thread)
- return POLLERR;
+ return EPOLLERR;
binder_inner_proc_lock(thread->proc);
thread->looper |= BINDER_LOOPER_STATE_POLL;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 056/374] binder: fix use-after-free in shinkers callback
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 055/374] binder: use EPOLLERR from eventpoll.h Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 057/374] binder: fix trivial typo of binder_free_buf_locked() Greg Kroah-Hartman
` (318 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Liam Howlett, Minchan Kim,
Alice Ryhl, Carlos Llamas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 3f489c2067c5824528212b0fc18b28d51332d906 upstream.
The mmap read lock is used during the shrinker's callback, which means
that using alloc->vma pointer isn't safe as it can race with munmap().
As of commit dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in
munmap") the mmap lock is downgraded after the vma has been isolated.
I was able to reproduce this issue by manually adding some delays and
triggering page reclaiming through the shrinker's debug sysfs. The
following KASAN report confirms the UAF:
==================================================================
BUG: KASAN: slab-use-after-free in zap_page_range_single+0x470/0x4b8
Read of size 8 at addr ffff356ed50e50f0 by task bash/478
CPU: 1 PID: 478 Comm: bash Not tainted 6.6.0-rc5-00055-g1c8b86a3799f-dirty #70
Hardware name: linux,dummy-virt (DT)
Call trace:
zap_page_range_single+0x470/0x4b8
binder_alloc_free_page+0x608/0xadc
__list_lru_walk_one+0x130/0x3b0
list_lru_walk_node+0xc4/0x22c
binder_shrink_scan+0x108/0x1dc
shrinker_debugfs_scan_write+0x2b4/0x500
full_proxy_write+0xd4/0x140
vfs_write+0x1ac/0x758
ksys_write+0xf0/0x1dc
__arm64_sys_write+0x6c/0x9c
Allocated by task 492:
kmem_cache_alloc+0x130/0x368
vm_area_alloc+0x2c/0x190
mmap_region+0x258/0x18bc
do_mmap+0x694/0xa60
vm_mmap_pgoff+0x170/0x29c
ksys_mmap_pgoff+0x290/0x3a0
__arm64_sys_mmap+0xcc/0x144
Freed by task 491:
kmem_cache_free+0x17c/0x3c8
vm_area_free_rcu_cb+0x74/0x98
rcu_core+0xa38/0x26d4
rcu_core_si+0x10/0x1c
__do_softirq+0x2fc/0xd24
Last potentially related work creation:
__call_rcu_common.constprop.0+0x6c/0xba0
call_rcu+0x10/0x1c
vm_area_free+0x18/0x24
remove_vma+0xe4/0x118
do_vmi_align_munmap.isra.0+0x718/0xb5c
do_vmi_munmap+0xdc/0x1fc
__vm_munmap+0x10c/0x278
__arm64_sys_munmap+0x58/0x7c
Fix this issue by performing instead a vma_lookup() which will fail to
find the vma that was isolated before the mmap lock downgrade. Note that
this option has better performance than upgrading to a mmap write lock
which would increase contention. Plus, mmap_write_trylock() has been
recently removed anyway.
Fixes: dd2283f2605e ("mm: mmap: zap pages with read mmap_sem in munmap")
Cc: stable@vger.kernel.org
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Minchan Kim <minchan@kernel.org>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-3-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -1005,7 +1005,9 @@ enum lru_status binder_alloc_free_page(s
goto err_mmget;
if (!mmap_read_trylock(mm))
goto err_mmap_read_lock_failed;
- vma = binder_alloc_get_vma(alloc);
+ vma = vma_lookup(mm, page_addr);
+ if (vma && vma != binder_alloc_get_vma(alloc))
+ goto err_invalid_vma;
list_lru_isolate(lru, item);
spin_unlock(lock);
@@ -1031,6 +1033,8 @@ enum lru_status binder_alloc_free_page(s
mutex_unlock(&alloc->mutex);
return LRU_REMOVED_RETRY;
+err_invalid_vma:
+ mmap_read_unlock(mm);
err_mmap_read_lock_failed:
mmput_async(mm);
err_mmget:
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 057/374] binder: fix trivial typo of binder_free_buf_locked()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 056/374] binder: fix use-after-free in shinkers callback Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 058/374] binder: fix comment on binder_alloc_new_buf() return value Greg Kroah-Hartman
` (317 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Carlos Llamas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 122a3c1cb0ff304c2b8934584fcfea4edb2fe5e3 upstream.
Fix minor misspelling of the function in the comment section.
No functional changes in this patch.
Cc: stable@vger.kernel.org
Fixes: 0f966cba95c7 ("binder: add flag to clear buffer on txn complete")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-7-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -706,7 +706,7 @@ void binder_alloc_free_buf(struct binder
/*
* We could eliminate the call to binder_alloc_clear_buf()
* from binder_alloc_deferred_release() by moving this to
- * binder_alloc_free_buf_locked(). However, that could
+ * binder_free_buf_locked(). However, that could
* increase contention for the alloc mutex if clear_on_free
* is used frequently for large buffers. The mutex is not
* needed for correctness here.
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 058/374] binder: fix comment on binder_alloc_new_buf() return value
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 057/374] binder: fix trivial typo of binder_free_buf_locked() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 059/374] uio: Fix use-after-free in uio_open Greg Kroah-Hartman
` (316 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Carlos Llamas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit e1090371e02b601cbfcea175c2a6cc7c955fa830 upstream.
Update the comments of binder_alloc_new_buf() to reflect that the return
value of the function is now ERR_PTR(-errno) on failure.
No functional changes in this patch.
Cc: stable@vger.kernel.org
Fixes: 57ada2fb2250 ("binder: add log information for binder transaction failures")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-8-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -557,7 +557,7 @@ err_alloc_buf_struct_failed:
* is the sum of the three given sizes (each rounded up to
* pointer-sized boundary)
*
- * Return: The allocated buffer or %NULL if error
+ * Return: The allocated buffer or %ERR_PTR(-errno) if error
*/
struct binder_buffer *binder_alloc_new_buf(struct binder_alloc *alloc,
size_t data_size,
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 059/374] uio: Fix use-after-free in uio_open
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 058/374] binder: fix comment on binder_alloc_new_buf() return value Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 060/374] parport: parport_serial: Add Brainboxes BAR details Greg Kroah-Hartman
` (315 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, stable, Guanghui Feng, Baolin Wang
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guanghui Feng <guanghuifeng@linux.alibaba.com>
commit 0c9ae0b8605078eafc3bea053cc78791e97ba2e2 upstream.
core-1 core-2
-------------------------------------------------------
uio_unregister_device uio_open
idev = idr_find()
device_unregister(&idev->dev)
put_device(&idev->dev)
uio_device_release
get_device(&idev->dev)
kfree(idev)
uio_free_minor(minor)
uio_release
put_device(&idev->dev)
kfree(idev)
-------------------------------------------------------
In the core-1 uio_unregister_device(), the device_unregister will kfree
idev when the idev->dev kobject ref is 1. But after core-1
device_unregister, put_device and before doing kfree, the core-2 may
get_device. Then:
1. After core-1 kfree idev, the core-2 will do use-after-free for idev.
2. When core-2 do uio_release and put_device, the idev will be double
freed.
To address this issue, we can get idev atomic & inc idev reference with
minor_lock.
Fixes: 57c5f4df0a5a ("uio: fix crash after the device is unregistered")
Cc: stable <stable@kernel.org>
Signed-off-by: Guanghui Feng <guanghuifeng@linux.alibaba.com>
Reviewed-by: Baolin Wang <baolin.wang@linux.alibaba.com>
Link: https://lore.kernel.org/r/1703152663-59949-1-git-send-email-guanghuifeng@linux.alibaba.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/uio/uio.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/drivers/uio/uio.c
+++ b/drivers/uio/uio.c
@@ -464,13 +464,13 @@ static int uio_open(struct inode *inode,
mutex_lock(&minor_lock);
idev = idr_find(&uio_idr, iminor(inode));
- mutex_unlock(&minor_lock);
if (!idev) {
ret = -ENODEV;
+ mutex_unlock(&minor_lock);
goto out;
}
-
get_device(&idev->dev);
+ mutex_unlock(&minor_lock);
if (!try_module_get(idev->owner)) {
ret = -ENODEV;
@@ -1062,9 +1062,8 @@ void uio_unregister_device(struct uio_in
wake_up_interruptible(&idev->wait);
kill_fasync(&idev->async_queue, SIGIO, POLL_HUP);
- device_unregister(&idev->dev);
-
uio_free_minor(minor);
+ device_unregister(&idev->dev);
return;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 060/374] parport: parport_serial: Add Brainboxes BAR details
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 059/374] uio: Fix use-after-free in uio_open Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 061/374] parport: parport_serial: Add Brainboxes device IDs and geometry Greg Kroah-Hartman
` (314 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cameron Williams, Sudip Mukherjee
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <cang1@live.co.uk>
commit 65fde134b0a4ffe838729f9ee11b459a2f6f2815 upstream.
Add BAR/enum entries for Brainboxes serial/parallel cards.
Cc: <stable@vger.kernel.org>
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Link: https://lore.kernel.org/r/AS4PR02MB79035155C2D5C3333AE6FA52C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/parport/parport_serial.c | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -65,6 +65,10 @@ enum parport_pc_pci_cards {
sunix_5069a,
sunix_5079a,
sunix_5099a,
+ brainboxes_uc257,
+ brainboxes_is300,
+ brainboxes_uc414,
+ brainboxes_px263,
};
/* each element directly indexed from enum list, above */
@@ -158,6 +162,10 @@ static struct parport_pc_pci cards[] = {
/* sunix_5069a */ { 1, { { 1, 2 }, } },
/* sunix_5079a */ { 1, { { 1, 2 }, } },
/* sunix_5099a */ { 1, { { 1, 2 }, } },
+ /* brainboxes_uc257 */ { 1, { { 3, -1 }, } },
+ /* brainboxes_is300 */ { 1, { { 3, -1 }, } },
+ /* brainboxes_uc414 */ { 1, { { 3, -1 }, } },
+ /* brainboxes_px263 */ { 1, { { 3, -1 }, } },
};
static struct pci_device_id parport_serial_pci_tbl[] = {
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 061/374] parport: parport_serial: Add Brainboxes device IDs and geometry
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 060/374] parport: parport_serial: Add Brainboxes BAR details Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 062/374] leds: ledtrig-tty: Free allocated ttyname buffer on deactivate Greg Kroah-Hartman
` (313 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Cameron Williams, Sudip Mukherjee
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Williams <cang1@live.co.uk>
commit 6aa1fc5a8085bbc01687aa708dcf2dbe637a5ee3 upstream.
Add device IDs for the Brainboxes UC-203, UC-257, UC-414, UC-475,
IS-300/IS-500 and PX-263/PX-295 and define the relevant "geometry"
for the cards.
This patch requires part 1 of this series.
Cc: <stable@vger.kernel.org>
Signed-off-by: Cameron Williams <cang1@live.co.uk>
Acked-by: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Link: https://lore.kernel.org/r/AS4PR02MB7903A4094564BE28F1F926A6C4A6A@AS4PR02MB7903.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/parport/parport_serial.c | 56 +++++++++++++++++++++++++++++++++++++++
1 file changed, 56 insertions(+)
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -285,6 +285,38 @@ static struct pci_device_id parport_seri
{ PCI_VENDOR_ID_SUNIX, PCI_DEVICE_ID_SUNIX_1999, PCI_VENDOR_ID_SUNIX,
0x0104, 0, 0, sunix_5099a },
+ /* Brainboxes UC-203 */
+ { PCI_VENDOR_ID_INTASHIELD, 0x0bc1,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+ { PCI_VENDOR_ID_INTASHIELD, 0x0bc2,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+
+ /* Brainboxes UC-257 */
+ { PCI_VENDOR_ID_INTASHIELD, 0x0861,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+ { PCI_VENDOR_ID_INTASHIELD, 0x0862,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+ { PCI_VENDOR_ID_INTASHIELD, 0x0863,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+
+ /* Brainboxes UC-414 */
+ { PCI_VENDOR_ID_INTASHIELD, 0x0e61,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc414 },
+
+ /* Brainboxes UC-475 */
+ { PCI_VENDOR_ID_INTASHIELD, 0x0981,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+ { PCI_VENDOR_ID_INTASHIELD, 0x0982,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_uc257 },
+
+ /* Brainboxes IS-300/IS-500 */
+ { PCI_VENDOR_ID_INTASHIELD, 0x0da0,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_is300 },
+
+ /* Brainboxes PX-263/PX-295 */
+ { PCI_VENDOR_ID_INTASHIELD, 0x402c,
+ PCI_ANY_ID, PCI_ANY_ID, 0, 0, brainboxes_px263 },
+
{ 0, } /* terminate list */
};
MODULE_DEVICE_TABLE(pci,parport_serial_pci_tbl);
@@ -550,6 +582,30 @@ static struct pciserial_board pci_parpor
.base_baud = 921600,
.uart_offset = 0x8,
},
+ [brainboxes_uc257] = {
+ .flags = FL_BASE2,
+ .num_ports = 2,
+ .base_baud = 115200,
+ .uart_offset = 8,
+ },
+ [brainboxes_is300] = {
+ .flags = FL_BASE2,
+ .num_ports = 1,
+ .base_baud = 115200,
+ .uart_offset = 8,
+ },
+ [brainboxes_uc414] = {
+ .flags = FL_BASE2,
+ .num_ports = 4,
+ .base_baud = 115200,
+ .uart_offset = 8,
+ },
+ [brainboxes_px263] = {
+ .flags = FL_BASE2,
+ .num_ports = 4,
+ .base_baud = 921600,
+ .uart_offset = 8,
+ },
};
struct parport_serial_private {
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 062/374] leds: ledtrig-tty: Free allocated ttyname buffer on deactivate
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 061/374] parport: parport_serial: Add Brainboxes device IDs and geometry Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 063/374] PCI: Add ACS quirk for more Zhaoxin Root Ports Greg Kroah-Hartman
` (312 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Eckert,
Uwe Kleine-König, Lee Jones
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Eckert <fe@dev.tdt.de>
commit 25054b232681c286fca9c678854f56494d1352cc upstream.
The ttyname buffer for the ledtrig_tty_data struct is allocated in the
sysfs ttyname_store() function. This buffer must be released on trigger
deactivation. This was missing and is thus a memory leak.
While we are at it, the TTY handler in the ledtrig_tty_data struct should
also be returned in case of the trigger deactivation call.
Cc: stable@vger.kernel.org
Fixes: fd4a641ac88f ("leds: trigger: implement a tty trigger")
Signed-off-by: Florian Eckert <fe@dev.tdt.de>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Link: https://lore.kernel.org/r/20231127081621.774866-1-fe@dev.tdt.de
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/trigger/ledtrig-tty.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/leds/trigger/ledtrig-tty.c
+++ b/drivers/leds/trigger/ledtrig-tty.c
@@ -168,6 +168,10 @@ static void ledtrig_tty_deactivate(struc
cancel_delayed_work_sync(&trigger_data->dwork);
+ kfree(trigger_data->ttyname);
+ tty_kref_put(trigger_data->tty);
+ trigger_data->tty = NULL;
+
kfree(trigger_data);
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 063/374] PCI: Add ACS quirk for more Zhaoxin Root Ports
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 062/374] leds: ledtrig-tty: Free allocated ttyname buffer on deactivate Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 064/374] coresight: etm4x: Fix width of CCITMIN field Greg Kroah-Hartman
` (311 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, LeoLiuoc, Bjorn Helgaas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: LeoLiuoc <LeoLiu-oc@zhaoxin.com>
commit e367e3c765f5477b2e79da0f1399aed49e2d1e37 upstream.
Add more Root Port Device IDs to pci_quirk_zhaoxin_pcie_ports_acs() for
some new Zhaoxin platforms.
Fixes: 299bd044a6f3 ("PCI: Add ACS quirk for Zhaoxin Root/Downstream Ports")
Link: https://lore.kernel.org/r/20231211091543.735903-1-LeoLiu-oc@zhaoxin.com
Signed-off-by: LeoLiuoc <LeoLiu-oc@zhaoxin.com>
[bhelgaas: update subject, drop changelog, add Fixes, add stable tag, fix
whitespace, wrap code comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: <stable@vger.kernel.org> # 5.7
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/quirks.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/drivers/pci/quirks.c
+++ b/drivers/pci/quirks.c
@@ -4577,17 +4577,21 @@ static int pci_quirk_xgene_acs(struct pc
* But the implementation could block peer-to-peer transactions between them
* and provide ACS-like functionality.
*/
-static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags)
+static int pci_quirk_zhaoxin_pcie_ports_acs(struct pci_dev *dev, u16 acs_flags)
{
if (!pci_is_pcie(dev) ||
((pci_pcie_type(dev) != PCI_EXP_TYPE_ROOT_PORT) &&
(pci_pcie_type(dev) != PCI_EXP_TYPE_DOWNSTREAM)))
return -ENOTTY;
+ /*
+ * Future Zhaoxin Root Ports and Switch Downstream Ports will
+ * implement ACS capability in accordance with the PCIe Spec.
+ */
switch (dev->device) {
case 0x0710 ... 0x071e:
case 0x0721:
- case 0x0723 ... 0x0732:
+ case 0x0723 ... 0x0752:
return pci_acs_ctrl_enabled(acs_flags,
PCI_ACS_SV | PCI_ACS_RR | PCI_ACS_CR | PCI_ACS_UF);
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 064/374] coresight: etm4x: Fix width of CCITMIN field
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 063/374] PCI: Add ACS quirk for more Zhaoxin Root Ports Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 065/374] x86/lib: Fix overflow when counting digits Greg Kroah-Hartman
` (310 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, kernel test robot, Mike Leach,
James Clark, Suzuki K Poulose
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Clark <james.clark@arm.com>
commit cc0271a339cc70cae914c3ec20edc2a8058407da upstream.
CCITMIN is a 12 bit field and doesn't fit in a u8, so extend it to u16.
This probably wasn't an issue previously because values higher than 255
never occurred.
But since commit 4aff040bcc8d ("coresight: etm: Override TRCIDR3.CCITMIN
on errata affected cpus"), a comparison with 256 was done to enable the
errata, generating the following W=1 build error:
coresight-etm4x-core.c:1188:24: error: result of comparison of
constant 256 with expression of type 'u8' (aka 'unsigned char') is
always false [-Werror,-Wtautological-constant-out-of-range-compare]
if (drvdata->ccitmin == 256)
Cc: stable@vger.kernel.org
Fixes: 2e1cdfe184b5 ("coresight-etm4x: Adding CoreSight ETM4x driver")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202310302043.as36UFED-lkp@intel.com/
Reviewed-by: Mike Leach <mike.leach@linaro.org>
Signed-off-by: James Clark <james.clark@arm.com>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Link: https://lore.kernel.org/r/20231101115206.70810-1-james.clark@arm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-etm4x.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/hwtracing/coresight/coresight-etm4x.h
+++ b/drivers/hwtracing/coresight/coresight-etm4x.h
@@ -944,7 +944,7 @@ struct etmv4_drvdata {
u8 ctxid_size;
u8 vmid_size;
u8 ccsize;
- u8 ccitmin;
+ u16 ccitmin;
u8 s_ex_level;
u8 ns_ex_level;
u8 q_support;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 065/374] x86/lib: Fix overflow when counting digits
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 064/374] coresight: etm4x: Fix width of CCITMIN field Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 066/374] EDAC/thunderx: Fix possible out-of-bounds string access Greg Kroah-Hartman
` (309 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Colin Ian King, Dave Hansen,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.i.king@gmail.com>
[ Upstream commit a24d61c609813963aacc9f6ec8343f4fcaac7243 ]
tl;dr: The num_digits() function has a theoretical overflow issue.
But it doesn't affect any actual in-tree users. Fix it by using
a larger type for one of the local variables.
Long version:
There is an overflow in variable m in function num_digits when val
is >= 1410065408 which leads to the digit calculation loop to
iterate more times than required. This results in either more
digits being counted or in some cases (for example where val is
1932683193) the value of m eventually overflows to zero and the
while loop spins forever).
Currently the function num_digits is currently only being used for
small values of val in the SMP boot stage for digit counting on the
number of cpus and NUMA nodes, so the overflow is never encountered.
However it is useful to fix the overflow issue in case the function
is used for other purposes in the future. (The issue was discovered
while investigating the digit counting performance in various
kernel helper functions rather than any real-world use-case).
The simplest fix is to make m a long long, the overhead in
multiplication speed for a long long is very minor for small values
of val less than 10000 on modern processors. The alternative
fix is to replace the multiplication with a constant division
by 10 loop (this compiles down to an multiplication and shift)
without needing to make m a long long, but this is slightly slower
than the fix in this commit when measured on a range of x86
processors).
[ dhansen: subject and changelog tweaks ]
Fixes: 646e29a1789a ("x86: Improve the printout of the SMP bootup CPU table")
Signed-off-by: Colin Ian King <colin.i.king@gmail.com>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Link: https://lore.kernel.org/all/20231102174901.2590325-1-colin.i.king%40gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/x86/lib/misc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/x86/lib/misc.c b/arch/x86/lib/misc.c
index a018ec4fba53..c97be9a1430a 100644
--- a/arch/x86/lib/misc.c
+++ b/arch/x86/lib/misc.c
@@ -6,7 +6,7 @@
*/
int num_digits(int val)
{
- int m = 10;
+ long long m = 10;
int d = 1;
if (val < 0) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 066/374] EDAC/thunderx: Fix possible out-of-bounds string access
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 065/374] x86/lib: Fix overflow when counting digits Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 067/374] powerpc: Mark .opd section read-only Greg Kroah-Hartman
` (308 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Borislav Petkov (AMD),
Gustavo A. R. Silva, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 475c58e1a471e9b873e3e39958c64a2d278275c8 ]
Enabling -Wstringop-overflow globally exposes a warning for a common bug
in the usage of strncat():
drivers/edac/thunderx_edac.c: In function 'thunderx_ocx_com_threaded_isr':
drivers/edac/thunderx_edac.c:1136:17: error: 'strncat' specified bound 1024 equals destination size [-Werror=stringop-overflow=]
1136 | strncat(msg, other, OCX_MESSAGE_SIZE);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
...
1145 | strncat(msg, other, OCX_MESSAGE_SIZE);
...
1150 | strncat(msg, other, OCX_MESSAGE_SIZE);
...
Apparently the author of this driver expected strncat() to behave the
way that strlcat() does, which uses the size of the destination buffer
as its third argument rather than the length of the source buffer. The
result is that there is no check on the size of the allocated buffer.
Change it to strlcat().
[ bp: Trim compiler output, fixup commit message. ]
Fixes: 41003396f932 ("EDAC, thunderx: Add Cavium ThunderX EDAC driver")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Link: https://lore.kernel.org/r/20231122222007.3199885-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/thunderx_edac.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/edac/thunderx_edac.c b/drivers/edac/thunderx_edac.c
index f13674081cb6..4dca21b39bf7 100644
--- a/drivers/edac/thunderx_edac.c
+++ b/drivers/edac/thunderx_edac.c
@@ -1133,7 +1133,7 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
decode_register(other, OCX_OTHER_SIZE,
ocx_com_errors, ctx->reg_com_int);
- strncat(msg, other, OCX_MESSAGE_SIZE);
+ strlcat(msg, other, OCX_MESSAGE_SIZE);
for (lane = 0; lane < OCX_RX_LANES; lane++)
if (ctx->reg_com_int & BIT(lane)) {
@@ -1142,12 +1142,12 @@ static irqreturn_t thunderx_ocx_com_threaded_isr(int irq, void *irq_id)
lane, ctx->reg_lane_int[lane],
lane, ctx->reg_lane_stat11[lane]);
- strncat(msg, other, OCX_MESSAGE_SIZE);
+ strlcat(msg, other, OCX_MESSAGE_SIZE);
decode_register(other, OCX_OTHER_SIZE,
ocx_lane_errors,
ctx->reg_lane_int[lane]);
- strncat(msg, other, OCX_MESSAGE_SIZE);
+ strlcat(msg, other, OCX_MESSAGE_SIZE);
}
if (ctx->reg_com_int & OCX_COM_INT_CE)
@@ -1217,7 +1217,7 @@ static irqreturn_t thunderx_ocx_lnk_threaded_isr(int irq, void *irq_id)
decode_register(other, OCX_OTHER_SIZE,
ocx_com_link_errors, ctx->reg_com_link_int);
- strncat(msg, other, OCX_MESSAGE_SIZE);
+ strlcat(msg, other, OCX_MESSAGE_SIZE);
if (ctx->reg_com_link_int & OCX_COM_LINK_INT_UE)
edac_device_handle_ue(ocx->edac_dev, 0, 0, msg);
@@ -1896,7 +1896,7 @@ static irqreturn_t thunderx_l2c_threaded_isr(int irq, void *irq_id)
decode_register(other, L2C_OTHER_SIZE, l2_errors, ctx->reg_int);
- strncat(msg, other, L2C_MESSAGE_SIZE);
+ strlcat(msg, other, L2C_MESSAGE_SIZE);
if (ctx->reg_int & mask_ue)
edac_device_handle_ue(l2c->edac_dev, 0, 0, msg);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 067/374] powerpc: Mark .opd section read-only
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 066/374] EDAC/thunderx: Fix possible out-of-bounds string access Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 068/374] powerpc/toc: Future proof kernel toc Greg Kroah-Hartman
` (307 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe Leroy, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
[ Upstream commit 3091f5fc5f1df7741ddf326561384e0997eca2a1 ]
.opd section contains function descriptors used to locate
functions in the kernel. If someone is able to modify a
function descriptor he will be able to run arbitrary
kernel function instead of another.
To avoid that, move .opd section inside read-only memory.
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/3cd40b682fb6f75bb40947b55ca0bac20cb3f995.1634136222.git.christophe.leroy@csgroup.eu
Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/kernel/vmlinux.lds.S | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index d4531902d8c6..d8301ce7c675 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -148,6 +148,12 @@ SECTIONS
SOFT_MASK_TABLE(8)
RESTART_TABLE(8)
+ .opd : AT(ADDR(.opd) - LOAD_OFFSET) {
+ __start_opd = .;
+ KEEP(*(.opd))
+ __end_opd = .;
+ }
+
. = ALIGN(8);
__stf_entry_barrier_fixup : AT(ADDR(__stf_entry_barrier_fixup) - LOAD_OFFSET) {
__start___stf_entry_barrier_fixup = .;
@@ -346,12 +352,6 @@ SECTIONS
*(.branch_lt)
}
- .opd : AT(ADDR(.opd) - LOAD_OFFSET) {
- __start_opd = .;
- KEEP(*(.opd))
- __end_opd = .;
- }
-
. = ALIGN(256);
.got : AT(ADDR(.got) - LOAD_OFFSET) {
__toc_start = .;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 068/374] powerpc/toc: Future proof kernel toc
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 067/374] powerpc: Mark .opd section read-only Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 069/374] powerpc: remove checks for binutils older than 2.25 Greg Kroah-Hartman
` (306 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Modra, Alexey Kardashevskiy,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Modra <amodra@au1.ibm.com>
[ Upstream commit a3ad84da076009c94969fa97f604257667e2980f ]
This patch future-proofs the kernel against linker changes that might
put the toc pointer at some location other than .got+0x8000, by
replacing __toc_start+0x8000 with .TOC. throughout. If the kernel's
idea of the toc pointer doesn't agree with the linker, bad things
happen.
prom_init.c code relocating its toc is also changed so that a symbolic
__prom_init_toc_start toc-pointer relative address is calculated
rather than assuming that it is always at toc-pointer - 0x8000. The
length calculations loading values from the toc are also avoided.
It's a little incestuous to do that with unreloc_toc picking up
adjusted values (which is fine in practice, they both adjust by the
same amount if all goes well).
I've also changed the way .got is aligned in vmlinux.lds and
zImage.lds, mostly so that dumping out section info by objdump or
readelf plainly shows the alignment is 256. This linker script
feature was added 2005-09-27, available in FSF binutils releases from
2.17 onwards. Should be safe to use in the kernel, I think.
Finally, put *(.got) before the prom_init.o entry which only needs
*(.toc), so that the GOT header goes in the correct place. I don't
believe this makes any difference for the kernel as it would for
dynamic objects being loaded by ld.so. That change is just to stop
lusers who blindly copy kernel scripts being led astray. Of course,
this change needs the prom_init.c changes.
Some notes on .toc and .got.
.toc is a compiler generated section of addresses. .got is a linker
generated section of addresses, generally built when the linker sees
R_*_*GOT* relocations. In the case of powerpc64 ld.bfd, there are
multiple generated .got sections, one per input object file. So you
can somewhat reasonably write in a linker script an input section
statement like *prom_init.o(.got .toc) to mean "the .got and .toc
section for files matching *prom_init.o". On other architectures that
doesn't make sense, because the linker generally has just one .got
section. Even on powerpc64, note well that the GOT entries for
prom_init.o may be merged with GOT entries from other objects. That
means that if prom_init.o references, say, _end via some GOT
relocation, and some other object also references _end via a GOT
relocation, the GOT entry for _end may be in the range
__prom_init_toc_start to __prom_init_toc_end and if the kernel does
something special to GOT/TOC entries in that range then the value of
_end as seen by objects other than prom_init.o will be affected. On
the other hand the GOT entry for _end may not be in the range
__prom_init_toc_start to __prom_init_toc_end. Which way it turns out
is deterministic but a detail of linker operation that should not be
relied on.
A feature of ld.bfd is that input .toc (and .got) sections matching
one linker input section statement may be sorted, to put entries used
by small-model code first, near the toc base. This is why scripts for
powerpc64 normally use *(.got .toc) rather than *(.got) *(.toc), since
the first form allows more freedom to sort.
Another feature of ld.bfd is that indirect addressing sequences using
the GOT/TOC may be edited by the linker to relative addressing. In
many cases relative addressing would be emitted by gcc for
-mcmodel=medium if you appropriately decorate variable declarations
with non-default visibility.
The original patch is here:
https://lore.kernel.org/linuxppc-dev/20210310034813.GM6042@bubble.grove.modra.org/
Signed-off-by: Alan Modra <amodra@au1.ibm.com>
[aik: removed non-relocatable which is gone in 24d33ac5b8ffb]
[aik: added <=2.24 check]
[aik: because of llvm-as, kernel_toc_addr() uses "mr" instead of global register variable]
Signed-off-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20211221055904.555763-2-aik@ozlabs.ru
Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Makefile | 5 +++--
arch/powerpc/boot/crt0.S | 2 +-
arch/powerpc/boot/zImage.lds.S | 7 ++-----
arch/powerpc/include/asm/sections.h | 16 ++++++++--------
arch/powerpc/kernel/head_64.S | 2 +-
arch/powerpc/kernel/vmlinux.lds.S | 8 +++-----
6 files changed, 18 insertions(+), 22 deletions(-)
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 3dc75040a756..41604a37b385 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -437,10 +437,11 @@ PHONY += checkbin
# Check toolchain versions:
# - gcc-4.6 is the minimum kernel-wide version so nothing required.
checkbin:
- @if test "x${CONFIG_CPU_LITTLE_ENDIAN}" = "xy" \
- && $(LD) --version | head -1 | grep ' 2\.24$$' >/dev/null ; then \
+ @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \
+ "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \
echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \
echo 'in some circumstances.' ; \
+ echo '*** binutils 2.23 do not define the TOC symbol ' ; \
echo -n '*** Please use a different binutils version.' ; \
false ; \
fi
diff --git a/arch/powerpc/boot/crt0.S b/arch/powerpc/boot/crt0.S
index e8f10a599659..feadee18e271 100644
--- a/arch/powerpc/boot/crt0.S
+++ b/arch/powerpc/boot/crt0.S
@@ -28,7 +28,7 @@ p_etext: .8byte _etext
p_bss_start: .8byte __bss_start
p_end: .8byte _end
-p_toc: .8byte __toc_start + 0x8000 - p_base
+p_toc: .8byte .TOC. - p_base
p_dyn: .8byte __dynamic_start - p_base
p_rela: .8byte __rela_dyn_start - p_base
p_prom: .8byte 0
diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S
index d6f072865627..d65cd55a6f38 100644
--- a/arch/powerpc/boot/zImage.lds.S
+++ b/arch/powerpc/boot/zImage.lds.S
@@ -36,12 +36,9 @@ SECTIONS
}
#ifdef CONFIG_PPC64_BOOT_WRAPPER
- . = ALIGN(256);
- .got :
+ .got : ALIGN(256)
{
- __toc_start = .;
- *(.got)
- *(.toc)
+ *(.got .toc)
}
#endif
diff --git a/arch/powerpc/include/asm/sections.h b/arch/powerpc/include/asm/sections.h
index e92d39c0cd1d..34d82ae1774c 100644
--- a/arch/powerpc/include/asm/sections.h
+++ b/arch/powerpc/include/asm/sections.h
@@ -26,16 +26,16 @@ extern char start_virt_trampolines[];
extern char end_virt_trampolines[];
#endif
+/*
+ * This assumes the kernel is never compiled -mcmodel=small or
+ * the total .toc is always less than 64k.
+ */
static inline unsigned long kernel_toc_addr(void)
{
- /* Defined by the linker, see vmlinux.lds.S */
- extern unsigned long __toc_start;
-
- /*
- * The TOC register (r2) points 32kB into the TOC, so that 64kB of
- * the TOC can be addressed using a single machine instruction.
- */
- return (unsigned long)(&__toc_start) + 0x8000UL;
+ unsigned long toc_ptr;
+
+ asm volatile("mr %0, 2" : "=r" (toc_ptr));
+ return toc_ptr;
}
static inline int overlaps_interrupt_vector_text(unsigned long start,
diff --git a/arch/powerpc/kernel/head_64.S b/arch/powerpc/kernel/head_64.S
index f17ae2083733..a08c050ff645 100644
--- a/arch/powerpc/kernel/head_64.S
+++ b/arch/powerpc/kernel/head_64.S
@@ -904,7 +904,7 @@ _GLOBAL(relative_toc)
blr
.balign 8
-p_toc: .8byte __toc_start + 0x8000 - 0b
+p_toc: .8byte .TOC. - 0b
/*
* This is where the main kernel code starts.
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index d8301ce7c675..70bf67ed87b5 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -352,15 +352,13 @@ SECTIONS
*(.branch_lt)
}
- . = ALIGN(256);
- .got : AT(ADDR(.got) - LOAD_OFFSET) {
- __toc_start = .;
+ .got : AT(ADDR(.got) - LOAD_OFFSET) ALIGN(256) {
+ *(.got)
#ifndef CONFIG_RELOCATABLE
__prom_init_toc_start = .;
- arch/powerpc/kernel/prom_init.o*(.toc .got)
+ arch/powerpc/kernel/prom_init.o*(.toc)
__prom_init_toc_end = .;
#endif
- *(.got)
*(.toc)
}
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 069/374] powerpc: remove checks for binutils older than 2.25
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 068/374] powerpc/toc: Future proof kernel toc Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 070/374] powerpc: add crtsavres.o to always-y instead of extra-y Greg Kroah-Hartman
` (305 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Nicholas Piggin,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit 54a11654de163994e32b24e3aa90ef81f4a3184d ]
Commit e4412739472b ("Documentation: raise minimum supported version of
binutils to 2.25") allows us to remove the checks for old binutils.
There is no more user for ld-ifversion. Remove it as well.
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20230119082250.151485-1-masahiroy@kernel.org
Stable-dep-of: 1b1e38002648 ("powerpc: add crtsavres.o to always-y instead of extra-y")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/Makefile | 17 +----------------
arch/powerpc/lib/Makefile | 2 +-
scripts/Makefile.compiler | 4 ----
3 files changed, 2 insertions(+), 21 deletions(-)
diff --git a/arch/powerpc/Makefile b/arch/powerpc/Makefile
index 41604a37b385..11a0ccb47be3 100644
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -44,18 +44,13 @@ machine-$(CONFIG_PPC64) += 64
machine-$(CONFIG_CPU_LITTLE_ENDIAN) += le
UTS_MACHINE := $(subst $(space),,$(machine-y))
-# XXX This needs to be before we override LD below
-ifdef CONFIG_PPC32
-KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
-else
-ifeq ($(call ld-ifversion, -ge, 22500, y),y)
+ifeq ($(CONFIG_PPC64)$(CONFIG_LD_IS_BFD),yy)
# Have the linker provide sfpr if possible.
# There is a corresponding test in arch/powerpc/lib/Makefile
KBUILD_LDFLAGS_MODULE += --save-restore-funcs
else
KBUILD_LDFLAGS_MODULE += arch/powerpc/lib/crtsavres.o
endif
-endif
ifdef CONFIG_CPU_LITTLE_ENDIAN
KBUILD_CFLAGS += -mlittle-endian
@@ -434,17 +429,7 @@ endif # CONFIG_PPC32
endif # CONFIG_SMP
PHONY += checkbin
-# Check toolchain versions:
-# - gcc-4.6 is the minimum kernel-wide version so nothing required.
checkbin:
- @if test "x${CONFIG_LD_IS_LLD}" != "xy" -a \
- "x$(call ld-ifversion, -le, 22400, y)" = "xy" ; then \
- echo -n '*** binutils 2.24 miscompiles weak symbols ' ; \
- echo 'in some circumstances.' ; \
- echo '*** binutils 2.23 do not define the TOC symbol ' ; \
- echo -n '*** Please use a different binutils version.' ; \
- false ; \
- fi
@if test "x${CONFIG_FTRACE_MCOUNT_USE_RECORDMCOUNT}" = "xy" -a \
"x${CONFIG_LD_IS_BFD}" = "xy" -a \
"${CONFIG_LD_VERSION}" = "23700" ; then \
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index 54be64203b2a..cb8a66743a02 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -37,7 +37,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o
# 64-bit linker creates .sfpr on demand for final link (vmlinux),
# so it is only needed for modules, and only for older linkers which
# do not support --save-restore-funcs
-ifeq ($(call ld-ifversion, -lt, 22500, y),y)
+ifndef CONFIG_LD_IS_BFD
extra-$(CONFIG_PPC64) += crtsavres.o
endif
diff --git a/scripts/Makefile.compiler b/scripts/Makefile.compiler
index 86ecd2ac874c..60ddd47bfa1b 100644
--- a/scripts/Makefile.compiler
+++ b/scripts/Makefile.compiler
@@ -68,7 +68,3 @@ cc-ifversion = $(shell [ $(CONFIG_GCC_VERSION)0 $(1) $(2)000 ] && echo $(3) || e
# ld-option
# Usage: KBUILD_LDFLAGS += $(call ld-option, -X, -Y)
ld-option = $(call try-run, $(LD) $(KBUILD_LDFLAGS) $(1) -v,$(1),$(2),$(3))
-
-# ld-ifversion
-# Usage: $(call ld-ifversion, -ge, 22252, y)
-ld-ifversion = $(shell [ $(CONFIG_LD_VERSION)0 $(1) $(2)0 ] && echo $(3) || echo $(4))
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 070/374] powerpc: add crtsavres.o to always-y instead of extra-y
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 069/374] powerpc: remove checks for binutils older than 2.25 Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 071/374] powerpc/44x: select I2C for CURRITUCK Greg Kroah-Hartman
` (304 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masahiro Yamada, Nicholas Piggin,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masahiro Yamada <masahiroy@kernel.org>
[ Upstream commit 1b1e38002648819c04773647d5242990e2824264 ]
crtsavres.o is linked to modules. However, as explained in commit
d0e628cd817f ("kbuild: doc: clarify the difference between extra-y
and always-y"), 'make modules' does not build extra-y.
For example, the following command fails:
$ make ARCH=powerpc LLVM=1 KBUILD_MODPOST_WARN=1 mrproper ps3_defconfig modules
[snip]
LD [M] arch/powerpc/platforms/cell/spufs/spufs.ko
ld.lld: error: cannot open arch/powerpc/lib/crtsavres.o: No such file or directory
make[3]: *** [scripts/Makefile.modfinal:56: arch/powerpc/platforms/cell/spufs/spufs.ko] Error 1
make[2]: *** [Makefile:1844: modules] Error 2
make[1]: *** [/home/masahiro/workspace/linux-kbuild/Makefile:350: __build_one_by_one] Error 2
make: *** [Makefile:234: __sub-make] Error 2
Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
Fixes: baa25b571a16 ("powerpc/64: Do not link crtsavres.o in vmlinux")
Reviewed-by: Nicholas Piggin <npiggin@gmail.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231120232332.4100288-1-masahiroy@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/lib/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/lib/Makefile b/arch/powerpc/lib/Makefile
index cb8a66743a02..6448de85f738 100644
--- a/arch/powerpc/lib/Makefile
+++ b/arch/powerpc/lib/Makefile
@@ -38,7 +38,7 @@ obj-$(CONFIG_FUNCTION_ERROR_INJECTION) += error-inject.o
# so it is only needed for modules, and only for older linkers which
# do not support --save-restore-funcs
ifndef CONFIG_LD_IS_BFD
-extra-$(CONFIG_PPC64) += crtsavres.o
+always-$(CONFIG_PPC64) += crtsavres.o
endif
obj-$(CONFIG_PPC_BOOK3S_64) += copyuser_power7.o copypage_power7.o \
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 071/374] powerpc/44x: select I2C for CURRITUCK
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 070/374] powerpc: add crtsavres.o to always-y instead of extra-y Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 072/374] powerpc/pseries/memhp: Fix access beyond end of drmem array Greg Kroah-Hartman
` (303 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, kernel test robot,
Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit 4a74197b65e69c46fe6e53f7df2f4d6ce9ffe012 ]
Fix build errors when CURRITUCK=y and I2C is not builtin (=m or is
not set). Fixes these build errors:
powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `avr_halt_system':
ppc476.c:(.text+0x58): undefined reference to `i2c_smbus_write_byte_data'
powerpc-linux-ld: arch/powerpc/platforms/44x/ppc476.o: in function `ppc47x_device_probe':
ppc476.c:(.init.text+0x18): undefined reference to `i2c_register_driver'
Fixes: 2a2c74b2efcb ("IBM Akebono: Add the Akebono platform")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Closes: lore.kernel.org/r/202312010820.cmdwF5X9-lkp@intel.com
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231201055159.8371-1-rdunlap@infradead.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/44x/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/platforms/44x/Kconfig b/arch/powerpc/platforms/44x/Kconfig
index 83975ef50975..66c54cef3cfa 100644
--- a/arch/powerpc/platforms/44x/Kconfig
+++ b/arch/powerpc/platforms/44x/Kconfig
@@ -177,6 +177,7 @@ config ISS4xx
config CURRITUCK
bool "IBM Currituck (476fpe) Support"
depends on PPC_47x
+ select I2C
select SWIOTLB
select 476FPE
select FORCE_PCI
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 072/374] powerpc/pseries/memhp: Fix access beyond end of drmem array
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 071/374] powerpc/44x: select I2C for CURRITUCK Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 073/374] selftests/powerpc: Fix error handling in FPU/VMX preemption tests Greg Kroah-Hartman
` (302 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nathan Lynch, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Lynch <nathanl@linux.ibm.com>
[ Upstream commit bd68ffce69f6cf8ddd3a3c32549d1d2275e49fc5 ]
dlpar_memory_remove_by_index() may access beyond the bounds of the
drmem lmb array when the LMB lookup fails to match an entry with the
given DRC index. When the search fails, the cursor is left pointing to
&drmem_info->lmbs[drmem_info->n_lmbs], which is one element past the
last valid entry in the array. The debug message at the end of the
function then dereferences this pointer:
pr_debug("Failed to hot-remove memory at %llx\n",
lmb->base_addr);
This was found by inspection and confirmed with KASAN:
pseries-hotplug-mem: Attempting to hot-remove LMB, drc index 1234
==================================================================
BUG: KASAN: slab-out-of-bounds in dlpar_memory+0x298/0x1658
Read of size 8 at addr c000000364e97fd0 by task bash/949
dump_stack_lvl+0xa4/0xfc (unreliable)
print_report+0x214/0x63c
kasan_report+0x140/0x2e0
__asan_load8+0xa8/0xe0
dlpar_memory+0x298/0x1658
handle_dlpar_errorlog+0x130/0x1d0
dlpar_store+0x18c/0x3e0
kobj_attr_store+0x68/0xa0
sysfs_kf_write+0xc4/0x110
kernfs_fop_write_iter+0x26c/0x390
vfs_write+0x2d4/0x4e0
ksys_write+0xac/0x1a0
system_call_exception+0x268/0x530
system_call_vectored_common+0x15c/0x2ec
Allocated by task 1:
kasan_save_stack+0x48/0x80
kasan_set_track+0x34/0x50
kasan_save_alloc_info+0x34/0x50
__kasan_kmalloc+0xd0/0x120
__kmalloc+0x8c/0x320
kmalloc_array.constprop.0+0x48/0x5c
drmem_init+0x2a0/0x41c
do_one_initcall+0xe0/0x5c0
kernel_init_freeable+0x4ec/0x5a0
kernel_init+0x30/0x1e0
ret_from_kernel_user_thread+0x14/0x1c
The buggy address belongs to the object at c000000364e80000
which belongs to the cache kmalloc-128k of size 131072
The buggy address is located 0 bytes to the right of
allocated 98256-byte region [c000000364e80000, c000000364e97fd0)
==================================================================
pseries-hotplug-mem: Failed to hot-remove memory at 0
Log failed lookups with a separate message and dereference the
cursor only when it points to a valid entry.
Signed-off-by: Nathan Lynch <nathanl@linux.ibm.com>
Fixes: 51925fb3c5c9 ("powerpc/pseries: Implement memory hotplug remove in the kernel")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231114-pseries-memhp-fixes-v1-1-fb8f2bb7c557@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/hotplug-memory.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index 91cf23495ccb..642951c0d5f5 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -501,14 +501,15 @@ static int dlpar_memory_remove_by_index(u32 drc_index)
}
}
- if (!lmb_found)
+ if (!lmb_found) {
+ pr_debug("Failed to look up LMB for drc index %x\n", drc_index);
rc = -EINVAL;
-
- if (rc)
+ } else if (rc) {
pr_debug("Failed to hot-remove memory at %llx\n",
lmb->base_addr);
- else
+ } else {
pr_debug("Memory at %llx was hot-removed\n", lmb->base_addr);
+ }
return rc;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 073/374] selftests/powerpc: Fix error handling in FPU/VMX preemption tests
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 072/374] powerpc/pseries/memhp: Fix access beyond end of drmem array Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 074/374] powerpc/powernv: Add a null pointer check to scom_debug_init_one() Greg Kroah-Hartman
` (301 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Ellerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Ellerman <mpe@ellerman.id.au>
[ Upstream commit 9dbd5927408c4a0707de73ae9dd9306b184e8fee ]
The FPU & VMX preemption tests do not check for errors returned by the
low-level asm routines, preempt_fpu() / preempt_vsx() respectively.
That means any register corruption detected by the asm routines does not
result in a test failure.
Fix it by returning the return value of the asm routines from the
pthread child routines.
Fixes: e5ab8be68e44 ("selftests/powerpc: Test preservation of FPU and VMX regs across preemption")
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231128132748.1990179-1-mpe@ellerman.id.au
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/powerpc/math/fpu_preempt.c | 9 +++++----
tools/testing/selftests/powerpc/math/vmx_preempt.c | 10 ++++++----
2 files changed, 11 insertions(+), 8 deletions(-)
diff --git a/tools/testing/selftests/powerpc/math/fpu_preempt.c b/tools/testing/selftests/powerpc/math/fpu_preempt.c
index 5235bdc8c0b1..3e5b5663d244 100644
--- a/tools/testing/selftests/powerpc/math/fpu_preempt.c
+++ b/tools/testing/selftests/powerpc/math/fpu_preempt.c
@@ -37,19 +37,20 @@ __thread double darray[] = {0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0,
int threads_starting;
int running;
-extern void preempt_fpu(double *darray, int *threads_starting, int *running);
+extern int preempt_fpu(double *darray, int *threads_starting, int *running);
void *preempt_fpu_c(void *p)
{
+ long rc;
int i;
+
srand(pthread_self());
for (i = 0; i < 21; i++)
darray[i] = rand();
- /* Test failed if it ever returns */
- preempt_fpu(darray, &threads_starting, &running);
+ rc = preempt_fpu(darray, &threads_starting, &running);
- return p;
+ return (void *)rc;
}
int test_preempt_fpu(void)
diff --git a/tools/testing/selftests/powerpc/math/vmx_preempt.c b/tools/testing/selftests/powerpc/math/vmx_preempt.c
index 6761d6ce30ec..6f7cf400c687 100644
--- a/tools/testing/selftests/powerpc/math/vmx_preempt.c
+++ b/tools/testing/selftests/powerpc/math/vmx_preempt.c
@@ -37,19 +37,21 @@ __thread vector int varray[] = {{1, 2, 3, 4}, {5, 6, 7, 8}, {9, 10,11,12},
int threads_starting;
int running;
-extern void preempt_vmx(vector int *varray, int *threads_starting, int *running);
+extern int preempt_vmx(vector int *varray, int *threads_starting, int *running);
void *preempt_vmx_c(void *p)
{
int i, j;
+ long rc;
+
srand(pthread_self());
for (i = 0; i < 12; i++)
for (j = 0; j < 4; j++)
varray[i][j] = rand();
- /* Test fails if it ever returns */
- preempt_vmx(varray, &threads_starting, &running);
- return p;
+ rc = preempt_vmx(varray, &threads_starting, &running);
+
+ return (void *)rc;
}
int test_preempt_vmx(void)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 074/374] powerpc/powernv: Add a null pointer check to scom_debug_init_one()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 073/374] selftests/powerpc: Fix error handling in FPU/VMX preemption tests Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 075/374] powerpc/powernv: Add a null pointer check in opal_event_init() Greg Kroah-Hartman
` (300 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit 9a260f2dd827bbc82cc60eb4f4d8c22707d80742 ]
kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Add a null pointer check, and release 'ent' to avoid memory leaks.
Fixes: bfd2f0d49aef ("powerpc/powernv: Get rid of old scom_controller abstraction")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231208085937.107210-1-chentao@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/opal-xscom.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/arch/powerpc/platforms/powernv/opal-xscom.c b/arch/powerpc/platforms/powernv/opal-xscom.c
index 6b4eed2ef4fa..f67235d1ba2c 100644
--- a/arch/powerpc/platforms/powernv/opal-xscom.c
+++ b/arch/powerpc/platforms/powernv/opal-xscom.c
@@ -165,6 +165,11 @@ static int scom_debug_init_one(struct dentry *root, struct device_node *dn,
ent->chip = chip;
snprintf(ent->name, 16, "%08x", chip);
ent->path.data = (void *)kasprintf(GFP_KERNEL, "%pOF", dn);
+ if (!ent->path.data) {
+ kfree(ent);
+ return -ENOMEM;
+ }
+
ent->path.size = strlen((char *)ent->path.data);
dir = debugfs_create_dir(ent->name, root);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 075/374] powerpc/powernv: Add a null pointer check in opal_event_init()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 074/374] powerpc/powernv: Add a null pointer check to scom_debug_init_one() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 076/374] powerpc/powernv: Add a null pointer check in opal_powercap_init() Greg Kroah-Hartman
` (299 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit 8649829a1dd25199bbf557b2621cedb4bf9b3050 ]
kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Fixes: 2717a33d6074 ("powerpc/opal-irqchip: Use interrupt names if present")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231127030755.1546750-1-chentao@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/opal-irqchip.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/powerpc/platforms/powernv/opal-irqchip.c b/arch/powerpc/platforms/powernv/opal-irqchip.c
index d55652b5f6fa..391f50535200 100644
--- a/arch/powerpc/platforms/powernv/opal-irqchip.c
+++ b/arch/powerpc/platforms/powernv/opal-irqchip.c
@@ -275,6 +275,8 @@ int __init opal_event_init(void)
else
name = kasprintf(GFP_KERNEL, "opal");
+ if (!name)
+ continue;
/* Install interrupt handler */
rc = request_irq(r->start, opal_interrupt, r->flags & IRQD_TRIGGER_MASK,
name, NULL);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 076/374] powerpc/powernv: Add a null pointer check in opal_powercap_init()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 075/374] powerpc/powernv: Add a null pointer check in opal_event_init() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 077/374] powerpc/imc-pmu: Add a null pointer check in update_events_in_group() Greg Kroah-Hartman
` (298 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit e123015c0ba859cf48aa7f89c5016cc6e98e018d ]
kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Fixes: b9ef7b4b867f ("powerpc: Convert to using %pOFn instead of device_node.name")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231126095739.1501990-1-chentao@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/powernv/opal-powercap.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/powerpc/platforms/powernv/opal-powercap.c b/arch/powerpc/platforms/powernv/opal-powercap.c
index c16d44f6f1d1..ce9ec3962cef 100644
--- a/arch/powerpc/platforms/powernv/opal-powercap.c
+++ b/arch/powerpc/platforms/powernv/opal-powercap.c
@@ -196,6 +196,12 @@ void __init opal_powercap_init(void)
j = 0;
pcaps[i].pg.name = kasprintf(GFP_KERNEL, "%pOFn", node);
+ if (!pcaps[i].pg.name) {
+ kfree(pcaps[i].pattrs);
+ kfree(pcaps[i].pg.attrs);
+ goto out_pcaps_pattrs;
+ }
+
if (has_min) {
powercap_add_attr(min, "powercap-min",
&pcaps[i].pattrs[j]);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 077/374] powerpc/imc-pmu: Add a null pointer check in update_events_in_group()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 076/374] powerpc/powernv: Add a null pointer check in opal_powercap_init() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 078/374] spi: spi-zynqmp-gqspi: fix driver kconfig dependencies Greg Kroah-Hartman
` (297 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Michael Ellerman,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit 0a233867a39078ebb0f575e2948593bbff5826b3 ]
kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Fixes: 885dcd709ba9 ("powerpc/perf: Add nest IMC PMU support")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://msgid.link/20231126093719.1440305-1-chentao@kylinos.cn
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/imc-pmu.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index 55a853edc3be..e2f6fe259aa6 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -292,6 +292,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
attr_group->attrs = attrs;
do {
ev_val_str = kasprintf(GFP_KERNEL, "event=0x%x", pmu->events[i].value);
+ if (!ev_val_str)
+ continue;
dev_str = device_str_attr_create(pmu->events[i].name, ev_val_str);
if (!dev_str)
continue;
@@ -299,6 +301,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
attrs[j++] = dev_str;
if (pmu->events[i].scale) {
ev_scale_str = kasprintf(GFP_KERNEL, "%s.scale", pmu->events[i].name);
+ if (!ev_scale_str)
+ continue;
dev_str = device_str_attr_create(ev_scale_str, pmu->events[i].scale);
if (!dev_str)
continue;
@@ -308,6 +312,8 @@ static int update_events_in_group(struct device_node *node, struct imc_pmu *pmu)
if (pmu->events[i].unit) {
ev_unit_str = kasprintf(GFP_KERNEL, "%s.unit", pmu->events[i].name);
+ if (!ev_unit_str)
+ continue;
dev_str = device_str_attr_create(ev_unit_str, pmu->events[i].unit);
if (!dev_str)
continue;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 078/374] spi: spi-zynqmp-gqspi: fix driver kconfig dependencies
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 077/374] powerpc/imc-pmu: Add a null pointer check in update_events_in_group() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 079/374] mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response Greg Kroah-Hartman
` (296 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amit Kumar Mahapatra,
Radhey Shyam Pandey, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
[ Upstream commit 424a8166764e462258fdccaaefbdeb07517c8b21 ]
ZynqMP GQSPI driver no longer uses spi-master framework. It had been
converted to use spi-mem framework. So remove driver dependency from
spi-master and replace it with spi-mem.
Fixes: 1c26372e5aa9 ("spi: spi-zynqmp-gqspi: Update driver to use spi-mem framework")
Signed-off-by: Amit Kumar Mahapatra <amit.kumar-mahapatra@amd.com>
Signed-off-by: Radhey Shyam Pandey <radhey.shyam.pandey@amd.com>
Link: https://lore.kernel.org/r/1699282435-884917-1-git-send-email-radhey.shyam.pandey@amd.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/Kconfig | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig
index 123689e457d1..412154732c46 100644
--- a/drivers/spi/Kconfig
+++ b/drivers/spi/Kconfig
@@ -984,9 +984,10 @@ config SPI_ZYNQ_QSPI
config SPI_ZYNQMP_GQSPI
tristate "Xilinx ZynqMP GQSPI controller"
- depends on (SPI_MASTER && HAS_DMA) || COMPILE_TEST
+ depends on (SPI_MEM && HAS_DMA) || COMPILE_TEST
help
Enables Xilinx GQSPI controller driver for Zynq UltraScale+ MPSoC.
+ This controller only supports SPI memory interface.
config SPI_AMD
tristate "AMD SPI controller"
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 079/374] mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 078/374] spi: spi-zynqmp-gqspi: fix driver kconfig dependencies Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 080/374] ACPI: video: check for error while searching for backlight device parent Greg Kroah-Hartman
` (295 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Andy Shevchenko,
Ronald Monthero, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ronald Monthero <debug.penguin32@gmail.com>
[ Upstream commit 923fb6238cb3ac529aa2bf13b3b1e53762186a8b ]
Under heavy load it is likely that the controller is done
with its own task but the thread unlocking the wait is not
scheduled in time. Increasing IFC_TIMEOUT_MSECS allows the
controller to respond within allowable timeslice of 1 sec.
fsl,ifc-nand 7e800000.nand: Controller is not responding
[<804b2047>] (nand_get_device) from [<804b5335>] (nand_write_oob+0x1b/0x4a)
[<804b5335>] (nand_write_oob) from [<804a3585>] (mtd_write+0x41/0x5c)
[<804a3585>] (mtd_write) from [<804c1d47>] (ubi_io_write+0x17f/0x22c)
[<804c1d47>] (ubi_io_write) from [<804c047b>] (ubi_eba_write_leb+0x5b/0x1d0)
Fixes: 82771882d960 ("NAND Machine support for Integrated Flash Controller")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Ronald Monthero <debug.penguin32@gmail.com>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20231118083156.776887-1-debug.penguin32@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/nand/raw/fsl_ifc_nand.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mtd/nand/raw/fsl_ifc_nand.c b/drivers/mtd/nand/raw/fsl_ifc_nand.c
index 02d500176838..bea1a7d3edd7 100644
--- a/drivers/mtd/nand/raw/fsl_ifc_nand.c
+++ b/drivers/mtd/nand/raw/fsl_ifc_nand.c
@@ -20,7 +20,7 @@
#define ERR_BYTE 0xFF /* Value returned for read
bytes when read failed */
-#define IFC_TIMEOUT_MSECS 500 /* Maximum number of mSecs to wait
+#define IFC_TIMEOUT_MSECS 1000 /* Maximum timeout to wait
for IFC NAND Machine */
struct fsl_ifc_ctrl;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 080/374] ACPI: video: check for error while searching for backlight device parent
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 079/374] mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 081/374] ACPI: LPIT: Avoid u32 multiplication overflow Greg Kroah-Hartman
` (294 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Kiryushin, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <kiryushin@ancud.ru>
[ Upstream commit ccd45faf4973746c4f30ea41eec864e5cf191099 ]
If acpi_get_parent() called in acpi_video_dev_register_backlight()
fails, for example, because acpi_ut_acquire_mutex() fails inside
acpi_get_parent), this can lead to incorrect (uninitialized)
acpi_parent handle being passed to acpi_get_pci_dev() for detecting
the parent pci device.
Check acpi_get_parent() result and set parent device only in case of success.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 9661e92c10a9 ("acpi: tie ACPI backlight devices to PCI devices if possible")
Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_video.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
index 2b18b51f6351..61bcdc75bee7 100644
--- a/drivers/acpi/acpi_video.c
+++ b/drivers/acpi/acpi_video.c
@@ -1793,12 +1793,12 @@ static void acpi_video_dev_register_backlight(struct acpi_video_device *device)
return;
count++;
- acpi_get_parent(device->dev->handle, &acpi_parent);
-
- pdev = acpi_get_pci_dev(acpi_parent);
- if (pdev) {
- parent = &pdev->dev;
- pci_dev_put(pdev);
+ if (ACPI_SUCCESS(acpi_get_parent(device->dev->handle, &acpi_parent))) {
+ pdev = acpi_get_pci_dev(acpi_parent);
+ if (pdev) {
+ parent = &pdev->dev;
+ pci_dev_put(pdev);
+ }
}
memset(&props, 0, sizeof(struct backlight_properties));
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 081/374] ACPI: LPIT: Avoid u32 multiplication overflow
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 080/374] ACPI: video: check for error while searching for backlight device parent Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 082/374] of: property: define of_property_read_u{8,16,32,64}_array() unconditionally Greg Kroah-Hartman
` (293 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Kiryushin, Rafael J. Wysocki,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Kiryushin <kiryushin@ancud.ru>
[ Upstream commit 56d2eeda87995245300836ee4dbd13b002311782 ]
In lpit_update_residency() there is a possibility of overflow
in multiplication, if tsc_khz is large enough (> UINT_MAX/1000).
Change multiplication to mul_u32_u32().
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: eeb2d80d502a ("ACPI / LPIT: Add Low Power Idle Table (LPIT) support")
Signed-off-by: Nikita Kiryushin <kiryushin@ancud.ru>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_lpit.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/acpi/acpi_lpit.c b/drivers/acpi/acpi_lpit.c
index 48e5059d67ca..7de59730030c 100644
--- a/drivers/acpi/acpi_lpit.c
+++ b/drivers/acpi/acpi_lpit.c
@@ -98,7 +98,7 @@ static void lpit_update_residency(struct lpit_residency_info *info,
struct acpi_lpit_native *lpit_native)
{
info->frequency = lpit_native->counter_frequency ?
- lpit_native->counter_frequency : tsc_khz * 1000;
+ lpit_native->counter_frequency : mul_u32_u32(tsc_khz, 1000U);
if (!info->frequency)
info->frequency = 1;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 082/374] of: property: define of_property_read_u{8,16,32,64}_array() unconditionally
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 081/374] ACPI: LPIT: Avoid u32 multiplication overflow Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 083/374] of: Add of_property_present() helper Greg Kroah-Hartman
` (292 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michael Walle, Rob Herring,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michael Walle <michael@walle.cc>
[ Upstream commit 2ca42c3ad9ed875b136065b010753a4caaaa1d38 ]
We can get rid of all the empty stubs because all these functions call
of_property_read_variable_u{8,16,32,64}_array() which already have an
empty stub if CONFIG_OF is not defined.
Signed-off-by: Michael Walle <michael@walle.cc>
Signed-off-by: Rob Herring <robh@kernel.org>
Link: https://lore.kernel.org/r/20220118173504.2867523-3-michael@walle.cc
Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/of.h | 274 ++++++++++++++++++++-------------------------
1 file changed, 124 insertions(+), 150 deletions(-)
diff --git a/include/linux/of.h b/include/linux/of.h
index 6f15e8b0f9d1..4403e8fc764a 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -415,130 +415,6 @@ extern int of_detach_node(struct device_node *);
#define of_match_ptr(_ptr) (_ptr)
-/**
- * of_property_read_u8_array - Find and read an array of u8 from a property.
- *
- * @np: device node from which the property value is to be read.
- * @propname: name of the property to be searched.
- * @out_values: pointer to return value, modified only if return value is 0.
- * @sz: number of array elements to read
- *
- * Search for a property in a device node and read 8-bit value(s) from
- * it.
- *
- * dts entry of array should be like:
- * ``property = /bits/ 8 <0x50 0x60 0x70>;``
- *
- * Return: 0 on success, -EINVAL if the property does not exist,
- * -ENODATA if property does not have a value, and -EOVERFLOW if the
- * property data isn't large enough.
- *
- * The out_values is modified only if a valid u8 value can be decoded.
- */
-static inline int of_property_read_u8_array(const struct device_node *np,
- const char *propname,
- u8 *out_values, size_t sz)
-{
- int ret = of_property_read_variable_u8_array(np, propname, out_values,
- sz, 0);
- if (ret >= 0)
- return 0;
- else
- return ret;
-}
-
-/**
- * of_property_read_u16_array - Find and read an array of u16 from a property.
- *
- * @np: device node from which the property value is to be read.
- * @propname: name of the property to be searched.
- * @out_values: pointer to return value, modified only if return value is 0.
- * @sz: number of array elements to read
- *
- * Search for a property in a device node and read 16-bit value(s) from
- * it.
- *
- * dts entry of array should be like:
- * ``property = /bits/ 16 <0x5000 0x6000 0x7000>;``
- *
- * Return: 0 on success, -EINVAL if the property does not exist,
- * -ENODATA if property does not have a value, and -EOVERFLOW if the
- * property data isn't large enough.
- *
- * The out_values is modified only if a valid u16 value can be decoded.
- */
-static inline int of_property_read_u16_array(const struct device_node *np,
- const char *propname,
- u16 *out_values, size_t sz)
-{
- int ret = of_property_read_variable_u16_array(np, propname, out_values,
- sz, 0);
- if (ret >= 0)
- return 0;
- else
- return ret;
-}
-
-/**
- * of_property_read_u32_array - Find and read an array of 32 bit integers
- * from a property.
- *
- * @np: device node from which the property value is to be read.
- * @propname: name of the property to be searched.
- * @out_values: pointer to return value, modified only if return value is 0.
- * @sz: number of array elements to read
- *
- * Search for a property in a device node and read 32-bit value(s) from
- * it.
- *
- * Return: 0 on success, -EINVAL if the property does not exist,
- * -ENODATA if property does not have a value, and -EOVERFLOW if the
- * property data isn't large enough.
- *
- * The out_values is modified only if a valid u32 value can be decoded.
- */
-static inline int of_property_read_u32_array(const struct device_node *np,
- const char *propname,
- u32 *out_values, size_t sz)
-{
- int ret = of_property_read_variable_u32_array(np, propname, out_values,
- sz, 0);
- if (ret >= 0)
- return 0;
- else
- return ret;
-}
-
-/**
- * of_property_read_u64_array - Find and read an array of 64 bit integers
- * from a property.
- *
- * @np: device node from which the property value is to be read.
- * @propname: name of the property to be searched.
- * @out_values: pointer to return value, modified only if return value is 0.
- * @sz: number of array elements to read
- *
- * Search for a property in a device node and read 64-bit value(s) from
- * it.
- *
- * Return: 0 on success, -EINVAL if the property does not exist,
- * -ENODATA if property does not have a value, and -EOVERFLOW if the
- * property data isn't large enough.
- *
- * The out_values is modified only if a valid u64 value can be decoded.
- */
-static inline int of_property_read_u64_array(const struct device_node *np,
- const char *propname,
- u64 *out_values, size_t sz)
-{
- int ret = of_property_read_variable_u64_array(np, propname, out_values,
- sz, 0);
- if (ret >= 0)
- return 0;
- else
- return ret;
-}
-
/*
* struct property *prop;
* const __be32 *p;
@@ -733,32 +609,6 @@ static inline int of_property_count_elems_of_size(const struct device_node *np,
return -ENOSYS;
}
-static inline int of_property_read_u8_array(const struct device_node *np,
- const char *propname, u8 *out_values, size_t sz)
-{
- return -ENOSYS;
-}
-
-static inline int of_property_read_u16_array(const struct device_node *np,
- const char *propname, u16 *out_values, size_t sz)
-{
- return -ENOSYS;
-}
-
-static inline int of_property_read_u32_array(const struct device_node *np,
- const char *propname,
- u32 *out_values, size_t sz)
-{
- return -ENOSYS;
-}
-
-static inline int of_property_read_u64_array(const struct device_node *np,
- const char *propname,
- u64 *out_values, size_t sz)
-{
- return -ENOSYS;
-}
-
static inline int of_property_read_u32_index(const struct device_node *np,
const char *propname, u32 index, u32 *out_value)
{
@@ -1235,6 +1085,130 @@ static inline bool of_property_read_bool(const struct device_node *np,
return prop ? true : false;
}
+/**
+ * of_property_read_u8_array - Find and read an array of u8 from a property.
+ *
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
+ * @out_values: pointer to return value, modified only if return value is 0.
+ * @sz: number of array elements to read
+ *
+ * Search for a property in a device node and read 8-bit value(s) from
+ * it.
+ *
+ * dts entry of array should be like:
+ * ``property = /bits/ 8 <0x50 0x60 0x70>;``
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
+ * -ENODATA if property does not have a value, and -EOVERFLOW if the
+ * property data isn't large enough.
+ *
+ * The out_values is modified only if a valid u8 value can be decoded.
+ */
+static inline int of_property_read_u8_array(const struct device_node *np,
+ const char *propname,
+ u8 *out_values, size_t sz)
+{
+ int ret = of_property_read_variable_u8_array(np, propname, out_values,
+ sz, 0);
+ if (ret >= 0)
+ return 0;
+ else
+ return ret;
+}
+
+/**
+ * of_property_read_u16_array - Find and read an array of u16 from a property.
+ *
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
+ * @out_values: pointer to return value, modified only if return value is 0.
+ * @sz: number of array elements to read
+ *
+ * Search for a property in a device node and read 16-bit value(s) from
+ * it.
+ *
+ * dts entry of array should be like:
+ * ``property = /bits/ 16 <0x5000 0x6000 0x7000>;``
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
+ * -ENODATA if property does not have a value, and -EOVERFLOW if the
+ * property data isn't large enough.
+ *
+ * The out_values is modified only if a valid u16 value can be decoded.
+ */
+static inline int of_property_read_u16_array(const struct device_node *np,
+ const char *propname,
+ u16 *out_values, size_t sz)
+{
+ int ret = of_property_read_variable_u16_array(np, propname, out_values,
+ sz, 0);
+ if (ret >= 0)
+ return 0;
+ else
+ return ret;
+}
+
+/**
+ * of_property_read_u32_array - Find and read an array of 32 bit integers
+ * from a property.
+ *
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
+ * @out_values: pointer to return value, modified only if return value is 0.
+ * @sz: number of array elements to read
+ *
+ * Search for a property in a device node and read 32-bit value(s) from
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
+ * -ENODATA if property does not have a value, and -EOVERFLOW if the
+ * property data isn't large enough.
+ *
+ * The out_values is modified only if a valid u32 value can be decoded.
+ */
+static inline int of_property_read_u32_array(const struct device_node *np,
+ const char *propname,
+ u32 *out_values, size_t sz)
+{
+ int ret = of_property_read_variable_u32_array(np, propname, out_values,
+ sz, 0);
+ if (ret >= 0)
+ return 0;
+ else
+ return ret;
+}
+
+/**
+ * of_property_read_u64_array - Find and read an array of 64 bit integers
+ * from a property.
+ *
+ * @np: device node from which the property value is to be read.
+ * @propname: name of the property to be searched.
+ * @out_values: pointer to return value, modified only if return value is 0.
+ * @sz: number of array elements to read
+ *
+ * Search for a property in a device node and read 64-bit value(s) from
+ * it.
+ *
+ * Return: 0 on success, -EINVAL if the property does not exist,
+ * -ENODATA if property does not have a value, and -EOVERFLOW if the
+ * property data isn't large enough.
+ *
+ * The out_values is modified only if a valid u64 value can be decoded.
+ */
+static inline int of_property_read_u64_array(const struct device_node *np,
+ const char *propname,
+ u64 *out_values, size_t sz)
+{
+ int ret = of_property_read_variable_u64_array(np, propname, out_values,
+ sz, 0);
+ if (ret >= 0)
+ return 0;
+ else
+ return ret;
+}
+
static inline int of_property_read_u8(const struct device_node *np,
const char *propname,
u8 *out_value)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 083/374] of: Add of_property_present() helper
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 082/374] of: property: define of_property_read_u{8,16,32,64}_array() unconditionally Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 084/374] cpufreq: Use of_property_present() for testing DT property presence Greg Kroah-Hartman
` (291 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Rowand, Rob Herring,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <robh@kernel.org>
[ Upstream commit 9cbad37ce8122de32a1529e394b468bc101c9e7f ]
Add an of_property_present() function similar to
fwnode_property_present(). of_property_read_bool() could be used
directly, but it is cleaner to not use it on non-boolean properties.
Reviewed-by: Frank Rowand <frowand.list@gmail.com>
Tested-by: Frank Rowand <frowand.list@gmail.com>
Link: https://lore.kernel.org/all/20230215215547.691573-1-robh@kernel.org/
Signed-off-by: Rob Herring <robh@kernel.org>
Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/of.h | 17 ++++++++++++++++-
1 file changed, 16 insertions(+), 1 deletion(-)
diff --git a/include/linux/of.h b/include/linux/of.h
index 4403e8fc764a..29f657101f4f 100644
--- a/include/linux/of.h
+++ b/include/linux/of.h
@@ -1073,7 +1073,8 @@ static inline int of_property_read_string_index(const struct device_node *np,
* @np: device node from which the property value is to be read.
* @propname: name of the property to be searched.
*
- * Search for a property in a device node.
+ * Search for a boolean property in a device node. Usage on non-boolean
+ * property types is deprecated.
*
* Return: true if the property exists false otherwise.
*/
@@ -1085,6 +1086,20 @@ static inline bool of_property_read_bool(const struct device_node *np,
return prop ? true : false;
}
+/**
+ * of_property_present - Test if a property is present in a node
+ * @np: device node to search for the property.
+ * @propname: name of the property to be searched.
+ *
+ * Test for a property present in a device node.
+ *
+ * Return: true if the property exists false otherwise.
+ */
+static inline bool of_property_present(const struct device_node *np, const char *propname)
+{
+ return of_property_read_bool(np, propname);
+}
+
/**
* of_property_read_u8_array - Find and read an array of u8 from a property.
*
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 084/374] cpufreq: Use of_property_present() for testing DT property presence
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 083/374] of: Add of_property_present() helper Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 085/374] cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() Greg Kroah-Hartman
` (290 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rob Herring, Viresh Kumar,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Herring <robh@kernel.org>
[ Upstream commit b8f3a396a7ee43e6079176cc0fb8de2b95a23681 ]
It is preferred to use typed property access functions (i.e.
of_property_read_<type> functions) rather than low-level
of_get_property/of_find_property functions for reading properties. As
part of this, convert of_get_property/of_find_property calls to the
recently added of_property_present() helper when we just want to test
for presence of a property and nothing more.
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Stable-dep-of: c4a5118a3ae1 ("cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/cpufreq-dt-platdev.c | 2 +-
drivers/cpufreq/imx-cpufreq-dt.c | 2 +-
drivers/cpufreq/imx6q-cpufreq.c | 4 ++--
drivers/cpufreq/scmi-cpufreq.c | 2 +-
drivers/cpufreq/tegra20-cpufreq.c | 2 +-
5 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/cpufreq/cpufreq-dt-platdev.c b/drivers/cpufreq/cpufreq-dt-platdev.c
index e1b5975c7daa..48ca7189a73b 100644
--- a/drivers/cpufreq/cpufreq-dt-platdev.c
+++ b/drivers/cpufreq/cpufreq-dt-platdev.c
@@ -171,7 +171,7 @@ static bool __init cpu0_node_has_opp_v2_prop(void)
struct device_node *np = of_cpu_device_node_get(0);
bool ret = false;
- if (of_get_property(np, "operating-points-v2", NULL))
+ if (of_property_present(np, "operating-points-v2"))
ret = true;
of_node_put(np);
diff --git a/drivers/cpufreq/imx-cpufreq-dt.c b/drivers/cpufreq/imx-cpufreq-dt.c
index 3fe9125156b4..0942498b348c 100644
--- a/drivers/cpufreq/imx-cpufreq-dt.c
+++ b/drivers/cpufreq/imx-cpufreq-dt.c
@@ -89,7 +89,7 @@ static int imx_cpufreq_dt_probe(struct platform_device *pdev)
cpu_dev = get_cpu_device(0);
- if (!of_find_property(cpu_dev->of_node, "cpu-supply", NULL))
+ if (!of_property_present(cpu_dev->of_node, "cpu-supply"))
return -ENODEV;
if (of_machine_is_compatible("fsl,imx7ulp")) {
diff --git a/drivers/cpufreq/imx6q-cpufreq.c b/drivers/cpufreq/imx6q-cpufreq.c
index 67f98a083d22..ae9ef99f7d86 100644
--- a/drivers/cpufreq/imx6q-cpufreq.c
+++ b/drivers/cpufreq/imx6q-cpufreq.c
@@ -230,7 +230,7 @@ static int imx6q_opp_check_speed_grading(struct device *dev)
u32 val;
int ret;
- if (of_find_property(dev->of_node, "nvmem-cells", NULL)) {
+ if (of_property_present(dev->of_node, "nvmem-cells")) {
ret = nvmem_cell_read_u32(dev, "speed_grade", &val);
if (ret)
return ret;
@@ -285,7 +285,7 @@ static int imx6ul_opp_check_speed_grading(struct device *dev)
u32 val;
int ret = 0;
- if (of_find_property(dev->of_node, "nvmem-cells", NULL)) {
+ if (of_property_present(dev->of_node, "nvmem-cells")) {
ret = nvmem_cell_read_u32(dev, "speed_grade", &val);
if (ret)
return ret;
diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
index 1e0cd4d165f0..82e588c3c57b 100644
--- a/drivers/cpufreq/scmi-cpufreq.c
+++ b/drivers/cpufreq/scmi-cpufreq.c
@@ -299,7 +299,7 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
#ifdef CONFIG_COMMON_CLK
/* dummy clock provider as needed by OPP if clocks property is used */
- if (of_find_property(dev->of_node, "#clock-cells", NULL))
+ if (of_property_present(dev->of_node, "#clock-cells"))
devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
#endif
diff --git a/drivers/cpufreq/tegra20-cpufreq.c b/drivers/cpufreq/tegra20-cpufreq.c
index e8db3d75be25..72b9c2d5f375 100644
--- a/drivers/cpufreq/tegra20-cpufreq.c
+++ b/drivers/cpufreq/tegra20-cpufreq.c
@@ -25,7 +25,7 @@ static bool cpu0_node_has_opp_v2_prop(void)
struct device_node *np = of_cpu_device_node_get(0);
bool ret = false;
- if (of_get_property(np, "operating-points-v2", NULL))
+ if (of_property_present(np, "operating-points-v2"))
ret = true;
of_node_put(np);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 085/374] cpufreq: scmi: process the result of devm_of_clk_add_hw_provider()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 084/374] cpufreq: Use of_property_present() for testing DT property presence Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 086/374] calipso: fix memory leak in netlbl_calipso_add_pass() Greg Kroah-Hartman
` (289 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandra Diupina, Viresh Kumar,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandra Diupina <adiupina@astralinux.ru>
[ Upstream commit c4a5118a3ae1eadc687d84eef9431f9e13eb015c ]
devm_of_clk_add_hw_provider() may return an errno, so
add a return value check
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 8410e7f3b31e ("cpufreq: scmi: Fix OPP addition failure with a dummy clock provider")
Signed-off-by: Alexandra Diupina <adiupina@astralinux.ru>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/cpufreq/scmi-cpufreq.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/cpufreq/scmi-cpufreq.c b/drivers/cpufreq/scmi-cpufreq.c
index 82e588c3c57b..c24e6373d341 100644
--- a/drivers/cpufreq/scmi-cpufreq.c
+++ b/drivers/cpufreq/scmi-cpufreq.c
@@ -299,8 +299,11 @@ static int scmi_cpufreq_probe(struct scmi_device *sdev)
#ifdef CONFIG_COMMON_CLK
/* dummy clock provider as needed by OPP if clocks property is used */
- if (of_property_present(dev->of_node, "#clock-cells"))
- devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
+ if (of_property_present(dev->of_node, "#clock-cells")) {
+ ret = devm_of_clk_add_hw_provider(dev, of_clk_hw_simple_get, NULL);
+ if (ret)
+ return dev_err_probe(dev, ret, "%s: registering clock provider failed\n", __func__);
+ }
#endif
ret = cpufreq_register_driver(&scmi_cpufreq_driver);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 086/374] calipso: fix memory leak in netlbl_calipso_add_pass()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 085/374] cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 087/374] efivarfs: force RO when remounting if SetVariable is not supported Greg Kroah-Hartman
` (288 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gavrilov Ilia, Paul Moore,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
[ Upstream commit ec4e9d630a64df500641892f4e259e8149594a99 ]
If IPv6 support is disabled at boot (ipv6.disable=1),
the calipso_init() -> netlbl_calipso_ops_register() function isn't called,
and the netlbl_calipso_ops_get() function always returns NULL.
In this case, the netlbl_calipso_add_pass() function allocates memory
for the doi_def variable but doesn't free it with the calipso_doi_free().
BUG: memory leak
unreferenced object 0xffff888011d68180 (size 64):
comm "syz-executor.1", pid 10746, jiffies 4295410986 (age 17.928s)
hex dump (first 32 bytes):
00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 ................
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<...>] kmalloc include/linux/slab.h:552 [inline]
[<...>] netlbl_calipso_add_pass net/netlabel/netlabel_calipso.c:76 [inline]
[<...>] netlbl_calipso_add+0x22e/0x4f0 net/netlabel/netlabel_calipso.c:111
[<...>] genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739
[<...>] genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]
[<...>] genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800
[<...>] netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2515
[<...>] genl_rcv+0x29/0x40 net/netlink/genetlink.c:811
[<...>] netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
[<...>] netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1339
[<...>] netlink_sendmsg+0x90a/0xdf0 net/netlink/af_netlink.c:1934
[<...>] sock_sendmsg_nosec net/socket.c:651 [inline]
[<...>] sock_sendmsg+0x157/0x190 net/socket.c:671
[<...>] ____sys_sendmsg+0x712/0x870 net/socket.c:2342
[<...>] ___sys_sendmsg+0xf8/0x170 net/socket.c:2396
[<...>] __sys_sendmsg+0xea/0x1b0 net/socket.c:2429
[<...>] do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46
[<...>] entry_SYSCALL_64_after_hwframe+0x61/0xc6
Found by InfoTeCS on behalf of Linux Verification Center
(linuxtesting.org) with Syzkaller
Fixes: cb72d38211ea ("netlabel: Initial support for the CALIPSO netlink protocol.")
Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru>
[PM: merged via the LSM tree at Jakub Kicinski request]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netlabel/netlabel_calipso.c | 49 +++++++++++++++++----------------
1 file changed, 26 insertions(+), 23 deletions(-)
diff --git a/net/netlabel/netlabel_calipso.c b/net/netlabel/netlabel_calipso.c
index 91a19c3ea1a3..84ef4a29864b 100644
--- a/net/netlabel/netlabel_calipso.c
+++ b/net/netlabel/netlabel_calipso.c
@@ -54,6 +54,28 @@ static const struct nla_policy calipso_genl_policy[NLBL_CALIPSO_A_MAX + 1] = {
[NLBL_CALIPSO_A_MTYPE] = { .type = NLA_U32 },
};
+static const struct netlbl_calipso_ops *calipso_ops;
+
+/**
+ * netlbl_calipso_ops_register - Register the CALIPSO operations
+ * @ops: ops to register
+ *
+ * Description:
+ * Register the CALIPSO packet engine operations.
+ *
+ */
+const struct netlbl_calipso_ops *
+netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
+{
+ return xchg(&calipso_ops, ops);
+}
+EXPORT_SYMBOL(netlbl_calipso_ops_register);
+
+static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
+{
+ return READ_ONCE(calipso_ops);
+}
+
/* NetLabel Command Handlers
*/
/**
@@ -96,15 +118,18 @@ static int netlbl_calipso_add_pass(struct genl_info *info,
*
*/
static int netlbl_calipso_add(struct sk_buff *skb, struct genl_info *info)
-
{
int ret_val = -EINVAL;
struct netlbl_audit audit_info;
+ const struct netlbl_calipso_ops *ops = netlbl_calipso_ops_get();
if (!info->attrs[NLBL_CALIPSO_A_DOI] ||
!info->attrs[NLBL_CALIPSO_A_MTYPE])
return -EINVAL;
+ if (!ops)
+ return -EOPNOTSUPP;
+
netlbl_netlink_auditinfo(&audit_info);
switch (nla_get_u32(info->attrs[NLBL_CALIPSO_A_MTYPE])) {
case CALIPSO_MAP_PASS:
@@ -362,28 +387,6 @@ int __init netlbl_calipso_genl_init(void)
return genl_register_family(&netlbl_calipso_gnl_family);
}
-static const struct netlbl_calipso_ops *calipso_ops;
-
-/**
- * netlbl_calipso_ops_register - Register the CALIPSO operations
- * @ops: ops to register
- *
- * Description:
- * Register the CALIPSO packet engine operations.
- *
- */
-const struct netlbl_calipso_ops *
-netlbl_calipso_ops_register(const struct netlbl_calipso_ops *ops)
-{
- return xchg(&calipso_ops, ops);
-}
-EXPORT_SYMBOL(netlbl_calipso_ops_register);
-
-static const struct netlbl_calipso_ops *netlbl_calipso_ops_get(void)
-{
- return READ_ONCE(calipso_ops);
-}
-
/**
* calipso_doi_add - Add a new DOI to the CALIPSO protocol engine
* @doi_def: the DOI structure
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 087/374] efivarfs: force RO when remounting if SetVariable is not supported
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 086/374] calipso: fix memory leak in netlbl_calipso_add_pass() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 088/374] spi: sh-msiof: Enforce fixed DTDL for R-Car H3 Greg Kroah-Hartman
` (287 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ilias Apalodimas, Ard Biesheuvel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
[ Upstream commit 0e8d2444168dd519fea501599d150e62718ed2fe ]
If SetVariable at runtime is not supported by the firmware we never assign
a callback for that function. At the same time mount the efivarfs as
RO so no one can call that. However, we never check the permission flags
when someone remounts the filesystem as RW. As a result this leads to a
crash looking like this:
$ mount -o remount,rw /sys/firmware/efi/efivars
$ efi-updatevar -f PK.auth PK
[ 303.279166] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 303.280482] Mem abort info:
[ 303.280854] ESR = 0x0000000086000004
[ 303.281338] EC = 0x21: IABT (current EL), IL = 32 bits
[ 303.282016] SET = 0, FnV = 0
[ 303.282414] EA = 0, S1PTW = 0
[ 303.282821] FSC = 0x04: level 0 translation fault
[ 303.283771] user pgtable: 4k pages, 48-bit VAs, pgdp=000000004258c000
[ 303.284913] [0000000000000000] pgd=0000000000000000, p4d=0000000000000000
[ 303.286076] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
[ 303.286936] Modules linked in: qrtr tpm_tis tpm_tis_core crct10dif_ce arm_smccc_trng rng_core drm fuse ip_tables x_tables ipv6
[ 303.288586] CPU: 1 PID: 755 Comm: efi-updatevar Not tainted 6.3.0-rc1-00108-gc7d0c4695c68 #1
[ 303.289748] Hardware name: Unknown Unknown Product/Unknown Product, BIOS 2023.04-00627-g88336918701d 04/01/2023
[ 303.291150] pstate: 60400005 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 303.292123] pc : 0x0
[ 303.292443] lr : efivar_set_variable_locked+0x74/0xec
[ 303.293156] sp : ffff800008673c10
[ 303.293619] x29: ffff800008673c10 x28: ffff0000037e8000 x27: 0000000000000000
[ 303.294592] x26: 0000000000000800 x25: ffff000002467400 x24: 0000000000000027
[ 303.295572] x23: ffffd49ea9832000 x22: ffff0000020c9800 x21: ffff000002467000
[ 303.296566] x20: 0000000000000001 x19: 00000000000007fc x18: 0000000000000000
[ 303.297531] x17: 0000000000000000 x16: 0000000000000000 x15: 0000aaaac807ab54
[ 303.298495] x14: ed37489f673633c0 x13: 71c45c606de13f80 x12: 47464259e219acf4
[ 303.299453] x11: ffff000002af7b01 x10: 0000000000000003 x9 : 0000000000000002
[ 303.300431] x8 : 0000000000000010 x7 : ffffd49ea8973230 x6 : 0000000000a85201
[ 303.301412] x5 : 0000000000000000 x4 : ffff0000020c9800 x3 : 00000000000007fc
[ 303.302370] x2 : 0000000000000027 x1 : ffff000002467400 x0 : ffff000002467000
[ 303.303341] Call trace:
[ 303.303679] 0x0
[ 303.303938] efivar_entry_set_get_size+0x98/0x16c
[ 303.304585] efivarfs_file_write+0xd0/0x1a4
[ 303.305148] vfs_write+0xc4/0x2e4
[ 303.305601] ksys_write+0x70/0x104
[ 303.306073] __arm64_sys_write+0x1c/0x28
[ 303.306622] invoke_syscall+0x48/0x114
[ 303.307156] el0_svc_common.constprop.0+0x44/0xec
[ 303.307803] do_el0_svc+0x38/0x98
[ 303.308268] el0_svc+0x2c/0x84
[ 303.308702] el0t_64_sync_handler+0xf4/0x120
[ 303.309293] el0t_64_sync+0x190/0x194
[ 303.309794] Code: ???????? ???????? ???????? ???????? (????????)
[ 303.310612] ---[ end trace 0000000000000000 ]---
Fix this by adding a .reconfigure() function to the fs operations which
we can use to check the requested flags and deny anything that's not RO
if the firmware doesn't implement SetVariable at runtime.
Fixes: f88814cc2578 ("efi/efivars: Expose RT service availability via efivars abstraction")
Signed-off-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/efivarfs/super.c | 12 ++++++++++++
1 file changed, 12 insertions(+)
diff --git a/fs/efivarfs/super.c b/fs/efivarfs/super.c
index 15880a68faad..3626816b174a 100644
--- a/fs/efivarfs/super.c
+++ b/fs/efivarfs/super.c
@@ -13,6 +13,7 @@
#include <linux/ucs2_string.h>
#include <linux/slab.h>
#include <linux/magic.h>
+#include <linux/printk.h>
#include "internal.h"
@@ -231,8 +232,19 @@ static int efivarfs_get_tree(struct fs_context *fc)
return get_tree_single(fc, efivarfs_fill_super);
}
+static int efivarfs_reconfigure(struct fs_context *fc)
+{
+ if (!efivar_supports_writes() && !(fc->sb_flags & SB_RDONLY)) {
+ pr_err("Firmware does not support SetVariableRT. Can not remount with rw\n");
+ return -EINVAL;
+ }
+
+ return 0;
+}
+
static const struct fs_context_operations efivarfs_context_ops = {
.get_tree = efivarfs_get_tree,
+ .reconfigure = efivarfs_reconfigure,
};
static int efivarfs_init_fs_context(struct fs_context *fc)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 088/374] spi: sh-msiof: Enforce fixed DTDL for R-Car H3
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 087/374] efivarfs: force RO when remounting if SetVariable is not supported Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 089/374] ACPI: LPSS: Fix the fractional clock divider flags Greg Kroah-Hartman
` (286 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wolfram Sang, Geert Uytterhoeven,
Yoshihiro Shimoda, Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit e5c7bcb499840551cfbe85c6df177ebc50432bf0 ]
Documentation says only DTDL of 200 is allowed for this SoC.
Fixes: 4286db8456f4 ("spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Reviewed-by: Geert Uytterhoeven <geert+renesas@glider.be>
Reviewed-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>
Link: https://msgid.link/r/20231212081239.14254-1-wsa+renesas@sang-engineering.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/spi/spi-sh-msiof.c | 17 +++++++++++++++++
1 file changed, 17 insertions(+)
diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c
index f88d9acd20d9..eb2c64e0a5f7 100644
--- a/drivers/spi/spi-sh-msiof.c
+++ b/drivers/spi/spi-sh-msiof.c
@@ -30,12 +30,15 @@
#include <asm/unaligned.h>
+#define SH_MSIOF_FLAG_FIXED_DTDL_200 BIT(0)
+
struct sh_msiof_chipdata {
u32 bits_per_word_mask;
u16 tx_fifo_size;
u16 rx_fifo_size;
u16 ctlr_flags;
u16 min_div_pow;
+ u32 flags;
};
struct sh_msiof_spi_priv {
@@ -1073,6 +1076,16 @@ static const struct sh_msiof_chipdata rcar_gen3_data = {
.min_div_pow = 1,
};
+static const struct sh_msiof_chipdata rcar_r8a7795_data = {
+ .bits_per_word_mask = SPI_BPW_MASK(8) | SPI_BPW_MASK(16) |
+ SPI_BPW_MASK(24) | SPI_BPW_MASK(32),
+ .tx_fifo_size = 64,
+ .rx_fifo_size = 64,
+ .ctlr_flags = SPI_CONTROLLER_MUST_TX,
+ .min_div_pow = 1,
+ .flags = SH_MSIOF_FLAG_FIXED_DTDL_200,
+};
+
static const struct of_device_id sh_msiof_match[] = {
{ .compatible = "renesas,sh-mobile-msiof", .data = &sh_data },
{ .compatible = "renesas,msiof-r8a7743", .data = &rcar_gen2_data },
@@ -1083,6 +1096,7 @@ static const struct of_device_id sh_msiof_match[] = {
{ .compatible = "renesas,msiof-r8a7793", .data = &rcar_gen2_data },
{ .compatible = "renesas,msiof-r8a7794", .data = &rcar_gen2_data },
{ .compatible = "renesas,rcar-gen2-msiof", .data = &rcar_gen2_data },
+ { .compatible = "renesas,msiof-r8a7795", .data = &rcar_r8a7795_data },
{ .compatible = "renesas,msiof-r8a7796", .data = &rcar_gen3_data },
{ .compatible = "renesas,rcar-gen3-msiof", .data = &rcar_gen3_data },
{ .compatible = "renesas,sh-msiof", .data = &sh_data }, /* Deprecated */
@@ -1279,6 +1293,9 @@ static int sh_msiof_spi_probe(struct platform_device *pdev)
return -ENXIO;
}
+ if (chipdata->flags & SH_MSIOF_FLAG_FIXED_DTDL_200)
+ info->dtdl = 200;
+
if (info->mode == MSIOF_SPI_SLAVE)
ctlr = spi_alloc_slave(&pdev->dev,
sizeof(struct sh_msiof_spi_priv));
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 089/374] ACPI: LPSS: Fix the fractional clock divider flags
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 088/374] spi: sh-msiof: Enforce fixed DTDL for R-Car H3 Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 090/374] ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error Greg Kroah-Hartman
` (285 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alex Vinarskis, Andy Shevchenko,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 3ebccf1d1ca74bbb78e6f8c38d1d172e468d91f8 ]
The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags
in the parameters and hence miscalculates the values in the clock
divider. Fix this by applying the flag to the proper parameter.
Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag")
Reported-by: Alex Vinarskis <alex.vinarskis@gmail.com>
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_lpss.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c
index f609f9d62efd..332befb5f579 100644
--- a/drivers/acpi/acpi_lpss.c
+++ b/drivers/acpi/acpi_lpss.c
@@ -439,8 +439,9 @@ static int register_device_clock(struct acpi_device *adev,
if (!clk_name)
return -ENOMEM;
clk = clk_register_fractional_divider(NULL, clk_name, parent,
+ 0, prv_base, 1, 15, 16, 15,
CLK_FRAC_DIVIDER_POWER_OF_TWO_PS,
- prv_base, 1, 15, 16, 15, 0, NULL);
+ NULL);
parent = clk_name;
clk_name = kasprintf(GFP_KERNEL, "%s-update", devname);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 090/374] ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 089/374] ACPI: LPSS: Fix the fractional clock divider flags Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 091/374] kunit: debugfs: Fix unchecked dereference in debugfs_print_results() Greg Kroah-Hartman
` (284 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Erwin Tsaur, Tony Luck,
Rafael J. Wysocki, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Luck <tony.luck@intel.com>
[ Upstream commit 38c872a9e96f72f2947affc0526cc05659367d3d ]
When both CONFIG_RAS_CEC and CONFIG_ACPI_EXTLOG are enabled, Linux does
not clear the status word of the BIOS supplied error record for corrected
errors. This may prevent logging of subsequent uncorrected errors.
Fix by clearing the status.
Fixes: 23ba710a0864 ("x86/mce: Fix all mce notifiers to update the mce->kflags bitmask")
Reported-by: Erwin Tsaur <erwin.tsaur@intel.com>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/acpi/acpi_extlog.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c
index e648158368a7..088db2356998 100644
--- a/drivers/acpi/acpi_extlog.c
+++ b/drivers/acpi/acpi_extlog.c
@@ -145,9 +145,14 @@ static int extlog_print(struct notifier_block *nb, unsigned long val,
static u32 err_seq;
estatus = extlog_elog_entry_check(cpu, bank);
- if (estatus == NULL || (mce->kflags & MCE_HANDLED_CEC))
+ if (!estatus)
return NOTIFY_DONE;
+ if (mce->kflags & MCE_HANDLED_CEC) {
+ estatus->block_status = 0;
+ return NOTIFY_DONE;
+ }
+
memcpy(elog_buf, (void *)estatus, ELOG_ENTRY_LEN);
/* clear record status to enable BIOS to update it again */
estatus->block_status = 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 091/374] kunit: debugfs: Fix unchecked dereference in debugfs_print_results()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 090/374] ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 092/374] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier Greg Kroah-Hartman
` (283 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Richard Fitzgerald, Dan Carpenter,
Rae Moar, Shuah Khan, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Fitzgerald <rf@opensource.cirrus.com>
[ Upstream commit 34dfd5bb2e5507e69d9b6d6c90f546600c7a4977 ]
Move the call to kunit_suite_has_succeeded() after the check that
the kunit_suite pointer is valid.
This was found by smatch:
lib/kunit/debugfs.c:66 debugfs_print_results() warn: variable
dereferenced before check 'suite' (see line 63)
Signed-off-by: Richard Fitzgerald <rf@opensource.cirrus.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Fixes: 38289a26e1b8 ("kunit: fix debugfs code to use enum kunit_status, not bool")
Reviewed-by: Rae Moar <rmoar@google.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
lib/kunit/debugfs.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/lib/kunit/debugfs.c b/lib/kunit/debugfs.c
index 1048ef1b8d6e..4c4b84db8f4a 100644
--- a/lib/kunit/debugfs.c
+++ b/lib/kunit/debugfs.c
@@ -52,12 +52,14 @@ static void debugfs_print_result(struct seq_file *seq,
static int debugfs_print_results(struct seq_file *seq, void *v)
{
struct kunit_suite *suite = (struct kunit_suite *)seq->private;
- enum kunit_status success = kunit_suite_has_succeeded(suite);
+ enum kunit_status success;
struct kunit_case *test_case;
if (!suite || !suite->log)
return 0;
+ success = kunit_suite_has_succeeded(suite);
+
seq_printf(seq, "%s", suite->log);
kunit_suite_for_each_test_case(suite, test_case)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 092/374] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 091/374] kunit: debugfs: Fix unchecked dereference in debugfs_print_results() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 093/374] selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket Greg Kroah-Hartman
` (282 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, ZhaoLong Wang, Zhihao Cheng,
Richard Weinberger, Miquel Raynal, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: ZhaoLong Wang <wangzhaolong1@huawei.com>
[ Upstream commit a43bdc376deab5fff1ceb93dca55bcab8dbdc1d6 ]
If both ftl.ko and gluebi.ko are loaded, the notifier of ftl
triggers NULL pointer dereference when trying to access
‘gluebi->desc’ in gluebi_read().
ubi_gluebi_init
ubi_register_volume_notifier
ubi_enumerate_volumes
ubi_notify_all
gluebi_notify nb->notifier_call()
gluebi_create
mtd_device_register
mtd_device_parse_register
add_mtd_device
blktrans_notify_add not->add()
ftl_add_mtd tr->add_mtd()
scan_header
mtd_read
mtd_read_oob
mtd_read_oob_std
gluebi_read mtd->read()
gluebi->desc - NULL
Detailed reproduction information available at the Link [1],
In the normal case, obtain gluebi->desc in the gluebi_get_device(),
and access gluebi->desc in the gluebi_read(). However,
gluebi_get_device() is not executed in advance in the
ftl_add_mtd() process, which leads to NULL pointer dereference.
The solution for the gluebi module is to run jffs2 on the UBI
volume without considering working with ftl or mtdblock [2].
Therefore, this problem can be avoided by preventing gluebi from
creating the mtdblock device after creating mtd partition of the
type MTD_UBIVOLUME.
Fixes: 2ba3d76a1e29 ("UBI: make gluebi a separate module")
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217992 [1]
Link: https://lore.kernel.org/lkml/441107100.23734.1697904580252.JavaMail.zimbra@nod.at/ [2]
Signed-off-by: ZhaoLong Wang <wangzhaolong1@huawei.com>
Reviewed-by: Zhihao Cheng <chengzhihao1@huawei.com>
Acked-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Link: https://lore.kernel.org/linux-mtd/20231220024619.2138625-1-wangzhaolong1@huawei.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mtd/mtd_blkdevs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/mtd/mtd_blkdevs.c b/drivers/mtd/mtd_blkdevs.c
index b8ae1ec14e17..5288a6aaf182 100644
--- a/drivers/mtd/mtd_blkdevs.c
+++ b/drivers/mtd/mtd_blkdevs.c
@@ -457,7 +457,7 @@ static void blktrans_notify_add(struct mtd_info *mtd)
{
struct mtd_blktrans_ops *tr;
- if (mtd->type == MTD_ABSENT)
+ if (mtd->type == MTD_ABSENT || mtd->type == MTD_UBIVOLUME)
return;
list_for_each_entry(tr, &blktrans_majors, list)
@@ -497,7 +497,7 @@ int register_mtd_blktrans(struct mtd_blktrans_ops *tr)
mutex_lock(&mtd_table_mutex);
list_add(&tr->list, &blktrans_majors);
mtd_for_each_device(mtd)
- if (mtd->type != MTD_ABSENT)
+ if (mtd->type != MTD_ABSENT && mtd->type != MTD_UBIVOLUME)
tr->add_mtd(tr, mtd);
mutex_unlock(&mtd_table_mutex);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 093/374] selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 092/374] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 094/374] crypto: virtio - Handle dataq logic with tasklet Greg Kroah-Hartman
` (281 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Paris, Konstantin Meskhidze,
Paul Moore, Stephen Smalley, Muhammad Usama Anjum,
Mickaël Salaün, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mickaël Salaün <mic@digikod.net>
[ Upstream commit bbf5a1d0e5d0fb3bdf90205aa872636122692a50 ]
The IPv6 network stack first checks the sockaddr length (-EINVAL error)
before checking the family (-EAFNOSUPPORT error).
This was discovered thanks to commit a549d055a22e ("selftests/landlock:
Add network tests").
Cc: Eric Paris <eparis@parisplace.org>
Cc: Konstantin Meskhidze <konstantin.meskhidze@huawei.com>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <stephen.smalley.work@gmail.com>
Reported-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Closes: https://lore.kernel.org/r/0584f91c-537c-4188-9e4f-04f192565667@collabora.com
Fixes: 0f8db8cc73df ("selinux: add AF_UNSPEC and INADDR_ANY checks to selinux_socket_bind()")
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Tested-by: Muhammad Usama Anjum <usama.anjum@collabora.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/selinux/hooks.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 9ce029b2f226..ec839716dbac 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4774,6 +4774,13 @@ static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, in
return -EINVAL;
addr4 = (struct sockaddr_in *)address;
if (family_sa == AF_UNSPEC) {
+ if (family == PF_INET6) {
+ /* Length check from inet6_bind_sk() */
+ if (addrlen < SIN6_LEN_RFC2133)
+ return -EINVAL;
+ /* Family check from __inet6_bind() */
+ goto err_af;
+ }
/* see __inet_bind(), we only want to allow
* AF_UNSPEC if the address is INADDR_ANY
*/
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 094/374] crypto: virtio - Handle dataq logic with tasklet
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 093/374] selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 095/374] crypto: sa2ul - Return crypto_aead_setkey to transfer the error Greg Kroah-Hartman
` (280 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Halil Pasic, wangyangxin, Gonglei,
Herbert Xu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gonglei (Arei) <arei.gonglei@huawei.com>
[ Upstream commit fed93fb62e05c38152b0fc1dc9609639e63eed76 ]
Doing ipsec produces a spinlock recursion warning.
This is due to crypto_finalize_request() being called in the upper half.
Move virtual data queue processing of virtio-crypto driver to tasklet.
Fixes: dbaf0624ffa57 ("crypto: add virtio-crypto driver")
Reported-by: Halil Pasic <pasic@linux.ibm.com>
Signed-off-by: wangyangxin <wangyangxin1@huawei.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/virtio/virtio_crypto_common.h | 2 ++
drivers/crypto/virtio/virtio_crypto_core.c | 23 +++++++++++---------
2 files changed, 15 insertions(+), 10 deletions(-)
diff --git a/drivers/crypto/virtio/virtio_crypto_common.h b/drivers/crypto/virtio/virtio_crypto_common.h
index a24f85c589e7..faa804a15299 100644
--- a/drivers/crypto/virtio/virtio_crypto_common.h
+++ b/drivers/crypto/virtio/virtio_crypto_common.h
@@ -10,6 +10,7 @@
#include <linux/virtio.h>
#include <linux/crypto.h>
#include <linux/spinlock.h>
+#include <linux/interrupt.h>
#include <crypto/aead.h>
#include <crypto/aes.h>
#include <crypto/engine.h>
@@ -27,6 +28,7 @@ struct data_queue {
char name[32];
struct crypto_engine *engine;
+ struct tasklet_struct done_task;
};
struct virtio_crypto {
diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
index e2375d992308..370c47c8a67a 100644
--- a/drivers/crypto/virtio/virtio_crypto_core.c
+++ b/drivers/crypto/virtio/virtio_crypto_core.c
@@ -22,27 +22,28 @@ virtcrypto_clear_request(struct virtio_crypto_request *vc_req)
}
}
-static void virtcrypto_dataq_callback(struct virtqueue *vq)
+static void virtcrypto_done_task(unsigned long data)
{
- struct virtio_crypto *vcrypto = vq->vdev->priv;
+ struct data_queue *data_vq = (struct data_queue *)data;
+ struct virtqueue *vq = data_vq->vq;
struct virtio_crypto_request *vc_req;
- unsigned long flags;
unsigned int len;
- unsigned int qid = vq->index;
- spin_lock_irqsave(&vcrypto->data_vq[qid].lock, flags);
do {
virtqueue_disable_cb(vq);
while ((vc_req = virtqueue_get_buf(vq, &len)) != NULL) {
- spin_unlock_irqrestore(
- &vcrypto->data_vq[qid].lock, flags);
if (vc_req->alg_cb)
vc_req->alg_cb(vc_req, len);
- spin_lock_irqsave(
- &vcrypto->data_vq[qid].lock, flags);
}
} while (!virtqueue_enable_cb(vq));
- spin_unlock_irqrestore(&vcrypto->data_vq[qid].lock, flags);
+}
+
+static void virtcrypto_dataq_callback(struct virtqueue *vq)
+{
+ struct virtio_crypto *vcrypto = vq->vdev->priv;
+ struct data_queue *dq = &vcrypto->data_vq[vq->index];
+
+ tasklet_schedule(&dq->done_task);
}
static int virtcrypto_find_vqs(struct virtio_crypto *vi)
@@ -99,6 +100,8 @@ static int virtcrypto_find_vqs(struct virtio_crypto *vi)
ret = -ENOMEM;
goto err_engine;
}
+ tasklet_init(&vi->data_vq[i].done_task, virtcrypto_done_task,
+ (unsigned long)&vi->data_vq[i]);
}
kfree(names);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 095/374] crypto: sa2ul - Return crypto_aead_setkey to transfer the error
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 094/374] crypto: virtio - Handle dataq logic with tasklet Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 096/374] crypto: ccp - fix memleak in ccp_init_dm_workarea Greg Kroah-Hartman
` (279 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chen Ni, Herbert Xu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen Ni <nichen@iscas.ac.cn>
[ Upstream commit ce852f1308ac738e61c5b2502517deea593a1554 ]
Return crypto_aead_setkey() in order to transfer the error if
it fails.
Fixes: d2c8ac187fc9 ("crypto: sa2ul - Add AEAD algorithm support")
Signed-off-by: Chen Ni <nichen@iscas.ac.cn>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sa2ul.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/crypto/sa2ul.c b/drivers/crypto/sa2ul.c
index 544d7040cfc5..91ab33690ccf 100644
--- a/drivers/crypto/sa2ul.c
+++ b/drivers/crypto/sa2ul.c
@@ -1868,9 +1868,8 @@ static int sa_aead_setkey(struct crypto_aead *authenc,
crypto_aead_set_flags(ctx->fallback.aead,
crypto_aead_get_flags(authenc) &
CRYPTO_TFM_REQ_MASK);
- crypto_aead_setkey(ctx->fallback.aead, key, keylen);
- return 0;
+ return crypto_aead_setkey(ctx->fallback.aead, key, keylen);
}
static int sa_aead_setauthsize(struct crypto_aead *tfm, unsigned int authsize)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 096/374] crypto: ccp - fix memleak in ccp_init_dm_workarea
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 095/374] crypto: sa2ul - Return crypto_aead_setkey to transfer the error Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 097/374] crypto: af_alg - Disallow multiple in-flight AIO requests Greg Kroah-Hartman
` (278 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dinghao Liu, Tom Lendacky,
Herbert Xu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dinghao Liu <dinghao.liu@zju.edu.cn>
[ Upstream commit a1c95dd5bc1d6a5d7a75a376c2107421b7d6240d ]
When dma_map_single() fails, wa->address is supposed to be freed
by the callers of ccp_init_dm_workarea() through ccp_dm_free().
However, many of the call spots don't expect to have to call
ccp_dm_free() on failure of ccp_init_dm_workarea(), which may
lead to a memleak. Let's free wa->address in ccp_init_dm_workarea()
when dma_map_single() fails.
Fixes: 63b945091a07 ("crypto: ccp - CCP device driver and interface support")
Signed-off-by: Dinghao Liu <dinghao.liu@zju.edu.cn>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/ccp/ccp-ops.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/ccp/ccp-ops.c b/drivers/crypto/ccp/ccp-ops.c
index aa4e1a500691..cb8e99936abb 100644
--- a/drivers/crypto/ccp/ccp-ops.c
+++ b/drivers/crypto/ccp/ccp-ops.c
@@ -179,8 +179,11 @@ static int ccp_init_dm_workarea(struct ccp_dm_workarea *wa,
wa->dma.address = dma_map_single(wa->dev, wa->address, len,
dir);
- if (dma_mapping_error(wa->dev, wa->dma.address))
+ if (dma_mapping_error(wa->dev, wa->dma.address)) {
+ kfree(wa->address);
+ wa->address = NULL;
return -ENOMEM;
+ }
wa->dma.length = len;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 097/374] crypto: af_alg - Disallow multiple in-flight AIO requests
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 096/374] crypto: ccp - fix memleak in ccp_init_dm_workarea Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 098/374] crypto: sahara - remove FLAGS_NEW_KEY logic Greg Kroah-Hartman
` (277 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Herbert Xu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Herbert Xu <herbert@gondor.apana.org.au>
[ Upstream commit 67b164a871af1d736f131fd6fe78a610909f06f3 ]
Having multiple in-flight AIO requests results in unpredictable
output because they all share the same IV. Fix this by only allowing
one request at a time.
Fixes: 83094e5e9e49 ("crypto: af_alg - add async support to algif_aead")
Fixes: a596999b7ddf ("crypto: algif - change algif_skcipher to be asynchronous")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/af_alg.c | 14 +++++++++++++-
include/crypto/if_alg.h | 3 +++
2 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/crypto/af_alg.c b/crypto/af_alg.c
index 8bd288d2b089..aa93501e27b9 100644
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@ -1045,9 +1045,13 @@ EXPORT_SYMBOL_GPL(af_alg_sendpage);
void af_alg_free_resources(struct af_alg_async_req *areq)
{
struct sock *sk = areq->sk;
+ struct af_alg_ctx *ctx;
af_alg_free_areq_sgls(areq);
sock_kfree_s(sk, areq, areq->areqlen);
+
+ ctx = alg_sk(sk)->private;
+ ctx->inflight = false;
}
EXPORT_SYMBOL_GPL(af_alg_free_resources);
@@ -1117,11 +1121,19 @@ EXPORT_SYMBOL_GPL(af_alg_poll);
struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
unsigned int areqlen)
{
- struct af_alg_async_req *areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
+ struct af_alg_ctx *ctx = alg_sk(sk)->private;
+ struct af_alg_async_req *areq;
+
+ /* Only one AIO request can be in flight. */
+ if (ctx->inflight)
+ return ERR_PTR(-EBUSY);
+ areq = sock_kmalloc(sk, areqlen, GFP_KERNEL);
if (unlikely(!areq))
return ERR_PTR(-ENOMEM);
+ ctx->inflight = true;
+
areq->areqlen = areqlen;
areq->sk = sk;
areq->last_rsgl = NULL;
diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h
index a5db86670bdf..a406e281ae57 100644
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@ -138,6 +138,7 @@ struct af_alg_async_req {
* recvmsg is invoked.
* @init: True if metadata has been sent.
* @len: Length of memory allocated for this data structure.
+ * @inflight: Non-zero when AIO requests are in flight.
*/
struct af_alg_ctx {
struct list_head tsgl_list;
@@ -156,6 +157,8 @@ struct af_alg_ctx {
bool init;
unsigned int len;
+
+ unsigned int inflight;
};
int af_alg_register_type(const struct af_alg_type *type);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 098/374] crypto: sahara - remove FLAGS_NEW_KEY logic
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 097/374] crypto: af_alg - Disallow multiple in-flight AIO requests Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 099/374] crypto: sahara - fix cbc selftest failure Greg Kroah-Hartman
` (276 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 8fd183435728b139248a77978ea3732039341779 ]
Remove the FLAGS_NEW_KEY logic as it has the following issues:
- the wrong key may end up being used when there are multiple data streams:
t1 t2
setkey()
encrypt()
setkey()
encrypt()
encrypt() <--- key from t2 is used
- switching between encryption and decryption with the same key is not
possible, as the hdr flags are only updated when a new setkey() is
performed
With this change, the key is always sent along with the cryptdata when
performing encryption/decryption operations.
Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 34 +++++++++++++---------------------
1 file changed, 13 insertions(+), 21 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index b07ae4ba165e..84a7c4de537a 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -44,7 +44,6 @@
#define FLAGS_MODE_MASK 0x000f
#define FLAGS_ENCRYPT BIT(0)
#define FLAGS_CBC BIT(1)
-#define FLAGS_NEW_KEY BIT(3)
#define SAHARA_HDR_BASE 0x00800000
#define SAHARA_HDR_SKHA_ALG_AES 0
@@ -142,8 +141,6 @@ struct sahara_hw_link {
};
struct sahara_ctx {
- unsigned long flags;
-
/* AES-specific context */
int keylen;
u8 key[AES_KEYSIZE_128];
@@ -448,26 +445,22 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
int i, j;
int idx = 0;
- /* Copy new key if necessary */
- if (ctx->flags & FLAGS_NEW_KEY) {
- memcpy(dev->key_base, ctx->key, ctx->keylen);
- ctx->flags &= ~FLAGS_NEW_KEY;
+ memcpy(dev->key_base, ctx->key, ctx->keylen);
- if (dev->flags & FLAGS_CBC) {
- dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
- dev->hw_desc[idx]->p1 = dev->iv_phys_base;
- } else {
- dev->hw_desc[idx]->len1 = 0;
- dev->hw_desc[idx]->p1 = 0;
- }
- dev->hw_desc[idx]->len2 = ctx->keylen;
- dev->hw_desc[idx]->p2 = dev->key_phys_base;
- dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
+ if (dev->flags & FLAGS_CBC) {
+ dev->hw_desc[idx]->len1 = AES_BLOCK_SIZE;
+ dev->hw_desc[idx]->p1 = dev->iv_phys_base;
+ } else {
+ dev->hw_desc[idx]->len1 = 0;
+ dev->hw_desc[idx]->p1 = 0;
+ }
+ dev->hw_desc[idx]->len2 = ctx->keylen;
+ dev->hw_desc[idx]->p2 = dev->key_phys_base;
+ dev->hw_desc[idx]->next = dev->hw_phys_desc[1];
+ dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
- dev->hw_desc[idx]->hdr = sahara_aes_key_hdr(dev);
+ idx++;
- idx++;
- }
dev->nb_in_sg = sg_nents_for_len(dev->in_sg, dev->total);
if (dev->nb_in_sg < 0) {
@@ -609,7 +602,6 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,
/* SAHARA only supports 128bit keys */
if (keylen == AES_KEYSIZE_128) {
memcpy(ctx->key, key, keylen);
- ctx->flags |= FLAGS_NEW_KEY;
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 099/374] crypto: sahara - fix cbc selftest failure
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 098/374] crypto: sahara - remove FLAGS_NEW_KEY logic Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 100/374] crypto: sahara - fix ahash " Greg Kroah-Hartman
` (275 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 9f10bc28c0fb676ae58aa3bfa358db8f5de124bb ]
The kernel crypto API requires that all CBC implementations update the IV
buffer to contain the last ciphertext block.
This fixes the following cbc selftest error:
alg: skcipher: sahara-cbc-aes encryption test failed (wrong output IV) on
test vector 0, cfg="in-place (one sglist)"
Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 33 +++++++++++++++++++++++++++++++--
1 file changed, 31 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 84a7c4de537a..1f41c8eeb8fc 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -149,6 +149,7 @@ struct sahara_ctx {
struct sahara_aes_reqctx {
unsigned long mode;
+ u8 iv_out[AES_BLOCK_SIZE];
struct skcipher_request fallback_req; // keep at the end
};
@@ -542,8 +543,24 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
return -EINVAL;
}
+static void sahara_aes_cbc_update_iv(struct skcipher_request *req)
+{
+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
+ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
+
+ /* Update IV buffer to contain the last ciphertext block */
+ if (rctx->mode & FLAGS_ENCRYPT) {
+ sg_pcopy_to_buffer(req->dst, sg_nents(req->dst), req->iv,
+ ivsize, req->cryptlen - ivsize);
+ } else {
+ memcpy(req->iv, rctx->iv_out, ivsize);
+ }
+}
+
static int sahara_aes_process(struct skcipher_request *req)
{
+ struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
struct sahara_dev *dev = dev_ptr;
struct sahara_ctx *ctx;
struct sahara_aes_reqctx *rctx;
@@ -565,8 +582,17 @@ static int sahara_aes_process(struct skcipher_request *req)
rctx->mode &= FLAGS_MODE_MASK;
dev->flags = (dev->flags & ~FLAGS_MODE_MASK) | rctx->mode;
- if ((dev->flags & FLAGS_CBC) && req->iv)
- memcpy(dev->iv_base, req->iv, AES_KEYSIZE_128);
+ if ((dev->flags & FLAGS_CBC) && req->iv) {
+ unsigned int ivsize = crypto_skcipher_ivsize(skcipher);
+
+ memcpy(dev->iv_base, req->iv, ivsize);
+
+ if (!(dev->flags & FLAGS_ENCRYPT)) {
+ sg_pcopy_to_buffer(req->src, sg_nents(req->src),
+ rctx->iv_out, ivsize,
+ req->cryptlen - ivsize);
+ }
+ }
/* assign new context to device */
dev->ctx = ctx;
@@ -589,6 +615,9 @@ static int sahara_aes_process(struct skcipher_request *req)
dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
DMA_TO_DEVICE);
+ if ((dev->flags & FLAGS_CBC) && req->iv)
+ sahara_aes_cbc_update_iv(req);
+
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 100/374] crypto: sahara - fix ahash selftest failure
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 099/374] crypto: sahara - fix cbc selftest failure Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 101/374] crypto: sahara - fix processing requests with cryptlen < sg->length Greg Kroah-Hartman
` (274 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit afffcf3db98b9495114b79d5381f8cc3f69476fb ]
update() calls should not modify the result buffer, so add an additional
check for "rctx->last" to make sure that only the final hash value is
copied into the buffer.
Fixes the following selftest failure:
alg: ahash: sahara-sha256 update() used result buffer on test vector 3,
cfg="init+update+final aligned buffer"
Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 1f41c8eeb8fc..2b20d1767ef9 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -1048,7 +1048,7 @@ static int sahara_sha_process(struct ahash_request *req)
memcpy(rctx->context, dev->context_base, rctx->context_size);
- if (req->result)
+ if (req->result && rctx->last)
memcpy(req->result, rctx->context, rctx->digest_size);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 101/374] crypto: sahara - fix processing requests with cryptlen < sg->length
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 100/374] crypto: sahara - fix ahash " Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 102/374] crypto: sahara - fix error handling in sahara_hw_descriptor_create() Greg Kroah-Hartman
` (273 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 5b8668ce3452827d27f8c34ff6ba080a8f983ed0 ]
It's not always the case that the entire sg entry needs to be processed.
Currently, when cryptlen is less than sg->legth, "Descriptor length" errors
are encountered.
The error was noticed when testing xts(sahara-ecb-aes) with arbitrary sized
input data. To fix this, take the actual request size into account when
populating the hw links.
Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 2b20d1767ef9..caa54d5312e9 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -445,6 +445,7 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
int ret;
int i, j;
int idx = 0;
+ u32 len;
memcpy(dev->key_base, ctx->key, ctx->keylen);
@@ -495,12 +496,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
/* Create input links */
dev->hw_desc[idx]->p1 = dev->hw_phys_link[0];
sg = dev->in_sg;
+ len = dev->total;
for (i = 0; i < dev->nb_in_sg; i++) {
- dev->hw_link[i]->len = sg->length;
+ dev->hw_link[i]->len = min(len, sg->length);
dev->hw_link[i]->p = sg->dma_address;
if (i == (dev->nb_in_sg - 1)) {
dev->hw_link[i]->next = 0;
} else {
+ len -= min(len, sg->length);
dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
sg = sg_next(sg);
}
@@ -509,12 +512,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
/* Create output links */
dev->hw_desc[idx]->p2 = dev->hw_phys_link[i];
sg = dev->out_sg;
+ len = dev->total;
for (j = i; j < dev->nb_out_sg + i; j++) {
- dev->hw_link[j]->len = sg->length;
+ dev->hw_link[j]->len = min(len, sg->length);
dev->hw_link[j]->p = sg->dma_address;
if (j == (dev->nb_out_sg + i - 1)) {
dev->hw_link[j]->next = 0;
} else {
+ len -= min(len, sg->length);
dev->hw_link[j]->next = dev->hw_phys_link[j + 1];
sg = sg_next(sg);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 102/374] crypto: sahara - fix error handling in sahara_hw_descriptor_create()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 101/374] crypto: sahara - fix processing requests with cryptlen < sg->length Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 103/374] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() Greg Kroah-Hartman
` (272 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit ee6e6f0a7f5b39d50a5ef5fcc006f4f693db18a7 ]
Do not call dma_unmap_sg() for scatterlists that were not mapped
successfully.
Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 8 +++-----
1 file changed, 3 insertions(+), 5 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index caa54d5312e9..f9fd64178a59 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -484,13 +484,14 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
DMA_TO_DEVICE);
if (ret != dev->nb_in_sg) {
dev_err(dev->device, "couldn't map in sg\n");
- goto unmap_in;
+ return -EINVAL;
}
+
ret = dma_map_sg(dev->device, dev->out_sg, dev->nb_out_sg,
DMA_FROM_DEVICE);
if (ret != dev->nb_out_sg) {
dev_err(dev->device, "couldn't map out sg\n");
- goto unmap_out;
+ goto unmap_in;
}
/* Create input links */
@@ -538,9 +539,6 @@ static int sahara_hw_descriptor_create(struct sahara_dev *dev)
return 0;
-unmap_out:
- dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
- DMA_FROM_DEVICE);
unmap_in:
dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
DMA_TO_DEVICE);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 103/374] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 102/374] crypto: sahara - fix error handling in sahara_hw_descriptor_create() Greg Kroah-Hartman
@ 2024-01-22 23:55 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 104/374] fs: indicate request originates from old mount API Greg Kroah-Hartman
` (271 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:55 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sergey Shtylyov, Kees Cook,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Shtylyov <s.shtylyov@omp.ru>
[ Upstream commit 86222a8fc16ec517de8da2604d904c9df3a08e5d ]
In persistent_ram_init_ecc(), on 64-bit arches DIV_ROUND_UP() will return
64-bit value since persistent_ram_zone::buffer_size has type size_t which
is derived from the 64-bit *unsigned long*, while the ecc_blocks variable
this value gets assigned to has (always 32-bit) *int* type. Even if that
value fits into *int* type, an overflow is still possible when calculating
the size_t typed ecc_total variable further below since there's no cast to
any 64-bit type before multiplication. Declaring the ecc_blocks variable
as *size_t* should fix this mess...
Found by Linux Verification Center (linuxtesting.org) with the SVACE static
analysis tool.
Fixes: 9cc05ad97c57 ("staging: android: persistent_ram: refactor ecc support")
Signed-off-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Link: https://lore.kernel.org/r/20231105202936.25694-1-s.shtylyov@omp.ru
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/pstore/ram_core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c
index ccdb71c3dc51..ec321722384d 100644
--- a/fs/pstore/ram_core.c
+++ b/fs/pstore/ram_core.c
@@ -190,7 +190,7 @@ static int persistent_ram_init_ecc(struct persistent_ram_zone *prz,
{
int numerr;
struct persistent_ram_buffer *buffer = prz->buffer;
- int ecc_blocks;
+ size_t ecc_blocks;
size_t ecc_total;
if (!ecc_info || !ecc_info->ecc_size)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 104/374] fs: indicate request originates from old mount API
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2024-01-22 23:55 ` [PATCH 5.15 103/374] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 105/374] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Greg Kroah-Hartman
` (270 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig,
Johannes Thumshirn, Anand Jain, Christian Brauner, Josef Bacik,
David Sterba, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Brauner <brauner@kernel.org>
[ Upstream commit f67d922edb4e95a4a56d07d5d40a76dd4f23a85b ]
We already communicate to filesystems when a remount request comes from
the old mount API as some filesystems choose to implement different
behavior in the new mount API than the old mount API to e.g., take the
chance to fix significant API bugs. Allow the same for regular mount
requests.
Fixes: b330966f79fb ("fuse: reject options on reconfigure via fsconfig(2)")
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/namespace.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/fs/namespace.c b/fs/namespace.c
index 1a9df6afb90b..932986448a98 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -2647,7 +2647,12 @@ static int do_remount(struct path *path, int ms_flags, int sb_flags,
if (IS_ERR(fc))
return PTR_ERR(fc);
+ /*
+ * Indicate to the filesystem that the remount request is coming
+ * from the legacy mount system call.
+ */
fc->oldapi = true;
+
err = parse_monolithic_mount_data(fc, data);
if (!err) {
down_write(&sb->s_umount);
@@ -2981,6 +2986,12 @@ static int do_new_mount(struct path *path, const char *fstype, int sb_flags,
if (IS_ERR(fc))
return PTR_ERR(fc);
+ /*
+ * Indicate to the filesystem that the mount request is coming
+ * from the legacy mount system call.
+ */
+ fc->oldapi = true;
+
if (subtype)
err = vfs_parse_fs_string(fc, "subtype",
subtype, strlen(subtype));
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 105/374] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 104/374] fs: indicate request originates from old mount API Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 106/374] crypto: virtio - Wait for tasklet to complete on device remove Greg Kroah-Hartman
` (269 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Osama Muhammad, Andreas Gruenbacher,
Sasha Levin, syzbot+da0fc229cc1ff4bb2e6d
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Osama Muhammad <osmtendev@gmail.com>
[ Upstream commit 8877243beafa7c6bfc42022cbfdf9e39b25bd4fa ]
Syzkaller has reported a NULL pointer dereference when accessing
rgd->rd_rgl in gfs2_rgrp_dump(). This can happen when creating
rgd->rd_gl fails in read_rindex_entry(). Add a NULL pointer check in
gfs2_rgrp_dump() to prevent that.
Reported-and-tested-by: syzbot+da0fc229cc1ff4bb2e6d@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=da0fc229cc1ff4bb2e6d
Fixes: 72244b6bc752 ("gfs2: improve debug information when lvb mismatches are found")
Signed-off-by: Osama Muhammad <osmtendev@gmail.com>
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/gfs2/rgrp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/gfs2/rgrp.c b/fs/gfs2/rgrp.c
index 6901cd85f1df..e4e85010ab5b 100644
--- a/fs/gfs2/rgrp.c
+++ b/fs/gfs2/rgrp.c
@@ -2316,7 +2316,7 @@ void gfs2_rgrp_dump(struct seq_file *seq, struct gfs2_rgrpd *rgd,
(unsigned long long)rgd->rd_addr, rgd->rd_flags,
rgd->rd_free, rgd->rd_free_clone, rgd->rd_dinodes,
rgd->rd_requested, rgd->rd_reserved, rgd->rd_extfail_pt);
- if (rgd->rd_sbd->sd_args.ar_rgrplvb) {
+ if (rgd->rd_sbd->sd_args.ar_rgrplvb && rgd->rd_rgl) {
struct gfs2_rgrp_lvb *rgl = rgd->rd_rgl;
gfs2_print_dbg(seq, "%s L: f:%02x b:%u i:%u\n", fs_id_buf,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 106/374] crypto: virtio - Wait for tasklet to complete on device remove
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 105/374] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 107/374] crypto: sahara - avoid skcipher fallback code duplication Greg Kroah-Hartman
` (268 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, wangyangxin, Gonglei, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: wangyangxin <wangyangxin1@huawei.com>
[ Upstream commit 67cc511e8d436456cc98033e6d4ba83ebfc8e672 ]
The scheduled tasklet needs to be executed on device remove.
Fixes: fed93fb62e05 ("crypto: virtio - Handle dataq logic with tasklet")
Signed-off-by: wangyangxin <wangyangxin1@huawei.com>
Signed-off-by: Gonglei <arei.gonglei@huawei.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/virtio/virtio_crypto_core.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/crypto/virtio/virtio_crypto_core.c b/drivers/crypto/virtio/virtio_crypto_core.c
index 370c47c8a67a..f1eff8f752cd 100644
--- a/drivers/crypto/virtio/virtio_crypto_core.c
+++ b/drivers/crypto/virtio/virtio_crypto_core.c
@@ -434,11 +434,14 @@ static void virtcrypto_free_unused_reqs(struct virtio_crypto *vcrypto)
static void virtcrypto_remove(struct virtio_device *vdev)
{
struct virtio_crypto *vcrypto = vdev->priv;
+ int i;
dev_info(&vdev->dev, "Start virtcrypto_remove.\n");
if (virtcrypto_dev_started(vcrypto))
virtcrypto_dev_stop(vcrypto);
+ for (i = 0; i < vcrypto->max_data_queues; i++)
+ tasklet_kill(&vcrypto->data_vq[i].done_task);
vdev->config->reset(vdev);
virtcrypto_free_unused_reqs(vcrypto);
virtcrypto_clear_crypto_engines(vcrypto);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 107/374] crypto: sahara - avoid skcipher fallback code duplication
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 106/374] crypto: virtio - Wait for tasklet to complete on device remove Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 108/374] crypto: sahara - handle zero-length aes requests Greg Kroah-Hartman
` (267 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 01d70a4bbff20ea05cadb4c208841985a7cc6596 ]
Factor out duplicated skcipher fallback handling code to a helper function
sahara_aes_fallback(). Also, keep a single check if fallback is required in
sahara_aes_crypt().
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Stable-dep-of: d1d6351e37aa ("crypto: sahara - handle zero-length aes requests")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 85 ++++++++++++-----------------------------
1 file changed, 25 insertions(+), 60 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index f9fd64178a59..bbd2c6474b50 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -649,12 +649,37 @@ static int sahara_aes_setkey(struct crypto_skcipher *tfm, const u8 *key,
return crypto_skcipher_setkey(ctx->fallback, key, keylen);
}
+static int sahara_aes_fallback(struct skcipher_request *req, unsigned long mode)
+{
+ struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+ struct sahara_ctx *ctx = crypto_skcipher_ctx(
+ crypto_skcipher_reqtfm(req));
+
+ skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
+ skcipher_request_set_callback(&rctx->fallback_req,
+ req->base.flags,
+ req->base.complete,
+ req->base.data);
+ skcipher_request_set_crypt(&rctx->fallback_req, req->src,
+ req->dst, req->cryptlen, req->iv);
+
+ if (mode & FLAGS_ENCRYPT)
+ return crypto_skcipher_encrypt(&rctx->fallback_req);
+
+ return crypto_skcipher_decrypt(&rctx->fallback_req);
+}
+
static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
{
struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
+ struct sahara_ctx *ctx = crypto_skcipher_ctx(
+ crypto_skcipher_reqtfm(req));
struct sahara_dev *dev = dev_ptr;
int err = 0;
+ if (unlikely(ctx->keylen != AES_KEYSIZE_128))
+ return sahara_aes_fallback(req, mode);
+
dev_dbg(dev->device, "nbytes: %d, enc: %d, cbc: %d\n",
req->cryptlen, !!(mode & FLAGS_ENCRYPT), !!(mode & FLAGS_CBC));
@@ -677,81 +702,21 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
static int sahara_aes_ecb_encrypt(struct skcipher_request *req)
{
- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
- struct sahara_ctx *ctx = crypto_skcipher_ctx(
- crypto_skcipher_reqtfm(req));
-
- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
- skcipher_request_set_callback(&rctx->fallback_req,
- req->base.flags,
- req->base.complete,
- req->base.data);
- skcipher_request_set_crypt(&rctx->fallback_req, req->src,
- req->dst, req->cryptlen, req->iv);
- return crypto_skcipher_encrypt(&rctx->fallback_req);
- }
-
return sahara_aes_crypt(req, FLAGS_ENCRYPT);
}
static int sahara_aes_ecb_decrypt(struct skcipher_request *req)
{
- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
- struct sahara_ctx *ctx = crypto_skcipher_ctx(
- crypto_skcipher_reqtfm(req));
-
- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
- skcipher_request_set_callback(&rctx->fallback_req,
- req->base.flags,
- req->base.complete,
- req->base.data);
- skcipher_request_set_crypt(&rctx->fallback_req, req->src,
- req->dst, req->cryptlen, req->iv);
- return crypto_skcipher_decrypt(&rctx->fallback_req);
- }
-
return sahara_aes_crypt(req, 0);
}
static int sahara_aes_cbc_encrypt(struct skcipher_request *req)
{
- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
- struct sahara_ctx *ctx = crypto_skcipher_ctx(
- crypto_skcipher_reqtfm(req));
-
- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
- skcipher_request_set_callback(&rctx->fallback_req,
- req->base.flags,
- req->base.complete,
- req->base.data);
- skcipher_request_set_crypt(&rctx->fallback_req, req->src,
- req->dst, req->cryptlen, req->iv);
- return crypto_skcipher_encrypt(&rctx->fallback_req);
- }
-
return sahara_aes_crypt(req, FLAGS_ENCRYPT | FLAGS_CBC);
}
static int sahara_aes_cbc_decrypt(struct skcipher_request *req)
{
- struct sahara_aes_reqctx *rctx = skcipher_request_ctx(req);
- struct sahara_ctx *ctx = crypto_skcipher_ctx(
- crypto_skcipher_reqtfm(req));
-
- if (unlikely(ctx->keylen != AES_KEYSIZE_128)) {
- skcipher_request_set_tfm(&rctx->fallback_req, ctx->fallback);
- skcipher_request_set_callback(&rctx->fallback_req,
- req->base.flags,
- req->base.complete,
- req->base.data);
- skcipher_request_set_crypt(&rctx->fallback_req, req->src,
- req->dst, req->cryptlen, req->iv);
- return crypto_skcipher_decrypt(&rctx->fallback_req);
- }
-
return sahara_aes_crypt(req, FLAGS_CBC);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 108/374] crypto: sahara - handle zero-length aes requests
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 107/374] crypto: sahara - avoid skcipher fallback code duplication Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 109/374] crypto: sahara - fix ahash reqsize Greg Kroah-Hartman
` (266 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit d1d6351e37aac14b32a291731d0855996c459d11 ]
In case of a zero-length input, exit gracefully from sahara_aes_crypt().
Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index bbd2c6474b50..3229dd180d0c 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -677,6 +677,9 @@ static int sahara_aes_crypt(struct skcipher_request *req, unsigned long mode)
struct sahara_dev *dev = dev_ptr;
int err = 0;
+ if (!req->cryptlen)
+ return 0;
+
if (unlikely(ctx->keylen != AES_KEYSIZE_128))
return sahara_aes_fallback(req, mode);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 109/374] crypto: sahara - fix ahash reqsize
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 108/374] crypto: sahara - handle zero-length aes requests Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 110/374] crypto: sahara - fix wait_for_completion_timeout() error handling Greg Kroah-Hartman
` (265 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit efcb50f41740ac55e6ccc4986c1a7740e21c62b4 ]
Set the reqsize for sha algorithms to sizeof(struct sahara_sha_reqctx), the
extra space is not needed.
Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 3229dd180d0c..d31ccaffebb8 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -1163,8 +1163,7 @@ static int sahara_sha_import(struct ahash_request *req, const void *in)
static int sahara_sha_cra_init(struct crypto_tfm *tfm)
{
crypto_ahash_set_reqsize(__crypto_ahash_cast(tfm),
- sizeof(struct sahara_sha_reqctx) +
- SHA_BUFFER_LEN + SHA256_BLOCK_SIZE);
+ sizeof(struct sahara_sha_reqctx));
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 110/374] crypto: sahara - fix wait_for_completion_timeout() error handling
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 109/374] crypto: sahara - fix ahash reqsize Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 111/374] crypto: sahara - improve error handling in sahara_sha_process() Greg Kroah-Hartman
` (264 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 2dba8e1d1a7957dcbe7888846268538847b471d1 ]
The sg lists are not unmapped in case of timeout errors. Fix this.
Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
Fixes: 5de8875281e1 ("crypto: sahara - Add driver for SAHARA2 accelerator.")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 18 ++++++++++--------
1 file changed, 10 insertions(+), 8 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index d31ccaffebb8..a5c40ef6d8af 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -608,16 +608,17 @@ static int sahara_aes_process(struct skcipher_request *req)
timeout = wait_for_completion_timeout(&dev->dma_completion,
msecs_to_jiffies(SAHARA_TIMEOUT_MS));
- if (!timeout) {
- dev_err(dev->device, "AES timeout\n");
- return -ETIMEDOUT;
- }
dma_unmap_sg(dev->device, dev->out_sg, dev->nb_out_sg,
DMA_FROM_DEVICE);
dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
DMA_TO_DEVICE);
+ if (!timeout) {
+ dev_err(dev->device, "AES timeout\n");
+ return -ETIMEDOUT;
+ }
+
if ((dev->flags & FLAGS_CBC) && req->iv)
sahara_aes_cbc_update_iv(req);
@@ -1008,15 +1009,16 @@ static int sahara_sha_process(struct ahash_request *req)
timeout = wait_for_completion_timeout(&dev->dma_completion,
msecs_to_jiffies(SAHARA_TIMEOUT_MS));
- if (!timeout) {
- dev_err(dev->device, "SHA timeout\n");
- return -ETIMEDOUT;
- }
if (rctx->sg_in_idx)
dma_unmap_sg(dev->device, dev->in_sg, dev->nb_in_sg,
DMA_TO_DEVICE);
+ if (!timeout) {
+ dev_err(dev->device, "SHA timeout\n");
+ return -ETIMEDOUT;
+ }
+
memcpy(rctx->context, dev->context_base, rctx->context_size);
if (req->result && rctx->last)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 111/374] crypto: sahara - improve error handling in sahara_sha_process()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 110/374] crypto: sahara - fix wait_for_completion_timeout() error handling Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 112/374] crypto: sahara - fix processing hash requests with req->nbytes < sg->length Greg Kroah-Hartman
` (263 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 5deff027fca49a1eb3b20359333cf2ae562a2343 ]
sahara_sha_hw_data_descriptor_create() returns negative error codes on
failure, so make sure the errors are correctly handled / propagated.
Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index a5c40ef6d8af..434c7e17d273 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -988,7 +988,10 @@ static int sahara_sha_process(struct ahash_request *req)
return ret;
if (rctx->first) {
- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
+ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 0);
+ if (ret)
+ return ret;
+
dev->hw_desc[0]->next = 0;
rctx->first = 0;
} else {
@@ -996,7 +999,10 @@ static int sahara_sha_process(struct ahash_request *req)
sahara_sha_hw_context_descriptor_create(dev, rctx, req, 0);
dev->hw_desc[0]->next = dev->hw_phys_desc[1];
- sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
+ ret = sahara_sha_hw_data_descriptor_create(dev, rctx, req, 1);
+ if (ret)
+ return ret;
+
dev->hw_desc[1]->next = 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 112/374] crypto: sahara - fix processing hash requests with req->nbytes < sg->length
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 111/374] crypto: sahara - improve error handling in sahara_sha_process() Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 113/374] crypto: sahara - do not resize req->src when doing hash operations Greg Kroah-Hartman
` (262 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit 7bafa74d1ba35dcc173e1ce915e983d65905f77e ]
It's not always the case that the entire sg entry needs to be processed.
Currently, when nbytes is less than sg->length, "Descriptor length" errors
are encountered.
To fix this, take the actual request size into account when populating the
hw links.
Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 434c7e17d273..538beec3b062 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -777,6 +777,7 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
int start)
{
struct scatterlist *sg;
+ unsigned int len;
unsigned int i;
int ret;
@@ -798,12 +799,14 @@ static int sahara_sha_hw_links_create(struct sahara_dev *dev,
if (!ret)
return -EFAULT;
+ len = rctx->total;
for (i = start; i < dev->nb_in_sg + start; i++) {
- dev->hw_link[i]->len = sg->length;
+ dev->hw_link[i]->len = min(len, sg->length);
dev->hw_link[i]->p = sg->dma_address;
if (i == (dev->nb_in_sg + start - 1)) {
dev->hw_link[i]->next = 0;
} else {
+ len -= min(len, sg->length);
dev->hw_link[i]->next = dev->hw_phys_link[i + 1];
sg = sg_next(sg);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 113/374] crypto: sahara - do not resize req->src when doing hash operations
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 112/374] crypto: sahara - fix processing hash requests with req->nbytes < sg->length Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 114/374] crypto: scomp - fix req->dst buffer overflow Greg Kroah-Hartman
` (261 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ovidiu Panait, Herbert Xu,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Panait <ovidiu.panait@windriver.com>
[ Upstream commit a3c6f4f4d249cecaf2f34471aadbfb4f4ef57298 ]
When testing sahara sha256 speed performance with tcrypt (mode=404) on
imx53-qsrb board, multiple "Invalid numbers of src SG." errors are
reported. This was traced to sahara_walk_and_recalc() resizing req->src
and causing the subsequent dma_map_sg() call to fail.
Now that the previous commit fixed sahara_sha_hw_links_create() to take
into account the actual request size, rather than relying on sg->length
values, the resize operation is no longer necessary.
Therefore, remove sahara_walk_and_recalc() and simplify associated logic.
Fixes: 5a2bb93f5992 ("crypto: sahara - add support for SHA1/256")
Signed-off-by: Ovidiu Panait <ovidiu.panait@windriver.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/crypto/sahara.c | 38 ++------------------------------------
1 file changed, 2 insertions(+), 36 deletions(-)
diff --git a/drivers/crypto/sahara.c b/drivers/crypto/sahara.c
index 538beec3b062..b9832978b935 100644
--- a/drivers/crypto/sahara.c
+++ b/drivers/crypto/sahara.c
@@ -887,24 +887,6 @@ static int sahara_sha_hw_context_descriptor_create(struct sahara_dev *dev,
return 0;
}
-static int sahara_walk_and_recalc(struct scatterlist *sg, unsigned int nbytes)
-{
- if (!sg || !sg->length)
- return nbytes;
-
- while (nbytes && sg) {
- if (nbytes <= sg->length) {
- sg->length = nbytes;
- sg_mark_end(sg);
- break;
- }
- nbytes -= sg->length;
- sg = sg_next(sg);
- }
-
- return nbytes;
-}
-
static int sahara_sha_prepare_request(struct ahash_request *req)
{
struct crypto_ahash *tfm = crypto_ahash_reqtfm(req);
@@ -941,36 +923,20 @@ static int sahara_sha_prepare_request(struct ahash_request *req)
hash_later, 0);
}
- /* nbytes should now be multiple of blocksize */
- req->nbytes = req->nbytes - hash_later;
-
- sahara_walk_and_recalc(req->src, req->nbytes);
-
+ rctx->total = len - hash_later;
/* have data from previous operation and current */
if (rctx->buf_cnt && req->nbytes) {
sg_init_table(rctx->in_sg_chain, 2);
sg_set_buf(rctx->in_sg_chain, rctx->rembuf, rctx->buf_cnt);
-
sg_chain(rctx->in_sg_chain, 2, req->src);
-
- rctx->total = req->nbytes + rctx->buf_cnt;
rctx->in_sg = rctx->in_sg_chain;
-
- req->src = rctx->in_sg_chain;
/* only data from previous operation */
} else if (rctx->buf_cnt) {
- if (req->src)
- rctx->in_sg = req->src;
- else
- rctx->in_sg = rctx->in_sg_chain;
- /* buf was copied into rembuf above */
+ rctx->in_sg = rctx->in_sg_chain;
sg_init_one(rctx->in_sg, rctx->rembuf, rctx->buf_cnt);
- rctx->total = rctx->buf_cnt;
/* no data from previous operation */
} else {
rctx->in_sg = req->src;
- rctx->total = req->nbytes;
- req->src = rctx->in_sg;
}
/* on next call, we only have the remaining data in the buffer */
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 114/374] crypto: scomp - fix req->dst buffer overflow
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 113/374] crypto: sahara - do not resize req->src when doing hash operations Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 115/374] blocklayoutdriver: Fix reference leak of pnfs_device_node Greg Kroah-Hartman
` (260 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3eff5e51bf1db122a16e,
Chengming Zhou, Barry Song, Herbert Xu, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chengming Zhou <zhouchengming@bytedance.com>
[ Upstream commit 744e1885922a9943458954cfea917b31064b4131 ]
The req->dst buffer size should be checked before copying from the
scomp_scratch->dst to avoid req->dst buffer overflow problem.
Fixes: 1ab53a77b772 ("crypto: acomp - add driver-side scomp interface")
Reported-by: syzbot+3eff5e51bf1db122a16e@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/0000000000000b05cd060d6b5511@google.com/
Signed-off-by: Chengming Zhou <zhouchengming@bytedance.com>
Reviewed-by: Barry Song <v-songbaohua@oppo.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
crypto/scompress.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/crypto/scompress.c b/crypto/scompress.c
index 738f4f8f0f41..4d6366a44400 100644
--- a/crypto/scompress.c
+++ b/crypto/scompress.c
@@ -124,6 +124,7 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
struct crypto_scomp *scomp = *tfm_ctx;
void **ctx = acomp_request_ctx(req);
struct scomp_scratch *scratch;
+ unsigned int dlen;
int ret;
if (!req->src || !req->slen || req->slen > SCOMP_SCRATCH_SIZE)
@@ -135,6 +136,8 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
if (!req->dlen || req->dlen > SCOMP_SCRATCH_SIZE)
req->dlen = SCOMP_SCRATCH_SIZE;
+ dlen = req->dlen;
+
scratch = raw_cpu_ptr(&scomp_scratch);
spin_lock(&scratch->lock);
@@ -152,6 +155,9 @@ static int scomp_acomp_comp_decomp(struct acomp_req *req, int dir)
ret = -ENOMEM;
goto out;
}
+ } else if (req->dlen > dlen) {
+ ret = -ENOSPC;
+ goto out;
}
scatterwalk_map_and_copy(scratch->dst, req->dst, 0, req->dlen,
1);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 115/374] blocklayoutdriver: Fix reference leak of pnfs_device_node
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 114/374] crypto: scomp - fix req->dst buffer overflow Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 116/374] NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT Greg Kroah-Hartman
` (259 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Coddington, Anna Schumaker,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Coddington <bcodding@redhat.com>
[ Upstream commit 1530827b90025cdf80c9b0d07a166d045a0a7b81 ]
The error path for blocklayout's device lookup is missing a reference drop
for the case where a lookup finds the device, but the device is marked with
NFS_DEVICEID_UNAVAILABLE.
Fixes: b3dce6a2f060 ("pnfs/blocklayout: handle transient devices")
Signed-off-by: Benjamin Coddington <bcodding@redhat.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/blocklayout/blocklayout.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c
index fe860c538747..dc657b12822d 100644
--- a/fs/nfs/blocklayout/blocklayout.c
+++ b/fs/nfs/blocklayout/blocklayout.c
@@ -599,6 +599,8 @@ bl_find_get_deviceid(struct nfs_server *server,
nfs4_delete_deviceid(node->ld, node->nfs_client, id);
goto retry;
}
+
+ nfs4_put_deviceid_node(node);
return ERR_PTR(-ENODEV);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 116/374] NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 115/374] blocklayoutdriver: Fix reference leak of pnfs_device_node Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 117/374] wifi: rtw88: fix RX filter in FIF_ALLMULTI flag Greg Kroah-Hartman
` (258 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Trond Myklebust, Anna Schumaker,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Trond Myklebust <trond.myklebust@hammerspace.com>
[ Upstream commit 037e56a22ff37f9a9c2330b66cff55d3d1ff9b90 ]
Once the client has processed the CB_LAYOUTRECALL, but has not yet
successfully returned the layout, the server is supposed to switch to
returning NFS4ERR_RETURNCONFLICT. This patch ensures that we handle
that return value correctly.
Fixes: 183d9e7b112a ("pnfs: rework LAYOUTGET retry handling")
Signed-off-by: Trond Myklebust <trond.myklebust@hammerspace.com>
Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/nfs/nfs4proc.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index d65af9a60c35..a865b384f0fc 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -173,6 +173,7 @@ static int nfs4_map_errors(int err)
case -NFS4ERR_RESOURCE:
case -NFS4ERR_LAYOUTTRYLATER:
case -NFS4ERR_RECALLCONFLICT:
+ case -NFS4ERR_RETURNCONFLICT:
return -EREMOTEIO;
case -NFS4ERR_WRONGSEC:
case -NFS4ERR_WRONG_CRED:
@@ -560,6 +561,7 @@ static int nfs4_do_handle_exception(struct nfs_server *server,
case -NFS4ERR_GRACE:
case -NFS4ERR_LAYOUTTRYLATER:
case -NFS4ERR_RECALLCONFLICT:
+ case -NFS4ERR_RETURNCONFLICT:
exception->delay = 1;
return 0;
@@ -9588,6 +9590,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
status = -EBUSY;
break;
case -NFS4ERR_RECALLCONFLICT:
+ case -NFS4ERR_RETURNCONFLICT:
status = -ERECALLCONFLICT;
break;
case -NFS4ERR_DELEG_REVOKED:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 117/374] wifi: rtw88: fix RX filter in FIF_ALLMULTI flag
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 116/374] NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 118/374] bpf, lpm: Fix check prefixlen before walking trie Greg Kroah-Hartman
` (257 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chih-Kang Chang, Ping-Ke Shih,
Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chih-Kang Chang <gary.chang@realtek.com>
[ Upstream commit 53ee0b3b99edc6a47096bffef15695f5a895386f ]
The broadcast packets will be filtered in the FIF_ALLMULTI flag in
the original code, which causes beacon packets to be filtered out
and disconnection. Therefore, we fix it.
Fixes: e3037485c68e ("rtw88: new Realtek 802.11ac driver")
Signed-off-by: Chih-Kang Chang <gary.chang@realtek.com>
Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231103020851.102238-1-pkshih@realtek.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtw88/mac80211.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtw88/mac80211.c b/drivers/net/wireless/realtek/rtw88/mac80211.c
index 6f5629852416..942bb2ab8b50 100644
--- a/drivers/net/wireless/realtek/rtw88/mac80211.c
+++ b/drivers/net/wireless/realtek/rtw88/mac80211.c
@@ -267,9 +267,9 @@ static void rtw_ops_configure_filter(struct ieee80211_hw *hw,
if (changed_flags & FIF_ALLMULTI) {
if (*new_flags & FIF_ALLMULTI)
- rtwdev->hal.rcr |= BIT_AM | BIT_AB;
+ rtwdev->hal.rcr |= BIT_AM;
else
- rtwdev->hal.rcr &= ~(BIT_AM | BIT_AB);
+ rtwdev->hal.rcr &= ~(BIT_AM);
}
if (changed_flags & FIF_FCSFAIL) {
if (*new_flags & FIF_FCSFAIL)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 118/374] bpf, lpm: Fix check prefixlen before walking trie
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 117/374] wifi: rtw88: fix RX filter in FIF_ALLMULTI flag Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 119/374] bpf: Add crosstask check to __bpf_get_stack Greg Kroah-Hartman
` (256 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Lehner, Andrii Nakryiko,
Alexei Starovoitov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Lehner <dev@der-flo.net>
[ Upstream commit 9b75dbeb36fcd9fc7ed51d370310d0518a387769 ]
When looking up an element in LPM trie, the condition 'matchlen ==
trie->max_prefixlen' will never return true, if key->prefixlen is larger
than trie->max_prefixlen. Consequently all elements in the LPM trie will
be visited and no element is returned in the end.
To resolve this, check key->prefixlen first before walking the LPM trie.
Fixes: b95a5c4db09b ("bpf: add a longest prefix match trie map implementation")
Signed-off-by: Florian Lehner <dev@der-flo.net>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231105085801.3742-1-dev@der-flo.net
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/lpm_trie.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c
index 423549d2c52e..4ea7fb0ca1ad 100644
--- a/kernel/bpf/lpm_trie.c
+++ b/kernel/bpf/lpm_trie.c
@@ -230,6 +230,9 @@ static void *trie_lookup_elem(struct bpf_map *map, void *_key)
struct lpm_trie_node *node, *found = NULL;
struct bpf_lpm_trie_key *key = _key;
+ if (key->prefixlen > trie->max_prefixlen)
+ return NULL;
+
/* Start walking the trie from the root node ... */
for (node = rcu_dereference_check(trie->root, rcu_read_lock_bh_held());
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 119/374] bpf: Add crosstask check to __bpf_get_stack
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 118/374] bpf, lpm: Fix check prefixlen before walking trie Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 120/374] wifi: ath11k: Defer on rproc_get failure Greg Kroah-Hartman
` (255 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan Rome, Andrii Nakryiko,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rome <jordalgo@meta.com>
[ Upstream commit b8e3a87a627b575896e448021e5c2f8a3bc19931 ]
Currently get_perf_callchain only supports user stack walking for
the current task. Passing the correct *crosstask* param will return
0 frames if the task passed to __bpf_get_stack isn't the current
one instead of a single incorrect frame/address. This change
passes the correct *crosstask* param but also does a preemptive
check in __bpf_get_stack if the task is current and returns
-EOPNOTSUPP if it is not.
This issue was found using bpf_get_task_stack inside a BPF
iterator ("iter/task"), which iterates over all tasks.
bpf_get_task_stack works fine for fetching kernel stacks
but because get_perf_callchain relies on the caller to know
if the requested *task* is the current one (via *crosstask*)
it was failing in a confusing way.
It might be possible to get user stacks for all tasks utilizing
something like access_process_vm but that requires the bpf
program calling bpf_get_task_stack to be sleepable and would
therefore be a breaking change.
Fixes: fa28dcb82a38 ("bpf: Introduce helper bpf_get_task_stack()")
Signed-off-by: Jordan Rome <jordalgo@meta.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231108112334.3433136-1-jordalgo@meta.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/uapi/linux/bpf.h | 3 +++
kernel/bpf/stackmap.c | 11 ++++++++++-
tools/include/uapi/linux/bpf.h | 3 +++
3 files changed, 16 insertions(+), 1 deletion(-)
diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index 9fb06a511250..1da082a8c4ec 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -4245,6 +4245,8 @@ union bpf_attr {
* long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags)
* Description
* Return a user or a kernel stack in bpf program provided buffer.
+ * Note: the user stack will only be populated if the *task* is
+ * the current task; all other tasks will return -EOPNOTSUPP.
* To achieve this, the helper needs *task*, which is a valid
* pointer to **struct task_struct**. To store the stacktrace, the
* bpf program provides *buf* with a nonnegative *size*.
@@ -4256,6 +4258,7 @@ union bpf_attr {
*
* **BPF_F_USER_STACK**
* Collect a user space stack instead of a kernel stack.
+ * The *task* must be the current task.
* **BPF_F_USER_BUILD_ID**
* Collect buildid+offset instead of ips for user stack,
* only valid if **BPF_F_USER_STACK** is also specified.
diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
index 7efae3af6201..f8587abef73c 100644
--- a/kernel/bpf/stackmap.c
+++ b/kernel/bpf/stackmap.c
@@ -435,6 +435,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
{
u32 trace_nr, copy_len, elem_size, num_elem, max_depth;
bool user_build_id = flags & BPF_F_USER_BUILD_ID;
+ bool crosstask = task && task != current;
u32 skip = flags & BPF_F_SKIP_FIELD_MASK;
bool user = flags & BPF_F_USER_STACK;
struct perf_callchain_entry *trace;
@@ -457,6 +458,14 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
if (task && user && !user_mode(regs))
goto err_fault;
+ /* get_perf_callchain does not support crosstask user stack walking
+ * but returns an empty stack instead of NULL.
+ */
+ if (crosstask && user) {
+ err = -EOPNOTSUPP;
+ goto clear;
+ }
+
num_elem = size / elem_size;
max_depth = num_elem + skip;
if (sysctl_perf_event_max_stack < max_depth)
@@ -468,7 +477,7 @@ static long __bpf_get_stack(struct pt_regs *regs, struct task_struct *task,
trace = get_callchain_entry_for_task(task, max_depth);
else
trace = get_perf_callchain(regs, 0, kernel, user, max_depth,
- false, false);
+ crosstask, false);
if (unlikely(!trace))
goto err_fault;
diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index 1e3e3f16eabc..d83eaa35c581 100644
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -4245,6 +4245,8 @@ union bpf_attr {
* long bpf_get_task_stack(struct task_struct *task, void *buf, u32 size, u64 flags)
* Description
* Return a user or a kernel stack in bpf program provided buffer.
+ * Note: the user stack will only be populated if the *task* is
+ * the current task; all other tasks will return -EOPNOTSUPP.
* To achieve this, the helper needs *task*, which is a valid
* pointer to **struct task_struct**. To store the stacktrace, the
* bpf program provides *buf* with a nonnegative *size*.
@@ -4256,6 +4258,7 @@ union bpf_attr {
*
* **BPF_F_USER_STACK**
* Collect a user space stack instead of a kernel stack.
+ * The *task* must be the current task.
* **BPF_F_USER_BUILD_ID**
* Collect buildid+offset instead of ips for user stack,
* only valid if **BPF_F_USER_STACK** is also specified.
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 120/374] wifi: ath11k: Defer on rproc_get failure
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 119/374] bpf: Add crosstask check to __bpf_get_stack Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 121/374] wifi: libertas: stop selecting wext Greg Kroah-Hartman
` (254 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luca Weiss, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luca Weiss <luca.weiss@fairphone.com>
[ Upstream commit 2a3ec40b98b46c339adb57313d3b933ee5e7a8e8 ]
If we already have gotten the rproc_handle (meaning the "qcom,rproc"
property is defined in the devicetree), it's a valid state that the
remoteproc module hasn't probed yet so we should defer probing instead
of just failing to probe.
This resolves a race condition when the ath11k driver probes and fails
before the wpss remoteproc driver has probed, like the following:
[ 6.232360] ath11k 17a10040.wifi: failed to get rproc
[ 6.232366] ath11k 17a10040.wifi: failed to get rproc: -22
[ 6.232478] ath11k: probe of 17a10040.wifi failed with error -22
...
[ 6.252415] remoteproc remoteproc2: 8a00000.remoteproc is available
[ 6.252776] remoteproc remoteproc2: powering up 8a00000.remoteproc
[ 6.252781] remoteproc remoteproc2: Booting fw image qcom/qcm6490/fairphone5/wpss.mdt, size 7188
So, defer the probe if we hit that so we can retry later once the wpss
remoteproc is available.
Tested-on: WCN6750 hw1.0 AHB WLAN.MSL.1.0.1-01264-QCAMSLSWPLZ-1.37886.3
Fixes: d5c65159f289 ("ath11k: driver for Qualcomm IEEE 802.11ax devices")
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20231027-ath11k-rproc-defer-v1-1-f6b6a812cd18@fairphone.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath11k/ahb.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath11k/ahb.c b/drivers/net/wireless/ath/ath11k/ahb.c
index 24bd0520926b..853a5df4f38c 100644
--- a/drivers/net/wireless/ath/ath11k/ahb.c
+++ b/drivers/net/wireless/ath/ath11k/ahb.c
@@ -650,8 +650,8 @@ static int ath11k_core_get_rproc(struct ath11k_base *ab)
prproc = rproc_get_by_phandle(rproc_phandle);
if (!prproc) {
- ath11k_err(ab, "failed to get rproc\n");
- return -EINVAL;
+ ath11k_dbg(ab, ATH11K_DBG_AHB, "failed to get rproc, deferring\n");
+ return -EPROBE_DEFER;
}
ab_ahb->tgt_rproc = prproc;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 121/374] wifi: libertas: stop selecting wext
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 120/374] wifi: ath11k: Defer on rproc_get failure Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 122/374] ARM: dts: qcom: apq8064: correct XOADC register address Greg Kroah-Hartman
` (253 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Kalle Valo,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 8170b04c2c92eee52ea50b96db4c54662197e512 ]
Libertas no longer references the iw_handler infrastructure or wext_spy,
so neither of the 'select' statements are used any more.
Fixes: e86dc1ca4676 ("Libertas: cfg80211 support")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231108153409.1065286-1-arnd@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/marvell/libertas/Kconfig | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/net/wireless/marvell/libertas/Kconfig b/drivers/net/wireless/marvell/libertas/Kconfig
index 6d62ab49aa8d..c7d02adb3eea 100644
--- a/drivers/net/wireless/marvell/libertas/Kconfig
+++ b/drivers/net/wireless/marvell/libertas/Kconfig
@@ -2,8 +2,6 @@
config LIBERTAS
tristate "Marvell 8xxx Libertas WLAN driver support"
depends on CFG80211
- select WIRELESS_EXT
- select WEXT_SPY
select LIB80211
select FW_LOADER
help
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 122/374] ARM: dts: qcom: apq8064: correct XOADC register address
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 121/374] wifi: libertas: stop selecting wext Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 123/374] net/ncsi: Fix netlink major/minor version numbers Greg Kroah-Hartman
` (252 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 554557542e709e190eff8a598f0cde02647d533a ]
The XOADC is present at the address 0x197 rather than just 197. It
doesn't change a lot (since the driver hardcodes all register
addresses), but the DT should present correct address anyway.
Fixes: c4b70883ee33 ("ARM: dts: add XOADC and IIO HWMON to APQ8064")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230928110309.1212221-3-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/qcom-apq8064.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/qcom-apq8064.dtsi b/arch/arm/boot/dts/qcom-apq8064.dtsi
index 0e830476fefd..d70f071fd830 100644
--- a/arch/arm/boot/dts/qcom-apq8064.dtsi
+++ b/arch/arm/boot/dts/qcom-apq8064.dtsi
@@ -760,7 +760,7 @@ pwrkey@1c {
xoadc: xoadc@197 {
compatible = "qcom,pm8921-adc";
- reg = <197>;
+ reg = <0x197>;
interrupts-extended = <&pmicintc 78 IRQ_TYPE_EDGE_RISING>;
#address-cells = <2>;
#size-cells = <0>;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 123/374] net/ncsi: Fix netlink major/minor version numbers
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 122/374] ARM: dts: qcom: apq8064: correct XOADC register address Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 124/374] firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() Greg Kroah-Hartman
` (251 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Delevoryas, David S. Miller,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Delevoryas <peter@pjd.dev>
[ Upstream commit 3084b58bfd0b9e4b5e034f31f31b42977db35f12 ]
The netlink interface for major and minor version numbers doesn't actually
return the major and minor version numbers.
It reports a u32 that contains the (major, minor, update, alpha1)
components as the major version number, and then alpha2 as the minor
version number.
For whatever reason, the u32 byte order was reversed (ntohl): maybe it was
assumed that the encoded value was a single big-endian u32, and alpha2 was
the minor version.
The correct way to get the supported NC-SI version from the network
controller is to parse the Get Version ID response as described in 8.4.44
of the NC-SI spec[1].
Get Version ID Response Packet Format
Bits
+--------+--------+--------+--------+
Bytes | 31..24 | 23..16 | 15..8 | 7..0 |
+-------+--------+--------+--------+--------+
| 0..15 | NC-SI Header |
+-------+--------+--------+--------+--------+
| 16..19| Response code | Reason code |
+-------+--------+--------+--------+--------+
|20..23 | Major | Minor | Update | Alpha1 |
+-------+--------+--------+--------+--------+
|24..27 | reserved | Alpha2 |
+-------+--------+--------+--------+--------+
| .... other stuff .... |
The major, minor, and update fields are all binary-coded decimal (BCD)
encoded [2]. The spec provides examples below the Get Version ID response
format in section 8.4.44.1, but for practical purposes, this is an example
from a live network card:
root@bmc:~# ncsi-util 0x15
NC-SI Command Response:
cmd: GET_VERSION_ID(0x15)
Response: COMMAND_COMPLETED(0x0000) Reason: NO_ERROR(0x0000)
Payload length = 40
20: 0xf1 0xf1 0xf0 0x00 <<<<<<<<< (major, minor, update, alpha1)
24: 0x00 0x00 0x00 0x00 <<<<<<<<< (_, _, _, alpha2)
28: 0x6d 0x6c 0x78 0x30
32: 0x2e 0x31 0x00 0x00
36: 0x00 0x00 0x00 0x00
40: 0x16 0x1d 0x07 0xd2
44: 0x10 0x1d 0x15 0xb3
48: 0x00 0x17 0x15 0xb3
52: 0x00 0x00 0x81 0x19
This should be parsed as "1.1.0".
"f" in the upper-nibble means to ignore it, contributing zero.
If both nibbles are "f", I think the whole field is supposed to be ignored.
Major and minor are "required", meaning they're not supposed to be "ff",
but the update field is "optional" so I think it can be ff. I think the
simplest thing to do is just set the major and minor to zero instead of
juggling some conditional logic or something.
bcd2bin() from "include/linux/bcd.h" seems to assume both nibbles are 0-9,
so I've provided a custom BCD decoding function.
Alpha1 and alpha2 are ISO/IEC 8859-1 encoded, which just means ASCII
characters as far as I can tell, although the full encoding table for
non-alphabetic characters is slightly different (I think).
I imagine the alpha fields are just supposed to be alphabetic characters,
but I haven't seen any network cards actually report a non-zero value for
either.
If people wrote software against this netlink behavior, and were parsing
the major and minor versions themselves from the u32, then this would
definitely break their code.
[1] https://www.dmtf.org/sites/default/files/standards/documents/DSP0222_1.0.0.pdf
[2] https://en.wikipedia.org/wiki/Binary-coded_decimal
[2] https://en.wikipedia.org/wiki/ISO/IEC_8859-1
Signed-off-by: Peter Delevoryas <peter@pjd.dev>
Fixes: 138635cc27c9 ("net/ncsi: NCSI response packet handler")
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ncsi/internal.h | 7 +++++--
net/ncsi/ncsi-netlink.c | 4 ++--
net/ncsi/ncsi-pkt.h | 7 +++++--
net/ncsi/ncsi-rsp.c | 26 ++++++++++++++++++++++++--
4 files changed, 36 insertions(+), 8 deletions(-)
diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h
index 03757e76bb6b..374412ed780b 100644
--- a/net/ncsi/internal.h
+++ b/net/ncsi/internal.h
@@ -105,8 +105,11 @@ enum {
struct ncsi_channel_version {
- u32 version; /* Supported BCD encoded NCSI version */
- u32 alpha2; /* Supported BCD encoded NCSI version */
+ u8 major; /* NCSI version major */
+ u8 minor; /* NCSI version minor */
+ u8 update; /* NCSI version update */
+ char alpha1; /* NCSI version alpha1 */
+ char alpha2; /* NCSI version alpha2 */
u8 fw_name[12]; /* Firmware name string */
u32 fw_version; /* Firmware version */
u16 pci_ids[4]; /* PCI identification */
diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index c189b4c8a182..db350b8f5d88 100644
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -71,8 +71,8 @@ static int ncsi_write_channel_info(struct sk_buff *skb,
if (nc == nc->package->preferred_channel)
nla_put_flag(skb, NCSI_CHANNEL_ATTR_FORCED);
- nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.version);
- nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.alpha2);
+ nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MAJOR, nc->version.major);
+ nla_put_u32(skb, NCSI_CHANNEL_ATTR_VERSION_MINOR, nc->version.minor);
nla_put_string(skb, NCSI_CHANNEL_ATTR_VERSION_STR, nc->version.fw_name);
vid_nest = nla_nest_start_noflag(skb, NCSI_CHANNEL_ATTR_VLAN_LIST);
diff --git a/net/ncsi/ncsi-pkt.h b/net/ncsi/ncsi-pkt.h
index ba66c7dc3a21..c9d1da34dc4d 100644
--- a/net/ncsi/ncsi-pkt.h
+++ b/net/ncsi/ncsi-pkt.h
@@ -197,9 +197,12 @@ struct ncsi_rsp_gls_pkt {
/* Get Version ID */
struct ncsi_rsp_gvi_pkt {
struct ncsi_rsp_pkt_hdr rsp; /* Response header */
- __be32 ncsi_version; /* NCSI version */
+ unsigned char major; /* NCSI version major */
+ unsigned char minor; /* NCSI version minor */
+ unsigned char update; /* NCSI version update */
+ unsigned char alpha1; /* NCSI version alpha1 */
unsigned char reserved[3]; /* Reserved */
- unsigned char alpha2; /* NCSI version */
+ unsigned char alpha2; /* NCSI version alpha2 */
unsigned char fw_name[12]; /* f/w name string */
__be32 fw_version; /* f/w version */
__be16 pci_ids[4]; /* PCI IDs */
diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
index 069c2659074b..480e80e3c283 100644
--- a/net/ncsi/ncsi-rsp.c
+++ b/net/ncsi/ncsi-rsp.c
@@ -19,6 +19,19 @@
#include "ncsi-pkt.h"
#include "ncsi-netlink.h"
+/* Nibbles within [0xA, 0xF] add zero "0" to the returned value.
+ * Optional fields (encoded as 0xFF) will default to zero.
+ */
+static u8 decode_bcd_u8(u8 x)
+{
+ int lo = x & 0xF;
+ int hi = x >> 4;
+
+ lo = lo < 0xA ? lo : 0;
+ hi = hi < 0xA ? hi : 0;
+ return lo + hi * 10;
+}
+
static int ncsi_validate_rsp_pkt(struct ncsi_request *nr,
unsigned short payload)
{
@@ -755,9 +768,18 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
if (!nc)
return -ENODEV;
- /* Update to channel's version info */
+ /* Update channel's version info
+ *
+ * Major, minor, and update fields are supposed to be
+ * unsigned integers encoded as packed BCD.
+ *
+ * Alpha1 and alpha2 are ISO/IEC 8859-1 characters.
+ */
ncv = &nc->version;
- ncv->version = ntohl(rsp->ncsi_version);
+ ncv->major = decode_bcd_u8(rsp->major);
+ ncv->minor = decode_bcd_u8(rsp->minor);
+ ncv->update = decode_bcd_u8(rsp->update);
+ ncv->alpha1 = rsp->alpha1;
ncv->alpha2 = rsp->alpha2;
memcpy(ncv->fw_name, rsp->fw_name, 12);
ncv->fw_version = ntohl(rsp->fw_version);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 124/374] firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 123/374] net/ncsi: Fix netlink major/minor version numbers Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 125/374] firmware: meson_sm: populate platform devices from sm device tree data Greg Kroah-Hartman
` (250 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Dan Carpenter,
Nishanth Menon, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 964946b88887089f447a9b6a28c39ee97dc76360 ]
The ending NULL is not taken into account by strncat(), so switch to
snprintf() to correctly build 'debug_name'.
Using snprintf() also makes the code more readable.
Fixes: aa276781a64a ("firmware: Add basic support for TI System Control Interface (TI-SCI) protocol")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/7158db0a4d7b19855ddd542ec61b666973aad8dc.1698660720.git.christophe.jaillet@wanadoo.fr
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/ti_sci.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/firmware/ti_sci.c b/drivers/firmware/ti_sci.c
index c2fafe49c2e8..b313337e4f19 100644
--- a/drivers/firmware/ti_sci.c
+++ b/drivers/firmware/ti_sci.c
@@ -161,7 +161,7 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
{
struct device *dev = &pdev->dev;
struct resource *res;
- char debug_name[50] = "ti_sci_debug@";
+ char debug_name[50];
/* Debug region is optional */
res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
@@ -178,10 +178,10 @@ static int ti_sci_debugfs_create(struct platform_device *pdev,
/* Setup NULL termination */
info->debug_buffer[info->debug_region_size] = 0;
- info->d = debugfs_create_file(strncat(debug_name, dev_name(dev),
- sizeof(debug_name) -
- sizeof("ti_sci_debug@")),
- 0444, NULL, info, &ti_sci_debug_fops);
+ snprintf(debug_name, sizeof(debug_name), "ti_sci_debug@%s",
+ dev_name(dev));
+ info->d = debugfs_create_file(debug_name, 0444, NULL, info,
+ &ti_sci_debug_fops);
if (IS_ERR(info->d))
return PTR_ERR(info->d);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 125/374] firmware: meson_sm: populate platform devices from sm device tree data
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 124/374] firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 126/374] wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior Greg Kroah-Hartman
` (249 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Rokosov, Martin Blumenstingl,
Neil Armstrong, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Rokosov <ddrokosov@sberdevices.ru>
[ Upstream commit e45f243409db98d610248c843b25435e7fb0baf3 ]
In some meson boards, secure monitor device has children, for example,
power secure controller. By default, secure monitor isn't the bus in terms
of device tree subsystem, so the of_platform initialization code doesn't
populate its device tree data. As a result, secure monitor's children
aren't probed at all.
Run the 'of_platform_populate()' routine manually to resolve such issues.
Signed-off-by: Dmitry Rokosov <ddrokosov@sberdevices.ru>
Acked-by: Martin Blumenstingl <martin.blumenstingl@googlemail.com>
Link: https://lore.kernel.org/r/20230324145557.27797-1-ddrokosov@sberdevices.ru
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Stable-dep-of: d8385d7433f9 ("firmware: meson-sm: unmap out_base shmem in error path")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/firmware/meson/meson_sm.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
index d081a6312627..bf19dd66c213 100644
--- a/drivers/firmware/meson/meson_sm.c
+++ b/drivers/firmware/meson/meson_sm.c
@@ -313,11 +313,14 @@ static int __init meson_sm_probe(struct platform_device *pdev)
platform_set_drvdata(pdev, fw);
- pr_info("secure-monitor enabled\n");
+ if (devm_of_platform_populate(dev))
+ goto out_in_base;
if (sysfs_create_group(&pdev->dev.kobj, &meson_sm_sysfs_attr_group))
goto out_in_base;
+ pr_info("secure-monitor enabled\n");
+
return 0;
out_in_base:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 126/374] wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 125/374] firmware: meson_sm: populate platform devices from sm device tree data Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 127/374] arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type Greg Kroah-Hartman
` (248 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Su Hui, Ping-Ke Shih, Kalle Valo,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit bc8263083af60e7e57c6120edbc1f75d6c909a35 ]
Clang static checker warns:
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c:184:49:
The result of the left shift is undefined due to shifting by '32',
which is greater or equal to the width of type 'u32'.
[core.UndefinedBinaryOperatorResult]
If the value of the right operand is negative or is greater than or
equal to the width of the promoted left operand, the behavior is
undefined.[1][2]
For example, when using different gcc's compilation optimization options
(-O0 or -O2), the result of '(u32)data << 32' is different. One is 0, the
other is old value of data. Let _rtl8821ae_phy_calculate_bit_shift()'s
return value less than 32 to fix this problem. Warn if bitmask is zero.
[1] https://stackoverflow.com/questions/11270492/what-does-the-c-standard-say-about-bitshifting-more-bits-than-the-width-of-type
[2] https://www.open-std.org/jtc1/sc22/wg14/www/docs/n1256.pdf
Fixes: 21e4b0726dc6 ("rtlwifi: rtl8821ae: Move driver from staging to regular tree")
Signed-off-by: Su Hui <suhui@nfschina.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231127013511.26694-2-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
index 5323ead30db0..fa1839d8ee55 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c
@@ -29,9 +29,10 @@ static void _rtl8821ae_phy_rf_serial_write(struct ieee80211_hw *hw,
u32 data);
static u32 _rtl8821ae_phy_calculate_bit_shift(u32 bitmask)
{
- u32 i = ffs(bitmask);
+ if (WARN_ON_ONCE(!bitmask))
+ return 0;
- return i ? i - 1 : 32;
+ return __ffs(bitmask);
}
static bool _rtl8821ae_phy_bb8821a_config_parafile(struct ieee80211_hw *hw);
/*static bool _rtl8812ae_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);*/
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 127/374] arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 126/374] wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 128/374] bpf: enforce precision of R0 on callback return Greg Kroah-Hartman
` (247 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen, Aradhya Bhatia,
Nishanth Menon, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit b57160859263c083c49482b0d083a586b1517f78 ]
DSS irq trigger type is set to IRQ_TYPE_EDGE_RISING in the DT file, but
the TRM says it is level triggered.
For some reason triggering on rising edge results in double the amount
of expected interrupts, e.g. for normal page flipping test the number of
interrupts per second is 2 * fps. It is as if the IRQ triggers on both
edges. There are no other side effects to this issue than slightly
increased CPU & power consumption due to the extra interrupt.
Switching to IRQ_TYPE_LEVEL_HIGH is correct and fixes the issue, so
let's do that.
Fixes: fc539b90eda2 ("arm64: dts: ti: am654: Add DSS node")
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
Link: https://lore.kernel.org/r/20231106-am65-dss-clk-edge-v1-1-4a959fec0e1e@ideasonboard.com
Signed-off-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
index 4f232f575ab2..b729d2dee209 100644
--- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi
@@ -855,7 +855,7 @@ dss: dss@4a00000 {
assigned-clocks = <&k3_clks 67 2>;
assigned-clock-parents = <&k3_clks 67 5>;
- interrupts = <GIC_SPI 166 IRQ_TYPE_EDGE_RISING>;
+ interrupts = <GIC_SPI 166 IRQ_TYPE_LEVEL_HIGH>;
dma-coherent;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 128/374] bpf: enforce precision of R0 on callback return
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 127/374] arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 129/374] ARM: dts: qcom: sdx65: correct SPMI node name Greg Kroah-Hartman
` (246 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eduard Zingerman, Shung-Hsi Yu,
Andrii Nakryiko, Alexei Starovoitov, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit 0acd03a5bd188b0c501d285d938439618bd855c4 ]
Given verifier checks actual value, r0 has to be precise, so we need to
propagate precision properly. r0 also has to be marked as read,
otherwise subsequent state comparisons will ignore such register as
unimportant and precision won't really help here.
Fixes: 69c087ba6225 ("bpf: Add bpf_for_each_map_elem() helper")
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231202175705.885270-4-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 5d8f352faebd..7318a5d44859 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -6244,6 +6244,13 @@ static int prepare_func_exit(struct bpf_verifier_env *env, int *insn_idx)
verbose(env, "R0 not a scalar value\n");
return -EACCES;
}
+
+ /* we are going to rely on register's precise value */
+ err = mark_reg_read(env, r0, r0->parent, REG_LIVE_READ64);
+ err = err ?: mark_chain_precision(env, BPF_REG_0);
+ if (err)
+ return err;
+
if (!tnum_in(range, r0->var_off)) {
verbose_invalid_scalar(env, r0, &range, "callback return", "R0");
return -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 129/374] ARM: dts: qcom: sdx65: correct SPMI node name
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 128/374] bpf: enforce precision of R0 on callback return Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 130/374] arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered Greg Kroah-Hartman
` (245 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Krzysztof Kozlowski,
Dmitry Baryshkov, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit a900ad783f507cb396e402827052e70c0c565ae9 ]
Node names should not have vendor prefixes:
qcom-sdx65-mtp.dtb: qcom,spmi@c440000: $nodename:0: 'qcom,spmi@c440000' does not match '^spmi@.*
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20230924183103.49487-3-krzysztof.kozlowski@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/boot/dts/qcom-sdx55.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm/boot/dts/qcom-sdx55.dtsi b/arch/arm/boot/dts/qcom-sdx55.dtsi
index 9d62487f6c8f..73fa0ef6b69e 100644
--- a/arch/arm/boot/dts/qcom-sdx55.dtsi
+++ b/arch/arm/boot/dts/qcom-sdx55.dtsi
@@ -457,7 +457,7 @@ restart@c264000 {
reg = <0x0c264000 0x1000>;
};
- spmi_bus: qcom,spmi@c440000 {
+ spmi_bus: spmi@c440000 {
compatible = "qcom,spmi-pmic-arb";
reg = <0x0c440000 0x0000d00>,
<0x0c600000 0x2000000>,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 130/374] arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 129/374] ARM: dts: qcom: sdx65: correct SPMI node name Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 131/374] arm64: dts: qcom: sc7280: " Greg Kroah-Hartman
` (244 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Stephen Boyd,
Douglas Anderson, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 7ac90b4cf107a3999b30844d7899e0331686b33b ]
On sc7180 when the watchdog timer fires your logs get filled with:
watchdog0: pretimeout event
watchdog0: pretimeout event
watchdog0: pretimeout event
...
watchdog0: pretimeout event
If you're using console-ramoops to debug crashes the above gets quite
annoying since it blows away any other log messages that might have
been there.
The issue is that the "bark" interrupt (AKA the "pretimeout"
interrupt) remains high until the watchdog is pet. Since we've got
things configured as "level" triggered we'll keep getting interrupted
over and over.
Let's switch to edge triggered. Now we'll get one interrupt when the
"bark" interrupt goes off and won't get another one until the "bark"
interrupt is cleared and asserts again.
This matches how many older Qualcomm SoCs have things configured.
Fixes: 28cc13e4060c ("arm64: dts: qcom: sc7180: Add watchdog bark interrupt")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20231106144335.v2.1.Ic7577567baff921347d423b722de8b857602efb1@changeid
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7180.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7180.dtsi b/arch/arm64/boot/dts/qcom/sc7180.dtsi
index 12816d60e249..410e0305eb51 100644
--- a/arch/arm64/boot/dts/qcom/sc7180.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7180.dtsi
@@ -3366,7 +3366,7 @@ watchdog@17c10000 {
compatible = "qcom,apss-wdt-sc7180", "qcom,kpss-wdt";
reg = <0 0x17c10000 0 0x1000>;
clocks = <&sleep_clk>;
- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
};
timer@17c20000{
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 131/374] arm64: dts: qcom: sc7280: Make watchdog bark interrupt edge triggered
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 130/374] arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 132/374] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
` (243 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Stephen Boyd,
Douglas Anderson, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 6897fac411db7b43243f67d4fd4d3f95abf7f656 ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
interrupt should be configured as edge triggered. Make the change.
Fixes: 0e51f883daa9 ("arm64: dts: qcom: sc7280: Add APSS watchdog node")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20231106144335.v2.2.I11f77956d2492c88aca0ef5462123f225caf4fb4@changeid
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index dc4aab258ff6..9971b8763e08 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -1711,7 +1711,7 @@ watchdog@17c10000 {
compatible = "qcom,apss-wdt-sc7280", "qcom,kpss-wdt";
reg = <0 0x17c10000 0 0x1000>;
clocks = <&sleep_clk>;
- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
};
timer@17c20000 {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 132/374] arm64: dts: qcom: sdm845: Make watchdog bark interrupt edge triggered
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 131/374] arm64: dts: qcom: sc7280: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 133/374] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
` (242 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Stephen Boyd,
Douglas Anderson, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 263b348499454f38d36b9442c3cf9279c571bb54 ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
interrupt should be configured as edge triggered. Make the change.
Fixes: 36c436b03c58 ("arm64: dts: qcom: sdm845: Add watchdog bark interrupt")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20231106144335.v2.3.I16675ebe5517c68453a1bd7f4334ff885f806c03@changeid
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845.dtsi b/arch/arm64/boot/dts/qcom/sdm845.dtsi
index 6a0e30cbf88f..5a78ee8622c9 100644
--- a/arch/arm64/boot/dts/qcom/sdm845.dtsi
+++ b/arch/arm64/boot/dts/qcom/sdm845.dtsi
@@ -4725,7 +4725,7 @@ watchdog@17980000 {
compatible = "qcom,apss-wdt-sdm845", "qcom,kpss-wdt";
reg = <0 0x17980000 0 0x1000>;
clocks = <&sleep_clk>;
- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
};
apss_shared: mailbox@17990000 {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 133/374] arm64: dts: qcom: sm8150: Make watchdog bark interrupt edge triggered
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 132/374] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 134/374] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
` (241 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Stephen Boyd,
Douglas Anderson, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 9204e9a4099212c850e1703c374ef4538080825b ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
interrupt should be configured as edge triggered. Make the change.
Fixes: b094c8f8dd2a ("arm64: dts: qcom: sm8150: Add watchdog bark interrupt")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20231106144335.v2.4.I23d0aa6c8f1fec5c26ad9b3c610df6f4c5392850@changeid
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8150.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8150.dtsi b/arch/arm64/boot/dts/qcom/sm8150.dtsi
index e8cb20c4cbf2..c6b6064e6b12 100644
--- a/arch/arm64/boot/dts/qcom/sm8150.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8150.dtsi
@@ -3359,7 +3359,7 @@ watchdog@17c10000 {
compatible = "qcom,apss-wdt-sm8150", "qcom,kpss-wdt";
reg = <0 0x17c10000 0 0x1000>;
clocks = <&sleep_clk>;
- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
};
timer@17c20000 {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 134/374] arm64: dts: qcom: sm8250: Make watchdog bark interrupt edge triggered
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 133/374] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 135/374] bpf: fix check for attempt to corrupt spilled pointer Greg Kroah-Hartman
` (240 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Stephen Boyd,
Douglas Anderson, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 735d80e2e8e5d073ae8b1fff8b1589ea284aa5af ]
As described in the patch ("arm64: dts: qcom: sc7180: Make watchdog
bark interrupt edge triggered"), the Qualcomm watchdog timer's bark
interrupt should be configured as edge triggered. Make the change.
Fixes: 46a4359f9156 ("arm64: dts: qcom: sm8250: Add watchdog bark interrupt")
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Stephen Boyd <swboyd@chromium.org>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20231106144335.v2.5.I2910e7c10493d896841e9785c1817df9b9a58701@changeid
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8250.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8250.dtsi b/arch/arm64/boot/dts/qcom/sm8250.dtsi
index 5d6551e1fcd8..8880e9cbc974 100644
--- a/arch/arm64/boot/dts/qcom/sm8250.dtsi
+++ b/arch/arm64/boot/dts/qcom/sm8250.dtsi
@@ -3947,7 +3947,7 @@ watchdog@17c10000 {
compatible = "qcom,apss-wdt-sm8250", "qcom,kpss-wdt";
reg = <0 0x17c10000 0 0x1000>;
clocks = <&sleep_clk>;
- interrupts = <GIC_SPI 0 IRQ_TYPE_LEVEL_HIGH>;
+ interrupts = <GIC_SPI 0 IRQ_TYPE_EDGE_RISING>;
};
timer@17c20000 {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 135/374] bpf: fix check for attempt to corrupt spilled pointer
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 134/374] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 136/374] scsi: fnic: Return error if vmalloc() failed Greg Kroah-Hartman
` (239 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andrii Nakryiko, Alexei Starovoitov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrii Nakryiko <andrii@kernel.org>
[ Upstream commit ab125ed3ec1c10ccc36bc98c7a4256ad114a3dae ]
When register is spilled onto a stack as a 1/2/4-byte register, we set
slot_type[BPF_REG_SIZE - 1] (plus potentially few more below it,
depending on actual spill size). So to check if some stack slot has
spilled register we need to consult slot_type[7], not slot_type[0].
To avoid the need to remember and double-check this in the future, just
use is_spilled_reg() helper.
Fixes: 27113c59b6d0 ("bpf: Check the other end of slot_type for STACK_SPILL")
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/r/20231205184248.1502704-4-andrii@kernel.org
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 7318a5d44859..cc284371eea0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2844,7 +2844,7 @@ static int check_stack_write_fixed_off(struct bpf_verifier_env *env,
* so it's aligned access and [off, off + size) are within stack limits
*/
if (!env->allow_ptr_leaks &&
- state->stack[spi].slot_type[0] == STACK_SPILL &&
+ is_spilled_reg(&state->stack[spi]) &&
size != BPF_REG_SIZE) {
verbose(env, "attempt to corrupt spilled pointer on stack\n");
return -EACCES;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 136/374] scsi: fnic: Return error if vmalloc() failed
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 135/374] bpf: fix check for attempt to corrupt spilled pointer Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 137/374] arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator Greg Kroah-Hartman
` (238 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Artem Chernyshev, Karan Tilak Kumar,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Artem Chernyshev <artem.chernyshev@red-soft.ru>
[ Upstream commit f5f27a332a14f43463aa0075efa3a0c662c0f4a8 ]
In fnic_init_module() exists redundant check for return value from
fnic_debugfs_init(), because at moment it only can return zero. It make
sense to process theoretical vmalloc() failure.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Fixes: 9730ddfb123d ("scsi: fnic: remove redundant assignment of variable rc")
Signed-off-by: Artem Chernyshev <artem.chernyshev@red-soft.ru>
Link: https://lore.kernel.org/r/20231128111008.2280507-1-artem.chernyshev@red-soft.ru
Reviewed-by: Karan Tilak Kumar <kartilak@cisco.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/fnic/fnic_debugfs.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/fnic/fnic_debugfs.c b/drivers/scsi/fnic/fnic_debugfs.c
index e7326505cabb..f611e9f00a9d 100644
--- a/drivers/scsi/fnic/fnic_debugfs.c
+++ b/drivers/scsi/fnic/fnic_debugfs.c
@@ -66,9 +66,10 @@ int fnic_debugfs_init(void)
fc_trc_flag->fnic_trace = 2;
fc_trc_flag->fc_trace = 3;
fc_trc_flag->fc_clear = 4;
+ return 0;
}
- return 0;
+ return -ENOMEM;
}
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 137/374] arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 136/374] scsi: fnic: Return error if vmalloc() failed Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 138/374] arm64: dts: qcom: sdm845-db845c: " Greg Kroah-Hartman
` (237 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Manivannan Sadhasivam, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit dc6b5562acbac0285ab3b2dad23930b6434bdfc6 ]
There is no "panic-indicator" default trigger but a property with that
name:
qrb5165-rb5.dtb: leds: led-user4: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
Fixes: b5cbd84e499a ("arm64: dts: qcom: qrb5165-rb5: Add onboard LED support")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231111094623.12476-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/qrb5165-rb5.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
index d3449cb52def..9ef0afdae148 100644
--- a/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
+++ b/arch/arm64/boot/dts/qcom/qrb5165-rb5.dts
@@ -58,8 +58,8 @@ leds {
user4 {
label = "green:user4";
gpios = <&pm8150_gpios 10 GPIO_ACTIVE_HIGH>;
- linux,default-trigger = "panic-indicator";
default-state = "off";
+ panic-indicator;
};
wlan {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 138/374] arm64: dts: qcom: sdm845-db845c: correct LED panic indicator
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 137/374] arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 139/374] arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types Greg Kroah-Hartman
` (236 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski, Konrad Dybcio,
Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
[ Upstream commit 0c90c75e663246203a2b7f6dd9e08a110f4c3c43 ]
There is no "panic-indicator" default trigger but a property with that
name:
sdm845-db845c.dtb: leds: led-0: Unevaluated properties are not allowed ('linux,default-trigger' was unexpected)
Fixes: 3f72e2d3e682 ("arm64: dts: qcom: Add Dragonboard 845c")
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231111095617.16496-1-krzysztof.kozlowski@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sdm845-db845c.dts | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
index 5ce270f0b2ec..62877311e5c2 100644
--- a/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
+++ b/arch/arm64/boot/dts/qcom/sdm845-db845c.dts
@@ -55,8 +55,8 @@ leds {
user4 {
label = "green:user4";
gpios = <&pm8998_gpio 13 GPIO_ACTIVE_HIGH>;
- linux,default-trigger = "panic-indicator";
default-state = "off";
+ panic-indicator;
};
wlan {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 139/374] arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 138/374] arm64: dts: qcom: sdm845-db845c: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 140/374] bpf: Fix verification of indirect var-off stack access Greg Kroah-Hartman
` (235 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johan Hovold, Bjorn Andersson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <johan+linaro@kernel.org>
[ Upstream commit 24f8aba9a7c77c7e9d814a5754798e8346c7dd28 ]
The DP/DM wakeup interrupts are edge triggered and which edge to trigger
on depends on use-case and whether a Low speed or Full/High speed device
is connected.
Note that only triggering on rising edges can be used to detect resume
events but not disconnect events.
Fixes: bb9efa59c665 ("arm64: dts: qcom: sc7280: Add USB related nodes")
Signed-off-by: Johan Hovold <johan+linaro@kernel.org>
Link: https://lore.kernel.org/r/20231120164331.8116-6-johan+linaro@kernel.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index 9971b8763e08..e0c7f72773d6 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -1290,8 +1290,8 @@ usb_2: usb@8cf8800 {
assigned-clock-rates = <19200000>, <200000000>;
interrupts-extended = <&intc GIC_SPI 240 IRQ_TYPE_LEVEL_HIGH>,
- <&pdc 13 IRQ_TYPE_EDGE_RISING>,
- <&pdc 12 IRQ_TYPE_EDGE_RISING>;
+ <&pdc 12 IRQ_TYPE_EDGE_BOTH>,
+ <&pdc 13 IRQ_TYPE_EDGE_BOTH>;
interrupt-names = "hs_phy_irq",
"dm_hs_phy_irq", "dp_hs_phy_irq";
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 140/374] bpf: Fix verification of indirect var-off stack access
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 139/374] arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 141/374] block: Set memalloc_noio to false on device_add_disk() error path Greg Kroah-Hartman
` (234 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Sun, Andrei Matei,
Andrii Nakryiko, Eduard Zingerman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrei Matei <andreimatei1@gmail.com>
[ Upstream commit a833a17aeac73b33f79433d7cee68d5cafd71e4f ]
This patch fixes a bug around the verification of possibly-zero-sized
stack accesses. When the access was done through a var-offset stack
pointer, check_stack_access_within_bounds was incorrectly computing the
maximum-offset of a zero-sized read to be the same as the register's min
offset. Instead, we have to take in account the register's maximum
possible value. The patch also simplifies how the max offset is checked;
the check is now simpler than for min offset.
The bug was allowing accesses to erroneously pass the
check_stack_access_within_bounds() checks, only to later crash in
check_stack_range_initialized() when all the possibly-affected stack
slots are iterated (this time with a correct max offset).
check_stack_range_initialized() is relying on
check_stack_access_within_bounds() for its accesses to the
stack-tracking vector to be within bounds; in the case of zero-sized
accesses, we were essentially only verifying that the lowest possible
slot was within bounds. We would crash when the max-offset of the stack
pointer was >= 0 (which shouldn't pass verification, and hopefully is
not something anyone's code attempts to do in practice).
Thanks Hao for reporting!
Fixes: 01f810ace9ed3 ("bpf: Allow variable-offset stack access")
Reported-by: Hao Sun <sunhao.th@gmail.com>
Signed-off-by: Andrei Matei <andreimatei1@gmail.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20231207041150.229139-2-andreimatei1@gmail.com
Closes: https://lore.kernel.org/bpf/CACkBjsZGEUaRCHsmaX=h-efVogsRfK1FPxmkgb0Os_frnHiNdw@mail.gmail.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index cc284371eea0..c2ecf349523d 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4305,10 +4305,7 @@ static int check_stack_access_within_bounds(
if (tnum_is_const(reg->var_off)) {
min_off = reg->var_off.value + off;
- if (access_size > 0)
- max_off = min_off + access_size - 1;
- else
- max_off = min_off;
+ max_off = min_off + access_size;
} else {
if (reg->smax_value >= BPF_MAX_VAR_OFF ||
reg->smin_value <= -BPF_MAX_VAR_OFF) {
@@ -4317,15 +4314,12 @@ static int check_stack_access_within_bounds(
return -EACCES;
}
min_off = reg->smin_value + off;
- if (access_size > 0)
- max_off = reg->smax_value + off + access_size - 1;
- else
- max_off = min_off;
+ max_off = reg->smax_value + off + access_size;
}
err = check_stack_slot_within_bounds(min_off, state, type);
- if (!err)
- err = check_stack_slot_within_bounds(max_off, state, type);
+ if (!err && max_off > 0)
+ err = -EINVAL; /* out of stack access into non-negative offsets */
if (err) {
if (tnum_is_const(reg->var_off)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 141/374] block: Set memalloc_noio to false on device_add_disk() error path
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 140/374] bpf: Fix verification of indirect var-off stack access Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 142/374] scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT Greg Kroah-Hartman
` (233 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Nan, Christoph Hellwig,
Jens Axboe, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 5fa3d1a00c2d4ba14f1300371ad39d5456e890d7 ]
On the error path of device_add_disk(), device's memalloc_noio flag was
set but not cleared. As the comment of pm_runtime_set_memalloc_noio(),
"The function should be called between device_add() and device_del()".
Clear this flag before device_del() now.
Fixes: 25e823c8c37d ("block/genhd.c: apply pm_runtime_set_memalloc_noio on block devices")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20231211075356.1839282-1-linan666@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/genhd.c | 1 +
1 file changed, 1 insertion(+)
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -538,6 +538,7 @@ out_del_integrity:
out_del_block_link:
if (!sysfs_deprecated)
sysfs_remove_link(block_depr, dev_name(ddev));
+ pm_runtime_set_memalloc_noio(ddev, false);
out_device_del:
device_del(ddev);
out_free_ext_minor:
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 142/374] scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 141/374] block: Set memalloc_noio to false on device_add_disk() error path Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 143/374] scsi: hisi_sas: Prevent parallel FLR and controller reset Greg Kroah-Hartman
` (232 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Luo Jiaxing, John Garry,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luo Jiaxing <luojiaxing@huawei.com>
[ Upstream commit b5a9fa20e3bf59d89b5f48315a0c0c32963796ed ]
HISI_SAS_RESET_BIT means that the controller is being reset, and so the
name is a bit vague. Rename it to HISI_SAS_RESETTING_BIT.
Link: https://lore.kernel.org/r/1629799260-120116-4-git-send-email-john.garry@huawei.com
Signed-off-by: Luo Jiaxing <luojiaxing@huawei.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: d34ee535705e ("scsi: hisi_sas: Replace with standard error code return value")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas.h | 2 +-
drivers/scsi/hisi_sas/hisi_sas_main.c | 12 ++++++------
drivers/scsi/hisi_sas/hisi_sas_v1_hw.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 2 +-
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 10 +++++-----
5 files changed, 14 insertions(+), 14 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas.h b/drivers/scsi/hisi_sas/hisi_sas.h
index 436d174f2194..57be32ba0109 100644
--- a/drivers/scsi/hisi_sas/hisi_sas.h
+++ b/drivers/scsi/hisi_sas/hisi_sas.h
@@ -35,7 +35,7 @@
#define HISI_SAS_QUEUE_SLOTS 4096
#define HISI_SAS_MAX_ITCT_ENTRIES 1024
#define HISI_SAS_MAX_DEVICES HISI_SAS_MAX_ITCT_ENTRIES
-#define HISI_SAS_RESET_BIT 0
+#define HISI_SAS_RESETTING_BIT 0
#define HISI_SAS_REJECT_CMD_BIT 1
#define HISI_SAS_PM_BIT 2
#define HISI_SAS_HW_FAULT_BIT 3
diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
index 7d93783c09a5..7744594cd3e3 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -724,7 +724,7 @@ static int hisi_sas_init_device(struct domain_device *device)
*/
local_phy = sas_get_local_phy(device);
if (!scsi_is_sas_phy_local(local_phy) &&
- !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) {
+ !test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) {
unsigned long deadline = ata_deadline(jiffies, 20000);
struct sata_device *sata_dev = &device->sata_dev;
struct ata_host *ata_host = sata_dev->ata_host;
@@ -1072,7 +1072,7 @@ static void hisi_sas_dev_gone(struct domain_device *device)
sas_dev->device_id, sas_dev->dev_type);
down(&hisi_hba->sem);
- if (!test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags)) {
+ if (!test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) {
hisi_sas_internal_task_abort(hisi_hba, device,
HISI_SAS_INT_ABT_DEV, 0, true);
@@ -1576,7 +1576,7 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba)
hisi_sas_reset_init_all_devices(hisi_hba);
up(&hisi_hba->sem);
scsi_unblock_requests(shost);
- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags);
+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
hisi_sas_rescan_topology(hisi_hba, hisi_hba->phy_state);
}
@@ -1587,7 +1587,7 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)
if (!hisi_hba->hw->soft_reset)
return -1;
- if (test_and_set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+ if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
return -1;
if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct)
@@ -1611,7 +1611,7 @@ static int hisi_sas_controller_reset(struct hisi_hba *hisi_hba)
clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
up(&hisi_hba->sem);
scsi_unblock_requests(shost);
- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags);
+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
return rc;
}
@@ -2251,7 +2251,7 @@ void hisi_sas_phy_down(struct hisi_hba *hisi_hba, int phy_no, int rdy,
} else {
struct hisi_sas_port *port = phy->port;
- if (test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags) ||
+ if (test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags) ||
phy->in_reset) {
dev_info(dev, "ignore flutter phy%d down\n", phy_no);
return;
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
index afe639994f3d..862f4e8b7eb5 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v1_hw.c
@@ -1422,7 +1422,7 @@ static irqreturn_t int_bcast_v1_hw(int irq, void *p)
goto end;
}
- if (!test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+ if (!test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD,
GFP_ATOMIC);
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
index c40588ed68a5..a6d89a149546 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v2_hw.c
@@ -2831,7 +2831,7 @@ static void phy_bcast_v2_hw(int phy_no, struct hisi_hba *hisi_hba)
hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 1);
bcast_status = hisi_sas_phy_read32(hisi_hba, phy_no, RX_PRIMS_STATUS);
if ((bcast_status & RX_BCAST_CHG_MSK) &&
- !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+ !test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD,
GFP_ATOMIC);
hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0,
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index d1c07e7cb60d..2ed787956fa8 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -1622,7 +1622,7 @@ static irqreturn_t phy_bcast_v3_hw(int phy_no, struct hisi_hba *hisi_hba)
hisi_sas_phy_write32(hisi_hba, phy_no, SL_RX_BCAST_CHK_MSK, 1);
bcast_status = hisi_sas_phy_read32(hisi_hba, phy_no, RX_PRIMS_STATUS);
if ((bcast_status & RX_BCAST_CHG_MSK) &&
- !test_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+ !test_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
sas_notify_port_event(sas_phy, PORTE_BROADCAST_RCVD,
GFP_ATOMIC);
hisi_sas_phy_write32(hisi_hba, phy_no, CHL_INT0,
@@ -4935,7 +4935,7 @@ static void hisi_sas_reset_prepare_v3_hw(struct pci_dev *pdev)
int rc;
dev_info(dev, "FLR prepare\n");
- set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags);
+ set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
hisi_sas_controller_reset_prepare(hisi_hba);
rc = disable_host_v3_hw(hisi_hba);
@@ -4981,7 +4981,7 @@ static int _suspend_v3_hw(struct device *device)
return -ENODEV;
}
- if (test_and_set_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags))
+ if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
return -1;
scsi_block_requests(shost);
@@ -4992,7 +4992,7 @@ static int _suspend_v3_hw(struct device *device)
if (rc) {
dev_err(dev, "PM suspend: disable host failed rc=%d\n", rc);
clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags);
+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
scsi_unblock_requests(shost);
return rc;
}
@@ -5031,7 +5031,7 @@ static int _resume_v3_hw(struct device *device)
}
phys_init_v3_hw(hisi_hba);
sas_resume_ha(sha);
- clear_bit(HISI_SAS_RESET_BIT, &hisi_hba->flags);
+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 143/374] scsi: hisi_sas: Prevent parallel FLR and controller reset
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 142/374] scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 144/374] scsi: hisi_sas: Replace with standard error code return value Greg Kroah-Hartman
` (231 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qi Liu, John Garry,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qi Liu <liuqi115@huawei.com>
[ Upstream commit 16775db613c2bdea09705dcb876942c0641a1098 ]
If we issue a controller reset command during executing a FLR a hung task
may be found:
Call trace:
__switch_to+0x158/0x1cc
__schedule+0x2e8/0x85c
schedule+0x7c/0x110
schedule_timeout+0x190/0x1cc
__down+0x7c/0xd4
down+0x5c/0x7c
hisi_sas_task_exec+0x510/0x680 [hisi_sas_main]
hisi_sas_queue_command+0x24/0x30 [hisi_sas_main]
smp_execute_task_sg+0xf4/0x23c [libsas]
sas_smp_phy_control+0x110/0x1e0 [libsas]
transport_sas_phy_reset+0xc8/0x190 [libsas]
phy_reset_work+0x2c/0x40 [libsas]
process_one_work+0x1dc/0x48c
worker_thread+0x15c/0x464
kthread+0x160/0x170
ret_from_fork+0x10/0x18
This is a race condition which occurs when the FLR completes first.
Here the host HISI_SAS_RESETTING_BIT flag out gets of sync as
HISI_SAS_RESETTING_BIT is not always cleared with the hisi_hba.sem held, so
now only set/unset HISI_SAS_RESETTING_BIT under hisi_hba.sem .
Link: https://lore.kernel.org/r/1639579061-179473-7-git-send-email-john.garry@huawei.com
Signed-off-by: Qi Liu <liuqi115@huawei.com>
Signed-off-by: John Garry <john.garry@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Stable-dep-of: d34ee535705e ("scsi: hisi_sas: Replace with standard error code return value")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_main.c | 8 +++++---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 1 +
2 files changed, 6 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
index 7744594cd3e3..19081790f011 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -1548,7 +1548,6 @@ void hisi_sas_controller_reset_prepare(struct hisi_hba *hisi_hba)
{
struct Scsi_Host *shost = hisi_hba->shost;
- down(&hisi_hba->sem);
hisi_hba->phy_state = hisi_hba->hw->get_phys_state(hisi_hba);
scsi_block_requests(shost);
@@ -1574,9 +1573,9 @@ void hisi_sas_controller_reset_done(struct hisi_hba *hisi_hba)
if (hisi_hba->reject_stp_links_msk)
hisi_sas_terminate_stp_reject(hisi_hba);
hisi_sas_reset_init_all_devices(hisi_hba);
- up(&hisi_hba->sem);
scsi_unblock_requests(shost);
clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
+ up(&hisi_hba->sem);
hisi_sas_rescan_topology(hisi_hba, hisi_hba->phy_state);
}
@@ -1587,8 +1586,11 @@ static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)
if (!hisi_hba->hw->soft_reset)
return -1;
- if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
+ down(&hisi_hba->sem);
+ if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) {
+ up(&hisi_hba->sem);
return -1;
+ }
if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct)
hisi_hba->hw->debugfs_snapshot_regs(hisi_hba);
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 2ed787956fa8..0e57381121d5 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -4935,6 +4935,7 @@ static void hisi_sas_reset_prepare_v3_hw(struct pci_dev *pdev)
int rc;
dev_info(dev, "FLR prepare\n");
+ down(&hisi_hba->sem);
set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
hisi_sas_controller_reset_prepare(hisi_hba);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 144/374] scsi: hisi_sas: Replace with standard error code return value
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 143/374] scsi: hisi_sas: Prevent parallel FLR and controller reset Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 145/374] scsi: hisi_sas: Rollback some operations if FLR failed Greg Kroah-Hartman
` (230 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yihang Li, Xiang Chen,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <liyihang9@huawei.com>
[ Upstream commit d34ee535705eb43885bc0f561c63046f697355ad ]
In function hisi_sas_controller_prereset(), -ENOSYS (Function not
implemented) should be returned if the driver does not support .soft_reset.
Returns -EPERM (Operation not permitted) if HISI_SAS_RESETTING_BIT is
already be set.
In function _suspend_v3_hw(), returns -EPERM (Operation not permitted) if
HISI_SAS_RESETTING_BIT is already be set.
Fixes: 4522204ab218 ("scsi: hisi_sas: tidy host controller reset function a bit")
Signed-off-by: Yihang Li <liyihang9@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Link: https://lore.kernel.org/r/1702525516-51258-3-git-send-email-chenxiang66@hisilicon.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_main.c | 4 ++--
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_main.c b/drivers/scsi/hisi_sas/hisi_sas_main.c
index 19081790f011..530f61df109a 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_main.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_main.c
@@ -1584,12 +1584,12 @@ EXPORT_SYMBOL_GPL(hisi_sas_controller_reset_done);
static int hisi_sas_controller_prereset(struct hisi_hba *hisi_hba)
{
if (!hisi_hba->hw->soft_reset)
- return -1;
+ return -ENOENT;
down(&hisi_hba->sem);
if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags)) {
up(&hisi_hba->sem);
- return -1;
+ return -EPERM;
}
if (hisi_sas_debugfs_enable && hisi_hba->debugfs_itct[0].itct)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 0e57381121d5..88af529ab100 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -4983,7 +4983,7 @@ static int _suspend_v3_hw(struct device *device)
}
if (test_and_set_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags))
- return -1;
+ return -EPERM;
scsi_block_requests(shost);
set_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 145/374] scsi: hisi_sas: Rollback some operations if FLR failed
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 144/374] scsi: hisi_sas: Replace with standard error code return value Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 146/374] scsi: hisi_sas: Correct the number of global debugfs registers Greg Kroah-Hartman
` (229 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yihang Li, Xiang Chen,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <liyihang9@huawei.com>
[ Upstream commit 7ea3e7763c50b20a8bd25cf524ea0c6463de69be ]
We obtain the semaphore and set HISI_SAS_RESETTING_BIT in
hisi_sas_reset_prepare_v3_hw(), block the scsi host and set
HISI_SAS_REJECT_CMD_BIT in hisi_sas_controller_reset_prepare(), released
them in hisi_sas_controller_reset_done(). However, if the HW reset failure
in FLR results in early return, the semaphore and flag bits will not be
release.
Rollback some operations including clearing flags / releasing semaphore
when FLR is failed.
Fixes: e5ea48014adc ("scsi: hisi_sas: Implement handlers of PCIe FLR for v3 hw")
Signed-off-by: Yihang Li <liyihang9@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Link: https://lore.kernel.org/r/1702525516-51258-5-git-send-email-chenxiang66@hisilicon.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 88af529ab100..4505310c0c3c 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -4948,6 +4948,7 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev)
{
struct sas_ha_struct *sha = pci_get_drvdata(pdev);
struct hisi_hba *hisi_hba = sha->lldd_ha;
+ struct Scsi_Host *shost = hisi_hba->shost;
struct device *dev = hisi_hba->dev;
int rc;
@@ -4956,6 +4957,10 @@ static void hisi_sas_reset_done_v3_hw(struct pci_dev *pdev)
rc = hw_init_v3_hw(hisi_hba);
if (rc) {
dev_err(dev, "FLR: hw init failed rc=%d\n", rc);
+ clear_bit(HISI_SAS_REJECT_CMD_BIT, &hisi_hba->flags);
+ scsi_unblock_requests(shost);
+ clear_bit(HISI_SAS_RESETTING_BIT, &hisi_hba->flags);
+ up(&hisi_hba->sem);
return;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 146/374] scsi: hisi_sas: Correct the number of global debugfs registers
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 145/374] scsi: hisi_sas: Rollback some operations if FLR failed Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 147/374] selftests/net: fix grep checking for fib_nexthop_multiprefix Greg Kroah-Hartman
` (228 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yihang Li, Xiang Chen,
Martin K. Petersen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihang Li <liyihang9@huawei.com>
[ Upstream commit 73e33f969ef05328766b23a99b2c07bfff765009 ]
In function debugfs_debugfs_snapshot_global_reg_v3_hw() it uses
debugfs_axi_reg.count (which is the number of axi debugfs registers) to
acquire the number of global debugfs registers.
Use debugfs_global_reg.count to acquire the number of global debugfs
registers instead.
Fixes: 623a4b6d5c2a ("scsi: hisi_sas: Move debugfs code to v3 hw driver")
Signed-off-by: Yihang Li <liyihang9@huawei.com>
Signed-off-by: Xiang Chen <chenxiang66@hisilicon.com>
Link: https://lore.kernel.org/r/1702525516-51258-6-git-send-email-chenxiang66@hisilicon.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
index 4505310c0c3c..1651d03d3b46 100644
--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
+++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c
@@ -3331,7 +3331,7 @@ static void debugfs_snapshot_global_reg_v3_hw(struct hisi_hba *hisi_hba)
u32 *databuf = hisi_hba->debugfs_regs[dump_index][DEBUGFS_GLOBAL].data;
int i;
- for (i = 0; i < debugfs_axi_reg.count; i++, databuf++)
+ for (i = 0; i < debugfs_global_reg.count; i++, databuf++)
*databuf = hisi_sas_read32(hisi_hba, 4 * i);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 147/374] selftests/net: fix grep checking for fib_nexthop_multiprefix
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 146/374] scsi: hisi_sas: Correct the number of global debugfs registers Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 148/374] virtio/vsock: fix logic which reduces credit update messages Greg Kroah-Hartman
` (227 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hangbin Liu, Jakub Kicinski,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hangbin Liu <liuhangbin@gmail.com>
[ Upstream commit a33e9da3470499e9ff476138f271fb52d6bfe767 ]
When running fib_nexthop_multiprefix test I saw all IPv6 test failed.
e.g.
]# ./fib_nexthop_multiprefix.sh
TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ]
TEST: IPv6: host 0 to host 1, mtu 1300 [FAIL]
With -v it shows
COMMAND: ip netns exec h0 /usr/sbin/ping6 -s 1350 -c5 -w5 2001:db8:101::1
PING 2001:db8:101::1(2001:db8:101::1) 1350 data bytes
From 2001:db8:100::64 icmp_seq=1 Packet too big: mtu=1300
--- 2001:db8:101::1 ping statistics ---
1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms
Route get
2001:db8:101::1 via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 metric 1024 expires 599sec mtu 1300 pref medium
Searching for:
2001:db8:101::1 from :: via 2001:db8:100::64 dev eth0 src 2001:db8:100::1 .* mtu 1300
The reason is when CONFIG_IPV6_SUBTREES is not enabled, rt6_fill_node() will
not put RTA_SRC info. After fix:
]# ./fib_nexthop_multiprefix.sh
TEST: IPv4: host 0 to host 1, mtu 1300 [ OK ]
TEST: IPv6: host 0 to host 1, mtu 1300 [ OK ]
Fixes: 735ab2f65dce ("selftests: Add test with multiple prefixes using single nexthop")
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20231213060856.4030084-7-liuhangbin@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/net/fib_nexthop_multiprefix.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
index 51df5e305855..b52d59547fc5 100755
--- a/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
+++ b/tools/testing/selftests/net/fib_nexthop_multiprefix.sh
@@ -209,12 +209,12 @@ validate_v6_exception()
echo "Route get"
ip -netns h0 -6 ro get ${dst}
echo "Searching for:"
- echo " ${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
+ echo " ${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
echo
fi
ip -netns h0 -6 ro get ${dst} | \
- grep -q "${dst} from :: via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
+ grep -q "${dst}.* via ${r1} dev eth0 src ${h0} .* mtu ${mtu}"
rc=$?
log_test $rc 0 "IPv6: host 0 to host ${i}, mtu ${mtu}"
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 148/374] virtio/vsock: fix logic which reduces credit update messages
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 147/374] selftests/net: fix grep checking for fib_nexthop_multiprefix Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 149/374] dma-mapping: Add dma_release_coherent_memory to DMA API Greg Kroah-Hartman
` (226 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Arseniy Krasnov, Stefano Garzarella,
Michael S. Tsirkin, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arseniy Krasnov <avkrasnov@salutedevices.com>
[ Upstream commit 93b80887668226180ea5f5349cc728ca6dc700ab ]
Add one more condition for sending credit update during dequeue from
stream socket: when number of bytes in the rx queue is smaller than
SO_RCVLOWAT value of the socket. This is actual for non-default value
of SO_RCVLOWAT (e.g. not 1) - idea is to "kick" peer to continue data
transmission, because we need at least SO_RCVLOWAT bytes in our rx
queue to wake up user for reading data (in corner case it is also
possible to stuck both tx and rx sides, this is why 'Fixes' is used).
Fixes: b89d882dc9fc ("vsock/virtio: reduce credit update messages")
Signed-off-by: Arseniy Krasnov <avkrasnov@salutedevices.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/vmw_vsock/virtio_transport_common.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c
index 00e8b60af0f8..b490f832439e 100644
--- a/net/vmw_vsock/virtio_transport_common.c
+++ b/net/vmw_vsock/virtio_transport_common.c
@@ -355,6 +355,8 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
struct virtio_vsock_pkt *pkt;
size_t bytes, total = 0;
u32 free_space;
+ u32 fwd_cnt_delta;
+ bool low_rx_bytes;
int err = -EFAULT;
spin_lock_bh(&vvs->rx_lock);
@@ -386,7 +388,10 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
}
}
- free_space = vvs->buf_alloc - (vvs->fwd_cnt - vvs->last_fwd_cnt);
+ fwd_cnt_delta = vvs->fwd_cnt - vvs->last_fwd_cnt;
+ free_space = vvs->buf_alloc - fwd_cnt_delta;
+ low_rx_bytes = (vvs->rx_bytes <
+ sock_rcvlowat(sk_vsock(vsk), 0, INT_MAX));
spin_unlock_bh(&vvs->rx_lock);
@@ -396,9 +401,11 @@ virtio_transport_stream_do_dequeue(struct vsock_sock *vsk,
* too high causes extra messages. Too low causes transmitter
* stalls. As stalls are in theory more expensive than extra
* messages, we set the limit to a high value. TODO: experiment
- * with different values.
+ * with different values. Also send credit update message when
+ * number of bytes in rx queue is not enough to wake up reader.
*/
- if (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE)
+ if (fwd_cnt_delta &&
+ (free_space < VIRTIO_VSOCK_MAX_PKT_BUF_SIZE || low_rx_bytes))
virtio_transport_send_credit_update(vsk);
return total;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 149/374] dma-mapping: Add dma_release_coherent_memory to DMA API
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 148/374] virtio/vsock: fix logic which reduces credit update messages Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 150/374] dma-mapping: clear dev->dma_mem to NULL after freeing it Greg Kroah-Hartman
` (225 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark-PK Tsai, Christoph Hellwig,
Mathieu Poirier, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
[ Upstream commit e61c451476e61450f6771ce03bbc01210a09be16 ]
Add dma_release_coherent_memory to DMA API to allow dma
user call it to release dev->dma_mem when the device is
removed.
Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Acked-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20220422062436.14384-2-mark-pk.tsai@mediatek.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Stable-dep-of: b07bc2347672 ("dma-mapping: clear dev->dma_mem to NULL after freeing it")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/dma-map-ops.h | 3 +++
kernel/dma/coherent.c | 10 ++++++++--
2 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/include/linux/dma-map-ops.h b/include/linux/dma-map-ops.h
index 0d5b06b3a4a6..53db9655efe9 100644
--- a/include/linux/dma-map-ops.h
+++ b/include/linux/dma-map-ops.h
@@ -166,6 +166,7 @@ static inline void dma_pernuma_cma_reserve(void) { }
#ifdef CONFIG_DMA_DECLARE_COHERENT
int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,
dma_addr_t device_addr, size_t size);
+void dma_release_coherent_memory(struct device *dev);
int dma_alloc_from_dev_coherent(struct device *dev, ssize_t size,
dma_addr_t *dma_handle, void **ret);
int dma_release_from_dev_coherent(struct device *dev, int order, void *vaddr);
@@ -177,6 +178,8 @@ static inline int dma_declare_coherent_memory(struct device *dev,
{
return -ENOSYS;
}
+
+#define dma_release_coherent_memory(dev) (0)
#define dma_alloc_from_dev_coherent(dev, size, handle, ret) (0)
#define dma_release_from_dev_coherent(dev, order, vaddr) (0)
#define dma_mmap_from_dev_coherent(dev, vma, vaddr, order, ret) (0)
diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
index 25fc85a7aebe..ca05989d9901 100644
--- a/kernel/dma/coherent.c
+++ b/kernel/dma/coherent.c
@@ -75,7 +75,7 @@ static struct dma_coherent_mem *dma_init_coherent_memory(phys_addr_t phys_addr,
return ERR_PTR(-ENOMEM);
}
-static void dma_release_coherent_memory(struct dma_coherent_mem *mem)
+static void _dma_release_coherent_memory(struct dma_coherent_mem *mem)
{
if (!mem)
return;
@@ -127,10 +127,16 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,
ret = dma_assign_coherent_memory(dev, mem);
if (ret)
- dma_release_coherent_memory(mem);
+ _dma_release_coherent_memory(mem);
return ret;
}
+void dma_release_coherent_memory(struct device *dev)
+{
+ if (dev)
+ _dma_release_coherent_memory(dev->dma_mem);
+}
+
static void *__dma_alloc_from_coherent(struct device *dev,
struct dma_coherent_mem *mem,
ssize_t size, dma_addr_t *dma_handle)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 150/374] dma-mapping: clear dev->dma_mem to NULL after freeing it
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 149/374] dma-mapping: Add dma_release_coherent_memory to DMA API Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 151/374] soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration Greg Kroah-Hartman
` (224 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joakim Zhang, Christoph Hellwig,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joakim Zhang <joakim.zhang@cixtech.com>
[ Upstream commit b07bc2347672cc8c7293c64499f1488278c5ca3d ]
Reproduced with below sequence:
dma_declare_coherent_memory()->dma_release_coherent_memory()
->dma_declare_coherent_memory()->"return -EBUSY" error
It will return -EBUSY from the dma_assign_coherent_memory()
in dma_declare_coherent_memory(), the reason is that dev->dma_mem
pointer has not been set to NULL after it's freed.
Fixes: cf65a0f6f6ff ("dma-mapping: move all DMA mapping code to kernel/dma")
Signed-off-by: Joakim Zhang <joakim.zhang@cixtech.com>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/dma/coherent.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/kernel/dma/coherent.c b/kernel/dma/coherent.c
index ca05989d9901..2df824fa40ef 100644
--- a/kernel/dma/coherent.c
+++ b/kernel/dma/coherent.c
@@ -133,8 +133,10 @@ int dma_declare_coherent_memory(struct device *dev, phys_addr_t phys_addr,
void dma_release_coherent_memory(struct device *dev)
{
- if (dev)
+ if (dev) {
_dma_release_coherent_memory(dev->dma_mem);
+ dev->dma_mem = NULL;
+ }
}
static void *__dma_alloc_from_coherent(struct device *dev,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 151/374] soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 150/374] dma-mapping: clear dev->dma_mem to NULL after freeing it Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 152/374] arm64: dts: qcom: sm8150-hdk: fix SS USB regulators Greg Kroah-Hartman
` (223 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Atul Dhudase, Mukesh Ojha,
Douglas Anderson, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Atul Dhudase <quic_adhudase@quicinc.com>
[ Upstream commit eed6e57e9f3e2beac37563eb6a0129549daa330e ]
Commit c14e64b46944 ("soc: qcom: llcc: Support chipsets that can
write to llcc") add the support for chipset where capacity based
allocation and retention through power collapse can be programmed
based on content of SCT table mentioned in the llcc driver where
the target like sdm845 where the entire programming related to it
is controlled in firmware. However, the commit introduces a bug
where capacity/retention register get overwritten each time it
gets programmed for each slice and that results in misconfiguration
of the register based on SCT table and that is not expected
behaviour instead it should be read modify write to retain the
configuration of other slices.
This issue is totally caught from code review and programming test
and not through any power/perf numbers so, it is not known what
impact this could make if we don't have this change however,
this feature are for these targets and they should have been
programmed accordingly as per their configuration mentioned in
SCT table like others bits information.
This change brings one difference where it keeps capacity/retention
bits of the slices that are not mentioned in SCT table in unknown
state where as earlier it was initialized to zero.
Fixes: c14e64b46944 ("soc: qcom: llcc: Support chipsets that can write to llcc")
Signed-off-by: Atul Dhudase <quic_adhudase@quicinc.com>
Signed-off-by: Mukesh Ojha <quic_mojha@quicinc.com>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/1701876771-10695-1-git-send-email-quic_mojha@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/soc/qcom/llcc-qcom.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/drivers/soc/qcom/llcc-qcom.c b/drivers/soc/qcom/llcc-qcom.c
index fabc5ce828af..59e359e9062b 100644
--- a/drivers/soc/qcom/llcc-qcom.c
+++ b/drivers/soc/qcom/llcc-qcom.c
@@ -450,14 +450,14 @@ static int _qcom_llcc_cfg_program(const struct llcc_slice_config *config,
u32 disable_cap_alloc, retain_pc;
disable_cap_alloc = config->dis_cap_alloc << config->slice_id;
- ret = regmap_write(drv_data->bcast_regmap,
- LLCC_TRP_SCID_DIS_CAP_ALLOC, disable_cap_alloc);
+ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_SCID_DIS_CAP_ALLOC,
+ BIT(config->slice_id), disable_cap_alloc);
if (ret)
return ret;
retain_pc = config->retain_on_pc << config->slice_id;
- ret = regmap_write(drv_data->bcast_regmap,
- LLCC_TRP_PCB_ACT, retain_pc);
+ ret = regmap_update_bits(drv_data->bcast_regmap, LLCC_TRP_PCB_ACT,
+ BIT(config->slice_id), retain_pc);
if (ret)
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 152/374] arm64: dts: qcom: sm8150-hdk: fix SS USB regulators
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 151/374] soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 153/374] block: add check of minors and first_minor in device_add_disk() Greg Kroah-Hartman
` (222 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit a509adf05b2aac31b22781f5aa09e4768a5b6c39 ]
The SM8150-HDK uses two different regulators to power up SuperSpeed USB
PHYs. The L5A regulator is used for the second USB host, while the first
(OTG) USB host uses different regulator, L18A. Fix the regulator for the
usb_1 QMPPHY and (to remove possible confusion) drop the
usb_ss_dp_core_1/_2 labels.
Fixes: 0ab1b2d10afe ("arm64: dts: qcom: add sm8150 hdk dts")
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20231215174152.315403-4-dmitry.baryshkov@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sm8150-hdk.dts | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
index 335aa0753fc0..716e964946ed 100644
--- a/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
+++ b/arch/arm64/boot/dts/qcom/sm8150-hdk.dts
@@ -126,8 +126,6 @@ vdda_qrefs_0p875_5:
vdda_sp_sensor:
vdda_ufs_2ln_core_1:
vdda_ufs_2ln_core_2:
- vdda_usb_ss_dp_core_1:
- vdda_usb_ss_dp_core_2:
vdda_qlink_lv:
vdda_qlink_lv_ck:
vreg_l5a_0p875: ldo5 {
@@ -209,6 +207,12 @@ vreg_l17a_3p0: ldo17 {
regulator-max-microvolt = <3008000>;
regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
};
+
+ vreg_l18a_0p8: ldo18 {
+ regulator-min-microvolt = <880000>;
+ regulator-max-microvolt = <880000>;
+ regulator-initial-mode = <RPMH_REGULATOR_MODE_HPM>;
+ };
};
pm8150l-rpmh-regulators {
@@ -441,13 +445,13 @@ &usb_2_hsphy {
&usb_1_qmpphy {
status = "okay";
vdda-phy-supply = <&vreg_l3c_1p2>;
- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
+ vdda-pll-supply = <&vreg_l18a_0p8>;
};
&usb_2_qmpphy {
status = "okay";
vdda-phy-supply = <&vreg_l3c_1p2>;
- vdda-pll-supply = <&vdda_usb_ss_dp_core_1>;
+ vdda-pll-supply = <&vreg_l5a_0p875>;
};
&usb_1 {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 153/374] block: add check of minors and first_minor in device_add_disk()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 152/374] arm64: dts: qcom: sm8150-hdk: fix SS USB regulators Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 154/374] arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent Greg Kroah-Hartman
` (221 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Nan, Christoph Hellwig,
Jens Axboe, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 4c434392c4777881d01beada6701eff8c76b43fe ]
'first_minor' represents the starting minor number of disks, and
'minors' represents the number of partitions in the device. Neither
of them can be greater than MINORMASK + 1.
Commit e338924bd05d ("block: check minor range in device_add_disk()")
only added the check of 'first_minor + minors'. However, their sum might
be less than MINORMASK but their values are wrong. Complete the checks now.
Fixes: e338924bd05d ("block: check minor range in device_add_disk()")
Signed-off-by: Li Nan <linan122@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20231219075942.840255-1-linan666@huaweicloud.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/genhd.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/block/genhd.c b/block/genhd.c
index 6aef540bbacf..84f5ac627e79 100644
--- a/block/genhd.c
+++ b/block/genhd.c
@@ -421,7 +421,9 @@ int device_add_disk(struct device *parent, struct gendisk *disk,
DISK_MAX_PARTS);
disk->minors = DISK_MAX_PARTS;
}
- if (disk->first_minor + disk->minors > MINORMASK + 1)
+ if (disk->first_minor > MINORMASK ||
+ disk->minors > MINORMASK + 1 ||
+ disk->first_minor + disk->minors > MINORMASK + 1)
return -EINVAL;
} else {
if (WARN_ON(disk->minors))
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 154/374] arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 153/374] block: add check of minors and first_minor in device_add_disk() Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 155/374] wifi: rtlwifi: add calculate_bit_shift() Greg Kroah-Hartman
` (220 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Bjorn Andersson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 827f5fc8d912203c1f971e47d61130b13c6820ba ]
The SDHCI hosts on SC7280 are cache-coherent, just like on most fairly
recent Qualcomm SoCs. Mark them as such.
Fixes: 298c81a7d44f ("arm64: dts: qcom: sc7280: Add nodes for eMMC and SD card")
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231218-topic-7280_dmac_sdhci-v1-1-97af7efd64a1@linaro.org
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm64/boot/dts/qcom/sc7280.dtsi | 2 ++
1 file changed, 2 insertions(+)
diff --git a/arch/arm64/boot/dts/qcom/sc7280.dtsi b/arch/arm64/boot/dts/qcom/sc7280.dtsi
index e0c7f72773d6..929fc0667e98 100644
--- a/arch/arm64/boot/dts/qcom/sc7280.dtsi
+++ b/arch/arm64/boot/dts/qcom/sc7280.dtsi
@@ -485,6 +485,7 @@ sdhc_1: sdhci@7c4000 {
bus-width = <8>;
supports-cqe;
+ dma-coherent;
qcom,dll-config = <0x0007642c>;
qcom,ddr-config = <0x80040868>;
@@ -1174,6 +1175,7 @@ sdhc_2: sdhci@8804000 {
operating-points-v2 = <&sdhc2_opp_table>;
bus-width = <4>;
+ dma-coherent;
qcom,dll-config = <0x0007642c>;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 155/374] wifi: rtlwifi: add calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (153 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 154/374] arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 156/374] wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() Greg Kroah-Hartman
` (219 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Su Hui, Ping-Ke Shih, Kalle Valo,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 52221dfddbbfb5b4e029bb2efe9bb7da33ec1e46 ]
There are many same functions like _rtl88e_phy_calculate_bit_shift(),
_rtl92c_phy_calculate_bit_shift() and so on. And these functions can
cause undefined bitwise shift behavior. Add calculate_bit_shift() to
replace them and fix undefined behavior in subsequent patches.
Signed-off-by: Su Hui <suhui@nfschina.com>
Acked-by: Ping-Ke Shih <pkshih@realtek.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-2-suhui@nfschina.com
Stable-dep-of: 969bc926f04b ("wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/wifi.h | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h
index aa07856411b1..a1f223c8848b 100644
--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h
+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h
@@ -3106,4 +3106,11 @@ static inline struct ieee80211_sta *rtl_find_sta(struct ieee80211_hw *hw,
return ieee80211_find_sta(mac->vif, mac_addr);
}
+static inline u32 calculate_bit_shift(u32 bitmask)
+{
+ if (WARN_ON_ONCE(!bitmask))
+ return 0;
+
+ return __ffs(bitmask);
+}
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 156/374] wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (154 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 155/374] wifi: rtlwifi: add calculate_bit_shift() Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 157/374] wifi: rtlwifi: rtl8192c: " Greg Kroah-Hartman
` (218 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 969bc926f04b438676768aeffffffb050e480b62 ]
Using calculate_bit_shift() to replace _rtl88e_phy_calculate_bit_shift().
And fix the undefined bitwise shift behavior problem.
Fixes: f0eb856e0b6c ("rtlwifi: rtl8188ee: Add new driver")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-4-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/realtek/rtlwifi/rtl8188ee/phy.c | 14 ++++----------
1 file changed, 4 insertions(+), 10 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
index 12d0b3a87af7..0fab3a0c7d49 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8188ee/phy.c
@@ -16,12 +16,6 @@ static u32 _rtl88e_phy_rf_serial_read(struct ieee80211_hw *hw,
static void _rtl88e_phy_rf_serial_write(struct ieee80211_hw *hw,
enum radio_path rfpath, u32 offset,
u32 data);
-static u32 _rtl88e_phy_calculate_bit_shift(u32 bitmask)
-{
- u32 i = ffs(bitmask);
-
- return i ? i - 1 : 32;
-}
static bool _rtl88e_phy_bb8188e_config_parafile(struct ieee80211_hw *hw);
static bool _rtl88e_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
static bool phy_config_bb_with_headerfile(struct ieee80211_hw *hw,
@@ -51,7 +45,7 @@ u32 rtl88e_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
"regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
returnvalue = (originalvalue & bitmask) >> bitshift;
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
@@ -74,7 +68,7 @@ void rtl88e_phy_set_bb_reg(struct ieee80211_hw *hw,
if (bitmask != MASKDWORD) {
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((originalvalue & (~bitmask)) | (data << bitshift));
}
@@ -99,7 +93,7 @@ u32 rtl88e_phy_query_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl88e_phy_rf_serial_read(hw, rfpath, regaddr);
- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
readback_value = (original_value & bitmask) >> bitshift;
spin_unlock(&rtlpriv->locks.rf_lock);
@@ -127,7 +121,7 @@ void rtl88e_phy_set_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl88e_phy_rf_serial_read(hw,
rfpath,
regaddr);
- bitshift = _rtl88e_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data =
((original_value & (~bitmask)) |
(data << bitshift));
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 157/374] wifi: rtlwifi: rtl8192c: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (155 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 156/374] wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 158/374] wifi: rtlwifi: rtl8192cu: " Greg Kroah-Hartman
` (217 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 1dedc3a6699d827d345019e921b8d8f37f694333 ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
And fix the undefined bitwise shift behavior problem.
Fixes: 4295cd254af3 ("rtlwifi: Move common parts of rtl8192ce/phy.c")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-5-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../wireless/realtek/rtlwifi/rtl8192c/phy_common.c | 12 ++----------
.../wireless/realtek/rtlwifi/rtl8192c/phy_common.h | 1 -
2 files changed, 2 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
index 3d29c8dbb255..144ee780e1b6 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.c
@@ -17,7 +17,7 @@ u32 rtl92c_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "regaddr(%#x), bitmask(%#x)\n",
regaddr, bitmask);
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
returnvalue = (originalvalue & bitmask) >> bitshift;
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
@@ -40,7 +40,7 @@ void rtl92c_phy_set_bb_reg(struct ieee80211_hw *hw,
if (bitmask != MASKDWORD) {
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((originalvalue & (~bitmask)) | (data << bitshift));
}
@@ -143,14 +143,6 @@ void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
}
EXPORT_SYMBOL(_rtl92c_phy_rf_serial_write);
-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask)
-{
- u32 i = ffs(bitmask);
-
- return i ? i - 1 : 32;
-}
-EXPORT_SYMBOL(_rtl92c_phy_calculate_bit_shift);
-
static void _rtl92c_phy_bb_config_1t(struct ieee80211_hw *hw)
{
rtl_set_bbreg(hw, RFPGA0_TXINFO, 0x3, 0x2);
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
index 75afa6253ad0..e64d377dfe9e 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192c/phy_common.h
@@ -196,7 +196,6 @@ bool rtl92c_phy_set_rf_power_state(struct ieee80211_hw *hw,
void rtl92ce_phy_set_rf_on(struct ieee80211_hw *hw);
void rtl92c_phy_set_io(struct ieee80211_hw *hw);
void rtl92c_bb_block_on(struct ieee80211_hw *hw);
-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
long _rtl92c_phy_txpwr_idx_to_dbm(struct ieee80211_hw *hw,
enum wireless_mode wirelessmode,
u8 txpwridx);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 158/374] wifi: rtlwifi: rtl8192cu: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (156 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 157/374] wifi: rtlwifi: rtl8192c: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 159/374] wifi: rtlwifi: rtl8192ce: " Greg Kroah-Hartman
` (216 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit f4088c8fcbabadad9dd17d17ae9ba24e9e3221ec ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
And fix an undefined bitwise shift behavior problem.
Fixes: f0a39ae738d6 ("rtlwifi: rtl8192cu: Add routine phy")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-6-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
index a8d9fe269f31..0b8cb7e61fd8 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/phy.c
@@ -32,7 +32,7 @@ u32 rtl92cu_phy_query_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl92c_phy_fw_rf_serial_read(hw,
rfpath, regaddr);
}
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
readback_value = (original_value & bitmask) >> bitshift;
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
"regaddr(%#x), rfpath(%#x), bitmask(%#x), original_value(%#x)\n",
@@ -56,7 +56,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl92c_phy_rf_serial_read(hw,
rfpath,
regaddr);
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data =
((original_value & (~bitmask)) |
(data << bitshift));
@@ -67,7 +67,7 @@ void rtl92cu_phy_set_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl92c_phy_fw_rf_serial_read(hw,
rfpath,
regaddr);
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data =
((original_value & (~bitmask)) |
(data << bitshift));
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 159/374] wifi: rtlwifi: rtl8192ce: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (157 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 158/374] wifi: rtlwifi: rtl8192cu: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 160/374] wifi: rtlwifi: rtl8192de: " Greg Kroah-Hartman
` (215 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 3d03e8231031bcc65a48cd88ef9c71b6524ce70b ]
Using calculate_bit_shift() to replace _rtl92c_phy_calculate_bit_shift().
And fix the undefined bitwise shift behavior problem.
Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-7-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c | 6 +++---
drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h | 1 -
2 files changed, 3 insertions(+), 4 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
index 04735da11168..6b98e77768e9 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.c
@@ -39,7 +39,7 @@ u32 rtl92c_phy_query_rf_reg(struct ieee80211_hw *hw,
rfpath, regaddr);
}
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
readback_value = (original_value & bitmask) >> bitshift;
spin_unlock(&rtlpriv->locks.rf_lock);
@@ -110,7 +110,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl92c_phy_rf_serial_read(hw,
rfpath,
regaddr);
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data =
((original_value & (~bitmask)) |
(data << bitshift));
@@ -122,7 +122,7 @@ void rtl92ce_phy_set_rf_reg(struct ieee80211_hw *hw,
original_value = _rtl92c_phy_fw_rf_serial_read(hw,
rfpath,
regaddr);
- bitshift = _rtl92c_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data =
((original_value & (~bitmask)) |
(data << bitshift));
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
index 7582a162bd11..c7a0d4c776f0 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ce/phy.h
@@ -94,7 +94,6 @@ u32 _rtl92c_phy_rf_serial_read(struct ieee80211_hw *hw, enum radio_path rfpath,
u32 offset);
u32 _rtl92c_phy_fw_rf_serial_read(struct ieee80211_hw *hw,
enum radio_path rfpath, u32 offset);
-u32 _rtl92c_phy_calculate_bit_shift(u32 bitmask);
void _rtl92c_phy_rf_serial_write(struct ieee80211_hw *hw,
enum radio_path rfpath, u32 offset, u32 data);
void _rtl92c_phy_fw_rf_serial_write(struct ieee80211_hw *hw,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 160/374] wifi: rtlwifi: rtl8192de: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (158 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 159/374] wifi: rtlwifi: rtl8192ce: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 161/374] wifi: rtlwifi: rtl8192ee: " Greg Kroah-Hartman
` (214 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit b8b2baad2e652042cf8b6339939ac2f4e6f53de4 ]
Using calculate_bit_shift() to replace _rtl92d_phy_calculate_bit_shift().
And fix the undefined bitwise shift behavior problem.
Fixes: 7274a8c22980 ("rtlwifi: rtl8192de: Merge phy routines")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-8-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/realtek/rtlwifi/rtl8192de/phy.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
index 4d153bd62c53..c3c07ca77614 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192de/phy.c
@@ -169,13 +169,6 @@ static const u8 channel_all[59] = {
157, 159, 161, 163, 165
};
-static u32 _rtl92d_phy_calculate_bit_shift(u32 bitmask)
-{
- u32 i = ffs(bitmask);
-
- return i ? i - 1 : 32;
-}
-
u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -198,7 +191,7 @@ u32 rtl92d_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
} else {
originalvalue = rtl_read_dword(rtlpriv, regaddr);
}
- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
returnvalue = (originalvalue & bitmask) >> bitshift;
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
"BBR MASK=0x%x Addr[0x%x]=0x%x\n",
@@ -230,7 +223,7 @@ void rtl92d_phy_set_bb_reg(struct ieee80211_hw *hw,
dbi_direct);
else
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((originalvalue & (~bitmask)) | (data << bitshift));
}
if (rtlhal->during_mac1init_radioa || rtlhal->during_mac0init_radiob)
@@ -317,7 +310,7 @@ u32 rtl92d_phy_query_rf_reg(struct ieee80211_hw *hw,
regaddr, rfpath, bitmask);
spin_lock(&rtlpriv->locks.rf_lock);
original_value = _rtl92d_phy_rf_serial_read(hw, rfpath, regaddr);
- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
readback_value = (original_value & bitmask) >> bitshift;
spin_unlock(&rtlpriv->locks.rf_lock);
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
@@ -343,7 +336,7 @@ void rtl92d_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
if (bitmask != RFREG_OFFSET_MASK) {
original_value = _rtl92d_phy_rf_serial_read(hw,
rfpath, regaddr);
- bitshift = _rtl92d_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((original_value & (~bitmask)) |
(data << bitshift));
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 161/374] wifi: rtlwifi: rtl8192ee: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (159 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 160/374] wifi: rtlwifi: rtl8192de: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 162/374] wifi: rtlwifi: rtl8192se: " Greg Kroah-Hartman
` (213 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 63526897fc0d086069bcab67c3a112caaec751cb ]
Using calculate_bit_shift() to replace _rtl92ee_phy_calculate_bit_shift().
And fix the undefined bitwise shift behavior problem.
Fixes: b1a3bfc97cd9 ("rtlwifi: rtl8192ee: Move driver from staging to the regular tree")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-9-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/realtek/rtlwifi/rtl8192ee/phy.c | 16 ++++------------
1 file changed, 4 insertions(+), 12 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
index cc0bcaf13e96..73ef602bfb01 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/phy.c
@@ -16,7 +16,6 @@ static u32 _rtl92ee_phy_rf_serial_read(struct ieee80211_hw *hw,
static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
enum radio_path rfpath, u32 offset,
u32 data);
-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask);
static bool _rtl92ee_phy_bb8192ee_config_parafile(struct ieee80211_hw *hw);
static bool _rtl92ee_phy_config_mac_with_headerfile(struct ieee80211_hw *hw);
static bool phy_config_bb_with_hdr_file(struct ieee80211_hw *hw,
@@ -46,7 +45,7 @@ u32 rtl92ee_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
"regaddr(%#x), bitmask(%#x)\n", regaddr, bitmask);
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
returnvalue = (originalvalue & bitmask) >> bitshift;
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE,
@@ -68,7 +67,7 @@ void rtl92ee_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr,
if (bitmask != MASKDWORD) {
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((originalvalue & (~bitmask)) | (data << bitshift));
}
@@ -92,7 +91,7 @@ u32 rtl92ee_phy_query_rf_reg(struct ieee80211_hw *hw,
spin_lock(&rtlpriv->locks.rf_lock);
original_value = _rtl92ee_phy_rf_serial_read(hw , rfpath, regaddr);
- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
readback_value = (original_value & bitmask) >> bitshift;
spin_unlock(&rtlpriv->locks.rf_lock);
@@ -119,7 +118,7 @@ void rtl92ee_phy_set_rf_reg(struct ieee80211_hw *hw,
if (bitmask != RFREG_OFFSET_MASK) {
original_value = _rtl92ee_phy_rf_serial_read(hw, rfpath, addr);
- bitshift = _rtl92ee_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = (original_value & (~bitmask)) | (data << bitshift);
}
@@ -201,13 +200,6 @@ static void _rtl92ee_phy_rf_serial_write(struct ieee80211_hw *hw,
pphyreg->rf3wire_offset, data_and_addr);
}
-static u32 _rtl92ee_phy_calculate_bit_shift(u32 bitmask)
-{
- u32 i = ffs(bitmask);
-
- return i ? i - 1 : 32;
-}
-
bool rtl92ee_phy_mac_config(struct ieee80211_hw *hw)
{
return _rtl92ee_phy_config_mac_with_headerfile(hw);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 162/374] wifi: rtlwifi: rtl8192se: using calculate_bit_shift()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (160 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 161/374] wifi: rtlwifi: rtl8192ee: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 163/374] wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request Greg Kroah-Hartman
` (212 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Kalle Valo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit ac32b9317063b101a8ff3d3e885f76f87a280419 ]
Using calculate_bit_shift() to replace _rtl92s_phy_calculate_bit_shift().
And fix the undefined bitwise shift behavior problem.
Fixes: d15853163bea ("rtlwifi: rtl8192se: Merge phy routines")
Signed-off-by: Su Hui <suhui@nfschina.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231219065739.1895666-10-suhui@nfschina.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/wireless/realtek/rtlwifi/rtl8192se/phy.c | 15 ++++-----------
1 file changed, 4 insertions(+), 11 deletions(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
index aaa004d4d6d0..0e2b9698088b 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192se/phy.c
@@ -14,13 +14,6 @@
#include "hw.h"
#include "table.h"
-static u32 _rtl92s_phy_calculate_bit_shift(u32 bitmask)
-{
- u32 i = ffs(bitmask);
-
- return i ? i - 1 : 32;
-}
-
u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
{
struct rtl_priv *rtlpriv = rtl_priv(hw);
@@ -30,7 +23,7 @@ u32 rtl92s_phy_query_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask)
regaddr, bitmask);
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
returnvalue = (originalvalue & bitmask) >> bitshift;
rtl_dbg(rtlpriv, COMP_RF, DBG_TRACE, "BBR MASK=0x%x Addr[0x%x]=0x%x\n",
@@ -52,7 +45,7 @@ void rtl92s_phy_set_bb_reg(struct ieee80211_hw *hw, u32 regaddr, u32 bitmask,
if (bitmask != MASKDWORD) {
originalvalue = rtl_read_dword(rtlpriv, regaddr);
- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((originalvalue & (~bitmask)) | (data << bitshift));
}
@@ -160,7 +153,7 @@ u32 rtl92s_phy_query_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
original_value = _rtl92s_phy_rf_serial_read(hw, rfpath, regaddr);
- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
readback_value = (original_value & bitmask) >> bitshift;
spin_unlock(&rtlpriv->locks.rf_lock);
@@ -191,7 +184,7 @@ void rtl92s_phy_set_rf_reg(struct ieee80211_hw *hw, enum radio_path rfpath,
if (bitmask != RFREG_OFFSET_MASK) {
original_value = _rtl92s_phy_rf_serial_read(hw, rfpath,
regaddr);
- bitshift = _rtl92s_phy_calculate_bit_shift(bitmask);
+ bitshift = calculate_bit_shift(bitmask);
data = ((original_value & (~bitmask)) | (data << bitshift));
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 163/374] wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (161 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 162/374] wifi: rtlwifi: rtl8192se: " Greg Kroah-Hartman
@ 2024-01-22 23:56 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 164/374] wifi: iwlwifi: mvm: send TX path flush in rfkill Greg Kroah-Hartman
` (211 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:56 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Luciano Coelho,
Miri Korenblit, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit b1a2e5c310e063560760806d2cc5d2233c596067 ]
The firmware changed their mind, don't set the chains to zero,
instead set them to 1 as we normally would for connections to
APs that don't use MIMO.
Fixes: 2a7ce54ccc23 ("iwlwifi: mvm: honour firmware SMPS requests")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231219215605.7f031f1a127f.Idc816e0f604b07d22a9d5352bc23c445512fad14@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c | 11 -----------
1 file changed, 11 deletions(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
index 6d82725cb87d..32ed8227d985 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/phy-ctxt.c
@@ -99,17 +99,6 @@ static void iwl_mvm_phy_ctxt_set_rxchain(struct iwl_mvm *mvm,
active_cnt = 2;
}
- /*
- * If the firmware requested it, then we know that it supports
- * getting zero for the values to indicate "use one, but pick
- * which one yourself", which means it can dynamically pick one
- * that e.g. has better RSSI.
- */
- if (mvm->fw_static_smps_request && active_cnt == 1 && idle_cnt == 1) {
- idle_cnt = 0;
- active_cnt = 0;
- }
-
*rxchain_info = cpu_to_le32(iwl_mvm_get_valid_rx_ant(mvm) <<
PHY_RX_CHAIN_VALID_POS);
*rxchain_info |= cpu_to_le32(idle_cnt << PHY_RX_CHAIN_CNT_POS);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 164/374] wifi: iwlwifi: mvm: send TX path flush in rfkill
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (162 preceding siblings ...)
2024-01-22 23:56 ` [PATCH 5.15 163/374] wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 165/374] netfilter: nf_tables: mark newset as dead on transaction abort Greg Kroah-Hartman
` (210 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Johannes Berg, Gregory Greenman,
Miri Korenblit, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Berg <johannes.berg@intel.com>
[ Upstream commit 2afc3dad39ea84a072d04ff40a417234326adc47 ]
If we want to drop packets, that's surely a good thing to
do when we want to enter rfkill. Send this command despite
rfkill so we can successfully clean up everything, we need
to handle it separately since it has CMD_WANT_SKB, so it's
not going to automatically return success when in rfkill.
Fixes: d4e3a341b87b ("iwlwifi: mvm: add support for new flush queue response")
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Reviewed-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com>
Link: https://msgid.link/20231219215605.c528a6fa6cec.Ibe5e9560359ccc0fba60c35e01de285c376748a2@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/intel/iwlwifi/mvm/tx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
index 08dd227bad4b..266d1e9a89f5 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c
@@ -2054,7 +2054,7 @@ int iwl_mvm_flush_sta_tids(struct iwl_mvm *mvm, u32 sta_id, u16 tids)
WARN_ON(!iwl_mvm_has_new_tx_api(mvm));
if (iwl_fw_lookup_notif_ver(mvm->fw, LONG_GROUP, TXPATH_FLUSH, 0) > 0)
- cmd.flags |= CMD_WANT_SKB;
+ cmd.flags |= CMD_WANT_SKB | CMD_SEND_IN_RFKILL;
IWL_DEBUG_TX_QUEUES(mvm, "flush for sta id %d tid mask 0x%x\n",
sta_id, tids);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 165/374] netfilter: nf_tables: mark newset as dead on transaction abort
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (163 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 164/374] wifi: iwlwifi: mvm: send TX path flush in rfkill Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 166/374] Bluetooth: Fix bogus check for re-auth no supported with non-ssp Greg Kroah-Hartman
` (209 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
[ Upstream commit 08e4c8c5919fd405a4d709b4ba43d836894a26eb ]
If a transaction is aborted, we should mark the to-be-released NEWSET dead,
just like commit path does for DEL and DESTROYSET commands.
In both cases all remaining elements will be released via
set->ops->destroy().
The existing abort code does NOT post the actual release to the work queue.
Also the entire __nf_tables_abort() function is wrapped in gc_seq
begin/end pair.
Therefore, async gc worker will never try to release the pending set
elements, as gc sequence is always stale.
It might be possible to speed up transaction aborts via work queue too,
this would result in a race and a possible use-after-free.
So fix this before it becomes an issue.
Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 3556818c7162..5fb8c7f0ad02 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -9740,6 +9740,7 @@ static int __nf_tables_abort(struct net *net, enum nfnl_abort_action action)
nft_trans_destroy(trans);
break;
}
+ nft_trans_set(trans)->dead = 1;
list_del_rcu(&nft_trans_set(trans)->list);
break;
case NFT_MSG_DELSET:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 166/374] Bluetooth: Fix bogus check for re-auth no supported with non-ssp
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (164 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 165/374] netfilter: nf_tables: mark newset as dead on transaction abort Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 167/374] Bluetooth: btmtkuart: fix recv_buf() return value Greg Kroah-Hartman
` (208 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Luiz Augusto von Dentz, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
[ Upstream commit d03376c185926098cb4d668d6458801eb785c0a5 ]
This reverts 19f8def031bfa50c579149b200bfeeb919727b27
"Bluetooth: Fix auth_complete_evt for legacy units" which seems to be
working around a bug on a broken controller rather then any limitation
imposed by the Bluetooth spec, in fact if there ws not possible to
re-auth the command shall fail not succeed.
Fixes: 19f8def031bf ("Bluetooth: Fix auth_complete_evt for legacy units")
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/bluetooth/hci_core.h | 1 -
net/bluetooth/hci_conn.c | 8 +++-----
net/bluetooth/hci_event.c | 11 ++---------
3 files changed, 5 insertions(+), 15 deletions(-)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index 9a21ccbb5b5c..b6114bc0dd0f 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -852,7 +852,6 @@ void hci_inquiry_cache_flush(struct hci_dev *hdev);
/* ----- HCI Connections ----- */
enum {
HCI_CONN_AUTH_PEND,
- HCI_CONN_REAUTH_PEND,
HCI_CONN_ENCRYPT_PEND,
HCI_CONN_RSWITCH_PEND,
HCI_CONN_MODE_CHANGE_PEND,
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index ce538dbe89d1..700920aea39e 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -1436,12 +1436,10 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
sizeof(cp), &cp);
- /* If we're already encrypted set the REAUTH_PEND flag,
- * otherwise set the ENCRYPT_PEND.
+ /* Set the ENCRYPT_PEND to trigger encryption after
+ * authentication.
*/
- if (test_bit(HCI_CONN_ENCRYPT, &conn->flags))
- set_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
- else
+ if (!test_bit(HCI_CONN_ENCRYPT, &conn->flags))
set_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
}
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index edf5132b5dc9..2ad2f4647847 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3017,14 +3017,8 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
if (!ev->status) {
clear_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
-
- if (!hci_conn_ssp_enabled(conn) &&
- test_bit(HCI_CONN_REAUTH_PEND, &conn->flags)) {
- bt_dev_info(hdev, "re-auth of legacy device is not possible.");
- } else {
- set_bit(HCI_CONN_AUTH, &conn->flags);
- conn->sec_level = conn->pending_sec_level;
- }
+ set_bit(HCI_CONN_AUTH, &conn->flags);
+ conn->sec_level = conn->pending_sec_level;
} else {
if (ev->status == HCI_ERROR_PIN_OR_KEY_MISSING)
set_bit(HCI_CONN_AUTH_FAILURE, &conn->flags);
@@ -3033,7 +3027,6 @@ static void hci_auth_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
}
clear_bit(HCI_CONN_AUTH_PEND, &conn->flags);
- clear_bit(HCI_CONN_REAUTH_PEND, &conn->flags);
if (conn->state == BT_CONFIG) {
if (!ev->status && hci_conn_ssp_enabled(conn)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 167/374] Bluetooth: btmtkuart: fix recv_buf() return value
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (165 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 166/374] Bluetooth: Fix bogus check for re-auth no supported with non-ssp Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 168/374] block: make BLK_DEF_MAX_SECTORS unsigned Greg Kroah-Hartman
` (207 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini,
Luiz Augusto von Dentz, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
[ Upstream commit 64057f051f20c2a2184b9db7f8037d928d68a4f4 ]
Serdev recv_buf() callback is supposed to return the amount of bytes
consumed, therefore an int in between 0 and count.
Do not return negative number in case of issue, just print an error and
return count. This fixes a WARN in ttyport_receive_buf().
Link: https://lore.kernel.org/all/087be419-ec6b-47ad-851a-5e1e3ea5cfcc@kernel.org/
Fixes: 7237c4c9ec92 ("Bluetooth: mediatek: Add protocol support for MediaTek serial devices")
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/bluetooth/btmtkuart.c | 11 +++--------
1 file changed, 3 insertions(+), 8 deletions(-)
diff --git a/drivers/bluetooth/btmtkuart.c b/drivers/bluetooth/btmtkuart.c
index 9ba22b13b4fa..a831d734cd9e 100644
--- a/drivers/bluetooth/btmtkuart.c
+++ b/drivers/bluetooth/btmtkuart.c
@@ -471,7 +471,7 @@ mtk_stp_split(struct btmtkuart_dev *bdev, const unsigned char *data, int count,
return data;
}
-static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
+static void btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
{
struct btmtkuart_dev *bdev = hci_get_drvdata(hdev);
const unsigned char *p_left = data, *p_h4;
@@ -510,25 +510,20 @@ static int btmtkuart_recv(struct hci_dev *hdev, const u8 *data, size_t count)
bt_dev_err(bdev->hdev,
"Frame reassembly failed (%d)", err);
bdev->rx_skb = NULL;
- return err;
+ return;
}
sz_left -= sz_h4;
p_left += sz_h4;
}
-
- return 0;
}
static int btmtkuart_receive_buf(struct serdev_device *serdev, const u8 *data,
size_t count)
{
struct btmtkuart_dev *bdev = serdev_device_get_drvdata(serdev);
- int err;
- err = btmtkuart_recv(bdev->hdev, data, count);
- if (err < 0)
- return err;
+ btmtkuart_recv(bdev->hdev, data, count);
bdev->hdev->stat.byte_rx += count;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 168/374] block: make BLK_DEF_MAX_SECTORS unsigned
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (166 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 167/374] Bluetooth: btmtkuart: fix recv_buf() return value Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 169/374] null_blk: dont cap max_hw_sectors to BLK_DEF_MAX_SECTORS Greg Kroah-Hartman
` (206 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Keith Busch,
Bart Van Assche, Martin K. Petersen, Jens Axboe, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Keith Busch <kbusch@kernel.org>
[ Upstream commit 0a26f327e46c203229e72c823dfec71a2b405ec5 ]
This is used as an unsigned value, so define it that way to avoid
having to cast it.
Suggested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Bart Van Assche <bvanassche@acm.org>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Link: https://lore.kernel.org/r/20230105205146.3610282-2-kbusch@meta.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Stable-dep-of: 9a9525de8654 ("null_blk: don't cap max_hw_sectors to BLK_DEF_MAX_SECTORS")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
block/blk-settings.c | 2 +-
drivers/block/null_blk/main.c | 3 +--
include/linux/blkdev.h | 3 ++-
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/block/blk-settings.c b/block/blk-settings.c
index 73a80895e3ae..959b5c1e6d3b 100644
--- a/block/blk-settings.c
+++ b/block/blk-settings.c
@@ -136,7 +136,7 @@ void blk_queue_max_hw_sectors(struct request_queue *q, unsigned int max_hw_secto
limits->max_hw_sectors = max_hw_sectors;
max_sectors = min_not_zero(max_hw_sectors, limits->max_dev_sectors);
- max_sectors = min_t(unsigned int, max_sectors, BLK_DEF_MAX_SECTORS);
+ max_sectors = min(max_sectors, BLK_DEF_MAX_SECTORS);
max_sectors = round_down(max_sectors,
limits->logical_block_size >> SECTOR_SHIFT);
limits->max_sectors = max_sectors;
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 686ec6bcdef3..4a867233b14a 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1902,8 +1902,7 @@ static int null_add_dev(struct nullb_device *dev)
blk_queue_physical_block_size(nullb->q, dev->blocksize);
if (!dev->max_sectors)
dev->max_sectors = queue_max_hw_sectors(nullb->q);
- dev->max_sectors = min_t(unsigned int, dev->max_sectors,
- BLK_DEF_MAX_SECTORS);
+ dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS);
blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
if (dev->virt_boundary)
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 67344dfe07a7..905844172cfd 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -1334,11 +1334,12 @@ static inline bool bdev_is_partition(struct block_device *bdev)
enum blk_default_limits {
BLK_MAX_SEGMENTS = 128,
BLK_SAFE_MAX_SECTORS = 255,
- BLK_DEF_MAX_SECTORS = 2560,
BLK_MAX_SEGMENT_SIZE = 65536,
BLK_SEG_BOUNDARY_MASK = 0xFFFFFFFFUL,
};
+#define BLK_DEF_MAX_SECTORS 2560u
+
static inline unsigned long queue_segment_boundary(const struct request_queue *q)
{
return q->limits.seg_boundary_mask;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 169/374] null_blk: dont cap max_hw_sectors to BLK_DEF_MAX_SECTORS
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (167 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 168/374] block: make BLK_DEF_MAX_SECTORS unsigned Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 170/374] net/sched: act_ct: fix skb leak and crash on ooo frags Greg Kroah-Hartman
` (205 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Hellwig, Jens Axboe,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Hellwig <hch@lst.de>
[ Upstream commit 9a9525de865410047fa962867b4fcd33943b206f ]
null_blk has some rather odd capping of the max_hw_sectors value to
BLK_DEF_MAX_SECTORS, which doesn't make sense - max_hw_sector is the
hardware limit, and BLK_DEF_MAX_SECTORS despite the confusing name is the
default cap for the max_sectors field used for normal file system I/O.
Remove all the capping, and simply leave it to the block layer or
user to take up or not all of that for file system I/O.
Fixes: ea17fd354ca8 ("null_blk: Allow controlling max_hw_sectors limit")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20231227092305.279567-2-hch@lst.de
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/block/null_blk/main.c | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
diff --git a/drivers/block/null_blk/main.c b/drivers/block/null_blk/main.c
index 4a867233b14a..87791265e09b 100644
--- a/drivers/block/null_blk/main.c
+++ b/drivers/block/null_blk/main.c
@@ -1900,10 +1900,8 @@ static int null_add_dev(struct nullb_device *dev)
blk_queue_logical_block_size(nullb->q, dev->blocksize);
blk_queue_physical_block_size(nullb->q, dev->blocksize);
- if (!dev->max_sectors)
- dev->max_sectors = queue_max_hw_sectors(nullb->q);
- dev->max_sectors = min(dev->max_sectors, BLK_DEF_MAX_SECTORS);
- blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
+ if (dev->max_sectors)
+ blk_queue_max_hw_sectors(nullb->q, dev->max_sectors);
if (dev->virt_boundary)
blk_queue_virt_boundary(nullb->q, PAGE_SIZE - 1);
@@ -1953,12 +1951,6 @@ static int __init null_init(void)
g_bs = PAGE_SIZE;
}
- if (g_max_sectors > BLK_DEF_MAX_SECTORS) {
- pr_warn("invalid max sectors\n");
- pr_warn("defaults max sectors to %u\n", BLK_DEF_MAX_SECTORS);
- g_max_sectors = BLK_DEF_MAX_SECTORS;
- }
-
if (g_home_node != NUMA_NO_NODE && g_home_node >= nr_online_nodes) {
pr_err("invalid home_node value\n");
g_home_node = NUMA_NO_NODE;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 170/374] net/sched: act_ct: fix skb leak and crash on ooo frags
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (168 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 169/374] null_blk: dont cap max_hw_sectors to BLK_DEF_MAX_SECTORS Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 171/374] mlxbf_gige: Fix intermittent no ip issue Greg Kroah-Hartman
` (204 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tao Liu, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tao Liu <taoliu828@163.com>
[ Upstream commit 3f14b377d01d8357eba032b4cabc8c1149b458b6 ]
act_ct adds skb->users before defragmentation. If frags arrive in order,
the last frag's reference is reset in:
inet_frag_reasm_prepare
skb_morph
which is not straightforward.
However when frags arrive out of order, nobody unref the last frag, and
all frags are leaked. The situation is even worse, as initiating packet
capture can lead to a crash[0] when skb has been cloned and shared at the
same time.
Fix the issue by removing skb_get() before defragmentation. act_ct
returns TC_ACT_CONSUMED when defrag failed or in progress.
[0]:
[ 843.804823] ------------[ cut here ]------------
[ 843.809659] kernel BUG at net/core/skbuff.c:2091!
[ 843.814516] invalid opcode: 0000 [#1] PREEMPT SMP
[ 843.819296] CPU: 7 PID: 0 Comm: swapper/7 Kdump: loaded Tainted: G S 6.7.0-rc3 #2
[ 843.824107] Hardware name: XFUSION 1288H V6/BC13MBSBD, BIOS 1.29 11/25/2022
[ 843.828953] RIP: 0010:pskb_expand_head+0x2ac/0x300
[ 843.833805] Code: 8b 70 28 48 85 f6 74 82 48 83 c6 08 bf 01 00 00 00 e8 38 bd ff ff 8b 83 c0 00 00 00 48 03 83 c8 00 00 00 e9 62 ff ff ff 0f 0b <0f> 0b e8 8d d0 ff ff e9 b3 fd ff ff 81 7c 24 14 40 01 00 00 4c 89
[ 843.843698] RSP: 0018:ffffc9000cce07c0 EFLAGS: 00010202
[ 843.848524] RAX: 0000000000000002 RBX: ffff88811a211d00 RCX: 0000000000000820
[ 843.853299] RDX: 0000000000000640 RSI: 0000000000000000 RDI: ffff88811a211d00
[ 843.857974] RBP: ffff888127d39518 R08: 00000000bee97314 R09: 0000000000000000
[ 843.862584] R10: 0000000000000000 R11: ffff8881109f0000 R12: 0000000000000880
[ 843.867147] R13: ffff888127d39580 R14: 0000000000000640 R15: ffff888170f7b900
[ 843.871680] FS: 0000000000000000(0000) GS:ffff889ffffc0000(0000) knlGS:0000000000000000
[ 843.876242] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 843.880778] CR2: 00007fa42affcfb8 CR3: 000000011433a002 CR4: 0000000000770ef0
[ 843.885336] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 843.889809] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 843.894229] PKRU: 55555554
[ 843.898539] Call Trace:
[ 843.902772] <IRQ>
[ 843.906922] ? __die_body+0x1e/0x60
[ 843.911032] ? die+0x3c/0x60
[ 843.915037] ? do_trap+0xe2/0x110
[ 843.918911] ? pskb_expand_head+0x2ac/0x300
[ 843.922687] ? do_error_trap+0x65/0x80
[ 843.926342] ? pskb_expand_head+0x2ac/0x300
[ 843.929905] ? exc_invalid_op+0x50/0x60
[ 843.933398] ? pskb_expand_head+0x2ac/0x300
[ 843.936835] ? asm_exc_invalid_op+0x1a/0x20
[ 843.940226] ? pskb_expand_head+0x2ac/0x300
[ 843.943580] inet_frag_reasm_prepare+0xd1/0x240
[ 843.946904] ip_defrag+0x5d4/0x870
[ 843.950132] nf_ct_handle_fragments+0xec/0x130 [nf_conntrack]
[ 843.953334] tcf_ct_act+0x252/0xd90 [act_ct]
[ 843.956473] ? tcf_mirred_act+0x516/0x5a0 [act_mirred]
[ 843.959657] tcf_action_exec+0xa1/0x160
[ 843.962823] fl_classify+0x1db/0x1f0 [cls_flower]
[ 843.966010] ? skb_clone+0x53/0xc0
[ 843.969173] tcf_classify+0x24d/0x420
[ 843.972333] tc_run+0x8f/0xf0
[ 843.975465] __netif_receive_skb_core+0x67a/0x1080
[ 843.978634] ? dev_gro_receive+0x249/0x730
[ 843.981759] __netif_receive_skb_list_core+0x12d/0x260
[ 843.984869] netif_receive_skb_list_internal+0x1cb/0x2f0
[ 843.987957] ? mlx5e_handle_rx_cqe_mpwrq_rep+0xfa/0x1a0 [mlx5_core]
[ 843.991170] napi_complete_done+0x72/0x1a0
[ 843.994305] mlx5e_napi_poll+0x28c/0x6d0 [mlx5_core]
[ 843.997501] __napi_poll+0x25/0x1b0
[ 844.000627] net_rx_action+0x256/0x330
[ 844.003705] __do_softirq+0xb3/0x29b
[ 844.006718] irq_exit_rcu+0x9e/0xc0
[ 844.009672] common_interrupt+0x86/0xa0
[ 844.012537] </IRQ>
[ 844.015285] <TASK>
[ 844.017937] asm_common_interrupt+0x26/0x40
[ 844.020591] RIP: 0010:acpi_safe_halt+0x1b/0x20
[ 844.023247] Code: ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 65 48 8b 04 25 00 18 03 00 48 8b 00 a8 08 75 0c 66 90 0f 00 2d 81 d0 44 00 fb f4 <fa> c3 0f 1f 00 89 fa ec 48 8b 05 ee 88 ed 00 a9 00 00 00 80 75 11
[ 844.028900] RSP: 0018:ffffc90000533e70 EFLAGS: 00000246
[ 844.031725] RAX: 0000000000004000 RBX: 0000000000000001 RCX: 0000000000000000
[ 844.034553] RDX: ffff889ffffc0000 RSI: ffffffff828b7f20 RDI: ffff88a090f45c64
[ 844.037368] RBP: ffff88a0901a2800 R08: ffff88a090f45c00 R09: 00000000000317c0
[ 844.040155] R10: 00ec812281150475 R11: ffff889fffff0e04 R12: ffffffff828b7fa0
[ 844.042962] R13: ffffffff828b7f20 R14: 0000000000000001 R15: 0000000000000000
[ 844.045819] acpi_idle_enter+0x7b/0xc0
[ 844.048621] cpuidle_enter_state+0x7f/0x430
[ 844.051451] cpuidle_enter+0x2d/0x40
[ 844.054279] do_idle+0x1d4/0x240
[ 844.057096] cpu_startup_entry+0x2a/0x30
[ 844.059934] start_secondary+0x104/0x130
[ 844.062787] secondary_startup_64_no_verify+0x16b/0x16b
[ 844.065674] </TASK>
Fixes: b57dc7c13ea9 ("net/sched: Introduce action ct")
Signed-off-by: Tao Liu <taoliu828@163.com>
Link: https://lore.kernel.org/r/20231228081457.936732-1-taoliu828@163.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/sched/act_ct.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
index 81a2d6cbfb44..b4c42b257ae7 100644
--- a/net/sched/act_ct.c
+++ b/net/sched/act_ct.c
@@ -705,7 +705,6 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
if (err || !frag)
return err;
- skb_get(skb);
mru = tc_skb_cb(skb)->mru;
if (family == NFPROTO_IPV4) {
@@ -987,12 +986,8 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
nh_ofs = skb_network_offset(skb);
skb_pull_rcsum(skb, nh_ofs);
err = tcf_ct_handle_fragments(net, skb, family, p->zone, &defrag);
- if (err == -EINPROGRESS) {
- retval = TC_ACT_STOLEN;
- goto out_clear;
- }
if (err)
- goto drop;
+ goto out_frag;
err = tcf_ct_skb_network_trim(skb, family);
if (err)
@@ -1059,6 +1054,11 @@ static int tcf_ct_act(struct sk_buff *skb, const struct tc_action *a,
qdisc_skb_cb(skb)->pkt_len = skb->len;
return retval;
+out_frag:
+ if (err != -EINPROGRESS)
+ tcf_action_inc_drop_qstats(&c->common);
+ return TC_ACT_CONSUMED;
+
drop:
tcf_action_inc_drop_qstats(&c->common);
return TC_ACT_SHOT;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 171/374] mlxbf_gige: Fix intermittent no ip issue
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (169 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 170/374] net/sched: act_ct: fix skb leak and crash on ooo frags Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 172/374] net: mellanox: mlxbf_gige: Replace non-standard interrupt handling Greg Kroah-Hartman
` (203 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Thompson, Asmaa Mnebhi,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asmaa Mnebhi <asmaa@nvidia.com>
[ Upstream commit ef210ef85d5cb543ce34a57803ed856d0c8c08c2 ]
Although the link is up, there is no ip assigned on setups with high background
traffic. Nothing is transmitted nor received. The RX error count keeps on
increasing. After several minutes, the RX error count stagnates and the
GigE interface finally gets an ip.
The issue is that mlxbf_gige_rx_init() is called before phy_start().
As soon as the RX DMA is enabled in mlxbf_gige_rx_init(), the RX CI reaches the max
of 128, and becomes equal to RX PI. RX CI doesn't decrease since the code hasn't
ran phy_start yet.
Bring the PHY up before starting the RX.
Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
Reviewed-by: David Thompson <davthompson@nvidia.com>
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 14 +++++++-------
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c | 6 +++---
2 files changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
index b990782c1eb1..2cbe0daafd41 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
@@ -149,14 +149,14 @@ static int mlxbf_gige_open(struct net_device *netdev)
*/
priv->valid_polarity = 0;
- err = mlxbf_gige_rx_init(priv);
+ phy_start(phydev);
+
+ err = mlxbf_gige_tx_init(priv);
if (err)
goto free_irqs;
- err = mlxbf_gige_tx_init(priv);
+ err = mlxbf_gige_rx_init(priv);
if (err)
- goto rx_deinit;
-
- phy_start(phydev);
+ goto tx_deinit;
netif_napi_add(netdev, &priv->napi, mlxbf_gige_poll, NAPI_POLL_WEIGHT);
napi_enable(&priv->napi);
@@ -178,8 +178,8 @@ static int mlxbf_gige_open(struct net_device *netdev)
return 0;
-rx_deinit:
- mlxbf_gige_rx_deinit(priv);
+tx_deinit:
+ mlxbf_gige_tx_deinit(priv);
free_irqs:
mlxbf_gige_free_irqs(priv);
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
index 227d01cace3f..699984358493 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_rx.c
@@ -142,6 +142,9 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv)
writeq(MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS_EN,
priv->base + MLXBF_GIGE_RX_MAC_FILTER_COUNT_PASS);
+ writeq(ilog2(priv->rx_q_entries),
+ priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2);
+
/* Clear MLXBF_GIGE_INT_MASK 'receive pkt' bit to
* indicate readiness to receive interrupts
*/
@@ -154,9 +157,6 @@ int mlxbf_gige_rx_init(struct mlxbf_gige *priv)
data |= MLXBF_GIGE_RX_DMA_EN;
writeq(data, priv->base + MLXBF_GIGE_RX_DMA);
- writeq(ilog2(priv->rx_q_entries),
- priv->base + MLXBF_GIGE_RX_WQE_SIZE_LOG2);
-
return 0;
free_wqe_and_skb:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 172/374] net: mellanox: mlxbf_gige: Replace non-standard interrupt handling
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (170 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 171/374] mlxbf_gige: Fix intermittent no ip issue Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 173/374] mlxbf_gige: Enable the GigE port in mlxbf_gige_open Greg Kroah-Hartman
` (202 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Asmaa Mnebhi, David S. Miller,
Bartosz Golaszewski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asmaa Mnebhi <asmaa@nvidia.com>
[ Upstream commit 6c2a6ddca763271fa583e22bce10c2805c1ea9f6 ]
Since the GPIO driver (gpio-mlxbf2.c) supports interrupt handling,
replace the custom routine with simple IRQ request.
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Bartosz Golaszewski <brgl@bgdev.pl>
Stable-dep-of: a460f4a68451 ("mlxbf_gige: Enable the GigE port in mlxbf_gige_open")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../net/ethernet/mellanox/mlxbf_gige/Makefile | 1 -
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige.h | 12 -
.../mellanox/mlxbf_gige/mlxbf_gige_gpio.c | 212 ------------------
.../mellanox/mlxbf_gige/mlxbf_gige_main.c | 22 +-
4 files changed, 9 insertions(+), 238 deletions(-)
delete mode 100644 drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile b/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile
index e57c1375f236..a97c2bef846b 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/Makefile
@@ -3,7 +3,6 @@
obj-$(CONFIG_MLXBF_GIGE) += mlxbf_gige.o
mlxbf_gige-y := mlxbf_gige_ethtool.o \
- mlxbf_gige_gpio.o \
mlxbf_gige_intr.o \
mlxbf_gige_main.o \
mlxbf_gige_mdio.o \
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
index 3e8725b7f0b7..0fdf2c8ca480 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige.h
@@ -51,11 +51,6 @@
#define MLXBF_GIGE_ERROR_INTR_IDX 0
#define MLXBF_GIGE_RECEIVE_PKT_INTR_IDX 1
#define MLXBF_GIGE_LLU_PLU_INTR_IDX 2
-#define MLXBF_GIGE_PHY_INT_N 3
-
-#define MLXBF_GIGE_MDIO_DEFAULT_PHY_ADDR 0x3
-
-#define MLXBF_GIGE_DEFAULT_PHY_INT_GPIO 12
struct mlxbf_gige_stats {
u64 hw_access_errors;
@@ -82,11 +77,7 @@ struct mlxbf_gige {
void __iomem *mdio_io;
void __iomem *clk_io;
struct mii_bus *mdiobus;
- void __iomem *gpio_io;
- struct irq_domain *irqdomain;
- u32 phy_int_gpio_mask;
spinlock_t lock; /* for packet processing indices */
- spinlock_t gpio_lock; /* for GPIO bus access */
u16 rx_q_entries;
u16 tx_q_entries;
u64 *tx_wqe_base;
@@ -186,7 +177,4 @@ int mlxbf_gige_poll(struct napi_struct *napi, int budget);
extern const struct ethtool_ops mlxbf_gige_ethtool_ops;
void mlxbf_gige_update_tx_wqe_next(struct mlxbf_gige *priv);
-int mlxbf_gige_gpio_init(struct platform_device *pdev, struct mlxbf_gige *priv);
-void mlxbf_gige_gpio_free(struct mlxbf_gige *priv);
-
#endif /* !defined(__MLXBF_GIGE_H__) */
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c
deleted file mode 100644
index a8d966db5715..000000000000
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_gpio.c
+++ /dev/null
@@ -1,212 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only OR BSD-3-Clause
-
-/* Initialize and handle GPIO interrupt triggered by INT_N PHY signal.
- * This GPIO interrupt triggers the PHY state machine to bring the link
- * up/down.
- *
- * Copyright (C) 2021 NVIDIA CORPORATION & AFFILIATES
- */
-
-#include <linux/acpi.h>
-#include <linux/bitfield.h>
-#include <linux/device.h>
-#include <linux/err.h>
-#include <linux/gpio/driver.h>
-#include <linux/interrupt.h>
-#include <linux/io.h>
-#include <linux/irq.h>
-#include <linux/irqdomain.h>
-#include <linux/irqreturn.h>
-#include <linux/platform_device.h>
-#include <linux/property.h>
-
-#include "mlxbf_gige.h"
-#include "mlxbf_gige_regs.h"
-
-#define MLXBF_GIGE_GPIO_CAUSE_FALL_EN 0x48
-#define MLXBF_GIGE_GPIO_CAUSE_OR_CAUSE_EVTEN0 0x80
-#define MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0 0x94
-#define MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE 0x98
-
-static void mlxbf_gige_gpio_enable(struct mlxbf_gige *priv)
-{
- unsigned long flags;
- u32 val;
-
- spin_lock_irqsave(&priv->gpio_lock, flags);
- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE);
- val |= priv->phy_int_gpio_mask;
- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE);
-
- /* The INT_N interrupt level is active low.
- * So enable cause fall bit to detect when GPIO
- * state goes low.
- */
- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_FALL_EN);
- val |= priv->phy_int_gpio_mask;
- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_FALL_EN);
-
- /* Enable PHY interrupt by setting the priority level */
- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0);
- val |= priv->phy_int_gpio_mask;
- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0);
- spin_unlock_irqrestore(&priv->gpio_lock, flags);
-}
-
-static void mlxbf_gige_gpio_disable(struct mlxbf_gige *priv)
-{
- unsigned long flags;
- u32 val;
-
- spin_lock_irqsave(&priv->gpio_lock, flags);
- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0);
- val &= ~priv->phy_int_gpio_mask;
- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_EVTEN0);
- spin_unlock_irqrestore(&priv->gpio_lock, flags);
-}
-
-static irqreturn_t mlxbf_gige_gpio_handler(int irq, void *ptr)
-{
- struct mlxbf_gige *priv;
- u32 val;
-
- priv = ptr;
-
- /* Check if this interrupt is from PHY device.
- * Return if it is not.
- */
- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CAUSE_EVTEN0);
- if (!(val & priv->phy_int_gpio_mask))
- return IRQ_NONE;
-
- /* Clear interrupt when done, otherwise, no further interrupt
- * will be triggered.
- */
- val = readl(priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE);
- val |= priv->phy_int_gpio_mask;
- writel(val, priv->gpio_io + MLXBF_GIGE_GPIO_CAUSE_OR_CLRCAUSE);
-
- generic_handle_irq(priv->phy_irq);
-
- return IRQ_HANDLED;
-}
-
-static void mlxbf_gige_gpio_mask(struct irq_data *irqd)
-{
- struct mlxbf_gige *priv = irq_data_get_irq_chip_data(irqd);
-
- mlxbf_gige_gpio_disable(priv);
-}
-
-static void mlxbf_gige_gpio_unmask(struct irq_data *irqd)
-{
- struct mlxbf_gige *priv = irq_data_get_irq_chip_data(irqd);
-
- mlxbf_gige_gpio_enable(priv);
-}
-
-static struct irq_chip mlxbf_gige_gpio_chip = {
- .name = "mlxbf_gige_phy",
- .irq_mask = mlxbf_gige_gpio_mask,
- .irq_unmask = mlxbf_gige_gpio_unmask,
-};
-
-static int mlxbf_gige_gpio_domain_map(struct irq_domain *d,
- unsigned int irq,
- irq_hw_number_t hwirq)
-{
- irq_set_chip_data(irq, d->host_data);
- irq_set_chip_and_handler(irq, &mlxbf_gige_gpio_chip, handle_simple_irq);
- irq_set_noprobe(irq);
-
- return 0;
-}
-
-static const struct irq_domain_ops mlxbf_gige_gpio_domain_ops = {
- .map = mlxbf_gige_gpio_domain_map,
- .xlate = irq_domain_xlate_twocell,
-};
-
-#ifdef CONFIG_ACPI
-static int mlxbf_gige_gpio_resources(struct acpi_resource *ares,
- void *data)
-{
- struct acpi_resource_gpio *gpio;
- u32 *phy_int_gpio = data;
-
- if (ares->type == ACPI_RESOURCE_TYPE_GPIO) {
- gpio = &ares->data.gpio;
- *phy_int_gpio = gpio->pin_table[0];
- }
-
- return 1;
-}
-#endif
-
-void mlxbf_gige_gpio_free(struct mlxbf_gige *priv)
-{
- irq_dispose_mapping(priv->phy_irq);
- irq_domain_remove(priv->irqdomain);
-}
-
-int mlxbf_gige_gpio_init(struct platform_device *pdev,
- struct mlxbf_gige *priv)
-{
- struct device *dev = &pdev->dev;
- struct resource *res;
- u32 phy_int_gpio = 0;
- int ret;
-
- LIST_HEAD(resources);
-
- res = platform_get_resource(pdev, IORESOURCE_MEM, MLXBF_GIGE_RES_GPIO0);
- if (!res)
- return -ENODEV;
-
- priv->gpio_io = devm_ioremap(dev, res->start, resource_size(res));
- if (!priv->gpio_io)
- return -ENOMEM;
-
-#ifdef CONFIG_ACPI
- ret = acpi_dev_get_resources(ACPI_COMPANION(dev),
- &resources, mlxbf_gige_gpio_resources,
- &phy_int_gpio);
- acpi_dev_free_resource_list(&resources);
- if (ret < 0 || !phy_int_gpio) {
- dev_err(dev, "Error retrieving the gpio phy pin");
- return -EINVAL;
- }
-#endif
-
- priv->phy_int_gpio_mask = BIT(phy_int_gpio);
-
- mlxbf_gige_gpio_disable(priv);
-
- priv->hw_phy_irq = platform_get_irq(pdev, MLXBF_GIGE_PHY_INT_N);
-
- priv->irqdomain = irq_domain_add_simple(NULL, 1, 0,
- &mlxbf_gige_gpio_domain_ops,
- priv);
- if (!priv->irqdomain) {
- dev_err(dev, "Failed to add IRQ domain\n");
- return -ENOMEM;
- }
-
- priv->phy_irq = irq_create_mapping(priv->irqdomain, 0);
- if (!priv->phy_irq) {
- irq_domain_remove(priv->irqdomain);
- priv->irqdomain = NULL;
- dev_err(dev, "Error mapping PHY IRQ\n");
- return -EINVAL;
- }
-
- ret = devm_request_irq(dev, priv->hw_phy_irq, mlxbf_gige_gpio_handler,
- IRQF_ONESHOT | IRQF_SHARED, "mlxbf_gige_phy", priv);
- if (ret) {
- dev_err(dev, "Failed to request PHY IRQ");
- mlxbf_gige_gpio_free(priv);
- return ret;
- }
-
- return ret;
-}
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
index 2cbe0daafd41..181a0845a105 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
@@ -280,8 +280,8 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
void __iomem *llu_base;
void __iomem *plu_base;
void __iomem *base;
+ int addr, phy_irq;
u64 control;
- int addr;
int err;
base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC);
@@ -316,20 +316,12 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
priv->pdev = pdev;
spin_lock_init(&priv->lock);
- spin_lock_init(&priv->gpio_lock);
/* Attach MDIO device */
err = mlxbf_gige_mdio_probe(pdev, priv);
if (err)
return err;
- err = mlxbf_gige_gpio_init(pdev, priv);
- if (err) {
- dev_err(&pdev->dev, "PHY IRQ initialization failed\n");
- mlxbf_gige_mdio_remove(priv);
- return -ENODEV;
- }
-
priv->base = base;
priv->llu_base = llu_base;
priv->plu_base = plu_base;
@@ -350,6 +342,12 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
priv->rx_irq = platform_get_irq(pdev, MLXBF_GIGE_RECEIVE_PKT_INTR_IDX);
priv->llu_plu_irq = platform_get_irq(pdev, MLXBF_GIGE_LLU_PLU_INTR_IDX);
+ phy_irq = acpi_dev_gpio_irq_get_by(ACPI_COMPANION(&pdev->dev), "phy-gpios", 0);
+ if (phy_irq < 0) {
+ dev_err(&pdev->dev, "Error getting PHY irq. Use polling instead");
+ phy_irq = PHY_POLL;
+ }
+
phydev = phy_find_first(priv->mdiobus);
if (!phydev) {
err = -ENODEV;
@@ -357,8 +355,8 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
}
addr = phydev->mdio.addr;
- priv->mdiobus->irq[addr] = priv->phy_irq;
- phydev->irq = priv->phy_irq;
+ priv->mdiobus->irq[addr] = phy_irq;
+ phydev->irq = phy_irq;
err = phy_connect_direct(netdev, phydev,
mlxbf_gige_adjust_link,
@@ -394,7 +392,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
return 0;
out:
- mlxbf_gige_gpio_free(priv);
mlxbf_gige_mdio_remove(priv);
return err;
}
@@ -405,7 +402,6 @@ static int mlxbf_gige_remove(struct platform_device *pdev)
unregister_netdev(priv->netdev);
phy_disconnect(priv->netdev->phydev);
- mlxbf_gige_gpio_free(priv);
mlxbf_gige_mdio_remove(priv);
platform_set_drvdata(pdev, NULL);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 173/374] mlxbf_gige: Enable the GigE port in mlxbf_gige_open
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (171 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 172/374] net: mellanox: mlxbf_gige: Replace non-standard interrupt handling Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 174/374] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() Greg Kroah-Hartman
` (201 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Thompson, Asmaa Mnebhi,
Florian Fainelli, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Asmaa Mnebhi <asmaa@nvidia.com>
[ Upstream commit a460f4a684511e007bbf1700758a41f05d9981e6 ]
At the moment, the GigE port is enabled in the mlxbf_gige_probe
function. If the mlxbf_gige_open is not executed, this could cause
pause frames to increase in the case where there is high backgroud
traffic. This results in clogging the port.
So move enabling the OOB port to mlxbf_gige_open.
Fixes: f92e1869d74e ("Add Mellanox BlueField Gigabit Ethernet driver")
Reviewed-by: David Thompson <davthompson@nvidia.com>
Signed-off-by: Asmaa Mnebhi <asmaa@nvidia.com>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
index 181a0845a105..679415a64f25 100644
--- a/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
+++ b/drivers/net/ethernet/mellanox/mlxbf_gige/mlxbf_gige_main.c
@@ -132,9 +132,15 @@ static int mlxbf_gige_open(struct net_device *netdev)
{
struct mlxbf_gige *priv = netdev_priv(netdev);
struct phy_device *phydev = netdev->phydev;
+ u64 control;
u64 int_en;
int err;
+ /* Perform general init of GigE block */
+ control = readq(priv->base + MLXBF_GIGE_CONTROL);
+ control |= MLXBF_GIGE_CONTROL_PORT_EN;
+ writeq(control, priv->base + MLXBF_GIGE_CONTROL);
+
err = mlxbf_gige_request_irqs(priv);
if (err)
return err;
@@ -281,7 +287,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
void __iomem *plu_base;
void __iomem *base;
int addr, phy_irq;
- u64 control;
int err;
base = devm_platform_ioremap_resource(pdev, MLXBF_GIGE_RES_MAC);
@@ -296,11 +301,6 @@ static int mlxbf_gige_probe(struct platform_device *pdev)
if (IS_ERR(plu_base))
return PTR_ERR(plu_base);
- /* Perform general init of GigE block */
- control = readq(base + MLXBF_GIGE_CONTROL);
- control |= MLXBF_GIGE_CONTROL_PORT_EN;
- writeq(control, base + MLXBF_GIGE_CONTROL);
-
netdev = devm_alloc_etherdev(&pdev->dev, sizeof(*priv));
if (!netdev)
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 174/374] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (172 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 173/374] mlxbf_gige: Enable the GigE port in mlxbf_gige_open Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 175/374] ARM: davinci: always select CONFIG_CPU_ARM926T Greg Kroah-Hartman
` (200 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Willem de Bruijn, David Ahern, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit d375b98e0248980681e5e56b712026174d617198 ]
syzbot pointed out [1] that NEXTHDR_FRAGMENT handling is broken.
Reading frag_off can only be done if we pulled enough bytes
to skb->head. Currently we might access garbage.
[1]
BUG: KMSAN: uninit-value in ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0
ip6_tnl_parse_tlv_enc_lim+0x94f/0xbb0
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]
ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432
__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
netdev_start_xmit include/linux/netdevice.h:4954 [inline]
xmit_one net/core/dev.c:3548 [inline]
dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
dev_queue_xmit include/linux/netdevice.h:3134 [inline]
neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137
ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:451 [inline]
ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155
ip6_send_skb net/ipv6/ip6_output.c:1952 [inline]
ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972
rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582
rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920
inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Uninit was created at:
slab_post_alloc_hook+0x129/0xa70 mm/slab.h:768
slab_alloc_node mm/slub.c:3478 [inline]
__kmem_cache_alloc_node+0x5c9/0x970 mm/slub.c:3517
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc_node_track_caller+0x118/0x3c0 mm/slab_common.c:1027
kmalloc_reserve+0x249/0x4a0 net/core/skbuff.c:582
pskb_expand_head+0x226/0x1a00 net/core/skbuff.c:2098
__pskb_pull_tail+0x13b/0x2310 net/core/skbuff.c:2655
pskb_may_pull_reason include/linux/skbuff.h:2673 [inline]
pskb_may_pull include/linux/skbuff.h:2681 [inline]
ip6_tnl_parse_tlv_enc_lim+0x901/0xbb0 net/ipv6/ip6_tunnel.c:408
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1326 [inline]
ip6_tnl_start_xmit+0xab2/0x1a70 net/ipv6/ip6_tunnel.c:1432
__netdev_start_xmit include/linux/netdevice.h:4940 [inline]
netdev_start_xmit include/linux/netdevice.h:4954 [inline]
xmit_one net/core/dev.c:3548 [inline]
dev_hard_start_xmit+0x247/0xa10 net/core/dev.c:3564
__dev_queue_xmit+0x33b8/0x5130 net/core/dev.c:4349
dev_queue_xmit include/linux/netdevice.h:3134 [inline]
neigh_connected_output+0x569/0x660 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:542 [inline]
ip6_finish_output2+0x23a9/0x2b30 net/ipv6/ip6_output.c:137
ip6_finish_output+0x855/0x12b0 net/ipv6/ip6_output.c:222
NF_HOOK_COND include/linux/netfilter.h:303 [inline]
ip6_output+0x323/0x610 net/ipv6/ip6_output.c:243
dst_output include/net/dst.h:451 [inline]
ip6_local_out+0xe9/0x140 net/ipv6/output_core.c:155
ip6_send_skb net/ipv6/ip6_output.c:1952 [inline]
ip6_push_pending_frames+0x1f9/0x560 net/ipv6/ip6_output.c:1972
rawv6_push_pending_frames+0xbe8/0xdf0 net/ipv6/raw.c:582
rawv6_sendmsg+0x2b66/0x2e70 net/ipv6/raw.c:920
inet_sendmsg+0x105/0x190 net/ipv4/af_inet.c:847
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0x9c2/0xd60 net/socket.c:2584
___sys_sendmsg+0x28d/0x3c0 net/socket.c:2638
__sys_sendmsg net/socket.c:2667 [inline]
__do_sys_sendmsg net/socket.c:2676 [inline]
__se_sys_sendmsg net/socket.c:2674 [inline]
__x64_sys_sendmsg+0x307/0x490 net/socket.c:2674
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
CPU: 0 PID: 7345 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00024-gac865f00af29 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Fixes: fbfa743a9d2a ("ipv6: fix ip6_tnl_parse_tlv_enc_lim()")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/ip6_tunnel.c | 26 +++++++++++++-------------
1 file changed, 13 insertions(+), 13 deletions(-)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index bc5d3188454d..a41ba4b161c4 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -401,7 +401,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw;
unsigned int nhoff = raw - skb->data;
unsigned int off = nhoff + sizeof(*ipv6h);
- u8 next, nexthdr = ipv6h->nexthdr;
+ u8 nexthdr = ipv6h->nexthdr;
while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) {
struct ipv6_opt_hdr *hdr;
@@ -412,25 +412,25 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
hdr = (struct ipv6_opt_hdr *)(skb->data + off);
if (nexthdr == NEXTHDR_FRAGMENT) {
- struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr;
- if (frag_hdr->frag_off)
- break;
optlen = 8;
} else if (nexthdr == NEXTHDR_AUTH) {
optlen = ipv6_authlen(hdr);
} else {
optlen = ipv6_optlen(hdr);
}
- /* cache hdr->nexthdr, since pskb_may_pull() might
- * invalidate hdr
- */
- next = hdr->nexthdr;
- if (nexthdr == NEXTHDR_DEST) {
- u16 i = 2;
- /* Remember : hdr is no longer valid at this point. */
- if (!pskb_may_pull(skb, off + optlen))
+ if (!pskb_may_pull(skb, off + optlen))
+ break;
+
+ hdr = (struct ipv6_opt_hdr *)(skb->data + off);
+ if (nexthdr == NEXTHDR_FRAGMENT) {
+ struct frag_hdr *frag_hdr = (struct frag_hdr *)hdr;
+
+ if (frag_hdr->frag_off)
break;
+ }
+ if (nexthdr == NEXTHDR_DEST) {
+ u16 i = 2;
while (1) {
struct ipv6_tlv_tnl_enc_lim *tel;
@@ -451,7 +451,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw)
i++;
}
}
- nexthdr = next;
+ nexthdr = hdr->nexthdr;
off += optlen;
}
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 175/374] ARM: davinci: always select CONFIG_CPU_ARM926T
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (173 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 174/374] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 176/374] Revert "drm/tidss: Annotate dma-fence critical section in commit path" Greg Kroah-Hartman
` (199 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bartosz Golaszewski, Arnd Bergmann,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 40974ee421b4d1fc74ac733d86899ce1b83d8f65 ]
The select was lost by accident during the multiplatform conversion.
Any davinci-only
arm-linux-gnueabi-ld: arch/arm/mach-davinci/sleep.o: in function `CACHE_FLUSH':
(.text+0x168): undefined reference to `arm926_flush_kern_cache_all'
Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5")
Acked-by: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Link: https://lore.kernel.org/r/20240108110055.1531153-1-arnd@kernel.org
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-davinci/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
index 1d3aef84287d..01684347da9b 100644
--- a/arch/arm/mach-davinci/Kconfig
+++ b/arch/arm/mach-davinci/Kconfig
@@ -3,6 +3,7 @@
menuconfig ARCH_DAVINCI
bool "TI DaVinci"
depends on ARCH_MULTI_V5
+ select CPU_ARM926T
select DAVINCI_TIMER
select ZONE_DMA
select PM_GENERIC_DOMAINS if PM
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 176/374] Revert "drm/tidss: Annotate dma-fence critical section in commit path"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (174 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 175/374] ARM: davinci: always select CONFIG_CPU_ARM926T Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 177/374] Revert "drm/omapdrm: " Greg Kroah-Hartman
` (198 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aradhya Bhatia, Tomi Valkeinen,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit ca34d816558c3e4c3f8fe037b5a6b16c944693de ]
This reverts commit 4d56a4f08391857ba93465de489707b66adad114.
The DMA-fence annotations cause a lockdep warning (see below). As per
https://patchwork.freedesktop.org/patch/462170/ it sounds like the
annotations don't work correctly.
======================================================
WARNING: possible circular locking dependency detected
6.6.0-rc2+ #1 Not tainted
------------------------------------------------------
kmstest/733 is trying to acquire lock:
ffff8000819377f0 (fs_reclaim){+.+.}-{0:0}, at: __kmem_cache_alloc_node+0x58/0x2d4
but task is already holding lock:
ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss]
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (dma_fence_map){++++}-{0:0}:
__dma_fence_might_wait+0x5c/0xd0
dma_resv_lockdep+0x1a4/0x32c
do_one_initcall+0x84/0x2fc
kernel_init_freeable+0x28c/0x4c4
kernel_init+0x24/0x1dc
ret_from_fork+0x10/0x20
-> #1 (mmu_notifier_invalidate_range_start){+.+.}-{0:0}:
fs_reclaim_acquire+0x70/0xe4
__kmem_cache_alloc_node+0x58/0x2d4
kmalloc_trace+0x38/0x78
__kthread_create_worker+0x3c/0x150
kthread_create_worker+0x64/0x8c
workqueue_init+0x1e8/0x2f0
kernel_init_freeable+0x11c/0x4c4
kernel_init+0x24/0x1dc
ret_from_fork+0x10/0x20
-> #0 (fs_reclaim){+.+.}-{0:0}:
__lock_acquire+0x1370/0x20d8
lock_acquire+0x1e8/0x308
fs_reclaim_acquire+0xd0/0xe4
__kmem_cache_alloc_node+0x58/0x2d4
__kmalloc_node_track_caller+0x58/0xf0
kmemdup+0x34/0x60
regmap_bulk_write+0x64/0x2c0
tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768]
drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm]
drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm]
drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper]
tidss_atomic_commit_tail+0x58/0xc0 [tidss]
commit_tail+0xa0/0x188 [drm_kms_helper]
drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper]
drm_atomic_commit+0xa8/0xe0 [drm]
drm_mode_atomic_ioctl+0x9ec/0xc80 [drm]
drm_ioctl_kernel+0xc4/0x170 [drm]
drm_ioctl+0x234/0x4b0 [drm]
drm_compat_ioctl+0x110/0x12c [drm]
__arm64_compat_sys_ioctl+0x128/0x150
invoke_syscall+0x48/0x110
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc_compat+0x1c/0x38
el0_svc_compat+0x48/0xb4
el0t_32_sync_handler+0xb0/0x138
el0t_32_sync+0x194/0x198
other info that might help us debug this:
Chain exists of:
fs_reclaim --> mmu_notifier_invalidate_range_start --> dma_fence_map
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(dma_fence_map);
lock(mmu_notifier_invalidate_range_start);
lock(dma_fence_map);
lock(fs_reclaim);
*** DEADLOCK ***
3 locks held by kmstest/733:
#0: ffff800082e5bba0 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0x118/0xc80 [drm]
#1: ffff000004224c88 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xdc/0x1a0 [drm]
#2: ffff800081a06aa0 (dma_fence_map){++++}-{0:0}, at: tidss_atomic_commit_tail+0x20/0xc0 [tidss]
stack backtrace:
CPU: 0 PID: 733 Comm: kmstest Not tainted 6.6.0-rc2+ #1
Hardware name: Toradex Verdin AM62 on Verdin Development Board (DT)
Call trace:
dump_backtrace+0x98/0x118
show_stack+0x18/0x24
dump_stack_lvl+0x60/0xac
dump_stack+0x18/0x24
print_circular_bug+0x288/0x368
check_noncircular+0x168/0x17c
__lock_acquire+0x1370/0x20d8
lock_acquire+0x1e8/0x308
fs_reclaim_acquire+0xd0/0xe4
__kmem_cache_alloc_node+0x58/0x2d4
__kmalloc_node_track_caller+0x58/0xf0
kmemdup+0x34/0x60
regmap_bulk_write+0x64/0x2c0
tc358768_bridge_pre_enable+0x8c/0x12d0 [tc358768]
drm_atomic_bridge_call_pre_enable+0x68/0x80 [drm]
drm_atomic_bridge_chain_pre_enable+0x50/0x158 [drm]
drm_atomic_helper_commit_modeset_enables+0x164/0x264 [drm_kms_helper]
tidss_atomic_commit_tail+0x58/0xc0 [tidss]
commit_tail+0xa0/0x188 [drm_kms_helper]
drm_atomic_helper_commit+0x1a8/0x1c0 [drm_kms_helper]
drm_atomic_commit+0xa8/0xe0 [drm]
drm_mode_atomic_ioctl+0x9ec/0xc80 [drm]
drm_ioctl_kernel+0xc4/0x170 [drm]
drm_ioctl+0x234/0x4b0 [drm]
drm_compat_ioctl+0x110/0x12c [drm]
__arm64_compat_sys_ioctl+0x128/0x150
invoke_syscall+0x48/0x110
el0_svc_common.constprop.0+0x40/0xe0
do_el0_svc_compat+0x1c/0x38
el0_svc_compat+0x48/0xb4
el0t_32_sync_handler+0xb0/0x138
el0t_32_sync+0x194/0x198
Fixes: 4d56a4f08391 ("drm/tidss: Annotate dma-fence critical section in commit path")
Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-1-7ebf6f7f5bf6@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tidss/tidss_kms.c | 4 ----
1 file changed, 4 deletions(-)
diff --git a/drivers/gpu/drm/tidss/tidss_kms.c b/drivers/gpu/drm/tidss/tidss_kms.c
index 666e527a0acf..cb0ab224282f 100644
--- a/drivers/gpu/drm/tidss/tidss_kms.c
+++ b/drivers/gpu/drm/tidss/tidss_kms.c
@@ -4,8 +4,6 @@
* Author: Tomi Valkeinen <tomi.valkeinen@ti.com>
*/
-#include <linux/dma-fence.h>
-
#include <drm/drm_atomic.h>
#include <drm/drm_atomic_helper.h>
#include <drm/drm_bridge.h>
@@ -28,7 +26,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state)
{
struct drm_device *ddev = old_state->dev;
struct tidss_device *tidss = to_tidss(ddev);
- bool fence_cookie = dma_fence_begin_signalling();
dev_dbg(ddev->dev, "%s\n", __func__);
@@ -39,7 +36,6 @@ static void tidss_atomic_commit_tail(struct drm_atomic_state *old_state)
drm_atomic_helper_commit_modeset_enables(ddev, old_state);
drm_atomic_helper_commit_hw_done(old_state);
- dma_fence_end_signalling(fence_cookie);
drm_atomic_helper_wait_for_flip_done(ddev, old_state);
drm_atomic_helper_cleanup_planes(ddev, old_state);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 177/374] Revert "drm/omapdrm: Annotate dma-fence critical section in commit path"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (175 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 176/374] Revert "drm/tidss: Annotate dma-fence critical section in commit path" Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 178/374] RDMA/usnic: Silence uninitialized symbol smatch warnings Greg Kroah-Hartman
` (197 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Aradhya Bhatia, Tomi Valkeinen,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit 9d7c8c066916f231ca0ed4e4fce6c4b58ca3e451 ]
This reverts commit 250aa22920cd5d956a5d3e9c6a43d671c2bae217.
The DMA-fence annotations cause a lockdep warning (see below). As per
https://patchwork.freedesktop.org/patch/462170/ it sounds like the
annotations don't work correctly.
======================================================
WARNING: possible circular locking dependency detected
6.5.0-rc2+ #2 Not tainted
------------------------------------------------------
kmstest/219 is trying to acquire lock:
c4705838 (&hdmi->lock){+.+.}-{3:3}, at: hdmi5_bridge_mode_set+0x1c/0x50
but task is already holding lock:
c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (dma_fence_map){++++}-{0:0}:
__dma_fence_might_wait+0x48/0xb4
dma_resv_lockdep+0x1b8/0x2bc
do_one_initcall+0x68/0x3b0
kernel_init_freeable+0x260/0x34c
kernel_init+0x14/0x140
ret_from_fork+0x14/0x28
-> #1 (fs_reclaim){+.+.}-{0:0}:
fs_reclaim_acquire+0x70/0xa8
__kmem_cache_alloc_node+0x3c/0x368
kmalloc_trace+0x28/0x58
_drm_do_get_edid+0x7c/0x35c
hdmi5_bridge_get_edid+0xc8/0x1ac
drm_bridge_connector_get_modes+0x64/0xc0
drm_helper_probe_single_connector_modes+0x170/0x528
drm_client_modeset_probe+0x208/0x1334
__drm_fb_helper_initial_config_and_unlock+0x30/0x548
omap_fbdev_client_hotplug+0x3c/0x6c
drm_client_register+0x58/0x94
pdev_probe+0x544/0x6b0
platform_probe+0x58/0xbc
really_probe+0xd8/0x3fc
__driver_probe_device+0x94/0x1f4
driver_probe_device+0x2c/0xc4
__device_attach_driver+0xa4/0x11c
bus_for_each_drv+0x84/0xdc
__device_attach+0xac/0x20c
bus_probe_device+0x8c/0x90
device_add+0x588/0x7e0
platform_device_add+0x110/0x24c
platform_device_register_full+0x108/0x15c
dss_bind+0x90/0xc0
try_to_bring_up_aggregate_device+0x1e0/0x2c8
__component_add+0xa4/0x174
hdmi5_probe+0x1c8/0x270
platform_probe+0x58/0xbc
really_probe+0xd8/0x3fc
__driver_probe_device+0x94/0x1f4
driver_probe_device+0x2c/0xc4
__device_attach_driver+0xa4/0x11c
bus_for_each_drv+0x84/0xdc
__device_attach+0xac/0x20c
bus_probe_device+0x8c/0x90
deferred_probe_work_func+0x8c/0xd8
process_one_work+0x2ac/0x6e4
worker_thread+0x30/0x4ec
kthread+0x100/0x124
ret_from_fork+0x14/0x28
-> #0 (&hdmi->lock){+.+.}-{3:3}:
__lock_acquire+0x145c/0x29cc
lock_acquire.part.0+0xb4/0x258
__mutex_lock+0x90/0x950
mutex_lock_nested+0x1c/0x24
hdmi5_bridge_mode_set+0x1c/0x50
drm_bridge_chain_mode_set+0x48/0x5c
crtc_set_mode+0x188/0x1d0
omap_atomic_commit_tail+0x2c/0xbc
commit_tail+0x9c/0x188
drm_atomic_helper_commit+0x158/0x18c
drm_atomic_commit+0xa4/0xe8
drm_mode_atomic_ioctl+0x9a4/0xc38
drm_ioctl+0x210/0x4a8
sys_ioctl+0x138/0xf00
ret_fast_syscall+0x0/0x1c
other info that might help us debug this:
Chain exists of:
&hdmi->lock --> fs_reclaim --> dma_fence_map
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
rlock(dma_fence_map);
lock(fs_reclaim);
lock(dma_fence_map);
lock(&hdmi->lock);
*** DEADLOCK ***
3 locks held by kmstest/219:
#0: f1011de4 (crtc_ww_class_acquire){+.+.}-{0:0}, at: drm_mode_atomic_ioctl+0xf0/0xc38
#1: c47059c8 (crtc_ww_class_mutex){+.+.}-{3:3}, at: modeset_lock+0xf8/0x230
#2: c11e1128 (dma_fence_map){++++}-{0:0}, at: omap_atomic_commit_tail+0x14/0xbc
stack backtrace:
CPU: 1 PID: 219 Comm: kmstest Not tainted 6.5.0-rc2+ #2
Hardware name: Generic DRA74X (Flattened Device Tree)
unwind_backtrace from show_stack+0x10/0x14
show_stack from dump_stack_lvl+0x58/0x70
dump_stack_lvl from check_noncircular+0x164/0x198
check_noncircular from __lock_acquire+0x145c/0x29cc
__lock_acquire from lock_acquire.part.0+0xb4/0x258
lock_acquire.part.0 from __mutex_lock+0x90/0x950
__mutex_lock from mutex_lock_nested+0x1c/0x24
mutex_lock_nested from hdmi5_bridge_mode_set+0x1c/0x50
hdmi5_bridge_mode_set from drm_bridge_chain_mode_set+0x48/0x5c
drm_bridge_chain_mode_set from crtc_set_mode+0x188/0x1d0
crtc_set_mode from omap_atomic_commit_tail+0x2c/0xbc
omap_atomic_commit_tail from commit_tail+0x9c/0x188
commit_tail from drm_atomic_helper_commit+0x158/0x18c
drm_atomic_helper_commit from drm_atomic_commit+0xa4/0xe8
drm_atomic_commit from drm_mode_atomic_ioctl+0x9a4/0xc38
drm_mode_atomic_ioctl from drm_ioctl+0x210/0x4a8
drm_ioctl from sys_ioctl+0x138/0xf00
sys_ioctl from ret_fast_syscall+0x0/0x1c
Exception stack(0xf1011fa8 to 0xf1011ff0)
1fa0: 00466d58 be9ab510 00000003 c03864bc be9ab510 be9ab4e0
1fc0: 00466d58 be9ab510 c03864bc 00000036 00466ef0 00466fc0 00467020 00466f20
1fe0: b6bc7ef4 be9ab4d0 b6bbbb00 b6cb2cc0
Fixes: 250aa22920cd ("drm/omapdrm: Annotate dma-fence critical section in commit path")
Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230920-dma-fence-annotation-revert-v1-2-7ebf6f7f5bf6@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/omapdrm/omap_drv.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/omapdrm/omap_drv.c b/drivers/gpu/drm/omapdrm/omap_drv.c
index f86e20578143..60871d255a4d 100644
--- a/drivers/gpu/drm/omapdrm/omap_drv.c
+++ b/drivers/gpu/drm/omapdrm/omap_drv.c
@@ -68,7 +68,6 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
{
struct drm_device *dev = old_state->dev;
struct omap_drm_private *priv = dev->dev_private;
- bool fence_cookie = dma_fence_begin_signalling();
dispc_runtime_get(priv->dispc);
@@ -91,6 +90,8 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
omap_atomic_wait_for_completion(dev, old_state);
drm_atomic_helper_commit_planes(dev, old_state, 0);
+
+ drm_atomic_helper_commit_hw_done(old_state);
} else {
/*
* OMAP3 DSS seems to have issues with the work-around above,
@@ -100,11 +101,9 @@ static void omap_atomic_commit_tail(struct drm_atomic_state *old_state)
drm_atomic_helper_commit_planes(dev, old_state, 0);
drm_atomic_helper_commit_modeset_enables(dev, old_state);
- }
- drm_atomic_helper_commit_hw_done(old_state);
-
- dma_fence_end_signalling(fence_cookie);
+ drm_atomic_helper_commit_hw_done(old_state);
+ }
/*
* Wait for completion of the page flips to ensure that old buffers
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 178/374] RDMA/usnic: Silence uninitialized symbol smatch warnings
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (176 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 177/374] Revert "drm/omapdrm: " Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 179/374] RDMA/hns: Fix inappropriate err code for unsupported operations Greg Kroah-Hartman
` (196 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Leon Romanovsky,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Leon Romanovsky <leonro@nvidia.com>
[ Upstream commit b9a85e5eec126d6ae6c362f94b447c223e8fe6e4 ]
The patch 1da177e4c3f4: "Linux-2.6.12-rc2" from Apr 16, 2005
(linux-next), leads to the following Smatch static checker warning:
drivers/infiniband/hw/mthca/mthca_cmd.c:644 mthca_SYS_EN()
error: uninitialized symbol 'out'.
drivers/infiniband/hw/mthca/mthca_cmd.c
636 int mthca_SYS_EN(struct mthca_dev *dev)
637 {
638 u64 out;
639 int ret;
640
641 ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
We pass out here and it gets used without being initialized.
err = mthca_cmd_post(dev, in_param,
out_param ? *out_param : 0,
^^^^^^^^^^
in_modifier, op_modifier,
op, context->token, 1);
It's the same in mthca_cmd_wait() and mthca_cmd_poll().
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/all/533bc3df-8078-4397-b93d-d1f6cec9b636@moroto.mountain
Link: https://lore.kernel.org/r/c559cb7113158c02d75401ac162652072ef1b5f0.1699867650.git.leon@kernel.org
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/mthca/mthca_cmd.c | 4 ++--
drivers/infiniband/hw/mthca/mthca_main.c | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/infiniband/hw/mthca/mthca_cmd.c b/drivers/infiniband/hw/mthca/mthca_cmd.c
index bdf5ed38de22..0307c45aa6d3 100644
--- a/drivers/infiniband/hw/mthca/mthca_cmd.c
+++ b/drivers/infiniband/hw/mthca/mthca_cmd.c
@@ -635,7 +635,7 @@ void mthca_free_mailbox(struct mthca_dev *dev, struct mthca_mailbox *mailbox)
int mthca_SYS_EN(struct mthca_dev *dev)
{
- u64 out;
+ u64 out = 0;
int ret;
ret = mthca_cmd_imm(dev, 0, &out, 0, 0, CMD_SYS_EN, CMD_TIME_CLASS_D);
@@ -1955,7 +1955,7 @@ int mthca_WRITE_MGM(struct mthca_dev *dev, int index,
int mthca_MGID_HASH(struct mthca_dev *dev, struct mthca_mailbox *mailbox,
u16 *hash)
{
- u64 imm;
+ u64 imm = 0;
int err;
err = mthca_cmd_imm(dev, mailbox->dma, &imm, 0, 0, CMD_MGID_HASH,
diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index f507c4cd46d3..f77c48b317f2 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -382,7 +382,7 @@ static int mthca_init_icm(struct mthca_dev *mdev,
struct mthca_init_hca_param *init_hca,
u64 icm_size)
{
- u64 aux_pages;
+ u64 aux_pages = 0;
int err;
err = mthca_SET_ICM_SIZE(mdev, icm_size, &aux_pages);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 179/374] RDMA/hns: Fix inappropriate err code for unsupported operations
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (177 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 178/374] RDMA/usnic: Silence uninitialized symbol smatch warnings Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 180/374] drm/panel-elida-kd35t133: hold panel in reset for unprepare Greg Kroah-Hartman
` (195 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Junxian Huang, Leon Romanovsky,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Junxian Huang <huangjunxian6@hisilicon.com>
[ Upstream commit f45b83ad39f8033e717b1eee57e81811113d5a84 ]
EOPNOTSUPP is more situable than EINVAL for allocating XRCD while XRC
is not supported and unsupported resizing SRQ.
Fixes: 32548870d438 ("RDMA/hns: Add support for XRC on HIP09")
Fixes: 221109e64316 ("RDMA/hns: Add interception for resizing SRQs")
Signed-off-by: Junxian Huang <huangjunxian6@hisilicon.com>
Link: https://lore.kernel.org/r/20231114123449.1106162-2-huangjunxian6@hisilicon.com
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 2 +-
drivers/infiniband/hw/hns/hns_roce_pd.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
index 6d8f3aa9d6aa..7376f012ece1 100644
--- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
+++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c
@@ -5442,7 +5442,7 @@ static int hns_roce_v2_modify_srq(struct ib_srq *ibsrq,
/* Resizing SRQs is not supported yet */
if (srq_attr_mask & IB_SRQ_MAX_WR)
- return -EINVAL;
+ return -EOPNOTSUPP;
if (srq_attr_mask & IB_SRQ_LIMIT) {
if (srq_attr->srq_limit > srq->wqe_cnt)
diff --git a/drivers/infiniband/hw/hns/hns_roce_pd.c b/drivers/infiniband/hw/hns/hns_roce_pd.c
index 81ffad77ae42..21bc26bd92d9 100644
--- a/drivers/infiniband/hw/hns/hns_roce_pd.c
+++ b/drivers/infiniband/hw/hns/hns_roce_pd.c
@@ -161,7 +161,7 @@ int hns_roce_alloc_xrcd(struct ib_xrcd *ib_xrcd, struct ib_udata *udata)
int ret;
if (!(hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_XRC))
- return -EINVAL;
+ return -EOPNOTSUPP;
ret = hns_roce_xrcd_alloc(hr_dev, &xrcd->xrcdn);
if (ret)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 180/374] drm/panel-elida-kd35t133: hold panel in reset for unprepare
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (178 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 179/374] RDMA/hns: Fix inappropriate err code for unsupported operations Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 181/374] drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer Greg Kroah-Hartman
` (194 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Morgan, Jessica Zhang,
Neil Armstrong, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chris Morgan <macromorgan@hotmail.com>
[ Upstream commit 03c5b2a5f6c39fe4e090346536cf1c14ee18b61e ]
For devices like the Anbernic RG351M and RG351P the panel is wired to
an always on regulator. When the device suspends and wakes up, there
are some slight artifacts on the screen that go away over time. If
instead we hold the panel in reset status after it is unprepared,
this does not happen.
Fixes: 5b6603360c12 ("drm/panel: add panel driver for Elida KD35T133 panels")
Signed-off-by: Chris Morgan <macromorgan@hotmail.com>
Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
Link: https://lore.kernel.org/r/20231117194405.1386265-3-macroalpha82@gmail.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231117194405.1386265-3-macroalpha82@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/panel/panel-elida-kd35t133.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/gpu/drm/panel/panel-elida-kd35t133.c b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
index 80227617a4d6..ccb7d521f30a 100644
--- a/drivers/gpu/drm/panel/panel-elida-kd35t133.c
+++ b/drivers/gpu/drm/panel/panel-elida-kd35t133.c
@@ -112,6 +112,8 @@ static int kd35t133_unprepare(struct drm_panel *panel)
return ret;
}
+ gpiod_set_value_cansleep(ctx->reset_gpio, 1);
+
regulator_disable(ctx->iovcc);
regulator_disable(ctx->vdd);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 181/374] drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (179 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 180/374] drm/panel-elida-kd35t133: hold panel in reset for unprepare Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 182/374] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function Greg Kroah-Hartman
` (193 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Abhinav Singh, Danilo Krummrich,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Abhinav Singh <singhabhinav9051571833@gmail.com>
[ Upstream commit 5f35a624c1e30b5bae5023b3c256e94e0ad4f806 ]
Fix a sparse warning with this message
"warning:dereference of noderef expression". In this context it means we
are dereferencing a __rcu tagged pointer directly.
We should not be directly dereferencing a rcu pointer. To get a normal
(non __rcu tagged pointer) from a __rcu tagged pointer we are using the
function unrcu_pointer(...). The non __rcu tagged pointer then can be
dereferenced just like a normal pointer.
I tested with qemu with this command
qemu-system-x86_64 \
-m 2G \
-smp 2 \
-kernel bzImage \
-append "console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \
-drive file=bullseye.img,format=raw \
-net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \
-net nic,model=e1000 \
-enable-kvm \
-nographic \
-pidfile vm.pid \
2>&1 | tee vm.log
with lockdep enabled.
Fixes: 0ec5f02f0e2c ("drm/nouveau: prevent stale fence->channel pointers, and protect with rcu")
Signed-off-by: Abhinav Singh <singhabhinav9051571833@gmail.com>
Signed-off-by: Danilo Krummrich <dakr@redhat.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231113191303.3277733-1-singhabhinav9051571833@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nv04_fence.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nv04_fence.c b/drivers/gpu/drm/nouveau/nv04_fence.c
index 5b71a5a5cd85..cdbc75e3d1f6 100644
--- a/drivers/gpu/drm/nouveau/nv04_fence.c
+++ b/drivers/gpu/drm/nouveau/nv04_fence.c
@@ -39,7 +39,7 @@ struct nv04_fence_priv {
static int
nv04_fence_emit(struct nouveau_fence *fence)
{
- struct nvif_push *push = fence->channel->chan.push;
+ struct nvif_push *push = unrcu_pointer(fence->channel)->chan.push;
int ret = PUSH_WAIT(push, 2);
if (ret == 0) {
PUSH_NVSQ(push, NV_SW, 0x0150, fence->base.seqno);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 182/374] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (180 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 181/374] drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 183/374] drm/tilcdc: Fix irq free on unload Greg Kroah-Hartman
` (192 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König,
Thomas Zimmermann, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit ce3e112e7ae854249d8755906acc5f27e1542114 ]
With tpd12s015_remove() marked with __exit this function is discarded
when the driver is compiled as a built-in. The result is that when the
driver unbinds there is no cleanup done which results in resource
leakage or worse.
Fixes: cff5e6f7e83f ("drm/bridge: Add driver for the TI TPD12S015 HDMI level shifter")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Link: https://patchwork.freedesktop.org/patch/msgid/20231102165640.3307820-19-u.kleine-koenig@pengutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/ti-tpd12s015.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/bridge/ti-tpd12s015.c b/drivers/gpu/drm/bridge/ti-tpd12s015.c
index e0e015243a60..b588fea12502 100644
--- a/drivers/gpu/drm/bridge/ti-tpd12s015.c
+++ b/drivers/gpu/drm/bridge/ti-tpd12s015.c
@@ -179,7 +179,7 @@ static int tpd12s015_probe(struct platform_device *pdev)
return 0;
}
-static int __exit tpd12s015_remove(struct platform_device *pdev)
+static int tpd12s015_remove(struct platform_device *pdev)
{
struct tpd12s015_device *tpd = platform_get_drvdata(pdev);
@@ -197,7 +197,7 @@ MODULE_DEVICE_TABLE(of, tpd12s015_of_match);
static struct platform_driver tpd12s015_driver = {
.probe = tpd12s015_probe,
- .remove = __exit_p(tpd12s015_remove),
+ .remove = tpd12s015_remove,
.driver = {
.name = "tpd12s015",
.of_match_table = tpd12s015_of_match,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 183/374] drm/tilcdc: Fix irq free on unload
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (181 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 182/374] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 184/374] media: pvrusb2: fix use after free on context disconnection Greg Kroah-Hartman
` (191 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, Aradhya Bhatia,
Tomi Valkeinen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit 38360bf96d816e175bc602c4ee76953cd303b71d ]
The driver only frees the reserved irq if priv->irq_enabled is set to
true. However, the driver mistakenly sets priv->irq_enabled to false,
instead of true, in tilcdc_irq_install(), and thus the driver never
frees the irq, causing issues on loading the driver a second time.
Fixes: b6366814fa77 ("drm/tilcdc: Convert to Linux IRQ interfaces")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Reviewed-by: Aradhya Bhatia <a-bhatia1@ti.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20230919-lcdc-v1-1-ba60da7421e1@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/tilcdc/tilcdc_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
index 6b03f89a98d4..6924488274dd 100644
--- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c
+++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c
@@ -140,7 +140,7 @@ static int tilcdc_irq_install(struct drm_device *dev, unsigned int irq)
if (ret)
return ret;
- priv->irq_enabled = false;
+ priv->irq_enabled = true;
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 184/374] media: pvrusb2: fix use after free on context disconnection
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (182 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 183/374] drm/tilcdc: Fix irq free on unload Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 185/374] drm/bridge: Fix typo in post_disable() description Greg Kroah-Hartman
` (190 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ricardo B. Marliere, Mike Isely,
Hans Verkuil, Mauro Carvalho Chehab, Sasha Levin,
syzbot+621409285c4156a009b3
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo B. Marliere <ricardo@marliere.net>
[ Upstream commit ded85b0c0edd8f45fec88783d7555a5b982449c1 ]
Upon module load, a kthread is created targeting the
pvr2_context_thread_func function, which may call pvr2_context_destroy
and thus call kfree() on the context object. However, that might happen
before the usb hub_event handler is able to notify the driver. This
patch adds a sanity check before the invalid read reported by syzbot,
within the context disconnection call stack.
Reported-and-tested-by: syzbot+621409285c4156a009b3@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/000000000000a02a4205fff8eb92@google.com/
Fixes: e5be15c63804 ("V4L/DVB (7711): pvrusb2: Fix race on module unload")
Signed-off-by: Ricardo B. Marliere <ricardo@marliere.net>
Acked-by: Mike Isely <isely@pobox.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/pvrusb2/pvrusb2-context.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/usb/pvrusb2/pvrusb2-context.c b/drivers/media/usb/pvrusb2/pvrusb2-context.c
index 14170a5d72b3..1764674de98b 100644
--- a/drivers/media/usb/pvrusb2/pvrusb2-context.c
+++ b/drivers/media/usb/pvrusb2/pvrusb2-context.c
@@ -268,7 +268,8 @@ void pvr2_context_disconnect(struct pvr2_context *mp)
{
pvr2_hdw_disconnect(mp->hdw);
mp->disconnect_flag = !0;
- pvr2_context_notify(mp);
+ if (!pvr2_context_shutok())
+ pvr2_context_notify(mp);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 185/374] drm/bridge: Fix typo in post_disable() description
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (183 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 184/374] media: pvrusb2: fix use after free on context disconnection Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 186/374] f2fs: fix to avoid dirent corruption Greg Kroah-Hartman
` (189 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dario Binacchi, Robert Foss,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dario Binacchi <dario.binacchi@amarulasolutions.com>
[ Upstream commit 288b039db225676e0c520c981a1b5a2562d893a3 ]
s/singals/signals/
Fixes: 199e4e967af4 ("drm: Extract drm_bridge.h")
Signed-off-by: Dario Binacchi <dario.binacchi@amarulasolutions.com>
Signed-off-by: Robert Foss <rfoss@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231124094253.658064-1-dario.binacchi@amarulasolutions.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/drm/drm_bridge.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/drm/drm_bridge.h b/include/drm/drm_bridge.h
index c84783cd5abd..3188b7a1d2c7 100644
--- a/include/drm/drm_bridge.h
+++ b/include/drm/drm_bridge.h
@@ -191,7 +191,7 @@ struct drm_bridge_funcs {
* or &drm_encoder_helper_funcs.dpms hook.
*
* The bridge must assume that the display pipe (i.e. clocks and timing
- * singals) feeding it is no longer running when this callback is
+ * signals) feeding it is no longer running when this callback is
* called.
*
* The @post_disable callback is optional.
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 186/374] f2fs: fix to avoid dirent corruption
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (184 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 185/374] drm/bridge: Fix typo in post_disable() description Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 187/374] drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() Greg Kroah-Hartman
` (188 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Kara, Al Viro, Chao Yu,
Jaegeuk Kim, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit 53edb549565f55ccd0bdf43be3d66ce4c2d48b28 ]
As Al reported in link[1]:
f2fs_rename()
...
if (old_dir != new_dir && !whiteout)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
f2fs_put_page(old_dir_page, 0);
You want correct inumber in the ".." link. And cross-directory
rename does move the source to new parent, even if you'd been asked
to leave a whiteout in the old place.
[1] https://lore.kernel.org/all/20231017055040.GN800259@ZenIV/
With below testcase, it may cause dirent corruption, due to it missed
to call f2fs_set_link() to update ".." link to new directory.
- mkdir -p dir/foo
- renameat2 -w dir/foo bar
[ASSERT] (__chk_dots_dentries:1421) --> Bad inode number[0x4] for '..', parent parent ino is [0x3]
[FSCK] other corrupted bugs [Fail]
Fixes: 7e01e7ad746b ("f2fs: support RENAME_WHITEOUT")
Cc: Jan Kara <jack@suse.cz>
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Chao Yu <chao@kernel.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c
index 7a86a8dcf4f1..0d6906644feb 100644
--- a/fs/f2fs/namei.c
+++ b/fs/f2fs/namei.c
@@ -1088,7 +1088,7 @@ static int f2fs_rename(struct inode *old_dir, struct dentry *old_dentry,
}
if (old_dir_entry) {
- if (old_dir != new_dir && !whiteout)
+ if (old_dir != new_dir)
f2fs_set_link(old_inode, old_dir_entry,
old_dir_page, new_dir);
else
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 187/374] drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (185 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 186/374] f2fs: fix to avoid dirent corruption Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 188/374] drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() Greg Kroah-Hartman
` (187 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 39c960bbf9d9ea862398759e75736cfb68c3446f ]
While improbable, there may be a chance of hitting integer
overflow when the result of radeon_get_ib_value() gets shifted
left.
Avoid it by casting one of the operands to larger data type (u64).
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 1729dd33d20b ("drm/radeon/kms: r600 CS parser fixes")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/r600_cs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/r600_cs.c b/drivers/gpu/drm/radeon/r600_cs.c
index 8be4799a98ef..6ade5dd470d5 100644
--- a/drivers/gpu/drm/radeon/r600_cs.c
+++ b/drivers/gpu/drm/radeon/r600_cs.c
@@ -1277,7 +1277,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
return -EINVAL;
}
tmp = (reg - CB_COLOR0_BASE) / 4;
- track->cb_color_bo_offset[tmp] = radeon_get_ib_value(p, idx) << 8;
+ track->cb_color_bo_offset[tmp] = (u64)radeon_get_ib_value(p, idx) << 8;
ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
track->cb_color_base_last[tmp] = ib[idx];
track->cb_color_bo[tmp] = reloc->robj;
@@ -1304,7 +1304,7 @@ static int r600_cs_check_reg(struct radeon_cs_parser *p, u32 reg, u32 idx)
"0x%04X\n", reg);
return -EINVAL;
}
- track->htile_offset = radeon_get_ib_value(p, idx) << 8;
+ track->htile_offset = (u64)radeon_get_ib_value(p, idx) << 8;
ib[idx] += (u32)((reloc->gpu_offset >> 8) & 0xffffffff);
track->htile_bo = reloc->robj;
track->db_dirty = true;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 188/374] drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (186 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 187/374] drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 189/374] drm/radeon: check return value of radeon_ring_lock() Greg Kroah-Hartman
` (186 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit b5c5baa458faa5430c445acd9a17481274d77ccf ]
It may be possible, albeit unlikely, to encounter integer overflow
during the multiplication of several unsigned int variables, the
result being assigned to a variable 'size' of wider type.
Prevent this potential behaviour by converting one of the multiples
to unsigned long.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 0242f74d29df ("drm/radeon: clean up CS functions in r100.c")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/r100.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/r100.c b/drivers/gpu/drm/radeon/r100.c
index 2dd85ba1faa2..d3ad98bd2590 100644
--- a/drivers/gpu/drm/radeon/r100.c
+++ b/drivers/gpu/drm/radeon/r100.c
@@ -2320,7 +2320,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
switch (prim_walk) {
case 1:
for (i = 0; i < track->num_arrays; i++) {
- size = track->arrays[i].esize * track->max_indx * 4;
+ size = track->arrays[i].esize * track->max_indx * 4UL;
if (track->arrays[i].robj == NULL) {
DRM_ERROR("(PW %u) Vertex array %u no buffer "
"bound\n", prim_walk, i);
@@ -2339,7 +2339,7 @@ int r100_cs_track_check(struct radeon_device *rdev, struct r100_cs_track *track)
break;
case 2:
for (i = 0; i < track->num_arrays; i++) {
- size = track->arrays[i].esize * (nverts - 1) * 4;
+ size = track->arrays[i].esize * (nverts - 1) * 4UL;
if (track->arrays[i].robj == NULL) {
DRM_ERROR("(PW %u) Vertex array %u no buffer "
"bound\n", prim_walk, i);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 189/374] drm/radeon: check return value of radeon_ring_lock()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (187 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 188/374] drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 190/374] ASoC: cs35l33: Fix GPIO name and drop legacy include Greg Kroah-Hartman
` (185 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Zhandarovich, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 71225e1c930942cb1e042fc08c5cc0c4ef30e95e ]
In the unlikely event of radeon_ring_lock() failing, its errno return
value should be processed. This patch checks said return value and
prints a debug message in case of an error.
Found by Linux Verification Center (linuxtesting.org) with static
analysis tool SVACE.
Fixes: 48c0c902e2e6 ("drm/radeon/kms: add support for CP setup on SI")
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/si.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c
index 4679b798a038..e4481e5a15e1 100644
--- a/drivers/gpu/drm/radeon/si.c
+++ b/drivers/gpu/drm/radeon/si.c
@@ -3611,6 +3611,10 @@ static int si_cp_start(struct radeon_device *rdev)
for (i = RADEON_RING_TYPE_GFX_INDEX; i <= CAYMAN_RING_TYPE_CP2_INDEX; ++i) {
ring = &rdev->ring[i];
r = radeon_ring_lock(rdev, ring, 2);
+ if (r) {
+ DRM_ERROR("radeon: cp failed to lock ring (%d).\n", r);
+ return r;
+ }
/* clear the compute context state */
radeon_ring_write(ring, PACKET3_COMPUTE(PACKET3_CLEAR_STATE, 0));
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 190/374] ASoC: cs35l33: Fix GPIO name and drop legacy include
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (188 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 189/374] drm/radeon: check return value of radeon_ring_lock() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 191/374] ASoC: cs35l34: " Greg Kroah-Hartman
` (184 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charles Keepax, Linus Walleij,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
[ Upstream commit 50678d339d670a92658e5538ebee30447c88ccb3 ]
This driver includes the legacy GPIO APIs <linux/gpio.h> and
<linux/of_gpio.h> but does not use any symbols from any of
them.
Drop the includes.
Further the driver is requesting "reset-gpios" rather than
just "reset" from the GPIO framework. This is wrong because
the gpiolib core will add "-gpios" before processing the
request from e.g. device tree. Drop the suffix.
The last problem means that the optional RESET GPIO has
never been properly retrieved and used even if it existed,
but nobody noticed.
Fixes: 3333cb7187b9 ("ASoC: cs35l33: Initial commit of the cs35l33 CODEC driver.")
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-2-ee9f9d4655eb@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs35l33.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/sound/soc/codecs/cs35l33.c b/sound/soc/codecs/cs35l33.c
index 2a6f5e46d031..3ea311fda98f 100644
--- a/sound/soc/codecs/cs35l33.c
+++ b/sound/soc/codecs/cs35l33.c
@@ -22,13 +22,11 @@
#include <sound/soc-dapm.h>
#include <sound/initval.h>
#include <sound/tlv.h>
-#include <linux/gpio.h>
#include <linux/gpio/consumer.h>
#include <sound/cs35l33.h>
#include <linux/pm_runtime.h>
#include <linux/regulator/consumer.h>
#include <linux/regulator/machine.h>
-#include <linux/of_gpio.h>
#include <linux/of.h>
#include <linux/of_device.h>
#include <linux/of_irq.h>
@@ -1169,7 +1167,7 @@ static int cs35l33_i2c_probe(struct i2c_client *i2c_client,
/* We could issue !RST or skip it based on AMP topology */
cs35l33->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
- "reset-gpios", GPIOD_OUT_HIGH);
+ "reset", GPIOD_OUT_HIGH);
if (IS_ERR(cs35l33->reset_gpio)) {
dev_err(&i2c_client->dev, "%s ERROR: Can't get reset GPIO\n",
__func__);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 191/374] ASoC: cs35l34: Fix GPIO name and drop legacy include
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (189 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 190/374] ASoC: cs35l33: Fix GPIO name and drop legacy include Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 192/374] drm/msm/mdp4: flush vblank event on disable Greg Kroah-Hartman
` (183 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Charles Keepax, Linus Walleij,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
[ Upstream commit a6122b0b4211d132934ef99e7b737910e6d54d2f ]
This driver includes the legacy GPIO APIs <linux/gpio.h> and
<linux/of_gpio.h> but does not use any symbols from any of
them.
Drop the includes.
Further the driver is requesting "reset-gpios" rather than
just "reset" from the GPIO framework. This is wrong because
the gpiolib core will add "-gpios" before processing the
request from e.g. device tree. Drop the suffix.
The last problem means that the optional RESET GPIO has
never been properly retrieved and used even if it existed,
but nobody noticed.
Fixes: c1124c09e103 ("ASoC: cs35l34: Initial commit of the cs35l34 CODEC driver.")
Acked-by: Charles Keepax <ckeepax@opensource.cirrus.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Link: https://lore.kernel.org/r/20231201-descriptors-sound-cirrus-v2-3-ee9f9d4655eb@linaro.org
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/cs35l34.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/sound/soc/codecs/cs35l34.c b/sound/soc/codecs/cs35l34.c
index ed678241c22b..be0edeebddfe 100644
--- a/sound/soc/codecs/cs35l34.c
+++ b/sound/soc/codecs/cs35l34.c
@@ -20,14 +20,12 @@
#include <linux/regulator/machine.h>
#include <linux/pm_runtime.h>
#include <linux/of_device.h>
-#include <linux/of_gpio.h>
#include <linux/of_irq.h>
#include <sound/core.h>
#include <sound/pcm.h>
#include <sound/pcm_params.h>
#include <sound/soc.h>
#include <sound/soc-dapm.h>
-#include <linux/gpio.h>
#include <linux/gpio/consumer.h>
#include <sound/initval.h>
#include <sound/tlv.h>
@@ -1063,7 +1061,7 @@ static int cs35l34_i2c_probe(struct i2c_client *i2c_client,
dev_err(&i2c_client->dev, "Failed to request IRQ: %d\n", ret);
cs35l34->reset_gpio = devm_gpiod_get_optional(&i2c_client->dev,
- "reset-gpios", GPIOD_OUT_LOW);
+ "reset", GPIOD_OUT_LOW);
if (IS_ERR(cs35l34->reset_gpio)) {
ret = PTR_ERR(cs35l34->reset_gpio);
goto err_regulator;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 192/374] drm/msm/mdp4: flush vblank event on disable
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (190 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 191/374] ASoC: cs35l34: " Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 193/374] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks Greg Kroah-Hartman
` (182 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Abhinav Kumar,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit c6721b3c6423d8a348ae885a0f4c85e14f9bf85c ]
Flush queued events when disabling the crtc. This avoids timeouts when
we come back and wait for dependencies (like the previous frame's
flip_done).
Fixes: c8afe684c95c ("drm/msm: basic KMS driver for snapdragon")
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Abhinav Kumar <quic_abhinavk@quicinc.com>
Patchwork: https://patchwork.freedesktop.org/patch/569127/
Link: https://lore.kernel.org/r/20231127215401.4064128-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
index 169f9de4a12a..3100957225a7 100644
--- a/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
+++ b/drivers/gpu/drm/msm/disp/mdp4/mdp4_crtc.c
@@ -269,6 +269,7 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
{
struct mdp4_crtc *mdp4_crtc = to_mdp4_crtc(crtc);
struct mdp4_kms *mdp4_kms = get_kms(crtc);
+ unsigned long flags;
DBG("%s", mdp4_crtc->name);
@@ -281,6 +282,14 @@ static void mdp4_crtc_atomic_disable(struct drm_crtc *crtc,
mdp_irq_unregister(&mdp4_kms->base, &mdp4_crtc->err);
mdp4_disable(mdp4_kms);
+ if (crtc->state->event && !crtc->state->active) {
+ WARN_ON(mdp4_crtc->event);
+ spin_lock_irqsave(&mdp4_kms->dev->event_lock, flags);
+ drm_crtc_send_vblank_event(crtc, crtc->state->event);
+ crtc->state->event = NULL;
+ spin_unlock_irqrestore(&mdp4_kms->dev->event_lock, flags);
+ }
+
mdp4_crtc->enabled = false;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 193/374] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (191 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 192/374] drm/msm/mdp4: flush vblank event on disable Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 194/374] drm/drv: propagate errors from drm_modeset_register_all() Greg Kroah-Hartman
` (181 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Konrad Dybcio, Dmitry Baryshkov,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konrad Dybcio <konrad.dybcio@linaro.org>
[ Upstream commit 3d07a411b4faaf2b498760ccf12888f8de529de0 ]
This helper has been introduced to avoid programmer errors (missing
_put calls leading to dangling refcnt) when using pm_runtime_get, use it.
While at it, start checking the return value.
Signed-off-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Fixes: 5c8290284402 ("drm/msm/dsi: Split PHY drivers to separate files")
Patchwork: https://patchwork.freedesktop.org/patch/543350/
Link: https://lore.kernel.org/r/20230620-topic-dsiphy_rpm-v2-1-a11a751f34f0@linaro.org
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/msm/dsi/phy/dsi_phy.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
index 6a917fe69a83..4b5b0a4b051b 100644
--- a/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
+++ b/drivers/gpu/drm/msm/dsi/phy/dsi_phy.c
@@ -588,7 +588,9 @@ static int dsi_phy_enable_resource(struct msm_dsi_phy *phy)
struct device *dev = &phy->pdev->dev;
int ret;
- pm_runtime_get_sync(dev);
+ ret = pm_runtime_resume_and_get(dev);
+ if (ret)
+ return ret;
ret = clk_prepare_enable(phy->ahb_clk);
if (ret) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 194/374] drm/drv: propagate errors from drm_modeset_register_all()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (192 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 193/374] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 195/374] drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() Greg Kroah-Hartman
` (180 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Neil Armstrong, Dmitry Baryshkov,
Maxime Ripard, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 5f8dec200923a76dc57187965fd59c1136f5d085 ]
In case the drm_modeset_register_all() function fails, its error code
will be ignored. Instead make the drm_dev_register() bail out in case of
such an error.
Fixes: 79190ea2658a ("drm: Add callbacks for late registering")
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Signed-off-by: Maxime Ripard <mripard@kernel.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20231202225552.1283638-1-dmitry.baryshkov@linaro.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/drm_drv.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c
index 6f1791613757..23409f1916ee 100644
--- a/drivers/gpu/drm/drm_drv.c
+++ b/drivers/gpu/drm/drm_drv.c
@@ -894,8 +894,11 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
goto err_minors;
}
- if (drm_core_check_feature(dev, DRIVER_MODESET))
- drm_modeset_register_all(dev);
+ if (drm_core_check_feature(dev, DRIVER_MODESET)) {
+ ret = drm_modeset_register_all(dev);
+ if (ret)
+ goto err_unload;
+ }
DRM_INFO("Initialized %s %d.%d.%d %s for %s on minor %d\n",
driver->name, driver->major, driver->minor,
@@ -905,6 +908,9 @@ int drm_dev_register(struct drm_device *dev, unsigned long flags)
goto out_unlock;
+err_unload:
+ if (dev->driver->unload)
+ dev->driver->unload(dev);
err_minors:
remove_compat_control_link(dev);
drm_minor_unregister(dev, DRM_MINOR_PRIMARY);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 195/374] drm/radeon: check the alloc_workqueue return value in radeon_crtc_init()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (193 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 194/374] drm/drv: propagate errors from drm_modeset_register_all() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 196/374] drm/radeon/dpm: fix a memleak in sumo_parse_power_table Greg Kroah-Hartman
` (179 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Yang Yingliang, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Yingliang <yangyingliang@huawei.com>
[ Upstream commit 7a2464fac80d42f6f8819fed97a553e9c2f43310 ]
check the alloc_workqueue return value in radeon_crtc_init()
to avoid null-ptr-deref.
Fixes: fa7f517cb26e ("drm/radeon: rework page flip handling v4")
Signed-off-by: Yang Yingliang <yangyingliang@huawei.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
index 573154268d43..6337fad441df 100644
--- a/drivers/gpu/drm/radeon/radeon_display.c
+++ b/drivers/gpu/drm/radeon/radeon_display.c
@@ -681,11 +681,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index)
if (radeon_crtc == NULL)
return;
+ radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
+ if (!radeon_crtc->flip_queue) {
+ kfree(radeon_crtc);
+ return;
+ }
+
drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs);
drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256);
radeon_crtc->crtc_id = index;
- radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0);
rdev->mode_info.crtcs[index] = radeon_crtc;
if (rdev->family >= CHIP_BONAIRE) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 196/374] drm/radeon/dpm: fix a memleak in sumo_parse_power_table
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (194 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 195/374] drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 197/374] drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table Greg Kroah-Hartman
` (178 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 0737df9ed0997f5b8addd6e2b9699a8c6edba2e4 ]
The rdev->pm.dpm.ps allocated by kcalloc should be freed in every
following error-handling path. However, in the error-handling of
rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed,
resulting in a memleak in this function.
Fixes: 80ea2c129c76 ("drm/radeon/kms: add dpm support for sumo asics (v2)")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/sumo_dpm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/sumo_dpm.c b/drivers/gpu/drm/radeon/sumo_dpm.c
index f74f381af05f..d49c145db437 100644
--- a/drivers/gpu/drm/radeon/sumo_dpm.c
+++ b/drivers/gpu/drm/radeon/sumo_dpm.c
@@ -1493,8 +1493,10 @@ static int sumo_parse_power_table(struct radeon_device *rdev)
non_clock_array_index = power_state->v2.nonClockInfoIndex;
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
&non_clock_info_array->nonClockInfo[non_clock_array_index];
- if (!rdev->pm.power_state[i].clock_info)
+ if (!rdev->pm.power_state[i].clock_info) {
+ kfree(rdev->pm.dpm.ps);
return -EINVAL;
+ }
ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
if (ps == NULL) {
kfree(rdev->pm.dpm.ps);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 197/374] drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (195 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 196/374] drm/radeon/dpm: fix a memleak in sumo_parse_power_table Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 198/374] drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable Greg Kroah-Hartman
` (177 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 28c28d7f77c06ac2c0b8f9c82bc04eba22912b3b ]
The rdev->pm.dpm.ps allocated by kcalloc should be freed in every
following error-handling path. However, in the error-handling of
rdev->pm.power_state[i].clock_info the rdev->pm.dpm.ps is not freed,
resulting in a memleak in this function.
Fixes: d70229f70447 ("drm/radeon/kms: add dpm support for trinity asics")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/trinity_dpm.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/radeon/trinity_dpm.c b/drivers/gpu/drm/radeon/trinity_dpm.c
index 08ea1c864cb2..ef1cc7bad20a 100644
--- a/drivers/gpu/drm/radeon/trinity_dpm.c
+++ b/drivers/gpu/drm/radeon/trinity_dpm.c
@@ -1726,8 +1726,10 @@ static int trinity_parse_power_table(struct radeon_device *rdev)
non_clock_array_index = power_state->v2.nonClockInfoIndex;
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
&non_clock_info_array->nonClockInfo[non_clock_array_index];
- if (!rdev->pm.power_state[i].clock_info)
+ if (!rdev->pm.power_state[i].clock_info) {
+ kfree(rdev->pm.dpm.ps);
return -EINVAL;
+ }
ps = kzalloc(sizeof(struct sumo_ps), GFP_KERNEL);
if (ps == NULL) {
kfree(rdev->pm.dpm.ps);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 198/374] drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (196 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 197/374] drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 199/374] drm/bridge: tc358767: Fix return value on error case Greg Kroah-Hartman
` (176 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Tomi Valkeinen,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit 155d6fb61270dd297f128731cd155080deee8f3a ]
'ret' could be uninitialized at the end of the function, although it's
not clear if that can happen in practice.
Fixes: 6a3608eae6d3 ("drm: bridge: cdns-mhdp8546: Enable HDCP")
Acked-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-3-c22b2444f5f5@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
index fccd6fbcc257..29c04012b701 100644
--- a/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
+++ b/drivers/gpu/drm/bridge/cadence/cdns-mhdp8546-hdcp.c
@@ -403,7 +403,8 @@ static int _cdns_mhdp_hdcp_disable(struct cdns_mhdp_device *mhdp)
static int _cdns_mhdp_hdcp_enable(struct cdns_mhdp_device *mhdp, u8 content_type)
{
- int ret, tries = 3;
+ int ret = -EINVAL;
+ int tries = 3;
u32 i;
for (i = 0; i < tries; i++) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 199/374] drm/bridge: tc358767: Fix return value on error case
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (197 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 198/374] drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 200/374] media: cx231xx: fix a memleak in cx231xx_init_isoc Greg Kroah-Hartman
` (175 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maxime Ripard, Tomi Valkeinen,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
[ Upstream commit 32bd29b619638256c5b75fb021d6d9f12fc4a984 ]
If the hpd_pin is invalid, the driver returns 'ret'. But 'ret' contains
0, instead of an error value.
Return -EINVAL instead.
Fixes: f25ee5017e4f ("drm/bridge: tc358767: add IRQ and HPD support")
Acked-by: Maxime Ripard <mripard@kernel.org>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20231103-uninit-fixes-v2-4-c22b2444f5f5@ideasonboard.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/bridge/tc358767.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/bridge/tc358767.c b/drivers/gpu/drm/bridge/tc358767.c
index 14d671742963..4c6f3052156b 100644
--- a/drivers/gpu/drm/bridge/tc358767.c
+++ b/drivers/gpu/drm/bridge/tc358767.c
@@ -1633,7 +1633,7 @@ static int tc_probe(struct i2c_client *client, const struct i2c_device_id *id)
} else {
if (tc->hpd_pin < 0 || tc->hpd_pin > 1) {
dev_err(dev, "failed to parse HPD number\n");
- return ret;
+ return -EINVAL;
}
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 200/374] media: cx231xx: fix a memleak in cx231xx_init_isoc
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (198 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 199/374] drm/bridge: tc358767: Fix return value on error case Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 201/374] clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config Greg Kroah-Hartman
` (174 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Hans Verkuil,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 5d3c8990e2bbf929cb211563dadd70708f42e4e6 ]
The dma_q->p_left_data alloced by kzalloc should be freed in all the
following error handling paths. However, it hasn't been freed in the
allocation error paths of dev->video_mode.isoc_ctl.urb and
dev->video_mode.isoc_ctl.transfer_buffer.
On the other hand, the dma_q->p_left_data did be freed in the
error-handling paths after that of dev->video_mode.isoc_ctl.urb and
dev->video_mode.isoc_ctl.transfer_buffer, by calling
cx231xx_uninit_isoc(dev). So the same free operation should be done in
error-handling paths of those two allocation.
Fixes: 64fbf4445526 ("[media] cx231xx: Added support for Carraera, Shelby, RDx_253S and VIDEO_GRABBER")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/usb/cx231xx/cx231xx-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c
index 727e6268567f..f1feccc28bf0 100644
--- a/drivers/media/usb/cx231xx/cx231xx-core.c
+++ b/drivers/media/usb/cx231xx/cx231xx-core.c
@@ -1024,6 +1024,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
if (!dev->video_mode.isoc_ctl.urb) {
dev_err(dev->dev,
"cannot alloc memory for usb buffers\n");
+ kfree(dma_q->p_left_data);
return -ENOMEM;
}
@@ -1033,6 +1034,7 @@ int cx231xx_init_isoc(struct cx231xx *dev, int max_packets,
dev_err(dev->dev,
"cannot allocate memory for usbtransfer\n");
kfree(dev->video_mode.isoc_ctl.urb);
+ kfree(dma_q->p_left_data);
return -ENOMEM;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 201/374] clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (199 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 200/374] media: cx231xx: fix a memleak in cx231xx_init_isoc Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 202/374] media: rkisp1: Disable runtime PM in probe error path Greg Kroah-Hartman
` (173 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Satya Priya Kakitapalli,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
[ Upstream commit 6ebd9a4f8b8d2b35cf965a04849c4ba763722f13 ]
Update the test_ctl_hi_val and test_ctl_hi1_val of gpu_cc_pll1
as per latest HW recommendation.
Fixes: 0cef71f2ccc8 ("clk: qcom: Add graphics clock controller driver for SM8150")
Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231122042814.4158076-1-quic_skakitap@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/gpucc-sm8150.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/qcom/gpucc-sm8150.c b/drivers/clk/qcom/gpucc-sm8150.c
index 8422fd047493..c89a5b59ddb7 100644
--- a/drivers/clk/qcom/gpucc-sm8150.c
+++ b/drivers/clk/qcom/gpucc-sm8150.c
@@ -37,8 +37,8 @@ static struct alpha_pll_config gpu_cc_pll1_config = {
.config_ctl_hi_val = 0x00002267,
.config_ctl_hi1_val = 0x00000024,
.test_ctl_val = 0x00000000,
- .test_ctl_hi_val = 0x00000002,
- .test_ctl_hi1_val = 0x00000000,
+ .test_ctl_hi_val = 0x00000000,
+ .test_ctl_hi1_val = 0x00000020,
.user_ctl_val = 0x00000000,
.user_ctl_hi_val = 0x00000805,
.user_ctl_hi1_val = 0x000000d0,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 202/374] media: rkisp1: Disable runtime PM in probe error path
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (200 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 201/374] clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 203/374] f2fs: fix to check compress file in f2fs_move_file_range() Greg Kroah-Hartman
` (172 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Laurent Pinchart, Dafna Hirschfeld,
Paul Elder, Mauro Carvalho Chehab, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
[ Upstream commit 13c9810281f8b24af9b7712cd84a1fce61843e93 ]
If the v4l2_device_register() call fails, runtime PM is left enabled.
Fix it.
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Dafna Hirschfeld <dafna@fastmail.com>
Reviewed-by: Paul Elder <paul.elder@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Stable-dep-of: 452f604a4683 ("media: rkisp1: Fix media device memory leak")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
index 560f928c3752..79cfa99f2a64 100644
--- a/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
+++ b/drivers/media/platform/rockchip/rkisp1/rkisp1-dev.c
@@ -514,7 +514,7 @@ static int rkisp1_probe(struct platform_device *pdev)
ret = v4l2_device_register(rkisp1->dev, &rkisp1->v4l2_dev);
if (ret)
- return ret;
+ goto err_pm_runtime_disable;
ret = media_device_register(&rkisp1->media_dev);
if (ret) {
@@ -534,6 +534,7 @@ static int rkisp1_probe(struct platform_device *pdev)
media_device_unregister(&rkisp1->media_dev);
err_unreg_v4l2_dev:
v4l2_device_unregister(&rkisp1->v4l2_dev);
+err_pm_runtime_disable:
pm_runtime_disable(&pdev->dev);
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 203/374] f2fs: fix to check compress file in f2fs_move_file_range()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (201 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 202/374] media: rkisp1: Disable runtime PM in probe error path Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 204/374] f2fs: fix to update iostat correctly in f2fs_filemap_fault() Greg Kroah-Hartman
` (171 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit fb9b65340c818875ea86464faf3c744bdce0055c ]
f2fs_move_file_range() doesn't support migrating compressed cluster
data, let's add the missing check condition and return -EOPNOTSUPP
for the case until we support it.
Fixes: 4c8ff7095bef ("f2fs: support data compression")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 58fd32db025d..0669ac4c0f12 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -2780,6 +2780,11 @@ static int f2fs_move_file_range(struct file *file_in, loff_t pos_in,
goto out;
}
+ if (f2fs_compressed_file(src) || f2fs_compressed_file(dst)) {
+ ret = -EOPNOTSUPP;
+ goto out_unlock;
+ }
+
ret = -EINVAL;
if (pos_in + len > src->i_size || pos_in + len < pos_in)
goto out_unlock;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 204/374] f2fs: fix to update iostat correctly in f2fs_filemap_fault()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (202 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 203/374] f2fs: fix to check compress file in f2fs_move_file_range() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 205/374] f2fs: fix the f2fs_file_write_iter tracepoint Greg Kroah-Hartman
` (170 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Chao Yu, Jaegeuk Kim, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
[ Upstream commit bb34cc6ca87ff78f9fb5913d7619dc1389554da6 ]
In f2fs_filemap_fault(), it fixes to update iostat info only if
VM_FAULT_LOCKED is tagged in return value of filemap_fault().
Fixes: 8b83ac81f428 ("f2fs: support read iostat")
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 0669ac4c0f12..533ab259ce01 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -41,7 +41,7 @@ static vm_fault_t f2fs_filemap_fault(struct vm_fault *vmf)
vm_fault_t ret;
ret = filemap_fault(vmf);
- if (!ret)
+ if (ret & VM_FAULT_LOCKED)
f2fs_update_iostat(F2FS_I_SB(inode), APP_MAPPED_READ_IO,
F2FS_BLKSIZE);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 205/374] f2fs: fix the f2fs_file_write_iter tracepoint
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (203 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 204/374] f2fs: fix to update iostat correctly in f2fs_filemap_fault() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 206/374] media: dvbdev: drop refcount on error path in dvb_device_open() Greg Kroah-Hartman
` (169 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Biggers, Chao Yu, Jaegeuk Kim,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Biggers <ebiggers@google.com>
[ Upstream commit ccf7cf92373d1a53166582013430b3b9c05a6ba2 ]
Pass in the original position and count rather than the position and
count that were updated by the write. Also use the correct types for
all arguments, in particular the file offset which was being truncated
to 32 bits on 32-bit platforms.
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Stable-dep-of: bb34cc6ca87f ("f2fs: fix to update iostat correctly in f2fs_filemap_fault()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/f2fs/file.c | 5 +++--
include/trace/events/f2fs.h | 12 ++++++------
2 files changed, 9 insertions(+), 8 deletions(-)
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 533ab259ce01..d220c4523982 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -4255,6 +4255,8 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
{
struct file *file = iocb->ki_filp;
struct inode *inode = file_inode(file);
+ const loff_t orig_pos = iocb->ki_pos;
+ const size_t orig_count = iov_iter_count(from);
ssize_t ret;
if (unlikely(f2fs_cp_error(F2FS_I_SB(inode)))) {
@@ -4358,8 +4360,7 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
unlock:
inode_unlock(inode);
out:
- trace_f2fs_file_write_iter(inode, iocb->ki_pos,
- iov_iter_count(from), ret);
+ trace_f2fs_file_write_iter(inode, orig_pos, orig_count, ret);
if (ret > 0)
ret = generic_write_sync(iocb, ret);
return ret;
diff --git a/include/trace/events/f2fs.h b/include/trace/events/f2fs.h
index f5dcf7c9b707..6033eaddcb74 100644
--- a/include/trace/events/f2fs.h
+++ b/include/trace/events/f2fs.h
@@ -540,17 +540,17 @@ TRACE_EVENT(f2fs_truncate_partial_nodes,
TRACE_EVENT(f2fs_file_write_iter,
- TP_PROTO(struct inode *inode, unsigned long offset,
- unsigned long length, int ret),
+ TP_PROTO(struct inode *inode, loff_t offset, size_t length,
+ ssize_t ret),
TP_ARGS(inode, offset, length, ret),
TP_STRUCT__entry(
__field(dev_t, dev)
__field(ino_t, ino)
- __field(unsigned long, offset)
- __field(unsigned long, length)
- __field(int, ret)
+ __field(loff_t, offset)
+ __field(size_t, length)
+ __field(ssize_t, ret)
),
TP_fast_assign(
@@ -562,7 +562,7 @@ TRACE_EVENT(f2fs_file_write_iter,
),
TP_printk("dev = (%d,%d), ino = %lu, "
- "offset = %lu, length = %lu, written(err) = %d",
+ "offset = %lld, length = %zu, written(err) = %zd",
show_dev_ino(__entry),
__entry->offset,
__entry->length,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 206/374] media: dvbdev: drop refcount on error path in dvb_device_open()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (204 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 205/374] f2fs: fix the f2fs_file_write_iter tracepoint Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 207/374] media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() Greg Kroah-Hartman
` (168 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dan Carpenter, Hans Verkuil,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@linaro.org>
[ Upstream commit a2dd235df435a05d389240be748909ada91201d2 ]
If call to file->f_op->open() fails, then call dvb_device_put(dvbdev).
Fixes: 0fc044b2b5e2 ("media: dvbdev: adopts refcnt to avoid UAF")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-core/dvbdev.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index 2ff8a1b776fb..3a83e8e09256 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c
@@ -114,6 +114,8 @@ static int dvb_device_open(struct inode *inode, struct file *file)
err = file->f_op->open(inode, file);
up_read(&minor_rwsem);
mutex_unlock(&dvbdev_mutex);
+ if (err)
+ dvb_device_put(dvbdev);
return err;
}
fail:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 207/374] media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (205 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 206/374] media: dvbdev: drop refcount on error path in dvb_device_open() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 208/374] drm/amdgpu/debugfs: fix error code when smc register accessors are NULL Greg Kroah-Hartman
` (167 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Hans Verkuil,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 5b2f885e2f6f482d05c23f04c8240f7b4fc5bdb5 ]
If an error occurs after a successful i2c_mux_add_adapter(), then
i2c_mux_del_adapters() should be called to free some resources, as
already done in the remove function.
Fixes: e6089feca460 ("media: m88ds3103: Add support for ds3103b demod")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/dvb-frontends/m88ds3103.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c
index e03fac025b51..fdf993da3001 100644
--- a/drivers/media/dvb-frontends/m88ds3103.c
+++ b/drivers/media/dvb-frontends/m88ds3103.c
@@ -1898,7 +1898,7 @@ static int m88ds3103_probe(struct i2c_client *client,
/* get frontend address */
ret = regmap_read(dev->regmap, 0x29, &utmp);
if (ret)
- goto err_kfree;
+ goto err_del_adapters;
dev->dt_addr = ((utmp & 0x80) == 0) ? 0x42 >> 1 : 0x40 >> 1;
dev_dbg(&client->dev, "dt addr is 0x%02x\n", dev->dt_addr);
@@ -1906,11 +1906,14 @@ static int m88ds3103_probe(struct i2c_client *client,
dev->dt_addr);
if (IS_ERR(dev->dt_client)) {
ret = PTR_ERR(dev->dt_client);
- goto err_kfree;
+ goto err_del_adapters;
}
}
return 0;
+
+err_del_adapters:
+ i2c_mux_del_adapters(dev->muxc);
err_kfree:
kfree(dev);
err:
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 208/374] drm/amdgpu/debugfs: fix error code when smc register accessors are NULL
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (206 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 207/374] media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 209/374] drm/amd/pm: fix a double-free in si_dpm_init Greg Kroah-Hartman
` (166 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
[ Upstream commit afe58346d5d3887b3e49ff623d2f2e471f232a8d ]
Should be -EOPNOTSUPP.
Fixes: 5104fdf50d32 ("drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL")
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
index 632d8df04ef4..aa057ceecf06 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_debugfs.c
@@ -465,7 +465,7 @@ static ssize_t amdgpu_debugfs_regs_smc_read(struct file *f, char __user *buf,
int r;
if (!adev->smc_rreg)
- return -EPERM;
+ return -EOPNOTSUPP;
if (size & 0x3 || *pos & 0x3)
return -EINVAL;
@@ -527,7 +527,7 @@ static ssize_t amdgpu_debugfs_regs_smc_write(struct file *f, const char __user *
int r;
if (!adev->smc_wreg)
- return -EPERM;
+ return -EOPNOTSUPP;
if (size & 0x3 || *pos & 0x3)
return -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 209/374] drm/amd/pm: fix a double-free in si_dpm_init
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (207 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 208/374] drm/amdgpu/debugfs: fix error code when smc register accessors are NULL Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 210/374] drivers/amd/pm: fix a use-after-free in kv_parse_power_table Greg Kroah-Hartman
` (165 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit ac16667237a82e2597e329eb9bc520d1cf9dff30 ]
When the allocation of
adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries fails,
amdgpu_free_extended_power_table is called to free some fields of adev.
However, when the control flow returns to si_dpm_sw_init, it goes to
label dpm_failed and calls si_dpm_fini, which calls
amdgpu_free_extended_power_table again and free those fields again. Thus
a double-free is triggered.
Fixes: 841686df9f7d ("drm/amdgpu: add SI DPM support (v4)")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
index 66fc63f1f1c1..09e78575db87 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/si_dpm.c
@@ -7346,10 +7346,9 @@ static int si_dpm_init(struct amdgpu_device *adev)
kcalloc(4,
sizeof(struct amdgpu_clock_voltage_dependency_entry),
GFP_KERNEL);
- if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries) {
- amdgpu_free_extended_power_table(adev);
+ if (!adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries)
return -ENOMEM;
- }
+
adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.count = 4;
adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].clk = 0;
adev->pm.dpm.dyn_state.vddc_dependency_on_dispclk.entries[0].v = 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 210/374] drivers/amd/pm: fix a use-after-free in kv_parse_power_table
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (208 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 209/374] drm/amd/pm: fix a double-free in si_dpm_init Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 211/374] gpu/drm/radeon: fix two memleaks in radeon_vm_init Greg Kroah-Hartman
` (164 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 28dd788382c43b330480f57cd34cde0840896743 ]
When ps allocated by kzalloc equals to NULL, kv_parse_power_table
frees adev->pm.dpm.ps that allocated before. However, after the control
flow goes through the following call chains:
kv_parse_power_table
|-> kv_dpm_init
|-> kv_dpm_sw_init
|-> kv_dpm_fini
The adev->pm.dpm.ps is used in the for loop of kv_dpm_fini after its
first free in kv_parse_power_table and causes a use-after-free bug.
Fixes: a2e73f56fa62 ("drm/amdgpu: Add support for CIK parts")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c
index 6ba4c2ae69a6..309c9f0b8f83 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c
@@ -2731,10 +2731,8 @@ static int kv_parse_power_table(struct amdgpu_device *adev)
non_clock_info = (struct _ATOM_PPLIB_NONCLOCK_INFO *)
&non_clock_info_array->nonClockInfo[non_clock_array_index];
ps = kzalloc(sizeof(struct kv_ps), GFP_KERNEL);
- if (ps == NULL) {
- kfree(adev->pm.dpm.ps);
+ if (ps == NULL)
return -ENOMEM;
- }
adev->pm.dpm.ps[i].ps_priv = ps;
k = 0;
idx = (u8 *)&power_state->v2.clockInfoIndex[0];
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 211/374] gpu/drm/radeon: fix two memleaks in radeon_vm_init
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (209 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 210/374] drivers/amd/pm: fix a use-after-free in kv_parse_power_table Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 212/374] dt-bindings: clock: Update the videocc resets for sm8150 Greg Kroah-Hartman
` (163 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit c2709b2d6a537ca0fa0f1da36fdaf07e48ef447d ]
When radeon_bo_create and radeon_vm_clear_bo fail, the vm->page_tables
allocated before need to be freed. However, neither radeon_vm_init
itself nor its caller have done such deallocation.
Fixes: 6d2f2944e95e ("drm/radeon: use normal BOs for the page tables v4")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_vm.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_vm.c b/drivers/gpu/drm/radeon/radeon_vm.c
index bb53016f3138..f2fc8ef99139 100644
--- a/drivers/gpu/drm/radeon/radeon_vm.c
+++ b/drivers/gpu/drm/radeon/radeon_vm.c
@@ -1204,13 +1204,17 @@ int radeon_vm_init(struct radeon_device *rdev, struct radeon_vm *vm)
r = radeon_bo_create(rdev, pd_size, align, true,
RADEON_GEM_DOMAIN_VRAM, 0, NULL,
NULL, &vm->page_directory);
- if (r)
+ if (r) {
+ kfree(vm->page_tables);
+ vm->page_tables = NULL;
return r;
-
+ }
r = radeon_vm_clear_bo(rdev, vm->page_directory);
if (r) {
radeon_bo_unref(&vm->page_directory);
vm->page_directory = NULL;
+ kfree(vm->page_tables);
+ vm->page_tables = NULL;
return r;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 212/374] dt-bindings: clock: Update the videocc resets for sm8150
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (210 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 211/374] gpu/drm/radeon: fix two memleaks in radeon_vm_init Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 213/374] clk: qcom: videocc-sm8150: Update the videocc resets Greg Kroah-Hartman
` (162 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Satya Priya Kakitapalli,
Krzysztof Kozlowski, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
[ Upstream commit 3185f96968eedd117ec72ee7b87ead44b6d1bbbd ]
Add all the available resets for the video clock controller
on sm8150.
Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
Acked-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-1-56bec3a5e443@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Stable-dep-of: 1fd9a939db24 ("clk: qcom: videocc-sm8150: Update the videocc resets")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/dt-bindings/clock/qcom,videocc-sm8150.h | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/include/dt-bindings/clock/qcom,videocc-sm8150.h b/include/dt-bindings/clock/qcom,videocc-sm8150.h
index e24ee840cfdb..c557b78dc572 100644
--- a/include/dt-bindings/clock/qcom,videocc-sm8150.h
+++ b/include/dt-bindings/clock/qcom,videocc-sm8150.h
@@ -16,6 +16,10 @@
/* VIDEO_CC Resets */
#define VIDEO_CC_MVSC_CORE_CLK_BCR 0
+#define VIDEO_CC_INTERFACE_BCR 1
+#define VIDEO_CC_MVS0_BCR 2
+#define VIDEO_CC_MVS1_BCR 3
+#define VIDEO_CC_MVSC_BCR 4
/* VIDEO_CC GDSCRs */
#define VENUS_GDSC 0
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 213/374] clk: qcom: videocc-sm8150: Update the videocc resets
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (211 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 212/374] dt-bindings: clock: Update the videocc resets for sm8150 Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 214/374] clk: qcom: videocc-sm8150: Add missing PLL config property Greg Kroah-Hartman
` (161 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Satya Priya Kakitapalli,
Bryan ODonoghue, Konrad Dybcio, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
[ Upstream commit 1fd9a939db24d2f66e48f8bca3e3654add3fa205 ]
Add all the available resets for the video clock controller
on sm8150.
Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150")
Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-2-56bec3a5e443@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/videocc-sm8150.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c
index 1afdbe4a249d..6a5f89f53da8 100644
--- a/drivers/clk/qcom/videocc-sm8150.c
+++ b/drivers/clk/qcom/videocc-sm8150.c
@@ -214,6 +214,10 @@ static const struct regmap_config video_cc_sm8150_regmap_config = {
static const struct qcom_reset_map video_cc_sm8150_resets[] = {
[VIDEO_CC_MVSC_CORE_CLK_BCR] = { 0x850, 2 },
+ [VIDEO_CC_INTERFACE_BCR] = { 0x8f0 },
+ [VIDEO_CC_MVS0_BCR] = { 0x870 },
+ [VIDEO_CC_MVS1_BCR] = { 0x8b0 },
+ [VIDEO_CC_MVSC_BCR] = { 0x810 },
};
static const struct qcom_cc_desc video_cc_sm8150_desc = {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 214/374] clk: qcom: videocc-sm8150: Add missing PLL config property
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (212 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 213/374] clk: qcom: videocc-sm8150: Update the videocc resets Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 215/374] drivers: clk: zynqmp: calculate closest mux rate Greg Kroah-Hartman
` (160 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Satya Priya Kakitapalli,
Konrad Dybcio, Bjorn Andersson, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
[ Upstream commit 71f130c9193f613d497f7245365ed05ffdb0a401 ]
When the driver was ported upstream, PLL test_ctl_hi1 register value
was omitted. Add it to ensure the PLLs are fully configured.
Fixes: 5658e8cf1a8a ("clk: qcom: add video clock controller driver for SM8150")
Signed-off-by: Satya Priya Kakitapalli <quic_skakitap@quicinc.com>
Reviewed-by: Konrad Dybcio <konrad.dybcio@linaro.org>
Link: https://lore.kernel.org/r/20231201-videocc-8150-v3-3-56bec3a5e443@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/qcom/videocc-sm8150.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/clk/qcom/videocc-sm8150.c b/drivers/clk/qcom/videocc-sm8150.c
index 6a5f89f53da8..52a9a453a143 100644
--- a/drivers/clk/qcom/videocc-sm8150.c
+++ b/drivers/clk/qcom/videocc-sm8150.c
@@ -33,6 +33,7 @@ static struct alpha_pll_config video_pll0_config = {
.config_ctl_val = 0x20485699,
.config_ctl_hi_val = 0x00002267,
.config_ctl_hi1_val = 0x00000024,
+ .test_ctl_hi1_val = 0x00000020,
.user_ctl_val = 0x00000000,
.user_ctl_hi_val = 0x00000805,
.user_ctl_hi1_val = 0x000000D0,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 215/374] drivers: clk: zynqmp: calculate closest mux rate
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (213 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 214/374] clk: qcom: videocc-sm8150: Add missing PLL config property Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 216/374] clk: zynqmp: make bestdiv unsigned Greg Kroah-Hartman
` (159 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Buddhabhatti, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
[ Upstream commit b782921ddd7f84f524723090377903f399fdbbcb ]
Currently zynqmp clock driver is not calculating closest mux rate and
because of that Linux is not setting proper frequency for CPU and
not able to set given frequency for dynamic frequency scaling.
E.g., In current logic initial acpu clock parent and frequency as below
apll1 0 0 0 2199999978 0 0 50000 Y
acpu0_mux 0 0 0 2199999978 0 0 50000 Y
acpu0_idiv1 0 0 0 2199999978 0 0 50000 Y
acpu0 0 0 0 2199999978 0 0 50000 Y
After changing acpu frequency to 549999994 Hz using CPU freq scaling its
selecting incorrect parent which is not closest frequency.
rpll_to_xpd 0 0 0 1599999984 0 0 50000 Y
acpu0_mux 0 0 0 1599999984 0 0 50000 Y
acpu0_div1 0 0 0 533333328 0 0 50000 Y
acpu0 0 0 0 533333328 0 0 50000 Y
Parent should remain same since 549999994 = 2199999978 / 4.
So use __clk_mux_determine_rate_closest() generic function to calculate
closest rate for mux clock. After this change its selecting correct
parent and correct clock rate.
apll1 0 0 0 2199999978 0 0 50000 Y
acpu0_mux 0 0 0 2199999978 0 0 50000 Y
acpu0_div1 0 0 0 549999995 0 0 50000 Y
acpu0 0 0 0 549999995 0 0 50000 Y
Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
Link: https://lore.kernel.org/r/20231129112916.23125-2-jay.buddhabhatti@amd.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/zynqmp/clk-mux-zynqmp.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/zynqmp/clk-mux-zynqmp.c b/drivers/clk/zynqmp/clk-mux-zynqmp.c
index 17afce594f28..5a040f939056 100644
--- a/drivers/clk/zynqmp/clk-mux-zynqmp.c
+++ b/drivers/clk/zynqmp/clk-mux-zynqmp.c
@@ -89,7 +89,7 @@ static int zynqmp_clk_mux_set_parent(struct clk_hw *hw, u8 index)
static const struct clk_ops zynqmp_clk_mux_ops = {
.get_parent = zynqmp_clk_mux_get_parent,
.set_parent = zynqmp_clk_mux_set_parent,
- .determine_rate = __clk_mux_determine_rate,
+ .determine_rate = __clk_mux_determine_rate_closest,
};
static const struct clk_ops zynqmp_clk_mux_ro_ops = {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 216/374] clk: zynqmp: make bestdiv unsigned
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (214 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 215/374] drivers: clk: zynqmp: calculate closest mux rate Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 217/374] clk: zynqmp: Add a check for NULL pointer Greg Kroah-Hartman
` (158 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shubhrajyoti Datta, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
[ Upstream commit d3954b51b475c4848179cd90b24ac73684cdc76b ]
Divisor is always positive make it u32 *.
Also the arguments passed are currently of u32 pointers.
Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
Link: https://lore.kernel.org/r/20220818113153.14431-1-shubhrajyoti.datta@amd.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 1fe15be1fb61 ("drivers: clk: zynqmp: update divider round rate logic")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/zynqmp/divider.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c
index cb49281f9cf9..9e535d3e1c0c 100644
--- a/drivers/clk/zynqmp/divider.c
+++ b/drivers/clk/zynqmp/divider.c
@@ -113,7 +113,7 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw,
static void zynqmp_get_divider2_val(struct clk_hw *hw,
unsigned long rate,
struct zynqmp_clk_divider *divider,
- int *bestdiv)
+ u32 *bestdiv)
{
int div1;
int div2;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 217/374] clk: zynqmp: Add a check for NULL pointer
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (215 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 216/374] clk: zynqmp: make bestdiv unsigned Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 218/374] drivers: clk: zynqmp: update divider round rate logic Greg Kroah-Hartman
` (157 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shubhrajyoti Datta, Michal Simek,
Stephen Boyd, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
[ Upstream commit 6ab9810cfe6c8f3d8b8750c827d7870abd3751b9 ]
Add a NULL pointer check as clk_hw_get_parent can return NULL.
Signed-off-by: Shubhrajyoti Datta <shubhrajyoti.datta@xilinx.com>
Link: https://lore.kernel.org/r/20220518055314.2486-1-shubhrajyoti.datta@xilinx.com
Acked-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: 1fe15be1fb61 ("drivers: clk: zynqmp: update divider round rate logic")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/zynqmp/divider.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c
index 9e535d3e1c0c..47a199346ddf 100644
--- a/drivers/clk/zynqmp/divider.c
+++ b/drivers/clk/zynqmp/divider.c
@@ -120,10 +120,13 @@ static void zynqmp_get_divider2_val(struct clk_hw *hw,
long error = LONG_MAX;
unsigned long div1_prate;
struct clk_hw *div1_parent_hw;
+ struct zynqmp_clk_divider *pdivider;
struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw);
- struct zynqmp_clk_divider *pdivider =
- to_zynqmp_clk_divider(div2_parent_hw);
+ if (!div2_parent_hw)
+ return;
+
+ pdivider = to_zynqmp_clk_divider(div2_parent_hw);
if (!pdivider)
return;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 218/374] drivers: clk: zynqmp: update divider round rate logic
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (216 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 217/374] clk: zynqmp: Add a check for NULL pointer Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 219/374] watchdog: set cdev owner before adding Greg Kroah-Hartman
` (156 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jay Buddhabhatti, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
[ Upstream commit 1fe15be1fb613534ecbac5f8c3f8744f757d237d ]
Currently zynqmp divider round rate is considering single parent and
calculating rate and parent rate accordingly. But if divider clock flag
is set to SET_RATE_PARENT then its not trying to traverse through all
parent rate and not selecting best parent rate from that. So use common
divider_round_rate() which is traversing through all clock parents and
its rate and calculating proper parent rate.
Fixes: 3fde0e16d016 ("drivers: clk: Add ZynqMP clock driver")
Signed-off-by: Jay Buddhabhatti <jay.buddhabhatti@amd.com>
Link: https://lore.kernel.org/r/20231129112916.23125-3-jay.buddhabhatti@amd.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/zynqmp/divider.c | 66 +++---------------------------------
1 file changed, 5 insertions(+), 61 deletions(-)
diff --git a/drivers/clk/zynqmp/divider.c b/drivers/clk/zynqmp/divider.c
index 47a199346ddf..e25c76ff2739 100644
--- a/drivers/clk/zynqmp/divider.c
+++ b/drivers/clk/zynqmp/divider.c
@@ -110,52 +110,6 @@ static unsigned long zynqmp_clk_divider_recalc_rate(struct clk_hw *hw,
return DIV_ROUND_UP_ULL(parent_rate, value);
}
-static void zynqmp_get_divider2_val(struct clk_hw *hw,
- unsigned long rate,
- struct zynqmp_clk_divider *divider,
- u32 *bestdiv)
-{
- int div1;
- int div2;
- long error = LONG_MAX;
- unsigned long div1_prate;
- struct clk_hw *div1_parent_hw;
- struct zynqmp_clk_divider *pdivider;
- struct clk_hw *div2_parent_hw = clk_hw_get_parent(hw);
-
- if (!div2_parent_hw)
- return;
-
- pdivider = to_zynqmp_clk_divider(div2_parent_hw);
- if (!pdivider)
- return;
-
- div1_parent_hw = clk_hw_get_parent(div2_parent_hw);
- if (!div1_parent_hw)
- return;
-
- div1_prate = clk_hw_get_rate(div1_parent_hw);
- *bestdiv = 1;
- for (div1 = 1; div1 <= pdivider->max_div;) {
- for (div2 = 1; div2 <= divider->max_div;) {
- long new_error = ((div1_prate / div1) / div2) - rate;
-
- if (abs(new_error) < abs(error)) {
- *bestdiv = div2;
- error = new_error;
- }
- if (divider->flags & CLK_DIVIDER_POWER_OF_TWO)
- div2 = div2 << 1;
- else
- div2++;
- }
- if (pdivider->flags & CLK_DIVIDER_POWER_OF_TWO)
- div1 = div1 << 1;
- else
- div1++;
- }
-}
-
/**
* zynqmp_clk_divider_round_rate() - Round rate of divider clock
* @hw: handle between common and hardware-specific interfaces
@@ -174,6 +128,7 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw,
u32 div_type = divider->div_type;
u32 bestdiv;
int ret;
+ u8 width;
/* if read only, just return current value */
if (divider->flags & CLK_DIVIDER_READ_ONLY) {
@@ -193,23 +148,12 @@ static long zynqmp_clk_divider_round_rate(struct clk_hw *hw,
return DIV_ROUND_UP_ULL((u64)*prate, bestdiv);
}
- bestdiv = zynqmp_divider_get_val(*prate, rate, divider->flags);
-
- /*
- * In case of two divisors, compute best divider values and return
- * divider2 value based on compute value. div1 will be automatically
- * set to optimum based on required total divider value.
- */
- if (div_type == TYPE_DIV2 &&
- (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT)) {
- zynqmp_get_divider2_val(hw, rate, divider, &bestdiv);
- }
+ width = fls(divider->max_div);
- if ((clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && divider->is_frac)
- bestdiv = rate % *prate ? 1 : bestdiv;
+ rate = divider_round_rate(hw, rate, prate, NULL, width, divider->flags);
- bestdiv = min_t(u32, bestdiv, divider->max_div);
- *prate = rate * bestdiv;
+ if (divider->is_frac && (clk_hw_get_flags(hw) & CLK_SET_RATE_PARENT) && (rate % *prate))
+ *prate = rate;
return rate;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 219/374] watchdog: set cdev owner before adding
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (217 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 218/374] drivers: clk: zynqmp: update divider round rate logic Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 220/374] watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO Greg Kroah-Hartman
` (155 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Curtis Klein, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Curtis Klein <curtis.klein@hpe.com>
[ Upstream commit 38d75297745f04206db9c29bdd75557f0344c7cc ]
When the new watchdog character device is registered, it becomes
available for opening. This creates a race where userspace may open the
device before the character device's owner is set. This results in an
imbalance in module_get calls as the cdev_get in cdev_open will not
increment the reference count on the watchdog driver module.
This causes problems when the watchdog character device is released as
the module loader's reference will also be released. This makes it
impossible to open the watchdog device later on as it now appears that
the module is being unloaded. The open will fail with -ENXIO from
chrdev_open.
The legacy watchdog device will fail with -EBUSY from the try_module_get
in watchdog_open because it's module owner is the watchdog core module
so it can still be opened but it will fail to get a refcount on the
underlying watchdog device driver.
Fixes: 72139dfa2464 ("watchdog: Fix the race between the release of watchdog_core_data and cdev")
Signed-off-by: Curtis Klein <curtis.klein@hpe.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20231205190522.55153-1-curtis.klein@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/watchdog_dev.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c
index 5eec84fa6517..d3b5aa87c141 100644
--- a/drivers/watchdog/watchdog_dev.c
+++ b/drivers/watchdog/watchdog_dev.c
@@ -1035,6 +1035,7 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
/* Fill in the data structures */
cdev_init(&wd_data->cdev, &watchdog_fops);
+ wd_data->cdev.owner = wdd->ops->owner;
/* Add the device */
err = cdev_device_add(&wd_data->cdev, &wd_data->dev);
@@ -1049,8 +1050,6 @@ static int watchdog_cdev_register(struct watchdog_device *wdd)
return err;
}
- wd_data->cdev.owner = wdd->ops->owner;
-
/* Record time of most recent heartbeat as 'just before now'. */
wd_data->last_hw_keepalive = ktime_sub(ktime_get(), 1);
watchdog_set_open_deadline(wd_data);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 220/374] watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (218 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 219/374] watchdog: set cdev owner before adding Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 221/374] watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling Greg Kroah-Hartman
` (154 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jerry Hoemann, Guenter Roeck,
Wim Van Sebroeck, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jerry Hoemann <jerry.hoemann@hpe.com>
[ Upstream commit dced0b3e51dd2af3730efe14dd86b5e3173f0a65 ]
Avoid unnecessary crashes by claiming only NMIs that are due to
ERROR signalling or generated by the hpwdt hardware device.
The code does this, but only for iLO5.
The intent was to preserve legacy, Gen9 and earlier, semantics of
using hpwdt for error containtment as hardware/firmware would signal
fatal IO errors as an NMI with the expectation of hpwdt crashing
the system. Howerver, these IO errors should be received by hpwdt
as an NMI_IO_CHECK. So the test is overly permissive and should
not be limited to only ilo5.
We need to enable this protection for future iLOs not matching the
current PCI IDs.
Fixes: 62290a5c194b ("watchdog: hpwdt: Claim NMIs generated by iLO5")
Signed-off-by: Jerry Hoemann <jerry.hoemann@hpe.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20231213215340.495734-2-jerry.hoemann@hpe.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/hpwdt.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c
index a5006a58e0db..39fc209f799e 100644
--- a/drivers/watchdog/hpwdt.c
+++ b/drivers/watchdog/hpwdt.c
@@ -176,7 +176,7 @@ static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs)
"3. OA Forward Progress Log\n"
"4. iLO Event Log";
- if (ilo5 && ulReason == NMI_UNKNOWN && !mynmi)
+ if (ulReason == NMI_UNKNOWN && !mynmi)
return NMI_DONE;
if (ilo5 && !pretimeout && !mynmi)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 221/374] watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (219 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 220/374] watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 222/374] watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused Greg Kroah-Hartman
` (153 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Wahren, Florian Fainelli,
Guenter Roeck, Wim Van Sebroeck, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Wahren <wahrenst@gmx.net>
[ Upstream commit f33f5b1fd1be5f5106d16f831309648cb0f1c31d ]
Users report about the unexpected behavior for setting timeouts above
15 sec on Raspberry Pi. According to watchdog-api.rst the ioctl
WDIOC_SETTIMEOUT shouldn't fail because of hardware limitations.
But looking at the code shows that max_timeout based on the
register value PM_WDOG_TIME_SET, which is the maximum.
Since 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat
in watchdog core") the watchdog core is able to handle this problem.
This fix has been tested with watchdog-test from selftests.
Link: https://bugzilla.kernel.org/show_bug.cgi?id=217374
Fixes: 664a39236e71 ("watchdog: Introduce hardware maximum heartbeat in watchdog core")
Signed-off-by: Stefan Wahren <wahrenst@gmx.net>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20231112173251.4827-1-wahrenst@gmx.net
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/bcm2835_wdt.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/bcm2835_wdt.c b/drivers/watchdog/bcm2835_wdt.c
index 94907176a0e4..55c0f7b0e8fb 100644
--- a/drivers/watchdog/bcm2835_wdt.c
+++ b/drivers/watchdog/bcm2835_wdt.c
@@ -42,6 +42,7 @@
#define SECS_TO_WDOG_TICKS(x) ((x) << 16)
#define WDOG_TICKS_TO_SECS(x) ((x) >> 16)
+#define WDOG_TICKS_TO_MSECS(x) ((x) * 1000 >> 16)
struct bcm2835_wdt {
void __iomem *base;
@@ -140,7 +141,7 @@ static struct watchdog_device bcm2835_wdt_wdd = {
.info = &bcm2835_wdt_info,
.ops = &bcm2835_wdt_ops,
.min_timeout = 1,
- .max_timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
+ .max_hw_heartbeat_ms = WDOG_TICKS_TO_MSECS(PM_WDOG_TIME_SET),
.timeout = WDOG_TICKS_TO_SECS(PM_WDOG_TIME_SET),
};
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 222/374] watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (220 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 221/374] watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 223/374] clk: si5341: fix an error code problem in si5341_output_clk_set_rate Greg Kroah-Hartman
` (152 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vignesh Raghavendra,
Manorit Chawdhry, Guenter Roeck, Wim Van Sebroeck, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vignesh Raghavendra <vigneshr@ti.com>
[ Upstream commit c1a6edf3b541e44e78f10bc6024df779715723f1 ]
Call runtime_pm_put*() if watchdog is not already started during probe and re
enable it in watchdog start as required.
On K3 SoCs, watchdogs and their corresponding CPUs are under same
power-domain, so if the reference count of unused watchdogs aren't
dropped, it will lead to CPU hotplug failures as Device Management
firmware won't allow to turn off the power-domain due to dangling
reference count.
Fixes: 2d63908bdbfb ("watchdog: Add K3 RTI watchdog support")
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Tested-by: Manorit Chawdhry <m-chawdhry@ti.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Link: https://lore.kernel.org/r/20231213140110.938129-1-vigneshr@ti.com
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Wim Van Sebroeck <wim@linux-watchdog.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/watchdog/rti_wdt.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/watchdog/rti_wdt.c b/drivers/watchdog/rti_wdt.c
index 46c2a4bd9ebe..daa00f3c5a6a 100644
--- a/drivers/watchdog/rti_wdt.c
+++ b/drivers/watchdog/rti_wdt.c
@@ -70,6 +70,11 @@ static int rti_wdt_start(struct watchdog_device *wdd)
{
u32 timer_margin;
struct rti_wdt_device *wdt = watchdog_get_drvdata(wdd);
+ int ret;
+
+ ret = pm_runtime_resume_and_get(wdd->parent);
+ if (ret)
+ return ret;
/* set timeout period */
timer_margin = (u64)wdd->timeout * wdt->freq;
@@ -296,6 +301,9 @@ static int rti_wdt_probe(struct platform_device *pdev)
if (last_ping)
watchdog_set_last_hw_keepalive(wdd, last_ping);
+ if (!watchdog_hw_running(wdd))
+ pm_runtime_put_sync(&pdev->dev);
+
return 0;
err_iomap:
@@ -310,7 +318,10 @@ static int rti_wdt_remove(struct platform_device *pdev)
struct rti_wdt_device *wdt = platform_get_drvdata(pdev);
watchdog_unregister_device(&wdt->wdd);
- pm_runtime_put(&pdev->dev);
+
+ if (!pm_runtime_suspended(&pdev->dev))
+ pm_runtime_put(&pdev->dev);
+
pm_runtime_disable(&pdev->dev);
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 223/374] clk: si5341: fix an error code problem in si5341_output_clk_set_rate
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (221 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 222/374] watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused Greg Kroah-Hartman
@ 2024-01-22 23:57 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 224/374] clk: asm9260: use parent index to link the reference clock Greg Kroah-Hartman
` (151 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:57 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mike Looijmans, Su Hui, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit 5607068ae5ab02c3ac9cabc6859d36e98004c341 ]
regmap_bulk_write() return zero or negative error code, return the value
of regmap_bulk_write() rather than '0'.
Fixes: 3044a860fd09 ("clk: Add Si5341/Si5340 driver")
Acked-by: Mike Looijmans <mike.looijmans@topic.nl>
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20231101031633.996124-1-suhui@nfschina.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-si5341.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/drivers/clk/clk-si5341.c b/drivers/clk/clk-si5341.c
index 91a6bc74ebd5..cda5a0f4d9df 100644
--- a/drivers/clk/clk-si5341.c
+++ b/drivers/clk/clk-si5341.c
@@ -892,10 +892,8 @@ static int si5341_output_clk_set_rate(struct clk_hw *hw, unsigned long rate,
r[0] = r_div ? (r_div & 0xff) : 1;
r[1] = (r_div >> 8) & 0xff;
r[2] = (r_div >> 16) & 0xff;
- err = regmap_bulk_write(output->data->regmap,
+ return regmap_bulk_write(output->data->regmap,
SI5341_OUT_R_REG(output), r, 3);
-
- return 0;
}
static int si5341_output_reparent(struct clk_si5341_output *output, u8 index)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 224/374] clk: asm9260: use parent index to link the reference clock
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (222 preceding siblings ...)
2024-01-22 23:57 ` [PATCH 5.15 223/374] clk: si5341: fix an error code problem in si5341_output_clk_set_rate Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 225/374] clk: fixed-rate: add devm_clk_hw_register_fixed_rate Greg Kroah-Hartman
` (150 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit f5290d8e4f0caa81a491448a27dd70e726095d07 ]
Rewrite clk-asm9260 to use parent index to use the reference clock.
During this rework two helpers are added:
- clk_hw_register_mux_table_parent_data() to supplement
clk_hw_register_mux_table() but using parent_data instead of
parent_names
- clk_hw_register_fixed_rate_parent_accuracy() to be used instead of
directly calling __clk_hw_register_fixed_rate(). The later function is
an internal API, which is better not to be called directly.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20220916061740.87167-2-dmitry.baryshkov@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: ee0cf5e07f44 ("clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-asm9260.c | 29 ++++++++++++-----------------
include/linux/clk-provider.h | 21 +++++++++++++++++++++
2 files changed, 33 insertions(+), 17 deletions(-)
diff --git a/drivers/clk/clk-asm9260.c b/drivers/clk/clk-asm9260.c
index bacebd457e6f..8b3c059e19a1 100644
--- a/drivers/clk/clk-asm9260.c
+++ b/drivers/clk/clk-asm9260.c
@@ -80,7 +80,7 @@ struct asm9260_mux_clock {
u8 mask;
u32 *table;
const char *name;
- const char **parent_names;
+ const struct clk_parent_data *parent_data;
u8 num_parents;
unsigned long offset;
unsigned long flags;
@@ -232,10 +232,10 @@ static const struct asm9260_gate_data asm9260_ahb_gates[] __initconst = {
HW_AHBCLKCTRL1, 16 },
};
-static const char __initdata *main_mux_p[] = { NULL, NULL };
-static const char __initdata *i2s0_mux_p[] = { NULL, NULL, "i2s0m_div"};
-static const char __initdata *i2s1_mux_p[] = { NULL, NULL, "i2s1m_div"};
-static const char __initdata *clkout_mux_p[] = { NULL, NULL, "rtc"};
+static struct clk_parent_data __initdata main_mux_p[] = { { .index = 0, }, { .name = "pll" } };
+static struct clk_parent_data __initdata i2s0_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "i2s0m_div"} };
+static struct clk_parent_data __initdata i2s1_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "i2s1m_div"} };
+static struct clk_parent_data __initdata clkout_mux_p[] = { { .index = 0, }, { .name = "pll" }, { .name = "rtc"} };
static u32 three_mux_table[] = {0, 1, 3};
static struct asm9260_mux_clock asm9260_mux_clks[] __initdata = {
@@ -255,9 +255,10 @@ static struct asm9260_mux_clock asm9260_mux_clks[] __initdata = {
static void __init asm9260_acc_init(struct device_node *np)
{
- struct clk_hw *hw;
+ struct clk_hw *hw, *pll_hw;
struct clk_hw **hws;
- const char *ref_clk, *pll_clk = "pll";
+ const char *pll_clk = "pll";
+ struct clk_parent_data pll_parent_data = { .index = 0 };
u32 rate;
int n;
@@ -274,21 +275,15 @@ static void __init asm9260_acc_init(struct device_node *np)
/* register pll */
rate = (ioread32(base + HW_SYSPLLCTRL) & 0xffff) * 1000000;
- /* TODO: Convert to DT parent scheme */
- ref_clk = of_clk_get_parent_name(np, 0);
- hw = __clk_hw_register_fixed_rate(NULL, NULL, pll_clk,
- ref_clk, NULL, NULL, 0, rate, 0,
- CLK_FIXED_RATE_PARENT_ACCURACY);
-
- if (IS_ERR(hw))
+ pll_hw = clk_hw_register_fixed_rate_parent_accuracy(NULL, pll_clk, &pll_parent_data,
+ 0, rate);
+ if (IS_ERR(pll_hw))
panic("%pOFn: can't register REFCLK. Check DT!", np);
for (n = 0; n < ARRAY_SIZE(asm9260_mux_clks); n++) {
const struct asm9260_mux_clock *mc = &asm9260_mux_clks[n];
- mc->parent_names[0] = ref_clk;
- mc->parent_names[1] = pll_clk;
- hw = clk_hw_register_mux_table(NULL, mc->name, mc->parent_names,
+ hw = clk_hw_register_mux_table_parent_data(NULL, mc->name, mc->parent_data,
mc->num_parents, mc->flags, base + mc->offset,
0, mc->mask, 0, mc->table, &asm9260_clk_lock);
}
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index f59c875271a0..e2a802d9cf51 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -439,6 +439,20 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \
(parent_data), NULL, (flags), \
(fixed_rate), (fixed_accuracy), 0)
+/**
+ * clk_hw_register_fixed_rate_parent_accuracy - register fixed-rate clock with
+ * the clock framework
+ * @dev: device that is registering this clock
+ * @name: name of this clock
+ * @parent_name: name of clock's parent
+ * @flags: framework-specific flags
+ * @fixed_rate: non-adjustable clock rate
+ */
+#define clk_hw_register_fixed_rate_parent_accuracy(dev, name, parent_data, \
+ flags, fixed_rate) \
+ __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \
+ (parent_data), (flags), (fixed_rate), 0, \
+ CLK_FIXED_RATE_PARENT_ACCURACY)
void clk_unregister_fixed_rate(struct clk *clk);
void clk_hw_unregister_fixed_rate(struct clk_hw *hw);
@@ -915,6 +929,13 @@ struct clk *clk_register_mux_table(struct device *dev, const char *name,
(parent_names), NULL, NULL, (flags), (reg), \
(shift), (mask), (clk_mux_flags), (table), \
(lock))
+#define clk_hw_register_mux_table_parent_data(dev, name, parent_data, \
+ num_parents, flags, reg, shift, mask, \
+ clk_mux_flags, table, lock) \
+ __clk_hw_register_mux((dev), NULL, (name), (num_parents), \
+ NULL, NULL, (parent_data), (flags), (reg), \
+ (shift), (mask), (clk_mux_flags), (table), \
+ (lock))
#define clk_hw_register_mux(dev, name, parent_names, num_parents, flags, reg, \
shift, width, clk_mux_flags, lock) \
__clk_hw_register_mux((dev), NULL, (name), (num_parents), \
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 225/374] clk: fixed-rate: add devm_clk_hw_register_fixed_rate
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (223 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 224/374] clk: asm9260: use parent index to link the reference clock Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 226/374] clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw Greg Kroah-Hartman
` (149 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
[ Upstream commit 1d7d20658534c7d36fe6f4252f6f1a27d9631a99 ]
Add devm_clk_hw_register_fixed_rate(), devres-managed helper to register
fixed-rate clock.
Signed-off-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20220916061740.87167-3-dmitry.baryshkov@linaro.org
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Stable-dep-of: ee0cf5e07f44 ("clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/clk/clk-fixed-rate.c | 28 ++++++++++++++++++++++++----
include/linux/clk-provider.h | 29 +++++++++++++++++++++--------
2 files changed, 45 insertions(+), 12 deletions(-)
diff --git a/drivers/clk/clk-fixed-rate.c b/drivers/clk/clk-fixed-rate.c
index 45501637705c..62e994d18fe2 100644
--- a/drivers/clk/clk-fixed-rate.c
+++ b/drivers/clk/clk-fixed-rate.c
@@ -49,12 +49,24 @@ const struct clk_ops clk_fixed_rate_ops = {
};
EXPORT_SYMBOL_GPL(clk_fixed_rate_ops);
+static void devm_clk_hw_register_fixed_rate_release(struct device *dev, void *res)
+{
+ struct clk_fixed_rate *fix = res;
+
+ /*
+ * We can not use clk_hw_unregister_fixed_rate, since it will kfree()
+ * the hw, resulting in double free. Just unregister the hw and let
+ * devres code kfree() it.
+ */
+ clk_hw_unregister(&fix->hw);
+}
+
struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev,
struct device_node *np, const char *name,
const char *parent_name, const struct clk_hw *parent_hw,
const struct clk_parent_data *parent_data, unsigned long flags,
unsigned long fixed_rate, unsigned long fixed_accuracy,
- unsigned long clk_fixed_flags)
+ unsigned long clk_fixed_flags, bool devm)
{
struct clk_fixed_rate *fixed;
struct clk_hw *hw;
@@ -62,7 +74,11 @@ struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev,
int ret = -EINVAL;
/* allocate fixed-rate clock */
- fixed = kzalloc(sizeof(*fixed), GFP_KERNEL);
+ if (devm)
+ fixed = devres_alloc(devm_clk_hw_register_fixed_rate_release,
+ sizeof(*fixed), GFP_KERNEL);
+ else
+ fixed = kzalloc(sizeof(*fixed), GFP_KERNEL);
if (!fixed)
return ERR_PTR(-ENOMEM);
@@ -90,9 +106,13 @@ struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev,
else if (np)
ret = of_clk_hw_register(np, hw);
if (ret) {
- kfree(fixed);
+ if (devm)
+ devres_free(fixed);
+ else
+ kfree(fixed);
hw = ERR_PTR(ret);
- }
+ } else if (devm)
+ devres_add(dev, fixed);
return hw;
}
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index e2a802d9cf51..43e177b3a4d3 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -350,7 +350,7 @@ struct clk_hw *__clk_hw_register_fixed_rate(struct device *dev,
const char *parent_name, const struct clk_hw *parent_hw,
const struct clk_parent_data *parent_data, unsigned long flags,
unsigned long fixed_rate, unsigned long fixed_accuracy,
- unsigned long clk_fixed_flags);
+ unsigned long clk_fixed_flags, bool devm);
struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
const char *parent_name, unsigned long flags,
unsigned long fixed_rate);
@@ -365,7 +365,20 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
*/
#define clk_hw_register_fixed_rate(dev, name, parent_name, flags, fixed_rate) \
__clk_hw_register_fixed_rate((dev), NULL, (name), (parent_name), NULL, \
- NULL, (flags), (fixed_rate), 0, 0)
+ NULL, (flags), (fixed_rate), 0, 0, false)
+
+/**
+ * devm_clk_hw_register_fixed_rate - register fixed-rate clock with the clock
+ * framework
+ * @dev: device that is registering this clock
+ * @name: name of this clock
+ * @parent_name: name of clock's parent
+ * @flags: framework-specific flags
+ * @fixed_rate: non-adjustable clock rate
+ */
+#define devm_clk_hw_register_fixed_rate(dev, name, parent_name, flags, fixed_rate) \
+ __clk_hw_register_fixed_rate((dev), NULL, (name), (parent_name), NULL, \
+ NULL, (flags), (fixed_rate), 0, 0, true)
/**
* clk_hw_register_fixed_rate_parent_hw - register fixed-rate clock with
* the clock framework
@@ -378,7 +391,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
#define clk_hw_register_fixed_rate_parent_hw(dev, name, parent_hw, flags, \
fixed_rate) \
__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw), \
- NULL, (flags), (fixed_rate), 0, 0)
+ NULL, (flags), (fixed_rate), 0, 0, false)
/**
* clk_hw_register_fixed_rate_parent_data - register fixed-rate clock with
* the clock framework
@@ -392,7 +405,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
fixed_rate) \
__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \
(parent_data), (flags), (fixed_rate), 0, \
- 0)
+ 0, false)
/**
* clk_hw_register_fixed_rate_with_accuracy - register fixed-rate clock with
* the clock framework
@@ -408,7 +421,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
fixed_accuracy) \
__clk_hw_register_fixed_rate((dev), NULL, (name), (parent_name), \
NULL, NULL, (flags), (fixed_rate), \
- (fixed_accuracy), 0)
+ (fixed_accuracy), 0, false)
/**
* clk_hw_register_fixed_rate_with_accuracy_parent_hw - register fixed-rate
* clock with the clock framework
@@ -423,7 +436,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
parent_hw, flags, fixed_rate, fixed_accuracy) \
__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw) \
NULL, NULL, (flags), (fixed_rate), \
- (fixed_accuracy), 0)
+ (fixed_accuracy), 0, false)
/**
* clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate
* clock with the clock framework
@@ -438,7 +451,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
parent_data, flags, fixed_rate, fixed_accuracy) \
__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \
(parent_data), NULL, (flags), \
- (fixed_rate), (fixed_accuracy), 0)
+ (fixed_rate), (fixed_accuracy), 0, false)
/**
* clk_hw_register_fixed_rate_parent_accuracy - register fixed-rate clock with
* the clock framework
@@ -452,7 +465,7 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
flags, fixed_rate) \
__clk_hw_register_fixed_rate((dev), NULL, (name), NULL, NULL, \
(parent_data), (flags), (fixed_rate), 0, \
- CLK_FIXED_RATE_PARENT_ACCURACY)
+ CLK_FIXED_RATE_PARENT_ACCURACY, false)
void clk_unregister_fixed_rate(struct clk *clk);
void clk_hw_unregister_fixed_rate(struct clk_hw *hw);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 226/374] clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (224 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 225/374] clk: fixed-rate: add devm_clk_hw_register_fixed_rate Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 227/374] pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable Greg Kroah-Hartman
` (148 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Théo Lebrun, Stephen Boyd,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Théo Lebrun <theo.lebrun@bootlin.com>
[ Upstream commit ee0cf5e07f44a10fce8f1bfa9db226c0b5ecf880 ]
Add missing comma and remove extraneous NULL argument. The macro is
currently used by no one which explains why the typo slipped by.
Fixes: 2d34f09e79c9 ("clk: fixed-rate: Add support for specifying parents via DT/pointers")
Signed-off-by: Théo Lebrun <theo.lebrun@bootlin.com>
Link: https://lore.kernel.org/r/20231218-mbly-clk-v1-1-44ce54108f06@bootlin.com
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/linux/clk-provider.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h
index 43e177b3a4d3..6cace09ba63d 100644
--- a/include/linux/clk-provider.h
+++ b/include/linux/clk-provider.h
@@ -434,8 +434,8 @@ struct clk *clk_register_fixed_rate(struct device *dev, const char *name,
*/
#define clk_hw_register_fixed_rate_with_accuracy_parent_hw(dev, name, \
parent_hw, flags, fixed_rate, fixed_accuracy) \
- __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw) \
- NULL, NULL, (flags), (fixed_rate), \
+ __clk_hw_register_fixed_rate((dev), NULL, (name), NULL, (parent_hw), \
+ NULL, (flags), (fixed_rate), \
(fixed_accuracy), 0, false)
/**
* clk_hw_register_fixed_rate_with_accuracy_parent_data - register fixed-rate
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 227/374] pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (225 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 226/374] clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 228/374] pwm: stm32: Use hweight32 in stm32_pwm_detect_channels Greg Kroah-Hartman
` (147 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fabrice Gasnier,
Uwe Kleine-König, Thierry Reding, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit 632ae5d7eb348b3ef88552ec0999260b6f9d6ab1 ]
Found using coccinelle and the following semantic patch:
@@
expression map, reg, bits;
@@
- regmap_update_bits(map, reg, bits, bits)
+ regmap_set_bits(map, reg, bits)
@@
expression map, reg, bits;
@@
- regmap_update_bits(map, reg, bits, 0)
+ regmap_clear_bits(map, reg, bits)
Tested-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Link: https://lore.kernel.org/r/20221115111347.3705732-6-u.kleine-koenig@pengutronix.de
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-stm32.c | 34 ++++++++++++++++------------------
1 file changed, 16 insertions(+), 18 deletions(-)
diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
index 794ca5b02968..21e4a34dfff3 100644
--- a/drivers/pwm/pwm-stm32.c
+++ b/drivers/pwm/pwm-stm32.c
@@ -115,14 +115,14 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm,
int ret;
/* Ensure registers have been updated, enable counter and capture */
- regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN);
+ regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG);
+ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
/* Use cc1 or cc3 DMA resp for PWM input channels 1 & 2 or 3 & 4 */
dma_id = pwm->hwpwm < 2 ? STM32_TIMERS_DMA_CH1 : STM32_TIMERS_DMA_CH3;
ccen = pwm->hwpwm < 2 ? TIM_CCER_CC12E : TIM_CCER_CC34E;
ccr = pwm->hwpwm < 2 ? TIM_CCR1 : TIM_CCR3;
- regmap_update_bits(priv->regmap, TIM_CCER, ccen, ccen);
+ regmap_set_bits(priv->regmap, TIM_CCER, ccen);
/*
* Timer DMA burst mode. Request 2 registers, 2 bursts, to get both
@@ -160,8 +160,8 @@ static int stm32_pwm_raw_capture(struct stm32_pwm *priv, struct pwm_device *pwm,
}
stop:
- regmap_update_bits(priv->regmap, TIM_CCER, ccen, 0);
- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
+ regmap_clear_bits(priv->regmap, TIM_CCER, ccen);
+ regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
return ret;
}
@@ -359,7 +359,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch,
regmap_write(priv->regmap, TIM_PSC, prescaler);
regmap_write(priv->regmap, TIM_ARR, prd - 1);
- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE, TIM_CR1_ARPE);
+ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_ARPE);
/* Calculate the duty cycles */
dty = prd * duty_ns;
@@ -377,7 +377,7 @@ static int stm32_pwm_config(struct stm32_pwm *priv, int ch,
else
regmap_update_bits(priv->regmap, TIM_CCMR2, mask, ccmr);
- regmap_update_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE, TIM_BDTR_MOE);
+ regmap_set_bits(priv->regmap, TIM_BDTR, TIM_BDTR_MOE);
return 0;
}
@@ -411,13 +411,13 @@ static int stm32_pwm_enable(struct stm32_pwm *priv, int ch)
if (priv->have_complementary_output)
mask |= TIM_CCER_CC1NE << (ch * 4);
- regmap_update_bits(priv->regmap, TIM_CCER, mask, mask);
+ regmap_set_bits(priv->regmap, TIM_CCER, mask);
/* Make sure that registers are updated */
- regmap_update_bits(priv->regmap, TIM_EGR, TIM_EGR_UG, TIM_EGR_UG);
+ regmap_set_bits(priv->regmap, TIM_EGR, TIM_EGR_UG);
/* Enable controller */
- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, TIM_CR1_CEN);
+ regmap_set_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
return 0;
}
@@ -431,11 +431,11 @@ static void stm32_pwm_disable(struct stm32_pwm *priv, int ch)
if (priv->have_complementary_output)
mask |= TIM_CCER_CC1NE << (ch * 4);
- regmap_update_bits(priv->regmap, TIM_CCER, mask, 0);
+ regmap_clear_bits(priv->regmap, TIM_CCER, mask);
/* When all channels are disabled, we can disable the controller */
if (!active_channels(priv))
- regmap_update_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN, 0);
+ regmap_clear_bits(priv->regmap, TIM_CR1, TIM_CR1_CEN);
clk_disable(priv->clk);
}
@@ -568,10 +568,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
* If complementary bit doesn't exist writing 1 will have no
* effect so we can detect it.
*/
- regmap_update_bits(priv->regmap,
- TIM_CCER, TIM_CCER_CC1NE, TIM_CCER_CC1NE);
+ regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE);
regmap_read(priv->regmap, TIM_CCER, &ccer);
- regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE, 0);
+ regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CC1NE);
priv->have_complementary_output = (ccer != 0);
}
@@ -585,10 +584,9 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
* If channels enable bits don't exist writing 1 will have no
* effect so we can detect and count them.
*/
- regmap_update_bits(priv->regmap,
- TIM_CCER, TIM_CCER_CCXE, TIM_CCER_CCXE);
+ regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
regmap_read(priv->regmap, TIM_CCER, &ccer);
- regmap_update_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE, 0);
+ regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
if (ccer & TIM_CCER_CC1E)
npwm++;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 228/374] pwm: stm32: Use hweight32 in stm32_pwm_detect_channels
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (226 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 227/374] pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 229/374] pwm: stm32: Fix enable count for clk in .probe() Greg Kroah-Hartman
` (146 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philipp Zabel, Uwe Kleine-König,
Fabrice Gasnier, Thierry Reding, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <p.zabel@pengutronix.de>
[ Upstream commit 41fa8f57c0d269243fe3bde2bce71e82c884b9ad ]
Use hweight32() to count the CCxE bits in stm32_pwm_detect_channels().
Since the return value is assigned to chip.npwm, change it to unsigned
int as well.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Stable-dep-of: 19f1016ea960 ("pwm: stm32: Fix enable count for clk in .probe()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-stm32.c | 17 ++---------------
1 file changed, 2 insertions(+), 15 deletions(-)
diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
index 21e4a34dfff3..9c260aac442d 100644
--- a/drivers/pwm/pwm-stm32.c
+++ b/drivers/pwm/pwm-stm32.c
@@ -575,10 +575,9 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
priv->have_complementary_output = (ccer != 0);
}
-static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv)
{
u32 ccer;
- int npwm = 0;
/*
* If channels enable bits don't exist writing 1 will have no
@@ -588,19 +587,7 @@ static int stm32_pwm_detect_channels(struct stm32_pwm *priv)
regmap_read(priv->regmap, TIM_CCER, &ccer);
regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
- if (ccer & TIM_CCER_CC1E)
- npwm++;
-
- if (ccer & TIM_CCER_CC2E)
- npwm++;
-
- if (ccer & TIM_CCER_CC3E)
- npwm++;
-
- if (ccer & TIM_CCER_CC4E)
- npwm++;
-
- return npwm;
+ return hweight32(ccer & TIM_CCER_CCXE);
}
static int stm32_pwm_probe(struct platform_device *pdev)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 229/374] pwm: stm32: Fix enable count for clk in .probe()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (227 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 228/374] pwm: stm32: Use hweight32 in stm32_pwm_detect_channels Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 230/374] ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] Greg Kroah-Hartman
` (145 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Philipp Zabel, Uwe Kleine-König,
Fabrice Gasnier, Thierry Reding, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Philipp Zabel <p.zabel@pengutronix.de>
[ Upstream commit 19f1016ea9600ed89bc24247c36ff5934ad94fbb ]
Make the driver take over hardware state without disabling in .probe()
and enable the clock for each enabled channel.
Signed-off-by: Philipp Zabel <p.zabel@pengutronix.de>
[ukleinek: split off from a patch that also implemented .get_state()]
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Fixes: 7edf7369205b ("pwm: Add driver for STM32 plaftorm")
Reviewed-by: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
Signed-off-by: Thierry Reding <thierry.reding@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pwm/pwm-stm32.c | 18 ++++++++++++++----
1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/drivers/pwm/pwm-stm32.c b/drivers/pwm/pwm-stm32.c
index 9c260aac442d..bdcdb7f38312 100644
--- a/drivers/pwm/pwm-stm32.c
+++ b/drivers/pwm/pwm-stm32.c
@@ -575,17 +575,21 @@ static void stm32_pwm_detect_complementary(struct stm32_pwm *priv)
priv->have_complementary_output = (ccer != 0);
}
-static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv)
+static unsigned int stm32_pwm_detect_channels(struct stm32_pwm *priv,
+ unsigned int *num_enabled)
{
- u32 ccer;
+ u32 ccer, ccer_backup;
/*
* If channels enable bits don't exist writing 1 will have no
* effect so we can detect and count them.
*/
+ regmap_read(priv->regmap, TIM_CCER, &ccer_backup);
regmap_set_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
regmap_read(priv->regmap, TIM_CCER, &ccer);
- regmap_clear_bits(priv->regmap, TIM_CCER, TIM_CCER_CCXE);
+ regmap_write(priv->regmap, TIM_CCER, ccer_backup);
+
+ *num_enabled = hweight32(ccer_backup & TIM_CCER_CCXE);
return hweight32(ccer & TIM_CCER_CCXE);
}
@@ -596,6 +600,8 @@ static int stm32_pwm_probe(struct platform_device *pdev)
struct device_node *np = dev->of_node;
struct stm32_timers *ddata = dev_get_drvdata(pdev->dev.parent);
struct stm32_pwm *priv;
+ unsigned int num_enabled;
+ unsigned int i;
int ret;
priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
@@ -618,7 +624,11 @@ static int stm32_pwm_probe(struct platform_device *pdev)
priv->chip.dev = dev;
priv->chip.ops = &stm32pwm_ops;
- priv->chip.npwm = stm32_pwm_detect_channels(priv);
+ priv->chip.npwm = stm32_pwm_detect_channels(priv, &num_enabled);
+
+ /* Initialize clock refcount to number of enabled PWM channels. */
+ for (i = 0; i < num_enabled; i++)
+ clk_enable(priv->clk);
ret = pwmchip_add(&priv->chip);
if (ret < 0)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 230/374] ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[]
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (228 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 229/374] pwm: stm32: Fix enable count for clk in .probe() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 231/374] ALSA: scarlett2: Add missing error check to scarlett2_config_save() Greg Kroah-Hartman
` (144 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chris Chiu, Hans de Goede,
Mark Brown, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
[ Upstream commit 51add1687f39292af626ac3c2046f49241713273 ]
dmi_platform_data[] first contains a DMI entry matching:
DMI_MATCH(DMI_PRODUCT_NAME, "EF20"),
and then contains an identical entry except for the match being:
DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
Since these are partial (non exact) DMI matches the first match
will also match any board with "EF20EA" in their DMI product-name,
drop the second, redundant, entry.
Fixes: a4dae468cfdd ("ASoC: rt5645: Add ACPI-defined GPIO for ECS EF20 series")
Cc: Chris Chiu <chiu@endlessos.org>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://msgid.link/r/20231126214024.300505-2-hdegoede@redhat.com
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/codecs/rt5645.c | 8 --------
1 file changed, 8 deletions(-)
diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index e7009f704b99..2fdfec505192 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c
@@ -3828,14 +3828,6 @@ static const struct dmi_system_id dmi_platform_data[] = {
},
.driver_data = (void *)&ecs_ef20_platform_data,
},
- {
- .ident = "EF20EA",
- .callback = cht_rt5645_ef20_quirk_cb,
- .matches = {
- DMI_MATCH(DMI_PRODUCT_NAME, "EF20EA"),
- },
- .driver_data = (void *)&ecs_ef20_platform_data,
- },
{ }
};
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 231/374] ALSA: scarlett2: Add missing error check to scarlett2_config_save()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (229 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 230/374] ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 232/374] ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() Greg Kroah-Hartman
` (143 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey D. Bennett, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <g@b4.vu>
[ Upstream commit 5f6ff6931a1c0065a55448108940371e1ac8075f ]
scarlett2_config_save() was ignoring the return value from
scarlett2_usb(). As this function is not called from user-space we
can't return the error, so call usb_audio_err() instead.
Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
Link: https://lore.kernel.org/r/bf0a15332d852d7825fa6da87d2a0d9c0b702053.1703001053.git.g@b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_scarlett_gen2.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
index 53ebabf42472..6e79872e68c4 100644
--- a/sound/usb/mixer_scarlett_gen2.c
+++ b/sound/usb/mixer_scarlett_gen2.c
@@ -1213,9 +1213,11 @@ static void scarlett2_config_save(struct usb_mixer_interface *mixer)
{
__le32 req = cpu_to_le32(SCARLETT2_USB_CONFIG_SAVE);
- scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
- &req, sizeof(u32),
- NULL, 0);
+ int err = scarlett2_usb(mixer, SCARLETT2_USB_DATA_CMD,
+ &req, sizeof(u32),
+ NULL, 0);
+ if (err < 0)
+ usb_audio_err(mixer->chip, "config save failed: %d\n", err);
}
/* Delayed work to save config */
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 232/374] ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (230 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 231/374] ALSA: scarlett2: Add missing error check to scarlett2_config_save() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 233/374] ALSA: scarlett2: Allow passing any output to line_out_remap() Greg Kroah-Hartman
` (142 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey D. Bennett, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <g@b4.vu>
[ Upstream commit ca459dfa7d4ed9098fcf13e410963be6ae9b6bf3 ]
scarlett2_usb_set_config() calls scarlett2_usb_get() but was not
checking the result. Return the error if it fails rather than
continuing with an invalid value.
Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Fixes: 9e15fae6c51a ("ALSA: usb-audio: scarlett2: Allow bit-level access to config")
Link: https://lore.kernel.org/r/def110c5c31dbdf0a7414d258838a0a31c0fab67.1703001053.git.g@b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_scarlett_gen2.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
index 6e79872e68c4..f8787a4b1e13 100644
--- a/sound/usb/mixer_scarlett_gen2.c
+++ b/sound/usb/mixer_scarlett_gen2.c
@@ -1266,7 +1266,10 @@ static int scarlett2_usb_set_config(
size = 1;
offset = config_item->offset;
- scarlett2_usb_get(mixer, offset, &tmp, 1);
+ err = scarlett2_usb_get(mixer, offset, &tmp, 1);
+ if (err < 0)
+ return err;
+
if (value)
tmp |= (1 << index);
else
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 233/374] ALSA: scarlett2: Allow passing any output to line_out_remap()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (231 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 232/374] ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 234/374] ALSA: scarlett2: Add missing error checks to *_ctl_get() Greg Kroah-Hartman
` (141 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey D. Bennett, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <g@b4.vu>
[ Upstream commit 2190b9aea4eb92ccf3176e35c17c959e40f1a81b ]
Line outputs 3 & 4 on the Gen 3 18i8 are internally the analogue 7 and
8 outputs, and this renumbering is hidden from the user by
line_out_remap(). By allowing higher values (representing non-analogue
outputs) to be passed to line_out_remap(), repeated code from
scarlett2_mux_src_enum_ctl_get() and scarlett2_mux_src_enum_ctl_put()
can be removed.
Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Link: https://lore.kernel.org/r/3b70267931f5994628ab27306c73cddd17b93c8f.1698342632.git.g@b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Stable-dep-of: 50603a67daef ("ALSA: scarlett2: Add missing error checks to *_ctl_get()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_scarlett_gen2.c | 25 +++++++++----------------
1 file changed, 9 insertions(+), 16 deletions(-)
diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
index f8787a4b1e13..ad46a0d3e33b 100644
--- a/sound/usb/mixer_scarlett_gen2.c
+++ b/sound/usb/mixer_scarlett_gen2.c
@@ -1777,9 +1777,16 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl,
static int line_out_remap(struct scarlett2_data *private, int index)
{
const struct scarlett2_device_info *info = private->info;
+ const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count;
+ int line_out_count =
+ port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT];
if (!info->line_out_remap_enable)
return index;
+
+ if (index >= line_out_count)
+ return index;
+
return info->line_out_remap[index];
}
@@ -3264,14 +3271,7 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
- const struct scarlett2_device_info *info = private->info;
- const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count;
- int line_out_count =
- port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT];
- int index = elem->control;
-
- if (index < line_out_count)
- index = line_out_remap(private, index);
+ int index = line_out_remap(private, elem->control);
mutex_lock(&private->data_mutex);
if (private->mux_updated)
@@ -3288,16 +3288,9 @@ static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
- const struct scarlett2_device_info *info = private->info;
- const int (*port_count)[SCARLETT2_PORT_DIRNS] = info->port_count;
- int line_out_count =
- port_count[SCARLETT2_PORT_TYPE_ANALOGUE][SCARLETT2_PORT_OUT];
- int index = elem->control;
+ int index = line_out_remap(private, elem->control);
int oval, val, err = 0;
- if (index < line_out_count)
- index = line_out_remap(private, index);
-
mutex_lock(&private->data_mutex);
oval = private->mux[index];
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 234/374] ALSA: scarlett2: Add missing error checks to *_ctl_get()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (232 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 233/374] ALSA: scarlett2: Allow passing any output to line_out_remap() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 235/374] ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Greg Kroah-Hartman
` (140 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey D. Bennett, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <g@b4.vu>
[ Upstream commit 50603a67daef161c78c814580d57f7f0be57167e ]
The *_ctl_get() functions which call scarlett2_update_*() were not
checking the return value. Fix to check the return value and pass to
the caller.
Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
Link: https://lore.kernel.org/r/32a5fdc83b05fa74e0fcdd672fbf71d75c5f0a6d.1703001053.git.g@b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_scarlett_gen2.c | 182 +++++++++++++++++++++++---------
1 file changed, 130 insertions(+), 52 deletions(-)
diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
index ad46a0d3e33b..9302f45b62ac 100644
--- a/sound/usb/mixer_scarlett_gen2.c
+++ b/sound/usb/mixer_scarlett_gen2.c
@@ -1674,14 +1674,20 @@ static int scarlett2_sync_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->sync_updated)
- scarlett2_update_sync(mixer);
+
+ if (private->sync_updated) {
+ err = scarlett2_update_sync(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.enumerated.item[0] = private->sync;
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static const struct snd_kcontrol_new scarlett2_sync_ctl = {
@@ -1764,14 +1770,20 @@ static int scarlett2_master_volume_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->vol_updated)
- scarlett2_update_volumes(mixer);
- mutex_unlock(&private->data_mutex);
+ if (private->vol_updated) {
+ err = scarlett2_update_volumes(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] = private->master_vol;
- return 0;
+
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int line_out_remap(struct scarlett2_data *private, int index)
@@ -1797,14 +1809,20 @@ static int scarlett2_volume_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
int index = line_out_remap(private, elem->control);
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->vol_updated)
- scarlett2_update_volumes(mixer);
- mutex_unlock(&private->data_mutex);
+ if (private->vol_updated) {
+ err = scarlett2_update_volumes(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] = private->vol[index];
- return 0;
+
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_volume_ctl_put(struct snd_kcontrol *kctl,
@@ -1871,14 +1889,20 @@ static int scarlett2_mute_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
int index = line_out_remap(private, elem->control);
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->vol_updated)
- scarlett2_update_volumes(mixer);
- mutex_unlock(&private->data_mutex);
+ if (private->vol_updated) {
+ err = scarlett2_update_volumes(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] = private->mute_switch[index];
- return 0;
+
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_mute_ctl_put(struct snd_kcontrol *kctl,
@@ -2124,14 +2148,20 @@ static int scarlett2_level_enum_ctl_get(struct snd_kcontrol *kctl,
const struct scarlett2_device_info *info = private->info;
int index = elem->control + info->level_input_first;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->input_other_updated)
- scarlett2_update_input_other(mixer);
+
+ if (private->input_other_updated) {
+ err = scarlett2_update_input_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.enumerated.item[0] = private->level_switch[index];
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_level_enum_ctl_put(struct snd_kcontrol *kctl,
@@ -2182,15 +2212,21 @@ static int scarlett2_pad_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->input_other_updated)
- scarlett2_update_input_other(mixer);
+
+ if (private->input_other_updated) {
+ err = scarlett2_update_input_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] =
private->pad_switch[elem->control];
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_pad_ctl_put(struct snd_kcontrol *kctl,
@@ -2240,14 +2276,20 @@ static int scarlett2_air_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->input_other_updated)
- scarlett2_update_input_other(mixer);
+
+ if (private->input_other_updated) {
+ err = scarlett2_update_input_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] = private->air_switch[elem->control];
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_air_ctl_put(struct snd_kcontrol *kctl,
@@ -2297,15 +2339,21 @@ static int scarlett2_phantom_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->input_other_updated)
- scarlett2_update_input_other(mixer);
+
+ if (private->input_other_updated) {
+ err = scarlett2_update_input_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] =
private->phantom_switch[elem->control];
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_phantom_ctl_put(struct snd_kcontrol *kctl,
@@ -2477,14 +2525,20 @@ static int scarlett2_direct_monitor_ctl_get(
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = elem->head.mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->monitor_other_updated)
- scarlett2_update_monitor_other(mixer);
+
+ if (private->monitor_other_updated) {
+ err = scarlett2_update_monitor_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.enumerated.item[0] = private->direct_monitor_switch;
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_direct_monitor_ctl_put(
@@ -2584,14 +2638,20 @@ static int scarlett2_speaker_switch_enum_ctl_get(
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->monitor_other_updated)
- scarlett2_update_monitor_other(mixer);
+
+ if (private->monitor_other_updated) {
+ err = scarlett2_update_monitor_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.enumerated.item[0] = private->speaker_switching_switch;
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
/* when speaker switching gets enabled, switch the main/alt speakers
@@ -2739,14 +2799,20 @@ static int scarlett2_talkback_enum_ctl_get(
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->monitor_other_updated)
- scarlett2_update_monitor_other(mixer);
+
+ if (private->monitor_other_updated) {
+ err = scarlett2_update_monitor_other(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.enumerated.item[0] = private->talkback_switch;
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_talkback_enum_ctl_put(
@@ -2894,14 +2960,20 @@ static int scarlett2_dim_mute_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_elem_info *elem = kctl->private_data;
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->vol_updated)
- scarlett2_update_volumes(mixer);
- mutex_unlock(&private->data_mutex);
+ if (private->vol_updated) {
+ err = scarlett2_update_volumes(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.integer.value[0] = private->dim_mute[elem->control];
- return 0;
+
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_dim_mute_ctl_put(struct snd_kcontrol *kctl,
@@ -3272,14 +3344,20 @@ static int scarlett2_mux_src_enum_ctl_get(struct snd_kcontrol *kctl,
struct usb_mixer_interface *mixer = elem->head.mixer;
struct scarlett2_data *private = mixer->private_data;
int index = line_out_remap(private, elem->control);
+ int err = 0;
mutex_lock(&private->data_mutex);
- if (private->mux_updated)
- scarlett2_usb_get_mux(mixer);
+
+ if (private->mux_updated) {
+ err = scarlett2_usb_get_mux(mixer);
+ if (err < 0)
+ goto unlock;
+ }
ucontrol->value.enumerated.item[0] = private->mux[index];
- mutex_unlock(&private->data_mutex);
- return 0;
+unlock:
+ mutex_unlock(&private->data_mutex);
+ return err;
}
static int scarlett2_mux_src_enum_ctl_put(struct snd_kcontrol *kctl,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 235/374] ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (233 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 234/374] ALSA: scarlett2: Add missing error checks to *_ctl_get() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 236/374] mmc: sdhci_am654: Fix TI SoC dependencies Greg Kroah-Hartman
` (139 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geoffrey D. Bennett, Takashi Iwai,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geoffrey D. Bennett <g@b4.vu>
[ Upstream commit 04f8f053252b86c7583895c962d66747ecdc61b7 ]
Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and
SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside
scarlett2_mixer_values[].
Signed-off-by: Geoffrey D. Bennett <g@b4.vu>
Fixes: 9e4d5c1be21f ("ALSA: usb-audio: Scarlett Gen 2 mixer interface")
Link: https://lore.kernel.org/r/3b19fb3da641b587749b85fe1daa1b4e696c0c1b.1703001053.git.g@b4.vu
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/usb/mixer_scarlett_gen2.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/sound/usb/mixer_scarlett_gen2.c b/sound/usb/mixer_scarlett_gen2.c
index 9302f45b62ac..0a9025e3c867 100644
--- a/sound/usb/mixer_scarlett_gen2.c
+++ b/sound/usb/mixer_scarlett_gen2.c
@@ -3237,7 +3237,8 @@ static int scarlett2_mixer_ctl_put(struct snd_kcontrol *kctl,
mutex_lock(&private->data_mutex);
oval = private->mix[index];
- val = ucontrol->value.integer.value[0];
+ val = clamp(ucontrol->value.integer.value[0],
+ 0L, (long)SCARLETT2_MIXER_MAX_VALUE);
num_mixer_in = port_count[SCARLETT2_PORT_TYPE_MIX][SCARLETT2_PORT_OUT];
mix_num = index / num_mixer_in;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 236/374] mmc: sdhci_am654: Fix TI SoC dependencies
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (234 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 235/374] ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 237/374] mmc: sdhci_omap: " Greg Kroah-Hartman
` (138 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Robinson, Ulf Hansson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <pbrobinson@gmail.com>
[ Upstream commit cb052da7f031b0d2309a4895ca236afb3b4bbf50 ]
The sdhci_am654 is specific to recent TI SoCs, update the
dependencies for those SoCs and compile testing. While we're
at it update the text to reflect the wider range of
supported TI SoCS the driver now supports.
Fixes: 41fd4caeb00b ("mmc: sdhci_am654: Add Initial Support for AM654 SDHCI driver")
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Link: https://lore.kernel.org/r/20231220135950.433588-1-pbrobinson@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/Kconfig | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index a281df78d168..ef36a0095211 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -1070,14 +1070,15 @@ config MMC_SDHCI_OMAP
config MMC_SDHCI_AM654
tristate "Support for the SDHCI Controller in TI's AM654 SOCs"
+ depends on ARCH_K3 || COMPILE_TEST
depends on MMC_SDHCI_PLTFM && OF
select MMC_SDHCI_IO_ACCESSORS
select MMC_CQHCI
select REGMAP_MMIO
help
This selects the Secure Digital Host Controller Interface (SDHCI)
- support present in TI's AM654 SOCs. The controller supports
- SD/MMC/SDIO devices.
+ support present in TI's AM65x/AM64x/AM62x/J721E SOCs. The controller
+ supports SD/MMC/SDIO devices.
If you have a controller with this interface, say Y or M here.
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 237/374] mmc: sdhci_omap: Fix TI SoC dependencies
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (235 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 236/374] mmc: sdhci_am654: Fix TI SoC dependencies Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 238/374] IB/iser: Prevent invalidating wrong MR Greg Kroah-Hartman
` (137 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Robinson, Ulf Hansson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Robinson <pbrobinson@gmail.com>
[ Upstream commit 09f164d393a6671e5ff8342ba6b3cb7fe3f20208 ]
The sdhci_omap is specific to older TI SoCs, update the
dependencies for those SoCs and compile testing. While we're
at it update the text to reflect the wider range of
supported TI SoCS the driver now supports.
Fixes: 7d326930d352 ("mmc: sdhci-omap: Add OMAP SDHCI driver")
Signed-off-by: Peter Robinson <pbrobinson@gmail.com>
Link: https://lore.kernel.org/r/20231220135950.433588-2-pbrobinson@gmail.com
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mmc/host/Kconfig | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index ef36a0095211..0061eeec220b 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -1055,14 +1055,15 @@ config MMC_SDHCI_XENON
config MMC_SDHCI_OMAP
tristate "TI SDHCI Controller Support"
+ depends on ARCH_OMAP2PLUS || ARCH_KEYSTONE || COMPILE_TEST
depends on MMC_SDHCI_PLTFM && OF
select THERMAL
imply TI_SOC_THERMAL
select MMC_SDHCI_EXTERNAL_DMA if DMA_ENGINE
help
This selects the Secure Digital Host Controller Interface (SDHCI)
- support present in TI's DRA7 SOCs. The controller supports
- SD/MMC/SDIO devices.
+ support present in TI's Keystone/OMAP2+/DRA7 SOCs. The controller
+ supports SD/MMC/SDIO devices.
If you have a controller with this interface, say Y or M here.
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 238/374] IB/iser: Prevent invalidating wrong MR
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (236 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 237/374] mmc: sdhci_omap: " Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 239/374] drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init Greg Kroah-Hartman
` (136 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Max Gurtovoy, Sergey Gorenko,
Jason Gunthorpe, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Gorenko <sergeygo@nvidia.com>
[ Upstream commit 2f1888281e67205bd80d3e8f54dbd519a9653f26 ]
The iser_reg_resources structure has two pointers to MR but only one
mr_valid field. The implementation assumes that we use only *sig_mr when
pi_enable is true. Otherwise, we use only *mr. However, it is only
sometimes correct. Read commands without protection information occur even
when pi_enble is true. For example, the following SCSI commands have a
Data-In buffer but never have protection information: READ CAPACITY (16),
INQUIRY, MODE SENSE(6), MAINTENANCE IN. So, we use
*sig_mr for some SCSI commands and *mr for the other SCSI commands.
In most cases, it works fine because the remote invalidation is applied.
However, there are two cases when the remote invalidation is not
applicable.
1. Small write commands when all data is sent as an immediate.
2. The target does not support the remote invalidation feature.
The lazy invalidation is used if the remote invalidation is impossible.
Since, at the lazy invalidation, we always invalidate the MR we want to
use, the wrong MR may be invalidated.
To fix the issue, we need a field per MR that indicates the MR needs
invalidation. Since the ib_mr structure already has such a field, let's
use ib_mr.need_inval instead of iser_reg_resources.mr_valid.
Fixes: b76a439982f8 ("IB/iser: Use IB_WR_REG_MR_INTEGRITY for PI handover")
Link: https://lore.kernel.org/r/20231219072311.40989-1-sergeygo@nvidia.com
Acked-by: Max Gurtovoy <mgurtovoy@nvidia.com>
Signed-off-by: Sergey Gorenko <sergeygo@nvidia.com>
Signed-off-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/infiniband/ulp/iser/iscsi_iser.h | 2 --
drivers/infiniband/ulp/iser/iser_initiator.c | 5 ++++-
drivers/infiniband/ulp/iser/iser_memory.c | 8 ++++----
drivers/infiniband/ulp/iser/iser_verbs.c | 1 -
4 files changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h
index 9f6ac0a09a78..35cc0a57e697 100644
--- a/drivers/infiniband/ulp/iser/iscsi_iser.h
+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h
@@ -321,12 +321,10 @@ struct iser_device {
*
* @mr: memory region
* @sig_mr: signature memory region
- * @mr_valid: is mr valid indicator
*/
struct iser_reg_resources {
struct ib_mr *mr;
struct ib_mr *sig_mr;
- u8 mr_valid:1;
};
/**
diff --git a/drivers/infiniband/ulp/iser/iser_initiator.c b/drivers/infiniband/ulp/iser/iser_initiator.c
index 27a6f75a9912..9ea88dd6a414 100644
--- a/drivers/infiniband/ulp/iser/iser_initiator.c
+++ b/drivers/infiniband/ulp/iser/iser_initiator.c
@@ -602,7 +602,10 @@ iser_inv_desc(struct iser_fr_desc *desc, u32 rkey)
return -EINVAL;
}
- desc->rsc.mr_valid = 0;
+ if (desc->sig_protected)
+ desc->rsc.sig_mr->need_inval = false;
+ else
+ desc->rsc.mr->need_inval = false;
return 0;
}
diff --git a/drivers/infiniband/ulp/iser/iser_memory.c b/drivers/infiniband/ulp/iser/iser_memory.c
index 9776b755d848..c362043e7f17 100644
--- a/drivers/infiniband/ulp/iser/iser_memory.c
+++ b/drivers/infiniband/ulp/iser/iser_memory.c
@@ -250,7 +250,7 @@ iser_reg_sig_mr(struct iscsi_iser_task *iser_task,
iser_set_prot_checks(iser_task->sc, &sig_attrs->check_mask);
- if (rsc->mr_valid)
+ if (rsc->sig_mr->need_inval)
iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr);
ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
@@ -274,7 +274,7 @@ iser_reg_sig_mr(struct iscsi_iser_task *iser_task,
wr->access = IB_ACCESS_LOCAL_WRITE |
IB_ACCESS_REMOTE_READ |
IB_ACCESS_REMOTE_WRITE;
- rsc->mr_valid = 1;
+ rsc->sig_mr->need_inval = true;
sig_reg->sge.lkey = mr->lkey;
sig_reg->rkey = mr->rkey;
@@ -299,7 +299,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
struct ib_reg_wr *wr = &tx_desc->reg_wr;
int n;
- if (rsc->mr_valid)
+ if (rsc->mr->need_inval)
iser_inv_rkey(&tx_desc->inv_wr, mr, cqe, &wr->wr);
ib_update_fast_reg_key(mr, ib_inc_rkey(mr->rkey));
@@ -322,7 +322,7 @@ static int iser_fast_reg_mr(struct iscsi_iser_task *iser_task,
IB_ACCESS_REMOTE_WRITE |
IB_ACCESS_REMOTE_READ;
- rsc->mr_valid = 1;
+ rsc->mr->need_inval = true;
reg->sge.lkey = mr->lkey;
reg->rkey = mr->rkey;
diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
index b566f7cb7797..8656664a15c5 100644
--- a/drivers/infiniband/ulp/iser/iser_verbs.c
+++ b/drivers/infiniband/ulp/iser/iser_verbs.c
@@ -136,7 +136,6 @@ iser_create_fastreg_desc(struct iser_device *device,
goto err_alloc_mr_integrity;
}
}
- desc->rsc.mr_valid = 0;
return desc;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 239/374] drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (237 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 238/374] IB/iser: Prevent invalidating wrong MR Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 240/374] ksmbd: validate the zero field of packet header Greg Kroah-Hartman
` (135 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zhipeng Lu, Alex Deucher,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhipeng Lu <alexious@zju.edu.cn>
[ Upstream commit 2f3be3ca779b11c332441b10e00443a2510f4d7b ]
The hwmgr->backend, (i.e. data) allocated by kzalloc is not freed in
the error-handling paths of smu7_get_evv_voltages and
smu7_update_edc_leakage_table. However, it did be freed in the
error-handling of phm_initializa_dynamic_state_adjustment_rule_settings,
by smu7_hwmgr_backend_fini. So the lack of free in smu7_get_evv_voltages
and smu7_update_edc_leakage_table is considered a memleak in this patch.
Fixes: 599a7e9fe1b6 ("drm/amd/powerplay: implement smu7 hwmgr to manager asics with smu ip version 7.")
Fixes: 8f0804c6b7d0 ("drm/amd/pm: add edc leakage controller setting")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
index 611969bf4520..9bfc465d08fb 100644
--- a/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
+++ b/drivers/gpu/drm/amd/pm/powerplay/hwmgr/smu7_hwmgr.c
@@ -2924,6 +2924,8 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
result = smu7_get_evv_voltages(hwmgr);
if (result) {
pr_info("Get EVV Voltage Failed. Abort Driver loading!\n");
+ kfree(hwmgr->backend);
+ hwmgr->backend = NULL;
return -EINVAL;
}
} else {
@@ -2969,8 +2971,10 @@ static int smu7_hwmgr_backend_init(struct pp_hwmgr *hwmgr)
}
result = smu7_update_edc_leakage_table(hwmgr);
- if (result)
+ if (result) {
+ smu7_hwmgr_backend_fini(hwmgr);
return result;
+ }
return 0;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 240/374] ksmbd: validate the zero field of packet header
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (238 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 239/374] drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 241/374] of: Fix double free in of_parse_phandle_with_args_map Greg Kroah-Hartman
` (134 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Li Nan, Tom Talpey, Namjae Jeon,
Steve French, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Nan <linan122@huawei.com>
[ Upstream commit 516b3eb8c8065f7465f87608d37a7ed08298c7a5 ]
The SMB2 Protocol requires that "The first byte of the Direct TCP
transport packet header MUST be zero (0x00)"[1]. Commit 1c1bcf2d3ea0
("ksmbd: validate smb request protocol id") removed the validation of
this 1-byte zero. Add the validation back now.
[1]: [MS-SMB2] - v20230227, page 30.
https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SMB2/%5bMS-SMB2%5d-230227.pdf
Fixes: 1c1bcf2d3ea0 ("ksmbd: validate smb request protocol id")
Signed-off-by: Li Nan <linan122@huawei.com>
Acked-by: Tom Talpey <tom@talpey.com>
Acked-by: Namjae Jeon <linkinjeon@kernel.org>
Signed-off-by: Steve French <stfrench@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ksmbd/smb_common.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c
index d160363c09eb..e90a1e8c1951 100644
--- a/fs/ksmbd/smb_common.c
+++ b/fs/ksmbd/smb_common.c
@@ -158,8 +158,12 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work)
*/
bool ksmbd_smb_request(struct ksmbd_conn *conn)
{
- __le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf);
+ __le32 *proto;
+ if (conn->request_buf[0] != 0)
+ return false;
+
+ proto = (__le32 *)smb2_get_msg(conn->request_buf);
if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) {
pr_err_ratelimited("smb2 compression not support yet");
return false;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 241/374] of: Fix double free in of_parse_phandle_with_args_map
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (239 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 240/374] ksmbd: validate the zero field of packet header Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 242/374] of: unittest: Fix of_count_phandle_with_args() expected value message Greg Kroah-Hartman
` (133 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stephen Boyd, Christian A. Ehrhardt,
Rob Herring, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian A. Ehrhardt <lk@c--e.de>
[ Upstream commit 4dde83569832f9377362e50f7748463340c5db6b ]
In of_parse_phandle_with_args_map() the inner loop that
iterates through the map entries calls of_node_put(new)
to free the reference acquired by the previous iteration
of the inner loop. This assumes that the value of "new" is
NULL on the first iteration of the inner loop.
Make sure that this is true in all iterations of the outer
loop by setting "new" to NULL after its value is assigned to "cur".
Extend the unittest to detect the double free and add an additional
test case that actually triggers this path.
Fixes: bd6f2fd5a1 ("of: Support parsing phandle argument lists through a nexus node")
Cc: Stephen Boyd <stephen.boyd@linaro.org>
Signed-off-by: "Christian A. Ehrhardt" <lk@c--e.de>
Link: https://lore.kernel.org/r/20231229105411.1603434-1-lk@c--e.de
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/base.c | 1 +
drivers/of/unittest-data/tests-phandle.dtsi | 10 ++-
drivers/of/unittest.c | 74 ++++++++++++---------
3 files changed, 53 insertions(+), 32 deletions(-)
diff --git a/drivers/of/base.c b/drivers/of/base.c
index 54719f8156ed..bc5abe650c5c 100644
--- a/drivers/of/base.c
+++ b/drivers/of/base.c
@@ -1669,6 +1669,7 @@ int of_parse_phandle_with_args_map(const struct device_node *np,
out_args->np = new;
of_node_put(cur);
cur = new;
+ new = NULL;
}
put:
of_node_put(cur);
diff --git a/drivers/of/unittest-data/tests-phandle.dtsi b/drivers/of/unittest-data/tests-phandle.dtsi
index 6b33be4c4416..aa0d7027ffa6 100644
--- a/drivers/of/unittest-data/tests-phandle.dtsi
+++ b/drivers/of/unittest-data/tests-phandle.dtsi
@@ -38,6 +38,13 @@ provider4: provider4 {
phandle-map-pass-thru = <0x0 0xf0>;
};
+ provider5: provider5 {
+ #phandle-cells = <2>;
+ phandle-map = <2 7 &provider4 2 3>;
+ phandle-map-mask = <0xff 0xf>;
+ phandle-map-pass-thru = <0x0 0xf0>;
+ };
+
consumer-a {
phandle-list = <&provider1 1>,
<&provider2 2 0>,
@@ -64,7 +71,8 @@ consumer-b {
<&provider4 4 0x100>,
<&provider4 0 0x61>,
<&provider0>,
- <&provider4 19 0x20>;
+ <&provider4 19 0x20>,
+ <&provider5 2 7>;
phandle-list-bad-phandle = <12345678 0 0>;
phandle-list-bad-args = <&provider2 1 0>,
<&provider4 0>;
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index 073a3f44c404..f3a136d75093 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -448,6 +448,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
unittest(passed, "index %i - data error on node %pOF rc=%i\n",
i, args.np, rc);
+
+ if (rc == 0)
+ of_node_put(args.np);
}
/* Check for missing list property */
@@ -537,8 +540,9 @@ static void __init of_unittest_parse_phandle_with_args(void)
static void __init of_unittest_parse_phandle_with_args_map(void)
{
- struct device_node *np, *p0, *p1, *p2, *p3;
+ struct device_node *np, *p[6] = {};
struct of_phandle_args args;
+ unsigned int prefs[6];
int i, rc;
np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-b");
@@ -547,34 +551,24 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
return;
}
- p0 = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
- if (!p0) {
- pr_err("missing testcase data\n");
- return;
- }
-
- p1 = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
- if (!p1) {
- pr_err("missing testcase data\n");
- return;
- }
-
- p2 = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
- if (!p2) {
- pr_err("missing testcase data\n");
- return;
- }
-
- p3 = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
- if (!p3) {
- pr_err("missing testcase data\n");
- return;
+ p[0] = of_find_node_by_path("/testcase-data/phandle-tests/provider0");
+ p[1] = of_find_node_by_path("/testcase-data/phandle-tests/provider1");
+ p[2] = of_find_node_by_path("/testcase-data/phandle-tests/provider2");
+ p[3] = of_find_node_by_path("/testcase-data/phandle-tests/provider3");
+ p[4] = of_find_node_by_path("/testcase-data/phandle-tests/provider4");
+ p[5] = of_find_node_by_path("/testcase-data/phandle-tests/provider5");
+ for (i = 0; i < ARRAY_SIZE(p); ++i) {
+ if (!p[i]) {
+ pr_err("missing testcase data\n");
+ return;
+ }
+ prefs[i] = kref_read(&p[i]->kobj.kref);
}
rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
- unittest(rc == 7, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
+ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
- for (i = 0; i < 8; i++) {
+ for (i = 0; i < 9; i++) {
bool passed = true;
memset(&args, 0, sizeof(args));
@@ -585,13 +579,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
switch (i) {
case 0:
passed &= !rc;
- passed &= (args.np == p1);
+ passed &= (args.np == p[1]);
passed &= (args.args_count == 1);
passed &= (args.args[0] == 1);
break;
case 1:
passed &= !rc;
- passed &= (args.np == p3);
+ passed &= (args.np == p[3]);
passed &= (args.args_count == 3);
passed &= (args.args[0] == 2);
passed &= (args.args[1] == 5);
@@ -602,28 +596,36 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
break;
case 3:
passed &= !rc;
- passed &= (args.np == p0);
+ passed &= (args.np == p[0]);
passed &= (args.args_count == 0);
break;
case 4:
passed &= !rc;
- passed &= (args.np == p1);
+ passed &= (args.np == p[1]);
passed &= (args.args_count == 1);
passed &= (args.args[0] == 3);
break;
case 5:
passed &= !rc;
- passed &= (args.np == p0);
+ passed &= (args.np == p[0]);
passed &= (args.args_count == 0);
break;
case 6:
passed &= !rc;
- passed &= (args.np == p2);
+ passed &= (args.np == p[2]);
passed &= (args.args_count == 2);
passed &= (args.args[0] == 15);
passed &= (args.args[1] == 0x20);
break;
case 7:
+ passed &= !rc;
+ passed &= (args.np == p[3]);
+ passed &= (args.args_count == 3);
+ passed &= (args.args[0] == 2);
+ passed &= (args.args[1] == 5);
+ passed &= (args.args[2] == 3);
+ break;
+ case 8:
passed &= (rc == -ENOENT);
break;
default:
@@ -632,6 +634,9 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
unittest(passed, "index %i - data error on node %s rc=%i\n",
i, args.np->full_name, rc);
+
+ if (rc == 0)
+ of_node_put(args.np);
}
/* Check for missing list property */
@@ -678,6 +683,13 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
"OF: /testcase-data/phandle-tests/consumer-b: #phandle-cells = 2 found -1");
unittest(rc == -EINVAL, "expected:%i got:%i\n", -EINVAL, rc);
+
+ for (i = 0; i < ARRAY_SIZE(p); ++i) {
+ unittest(prefs[i] == kref_read(&p[i]->kobj.kref),
+ "provider%d: expected:%d got:%d\n",
+ i, prefs[i], kref_read(&p[i]->kobj.kref));
+ of_node_put(p[i]);
+ }
}
static void __init of_unittest_property_string(void)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 242/374] of: unittest: Fix of_count_phandle_with_args() expected value message
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (240 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 241/374] of: Fix double free in of_parse_phandle_with_args_map Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 243/374] selftests/bpf: Add assert for user stacks in test_task_stack Greg Kroah-Hartman
` (132 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geert Uytterhoeven, Rob Herring,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert+renesas@glider.be>
[ Upstream commit 716089b417cf98d01f0dc1b39f9c47e1d7b4c965 ]
The expected result value for the call to of_count_phandle_with_args()
was updated from 7 to 8, but the accompanying error message was
forgotten.
Fixes: 4dde83569832f937 ("of: Fix double free in of_parse_phandle_with_args_map")
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Link: https://lore.kernel.org/r/20240111085025.2073894-1-geert+renesas@glider.be
Signed-off-by: Rob Herring <robh@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/of/unittest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c
index f3a136d75093..699daf0645d1 100644
--- a/drivers/of/unittest.c
+++ b/drivers/of/unittest.c
@@ -566,7 +566,7 @@ static void __init of_unittest_parse_phandle_with_args_map(void)
}
rc = of_count_phandle_with_args(np, "phandle-list", "#phandle-cells");
- unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 7\n", rc);
+ unittest(rc == 8, "of_count_phandle_with_args() returned %i, expected 8\n", rc);
for (i = 0; i < 9; i++) {
bool passed = true;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 243/374] selftests/bpf: Add assert for user stacks in test_task_stack
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (241 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 242/374] of: unittest: Fix of_count_phandle_with_args() expected value message Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 244/374] keys, dns: Fix size check of V1 server-list header Greg Kroah-Hartman
` (131 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan Rome, Andrii Nakryiko,
Stanislav Fomichev
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jordan Rome <linux@jordanrome.com>
commit 727a92d62fd6a382b4c5972008e45667e707b0e4 upstream.
This is a follow up to:
commit b8e3a87a627b ("bpf: Add crosstask check to __bpf_get_stack").
This test ensures that the task iterator only gets a single
user stack (for the current task).
Signed-off-by: Jordan Rome <linux@jordanrome.com>
Signed-off-by: Andrii Nakryiko <andrii@kernel.org>
Acked-by: Stanislav Fomichev <sdf@google.com>
Link: https://lore.kernel.org/bpf/20231112023010.144675-1-linux@jordanrome.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/testing/selftests/bpf/prog_tests/bpf_iter.c | 2 ++
tools/testing/selftests/bpf/progs/bpf_iter_task_stack.c | 5 +++++
2 files changed, 7 insertions(+)
--- a/tools/testing/selftests/bpf/prog_tests/bpf_iter.c
+++ b/tools/testing/selftests/bpf/prog_tests/bpf_iter.c
@@ -150,6 +150,8 @@ static void test_task_stack(void)
do_dummy_read(skel->progs.dump_task_stack);
do_dummy_read(skel->progs.get_task_user_stacks);
+ ASSERT_EQ(skel->bss->num_user_stacks, 1, "num_user_stacks");
+
bpf_iter_task_stack__destroy(skel);
}
--- a/tools/testing/selftests/bpf/progs/bpf_iter_task_stack.c
+++ b/tools/testing/selftests/bpf/progs/bpf_iter_task_stack.c
@@ -35,6 +35,8 @@ int dump_task_stack(struct bpf_iter__tas
return 0;
}
+int num_user_stacks = 0;
+
SEC("iter/task")
int get_task_user_stacks(struct bpf_iter__task *ctx)
{
@@ -51,6 +53,9 @@ int get_task_user_stacks(struct bpf_iter
if (res <= 0)
return 0;
+ /* Only one task, the current one, should succeed */
+ ++num_user_stacks;
+
buf_sz += res;
/* If the verifier doesn't refine bpf_get_task_stack res, and instead
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 244/374] keys, dns: Fix size check of V1 server-list header
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (242 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 243/374] selftests/bpf: Add assert for user stacks in test_task_stack Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 245/374] binder: fix async space check for 0-sized buffers Greg Kroah-Hartman
` (130 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Pengfei Xu, David Howells,
Linus Torvalds, Petr Vorel
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit acc657692aed438e9931438f8c923b2b107aebf9 upstream.
Fix the size check added to dns_resolver_preparse() for the V1 server-list
header so that it doesn't give EINVAL if the size supplied is the same as
the size of the header struct (which should be valid).
This can be tested with:
echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p
which will give "add_key: Invalid argument" without this fix.
Fixes: 1997b3cb4217 ("keys, dns: Fix missing size check of V1 server-list header")
Reported-by: Pengfei Xu <pengfei.xu@intel.com>
Link: https://lore.kernel.org/r/ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Petr Vorel <pvorel@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/dns_resolver/dns_key.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -104,7 +104,7 @@ dns_resolver_preparse(struct key_prepars
const struct dns_server_list_v1_header *v1;
/* It may be a server list. */
- if (datalen <= sizeof(*v1))
+ if (datalen < sizeof(*v1))
return -EINVAL;
v1 = (const struct dns_server_list_v1_header *)data;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 245/374] binder: fix async space check for 0-sized buffers
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (243 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 244/374] keys, dns: Fix size check of V1 server-list header Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 246/374] binder: fix unused alloc->free_async_space Greg Kroah-Hartman
` (129 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Carlos Llamas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 3091c21d3e9322428691ce0b7a0cfa9c0b239eeb upstream.
Move the padding of 0-sized buffers to an earlier stage to account for
this round up during the alloc->free_async_space check.
Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-5-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -407,6 +407,10 @@ static struct binder_buffer *binder_allo
alloc->pid, extra_buffers_size);
return ERR_PTR(-EINVAL);
}
+
+ /* Pad 0-size buffers so they get assigned unique addresses */
+ size = max(size, sizeof(void *));
+
if (is_async &&
alloc->free_async_space < size + sizeof(struct binder_buffer)) {
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
@@ -415,9 +419,6 @@ static struct binder_buffer *binder_allo
return ERR_PTR(-ENOSPC);
}
- /* Pad 0-size buffers so they get assigned unique addresses */
- size = max(size, sizeof(void *));
-
while (n) {
buffer = rb_entry(n, struct binder_buffer, rb_node);
BUG_ON(!buffer->free);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 246/374] binder: fix unused alloc->free_async_space
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (244 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 245/374] binder: fix async space check for 0-sized buffers Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 247/374] Input: atkbd - use ab83 as id when skipping the getid command Greg Kroah-Hartman
` (128 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Llamas, Alice Ryhl
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit c6d05e0762ab276102246d24affd1e116a46aa0c upstream.
Each transaction is associated with a 'struct binder_buffer' that stores
the metadata about its buffer area. Since commit 74310e06be4d ("android:
binder: Move buffer out of area shared with user space") this struct is
no longer embedded within the buffer itself but is instead allocated on
the heap to prevent userspace access to this driver-exclusive info.
Unfortunately, the space of this struct is still being accounted for in
the total buffer size calculation, specifically for async transactions.
This results in an additional 104 bytes added to every async buffer
request, and this area is never used.
This wasted space can be substantial. If we consider the maximum mmap
buffer space of SZ_4M, the driver will reserve half of it for async
transactions, or 0x200000. This area should, in theory, accommodate up
to 262,144 buffers of the minimum 8-byte size. However, after adding
the extra 'sizeof(struct binder_buffer)', the total number of buffers
drops to only 18,724, which is a sad 7.14% of the actual capacity.
This patch fixes the buffer size calculation to enable the utilization
of the entire async buffer space. This is expected to reduce the number
of -ENOSPC errors that are seen on the field.
Fixes: 74310e06be4d ("android: binder: Move buffer out of area shared with user space")
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-6-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 11 ++++-------
1 file changed, 4 insertions(+), 7 deletions(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -344,8 +344,7 @@ static bool debug_low_async_space_locked
continue;
if (!buffer->async_transaction)
continue;
- total_alloc_size += binder_alloc_buffer_size(alloc, buffer)
- + sizeof(struct binder_buffer);
+ total_alloc_size += binder_alloc_buffer_size(alloc, buffer);
num_buffers++;
}
@@ -411,8 +410,7 @@ static struct binder_buffer *binder_allo
/* Pad 0-size buffers so they get assigned unique addresses */
size = max(size, sizeof(void *));
- if (is_async &&
- alloc->free_async_space < size + sizeof(struct binder_buffer)) {
+ if (is_async && alloc->free_async_space < size) {
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC,
"%d: binder_alloc_buf size %zd failed, no async space left\n",
alloc->pid, size);
@@ -520,7 +518,7 @@ static struct binder_buffer *binder_allo
buffer->pid = pid;
buffer->oneway_spam_suspect = false;
if (is_async) {
- alloc->free_async_space -= size + sizeof(struct binder_buffer);
+ alloc->free_async_space -= size;
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
"%d: binder_alloc_buf size %zd async free %zd\n",
alloc->pid, size, alloc->free_async_space);
@@ -658,8 +656,7 @@ static void binder_free_buf_locked(struc
BUG_ON(buffer->user_data > alloc->buffer + alloc->buffer_size);
if (buffer->async_transaction) {
- alloc->free_async_space += buffer_size + sizeof(struct binder_buffer);
-
+ alloc->free_async_space += buffer_size;
binder_alloc_debug(BINDER_DEBUG_BUFFER_ALLOC_ASYNC,
"%d: binder_free_buf size %zd async free %zd\n",
alloc->pid, size, alloc->free_async_space);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 247/374] Input: atkbd - use ab83 as id when skipping the getid command
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (245 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 246/374] binder: fix unused alloc->free_async_space Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 248/374] dma-mapping: Fix build error unused-value Greg Kroah-Hartman
` (127 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Barnabás Pőcze,
Hans de Goede, Dmitry Torokhov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hans de Goede <hdegoede@redhat.com>
commit 58f65f9db7e0de366a5a115c2e2c0703858bba69 upstream.
Barnabás reported that the change to skip the getid command
when the controller is in translated mode on laptops caused
the Version field of his "AT Translated Set 2 keyboard"
input device to change from ab83 to abba, breaking a custom
hwdb entry for this keyboard.
Use the standard ab83 id for keyboards when getid is skipped
(rather then that getid fails) to avoid reporting a different
Version to userspace then before skipping the getid.
Fixes: 936e4d49ecbc ("Input: atkbd - skip ATKBD_CMD_GETID in translated mode")
Reported-by: Barnabás Pőcze <pobrn@protonmail.com>
Closes: https://lore.kernel.org/linux-input/W1ydwoG2fYv85Z3C3yfDOJcVpilEvGge6UGa9kZh8zI2-qkHXp7WLnl2hSkFz63j-c7WupUWI5TLL6n7Lt8DjRuU-yJBwLYWrreb1hbnd6A=@protonmail.com/
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Link: https://lore.kernel.org/r/20240116204325.7719-1-hdegoede@redhat.com
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/keyboard/atkbd.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -782,9 +782,9 @@ static bool atkbd_is_portable_device(voi
* not work. So in this case simply assume a keyboard is connected to avoid
* confusing some laptop keyboards.
*
- * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using a fake id is
- * ok in translated mode, only atkbd_select_set() checks atkbd->id and in
- * translated mode that is a no-op.
+ * Skipping ATKBD_CMD_GETID ends up using a fake keyboard id. Using the standard
+ * 0xab83 id is ok in translated mode, only atkbd_select_set() checks atkbd->id
+ * and in translated mode that is a no-op.
*/
static bool atkbd_skip_getid(struct atkbd *atkbd)
{
@@ -802,6 +802,7 @@ static int atkbd_probe(struct atkbd *atk
{
struct ps2dev *ps2dev = &atkbd->ps2dev;
unsigned char param[2];
+ bool skip_getid;
/*
* Some systems, where the bit-twiddling when testing the io-lines of the
@@ -823,7 +824,8 @@ static int atkbd_probe(struct atkbd *atk
*/
param[0] = param[1] = 0xa5; /* initialize with invalid values */
- if (atkbd_skip_getid(atkbd) || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
+ skip_getid = atkbd_skip_getid(atkbd);
+ if (skip_getid || ps2_command(ps2dev, param, ATKBD_CMD_GETID)) {
/*
* If the get ID command was skipped or failed, we check if we can at least set
@@ -833,7 +835,7 @@ static int atkbd_probe(struct atkbd *atk
param[0] = 0;
if (ps2_command(ps2dev, param, ATKBD_CMD_SETLEDS))
return -1;
- atkbd->id = 0xabba;
+ atkbd->id = skip_getid ? 0xab83 : 0xabba;
return 0;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 248/374] dma-mapping: Fix build error unused-value
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (246 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 247/374] Input: atkbd - use ab83 as id when skipping the getid command Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 249/374] virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() Greg Kroah-Hartman
` (126 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hulk Robot, Ren Zhijie,
Christoph Hellwig, Mathieu Poirier
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ren Zhijie <renzhijie2@huawei.com>
commit 50d6281ce9b8412f7ef02d1bc9d23aa62ae0cf98 upstream.
If CONFIG_DMA_DECLARE_COHERENT is not set,
make ARCH=x86_64 CROSS_COMPILE=x86_64-linux-gnu- will be failed, like this:
drivers/remoteproc/remoteproc_core.c: In function ‘rproc_rvdev_release’:
./include/linux/dma-map-ops.h:182:42: error: statement with no effect [-Werror=unused-value]
#define dma_release_coherent_memory(dev) (0)
^
drivers/remoteproc/remoteproc_core.c:464:2: note: in expansion of macro ‘dma_release_coherent_memory’
dma_release_coherent_memory(dev);
^~~~~~~~~~~~~~~~~~~~~~~~~~~
cc1: all warnings being treated as errors
The return type of function dma_release_coherent_memory in CONFIG_DMA_DECLARE_COHERENT area is void, so in !CONFIG_DMA_DECLARE_COHERENT area it should neither return any value nor be defined as zero.
Reported-by: Hulk Robot <hulkci@huawei.com>
Fixes: e61c451476e6 ("dma-mapping: Add dma_release_coherent_memory to DMA API")
Signed-off-by: Ren Zhijie <renzhijie2@huawei.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20220630123528.251181-1-renzhijie2@huawei.com
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/dma-map-ops.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/include/linux/dma-map-ops.h
+++ b/include/linux/dma-map-ops.h
@@ -179,10 +179,10 @@ static inline int dma_declare_coherent_m
return -ENOSYS;
}
-#define dma_release_coherent_memory(dev) (0)
#define dma_alloc_from_dev_coherent(dev, size, handle, ret) (0)
#define dma_release_from_dev_coherent(dev, order, vaddr) (0)
#define dma_mmap_from_dev_coherent(dev, vma, vaddr, order, ret) (0)
+static inline void dma_release_coherent_memory(struct device *dev) { }
#endif /* CONFIG_DMA_DECLARE_COHERENT */
#ifdef CONFIG_DMA_GLOBAL_POOL
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 249/374] virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (247 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 248/374] dma-mapping: Fix build error unused-value Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 250/374] xen-netback: dont produce zero-size SKB frags Greg Kroah-Hartman
` (125 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yongjun, Michael S. Tsirkin,
Gonglei, zhenwei pi, Jason Wang
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <weiyongjun1@huawei.com>
commit b1d65f717cd6305a396a8738e022c6f7c65cfbe8 upstream.
'vc_ctrl_req' is alloced in virtio_crypto_alg_skcipher_close_session(),
and should be freed in the invalid ctrl_status->status error handling
case. Otherwise there is a memory leak.
Fixes: 0756ad15b1fe ("virtio-crypto: use private buffer for control request")
Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
Message-Id: <20221114110740.537276-1-weiyongjun@huaweicloud.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Gonglei <arei.gonglei@huawei.com>
Acked-by: zhenwei pi<pizhenwei@bytedance.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/crypto/virtio/virtio_crypto_algs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/crypto/virtio/virtio_crypto_algs.c
+++ b/drivers/crypto/virtio/virtio_crypto_algs.c
@@ -255,7 +255,7 @@ static int virtio_crypto_alg_skcipher_cl
vcrypto->ctrl_status.status,
destroy_session->session_id);
- return -EINVAL;
+ err = -EINVAL;
}
spin_unlock(&vcrypto->ctrl_lock);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 250/374] xen-netback: dont produce zero-size SKB frags
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (248 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 249/374] virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 251/374] binder: fix race between mmput() and do_exit() Greg Kroah-Hartman
` (124 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Beulich, Juergen Gross,
Paul Durrant
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <jbeulich@suse.com>
commit c7ec4f2d684e17d69bbdd7c4324db0ef5daac26a upstream.
While frontends may submit zero-size requests (wasting a precious slot),
core networking code as of at least 3ece782693c4b ("sock: skb_copy_ubufs
support for compound pages") can't deal with SKBs when they have all
zero-size fragments. Respond to empty requests right when populating
fragments; all further processing is fragment based and hence won't
encounter these empty requests anymore.
In a way this should have been that way from the beginning: When no data
is to be transferred for a particular request, there's not even a point
in validating the respective grant ref. That's no different from e.g.
passing NULL into memcpy() when at the same time the size is 0.
This is XSA-448 / CVE-2023-46838.
Cc: stable@vger.kernel.org
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Paul Durrant <paul@xen.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/xen-netback/netback.c | 44 ++++++++++++++++++++++++++++++++------
1 file changed, 38 insertions(+), 6 deletions(-)
--- a/drivers/net/xen-netback/netback.c
+++ b/drivers/net/xen-netback/netback.c
@@ -463,12 +463,25 @@ static void xenvif_get_requests(struct x
}
for (shinfo->nr_frags = 0; nr_slots > 0 && shinfo->nr_frags < MAX_SKB_FRAGS;
- shinfo->nr_frags++, gop++, nr_slots--) {
+ nr_slots--) {
+ if (unlikely(!txp->size)) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&queue->response_lock, flags);
+ make_tx_response(queue, txp, 0, XEN_NETIF_RSP_OKAY);
+ push_tx_responses(queue);
+ spin_unlock_irqrestore(&queue->response_lock, flags);
+ ++txp;
+ continue;
+ }
+
index = pending_index(queue->pending_cons++);
pending_idx = queue->pending_ring[index];
xenvif_tx_create_map_op(queue, pending_idx, txp,
txp == first ? extra_count : 0, gop);
frag_set_pending_idx(&frags[shinfo->nr_frags], pending_idx);
+ ++shinfo->nr_frags;
+ ++gop;
if (txp == first)
txp = txfrags;
@@ -481,20 +494,39 @@ static void xenvif_get_requests(struct x
shinfo = skb_shinfo(nskb);
frags = shinfo->frags;
- for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots;
- shinfo->nr_frags++, txp++, gop++) {
+ for (shinfo->nr_frags = 0; shinfo->nr_frags < nr_slots; ++txp) {
+ if (unlikely(!txp->size)) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&queue->response_lock, flags);
+ make_tx_response(queue, txp, 0,
+ XEN_NETIF_RSP_OKAY);
+ push_tx_responses(queue);
+ spin_unlock_irqrestore(&queue->response_lock,
+ flags);
+ continue;
+ }
+
index = pending_index(queue->pending_cons++);
pending_idx = queue->pending_ring[index];
xenvif_tx_create_map_op(queue, pending_idx, txp, 0,
gop);
frag_set_pending_idx(&frags[shinfo->nr_frags],
pending_idx);
+ ++shinfo->nr_frags;
+ ++gop;
}
- skb_shinfo(skb)->frag_list = nskb;
- } else if (nskb) {
+ if (shinfo->nr_frags) {
+ skb_shinfo(skb)->frag_list = nskb;
+ nskb = NULL;
+ }
+ }
+
+ if (nskb) {
/* A frag_list skb was allocated but it is no longer needed
- * because enough slots were converted to copy ops above.
+ * because enough slots were converted to copy ops above or some
+ * were empty.
*/
kfree_skb(nskb);
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 251/374] binder: fix race between mmput() and do_exit()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (249 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 250/374] xen-netback: dont produce zero-size SKB frags Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 252/374] tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug Greg Kroah-Hartman
` (123 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Carlos Llamas
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 9a9ab0d963621d9d12199df9817e66982582d5a5 upstream.
Task A calls binder_update_page_range() to allocate and insert pages on
a remote address space from Task B. For this, Task A pins the remote mm
via mmget_not_zero() first. This can race with Task B do_exit() and the
final mmput() refcount decrement will come from Task A.
Task A | Task B
------------------+------------------
mmget_not_zero() |
| do_exit()
| exit_mm()
| mmput()
mmput() |
exit_mmap() |
remove_vma() |
fput() |
In this case, the work of ____fput() from Task B is queued up in Task A
as TWA_RESUME. So in theory, Task A returns to userspace and the cleanup
work gets executed. However, Task A instead sleep, waiting for a reply
from Task B that never comes (it's dead).
This means the binder_deferred_release() is blocked until an unrelated
binder event forces Task A to go back to userspace. All the associated
death notifications will also be delayed until then.
In order to fix this use mmput_async() that will schedule the work in
the corresponding mm->async_put_work WQ instead of Task A.
Fixes: 457b9a6f09f0 ("Staging: android: add binder driver")
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20231201172212.1813387-4-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder_alloc.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/android/binder_alloc.c
+++ b/drivers/android/binder_alloc.c
@@ -271,7 +271,7 @@ static int binder_update_page_range(stru
}
if (mm) {
mmap_write_unlock(mm);
- mmput(mm);
+ mmput_async(mm);
}
return 0;
@@ -304,7 +304,7 @@ err_page_ptr_cleared:
err_no_vma:
if (mm) {
mmap_write_unlock(mm);
- mmput(mm);
+ mmput_async(mm);
}
return vma ? -ENOMEM : -ESRCH;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 252/374] tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (250 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 251/374] binder: fix race between mmput() and do_exit() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 253/374] usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() Greg Kroah-Hartman
` (122 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Gerald Schaefer, Heiko Carstens,
Thomas Gleixner, Frederic Weisbecker
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit 71fee48fb772ac4f6cfa63dbebc5629de8b4cc09 upstream.
When offlining and onlining CPUs the overall reported idle and iowait
times as reported by /proc/stat jump backward and forward:
cpu 132 0 176 225249 47 6 6 21 0 0
cpu0 80 0 115 112575 33 3 4 18 0 0
cpu1 52 0 60 112673 13 3 1 2 0 0
cpu 133 0 177 226681 47 6 6 21 0 0
cpu0 80 0 116 113387 33 3 4 18 0 0
cpu 133 0 178 114431 33 6 6 21 0 0 <---- jump backward
cpu0 80 0 116 114247 33 3 4 18 0 0
cpu1 52 0 61 183 0 3 1 2 0 0 <---- idle + iowait start with 0
cpu 133 0 178 228956 47 6 6 21 0 0 <---- jump forward
cpu0 81 0 117 114929 33 3 4 18 0 0
Reason for this is that get_idle_time() in fs/proc/stat.c has different
sources for both values depending on if a CPU is online or offline:
- if a CPU is online the values may be taken from its per cpu
tick_cpu_sched structure
- if a CPU is offline the values are taken from its per cpu cpustat
structure
The problem is that the per cpu tick_cpu_sched structure is set to zero on
CPU offline. See tick_cancel_sched_timer() in kernel/time/tick-sched.c.
Therefore when a CPU is brought offline and online afterwards both its idle
and iowait sleeptime will be zero, causing a jump backward in total system
idle and iowait sleeptime. In a similar way if a CPU is then brought
offline again the total idle and iowait sleeptimes will jump forward.
It looks like this behavior was introduced with commit 4b0c0f294f60
("tick: Cleanup NOHZ per cpu data on cpu down").
This was only noticed now on s390, since we switched to generic idle time
reporting with commit be76ea614460 ("s390/idle: remove arch_cpu_idle_time()
and corresponding code").
Fix this by preserving the values of idle_sleeptime and iowait_sleeptime
members of the per-cpu tick_sched structure on CPU hotplug.
Fixes: 4b0c0f294f60 ("tick: Cleanup NOHZ per cpu data on cpu down")
Reported-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Reviewed-by: Frederic Weisbecker <frederic@kernel.org>
Link: https://lore.kernel.org/r/20240115163555.1004144-1-hca@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/tick-sched.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/kernel/time/tick-sched.c
+++ b/kernel/time/tick-sched.c
@@ -1528,13 +1528,18 @@ void tick_setup_sched_timer(void)
void tick_cancel_sched_timer(int cpu)
{
struct tick_sched *ts = &per_cpu(tick_cpu_sched, cpu);
+ ktime_t idle_sleeptime, iowait_sleeptime;
# ifdef CONFIG_HIGH_RES_TIMERS
if (ts->sched_timer.base)
hrtimer_cancel(&ts->sched_timer);
# endif
+ idle_sleeptime = ts->idle_sleeptime;
+ iowait_sleeptime = ts->iowait_sleeptime;
memset(ts, 0, sizeof(*ts));
+ ts->idle_sleeptime = idle_sleeptime;
+ ts->iowait_sleeptime = iowait_sleeptime;
}
#endif
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 253/374] usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (251 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 252/374] tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 254/374] usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Greg Kroah-Hartman
` (121 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Chen, Xu Yang
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit ff2b89de471da942a4d853443688113a44fd35ed upstream.
When CONFIG_USB_OTG is not set, mxs_phy_is_otg_host() will always return
false. This behaviour is wrong. Since phy.last_event will always be set
for either host or device mode. Therefore, CONFIG_USB_OTG condition
can be removed.
Fixes: 5eda42aebb76 ("usb: phy: mxs: fix getting wrong state with mxs_phy_is_otg_host()")
cc: <stable@vger.kernel.org>
Acked-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Link: https://lore.kernel.org/r/20231228110753.1755756-3-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/phy/phy-mxs-usb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/usb/phy/phy-mxs-usb.c
+++ b/drivers/usb/phy/phy-mxs-usb.c
@@ -388,8 +388,7 @@ static void __mxs_phy_disconnect_line(st
static bool mxs_phy_is_otg_host(struct mxs_phy *mxs_phy)
{
- return IS_ENABLED(CONFIG_USB_OTG) &&
- mxs_phy->phy.last_event == USB_EVENT_ID;
+ return mxs_phy->phy.last_event == USB_EVENT_ID;
}
static void mxs_phy_disconnect_line(struct mxs_phy *mxs_phy, bool on)
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 254/374] usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (252 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 253/374] usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 255/374] Revert "usb: dwc3: Soft reset phy on probe for host" Greg Kroah-Hartman
` (120 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Uttkarsh Aggarwal
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
commit e9d40b215e38480fd94c66b06d79045717a59e9c upstream.
Current implementation blocks the running operations when Plug-out and
Plug-In is performed continuously, process gets stuck in
dwc3_thread_interrupt().
Code Flow:
CPU1
->Gadget_start
->dwc3_interrupt
->dwc3_thread_interrupt
->dwc3_process_event_buf
->dwc3_process_event_entry
->dwc3_endpoint_interrupt
->dwc3_ep0_interrupt
->dwc3_ep0_inspect_setup
->dwc3_ep0_stall_and_restart
By this time if pending_list is not empty, it will get the next request
on the given list and calls dwc3_gadget_giveback which will unmap request
and call its complete() callback to notify upper layers that it has
completed. Currently dwc3_gadget_giveback status is set to -ECONNRESET,
whereas it should be -ESHUTDOWN based on condition if not dwc->connected
is true.
Cc: <stable@vger.kernel.org>
Fixes: d742220b3577 ("usb: dwc3: ep0: giveback requests on stall_and_restart")
Signed-off-by: Uttkarsh Aggarwal <quic_uaggarwa@quicinc.com>
Link: https://lore.kernel.org/r/20231222094704.20276-1-quic_uaggarwa@quicinc.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/ep0.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/usb/dwc3/ep0.c
+++ b/drivers/usb/dwc3/ep0.c
@@ -236,7 +236,10 @@ static void dwc3_ep0_stall_and_restart(s
struct dwc3_request *req;
req = next_request(&dep->pending_list);
- dwc3_gadget_giveback(dep, req, -ECONNRESET);
+ if (!dwc->connected)
+ dwc3_gadget_giveback(dep, req, -ESHUTDOWN);
+ else
+ dwc3_gadget_giveback(dep, req, -ECONNRESET);
}
dwc->ep0state = EP0_SETUP_PHASE;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 255/374] Revert "usb: dwc3: Soft reset phy on probe for host"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (253 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 254/374] usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 256/374] Revert "usb: dwc3: dont reset device side if dwc3 was configured as host-only" Greg Kroah-Hartman
` (119 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Köry Maincent, Thinh Nguyen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 7059fbebcb00554c3f31e5b5d93ef6d2d96dc7b4 upstream.
This reverts commit 8bea147dfdf823eaa8d3baeccc7aeb041b41944b.
The phy soft reset GUSB2PHYCFG.PHYSOFTRST only applies to UTMI phy, not
ULPI. This fix is incomplete.
Cc: <stable@vger.kernel.org>
Fixes: 8bea147dfdf8 ("usb: dwc3: Soft reset phy on probe for host")
Reported-by: Köry Maincent <kory.maincent@bootlin.com>
Closes: https://lore.kernel.org/linux-usb/20231205151959.5236c231@kmaincent-XPS-13-7390
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/29a26593a60eba727de872a3e580a674807b3339.1703282469.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 39 +--------------------------------------
1 file changed, 1 insertion(+), 38 deletions(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -277,46 +277,9 @@ int dwc3_core_soft_reset(struct dwc3 *dw
* XHCI driver will reset the host block. If dwc3 was configured for
* host-only mode or current role is host, then we can return early.
*/
- if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
+ if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
return 0;
- /*
- * If the dr_mode is host and the dwc->current_dr_role is not the
- * corresponding DWC3_GCTL_PRTCAP_HOST, then the dwc3_core_init_mode
- * isn't executed yet. Ensure the phy is ready before the controller
- * updates the GCTL.PRTCAPDIR or other settings by soft-resetting
- * the phy.
- *
- * Note: GUSB3PIPECTL[n] and GUSB2PHYCFG[n] are port settings where n
- * is port index. If this is a multiport host, then we need to reset
- * all active ports.
- */
- if (dwc->dr_mode == USB_DR_MODE_HOST) {
- u32 usb3_port;
- u32 usb2_port;
-
- usb3_port = dwc3_readl(dwc->regs, DWC3_GUSB3PIPECTL(0));
- usb3_port |= DWC3_GUSB3PIPECTL_PHYSOFTRST;
- dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port);
-
- usb2_port = dwc3_readl(dwc->regs, DWC3_GUSB2PHYCFG(0));
- usb2_port |= DWC3_GUSB2PHYCFG_PHYSOFTRST;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port);
-
- /* Small delay for phy reset assertion */
- usleep_range(1000, 2000);
-
- usb3_port &= ~DWC3_GUSB3PIPECTL_PHYSOFTRST;
- dwc3_writel(dwc->regs, DWC3_GUSB3PIPECTL(0), usb3_port);
-
- usb2_port &= ~DWC3_GUSB2PHYCFG_PHYSOFTRST;
- dwc3_writel(dwc->regs, DWC3_GUSB2PHYCFG(0), usb2_port);
-
- /* Wait for clock synchronization */
- msleep(50);
- return 0;
- }
-
reg = dwc3_readl(dwc->regs, DWC3_DCTL);
reg |= DWC3_DCTL_CSFTRST;
reg &= ~DWC3_DCTL_RUN_STOP;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 256/374] Revert "usb: dwc3: dont reset device side if dwc3 was configured as host-only"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (254 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 255/374] Revert "usb: dwc3: Soft reset phy on probe for host" Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 257/374] usb: chipidea: wait controller resume finished for wakeup irq Greg Kroah-Hartman
` (118 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Thinh Nguyen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit afe28cd686aeb77e8d9140d50fb1cf06a7ecb731 upstream.
This reverts commit e835c0a4e23c38531dcee5ef77e8d1cf462658c7.
Don't omit soft-reset. During initialization, the driver may need to
perform a soft reset to ensure the phy is ready when the controller
updates the GCTL.PRTCAPDIR or other settings by issuing phy soft-reset.
Many platforms often have access to DCTL register for soft-reset despite
being host-only. If there are actual reported issues from the platforms
that don't expose DCTL registers, then we will need to revisit (perhaps
to teach dwc3 to perform xhci's soft-reset USBCMD.HCRST).
Cc: <stable@vger.kernel.org>
Fixes: e835c0a4e23c ("usb: dwc3: don't reset device side if dwc3 was configured as host-only")
Signed-off-by: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
Link: https://lore.kernel.org/r/7668ab11a48f260820825274976eb41fec7f54d1.1703282469.git.Thinh.Nguyen@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/dwc3/core.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/usb/dwc3/core.c
+++ b/drivers/usb/dwc3/core.c
@@ -275,9 +275,9 @@ int dwc3_core_soft_reset(struct dwc3 *dw
/*
* We're resetting only the device side because, if we're in host mode,
* XHCI driver will reset the host block. If dwc3 was configured for
- * host-only mode or current role is host, then we can return early.
+ * host-only mode, then we can return early.
*/
- if (dwc->dr_mode == USB_DR_MODE_HOST || dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
+ if (dwc->current_dr_role == DWC3_GCTL_PRTCAP_HOST)
return 0;
reg = dwc3_readl(dwc->regs, DWC3_DCTL);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 257/374] usb: chipidea: wait controller resume finished for wakeup irq
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (255 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 256/374] Revert "usb: dwc3: dont reset device side if dwc3 was configured as host-only" Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 258/374] usb: cdns3: fix uvc failure work since sg support enabled Greg Kroah-Hartman
` (117 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Peter Chen, Xu Yang, Li Jun
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit 128d849074d05545becf86e713715ce7676fc074 upstream.
After the chipidea driver introduce extcon for id and vbus, it's able
to wakeup from another irq source, in case the system with extcon ID
cable, wakeup from usb ID cable and device removal, the usb device
disconnect irq may come firstly before the extcon notifier while system
resume, so we will get 2 "wakeup" irq, one for usb device disconnect;
and one for extcon ID cable change(real wakeup event), current driver
treat them as 2 successive wakeup irq so can't handle it correctly, then
finally the usb irq can't be enabled. This patch adds a check to bypass
further usb events before controller resume finished to fix it.
Fixes: 1f874edcb731 ("usb: chipidea: add runtime power management support")
cc: <stable@vger.kernel.org>
Acked-by: Peter Chen <peter.chen@kernel.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Signed-off-by: Li Jun <jun.li@nxp.com>
Link: https://lore.kernel.org/r/20231228110753.1755756-2-xu.yang_2@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/chipidea/core.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/chipidea/core.c
+++ b/drivers/usb/chipidea/core.c
@@ -521,6 +521,13 @@ static irqreturn_t ci_irq_handler(int ir
u32 otgsc = 0;
if (ci->in_lpm) {
+ /*
+ * If we already have a wakeup irq pending there,
+ * let's just return to wait resume finished firstly.
+ */
+ if (ci->wakeup_int)
+ return IRQ_HANDLED;
+
disable_irq_nosync(irq);
ci->wakeup_int = true;
pm_runtime_get(ci->dev);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 258/374] usb: cdns3: fix uvc failure work since sg support enabled
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (256 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 257/374] usb: chipidea: wait controller resume finished for wakeup irq Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 259/374] usb: cdns3: fix iso transfer error when mult is not zero Greg Kroah-Hartman
` (116 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 1b8be5ecff26201bafb0a554c74e91571299fb94 upstream.
When IP version >= DEV_VER_V2, gadget:sg_supported is true. So uvc gadget
function driver will use sg to equeue data, first is 8bytes header, the
second is 1016bytes data.
cdns3_prepare_trb: ep2in: trb 0000000000ac755f, dma buf: 0xbf455000, size: 8, burst: 128 ctrl: 0x00000415 (C=1, T=0, ISP, CHAIN, Normal)
cdns3_prepare_trb: ep2in: trb 00000000a574e693, dma buf: 0xc0200fe0, size: 1016, burst: 128 ctrl: 0x00000405 (C=1, T=0, ISP, Normal)
But cdns3_ep_run_transfer() can't correctly handle this case, which only
support one TRB for ISO transfer.
The controller requires duplicate the TD for each SOF if priv_ep->interval
is not 1. DMA will read data from DDR to internal FIFO when get SOF. Send
data to bus when receive IN token. DMA always refill FIFO when get SOF
regardless host send IN token or not. If host send IN token later, some
frames data will be lost.
Fixed it by below major steps:
1. Calculate numembers of TRB base on sg_nums and priv_ep->interval.
2. Remove CHAIN flags for each end TRB of TD when duplicate TD.
3. The controller requires LINK TRB must be first TRB of TD. When check
there are not enough TRBs lefts, just fill LINK TRB for left TRBs.
.... CHAIN_TRB DATA_TRB, CHAIN_TRB DATA_TRB, LINK_TRB ... LINK_TRB
^End of TRB List
Cc: <stable@vger.kernel.org>
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20231224153816.1664687-2-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 51 ++++++++++++++++++++++++++++++---------
1 file changed, 40 insertions(+), 11 deletions(-)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -1117,6 +1117,7 @@ static int cdns3_ep_run_transfer(struct
dma_addr_t trb_dma;
u32 togle_pcs = 1;
int sg_iter = 0;
+ int num_trb_req;
int num_trb;
int address;
u32 control;
@@ -1125,15 +1126,13 @@ static int cdns3_ep_run_transfer(struct
struct scatterlist *s = NULL;
bool sg_supported = !!(request->num_mapped_sgs);
+ num_trb_req = sg_supported ? request->num_mapped_sgs : 1;
+
+ /* ISO transfer require each SOF have a TD, each TD include some TRBs */
if (priv_ep->type == USB_ENDPOINT_XFER_ISOC)
- num_trb = priv_ep->interval;
+ num_trb = priv_ep->interval * num_trb_req;
else
- num_trb = sg_supported ? request->num_mapped_sgs : 1;
-
- if (num_trb > priv_ep->free_trbs) {
- priv_ep->flags |= EP_RING_FULL;
- return -ENOBUFS;
- }
+ num_trb = num_trb_req;
priv_req = to_cdns3_request(request);
address = priv_ep->endpoint.desc->bEndpointAddress;
@@ -1182,14 +1181,31 @@ static int cdns3_ep_run_transfer(struct
link_trb->control = cpu_to_le32(((priv_ep->pcs) ? TRB_CYCLE : 0) |
TRB_TYPE(TRB_LINK) | TRB_TOGGLE | ch_bit);
+
+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) {
+ /*
+ * ISO require LINK TRB must be first one of TD.
+ * Fill LINK TRBs for left trb space to simply software process logic.
+ */
+ while (priv_ep->enqueue) {
+ *trb = *link_trb;
+ trace_cdns3_prepare_trb(priv_ep, trb);
+
+ cdns3_ep_inc_enq(priv_ep);
+ trb = priv_ep->trb_pool + priv_ep->enqueue;
+ priv_req->trb = trb;
+ }
+ }
+ }
+
+ if (num_trb > priv_ep->free_trbs) {
+ priv_ep->flags |= EP_RING_FULL;
+ return -ENOBUFS;
}
if (priv_dev->dev_ver <= DEV_VER_V2)
togle_pcs = cdns3_wa1_update_guard(priv_ep, trb);
- if (sg_supported)
- s = request->sg;
-
/* set incorrect Cycle Bit for first trb*/
control = priv_ep->pcs ? 0 : TRB_CYCLE;
trb->length = 0;
@@ -1207,6 +1223,9 @@ static int cdns3_ep_run_transfer(struct
do {
u32 length;
+ if (!(sg_iter % num_trb_req) && sg_supported)
+ s = request->sg;
+
/* fill TRB */
control |= TRB_TYPE(TRB_NORMAL);
if (sg_supported) {
@@ -1248,7 +1267,7 @@ static int cdns3_ep_run_transfer(struct
if (sg_supported) {
trb->control |= cpu_to_le32(TRB_ISP);
/* Don't set chain bit for last TRB */
- if (sg_iter < num_trb - 1)
+ if ((sg_iter % num_trb_req) < num_trb_req - 1)
trb->control |= cpu_to_le32(TRB_CHAIN);
s = sg_next(s);
@@ -1506,6 +1525,12 @@ static void cdns3_transfer_completed(str
/* The TRB was changed as link TRB, and the request was handled at ep_dequeue */
while (TRB_FIELD_TO_TYPE(le32_to_cpu(trb->control)) == TRB_LINK) {
+
+ /* ISO ep_traddr may stop at LINK TRB */
+ if (priv_ep->dequeue == cdns3_get_dma_pos(priv_dev, priv_ep) &&
+ priv_ep->type == USB_ENDPOINT_XFER_ISOC)
+ break;
+
trace_cdns3_complete_trb(priv_ep, trb);
cdns3_ep_inc_deq(priv_ep);
trb = priv_ep->trb_pool + priv_ep->dequeue;
@@ -1538,6 +1563,10 @@ static void cdns3_transfer_completed(str
}
if (request_handled) {
+ /* TRBs are duplicated by priv_ep->interval time for ISO IN */
+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC && priv_ep->dir)
+ request->actual /= priv_ep->interval;
+
cdns3_gadget_giveback(priv_ep, priv_req, 0);
request_handled = false;
transfer_end = false;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 259/374] usb: cdns3: fix iso transfer error when mult is not zero
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (257 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 258/374] usb: cdns3: fix uvc failure work since sg support enabled Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 260/374] usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled Greg Kroah-Hartman
` (115 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 92f02efa1d86d7dcaef7f38a5fe3396c4e88a93c upstream.
ISO basic transfer is
ITP(SOF) Package_0 Package_1 ... Package_n
CDNS3 DMA start dma transfer from memmory to internal FIFO when get SOF,
controller will transfer data to usb bus from internal FIFO when get IN
token.
According USB spec defination:
Maximum number of packets = (bMaxBurst + 1) * (Mult + 1)
Internal memory should be the same as (bMaxBurst + 1) * (Mult + 1). DMA
don't fetch data advance when ISO transfer, so only reserve
(bMaxBurst + 1) * (Mult + 1) internal memory for ISO transfer.
Need save Mult and bMaxBurst information and set it into EP_CFG register,
otherwise only 1 package is sent by controller, other package will be
lost.
Cc: <stable@vger.kernel.org>
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20231224153816.1664687-3-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 59 +++++++++++++++++++++++----------------
drivers/usb/cdns3/cdns3-gadget.h | 3 +
2 files changed, 39 insertions(+), 23 deletions(-)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -2062,11 +2062,10 @@ int cdns3_ep_config(struct cdns3_endpoin
bool is_iso_ep = (priv_ep->type == USB_ENDPOINT_XFER_ISOC);
struct cdns3_device *priv_dev = priv_ep->cdns3_dev;
u32 bEndpointAddress = priv_ep->num | priv_ep->dir;
- u32 max_packet_size = 0;
- u8 maxburst = 0;
+ u32 max_packet_size = priv_ep->wMaxPacketSize;
+ u8 maxburst = priv_ep->bMaxBurst;
u32 ep_cfg = 0;
u8 buffering;
- u8 mult = 0;
int ret;
buffering = priv_dev->ep_buf_size - 1;
@@ -2088,8 +2087,7 @@ int cdns3_ep_config(struct cdns3_endpoin
break;
default:
ep_cfg = EP_CFG_EPTYPE(USB_ENDPOINT_XFER_ISOC);
- mult = priv_dev->ep_iso_burst - 1;
- buffering = mult + 1;
+ buffering = (priv_ep->bMaxBurst + 1) * (priv_ep->mult + 1) - 1;
}
switch (priv_dev->gadget.speed) {
@@ -2100,17 +2098,8 @@ int cdns3_ep_config(struct cdns3_endpoin
max_packet_size = is_iso_ep ? 1024 : 512;
break;
case USB_SPEED_SUPER:
- /* It's limitation that driver assumes in driver. */
- mult = 0;
- max_packet_size = 1024;
- if (priv_ep->type == USB_ENDPOINT_XFER_ISOC) {
- maxburst = priv_dev->ep_iso_burst - 1;
- buffering = (mult + 1) *
- (maxburst + 1);
-
- if (priv_ep->interval > 1)
- buffering++;
- } else {
+ if (priv_ep->type != USB_ENDPOINT_XFER_ISOC) {
+ max_packet_size = 1024;
maxburst = priv_dev->ep_buf_size - 1;
}
break;
@@ -2139,7 +2128,6 @@ int cdns3_ep_config(struct cdns3_endpoin
if (priv_dev->dev_ver < DEV_VER_V2)
priv_ep->trb_burst_size = 16;
- mult = min_t(u8, mult, EP_CFG_MULT_MAX);
buffering = min_t(u8, buffering, EP_CFG_BUFFERING_MAX);
maxburst = min_t(u8, maxburst, EP_CFG_MAXBURST_MAX);
@@ -2173,7 +2161,7 @@ int cdns3_ep_config(struct cdns3_endpoin
}
ep_cfg |= EP_CFG_MAXPKTSIZE(max_packet_size) |
- EP_CFG_MULT(mult) |
+ EP_CFG_MULT(priv_ep->mult) | /* must match EP setting */
EP_CFG_BUFFERING(buffering) |
EP_CFG_MAXBURST(maxburst);
@@ -2263,6 +2251,13 @@ usb_ep *cdns3_gadget_match_ep(struct usb
priv_ep->type = usb_endpoint_type(desc);
priv_ep->flags |= EP_CLAIMED;
priv_ep->interval = desc->bInterval ? BIT(desc->bInterval - 1) : 0;
+ priv_ep->wMaxPacketSize = usb_endpoint_maxp(desc);
+ priv_ep->mult = USB_EP_MAXP_MULT(priv_ep->wMaxPacketSize);
+ priv_ep->wMaxPacketSize &= USB_ENDPOINT_MAXP_MASK;
+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC && comp_desc) {
+ priv_ep->mult = USB_SS_MULT(comp_desc->bmAttributes) - 1;
+ priv_ep->bMaxBurst = comp_desc->bMaxBurst;
+ }
spin_unlock_irqrestore(&priv_dev->lock, flags);
return &priv_ep->endpoint;
@@ -3044,22 +3039,40 @@ static int cdns3_gadget_check_config(str
struct cdns3_endpoint *priv_ep;
struct usb_ep *ep;
int n_in = 0;
+ int iso = 0;
+ int out = 1;
int total;
+ int n;
list_for_each_entry(ep, &gadget->ep_list, ep_list) {
priv_ep = ep_to_cdns3_ep(ep);
- if ((priv_ep->flags & EP_CLAIMED) && (ep->address & USB_DIR_IN))
- n_in++;
+ if (!(priv_ep->flags & EP_CLAIMED))
+ continue;
+
+ n = (priv_ep->mult + 1) * (priv_ep->bMaxBurst + 1);
+ if (ep->address & USB_DIR_IN) {
+ /*
+ * ISO transfer: DMA start move data when get ISO, only transfer
+ * data as min(TD size, iso). No benefit for allocate bigger
+ * internal memory than 'iso'.
+ */
+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC)
+ iso += n;
+ else
+ n_in++;
+ } else {
+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC)
+ out = max_t(int, out, n);
+ }
}
/* 2KB are reserved for EP0, 1KB for out*/
- total = 2 + n_in + 1;
+ total = 2 + n_in + out + iso;
if (total > priv_dev->onchip_buffers)
return -ENOMEM;
- priv_dev->ep_buf_size = priv_dev->ep_iso_burst =
- (priv_dev->onchip_buffers - 2) / (n_in + 1);
+ priv_dev->ep_buf_size = (priv_dev->onchip_buffers - 2 - iso) / (n_in + out);
return 0;
}
--- a/drivers/usb/cdns3/cdns3-gadget.h
+++ b/drivers/usb/cdns3/cdns3-gadget.h
@@ -1168,6 +1168,9 @@ struct cdns3_endpoint {
u8 dir;
u8 num;
u8 type;
+ u8 mult;
+ u8 bMaxBurst;
+ u16 wMaxPacketSize;
int interval;
int free_trbs;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 260/374] usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (258 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 259/374] usb: cdns3: fix iso transfer error when mult is not zero Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 261/374] Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" Greg Kroah-Hartman
` (114 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Frank Li
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 40c304109e866a7dc123661a5c8ca72f6b5e14e0 upstream.
Supposed DMA cross 4k bounder problem should be fixed at DEV_VER_V2, but
still met problem when do ISO transfer if sg enabled.
Data pattern likes below when sg enabled, package size is 1k and mult is 2
[UVC Header(8B) ] [data(3k - 8)] ...
The received data at offset 0xd000 will get 0xc000 data, len 0x70. Error
happen position as below pattern:
0xd000: wrong
0xe000: wrong
0xf000: correct
0x10000: wrong
0x11000: wrong
0x12000: correct
...
To avoid DMA cross 4k bounder at ISO transfer, reduce burst len according
to start DMA address's alignment.
Cc: <stable@vger.kernel.org>
Fixes: 7733f6c32e36 ("usb: cdns3: Add Cadence USB3 DRD Driver")
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20231224153816.1664687-4-Frank.Li@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/cdns3/cdns3-gadget.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
--- a/drivers/usb/cdns3/cdns3-gadget.c
+++ b/drivers/usb/cdns3/cdns3-gadget.c
@@ -1118,6 +1118,7 @@ static int cdns3_ep_run_transfer(struct
u32 togle_pcs = 1;
int sg_iter = 0;
int num_trb_req;
+ int trb_burst;
int num_trb;
int address;
u32 control;
@@ -1240,7 +1241,36 @@ static int cdns3_ep_run_transfer(struct
total_tdl += DIV_ROUND_UP(length,
priv_ep->endpoint.maxpacket);
- trb->length |= cpu_to_le32(TRB_BURST_LEN(priv_ep->trb_burst_size) |
+ trb_burst = priv_ep->trb_burst_size;
+
+ /*
+ * Supposed DMA cross 4k bounder problem should be fixed at DEV_VER_V2, but still
+ * met problem when do ISO transfer if sg enabled.
+ *
+ * Data pattern likes below when sg enabled, package size is 1k and mult is 2
+ * [UVC Header(8B) ] [data(3k - 8)] ...
+ *
+ * The received data at offset 0xd000 will get 0xc000 data, len 0x70. Error happen
+ * as below pattern:
+ * 0xd000: wrong
+ * 0xe000: wrong
+ * 0xf000: correct
+ * 0x10000: wrong
+ * 0x11000: wrong
+ * 0x12000: correct
+ * ...
+ *
+ * But it is still unclear about why error have not happen below 0xd000, it should
+ * cross 4k bounder. But anyway, the below code can fix this problem.
+ *
+ * To avoid DMA cross 4k bounder at ISO transfer, reduce burst len according to 16.
+ */
+ if (priv_ep->type == USB_ENDPOINT_XFER_ISOC && priv_dev->dev_ver <= DEV_VER_V2)
+ if (ALIGN_DOWN(trb->buffer, SZ_4K) !=
+ ALIGN_DOWN(trb->buffer + length, SZ_4K))
+ trb_burst = 16;
+
+ trb->length |= cpu_to_le32(TRB_BURST_LEN(trb_burst) |
TRB_LEN(length));
pcs = priv_ep->pcs ? TRB_CYCLE : 0;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 261/374] Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs"
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (259 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 260/374] usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 262/374] usb: typec: class: fix typec_altmode_put_partner to put plugs Greg Kroah-Hartman
` (113 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, RD Babiera, Chris Bainbridge,
Heikki Krogerus
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
commit 9c6b789e954fae73c548f39332bcc56bdf0d4373 upstream.
This reverts commit b17b7fe6dd5c6ff74b38b0758ca799cdbb79e26e.
That commit messed up the reference counting, so it needs to
be rethought.
Fixes: b17b7fe6dd5c ("usb: typec: class: fix typec_altmode_put_partner to put plugs")
Cc: <stable@vger.kernel.org>
Cc: RD Babiera <rdbabiera@google.com>
Reported-by: Chris Bainbridge <chris.bainbridge@gmail.com>
Closes: https://lore.kernel.org/lkml/CAP-bSRb3SXpgo_BEdqZB-p1K5625fMegRZ17ZkPE1J8ZYgEHDg@mail.gmail.com/
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240102091142.2136472-1-heikki.krogerus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/class.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -265,7 +265,7 @@ static void typec_altmode_put_partner(st
if (!partner)
return;
- adev = &altmode->adev;
+ adev = &partner->adev;
if (is_typec_plug(adev->dev.parent)) {
struct typec_plug *plug = to_typec_plug(adev->dev.parent);
@@ -495,8 +495,7 @@ static void typec_altmode_release(struct
{
struct altmode *alt = to_altmode(to_typec_altmode(dev));
- if (!is_typec_port(dev->parent))
- typec_altmode_put_partner(alt);
+ typec_altmode_put_partner(alt);
altmode_id_remove(alt->adev.dev.parent, alt->id);
kfree(alt);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 262/374] usb: typec: class: fix typec_altmode_put_partner to put plugs
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (260 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 261/374] Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 263/374] usb: mon: Fix atomicity violation in mon_bin_vma_fault Greg Kroah-Hartman
` (112 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian A. Ehrhardt, RD Babiera,
Heikki Krogerus
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: RD Babiera <rdbabiera@google.com>
commit 5962ded777d689cd8bf04454273e32228d7fb71f upstream.
When typec_altmode_put_partner is called by a plug altmode upon release,
the port altmode the plug belongs to will not remove its reference to the
plug. The check to see if the altmode being released is a plug evaluates
against the released altmode's partner instead of the calling altmode, so
change adev in typec_altmode_put_partner to properly refer to the altmode
being released.
Because typec_altmode_set_partner calls get_device() on the port altmode,
add partner_adev that points to the port altmode in typec_put_partner to
call put_device() on. typec_altmode_set_partner is not called for port
altmodes, so add a check in typec_altmode_release to prevent
typec_altmode_put_partner() calls on port altmode release.
Fixes: 8a37d87d72f0 ("usb: typec: Bus type for alternate modes")
Cc: <stable@vger.kernel.org>
Co-developed-by: Christian A. Ehrhardt <lk@c--e.de>
Signed-off-by: Christian A. Ehrhardt <lk@c--e.de>
Signed-off-by: RD Babiera <rdbabiera@google.com>
Tested-by: Christian A. Ehrhardt <lk@c--e.de>
Acked-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20240103181754.2492492-2-rdbabiera@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/typec/class.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/usb/typec/class.c
+++ b/drivers/usb/typec/class.c
@@ -261,11 +261,13 @@ static void typec_altmode_put_partner(st
{
struct altmode *partner = altmode->partner;
struct typec_altmode *adev;
+ struct typec_altmode *partner_adev;
if (!partner)
return;
- adev = &partner->adev;
+ adev = &altmode->adev;
+ partner_adev = &partner->adev;
if (is_typec_plug(adev->dev.parent)) {
struct typec_plug *plug = to_typec_plug(adev->dev.parent);
@@ -274,7 +276,7 @@ static void typec_altmode_put_partner(st
} else {
partner->partner = NULL;
}
- put_device(&adev->dev);
+ put_device(&partner_adev->dev);
}
/**
@@ -495,7 +497,8 @@ static void typec_altmode_release(struct
{
struct altmode *alt = to_altmode(to_typec_altmode(dev));
- typec_altmode_put_partner(alt);
+ if (!is_typec_port(dev->parent))
+ typec_altmode_put_partner(alt);
altmode_id_remove(alt->adev.dev.parent, alt->id);
kfree(alt);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 263/374] usb: mon: Fix atomicity violation in mon_bin_vma_fault
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (261 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 262/374] usb: typec: class: fix typec_altmode_put_partner to put plugs Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 264/374] serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock Greg Kroah-Hartman
` (111 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gui-Dong Han
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <2045gemini@gmail.com>
commit 2dd23cc4d0e6aa55cf9fb3b05f2f4165b01de81c upstream.
In mon_bin_vma_fault():
offset = vmf->pgoff << PAGE_SHIFT;
if (offset >= rp->b_size)
return VM_FAULT_SIGBUS;
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
The code is executed without holding any lock.
In mon_bin_vma_close():
spin_lock_irqsave(&rp->b_lock, flags);
rp->mmap_active--;
spin_unlock_irqrestore(&rp->b_lock, flags);
In mon_bin_ioctl():
spin_lock_irqsave(&rp->b_lock, flags);
if (rp->mmap_active) {
...
} else {
...
kfree(rp->b_vec);
rp->b_vec = vec;
rp->b_size = size;
...
}
spin_unlock_irqrestore(&rp->b_lock, flags);
Concurrent execution of mon_bin_vma_fault() with mon_bin_vma_close() and
mon_bin_ioctl() could lead to atomicity violations. mon_bin_vma_fault()
accesses rp->b_size and rp->b_vec without locking, risking array
out-of-bounds access or use-after-free bugs due to possible modifications
in mon_bin_ioctl().
This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 6.2.
To address this issue, it is proposed to add a spin lock pair in
mon_bin_vma_fault() to ensure atomicity. With this patch applied, our tool
never reports the possible bug, with the kernel configuration allyesconfig
for x86_64. Due to the lack of associated hardware, we cannot test the
patch in runtime testing, and just verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
Fixes: 19e6317d24c2 ("usb: mon: Fix a deadlock in usbmon between ...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gui-Dong Han <2045gemini@gmail.com>
Link: https://lore.kernel.org/r/20240105052412.9377-1-2045gemini@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/mon/mon_bin.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/drivers/usb/mon/mon_bin.c
+++ b/drivers/usb/mon/mon_bin.c
@@ -1247,14 +1247,19 @@ static vm_fault_t mon_bin_vma_fault(stru
struct mon_reader_bin *rp = vmf->vma->vm_private_data;
unsigned long offset, chunk_idx;
struct page *pageptr;
+ unsigned long flags;
+ spin_lock_irqsave(&rp->b_lock, flags);
offset = vmf->pgoff << PAGE_SHIFT;
- if (offset >= rp->b_size)
+ if (offset >= rp->b_size) {
+ spin_unlock_irqrestore(&rp->b_lock, flags);
return VM_FAULT_SIGBUS;
+ }
chunk_idx = offset / CHUNK_SIZE;
pageptr = rp->b_vec[chunk_idx].pg;
get_page(pageptr);
vmf->page = pageptr;
+ spin_unlock_irqrestore(&rp->b_lock, flags);
return 0;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 264/374] serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (262 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 263/374] usb: mon: Fix atomicity violation in mon_bin_vma_fault Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 265/374] ALSA: oxygen: Fix right channel of capture volume mixer Greg Kroah-Hartman
` (110 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Christoph Niedermaier,
Lukas Wunner
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
commit 7c45eaa813476bd195ac1227a64b52f9cf2e2030 upstream.
There are register accesses in the function imx_uart_rs485_config(). The
clock must be enabled for these accesses. This was ensured by calling it
via the function uart_rs485_config() in the probe() function within the
range where the clock is enabled. With the commit 7c7f9bc986e6 ("serial:
Deassert Transmit Enable on probe in driver-specific way") it was removed
from the probe() function and is now only called through the function
uart_add_one_port() which is located at the end of the probe() function.
But the clock is already switched off in this area. To ensure that the
clock is enabled during register access, move the disabling of the clock
to the very end of the probe() function. To avoid leaking enabled clocks
on error also add an error path for exiting with disabling the clock.
Fixes: 7c7f9bc986e6 ("serial: Deassert Transmit Enable on probe in driver-specific way")
Cc: stable <stable@kernel.org>
Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Reviewed-by: Lukas Wunner <lukas@wunner.de>
Link: https://lore.kernel.org/r/20231226113647.39376-1-cniedermaier@dh-electronics.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/imx.c | 23 ++++++++++++-----------
1 file changed, 12 insertions(+), 11 deletions(-)
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2330,10 +2330,8 @@ static int imx_uart_probe(struct platfor
sport->ufcr = readl(sport->port.membase + UFCR);
ret = uart_get_rs485_mode(&sport->port);
- if (ret) {
- clk_disable_unprepare(sport->clk_ipg);
- return ret;
- }
+ if (ret)
+ goto err_clk;
if (sport->port.rs485.flags & SER_RS485_ENABLED &&
(!sport->have_rtscts && !sport->have_rtsgpio))
@@ -2417,8 +2415,6 @@ static int imx_uart_probe(struct platfor
imx_uart_writel(sport, ucr3, UCR3);
}
- clk_disable_unprepare(sport->clk_ipg);
-
hrtimer_init(&sport->trigger_start_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
hrtimer_init(&sport->trigger_stop_tx, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
sport->trigger_start_tx.function = imx_trigger_start_tx;
@@ -2434,7 +2430,7 @@ static int imx_uart_probe(struct platfor
if (ret) {
dev_err(&pdev->dev, "failed to request rx irq: %d\n",
ret);
- return ret;
+ goto err_clk;
}
ret = devm_request_irq(&pdev->dev, txirq, imx_uart_txint, 0,
@@ -2442,7 +2438,7 @@ static int imx_uart_probe(struct platfor
if (ret) {
dev_err(&pdev->dev, "failed to request tx irq: %d\n",
ret);
- return ret;
+ goto err_clk;
}
ret = devm_request_irq(&pdev->dev, rtsirq, imx_uart_rtsint, 0,
@@ -2450,14 +2446,14 @@ static int imx_uart_probe(struct platfor
if (ret) {
dev_err(&pdev->dev, "failed to request rts irq: %d\n",
ret);
- return ret;
+ goto err_clk;
}
} else {
ret = devm_request_irq(&pdev->dev, rxirq, imx_uart_int, 0,
dev_name(&pdev->dev), sport);
if (ret) {
dev_err(&pdev->dev, "failed to request irq: %d\n", ret);
- return ret;
+ goto err_clk;
}
}
@@ -2465,7 +2461,12 @@ static int imx_uart_probe(struct platfor
platform_set_drvdata(pdev, sport);
- return uart_add_one_port(&imx_uart_uart_driver, &sport->port);
+ ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port);
+
+err_clk:
+ clk_disable_unprepare(sport->clk_ipg);
+
+ return ret;
}
static int imx_uart_remove(struct platform_device *pdev)
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 265/374] ALSA: oxygen: Fix right channel of capture volume mixer
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (263 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 264/374] serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 266/374] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx Greg Kroah-Hartman
` (109 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Takashi Iwai
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <tiwai@suse.de>
commit a03cfad512ac24a35184d7d87ec0d5489e1cb763 upstream.
There was a typo in oxygen mixer code that didn't update the right
channel value properly for the capture volume. Let's fix it.
This trivial fix was originally reported on Bugzilla.
Fixes: a3601560496d ("[ALSA] oxygen: add front panel controls")
Cc: <stable@vger.kernel.org>
Link: https://bugzilla.kernel.org/show_bug.cgi?id=156561
Link: https://lore.kernel.org/r/20240112111023.6208-1-tiwai@suse.de
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/oxygen/oxygen_mixer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/sound/pci/oxygen/oxygen_mixer.c
+++ b/sound/pci/oxygen/oxygen_mixer.c
@@ -718,7 +718,7 @@ static int ac97_fp_rec_volume_put(struct
oldreg = oxygen_read_ac97(chip, 1, AC97_REC_GAIN);
newreg = oldreg & ~0x0707;
newreg = newreg | (value->value.integer.value[0] & 7);
- newreg = newreg | ((value->value.integer.value[0] & 7) << 8);
+ newreg = newreg | ((value->value.integer.value[1] & 7) << 8);
change = newreg != oldreg;
if (change)
oxygen_write_ac97(chip, 1, AC97_REC_GAIN, newreg);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 266/374] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (264 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 265/374] ALSA: oxygen: Fix right channel of capture volume mixer Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 267/374] fbdev: flush deferred work in fb_deferred_io_fsync() Greg Kroah-Hartman
` (108 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Çağhan Demir, Takashi Iwai
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Çağhan Demir <caghandemir@marun.edu.tr>
commit bc7863d18677df66b2c7a0e172c91296ff380f11 upstream.
This HP Laptop uses ALC236 codec with COEF 0x07 idx 1 controlling
the mute LED. This patch enables the already existing quirk for
this device.
Signed-off-by: Çağhan Demir <caghandemir@marun.edu.tr>
Cc: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20240115172303.4718-1-caghandemir@marun.edu.tr
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/pci/hda/patch_realtek.c | 1 +
1 file changed, 1 insertion(+)
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -9098,6 +9098,7 @@ static const struct snd_pci_quirk alc269
SND_PCI_QUIRK(0x103c, 0x87f5, "HP", ALC287_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x87f6, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
SND_PCI_QUIRK(0x103c, 0x87f7, "HP Spectre x360 14", ALC245_FIXUP_HP_X360_AMP),
+ SND_PCI_QUIRK(0x103c, 0x87fe, "HP Laptop 15s-fq2xxx", ALC236_FIXUP_HP_MUTE_LED_COEFBIT2),
SND_PCI_QUIRK(0x103c, 0x8805, "HP ProBook 650 G8 Notebook PC", ALC236_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x880d, "HP EliteBook 830 G8 Notebook PC", ALC285_FIXUP_HP_GPIO_LED),
SND_PCI_QUIRK(0x103c, 0x8811, "HP Spectre x360 15-eb1xxx", ALC285_FIXUP_HP_SPECTRE_X360_EB1),
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 267/374] fbdev: flush deferred work in fb_deferred_io_fsync()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (265 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 266/374] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 268/374] scsi: mpi3mr: Refresh sdev queue depth after controller reset Greg Kroah-Hartman
` (107 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nam Cao, Sebastian Andrzej Siewior,
Helge Deller
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nam Cao <namcao@linutronix.de>
commit 15e4c1f462279b4e128f27de48133e0debe9e0df upstream.
The driver's fsync() is supposed to flush any pending operation to
hardware. It is implemented in this driver by cancelling the queued
deferred IO first, then schedule it for "immediate execution" by calling
schedule_delayed_work() again with delay=0. However, setting delay=0
only means the work is scheduled immediately, it does not mean the work
is executed immediately. There is no guarantee that the work is finished
after schedule_delayed_work() returns. After this driver's fsync()
returns, there can still be pending work. Furthermore, if close() is
called by users immediately after fsync(), the pending work gets
cancelled and fsync() may do nothing.
To ensure that the deferred IO completes, use flush_delayed_work()
instead. Write operations to this driver either write to the device
directly, or invoke schedule_delayed_work(); so by flushing the
workqueue, it can be guaranteed that all previous writes make it to the
device.
Fixes: 5e841b88d23d ("fb: fsync() method for deferred I/O flush.")
Cc: stable@vger.kernel.org
Signed-off-by: Nam Cao <namcao@linutronix.de>
Reviewed-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/fbdev/core/fb_defio.c | 6 +-----
1 file changed, 1 insertion(+), 5 deletions(-)
--- a/drivers/video/fbdev/core/fb_defio.c
+++ b/drivers/video/fbdev/core/fb_defio.c
@@ -78,11 +78,7 @@ int fb_deferred_io_fsync(struct file *fi
return 0;
inode_lock(inode);
- /* Kill off the delayed work */
- cancel_delayed_work_sync(&info->deferred_work);
-
- /* Run it immediately */
- schedule_delayed_work(&info->deferred_work, 0);
+ flush_delayed_work(&info->deferred_work);
inode_unlock(inode);
return 0;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 268/374] scsi: mpi3mr: Refresh sdev queue depth after controller reset
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (266 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 267/374] fbdev: flush deferred work in fb_deferred_io_fsync() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 269/374] block: add check that partition length needs to be aligned with block size Greg Kroah-Hartman
` (106 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sathya Prakash, Chandrakanth patil,
Martin K. Petersen
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandrakanth patil <chandrakanth.patil@broadcom.com>
commit e5aab848dfdf7996d20ece4d28d2733c732c5e5a upstream.
After a controller reset, the firmware may modify the device queue depth.
Therefore, update the device queue depth accordingly.
Cc: <stable@vger.kernel.org> # v5.15+
Co-developed-by: Sathya Prakash <sathya.prakash@broadcom.com>
Signed-off-by: Sathya Prakash <sathya.prakash@broadcom.com>
Signed-off-by: Chandrakanth patil <chandrakanth.patil@broadcom.com>
Link: https://lore.kernel.org/r/20231126053134.10133-2-chandrakanth.patil@broadcom.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/mpi3mr/mpi3mr_os.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/scsi/mpi3mr/mpi3mr_os.c
+++ b/drivers/scsi/mpi3mr/mpi3mr_os.c
@@ -781,8 +781,14 @@ void mpi3mr_rfresh_tgtdevs(struct mpi3mr
tgtdev = NULL;
list_for_each_entry(tgtdev, &mrioc->tgtdev_list, list) {
if ((tgtdev->dev_handle != MPI3MR_INVALID_DEV_HANDLE) &&
- !tgtdev->is_hidden && !tgtdev->host_exposed)
- mpi3mr_report_tgtdev_to_host(mrioc, tgtdev->perst_id);
+ !tgtdev->is_hidden) {
+ if (!tgtdev->host_exposed)
+ mpi3mr_report_tgtdev_to_host(mrioc,
+ tgtdev->perst_id);
+ else if (tgtdev->starget)
+ starget_for_each_device(tgtdev->starget,
+ (void *)tgtdev, mpi3mr_update_sdev);
+ }
}
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 269/374] block: add check that partition length needs to be aligned with block size
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (267 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 268/374] scsi: mpi3mr: Refresh sdev queue depth after controller reset Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 270/374] netfilter: nf_tables: check if catch-all set element is active in next generation Greg Kroah-Hartman
` (105 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Min Li, Damien Le Moal,
Chaitanya Kulkarni, Christoph Hellwig, Jens Axboe
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Min Li <min15.li@samsung.com>
commit 6f64f866aa1ae6975c95d805ed51d7e9433a0016 upstream.
Before calling add partition or resize partition, there is no check
on whether the length is aligned with the logical block size.
If the logical block size of the disk is larger than 512 bytes,
then the partition size maybe not the multiple of the logical block size,
and when the last sector is read, bio_truncate() will adjust the bio size,
resulting in an IO error if the size of the read command is smaller than
the logical block size.If integrity data is supported, this will also
result in a null pointer dereference when calling bio_integrity_free.
Cc: <stable@vger.kernel.org>
Signed-off-by: Min Li <min15.li@samsung.com>
Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Chaitanya Kulkarni <kch@nvidia.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Link: https://lore.kernel.org/r/20230629142517.121241-1-min15.li@samsung.com
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/ioctl.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
--- a/block/ioctl.c
+++ b/block/ioctl.c
@@ -18,7 +18,7 @@ static int blkpg_do_ioctl(struct block_d
{
struct gendisk *disk = bdev->bd_disk;
struct blkpg_partition p;
- long long start, length;
+ sector_t start, length;
if (disk->flags & GENHD_FL_NO_PART)
return -EINVAL;
@@ -35,14 +35,17 @@ static int blkpg_do_ioctl(struct block_d
if (op == BLKPG_DEL_PARTITION)
return bdev_del_partition(disk, p.pno);
+ if (p.start < 0 || p.length <= 0 || p.start + p.length < 0)
+ return -EINVAL;
+ /* Check that the partition is aligned to the block size */
+ if (!IS_ALIGNED(p.start | p.length, bdev_logical_block_size(bdev)))
+ return -EINVAL;
+
start = p.start >> SECTOR_SHIFT;
length = p.length >> SECTOR_SHIFT;
switch (op) {
case BLKPG_ADD_PARTITION:
- /* check if partition is aligned to blocksize */
- if (p.start & (bdev_logical_block_size(bdev) - 1))
- return -EINVAL;
return bdev_add_partition(disk, p.pno, start, length);
case BLKPG_RESIZE_PARTITION:
return bdev_resize_partition(disk, p.pno, start, length);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 270/374] netfilter: nf_tables: check if catch-all set element is active in next generation
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (268 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 269/374] block: add check that partition length needs to be aligned with block size Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 271/374] pwm: jz4740: Dont use dev_err_probe() in .request() Greg Kroah-Hartman
` (104 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, lonial con, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit b1db244ffd041a49ecc9618e8feb6b5c1afcdaa7 upstream.
When deactivating the catch-all set element, check the state in the next
generation that represents this transaction.
This bug uncovered after the recent removal of the element busy mark
a2dd0233cbc4 ("netfilter: nf_tables: remove busy mark and gc batch API").
Fixes: aaa31047a6d2 ("netfilter: nftables: add catch-all set element support")
Cc: stable@vger.kernel.org
Reported-by: lonial con <kongln9170@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nf_tables_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6034,7 +6034,7 @@ static int nft_setelem_catchall_deactiva
list_for_each_entry(catchall, &set->catchall_list, list) {
ext = nft_set_elem_ext(set, catchall->elem);
- if (!nft_is_active(net, ext))
+ if (!nft_is_active_next(net, ext))
continue;
kfree(elem->priv);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 271/374] pwm: jz4740: Dont use dev_err_probe() in .request()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (269 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 270/374] netfilter: nf_tables: check if catch-all set element is active in next generation Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 272/374] io_uring/rw: ensure io->bytes_done is always initialized Greg Kroah-Hartman
` (103 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Krzysztof Kozlowski,
Uwe Kleine-König
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
commit 9320fc509b87b4d795fb37112931e2f4f8b5c55f upstream.
dev_err_probe() is only supposed to be used in probe functions. While it
probably doesn't hurt, both the EPROBE_DEFER handling and calling
device_set_deferred_probe_reason() are conceptually wrong in the request
callback. So replace the call by dev_err() and a separate return
statement.
This effectively reverts commit c0bfe9606e03 ("pwm: jz4740: Simplify
with dev_err_probe()").
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Link: https://lore.kernel.org/r/20240106141302.1253365-2-u.kleine-koenig@pengutronix.de
Fixes: c0bfe9606e03 ("pwm: jz4740: Simplify with dev_err_probe()")
Cc: stable@vger.kernel.org
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pwm/pwm-jz4740.c | 7 ++++---
1 file changed, 4 insertions(+), 3 deletions(-)
--- a/drivers/pwm/pwm-jz4740.c
+++ b/drivers/pwm/pwm-jz4740.c
@@ -60,9 +60,10 @@ static int jz4740_pwm_request(struct pwm
snprintf(name, sizeof(name), "timer%u", pwm->hwpwm);
clk = clk_get(chip->dev, name);
- if (IS_ERR(clk))
- return dev_err_probe(chip->dev, PTR_ERR(clk),
- "Failed to get clock\n");
+ if (IS_ERR(clk)) {
+ dev_err(chip->dev, "error %pe: Failed to get clock\n", clk);
+ return PTR_ERR(clk);
+ }
err = clk_prepare_enable(clk);
if (err < 0) {
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 272/374] io_uring/rw: ensure io->bytes_done is always initialized
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (270 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 271/374] pwm: jz4740: Dont use dev_err_probe() in .request() Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 273/374] rootfs: Fix support for rootfstype= when root= is given Greg Kroah-Hartman
` (102 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, xingwei lee, Jens Axboe
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <axboe@kernel.dk>
commit 0a535eddbe0dc1de4386046ab849f08aeb2f8faf upstream.
If IOSQE_ASYNC is set and we fail importing an iovec for a readv or
writev request, then we leave ->bytes_done uninitialized and hence the
eventual failure CQE posted can potentially have a random res value
rather than the expected -EINVAL.
Setup ->bytes_done before potentially failing, so we have a consistent
value if we fail the request early.
Cc: stable@vger.kernel.org
Reported-by: xingwei lee <xrivendell7@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
io_uring/io_uring.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3490,14 +3490,17 @@ static inline int io_rw_prep_async(struc
struct iovec *iov = iorw->fast_iov;
int ret;
+ iorw->bytes_done = 0;
+ iorw->free_iovec = NULL;
+
ret = io_import_iovec(rw, req, &iov, &iorw->iter, false);
if (unlikely(ret < 0))
return ret;
- iorw->bytes_done = 0;
- iorw->free_iovec = iov;
- if (iov)
+ if (iov) {
+ iorw->free_iovec = iov;
req->flags |= REQ_F_NEED_CLEANUP;
+ }
iov_iter_save_state(&iorw->iter, &iorw->iter_state);
return 0;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 273/374] rootfs: Fix support for rootfstype= when root= is given
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (271 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 272/374] io_uring/rw: ensure io->bytes_done is always initialized Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 274/374] Bluetooth: Fix atomicity violation in {min,max}_key_size_set Greg Kroah-Hartman
` (101 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Rob Landley, Stefan Berger,
Mimi Zohar
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Berger <stefanb@linux.ibm.com>
commit 21528c69a0d8483f7c6345b1a0bc8d8975e9a172 upstream.
Documentation/filesystems/ramfs-rootfs-initramfs.rst states:
If CONFIG_TMPFS is enabled, rootfs will use tmpfs instead of ramfs by
default. To force ramfs, add "rootfstype=ramfs" to the kernel command
line.
This currently does not work when root= is provided since then
saved_root_name contains a string and rootfstype= is ignored. Therefore,
ramfs is currently always chosen when root= is provided.
The current behavior for rootfs's filesystem is:
root= | rootfstype= | chosen rootfs filesystem
------------+-------------+--------------------------
unspecified | unspecified | tmpfs
unspecified | tmpfs | tmpfs
unspecified | ramfs | ramfs
provided | ignored | ramfs
rootfstype= should be respected regardless whether root= is given,
as shown below:
root= | rootfstype= | chosen rootfs filesystem
------------+-------------+--------------------------
unspecified | unspecified | tmpfs (as before)
unspecified | tmpfs | tmpfs (as before)
unspecified | ramfs | ramfs (as before)
provided | unspecified | ramfs (compatibility with before)
provided | tmpfs | tmpfs (new)
provided | ramfs | ramfs (new)
This table represents the new behavior.
Fixes: 6e19eded3684 ("initmpfs: use initramfs if rootfstype= or root= specified")
Cc: <stable@vger.kernel.org>
Signed-off-by: Rob Landley <rob@landley.net>
Link: https://lore.kernel.org/lkml/8244c75f-445e-b15b-9dbf-266e7ca666e2@landley.net/
Reviewed-and-Tested-by: Mimi Zohar <zohar@linux.ibm.com>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
Link: https://lore.kernel.org/r/20231120011248.396012-1-stefanb@linux.ibm.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
init/do_mounts.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/init/do_mounts.c
+++ b/init/do_mounts.c
@@ -666,7 +666,10 @@ struct file_system_type rootfs_fs_type =
void __init init_rootfs(void)
{
- if (IS_ENABLED(CONFIG_TMPFS) && !saved_root_name[0] &&
- (!root_fs_names || strstr(root_fs_names, "tmpfs")))
- is_tmpfs = true;
+ if (IS_ENABLED(CONFIG_TMPFS)) {
+ if (!saved_root_name[0] && !root_fs_names)
+ is_tmpfs = true;
+ else if (root_fs_names && !!strstr(root_fs_names, "tmpfs"))
+ is_tmpfs = true;
+ }
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 274/374] Bluetooth: Fix atomicity violation in {min,max}_key_size_set
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (272 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 273/374] rootfs: Fix support for rootfstype= when root= is given Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 275/374] bpf: Fix re-attachment branch in bpf_tracing_prog_attach Greg Kroah-Hartman
` (100 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gui-Dong Han, Luiz Augusto von Dentz
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gui-Dong Han <2045gemini@gmail.com>
commit da9065caa594d19b26e1a030fd0cc27bd365d685 upstream.
In min_key_size_set():
if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE)
return -EINVAL;
hci_dev_lock(hdev);
hdev->le_min_key_size = val;
hci_dev_unlock(hdev);
In max_key_size_set():
if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size)
return -EINVAL;
hci_dev_lock(hdev);
hdev->le_max_key_size = val;
hci_dev_unlock(hdev);
The atomicity violation occurs due to concurrent execution of set_min and
set_max funcs.Consider a scenario where setmin writes a new, valid 'min'
value, and concurrently, setmax writes a value that is greater than the
old 'min' but smaller than the new 'min'. In this case, setmax might check
against the old 'min' value (before acquiring the lock) but write its
value after the 'min' has been updated by setmin. This leads to a
situation where the 'max' value ends up being smaller than the 'min'
value, which is an inconsistency.
This possible bug is found by an experimental static analysis tool
developed by our team, BassCheck[1]. This tool analyzes the locking APIs
to extract function pairs that can be concurrently executed, and then
analyzes the instructions in the paired functions to identify possible
concurrency bugs including data races and atomicity violations. The above
possible bug is reported when our tool analyzes the source code of
Linux 5.17.
To resolve this issue, it is suggested to encompass the validity checks
within the locked sections in both set_min and set_max funcs. The
modification ensures that the validation of 'val' against the
current min/max values is atomic, thus maintaining the integrity of the
settings. With this patch applied, our tool no longer reports the bug,
with the kernel configuration allyesconfig for x86_64. Due to the lack of
associated hardware, we cannot test the patch in runtime testing, and just
verify it according to the code logic.
[1] https://sites.google.com/view/basscheck/
Fixes: 18f81241b74f ("Bluetooth: Move {min,max}_key_size debugfs ...")
Cc: stable@vger.kernel.org
Signed-off-by: Gui-Dong Han <2045gemini@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/bluetooth/hci_debugfs.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/net/bluetooth/hci_debugfs.c
+++ b/net/bluetooth/hci_debugfs.c
@@ -1044,10 +1044,12 @@ static int min_key_size_set(void *data,
{
struct hci_dev *hdev = data;
- if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE)
+ hci_dev_lock(hdev);
+ if (val > hdev->le_max_key_size || val < SMP_MIN_ENC_KEY_SIZE) {
+ hci_dev_unlock(hdev);
return -EINVAL;
+ }
- hci_dev_lock(hdev);
hdev->le_min_key_size = val;
hci_dev_unlock(hdev);
@@ -1072,10 +1074,12 @@ static int max_key_size_set(void *data,
{
struct hci_dev *hdev = data;
- if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size)
+ hci_dev_lock(hdev);
+ if (val > SMP_MAX_ENC_KEY_SIZE || val < hdev->le_min_key_size) {
+ hci_dev_unlock(hdev);
return -EINVAL;
+ }
- hci_dev_lock(hdev);
hdev->le_max_key_size = val;
hci_dev_unlock(hdev);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 275/374] bpf: Fix re-attachment branch in bpf_tracing_prog_attach
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (273 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 274/374] Bluetooth: Fix atomicity violation in {min,max}_key_size_set Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 276/374] iommu/arm-smmu-qcom: Add missing GMU entry to match table Greg Kroah-Hartman
` (99 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jiri Olsa, Song Liu, Dmitrii Dolgov,
Alexei Starovoitov
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <olsajiri@gmail.com>
commit 715d82ba636cb3629a6e18a33bb9dbe53f9936ee upstream.
The following case can cause a crash due to missing attach_btf:
1) load rawtp program
2) load fentry program with rawtp as target_fd
3) create tracing link for fentry program with target_fd = 0
4) repeat 3
In the end we have:
- prog->aux->dst_trampoline == NULL
- tgt_prog == NULL (because we did not provide target_fd to link_create)
- prog->aux->attach_btf == NULL (the program was loaded with attach_prog_fd=X)
- the program was loaded for tgt_prog but we have no way to find out which one
BUG: kernel NULL pointer dereference, address: 0000000000000058
Call Trace:
<TASK>
? __die+0x20/0x70
? page_fault_oops+0x15b/0x430
? fixup_exception+0x22/0x330
? exc_page_fault+0x6f/0x170
? asm_exc_page_fault+0x22/0x30
? bpf_tracing_prog_attach+0x279/0x560
? btf_obj_id+0x5/0x10
bpf_tracing_prog_attach+0x439/0x560
__sys_bpf+0x1cf4/0x2de0
__x64_sys_bpf+0x1c/0x30
do_syscall_64+0x41/0xf0
entry_SYSCALL_64_after_hwframe+0x6e/0x76
Return -EINVAL in this situation.
Fixes: f3a95075549e0 ("bpf: Allow trampoline re-attach for tracing and lsm programs")
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Olsa <olsajiri@gmail.com>
Acked-by: Jiri Olsa <olsajiri@gmail.com>
Acked-by: Song Liu <song@kernel.org>
Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com>
Link: https://lore.kernel.org/r/20240103190559.14750-4-9erthalion6@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/bpf/syscall.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -2761,6 +2761,10 @@ static int bpf_tracing_prog_attach(struc
*
* - if prog->aux->dst_trampoline and tgt_prog is NULL, the program
* was detached and is going for re-attachment.
+ *
+ * - if prog->aux->dst_trampoline is NULL and tgt_prog and prog->aux->attach_btf
+ * are NULL, then program was already attached and user did not provide
+ * tgt_prog_fd so we have no way to find out or create trampoline
*/
if (!prog->aux->dst_trampoline && !tgt_prog) {
/*
@@ -2774,6 +2778,11 @@ static int bpf_tracing_prog_attach(struc
err = -EINVAL;
goto out_unlock;
}
+ /* We can allow re-attach only if we have valid attach_btf. */
+ if (!prog->aux->attach_btf) {
+ err = -EINVAL;
+ goto out_unlock;
+ }
btf_id = prog->aux->attach_btf_id;
key = bpf_trampoline_compute_key(NULL, prog->aux->attach_btf, btf_id);
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 276/374] iommu/arm-smmu-qcom: Add missing GMU entry to match table
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (274 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 275/374] bpf: Fix re-attachment branch in bpf_tracing_prog_attach Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 277/374] wifi: mt76: fix broken precal loading from MTD for mt7915 Greg Kroah-Hartman
` (98 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Rob Clark, Johan Hovold,
Robin Murphy, Will Deacon
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rob Clark <robdclark@chromium.org>
commit afc95681c3068956fed1241a1ff1612c066c75ac upstream.
In some cases the firmware expects cbndx 1 to be assigned to the GMU,
so we also want the default domain for the GMU to be an identy domain.
This way it does not get a context bank assigned. Without this, both
of_dma_configure() and drm/msm's iommu_domain_attach() will trigger
allocating and configuring a context bank. So GMU ends up attached to
both cbndx 1 and later cbndx 2. This arrangement seemingly confounds
and surprises the firmware if the GPU later triggers a translation
fault, resulting (on sc8280xp / lenovo x13s, at least) in the SMMU
getting wedged and the GPU stuck without memory access.
Cc: stable@vger.kernel.org
Signed-off-by: Rob Clark <robdclark@chromium.org>
Tested-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Robin Murphy <robin.murphy@arm.com>
Link: https://lore.kernel.org/r/20231210180655.75542-1-robdclark@gmail.com
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu-qcom.c
@@ -226,6 +226,7 @@ static int qcom_adreno_smmu_init_context
static const struct of_device_id qcom_smmu_client_of_match[] __maybe_unused = {
{ .compatible = "qcom,adreno" },
+ { .compatible = "qcom,adreno-gmu" },
{ .compatible = "qcom,mdp4" },
{ .compatible = "qcom,mdss" },
{ .compatible = "qcom,sc7180-mdss" },
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 277/374] wifi: mt76: fix broken precal loading from MTD for mt7915
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (275 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 276/374] iommu/arm-smmu-qcom: Add missing GMU entry to match table Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 278/374] wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code Greg Kroah-Hartman
` (97 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Marangi, Felix Fietkau
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Marangi <ansuelsmth@gmail.com>
commit e874a79250b39447765ac13272b67ac36ccf2a75 upstream.
Commit 495184ac91bb ("mt76: mt7915: add support for applying
pre-calibration data") was fundamentally broken and never worked.
The idea (before NVMEM support) was to expand the MTD function and pass
an additional offset. For normal EEPROM load the offset would always be
0. For the purpose of precal loading, an offset was passed that was
internally the size of EEPROM, since precal data is right after the
EEPROM.
Problem is that the offset value passed is never handled and is actually
overwrite by
offset = be32_to_cpup(list);
ret = mtd_read(mtd, offset, len, &retlen, eep);
resulting in the passed offset value always ingnored. (and even passing
garbage data as precal as the start of the EEPROM is getting read)
Fix this by adding to the current offset value, the offset from DT to
correctly read the piece of data at the requested location.
Cc: stable@vger.kernel.org
Fixes: 495184ac91bb ("mt76: mt7915: add support for applying pre-calibration data")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
Signed-off-by: Felix Fietkau <nbd@nbd.name>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/mediatek/mt76/eeprom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/wireless/mediatek/mt76/eeprom.c
+++ b/drivers/net/wireless/mediatek/mt76/eeprom.c
@@ -51,7 +51,7 @@ int mt76_get_of_eeprom(struct mt76_dev *
goto out_put_node;
}
- offset = be32_to_cpup(list);
+ offset += be32_to_cpup(list);
ret = mtd_read(mtd, offset, len, &retlen, eep);
put_mtd_device(mtd);
if (ret)
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 278/374] wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (276 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 277/374] wifi: mt76: fix broken precal loading from MTD for mt7915 Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 279/374] wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors Greg Kroah-Hartman
` (96 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Kalle Valo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
commit b3943b3c2971444364e03224cfc828c5789deada upstream.
Ever since introduction in the commit 0c8173385e54 ("rtl8192ce: Add new
driver") the rtlwifi code has, according to comments, attempted to
disable/enable ASPM of the upstream bridge by writing into its LNKCTL
register. However, the code has never been correct because it performs
the writes to the device instead of the upstream bridge.
Worse yet, the offset where the PCIe capabilities reside is derived
from the offset of the upstream bridge. As a result, the write will use
an offset on the device that does not relate to the LNKCTL register
making the ASPM disable/enable code outright dangerous.
Because of those problems, there is no indication that the driver needs
disable/enable ASPM on the upstream bridge. As the Capabilities offset
is not correctly calculated for the write to target device's LNKCTL
register, the code is not disabling/enabling device's ASPM either.
Therefore, just remove the upstream bridge related ASPM disable/enable
code entirely.
The upstream bridge related ASPM code was the only user of the struct
mp_adapter members num4bytes, pcibridge_pciehdr_offset, and
pcibridge_linkctrlreg so those are removed as well.
Note: This change does not remove the code related to changing the
device's ASPM on purpose (which is independent of this flawed code
related to upstream bridge's ASPM).
Suggested-by: Bjorn Helgaas <bhelgaas@kernel.org>
Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
Fixes: 886e14b65a8f ("rtlwifi: Eliminate raw reads and writes from PCIe portion")
Cc: stable@vger.kernel.org
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231124084725.12738-2-ilpo.jarvinen@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/pci.c | 58 -----------------------------
drivers/net/wireless/realtek/rtlwifi/pci.h | 5 --
2 files changed, 1 insertion(+), 62 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -192,11 +192,8 @@ static void rtl_pci_disable_aspm(struct
struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
- u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
/*Retrieve original configuration settings. */
u8 linkctrl_reg = pcipriv->ndis_adapter.linkctrl_reg;
- u16 pcibridge_linkctrlreg = pcipriv->ndis_adapter.
- pcibridge_linkctrlreg;
u16 aspmlevel = 0;
u8 tmp_u1b = 0;
@@ -221,16 +218,8 @@ static void rtl_pci_disable_aspm(struct
/*Set corresponding value. */
aspmlevel |= BIT(0) | BIT(1);
linkctrl_reg &= ~aspmlevel;
- pcibridge_linkctrlreg &= ~(BIT(0) | BIT(1));
_rtl_pci_platform_switch_device_pci_aspm(hw, linkctrl_reg);
- udelay(50);
-
- /*4 Disable Pci Bridge ASPM */
- pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
- pcibridge_linkctrlreg);
-
- udelay(50);
}
/*Enable RTL8192SE ASPM & Enable Pci Bridge ASPM for
@@ -245,9 +234,7 @@ static void rtl_pci_enable_aspm(struct i
struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
u8 pcibridge_vendor = pcipriv->ndis_adapter.pcibridge_vendor;
- u8 num4bytes = pcipriv->ndis_adapter.num4bytes;
u16 aspmlevel;
- u8 u_pcibridge_aspmsetting;
u8 u_device_aspmsetting;
if (!ppsc->support_aspm)
@@ -259,25 +246,6 @@ static void rtl_pci_enable_aspm(struct i
return;
}
- /*4 Enable Pci Bridge ASPM */
-
- u_pcibridge_aspmsetting =
- pcipriv->ndis_adapter.pcibridge_linkctrlreg |
- rtlpci->const_hostpci_aspm_setting;
-
- if (pcibridge_vendor == PCI_BRIDGE_VENDOR_INTEL)
- u_pcibridge_aspmsetting &= ~BIT(0);
-
- pci_write_config_byte(rtlpci->pdev, (num4bytes << 2),
- u_pcibridge_aspmsetting);
-
- rtl_dbg(rtlpriv, COMP_INIT, DBG_LOUD,
- "PlatformEnableASPM(): Write reg[%x] = %x\n",
- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10),
- u_pcibridge_aspmsetting);
-
- udelay(50);
-
/*Get ASPM level (with/without Clock Req) */
aspmlevel = rtlpci->const_devicepci_aspm_setting;
u_device_aspmsetting = pcipriv->ndis_adapter.linkctrl_reg;
@@ -359,22 +327,6 @@ static bool rtl_pci_check_buddy_priv(str
return find_buddy_priv;
}
-static void rtl_pci_get_linkcontrol_field(struct ieee80211_hw *hw)
-{
- struct rtl_pci_priv *pcipriv = rtl_pcipriv(hw);
- struct rtl_pci *rtlpci = rtl_pcidev(pcipriv);
- u8 capabilityoffset = pcipriv->ndis_adapter.pcibridge_pciehdr_offset;
- u8 linkctrl_reg;
- u8 num4bbytes;
-
- num4bbytes = (capabilityoffset + 0x10) / 4;
-
- /*Read Link Control Register */
- pci_read_config_byte(rtlpci->pdev, (num4bbytes << 2), &linkctrl_reg);
-
- pcipriv->ndis_adapter.pcibridge_linkctrlreg = linkctrl_reg;
-}
-
static void rtl_pci_parse_configuration(struct pci_dev *pdev,
struct ieee80211_hw *hw)
{
@@ -2035,12 +1987,6 @@ static bool _rtl_pci_find_adapter(struct
PCI_SLOT(bridge_pdev->devfn);
pcipriv->ndis_adapter.pcibridge_funcnum =
PCI_FUNC(bridge_pdev->devfn);
- pcipriv->ndis_adapter.pcibridge_pciehdr_offset =
- pci_pcie_cap(bridge_pdev);
- pcipriv->ndis_adapter.num4bytes =
- (pcipriv->ndis_adapter.pcibridge_pciehdr_offset + 0x10) / 4;
-
- rtl_pci_get_linkcontrol_field(hw);
if (pcipriv->ndis_adapter.pcibridge_vendor ==
PCI_BRIDGE_VENDOR_AMD) {
@@ -2057,13 +2003,11 @@ static bool _rtl_pci_find_adapter(struct
pdev->vendor, pcipriv->ndis_adapter.linkctrl_reg);
rtl_dbg(rtlpriv, COMP_INIT, DBG_DMESG,
- "pci_bridge busnumber:devnumber:funcnumber:vendor:pcie_cap:link_ctl_reg:amd %d:%d:%d:%x:%x:%x:%x\n",
+ "pci_bridge busnumber:devnumber:funcnumber:vendor:amd %d:%d:%d:%x:%x\n",
pcipriv->ndis_adapter.pcibridge_busnum,
pcipriv->ndis_adapter.pcibridge_devnum,
pcipriv->ndis_adapter.pcibridge_funcnum,
pcibridge_vendors[pcipriv->ndis_adapter.pcibridge_vendor],
- pcipriv->ndis_adapter.pcibridge_pciehdr_offset,
- pcipriv->ndis_adapter.pcibridge_linkctrlreg,
pcipriv->ndis_adapter.amd_l1_patch);
rtl_pci_parse_configuration(pdev, hw);
--- a/drivers/net/wireless/realtek/rtlwifi/pci.h
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.h
@@ -236,11 +236,6 @@ struct mp_adapter {
u16 pcibridge_vendorid;
u16 pcibridge_deviceid;
- u8 num4bytes;
-
- u8 pcibridge_pciehdr_offset;
- u8 pcibridge_linkctrlreg;
-
bool amd_l1_patch;
};
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 279/374] wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (277 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 278/374] wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 280/374] wifi: mwifiex: configure BSSID consistently when starting AP Greg Kroah-Hartman
` (95 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ilpo Järvinen, Kalle Valo
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
commit 5894d0089cbc146063dcc0239a78ede0a8142efb upstream.
The rtlwifi driver comes with custom code to write into PCIe Link
Control register. RMW access for the Link Control register requires
locking that is already provided by the standard PCIe capability
accessors.
Convert the custom RMW code writing into LNKCTL register to standard
RMW capability accessors. The accesses are changed to cover the full
LNKCTL register instead of touching just a single byte of the register.
Fixes: 0c8173385e54 ("rtl8192ce: Add new driver")
Cc: stable@vger.kernel.org
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20231124084725.12738-3-ilpo.jarvinen@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/realtek/rtlwifi/pci.c | 21 +++++++++++++++------
1 file changed, 15 insertions(+), 6 deletions(-)
--- a/drivers/net/wireless/realtek/rtlwifi/pci.c
+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c
@@ -164,21 +164,29 @@ static bool _rtl_pci_platform_switch_dev
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
+ value &= PCI_EXP_LNKCTL_ASPMC;
+
if (rtlhal->hw_type != HARDWARE_TYPE_RTL8192SE)
- value |= 0x40;
+ value |= PCI_EXP_LNKCTL_CCC;
- pci_write_config_byte(rtlpci->pdev, 0x80, value);
+ pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_ASPMC | value,
+ value);
return false;
}
-/*When we set 0x01 to enable clk request. Set 0x0 to disable clk req.*/
-static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u8 value)
+/* @value is PCI_EXP_LNKCTL_CLKREQ_EN or 0 to enable/disable clk request. */
+static void _rtl_pci_switch_clk_req(struct ieee80211_hw *hw, u16 value)
{
struct rtl_pci *rtlpci = rtl_pcidev(rtl_pcipriv(hw));
struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw));
- pci_write_config_byte(rtlpci->pdev, 0x81, value);
+ value &= PCI_EXP_LNKCTL_CLKREQ_EN;
+
+ pcie_capability_clear_and_set_word(rtlpci->pdev, PCI_EXP_LNKCTL,
+ PCI_EXP_LNKCTL_CLKREQ_EN,
+ value);
if (rtlhal->hw_type == HARDWARE_TYPE_RTL8192SE)
udelay(100);
@@ -259,7 +267,8 @@ static void rtl_pci_enable_aspm(struct i
if (ppsc->reg_rfps_level & RT_RF_OFF_LEVL_CLK_REQ) {
_rtl_pci_switch_clk_req(hw, (ppsc->reg_rfps_level &
- RT_RF_OFF_LEVL_CLK_REQ) ? 1 : 0);
+ RT_RF_OFF_LEVL_CLK_REQ) ?
+ PCI_EXP_LNKCTL_CLKREQ_EN : 0);
RT_SET_PS_LEVEL(ppsc, RT_RF_OFF_LEVL_CLK_REQ);
}
udelay(100);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 280/374] wifi: mwifiex: configure BSSID consistently when starting AP
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (278 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 279/374] wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 281/374] PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support Greg Kroah-Hartman
` (94 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lin, Francesco Dolcini,
Brian Norris, Kalle Valo, Rafael Beims
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Lin <yu-hao.lin@nxp.com>
commit f0dd488e11e71ac095df7638d892209c629d9af2 upstream.
AP BSSID configuration is missing at AP start. Without this fix, FW returns
STA interface MAC address after first init. When hostapd restarts, it gets MAC
address from netdev before driver sets STA MAC to netdev again. Now MAC address
between hostapd and net interface are different causes STA cannot connect to
AP. After that MAC address of uap0 mlan0 become the same. And issue disappears
after following hostapd restart (another issue is AP/STA MAC address become the
same).
This patch fixes the issue cleanly.
Signed-off-by: David Lin <yu-hao.lin@nxp.com>
Fixes: 12190c5d80bd ("mwifiex: add cfg80211 start_ap and stop_ap handlers")
Cc: stable@vger.kernel.org
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Tested-by: Rafael Beims <rafael.beims@toradex.com> # Verdin iMX8MP/SD8997 SD
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://msgid.link/20231215005118.17031-1-yu-hao.lin@nxp.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 ++
drivers/net/wireless/marvell/mwifiex/fw.h | 1 +
drivers/net/wireless/marvell/mwifiex/ioctl.h | 1 +
drivers/net/wireless/marvell/mwifiex/uap_cmd.c | 8 ++++++++
4 files changed, 12 insertions(+)
--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c
@@ -1980,6 +1980,8 @@ static int mwifiex_cfg80211_start_ap(str
mwifiex_set_sys_config_invalid_data(bss_cfg);
+ memcpy(bss_cfg->mac_addr, priv->curr_addr, ETH_ALEN);
+
if (params->beacon_interval)
bss_cfg->beacon_period = params->beacon_interval;
if (params->dtim_period)
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -177,6 +177,7 @@ enum MWIFIEX_802_11_PRIVACY_FILTER {
#define TLV_TYPE_STA_MAC_ADDR (PROPRIETARY_TLV_BASE_ID + 32)
#define TLV_TYPE_BSSID (PROPRIETARY_TLV_BASE_ID + 35)
#define TLV_TYPE_CHANNELBANDLIST (PROPRIETARY_TLV_BASE_ID + 42)
+#define TLV_TYPE_UAP_MAC_ADDRESS (PROPRIETARY_TLV_BASE_ID + 43)
#define TLV_TYPE_UAP_BEACON_PERIOD (PROPRIETARY_TLV_BASE_ID + 44)
#define TLV_TYPE_UAP_DTIM_PERIOD (PROPRIETARY_TLV_BASE_ID + 45)
#define TLV_TYPE_UAP_BCAST_SSID (PROPRIETARY_TLV_BASE_ID + 48)
--- a/drivers/net/wireless/marvell/mwifiex/ioctl.h
+++ b/drivers/net/wireless/marvell/mwifiex/ioctl.h
@@ -119,6 +119,7 @@ struct mwifiex_uap_bss_param {
u8 qos_info;
u8 power_constraint;
struct mwifiex_types_wmm_info wmm_info;
+ u8 mac_addr[ETH_ALEN];
};
enum {
--- a/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/uap_cmd.c
@@ -480,6 +480,7 @@ void mwifiex_config_uap_11d(struct mwifi
static int
mwifiex_uap_bss_param_prepare(u8 *tlv, void *cmd_buf, u16 *param_size)
{
+ struct host_cmd_tlv_mac_addr *mac_tlv;
struct host_cmd_tlv_dtim_period *dtim_period;
struct host_cmd_tlv_beacon_period *beacon_period;
struct host_cmd_tlv_ssid *ssid;
@@ -499,6 +500,13 @@ mwifiex_uap_bss_param_prepare(u8 *tlv, v
int i;
u16 cmd_size = *param_size;
+ mac_tlv = (struct host_cmd_tlv_mac_addr *)tlv;
+ mac_tlv->header.type = cpu_to_le16(TLV_TYPE_UAP_MAC_ADDRESS);
+ mac_tlv->header.len = cpu_to_le16(ETH_ALEN);
+ memcpy(mac_tlv->mac_addr, bss_cfg->mac_addr, ETH_ALEN);
+ cmd_size += sizeof(struct host_cmd_tlv_mac_addr);
+ tlv += sizeof(struct host_cmd_tlv_mac_addr);
+
if (bss_cfg->ssid.ssid_len) {
ssid = (struct host_cmd_tlv_ssid *)tlv;
ssid->header.type = cpu_to_le16(TLV_TYPE_UAP_SSID);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 281/374] PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (279 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 280/374] wifi: mwifiex: configure BSSID consistently when starting AP Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 282/374] PCI: mediatek: Clear interrupt status before dispatching handler Greg Kroah-Hartman
` (93 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel,
Krzysztof Wilczyński, Manivannan Sadhasivam,
Kishon Vijay Abraham I
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <niklas.cassel@wdc.com>
commit 2217fffcd63f86776c985d42e76daa43a56abdf1 upstream.
Commit 6f5e193bfb55 ("PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get
correct MSI-X table address") modified dw_pcie_ep_raise_msix_irq() to
support iATUs which require a specific alignment.
However, this support cannot have been properly tested.
The whole point is for the iATU to map an address that is aligned,
using dw_pcie_ep_map_addr(), and then let the writel() write to
ep->msi_mem + aligned_offset.
Thus, modify the address that is mapped such that it is aligned.
With this change, dw_pcie_ep_raise_msix_irq() matches the logic in
dw_pcie_ep_raise_msi_irq().
Link: https://lore.kernel.org/linux-pci/20231128132231.2221614-1-nks@flawful.org
Fixes: 6f5e193bfb55 ("PCI: dwc: Fix dw_pcie_ep_raise_msix_irq() to get correct MSI-X table address")
Signed-off-by: Niklas Cassel <niklas.cassel@wdc.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Cc: stable@vger.kernel.org # 5.7
Cc: Kishon Vijay Abraham I <kishon@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-designware-ep.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -589,6 +589,7 @@ int dw_pcie_ep_raise_msix_irq(struct dw_
}
aligned_offset = msg_addr & (epc->mem->window.page_size - 1);
+ msg_addr &= ~aligned_offset;
ret = dw_pcie_ep_map_addr(epc, func_no, 0, ep->msi_mem_phys, msg_addr,
epc->mem->window.page_size);
if (ret)
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 282/374] PCI: mediatek: Clear interrupt status before dispatching handler
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (280 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 281/374] PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 283/374] x86/kvm: Do not try to disable kvmclock if it was not enabled Greg Kroah-Hartman
` (92 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, qizhong cheng, Jianjun Wang,
Krzysztof Wilczyński, Bjorn Helgaas,
AngeloGioacchino Del Regno
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: qizhong cheng <qizhong.cheng@mediatek.com>
commit 4e11c29873a8a296a20f99b3e03095e65ebf897d upstream.
We found a failure when using the iperf tool during WiFi performance
testing, where some MSIs were received while clearing the interrupt
status, and these MSIs cannot be serviced.
The interrupt status can be cleared even if the MSI status remains pending.
As such, given the edge-triggered interrupt type, its status should be
cleared before being dispatched to the handler of the underling device.
[kwilczynski: commit log, code comment wording]
Link: https://lore.kernel.org/linux-pci/20231211094923.31967-1-jianjun.wang@mediatek.com
Fixes: 43e6409db64d ("PCI: mediatek: Add MSI support for MT2712 and MT7622")
Signed-off-by: qizhong cheng <qizhong.cheng@mediatek.com>
Signed-off-by: Jianjun Wang <jianjun.wang@mediatek.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
[bhelgaas: rewrap comment]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-mediatek.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/pci/controller/pcie-mediatek.c
+++ b/drivers/pci/controller/pcie-mediatek.c
@@ -624,12 +624,18 @@ static void mtk_pcie_intr_handler(struct
if (status & MSI_STATUS){
unsigned long imsi_status;
+ /*
+ * The interrupt status can be cleared even if the
+ * MSI status remains pending. As such, given the
+ * edge-triggered interrupt type, its status should
+ * be cleared before being dispatched to the
+ * handler of the underlying device.
+ */
+ writel(MSI_STATUS, port->base + PCIE_INT_STATUS);
while ((imsi_status = readl(port->base + PCIE_IMSI_STATUS))) {
for_each_set_bit(bit, &imsi_status, MTK_MSI_IRQS_NUM)
generic_handle_domain_irq(port->inner_domain, bit);
}
- /* Clear MSI interrupt status */
- writel(MSI_STATUS, port->base + PCIE_INT_STATUS);
}
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 283/374] x86/kvm: Do not try to disable kvmclock if it was not enabled
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (281 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 282/374] PCI: mediatek: Clear interrupt status before dispatching handler Greg Kroah-Hartman
@ 2024-01-22 23:58 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 284/374] KVM: arm64: vgic-v4: Restore pending state on host userspace write Greg Kroah-Hartman
` (91 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:58 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kirill A. Shutemov,
Sean Christopherson, Vitaly Kuznetsov, Paolo Bonzini, Wanpeng Li
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
commit 1c6d984f523f67ecfad1083bb04c55d91977bb15 upstream.
kvm_guest_cpu_offline() tries to disable kvmclock regardless if it is
present in the VM. It leads to write to a MSR that doesn't exist on some
configurations, namely in TDX guest:
unchecked MSR access error: WRMSR to 0x12 (tried to write 0x0000000000000000)
at rIP: 0xffffffff8110687c (kvmclock_disable+0x1c/0x30)
kvmclock enabling is gated by CLOCKSOURCE and CLOCKSOURCE2 KVM paravirt
features.
Do not disable kvmclock if it was not enabled.
Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Fixes: c02027b5742b ("x86/kvm: Disable kvmclock on all CPUs on shutdown")
Reviewed-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Wanpeng Li <wanpengli@tencent.com>
Cc: stable@vger.kernel.org
Message-Id: <20231205004510.27164-6-kirill.shutemov@linux.intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/kvmclock.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c
@@ -24,8 +24,8 @@
static int kvmclock __initdata = 1;
static int kvmclock_vsyscall __initdata = 1;
-static int msr_kvm_system_time __ro_after_init = MSR_KVM_SYSTEM_TIME;
-static int msr_kvm_wall_clock __ro_after_init = MSR_KVM_WALL_CLOCK;
+static int msr_kvm_system_time __ro_after_init;
+static int msr_kvm_wall_clock __ro_after_init;
static u64 kvm_sched_clock_offset __ro_after_init;
static int __init parse_no_kvmclock(char *arg)
@@ -195,7 +195,8 @@ static void kvm_setup_secondary_clock(vo
void kvmclock_disable(void)
{
- native_write_msr(msr_kvm_system_time, 0, 0);
+ if (msr_kvm_system_time)
+ native_write_msr(msr_kvm_system_time, 0, 0);
}
static void __init kvmclock_init_mem(void)
@@ -291,7 +292,10 @@ void __init kvmclock_init(void)
if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE2)) {
msr_kvm_system_time = MSR_KVM_SYSTEM_TIME_NEW;
msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK_NEW;
- } else if (!kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) {
+ } else if (kvm_para_has_feature(KVM_FEATURE_CLOCKSOURCE)) {
+ msr_kvm_system_time = MSR_KVM_SYSTEM_TIME;
+ msr_kvm_wall_clock = MSR_KVM_WALL_CLOCK;
+ } else {
return;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 284/374] KVM: arm64: vgic-v4: Restore pending state on host userspace write
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (282 preceding siblings ...)
2024-01-22 23:58 ` [PATCH 5.15 283/374] x86/kvm: Do not try to disable kvmclock if it was not enabled Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 285/374] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache Greg Kroah-Hartman
` (90 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kunkun Jiang, Marc Zyngier,
Zenghui Yu
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marc Zyngier <maz@kernel.org>
commit 7b95382f965133ef61ce44aaabc518c16eb46909 upstream.
When the VMM writes to ISPENDR0 to set the state pending state of
an SGI, we fail to convey this to the HW if this SGI is already
backed by a GICv4.1 vSGI.
This is a bit of a corner case, as this would only occur if the
vgic state is changed on an already running VM, but this can
apparently happen across a guest reset driven by the VMM.
Fix this by always writing out the pending_latch value to the
HW, and reseting it to false.
Reported-by: Kunkun Jiang <jiangkunkun@huawei.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Zenghui Yu <yuzenghui@huawei.com>
Cc: stable@vger.kernel.org # 5.10+
Link: https://lore.kernel.org/r/7e7f2c0c-448b-10a9-8929-4b8f4f6e2a32@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-mmio-v3.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
--- a/arch/arm64/kvm/vgic/vgic-mmio-v3.c
+++ b/arch/arm64/kvm/vgic/vgic-mmio-v3.c
@@ -363,19 +363,26 @@ static int vgic_v3_uaccess_write_pending
struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i);
raw_spin_lock_irqsave(&irq->irq_lock, flags);
- if (test_bit(i, &val)) {
- /*
- * pending_latch is set irrespective of irq type
- * (level or edge) to avoid dependency that VM should
- * restore irq config before pending info.
- */
- irq->pending_latch = true;
- vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
- } else {
+
+ /*
+ * pending_latch is set irrespective of irq type
+ * (level or edge) to avoid dependency that VM should
+ * restore irq config before pending info.
+ */
+ irq->pending_latch = test_bit(i, &val);
+
+ if (irq->hw && vgic_irq_is_sgi(irq->intid)) {
+ irq_set_irqchip_state(irq->host_irq,
+ IRQCHIP_STATE_PENDING,
+ irq->pending_latch);
irq->pending_latch = false;
- raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
}
+ if (irq->pending_latch)
+ vgic_queue_irq_unlock(vcpu->kvm, irq, flags);
+ else
+ raw_spin_unlock_irqrestore(&irq->irq_lock, flags);
+
vgic_put_irq(vcpu->kvm, irq);
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 285/374] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (283 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 284/374] KVM: arm64: vgic-v4: Restore pending state on host userspace write Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 287/374] HID: wacom: Correct behavior when processing some confidence == false touches Greg Kroah-Hartman
` (89 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Upton, Marc Zyngier
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Upton <oliver.upton@linux.dev>
commit ad362fe07fecf0aba839ff2cc59a3617bd42c33f upstream.
There is a potential UAF scenario in the case of an LPI translation
cache hit racing with an operation that invalidates the cache, such
as a DISCARD ITS command. The root of the problem is that
vgic_its_check_cache() does not elevate the refcount on the vgic_irq
before dropping the lock that serializes refcount changes.
Have vgic_its_check_cache() raise the refcount on the returned vgic_irq
and add the corresponding decrement after queueing the interrupt.
Cc: stable@vger.kernel.org
Signed-off-by: Oliver Upton <oliver.upton@linux.dev>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Link: https://lore.kernel.org/r/20240104183233.3560639-1-oliver.upton@linux.dev
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/kvm/vgic/vgic-its.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/arch/arm64/kvm/vgic/vgic-its.c
+++ b/arch/arm64/kvm/vgic/vgic-its.c
@@ -584,7 +584,11 @@ static struct vgic_irq *vgic_its_check_c
unsigned long flags;
raw_spin_lock_irqsave(&dist->lpi_list_lock, flags);
+
irq = __vgic_its_check_cache(dist, db, devid, eventid);
+ if (irq)
+ vgic_get_irq_kref(irq);
+
raw_spin_unlock_irqrestore(&dist->lpi_list_lock, flags);
return irq;
@@ -763,6 +767,7 @@ int vgic_its_inject_cached_translation(s
raw_spin_lock_irqsave(&irq->irq_lock, flags);
irq->pending_latch = true;
vgic_queue_irq_unlock(kvm, irq, flags);
+ vgic_put_irq(kvm, irq);
return 0;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 287/374] HID: wacom: Correct behavior when processing some confidence == false touches
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (284 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 285/374] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 289/374] serial: sc16is7xx: set safe default SPI clock frequency Greg Kroah-Hartman
` (88 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tatsunosuke Tobita, Ping Cheng,
Jason Gerecke, Jiri Kosina
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gerecke <jason.gerecke@wacom.com>
commit 502296030ec6b0329e00f9fb15018e170cc63037 upstream.
There appear to be a few different ways that Wacom devices can deal with
confidence:
1. If the device looses confidence in a touch, it will first clear
the tipswitch flag in one report, and then clear the confidence
flag in a second report. This behavior is used by e.g. DTH-2452.
2. If the device looses confidence in a touch, it will clear both
the tipswitch and confidence flags within the same report. This
behavior is used by some AES devices.
3. If the device looses confidence in a touch, it will clear *only*
the confidence bit. The tipswitch bit will remain set so long as
the touch is tracked. This behavior may be used in future devices.
The driver does not currently handle situation 3 properly. Touches that
loose confidence will remain "in prox" and essentially frozen in place
until the tipswitch bit is finally cleared. Not only does this result
in userspace seeing a stuck touch, but it also prevents pen arbitration
from working properly (the pen won't send events until all touches are
up, but we don't currently process events from non-confident touches).
This commit centralizes the checking of the confidence bit in the
wacom_wac_finger_slot() function and has 'prox' depend on it. In the
case where situation 3 is encountered, the treat the touch as though
it was removed, allowing both userspace and the pen arbitration to
act normally.
Signed-off-by: Tatsunosuke Tobita <tatsunosuke.tobita@wacom.com>
Signed-off-by: Ping Cheng <ping.cheng@wacom.com>
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Fixes: 7fb0413baa7f ("HID: wacom: Use "Confidence" flag to prevent reporting invalid contacts")
Cc: stable@vger.kernel.org
Signed-off-by: Jiri Kosina <jkosina@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/wacom_wac.c | 32 ++++----------------------------
1 file changed, 4 insertions(+), 28 deletions(-)
--- a/drivers/hid/wacom_wac.c
+++ b/drivers/hid/wacom_wac.c
@@ -2623,8 +2623,8 @@ static void wacom_wac_finger_slot(struct
{
struct hid_data *hid_data = &wacom_wac->hid_data;
bool mt = wacom_wac->features.touch_max > 1;
- bool prox = hid_data->tipswitch &&
- report_touch_events(wacom_wac);
+ bool touch_down = hid_data->tipswitch && hid_data->confidence;
+ bool prox = touch_down && report_touch_events(wacom_wac);
if (touch_is_muted(wacom_wac)) {
if (!wacom_wac->shared->touch_down)
@@ -2674,24 +2674,6 @@ static void wacom_wac_finger_slot(struct
}
}
-static bool wacom_wac_slot_is_active(struct input_dev *dev, int key)
-{
- struct input_mt *mt = dev->mt;
- struct input_mt_slot *s;
-
- if (!mt)
- return false;
-
- for (s = mt->slots; s != mt->slots + mt->num_slots; s++) {
- if (s->key == key &&
- input_mt_get_value(s, ABS_MT_TRACKING_ID) >= 0) {
- return true;
- }
- }
-
- return false;
-}
-
static void wacom_wac_finger_event(struct hid_device *hdev,
struct hid_field *field, struct hid_usage *usage, __s32 value)
{
@@ -2742,14 +2724,8 @@ static void wacom_wac_finger_event(struc
}
if (usage->usage_index + 1 == field->report_count) {
- if (equivalent_usage == wacom_wac->hid_data.last_slot_field) {
- bool touch_removed = wacom_wac_slot_is_active(wacom_wac->touch_input,
- wacom_wac->hid_data.id) && !wacom_wac->hid_data.tipswitch;
-
- if (wacom_wac->hid_data.confidence || touch_removed) {
- wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
- }
- }
+ if (equivalent_usage == wacom_wac->hid_data.last_slot_field)
+ wacom_wac_finger_slot(wacom_wac, wacom_wac->touch_input);
}
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 289/374] serial: sc16is7xx: set safe default SPI clock frequency
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (285 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 287/374] HID: wacom: Correct behavior when processing some confidence == false touches Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 290/374] iommu/dma: Trace bounce buffer usage when mapping buffers Greg Kroah-Hartman
` (87 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Hugo Villeneuve
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
commit 3ef79cd1412236d884ab0c46b4d1921380807b48 upstream.
15 MHz is supported only by 76x variants.
If the SPI clock frequency is not specified, use a safe default clock value
of 4 MHz that is supported by all variants.
Also use HZ_PER_MHZ macro to improve readability.
Fixes: 2c837a8a8f9f ("sc16is7xx: spi interface is added")
Cc: <stable@vger.kernel.org>
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Link: https://lore.kernel.org/r/20231221231823.2327894-4-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/sc16is7xx.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/sc16is7xx.c
+++ b/drivers/tty/serial/sc16is7xx.c
@@ -24,6 +24,7 @@
#include <linux/tty_flip.h>
#include <linux/spi/spi.h>
#include <linux/uaccess.h>
+#include <linux/units.h>
#include <uapi/linux/sched/types.h>
#define SC16IS7XX_NAME "sc16is7xx"
@@ -1454,7 +1455,7 @@ static int sc16is7xx_spi_probe(struct sp
return dev_err_probe(&spi->dev, -EINVAL, "Unsupported SPI mode\n");
spi->mode = spi->mode ? : SPI_MODE_0;
- spi->max_speed_hz = spi->max_speed_hz ? : 15000000;
+ spi->max_speed_hz = spi->max_speed_hz ? : 4 * HZ_PER_MHZ;
ret = spi_setup(spi);
if (ret)
return ret;
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 290/374] iommu/dma: Trace bounce buffer usage when mapping buffers
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (286 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 289/374] serial: sc16is7xx: set safe default SPI clock frequency Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 291/374] ARM: 9330/1: davinci: also select PINCTRL Greg Kroah-Hartman
` (86 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Tom Murphy, Lu Baolu,
Saravana Kannan, Isaac J. Manjarres, Joerg Roedel
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Isaac J. Manjarres <isaacmanjarres@google.com>
commit a63c357b9fd56ad5fe64616f5b22835252c6a76a upstream.
When commit 82612d66d51d ("iommu: Allow the dma-iommu api to
use bounce buffers") was introduced, it did not add the logic
for tracing the bounce buffer usage from iommu_dma_map_page().
All of the users of swiotlb_tbl_map_single() trace their bounce
buffer usage, except iommu_dma_map_page(). This makes it difficult
to track SWIOTLB usage from that function. Thus, trace bounce buffer
usage from iommu_dma_map_page().
Fixes: 82612d66d51d ("iommu: Allow the dma-iommu api to use bounce buffers")
Cc: stable@vger.kernel.org # v5.15+
Cc: Tom Murphy <murphyt7@tcd.ie>
Cc: Lu Baolu <baolu.lu@linux.intel.com>
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Link: https://lore.kernel.org/r/20231208234141.2356157-1-isaacmanjarres@google.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>
Signed-off-by: Isaac J. Manjarres <isaacmanjarres@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/dma-iommu.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/iommu/dma-iommu.c
+++ b/drivers/iommu/dma-iommu.c
@@ -25,6 +25,7 @@
#include <linux/vmalloc.h>
#include <linux/crash_dump.h>
#include <linux/dma-direct.h>
+#include <trace/events/swiotlb.h>
struct iommu_dma_msi_page {
struct list_head list;
@@ -817,6 +818,8 @@ static dma_addr_t iommu_dma_map_page(str
void *padding_start;
size_t padding_size, aligned_size;
+ trace_swiotlb_bounced(dev, phys, size, swiotlb_force);
+
aligned_size = iova_align(iovad, size);
phys = swiotlb_tbl_map_single(dev, phys, size, aligned_size,
iova_mask(iovad), dir, attrs);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 291/374] ARM: 9330/1: davinci: also select PINCTRL
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (287 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 290/374] iommu/dma: Trace bounce buffer usage when mapping buffers Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 292/374] mfd: syscon: Fix null pointer dereference in of_syscon_register() Greg Kroah-Hartman
` (85 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Randy Dunlap, kernel test robot,
Bartosz Golaszewski, Arnd Bergmann, linux-arm-kernel, patches,
Russell King (Oracle), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit f54e8634d1366926c807e2af6125b33cff555fa7 ]
kconfig warns when PINCTRL_SINGLE is selected but PINCTRL is not
set, so also set PINCTRL for ARCH_DAVINCI. This prevents a
kconfig/build warning:
WARNING: unmet direct dependencies detected for PINCTRL_SINGLE
Depends on [n]: PINCTRL [=n] && OF [=y] && HAS_IOMEM [=y]
Selected by [y]:
- ARCH_DAVINCI [=y] && ARCH_MULTI_V5 [=y]
Closes: lore.kernel.org/r/202311070548.0f6XfBrh-lkp@intel.com
Fixes: f962396ce292 ("ARM: davinci: support multiplatform build for ARM v5")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reported-by: kernel test robot <lkp@intel.com>
Cc: Bartosz Golaszewski <brgl@bgdev.pl>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: linux-arm-kernel@lists.infradead.org
Cc: patches@armlinux.org.uk
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/arm/mach-davinci/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/arm/mach-davinci/Kconfig b/arch/arm/mach-davinci/Kconfig
index 01684347da9b..889f3b9255c7 100644
--- a/arch/arm/mach-davinci/Kconfig
+++ b/arch/arm/mach-davinci/Kconfig
@@ -10,6 +10,7 @@ menuconfig ARCH_DAVINCI
select PM_GENERIC_DOMAINS_OF if PM && OF
select REGMAP_MMIO
select RESET_CONTROLLER
+ select PINCTRL
select PINCTRL_SINGLE
if ARCH_DAVINCI
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 292/374] mfd: syscon: Fix null pointer dereference in of_syscon_register()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (288 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 291/374] ARM: 9330/1: davinci: also select PINCTRL Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 293/374] leds: aw2013: Select missing dependency REGMAP_I2C Greg Kroah-Hartman
` (84 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Arnd Bergmann, Lee Jones,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit 41673c66b3d0c09915698fec5c13b24336f18dd1 ]
kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Fixes: e15d7f2b81d2 ("mfd: syscon: Use a unique name with regmap_config")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Reviewed-by: Arnd Bergmann <arnd@arndb.de>
Link: https://lore.kernel.org/r/20231204092443.2462115-1-chentao@kylinos.cn
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/syscon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/mfd/syscon.c b/drivers/mfd/syscon.c
index 191fdb87c424..552b1861adad 100644
--- a/drivers/mfd/syscon.c
+++ b/drivers/mfd/syscon.c
@@ -103,6 +103,10 @@ static struct syscon *of_syscon_register(struct device_node *np, bool check_clk)
syscon_config.name = kasprintf(GFP_KERNEL, "%pOFn@%llx", np,
(u64)res.start);
+ if (!syscon_config.name) {
+ ret = -ENOMEM;
+ goto err_regmap;
+ }
syscon_config.reg_stride = reg_io_width;
syscon_config.val_bits = reg_io_width * 8;
syscon_config.max_register = resource_size(&res) - reg_io_width;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 293/374] leds: aw2013: Select missing dependency REGMAP_I2C
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (289 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 292/374] mfd: syscon: Fix null pointer dereference in of_syscon_register() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 294/374] mfd: intel-lpss: Fix the fractional clock divider flags Greg Kroah-Hartman
` (83 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dang Huynh, Nikita Travkin,
Lee Jones, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dang Huynh <danct12@riseup.net>
[ Upstream commit 75469bb0537ad2ab0fc1fb6e534a79cfc03f3b3f ]
The AW2013 driver uses devm_regmap_init_i2c, so REGMAP_I2C needs to
be selected.
Otherwise build process may fail with:
ld: drivers/leds/leds-aw2013.o: in function `aw2013_probe':
leds-aw2013.c:345: undefined reference to `__devm_regmap_init_i2c'
Signed-off-by: Dang Huynh <danct12@riseup.net>
Acked-by: Nikita Travkin <nikita@trvn.ru>
Fixes: 59ea3c9faf32 ("leds: add aw2013 driver")
Link: https://lore.kernel.org/r/20231103114203.1108922-1-danct12@riseup.net
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/leds/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/leds/Kconfig b/drivers/leds/Kconfig
index 8bf545100fb0..fdfc41535c8a 100644
--- a/drivers/leds/Kconfig
+++ b/drivers/leds/Kconfig
@@ -97,6 +97,7 @@ config LEDS_ARIEL
config LEDS_AW2013
tristate "LED support for Awinic AW2013"
depends on LEDS_CLASS && I2C && OF
+ select REGMAP_I2C
help
This option enables support for the AW2013 3-channel
LED driver.
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 294/374] mfd: intel-lpss: Fix the fractional clock divider flags
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (290 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 293/374] leds: aw2013: Select missing dependency REGMAP_I2C Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 295/374] mips: dmi: Fix early remap on MIPS32 Greg Kroah-Hartman
` (82 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko, Alex Vinarskis,
Lee Jones, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
[ Upstream commit 03d790f04fb2507173913cad9c213272ac983a60 ]
The conversion to CLK_FRAC_DIVIDER_POWER_OF_TWO_PS uses wrong flags
in the parameters and hence miscalculates the values in the clock
divider. Fix this by applying the flag to the proper parameter.
Fixes: 82f53f9ee577 ("clk: fractional-divider: Introduce POWER_OF_TWO_PS flag")
Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reported-by: Alex Vinarskis <alex.vinarskis@gmail.com>
Link: https://lore.kernel.org/r/20231211111441.3910083-1-andriy.shevchenko@linux.intel.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/mfd/intel-lpss.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
index 0e15afc39f54..b1a0cd34e8a9 100644
--- a/drivers/mfd/intel-lpss.c
+++ b/drivers/mfd/intel-lpss.c
@@ -301,8 +301,8 @@ static int intel_lpss_register_clock_divider(struct intel_lpss *lpss,
snprintf(name, sizeof(name), "%s-div", devname);
tmp = clk_register_fractional_divider(NULL, name, __clk_get_name(tmp),
+ 0, lpss->priv, 1, 15, 16, 15,
CLK_FRAC_DIVIDER_POWER_OF_TWO_PS,
- lpss->priv, 1, 15, 16, 15, 0,
NULL);
if (IS_ERR(tmp))
return PTR_ERR(tmp);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 295/374] mips: dmi: Fix early remap on MIPS32
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (291 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 294/374] mfd: intel-lpss: Fix the fractional clock divider flags Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 296/374] mips: Fix incorrect max_low_pfn adjustment Greg Kroah-Hartman
` (81 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge Semin, Thomas Bogendoerfer,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <fancer.lancer@gmail.com>
[ Upstream commit 0d0a3748a2cb38f9da1f08d357688ebd982eb788 ]
dmi_early_remap() has been defined as ioremap_cache() which on MIPS32 gets
to be converted to the VM-based mapping. DMI early remapping is performed
at the setup_arch() stage with no VM available. So calling the
dmi_early_remap() for MIPS32 causes the system to crash at the early boot
time. Fix that by converting dmi_early_remap() to the uncached remapping
which is always available on both 32 and 64-bits MIPS systems.
Note this change shall not cause any regressions on the current DMI
support implementation because on the early boot-up stage neither MIPS32
nor MIPS64 has the cacheable ioremapping support anyway.
Fixes: be8fa1cb444c ("MIPS: Add support for Desktop Management Interface (DMI)")
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/include/asm/dmi.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/include/asm/dmi.h b/arch/mips/include/asm/dmi.h
index 27415a288adf..dc397f630c66 100644
--- a/arch/mips/include/asm/dmi.h
+++ b/arch/mips/include/asm/dmi.h
@@ -5,7 +5,7 @@
#include <linux/io.h>
#include <linux/memblock.h>
-#define dmi_early_remap(x, l) ioremap_cache(x, l)
+#define dmi_early_remap(x, l) ioremap(x, l)
#define dmi_early_unmap(x, l) iounmap(x)
#define dmi_remap(x, l) ioremap_cache(x, l)
#define dmi_unmap(x) iounmap(x)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 296/374] mips: Fix incorrect max_low_pfn adjustment
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (292 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 295/374] mips: dmi: Fix early remap on MIPS32 Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 297/374] riscv: Check if the code to patch lies in the exit section Greg Kroah-Hartman
` (80 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Serge Semin, Thomas Bogendoerfer,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Serge Semin <fancer.lancer@gmail.com>
[ Upstream commit 0f5cc249ff73552d3bd864e62f85841dafaa107d ]
max_low_pfn variable is incorrectly adjusted if the kernel is built with
high memory support and the later is detected in a running system, so the
memory which actually can be directly mapped is getting into the highmem
zone. See the ZONE_NORMAL range on my MIPS32r5 system:
> Zone ranges:
> DMA [mem 0x0000000000000000-0x0000000000ffffff]
> Normal [mem 0x0000000001000000-0x0000000007ffffff]
> HighMem [mem 0x0000000008000000-0x000000020fffffff]
while the zones are supposed to look as follows:
> Zone ranges:
> DMA [mem 0x0000000000000000-0x0000000000ffffff]
> Normal [mem 0x0000000001000000-0x000000001fffffff]
> HighMem [mem 0x0000000020000000-0x000000020fffffff]
Even though the physical memory within the range [0x08000000;0x20000000]
belongs to MMIO on our system, we don't really want it to be considered as
high memory since on MIPS32 that range still can be directly mapped.
Note there might be other problems caused by the max_low_pfn variable
misconfiguration. For instance high_memory variable is initialize with
virtual address corresponding to the max_low_pfn PFN, and by design it
must define the upper bound on direct map memory, then end of the normal
zone. That in its turn potentially may cause problems in accessing the
memory by means of the /dev/mem and /dev/kmem devices.
Let's fix the discovered misconfiguration then. It turns out the commit
a94e4f24ec83 ("MIPS: init: Drop boot_mem_map") didn't introduce the
max_low_pfn adjustment quite correct. If the kernel is built with high
memory support and the system is equipped with high memory, the
max_low_pfn variable will need to be initialized with PFN of the most
upper directly reachable memory address so the zone normal would be
correctly setup. On MIPS that PFN corresponds to PFN_DOWN(HIGHMEM_START).
If the system is built with no high memory support and one is detected in
the running system, we'll just need to adjust the max_pfn variable to
discard the found high memory from the system and leave the max_low_pfn as
is, since the later will be less than PFN_DOWN(HIGHMEM_START) anyway by
design of the for_each_memblock() loop performed a bit early in the
bootmem_init() method.
Fixes: a94e4f24ec83 ("MIPS: init: Drop boot_mem_map")
Signed-off-by: Serge Semin <fancer.lancer@gmail.com>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/kernel/setup.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c
index 145f905fb362..9d53498682d2 100644
--- a/arch/mips/kernel/setup.c
+++ b/arch/mips/kernel/setup.c
@@ -324,11 +324,11 @@ static void __init bootmem_init(void)
panic("Incorrect memory mapping !!!");
if (max_pfn > PFN_DOWN(HIGHMEM_START)) {
+ max_low_pfn = PFN_DOWN(HIGHMEM_START);
#ifdef CONFIG_HIGHMEM
- highstart_pfn = PFN_DOWN(HIGHMEM_START);
+ highstart_pfn = max_low_pfn;
highend_pfn = max_pfn;
#else
- max_low_pfn = PFN_DOWN(HIGHMEM_START);
max_pfn = max_low_pfn;
#endif
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 297/374] riscv: Check if the code to patch lies in the exit section
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (293 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 296/374] mips: Fix incorrect max_low_pfn adjustment Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 298/374] riscv: Fix module_alloc() that did not reset the linear mapping permissions Greg Kroah-Hartman
` (79 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Ghiti, Charlie Jenkins,
Palmer Dabbelt, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <alexghiti@rivosinc.com>
[ Upstream commit 420370f3ae3d3b883813fd3051a38805160b2b9f ]
Otherwise we fall through to vmalloc_to_page() which panics since the
address does not lie in the vmalloc region.
Fixes: 043cb41a85de ("riscv: introduce interfaces to patch kernel code")
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Reviewed-by: Charlie Jenkins <charlie@rivosinc.com>
Link: https://lore.kernel.org/r/20231214091926.203439-1-alexghiti@rivosinc.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/include/asm/sections.h | 1 +
arch/riscv/kernel/patch.c | 11 ++++++++++-
arch/riscv/kernel/vmlinux-xip.lds.S | 2 ++
arch/riscv/kernel/vmlinux.lds.S | 2 ++
4 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/include/asm/sections.h b/arch/riscv/include/asm/sections.h
index 32336e8a17cb..a393d5035c54 100644
--- a/arch/riscv/include/asm/sections.h
+++ b/arch/riscv/include/asm/sections.h
@@ -13,6 +13,7 @@ extern char _start_kernel[];
extern char __init_data_begin[], __init_data_end[];
extern char __init_text_begin[], __init_text_end[];
extern char __alt_start[], __alt_end[];
+extern char __exittext_begin[], __exittext_end[];
static inline bool is_va_kernel_text(uintptr_t va)
{
diff --git a/arch/riscv/kernel/patch.c b/arch/riscv/kernel/patch.c
index e099961453cc..160e5c1caa9c 100644
--- a/arch/riscv/kernel/patch.c
+++ b/arch/riscv/kernel/patch.c
@@ -13,6 +13,7 @@
#include <asm/fixmap.h>
#include <asm/ftrace.h>
#include <asm/patch.h>
+#include <asm/sections.h>
struct patch_insn {
void *addr;
@@ -23,6 +24,14 @@ struct patch_insn {
int riscv_patch_in_stop_machine = false;
#ifdef CONFIG_MMU
+
+static inline bool is_kernel_exittext(uintptr_t addr)
+{
+ return system_state < SYSTEM_RUNNING &&
+ addr >= (uintptr_t)__exittext_begin &&
+ addr < (uintptr_t)__exittext_end;
+}
+
/*
* The fix_to_virt(, idx) needs a const value (not a dynamic variable of
* reg-a0) or BUILD_BUG_ON failed with "idx >= __end_of_fixed_addresses".
@@ -33,7 +42,7 @@ static __always_inline void *patch_map(void *addr, const unsigned int fixmap)
uintptr_t uintaddr = (uintptr_t) addr;
struct page *page;
- if (core_kernel_text(uintaddr))
+ if (core_kernel_text(uintaddr) || is_kernel_exittext(uintaddr))
page = phys_to_page(__pa_symbol(addr));
else if (IS_ENABLED(CONFIG_STRICT_MODULE_RWX))
page = vmalloc_to_page(addr);
diff --git a/arch/riscv/kernel/vmlinux-xip.lds.S b/arch/riscv/kernel/vmlinux-xip.lds.S
index 9c9f35091ef0..5407eafa166b 100644
--- a/arch/riscv/kernel/vmlinux-xip.lds.S
+++ b/arch/riscv/kernel/vmlinux-xip.lds.S
@@ -29,10 +29,12 @@ SECTIONS
HEAD_TEXT_SECTION
INIT_TEXT_SECTION(PAGE_SIZE)
/* we have to discard exit text and such at runtime, not link time */
+ __exittext_begin = .;
.exit.text :
{
EXIT_TEXT
}
+ __exittext_end = .;
.text : {
_text = .;
diff --git a/arch/riscv/kernel/vmlinux.lds.S b/arch/riscv/kernel/vmlinux.lds.S
index 5104f3a871e3..adcfe9c6a7bf 100644
--- a/arch/riscv/kernel/vmlinux.lds.S
+++ b/arch/riscv/kernel/vmlinux.lds.S
@@ -73,10 +73,12 @@ SECTIONS
__soc_builtin_dtb_table_end = .;
}
/* we have to discard exit text and such at runtime, not link time */
+ __exittext_begin = .;
.exit.text :
{
EXIT_TEXT
}
+ __exittext_end = .;
__init_text_end = .;
. = ALIGN(SECTION_ALIGN);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 298/374] riscv: Fix module_alloc() that did not reset the linear mapping permissions
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (294 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 297/374] riscv: Check if the code to patch lies in the exit section Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 299/374] MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() Greg Kroah-Hartman
` (78 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandre Ghiti, Palmer Dabbelt,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandre Ghiti <alexghiti@rivosinc.com>
[ Upstream commit 749b94b08005929bbc636df21a23322733166e35 ]
After unloading a module, we must reset the linear mapping permissions,
see the example below:
Before unloading a module:
0xffffaf809d65d000-0xffffaf809d6dc000 0x000000011d65d000 508K PTE . .. .. D A G . . W R V
0xffffaf809d6dc000-0xffffaf809d6dd000 0x000000011d6dc000 4K PTE . .. .. D A G . . . R V
0xffffaf809d6dd000-0xffffaf809d6e1000 0x000000011d6dd000 16K PTE . .. .. D A G . . W R V
0xffffaf809d6e1000-0xffffaf809d6e7000 0x000000011d6e1000 24K PTE . .. .. D A G . X . R V
After unloading a module:
0xffffaf809d65d000-0xffffaf809d6e1000 0x000000011d65d000 528K PTE . .. .. D A G . . W R V
0xffffaf809d6e1000-0xffffaf809d6e7000 0x000000011d6e1000 24K PTE . .. .. D A G . X W R V
The last mapping is not reset and we end up with WX mappings in the linear
mapping.
So add VM_FLUSH_RESET_PERMS to our module_alloc() definition.
Fixes: 0cff8bff7af8 ("riscv: avoid the PIC offset of static percpu data in module beyond 2G limits")
Signed-off-by: Alexandre Ghiti <alexghiti@rivosinc.com>
Link: https://lore.kernel.org/r/20231213134027.155327-2-alexghiti@rivosinc.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/riscv/kernel/module.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/arch/riscv/kernel/module.c b/arch/riscv/kernel/module.c
index 4a48287513c3..24c3883c80d0 100644
--- a/arch/riscv/kernel/module.c
+++ b/arch/riscv/kernel/module.c
@@ -423,7 +423,8 @@ void *module_alloc(unsigned long size)
{
return __vmalloc_node_range(size, 1, MODULES_VADDR,
MODULES_END, GFP_KERNEL,
- PAGE_KERNEL, 0, NUMA_NO_NODE,
+ PAGE_KERNEL, VM_FLUSH_RESET_PERMS,
+ NUMA_NO_NODE,
__builtin_return_address(0));
}
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 299/374] MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (295 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 298/374] riscv: Fix module_alloc() that did not reset the linear mapping permissions Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 300/374] MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() Greg Kroah-Hartman
` (77 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Thomas Bogendoerfer, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 89c4b588d11e9acf01d604de4b0c715884f59213 ]
When calling spi_register_board_info(), we should pass the number of
elements in 'db1200_spi_devs', not 'db1200_i2c_devs'.
Fixes: 63323ec54a7e ("MIPS: Alchemy: Extended DB1200 board support.")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/alchemy/devboards/db1200.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/alchemy/devboards/db1200.c b/arch/mips/alchemy/devboards/db1200.c
index f521874ebb07..67f067706af2 100644
--- a/arch/mips/alchemy/devboards/db1200.c
+++ b/arch/mips/alchemy/devboards/db1200.c
@@ -847,7 +847,7 @@ int __init db1200_dev_setup(void)
i2c_register_board_info(0, db1200_i2c_devs,
ARRAY_SIZE(db1200_i2c_devs));
spi_register_board_info(db1200_spi_devs,
- ARRAY_SIZE(db1200_i2c_devs));
+ ARRAY_SIZE(db1200_spi_devs));
/* SWITCHES: S6.8 I2C/SPI selector (OFF=I2C ON=SPI)
* S6.7 AC97/I2S selector (OFF=AC97 ON=I2S)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 300/374] MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (296 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 299/374] MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 301/374] power: supply: cw2015: correct time_to_empty units in sysfs Greg Kroah-Hartman
` (76 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET,
Thomas Bogendoerfer, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 3c1e5abcda64bed0c7bffa65af2316995f269a61 ]
When calling spi_register_board_info(),
Fixes: f869d42e580f ("MIPS: Alchemy: Improved DB1550 support, with audio and serial busses.")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/alchemy/devboards/db1550.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c
index 752b93d91ac9..06811a5db71d 100644
--- a/arch/mips/alchemy/devboards/db1550.c
+++ b/arch/mips/alchemy/devboards/db1550.c
@@ -588,7 +588,7 @@ int __init db1550_dev_setup(void)
i2c_register_board_info(0, db1550_i2c_devs,
ARRAY_SIZE(db1550_i2c_devs));
spi_register_board_info(db1550_spi_devs,
- ARRAY_SIZE(db1550_i2c_devs));
+ ARRAY_SIZE(db1550_spi_devs));
c = clk_get(NULL, "psc0_intclk");
if (!IS_ERR(c)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 301/374] power: supply: cw2015: correct time_to_empty units in sysfs
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (297 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 300/374] MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 302/374] power: supply: bq256xx: fix some problem in bq256xx_hw_init Greg Kroah-Hartman
` (75 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jan Palus, Sebastian Reichel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Palus <jpalus@fastmail.com>
[ Upstream commit f37669119423ca852ca855b24732f25c0737aa57 ]
RRT_ALRT register holds remaining battery time in minutes therefore it
needs to be scaled accordingly when exposing TIME_TO_EMPTY via sysfs
expressed in seconds
Fixes: b4c7715c10c1 ("power: supply: add CellWise cw2015 fuel gauge driver")
Signed-off-by: Jan Palus <jpalus@fastmail.com>
Link: https://lore.kernel.org/r/20231111221704.5579-1-jpalus@fastmail.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/cw2015_battery.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/power/supply/cw2015_battery.c b/drivers/power/supply/cw2015_battery.c
index 091868e9e9e8..587db9fd8624 100644
--- a/drivers/power/supply/cw2015_battery.c
+++ b/drivers/power/supply/cw2015_battery.c
@@ -490,7 +490,7 @@ static int cw_battery_get_property(struct power_supply *psy,
case POWER_SUPPLY_PROP_TIME_TO_EMPTY_NOW:
if (cw_battery_valid_time_to_empty(cw_bat))
- val->intval = cw_bat->time_to_empty;
+ val->intval = cw_bat->time_to_empty * 60;
else
val->intval = 0;
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 302/374] power: supply: bq256xx: fix some problem in bq256xx_hw_init
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (298 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 301/374] power: supply: cw2015: correct time_to_empty units in sysfs Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 303/374] serial: 8250: omap: Dont skip resource freeing if pm_runtime_resume_and_get() failed Greg Kroah-Hartman
` (74 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Su Hui, Sebastian Reichel,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Su Hui <suhui@nfschina.com>
[ Upstream commit b55d073e6501dc6077edaa945a6dad8ac5c8bbab ]
smatch complains that there is a buffer overflow and clang complains
'ret' is never read.
Smatch error:
drivers/power/supply/bq256xx_charger.c:1578 bq256xx_hw_init() error:
buffer overflow 'bq256xx_watchdog_time' 4 <= 4
Clang static checker:
Value stored to 'ret' is never read.
Add check for buffer overflow and error code from regmap_update_bits().
Fixes: 32e4978bb920 ("power: supply: bq256xx: Introduce the BQ256XX charger driver")
Signed-off-by: Su Hui <suhui@nfschina.com>
Link: https://lore.kernel.org/r/20231116041822.1378758-1-suhui@nfschina.com
Signed-off-by: Sebastian Reichel <sebastian.reichel@collabora.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/power/supply/bq256xx_charger.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/power/supply/bq256xx_charger.c b/drivers/power/supply/bq256xx_charger.c
index f501ecd49202..9fb7b44e890a 100644
--- a/drivers/power/supply/bq256xx_charger.c
+++ b/drivers/power/supply/bq256xx_charger.c
@@ -1514,13 +1514,16 @@ static int bq256xx_hw_init(struct bq256xx_device *bq)
wd_reg_val = i;
break;
}
- if (bq->watchdog_timer > bq256xx_watchdog_time[i] &&
+ if (i + 1 < BQ256XX_NUM_WD_VAL &&
+ bq->watchdog_timer > bq256xx_watchdog_time[i] &&
bq->watchdog_timer < bq256xx_watchdog_time[i + 1])
wd_reg_val = i;
}
ret = regmap_update_bits(bq->regmap, BQ256XX_CHARGER_CONTROL_1,
BQ256XX_WATCHDOG_MASK, wd_reg_val <<
BQ256XX_WDT_BIT_SHIFT);
+ if (ret)
+ return ret;
ret = power_supply_get_battery_info(bq->charger, &bat_info);
if (ret) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 303/374] serial: 8250: omap: Dont skip resource freeing if pm_runtime_resume_and_get() failed
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (299 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 302/374] power: supply: bq256xx: fix some problem in bq256xx_hw_init Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 304/374] libapi: Add missing linux/types.h header to get the __u64 type on io.h Greg Kroah-Hartman
` (73 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Uwe Kleine-König, Tony Lindgren,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit ad90d0358bd3b4554f243a425168fc7cebe7d04e ]
Returning an error code from .remove() makes the driver core emit the
little helpful error message:
remove callback returned a non-zero value. This will be ignored.
and then remove the device anyhow. So all resources that were not freed
are leaked in this case. Skipping serial8250_unregister_port() has the
potential to keep enough of the UART around to trigger a use-after-free.
So replace the error return (and with it the little helpful error
message) by a more useful error message and continue to cleanup.
Fixes: e3f0c638f428 ("serial: 8250: omap: Fix unpaired pm_runtime_put_sync() in omap8250_remove()")
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Reviewed-by: Tony Lindgren <tony@atomide.com>
Link: https://lore.kernel.org/r/20231110152927.70601-2-u.kleine-koenig@pengutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/8250/8250_omap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c
index 20e0703f1def..770c4cabdf9b 100644
--- a/drivers/tty/serial/8250/8250_omap.c
+++ b/drivers/tty/serial/8250/8250_omap.c
@@ -1492,7 +1492,7 @@ static int omap8250_remove(struct platform_device *pdev)
err = pm_runtime_resume_and_get(&pdev->dev);
if (err)
- return err;
+ dev_err(&pdev->dev, "Failed to resume hardware\n");
serial8250_unregister_port(priv->line);
priv->line = -ENODEV;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 304/374] libapi: Add missing linux/types.h header to get the __u64 type on io.h
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (300 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 303/374] serial: 8250: omap: Dont skip resource freeing if pm_runtime_resume_and_get() failed Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 305/374] usb: core: Allow subclassed USB drivers to override usb_choose_configuration() Greg Kroah-Hartman
` (72 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Adrian Hunter, Jiri Olsa,
Namhyung Kim, Arnaldo Carvalho de Melo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnaldo Carvalho de Melo <acme@redhat.com>
[ Upstream commit af76b2dec0984a079d8497bfa37d29a9b55932e1 ]
There are functions using __u64, so we need to have the linux/types.h
header otherwise we'll break when its not included before api/io.h.
Fixes: e95770af4c4a280f ("tools api: Add a lightweight buffered reading api")
Reviewed-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/lkml/ZWjDPL+IzPPsuC3X@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/lib/api/io.h | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/lib/api/io.h b/tools/lib/api/io.h
index 777c20f6b604..458acd294237 100644
--- a/tools/lib/api/io.h
+++ b/tools/lib/api/io.h
@@ -9,6 +9,7 @@
#include <stdlib.h>
#include <unistd.h>
+#include <linux/types.h>
struct io {
/* File descriptor being read/ */
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 305/374] usb: core: Allow subclassed USB drivers to override usb_choose_configuration()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (301 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 304/374] libapi: Add missing linux/types.h header to get the __u64 type on io.h Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 306/374] r8152: Choose our USB config with choose_configuration() rather than probe() Greg Kroah-Hartman
` (71 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Douglas Anderson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit a87b8e3be926af0fc3b9b1af42b1127bd1ff077c ]
For some USB devices we might want to do something different for
usb_choose_configuration(). One example here is the r8152 driver where
we want to end up using the vendor driver with the preferred
interface.
The r8152 driver tried to make things work by implementing a USB
generic_subclass driver and then overriding the normal config
selection after it happened. This is less than ideal and also caused
breakage if someone deauthorized and re-authorized the USB device
because the USB core ended up going back to it's default logic for
choosing the best config. I made an attempt to fix this [1] but it was
a bit ugly.
Let's do this better and allow USB generic_subclass drivers to
override usb_choose_configuration().
[1] https://lore.kernel.org/r/20231130154337.1.Ie00e07f07f87149c9ce0b27ae4e26991d307e14b@changeid
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Link: https://lore.kernel.org/r/20231201102946.v2.2.Iade5fa31997f1a0ca3e1dec0591633b02471df12@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: aa4f2b3e418e ("r8152: Choose our USB config with choose_configuration() rather than probe()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/generic.c | 7 +++++++
include/linux/usb.h | 6 ++++++
2 files changed, 13 insertions(+)
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 26f9fb9f67ca..57f6cab36ef6 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -59,10 +59,17 @@ int usb_choose_configuration(struct usb_device *udev)
int num_configs;
int insufficient_power = 0;
struct usb_host_config *c, *best;
+ struct usb_device_driver *udriver = to_usb_device_driver(udev->dev.driver);
if (usb_device_is_owned(udev))
return 0;
+ if (udriver->choose_configuration) {
+ i = udriver->choose_configuration(udev);
+ if (i >= 0)
+ return i;
+ }
+
best = NULL;
c = udev->config;
num_configs = udev->descriptor.bNumConfigurations;
diff --git a/include/linux/usb.h b/include/linux/usb.h
index 987550fd46fa..d879fc573f43 100644
--- a/include/linux/usb.h
+++ b/include/linux/usb.h
@@ -1241,6 +1241,9 @@ struct usb_driver {
* module is being unloaded.
* @suspend: Called when the device is going to be suspended by the system.
* @resume: Called when the device is being resumed by the system.
+ * @choose_configuration: If non-NULL, called instead of the default
+ * usb_choose_configuration(). If this returns an error then we'll go
+ * on to call the normal usb_choose_configuration().
* @dev_groups: Attributes attached to the device that will be created once it
* is bound to the driver.
* @drvwrap: Driver-model core structure wrapper.
@@ -1264,6 +1267,9 @@ struct usb_device_driver {
int (*suspend) (struct usb_device *udev, pm_message_t message);
int (*resume) (struct usb_device *udev, pm_message_t message);
+
+ int (*choose_configuration) (struct usb_device *udev);
+
const struct attribute_group **dev_groups;
struct usbdrv_wrap drvwrap;
const struct usb_device_id *id_table;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 306/374] r8152: Choose our USB config with choose_configuration() rather than probe()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (302 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 305/374] usb: core: Allow subclassed USB drivers to override usb_choose_configuration() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 307/374] software node: Let args be NULL in software_node_get_reference_args Greg Kroah-Hartman
` (70 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Douglas Anderson,
Grant Grundler, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit aa4f2b3e418e8673e55145de8b8016a7a9920306 ]
If you deauthorize the r8152 device (by writing 0 to the "authorized"
field in sysfs) and then reauthorize it (by writing a 1) then it no
longer works. This is because when you do the above we lose the
special configuration that we set in rtl8152_cfgselector_probe().
Deauthorizing causes the config to be set to -1 and then reauthorizing
runs the default logic for choosing the best config.
I made an attempt to fix it so that the config is kept across
deauthorizing / reauthorizing [1] but it was a bit ugly.
Let's instead use the new USB core feature to override
choose_configuration().
This patch relies upon the patches ("usb: core: Don't force USB
generic_subclass drivers to define probe()") and ("usb: core: Allow
subclassed USB drivers to override usb_choose_configuration()")
[1] https://lore.kernel.org/r/20231130154337.1.Ie00e07f07f87149c9ce0b27ae4e26991d307e14b@changeid
Fixes: ec51fbd1b8a2 ("r8152: add USB device driver for config selection")
Suggested-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Reviewed-by: Grant Grundler <grundler@chromium.org>
Link: https://lore.kernel.org/r/20231201102946.v2.3.Ie00e07f07f87149c9ce0b27ae4e26991d307e14b@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/usb/r8152.c | 16 +++++-----------
1 file changed, 5 insertions(+), 11 deletions(-)
diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
index e8fd743a1509..85b98fd06ba2 100644
--- a/drivers/net/usb/r8152.c
+++ b/drivers/net/usb/r8152.c
@@ -9872,7 +9872,7 @@ static struct usb_driver rtl8152_driver = {
.disable_hub_initiated_lpm = 1,
};
-static int rtl8152_cfgselector_probe(struct usb_device *udev)
+static int rtl8152_cfgselector_choose_configuration(struct usb_device *udev)
{
struct usb_host_config *c;
int i, num_configs;
@@ -9899,19 +9899,13 @@ static int rtl8152_cfgselector_probe(struct usb_device *udev)
if (i == num_configs)
return -ENODEV;
- if (usb_set_configuration(udev, c->desc.bConfigurationValue)) {
- dev_err(&udev->dev, "Failed to set configuration %d\n",
- c->desc.bConfigurationValue);
- return -ENODEV;
- }
-
- return 0;
+ return c->desc.bConfigurationValue;
}
static struct usb_device_driver rtl8152_cfgselector_driver = {
- .name = MODULENAME "-cfgselector",
- .probe = rtl8152_cfgselector_probe,
- .id_table = rtl8152_table,
+ .name = MODULENAME "-cfgselector",
+ .choose_configuration = rtl8152_cfgselector_choose_configuration,
+ .id_table = rtl8152_table,
.generic_subclass = 1,
.supports_autosuspend = 1,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 307/374] software node: Let args be NULL in software_node_get_reference_args
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (303 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 306/374] r8152: Choose our USB config with choose_configuration() rather than probe() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 308/374] serial: imx: fix tx statemachine deadlock Greg Kroah-Hartman
` (69 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Andy Shevchenko,
Heikki Krogerus, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sakari Ailus <sakari.ailus@linux.intel.com>
[ Upstream commit 1eaea4b3604eb9ca7d9a1e73d88fc121bb4061f5 ]
fwnode_get_property_reference_args() may not be called with args argument
NULL and while OF already supports this. Add the missing NULL check.
The purpose is to be able to count the references.
Fixes: b06184acf751 ("software node: Add software_node_get_reference_args()")
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Link: https://lore.kernel.org/r/20231109101010.1329587-3-sakari.ailus@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/base/swnode.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/base/swnode.c b/drivers/base/swnode.c
index 3ba1232ce845..15f149fc1940 100644
--- a/drivers/base/swnode.c
+++ b/drivers/base/swnode.c
@@ -547,6 +547,9 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,
if (nargs > NR_FWNODE_REFERENCE_ARGS)
return -EINVAL;
+ if (!args)
+ return 0;
+
args->fwnode = software_node_get(refnode);
args->nargs = nargs;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 308/374] serial: imx: fix tx statemachine deadlock
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (304 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 307/374] software node: Let args be NULL in software_node_get_reference_args Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 309/374] selftests/sgx: Fix uninitialized pointer dereference in error path Greg Kroah-Hartman
` (68 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Paul Geurts, Rasmus Villemoes,
Eberhard Stoll, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Geurts <paul_geurts@live.nl>
[ Upstream commit 78d60dae9a0c9f09aa3d6477c94047df2fe6f7b0 ]
When using the serial port as RS485 port, the tx statemachine is used to
control the RTS pin to drive the RS485 transceiver TX_EN pin. When the
TTY port is closed in the middle of a transmission (for instance during
userland application crash), imx_uart_shutdown disables the interface
and disables the Transmission Complete interrupt. afer that,
imx_uart_stop_tx bails on an incomplete transmission, to be retriggered
by the TC interrupt. This interrupt is disabled and therefore the tx
statemachine never transitions out of SEND. The statemachine is in
deadlock now, and the TX_EN remains low, making the interface useless.
imx_uart_stop_tx now checks for incomplete transmission AND whether TC
interrupts are enabled before bailing to be retriggered. This makes sure
the state machine handling is reached, and is properly set to
WAIT_AFTER_SEND.
Fixes: cb1a60923609 ("serial: imx: implement rts delaying for rs485")
Signed-off-by: Paul Geurts <paul_geurts@live.nl>
Tested-by: Rasmus Villemoes <rasmus.villemoes@prevas.dk>
Tested-by: Eberhard Stoll <eberhard.stoll@gmx.de>
Link: https://lore.kernel.org/r/AM0PR09MB26758F651BC1B742EB45775995B8A@AM0PR09MB2675.eurprd09.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/imx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 4b9e82737e0b..52f183889c95 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -450,13 +450,13 @@ static void imx_uart_stop_tx(struct uart_port *port)
ucr1 = imx_uart_readl(sport, UCR1);
imx_uart_writel(sport, ucr1 & ~UCR1_TRDYEN, UCR1);
+ ucr4 = imx_uart_readl(sport, UCR4);
usr2 = imx_uart_readl(sport, USR2);
- if (!(usr2 & USR2_TXDC)) {
+ if ((!(usr2 & USR2_TXDC)) && (ucr4 & UCR4_TCEN)) {
/* The shifter is still busy, so retry once TC triggers */
return;
}
- ucr4 = imx_uart_readl(sport, UCR4);
ucr4 &= ~UCR4_TCEN;
imx_uart_writel(sport, ucr4, UCR4);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 309/374] selftests/sgx: Fix uninitialized pointer dereference in error path
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (305 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 308/374] serial: imx: fix tx statemachine deadlock Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 310/374] selftests/sgx: Skip non X86_64 platform Greg Kroah-Hartman
` (67 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jo Van Bulck, Dave Hansen,
Jarkko Sakkinen, Kai Huang, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
[ Upstream commit 79eba8c924f7decfa71ddf187d38cb9f5f2cd7b3 ]
Ensure ctx is zero-initialized, such that the encl_measure function will
not call EVP_MD_CTX_destroy with an uninitialized ctx pointer in case of an
early error during key generation.
Fixes: 2adcba79e69d ("selftests/x86: Add a selftest for SGX")
Signed-off-by: Jo Van Bulck <jo.vanbulck@cs.kuleuven.be>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Acked-by: Kai Huang <kai.huang@intel.com>
Link: https://lore.kernel.org/all/20231005153854.25566-2-jo.vanbulck%40cs.kuleuven.be
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/sgx/sigstruct.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/sgx/sigstruct.c b/tools/testing/selftests/sgx/sigstruct.c
index 92bbc5a15c39..a201d64f9b49 100644
--- a/tools/testing/selftests/sgx/sigstruct.c
+++ b/tools/testing/selftests/sgx/sigstruct.c
@@ -310,9 +310,9 @@ bool encl_measure(struct encl *encl)
struct sgx_sigstruct *sigstruct = &encl->sigstruct;
struct sgx_sigstruct_payload payload;
uint8_t digest[SHA256_DIGEST_LENGTH];
+ EVP_MD_CTX *ctx = NULL;
unsigned int siglen;
RSA *key = NULL;
- EVP_MD_CTX *ctx;
int i;
memset(sigstruct, 0, sizeof(*sigstruct));
@@ -376,7 +376,8 @@ bool encl_measure(struct encl *encl)
return true;
err:
- EVP_MD_CTX_destroy(ctx);
+ if (ctx)
+ EVP_MD_CTX_destroy(ctx);
RSA_free(key);
return false;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 310/374] selftests/sgx: Skip non X86_64 platform
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (306 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 309/374] selftests/sgx: Fix uninitialized pointer dereference in error path Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 311/374] iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify Greg Kroah-Hartman
` (66 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zhao Mengmeng, Dave Hansen,
Jarkko Sakkinen, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
[ Upstream commit 981cf568a8644161c2f15c02278ebc2834b51ba6 ]
When building whole selftests on arm64, rsync gives an erorr about sgx:
rsync: [sender] link_stat "/root/linux-next/tools/testing/selftests/sgx/test_encl.elf" failed: No such file or directory (2)
rsync error: some files/attrs were not transferred (see previous errors) (code 23) at main.c(1327) [sender=3.2.5]
The root casue is sgx only used on X86_64, and shall be skipped on other
platforms.
Fix this by moving TEST_CUSTOM_PROGS and TEST_FILES inside the if check,
then the build result will be "Skipping non-existent dir: sgx".
Fixes: 2adcba79e69d ("selftests/x86: Add a selftest for SGX")
Signed-off-by: Zhao Mengmeng <zhaomengmeng@kylinos.cn>
Signed-off-by: Dave Hansen <dave.hansen@linux.intel.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/all/20231206025605.3965302-1-zhaomzhao%40126.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/testing/selftests/sgx/Makefile | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/testing/selftests/sgx/Makefile b/tools/testing/selftests/sgx/Makefile
index 472b27ccd7dc..394d0dde479b 100644
--- a/tools/testing/selftests/sgx/Makefile
+++ b/tools/testing/selftests/sgx/Makefile
@@ -16,9 +16,9 @@ HOST_CFLAGS := -Wall -Werror -g $(INCLUDES) -fPIC -z noexecstack
ENCL_CFLAGS := -Wall -Werror -static -nostdlib -nostartfiles -fPIC \
-fno-stack-protector -mrdrnd $(INCLUDES)
+ifeq ($(CAN_BUILD_X86_64), 1)
TEST_CUSTOM_PROGS := $(OUTPUT)/test_sgx
-ifeq ($(CAN_BUILD_X86_64), 1)
all: $(TEST_CUSTOM_PROGS) $(OUTPUT)/test_encl.elf
endif
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 311/374] iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (307 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 310/374] selftests/sgx: Skip non X86_64 platform Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 312/374] iio: adc: ad9467: fix reset gpio handling Greg Kroah-Hartman
` (65 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Andy Shevchenko,
Uwe Kleine-König, Jonathan Cameron, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
[ Upstream commit cdd07b3ab94a020570132558442a26e74b70bc42 ]
Make use of devm_clk_get_enabled() to replace some code that effectively
open codes this new function.
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20220808204740.307667-3-u.kleine-koenig@pengutronix.de
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Stable-dep-of: 76f028539cf3 ("iio: adc: ad9467: fix reset gpio handling")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad9467.c | 17 +----------------
1 file changed, 1 insertion(+), 16 deletions(-)
diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c
index dbfc8517cb8a..a07df0fd3329 100644
--- a/drivers/iio/adc/ad9467.c
+++ b/drivers/iio/adc/ad9467.c
@@ -378,13 +378,6 @@ static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv)
return ad9467_outputmode_set(st->spi, st->output_mode);
}
-static void ad9467_clk_disable(void *data)
-{
- struct ad9467_state *st = data;
-
- clk_disable_unprepare(st->clk);
-}
-
static int ad9467_probe(struct spi_device *spi)
{
const struct ad9467_chip_info *info;
@@ -404,18 +397,10 @@ static int ad9467_probe(struct spi_device *spi)
st = adi_axi_adc_conv_priv(conv);
st->spi = spi;
- st->clk = devm_clk_get(&spi->dev, "adc-clk");
+ st->clk = devm_clk_get_enabled(&spi->dev, "adc-clk");
if (IS_ERR(st->clk))
return PTR_ERR(st->clk);
- ret = clk_prepare_enable(st->clk);
- if (ret < 0)
- return ret;
-
- ret = devm_add_action_or_reset(&spi->dev, ad9467_clk_disable, st);
- if (ret)
- return ret;
-
st->pwrdown_gpio = devm_gpiod_get_optional(&spi->dev, "powerdown",
GPIOD_OUT_LOW);
if (IS_ERR(st->pwrdown_gpio))
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 312/374] iio: adc: ad9467: fix reset gpio handling
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (308 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 311/374] iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 313/374] iio: adc: ad9467: dont ignore error codes Greg Kroah-Hartman
` (64 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lechner, Nuno Sa,
Jonathan Cameron, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <nuno.sa@analog.com>
[ Upstream commit 76f028539cf360f750efd8cde560edda298e4c6b ]
The reset gpio was being handled with inverted polarity. This means that
as far as gpiolib is concerned we were actually leaving the pin asserted
(in theory, this would mean reset). However, inverting the polarity in
devicetree made things work. Fix it by doing it the proper way and how
gpiolib expects it to be done.
While at it, moved the handling to it's own function and dropped
'reset_gpio' from the 'struct ad9467_state' as we only need it during
probe. On top of that, refactored things so that we now request the gpio
asserted (i.e in reset) and then de-assert it. Also note that we now use
gpiod_set_value_cansleep() instead of gpiod_direction_output() as we
already request the pin as output.
Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC")
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-1-a4a33bc4d70e@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad9467.c | 31 ++++++++++++++++++-------------
1 file changed, 18 insertions(+), 13 deletions(-)
diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c
index a07df0fd3329..46c85748a07e 100644
--- a/drivers/iio/adc/ad9467.c
+++ b/drivers/iio/adc/ad9467.c
@@ -121,7 +121,6 @@ struct ad9467_state {
unsigned int output_mode;
struct gpio_desc *pwrdown_gpio;
- struct gpio_desc *reset_gpio;
};
static int ad9467_spi_read(struct spi_device *spi, unsigned int reg)
@@ -378,6 +377,21 @@ static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv)
return ad9467_outputmode_set(st->spi, st->output_mode);
}
+static int ad9467_reset(struct device *dev)
+{
+ struct gpio_desc *gpio;
+
+ gpio = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
+ if (IS_ERR_OR_NULL(gpio))
+ return PTR_ERR_OR_ZERO(gpio);
+
+ fsleep(1);
+ gpiod_set_value_cansleep(gpio, 0);
+ fsleep(10 * USEC_PER_MSEC);
+
+ return 0;
+}
+
static int ad9467_probe(struct spi_device *spi)
{
const struct ad9467_chip_info *info;
@@ -406,18 +420,9 @@ static int ad9467_probe(struct spi_device *spi)
if (IS_ERR(st->pwrdown_gpio))
return PTR_ERR(st->pwrdown_gpio);
- st->reset_gpio = devm_gpiod_get_optional(&spi->dev, "reset",
- GPIOD_OUT_LOW);
- if (IS_ERR(st->reset_gpio))
- return PTR_ERR(st->reset_gpio);
-
- if (st->reset_gpio) {
- udelay(1);
- ret = gpiod_direction_output(st->reset_gpio, 1);
- if (ret)
- return ret;
- mdelay(10);
- }
+ ret = ad9467_reset(&spi->dev);
+ if (ret)
+ return ret;
conv->chip_info = &info->axi_adc_info;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 313/374] iio: adc: ad9467: dont ignore error codes
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (309 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 312/374] iio: adc: ad9467: fix reset gpio handling Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 314/374] iio: adc: ad9467: fix scale setting Greg Kroah-Hartman
` (63 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, David Lechner, Nuno Sa,
Jonathan Cameron, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <nuno.sa@analog.com>
[ Upstream commit e072e149cfb827e0ab4cafb0547e9658e35393cd ]
Make sure functions that return errors are not ignored.
Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC")
Reviewed-by: David Lechner <dlechner@baylibre.com>
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-2-a4a33bc4d70e@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad9467.c | 27 +++++++++++++++++----------
1 file changed, 17 insertions(+), 10 deletions(-)
diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c
index 46c85748a07e..09ff5b27cee5 100644
--- a/drivers/iio/adc/ad9467.c
+++ b/drivers/iio/adc/ad9467.c
@@ -162,9 +162,10 @@ static int ad9467_reg_access(struct adi_axi_adc_conv *conv, unsigned int reg,
if (readval == NULL) {
ret = ad9467_spi_write(spi, reg, writeval);
- ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER,
- AN877_ADC_TRANSFER_SYNC);
- return ret;
+ if (ret)
+ return ret;
+ return ad9467_spi_write(spi, AN877_ADC_REG_TRANSFER,
+ AN877_ADC_TRANSFER_SYNC);
}
ret = ad9467_spi_read(spi, reg);
@@ -272,10 +273,13 @@ static int ad9467_get_scale(struct adi_axi_adc_conv *conv, int *val, int *val2)
const struct ad9467_chip_info *info1 = to_ad9467_chip_info(info);
struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
unsigned int i, vref_val;
+ int ret;
- vref_val = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF);
+ ret = ad9467_spi_read(st->spi, AN877_ADC_REG_VREF);
+ if (ret < 0)
+ return ret;
- vref_val &= info1->vref_mask;
+ vref_val = ret & info1->vref_mask;
for (i = 0; i < info->num_scales; i++) {
if (vref_val == info->scale_table[i][1])
@@ -296,6 +300,7 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2)
struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
unsigned int scale_val[2];
unsigned int i;
+ int ret;
if (val != 0)
return -EINVAL;
@@ -305,11 +310,13 @@ static int ad9467_set_scale(struct adi_axi_adc_conv *conv, int val, int val2)
if (scale_val[0] != val || scale_val[1] != val2)
continue;
- ad9467_spi_write(st->spi, AN877_ADC_REG_VREF,
- info->scale_table[i][1]);
- ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER,
- AN877_ADC_TRANSFER_SYNC);
- return 0;
+ ret = ad9467_spi_write(st->spi, AN877_ADC_REG_VREF,
+ info->scale_table[i][1]);
+ if (ret < 0)
+ return ret;
+
+ return ad9467_spi_write(st->spi, AN877_ADC_REG_TRANSFER,
+ AN877_ADC_TRANSFER_SYNC);
}
return -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 314/374] iio: adc: ad9467: fix scale setting
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (310 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 313/374] iio: adc: ad9467: dont ignore error codes Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 315/374] perf genelf: Set ELF program header addresses properly Greg Kroah-Hartman
` (62 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nuno Sa, David Lechner,
Jonathan Cameron, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <nuno.sa@analog.com>
[ Upstream commit b73f08bb7fe5a0901646ca5ceaa1e7a2d5ee6293 ]
When reading in_voltage_scale we can get something like:
root@analog:/sys/bus/iio/devices/iio:device2# cat in_voltage_scale
0.038146
However, when reading the available options:
root@analog:/sys/bus/iio/devices/iio:device2# cat
in_voltage_scale_available
2000.000000 2100.000006 2200.000007 2300.000008 2400.000009 2500.000010
which does not make sense. Moreover, when trying to set a new scale we
get an error because there's no call to __ad9467_get_scale() to give us
values as given when reading in_voltage_scale. Fix it by computing the
available scales during probe and properly pass the list when
.read_available() is called.
While at it, change to use .read_available() from iio_info. Also note
that to properly fix this, adi-axi-adc.c has to be changed accordingly.
Fixes: ad6797120238 ("iio: adc: ad9467: add support AD9467 ADC")
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Reviewed-by: David Lechner <dlechner@baylibre.com>
Link: https://lore.kernel.org/r/20231207-iio-backend-prep-v2-4-a4a33bc4d70e@analog.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/iio/adc/ad9467.c | 47 ++++++++++++++++++
drivers/iio/adc/adi-axi-adc.c | 74 ++++++-----------------------
include/linux/iio/adc/adi-axi-adc.h | 4 ++
3 files changed, 66 insertions(+), 59 deletions(-)
diff --git a/drivers/iio/adc/ad9467.c b/drivers/iio/adc/ad9467.c
index 09ff5b27cee5..ad94f0abc402 100644
--- a/drivers/iio/adc/ad9467.c
+++ b/drivers/iio/adc/ad9467.c
@@ -119,6 +119,7 @@ struct ad9467_state {
struct spi_device *spi;
struct clk *clk;
unsigned int output_mode;
+ unsigned int (*scales)[2];
struct gpio_desc *pwrdown_gpio;
};
@@ -212,6 +213,7 @@ static void __ad9467_get_scale(struct adi_axi_adc_conv *conv, int index,
.channel = _chan, \
.info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE) | \
BIT(IIO_CHAN_INFO_SAMP_FREQ), \
+ .info_mask_shared_by_type_available = BIT(IIO_CHAN_INFO_SCALE), \
.scan_index = _si, \
.scan_type = { \
.sign = _sign, \
@@ -365,6 +367,26 @@ static int ad9467_write_raw(struct adi_axi_adc_conv *conv,
}
}
+static int ad9467_read_avail(struct adi_axi_adc_conv *conv,
+ struct iio_chan_spec const *chan,
+ const int **vals, int *type, int *length,
+ long mask)
+{
+ const struct adi_axi_adc_chip_info *info = conv->chip_info;
+ struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+
+ switch (mask) {
+ case IIO_CHAN_INFO_SCALE:
+ *vals = (const int *)st->scales;
+ *type = IIO_VAL_INT_PLUS_MICRO;
+ /* Values are stored in a 2D matrix */
+ *length = info->num_scales * 2;
+ return IIO_AVAIL_LIST;
+ default:
+ return -EINVAL;
+ }
+}
+
static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode)
{
int ret;
@@ -377,6 +399,26 @@ static int ad9467_outputmode_set(struct spi_device *spi, unsigned int mode)
AN877_ADC_TRANSFER_SYNC);
}
+static int ad9467_scale_fill(struct adi_axi_adc_conv *conv)
+{
+ const struct adi_axi_adc_chip_info *info = conv->chip_info;
+ struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
+ unsigned int i, val1, val2;
+
+ st->scales = devm_kmalloc_array(&st->spi->dev, info->num_scales,
+ sizeof(*st->scales), GFP_KERNEL);
+ if (!st->scales)
+ return -ENOMEM;
+
+ for (i = 0; i < info->num_scales; i++) {
+ __ad9467_get_scale(conv, i, &val1, &val2);
+ st->scales[i][0] = val1;
+ st->scales[i][1] = val2;
+ }
+
+ return 0;
+}
+
static int ad9467_preenable_setup(struct adi_axi_adc_conv *conv)
{
struct ad9467_state *st = adi_axi_adc_conv_priv(conv);
@@ -433,6 +475,10 @@ static int ad9467_probe(struct spi_device *spi)
conv->chip_info = &info->axi_adc_info;
+ ret = ad9467_scale_fill(conv);
+ if (ret)
+ return ret;
+
id = ad9467_spi_read(spi, AN877_ADC_REG_CHIP_ID);
if (id != conv->chip_info->id) {
dev_err(&spi->dev, "Mismatch CHIP_ID, got 0x%X, expected 0x%X\n",
@@ -443,6 +489,7 @@ static int ad9467_probe(struct spi_device *spi)
conv->reg_access = ad9467_reg_access;
conv->write_raw = ad9467_write_raw;
conv->read_raw = ad9467_read_raw;
+ conv->read_avail = ad9467_read_avail;
conv->preenable_setup = ad9467_preenable_setup;
st->output_mode = info->default_output_mode |
diff --git a/drivers/iio/adc/adi-axi-adc.c b/drivers/iio/adc/adi-axi-adc.c
index a9e655e69eaa..c6dac4c10c31 100644
--- a/drivers/iio/adc/adi-axi-adc.c
+++ b/drivers/iio/adc/adi-axi-adc.c
@@ -142,6 +142,20 @@ static int adi_axi_adc_write_raw(struct iio_dev *indio_dev,
return conv->write_raw(conv, chan, val, val2, mask);
}
+static int adi_axi_adc_read_avail(struct iio_dev *indio_dev,
+ struct iio_chan_spec const *chan,
+ const int **vals, int *type, int *length,
+ long mask)
+{
+ struct adi_axi_adc_state *st = iio_priv(indio_dev);
+ struct adi_axi_adc_conv *conv = &st->client->conv;
+
+ if (!conv->read_avail)
+ return -EOPNOTSUPP;
+
+ return conv->read_avail(conv, chan, vals, type, length, mask);
+}
+
static int adi_axi_adc_update_scan_mode(struct iio_dev *indio_dev,
const unsigned long *scan_mask)
{
@@ -226,69 +240,11 @@ struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev,
}
EXPORT_SYMBOL_GPL(devm_adi_axi_adc_conv_register);
-static ssize_t in_voltage_scale_available_show(struct device *dev,
- struct device_attribute *attr,
- char *buf)
-{
- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
- struct adi_axi_adc_state *st = iio_priv(indio_dev);
- struct adi_axi_adc_conv *conv = &st->client->conv;
- size_t len = 0;
- int i;
-
- for (i = 0; i < conv->chip_info->num_scales; i++) {
- const unsigned int *s = conv->chip_info->scale_table[i];
-
- len += scnprintf(buf + len, PAGE_SIZE - len,
- "%u.%06u ", s[0], s[1]);
- }
- buf[len - 1] = '\n';
-
- return len;
-}
-
-static IIO_DEVICE_ATTR_RO(in_voltage_scale_available, 0);
-
-enum {
- ADI_AXI_ATTR_SCALE_AVAIL,
-};
-
-#define ADI_AXI_ATTR(_en_, _file_) \
- [ADI_AXI_ATTR_##_en_] = &iio_dev_attr_##_file_.dev_attr.attr
-
-static struct attribute *adi_axi_adc_attributes[] = {
- ADI_AXI_ATTR(SCALE_AVAIL, in_voltage_scale_available),
- NULL
-};
-
-static umode_t axi_adc_attr_is_visible(struct kobject *kobj,
- struct attribute *attr, int n)
-{
- struct device *dev = kobj_to_dev(kobj);
- struct iio_dev *indio_dev = dev_to_iio_dev(dev);
- struct adi_axi_adc_state *st = iio_priv(indio_dev);
- struct adi_axi_adc_conv *conv = &st->client->conv;
-
- switch (n) {
- case ADI_AXI_ATTR_SCALE_AVAIL:
- if (!conv->chip_info->num_scales)
- return 0;
- return attr->mode;
- default:
- return attr->mode;
- }
-}
-
-static const struct attribute_group adi_axi_adc_attribute_group = {
- .attrs = adi_axi_adc_attributes,
- .is_visible = axi_adc_attr_is_visible,
-};
-
static const struct iio_info adi_axi_adc_info = {
.read_raw = &adi_axi_adc_read_raw,
.write_raw = &adi_axi_adc_write_raw,
- .attrs = &adi_axi_adc_attribute_group,
.update_scan_mode = &adi_axi_adc_update_scan_mode,
+ .read_avail = &adi_axi_adc_read_avail,
};
static const struct adi_axi_adc_core_info adi_axi_adc_10_0_a_info = {
diff --git a/include/linux/iio/adc/adi-axi-adc.h b/include/linux/iio/adc/adi-axi-adc.h
index 52620e5b8052..b7904992d561 100644
--- a/include/linux/iio/adc/adi-axi-adc.h
+++ b/include/linux/iio/adc/adi-axi-adc.h
@@ -41,6 +41,7 @@ struct adi_axi_adc_chip_info {
* @reg_access IIO debugfs_reg_access hook for the client ADC
* @read_raw IIO read_raw hook for the client ADC
* @write_raw IIO write_raw hook for the client ADC
+ * @read_avail IIO read_avail hook for the client ADC
*/
struct adi_axi_adc_conv {
const struct adi_axi_adc_chip_info *chip_info;
@@ -54,6 +55,9 @@ struct adi_axi_adc_conv {
int (*write_raw)(struct adi_axi_adc_conv *conv,
struct iio_chan_spec const *chan,
int val, int val2, long mask);
+ int (*read_avail)(struct adi_axi_adc_conv *conv,
+ struct iio_chan_spec const *chan,
+ const int **val, int *type, int *length, long mask);
};
struct adi_axi_adc_conv *devm_adi_axi_adc_conv_register(struct device *dev,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 315/374] perf genelf: Set ELF program header addresses properly
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (311 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 314/374] iio: adc: ad9467: fix scale setting Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 316/374] tty: change tty_write_lock()s ndelay parameter to bool Greg Kroah-Hartman
` (61 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Namhyung Kim,
Adrian Hunter, Fangrui Song, Ingo Molnar, Jiri Olsa, Lieven Hey,
Milian Wolff, Pablo Galindo, Peter Zijlstra,
Arnaldo Carvalho de Melo, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Namhyung Kim <namhyung@kernel.org>
[ Upstream commit 1af478903fc48c1409a8dd6b698383b62387adf1 ]
The text section starts after the ELF headers so PHDR.p_vaddr and
others should have the correct addresses.
Fixes: babd04386b1df8c3 ("perf jit: Include program header in ELF files")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Fangrui Song <maskray@google.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Lieven Hey <lieven.hey@kdab.com>
Cc: Milian Wolff <milian.wolff@kdab.com>
Cc: Pablo Galindo <pablogsal@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20231212070547.612536-2-namhyung@kernel.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/genelf.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/genelf.c b/tools/perf/util/genelf.c
index 02cd9f75e3d2..89a85601485d 100644
--- a/tools/perf/util/genelf.c
+++ b/tools/perf/util/genelf.c
@@ -291,9 +291,9 @@ jit_write_elf(int fd, uint64_t load_addr, const char *sym,
*/
phdr = elf_newphdr(e, 1);
phdr[0].p_type = PT_LOAD;
- phdr[0].p_offset = 0;
- phdr[0].p_vaddr = 0;
- phdr[0].p_paddr = 0;
+ phdr[0].p_offset = GEN_ELF_TEXT_OFFSET;
+ phdr[0].p_vaddr = GEN_ELF_TEXT_OFFSET;
+ phdr[0].p_paddr = GEN_ELF_TEXT_OFFSET;
phdr[0].p_filesz = csize;
phdr[0].p_memsz = csize;
phdr[0].p_flags = PF_X | PF_R;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 316/374] tty: change tty_write_lock()s ndelay parameter to bool
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (312 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 315/374] perf genelf: Set ELF program header addresses properly Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 317/374] tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK Greg Kroah-Hartman
` (60 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit af815336556df28f800669c58ab3bdad7d786b98 ]
It's a yes-no parameter, so convert it to bool to be obvious.
Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20230810091510.13006-6-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty.h | 2 +-
drivers/tty/tty_io.c | 6 +++---
drivers/tty/tty_ioctl.c | 2 +-
3 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/drivers/tty/tty.h b/drivers/tty/tty.h
index 72b88aafd536..989986f67263 100644
--- a/drivers/tty/tty.h
+++ b/drivers/tty/tty.h
@@ -63,7 +63,7 @@ int tty_check_change(struct tty_struct *tty);
void __stop_tty(struct tty_struct *tty);
void __start_tty(struct tty_struct *tty);
void tty_write_unlock(struct tty_struct *tty);
-int tty_write_lock(struct tty_struct *tty, int ndelay);
+int tty_write_lock(struct tty_struct *tty, bool ndelay);
void tty_vhangup_session(struct tty_struct *tty);
void tty_open_proc_set_tty(struct file *filp, struct tty_struct *tty);
int tty_signal_session_leader(struct tty_struct *tty, int exit_session);
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 3d540dff42ef..12f6ef8d0f45 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -956,7 +956,7 @@ void tty_write_unlock(struct tty_struct *tty)
wake_up_interruptible_poll(&tty->write_wait, EPOLLOUT);
}
-int tty_write_lock(struct tty_struct *tty, int ndelay)
+int tty_write_lock(struct tty_struct *tty, bool ndelay)
{
if (!mutex_trylock(&tty->atomic_write_lock)) {
if (ndelay)
@@ -1173,7 +1173,7 @@ int tty_send_xchar(struct tty_struct *tty, char ch)
return 0;
}
- if (tty_write_lock(tty, 0) < 0)
+ if (tty_write_lock(tty, false) < 0)
return -ERESTARTSYS;
down_read(&tty->termios_rwsem);
@@ -2507,7 +2507,7 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
retval = tty->ops->break_ctl(tty, duration);
else {
/* Do the work ourselves */
- if (tty_write_lock(tty, 0) < 0)
+ if (tty_write_lock(tty, false) < 0)
return -EINTR;
retval = tty->ops->break_ctl(tty, -1);
if (retval)
diff --git a/drivers/tty/tty_ioctl.c b/drivers/tty/tty_ioctl.c
index 1736130f9c39..dac1e2568803 100644
--- a/drivers/tty/tty_ioctl.c
+++ b/drivers/tty/tty_ioctl.c
@@ -427,7 +427,7 @@ static int set_termios(struct tty_struct *tty, void __user *arg, int opt)
if (retval < 0)
return retval;
- if (tty_write_lock(tty, 0) < 0)
+ if (tty_write_lock(tty, false) < 0)
goto retry_write_wait;
/* Racing writer? */
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 317/374] tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (313 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 316/374] tty: change tty_write_lock()s ndelay parameter to bool Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 318/374] tty: dont check for signal_pending() in send_break() Greg Kroah-Hartman
` (59 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 66619686d187b4a6395316b7f39881e945dce4bc ]
If the driver sets TTY_DRIVER_HARDWARE_BREAK, we leave ops->break_ctl()
to the driver and return from send_break(). But we do it using a local
variable and keep the code flowing through the end of the function.
Instead, do 'return' immediately with the ops->break_ctl()'s return
value.
This way, we don't have to stuff the 'else' branch of the 'if' with the
software break handling. And we can re-indent the function too.
Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20230919085156.1578-14-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty_io.c | 32 +++++++++++++++++---------------
1 file changed, 17 insertions(+), 15 deletions(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 12f6ef8d0f45..a18138ce67b2 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2504,22 +2504,24 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
return 0;
if (tty->driver->flags & TTY_DRIVER_HARDWARE_BREAK)
- retval = tty->ops->break_ctl(tty, duration);
- else {
- /* Do the work ourselves */
- if (tty_write_lock(tty, false) < 0)
- return -EINTR;
- retval = tty->ops->break_ctl(tty, -1);
- if (retval)
- goto out;
- if (!signal_pending(current))
- msleep_interruptible(duration);
- retval = tty->ops->break_ctl(tty, 0);
+ return tty->ops->break_ctl(tty, duration);
+
+ /* Do the work ourselves */
+ if (tty_write_lock(tty, false) < 0)
+ return -EINTR;
+
+ retval = tty->ops->break_ctl(tty, -1);
+ if (retval)
+ goto out;
+ if (!signal_pending(current))
+ msleep_interruptible(duration);
+ retval = tty->ops->break_ctl(tty, 0);
out:
- tty_write_unlock(tty);
- if (signal_pending(current))
- retval = -EINTR;
- }
+ tty_write_unlock(tty);
+
+ if (signal_pending(current))
+ retval = -EINTR;
+
return retval;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 318/374] tty: dont check for signal_pending() in send_break()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (314 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 317/374] tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 319/374] tty: use if in send_break() instead of goto Greg Kroah-Hartman
` (58 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit fd99392b643b824813df2edbaebe26a2136d31e6 ]
msleep_interruptible() will check on its own. So no need to do the check
in send_break() before calling the above.
Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20230919085156.1578-15-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty_io.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index a18138ce67b2..cdbf05e76bc7 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2513,8 +2513,7 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
retval = tty->ops->break_ctl(tty, -1);
if (retval)
goto out;
- if (!signal_pending(current))
- msleep_interruptible(duration);
+ msleep_interruptible(duration);
retval = tty->ops->break_ctl(tty, 0);
out:
tty_write_unlock(tty);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 319/374] tty: use if in send_break() instead of goto
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (315 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 318/374] tty: dont check for signal_pending() in send_break() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 320/374] usb: cdc-acm: return correct error code on unsupported break Greg Kroah-Hartman
` (57 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jiri Slaby (SUSE), Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby (SUSE) <jirislaby@kernel.org>
[ Upstream commit 24f2cd019946fc2e88e632d2e24a34c2cc3f2be4 ]
Now, the "jumped-over" code is simple enough to be put inside an 'if'.
Do so to make it 'goto'-less.
Signed-off-by: "Jiri Slaby (SUSE)" <jirislaby@kernel.org>
Link: https://lore.kernel.org/r/20230919085156.1578-16-jirislaby@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Stable-dep-of: 66aad7d8d3ec ("usb: cdc-acm: return correct error code on unsupported break")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty_io.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index cdbf05e76bc7..82b49aa0f9de 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2511,11 +2511,10 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
return -EINTR;
retval = tty->ops->break_ctl(tty, -1);
- if (retval)
- goto out;
- msleep_interruptible(duration);
- retval = tty->ops->break_ctl(tty, 0);
-out:
+ if (!retval) {
+ msleep_interruptible(duration);
+ retval = tty->ops->break_ctl(tty, 0);
+ }
tty_write_unlock(tty);
if (signal_pending(current))
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 320/374] usb: cdc-acm: return correct error code on unsupported break
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (316 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 319/374] tty: use if in send_break() instead of goto Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 321/374] usb: core: Fix crash w/ usb_choose_configuration() if no driver Greg Kroah-Hartman
` (56 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oliver Neukum, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Neukum <oneukum@suse.com>
[ Upstream commit 66aad7d8d3ec5a3a8ec2023841bcec2ded5f65c9 ]
In ACM support for sending breaks to devices is optional.
If a device says that it doenot support sending breaks,
the host must respect that.
Given the number of optional features providing tty operations
for each combination is not practical and errors need to be
returned dynamically if unsupported features are requested.
In case a device does not support break, we want the tty layer
to treat that like it treats drivers that statically cannot
support sending a break. It ignores the inability and does nothing.
This patch uses EOPNOTSUPP to indicate that.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
Fixes: 9e98966c7bb94 ("tty: rework break handling")
Link: https://lore.kernel.org/r/20231207132639.18250-1-oneukum@suse.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/tty_io.c | 3 +++
drivers/usb/class/cdc-acm.c | 3 +++
2 files changed, 6 insertions(+)
diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c
index 82b49aa0f9de..d5191065b6e9 100644
--- a/drivers/tty/tty_io.c
+++ b/drivers/tty/tty_io.c
@@ -2514,6 +2514,9 @@ static int send_break(struct tty_struct *tty, unsigned int duration)
if (!retval) {
msleep_interruptible(duration);
retval = tty->ops->break_ctl(tty, 0);
+ } else if (retval == -EOPNOTSUPP) {
+ /* some drivers can tell only dynamically */
+ retval = 0;
}
tty_write_unlock(tty);
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index adc154b691d0..f21fd809e44f 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -896,6 +896,9 @@ static int acm_tty_break_ctl(struct tty_struct *tty, int state)
struct acm *acm = tty->driver_data;
int retval;
+ if (!(acm->ctrl_caps & USB_CDC_CAP_BRK))
+ return -EOPNOTSUPP;
+
retval = acm_send_break(acm, state ? 0xffff : 0);
if (retval < 0)
dev_dbg(&acm->control->dev,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 321/374] usb: core: Fix crash w/ usb_choose_configuration() if no driver
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (317 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 320/374] usb: cdc-acm: return correct error code on unsupported break Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 322/374] nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length Greg Kroah-Hartman
` (55 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alan Stern, Douglas Anderson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <dianders@chromium.org>
[ Upstream commit 44995e6f07028f798efd0c3c11a1efc78330f600 ]
It's possible that usb_choose_configuration() can get called when a
USB device has no driver. In this case the recent commit a87b8e3be926
("usb: core: Allow subclassed USB drivers to override
usb_choose_configuration()") can cause a crash since it dereferenced
the driver structure without checking for NULL. Let's add a check.
A USB device with no driver is an anomaly, so make
usb_choose_configuration() return immediately if there is no driver.
This was seen in the real world when usbguard got ahold of a r8152
device at the wrong time. It can also be simulated via this on a
computer with one r8152-based USB Ethernet adapter:
cd /sys/bus/usb/drivers/r8152-cfgselector
to_unbind="$(ls -d *-*)"
real_dir="$(readlink -f "${to_unbind}")"
echo "${to_unbind}" > unbind
cd "${real_dir}"
echo 0 > authorized
echo 1 > authorized
Fixes: a87b8e3be926 ("usb: core: Allow subclassed USB drivers to override usb_choose_configuration()")
Reviewed-by: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Douglas Anderson <dianders@chromium.org>
Link: https://lore.kernel.org/r/20231211073237.v3.1.If27eb3bf7812f91ab83810f232292f032f4203e0@changeid
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/core/generic.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c
index 57f6cab36ef6..77aefe0f4fc5 100644
--- a/drivers/usb/core/generic.c
+++ b/drivers/usb/core/generic.c
@@ -59,7 +59,16 @@ int usb_choose_configuration(struct usb_device *udev)
int num_configs;
int insufficient_power = 0;
struct usb_host_config *c, *best;
- struct usb_device_driver *udriver = to_usb_device_driver(udev->dev.driver);
+ struct usb_device_driver *udriver;
+
+ /*
+ * If a USB device (not an interface) doesn't have a driver then the
+ * kernel has no business trying to select or install a configuration
+ * for it.
+ */
+ if (!udev->dev.driver)
+ return -1;
+ udriver = to_usb_device_driver(udev->dev.driver);
if (usb_device_is_owned(udev))
return 0;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 322/374] nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (318 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 321/374] usb: core: Fix crash w/ usb_choose_configuration() if no driver Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 323/374] nvmet-tcp: fix a crash in nvmet_req_complete() Greg Kroah-Hartman
` (54 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Sagi Grimberg,
Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit efa56305908ba20de2104f1b8508c6a7401833be ]
If the host sends an H2CData command with an invalid DATAL,
the kernel may crash in nvmet_tcp_build_pdu_iovec().
Unable to handle kernel NULL pointer dereference at
virtual address 0000000000000000
lr : nvmet_tcp_io_work+0x6ac/0x718 [nvmet_tcp]
Call trace:
process_one_work+0x174/0x3c8
worker_thread+0x2d0/0x3e8
kthread+0x104/0x110
Fix the bug by raising a fatal error if DATAL isn't coherent
with the packet size.
Also, the PDU length should never exceed the MAXH2CDATA parameter which
has been communicated to the host in nvmet_tcp_handle_icreq().
Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index 6a57cf885db1..a0a7540f048e 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -18,6 +18,7 @@
#include "nvmet.h"
#define NVMET_TCP_DEF_INLINE_DATA_SIZE (4 * PAGE_SIZE)
+#define NVMET_TCP_MAXH2CDATA 0x400000 /* 16M arbitrary limit */
/* Define the socket priority to use for connections were it is desirable
* that the NIC consider performing optimized packet processing or filtering.
@@ -884,7 +885,7 @@ static int nvmet_tcp_handle_icreq(struct nvmet_tcp_queue *queue)
icresp->hdr.pdo = 0;
icresp->hdr.plen = cpu_to_le32(icresp->hdr.hlen);
icresp->pfv = cpu_to_le16(NVME_TCP_PFV_1_0);
- icresp->maxdata = cpu_to_le32(0x400000); /* 16M arbitrary limit */
+ icresp->maxdata = cpu_to_le32(NVMET_TCP_MAXH2CDATA);
icresp->cpda = 0;
if (queue->hdr_digest)
icresp->digest |= NVME_TCP_HDR_DIGEST_ENABLE;
@@ -930,6 +931,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
{
struct nvme_tcp_data_pdu *data = &queue->pdu.data;
struct nvmet_tcp_cmd *cmd;
+ unsigned int plen;
if (likely(queue->nr_cmds)) {
if (unlikely(data->ttag >= queue->nr_cmds)) {
@@ -953,7 +955,16 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
return -EPROTO;
}
+ plen = le32_to_cpu(data->hdr.plen);
cmd->pdu_len = le32_to_cpu(data->data_length);
+ if (unlikely(cmd->pdu_len != (plen - sizeof(*data)) ||
+ cmd->pdu_len == 0 ||
+ cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) {
+ pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);
+ /* FIXME: use proper transport errors */
+ nvmet_tcp_fatal_error(queue);
+ return -EPROTO;
+ }
cmd->pdu_recv = 0;
nvmet_tcp_map_pdu_iovec(cmd);
queue->cmd = cmd;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 323/374] nvmet-tcp: fix a crash in nvmet_req_complete()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (319 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 322/374] nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 324/374] perf env: Avoid recursively taking env->bpf_progs.lock Greg Kroah-Hartman
` (53 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sagi Grimberg, Maurizio Lombardi,
Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit 0849a5441358cef02586fb2d60f707c0db195628 ]
in nvmet_tcp_handle_h2c_data_pdu(), if the host sends a data_offset
different from rbytes_done, the driver ends up calling nvmet_req_complete()
passing a status error.
The problem is that at this point cmd->req is not yet initialized,
the kernel will crash after dereferencing a NULL pointer.
Fix the bug by replacing the call to nvmet_req_complete() with
nvmet_tcp_fatal_error().
Fixes: 872d26a391da ("nvmet-tcp: add NVMe over TCP target driver")
Reviewed-by: Keith Busch <kbsuch@kernel.org>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index a0a7540f048e..d25ca0742f91 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -950,8 +950,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
data->ttag, le32_to_cpu(data->data_offset),
cmd->rbytes_done);
/* FIXME: use path and transport errors */
- nvmet_req_complete(&cmd->req,
- NVME_SC_INVALID_FIELD | NVME_SC_DNR);
+ nvmet_tcp_fatal_error(queue);
return -EPROTO;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 324/374] perf env: Avoid recursively taking env->bpf_progs.lock
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (320 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 323/374] nvmet-tcp: fix a crash in nvmet_req_complete() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 325/374] apparmor: avoid crash when parsed profile name is empty Greg Kroah-Hartman
` (52 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ian Rogers, Jiri Olsa, Song Liu,
Adrian Hunter, Alexander Shishkin, Huacai Chen, Ingo Molnar,
K Prateek Nayak, Kan Liang, Mark Rutland, Ming Wang, Namhyung Kim,
Peter Zijlstra, Ravi Bangoria, Arnaldo Carvalho de Melo,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ian Rogers <irogers@google.com>
[ Upstream commit 9c51f8788b5d4e9f46afbcf563255cfd355690b3 ]
Add variants of perf_env__insert_bpf_prog_info(), perf_env__insert_btf()
and perf_env__find_btf prefixed with __ to indicate the
env->bpf_progs.lock is assumed held.
Call these variants when the lock is held to avoid recursively taking it
and potentially having a thread deadlock with itself.
Fixes: f8dfeae009effc0b ("perf bpf: Show more BPF program info in print_bpf_prog_info()")
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Song Liu <song@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Ming Wang <wangming01@loongson.cn>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Link: https://lore.kernel.org/r/20231207014655.1252484-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
tools/perf/util/bpf-event.c | 8 +++---
tools/perf/util/bpf-event.h | 12 ++++-----
tools/perf/util/env.c | 50 ++++++++++++++++++++++++-------------
tools/perf/util/env.h | 4 +++
| 8 +++---
5 files changed, 50 insertions(+), 32 deletions(-)
diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index cf1b9f6ec0db..ce74bc367e9c 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -554,9 +554,9 @@ int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env)
return evlist__add_sb_event(evlist, &attr, bpf_event__sb_cb, env);
}
-void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
- struct perf_env *env,
- FILE *fp)
+void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
+ struct perf_env *env,
+ FILE *fp)
{
__u32 *prog_lens = (__u32 *)(uintptr_t)(info->jited_func_lens);
__u64 *prog_addrs = (__u64 *)(uintptr_t)(info->jited_ksyms);
@@ -572,7 +572,7 @@ void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
if (info->btf_id) {
struct btf_node *node;
- node = perf_env__find_btf(env, info->btf_id);
+ node = __perf_env__find_btf(env, info->btf_id);
if (node)
btf = btf__new((__u8 *)(node->data),
node->data_size);
diff --git a/tools/perf/util/bpf-event.h b/tools/perf/util/bpf-event.h
index 68f315c3df5b..50f7412464df 100644
--- a/tools/perf/util/bpf-event.h
+++ b/tools/perf/util/bpf-event.h
@@ -34,9 +34,9 @@ struct btf_node {
int machine__process_bpf(struct machine *machine, union perf_event *event,
struct perf_sample *sample);
int evlist__add_bpf_sb_event(struct evlist *evlist, struct perf_env *env);
-void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
- struct perf_env *env,
- FILE *fp);
+void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info,
+ struct perf_env *env,
+ FILE *fp);
#else
static inline int machine__process_bpf(struct machine *machine __maybe_unused,
union perf_event *event __maybe_unused,
@@ -51,9 +51,9 @@ static inline int evlist__add_bpf_sb_event(struct evlist *evlist __maybe_unused,
return 0;
}
-static inline void bpf_event__print_bpf_prog_info(struct bpf_prog_info *info __maybe_unused,
- struct perf_env *env __maybe_unused,
- FILE *fp __maybe_unused)
+static inline void __bpf_event__print_bpf_prog_info(struct bpf_prog_info *info __maybe_unused,
+ struct perf_env *env __maybe_unused,
+ FILE *fp __maybe_unused)
{
}
diff --git a/tools/perf/util/env.c b/tools/perf/util/env.c
index 5b24eb010336..d3d67ce70f55 100644
--- a/tools/perf/util/env.c
+++ b/tools/perf/util/env.c
@@ -20,13 +20,19 @@ struct perf_env perf_env;
void perf_env__insert_bpf_prog_info(struct perf_env *env,
struct bpf_prog_info_node *info_node)
+{
+ down_write(&env->bpf_progs.lock);
+ __perf_env__insert_bpf_prog_info(env, info_node);
+ up_write(&env->bpf_progs.lock);
+}
+
+void __perf_env__insert_bpf_prog_info(struct perf_env *env, struct bpf_prog_info_node *info_node)
{
__u32 prog_id = info_node->info_linear->info.id;
struct bpf_prog_info_node *node;
struct rb_node *parent = NULL;
struct rb_node **p;
- down_write(&env->bpf_progs.lock);
p = &env->bpf_progs.infos.rb_node;
while (*p != NULL) {
@@ -38,15 +44,13 @@ void perf_env__insert_bpf_prog_info(struct perf_env *env,
p = &(*p)->rb_right;
} else {
pr_debug("duplicated bpf prog info %u\n", prog_id);
- goto out;
+ return;
}
}
rb_link_node(&info_node->rb_node, parent, p);
rb_insert_color(&info_node->rb_node, &env->bpf_progs.infos);
env->bpf_progs.infos_cnt++;
-out:
- up_write(&env->bpf_progs.lock);
}
struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
@@ -75,14 +79,22 @@ struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
}
bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node)
+{
+ bool ret;
+
+ down_write(&env->bpf_progs.lock);
+ ret = __perf_env__insert_btf(env, btf_node);
+ up_write(&env->bpf_progs.lock);
+ return ret;
+}
+
+bool __perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node)
{
struct rb_node *parent = NULL;
__u32 btf_id = btf_node->id;
struct btf_node *node;
struct rb_node **p;
- bool ret = true;
- down_write(&env->bpf_progs.lock);
p = &env->bpf_progs.btfs.rb_node;
while (*p != NULL) {
@@ -94,25 +106,31 @@ bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node)
p = &(*p)->rb_right;
} else {
pr_debug("duplicated btf %u\n", btf_id);
- ret = false;
- goto out;
+ return false;
}
}
rb_link_node(&btf_node->rb_node, parent, p);
rb_insert_color(&btf_node->rb_node, &env->bpf_progs.btfs);
env->bpf_progs.btfs_cnt++;
-out:
- up_write(&env->bpf_progs.lock);
- return ret;
+ return true;
}
struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id)
+{
+ struct btf_node *res;
+
+ down_read(&env->bpf_progs.lock);
+ res = __perf_env__find_btf(env, btf_id);
+ up_read(&env->bpf_progs.lock);
+ return res;
+}
+
+struct btf_node *__perf_env__find_btf(struct perf_env *env, __u32 btf_id)
{
struct btf_node *node = NULL;
struct rb_node *n;
- down_read(&env->bpf_progs.lock);
n = env->bpf_progs.btfs.rb_node;
while (n) {
@@ -122,13 +140,9 @@ struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id)
else if (btf_id > node->id)
n = n->rb_right;
else
- goto out;
+ return node;
}
- node = NULL;
-
-out:
- up_read(&env->bpf_progs.lock);
- return node;
+ return NULL;
}
/* purge data in bpf_progs.infos tree */
diff --git a/tools/perf/util/env.h b/tools/perf/util/env.h
index 163e5ec503a2..192318054e12 100644
--- a/tools/perf/util/env.h
+++ b/tools/perf/util/env.h
@@ -163,12 +163,16 @@ const char *perf_env__raw_arch(struct perf_env *env);
int perf_env__nr_cpus_avail(struct perf_env *env);
void perf_env__init(struct perf_env *env);
+void __perf_env__insert_bpf_prog_info(struct perf_env *env,
+ struct bpf_prog_info_node *info_node);
void perf_env__insert_bpf_prog_info(struct perf_env *env,
struct bpf_prog_info_node *info_node);
struct bpf_prog_info_node *perf_env__find_bpf_prog_info(struct perf_env *env,
__u32 prog_id);
bool perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node);
+bool __perf_env__insert_btf(struct perf_env *env, struct btf_node *btf_node);
struct btf_node *perf_env__find_btf(struct perf_env *env, __u32 btf_id);
+struct btf_node *__perf_env__find_btf(struct perf_env *env, __u32 btf_id);
int perf_env__numa_node(struct perf_env *env, int cpu);
#endif /* __PERF_ENV_H */
--git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 25947d013603..8b0a8ac7afef 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1735,8 +1735,8 @@ static void print_bpf_prog_info(struct feat_fd *ff, FILE *fp)
node = rb_entry(next, struct bpf_prog_info_node, rb_node);
next = rb_next(&node->rb_node);
- bpf_event__print_bpf_prog_info(&node->info_linear->info,
- env, fp);
+ __bpf_event__print_bpf_prog_info(&node->info_linear->info,
+ env, fp);
}
up_read(&env->bpf_progs.lock);
@@ -3073,7 +3073,7 @@ static int process_bpf_prog_info(struct feat_fd *ff, void *data __maybe_unused)
/* after reading from file, translate offset to address */
bpf_program__bpil_offs_to_addr(info_linear);
info_node->info_linear = info_linear;
- perf_env__insert_bpf_prog_info(env, info_node);
+ __perf_env__insert_bpf_prog_info(env, info_node);
}
up_write(&env->bpf_progs.lock);
@@ -3120,7 +3120,7 @@ static int process_bpf_btf(struct feat_fd *ff, void *data __maybe_unused)
if (__do_read(ff, node->data, data_size))
goto out;
- perf_env__insert_btf(env, node);
+ __perf_env__insert_btf(env, node);
node = NULL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 325/374] apparmor: avoid crash when parsed profile name is empty
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (321 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 324/374] perf env: Avoid recursively taking env->bpf_progs.lock Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 326/374] usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer Greg Kroah-Hartman
` (51 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, John Johansen,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit 55a8210c9e7d21ff2644809699765796d4bfb200 ]
When processing a packed profile in unpack_profile() described like
"profile :ns::samba-dcerpcd /usr/lib*/samba/{,samba/}samba-dcerpcd {...}"
a string ":samba-dcerpcd" is unpacked as a fully-qualified name and then
passed to aa_splitn_fqname().
aa_splitn_fqname() treats ":samba-dcerpcd" as only containing a namespace.
Thus it returns NULL for tmpname, meanwhile tmpns is non-NULL. Later
aa_alloc_profile() crashes as the new profile name is NULL now.
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 6 PID: 1657 Comm: apparmor_parser Not tainted 6.7.0-rc2-dirty #16
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.2-3-gd478f380-rebuilt.opensuse.org 04/01/2014
RIP: 0010:strlen+0x1e/0xa0
Call Trace:
<TASK>
? strlen+0x1e/0xa0
aa_policy_init+0x1bb/0x230
aa_alloc_profile+0xb1/0x480
unpack_profile+0x3bc/0x4960
aa_unpack+0x309/0x15e0
aa_replace_profiles+0x213/0x33c0
policy_update+0x261/0x370
profile_replace+0x20e/0x2a0
vfs_write+0x2af/0xe00
ksys_write+0x126/0x250
do_syscall_64+0x46/0xf0
entry_SYSCALL_64_after_hwframe+0x6e/0x76
</TASK>
---[ end trace 0000000000000000 ]---
RIP: 0010:strlen+0x1e/0xa0
It seems such behaviour of aa_splitn_fqname() is expected and checked in
other places where it is called (e.g. aa_remove_profiles). Well, there
is an explicit comment "a ns name without a following profile is allowed"
inside.
AFAICS, nothing can prevent unpacked "name" to be in form like
":samba-dcerpcd" - it is passed from userspace.
Deny the whole profile set replacement in such case and inform user with
EPROTO and an explaining message.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 04dc715e24d0 ("apparmor: audit policy ns specified in policy load")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
security/apparmor/policy_unpack.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/security/apparmor/policy_unpack.c b/security/apparmor/policy_unpack.c
index 5f758b289ace..d1a385b44d63 100644
--- a/security/apparmor/policy_unpack.c
+++ b/security/apparmor/policy_unpack.c
@@ -696,6 +696,10 @@ static struct aa_profile *unpack_profile(struct aa_ext *e, char **ns_name)
tmpname = aa_splitn_fqname(name, strlen(name), &tmpns, &ns_len);
if (tmpns) {
+ if (!tmpname) {
+ info = "empty profile name";
+ goto fail;
+ }
*ns_name = kstrndup(tmpns, ns_len, GFP_KERNEL);
if (!*ns_name) {
info = "out of memory";
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 326/374] usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (322 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 325/374] apparmor: avoid crash when parsed profile name is empty Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 327/374] serial: imx: Correct clock error message in function probe() Greg Kroah-Hartman
` (50 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, AngeloGioacchino Del Regno,
Chunfeng Yun, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chunfeng Yun <chunfeng.yun@mediatek.com>
[ Upstream commit 017dbfc05c31284150819890b4cc86a699cbdb71 ]
For Gen1 isoc-in transfer, host still send out unexpected ACK after device
finish the burst with a short packet, this will cause an exception on the
connected device, such as, a usb 4k camera.
It can be fixed by setting rxfifo depth less than 4k bytes, prefer to use
3k here, the side-effect is that may cause performance drop about 10%,
including bulk transfer.
Fixes: 926d60ae64a6 ("usb: xhci-mtk: modify the SOF/ITP interval for mt8195")
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
Link: https://lore.kernel.org/r/20240104061640.7335-2-chunfeng.yun@mediatek.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/host/xhci-mtk.c | 40 +++++++++++++++++++++++++++++++++++--
drivers/usb/host/xhci-mtk.h | 2 ++
2 files changed, 40 insertions(+), 2 deletions(-)
diff --git a/drivers/usb/host/xhci-mtk.c b/drivers/usb/host/xhci-mtk.c
index b55ddc1156cc..4e5c7d3fb4bc 100644
--- a/drivers/usb/host/xhci-mtk.c
+++ b/drivers/usb/host/xhci-mtk.c
@@ -7,6 +7,7 @@
* Chunfeng Yun <chunfeng.yun@mediatek.com>
*/
+#include <linux/bitfield.h>
#include <linux/dma-mapping.h>
#include <linux/iopoll.h>
#include <linux/kernel.h>
@@ -72,6 +73,9 @@
#define FRMCNT_LEV1_RANG (0x12b << 8)
#define FRMCNT_LEV1_RANG_MASK GENMASK(19, 8)
+#define HSCH_CFG1 0x960
+#define SCH3_RXFIFO_DEPTH_MASK GENMASK(21, 20)
+
#define SS_GEN2_EOF_CFG 0x990
#define SSG2EOF_OFFSET 0x3c
@@ -100,6 +104,8 @@
#define SSC_IP_SLEEP_EN BIT(4)
#define SSC_SPM_INT_EN BIT(1)
+#define SCH_FIFO_TO_KB(x) ((x) >> 10)
+
enum ssusb_uwk_vers {
SSUSB_UWK_V1 = 1,
SSUSB_UWK_V2,
@@ -147,6 +153,35 @@ static void xhci_mtk_set_frame_interval(struct xhci_hcd_mtk *mtk)
writel(value, hcd->regs + SS_GEN2_EOF_CFG);
}
+/*
+ * workaround: usb3.2 gen1 isoc rx hw issue
+ * host send out unexpected ACK afer device fininsh a burst transfer with
+ * a short packet.
+ */
+static void xhci_mtk_rxfifo_depth_set(struct xhci_hcd_mtk *mtk)
+{
+ struct usb_hcd *hcd = mtk->hcd;
+ u32 value;
+
+ if (!mtk->rxfifo_depth)
+ return;
+
+ value = readl(hcd->regs + HSCH_CFG1);
+ value &= ~SCH3_RXFIFO_DEPTH_MASK;
+ value |= FIELD_PREP(SCH3_RXFIFO_DEPTH_MASK,
+ SCH_FIFO_TO_KB(mtk->rxfifo_depth) - 1);
+ writel(value, hcd->regs + HSCH_CFG1);
+}
+
+static void xhci_mtk_init_quirk(struct xhci_hcd_mtk *mtk)
+{
+ /* workaround only for mt8195 */
+ xhci_mtk_set_frame_interval(mtk);
+
+ /* workaround for SoCs using SSUSB about before IPM v1.6.0 */
+ xhci_mtk_rxfifo_depth_set(mtk);
+}
+
static int xhci_mtk_host_enable(struct xhci_hcd_mtk *mtk)
{
struct mu3c_ippc_regs __iomem *ippc = mtk->ippc_regs;
@@ -429,8 +464,7 @@ static int xhci_mtk_setup(struct usb_hcd *hcd)
if (ret)
return ret;
- /* workaround only for mt8195 */
- xhci_mtk_set_frame_interval(mtk);
+ xhci_mtk_init_quirk(mtk);
}
ret = xhci_gen_setup(hcd, xhci_mtk_quirks);
@@ -517,6 +551,8 @@ static int xhci_mtk_probe(struct platform_device *pdev)
of_property_read_u32(node, "mediatek,u2p-dis-msk",
&mtk->u2p_dis_msk);
+ of_property_read_u32(node, "rx-fifo-depth", &mtk->rxfifo_depth);
+
ret = usb_wakeup_of_property_parse(mtk, node);
if (ret) {
dev_err(dev, "failed to parse uwk property\n");
diff --git a/drivers/usb/host/xhci-mtk.h b/drivers/usb/host/xhci-mtk.h
index 4b1ea89f959a..153fc7ba1609 100644
--- a/drivers/usb/host/xhci-mtk.h
+++ b/drivers/usb/host/xhci-mtk.h
@@ -161,6 +161,8 @@ struct xhci_hcd_mtk {
struct regmap *uwk;
u32 uwk_reg_base;
u32 uwk_vers;
+ /* quirk */
+ u32 rxfifo_depth;
};
static inline struct xhci_hcd_mtk *hcd_to_mtk(struct usb_hcd *hcd)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 327/374] serial: imx: Correct clock error message in function probe()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (323 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 326/374] usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 328/374] nvmet: re-fix tracing strncpy() warning Greg Kroah-Hartman
` (49 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christoph Niedermaier,
Uwe Kleine-König, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christoph Niedermaier <cniedermaier@dh-electronics.com>
[ Upstream commit 3e189470cad27d41a3a9dc02649f965b7ed1c90f ]
Correct the clock error message by changing the clock name.
Fixes: 1e512d45332b ("serial: imx: add error messages when .probe fails")
Signed-off-by: Christoph Niedermaier <cniedermaier@dh-electronics.com>
Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Link: https://lore.kernel.org/r/20231224093209.2612-1-cniedermaier@dh-electronics.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/tty/serial/imx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
index 52f183889c95..4504b5fcc171 100644
--- a/drivers/tty/serial/imx.c
+++ b/drivers/tty/serial/imx.c
@@ -2318,7 +2318,7 @@ static int imx_uart_probe(struct platform_device *pdev)
/* For register access, we only need to enable the ipg clock. */
ret = clk_prepare_enable(sport->clk_ipg);
if (ret) {
- dev_err(&pdev->dev, "failed to enable per clk: %d\n", ret);
+ dev_err(&pdev->dev, "failed to enable ipg clk: %d\n", ret);
return ret;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 328/374] nvmet: re-fix tracing strncpy() warning
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (324 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 327/374] serial: imx: Correct clock error message in function probe() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 329/374] nvmet-tcp: Fix the H2C expected PDU len calculation Greg Kroah-Hartman
` (48 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Arnd Bergmann, Keith Busch,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit 4ee7ffeb4ce50c80bc4504db6f39b25a2df6bcf4 ]
An earlier patch had tried to address a warning about a string copy with
missing zero termination:
drivers/nvme/target/trace.h:52:3: warning: ‘strncpy’ specified bound 32 equals destination size [-Wstringop-truncation]
The new version causes a different warning with some compiler versions, notably
gcc-9 and gcc-10, and also misses the zero padding that was apparently done
intentionally in the original code:
drivers/nvme/target/trace.h:56:2: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
Change it to use strscpy_pad() with the original length, which will give
a properly padded and zero-terminated string as well as avoiding the warning.
Fixes: d86481e924a7 ("nvmet: use min of device_path and disk len")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/trace.h | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/drivers/nvme/target/trace.h b/drivers/nvme/target/trace.h
index 6109b3806b12..155334ddc13f 100644
--- a/drivers/nvme/target/trace.h
+++ b/drivers/nvme/target/trace.h
@@ -53,8 +53,7 @@ static inline void __assign_req_name(char *name, struct nvmet_req *req)
return;
}
- strncpy(name, req->ns->device_path,
- min_t(size_t, DISK_NAME_LEN, strlen(req->ns->device_path)));
+ strscpy_pad(name, req->ns->device_path, DISK_NAME_LEN);
}
#endif
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 329/374] nvmet-tcp: Fix the H2C expected PDU len calculation
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (325 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 328/374] nvmet: re-fix tracing strncpy() warning Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 330/374] PCI: keystone: Fix race condition when initializing PHYs Greg Kroah-Hartman
` (47 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Maurizio Lombardi, Sagi Grimberg,
Keith Busch, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maurizio Lombardi <mlombard@redhat.com>
[ Upstream commit 9a1abc24850eb759e36a2f8869161c3b7254c904 ]
The nvmet_tcp_handle_h2c_data_pdu() function should take into
consideration the possibility that the header digest and/or the data
digests are enabled when calculating the expected PDU length, before
comparing it to the value stored in cmd->pdu_len.
Fixes: efa56305908b ("nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length")
Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Keith Busch <kbusch@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/nvme/target/tcp.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
index d25ca0742f91..4f2164a3f466 100644
--- a/drivers/nvme/target/tcp.c
+++ b/drivers/nvme/target/tcp.c
@@ -931,7 +931,7 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
{
struct nvme_tcp_data_pdu *data = &queue->pdu.data;
struct nvmet_tcp_cmd *cmd;
- unsigned int plen;
+ unsigned int exp_data_len;
if (likely(queue->nr_cmds)) {
if (unlikely(data->ttag >= queue->nr_cmds)) {
@@ -954,9 +954,13 @@ static int nvmet_tcp_handle_h2c_data_pdu(struct nvmet_tcp_queue *queue)
return -EPROTO;
}
- plen = le32_to_cpu(data->hdr.plen);
+ exp_data_len = le32_to_cpu(data->hdr.plen) -
+ nvmet_tcp_hdgst_len(queue) -
+ nvmet_tcp_ddgst_len(queue) -
+ sizeof(*data);
+
cmd->pdu_len = le32_to_cpu(data->data_length);
- if (unlikely(cmd->pdu_len != (plen - sizeof(*data)) ||
+ if (unlikely(cmd->pdu_len != exp_data_len ||
cmd->pdu_len == 0 ||
cmd->pdu_len > NVMET_TCP_MAXH2CDATA)) {
pr_err("H2CData PDU len %u is invalid\n", cmd->pdu_len);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 330/374] PCI: keystone: Fix race condition when initializing PHYs
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (326 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 329/374] nvmet-tcp: Fix the H2C expected PDU len calculation Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 331/374] s390/pci: fix max size calculation in zpci_memcpy_toio() Greg Kroah-Hartman
` (46 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Siddharth Vadapalli,
Krzysztof Wilczyński, Ravi Gunasekaran, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Siddharth Vadapalli <s-vadapalli@ti.com>
[ Upstream commit c12ca110c613a81cb0f0099019c839d078cd0f38 ]
The PCI driver invokes the PHY APIs using the ks_pcie_enable_phy()
function. The PHY in this case is the Serdes. It is possible that the
PCI instance is configured for two lane operation across two different
Serdes instances, using one lane of each Serdes.
In such a configuration, if the reference clock for one Serdes is
provided by the other Serdes, it results in a race condition. After the
Serdes providing the reference clock is initialized by the PCI driver by
invoking its PHY APIs, it is not guaranteed that this Serdes remains
powered on long enough for the PHY APIs based initialization of the
dependent Serdes. In such cases, the PLL of the dependent Serdes fails
to lock due to the absence of the reference clock from the former Serdes
which has been powered off by the PM Core.
Fix this by obtaining reference to the PHYs before invoking the PHY
initialization APIs and releasing reference after the initialization is
complete.
Link: https://lore.kernel.org/linux-pci/20230927041845.1222080-1-s-vadapalli@ti.com
Fixes: 49229238ab47 ("PCI: keystone: Cleanup PHY handling")
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Acked-by: Ravi Gunasekaran <r-gunasekaran@ti.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/controller/dwc/pci-keystone.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/drivers/pci/controller/dwc/pci-keystone.c b/drivers/pci/controller/dwc/pci-keystone.c
index eacdcb0a8771..09379e5f7724 100644
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1200,7 +1200,16 @@ static int ks_pcie_probe(struct platform_device *pdev)
goto err_link;
}
+ /* Obtain references to the PHYs */
+ for (i = 0; i < num_lanes; i++)
+ phy_pm_runtime_get_sync(ks_pcie->phy[i]);
+
ret = ks_pcie_enable_phy(ks_pcie);
+
+ /* Release references to the PHYs */
+ for (i = 0; i < num_lanes; i++)
+ phy_pm_runtime_put_sync(ks_pcie->phy[i]);
+
if (ret) {
dev_err(dev, "failed to enable phy\n");
goto err_link;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 331/374] s390/pci: fix max size calculation in zpci_memcpy_toio()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (327 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 330/374] PCI: keystone: Fix race condition when initializing PHYs Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 332/374] net: qualcomm: rmnet: fix global oob in rmnet_policy Greg Kroah-Hartman
` (45 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Rosato, Niklas Schnelle,
Alexander Gordeev, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Schnelle <schnelle@linux.ibm.com>
[ Upstream commit 80df7d6af7f6d229b34cf237b2cc9024c07111cd ]
The zpci_get_max_write_size() helper is used to determine the maximum
size a PCI store or load can use at a given __iomem address.
For the PCI block store the following restrictions apply:
1. The dst + len must not cross a 4K boundary in the (pseudo-)MMIO space
2. len must not exceed ZPCI_MAX_WRITE_SIZE
3. len must be a multiple of 8 bytes
4. The src address must be double word (8 byte) aligned
5. The dst address must be double word (8 byte) aligned
Otherwise only a normal PCI store which takes its src value from
a register can be used. For these PCI store restriction 1 still applies.
Similarly 1 also applies to PCI loads.
It turns out zpci_max_write_size() instead implements stricter
conditions which prevents PCI block stores from being used where they
can and should be used. In particular instead of conditions 4 and 5 it
wrongly enforces both dst and src to be size aligned. This indirectly
covers condition 1 but also prevents many legal PCI block stores.
On top of the functional shortcomings the zpci_get_max_write_size() is
misnamed as it is used for both read and write size calculations. Rename
it to zpci_get_max_io_size() and implement the listed conditions
explicitly.
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Fixes: cd24834130ac ("s390/pci: base support")
Signed-off-by: Niklas Schnelle <schnelle@linux.ibm.com>
[agordeev@linux.ibm.com replaced spaces with tabs]
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/s390/include/asm/pci_io.h | 32 ++++++++++++++++++--------------
arch/s390/pci/pci_mmio.c | 12 ++++++------
2 files changed, 24 insertions(+), 20 deletions(-)
diff --git a/arch/s390/include/asm/pci_io.h b/arch/s390/include/asm/pci_io.h
index 287bb88f7698..2686bee800e3 100644
--- a/arch/s390/include/asm/pci_io.h
+++ b/arch/s390/include/asm/pci_io.h
@@ -11,6 +11,8 @@
/* I/O size constraints */
#define ZPCI_MAX_READ_SIZE 8
#define ZPCI_MAX_WRITE_SIZE 128
+#define ZPCI_BOUNDARY_SIZE (1 << 12)
+#define ZPCI_BOUNDARY_MASK (ZPCI_BOUNDARY_SIZE - 1)
/* I/O Map */
#define ZPCI_IOMAP_SHIFT 48
@@ -125,16 +127,18 @@ static inline int zpci_read_single(void *dst, const volatile void __iomem *src,
int zpci_write_block(volatile void __iomem *dst, const void *src,
unsigned long len);
-static inline u8 zpci_get_max_write_size(u64 src, u64 dst, int len, int max)
+static inline int zpci_get_max_io_size(u64 src, u64 dst, int len, int max)
{
- int count = len > max ? max : len, size = 1;
+ int offset = dst & ZPCI_BOUNDARY_MASK;
+ int size;
- while (!(src & 0x1) && !(dst & 0x1) && ((size << 1) <= count)) {
- dst = dst >> 1;
- src = src >> 1;
- size = size << 1;
- }
- return size;
+ size = min3(len, ZPCI_BOUNDARY_SIZE - offset, max);
+ if (IS_ALIGNED(src, 8) && IS_ALIGNED(dst, 8) && IS_ALIGNED(size, 8))
+ return size;
+
+ if (size >= 8)
+ return 8;
+ return rounddown_pow_of_two(size);
}
static inline int zpci_memcpy_fromio(void *dst,
@@ -144,9 +148,9 @@ static inline int zpci_memcpy_fromio(void *dst,
int size, rc = 0;
while (n > 0) {
- size = zpci_get_max_write_size((u64 __force) src,
- (u64) dst, n,
- ZPCI_MAX_READ_SIZE);
+ size = zpci_get_max_io_size((u64 __force) src,
+ (u64) dst, n,
+ ZPCI_MAX_READ_SIZE);
rc = zpci_read_single(dst, src, size);
if (rc)
break;
@@ -166,9 +170,9 @@ static inline int zpci_memcpy_toio(volatile void __iomem *dst,
return -EINVAL;
while (n > 0) {
- size = zpci_get_max_write_size((u64 __force) dst,
- (u64) src, n,
- ZPCI_MAX_WRITE_SIZE);
+ size = zpci_get_max_io_size((u64 __force) dst,
+ (u64) src, n,
+ ZPCI_MAX_WRITE_SIZE);
if (size > 8) /* main path */
rc = zpci_write_block(dst, src, size);
else
diff --git a/arch/s390/pci/pci_mmio.c b/arch/s390/pci/pci_mmio.c
index b94163ee5632..7e4cb95a431c 100644
--- a/arch/s390/pci/pci_mmio.c
+++ b/arch/s390/pci/pci_mmio.c
@@ -96,9 +96,9 @@ static inline int __memcpy_toio_inuser(void __iomem *dst,
return -EINVAL;
while (n > 0) {
- size = zpci_get_max_write_size((u64 __force) dst,
- (u64 __force) src, n,
- ZPCI_MAX_WRITE_SIZE);
+ size = zpci_get_max_io_size((u64 __force) dst,
+ (u64 __force) src, n,
+ ZPCI_MAX_WRITE_SIZE);
if (size > 8) /* main path */
rc = __pcistb_mio_inuser(dst, src, size, &status);
else
@@ -241,9 +241,9 @@ static inline int __memcpy_fromio_inuser(void __user *dst,
u8 status;
while (n > 0) {
- size = zpci_get_max_write_size((u64 __force) src,
- (u64 __force) dst, n,
- ZPCI_MAX_READ_SIZE);
+ size = zpci_get_max_io_size((u64 __force) src,
+ (u64 __force) dst, n,
+ ZPCI_MAX_READ_SIZE);
rc = __pcilg_mio_inuser(dst, src, size, &status);
if (rc)
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 332/374] net: qualcomm: rmnet: fix global oob in rmnet_policy
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (328 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 331/374] s390/pci: fix max size calculation in zpci_memcpy_toio() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 333/374] net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames Greg Kroah-Hartman
` (44 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Lin Ma,
Subash Abhinov Kasiviswanathan, Simon Horman, Jiri Pirko,
Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit b33fb5b801c6db408b774a68e7c8722796b59ecc ]
The variable rmnet_link_ops assign a *bigger* maxtype which leads to a
global out-of-bounds read when parsing the netlink attributes. See bug
trace below:
==================================================================
BUG: KASAN: global-out-of-bounds in validate_nla lib/nlattr.c:386 [inline]
BUG: KASAN: global-out-of-bounds in __nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600
Read of size 1 at addr ffffffff92c438d0 by task syz-executor.6/84207
CPU: 0 PID: 84207 Comm: syz-executor.6 Tainted: G N 6.1.0 #3
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x8b/0xb3 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x172/0x475 mm/kasan/report.c:395
kasan_report+0xbb/0x1c0 mm/kasan/report.c:495
validate_nla lib/nlattr.c:386 [inline]
__nla_validate_parse+0x24af/0x2750 lib/nlattr.c:600
__nla_parse+0x3e/0x50 lib/nlattr.c:697
nla_parse_nested_deprecated include/net/netlink.h:1248 [inline]
__rtnl_newlink+0x50a/0x1880 net/core/rtnetlink.c:3485
rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594
rtnetlink_rcv_msg+0x43c/0xd70 net/core/rtnetlink.c:6091
netlink_rcv_skb+0x14f/0x410 net/netlink/af_netlink.c:2540
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x54e/0x800 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x930/0xe50 net/netlink/af_netlink.c:1921
sock_sendmsg_nosec net/socket.c:714 [inline]
sock_sendmsg+0x154/0x190 net/socket.c:734
____sys_sendmsg+0x6df/0x840 net/socket.c:2482
___sys_sendmsg+0x110/0x1b0 net/socket.c:2536
__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fdcf2072359
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fdcf13e3168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fdcf219ff80 RCX: 00007fdcf2072359
RDX: 0000000000000000 RSI: 0000000020000200 RDI: 0000000000000003
RBP: 00007fdcf20bd493 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fffbb8d7bdf R14: 00007fdcf13e3300 R15: 0000000000022000
</TASK>
The buggy address belongs to the variable:
rmnet_policy+0x30/0xe0
The buggy address belongs to the physical page:
page:0000000065bdeb3c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x155243
flags: 0x200000000001000(reserved|node=0|zone=2)
raw: 0200000000001000 ffffea00055490c8 ffffea00055490c8 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffffffff92c43780: f9 f9 f9 f9 00 00 00 02 f9 f9 f9 f9 00 00 00 07
ffffffff92c43800: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 06 f9 f9 f9
>ffffffff92c43880: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
^
ffffffff92c43900: 00 00 00 00 00 00 00 00 07 f9 f9 f9 f9 f9 f9 f9
ffffffff92c43980: 00 00 00 07 f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9
According to the comment of `nla_parse_nested_deprecated`, the maxtype
should be len(destination array) - 1. Hence use `IFLA_RMNET_MAX` here.
Fixes: 14452ca3b5ce ("net: qualcomm: rmnet: Export mux_id and flags to netlink")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Reviewed-by: Subash Abhinov Kasiviswanathan <quic_subashab@quicinc.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Link: https://lore.kernel.org/r/20240110061400.3356108-1-linma@zju.edu.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
index 27b1663c476e..64b209a0ad21 100644
--- a/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
+++ b/drivers/net/ethernet/qualcomm/rmnet/rmnet_config.c
@@ -391,7 +391,7 @@ static int rmnet_fill_info(struct sk_buff *skb, const struct net_device *dev)
struct rtnl_link_ops rmnet_link_ops __read_mostly = {
.kind = "rmnet",
- .maxtype = __IFLA_RMNET_MAX,
+ .maxtype = IFLA_RMNET_MAX,
.priv_size = sizeof(struct rmnet_priv),
.setup = rmnet_vnd_setup,
.validate = rmnet_rtnl_validate,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 333/374] net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (329 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 332/374] net: qualcomm: rmnet: fix global oob in rmnet_policy Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 334/374] net: phy: micrel: populate .soft_reset for KSZ9131 Greg Kroah-Hartman
` (43 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jorge Sanjuan Garcia, Horatiu Vultur,
Siddharth Vadapalli, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sanjuán García, Jorge <Jorge.SanjuanGarcia@duagon.com>
[ Upstream commit 64e47d8afb5ca533b27efc006405e5bcae2c4a7b ]
The value of AM65_CPSW_MAX_PACKET_SIZE represents the maximum length
of a received frame. This value is written to the register
AM65_CPSW_PORT_REG_RX_MAXLEN.
The maximum MTU configured on the network device should then leave
some room for the ethernet headers and frame check. Otherwise, if
the network interface is configured to its maximum mtu possible,
the frames will be larger than AM65_CPSW_MAX_PACKET_SIZE and will
get dropped as oversized.
The switch supports ethernet frame sizes between 64 and 2024 bytes
(including VLAN) as stated in the technical reference manual, so
define AM65_CPSW_MAX_PACKET_SIZE with that maximum size.
Fixes: 93a76530316a ("net: ethernet: ti: introduce am65x/j721e gigabit eth subsystem driver")
Signed-off-by: Jorge Sanjuan Garcia <jorge.sanjuangarcia@duagon.com>
Reviewed-by: Horatiu Vultur <horatiu.vultur@microchip.com>
Reviewed-by: Siddharth Vadapalli <s-vadapalli@ti.com>
Link: https://lore.kernel.org/r/20240105085530.14070-2-jorge.sanjuangarcia@duagon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/ti/am65-cpsw-nuss.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/ti/am65-cpsw-nuss.c b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
index 4aa9477ac597..1fa6f0dacd2d 100644
--- a/drivers/net/ethernet/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ethernet/ti/am65-cpsw-nuss.c
@@ -53,7 +53,7 @@
#define AM65_CPSW_MAX_PORTS 8
#define AM65_CPSW_MIN_PACKET_SIZE VLAN_ETH_ZLEN
-#define AM65_CPSW_MAX_PACKET_SIZE (VLAN_ETH_FRAME_LEN + ETH_FCS_LEN)
+#define AM65_CPSW_MAX_PACKET_SIZE 2024
#define AM65_CPSW_REG_CTL 0x004
#define AM65_CPSW_REG_STAT_PORT_EN 0x014
@@ -1985,7 +1985,8 @@ am65_cpsw_nuss_init_port_ndev(struct am65_cpsw_common *common, u32 port_idx)
eth_hw_addr_set(port->ndev, port->slave.mac_addr);
port->ndev->min_mtu = AM65_CPSW_MIN_PACKET_SIZE;
- port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE;
+ port->ndev->max_mtu = AM65_CPSW_MAX_PACKET_SIZE -
+ (VLAN_ETH_HLEN + ETH_FCS_LEN);
port->ndev->hw_features = NETIF_F_SG |
NETIF_F_RXCSUM |
NETIF_F_HW_CSUM |
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 334/374] net: phy: micrel: populate .soft_reset for KSZ9131
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (330 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 333/374] net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 335/374] mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN Greg Kroah-Hartman
` (42 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Claudiu Beznea, Maxime Chevallier,
Andrew Lunn, David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
[ Upstream commit e398822c4751017fe401f57409488f5948d12fb5 ]
The RZ/G3S SMARC Module has 2 KSZ9131 PHYs. In this setup, the KSZ9131 PHY
is used with the ravb Ethernet driver. It has been discovered that when
bringing the Ethernet interface down/up continuously, e.g., with the
following sh script:
$ while :; do ifconfig eth0 down; ifconfig eth0 up; done
the link speed and duplex are wrong after interrupting the bring down/up
operation even though the Ethernet interface is up. To recover from this
state the following configuration sequence is necessary (executed
manually):
$ ifconfig eth0 down
$ ifconfig eth0 up
The behavior has been identified also on the Microchip SAMA7G5-EK board
which runs the macb driver and uses the same PHY.
The order of PHY-related operations in ravb_open() is as follows:
ravb_open() ->
ravb_phy_start() ->
ravb_phy_init() ->
of_phy_connect() ->
phy_connect_direct() ->
phy_attach_direct() ->
phy_init_hw() ->
phydev->drv->soft_reset()
phydev->drv->config_init()
phydev->drv->config_intr()
phy_resume()
kszphy_resume()
The order of PHY-related operations in ravb_close is as follows:
ravb_close() ->
phy_stop() ->
phy_suspend() ->
kszphy_suspend() ->
genphy_suspend()
// set BMCR_PDOWN bit in MII_BMCR
In genphy_suspend() setting the BMCR_PDWN bit in MII_BMCR switches the PHY
to Software Power-Down (SPD) mode (according to the KSZ9131 datasheet).
Thus, when opening the interface after it has been previously closed (via
ravb_close()), the phydev->drv->config_init() and
phydev->drv->config_intr() reach the KSZ9131 PHY driver via the
ksz9131_config_init() and kszphy_config_intr() functions.
KSZ9131 specifies that the MII management interface remains operational
during SPD (Software Power-Down), but (according to manual):
- Only access to the standard registers (0 through 31) is supported.
- Access to MMD address spaces other than MMD address space 1 is possible
if the spd_clock_gate_override bit is set.
- Access to MMD address space 1 is not possible.
The spd_clock_gate_override bit is not used in the KSZ9131 driver.
ksz9131_config_init() configures RGMII delay, pad skews and LEDs by
accessesing MMD registers other than those in address space 1.
The datasheet for the KSZ9131 does not specify what happens if registers
from an unsupported address space are accessed while the PHY is in SPD.
To fix the issue the .soft_reset method has been instantiated for KSZ9131,
too. This resets the PHY to the default state before doing any
configurations to it, thus switching it out of SPD.
Fixes: bff5b4b37372 ("net: phy: micrel: add Microchip KSZ9131 initial driver")
Signed-off-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com>
Reviewed-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/phy/micrel.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index 05a8985d7107..dc209ad8a0fe 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -1728,6 +1728,7 @@ static struct phy_driver ksphy_driver[] = {
/* PHY_GBIT_FEATURES */
.driver_data = &ksz9021_type,
.probe = kszphy_probe,
+ .soft_reset = genphy_soft_reset,
.config_init = ksz9131_config_init,
.config_intr = kszphy_config_intr,
.handle_interrupt = kszphy_handle_interrupt,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 335/374] mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (331 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 334/374] net: phy: micrel: populate .soft_reset for KSZ9131 Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 336/374] mptcp: drop unused sk in mptcp_get_options Greg Kroah-Hartman
` (41 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Florian Westphal,
Peter Krystad, Matthieu Baerts, Mat Martineau, Geliang Tang,
Simon Horman, Paolo Abeni, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 89e23277f9c16df6f9f9c1a1a07f8f132339c15c ]
mptcp_parse_option() currently sets OPTIONS_MPTCP_MPJ, for the three
possible cases handled for MPTCPOPT_MP_JOIN option.
OPTIONS_MPTCP_MPJ is the combination of three flags:
- OPTION_MPTCP_MPJ_SYN
- OPTION_MPTCP_MPJ_SYNACK
- OPTION_MPTCP_MPJ_ACK
This is a problem, because backup, join_id, token, nonce and/or hmac fields
could be left uninitialized in some cases.
Distinguish the three cases, as following patches will need this step.
Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Krystad <peter.krystad@linux.intel.com>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20240111194917.4044654-2-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/options.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 012e0e352276..c7d6997b31c8 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -118,8 +118,8 @@ static void mptcp_parse_option(const struct sk_buff *skb,
break;
case MPTCPOPT_MP_JOIN:
- mp_opt->suboptions |= OPTIONS_MPTCP_MPJ;
if (opsize == TCPOLEN_MPTCP_MPJ_SYN) {
+ mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYN;
mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
mp_opt->join_id = *ptr++;
mp_opt->token = get_unaligned_be32(ptr);
@@ -130,6 +130,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
mp_opt->backup, mp_opt->join_id,
mp_opt->token, mp_opt->nonce);
} else if (opsize == TCPOLEN_MPTCP_MPJ_SYNACK) {
+ mp_opt->suboptions |= OPTION_MPTCP_MPJ_SYNACK;
mp_opt->backup = *ptr++ & MPTCPOPT_BACKUP;
mp_opt->join_id = *ptr++;
mp_opt->thmac = get_unaligned_be64(ptr);
@@ -140,11 +141,10 @@ static void mptcp_parse_option(const struct sk_buff *skb,
mp_opt->backup, mp_opt->join_id,
mp_opt->thmac, mp_opt->nonce);
} else if (opsize == TCPOLEN_MPTCP_MPJ_ACK) {
+ mp_opt->suboptions |= OPTION_MPTCP_MPJ_ACK;
ptr += 2;
memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
pr_debug("MP_JOIN hmac");
- } else {
- mp_opt->suboptions &= ~OPTIONS_MPTCP_MPJ;
}
break;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 336/374] mptcp: drop unused sk in mptcp_get_options
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (332 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 335/374] mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 337/374] mptcp: strict validation before using mp_opt->hmac Greg Kroah-Hartman
` (40 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Geliang Tang, Matthieu Baerts,
Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geliang Tang <geliang.tang@suse.com>
[ Upstream commit 0799e21b5a76d9f14d8a8f024d0b6b9847ad1a03 ]
The parameter 'sk' became useless since the code using it was dropped
from mptcp_get_options() in the commit 8d548ea1dd15 ("mptcp: do not set
unconditionally csum_reqd on incoming opt"). Let's drop it.
Signed-off-by: Geliang Tang <geliang.tang@suse.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: c1665273bdc7 ("mptcp: strict validation before using mp_opt->hmac")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/options.c | 5 ++---
net/mptcp/protocol.h | 3 +--
net/mptcp/subflow.c | 10 +++++-----
3 files changed, 8 insertions(+), 10 deletions(-)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index c7d6997b31c8..3b4ce8a06f99 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -354,8 +354,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
}
}
-void mptcp_get_options(const struct sock *sk,
- const struct sk_buff *skb,
+void mptcp_get_options(const struct sk_buff *skb,
struct mptcp_options_received *mp_opt)
{
const struct tcphdr *th = tcp_hdr(skb);
@@ -1091,7 +1090,7 @@ bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
return true;
}
- mptcp_get_options(sk, skb, &mp_opt);
+ mptcp_get_options(skb, &mp_opt);
/* The subflow can be in close state only if check_fully_established()
* just sent a reset. If so, tell the caller to ignore the current packet.
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index e193b710b471..78aa6125eafb 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -636,8 +636,7 @@ int __init mptcp_proto_v6_init(void);
struct sock *mptcp_sk_clone(const struct sock *sk,
const struct mptcp_options_received *mp_opt,
struct request_sock *req);
-void mptcp_get_options(const struct sock *sk,
- const struct sk_buff *skb,
+void mptcp_get_options(const struct sk_buff *skb,
struct mptcp_options_received *mp_opt);
void mptcp_finish_connect(struct sock *sk);
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 666f6720db76..a1349c6eda46 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -152,7 +152,7 @@ static int subflow_check_req(struct request_sock *req,
return -EINVAL;
#endif
- mptcp_get_options(sk_listener, skb, &mp_opt);
+ mptcp_get_options(skb, &mp_opt);
opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC);
opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ);
@@ -249,7 +249,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
int err;
subflow_init_req(req, sk_listener);
- mptcp_get_options(sk_listener, skb, &mp_opt);
+ mptcp_get_options(skb, &mp_opt);
opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC);
opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ);
@@ -407,7 +407,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
subflow->ssn_offset = TCP_SKB_CB(skb)->seq;
pr_debug("subflow=%p synack seq=%x", subflow, subflow->ssn_offset);
- mptcp_get_options(sk, skb, &mp_opt);
+ mptcp_get_options(skb, &mp_opt);
if (subflow->request_mptcp) {
if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC)) {
MPTCP_INC_STATS(sock_net(sk),
@@ -687,7 +687,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
* reordered MPC will cause fallback, but we don't have other
* options.
*/
- mptcp_get_options(sk, skb, &mp_opt);
+ mptcp_get_options(skb, &mp_opt);
if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPC)) {
fallback = true;
goto create_child;
@@ -697,7 +697,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
if (!new_msk)
fallback = true;
} else if (subflow_req->mp_join) {
- mptcp_get_options(sk, skb, &mp_opt);
+ mptcp_get_options(skb, &mp_opt);
if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ) ||
!subflow_hmac_valid(req, &mp_opt) ||
!mptcp_can_accept_new_subflow(subflow_req->msk)) {
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 337/374] mptcp: strict validation before using mp_opt->hmac
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (333 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 336/374] mptcp: drop unused sk in mptcp_get_options Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 338/374] mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() Greg Kroah-Hartman
` (39 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Florian Westphal,
Peter Krystad, Matthieu Baerts, Mat Martineau, Geliang Tang,
Simon Horman, Paolo Abeni, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit c1665273bdc7c201766c65e561c06711f2e050dc ]
mp_opt->hmac contains uninitialized data unless OPTION_MPTCP_MPJ_ACK
was set in mptcp_parse_option().
We must refine the condition before we call subflow_hmac_valid().
Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Krystad <peter.krystad@linux.intel.com>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20240111194917.4044654-3-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/subflow.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index a1349c6eda46..c2c30724b322 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -698,7 +698,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
fallback = true;
} else if (subflow_req->mp_join) {
mptcp_get_options(skb, &mp_opt);
- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ) ||
+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK) ||
!subflow_hmac_valid(req, &mp_opt) ||
!mptcp_can_accept_new_subflow(subflow_req->msk)) {
SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 338/374] mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (334 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 337/374] mptcp: strict validation before using mp_opt->hmac Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 339/374] mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() Greg Kroah-Hartman
` (38 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Eric Dumazet, Florian Westphal,
Peter Krystad, Matthieu Baerts, Mat Martineau, Geliang Tang,
Simon Horman, Paolo Abeni, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit be1d9d9d38da922bd4beeec5b6dd821ff5a1dfeb ]
subflow_finish_connect() uses four fields (backup, join_id, thmac, none)
that may contain garbage unless OPTION_MPTCP_MPJ_SYNACK has been set
in mptcp_parse_option()
Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Krystad <peter.krystad@linux.intel.com>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20240111194917.4044654-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/subflow.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index c2c30724b322..297d2465c413 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -432,7 +432,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
} else if (subflow->request_join) {
u8 hmac[SHA256_DIGEST_SIZE];
- if (!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ)) {
+ if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYNACK)) {
subflow->reset_reason = MPTCP_RST_EMPTCP;
goto do_reset;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 339/374] mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (335 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 338/374] mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 340/374] net: ravb: Fix dma_addr_t truncation in error case Greg Kroah-Hartman
` (37 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot, Eric Dumazet,
Florian Westphal, Peter Krystad, Matthieu Baerts, Mat Martineau,
Geliang Tang, Simon Horman, Paolo Abeni, Jakub Kicinski,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Dumazet <edumazet@google.com>
[ Upstream commit 66ff70df1a919a066942844bb095d6fcb748d78d ]
syzbot reported that subflow_check_req() was using uninitialized data in
subflow_check_req() [1]
This is because mp_opt.token is only set when OPTION_MPTCP_MPJ_SYN is also set.
While we are are it, fix mptcp_subflow_init_cookie_req()
to test for OPTION_MPTCP_MPJ_ACK.
[1]
BUG: KMSAN: uninit-value in subflow_token_join_request net/mptcp/subflow.c:91 [inline]
BUG: KMSAN: uninit-value in subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209
subflow_token_join_request net/mptcp/subflow.c:91 [inline]
subflow_check_req+0x1028/0x15d0 net/mptcp/subflow.c:209
subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367
tcp_conn_request+0x153a/0x4240 net/ipv4/tcp_input.c:7164
subflow_v6_conn_request+0x3ee/0x510
tcp_rcv_state_process+0x2e1/0x4ac0 net/ipv4/tcp_input.c:6659
tcp_v6_do_rcv+0x11bf/0x1fe0 net/ipv6/tcp_ipv6.c:1669
tcp_v6_rcv+0x480b/0x4fb0 net/ipv6/tcp_ipv6.c:1900
ip6_protocol_deliver_rcu+0xda6/0x2a60 net/ipv6/ip6_input.c:438
ip6_input_finish net/ipv6/ip6_input.c:483 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
ip6_input+0x15d/0x430 net/ipv6/ip6_input.c:492
dst_input include/net/dst.h:461 [inline]
ip6_rcv_finish+0x5db/0x870 net/ipv6/ip6_input.c:79
NF_HOOK include/linux/netfilter.h:314 [inline]
ipv6_rcv+0xda/0x390 net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core net/core/dev.c:5532 [inline]
__netif_receive_skb+0x1a6/0x5a0 net/core/dev.c:5646
netif_receive_skb_internal net/core/dev.c:5732 [inline]
netif_receive_skb+0x58/0x660 net/core/dev.c:5791
tun_rx_batched+0x3ee/0x980 drivers/net/tun.c:1555
tun_get_user+0x53af/0x66d0 drivers/net/tun.c:2002
tun_chr_write_iter+0x3af/0x5d0 drivers/net/tun.c:2048
call_write_iter include/linux/fs.h:2020 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x8ef/0x1490 fs/read_write.c:584
ksys_write+0x20f/0x4c0 fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__x64_sys_write+0x93/0xd0 fs/read_write.c:646
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x44/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Local variable mp_opt created at:
subflow_check_req+0x6d/0x15d0 net/mptcp/subflow.c:145
subflow_v6_route_req+0x269/0x410 net/mptcp/subflow.c:367
CPU: 1 PID: 5924 Comm: syz-executor.3 Not tainted 6.7.0-rc8-syzkaller-00055-g5eff55d725a4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/17/2023
Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Cc: Peter Krystad <peter.krystad@linux.intel.com>
Cc: Matthieu Baerts <matttbe@kernel.org>
Cc: Mat Martineau <martineau@kernel.org>
Cc: Geliang Tang <geliang.tang@linux.dev>
Reviewed-by: Simon Horman <horms@kernel.org>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Link: https://lore.kernel.org/r/20240111194917.4044654-5-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/mptcp/subflow.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 297d2465c413..099bdfc12da9 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -155,7 +155,7 @@ static int subflow_check_req(struct request_sock *req,
mptcp_get_options(skb, &mp_opt);
opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC);
- opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ);
+ opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN);
if (opt_mp_capable) {
SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE);
@@ -252,7 +252,7 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req,
mptcp_get_options(skb, &mp_opt);
opt_mp_capable = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPC);
- opt_mp_join = !!(mp_opt.suboptions & OPTIONS_MPTCP_MPJ);
+ opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK);
if (opt_mp_capable && opt_mp_join)
return -EINVAL;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 340/374] net: ravb: Fix dma_addr_t truncation in error case
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (336 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 339/374] mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 341/374] net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls Greg Kroah-Hartman
` (36 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nikita Yushchenko,
Niklas Söderlund, Sergey Shtylyov, Florian Fainelli,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
[ Upstream commit e327b2372bc0f18c30433ac40be07741b59231c5 ]
In ravb_start_xmit(), ravb driver uses u32 variable to store result of
dma_map_single() call. Since ravb hardware has 32-bit address fields in
descriptors, this works properly when mapping is successful - it is
platform's job to provide mapping addresses that fit into hardware
limitations.
However, in failure case dma_map_single() returns DMA_MAPPING_ERROR
constant that is 64-bit when dma_addr_t is 64-bit. Storing this constant
in u32 leads to truncation, and further call to dma_mapping_error()
fails to notice the error.
Fix that by storing result of dma_map_single() in a dma_addr_t
variable.
Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
Signed-off-by: Nikita Yushchenko <nikita.yoush@cogentembedded.com>
Reviewed-by: Niklas Söderlund <niklas.soderlund+renesas@ragnatech.se>
Reviewed-by: Sergey Shtylyov <s.shtylyov@omp.ru>
Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/renesas/ravb_main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
index 1fa002c42c88..2bf5d4c208d3 100644
--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1567,7 +1567,7 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev)
struct ravb_tstamp_skb *ts_skb;
struct ravb_tx_desc *desc;
unsigned long flags;
- u32 dma_addr;
+ dma_addr_t dma_addr;
void *buffer;
u32 entry;
u32 len;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 341/374] net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (337 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 340/374] net: ravb: Fix dma_addr_t truncation in error case Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 342/374] bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS Greg Kroah-Hartman
` (35 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiang Ma, Simon Horman, Paolo Abeni,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Ma <maqianga@uniontech.com>
[ Upstream commit a23aa04042187cbde16f470b49d4ad60d32e9206 ]
We found the following dmesg calltrace when testing the GMAC NIC notebook:
[9.448656] ------------[ cut here ]------------
[9.448658] Unbalanced IRQ 43 wake disable
[9.448673] WARNING: CPU: 3 PID: 1083 at kernel/irq/manage.c:688 irq_set_irq_wake+0xe0/0x128
[9.448717] CPU: 3 PID: 1083 Comm: ethtool Tainted: G O 4.19 #1
[9.448773] ...
[9.448774] Call Trace:
[9.448781] [<9000000000209b5c>] show_stack+0x34/0x140
[9.448788] [<9000000000d52700>] dump_stack+0x98/0xd0
[9.448794] [<9000000000228610>] __warn+0xa8/0x120
[9.448797] [<9000000000d2fb60>] report_bug+0x98/0x130
[9.448800] [<900000000020a418>] do_bp+0x248/0x2f0
[9.448805] [<90000000002035f4>] handle_bp_int+0x4c/0x78
[9.448808] [<900000000029ea40>] irq_set_irq_wake+0xe0/0x128
[9.448813] [<9000000000a96a7c>] stmmac_set_wol+0x134/0x150
[9.448819] [<9000000000be6ed0>] dev_ethtool+0x1368/0x2440
[9.448824] [<9000000000c08350>] dev_ioctl+0x1f8/0x3e0
[9.448827] [<9000000000bb2a34>] sock_ioctl+0x2a4/0x450
[9.448832] [<900000000046f044>] do_vfs_ioctl+0xa4/0x738
[9.448834] [<900000000046f778>] ksys_ioctl+0xa0/0xe8
[9.448837] [<900000000046f7d8>] sys_ioctl+0x18/0x28
[9.448840] [<9000000000211ab4>] syscall_common+0x20/0x34
[9.448842] ---[ end trace 40c18d9aec863c3e ]---
Multiple disable_irq_wake() calls will keep decreasing the IRQ
wake_depth, When wake_depth is 0, calling disable_irq_wake() again,
will report the above calltrace.
Due to the need to appear in pairs, we cannot call disable_irq_wake()
without calling enable_irq_wake(). Fix this by making sure there are
no unbalanced disable_irq_wake() calls.
Fixes: 3172d3afa998 ("stmmac: support wake up irq from external sources (v3)")
Signed-off-by: Qiang Ma <maqianga@uniontech.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240112021249.24598-1-maqianga@uniontech.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac.h | 1 +
drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 10 ++++++++--
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 +
3 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac.h b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
index f03779205ade..1a74437787c0 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
@@ -241,6 +241,7 @@ struct stmmac_priv {
u32 msg_enable;
int wolopts;
int wol_irq;
+ bool wol_irq_disabled;
int clk_csr;
struct timer_list eee_ctrl_timer;
int lpi_irq;
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
index 9e8ae4384e4f..7b954365e564 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
@@ -758,10 +758,16 @@ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
if (wol->wolopts) {
pr_info("stmmac: wakeup enable\n");
device_set_wakeup_enable(priv->device, 1);
- enable_irq_wake(priv->wol_irq);
+ /* Avoid unbalanced enable_irq_wake calls */
+ if (priv->wol_irq_disabled)
+ enable_irq_wake(priv->wol_irq);
+ priv->wol_irq_disabled = false;
} else {
device_set_wakeup_enable(priv->device, 0);
- disable_irq_wake(priv->wol_irq);
+ /* Avoid unbalanced disable_irq_wake calls */
+ if (!priv->wol_irq_disabled)
+ disable_irq_wake(priv->wol_irq);
+ priv->wol_irq_disabled = true;
}
mutex_lock(&priv->lock);
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 08693d7458d1..ede630bfad2f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -3506,6 +3506,7 @@ static int stmmac_request_irq_multi_msi(struct net_device *dev)
/* Request the Wake IRQ in case of another line
* is used for WoL
*/
+ priv->wol_irq_disabled = true;
if (priv->wol_irq > 0 && priv->wol_irq != dev->irq) {
int_name = priv->int_name_wol;
sprintf(int_name, "%s:%s", dev->name, "wol");
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 342/374] bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (338 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 341/374] net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 343/374] net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe Greg Kroah-Hartman
` (34 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hao Sun, Daniel Borkmann,
Yonghong Song, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hao Sun <sunhao.th@gmail.com>
[ Upstream commit 22c7fa171a02d310e3a3f6ed46a698ca8a0060ed ]
For PTR_TO_FLOW_KEYS, check_flow_keys_access() only uses fixed off
for validation. However, variable offset ptr alu is not prohibited
for this ptr kind. So the variable offset is not checked.
The following prog is accepted:
func#0 @0
0: R1=ctx() R10=fp0
0: (bf) r6 = r1 ; R1=ctx() R6_w=ctx()
1: (79) r7 = *(u64 *)(r6 +144) ; R6_w=ctx() R7_w=flow_keys()
2: (b7) r8 = 1024 ; R8_w=1024
3: (37) r8 /= 1 ; R8_w=scalar()
4: (57) r8 &= 1024 ; R8_w=scalar(smin=smin32=0,
smax=umax=smax32=umax32=1024,var_off=(0x0; 0x400))
5: (0f) r7 += r8
mark_precise: frame0: last_idx 5 first_idx 0 subseq_idx -1
mark_precise: frame0: regs=r8 stack= before 4: (57) r8 &= 1024
mark_precise: frame0: regs=r8 stack= before 3: (37) r8 /= 1
mark_precise: frame0: regs=r8 stack= before 2: (b7) r8 = 1024
6: R7_w=flow_keys(smin=smin32=0,smax=umax=smax32=umax32=1024,var_off
=(0x0; 0x400)) R8_w=scalar(smin=smin32=0,smax=umax=smax32=umax32=1024,
var_off=(0x0; 0x400))
6: (79) r0 = *(u64 *)(r7 +0) ; R0_w=scalar()
7: (95) exit
This prog loads flow_keys to r7, and adds the variable offset r8
to r7, and finally causes out-of-bounds access:
BUG: unable to handle page fault for address: ffffc90014c80038
[...]
Call Trace:
<TASK>
bpf_dispatcher_nop_func include/linux/bpf.h:1231 [inline]
__bpf_prog_run include/linux/filter.h:651 [inline]
bpf_prog_run include/linux/filter.h:658 [inline]
bpf_prog_run_pin_on_cpu include/linux/filter.h:675 [inline]
bpf_flow_dissect+0x15f/0x350 net/core/flow_dissector.c:991
bpf_prog_test_run_flow_dissector+0x39d/0x620 net/bpf/test_run.c:1359
bpf_prog_test_run kernel/bpf/syscall.c:4107 [inline]
__sys_bpf+0xf8f/0x4560 kernel/bpf/syscall.c:5475
__do_sys_bpf kernel/bpf/syscall.c:5561 [inline]
__se_sys_bpf kernel/bpf/syscall.c:5559 [inline]
__x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:5559
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x3f/0x110 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Fix this by rejecting ptr alu with variable offset on flow_keys.
Applying the patch rejects the program with "R7 pointer arithmetic
on flow_keys prohibited".
Fixes: d58e468b1112 ("flow_dissector: implements flow dissector BPF hook")
Signed-off-by: Hao Sun <sunhao.th@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/bpf/20240115082028.9992-1-sunhao.th@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/bpf/verifier.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index c2ecf349523d..88a468cc0510 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -7295,6 +7295,10 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env,
}
switch (base_type(ptr_reg->type)) {
+ case PTR_TO_FLOW_KEYS:
+ if (known)
+ break;
+ fallthrough;
case CONST_PTR_TO_MAP:
/* smin_val represents the known value */
if (known && smin_val == 0 && opcode == BPF_ADD)
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 343/374] net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (339 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 342/374] bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS Greg Kroah-Hartman
@ 2024-01-22 23:59 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 344/374] netfilter: nf_tables: reject invalid set policy Greg Kroah-Hartman
` (33 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-22 23:59 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kunwu Chan, Jakub Kicinski,
Simon Horman, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kunwu Chan <chentao@kylinos.cn>
[ Upstream commit 776dac5a662774f07a876b650ba578d0a62d20db ]
devm_kasprintf() returns a pointer to dynamically allocated memory
which can be NULL upon failure.
Fixes: 05bd97fc559d ("net: dsa: Add Vitesse VSC73xx DSA router driver")
Signed-off-by: Kunwu Chan <chentao@kylinos.cn>
Suggested-by: Jakub Kicinski <kuba@kernel.org>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://lore.kernel.org/r/20240111072018.75971-1-chentao@kylinos.cn
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/dsa/vitesse-vsc73xx-core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/dsa/vitesse-vsc73xx-core.c b/drivers/net/dsa/vitesse-vsc73xx-core.c
index 0c0bc78b1788..6b6470ef2ae9 100644
--- a/drivers/net/dsa/vitesse-vsc73xx-core.c
+++ b/drivers/net/dsa/vitesse-vsc73xx-core.c
@@ -1119,6 +1119,8 @@ static int vsc73xx_gpio_probe(struct vsc73xx *vsc)
vsc->gc.label = devm_kasprintf(vsc->dev, GFP_KERNEL, "VSC%04x",
vsc->chipid);
+ if (!vsc->gc.label)
+ return -ENOMEM;
vsc->gc.ngpio = 4;
vsc->gc.owner = THIS_MODULE;
vsc->gc.parent = vsc->dev;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 344/374] netfilter: nf_tables: reject invalid set policy
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (340 preceding siblings ...)
2024-01-22 23:59 ` [PATCH 5.15 343/374] net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 345/374] netfilter: nft_connlimit: move stateful fields out of expression data Greg Kroah-Hartman
` (32 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 0617c3de9b4026b87be12b0cb5c35f42c7c66fcb ]
Report -EINVAL in case userspace provides a unsupported set backend
policy.
Fixes: c50b960ccc59 ("netfilter: nf_tables: implement proper set selection")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 54ff4d3bcd54..8a5fca1e61be 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4683,8 +4683,16 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
}
desc.policy = NFT_SET_POL_PERFORMANCE;
- if (nla[NFTA_SET_POLICY] != NULL)
+ if (nla[NFTA_SET_POLICY] != NULL) {
desc.policy = ntohl(nla_get_be32(nla[NFTA_SET_POLICY]));
+ switch (desc.policy) {
+ case NFT_SET_POL_PERFORMANCE:
+ case NFT_SET_POL_MEMORY:
+ break;
+ default:
+ return -EOPNOTSUPP;
+ }
+ }
if (nla[NFTA_SET_DESC] != NULL) {
err = nf_tables_set_desc_parse(&desc, nla[NFTA_SET_DESC]);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 345/374] netfilter: nft_connlimit: move stateful fields out of expression data
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (341 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 344/374] netfilter: nf_tables: reject invalid set policy Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 346/374] netfilter: nft_last: " Greg Kroah-Hartman
` (31 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 37f319f37d9005693dff085bb72852eeebc803ef ]
In preparation for the rule blob representation.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a139cee120 ("netfilter: nft_limit: do not ignore unsupported flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_connlimit.c | 26 ++++++++++++++++++--------
1 file changed, 18 insertions(+), 8 deletions(-)
diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 7d0761fad37e..58dcafe8bf79 100644
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -14,7 +14,7 @@
#include <net/netfilter/nf_conntrack_zones.h>
struct nft_connlimit {
- struct nf_conncount_list list;
+ struct nf_conncount_list *list;
u32 limit;
bool invert;
};
@@ -43,12 +43,12 @@ static inline void nft_connlimit_do_eval(struct nft_connlimit *priv,
return;
}
- if (nf_conncount_add(nft_net(pkt), &priv->list, tuple_ptr, zone)) {
+ if (nf_conncount_add(nft_net(pkt), priv->list, tuple_ptr, zone)) {
regs->verdict.code = NF_DROP;
return;
}
- count = priv->list.count;
+ count = priv->list->count;
if ((count > priv->limit) ^ priv->invert) {
regs->verdict.code = NFT_BREAK;
@@ -76,7 +76,11 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx,
invert = true;
}
- nf_conncount_list_init(&priv->list);
+ priv->list = kmalloc(sizeof(*priv->list), GFP_KERNEL);
+ if (!priv->list)
+ return -ENOMEM;
+
+ nf_conncount_list_init(priv->list);
priv->limit = limit;
priv->invert = invert;
@@ -87,7 +91,8 @@ static void nft_connlimit_do_destroy(const struct nft_ctx *ctx,
struct nft_connlimit *priv)
{
nf_ct_netns_put(ctx->net, ctx->family);
- nf_conncount_cache_free(&priv->list);
+ nf_conncount_cache_free(priv->list);
+ kfree(priv->list);
}
static int nft_connlimit_do_dump(struct sk_buff *skb,
@@ -200,7 +205,11 @@ static int nft_connlimit_clone(struct nft_expr *dst, const struct nft_expr *src)
struct nft_connlimit *priv_dst = nft_expr_priv(dst);
struct nft_connlimit *priv_src = nft_expr_priv(src);
- nf_conncount_list_init(&priv_dst->list);
+ priv_dst->list = kmalloc(sizeof(*priv_dst->list), GFP_ATOMIC);
+ if (priv_dst->list)
+ return -ENOMEM;
+
+ nf_conncount_list_init(priv_dst->list);
priv_dst->limit = priv_src->limit;
priv_dst->invert = priv_src->invert;
@@ -212,7 +221,8 @@ static void nft_connlimit_destroy_clone(const struct nft_ctx *ctx,
{
struct nft_connlimit *priv = nft_expr_priv(expr);
- nf_conncount_cache_free(&priv->list);
+ nf_conncount_cache_free(priv->list);
+ kfree(priv->list);
}
static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)
@@ -221,7 +231,7 @@ static bool nft_connlimit_gc(struct net *net, const struct nft_expr *expr)
bool ret;
local_bh_disable();
- ret = nf_conncount_gc_list(net, &priv->list);
+ ret = nf_conncount_gc_list(net, priv->list);
local_bh_enable();
return ret;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 346/374] netfilter: nft_last: move stateful fields out of expression data
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (342 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 345/374] netfilter: nft_connlimit: move stateful fields out of expression data Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 347/374] netfilter: nft_quota: " Greg Kroah-Hartman
` (30 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 33a24de37e814572491bcb35f42c0de74ad67586 ]
In preparation for the rule blob representation.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a139cee120 ("netfilter: nft_limit: do not ignore unsupported flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_last.c | 69 +++++++++++++++++++++++++++++-----------
1 file changed, 51 insertions(+), 18 deletions(-)
diff --git a/net/netfilter/nft_last.c b/net/netfilter/nft_last.c
index 304e33cbed9b..5ee33d0ccd4e 100644
--- a/net/netfilter/nft_last.c
+++ b/net/netfilter/nft_last.c
@@ -8,9 +8,13 @@
#include <net/netfilter/nf_tables_core.h>
#include <net/netfilter/nf_tables.h>
+struct nft_last {
+ unsigned long jiffies;
+ unsigned int set;
+};
+
struct nft_last_priv {
- unsigned long last_jiffies;
- unsigned int last_set;
+ struct nft_last *last;
};
static const struct nla_policy nft_last_policy[NFTA_LAST_MAX + 1] = {
@@ -22,47 +26,55 @@ static int nft_last_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
const struct nlattr * const tb[])
{
struct nft_last_priv *priv = nft_expr_priv(expr);
+ struct nft_last *last;
u64 last_jiffies;
- u32 last_set = 0;
int err;
- if (tb[NFTA_LAST_SET]) {
- last_set = ntohl(nla_get_be32(tb[NFTA_LAST_SET]));
- if (last_set == 1)
- priv->last_set = 1;
- }
+ last = kzalloc(sizeof(*last), GFP_KERNEL);
+ if (!last)
+ return -ENOMEM;
+
+ if (tb[NFTA_LAST_SET])
+ last->set = ntohl(nla_get_be32(tb[NFTA_LAST_SET]));
- if (last_set && tb[NFTA_LAST_MSECS]) {
+ if (last->set && tb[NFTA_LAST_MSECS]) {
err = nf_msecs_to_jiffies64(tb[NFTA_LAST_MSECS], &last_jiffies);
if (err < 0)
- return err;
+ goto err;
- priv->last_jiffies = jiffies - (unsigned long)last_jiffies;
+ last->jiffies = jiffies - (unsigned long)last_jiffies;
}
+ priv->last = last;
return 0;
+err:
+ kfree(last);
+
+ return err;
}
static void nft_last_eval(const struct nft_expr *expr,
struct nft_regs *regs, const struct nft_pktinfo *pkt)
{
struct nft_last_priv *priv = nft_expr_priv(expr);
+ struct nft_last *last = priv->last;
- if (READ_ONCE(priv->last_jiffies) != jiffies)
- WRITE_ONCE(priv->last_jiffies, jiffies);
- if (READ_ONCE(priv->last_set) == 0)
- WRITE_ONCE(priv->last_set, 1);
+ if (READ_ONCE(last->jiffies) != jiffies)
+ WRITE_ONCE(last->jiffies, jiffies);
+ if (READ_ONCE(last->set) == 0)
+ WRITE_ONCE(last->set, 1);
}
static int nft_last_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
struct nft_last_priv *priv = nft_expr_priv(expr);
- unsigned long last_jiffies = READ_ONCE(priv->last_jiffies);
- u32 last_set = READ_ONCE(priv->last_set);
+ struct nft_last *last = priv->last;
+ unsigned long last_jiffies = READ_ONCE(last->jiffies);
+ u32 last_set = READ_ONCE(last->set);
__be64 msecs;
if (time_before(jiffies, last_jiffies)) {
- WRITE_ONCE(priv->last_set, 0);
+ WRITE_ONCE(last->set, 0);
last_set = 0;
}
@@ -81,11 +93,32 @@ static int nft_last_dump(struct sk_buff *skb, const struct nft_expr *expr)
return -1;
}
+static void nft_last_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+{
+ struct nft_last_priv *priv = nft_expr_priv(expr);
+
+ kfree(priv->last);
+}
+
+static int nft_last_clone(struct nft_expr *dst, const struct nft_expr *src)
+{
+ struct nft_last_priv *priv_dst = nft_expr_priv(dst);
+
+ priv_dst->last = kzalloc(sizeof(*priv_dst->last), GFP_ATOMIC);
+ if (priv_dst->last)
+ return -ENOMEM;
+
+ return 0;
+}
+
static const struct nft_expr_ops nft_last_ops = {
.type = &nft_last_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_last_priv)),
.eval = nft_last_eval,
.init = nft_last_init,
+ .destroy = nft_last_destroy,
+ .clone = nft_last_clone,
.dump = nft_last_dump,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 347/374] netfilter: nft_quota: move stateful fields out of expression data
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (343 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 346/374] netfilter: nft_last: " Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 348/374] netfilter: nft_limit: rename stateful structure Greg Kroah-Hartman
` (29 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit ed0a0c60f0e50fa52853620672af97edde3d3a03 ]
In preparation for the rule blob representation.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a139cee120 ("netfilter: nft_limit: do not ignore unsupported flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_quota.c | 52 +++++++++++++++++++++++++++++++++++----
1 file changed, 47 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c
index c4d1389f7185..0484aef74273 100644
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -15,13 +15,13 @@
struct nft_quota {
atomic64_t quota;
unsigned long flags;
- atomic64_t consumed;
+ atomic64_t *consumed;
};
static inline bool nft_overquota(struct nft_quota *priv,
const struct sk_buff *skb)
{
- return atomic64_add_return(skb->len, &priv->consumed) >=
+ return atomic64_add_return(skb->len, priv->consumed) >=
atomic64_read(&priv->quota);
}
@@ -90,13 +90,23 @@ static int nft_quota_do_init(const struct nlattr * const tb[],
return -EOPNOTSUPP;
}
+ priv->consumed = kmalloc(sizeof(*priv->consumed), GFP_KERNEL);
+ if (!priv->consumed)
+ return -ENOMEM;
+
atomic64_set(&priv->quota, quota);
priv->flags = flags;
- atomic64_set(&priv->consumed, consumed);
+ atomic64_set(priv->consumed, consumed);
return 0;
}
+static void nft_quota_do_destroy(const struct nft_ctx *ctx,
+ struct nft_quota *priv)
+{
+ kfree(priv->consumed);
+}
+
static int nft_quota_obj_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[],
struct nft_object *obj)
@@ -128,7 +138,7 @@ static int nft_quota_do_dump(struct sk_buff *skb, struct nft_quota *priv,
* that we see, don't go over the quota boundary in what we send to
* userspace.
*/
- consumed = atomic64_read(&priv->consumed);
+ consumed = atomic64_read(priv->consumed);
quota = atomic64_read(&priv->quota);
if (consumed >= quota) {
consumed_cap = quota;
@@ -145,7 +155,7 @@ static int nft_quota_do_dump(struct sk_buff *skb, struct nft_quota *priv,
goto nla_put_failure;
if (reset) {
- atomic64_sub(consumed, &priv->consumed);
+ atomic64_sub(consumed, priv->consumed);
clear_bit(NFT_QUOTA_DEPLETED_BIT, &priv->flags);
}
return 0;
@@ -162,11 +172,20 @@ static int nft_quota_obj_dump(struct sk_buff *skb, struct nft_object *obj,
return nft_quota_do_dump(skb, priv, reset);
}
+static void nft_quota_obj_destroy(const struct nft_ctx *ctx,
+ struct nft_object *obj)
+{
+ struct nft_quota *priv = nft_obj_data(obj);
+
+ return nft_quota_do_destroy(ctx, priv);
+}
+
static struct nft_object_type nft_quota_obj_type;
static const struct nft_object_ops nft_quota_obj_ops = {
.type = &nft_quota_obj_type,
.size = sizeof(struct nft_quota),
.init = nft_quota_obj_init,
+ .destroy = nft_quota_obj_destroy,
.eval = nft_quota_obj_eval,
.dump = nft_quota_obj_dump,
.update = nft_quota_obj_update,
@@ -205,12 +224,35 @@ static int nft_quota_dump(struct sk_buff *skb, const struct nft_expr *expr)
return nft_quota_do_dump(skb, priv, false);
}
+static void nft_quota_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+{
+ struct nft_quota *priv = nft_expr_priv(expr);
+
+ return nft_quota_do_destroy(ctx, priv);
+}
+
+static int nft_quota_clone(struct nft_expr *dst, const struct nft_expr *src)
+{
+ struct nft_quota *priv_dst = nft_expr_priv(dst);
+
+ priv_dst->consumed = kmalloc(sizeof(*priv_dst->consumed), GFP_ATOMIC);
+ if (priv_dst->consumed)
+ return -ENOMEM;
+
+ atomic64_set(priv_dst->consumed, 0);
+
+ return 0;
+}
+
static struct nft_expr_type nft_quota_type;
static const struct nft_expr_ops nft_quota_ops = {
.type = &nft_quota_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_quota)),
.eval = nft_quota_eval,
.init = nft_quota_init,
+ .destroy = nft_quota_destroy,
+ .clone = nft_quota_clone,
.dump = nft_quota_dump,
};
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 348/374] netfilter: nft_limit: rename stateful structure
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (344 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 347/374] netfilter: nft_quota: " Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 349/374] netfilter: nft_limit: move stateful fields out of expression data Greg Kroah-Hartman
` (28 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 369b6cb5d391750fc01ce951c2500281d2975705 ]
>From struct nft_limit to nft_limit_priv.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a139cee120 ("netfilter: nft_limit: do not ignore unsupported flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_limit.c | 104 +++++++++++++++++++-------------------
1 file changed, 52 insertions(+), 52 deletions(-)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index 82ec27bdf941..d6e0226b7603 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -14,7 +14,7 @@
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
-struct nft_limit {
+struct nft_limit_priv {
spinlock_t lock;
u64 last;
u64 tokens;
@@ -25,33 +25,33 @@ struct nft_limit {
bool invert;
};
-static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
+static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost)
{
u64 now, tokens;
s64 delta;
- spin_lock_bh(&limit->lock);
+ spin_lock_bh(&priv->lock);
now = ktime_get_ns();
- tokens = limit->tokens + now - limit->last;
- if (tokens > limit->tokens_max)
- tokens = limit->tokens_max;
+ tokens = priv->tokens + now - priv->last;
+ if (tokens > priv->tokens_max)
+ tokens = priv->tokens_max;
- limit->last = now;
+ priv->last = now;
delta = tokens - cost;
if (delta >= 0) {
- limit->tokens = delta;
- spin_unlock_bh(&limit->lock);
- return limit->invert;
+ priv->tokens = delta;
+ spin_unlock_bh(&priv->lock);
+ return priv->invert;
}
- limit->tokens = tokens;
- spin_unlock_bh(&limit->lock);
- return !limit->invert;
+ priv->tokens = tokens;
+ spin_unlock_bh(&priv->lock);
+ return !priv->invert;
}
/* Use same default as in iptables. */
#define NFT_LIMIT_PKT_BURST_DEFAULT 5
-static int nft_limit_init(struct nft_limit *limit,
+static int nft_limit_init(struct nft_limit_priv *priv,
const struct nlattr * const tb[], bool pkts)
{
u64 unit, tokens;
@@ -60,58 +60,58 @@ static int nft_limit_init(struct nft_limit *limit,
tb[NFTA_LIMIT_UNIT] == NULL)
return -EINVAL;
- limit->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
+ priv->rate = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_RATE]));
unit = be64_to_cpu(nla_get_be64(tb[NFTA_LIMIT_UNIT]));
- limit->nsecs = unit * NSEC_PER_SEC;
- if (limit->rate == 0 || limit->nsecs < unit)
+ priv->nsecs = unit * NSEC_PER_SEC;
+ if (priv->rate == 0 || priv->nsecs < unit)
return -EOVERFLOW;
if (tb[NFTA_LIMIT_BURST])
- limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
+ priv->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
- if (pkts && limit->burst == 0)
- limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
+ if (pkts && priv->burst == 0)
+ priv->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
- if (limit->rate + limit->burst < limit->rate)
+ if (priv->rate + priv->burst < priv->rate)
return -EOVERFLOW;
if (pkts) {
- tokens = div64_u64(limit->nsecs, limit->rate) * limit->burst;
+ tokens = div64_u64(priv->nsecs, priv->rate) * priv->burst;
} else {
/* The token bucket size limits the number of tokens can be
* accumulated. tokens_max specifies the bucket size.
* tokens_max = unit * (rate + burst) / rate.
*/
- tokens = div64_u64(limit->nsecs * (limit->rate + limit->burst),
- limit->rate);
+ tokens = div64_u64(priv->nsecs * (priv->rate + priv->burst),
+ priv->rate);
}
- limit->tokens = tokens;
- limit->tokens_max = limit->tokens;
+ priv->tokens = tokens;
+ priv->tokens_max = priv->tokens;
if (tb[NFTA_LIMIT_FLAGS]) {
u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
if (flags & NFT_LIMIT_F_INV)
- limit->invert = true;
+ priv->invert = true;
}
- limit->last = ktime_get_ns();
- spin_lock_init(&limit->lock);
+ priv->last = ktime_get_ns();
+ spin_lock_init(&priv->lock);
return 0;
}
-static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
+static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit_priv *priv,
enum nft_limit_type type)
{
- u32 flags = limit->invert ? NFT_LIMIT_F_INV : 0;
- u64 secs = div_u64(limit->nsecs, NSEC_PER_SEC);
+ u32 flags = priv->invert ? NFT_LIMIT_F_INV : 0;
+ u64 secs = div_u64(priv->nsecs, NSEC_PER_SEC);
- if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(limit->rate),
+ if (nla_put_be64(skb, NFTA_LIMIT_RATE, cpu_to_be64(priv->rate),
NFTA_LIMIT_PAD) ||
nla_put_be64(skb, NFTA_LIMIT_UNIT, cpu_to_be64(secs),
NFTA_LIMIT_PAD) ||
- nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(limit->burst)) ||
+ nla_put_be32(skb, NFTA_LIMIT_BURST, htonl(priv->burst)) ||
nla_put_be32(skb, NFTA_LIMIT_TYPE, htonl(type)) ||
nla_put_be32(skb, NFTA_LIMIT_FLAGS, htonl(flags)))
goto nla_put_failure;
@@ -121,8 +121,8 @@ static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit *limit,
return -1;
}
-struct nft_limit_pkts {
- struct nft_limit limit;
+struct nft_limit_priv_pkts {
+ struct nft_limit_priv limit;
u64 cost;
};
@@ -130,7 +130,7 @@ static void nft_limit_pkts_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
- struct nft_limit_pkts *priv = nft_expr_priv(expr);
+ struct nft_limit_priv_pkts *priv = nft_expr_priv(expr);
if (nft_limit_eval(&priv->limit, priv->cost))
regs->verdict.code = NFT_BREAK;
@@ -148,7 +148,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
{
- struct nft_limit_pkts *priv = nft_expr_priv(expr);
+ struct nft_limit_priv_pkts *priv = nft_expr_priv(expr);
int err;
err = nft_limit_init(&priv->limit, tb, true);
@@ -161,7 +161,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
{
- const struct nft_limit_pkts *priv = nft_expr_priv(expr);
+ const struct nft_limit_priv_pkts *priv = nft_expr_priv(expr);
return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}
@@ -169,7 +169,7 @@ static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
static struct nft_expr_type nft_limit_type;
static const struct nft_expr_ops nft_limit_pkts_ops = {
.type = &nft_limit_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts)),
.eval = nft_limit_pkts_eval,
.init = nft_limit_pkts_init,
.dump = nft_limit_pkts_dump,
@@ -179,7 +179,7 @@ static void nft_limit_bytes_eval(const struct nft_expr *expr,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
- struct nft_limit *priv = nft_expr_priv(expr);
+ struct nft_limit_priv *priv = nft_expr_priv(expr);
u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);
if (nft_limit_eval(priv, cost))
@@ -190,7 +190,7 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
const struct nft_expr *expr,
const struct nlattr * const tb[])
{
- struct nft_limit *priv = nft_expr_priv(expr);
+ struct nft_limit_priv *priv = nft_expr_priv(expr);
return nft_limit_init(priv, tb, false);
}
@@ -198,14 +198,14 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
static int nft_limit_bytes_dump(struct sk_buff *skb,
const struct nft_expr *expr)
{
- const struct nft_limit *priv = nft_expr_priv(expr);
+ const struct nft_limit_priv *priv = nft_expr_priv(expr);
return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
}
static const struct nft_expr_ops nft_limit_bytes_ops = {
.type = &nft_limit_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_limit)),
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv)),
.eval = nft_limit_bytes_eval,
.init = nft_limit_bytes_init,
.dump = nft_limit_bytes_dump,
@@ -240,7 +240,7 @@ static void nft_limit_obj_pkts_eval(struct nft_object *obj,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
- struct nft_limit_pkts *priv = nft_obj_data(obj);
+ struct nft_limit_priv_pkts *priv = nft_obj_data(obj);
if (nft_limit_eval(&priv->limit, priv->cost))
regs->verdict.code = NFT_BREAK;
@@ -250,7 +250,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[],
struct nft_object *obj)
{
- struct nft_limit_pkts *priv = nft_obj_data(obj);
+ struct nft_limit_priv_pkts *priv = nft_obj_data(obj);
int err;
err = nft_limit_init(&priv->limit, tb, true);
@@ -265,7 +265,7 @@ static int nft_limit_obj_pkts_dump(struct sk_buff *skb,
struct nft_object *obj,
bool reset)
{
- const struct nft_limit_pkts *priv = nft_obj_data(obj);
+ const struct nft_limit_priv_pkts *priv = nft_obj_data(obj);
return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}
@@ -273,7 +273,7 @@ static int nft_limit_obj_pkts_dump(struct sk_buff *skb,
static struct nft_object_type nft_limit_obj_type;
static const struct nft_object_ops nft_limit_obj_pkts_ops = {
.type = &nft_limit_obj_type,
- .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_pkts)),
+ .size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts)),
.init = nft_limit_obj_pkts_init,
.eval = nft_limit_obj_pkts_eval,
.dump = nft_limit_obj_pkts_dump,
@@ -283,7 +283,7 @@ static void nft_limit_obj_bytes_eval(struct nft_object *obj,
struct nft_regs *regs,
const struct nft_pktinfo *pkt)
{
- struct nft_limit *priv = nft_obj_data(obj);
+ struct nft_limit_priv *priv = nft_obj_data(obj);
u64 cost = div64_u64(priv->nsecs * pkt->skb->len, priv->rate);
if (nft_limit_eval(priv, cost))
@@ -294,7 +294,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
const struct nlattr * const tb[],
struct nft_object *obj)
{
- struct nft_limit *priv = nft_obj_data(obj);
+ struct nft_limit_priv *priv = nft_obj_data(obj);
return nft_limit_init(priv, tb, false);
}
@@ -303,7 +303,7 @@ static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
struct nft_object *obj,
bool reset)
{
- const struct nft_limit *priv = nft_obj_data(obj);
+ const struct nft_limit_priv *priv = nft_obj_data(obj);
return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
}
@@ -311,7 +311,7 @@ static int nft_limit_obj_bytes_dump(struct sk_buff *skb,
static struct nft_object_type nft_limit_obj_type;
static const struct nft_object_ops nft_limit_obj_bytes_ops = {
.type = &nft_limit_obj_type,
- .size = sizeof(struct nft_limit),
+ .size = sizeof(struct nft_limit_priv),
.init = nft_limit_obj_bytes_init,
.eval = nft_limit_obj_bytes_eval,
.dump = nft_limit_obj_bytes_dump,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 349/374] netfilter: nft_limit: move stateful fields out of expression data
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (345 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 348/374] netfilter: nft_limit: rename stateful structure Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 350/374] netfilter: nf_tables: memcg accounting for dynamically allocated objects Greg Kroah-Hartman
` (27 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 3b9e2ea6c11bff72ac1d607f6b954e7666b47409 ]
In preparation for the rule blob representation.
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a139cee120 ("netfilter: nft_limit: do not ignore unsupported flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_limit.c | 94 ++++++++++++++++++++++++++++++++++-----
1 file changed, 82 insertions(+), 12 deletions(-)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index d6e0226b7603..f04be5be73a0 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -14,10 +14,14 @@
#include <linux/netfilter/nf_tables.h>
#include <net/netfilter/nf_tables.h>
-struct nft_limit_priv {
+struct nft_limit {
spinlock_t lock;
u64 last;
u64 tokens;
+};
+
+struct nft_limit_priv {
+ struct nft_limit *limit;
u64 tokens_max;
u64 rate;
u64 nsecs;
@@ -30,21 +34,21 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost)
u64 now, tokens;
s64 delta;
- spin_lock_bh(&priv->lock);
+ spin_lock_bh(&priv->limit->lock);
now = ktime_get_ns();
- tokens = priv->tokens + now - priv->last;
+ tokens = priv->limit->tokens + now - priv->limit->last;
if (tokens > priv->tokens_max)
tokens = priv->tokens_max;
- priv->last = now;
+ priv->limit->last = now;
delta = tokens - cost;
if (delta >= 0) {
- priv->tokens = delta;
- spin_unlock_bh(&priv->lock);
+ priv->limit->tokens = delta;
+ spin_unlock_bh(&priv->limit->lock);
return priv->invert;
}
- priv->tokens = tokens;
- spin_unlock_bh(&priv->lock);
+ priv->limit->tokens = tokens;
+ spin_unlock_bh(&priv->limit->lock);
return !priv->invert;
}
@@ -86,8 +90,12 @@ static int nft_limit_init(struct nft_limit_priv *priv,
priv->rate);
}
- priv->tokens = tokens;
- priv->tokens_max = priv->tokens;
+ priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL);
+ if (!priv->limit)
+ return -ENOMEM;
+
+ priv->limit->tokens = tokens;
+ priv->tokens_max = priv->limit->tokens;
if (tb[NFTA_LIMIT_FLAGS]) {
u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
@@ -95,8 +103,8 @@ static int nft_limit_init(struct nft_limit_priv *priv,
if (flags & NFT_LIMIT_F_INV)
priv->invert = true;
}
- priv->last = ktime_get_ns();
- spin_lock_init(&priv->lock);
+ priv->limit->last = ktime_get_ns();
+ spin_lock_init(&priv->limit->lock);
return 0;
}
@@ -121,6 +129,32 @@ static int nft_limit_dump(struct sk_buff *skb, const struct nft_limit_priv *priv
return -1;
}
+static void nft_limit_destroy(const struct nft_ctx *ctx,
+ const struct nft_limit_priv *priv)
+{
+ kfree(priv->limit);
+}
+
+static int nft_limit_clone(struct nft_limit_priv *priv_dst,
+ const struct nft_limit_priv *priv_src)
+{
+ priv_dst->tokens_max = priv_src->tokens_max;
+ priv_dst->rate = priv_src->rate;
+ priv_dst->nsecs = priv_src->nsecs;
+ priv_dst->burst = priv_src->burst;
+ priv_dst->invert = priv_src->invert;
+
+ priv_dst->limit = kmalloc(sizeof(*priv_dst->limit), GFP_ATOMIC);
+ if (priv_dst->limit)
+ return -ENOMEM;
+
+ spin_lock_init(&priv_dst->limit->lock);
+ priv_dst->limit->tokens = priv_src->tokens_max;
+ priv_dst->limit->last = ktime_get_ns();
+
+ return 0;
+}
+
struct nft_limit_priv_pkts {
struct nft_limit_priv limit;
u64 cost;
@@ -166,12 +200,30 @@ static int nft_limit_pkts_dump(struct sk_buff *skb, const struct nft_expr *expr)
return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}
+static void nft_limit_pkts_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+{
+ const struct nft_limit_priv_pkts *priv = nft_expr_priv(expr);
+
+ nft_limit_destroy(ctx, &priv->limit);
+}
+
+static int nft_limit_pkts_clone(struct nft_expr *dst, const struct nft_expr *src)
+{
+ struct nft_limit_priv_pkts *priv_dst = nft_expr_priv(dst);
+ struct nft_limit_priv_pkts *priv_src = nft_expr_priv(src);
+
+ return nft_limit_clone(&priv_dst->limit, &priv_src->limit);
+}
+
static struct nft_expr_type nft_limit_type;
static const struct nft_expr_ops nft_limit_pkts_ops = {
.type = &nft_limit_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts)),
.eval = nft_limit_pkts_eval,
.init = nft_limit_pkts_init,
+ .destroy = nft_limit_pkts_destroy,
+ .clone = nft_limit_pkts_clone,
.dump = nft_limit_pkts_dump,
};
@@ -203,12 +255,30 @@ static int nft_limit_bytes_dump(struct sk_buff *skb,
return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
}
+static void nft_limit_bytes_destroy(const struct nft_ctx *ctx,
+ const struct nft_expr *expr)
+{
+ const struct nft_limit_priv *priv = nft_expr_priv(expr);
+
+ nft_limit_destroy(ctx, priv);
+}
+
+static int nft_limit_bytes_clone(struct nft_expr *dst, const struct nft_expr *src)
+{
+ struct nft_limit_priv *priv_dst = nft_expr_priv(dst);
+ struct nft_limit_priv *priv_src = nft_expr_priv(src);
+
+ return nft_limit_clone(priv_dst, priv_src);
+}
+
static const struct nft_expr_ops nft_limit_bytes_ops = {
.type = &nft_limit_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv)),
.eval = nft_limit_bytes_eval,
.init = nft_limit_bytes_init,
.dump = nft_limit_bytes_dump,
+ .clone = nft_limit_bytes_clone,
+ .destroy = nft_limit_bytes_destroy,
};
static const struct nft_expr_ops *
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 350/374] netfilter: nf_tables: memcg accounting for dynamically allocated objects
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (346 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 349/374] netfilter: nft_limit: move stateful fields out of expression data Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 351/374] netfilter: nft_limit: do not ignore unsupported flags Greg Kroah-Hartman
` (26 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vasily Averin, Roman Gushchin,
Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Averin <vasily.averin@linux.dev>
[ Upstream commit 42193ffd79bd3acd91bd947e53f3548a3661d0a1 ]
nft_*.c files whose NFT_EXPR_STATEFUL flag is set on need to
use __GFP_ACCOUNT flag for objects that are dynamically
allocated from the packet path.
Such objects are allocated inside nft_expr_ops->init() callbacks
executed in task context while processing netlink messages.
In addition, this patch adds accounting to nft_set_elem_expr_clone()
used for the same purposes.
Signed-off-by: Vasily Averin <vvs@openvz.org>
Acked-by: Roman Gushchin <roman.gushchin@linux.dev>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Stable-dep-of: 91a139cee120 ("netfilter: nft_limit: do not ignore unsupported flags")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 2 +-
net/netfilter/nft_connlimit.c | 2 +-
net/netfilter/nft_counter.c | 2 +-
net/netfilter/nft_last.c | 2 +-
net/netfilter/nft_limit.c | 2 +-
net/netfilter/nft_quota.c | 2 +-
6 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 8a5fca1e61be..e1a06d5a386f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5896,7 +5896,7 @@ int nft_set_elem_expr_clone(const struct nft_ctx *ctx, struct nft_set *set,
int err, i, k;
for (i = 0; i < set->num_exprs; i++) {
- expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL);
+ expr = kzalloc(set->exprs[i]->ops->size, GFP_KERNEL_ACCOUNT);
if (!expr)
goto err_expr;
diff --git a/net/netfilter/nft_connlimit.c b/net/netfilter/nft_connlimit.c
index 58dcafe8bf79..2a2042adf3b1 100644
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -76,7 +76,7 @@ static int nft_connlimit_do_init(const struct nft_ctx *ctx,
invert = true;
}
- priv->list = kmalloc(sizeof(*priv->list), GFP_KERNEL);
+ priv->list = kmalloc(sizeof(*priv->list), GFP_KERNEL_ACCOUNT);
if (!priv->list)
return -ENOMEM;
diff --git a/net/netfilter/nft_counter.c b/net/netfilter/nft_counter.c
index 8edd3b3c173d..9f78f8ad4ee1 100644
--- a/net/netfilter/nft_counter.c
+++ b/net/netfilter/nft_counter.c
@@ -61,7 +61,7 @@ static int nft_counter_do_init(const struct nlattr * const tb[],
struct nft_counter __percpu *cpu_stats;
struct nft_counter *this_cpu;
- cpu_stats = alloc_percpu(struct nft_counter);
+ cpu_stats = alloc_percpu_gfp(struct nft_counter, GFP_KERNEL_ACCOUNT);
if (cpu_stats == NULL)
return -ENOMEM;
diff --git a/net/netfilter/nft_last.c b/net/netfilter/nft_last.c
index 5ee33d0ccd4e..df48a11e224e 100644
--- a/net/netfilter/nft_last.c
+++ b/net/netfilter/nft_last.c
@@ -30,7 +30,7 @@ static int nft_last_init(const struct nft_ctx *ctx, const struct nft_expr *expr,
u64 last_jiffies;
int err;
- last = kzalloc(sizeof(*last), GFP_KERNEL);
+ last = kzalloc(sizeof(*last), GFP_KERNEL_ACCOUNT);
if (!last)
return -ENOMEM;
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index f04be5be73a0..ac0979febdac 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -90,7 +90,7 @@ static int nft_limit_init(struct nft_limit_priv *priv,
priv->rate);
}
- priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL);
+ priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL_ACCOUNT);
if (!priv->limit)
return -ENOMEM;
diff --git a/net/netfilter/nft_quota.c b/net/netfilter/nft_quota.c
index 0484aef74273..18ff38682de4 100644
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -90,7 +90,7 @@ static int nft_quota_do_init(const struct nlattr * const tb[],
return -EOPNOTSUPP;
}
- priv->consumed = kmalloc(sizeof(*priv->consumed), GFP_KERNEL);
+ priv->consumed = kmalloc(sizeof(*priv->consumed), GFP_KERNEL_ACCOUNT);
if (!priv->consumed)
return -ENOMEM;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 351/374] netfilter: nft_limit: do not ignore unsupported flags
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (347 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 350/374] netfilter: nf_tables: memcg accounting for dynamically allocated objects Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 352/374] netfilter: nf_tables: do not allow mismatch field size and set key length Greg Kroah-Hartman
` (25 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 91a139cee1202a4599a380810d93c69b5bac6197 ]
Bail out if userspace provides unsupported flags, otherwise future
extensions to the limit expression will be silently ignored by the
kernel.
Fixes: c7862a5f0de5 ("netfilter: nft_limit: allow to invert matching criteria")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nft_limit.c | 19 ++++++++++++-------
1 file changed, 12 insertions(+), 7 deletions(-)
diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index ac0979febdac..a355fbabe99f 100644
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -58,6 +58,7 @@ static inline bool nft_limit_eval(struct nft_limit_priv *priv, u64 cost)
static int nft_limit_init(struct nft_limit_priv *priv,
const struct nlattr * const tb[], bool pkts)
{
+ bool invert = false;
u64 unit, tokens;
if (tb[NFTA_LIMIT_RATE] == NULL ||
@@ -90,19 +91,23 @@ static int nft_limit_init(struct nft_limit_priv *priv,
priv->rate);
}
+ if (tb[NFTA_LIMIT_FLAGS]) {
+ u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
+
+ if (flags & ~NFT_LIMIT_F_INV)
+ return -EOPNOTSUPP;
+
+ if (flags & NFT_LIMIT_F_INV)
+ invert = true;
+ }
+
priv->limit = kmalloc(sizeof(*priv->limit), GFP_KERNEL_ACCOUNT);
if (!priv->limit)
return -ENOMEM;
priv->limit->tokens = tokens;
priv->tokens_max = priv->limit->tokens;
-
- if (tb[NFTA_LIMIT_FLAGS]) {
- u32 flags = ntohl(nla_get_be32(tb[NFTA_LIMIT_FLAGS]));
-
- if (flags & NFT_LIMIT_F_INV)
- priv->invert = true;
- }
+ priv->invert = invert;
priv->limit->last = ktime_get_ns();
spin_lock_init(&priv->limit->lock);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 352/374] netfilter: nf_tables: do not allow mismatch field size and set key length
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (348 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 351/374] netfilter: nft_limit: do not ignore unsupported flags Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 353/374] netfilter: nf_tables: skip dead set elements in netlink dump Greg Kroah-Hartman
` (24 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 3ce67e3793f48c1b9635beb9bb71116ca1e51b58 ]
The set description provides the size of each field in the set whose sum
should not mismatch the set key length, bail out otherwise.
I did not manage to crash nft_set_pipapo with mismatch fields and set key
length so far, but this is UB which must be disallowed.
Fixes: f3a2181e16f1 ("netfilter: nf_tables: Support for sets with multiple ranged fields")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index e1a06d5a386f..9f22f62a9b4d 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4453,8 +4453,8 @@ static int nft_set_desc_concat_parse(const struct nlattr *attr,
static int nft_set_desc_concat(struct nft_set_desc *desc,
const struct nlattr *nla)
{
+ u32 num_regs = 0, key_num_regs = 0;
struct nlattr *attr;
- u32 num_regs = 0;
int rem, err, i;
nla_for_each_nested(attr, nla, rem) {
@@ -4469,6 +4469,10 @@ static int nft_set_desc_concat(struct nft_set_desc *desc,
for (i = 0; i < desc->field_count; i++)
num_regs += DIV_ROUND_UP(desc->field_len[i], sizeof(u32));
+ key_num_regs = DIV_ROUND_UP(desc->klen, sizeof(u32));
+ if (key_num_regs != num_regs)
+ return -EINVAL;
+
if (num_regs > NFT_REG32_COUNT)
return -E2BIG;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 353/374] netfilter: nf_tables: skip dead set elements in netlink dump
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (349 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 352/374] netfilter: nf_tables: do not allow mismatch field size and set key length Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 354/374] netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description Greg Kroah-Hartman
` (23 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 6b1ca88e4bb63673dc9f9c7f23c899f22c3cb17a ]
Delete from packet path relies on the garbage collector to purge
elements with NFT_SET_ELEM_DEAD_BIT on.
Skip these dead elements from nf_tables_dump_setelem() path, I very
rarely see tests/shell/testcases/maps/typeof_maps_add_delete reports
[DUMP FAILED] showing a mismatch in the expected output with an element
that should not be there.
If the netlink dump happens before GC worker run, it might show dead
elements in the ruleset listing.
nft_rhash_get() already skips dead elements in nft_rhash_cmp(),
therefore, it already does not show the element when getting a single
element via netlink control plane.
Fixes: 5f68718b34a5 ("netfilter: nf_tables: GC transaction API to avoid race with control plane")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 9f22f62a9b4d..967ad439e6b3 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -5348,7 +5348,7 @@ static int nf_tables_dump_setelem(const struct nft_ctx *ctx,
const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
struct nft_set_dump_args *args;
- if (nft_set_elem_expired(ext))
+ if (nft_set_elem_expired(ext) || nft_set_elem_is_dead(ext))
return 0;
args = container_of(iter, struct nft_set_dump_args, iter);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 354/374] netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (350 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 353/374] netfilter: nf_tables: skip dead set elements in netlink dump Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 355/374] ipvs: avoid stat macros calls from preemptible context Greg Kroah-Hartman
` (22 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
[ Upstream commit 113661e07460a6604aacc8ae1b23695a89e7d4b3 ]
It is still possible to set on the NFT_SET_CONCAT flag by specifying a
set size and no field description, report EINVAL in such case.
Fixes: 1b6345d4160e ("netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/nf_tables_api.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 967ad439e6b3..e2e3ccbb635f 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -4703,8 +4703,12 @@ static int nf_tables_newset(struct sk_buff *skb, const struct nfnl_info *info,
if (err < 0)
return err;
- if (desc.field_count > 1 && !(flags & NFT_SET_CONCAT))
+ if (desc.field_count > 1) {
+ if (!(flags & NFT_SET_CONCAT))
+ return -EINVAL;
+ } else if (flags & NFT_SET_CONCAT) {
return -EINVAL;
+ }
} else if (flags & NFT_SET_CONCAT) {
return -EINVAL;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 355/374] ipvs: avoid stat macros calls from preemptible context
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (351 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 354/374] netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 356/374] kdb: Fix a potential buffer overflow in kdb_local() Greg Kroah-Hartman
` (21 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Fedor Pchelkin, Julian Anastasov,
Simon Horman, Pablo Neira Ayuso, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Fedor Pchelkin <pchelkin@ispras.ru>
[ Upstream commit d6938c1c76c64f42363d0d1f051e1b4641c2ad40 ]
Inside decrement_ttl() upon discovering that the packet ttl has exceeded,
__IP_INC_STATS and __IP6_INC_STATS macros can be called from preemptible
context having the following backtrace:
check_preemption_disabled: 48 callbacks suppressed
BUG: using __this_cpu_add() in preemptible [00000000] code: curl/1177
caller is decrement_ttl+0x217/0x830
CPU: 5 PID: 1177 Comm: curl Not tainted 6.7.0+ #34
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xbd/0xe0
check_preemption_disabled+0xd1/0xe0
decrement_ttl+0x217/0x830
__ip_vs_get_out_rt+0x4e0/0x1ef0
ip_vs_nat_xmit+0x205/0xcd0
ip_vs_in_hook+0x9b1/0x26a0
nf_hook_slow+0xc2/0x210
nf_hook+0x1fb/0x770
__ip_local_out+0x33b/0x640
ip_local_out+0x2a/0x490
__ip_queue_xmit+0x990/0x1d10
__tcp_transmit_skb+0x288b/0x3d10
tcp_connect+0x3466/0x5180
tcp_v4_connect+0x1535/0x1bb0
__inet_stream_connect+0x40d/0x1040
inet_stream_connect+0x57/0xa0
__sys_connect_file+0x162/0x1a0
__sys_connect+0x137/0x160
__x64_sys_connect+0x72/0xb0
do_syscall_64+0x6f/0x140
entry_SYSCALL_64_after_hwframe+0x6e/0x76
RIP: 0033:0x7fe6dbbc34e0
Use the corresponding preemption-aware variants: IP_INC_STATS and
IP6_INC_STATS.
Found by Linux Verification Center (linuxtesting.org).
Fixes: 8d8e20e2d7bb ("ipvs: Decrement ttl")
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Acked-by: Julian Anastasov <ja@ssi.bg>
Acked-by: Simon Horman <horms@kernel.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/netfilter/ipvs/ip_vs_xmit.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index cd2130e98836..c87dbc897002 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -271,7 +271,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
skb->dev = dst->dev;
icmpv6_send(skb, ICMPV6_TIME_EXCEED,
ICMPV6_EXC_HOPLIMIT, 0);
- __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
+ IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
return false;
}
@@ -286,7 +286,7 @@ static inline bool decrement_ttl(struct netns_ipvs *ipvs,
{
if (ip_hdr(skb)->ttl <= 1) {
/* Tell the sender its packet died... */
- __IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
+ IP_INC_STATS(net, IPSTATS_MIB_INHDRERRORS);
icmp_send(skb, ICMP_TIME_EXCEEDED, ICMP_EXC_TTL, 0);
return false;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 356/374] kdb: Fix a potential buffer overflow in kdb_local()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (352 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 355/374] ipvs: avoid stat macros calls from preemptible context Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 357/374] ethtool: netlink: Add missing ethnl_ops_begin/complete Greg Kroah-Hartman
` (20 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Douglas Anderson,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 4f41d30cd6dc865c3cbc1a852372321eba6d4e4c ]
When appending "[defcmd]" to 'kdb_prompt_str', the size of the string
already in the buffer should be taken into account.
An option could be to switch from strncat() to strlcat() which does the
correct test to avoid such an overflow.
However, this actually looks as dead code, because 'defcmd_in_progress'
can't be true here.
See a more detailed explanation at [1].
[1]: https://lore.kernel.org/all/CAD=FV=WSh7wKN7Yp-3wWiDgX4E3isQ8uh0LCzTmd1v9Cg9j+nQ@mail.gmail.com/
Fixes: 5d5314d6795f ("kdb: core for kgdb back end (1 of 2)")
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Douglas Anderson <dianders@chromium.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/debug/kdb/kdb_main.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index ead4da947127..23723c5727aa 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1350,8 +1350,6 @@ static int kdb_local(kdb_reason_t reason, int error, struct pt_regs *regs,
/* PROMPT can only be set if we have MEM_READ permission. */
snprintf(kdb_prompt_str, CMD_BUFLEN, kdbgetenv("PROMPT"),
raw_smp_processor_id());
- if (defcmd_in_progress)
- strncat(kdb_prompt_str, "[defcmd]", CMD_BUFLEN);
/*
* Fetch command from keyboard
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 357/374] ethtool: netlink: Add missing ethnl_ops_begin/complete
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (353 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 356/374] kdb: Fix a potential buffer overflow in kdb_local() Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 358/374] mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Greg Kroah-Hartman
` (19 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ludvig Pärsson, Paolo Abeni,
Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludvig Pärsson <ludvig.parsson@axis.com>
[ Upstream commit f1172f3ee3a98754d95b968968920a7d03fdebcc ]
Accessing an ethernet device that is powered off or clock gated might
cause the CPU to hang. Add ethnl_ops_begin/complete in
ethnl_set_features() to protect against this.
Fixes: 0980bfcd6954 ("ethtool: set netdev features with FEATURES_SET request")
Signed-off-by: Ludvig Pärsson <ludvig.parsson@axis.com>
Link: https://lore.kernel.org/r/20240117-etht2-v2-1-1a96b6e8c650@axis.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ethtool/features.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/net/ethtool/features.c b/net/ethtool/features.c
index 1c9f4df273bd..faccab84d865 100644
--- a/net/ethtool/features.c
+++ b/net/ethtool/features.c
@@ -235,17 +235,20 @@ int ethnl_set_features(struct sk_buff *skb, struct genl_info *info)
dev = req_info.dev;
rtnl_lock();
+ ret = ethnl_ops_begin(dev);
+ if (ret < 0)
+ goto out_rtnl;
ethnl_features_to_bitmap(old_active, dev->features);
ethnl_features_to_bitmap(old_wanted, dev->wanted_features);
ret = ethnl_parse_bitset(req_wanted, req_mask, NETDEV_FEATURE_COUNT,
tb[ETHTOOL_A_FEATURES_WANTED],
netdev_features_strings, info->extack);
if (ret < 0)
- goto out_rtnl;
+ goto out_ops;
if (ethnl_bitmap_to_features(req_mask) & ~NETIF_F_ETHTOOL_BITS) {
GENL_SET_ERR_MSG(info, "attempt to change non-ethtool features");
ret = -EINVAL;
- goto out_rtnl;
+ goto out_ops;
}
/* set req_wanted bits not in req_mask from old_wanted */
@@ -282,6 +285,8 @@ int ethnl_set_features(struct sk_buff *skb, struct genl_info *info)
if (mod)
netdev_features_change(dev);
+out_ops:
+ ethnl_ops_complete(dev);
out_rtnl:
rtnl_unlock();
dev_put(dev);
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 358/374] mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (354 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 357/374] ethtool: netlink: Add missing ethnl_ops_begin/complete Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 359/374] mlxsw: spectrum: Use bitmap_zalloc() when applicable Greg Kroah-Hartman
` (18 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Amit Cohen, Ido Schimmel,
Petr Machata, Paolo Abeni, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <amcohen@nvidia.com>
[ Upstream commit 6d6eeabcfaba2fcadf5443b575789ea606f9de83 ]
Lately, a bug was found when many TC filters are added - at some point,
several bugs are printed to dmesg [1] and the switch is crashed with
segmentation fault.
The issue starts when gen_pool_free() fails because of unexpected
behavior - a try to free memory which is already freed, this leads to BUG()
call which crashes the switch and makes many other bugs.
Trying to track down the unexpected behavior led to a bug in eRP code. The
function mlxsw_sp_acl_erp_table_alloc() gets a pointer to the allocated
index, sets the value and returns an error code. When gen_pool_alloc()
fails it returns address 0, we track it and return -ENOBUFS outside, BUT
the call for gen_pool_alloc() already override the index in erp_table
structure. This is a problem when such allocation is done as part of
table expansion. This is not a new table, which will not be used in case
of allocation failure. We try to expand eRP table and override the
current index (non-zero) with zero. Then, it leads to an unexpected
behavior when address 0 is freed twice. Note that address 0 is valid in
erp_table->base_index and indeed other tables use it.
gen_pool_alloc() fails in case that there is no space left in the
pre-allocated pool, in our case, the pool is limited to
ACL_MAX_ERPT_BANK_SIZE, which is read from hardware. When more than max
erp entries are required, we exceed the limit and return an error, this
error leads to "Failed to migrate vregion" print.
Fix this by changing erp_table->base_index only in case of a successful
allocation.
Add a test case for such a scenario. Without this fix it causes
segmentation fault:
$ TESTS="max_erp_entries_test" ./tc_flower.sh
./tc_flower.sh: line 988: 1560 Segmentation fault tc filter del dev $h2 ingress chain $i protocol ip pref $i handle $j flower &>/dev/null
[1]:
kernel BUG at lib/genalloc.c:508!
invalid opcode: 0000 [#1] PREEMPT SMP
CPU: 6 PID: 3531 Comm: tc Not tainted 6.7.0-rc5-custom-ga6893f479f5e #1
Hardware name: Mellanox Technologies Ltd. MSN4700/VMOD0010, BIOS 5.11 07/12/2021
RIP: 0010:gen_pool_free_owner+0xc9/0xe0
...
Call Trace:
<TASK>
__mlxsw_sp_acl_erp_table_other_dec+0x70/0xa0 [mlxsw_spectrum]
mlxsw_sp_acl_erp_mask_destroy+0xf5/0x110 [mlxsw_spectrum]
objagg_obj_root_destroy+0x18/0x80 [objagg]
objagg_obj_destroy+0x12c/0x130 [objagg]
mlxsw_sp_acl_erp_mask_put+0x37/0x50 [mlxsw_spectrum]
mlxsw_sp_acl_ctcam_region_entry_remove+0x74/0xa0 [mlxsw_spectrum]
mlxsw_sp_acl_ctcam_entry_del+0x1e/0x40 [mlxsw_spectrum]
mlxsw_sp_acl_tcam_ventry_del+0x78/0xd0 [mlxsw_spectrum]
mlxsw_sp_flower_destroy+0x4d/0x70 [mlxsw_spectrum]
mlxsw_sp_flow_block_cb+0x73/0xb0 [mlxsw_spectrum]
tc_setup_cb_destroy+0xc1/0x180
fl_hw_destroy_filter+0x94/0xc0 [cls_flower]
__fl_delete+0x1ac/0x1c0 [cls_flower]
fl_destroy+0xc2/0x150 [cls_flower]
tcf_proto_destroy+0x1a/0xa0
...
mlxsw_spectrum3 0000:07:00.0: Failed to migrate vregion
mlxsw_spectrum3 0000:07:00.0: Failed to migrate vregion
Fixes: f465261aa105 ("mlxsw: spectrum_acl: Implement common eRP core")
Signed-off-by: Amit Cohen <amcohen@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/4cfca254dfc0e5d283974801a24371c7b6db5989.1705502064.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlxsw/spectrum_acl_erp.c | 8 +--
.../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 52 ++++++++++++++++++-
2 files changed, 56 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
index 4c98950380d5..d231f4d2888b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_erp.c
@@ -301,6 +301,7 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core,
unsigned long *p_index)
{
unsigned int num_rows, entry_size;
+ unsigned long index;
/* We only allow allocations of entire rows */
if (num_erps % erp_core->num_erp_banks != 0)
@@ -309,10 +310,11 @@ mlxsw_sp_acl_erp_table_alloc(struct mlxsw_sp_acl_erp_core *erp_core,
entry_size = erp_core->erpt_entries_size[region_type];
num_rows = num_erps / erp_core->num_erp_banks;
- *p_index = gen_pool_alloc(erp_core->erp_tables, num_rows * entry_size);
- if (*p_index == 0)
+ index = gen_pool_alloc(erp_core->erp_tables, num_rows * entry_size);
+ if (!index)
return -ENOBUFS;
- *p_index -= MLXSW_SP_ACL_ERP_GENALLOC_OFFSET;
+
+ *p_index = index - MLXSW_SP_ACL_ERP_GENALLOC_OFFSET;
return 0;
}
diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
index fb850e0ec837..7bf56ea161e3 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
@@ -10,7 +10,8 @@ lib_dir=$(dirname $0)/../../../../net/forwarding
ALL_TESTS="single_mask_test identical_filters_test two_masks_test \
multiple_masks_test ctcam_edge_cases_test delta_simple_test \
delta_two_masks_one_key_test delta_simple_rehash_test \
- bloom_simple_test bloom_complex_test bloom_delta_test"
+ bloom_simple_test bloom_complex_test bloom_delta_test \
+ max_erp_entries_test"
NUM_NETIFS=2
source $lib_dir/lib.sh
source $lib_dir/tc_common.sh
@@ -983,6 +984,55 @@ bloom_delta_test()
log_test "bloom delta test ($tcflags)"
}
+max_erp_entries_test()
+{
+ # The number of eRP entries is limited. Once the maximum number of eRPs
+ # has been reached, filters cannot be added. This test verifies that
+ # when this limit is reached, inserstion fails without crashing.
+
+ RET=0
+
+ local num_masks=32
+ local num_regions=15
+ local chain_failed
+ local mask_failed
+ local ret
+
+ if [[ "$tcflags" != "skip_sw" ]]; then
+ return 0;
+ fi
+
+ for ((i=1; i < $num_regions; i++)); do
+ for ((j=$num_masks; j >= 0; j--)); do
+ tc filter add dev $h2 ingress chain $i protocol ip \
+ pref $i handle $j flower $tcflags \
+ dst_ip 192.1.0.0/$j &> /dev/null
+ ret=$?
+
+ if [ $ret -ne 0 ]; then
+ chain_failed=$i
+ mask_failed=$j
+ break 2
+ fi
+ done
+ done
+
+ # We expect to exceed the maximum number of eRP entries, so that
+ # insertion eventually fails. Otherwise, the test should be adjusted to
+ # add more filters.
+ check_fail $ret "expected to exceed number of eRP entries"
+
+ for ((; i >= 1; i--)); do
+ for ((j=0; j <= $num_masks; j++)); do
+ tc filter del dev $h2 ingress chain $i protocol ip \
+ pref $i handle $j flower &> /dev/null
+ done
+ done
+
+ log_test "max eRP entries test ($tcflags). " \
+ "max chain $chain_failed, mask $mask_failed"
+}
+
setup_prepare()
{
h1=${NETIFS[p1]}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 359/374] mlxsw: spectrum: Use bitmap_zalloc() when applicable
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (355 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 358/374] mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 360/374] mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() Greg Kroah-Hartman
` (17 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christophe JAILLET, Ido Schimmel,
David S. Miller, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
[ Upstream commit 2c087dfcc9d5e7e8557d217f01f58ba42d1ddbf1 ]
Use 'bitmap_zalloc()' to simplify code, improve the semantic and avoid
some open-coded arithmetic in allocator arguments.
Also change the corresponding 'kfree()' into 'bitmap_free()' to keep
consistency.
Signed-off-by: Christophe JAILLET <christophe.jaillet@wanadoo.fr>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Stable-dep-of: 483ae90d8f97 ("mlxsw: spectrum_acl_tcam: Fix stack corruption")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../ethernet/mellanox/mlxsw/spectrum_acl_atcam.c | 8 +++-----
.../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 15 ++++++---------
.../net/ethernet/mellanox/mlxsw/spectrum_cnt.c | 9 +++------
.../ethernet/mellanox/mlxsw/spectrum_switchdev.c | 11 ++++-------
4 files changed, 16 insertions(+), 27 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c
index ded4cf658680..4b713832fdd5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_atcam.c
@@ -119,7 +119,6 @@ mlxsw_sp_acl_atcam_region_12kb_init(struct mlxsw_sp_acl_atcam_region *aregion)
{
struct mlxsw_sp *mlxsw_sp = aregion->region->mlxsw_sp;
struct mlxsw_sp_acl_atcam_region_12kb *region_12kb;
- size_t alloc_size;
u64 max_lkey_id;
int err;
@@ -131,8 +130,7 @@ mlxsw_sp_acl_atcam_region_12kb_init(struct mlxsw_sp_acl_atcam_region *aregion)
if (!region_12kb)
return -ENOMEM;
- alloc_size = BITS_TO_LONGS(max_lkey_id) * sizeof(unsigned long);
- region_12kb->used_lkey_id = kzalloc(alloc_size, GFP_KERNEL);
+ region_12kb->used_lkey_id = bitmap_zalloc(max_lkey_id, GFP_KERNEL);
if (!region_12kb->used_lkey_id) {
err = -ENOMEM;
goto err_used_lkey_id_alloc;
@@ -149,7 +147,7 @@ mlxsw_sp_acl_atcam_region_12kb_init(struct mlxsw_sp_acl_atcam_region *aregion)
return 0;
err_rhashtable_init:
- kfree(region_12kb->used_lkey_id);
+ bitmap_free(region_12kb->used_lkey_id);
err_used_lkey_id_alloc:
kfree(region_12kb);
return err;
@@ -161,7 +159,7 @@ mlxsw_sp_acl_atcam_region_12kb_fini(struct mlxsw_sp_acl_atcam_region *aregion)
struct mlxsw_sp_acl_atcam_region_12kb *region_12kb = aregion->priv;
rhashtable_destroy(®ion_12kb->lkey_ht);
- kfree(region_12kb->used_lkey_id);
+ bitmap_free(region_12kb->used_lkey_id);
kfree(region_12kb);
}
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index 7cccc41dd69c..31f7f4c3acc3 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -36,7 +36,6 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
u64 max_tcam_regions;
u64 max_regions;
u64 max_groups;
- size_t alloc_size;
int err;
mutex_init(&tcam->lock);
@@ -52,15 +51,13 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
if (max_tcam_regions < max_regions)
max_regions = max_tcam_regions;
- alloc_size = sizeof(tcam->used_regions[0]) * BITS_TO_LONGS(max_regions);
- tcam->used_regions = kzalloc(alloc_size, GFP_KERNEL);
+ tcam->used_regions = bitmap_zalloc(max_regions, GFP_KERNEL);
if (!tcam->used_regions)
return -ENOMEM;
tcam->max_regions = max_regions;
max_groups = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUPS);
- alloc_size = sizeof(tcam->used_groups[0]) * BITS_TO_LONGS(max_groups);
- tcam->used_groups = kzalloc(alloc_size, GFP_KERNEL);
+ tcam->used_groups = bitmap_zalloc(max_groups, GFP_KERNEL);
if (!tcam->used_groups) {
err = -ENOMEM;
goto err_alloc_used_groups;
@@ -76,9 +73,9 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
return 0;
err_tcam_init:
- kfree(tcam->used_groups);
+ bitmap_free(tcam->used_groups);
err_alloc_used_groups:
- kfree(tcam->used_regions);
+ bitmap_free(tcam->used_regions);
return err;
}
@@ -89,8 +86,8 @@ void mlxsw_sp_acl_tcam_fini(struct mlxsw_sp *mlxsw_sp,
mutex_destroy(&tcam->lock);
ops->fini(mlxsw_sp, tcam->priv);
- kfree(tcam->used_groups);
- kfree(tcam->used_regions);
+ bitmap_free(tcam->used_groups);
+ bitmap_free(tcam->used_regions);
}
int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp,
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.c
index b65b93a2b9bc..fc2257753b9b 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_cnt.c
@@ -122,7 +122,6 @@ int mlxsw_sp_counter_pool_init(struct mlxsw_sp *mlxsw_sp)
unsigned int sub_pools_count = ARRAY_SIZE(mlxsw_sp_counter_sub_pools);
struct devlink *devlink = priv_to_devlink(mlxsw_sp->core);
struct mlxsw_sp_counter_pool *pool;
- unsigned int map_size;
int err;
pool = kzalloc(struct_size(pool, sub_pools, sub_pools_count),
@@ -143,9 +142,7 @@ int mlxsw_sp_counter_pool_init(struct mlxsw_sp *mlxsw_sp)
devlink_resource_occ_get_register(devlink, MLXSW_SP_RESOURCE_COUNTERS,
mlxsw_sp_counter_pool_occ_get, pool);
- map_size = BITS_TO_LONGS(pool->pool_size) * sizeof(unsigned long);
-
- pool->usage = kzalloc(map_size, GFP_KERNEL);
+ pool->usage = bitmap_zalloc(pool->pool_size, GFP_KERNEL);
if (!pool->usage) {
err = -ENOMEM;
goto err_usage_alloc;
@@ -158,7 +155,7 @@ int mlxsw_sp_counter_pool_init(struct mlxsw_sp *mlxsw_sp)
return 0;
err_sub_pools_init:
- kfree(pool->usage);
+ bitmap_free(pool->usage);
err_usage_alloc:
devlink_resource_occ_get_unregister(devlink,
MLXSW_SP_RESOURCE_COUNTERS);
@@ -176,7 +173,7 @@ void mlxsw_sp_counter_pool_fini(struct mlxsw_sp *mlxsw_sp)
WARN_ON(find_first_bit(pool->usage, pool->pool_size) !=
pool->pool_size);
WARN_ON(atomic_read(&pool->active_entries_count));
- kfree(pool->usage);
+ bitmap_free(pool->usage);
devlink_resource_occ_get_unregister(devlink,
MLXSW_SP_RESOURCE_COUNTERS);
kfree(pool);
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
index 22fede5cb32c..81c7e8a7fcf5 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
@@ -1635,16 +1635,13 @@ mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
u16 fid)
{
struct mlxsw_sp_mid *mid;
- size_t alloc_size;
mid = kzalloc(sizeof(*mid), GFP_KERNEL);
if (!mid)
return NULL;
- alloc_size = sizeof(unsigned long) *
- BITS_TO_LONGS(mlxsw_core_max_ports(mlxsw_sp->core));
-
- mid->ports_in_mid = kzalloc(alloc_size, GFP_KERNEL);
+ mid->ports_in_mid = bitmap_zalloc(mlxsw_core_max_ports(mlxsw_sp->core),
+ GFP_KERNEL);
if (!mid->ports_in_mid)
goto err_ports_in_mid_alloc;
@@ -1663,7 +1660,7 @@ mlxsw_sp_mid *__mlxsw_sp_mc_alloc(struct mlxsw_sp *mlxsw_sp,
return mid;
err_write_mdb_entry:
- kfree(mid->ports_in_mid);
+ bitmap_free(mid->ports_in_mid);
err_ports_in_mid_alloc:
kfree(mid);
return NULL;
@@ -1680,7 +1677,7 @@ static int mlxsw_sp_port_remove_from_mid(struct mlxsw_sp_port *mlxsw_sp_port,
mlxsw_core_max_ports(mlxsw_sp->core))) {
err = mlxsw_sp_mc_remove_mdb_entry(mlxsw_sp, mid);
list_del(&mid->list);
- kfree(mid->ports_in_mid);
+ bitmap_free(mid->ports_in_mid);
kfree(mid);
}
return err;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 360/374] mlxsw: spectrum_acl_tcam: Add missing mutex_destroy()
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (356 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 359/374] mlxsw: spectrum: Use bitmap_zalloc() when applicable Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 361/374] mlxsw: spectrum_acl_tcam: Make fini symmetric to init Greg Kroah-Hartman
` (16 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Jiri Pirko,
Petr Machata, Jacob Keller, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 65823e07b1e4055b6278725fd92f4d7e6f8d53fd ]
Pair mutex_init() with a mutex_destroy() in the error path. Found during
code review. No functional changes.
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 483ae90d8f97 ("mlxsw: spectrum_acl_tcam: Fix stack corruption")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index 31f7f4c3acc3..c8d9f523242e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -52,8 +52,10 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
max_regions = max_tcam_regions;
tcam->used_regions = bitmap_zalloc(max_regions, GFP_KERNEL);
- if (!tcam->used_regions)
- return -ENOMEM;
+ if (!tcam->used_regions) {
+ err = -ENOMEM;
+ goto err_alloc_used_regions;
+ }
tcam->max_regions = max_regions;
max_groups = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUPS);
@@ -76,6 +78,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
bitmap_free(tcam->used_groups);
err_alloc_used_groups:
bitmap_free(tcam->used_regions);
+err_alloc_used_regions:
+ mutex_destroy(&tcam->lock);
return err;
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 361/374] mlxsw: spectrum_acl_tcam: Make fini symmetric to init
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (357 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 360/374] mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 362/374] mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations Greg Kroah-Hartman
` (15 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Jiri Pirko,
Petr Machata, Jacob Keller, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 61fe3b9102ac84ba479ab84d8f5454af2e21e468 ]
Move mutex_destroy() to the end to make the function symmetric with
mlxsw_sp_acl_tcam_init(). No functional changes.
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 483ae90d8f97 ("mlxsw: spectrum_acl_tcam: Fix stack corruption")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index c8d9f523242e..08d91bfa7b39 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -88,10 +88,10 @@ void mlxsw_sp_acl_tcam_fini(struct mlxsw_sp *mlxsw_sp,
{
const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops;
- mutex_destroy(&tcam->lock);
ops->fini(mlxsw_sp, tcam->priv);
bitmap_free(tcam->used_groups);
bitmap_free(tcam->used_regions);
+ mutex_destroy(&tcam->lock);
}
int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 362/374] mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (358 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 361/374] mlxsw: spectrum_acl_tcam: Make fini symmetric to init Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 363/374] mlxsw: spectrum_acl_tcam: Fix stack corruption Greg Kroah-Hartman
` (14 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ido Schimmel, Jiri Pirko,
Petr Machata, Jacob Keller, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 194ab9476089bbfc021073214e071a404e375ee6 ]
Move the initialization and de-initialization code further below in
order to avoid forward declarations in the next patch. No functional
changes.
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Stable-dep-of: 483ae90d8f97 ("mlxsw: spectrum_acl_tcam: Fix stack corruption")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlxsw/spectrum_acl_tcam.c | 130 +++++++++---------
1 file changed, 65 insertions(+), 65 deletions(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index 08d91bfa7b39..ab897b8be39f 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -29,71 +29,6 @@ size_t mlxsw_sp_acl_tcam_priv_size(struct mlxsw_sp *mlxsw_sp)
#define MLXSW_SP_ACL_TCAM_VREGION_REHASH_INTRVL_MIN 3000 /* ms */
#define MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS 100 /* number of entries */
-int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
- struct mlxsw_sp_acl_tcam *tcam)
-{
- const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops;
- u64 max_tcam_regions;
- u64 max_regions;
- u64 max_groups;
- int err;
-
- mutex_init(&tcam->lock);
- tcam->vregion_rehash_intrvl =
- MLXSW_SP_ACL_TCAM_VREGION_REHASH_INTRVL_DFLT;
- INIT_LIST_HEAD(&tcam->vregion_list);
-
- max_tcam_regions = MLXSW_CORE_RES_GET(mlxsw_sp->core,
- ACL_MAX_TCAM_REGIONS);
- max_regions = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_REGIONS);
-
- /* Use 1:1 mapping between ACL region and TCAM region */
- if (max_tcam_regions < max_regions)
- max_regions = max_tcam_regions;
-
- tcam->used_regions = bitmap_zalloc(max_regions, GFP_KERNEL);
- if (!tcam->used_regions) {
- err = -ENOMEM;
- goto err_alloc_used_regions;
- }
- tcam->max_regions = max_regions;
-
- max_groups = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUPS);
- tcam->used_groups = bitmap_zalloc(max_groups, GFP_KERNEL);
- if (!tcam->used_groups) {
- err = -ENOMEM;
- goto err_alloc_used_groups;
- }
- tcam->max_groups = max_groups;
- tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core,
- ACL_MAX_GROUP_SIZE);
-
- err = ops->init(mlxsw_sp, tcam->priv, tcam);
- if (err)
- goto err_tcam_init;
-
- return 0;
-
-err_tcam_init:
- bitmap_free(tcam->used_groups);
-err_alloc_used_groups:
- bitmap_free(tcam->used_regions);
-err_alloc_used_regions:
- mutex_destroy(&tcam->lock);
- return err;
-}
-
-void mlxsw_sp_acl_tcam_fini(struct mlxsw_sp *mlxsw_sp,
- struct mlxsw_sp_acl_tcam *tcam)
-{
- const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops;
-
- ops->fini(mlxsw_sp, tcam->priv);
- bitmap_free(tcam->used_groups);
- bitmap_free(tcam->used_regions);
- mutex_destroy(&tcam->lock);
-}
-
int mlxsw_sp_acl_tcam_priority_get(struct mlxsw_sp *mlxsw_sp,
struct mlxsw_sp_acl_rule_info *rulei,
u32 *priority, bool fillup_priority)
@@ -1546,6 +1481,71 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp,
mlxsw_sp_acl_tcam_vregion_rehash_end(mlxsw_sp, vregion, ctx);
}
+int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
+ struct mlxsw_sp_acl_tcam *tcam)
+{
+ const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops;
+ u64 max_tcam_regions;
+ u64 max_regions;
+ u64 max_groups;
+ int err;
+
+ mutex_init(&tcam->lock);
+ tcam->vregion_rehash_intrvl =
+ MLXSW_SP_ACL_TCAM_VREGION_REHASH_INTRVL_DFLT;
+ INIT_LIST_HEAD(&tcam->vregion_list);
+
+ max_tcam_regions = MLXSW_CORE_RES_GET(mlxsw_sp->core,
+ ACL_MAX_TCAM_REGIONS);
+ max_regions = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_REGIONS);
+
+ /* Use 1:1 mapping between ACL region and TCAM region */
+ if (max_tcam_regions < max_regions)
+ max_regions = max_tcam_regions;
+
+ tcam->used_regions = bitmap_zalloc(max_regions, GFP_KERNEL);
+ if (!tcam->used_regions) {
+ err = -ENOMEM;
+ goto err_alloc_used_regions;
+ }
+ tcam->max_regions = max_regions;
+
+ max_groups = MLXSW_CORE_RES_GET(mlxsw_sp->core, ACL_MAX_GROUPS);
+ tcam->used_groups = bitmap_zalloc(max_groups, GFP_KERNEL);
+ if (!tcam->used_groups) {
+ err = -ENOMEM;
+ goto err_alloc_used_groups;
+ }
+ tcam->max_groups = max_groups;
+ tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core,
+ ACL_MAX_GROUP_SIZE);
+
+ err = ops->init(mlxsw_sp, tcam->priv, tcam);
+ if (err)
+ goto err_tcam_init;
+
+ return 0;
+
+err_tcam_init:
+ bitmap_free(tcam->used_groups);
+err_alloc_used_groups:
+ bitmap_free(tcam->used_regions);
+err_alloc_used_regions:
+ mutex_destroy(&tcam->lock);
+ return err;
+}
+
+void mlxsw_sp_acl_tcam_fini(struct mlxsw_sp *mlxsw_sp,
+ struct mlxsw_sp_acl_tcam *tcam)
+{
+ const struct mlxsw_sp_acl_tcam_ops *ops = mlxsw_sp->acl_tcam_ops;
+
+ ops->fini(mlxsw_sp, tcam->priv);
+ bitmap_free(tcam->used_groups);
+ bitmap_free(tcam->used_regions);
+ mutex_destroy(&tcam->lock);
+}
+
static const enum mlxsw_afk_element mlxsw_sp_acl_tcam_pattern_ipv4[] = {
MLXSW_AFK_ELEMENT_SRC_SYS_PORT,
MLXSW_AFK_ELEMENT_DMAC_32_47,
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 363/374] mlxsw: spectrum_acl_tcam: Fix stack corruption
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (359 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 362/374] mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 364/374] selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes Greg Kroah-Hartman
` (13 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Orel Hagag, Ido Schimmel, Amit Cohen,
Petr Machata, Paolo Abeni, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ido Schimmel <idosch@nvidia.com>
[ Upstream commit 483ae90d8f976f8339cf81066312e1329f2d3706 ]
When tc filters are first added to a net device, the corresponding local
port gets bound to an ACL group in the device. The group contains a list
of ACLs. In turn, each ACL points to a different TCAM region where the
filters are stored. During forwarding, the ACLs are sequentially
evaluated until a match is found.
One reason to place filters in different regions is when they are added
with decreasing priorities and in an alternating order so that two
consecutive filters can never fit in the same region because of their
key usage.
In Spectrum-2 and newer ASICs the firmware started to report that the
maximum number of ACLs in a group is more than 16, but the layout of the
register that configures ACL groups (PAGT) was not updated to account
for that. It is therefore possible to hit stack corruption [1] in the
rare case where more than 16 ACLs in a group are required.
Fix by limiting the maximum ACL group size to the minimum between what
the firmware reports and the maximum ACLs that fit in the PAGT register.
Add a test case to make sure the machine does not crash when this
condition is hit.
[1]
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: mlxsw_sp_acl_tcam_group_update+0x116/0x120
[...]
dump_stack_lvl+0x36/0x50
panic+0x305/0x330
__stack_chk_fail+0x15/0x20
mlxsw_sp_acl_tcam_group_update+0x116/0x120
mlxsw_sp_acl_tcam_group_region_attach+0x69/0x110
mlxsw_sp_acl_tcam_vchunk_get+0x492/0xa20
mlxsw_sp_acl_tcam_ventry_add+0x25/0xe0
mlxsw_sp_acl_rule_add+0x47/0x240
mlxsw_sp_flower_replace+0x1a9/0x1d0
tc_setup_cb_add+0xdc/0x1c0
fl_hw_replace_filter+0x146/0x1f0
fl_change+0xc17/0x1360
tc_new_tfilter+0x472/0xb90
rtnetlink_rcv_msg+0x313/0x3b0
netlink_rcv_skb+0x58/0x100
netlink_unicast+0x244/0x390
netlink_sendmsg+0x1e4/0x440
____sys_sendmsg+0x164/0x260
___sys_sendmsg+0x9a/0xe0
__sys_sendmsg+0x7a/0xc0
do_syscall_64+0x40/0xe0
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Fixes: c3ab435466d5 ("mlxsw: spectrum: Extend to support Spectrum-2 ASIC")
Reported-by: Orel Hagag <orelh@nvidia.com>
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Amit Cohen <amcohen@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/2d91c89afba59c22587b444994ae419dbea8d876.1705502064.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../mellanox/mlxsw/spectrum_acl_tcam.c | 2 +
.../drivers/net/mlxsw/spectrum-2/tc_flower.sh | 56 ++++++++++++++++++-
2 files changed, 57 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
index ab897b8be39f..483c8b75bebb 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c
@@ -1519,6 +1519,8 @@ int mlxsw_sp_acl_tcam_init(struct mlxsw_sp *mlxsw_sp,
tcam->max_groups = max_groups;
tcam->max_group_size = MLXSW_CORE_RES_GET(mlxsw_sp->core,
ACL_MAX_GROUP_SIZE);
+ tcam->max_group_size = min_t(unsigned int, tcam->max_group_size,
+ MLXSW_REG_PAGT_ACL_MAX_NUM);
err = ops->init(mlxsw_sp, tcam->priv, tcam);
if (err)
diff --git a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
index 7bf56ea161e3..616d3581419c 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/spectrum-2/tc_flower.sh
@@ -11,7 +11,7 @@ ALL_TESTS="single_mask_test identical_filters_test two_masks_test \
multiple_masks_test ctcam_edge_cases_test delta_simple_test \
delta_two_masks_one_key_test delta_simple_rehash_test \
bloom_simple_test bloom_complex_test bloom_delta_test \
- max_erp_entries_test"
+ max_erp_entries_test max_group_size_test"
NUM_NETIFS=2
source $lib_dir/lib.sh
source $lib_dir/tc_common.sh
@@ -1033,6 +1033,60 @@ max_erp_entries_test()
"max chain $chain_failed, mask $mask_failed"
}
+max_group_size_test()
+{
+ # The number of ACLs in an ACL group is limited. Once the maximum
+ # number of ACLs has been reached, filters cannot be added. This test
+ # verifies that when this limit is reached, insertion fails without
+ # crashing.
+
+ RET=0
+
+ local num_acls=32
+ local max_size
+ local ret
+
+ if [[ "$tcflags" != "skip_sw" ]]; then
+ return 0;
+ fi
+
+ for ((i=1; i < $num_acls; i++)); do
+ if [[ $(( i % 2 )) == 1 ]]; then
+ tc filter add dev $h2 ingress pref $i proto ipv4 \
+ flower $tcflags dst_ip 198.51.100.1/32 \
+ ip_proto tcp tcp_flags 0x01/0x01 \
+ action drop &> /dev/null
+ else
+ tc filter add dev $h2 ingress pref $i proto ipv6 \
+ flower $tcflags dst_ip 2001:db8:1::1/128 \
+ action drop &> /dev/null
+ fi
+
+ ret=$?
+ [[ $ret -ne 0 ]] && max_size=$((i - 1)) && break
+ done
+
+ # We expect to exceed the maximum number of ACLs in a group, so that
+ # insertion eventually fails. Otherwise, the test should be adjusted to
+ # add more filters.
+ check_fail $ret "expected to exceed number of ACLs in a group"
+
+ for ((; i >= 1; i--)); do
+ if [[ $(( i % 2 )) == 1 ]]; then
+ tc filter del dev $h2 ingress pref $i proto ipv4 \
+ flower $tcflags dst_ip 198.51.100.1/32 \
+ ip_proto tcp tcp_flags 0x01/0x01 \
+ action drop &> /dev/null
+ else
+ tc filter del dev $h2 ingress pref $i proto ipv6 \
+ flower $tcflags dst_ip 2001:db8:1::1/128 \
+ action drop &> /dev/null
+ fi
+ done
+
+ log_test "max ACL group size test ($tcflags). max size $max_size"
+}
+
setup_prepare()
{
h1=${NETIFS[p1]}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 364/374] selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (360 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 363/374] mlxsw: spectrum_acl_tcam: Fix stack corruption Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 365/374] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work Greg Kroah-Hartman
` (12 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shuah Khan, Amit Cohen, Ido Schimmel,
Petr Machata, Paolo Abeni, Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Amit Cohen <amcohen@nvidia.com>
[ Upstream commit b34f4de6d30cbaa8fed905a5080b6eace8c84dc7 ]
'qos_pfc' test checks PFC behavior. The idea is to limit the traffic
using a shaper somewhere in the flow of the packets. In this area, the
buffer is smaller than the buffer at the beginning of the flow, so it fills
up until there is no more space left. The test configures there PFC
which is supposed to notice that the headroom is filling up and send PFC
Xoff to indicate the transmitter to stop sending traffic for the priorities
sharing this PG.
The Xon/Xoff threshold is auto-configured and always equal to
2*(MTU rounded up to cell size). Even after sending the PFC Xoff packet,
traffic will keep arriving until the transmitter receives and processes
the PFC packet. This amount of traffic is known as the PFC delay allowance.
Currently the buffer for the delay traffic is configured as 100KB. The
MTU in the test is 10KB, therefore the threshold for Xoff is about 20KB.
This allows 80KB extra to be stored in this buffer.
8-lane ports use two buffers among which the configured buffer is split,
the Xoff threshold then applies to each buffer in parallel.
The test does not take into account the behavior of 8-lane ports, when the
ports are configured to 400Gbps with 8 lanes or 800Gbps with 8 lanes,
packets are dropped and the test fails.
Check if the relevant ports use 8 lanes, in such case double the size of
the buffer, as the headroom is split half-half.
Cc: Shuah Khan <shuah@kernel.org>
Fixes: bfa804784e32 ("selftests: mlxsw: Add a PFC test")
Signed-off-by: Amit Cohen <amcohen@nvidia.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Petr Machata <petrm@nvidia.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/23ff11b7dff031eb04a41c0f5254a2b636cd8ebb.1705502064.git.petrm@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/drivers/net/mlxsw/qos_pfc.sh | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh b/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh
index 5d5622fc2758..56761de1ca3b 100755
--- a/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh
+++ b/tools/testing/selftests/drivers/net/mlxsw/qos_pfc.sh
@@ -121,6 +121,9 @@ h2_destroy()
switch_create()
{
+ local lanes_swp4
+ local pg1_size
+
# pools
# -----
@@ -230,7 +233,20 @@ switch_create()
dcb pfc set dev $swp4 prio-pfc all:off 1:on
# PG0 will get autoconfigured to Xoff, give PG1 arbitrarily 100K, which
# is (-2*MTU) about 80K of delay provision.
- dcb buffer set dev $swp4 buffer-size all:0 1:$_100KB
+ pg1_size=$_100KB
+
+ setup_wait_dev_with_timeout $swp4
+
+ lanes_swp4=$(ethtool $swp4 | grep 'Lanes:')
+ lanes_swp4=${lanes_swp4#*"Lanes: "}
+
+ # 8-lane ports use two buffers among which the configured buffer
+ # is split, so double the size to get twice (20K + 80K).
+ if [[ $lanes_swp4 -eq 8 ]]; then
+ pg1_size=$((pg1_size * 2))
+ fi
+
+ dcb buffer set dev $swp4 buffer-size all:0 1:$pg1_size
# bridges
# -------
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 365/374] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (361 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 364/374] selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 366/374] i2c: s3c24xx: fix read transfers in polling mode Greg Kroah-Hartman
` (11 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a9400cabb1d784e49abf,
Nikita Zhandarovich, Taehee Yoo, Eric Dumazet, Hangbin Liu,
Jakub Kicinski, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
[ Upstream commit 2e7ef287f07c74985f1bf2858bedc62bd9ebf155 ]
idev->mc_ifc_count can be written over without proper locking.
Originally found by syzbot [1], fix this issue by encapsulating calls
to mld_ifc_stop_work() (and mld_gq_stop_work() for good measure) with
mutex_lock() and mutex_unlock() accordingly as these functions
should only be called with mc_lock per their declarations.
[1]
BUG: KCSAN: data-race in ipv6_mc_down / mld_ifc_work
write to 0xffff88813a80c832 of 1 bytes by task 3771 on cpu 0:
mld_ifc_stop_work net/ipv6/mcast.c:1080 [inline]
ipv6_mc_down+0x10a/0x280 net/ipv6/mcast.c:2725
addrconf_ifdown+0xe32/0xf10 net/ipv6/addrconf.c:3949
addrconf_notify+0x310/0x980
notifier_call_chain kernel/notifier.c:93 [inline]
raw_notifier_call_chain+0x6b/0x1c0 kernel/notifier.c:461
__dev_notify_flags+0x205/0x3d0
dev_change_flags+0xab/0xd0 net/core/dev.c:8685
do_setlink+0x9f6/0x2430 net/core/rtnetlink.c:2916
rtnl_group_changelink net/core/rtnetlink.c:3458 [inline]
__rtnl_newlink net/core/rtnetlink.c:3717 [inline]
rtnl_newlink+0xbb3/0x1670 net/core/rtnetlink.c:3754
rtnetlink_rcv_msg+0x807/0x8c0 net/core/rtnetlink.c:6558
netlink_rcv_skb+0x126/0x220 net/netlink/af_netlink.c:2545
rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:6576
netlink_unicast_kernel net/netlink/af_netlink.c:1342 [inline]
netlink_unicast+0x589/0x650 net/netlink/af_netlink.c:1368
netlink_sendmsg+0x66e/0x770 net/netlink/af_netlink.c:1910
...
write to 0xffff88813a80c832 of 1 bytes by task 22 on cpu 1:
mld_ifc_work+0x54c/0x7b0 net/ipv6/mcast.c:2653
process_one_work kernel/workqueue.c:2627 [inline]
process_scheduled_works+0x5b8/0xa30 kernel/workqueue.c:2700
worker_thread+0x525/0x730 kernel/workqueue.c:2781
...
Fixes: 2d9a93b4902b ("mld: convert from timer to delayed work")
Reported-by: syzbot+a9400cabb1d784e49abf@syzkaller.appspotmail.com
Link: https://lore.kernel.org/all/000000000000994e09060ebcdffb@google.com/
Signed-off-by: Nikita Zhandarovich <n.zhandarovich@fintech.ru>
Acked-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Hangbin Liu <liuhangbin@gmail.com>
Link: https://lore.kernel.org/r/20240117172102.12001-1-n.zhandarovich@fintech.ru
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/ipv6/mcast.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 87c699d57b36..0ea7d97cdc02 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2725,8 +2725,12 @@ void ipv6_mc_down(struct inet6_dev *idev)
synchronize_net();
mld_query_stop_work(idev);
mld_report_stop_work(idev);
+
+ mutex_lock(&idev->mc_lock);
mld_ifc_stop_work(idev);
mld_gq_stop_work(idev);
+ mutex_unlock(&idev->mc_lock);
+
mld_dad_stop_work(idev);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 366/374] i2c: s3c24xx: fix read transfers in polling mode
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (362 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 365/374] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 367/374] i2c: s3c24xx: fix transferring more than one message " Greg Kroah-Hartman
` (10 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski, Chanho Park,
Andi Shyti, Wolfram Sang, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 0d9cf23ed55d7ba3ab26d617a3ae507863674c8f ]
To properly handle read transfers in polling mode, no waiting for the ACK
state is needed as it will never come. Just wait a bit to ensure start
state is on the bus and continue processing next bytes.
Fixes: 117053f77a5a ("i2c: s3c2410: Add polling mode support")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Chanho Park <chanho61.park@samsung.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-s3c2410.c | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index b49a1b170bb2..9a6fbb38a5ba 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -220,8 +220,17 @@ static bool is_ack(struct s3c24xx_i2c *i2c)
int tries;
for (tries = 50; tries; --tries) {
- if (readl(i2c->regs + S3C2410_IICCON)
- & S3C2410_IICCON_IRQPEND) {
+ unsigned long tmp = readl(i2c->regs + S3C2410_IICCON);
+
+ if (!(tmp & S3C2410_IICCON_ACKEN)) {
+ /*
+ * Wait a bit for the bus to stabilize,
+ * delay estimated experimentally.
+ */
+ usleep_range(100, 200);
+ return true;
+ }
+ if (tmp & S3C2410_IICCON_IRQPEND) {
if (!(readl(i2c->regs + S3C2410_IICSTAT)
& S3C2410_IICSTAT_LASTBIT))
return true;
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 367/374] i2c: s3c24xx: fix transferring more than one message in polling mode
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (363 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 366/374] i2c: s3c24xx: fix read transfers in polling mode Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 368/374] block: Remove special-casing of compound pages Greg Kroah-Hartman
` (9 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Marek Szyprowski, Andi Shyti,
Wolfram Sang, Sasha Levin
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Szyprowski <m.szyprowski@samsung.com>
[ Upstream commit 990489e1042c6c5d6bccf56deca68f8dbeed8180 ]
To properly handle ACK on the bus when transferring more than one
message in polling mode, move the polling handling loop from
s3c24xx_i2c_message_start() to s3c24xx_i2c_doxfer(). This way
i2c_s3c_irq_nextbyte() is always executed till the end, properly
acknowledging the IRQ bits and no recursive calls to
i2c_s3c_irq_nextbyte() are made.
While touching this, also fix finishing transfers in polling mode by
using common code path and always waiting for the bus to become idle
and disabled.
Fixes: 117053f77a5a ("i2c: s3c2410: Add polling mode support")
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Andi Shyti <andi.shyti@kernel.org>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-s3c2410.c | 27 ++++++++++-----------------
1 file changed, 10 insertions(+), 17 deletions(-)
diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
index 9a6fbb38a5ba..0777848b3316 100644
--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
@@ -283,16 +283,6 @@ static void s3c24xx_i2c_message_start(struct s3c24xx_i2c *i2c,
stat |= S3C2410_IICSTAT_START;
writel(stat, i2c->regs + S3C2410_IICSTAT);
-
- if (i2c->quirks & QUIRK_POLL) {
- while ((i2c->msg_num != 0) && is_ack(i2c)) {
- i2c_s3c_irq_nextbyte(i2c, stat);
- stat = readl(i2c->regs + S3C2410_IICSTAT);
-
- if (stat & S3C2410_IICSTAT_ARBITR)
- dev_err(i2c->dev, "deal with arbitration loss\n");
- }
- }
}
static inline void s3c24xx_i2c_stop(struct s3c24xx_i2c *i2c, int ret)
@@ -699,7 +689,7 @@ static void s3c24xx_i2c_wait_idle(struct s3c24xx_i2c *i2c)
static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
struct i2c_msg *msgs, int num)
{
- unsigned long timeout;
+ unsigned long timeout = 0;
int ret;
ret = s3c24xx_i2c_set_master(i2c);
@@ -719,16 +709,19 @@ static int s3c24xx_i2c_doxfer(struct s3c24xx_i2c *i2c,
s3c24xx_i2c_message_start(i2c, msgs);
if (i2c->quirks & QUIRK_POLL) {
- ret = i2c->msg_idx;
+ while ((i2c->msg_num != 0) && is_ack(i2c)) {
+ unsigned long stat = readl(i2c->regs + S3C2410_IICSTAT);
- if (ret != num)
- dev_dbg(i2c->dev, "incomplete xfer (%d)\n", ret);
+ i2c_s3c_irq_nextbyte(i2c, stat);
- goto out;
+ stat = readl(i2c->regs + S3C2410_IICSTAT);
+ if (stat & S3C2410_IICSTAT_ARBITR)
+ dev_err(i2c->dev, "deal with arbitration loss\n");
+ }
+ } else {
+ timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);
}
- timeout = wait_event_timeout(i2c->wait, i2c->msg_num == 0, HZ * 5);
-
ret = i2c->msg_idx;
/*
--
2.43.0
^ permalink raw reply related [flat|nested] 377+ messages in thread
* [PATCH 5.15 368/374] block: Remove special-casing of compound pages
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (364 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 367/374] i2c: s3c24xx: fix transferring more than one message " Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 369/374] netfilter: nf_tables: typo NULL check in _clone() function Greg Kroah-Hartman
` (8 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Matthew Wilcox (Oracle), Jens Axboe
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Wilcox (Oracle) <willy@infradead.org>
commit 1b151e2435fc3a9b10c8946c6aebe9f3e1938c55 upstream.
The special casing was originally added in pre-git history; reproducing
the commit log here:
> commit a318a92567d77
> Author: Andrew Morton <akpm@osdl.org>
> Date: Sun Sep 21 01:42:22 2003 -0700
>
> [PATCH] Speed up direct-io hugetlbpage handling
>
> This patch short-circuits all the direct-io page dirtying logic for
> higher-order pages. Without this, we pointlessly bounce BIOs up to
> keventd all the time.
In the last twenty years, compound pages have become used for more than
just hugetlb. Rewrite these functions to operate on folios instead
of pages and remove the special case for hugetlbfs; I don't think
it's needed any more (and if it is, we can put it back in as a call
to folio_test_hugetlb()).
This was found by inspection; as far as I can tell, this bug can lead
to pages used as the destination of a direct I/O read not being marked
as dirty. If those pages are then reclaimed by the MM without being
dirtied for some other reason, they won't be written out. Then when
they're faulted back in, they will not contain the data they should.
It'll take a pretty unusual setup to produce this problem with several
races all going the wrong way.
This problem predates the folio work; it could for example have been
triggered by mmaping a THP in tmpfs and using that as the target of an
O_DIRECT read.
Fixes: 800d8c63b2e98 ("shmem: add huge pages support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/bio.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
--- a/block/bio.c
+++ b/block/bio.c
@@ -1026,7 +1026,7 @@ void bio_release_pages(struct bio *bio,
return;
bio_for_each_segment_all(bvec, bio, iter_all) {
- if (mark_dirty && !PageCompound(bvec->bv_page))
+ if (mark_dirty)
set_page_dirty_lock(bvec->bv_page);
put_page(bvec->bv_page);
}
@@ -1345,8 +1345,7 @@ void bio_set_pages_dirty(struct bio *bio
struct bvec_iter_all iter_all;
bio_for_each_segment_all(bvec, bio, iter_all) {
- if (!PageCompound(bvec->bv_page))
- set_page_dirty_lock(bvec->bv_page);
+ set_page_dirty_lock(bvec->bv_page);
}
}
@@ -1394,7 +1393,7 @@ void bio_check_pages_dirty(struct bio *b
struct bvec_iter_all iter_all;
bio_for_each_segment_all(bvec, bio, iter_all) {
- if (!PageDirty(bvec->bv_page) && !PageCompound(bvec->bv_page))
+ if (!PageDirty(bvec->bv_page))
goto defer;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 369/374] netfilter: nf_tables: typo NULL check in _clone() function
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (365 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 368/374] block: Remove special-casing of compound pages Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 370/374] netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails Greg Kroah-Hartman
` (7 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Julian Wiedmann, Pablo Neira Ayuso,
Jakub Kicinski
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 51edb2ff1c6fc27d3fa73f0773a31597ecd8e230 upstream.
This should check for NULL in case memory allocation fails.
Reported-by: Julian Wiedmann <jwiedmann.dev@gmail.com>
Fixes: 3b9e2ea6c11b ("netfilter: nft_limit: move stateful fields out of expression data")
Fixes: 37f319f37d90 ("netfilter: nft_connlimit: move stateful fields out of expression data")
Fixes: 33a24de37e81 ("netfilter: nft_last: move stateful fields out of expression data")
Fixes: ed0a0c60f0e5 ("netfilter: nft_quota: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Link: https://lore.kernel.org/r/20220110194817.53481-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_connlimit.c | 2 +-
net/netfilter/nft_last.c | 2 +-
net/netfilter/nft_limit.c | 2 +-
net/netfilter/nft_quota.c | 2 +-
4 files changed, 4 insertions(+), 4 deletions(-)
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -206,7 +206,7 @@ static int nft_connlimit_clone(struct nf
struct nft_connlimit *priv_src = nft_expr_priv(src);
priv_dst->list = kmalloc(sizeof(*priv_dst->list), GFP_ATOMIC);
- if (priv_dst->list)
+ if (!priv_dst->list)
return -ENOMEM;
nf_conncount_list_init(priv_dst->list);
--- a/net/netfilter/nft_last.c
+++ b/net/netfilter/nft_last.c
@@ -106,7 +106,7 @@ static int nft_last_clone(struct nft_exp
struct nft_last_priv *priv_dst = nft_expr_priv(dst);
priv_dst->last = kzalloc(sizeof(*priv_dst->last), GFP_ATOMIC);
- if (priv_dst->last)
+ if (!priv_dst->last)
return -ENOMEM;
return 0;
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -150,7 +150,7 @@ static int nft_limit_clone(struct nft_li
priv_dst->invert = priv_src->invert;
priv_dst->limit = kmalloc(sizeof(*priv_dst->limit), GFP_ATOMIC);
- if (priv_dst->limit)
+ if (!priv_dst->limit)
return -ENOMEM;
spin_lock_init(&priv_dst->limit->lock);
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -237,7 +237,7 @@ static int nft_quota_clone(struct nft_ex
struct nft_quota *priv_dst = nft_expr_priv(dst);
priv_dst->consumed = kmalloc(sizeof(*priv_dst->consumed), GFP_ATOMIC);
- if (priv_dst->consumed)
+ if (!priv_dst->consumed)
return -ENOMEM;
atomic64_set(priv_dst->consumed, 0);
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 370/374] netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (366 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 369/374] netfilter: nf_tables: typo NULL check in _clone() function Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 371/374] netfilter: nft_limit: fix stateful object memory leak Greg Kroah-Hartman
` (6 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 7d70984a1ad4c445dff08edb9aacce8906b6a222 upstream.
Check if nf_ct_netns_get() fails then release the limit object
previously allocated via kmalloc().
Fixes: 37f319f37d90 ("netfilter: nft_connlimit: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_connlimit.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
--- a/net/netfilter/nft_connlimit.c
+++ b/net/netfilter/nft_connlimit.c
@@ -62,6 +62,7 @@ static int nft_connlimit_do_init(const s
{
bool invert = false;
u32 flags, limit;
+ int err;
if (!tb[NFTA_CONNLIMIT_COUNT])
return -EINVAL;
@@ -84,7 +85,15 @@ static int nft_connlimit_do_init(const s
priv->limit = limit;
priv->invert = invert;
- return nf_ct_netns_get(ctx->net, ctx->family);
+ err = nf_ct_netns_get(ctx->net, ctx->family);
+ if (err < 0)
+ goto err_netns;
+
+ return 0;
+err_netns:
+ kfree(priv->list);
+
+ return err;
}
static void nft_connlimit_do_destroy(const struct nft_ctx *ctx,
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 371/374] netfilter: nft_limit: fix stateful object memory leak
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (367 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 370/374] netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 372/374] netfilter: nft_limit: Clone packet limits cost value Greg Kroah-Hartman
` (5 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Florian Westphal, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Florian Westphal <fw@strlen.de>
commit 1a58f84ea5df7f026bf92a0009f931bf547fe965 upstream.
We need to provide a destroy callback to release the extra fields.
Fixes: 3b9e2ea6c11b ("netfilter: nft_limit: move stateful fields out of expression data")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_limit.c | 18 ++++++++++++++++++
1 file changed, 18 insertions(+)
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -345,11 +345,20 @@ static int nft_limit_obj_pkts_dump(struc
return nft_limit_dump(skb, &priv->limit, NFT_LIMIT_PKTS);
}
+static void nft_limit_obj_pkts_destroy(const struct nft_ctx *ctx,
+ struct nft_object *obj)
+{
+ struct nft_limit_priv_pkts *priv = nft_obj_data(obj);
+
+ nft_limit_destroy(ctx, &priv->limit);
+}
+
static struct nft_object_type nft_limit_obj_type;
static const struct nft_object_ops nft_limit_obj_pkts_ops = {
.type = &nft_limit_obj_type,
.size = NFT_EXPR_SIZE(sizeof(struct nft_limit_priv_pkts)),
.init = nft_limit_obj_pkts_init,
+ .destroy = nft_limit_obj_pkts_destroy,
.eval = nft_limit_obj_pkts_eval,
.dump = nft_limit_obj_pkts_dump,
};
@@ -383,11 +392,20 @@ static int nft_limit_obj_bytes_dump(stru
return nft_limit_dump(skb, priv, NFT_LIMIT_PKT_BYTES);
}
+static void nft_limit_obj_bytes_destroy(const struct nft_ctx *ctx,
+ struct nft_object *obj)
+{
+ struct nft_limit_priv *priv = nft_obj_data(obj);
+
+ nft_limit_destroy(ctx, priv);
+}
+
static struct nft_object_type nft_limit_obj_type;
static const struct nft_object_ops nft_limit_obj_bytes_ops = {
.type = &nft_limit_obj_type,
.size = sizeof(struct nft_limit_priv),
.init = nft_limit_obj_bytes_init,
+ .destroy = nft_limit_obj_bytes_destroy,
.eval = nft_limit_obj_bytes_eval,
.dump = nft_limit_obj_bytes_dump,
};
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 372/374] netfilter: nft_limit: Clone packet limits cost value
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (368 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 371/374] netfilter: nft_limit: fix stateful object memory leak Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 373/374] netfilter: nft_last: copy content when cloning expression Greg Kroah-Hartman
` (4 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Phil Sutter, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Phil Sutter <phil@nwl.cc>
commit 558254b0b602b8605d7246a10cfeb584b1fcabfc upstream.
When cloning a packet-based limit expression, copy the cost value as
well. Otherwise the new limit is not functional anymore.
Fixes: 3b9e2ea6c11bf ("netfilter: nft_limit: move stateful fields out of expression data")
Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_limit.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -218,6 +218,8 @@ static int nft_limit_pkts_clone(struct n
struct nft_limit_priv_pkts *priv_dst = nft_expr_priv(dst);
struct nft_limit_priv_pkts *priv_src = nft_expr_priv(src);
+ priv_dst->cost = priv_src->cost;
+
return nft_limit_clone(&priv_dst->limit, &priv_src->limit);
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 373/374] netfilter: nft_last: copy content when cloning expression
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (369 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 372/374] netfilter: nft_limit: Clone packet limits cost value Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 374/374] netfilter: nft_quota: " Greg Kroah-Hartman
` (3 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit 860e874290fb3be08e966c9c8ffc510c5b0f2bd8 upstream.
If the ruleset contains last timestamps, restore them accordingly.
Otherwise, listing after restoration shows never used items.
Fixes: 33a24de37e81 ("netfilter: nft_last: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_last.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/net/netfilter/nft_last.c
+++ b/net/netfilter/nft_last.c
@@ -104,11 +104,15 @@ static void nft_last_destroy(const struc
static int nft_last_clone(struct nft_expr *dst, const struct nft_expr *src)
{
struct nft_last_priv *priv_dst = nft_expr_priv(dst);
+ struct nft_last_priv *priv_src = nft_expr_priv(src);
priv_dst->last = kzalloc(sizeof(*priv_dst->last), GFP_ATOMIC);
if (!priv_dst->last)
return -ENOMEM;
+ priv_dst->last->set = priv_src->last->set;
+ priv_dst->last->jiffies = priv_src->last->jiffies;
+
return 0;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* [PATCH 5.15 374/374] netfilter: nft_quota: copy content when cloning expression
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (370 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 373/374] netfilter: nft_last: copy content when cloning expression Greg Kroah-Hartman
@ 2024-01-23 0:00 ` Greg Kroah-Hartman
2024-01-23 1:48 ` [PATCH 5.15 000/374] 5.15.148-rc1 review SeongJae Park
` (2 subsequent siblings)
374 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 0:00 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Pablo Neira Ayuso
5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pablo Neira Ayuso <pablo@netfilter.org>
commit aabef97a35160461e9c576848ded737558d89055 upstream.
If the ruleset contains consumed quota, restore them accordingly.
Otherwise, listing after restoration shows never used items.
Restore the user-defined quota and flags too.
Fixes: ed0a0c60f0e5 ("netfilter: nft_quota: move stateful fields out of expression data")
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/netfilter/nft_quota.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/net/netfilter/nft_quota.c
+++ b/net/netfilter/nft_quota.c
@@ -235,12 +235,16 @@ static void nft_quota_destroy(const stru
static int nft_quota_clone(struct nft_expr *dst, const struct nft_expr *src)
{
struct nft_quota *priv_dst = nft_expr_priv(dst);
+ struct nft_quota *priv_src = nft_expr_priv(src);
+
+ priv_dst->quota = priv_src->quota;
+ priv_dst->flags = priv_src->flags;
priv_dst->consumed = kmalloc(sizeof(*priv_dst->consumed), GFP_ATOMIC);
if (!priv_dst->consumed)
return -ENOMEM;
- atomic64_set(priv_dst->consumed, 0);
+ *priv_dst->consumed = *priv_src->consumed;
return 0;
}
^ permalink raw reply [flat|nested] 377+ messages in thread
* Re: [PATCH 5.15 000/374] 5.15.148-rc1 review
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (371 preceding siblings ...)
2024-01-23 0:00 ` [PATCH 5.15 374/374] netfilter: nft_quota: " Greg Kroah-Hartman
@ 2024-01-23 1:48 ` SeongJae Park
2024-01-23 15:35 ` Jon Hunter
2024-01-24 9:30 ` Harshit Mogalapalli
374 siblings, 0 replies; 377+ messages in thread
From: SeongJae Park @ 2024-01-23 1:48 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, allen.lkml, damon,
SeongJae Park
Hello,
On Mon, 22 Jan 2024 15:54:16 -0800 Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> This is the start of the stable review cycle for the 5.15.148 release.
> There are 374 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.148-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
This rc kernel passes DAMON functionality test[1] on my test machine.
Attaching the test results summary below. Please note that I retrieved the
kernel from linux-stable-rc tree[2].
Tested-by: SeongJae Park <sj@kernel.org>
[1] https://github.com/awslabs/damon-tests/tree/next/corr
[2] 59db9667b9d1 ("Linux 5.15.148-rc1")
Thanks,
SJ
[...]
---
ok 1 selftests: damon: debugfs_attrs.sh
ok 1 selftests: damon-tests: kunit.sh
ok 2 selftests: damon-tests: huge_count_read_write.sh
ok 3 selftests: damon-tests: buffer_overflow.sh
ok 4 selftests: damon-tests: rm_contexts.sh
ok 5 selftests: damon-tests: record_null_deref.sh
ok 6 selftests: damon-tests: dbgfs_target_ids_read_before_terminate_race.sh
ok 7 selftests: damon-tests: dbgfs_target_ids_pid_leak.sh
ok 8 selftests: damon-tests: damo_tests.sh
ok 9 selftests: damon-tests: masim-record.sh
ok 10 selftests: damon-tests: build_i386.sh
ok 11 selftests: damon-tests: build_arm64.sh
ok 12 selftests: damon-tests: build_m68k.sh
ok 13 selftests: damon-tests: build_i386_idle_flag.sh
ok 14 selftests: damon-tests: build_i386_highpte.sh
ok 15 selftests: damon-tests: build_nomemcg.sh
[33m
[92mPASS [39m
^ permalink raw reply [flat|nested] 377+ messages in thread
* Re: [PATCH 5.15 000/374] 5.15.148-rc1 review
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (372 preceding siblings ...)
2024-01-23 1:48 ` [PATCH 5.15 000/374] 5.15.148-rc1 review SeongJae Park
@ 2024-01-23 15:35 ` Jon Hunter
2024-01-23 17:13 ` Greg Kroah-Hartman
2024-01-24 9:30 ` Harshit Mogalapalli
374 siblings, 1 reply; 377+ messages in thread
From: Jon Hunter @ 2024-01-23 15:35 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, f.fainelli, sudipm.mukherjee, srw, rwarsow,
conor, allen.lkml, linux-tegra@vger.kernel.org
Hi Greg,
On 22/01/2024 23:54, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.148 release.
> There are 374 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.148-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
...
> Douglas Anderson <dianders@chromium.org>
> r8152: Choose our USB config with choose_configuration() rather than probe()
The above commit is causing a boot regression on the Tegra210 Jetson TX1
board and reverting this commit fixes it. This also happens with
linux-6.1.y, linux-6.6.y and linux-6.7.y. I am not seeing this on the
mainline.
Test results for stable-v5.15:
10 builds: 10 pass, 0 fail
28 boots: 26 pass, 2 fail
74 tests: 74 pass, 0 fail
Linux version: 5.15.148-rc1-g59db9667b9d1
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra194-p3509-0000+p3668-0000,
tegra20-ventana, tegra210-p2371-2180,
tegra210-p3450-0000, tegra30-cardhu-a04
Boot failures: tegra210-p2371-2180
Looking at the console I am seeing the following panic ...
[ 5.262192] r8152-cfgselector 2-1: reset SuperSpeed USB device number 2 using tegra-xusb
[ 5.367566] r8152 2-1:1.0: load rtl8153a-3 v2 02/07/20 successfully
[ 5.415902] r8152 2-1:1.0 eth0: v1.12.13
[ 5.423122] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[ 5.431970] Mem abort info:
[ 5.434799] ESR = 0x0000000086000004
[ 5.438596] EC = 0x21: IABT (current EL), IL = 32 bits
[ 5.443963] SET = 0, FnV = 0
[ 5.447078] EA = 0, S1PTW = 0
[ 5.450254] FSC = 0x04: level 0 translation fault
[ 5.455160] [0000000000000000] user address but active_mm is swapper
[ 5.461551] Internal error: Oops: 0000000086000004 [#1] PREEMPT SMP
[ 5.467830] Modules linked in:
[ 5.470892] CPU: 2 PID: 120 Comm: kworker/2:3 Not tainted 5.15.147-00306-gfca62e959560 #8
[ 5.479075] Hardware name: NVIDIA Jetson TX1 Developer Kit (DT)
[ 5.484995] Workqueue: usb_hub_wq hub_event
[ 5.489196] pstate: 80000005 (Nzcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 5.496163] pc : 0x0
[ 5.498354] lr : usb_probe_device+0x34/0xb8
[ 5.502548] sp : ffff80000aad3990
[ 5.505863] x29: ffff80000aad3990 x28: ffff0000825810a8 x27: ffff80000a464958
[ 5.513015] x26: ffff80000a3190f8 x25: ffff80000a34df50 x24: 0000000000000000
[ 5.520163] x23: 0000000000000001 x22: 000000000000001d x21: ffff000082581000
[ 5.527309] x20: ffff80000a34d1d0 x19: ffff80000a34d210 x18: 0000000000000000
[ 5.534456] x17: 313a312d322f312d x16: 322f326273752f62 x15: 0000000000000001
[ 5.541602] x14: 0000000000000002 x13: 00000000000777aa x12: 0000000000000001
[ 5.548746] x11: 0000000000000028 x10: 0000000000000001 x9 : 0000000000000228
[ 5.555892] x8 : 0101010101010101 x7 : 7f7f7f7f7f7f7f7f x6 : 000000000ef0212c
[ 5.563038] x5 : 00ffffffffffffff x4 : ffff80000a34ef88 x3 : 0000000000000000
[ 5.570184] x2 : ffffffffffffff00 x1 : 0000000000000000 x0 : ffff000082581000
[ 5.577329] Call trace:
[ 5.579777] 0x0
[ 5.581619] really_probe+0xb4/0x2e0
[ 5.585208] __driver_probe_device+0x7c/0x120
[ 5.589570] driver_probe_device+0x40/0x130
[ 5.593757] __device_attach_driver+0x94/0xe0
[ 5.598120] bus_for_each_drv+0x70/0xc8
[ 5.601963] __device_attach+0xfc/0x188
[ 5.605803] device_initial_probe+0x10/0x18
[ 5.609993] bus_probe_device+0x94/0xa0
[ 5.613833] device_add+0x4ac/0x838
[ 5.617326] usb_new_device+0x1e4/0x580
[ 5.621167] hub_event+0x918/0x1350
[ 5.624658] process_one_work+0x1f4/0x4c0
[ 5.628675] worker_thread+0x48/0x470
[ 5.632342] kthread+0x120/0x158
[ 5.635579] ret_from_fork+0x10/0x20
[ 5.639166] Code: bad PC value
[ 5.642224] ---[ end trace f266fb655cdbc485 ]---
Jon
--
nvpublic
^ permalink raw reply [flat|nested] 377+ messages in thread
* Re: [PATCH 5.15 000/374] 5.15.148-rc1 review
2024-01-23 15:35 ` Jon Hunter
@ 2024-01-23 17:13 ` Greg Kroah-Hartman
0 siblings, 0 replies; 377+ messages in thread
From: Greg Kroah-Hartman @ 2024-01-23 17:13 UTC (permalink / raw)
To: Jon Hunter
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml, linux-tegra@vger.kernel.org
On Tue, Jan 23, 2024 at 03:35:24PM +0000, Jon Hunter wrote:
> Hi Greg,
>
> On 22/01/2024 23:54, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 5.15.148 release.
> > There are 374 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.148-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> > and the diffstat can be found below.
> >
> > thanks,
> >
> > greg k-h
>
> ...
> > Douglas Anderson <dianders@chromium.org>
> > r8152: Choose our USB config with choose_configuration() rather than probe()
>
>
> The above commit is causing a boot regression on the Tegra210 Jetson TX1
> board and reverting this commit fixes it. This also happens with
> linux-6.1.y, linux-6.6.y and linux-6.7.y. I am not seeing this on the
> mainline.
Ok, thanks for letting us know, I was a bit "worried" about these
changes, so I'll back them out and push out new -rc releases. If the
ChromeOS developers want them backported, I'll let them provide a
working series.
thanks!
greg k-h
^ permalink raw reply [flat|nested] 377+ messages in thread
* Re: [PATCH 5.15 000/374] 5.15.148-rc1 review
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
` (373 preceding siblings ...)
2024-01-23 15:35 ` Jon Hunter
@ 2024-01-24 9:30 ` Harshit Mogalapalli
374 siblings, 0 replies; 377+ messages in thread
From: Harshit Mogalapalli @ 2024-01-24 9:30 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, allen.lkml, Vegard Nossum, Darren Kenny
Hi Greg,
On 23/01/24 5:24 am, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 5.15.148 release.
> There are 374 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed, 24 Jan 2024 23:56:49 +0000.
> Anything received after that time might be too late.
>
No problems seen on x86_64 and aarch64 with our testing.
Tested-by: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Thanks,
Harshit
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.15.148-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.15.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
^ permalink raw reply [flat|nested] 377+ messages in thread
end of thread, other threads:[~2024-01-24 9:31 UTC | newest]
Thread overview: 377+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-01-22 23:54 [PATCH 5.15 000/374] 5.15.148-rc1 review Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 001/374] f2fs: explicitly null-terminate the xattr list Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 002/374] pinctrl: lochnagar: Dont build on MIPS Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 003/374] ALSA: hda - Fix speaker and headset mic pin config for CHUWI CoreBook XPro Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 004/374] mptcp: fix uninit-value in mptcp_incoming_options Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 005/374] wifi: cfg80211: lock wiphy mutex for rfkill poll Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 006/374] debugfs: fix automount d_fsdata usage Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 007/374] drm/amdgpu: Fix cat debugfs amdgpu_regs_didt causes kernel null pointer Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 008/374] nvme-core: check for too small lba shift Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 009/374] ASoC: wm8974: Correct boost mixer inputs Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 010/374] ASoC: Intel: Skylake: Fix mem leak in few functions Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 011/374] ASoC: nau8822: Fix incorrect type in assignment and cast to restricted __be16 Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 012/374] ASoC: Intel: Skylake: mem leak in skl register function Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 013/374] ASoC: cs43130: Fix the position of const qualifier Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 014/374] ASoC: cs43130: Fix incorrect frame delay configuration Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 015/374] ASoC: rt5650: add mutex to avoid the jack detection failure Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 016/374] nouveau/tu102: flush all pdbs on vmm flush Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 017/374] net/tg3: fix race condition in tg3_reset_task() Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 018/374] ASoC: da7219: Support low DC impedance headset Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 019/374] ASoC: ops: add correct range check for limiting volume Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 020/374] nvme: introduce helper function to get ctrl state Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 021/374] drm/amdgpu: Add NULL checks for function pointers Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 022/374] drm/exynos: fix a potential error pointer dereference Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 023/374] drm/exynos: fix a wrong error checking Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 024/374] hwmon: (corsair-psu) Fix probe when built-in Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 025/374] clk: rockchip: rk3128: Fix HCLK_OTG gate register Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 026/374] jbd2: correct the printing of write_flags in jbd2_write_superblock() Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 027/374] drm/crtc: Fix uninit-value bug in drm_mode_setcrtc Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 028/374] neighbour: Dont let neigh_forced_gc() disable preemption for long Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 029/374] platform/x86: intel-vbtn: Fix missing tablet-mode-switch events Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 030/374] jbd2: fix soft lockup in journal_finish_inode_data_buffers() Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 031/374] tracing: Have large events show up as [LINE TOO BIG] instead of nothing Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 032/374] tracing: Add size check when printing trace_marker output Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 033/374] stmmac: dwmac-loongson: drop useless check for compatible fallback Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 034/374] MIPS: dts: loongson: drop incorrect dwmac fallback compatible Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 035/374] tracing: Fix uaf issue when open the hist or hist_debug file Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 036/374] ring-buffer: Do not record in NMI if the arch does not support cmpxchg in NMI Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 037/374] reset: hisilicon: hi6220: fix Wvoid-pointer-to-enum-cast warning Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 038/374] Input: atkbd - skip ATKBD_CMD_GETID in translated mode Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 039/374] Input: i8042 - add nomux quirk for Acer P459-G2-M Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 040/374] s390/scm: fix virtual vs physical address confusion Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 041/374] ARC: fix spare error Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 042/374] wifi: iwlwifi: pcie: avoid a NULL pointer dereference Greg Kroah-Hartman
2024-01-22 23:54 ` [PATCH 5.15 043/374] Input: xpad - add Razer Wolverine V2 support Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 044/374] ASoC: Intel: bytcr_rt5640: Add quirk for the Medion Lifetab S10346 Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 045/374] i2c: rk3x: fix potential spinlock recursion on poll Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 046/374] ida: Fix crash in ida_free when the bitmap is empty Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 047/374] net: qrtr: ns: Return 0 if server port is not present Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 048/374] ARM: sun9i: smp: fix return code check of of_property_match_string Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 049/374] drm/crtc: fix uninitialized variable use Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 050/374] ACPI: resource: Add another DMI match for the TongFang GMxXGxx Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 051/374] Revert "ASoC: atmel: Remove system clock tree configuration for at91sam9g20ek" Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 052/374] bpf: Add --skip_encoding_btf_inconsistent_proto, --btf_gen_optimized to pahole flags for v1.25 Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 053/374] kprobes: Fix to handle forcibly unoptimized kprobes on freeing_list Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 054/374] Revert "md/raid5: Wait for MD_SB_CHANGE_PENDING in raid5d" Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 055/374] binder: use EPOLLERR from eventpoll.h Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 056/374] binder: fix use-after-free in shinkers callback Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 057/374] binder: fix trivial typo of binder_free_buf_locked() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 058/374] binder: fix comment on binder_alloc_new_buf() return value Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 059/374] uio: Fix use-after-free in uio_open Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 060/374] parport: parport_serial: Add Brainboxes BAR details Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 061/374] parport: parport_serial: Add Brainboxes device IDs and geometry Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 062/374] leds: ledtrig-tty: Free allocated ttyname buffer on deactivate Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 063/374] PCI: Add ACS quirk for more Zhaoxin Root Ports Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 064/374] coresight: etm4x: Fix width of CCITMIN field Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 065/374] x86/lib: Fix overflow when counting digits Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 066/374] EDAC/thunderx: Fix possible out-of-bounds string access Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 067/374] powerpc: Mark .opd section read-only Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 068/374] powerpc/toc: Future proof kernel toc Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 069/374] powerpc: remove checks for binutils older than 2.25 Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 070/374] powerpc: add crtsavres.o to always-y instead of extra-y Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 071/374] powerpc/44x: select I2C for CURRITUCK Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 072/374] powerpc/pseries/memhp: Fix access beyond end of drmem array Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 073/374] selftests/powerpc: Fix error handling in FPU/VMX preemption tests Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 074/374] powerpc/powernv: Add a null pointer check to scom_debug_init_one() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 075/374] powerpc/powernv: Add a null pointer check in opal_event_init() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 076/374] powerpc/powernv: Add a null pointer check in opal_powercap_init() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 077/374] powerpc/imc-pmu: Add a null pointer check in update_events_in_group() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 078/374] spi: spi-zynqmp-gqspi: fix driver kconfig dependencies Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 079/374] mtd: rawnand: Increment IFC_TIMEOUT_MSECS for nand controller response Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 080/374] ACPI: video: check for error while searching for backlight device parent Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 081/374] ACPI: LPIT: Avoid u32 multiplication overflow Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 082/374] of: property: define of_property_read_u{8,16,32,64}_array() unconditionally Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 083/374] of: Add of_property_present() helper Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 084/374] cpufreq: Use of_property_present() for testing DT property presence Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 085/374] cpufreq: scmi: process the result of devm_of_clk_add_hw_provider() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 086/374] calipso: fix memory leak in netlbl_calipso_add_pass() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 087/374] efivarfs: force RO when remounting if SetVariable is not supported Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 088/374] spi: sh-msiof: Enforce fixed DTDL for R-Car H3 Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 089/374] ACPI: LPSS: Fix the fractional clock divider flags Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 090/374] ACPI: extlog: Clear Extended Error Log status when RAS_CEC handled the error Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 091/374] kunit: debugfs: Fix unchecked dereference in debugfs_print_results() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 092/374] mtd: Fix gluebi NULL pointer dereference caused by ftl notifier Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 093/374] selinux: Fix error priority for bind with AF_UNSPEC on PF_INET6 socket Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 094/374] crypto: virtio - Handle dataq logic with tasklet Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 095/374] crypto: sa2ul - Return crypto_aead_setkey to transfer the error Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 096/374] crypto: ccp - fix memleak in ccp_init_dm_workarea Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 097/374] crypto: af_alg - Disallow multiple in-flight AIO requests Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 098/374] crypto: sahara - remove FLAGS_NEW_KEY logic Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 099/374] crypto: sahara - fix cbc selftest failure Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 100/374] crypto: sahara - fix ahash " Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 101/374] crypto: sahara - fix processing requests with cryptlen < sg->length Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 102/374] crypto: sahara - fix error handling in sahara_hw_descriptor_create() Greg Kroah-Hartman
2024-01-22 23:55 ` [PATCH 5.15 103/374] pstore: ram_core: fix possible overflow in persistent_ram_init_ecc() Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 104/374] fs: indicate request originates from old mount API Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 105/374] gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 106/374] crypto: virtio - Wait for tasklet to complete on device remove Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 107/374] crypto: sahara - avoid skcipher fallback code duplication Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 108/374] crypto: sahara - handle zero-length aes requests Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 109/374] crypto: sahara - fix ahash reqsize Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 110/374] crypto: sahara - fix wait_for_completion_timeout() error handling Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 111/374] crypto: sahara - improve error handling in sahara_sha_process() Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 112/374] crypto: sahara - fix processing hash requests with req->nbytes < sg->length Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 113/374] crypto: sahara - do not resize req->src when doing hash operations Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 114/374] crypto: scomp - fix req->dst buffer overflow Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 115/374] blocklayoutdriver: Fix reference leak of pnfs_device_node Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 116/374] NFSv4.1/pnfs: Ensure we handle the error NFS4ERR_RETURNCONFLICT Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 117/374] wifi: rtw88: fix RX filter in FIF_ALLMULTI flag Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 118/374] bpf, lpm: Fix check prefixlen before walking trie Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 119/374] bpf: Add crosstask check to __bpf_get_stack Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 120/374] wifi: ath11k: Defer on rproc_get failure Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 121/374] wifi: libertas: stop selecting wext Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 122/374] ARM: dts: qcom: apq8064: correct XOADC register address Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 123/374] net/ncsi: Fix netlink major/minor version numbers Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 124/374] firmware: ti_sci: Fix an off-by-one in ti_sci_debugfs_create() Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 125/374] firmware: meson_sm: populate platform devices from sm device tree data Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 126/374] wifi: rtlwifi: rtl8821ae: phy: fix an undefined bitwise shift behavior Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 127/374] arm64: dts: ti: k3-am65-main: Fix DSS irq trigger type Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 128/374] bpf: enforce precision of R0 on callback return Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 129/374] ARM: dts: qcom: sdx65: correct SPMI node name Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 130/374] arm64: dts: qcom: sc7180: Make watchdog bark interrupt edge triggered Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 131/374] arm64: dts: qcom: sc7280: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 132/374] arm64: dts: qcom: sdm845: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 133/374] arm64: dts: qcom: sm8150: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 134/374] arm64: dts: qcom: sm8250: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 135/374] bpf: fix check for attempt to corrupt spilled pointer Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 136/374] scsi: fnic: Return error if vmalloc() failed Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 137/374] arm64: dts: qcom: qrb5165-rb5: correct LED panic indicator Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 138/374] arm64: dts: qcom: sdm845-db845c: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 139/374] arm64: dts: qcom: sc7280: fix usb_2 wakeup interrupt types Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 140/374] bpf: Fix verification of indirect var-off stack access Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 141/374] block: Set memalloc_noio to false on device_add_disk() error path Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 142/374] scsi: hisi_sas: Rename HISI_SAS_{RESET -> RESETTING}_BIT Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 143/374] scsi: hisi_sas: Prevent parallel FLR and controller reset Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 144/374] scsi: hisi_sas: Replace with standard error code return value Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 145/374] scsi: hisi_sas: Rollback some operations if FLR failed Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 146/374] scsi: hisi_sas: Correct the number of global debugfs registers Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 147/374] selftests/net: fix grep checking for fib_nexthop_multiprefix Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 148/374] virtio/vsock: fix logic which reduces credit update messages Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 149/374] dma-mapping: Add dma_release_coherent_memory to DMA API Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 150/374] dma-mapping: clear dev->dma_mem to NULL after freeing it Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 151/374] soc: qcom: llcc: Fix dis_cap_alloc and retain_on_pc configuration Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 152/374] arm64: dts: qcom: sm8150-hdk: fix SS USB regulators Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 153/374] block: add check of minors and first_minor in device_add_disk() Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 154/374] arm64: dts: qcom: sc7280: Mark SDHCI hosts as cache-coherent Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 155/374] wifi: rtlwifi: add calculate_bit_shift() Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 156/374] wifi: rtlwifi: rtl8188ee: phy: using calculate_bit_shift() Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 157/374] wifi: rtlwifi: rtl8192c: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 158/374] wifi: rtlwifi: rtl8192cu: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 159/374] wifi: rtlwifi: rtl8192ce: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 160/374] wifi: rtlwifi: rtl8192de: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 161/374] wifi: rtlwifi: rtl8192ee: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 162/374] wifi: rtlwifi: rtl8192se: " Greg Kroah-Hartman
2024-01-22 23:56 ` [PATCH 5.15 163/374] wifi: iwlwifi: mvm: set siso/mimo chains to 1 in FW SMPS request Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 164/374] wifi: iwlwifi: mvm: send TX path flush in rfkill Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 165/374] netfilter: nf_tables: mark newset as dead on transaction abort Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 166/374] Bluetooth: Fix bogus check for re-auth no supported with non-ssp Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 167/374] Bluetooth: btmtkuart: fix recv_buf() return value Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 168/374] block: make BLK_DEF_MAX_SECTORS unsigned Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 169/374] null_blk: dont cap max_hw_sectors to BLK_DEF_MAX_SECTORS Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 170/374] net/sched: act_ct: fix skb leak and crash on ooo frags Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 171/374] mlxbf_gige: Fix intermittent no ip issue Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 172/374] net: mellanox: mlxbf_gige: Replace non-standard interrupt handling Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 173/374] mlxbf_gige: Enable the GigE port in mlxbf_gige_open Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 174/374] ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 175/374] ARM: davinci: always select CONFIG_CPU_ARM926T Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 176/374] Revert "drm/tidss: Annotate dma-fence critical section in commit path" Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 177/374] Revert "drm/omapdrm: " Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 178/374] RDMA/usnic: Silence uninitialized symbol smatch warnings Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 179/374] RDMA/hns: Fix inappropriate err code for unsupported operations Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 180/374] drm/panel-elida-kd35t133: hold panel in reset for unprepare Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 181/374] drm/nouveau/fence:: fix warning directly dereferencing a rcu pointer Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 182/374] drm/bridge: tpd12s015: Drop buggy __exit annotation for remove function Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 183/374] drm/tilcdc: Fix irq free on unload Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 184/374] media: pvrusb2: fix use after free on context disconnection Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 185/374] drm/bridge: Fix typo in post_disable() description Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 186/374] f2fs: fix to avoid dirent corruption Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 187/374] drm/radeon/r600_cs: Fix possible int overflows in r600_cs_check_reg() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 188/374] drm/radeon/r100: Fix integer overflow issues in r100_cs_track_check() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 189/374] drm/radeon: check return value of radeon_ring_lock() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 190/374] ASoC: cs35l33: Fix GPIO name and drop legacy include Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 191/374] ASoC: cs35l34: " Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 192/374] drm/msm/mdp4: flush vblank event on disable Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 193/374] drm/msm/dsi: Use pm_runtime_resume_and_get to prevent refcnt leaks Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 194/374] drm/drv: propagate errors from drm_modeset_register_all() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 195/374] drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 196/374] drm/radeon/dpm: fix a memleak in sumo_parse_power_table Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 197/374] drm/radeon/trinity_dpm: fix a memleak in trinity_parse_power_table Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 198/374] drm/bridge: cdns-mhdp8546: Fix use of uninitialized variable Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 199/374] drm/bridge: tc358767: Fix return value on error case Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 200/374] media: cx231xx: fix a memleak in cx231xx_init_isoc Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 201/374] clk: qcom: gpucc-sm8150: Update the gpu_cc_pll1 config Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 202/374] media: rkisp1: Disable runtime PM in probe error path Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 203/374] f2fs: fix to check compress file in f2fs_move_file_range() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 204/374] f2fs: fix to update iostat correctly in f2fs_filemap_fault() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 205/374] f2fs: fix the f2fs_file_write_iter tracepoint Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 206/374] media: dvbdev: drop refcount on error path in dvb_device_open() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 207/374] media: dvb-frontends: m88ds3103: Fix a memory leak in an error handling path of m88ds3103_probe() Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 208/374] drm/amdgpu/debugfs: fix error code when smc register accessors are NULL Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 209/374] drm/amd/pm: fix a double-free in si_dpm_init Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 210/374] drivers/amd/pm: fix a use-after-free in kv_parse_power_table Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 211/374] gpu/drm/radeon: fix two memleaks in radeon_vm_init Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 212/374] dt-bindings: clock: Update the videocc resets for sm8150 Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 213/374] clk: qcom: videocc-sm8150: Update the videocc resets Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 214/374] clk: qcom: videocc-sm8150: Add missing PLL config property Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 215/374] drivers: clk: zynqmp: calculate closest mux rate Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 216/374] clk: zynqmp: make bestdiv unsigned Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 217/374] clk: zynqmp: Add a check for NULL pointer Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 218/374] drivers: clk: zynqmp: update divider round rate logic Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 219/374] watchdog: set cdev owner before adding Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 220/374] watchdog/hpwdt: Only claim UNKNOWN NMI if from iLO Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 221/374] watchdog: bcm2835_wdt: Fix WDIOC_SETTIMEOUT handling Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 222/374] watchdog: rti_wdt: Drop runtime pm reference count when watchdog is unused Greg Kroah-Hartman
2024-01-22 23:57 ` [PATCH 5.15 223/374] clk: si5341: fix an error code problem in si5341_output_clk_set_rate Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 224/374] clk: asm9260: use parent index to link the reference clock Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 225/374] clk: fixed-rate: add devm_clk_hw_register_fixed_rate Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 226/374] clk: fixed-rate: fix clk_hw_register_fixed_rate_with_accuracy_parent_hw Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 227/374] pwm: stm32: Use regmap_clear_bits and regmap_set_bits where applicable Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 228/374] pwm: stm32: Use hweight32 in stm32_pwm_detect_channels Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 229/374] pwm: stm32: Fix enable count for clk in .probe() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 230/374] ASoC: rt5645: Drop double EF20 entry from dmi_platform_data[] Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 231/374] ALSA: scarlett2: Add missing error check to scarlett2_config_save() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 232/374] ALSA: scarlett2: Add missing error check to scarlett2_usb_set_config() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 233/374] ALSA: scarlett2: Allow passing any output to line_out_remap() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 234/374] ALSA: scarlett2: Add missing error checks to *_ctl_get() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 235/374] ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 236/374] mmc: sdhci_am654: Fix TI SoC dependencies Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 237/374] mmc: sdhci_omap: " Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 238/374] IB/iser: Prevent invalidating wrong MR Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 239/374] drm/amd/pm/smu7: fix a memleak in smu7_hwmgr_backend_init Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 240/374] ksmbd: validate the zero field of packet header Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 241/374] of: Fix double free in of_parse_phandle_with_args_map Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 242/374] of: unittest: Fix of_count_phandle_with_args() expected value message Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 243/374] selftests/bpf: Add assert for user stacks in test_task_stack Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 244/374] keys, dns: Fix size check of V1 server-list header Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 245/374] binder: fix async space check for 0-sized buffers Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 246/374] binder: fix unused alloc->free_async_space Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 247/374] Input: atkbd - use ab83 as id when skipping the getid command Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 248/374] dma-mapping: Fix build error unused-value Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 249/374] virtio-crypto: fix memory leak in virtio_crypto_alg_skcipher_close_session() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 250/374] xen-netback: dont produce zero-size SKB frags Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 251/374] binder: fix race between mmput() and do_exit() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 252/374] tick-sched: Fix idle and iowait sleeptime accounting vs CPU hotplug Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 253/374] usb: phy: mxs: remove CONFIG_USB_OTG condition for mxs_phy_is_otg_host() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 254/374] usb: dwc: ep0: Update request status in dwc3_ep0_stall_restart Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 255/374] Revert "usb: dwc3: Soft reset phy on probe for host" Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 256/374] Revert "usb: dwc3: dont reset device side if dwc3 was configured as host-only" Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 257/374] usb: chipidea: wait controller resume finished for wakeup irq Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 258/374] usb: cdns3: fix uvc failure work since sg support enabled Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 259/374] usb: cdns3: fix iso transfer error when mult is not zero Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 260/374] usb: cdns3: Fix uvc fail when DMA cross 4k boundery since sg enabled Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 261/374] Revert "usb: typec: class: fix typec_altmode_put_partner to put plugs" Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 262/374] usb: typec: class: fix typec_altmode_put_partner to put plugs Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 263/374] usb: mon: Fix atomicity violation in mon_bin_vma_fault Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 264/374] serial: imx: Ensure that imx_uart_rs485_config() is called with enabled clock Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 265/374] ALSA: oxygen: Fix right channel of capture volume mixer Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 266/374] ALSA: hda/relatek: Enable Mute LED on HP Laptop 15s-fq2xxx Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 267/374] fbdev: flush deferred work in fb_deferred_io_fsync() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 268/374] scsi: mpi3mr: Refresh sdev queue depth after controller reset Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 269/374] block: add check that partition length needs to be aligned with block size Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 270/374] netfilter: nf_tables: check if catch-all set element is active in next generation Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 271/374] pwm: jz4740: Dont use dev_err_probe() in .request() Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 272/374] io_uring/rw: ensure io->bytes_done is always initialized Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 273/374] rootfs: Fix support for rootfstype= when root= is given Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 274/374] Bluetooth: Fix atomicity violation in {min,max}_key_size_set Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 275/374] bpf: Fix re-attachment branch in bpf_tracing_prog_attach Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 276/374] iommu/arm-smmu-qcom: Add missing GMU entry to match table Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 277/374] wifi: mt76: fix broken precal loading from MTD for mt7915 Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 278/374] wifi: rtlwifi: Remove bogus and dangerous ASPM disable/enable code Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 279/374] wifi: rtlwifi: Convert LNKCTL change to PCIe cap RMW accessors Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 280/374] wifi: mwifiex: configure BSSID consistently when starting AP Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 281/374] PCI: dwc: endpoint: Fix dw_pcie_ep_raise_msix_irq() alignment support Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 282/374] PCI: mediatek: Clear interrupt status before dispatching handler Greg Kroah-Hartman
2024-01-22 23:58 ` [PATCH 5.15 283/374] x86/kvm: Do not try to disable kvmclock if it was not enabled Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 284/374] KVM: arm64: vgic-v4: Restore pending state on host userspace write Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 285/374] KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 287/374] HID: wacom: Correct behavior when processing some confidence == false touches Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 289/374] serial: sc16is7xx: set safe default SPI clock frequency Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 290/374] iommu/dma: Trace bounce buffer usage when mapping buffers Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 291/374] ARM: 9330/1: davinci: also select PINCTRL Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 292/374] mfd: syscon: Fix null pointer dereference in of_syscon_register() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 293/374] leds: aw2013: Select missing dependency REGMAP_I2C Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 294/374] mfd: intel-lpss: Fix the fractional clock divider flags Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 295/374] mips: dmi: Fix early remap on MIPS32 Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 296/374] mips: Fix incorrect max_low_pfn adjustment Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 297/374] riscv: Check if the code to patch lies in the exit section Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 298/374] riscv: Fix module_alloc() that did not reset the linear mapping permissions Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 299/374] MIPS: Alchemy: Fix an out-of-bound access in db1200_dev_setup() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 300/374] MIPS: Alchemy: Fix an out-of-bound access in db1550_dev_setup() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 301/374] power: supply: cw2015: correct time_to_empty units in sysfs Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 302/374] power: supply: bq256xx: fix some problem in bq256xx_hw_init Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 303/374] serial: 8250: omap: Dont skip resource freeing if pm_runtime_resume_and_get() failed Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 304/374] libapi: Add missing linux/types.h header to get the __u64 type on io.h Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 305/374] usb: core: Allow subclassed USB drivers to override usb_choose_configuration() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 306/374] r8152: Choose our USB config with choose_configuration() rather than probe() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 307/374] software node: Let args be NULL in software_node_get_reference_args Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 308/374] serial: imx: fix tx statemachine deadlock Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 309/374] selftests/sgx: Fix uninitialized pointer dereference in error path Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 310/374] selftests/sgx: Skip non X86_64 platform Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 311/374] iio: adc: ad9467: Benefit from devm_clk_get_enabled() to simplify Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 312/374] iio: adc: ad9467: fix reset gpio handling Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 313/374] iio: adc: ad9467: dont ignore error codes Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 314/374] iio: adc: ad9467: fix scale setting Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 315/374] perf genelf: Set ELF program header addresses properly Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 316/374] tty: change tty_write_lock()s ndelay parameter to bool Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 317/374] tty: early return from send_break() on TTY_DRIVER_HARDWARE_BREAK Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 318/374] tty: dont check for signal_pending() in send_break() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 319/374] tty: use if in send_break() instead of goto Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 320/374] usb: cdc-acm: return correct error code on unsupported break Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 321/374] usb: core: Fix crash w/ usb_choose_configuration() if no driver Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 322/374] nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 323/374] nvmet-tcp: fix a crash in nvmet_req_complete() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 324/374] perf env: Avoid recursively taking env->bpf_progs.lock Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 325/374] apparmor: avoid crash when parsed profile name is empty Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 326/374] usb: xhci-mtk: fix a short packet issue of gen1 isoc-in transfer Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 327/374] serial: imx: Correct clock error message in function probe() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 328/374] nvmet: re-fix tracing strncpy() warning Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 329/374] nvmet-tcp: Fix the H2C expected PDU len calculation Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 330/374] PCI: keystone: Fix race condition when initializing PHYs Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 331/374] s390/pci: fix max size calculation in zpci_memcpy_toio() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 332/374] net: qualcomm: rmnet: fix global oob in rmnet_policy Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 333/374] net: ethernet: ti: am65-cpsw: Fix max mtu to fit ethernet frames Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 334/374] net: phy: micrel: populate .soft_reset for KSZ9131 Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 335/374] mptcp: mptcp_parse_option() fix for MPTCPOPT_MP_JOIN Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 336/374] mptcp: drop unused sk in mptcp_get_options Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 337/374] mptcp: strict validation before using mp_opt->hmac Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 338/374] mptcp: use OPTION_MPTCP_MPJ_SYNACK in subflow_finish_connect() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 339/374] mptcp: use OPTION_MPTCP_MPJ_SYN in subflow_check_req() Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 340/374] net: ravb: Fix dma_addr_t truncation in error case Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 341/374] net: stmmac: ethtool: Fixed calltrace caused by unbalanced disable_irq_wake calls Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 342/374] bpf: Reject variable offset alu on PTR_TO_FLOW_KEYS Greg Kroah-Hartman
2024-01-22 23:59 ` [PATCH 5.15 343/374] net: dsa: vsc73xx: Add null pointer check to vsc73xx_gpio_probe Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 344/374] netfilter: nf_tables: reject invalid set policy Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 345/374] netfilter: nft_connlimit: move stateful fields out of expression data Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 346/374] netfilter: nft_last: " Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 347/374] netfilter: nft_quota: " Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 348/374] netfilter: nft_limit: rename stateful structure Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 349/374] netfilter: nft_limit: move stateful fields out of expression data Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 350/374] netfilter: nf_tables: memcg accounting for dynamically allocated objects Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 351/374] netfilter: nft_limit: do not ignore unsupported flags Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 352/374] netfilter: nf_tables: do not allow mismatch field size and set key length Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 353/374] netfilter: nf_tables: skip dead set elements in netlink dump Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 354/374] netfilter: nf_tables: reject NFT_SET_CONCAT with not field length description Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 355/374] ipvs: avoid stat macros calls from preemptible context Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 356/374] kdb: Fix a potential buffer overflow in kdb_local() Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 357/374] ethtool: netlink: Add missing ethnl_ops_begin/complete Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 358/374] mlxsw: spectrum_acl_erp: Fix error flow of pool allocation failure Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 359/374] mlxsw: spectrum: Use bitmap_zalloc() when applicable Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 360/374] mlxsw: spectrum_acl_tcam: Add missing mutex_destroy() Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 361/374] mlxsw: spectrum_acl_tcam: Make fini symmetric to init Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 362/374] mlxsw: spectrum_acl_tcam: Reorder functions to avoid forward declarations Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 363/374] mlxsw: spectrum_acl_tcam: Fix stack corruption Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 364/374] selftests: mlxsw: qos_pfc: Adjust the test to support 8 lanes Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 365/374] ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 366/374] i2c: s3c24xx: fix read transfers in polling mode Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 367/374] i2c: s3c24xx: fix transferring more than one message " Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 368/374] block: Remove special-casing of compound pages Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 369/374] netfilter: nf_tables: typo NULL check in _clone() function Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 370/374] netfilter: nft_connlimit: memleak if nf_ct_netns_get() fails Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 371/374] netfilter: nft_limit: fix stateful object memory leak Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 372/374] netfilter: nft_limit: Clone packet limits cost value Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 373/374] netfilter: nft_last: copy content when cloning expression Greg Kroah-Hartman
2024-01-23 0:00 ` [PATCH 5.15 374/374] netfilter: nft_quota: " Greg Kroah-Hartman
2024-01-23 1:48 ` [PATCH 5.15 000/374] 5.15.148-rc1 review SeongJae Park
2024-01-23 15:35 ` Jon Hunter
2024-01-23 17:13 ` Greg Kroah-Hartman
2024-01-24 9:30 ` Harshit Mogalapalli
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).