* [PATCH 6.12 001/146] xfs: remove unknown compat feature check in superblock write validation
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 002/146] quota: flush quota_release_work upon quota writeback Greg Kroah-Hartman
` (152 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Long Li, Darrick J. Wong,
Christoph Hellwig, Carlos Maiolino, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Long Li <leo.lilong@huawei.com>
[ Upstream commit 652f03db897ba24f9c4b269e254ccc6cc01ff1b7 ]
Compat features are new features that older kernels can safely ignore,
allowing read-write mounts without issues. The current sb write validation
implementation returns -EFSCORRUPTED for unknown compat features,
preventing filesystem write operations and contradicting the feature's
definition.
Additionally, if the mounted image is unclean, the log recovery may need
to write to the superblock. Returning an error for unknown compat features
during sb write validation can cause mount failures.
Although XFS currently does not use compat feature flags, this issue
affects current kernels' ability to mount images that may use compat
feature flags in the future.
Since superblock read validation already warns about unknown compat
features, it's unnecessary to repeat this warning during write validation.
Therefore, the relevant code in write validation is being removed.
Fixes: 9e037cb7972f ("xfs: check for unknown v5 feature bits in superblock write verifier")
Cc: stable@vger.kernel.org # v4.19+
Signed-off-by: Long Li <leo.lilong@huawei.com>
Reviewed-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Carlos Maiolino <cem@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/xfs/libxfs/xfs_sb.c | 7 -------
1 file changed, 7 deletions(-)
diff --git a/fs/xfs/libxfs/xfs_sb.c b/fs/xfs/libxfs/xfs_sb.c
index d95409f3cba66..02ebcbc4882f5 100644
--- a/fs/xfs/libxfs/xfs_sb.c
+++ b/fs/xfs/libxfs/xfs_sb.c
@@ -297,13 +297,6 @@ xfs_validate_sb_write(
* the kernel cannot support since we checked for unsupported bits in
* the read verifier, which means that memory is corrupt.
*/
- if (xfs_sb_has_compat_feature(sbp, XFS_SB_FEAT_COMPAT_UNKNOWN)) {
- xfs_warn(mp,
-"Corruption detected in superblock compatible features (0x%x)!",
- (sbp->sb_features_compat & XFS_SB_FEAT_COMPAT_UNKNOWN));
- return -EFSCORRUPTED;
- }
-
if (!xfs_is_readonly(mp) &&
xfs_sb_has_ro_compat_feature(sbp, XFS_SB_FEAT_RO_COMPAT_UNKNOWN)) {
xfs_alert(mp,
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 002/146] quota: flush quota_release_work upon quota writeback
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 001/146] xfs: remove unknown compat feature check in superblock write validation Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 003/146] btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages() Greg Kroah-Hartman
` (151 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Disha Goel, Baokun Li, Ojaswin Mujoo,
Jan Kara, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ojaswin Mujoo <ojaswin@linux.ibm.com>
[ Upstream commit ac6f420291b3fee1113f21d612fa88b628afab5b ]
One of the paths quota writeback is called from is:
freeze_super()
sync_filesystem()
ext4_sync_fs()
dquot_writeback_dquots()
Since we currently don't always flush the quota_release_work queue in
this path, we can end up with the following race:
1. dquot are added to releasing_dquots list during regular operations.
2. FS Freeze starts, however, this does not flush the quota_release_work queue.
3. Freeze completes.
4. Kernel eventually tries to flush the workqueue while FS is frozen which
hits a WARN_ON since transaction gets started during frozen state:
ext4_journal_check_start+0x28/0x110 [ext4] (unreliable)
__ext4_journal_start_sb+0x64/0x1c0 [ext4]
ext4_release_dquot+0x90/0x1d0 [ext4]
quota_release_workfn+0x43c/0x4d0
Which is the following line:
WARN_ON(sb->s_writers.frozen == SB_FREEZE_COMPLETE);
Which ultimately results in generic/390 failing due to dmesg
noise. This was detected on powerpc machine 15 cores.
To avoid this, make sure to flush the workqueue during
dquot_writeback_dquots() so we dont have any pending workitems after
freeze.
Reported-by: Disha Goel <disgoel@linux.ibm.com>
CC: stable@vger.kernel.org
Fixes: dabc8b207566 ("quota: fix dqput() to follow the guarantees dquot_srcu should provide")
Reviewed-by: Baokun Li <libaokun1@huawei.com>
Signed-off-by: Ojaswin Mujoo <ojaswin@linux.ibm.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Link: https://patch.msgid.link/20241121123855.645335-2-ojaswin@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/quota/dquot.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index b40410cd39af4..71c0ce31a4c4d 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -689,6 +689,8 @@ int dquot_writeback_dquots(struct super_block *sb, int type)
WARN_ON_ONCE(!rwsem_is_locked(&sb->s_umount));
+ flush_delayed_work("a_release_work);
+
for (cnt = 0; cnt < MAXQUOTAS; cnt++) {
if (type != -1 && cnt != type)
continue;
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 003/146] btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 001/146] xfs: remove unknown compat feature check in superblock write validation Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 002/146] quota: flush quota_release_work upon quota writeback Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 004/146] btrfs: change btrfs_encoded_read() so that reading of extent is done by caller Greg Kroah-Hartman
` (150 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Anand Jain, David Sterba,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <dsterba@suse.com>
[ Upstream commit 590168edbe6317ca9f4066215fb099f43ffe745c ]
The file_offset parameter used to be passed to encoded read struct but
was removed in commit b665affe93d8 ("btrfs: remove unused members from
struct btrfs_encoded_read_private").
Reviewed-by: Anand Jain <anand.jain@oracle.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 05b36b04d74a ("btrfs: fix use-after-free in btrfs_encoded_read_endio()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/btrfs_inode.h | 3 +--
fs/btrfs/inode.c | 6 +++---
fs/btrfs/send.c | 2 +-
3 files changed, 5 insertions(+), 6 deletions(-)
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index e152fde888fc9..5e2d93c2dfb5a 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -613,8 +613,7 @@ int btrfs_writepage_cow_fixup(struct folio *folio);
int btrfs_encoded_io_compression_from_extent(struct btrfs_fs_info *fs_info,
int compress_type);
int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
- u64 file_offset, u64 disk_bytenr,
- u64 disk_io_size,
+ u64 disk_bytenr, u64 disk_io_size,
struct page **pages);
ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
struct btrfs_ioctl_encoded_io_args *encoded);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 1e4ca1e7d2e58..753e9cb0c3717 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9132,8 +9132,8 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio)
}
int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
- u64 file_offset, u64 disk_bytenr,
- u64 disk_io_size, struct page **pages)
+ u64 disk_bytenr, u64 disk_io_size,
+ struct page **pages)
{
struct btrfs_fs_info *fs_info = inode->root->fs_info;
struct btrfs_encoded_read_private priv = {
@@ -9203,7 +9203,7 @@ static ssize_t btrfs_encoded_read_regular(struct kiocb *iocb,
goto out;
}
- ret = btrfs_encoded_read_regular_fill_pages(inode, start, disk_bytenr,
+ ret = btrfs_encoded_read_regular_fill_pages(inode, disk_bytenr,
disk_io_size, pages);
if (ret)
goto out;
diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c
index b068469871f8e..0cb11dcd10cd4 100644
--- a/fs/btrfs/send.c
+++ b/fs/btrfs/send.c
@@ -5677,7 +5677,7 @@ static int send_encoded_extent(struct send_ctx *sctx, struct btrfs_path *path,
* Note that send_buf is a mapping of send_buf_pages, so this is really
* reading into send_buf.
*/
- ret = btrfs_encoded_read_regular_fill_pages(BTRFS_I(inode), offset,
+ ret = btrfs_encoded_read_regular_fill_pages(BTRFS_I(inode),
disk_bytenr, disk_num_bytes,
sctx->send_buf_pages +
(data_offset >> PAGE_SHIFT));
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 004/146] btrfs: change btrfs_encoded_read() so that reading of extent is done by caller
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 003/146] btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages() Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 005/146] btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages() Greg Kroah-Hartman
` (149 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Harmstone, David Sterba,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <maharmstone@fb.com>
[ Upstream commit 26efd44796c6dd7a64f039a0dda6d558eac97a3e ]
Change the behaviour of btrfs_encoded_read() so that if it needs to read
an extent from disk, it leaves the extent and inode locked and returns
-EIOCBQUEUED. The caller is then responsible for doing the I/O via
btrfs_encoded_read_regular() and unlocking the extent and inode.
Signed-off-by: Mark Harmstone <maharmstone@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 05b36b04d74a ("btrfs: fix use-after-free in btrfs_encoded_read_endio()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/btrfs_inode.h | 9 ++++++-
fs/btrfs/inode.c | 57 ++++++++++++++++++++----------------------
fs/btrfs/ioctl.c | 32 +++++++++++++++++++++++-
3 files changed, 66 insertions(+), 32 deletions(-)
diff --git a/fs/btrfs/btrfs_inode.h b/fs/btrfs/btrfs_inode.h
index 5e2d93c2dfb5a..db53a3263fbd0 100644
--- a/fs/btrfs/btrfs_inode.h
+++ b/fs/btrfs/btrfs_inode.h
@@ -616,7 +616,14 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
u64 disk_bytenr, u64 disk_io_size,
struct page **pages);
ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
- struct btrfs_ioctl_encoded_io_args *encoded);
+ struct btrfs_ioctl_encoded_io_args *encoded,
+ struct extent_state **cached_state,
+ u64 *disk_bytenr, u64 *disk_io_size);
+ssize_t btrfs_encoded_read_regular(struct kiocb *iocb, struct iov_iter *iter,
+ u64 start, u64 lockend,
+ struct extent_state **cached_state,
+ u64 disk_bytenr, u64 disk_io_size,
+ size_t count, bool compressed, bool *unlocked);
ssize_t btrfs_do_encoded_write(struct kiocb *iocb, struct iov_iter *from,
const struct btrfs_ioctl_encoded_io_args *encoded);
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 753e9cb0c3717..9c4f1a3742f3f 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9177,13 +9177,11 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
return blk_status_to_errno(READ_ONCE(priv.status));
}
-static ssize_t btrfs_encoded_read_regular(struct kiocb *iocb,
- struct iov_iter *iter,
- u64 start, u64 lockend,
- struct extent_state **cached_state,
- u64 disk_bytenr, u64 disk_io_size,
- size_t count, bool compressed,
- bool *unlocked)
+ssize_t btrfs_encoded_read_regular(struct kiocb *iocb, struct iov_iter *iter,
+ u64 start, u64 lockend,
+ struct extent_state **cached_state,
+ u64 disk_bytenr, u64 disk_io_size,
+ size_t count, bool compressed, bool *unlocked)
{
struct btrfs_inode *inode = BTRFS_I(file_inode(iocb->ki_filp));
struct extent_io_tree *io_tree = &inode->io_tree;
@@ -9244,15 +9242,16 @@ static ssize_t btrfs_encoded_read_regular(struct kiocb *iocb,
}
ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
- struct btrfs_ioctl_encoded_io_args *encoded)
+ struct btrfs_ioctl_encoded_io_args *encoded,
+ struct extent_state **cached_state,
+ u64 *disk_bytenr, u64 *disk_io_size)
{
struct btrfs_inode *inode = BTRFS_I(file_inode(iocb->ki_filp));
struct btrfs_fs_info *fs_info = inode->root->fs_info;
struct extent_io_tree *io_tree = &inode->io_tree;
ssize_t ret;
size_t count = iov_iter_count(iter);
- u64 start, lockend, disk_bytenr, disk_io_size;
- struct extent_state *cached_state = NULL;
+ u64 start, lockend;
struct extent_map *em;
bool unlocked = false;
@@ -9278,13 +9277,13 @@ ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
lockend - start + 1);
if (ret)
goto out_unlock_inode;
- lock_extent(io_tree, start, lockend, &cached_state);
+ lock_extent(io_tree, start, lockend, cached_state);
ordered = btrfs_lookup_ordered_range(inode, start,
lockend - start + 1);
if (!ordered)
break;
btrfs_put_ordered_extent(ordered);
- unlock_extent(io_tree, start, lockend, &cached_state);
+ unlock_extent(io_tree, start, lockend, cached_state);
cond_resched();
}
@@ -9304,7 +9303,7 @@ ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
free_extent_map(em);
em = NULL;
ret = btrfs_encoded_read_inline(iocb, iter, start, lockend,
- &cached_state, extent_start,
+ cached_state, extent_start,
count, encoded, &unlocked);
goto out;
}
@@ -9317,12 +9316,12 @@ ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
inode->vfs_inode.i_size) - iocb->ki_pos;
if (em->disk_bytenr == EXTENT_MAP_HOLE ||
(em->flags & EXTENT_FLAG_PREALLOC)) {
- disk_bytenr = EXTENT_MAP_HOLE;
+ *disk_bytenr = EXTENT_MAP_HOLE;
count = min_t(u64, count, encoded->len);
encoded->len = count;
encoded->unencoded_len = count;
} else if (extent_map_is_compressed(em)) {
- disk_bytenr = em->disk_bytenr;
+ *disk_bytenr = em->disk_bytenr;
/*
* Bail if the buffer isn't large enough to return the whole
* compressed extent.
@@ -9331,7 +9330,7 @@ ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
ret = -ENOBUFS;
goto out_em;
}
- disk_io_size = em->disk_num_bytes;
+ *disk_io_size = em->disk_num_bytes;
count = em->disk_num_bytes;
encoded->unencoded_len = em->ram_bytes;
encoded->unencoded_offset = iocb->ki_pos - (em->start - em->offset);
@@ -9341,35 +9340,32 @@ ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
goto out_em;
encoded->compression = ret;
} else {
- disk_bytenr = extent_map_block_start(em) + (start - em->start);
+ *disk_bytenr = extent_map_block_start(em) + (start - em->start);
if (encoded->len > count)
encoded->len = count;
/*
* Don't read beyond what we locked. This also limits the page
* allocations that we'll do.
*/
- disk_io_size = min(lockend + 1, iocb->ki_pos + encoded->len) - start;
- count = start + disk_io_size - iocb->ki_pos;
+ *disk_io_size = min(lockend + 1, iocb->ki_pos + encoded->len) - start;
+ count = start + *disk_io_size - iocb->ki_pos;
encoded->len = count;
encoded->unencoded_len = count;
- disk_io_size = ALIGN(disk_io_size, fs_info->sectorsize);
+ *disk_io_size = ALIGN(*disk_io_size, fs_info->sectorsize);
}
free_extent_map(em);
em = NULL;
- if (disk_bytenr == EXTENT_MAP_HOLE) {
- unlock_extent(io_tree, start, lockend, &cached_state);
+ if (*disk_bytenr == EXTENT_MAP_HOLE) {
+ unlock_extent(io_tree, start, lockend, cached_state);
btrfs_inode_unlock(inode, BTRFS_ILOCK_SHARED);
unlocked = true;
ret = iov_iter_zero(count, iter);
if (ret != count)
ret = -EFAULT;
} else {
- ret = btrfs_encoded_read_regular(iocb, iter, start, lockend,
- &cached_state, disk_bytenr,
- disk_io_size, count,
- encoded->compression,
- &unlocked);
+ ret = -EIOCBQUEUED;
+ goto out_em;
}
out:
@@ -9378,10 +9374,11 @@ ssize_t btrfs_encoded_read(struct kiocb *iocb, struct iov_iter *iter,
out_em:
free_extent_map(em);
out_unlock_extent:
- if (!unlocked)
- unlock_extent(io_tree, start, lockend, &cached_state);
+ /* Leave inode and extent locked if we need to do a read. */
+ if (!unlocked && ret != -EIOCBQUEUED)
+ unlock_extent(io_tree, start, lockend, cached_state);
out_unlock_inode:
- if (!unlocked)
+ if (!unlocked && ret != -EIOCBQUEUED)
btrfs_inode_unlock(inode, BTRFS_ILOCK_SHARED);
return ret;
}
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index 226c91fe31a70..3e3722a732393 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -4514,12 +4514,17 @@ static int btrfs_ioctl_encoded_read(struct file *file, void __user *argp,
size_t copy_end_kernel = offsetofend(struct btrfs_ioctl_encoded_io_args,
flags);
size_t copy_end;
+ struct btrfs_inode *inode = BTRFS_I(file_inode(file));
+ struct btrfs_fs_info *fs_info = inode->root->fs_info;
+ struct extent_io_tree *io_tree = &inode->io_tree;
struct iovec iovstack[UIO_FASTIOV];
struct iovec *iov = iovstack;
struct iov_iter iter;
loff_t pos;
struct kiocb kiocb;
ssize_t ret;
+ u64 disk_bytenr, disk_io_size;
+ struct extent_state *cached_state = NULL;
if (!capable(CAP_SYS_ADMIN)) {
ret = -EPERM;
@@ -4572,7 +4577,32 @@ static int btrfs_ioctl_encoded_read(struct file *file, void __user *argp,
init_sync_kiocb(&kiocb, file);
kiocb.ki_pos = pos;
- ret = btrfs_encoded_read(&kiocb, &iter, &args);
+ ret = btrfs_encoded_read(&kiocb, &iter, &args, &cached_state,
+ &disk_bytenr, &disk_io_size);
+
+ if (ret == -EIOCBQUEUED) {
+ bool unlocked = false;
+ u64 start, lockend, count;
+
+ start = ALIGN_DOWN(kiocb.ki_pos, fs_info->sectorsize);
+ lockend = start + BTRFS_MAX_UNCOMPRESSED - 1;
+
+ if (args.compression)
+ count = disk_io_size;
+ else
+ count = args.len;
+
+ ret = btrfs_encoded_read_regular(&kiocb, &iter, start, lockend,
+ &cached_state, disk_bytenr,
+ disk_io_size, count,
+ args.compression, &unlocked);
+
+ if (!unlocked) {
+ unlock_extent(io_tree, start, lockend, &cached_state);
+ btrfs_inode_unlock(inode, BTRFS_ILOCK_SHARED);
+ }
+ }
+
if (ret >= 0) {
fsnotify_access(file);
if (copy_to_user(argp + copy_end,
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 005/146] btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 004/146] btrfs: change btrfs_encoded_read() so that reading of extent is done by caller Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 006/146] btrfs: fix use-after-free in btrfs_encoded_read_endio() Greg Kroah-Hartman
` (148 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Harmstone, David Sterba,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mark Harmstone <maharmstone@fb.com>
[ Upstream commit 68d3b27e05c7ca5545e88465f5e2be6eda0e11df ]
Change btrfs_encoded_read_regular_fill_pages() so that the priv struct
is allocated rather than stored on the stack, in preparation for adding
an asynchronous mode to the function.
Signed-off-by: Mark Harmstone <maharmstone@fb.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Stable-dep-of: 05b36b04d74a ("btrfs: fix use-after-free in btrfs_encoded_read_endio()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/inode.c | 29 ++++++++++++++++++-----------
1 file changed, 18 insertions(+), 11 deletions(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 9c4f1a3742f3f..857cbe9b07d28 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9136,16 +9136,21 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
struct page **pages)
{
struct btrfs_fs_info *fs_info = inode->root->fs_info;
- struct btrfs_encoded_read_private priv = {
- .pending = ATOMIC_INIT(1),
- };
+ struct btrfs_encoded_read_private *priv;
unsigned long i = 0;
struct btrfs_bio *bbio;
+ int ret;
- init_waitqueue_head(&priv.wait);
+ priv = kmalloc(sizeof(struct btrfs_encoded_read_private), GFP_NOFS);
+ if (!priv)
+ return -ENOMEM;
+
+ init_waitqueue_head(&priv->wait);
+ atomic_set(&priv->pending, 1);
+ priv->status = 0;
bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info,
- btrfs_encoded_read_endio, &priv);
+ btrfs_encoded_read_endio, priv);
bbio->bio.bi_iter.bi_sector = disk_bytenr >> SECTOR_SHIFT;
bbio->inode = inode;
@@ -9153,11 +9158,11 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
size_t bytes = min_t(u64, disk_io_size, PAGE_SIZE);
if (bio_add_page(&bbio->bio, pages[i], bytes, 0) < bytes) {
- atomic_inc(&priv.pending);
+ atomic_inc(&priv->pending);
btrfs_submit_bbio(bbio, 0);
bbio = btrfs_bio_alloc(BIO_MAX_VECS, REQ_OP_READ, fs_info,
- btrfs_encoded_read_endio, &priv);
+ btrfs_encoded_read_endio, priv);
bbio->bio.bi_iter.bi_sector = disk_bytenr >> SECTOR_SHIFT;
bbio->inode = inode;
continue;
@@ -9168,13 +9173,15 @@ int btrfs_encoded_read_regular_fill_pages(struct btrfs_inode *inode,
disk_io_size -= bytes;
} while (disk_io_size);
- atomic_inc(&priv.pending);
+ atomic_inc(&priv->pending);
btrfs_submit_bbio(bbio, 0);
- if (atomic_dec_return(&priv.pending))
- io_wait_event(priv.wait, !atomic_read(&priv.pending));
+ if (atomic_dec_return(&priv->pending))
+ io_wait_event(priv->wait, !atomic_read(&priv->pending));
/* See btrfs_encoded_read_endio() for ordering. */
- return blk_status_to_errno(READ_ONCE(priv.status));
+ ret = blk_status_to_errno(READ_ONCE(priv->status));
+ kfree(priv);
+ return ret;
}
ssize_t btrfs_encoded_read_regular(struct kiocb *iocb, struct iov_iter *iter,
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 006/146] btrfs: fix use-after-free in btrfs_encoded_read_endio()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 005/146] btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages() Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 007/146] btrfs: dont loop for nowait writes when checking for cross references Greg Kroah-Hartman
` (147 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Shinichiro Kawasaki, Damien Le Moal,
Filipe Manana, Qu Wenruo, Johannes Thumshirn, David Sterba,
Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Thumshirn <johannes.thumshirn@wdc.com>
[ Upstream commit 05b36b04d74a517d6675bf2f90829ff1ac7e28dc ]
Shinichiro reported the following use-after free that sometimes is
happening in our CI system when running fstests' btrfs/284 on a TCMU
runner device:
BUG: KASAN: slab-use-after-free in lock_release+0x708/0x780
Read of size 8 at addr ffff888106a83f18 by task kworker/u80:6/219
CPU: 8 UID: 0 PID: 219 Comm: kworker/u80:6 Not tainted 6.12.0-rc6-kts+ #15
Hardware name: Supermicro Super Server/X11SPi-TF, BIOS 3.3 02/21/2020
Workqueue: btrfs-endio btrfs_end_bio_work [btrfs]
Call Trace:
<TASK>
dump_stack_lvl+0x6e/0xa0
? lock_release+0x708/0x780
print_report+0x174/0x505
? lock_release+0x708/0x780
? __virt_addr_valid+0x224/0x410
? lock_release+0x708/0x780
kasan_report+0xda/0x1b0
? lock_release+0x708/0x780
? __wake_up+0x44/0x60
lock_release+0x708/0x780
? __pfx_lock_release+0x10/0x10
? __pfx_do_raw_spin_lock+0x10/0x10
? lock_is_held_type+0x9a/0x110
_raw_spin_unlock_irqrestore+0x1f/0x60
__wake_up+0x44/0x60
btrfs_encoded_read_endio+0x14b/0x190 [btrfs]
btrfs_check_read_bio+0x8d9/0x1360 [btrfs]
? lock_release+0x1b0/0x780
? trace_lock_acquire+0x12f/0x1a0
? __pfx_btrfs_check_read_bio+0x10/0x10 [btrfs]
? process_one_work+0x7e3/0x1460
? lock_acquire+0x31/0xc0
? process_one_work+0x7e3/0x1460
process_one_work+0x85c/0x1460
? __pfx_process_one_work+0x10/0x10
? assign_work+0x16c/0x240
worker_thread+0x5e6/0xfc0
? __pfx_worker_thread+0x10/0x10
kthread+0x2c3/0x3a0
? __pfx_kthread+0x10/0x10
ret_from_fork+0x31/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Allocated by task 3661:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
btrfs_encoded_read_regular_fill_pages+0x16c/0x6d0 [btrfs]
send_extent_data+0xf0f/0x24a0 [btrfs]
process_extent+0x48a/0x1830 [btrfs]
changed_cb+0x178b/0x2ea0 [btrfs]
btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]
_btrfs_ioctl_send+0x117/0x330 [btrfs]
btrfs_ioctl+0x184a/0x60a0 [btrfs]
__x64_sys_ioctl+0x12e/0x1a0
do_syscall_64+0x95/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 3661:
kasan_save_stack+0x30/0x50
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x70
__kasan_slab_free+0x4f/0x70
kfree+0x143/0x490
btrfs_encoded_read_regular_fill_pages+0x531/0x6d0 [btrfs]
send_extent_data+0xf0f/0x24a0 [btrfs]
process_extent+0x48a/0x1830 [btrfs]
changed_cb+0x178b/0x2ea0 [btrfs]
btrfs_ioctl_send+0x3bf9/0x5c20 [btrfs]
_btrfs_ioctl_send+0x117/0x330 [btrfs]
btrfs_ioctl+0x184a/0x60a0 [btrfs]
__x64_sys_ioctl+0x12e/0x1a0
do_syscall_64+0x95/0x180
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff888106a83f00
which belongs to the cache kmalloc-rnd-07-96 of size 96
The buggy address is located 24 bytes inside of
freed 96-byte region [ffff888106a83f00, ffff888106a83f60)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888106a83800 pfn:0x106a83
flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
page_type: f5(slab)
raw: 0017ffffc0000000 ffff888100053680 ffffea0004917200 0000000000000004
raw: ffff888106a83800 0000000080200019 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888106a83e00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888106a83e80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
>ffff888106a83f00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
^
ffff888106a83f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888106a84000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Further analyzing the trace and the crash dump's vmcore file shows that
the wake_up() call in btrfs_encoded_read_endio() is calling wake_up() on
the wait_queue that is in the private data passed to the end_io handler.
Commit 4ff47df40447 ("btrfs: move priv off stack in
btrfs_encoded_read_regular_fill_pages()") moved 'struct
btrfs_encoded_read_private' off the stack.
Before that commit one can see a corruption of the private data when
analyzing the vmcore after a crash:
*(struct btrfs_encoded_read_private *)0xffff88815626eec8 = {
.wait = (wait_queue_head_t){
.lock = (spinlock_t){
.rlock = (struct raw_spinlock){
.raw_lock = (arch_spinlock_t){
.val = (atomic_t){
.counter = (int)-2005885696,
},
.locked = (u8)0,
.pending = (u8)157,
.locked_pending = (u16)40192,
.tail = (u16)34928,
},
.magic = (unsigned int)536325682,
.owner_cpu = (unsigned int)29,
.owner = (void *)__SCT__tp_func_btrfs_transaction_commit+0x0 = 0x0,
.dep_map = (struct lockdep_map){
.key = (struct lock_class_key *)0xffff8881575a3b6c,
.class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 },
.name = (const char *)0xffff88815626f100 = "",
.wait_type_outer = (u8)37,
.wait_type_inner = (u8)178,
.lock_type = (u8)154,
},
},
.__padding = (u8 [24]){ 0, 157, 112, 136, 50, 174, 247, 31, 29 },
.dep_map = (struct lockdep_map){
.key = (struct lock_class_key *)0xffff8881575a3b6c,
.class_cache = (struct lock_class *[2]){ 0xffff8882a71985c0, 0xffffea00066f5d40 },
.name = (const char *)0xffff88815626f100 = "",
.wait_type_outer = (u8)37,
.wait_type_inner = (u8)178,
.lock_type = (u8)154,
},
},
.head = (struct list_head){
.next = (struct list_head *)0x112cca,
.prev = (struct list_head *)0x47,
},
},
.pending = (atomic_t){
.counter = (int)-1491499288,
},
.status = (blk_status_t)130,
}
Here we can see several indicators of in-memory data corruption, e.g. the
large negative atomic values of ->pending or
->wait->lock->rlock->raw_lock->val, as well as the bogus spinlock magic
0x1ff7ae32 (decimal 536325682 above) instead of 0xdead4ead or the bogus
pointer values for ->wait->head.
To fix this, change atomic_dec_return() to atomic_dec_and_test() to fix the
corruption, as atomic_dec_return() is defined as two instructions on
x86_64, whereas atomic_dec_and_test() is defined as a single atomic
operation. This can lead to a situation where counter value is already
decremented but the if statement in btrfs_encoded_read_endio() is not
completely processed, i.e. the 0 test has not completed. If another thread
continues executing btrfs_encoded_read_regular_fill_pages() the
atomic_dec_return() there can see an already updated ->pending counter and
continues by freeing the private data. Continuing in the endio handler the
test for 0 succeeds and the wait_queue is woken up, resulting in a
use-after-free.
Reported-by: Shinichiro Kawasaki <shinichiro.kawasaki@wdc.com>
Suggested-by: Damien Le Moal <Damien.LeMoal@wdc.com>
Fixes: 1881fba89bd5 ("btrfs: add BTRFS_IOC_ENCODED_READ ioctl")
CC: stable@vger.kernel.org # 6.1+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: Qu Wenruo <wqu@suse.com>
Signed-off-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/inode.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 857cbe9b07d28..d067db2619713 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -9126,7 +9126,7 @@ static void btrfs_encoded_read_endio(struct btrfs_bio *bbio)
*/
WRITE_ONCE(priv->status, bbio->bio.bi_status);
}
- if (!atomic_dec_return(&priv->pending))
+ if (atomic_dec_and_test(&priv->pending))
wake_up(&priv->wait);
bio_put(&bbio->bio);
}
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 007/146] btrfs: dont loop for nowait writes when checking for cross references
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 006/146] btrfs: fix use-after-free in btrfs_encoded_read_endio() Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 008/146] btrfs: add a sanity check for btrfs root in btrfs_search_slot() Greg Kroah-Hartman
` (146 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josef Bacik, Filipe Manana,
David Sterba, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit ed67f2a913a4f0fc505db29805c41dd07d3cb356 ]
When checking for delayed refs when verifying if there are cross
references for a data extent, we stop if the path has nowait set and we
can't try lock the delayed ref head's mutex, returning -EAGAIN with the
goal of making a write fallback to a blocking context. However we ignore
the -EAGAIN at btrfs_cross_ref_exist() when check_delayed_ref() returns
it, and keep looping instead of immediately returning the -EAGAIN to the
caller.
Fix this by not looping if we get -EAGAIN and we have a nowait path.
Fixes: 26ce91144631 ("btrfs: make can_nocow_extent nowait compatible")
CC: stable@vger.kernel.org # 6.1+
Reviewed-by: Josef Bacik <josef@toxicpanda.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/extent-tree.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index d9f511babd89a..b43a8611aca5c 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -2446,7 +2446,7 @@ int btrfs_cross_ref_exist(struct btrfs_root *root, u64 objectid, u64 offset,
goto out;
ret = check_delayed_ref(root, path, objectid, offset, bytenr);
- } while (ret == -EAGAIN);
+ } while (ret == -EAGAIN && !path->nowait);
out:
btrfs_release_path(path);
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 008/146] btrfs: add a sanity check for btrfs root in btrfs_search_slot()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 007/146] btrfs: dont loop for nowait writes when checking for cross references Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 009/146] btrfs: ref-verify: fix use-after-free after invalid ref action Greg Kroah-Hartman
` (145 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+3030e17bd57a73d39bd7,
Qu Wenruo, Lizhi Xu, David Sterba, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lizhi Xu <lizhi.xu@windriver.com>
[ Upstream commit 3ed51857a50f530ac7a1482e069dfbd1298558d4 ]
Syzbot reports a null-ptr-deref in btrfs_search_slot().
The reproducer is using rescue=ibadroots, and the extent tree root is
corrupted thus the extent tree is NULL.
When scrub tries to search the extent tree to gather the needed extent
info, btrfs_search_slot() doesn't check if the target root is NULL or
not, resulting the null-ptr-deref.
Add sanity check for btrfs root before using it in btrfs_search_slot().
Reported-by: syzbot+3030e17bd57a73d39bd7@syzkaller.appspotmail.com
Fixes: 42437a6386ff ("btrfs: introduce mount option rescue=ignorebadroots")
Link: https://syzkaller.appspot.com/bug?extid=3030e17bd57a73d39bd7
CC: stable@vger.kernel.org # 5.15+
Reviewed-by: Qu Wenruo <wqu@suse.com>
Tested-by: syzbot+3030e17bd57a73d39bd7@syzkaller.appspotmail.com
Signed-off-by: Lizhi Xu <lizhi.xu@windriver.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ctree.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 0cc919d15b144..9c05cab473f57 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -2010,7 +2010,7 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
const struct btrfs_key *key, struct btrfs_path *p,
int ins_len, int cow)
{
- struct btrfs_fs_info *fs_info = root->fs_info;
+ struct btrfs_fs_info *fs_info;
struct extent_buffer *b;
int slot;
int ret;
@@ -2023,6 +2023,10 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root,
int min_write_lock_level;
int prev_cmp;
+ if (!root)
+ return -EINVAL;
+
+ fs_info = root->fs_info;
might_sleep();
lowest_level = p->lowest_level;
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 009/146] btrfs: ref-verify: fix use-after-free after invalid ref action
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 008/146] btrfs: add a sanity check for btrfs root in btrfs_search_slot() Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 010/146] iommu/tegra241-cmdqv: Fix unused variable warning Greg Kroah-Hartman
` (144 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+7325f164162e200000c1,
Johannes Thumshirn, Filipe Manana, David Sterba, Sasha Levin
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <fdmanana@suse.com>
[ Upstream commit 7c4e39f9d2af4abaf82ca0e315d1fd340456620f ]
At btrfs_ref_tree_mod() after we successfully inserted the new ref entry
(local variable 'ref') into the respective block entry's rbtree (local
variable 'be'), if we find an unexpected action of BTRFS_DROP_DELAYED_REF,
we error out and free the ref entry without removing it from the block
entry's rbtree. Then in the error path of btrfs_ref_tree_mod() we call
btrfs_free_ref_cache(), which iterates over all block entries and then
calls free_block_entry() for each one, and there we will trigger a
use-after-free when we are called against the block entry to which we
added the freed ref entry to its rbtree, since the rbtree still points
to the block entry, as we didn't remove it from the rbtree before freeing
it in the error path at btrfs_ref_tree_mod(). Fix this by removing the
new ref entry from the rbtree before freeing it.
Syzbot report this with the following stack traces:
BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_insert_empty_items+0x9c/0x1a0 fs/btrfs/ctree.c:4314
btrfs_insert_empty_item fs/btrfs/ctree.h:669 [inline]
btrfs_insert_orphan_item+0x1f1/0x320 fs/btrfs/orphan.c:23
btrfs_orphan_add+0x6d/0x1a0 fs/btrfs/inode.c:3482
btrfs_unlink+0x267/0x350 fs/btrfs/inode.c:4293
vfs_unlink+0x365/0x650 fs/namei.c:4469
do_unlinkat+0x4ae/0x830 fs/namei.c:4533
__do_sys_unlinkat fs/namei.c:4576 [inline]
__se_sys_unlinkat fs/namei.c:4569 [inline]
__x64_sys_unlinkat+0xcc/0xf0 fs/namei.c:4569
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
BTRFS error (device loop0 state EA): Ref action 1, root 5, ref_root 5, parent 0, owner 260, offset 0, num_refs 1
__btrfs_mod_ref+0x76b/0xac0 fs/btrfs/extent-tree.c:2521
update_ref_for_cow+0x96a/0x11f0
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
BTRFS error (device loop0 state EA): Ref action 2, root 5, ref_root 0, parent 8564736, owner 0, offset 0, num_refs 18446744073709551615
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
==================================================================
BUG: KASAN: slab-use-after-free in rb_first+0x69/0x70 lib/rbtree.c:473
Read of size 8 at addr ffff888042d1af38 by task syz.0.0/5329
CPU: 0 UID: 0 PID: 5329 Comm: syz.0.0 Not tainted 6.12.0-rc7-syzkaller #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
rb_first+0x69/0x70 lib/rbtree.c:473
free_block_entry+0x78/0x230 fs/btrfs/ref-verify.c:248
btrfs_free_ref_cache+0xa3/0x100 fs/btrfs/ref-verify.c:917
btrfs_ref_tree_mod+0x139f/0x15e0 fs/btrfs/ref-verify.c:898
btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f996df7e719
RSP: 002b:00007f996ede7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f996e135f80 RCX: 00007f996df7e719
RDX: 0000000020000180 RSI: 00000000c4009420 RDI: 0000000000000004
RBP: 00007f996dff139e R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f996e135f80 R15: 00007fff79f32e68
</TASK>
Allocated by task 5329:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
btrfs_ref_tree_mod+0x264/0x15e0 fs/btrfs/ref-verify.c:701
btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5329:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x59/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2342 [inline]
slab_free mm/slub.c:4579 [inline]
kfree+0x1a0/0x440 mm/slub.c:4727
btrfs_ref_tree_mod+0x136c/0x15e0
btrfs_free_extent+0x33c/0x380 fs/btrfs/extent-tree.c:3544
__btrfs_mod_ref+0x7dd/0xac0 fs/btrfs/extent-tree.c:2523
update_ref_for_cow+0x9cd/0x11f0 fs/btrfs/ctree.c:512
btrfs_force_cow_block+0x9f6/0x1da0 fs/btrfs/ctree.c:594
btrfs_cow_block+0x35e/0xa40 fs/btrfs/ctree.c:754
btrfs_search_slot+0xbdd/0x30d0 fs/btrfs/ctree.c:2116
btrfs_lookup_inode+0xdc/0x480 fs/btrfs/inode-item.c:411
__btrfs_update_delayed_inode+0x1e7/0xb90 fs/btrfs/delayed-inode.c:1030
btrfs_update_delayed_inode fs/btrfs/delayed-inode.c:1114 [inline]
__btrfs_commit_inode_delayed_items+0x2318/0x24a0 fs/btrfs/delayed-inode.c:1137
__btrfs_run_delayed_items+0x213/0x490 fs/btrfs/delayed-inode.c:1171
btrfs_commit_transaction+0x8a8/0x3740 fs/btrfs/transaction.c:2313
prepare_to_relocate+0x3c4/0x4c0 fs/btrfs/relocation.c:3586
relocate_block_group+0x16c/0xd40 fs/btrfs/relocation.c:3611
btrfs_relocate_block_group+0x77d/0xd90 fs/btrfs/relocation.c:4081
btrfs_relocate_chunk+0x12c/0x3b0 fs/btrfs/volumes.c:3377
__btrfs_balance+0x1b0f/0x26b0 fs/btrfs/volumes.c:4161
btrfs_balance+0xbdc/0x10c0 fs/btrfs/volumes.c:4538
btrfs_ioctl_balance+0x493/0x7c0 fs/btrfs/ioctl.c:3673
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0xf9/0x170 fs/ioctl.c:893
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888042d1af00
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 56 bytes inside of
freed 64-byte region [ffff888042d1af00, ffff888042d1af40)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x42d1a
anon flags: 0x4fff00000000000(node=1|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 04fff00000000000 ffff88801ac418c0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5055, tgid 5055 (dhcpcd-run-hook), ts 40377240074, free_ts 40376848335
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1541
prep_new_page mm/page_alloc.c:1549 [inline]
get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3459
__alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4735
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265
alloc_slab_page+0x6a/0x140 mm/slub.c:2412
allocate_slab+0x5a/0x2f0 mm/slub.c:2578
new_slab mm/slub.c:2631 [inline]
___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818
__slab_alloc+0x58/0xa0 mm/slub.c:3908
__slab_alloc_node mm/slub.c:3961 [inline]
slab_alloc_node mm/slub.c:4122 [inline]
__do_kmalloc_node mm/slub.c:4263 [inline]
__kmalloc_noprof+0x25a/0x400 mm/slub.c:4276
kmalloc_noprof include/linux/slab.h:882 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x26f/0x540 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x59e/0x5e0 security/tomoyo/realpath.c:283
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771
security_file_open+0x777/0x990 security/security.c:3109
do_dentry_open+0x369/0x1460 fs/open.c:945
vfs_open+0x3e/0x330 fs/open.c:1088
do_open fs/namei.c:3774 [inline]
path_openat+0x2c84/0x3590 fs/namei.c:3933
page last free pid 5055 tgid 5055 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1112 [inline]
free_unref_page+0xcfb/0xf20 mm/page_alloc.c:2642
free_pipe_info+0x300/0x390 fs/pipe.c:860
put_pipe_info fs/pipe.c:719 [inline]
pipe_release+0x245/0x320 fs/pipe.c:742
__fput+0x23f/0x880 fs/file_table.c:431
__do_sys_close fs/open.c:1567 [inline]
__se_sys_close fs/open.c:1552 [inline]
__x64_sys_close+0x7f/0x110 fs/open.c:1552
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888042d1ae00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888042d1ae80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
>ffff888042d1af00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888042d1af80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
ffff888042d1b000: 00 00 00 00 00 fc fc 00 00 00 00 00 fc fc 00 00
Reported-by: syzbot+7325f164162e200000c1@syzkaller.appspotmail.com
Link: https://lore.kernel.org/linux-btrfs/673723eb.050a0220.1324f8.00a8.GAE@google.com/T/#u
Fixes: fd708b81d972 ("Btrfs: add a extent ref verify tool")
CC: stable@vger.kernel.org # 4.19+
Reviewed-by: Johannes Thumshirn <johannes.thumshirn@wdc.com>
Signed-off-by: Filipe Manana <fdmanana@suse.com>
Reviewed-by: David Sterba <dsterba@suse.com>
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/ref-verify.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/fs/btrfs/ref-verify.c b/fs/btrfs/ref-verify.c
index 9522a8b79d22b..2928abf7eb827 100644
--- a/fs/btrfs/ref-verify.c
+++ b/fs/btrfs/ref-verify.c
@@ -857,6 +857,7 @@ int btrfs_ref_tree_mod(struct btrfs_fs_info *fs_info,
"dropping a ref for a root that doesn't have a ref on the block");
dump_block_entry(fs_info, be);
dump_ref_action(fs_info, ra);
+ rb_erase(&ref->node, &be->refs);
kfree(ref);
kfree(ra);
goto out_unlock;
--
2.43.0
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 010/146] iommu/tegra241-cmdqv: Fix unused variable warning
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 009/146] btrfs: ref-verify: fix use-after-free after invalid ref action Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 011/146] netkit: Add option for scrubbing skb meta data Greg Kroah-Hartman
` (143 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Will Deacon, Jiri Slaby
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Will Deacon <will@kernel.org>
commit 5492f0c4085a8fb8820ff974f17b83a7d6dab5a5 upstream.
While testing some io-pgtable changes, I ran into a compiler warning
from the Tegra CMDQ driver:
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c:803:23: warning: unused variable 'cmdqv_debugfs_dir' [-Wunused-variable]
803 | static struct dentry *cmdqv_debugfs_dir;
| ^~~~~~~~~~~~~~~~~
1 warning generated.
Guard the variable declaration with CONFIG_IOMMU_DEBUGFS to silence the
warning.
Signed-off-by: Will Deacon <will@kernel.org>
Cc: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -801,7 +801,9 @@ out_fallback:
return 0;
}
+#ifdef CONFIG_IOMMU_DEBUGFS
static struct dentry *cmdqv_debugfs_dir;
+#endif
static struct arm_smmu_device *
__tegra241_cmdqv_probe(struct arm_smmu_device *smmu, struct resource *res,
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 011/146] netkit: Add option for scrubbing skb meta data
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 010/146] iommu/tegra241-cmdqv: Fix unused variable warning Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 012/146] md/raid5: Wait sync io to finish before changing group cnt Greg Kroah-Hartman
` (142 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jordan Rife, Daniel Borkmann,
Nikolay Aleksandrov, Jakub Kicinski, Martin KaFai Lau
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <daniel@iogearbox.net>
commit 83134ef4609388f6b9ca31a384f531155196c2a7 upstream.
Jordan reported that when running Cilium with netkit in per-endpoint-routes
mode, network policy misclassifies traffic. In this direct routing mode
of Cilium which is used in case of GKE/EKS/AKS, the Pod's BPF program to
enforce policy sits on the netkit primary device's egress side.
The issue here is that in case of netkit's netkit_prep_forward(), it will
clear meta data such as skb->mark and skb->priority before executing the
BPF program. Thus, identity data stored in there from earlier BPF programs
(e.g. from tcx ingress on the physical device) gets cleared instead of
being made available for the primary's program to process. While for traffic
egressing the Pod via the peer device this might be desired, this is
different for the primary one where compared to tcx egress on the host
veth this information would be available.
To address this, add a new parameter for the device orchestration to
allow control of skb->mark and skb->priority scrubbing, to make the two
accessible from BPF (and eventually leave it up to the program to scrub).
By default, the current behavior is retained. For netkit peer this also
enables the use case where applications could cooperate/signal intent to
the BPF program.
Note that struct netkit has a 4 byte hole between policy and bundle which
is used here, in other words, struct netkit's first cacheline content used
in fast-path does not get moved around.
Fixes: 35dfaad7188c ("netkit, bpf: Add bpf programmable net device")
Reported-by: Jordan Rife <jrife@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://github.com/cilium/cilium/issues/34042
Acked-by: Jakub Kicinski <kuba@kernel.org>
Acked-by: Nikolay Aleksandrov <razor@blackwall.org>
Link: https://lore.kernel.org/r/20241004101335.117711-1-daniel@iogearbox.net
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/netkit.c | 68 ++++++++++++++++++++++++++++++++++---------
include/uapi/linux/if_link.h | 15 +++++++++
2 files changed, 70 insertions(+), 13 deletions(-)
--- a/drivers/net/netkit.c
+++ b/drivers/net/netkit.c
@@ -20,6 +20,7 @@ struct netkit {
struct net_device __rcu *peer;
struct bpf_mprog_entry __rcu *active;
enum netkit_action policy;
+ enum netkit_scrub scrub;
struct bpf_mprog_bundle bundle;
/* Needed in slow-path */
@@ -50,12 +51,24 @@ netkit_run(const struct bpf_mprog_entry
return ret;
}
-static void netkit_prep_forward(struct sk_buff *skb, bool xnet)
+static void netkit_xnet(struct sk_buff *skb)
{
- skb_scrub_packet(skb, xnet);
skb->priority = 0;
+ skb->mark = 0;
+}
+
+static void netkit_prep_forward(struct sk_buff *skb,
+ bool xnet, bool xnet_scrub)
+{
+ skb_scrub_packet(skb, false);
nf_skip_egress(skb, true);
skb_reset_mac_header(skb);
+ if (!xnet)
+ return;
+ ipvs_reset(skb);
+ skb_clear_tstamp(skb);
+ if (xnet_scrub)
+ netkit_xnet(skb);
}
static struct netkit *netkit_priv(const struct net_device *dev)
@@ -80,7 +93,8 @@ static netdev_tx_t netkit_xmit(struct sk
!pskb_may_pull(skb, ETH_HLEN) ||
skb_orphan_frags(skb, GFP_ATOMIC)))
goto drop;
- netkit_prep_forward(skb, !net_eq(dev_net(dev), dev_net(peer)));
+ netkit_prep_forward(skb, !net_eq(dev_net(dev), dev_net(peer)),
+ nk->scrub);
eth_skb_pkt_type(skb, peer);
skb->dev = peer;
entry = rcu_dereference(nk->active);
@@ -332,8 +346,10 @@ static int netkit_new_link(struct net *s
struct netlink_ext_ack *extack)
{
struct nlattr *peer_tb[IFLA_MAX + 1], **tbp = tb, *attr;
- enum netkit_action default_prim = NETKIT_PASS;
- enum netkit_action default_peer = NETKIT_PASS;
+ enum netkit_action policy_prim = NETKIT_PASS;
+ enum netkit_action policy_peer = NETKIT_PASS;
+ enum netkit_scrub scrub_prim = NETKIT_SCRUB_DEFAULT;
+ enum netkit_scrub scrub_peer = NETKIT_SCRUB_DEFAULT;
enum netkit_mode mode = NETKIT_L3;
unsigned char ifname_assign_type;
struct ifinfomsg *ifmp = NULL;
@@ -362,17 +378,21 @@ static int netkit_new_link(struct net *s
return err;
tbp = peer_tb;
}
+ if (data[IFLA_NETKIT_SCRUB])
+ scrub_prim = nla_get_u32(data[IFLA_NETKIT_SCRUB]);
+ if (data[IFLA_NETKIT_PEER_SCRUB])
+ scrub_peer = nla_get_u32(data[IFLA_NETKIT_PEER_SCRUB]);
if (data[IFLA_NETKIT_POLICY]) {
attr = data[IFLA_NETKIT_POLICY];
- default_prim = nla_get_u32(attr);
- err = netkit_check_policy(default_prim, attr, extack);
+ policy_prim = nla_get_u32(attr);
+ err = netkit_check_policy(policy_prim, attr, extack);
if (err < 0)
return err;
}
if (data[IFLA_NETKIT_PEER_POLICY]) {
attr = data[IFLA_NETKIT_PEER_POLICY];
- default_peer = nla_get_u32(attr);
- err = netkit_check_policy(default_peer, attr, extack);
+ policy_peer = nla_get_u32(attr);
+ err = netkit_check_policy(policy_peer, attr, extack);
if (err < 0)
return err;
}
@@ -409,7 +429,8 @@ static int netkit_new_link(struct net *s
nk = netkit_priv(peer);
nk->primary = false;
- nk->policy = default_peer;
+ nk->policy = policy_peer;
+ nk->scrub = scrub_peer;
nk->mode = mode;
bpf_mprog_bundle_init(&nk->bundle);
@@ -434,7 +455,8 @@ static int netkit_new_link(struct net *s
nk = netkit_priv(dev);
nk->primary = true;
- nk->policy = default_prim;
+ nk->policy = policy_prim;
+ nk->scrub = scrub_prim;
nk->mode = mode;
bpf_mprog_bundle_init(&nk->bundle);
@@ -874,6 +896,18 @@ static int netkit_change_link(struct net
return -EACCES;
}
+ if (data[IFLA_NETKIT_SCRUB]) {
+ NL_SET_ERR_MSG_ATTR(extack, data[IFLA_NETKIT_SCRUB],
+ "netkit scrubbing cannot be changed after device creation");
+ return -EACCES;
+ }
+
+ if (data[IFLA_NETKIT_PEER_SCRUB]) {
+ NL_SET_ERR_MSG_ATTR(extack, data[IFLA_NETKIT_PEER_SCRUB],
+ "netkit scrubbing cannot be changed after device creation");
+ return -EACCES;
+ }
+
if (data[IFLA_NETKIT_PEER_INFO]) {
NL_SET_ERR_MSG_ATTR(extack, data[IFLA_NETKIT_PEER_INFO],
"netkit peer info cannot be changed after device creation");
@@ -908,8 +942,10 @@ static size_t netkit_get_size(const stru
{
return nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_POLICY */
nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_PEER_POLICY */
- nla_total_size(sizeof(u8)) + /* IFLA_NETKIT_PRIMARY */
+ nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_SCRUB */
+ nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_PEER_SCRUB */
nla_total_size(sizeof(u32)) + /* IFLA_NETKIT_MODE */
+ nla_total_size(sizeof(u8)) + /* IFLA_NETKIT_PRIMARY */
0;
}
@@ -924,11 +960,15 @@ static int netkit_fill_info(struct sk_bu
return -EMSGSIZE;
if (nla_put_u32(skb, IFLA_NETKIT_MODE, nk->mode))
return -EMSGSIZE;
+ if (nla_put_u32(skb, IFLA_NETKIT_SCRUB, nk->scrub))
+ return -EMSGSIZE;
if (peer) {
nk = netkit_priv(peer);
if (nla_put_u32(skb, IFLA_NETKIT_PEER_POLICY, nk->policy))
return -EMSGSIZE;
+ if (nla_put_u32(skb, IFLA_NETKIT_PEER_SCRUB, nk->scrub))
+ return -EMSGSIZE;
}
return 0;
@@ -936,9 +976,11 @@ static int netkit_fill_info(struct sk_bu
static const struct nla_policy netkit_policy[IFLA_NETKIT_MAX + 1] = {
[IFLA_NETKIT_PEER_INFO] = { .len = sizeof(struct ifinfomsg) },
- [IFLA_NETKIT_POLICY] = { .type = NLA_U32 },
[IFLA_NETKIT_MODE] = { .type = NLA_U32 },
+ [IFLA_NETKIT_POLICY] = { .type = NLA_U32 },
[IFLA_NETKIT_PEER_POLICY] = { .type = NLA_U32 },
+ [IFLA_NETKIT_SCRUB] = NLA_POLICY_MAX(NLA_U32, NETKIT_SCRUB_DEFAULT),
+ [IFLA_NETKIT_PEER_SCRUB] = NLA_POLICY_MAX(NLA_U32, NETKIT_SCRUB_DEFAULT),
[IFLA_NETKIT_PRIMARY] = { .type = NLA_REJECT,
.reject_message = "Primary attribute is read-only" },
};
--- a/include/uapi/linux/if_link.h
+++ b/include/uapi/linux/if_link.h
@@ -1292,6 +1292,19 @@ enum netkit_mode {
NETKIT_L3,
};
+/* NETKIT_SCRUB_NONE leaves clearing skb->{mark,priority} up to
+ * the BPF program if attached. This also means the latter can
+ * consume the two fields if they were populated earlier.
+ *
+ * NETKIT_SCRUB_DEFAULT zeroes skb->{mark,priority} fields before
+ * invoking the attached BPF program when the peer device resides
+ * in a different network namespace. This is the default behavior.
+ */
+enum netkit_scrub {
+ NETKIT_SCRUB_NONE,
+ NETKIT_SCRUB_DEFAULT,
+};
+
enum {
IFLA_NETKIT_UNSPEC,
IFLA_NETKIT_PEER_INFO,
@@ -1299,6 +1312,8 @@ enum {
IFLA_NETKIT_POLICY,
IFLA_NETKIT_PEER_POLICY,
IFLA_NETKIT_MODE,
+ IFLA_NETKIT_SCRUB,
+ IFLA_NETKIT_PEER_SCRUB,
__IFLA_NETKIT_MAX,
};
#define IFLA_NETKIT_MAX (__IFLA_NETKIT_MAX - 1)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 012/146] md/raid5: Wait sync io to finish before changing group cnt
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 011/146] netkit: Add option for scrubbing skb meta data Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 013/146] md/md-bitmap: Add missing destroy_work_on_stack() Greg Kroah-Hartman
` (141 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Xiao Ni, Yu Kuai, Song Liu
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xiao Ni <xni@redhat.com>
commit fa1944bbe6220eb929e2c02e5e8706b908565711 upstream.
One customer reports a bug: raid5 is hung when changing thread cnt
while resync is running. The stripes are all in conf->handle_list
and new threads can't handle them.
Commit b39f35ebe86d ("md: don't quiesce in mddev_suspend()") removes
pers->quiesce from mddev_suspend/resume. Before this patch, mddev_suspend
needs to wait for all ios including sync io to finish. Now it's used
to only wait normal io.
Fix this by calling raid5_quiesce from raid5_store_group_thread_cnt
directly to wait all sync requests to finish before changing the group
cnt.
Fixes: b39f35ebe86d ("md: don't quiesce in mddev_suspend()")
Cc: stable@vger.kernel.org
Signed-off-by: Xiao Ni <xni@redhat.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20241106095124.74577-1-xni@redhat.com
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/raid5.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c
@@ -7177,6 +7177,8 @@ raid5_store_group_thread_cnt(struct mdde
err = mddev_suspend_and_lock(mddev);
if (err)
return err;
+ raid5_quiesce(mddev, true);
+
conf = mddev->private;
if (!conf)
err = -ENODEV;
@@ -7198,6 +7200,8 @@ raid5_store_group_thread_cnt(struct mdde
kfree(old_groups);
}
}
+
+ raid5_quiesce(mddev, false);
mddev_unlock_and_resume(mddev);
return err ?: len;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 013/146] md/md-bitmap: Add missing destroy_work_on_stack()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 012/146] md/raid5: Wait sync io to finish before changing group cnt Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 014/146] arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer Greg Kroah-Hartman
` (140 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuan Can, Yu Kuai, Song Liu
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <yuancan@huawei.com>
commit 6012169e8aae9c0eda38bbedcd7a1540a81220ae upstream.
This commit add missed destroy_work_on_stack() operations for
unplug_work.work in bitmap_unplug_async().
Fixes: a022325ab970 ("md/md-bitmap: add a new helper to unplug bitmap asynchrously")
Cc: stable@vger.kernel.org
Signed-off-by: Yuan Can <yuancan@huawei.com>
Reviewed-by: Yu Kuai <yukuai3@huawei.com>
Link: https://lore.kernel.org/r/20241105130105.127336-1-yuancan@huawei.com
Signed-off-by: Song Liu <song@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/md-bitmap.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/md-bitmap.c
+++ b/drivers/md/md-bitmap.c
@@ -1285,6 +1285,7 @@ static void bitmap_unplug_async(struct b
queue_work(md_bitmap_wq, &unplug_work.work);
wait_for_completion(&done);
+ destroy_work_on_stack(&unplug_work.work);
}
static void bitmap_unplug(struct mddev *mddev, bool sync)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 014/146] arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 013/146] md/md-bitmap: Add missing destroy_work_on_stack() Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 015/146] arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread Greg Kroah-Hartman
` (139 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Ondrej Jirman, Andrey Skvortsov,
Dragan Simic, Chen-Yu Tsai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dragan Simic <dsimic@manjaro.org>
commit 2496b2aaacf137250f4ca449f465e2cadaabb0e8 upstream.
The way InvenSense MPU-6050 accelerometer is mounted on the user-facing side
of the Pine64 PinePhone mainboard, which makes it rotated 90 degrees counter-
clockwise, [1] requires the accelerometer's x- and y-axis to be swapped, and
the direction of the accelerometer's y-axis to be inverted.
Rectify this by adding a mount-matrix to the accelerometer definition in the
Pine64 PinePhone dtsi file.
[1] https://files.pine64.org/doc/PinePhone/PinePhone%20mainboard%20bottom%20placement%20v1.1%2020191031.pdf
Fixes: 91f480d40942 ("arm64: dts: allwinner: Add initial support for Pine64 PinePhone")
Cc: stable@vger.kernel.org
Suggested-by: Ondrej Jirman <megi@xff.cz>
Suggested-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Signed-off-by: Dragan Simic <dsimic@manjaro.org>
Reviewed-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
Link: https://patch.msgid.link/129f0c754d071cca1db5d207d9d4a7bd9831dff7.1726773282.git.dsimic@manjaro.org
[wens@csie.org: Replaced Helped-by with Suggested-by]
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 +++
1 file changed, 3 insertions(+)
--- a/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
+++ b/arch/arm64/boot/dts/allwinner/sun50i-a64-pinephone.dtsi
@@ -212,6 +212,9 @@
interrupts = <7 5 IRQ_TYPE_EDGE_RISING>; /* PH5 */
vdd-supply = <®_dldo1>;
vddio-supply = <®_dldo1>;
+ mount-matrix = "0", "1", "0",
+ "-1", "0", "0",
+ "0", "0", "1";
};
};
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 015/146] arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 014/146] arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 016/146] arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay Greg Kroah-Hartman
` (138 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
commit 2f1aab0cb0661d533f008e4975325080351cdfc8 upstream.
The GPU SRAM supply is supposed to be always at least 0.1V higher than
the GPU supply. However when the DT was upstreamed, the spread was
incorrectly set to 0.01V.
Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://lore.kernel.org/r/20241021140537.3049232-1-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
index 0c0b3ac59745..eb06b343a540 100644
--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
@@ -1336,7 +1336,7 @@ mt6366_vgpu_reg: vgpu {
regulator-allowed-modes = <MT6397_BUCK_MODE_AUTO
MT6397_BUCK_MODE_FORCE_PWM>;
regulator-coupled-with = <&mt6366_vsram_gpu_reg>;
- regulator-coupled-max-spread = <10000>;
+ regulator-coupled-max-spread = <100000>;
};
mt6366_vproc11_reg: vproc11 {
@@ -1545,7 +1545,7 @@ mt6366_vsram_gpu_reg: vsram-gpu {
regulator-ramp-delay = <6250>;
regulator-enable-ramp-delay = <240>;
regulator-coupled-with = <&mt6366_vgpu_reg>;
- regulator-coupled-max-spread = <10000>;
+ regulator-coupled-max-spread = <100000>;
};
mt6366_vsram_others_reg: vsram-others {
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 016/146] arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 015/146] arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 017/146] arm64: dts: ti: k3-am62-verdin: " Greg Kroah-Hartman
` (137 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Shawn Guo
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
commit 0ca7699c376743b633b6419a42888dba386d5351 upstream.
The power switch used to power the SD card interface might have
more than 2ms turn-on time, increase the startup delay to 20ms to
prevent failures.
Fixes: 6a57f224f734 ("arm64: dts: freescale: add initial support for verdin imx8m mini")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi
@@ -162,7 +162,7 @@
regulator-max-microvolt = <3300000>;
regulator-min-microvolt = <3300000>;
regulator-name = "+V3.3_SD";
- startup-delay-us = <2000>;
+ startup-delay-us = <20000>;
};
reserved-memory {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 017/146] arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 016/146] arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 018/146] arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity Greg Kroah-Hartman
` (136 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Francesco Dolcini,
Vignesh Raghavendra
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
commit 2213ca51998fef61d3df4ca156054cdcc37c42b8 upstream.
The power switch used to power the SD card interface might have
more than 2ms turn-on time, increase the startup delay to 20ms to
prevent failures.
Fixes: 316b80246b16 ("arm64: dts: ti: add verdin am62")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Link: https://lore.kernel.org/r/20241024130628.49650-1-francesco@dolcini.it
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
+++ b/arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi
@@ -160,7 +160,7 @@
regulator-max-microvolt = <3300000>;
regulator-min-microvolt = <3300000>;
regulator-name = "+V3.3_SD";
- startup-delay-us = <2000>;
+ startup-delay-us = <20000>;
};
reg_sdhc1_vqmmc: regulator-sdhci1-vqmmc {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 018/146] arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 017/146] arm64: dts: ti: k3-am62-verdin: " Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 019/146] media: qcom: camss: fix error path on configuration of power domains Greg Kroah-Hartman
` (135 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Chen-Yu Tsai,
AngeloGioacchino Del Regno
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
commit fbcc95fceb6d179dd150df2dc613dfd9b013052c upstream.
The reset line of the IT6505 bridge chip is active low, not active high.
It was incorrectly inverted in the device tree as the implementation at
the time incorrectly inverted the polarity in its driver, due to a prior
device having an inline inverting level shifter.
Fix the polarity now while the external display pipeline is incomplete,
thereby avoiding any impact to running systems.
A matching fix for the driver should be included if this change is
backported.
Fixes: 8855d01fb81f ("arm64: dts: mediatek: Add MT8186 Krabby platform based Tentacruel / Tentacool")
Cc: stable@vger.kernel.org
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Link: https://lore.kernel.org/r/20241029100226.660263-1-wenst@chromium.org
Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
+++ b/arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi
@@ -423,7 +423,7 @@
#sound-dai-cells = <0>;
ovdd-supply = <&mt6366_vsim2_reg>;
pwr18-supply = <&pp1800_dpbrdg_dx>;
- reset-gpios = <&pio 177 GPIO_ACTIVE_HIGH>;
+ reset-gpios = <&pio 177 GPIO_ACTIVE_LOW>;
ports {
#address-cells = <1>;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 019/146] media: qcom: camss: fix error path on configuration of power domains
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 018/146] arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 020/146] media: amphion: Set video drvdata before register video device Greg Kroah-Hartman
` (134 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Vladimir Zapolskiy, Bryan ODonoghue,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
commit 4f45d65b781499d2a79eca12155532739c876aa2 upstream.
There is a chance to meet runtime issues during configuration of CAMSS
power domains, because on the error path dev_pm_domain_detach() is
unexpectedly called with NULL or error pointer.
One of the simplest ways to reproduce the problem is to probe CAMSS
driver before registration of CAMSS power domains, for instance if
a platform CAMCC driver is simply not built.
Warning backtrace example:
Unable to handle kernel NULL pointer dereference at virtual address 00000000000001a2
<snip>
pc : dev_pm_domain_detach+0x8/0x48
lr : camss_probe+0x374/0x9c0
<snip>
Call trace:
dev_pm_domain_detach+0x8/0x48
platform_probe+0x70/0xf0
really_probe+0xc4/0x2a8
__driver_probe_device+0x80/0x140
driver_probe_device+0x48/0x170
__device_attach_driver+0xc0/0x148
bus_for_each_drv+0x88/0xf0
__device_attach+0xb0/0x1c0
device_initial_probe+0x1c/0x30
bus_probe_device+0xb4/0xc0
deferred_probe_work_func+0x90/0xd0
process_one_work+0x164/0x3e0
worker_thread+0x310/0x420
kthread+0x120/0x130
ret_from_fork+0x10/0x20
Fixes: 23aa4f0cd327 ("media: qcom: camss: Move VFE power-domain specifics into vfe.c")
Cc: <stable@vger.kernel.org>
Signed-off-by: Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/camss/camss.c | 19 ++++++++-----------
1 file changed, 8 insertions(+), 11 deletions(-)
--- a/drivers/media/platform/qcom/camss/camss.c
+++ b/drivers/media/platform/qcom/camss/camss.c
@@ -2130,10 +2130,8 @@ static int camss_configure_pd(struct cam
if (camss->res->pd_name) {
camss->genpd = dev_pm_domain_attach_by_name(camss->dev,
camss->res->pd_name);
- if (IS_ERR(camss->genpd)) {
- ret = PTR_ERR(camss->genpd);
- goto fail_pm;
- }
+ if (IS_ERR(camss->genpd))
+ return PTR_ERR(camss->genpd);
}
if (!camss->genpd) {
@@ -2143,14 +2141,13 @@ static int camss_configure_pd(struct cam
*/
camss->genpd = dev_pm_domain_attach_by_id(camss->dev,
camss->genpd_num - 1);
+ if (IS_ERR(camss->genpd))
+ return PTR_ERR(camss->genpd);
}
- if (IS_ERR_OR_NULL(camss->genpd)) {
- if (!camss->genpd)
- ret = -ENODEV;
- else
- ret = PTR_ERR(camss->genpd);
- goto fail_pm;
- }
+
+ if (!camss->genpd)
+ return -ENODEV;
+
camss->genpd_link = device_link_add(camss->dev, camss->genpd,
DL_FLAG_STATELESS | DL_FLAG_PM_RUNTIME |
DL_FLAG_RPM_ACTIVE);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 020/146] media: amphion: Set video drvdata before register video device
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 019/146] media: qcom: camss: fix error path on configuration of power domains Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 021/146] media: imx-jpeg: " Greg Kroah-Hartman
` (133 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Qian, TaoJiang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <ming.qian@nxp.com>
commit 8cbb1a7bd5973b57898b26eb804fe44af440bb63 upstream.
The video drvdata should be set before the video device is registered,
otherwise video_drvdata() may return NULL in the open() file ops, and led
to oops.
Fixes: 3cd084519c6f ("media: amphion: add vpu v4l2 m2m support")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Reviewed-by: TaoJiang <tao.jiang_2@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/amphion/vpu_v4l2.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/amphion/vpu_v4l2.c
+++ b/drivers/media/platform/amphion/vpu_v4l2.c
@@ -841,6 +841,7 @@ int vpu_add_func(struct vpu_dev *vpu, st
vfd->fops = vdec_get_fops();
vfd->ioctl_ops = vdec_get_ioctl_ops();
}
+ video_set_drvdata(vfd, vpu);
ret = video_register_device(vfd, VFL_TYPE_VIDEO, -1);
if (ret) {
@@ -848,7 +849,6 @@ int vpu_add_func(struct vpu_dev *vpu, st
v4l2_m2m_release(func->m2m_dev);
return ret;
}
- video_set_drvdata(vfd, vpu);
func->vfd = vfd;
ret = v4l2_m2m_register_media_controller(func->m2m_dev, func->vfd, func->function);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 021/146] media: imx-jpeg: Set video drvdata before register video device
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 020/146] media: amphion: Set video drvdata before register video device Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 022/146] media: mtk-jpeg: Fix null-ptr-deref during unload module Greg Kroah-Hartman
` (132 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Qian, TaoJiang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <ming.qian@nxp.com>
commit d2b7ecc26bd5406d5ba927be1748aa99c568696c upstream.
The video drvdata should be set before the video device is registered,
otherwise video_drvdata() may return NULL in the open() file ops, and led
to oops.
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Reviewed-by: TaoJiang <tao.jiang_2@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -2842,6 +2842,7 @@ static int mxc_jpeg_probe(struct platfor
jpeg->dec_vdev->vfl_dir = VFL_DIR_M2M;
jpeg->dec_vdev->device_caps = V4L2_CAP_STREAMING |
V4L2_CAP_VIDEO_M2M_MPLANE;
+ video_set_drvdata(jpeg->dec_vdev, jpeg);
if (mode == MXC_JPEG_ENCODE) {
v4l2_disable_ioctl(jpeg->dec_vdev, VIDIOC_DECODER_CMD);
v4l2_disable_ioctl(jpeg->dec_vdev, VIDIOC_TRY_DECODER_CMD);
@@ -2854,7 +2855,6 @@ static int mxc_jpeg_probe(struct platfor
dev_err(dev, "failed to register video device\n");
goto err_vdev_register;
}
- video_set_drvdata(jpeg->dec_vdev, jpeg);
if (mode == MXC_JPEG_ENCODE)
v4l2_info(&jpeg->v4l2_dev,
"encoder device registered as /dev/video%d (%d,%d)\n",
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 022/146] media: mtk-jpeg: Fix null-ptr-deref during unload module
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 021/146] media: imx-jpeg: " Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 023/146] media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled Greg Kroah-Hartman
` (131 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Guoqing Jiang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Guoqing Jiang <guoqing.jiang@canonical.com>
commit 17af2b39daf12870cac61ffc360e62bc35798afb upstream.
The workqueue should be destroyed in mtk_jpeg_core.c since commit
09aea13ecf6f ("media: mtk-jpeg: refactor some variables"), otherwise
the below calltrace can be easily triggered.
[ 677.862514] Unable to handle kernel paging request at virtual address dfff800000000023
[ 677.863633] KASAN: null-ptr-deref in range [0x0000000000000118-0x000000000000011f]
...
[ 677.879654] CPU: 6 PID: 1071 Comm: modprobe Tainted: G O 6.8.12-mtk+gfa1a78e5d24b+ #17
...
[ 677.882838] pc : destroy_workqueue+0x3c/0x770
[ 677.883413] lr : mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
[ 677.884314] sp : ffff80008ad974f0
[ 677.884744] x29: ffff80008ad974f0 x28: ffff0000d7115580 x27: ffff0000dd691070
[ 677.885669] x26: ffff0000dd691408 x25: ffff8000844af3e0 x24: ffff80008ad97690
[ 677.886592] x23: ffff0000e051d400 x22: ffff0000dd691010 x21: dfff800000000000
[ 677.887515] x20: 0000000000000000 x19: 0000000000000000 x18: ffff800085397ac0
[ 677.888438] x17: 0000000000000000 x16: ffff8000801b87c8 x15: 1ffff000115b2e10
[ 677.889361] x14: 00000000f1f1f1f1 x13: 0000000000000000 x12: ffff7000115b2e4d
[ 677.890285] x11: 1ffff000115b2e4c x10: ffff7000115b2e4c x9 : ffff80000aa43e90
[ 677.891208] x8 : 00008fffeea4d1b4 x7 : ffff80008ad97267 x6 : 0000000000000001
[ 677.892131] x5 : ffff80008ad97260 x4 : ffff7000115b2e4d x3 : 0000000000000000
[ 677.893054] x2 : 0000000000000023 x1 : dfff800000000000 x0 : 0000000000000118
[ 677.893977] Call trace:
[ 677.894297] destroy_workqueue+0x3c/0x770
[ 677.894826] mtk_jpegdec_destroy_workqueue+0x70/0x88 [mtk_jpeg_dec_hw]
[ 677.895677] devm_action_release+0x50/0x90
[ 677.896211] release_nodes+0xe8/0x170
[ 677.896688] devres_release_all+0xf8/0x178
[ 677.897219] device_unbind_cleanup+0x24/0x170
[ 677.897785] device_release_driver_internal+0x35c/0x480
[ 677.898461] device_release_driver+0x20/0x38
...
[ 677.912665] ---[ end trace 0000000000000000 ]---
Fixes: 09aea13ecf6f ("media: mtk-jpeg: refactor some variables")
Cc: <stable@vger.kernel.org>
Signed-off-by: Guoqing Jiang <guoqing.jiang@canonical.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++++++++++
drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 -----------
2 files changed, 10 insertions(+), 11 deletions(-)
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_core.c
@@ -1293,6 +1293,11 @@ static int mtk_jpeg_single_core_init(str
return 0;
}
+static void mtk_jpeg_destroy_workqueue(void *data)
+{
+ destroy_workqueue(data);
+}
+
static int mtk_jpeg_probe(struct platform_device *pdev)
{
struct mtk_jpeg_dev *jpeg;
@@ -1337,6 +1342,11 @@ static int mtk_jpeg_probe(struct platfor
| WQ_FREEZABLE);
if (!jpeg->workqueue)
return -EINVAL;
+ ret = devm_add_action_or_reset(&pdev->dev,
+ mtk_jpeg_destroy_workqueue,
+ jpeg->workqueue);
+ if (ret)
+ return ret;
}
ret = v4l2_device_register(&pdev->dev, &jpeg->v4l2_dev);
--- a/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
+++ b/drivers/media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c
@@ -578,11 +578,6 @@ static int mtk_jpegdec_hw_init_irq(struc
return 0;
}
-static void mtk_jpegdec_destroy_workqueue(void *data)
-{
- destroy_workqueue(data);
-}
-
static int mtk_jpegdec_hw_probe(struct platform_device *pdev)
{
struct mtk_jpegdec_clk *jpegdec_clk;
@@ -606,12 +601,6 @@ static int mtk_jpegdec_hw_probe(struct p
dev->plat_dev = pdev;
dev->dev = &pdev->dev;
- ret = devm_add_action_or_reset(&pdev->dev,
- mtk_jpegdec_destroy_workqueue,
- master_dev->workqueue);
- if (ret)
- return ret;
-
spin_lock_init(&dev->hw_lock);
dev->hw_state = MTK_JPEG_HW_IDLE;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 023/146] media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 022/146] media: mtk-jpeg: Fix null-ptr-deref during unload module Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 024/146] arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay Greg Kroah-Hartman
` (130 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sakari Ailus, Jinjie Ruan,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit d6594d50761728d09f23238cf9c368bab6260ef3 upstream.
It is not valid to call pm_runtime_set_suspended() and
pm_runtime_set_active() for devices with runtime PM enabled because it
returns -EAGAIN if it is enabled already and working. So, adjust the
order to fix it.
Cc: stable@vger.kernel.org
Fixes: 5f9a089b6de3 ("dw9768: Enable low-power probe on ACPI")
Suggested-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/dw9768.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/dw9768.c
+++ b/drivers/media/i2c/dw9768.c
@@ -471,10 +471,9 @@ static int dw9768_probe(struct i2c_clien
* to be powered on in an ACPI system. Similarly for power off in
* remove.
*/
- pm_runtime_enable(dev);
full_power = (is_acpi_node(dev_fwnode(dev)) &&
acpi_dev_state_d0(dev)) ||
- (is_of_node(dev_fwnode(dev)) && !pm_runtime_enabled(dev));
+ (is_of_node(dev_fwnode(dev)) && !IS_ENABLED(CONFIG_PM));
if (full_power) {
ret = dw9768_runtime_resume(dev);
if (ret < 0) {
@@ -484,6 +483,7 @@ static int dw9768_probe(struct i2c_clien
pm_runtime_set_active(dev);
}
+ pm_runtime_enable(dev);
ret = v4l2_async_register_subdev(&dw9768->sd);
if (ret < 0) {
dev_err(dev, "failed to register V4L2 subdev: %d", ret);
@@ -495,12 +495,12 @@ static int dw9768_probe(struct i2c_clien
return 0;
err_power_off:
+ pm_runtime_disable(dev);
if (full_power) {
dw9768_runtime_suspend(dev);
pm_runtime_set_suspended(dev);
}
err_clean_entity:
- pm_runtime_disable(dev);
media_entity_cleanup(&dw9768->sd.entity);
err_free_handler:
v4l2_ctrl_handler_free(&dw9768->ctrls);
@@ -517,12 +517,12 @@ static void dw9768_remove(struct i2c_cli
v4l2_async_unregister_subdev(&dw9768->sd);
v4l2_ctrl_handler_free(&dw9768->ctrls);
media_entity_cleanup(&dw9768->sd.entity);
+ pm_runtime_disable(dev);
if ((is_acpi_node(dev_fwnode(dev)) && acpi_dev_state_d0(dev)) ||
- (is_of_node(dev_fwnode(dev)) && !pm_runtime_enabled(dev))) {
+ (is_of_node(dev_fwnode(dev)) && !IS_ENABLED(CONFIG_PM))) {
dw9768_runtime_suspend(dev);
pm_runtime_set_suspended(dev);
}
- pm_runtime_disable(dev);
}
static const struct of_device_id dw9768_of_table[] = {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 024/146] arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 023/146] media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 025/146] media: i2c: tc358743: Fix crash in the probe error path when using polling Greg Kroah-Hartman
` (129 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Shawn Guo
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
commit 6c5789c9d2c06968532243daa235f6ff809ad71e upstream.
The power switch used to power the SD card interface might have
more than 2ms turn-on time, increase the startup delay to 20ms to
prevent failures.
Fixes: a39ed23bdf6e ("arm64: dts: freescale: add initial support for verdin imx8m plus")
Cc: stable@vger.kernel.org
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Signed-off-by: Shawn Guo <shawnguo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi
+++ b/arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi
@@ -175,7 +175,7 @@
regulator-max-microvolt = <3300000>;
regulator-min-microvolt = <3300000>;
regulator-name = "+V3.3_SD";
- startup-delay-us = <2000>;
+ startup-delay-us = <20000>;
};
reserved-memory {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 025/146] media: i2c: tc358743: Fix crash in the probe error path when using polling
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 024/146] arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 026/146] media: imx-jpeg: Ensure power suppliers be suspended before detach them Greg Kroah-Hartman
` (128 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alexander Shiyan, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <eagle.alexander923@gmail.com>
commit 869f38ae07f7df829da4951c3d1f7a2be09c2e9a upstream.
If an error occurs in the probe() function, we should remove the polling
timer that was alarmed earlier, otherwise the timer is called with
arguments that are already freed, which results in a crash.
------------[ cut here ]------------
WARNING: CPU: 3 PID: 0 at kernel/time/timer.c:1830 __run_timers+0x244/0x268
Modules linked in:
CPU: 3 UID: 0 PID: 0 Comm: swapper/3 Not tainted 6.11.0 #226
Hardware name: Diasom DS-RK3568-SOM-EVB (DT)
pstate: 804000c9 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __run_timers+0x244/0x268
lr : __run_timers+0x1d4/0x268
sp : ffffff80eff2baf0
x29: ffffff80eff2bb50 x28: 7fffffffffffffff x27: ffffff80eff2bb00
x26: ffffffc080f669c0 x25: ffffff80efef6bf0 x24: ffffff80eff2bb00
x23: 0000000000000000 x22: dead000000000122 x21: 0000000000000000
x20: ffffff80efef6b80 x19: ffffff80041c8bf8 x18: ffffffffffffffff
x17: ffffffc06f146000 x16: ffffff80eff27dc0 x15: 000000000000003e
x14: 0000000000000000 x13: 00000000000054da x12: 0000000000000000
x11: 00000000000639c0 x10: 000000000000000c x9 : 0000000000000009
x8 : ffffff80eff2cb40 x7 : ffffff80eff2cb40 x6 : ffffff8002bee480
x5 : ffffffc080cb2220 x4 : ffffffc080cb2150 x3 : 00000000000f4240
x2 : 0000000000000102 x1 : ffffff80eff2bb00 x0 : ffffff80041c8bf0
Call trace:
__run_timers+0x244/0x268
timer_expire_remote+0x50/0x68
tmigr_handle_remote+0x388/0x39c
run_timer_softirq+0x38/0x44
handle_softirqs+0x138/0x298
__do_softirq+0x14/0x20
____do_softirq+0x10/0x1c
call_on_irq_stack+0x24/0x4c
do_softirq_own_stack+0x1c/0x2c
irq_exit_rcu+0x9c/0xcc
el1_interrupt+0x48/0xc0
el1h_64_irq_handler+0x18/0x24
el1h_64_irq+0x7c/0x80
default_idle_call+0x34/0x68
do_idle+0x23c/0x294
cpu_startup_entry+0x38/0x3c
secondary_start_kernel+0x128/0x160
__secondary_switched+0xb8/0xbc
---[ end trace 0000000000000000 ]---
Fixes: 4e66a52a2e4c ("[media] tc358743: Add support for platforms without IRQ line")
Signed-off-by: Alexander Shiyan <eagle.alexander923@gmail.com>
Cc: stable@vger.kernel.org
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/tc358743.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/i2c/tc358743.c
+++ b/drivers/media/i2c/tc358743.c
@@ -2168,8 +2168,10 @@ static int tc358743_probe(struct i2c_cli
err_work_queues:
cec_unregister_adapter(state->cec_adap);
- if (!state->i2c_client->irq)
+ if (!state->i2c_client->irq) {
+ del_timer(&state->timer);
flush_work(&state->work_i2c_poll);
+ }
cancel_delayed_work(&state->delayed_work_enable_hotplug);
mutex_destroy(&state->confctl_mutex);
err_hdl:
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 026/146] media: imx-jpeg: Ensure power suppliers be suspended before detach them
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 025/146] media: i2c: tc358743: Fix crash in the probe error path when using polling Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 027/146] media: platform: rga: fix 32-bit DMA limitation Greg Kroah-Hartman
` (127 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ming Qian, TaoJiang, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Qian <ming.qian@nxp.com>
commit fd0af4cd35da0eb550ef682b71cda70a4e36f6b9 upstream.
The power suppliers are always requested to suspend asynchronously,
dev_pm_domain_detach() requires the caller to ensure proper
synchronization of this function with power management callbacks.
otherwise the detach may led to kernel panic, like below:
[ 1457.107934] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000040
[ 1457.116777] Mem abort info:
[ 1457.119589] ESR = 0x0000000096000004
[ 1457.123358] EC = 0x25: DABT (current EL), IL = 32 bits
[ 1457.128692] SET = 0, FnV = 0
[ 1457.131764] EA = 0, S1PTW = 0
[ 1457.134920] FSC = 0x04: level 0 translation fault
[ 1457.139812] Data abort info:
[ 1457.142707] ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
[ 1457.148196] CM = 0, WnR = 0, TnD = 0, TagAccess = 0
[ 1457.153256] GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[ 1457.158563] user pgtable: 4k pages, 48-bit VAs, pgdp=00000001138b6000
[ 1457.165000] [0000000000000040] pgd=0000000000000000, p4d=0000000000000000
[ 1457.171792] Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
[ 1457.178045] Modules linked in: v4l2_jpeg wave6_vpu_ctrl(-) [last unloaded: mxc_jpeg_encdec]
[ 1457.186383] CPU: 0 PID: 51938 Comm: kworker/0:3 Not tainted 6.6.36-gd23d64eea511 #66
[ 1457.194112] Hardware name: NXP i.MX95 19X19 board (DT)
[ 1457.199236] Workqueue: pm pm_runtime_work
[ 1457.203247] pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[ 1457.210188] pc : genpd_runtime_suspend+0x20/0x290
[ 1457.214886] lr : __rpm_callback+0x48/0x1d8
[ 1457.218968] sp : ffff80008250bc50
[ 1457.222270] x29: ffff80008250bc50 x28: 0000000000000000 x27: 0000000000000000
[ 1457.229394] x26: 0000000000000000 x25: 0000000000000008 x24: 00000000000f4240
[ 1457.236518] x23: 0000000000000000 x22: ffff00008590f0e4 x21: 0000000000000008
[ 1457.243642] x20: ffff80008099c434 x19: ffff00008590f000 x18: ffffffffffffffff
[ 1457.250766] x17: 5300326563697665 x16: 645f676e696c6f6f x15: 63343a6d726f6674
[ 1457.257890] x14: 0000000000000004 x13: 00000000000003a4 x12: 0000000000000002
[ 1457.265014] x11: 0000000000000000 x10: 0000000000000a60 x9 : ffff80008250bbb0
[ 1457.272138] x8 : ffff000092937200 x7 : ffff0003fdf6af80 x6 : 0000000000000000
[ 1457.279262] x5 : 00000000410fd050 x4 : 0000000000200000 x3 : 0000000000000000
[ 1457.286386] x2 : 0000000000000000 x1 : 0000000000000000 x0 : ffff00008590f000
[ 1457.293510] Call trace:
[ 1457.295946] genpd_runtime_suspend+0x20/0x290
[ 1457.300296] __rpm_callback+0x48/0x1d8
[ 1457.304038] rpm_callback+0x6c/0x78
[ 1457.307515] rpm_suspend+0x10c/0x570
[ 1457.311077] pm_runtime_work+0xc4/0xc8
[ 1457.314813] process_one_work+0x138/0x248
[ 1457.318816] worker_thread+0x320/0x438
[ 1457.322552] kthread+0x110/0x114
[ 1457.325767] ret_from_fork+0x10/0x20
Fixes: 2db16c6ed72c ("media: imx-jpeg: Add V4L2 driver for i.MX8 JPEG Encoder/Decoder")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ming Qian <ming.qian@nxp.com>
Reviewed-by: TaoJiang <tao.jiang_2@nxp.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
+++ b/drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c
@@ -2679,6 +2679,8 @@ static void mxc_jpeg_detach_pm_domains(s
int i;
for (i = 0; i < jpeg->num_domains; i++) {
+ if (jpeg->pd_dev[i] && !pm_runtime_suspended(jpeg->pd_dev[i]))
+ pm_runtime_force_suspend(jpeg->pd_dev[i]);
if (jpeg->pd_link[i] && !IS_ERR(jpeg->pd_link[i]))
device_link_del(jpeg->pd_link[i]);
if (jpeg->pd_dev[i] && !IS_ERR(jpeg->pd_dev[i]))
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 027/146] media: platform: rga: fix 32-bit DMA limitation
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 026/146] media: imx-jpeg: Ensure power suppliers be suspended before detach them Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:35 ` [PATCH 6.12 028/146] media: verisilicon: av1: Fix reference video buffer pointer assignment Greg Kroah-Hartman
` (126 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, John Keeping, Michael Tretter,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: John Keeping <jkeeping@inmusicbrands.com>
commit 953c03d8cb41d08fe6994f5d94c4393ac9da2f13 upstream.
The destination buffer flags are assigned twice but source is not set in
what looks like a copy+paste mistake. Assign the source queue flags so
the 32-bit DMA limitation is handled consistently.
Fixes: ec9ef8dda2a2 ("media: rockchip: rga: set dma mask to 32 bits")
Cc: <stable@vger.kernel.org>
Signed-off-by: John Keeping <jkeeping@inmusicbrands.com>
Reviewed-by: Michael Tretter <m.tretter@pengutronix.de>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/rockchip/rga/rga.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/rockchip/rga/rga.c
+++ b/drivers/media/platform/rockchip/rga/rga.c
@@ -102,7 +102,7 @@ queue_init(void *priv, struct vb2_queue
src_vq->drv_priv = ctx;
src_vq->ops = &rga_qops;
src_vq->mem_ops = &vb2_dma_sg_memops;
- dst_vq->gfp_flags = __GFP_DMA32;
+ src_vq->gfp_flags = __GFP_DMA32;
src_vq->buf_struct_size = sizeof(struct rga_vb_buffer);
src_vq->timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_COPY;
src_vq->lock = &ctx->rga->mutex;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 028/146] media: verisilicon: av1: Fix reference video buffer pointer assignment
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 027/146] media: platform: rga: fix 32-bit DMA limitation Greg Kroah-Hartman
@ 2024-12-06 14:35 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 029/146] media: ts2020: fix null-ptr-deref in ts2020_probe() Greg Kroah-Hartman
` (125 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:35 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Benjamin Gaignard, Nicolas Dufresne,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Gaignard <benjamin.gaignard@collabora.com>
commit 672f24ed6ebcd986688c6674a6d994a265fefc25 upstream.
Always get new destination buffer for reference frame because nothing
garantees the one set previously is still valid or unused.
Fixes this chromium test suite:
https://chromium.googlesource.com/chromium/src/media/+/refs/heads/main/test/data/test-25fps.av1.ivf
Fixes: 727a400686a2 ("media: verisilicon: Add Rockchip AV1 decoder")
Cc: <stable@vger.kernel.org>
Signed-off-by: Benjamin Gaignard <benjamin.gaignard@collabora.com>
Reviewed-by: Nicolas Dufresne <nicolas.dufresne@collabora.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
[hverkuil: fix typo and add link to chromium test suite]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
+++ b/drivers/media/platform/verisilicon/rockchip_vpu981_hw_av1_dec.c
@@ -161,8 +161,7 @@ static int rockchip_vpu981_av1_dec_frame
av1_dec->frame_refs[i].timestamp = timestamp;
av1_dec->frame_refs[i].frame_type = frame->frame_type;
av1_dec->frame_refs[i].order_hint = frame->order_hint;
- if (!av1_dec->frame_refs[i].vb2_ref)
- av1_dec->frame_refs[i].vb2_ref = hantro_get_dst_buf(ctx);
+ av1_dec->frame_refs[i].vb2_ref = hantro_get_dst_buf(ctx);
for (j = 0; j < V4L2_AV1_TOTAL_REFS_PER_FRAME; j++)
av1_dec->frame_refs[i].order_hints[j] = frame->order_hints[j];
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 029/146] media: ts2020: fix null-ptr-deref in ts2020_probe()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2024-12-06 14:35 ` [PATCH 6.12 028/146] media: verisilicon: av1: Fix reference video buffer pointer assignment Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 030/146] media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available Greg Kroah-Hartman
` (124 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Li Zetao, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Li Zetao <lizetao1@huawei.com>
commit 4a058b34b52ed3feb1f3ff6fd26aefeeeed20cba upstream.
KASAN reported a null-ptr-deref issue when executing the following
command:
# echo ts2020 0x20 > /sys/bus/i2c/devices/i2c-0/new_device
KASAN: null-ptr-deref in range [0x0000000000000010-0x0000000000000017]
CPU: 53 UID: 0 PID: 970 Comm: systemd-udevd Not tainted 6.12.0-rc2+ #24
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009)
RIP: 0010:ts2020_probe+0xad/0xe10 [ts2020]
RSP: 0018:ffffc9000abbf598 EFLAGS: 00010202
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffffc0714809
RDX: 0000000000000002 RSI: ffff88811550be00 RDI: 0000000000000010
RBP: ffff888109868800 R08: 0000000000000001 R09: fffff52001577eb6
R10: 0000000000000000 R11: ffffc9000abbff50 R12: ffffffffc0714790
R13: 1ffff92001577eb8 R14: ffffffffc07190d0 R15: 0000000000000001
FS: 00007f95f13b98c0(0000) GS:ffff888149280000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555d2634b000 CR3: 0000000152236000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
ts2020_probe+0xad/0xe10 [ts2020]
i2c_device_probe+0x421/0xb40
really_probe+0x266/0x850
...
The cause of the problem is that when using sysfs to dynamically register
an i2c device, there is no platform data, but the probe process of ts2020
needs to use platform data, resulting in a null pointer being accessed.
Solve this problem by adding checks to platform data.
Fixes: dc245a5f9b51 ("[media] ts2020: implement I2C client bindings")
Cc: <stable@vger.kernel.org>
Signed-off-by: Li Zetao <lizetao1@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/dvb-frontends/ts2020.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/media/dvb-frontends/ts2020.c
+++ b/drivers/media/dvb-frontends/ts2020.c
@@ -553,13 +553,19 @@ static void ts2020_regmap_unlock(void *_
static int ts2020_probe(struct i2c_client *client)
{
struct ts2020_config *pdata = client->dev.platform_data;
- struct dvb_frontend *fe = pdata->fe;
+ struct dvb_frontend *fe;
struct ts2020_priv *dev;
int ret;
u8 u8tmp;
unsigned int utmp;
char *chip_str;
+ if (!pdata) {
+ dev_err(&client->dev, "platform data is mandatory\n");
+ return -EINVAL;
+ }
+
+ fe = pdata->fe;
dev = kzalloc(sizeof(*dev), GFP_KERNEL);
if (!dev) {
ret = -ENOMEM;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 030/146] media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 029/146] media: ts2020: fix null-ptr-deref in ts2020_probe() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 031/146] efi/libstub: Free correct pointer on failure Greg Kroah-Hartman
` (123 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Joe Hattori, Krzysztof Kozlowski,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
commit 8964eb23408243ae0016d1f8473c76f64ff25d20 upstream.
In fimc_md_is_isp_available(), of_get_child_by_name() is called to check
if FIMC-IS is available. Current code does not decrement the refcount of
the returned device node, which causes an OF node reference leak. Fix it
by calling of_node_put() at the end of the variable scope.
Signed-off-by: Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
Fixes: e781bbe3fecf ("[media] exynos4-is: Add fimc-is subdevs registration")
Cc: stable@vger.kernel.org
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
[hverkuil: added CC to stable]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/samsung/exynos4-is/media-dev.h | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/media/platform/samsung/exynos4-is/media-dev.h
+++ b/drivers/media/platform/samsung/exynos4-is/media-dev.h
@@ -178,8 +178,9 @@ int fimc_md_set_camclk(struct v4l2_subde
#ifdef CONFIG_OF
static inline bool fimc_md_is_isp_available(struct device_node *node)
{
- node = of_get_child_by_name(node, FIMC_IS_OF_NODE_NAME);
- return node ? of_device_is_available(node) : false;
+ struct device_node *child __free(device_node) =
+ of_get_child_by_name(node, FIMC_IS_OF_NODE_NAME);
+ return child ? of_device_is_available(child) : false;
}
#else
#define fimc_md_is_isp_available(node) (false)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 031/146] efi/libstub: Free correct pointer on failure
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 030/146] media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 032/146] net: phy: dp83869: fix status reporting for 1000base-x autonegotiation Greg Kroah-Hartman
` (122 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ard Biesheuvel
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ard Biesheuvel <ardb@kernel.org>
commit 06d39d79cbd5a91a33707951ebf2512d0e759847 upstream.
cmdline_ptr is an out parameter, which is not allocated by the function
itself, and likely points into the caller's stack.
cmdline refers to the pool allocation that should be freed when cleaning
up after a failure, so pass this instead to free_pool().
Fixes: 42c8ea3dca09 ("efi: libstub: Factor out EFI stub entrypoint ...")
Cc: <stable@vger.kernel.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/firmware/efi/libstub/efi-stub.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/firmware/efi/libstub/efi-stub.c
+++ b/drivers/firmware/efi/libstub/efi-stub.c
@@ -149,7 +149,7 @@ efi_status_t efi_handle_cmdline(efi_load
return EFI_SUCCESS;
fail_free_cmdline:
- efi_bs_call(free_pool, cmdline_ptr);
+ efi_bs_call(free_pool, cmdline);
return status;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 032/146] net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 031/146] efi/libstub: Free correct pointer on failure Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 033/146] media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled Greg Kroah-Hartman
` (121 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Romain Gantois, Jakub Kicinski
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Romain Gantois <romain.gantois@bootlin.com>
commit 378e8feea9a70d37a5dc1678b7ec27df21099fa5 upstream.
The DP83869 PHY transceiver supports converting from RGMII to 1000base-x.
In this operation mode, autonegotiation can be performed, as described in
IEEE802.3.
The DP83869 has a set of fiber-specific registers located at offset 0xc00.
When the transceiver is configured in RGMII-to-1000base-x mode, these
registers are mapped onto offset 0, which should make reading the
autonegotiation status transparent.
However, the fiber registers at offset 0xc04 and 0xc05 follow the bit
layout specified in Clause 37, and genphy_read_status() assumes a Clause 22
layout. Thus, genphy_read_status() doesn't properly read the capabilities
advertised by the link partner, resulting in incorrect link parameters.
Similarly, genphy_config_aneg() doesn't properly write advertised
capabilities.
Fix the 1000base-x autonegotiation procedure by replacing
genphy_read_status() and genphy_config_aneg() with their Clause 37
equivalents.
Fixes: a29de52ba2a1 ("net: dp83869: Add ability to advertise Fiber connection")
Cc: stable@vger.kernel.org
Signed-off-by: Romain Gantois <romain.gantois@bootlin.com>
Link: https://patch.msgid.link/20241112-dp83869-1000base-x-v3-1-36005f4ab0d9@bootlin.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/phy/dp83869.c | 20 +++++++++++++++++---
1 file changed, 17 insertions(+), 3 deletions(-)
--- a/drivers/net/phy/dp83869.c
+++ b/drivers/net/phy/dp83869.c
@@ -153,19 +153,32 @@ struct dp83869_private {
int mode;
};
+static int dp83869_config_aneg(struct phy_device *phydev)
+{
+ struct dp83869_private *dp83869 = phydev->priv;
+
+ if (dp83869->mode != DP83869_RGMII_1000_BASE)
+ return genphy_config_aneg(phydev);
+
+ return genphy_c37_config_aneg(phydev);
+}
+
static int dp83869_read_status(struct phy_device *phydev)
{
struct dp83869_private *dp83869 = phydev->priv;
+ bool changed;
int ret;
+ if (dp83869->mode == DP83869_RGMII_1000_BASE)
+ return genphy_c37_read_status(phydev, &changed);
+
ret = genphy_read_status(phydev);
if (ret)
return ret;
- if (linkmode_test_bit(ETHTOOL_LINK_MODE_FIBRE_BIT, phydev->supported)) {
+ if (dp83869->mode == DP83869_RGMII_100_BASE) {
if (phydev->link) {
- if (dp83869->mode == DP83869_RGMII_100_BASE)
- phydev->speed = SPEED_100;
+ phydev->speed = SPEED_100;
} else {
phydev->speed = SPEED_UNKNOWN;
phydev->duplex = DUPLEX_UNKNOWN;
@@ -898,6 +911,7 @@ static int dp83869_phy_reset(struct phy_
.soft_reset = dp83869_phy_reset, \
.config_intr = dp83869_config_intr, \
.handle_interrupt = dp83869_handle_interrupt, \
+ .config_aneg = dp83869_config_aneg, \
.read_status = dp83869_read_status, \
.get_tunable = dp83869_get_tunable, \
.set_tunable = dp83869_set_tunable, \
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 033/146] media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 032/146] net: phy: dp83869: fix status reporting for 1000base-x autonegotiation Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 034/146] media: venus: " Greg Kroah-Hartman
` (120 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Bryan ODonoghue,
Sakari Ailus, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 316e74500d1c6589cba28cebe2864a0bceeb2396 upstream.
It is not valid to call pm_runtime_set_suspended() for devices
with runtime PM enabled because it returns -EAGAIN if it is enabled
already and working. So, call pm_runtime_disable() before to fix it.
Cc: stable@vger.kernel.org
Fixes: b50a64fc54af ("media: amphion: add amphion vpu device driver")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/amphion/vpu_drv.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/amphion/vpu_drv.c
+++ b/drivers/media/platform/amphion/vpu_drv.c
@@ -151,8 +151,8 @@ err_add_decoder:
media_device_cleanup(&vpu->mdev);
v4l2_device_unregister(&vpu->v4l2_dev);
err_vpu_deinit:
- pm_runtime_set_suspended(dev);
pm_runtime_disable(dev);
+ pm_runtime_set_suspended(dev);
return ret;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 034/146] media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 033/146] media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 035/146] media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() Greg Kroah-Hartman
` (119 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Bryan ODonoghue,
Stanimir Varbanov, Sakari Ailus, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 2a20869f7d798aa2b69e45b863eaf1b1ecf98278 upstream.
It is not valid to call pm_runtime_set_suspended() for devices
with runtime PM enabled because it returns -EAGAIN if it is enabled
already and working. So, call pm_runtime_disable() before to fix it.
Cc: stable@vger.kernel.org
Fixes: af2c3834c8ca ("[media] media: venus: adding core part and helper functions")
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Acked-by: Stanimir Varbanov <stanimir.k.varbanov@gmail.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/qcom/venus/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/platform/qcom/venus/core.c
+++ b/drivers/media/platform/qcom/venus/core.c
@@ -412,8 +412,8 @@ err_of_depopulate:
of_platform_depopulate(dev);
err_runtime_disable:
pm_runtime_put_noidle(dev);
- pm_runtime_set_suspended(dev);
pm_runtime_disable(dev);
+ pm_runtime_set_suspended(dev);
hfi_destroy(core);
err_core_deinit:
hfi_core_deinit(core, false);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 035/146] media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 034/146] media: venus: " Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 036/146] media: ov08x40: Fix burst write sequence Greg Kroah-Hartman
` (118 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jinjie Ruan, Sakari Ailus,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit d2842dec577900031826dc44e9bf0c66416d7173 upstream.
In set_frame_rate(), select a rate in rate_0 or rate_1 by checking
sd->frame_rate >= r->fps in a loop, but the loop condition terminates when
the index reaches zero, which fails to check the last elememt in rate_0 or
rate_1.
Check for >= 0 so that the last one in rate_0 or rate_1 is also checked.
Fixes: 189d92af707e ("V4L/DVB (13422): gspca - ov534: ov772x changes from Richard Kaswy.")
Cc: stable@vger.kernel.org
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/gspca/ov534.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/media/usb/gspca/ov534.c
+++ b/drivers/media/usb/gspca/ov534.c
@@ -847,7 +847,7 @@ static void set_frame_rate(struct gspca_
r = rate_1;
i = ARRAY_SIZE(rate_1);
}
- while (--i > 0) {
+ while (--i >= 0) {
if (sd->frame_rate >= r->fps)
break;
r++;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 036/146] media: ov08x40: Fix burst write sequence
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 035/146] media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 037/146] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() Greg Kroah-Hartman
` (117 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Bryan ODonoghue, Sakari Ailus,
Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
commit d0fef6de4f1b957e35a05a5ba4aab2a2576d6686 upstream.
It is necessary to account for I2C quirks in the burst mode path of this
driver. Not all I2C controllers can accept arbitrarily long writes and this
is represented in the quirks field of the adapter structure.
Prior to this patch the following error message is seen on a Qualcomm
X1E80100 CRD.
[ 38.773524] i2c i2c-2: adapter quirk: msg too long (addr 0x0036, size 290, write)
[ 38.781454] ov08x40 2-0036: Failed regs transferred: -95
[ 38.787076] ov08x40 2-0036: ov08x40_start_streaming failed to set regs
Fix the error by breaking up the write sequence into the advertised maximum
write size of the quirks field if the quirks field is populated.
Fixes: 8f667d202384 ("media: ov08x40: Reduce start streaming time")
Cc: stable@vger.kernel.org # v6.9+
Tested-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org> # x1e80100-crd
Signed-off-by: Bryan O'Donoghue <bryan.odonoghue@linaro.org>
Signed-off-by: Sakari Ailus <sakari.ailus@linux.intel.com>
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/ov08x40.c | 33 ++++++++++++++++++++++++++++-----
1 file changed, 28 insertions(+), 5 deletions(-)
--- a/drivers/media/i2c/ov08x40.c
+++ b/drivers/media/i2c/ov08x40.c
@@ -1339,15 +1339,13 @@ static int ov08x40_read_reg(struct ov08x
return 0;
}
-static int ov08x40_burst_fill_regs(struct ov08x40 *ov08x, u16 first_reg,
- u16 last_reg, u8 val)
+static int __ov08x40_burst_fill_regs(struct i2c_client *client, u16 first_reg,
+ u16 last_reg, size_t num_regs, u8 val)
{
- struct i2c_client *client = v4l2_get_subdevdata(&ov08x->sd);
struct i2c_msg msgs;
- size_t i, num_regs;
+ size_t i;
int ret;
- num_regs = last_reg - first_reg + 1;
msgs.addr = client->addr;
msgs.flags = 0;
msgs.len = 2 + num_regs;
@@ -1371,6 +1369,31 @@ static int ov08x40_burst_fill_regs(struc
}
return 0;
+}
+
+static int ov08x40_burst_fill_regs(struct ov08x40 *ov08x, u16 first_reg,
+ u16 last_reg, u8 val)
+{
+ struct i2c_client *client = v4l2_get_subdevdata(&ov08x->sd);
+ size_t num_regs, num_write_regs;
+ int ret;
+
+ num_regs = last_reg - first_reg + 1;
+ num_write_regs = num_regs;
+
+ if (client->adapter->quirks && client->adapter->quirks->max_write_len)
+ num_write_regs = client->adapter->quirks->max_write_len - 2;
+
+ while (first_reg < last_reg) {
+ ret = __ov08x40_burst_fill_regs(client, first_reg, last_reg,
+ num_write_regs, val);
+ if (ret)
+ return ret;
+
+ first_reg += num_write_regs;
+ }
+
+ return 0;
}
/* Write registers up to 4 at a time */
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 037/146] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 036/146] media: ov08x40: Fix burst write sequence Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 038/146] media: uvcvideo: Stop stream during unregister Greg Kroah-Hartman
` (116 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gaosheng Cui, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gaosheng Cui <cuigaosheng1@huawei.com>
commit 0f514068fbc5d4d189c817adc7c4e32cffdc2e47 upstream.
The buffer in the loop should be released under the exception path,
otherwise there may be a memory leak here.
To mitigate this, free the buffer when allegro_alloc_buffer fails.
Fixes: f20387dfd065 ("media: allegro: add Allegro DVT video IP core driver")
Cc: <stable@vger.kernel.org>
Signed-off-by: Gaosheng Cui <cuigaosheng1@huawei.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/platform/allegro-dvt/allegro-core.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/media/platform/allegro-dvt/allegro-core.c
+++ b/drivers/media/platform/allegro-dvt/allegro-core.c
@@ -1509,8 +1509,10 @@ static int allocate_buffers_internal(str
INIT_LIST_HEAD(&buffer->head);
err = allegro_alloc_buffer(dev, buffer, size);
- if (err)
+ if (err) {
+ kfree(buffer);
goto err;
+ }
list_add(&buffer->head, list);
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 038/146] media: uvcvideo: Stop stream during unregister
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 037/146] media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 039/146] media: uvcvideo: Require entities to have a non-zero unique ID Greg Kroah-Hartman
` (115 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hans Verkuil, Ricardo Ribalda,
Mauro Carvalho Chehab
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ricardo Ribalda <ribalda@chromium.org>
commit c9ec6f1736363b2b2bb4e266997389740f628441 upstream.
uvc_unregister_video() can be called asynchronously from
uvc_disconnect(). If the device is still streaming when that happens, a
plethora of race conditions can occur.
Make sure that the device has stopped streaming before exiting this
function.
If the user still holds handles to the driver's file descriptors, any
ioctl will return -ENODEV from the v4l2 core.
This change makes uvc more consistent with the rest of the v4l2 drivers
using the vb2_fop_* and vb2_ioctl_* helpers.
This driver (and many other usb drivers) always had this problem, but it
wasn't possible to easily fix this until the vb2_video_unregister_device()
helper was added. So the Fixes tag points to the creation of that helper.
Reviewed-by: Hans Verkuil <hverkuil@xs4all.nl>
Suggested-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Fixes: f729ef5796d8 ("media: videobuf2-v4l2.c: add vb2_video_unregister_device helper function")
Cc: stable@vger.kernel.org # 5.10.x
[hverkuil: add note regarding Fixes version]
Signed-off-by: Hans Verkuil <hverkuil@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_driver.c | 32 +++++++++++++++++++++++++++++++-
1 file changed, 31 insertions(+), 1 deletion(-)
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -1919,11 +1919,41 @@ static void uvc_unregister_video(struct
struct uvc_streaming *stream;
list_for_each_entry(stream, &dev->streams, list) {
+ /* Nothing to do here, continue. */
if (!video_is_registered(&stream->vdev))
continue;
+ /*
+ * For stream->vdev we follow the same logic as:
+ * vb2_video_unregister_device().
+ */
+
+ /* 1. Take a reference to vdev */
+ get_device(&stream->vdev.dev);
+
+ /* 2. Ensure that no new ioctls can be called. */
video_unregister_device(&stream->vdev);
- video_unregister_device(&stream->meta.vdev);
+
+ /* 3. Wait for old ioctls to finish. */
+ mutex_lock(&stream->mutex);
+
+ /* 4. Stop streaming. */
+ uvc_queue_release(&stream->queue);
+
+ mutex_unlock(&stream->mutex);
+
+ put_device(&stream->vdev.dev);
+
+ /*
+ * For stream->meta.vdev we can directly call:
+ * vb2_video_unregister_device().
+ */
+ vb2_video_unregister_device(&stream->meta.vdev);
+
+ /*
+ * Now both vdevs are not streaming and all the ioctls will
+ * return -ENODEV.
+ */
uvc_debugfs_cleanup_stream(stream);
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 039/146] media: uvcvideo: Require entities to have a non-zero unique ID
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 038/146] media: uvcvideo: Stop stream during unregister Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 040/146] tracing: Fix function timing profiler to initialize hashtable Greg Kroah-Hartman
` (114 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+0584f746fde3d52b4675,
syzbot+dd320d114deb3f5bb79b, Thadeu Lima de Souza Cascardo,
Ricardo Ribalda, Laurent Pinchart, Hans Verkuil
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
commit 3dd075fe8ebbc6fcbf998f81a75b8c4b159a6195 upstream.
Per UVC 1.1+ specification 3.7.2, units and terminals must have a non-zero
unique ID.
```
Each Unit and Terminal within the video function is assigned a unique
identification number, the Unit ID (UID) or Terminal ID (TID), contained in
the bUnitID or bTerminalID field of the descriptor. The value 0x00 is
reserved for undefined ID,
```
So, deny allocating an entity with ID 0 or an ID that belongs to a unit
that is already added to the list of entities.
This also prevents some syzkaller reproducers from triggering warnings due
to a chain of entities referring to themselves. In one particular case, an
Output Unit is connected to an Input Unit, both with the same ID of 1. But
when looking up for the source ID of the Output Unit, that same entity is
found instead of the input entity, which leads to such warnings.
In another case, a backward chain was considered finished as the source ID
was 0. Later on, that entity was found, but its pads were not valid.
Here is a sample stack trace for one of those cases.
[ 20.650953] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[ 20.830206] usb 1-1: Using ep0 maxpacket: 8
[ 20.833501] usb 1-1: config 0 descriptor??
[ 21.038518] usb 1-1: string descriptor 0 read error: -71
[ 21.038893] usb 1-1: Found UVC 0.00 device <unnamed> (2833:0201)
[ 21.039299] uvcvideo 1-1:0.0: Entity type for entity Output 1 was not initialized!
[ 21.041583] uvcvideo 1-1:0.0: Entity type for entity Input 1 was not initialized!
[ 21.042218] ------------[ cut here ]------------
[ 21.042536] WARNING: CPU: 0 PID: 9 at drivers/media/mc/mc-entity.c:1147 media_create_pad_link+0x2c4/0x2e0
[ 21.043195] Modules linked in:
[ 21.043535] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Not tainted 6.11.0-rc7-00030-g3480e43aeccf #444
[ 21.044101] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04/01/2014
[ 21.044639] Workqueue: usb_hub_wq hub_event
[ 21.045100] RIP: 0010:media_create_pad_link+0x2c4/0x2e0
[ 21.045508] Code: fe e8 20 01 00 00 b8 f4 ff ff ff 48 83 c4 30 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc 0f 0b eb e9 0f 0b eb 0a 0f 0b eb 06 <0f> 0b eb 02 0f 0b b8 ea ff ff ff eb d4 66 2e 0f 1f 84 00 00 00 00
[ 21.046801] RSP: 0018:ffffc9000004b318 EFLAGS: 00010246
[ 21.047227] RAX: ffff888004e5d458 RBX: 0000000000000000 RCX: ffffffff818fccf1
[ 21.047719] RDX: 000000000000007b RSI: 0000000000000000 RDI: ffff888004313290
[ 21.048241] RBP: ffff888004313290 R08: 0001ffffffffffff R09: 0000000000000000
[ 21.048701] R10: 0000000000000013 R11: 0001888004313290 R12: 0000000000000003
[ 21.049138] R13: ffff888004313080 R14: ffff888004313080 R15: 0000000000000000
[ 21.049648] FS: 0000000000000000(0000) GS:ffff88803ec00000(0000) knlGS:0000000000000000
[ 21.050271] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 21.050688] CR2: 0000592cc27635b0 CR3: 000000000431c000 CR4: 0000000000750ef0
[ 21.051136] PKRU: 55555554
[ 21.051331] Call Trace:
[ 21.051480] <TASK>
[ 21.051611] ? __warn+0xc4/0x210
[ 21.051861] ? media_create_pad_link+0x2c4/0x2e0
[ 21.052252] ? report_bug+0x11b/0x1a0
[ 21.052540] ? trace_hardirqs_on+0x31/0x40
[ 21.052901] ? handle_bug+0x3d/0x70
[ 21.053197] ? exc_invalid_op+0x1a/0x50
[ 21.053511] ? asm_exc_invalid_op+0x1a/0x20
[ 21.053924] ? media_create_pad_link+0x91/0x2e0
[ 21.054364] ? media_create_pad_link+0x2c4/0x2e0
[ 21.054834] ? media_create_pad_link+0x91/0x2e0
[ 21.055131] ? _raw_spin_unlock+0x1e/0x40
[ 21.055441] ? __v4l2_device_register_subdev+0x202/0x210
[ 21.055837] uvc_mc_register_entities+0x358/0x400
[ 21.056144] uvc_register_chains+0x1fd/0x290
[ 21.056413] uvc_probe+0x380e/0x3dc0
[ 21.056676] ? __lock_acquire+0x5aa/0x26e0
[ 21.056946] ? find_held_lock+0x33/0xa0
[ 21.057196] ? kernfs_activate+0x70/0x80
[ 21.057533] ? usb_match_dynamic_id+0x1b/0x70
[ 21.057811] ? find_held_lock+0x33/0xa0
[ 21.058047] ? usb_match_dynamic_id+0x55/0x70
[ 21.058330] ? lock_release+0x124/0x260
[ 21.058657] ? usb_match_one_id_intf+0xa2/0x100
[ 21.058997] usb_probe_interface+0x1ba/0x330
[ 21.059399] really_probe+0x1ba/0x4c0
[ 21.059662] __driver_probe_device+0xb2/0x180
[ 21.059944] driver_probe_device+0x5a/0x100
[ 21.060170] __device_attach_driver+0xe9/0x160
[ 21.060427] ? __pfx___device_attach_driver+0x10/0x10
[ 21.060872] bus_for_each_drv+0xa9/0x100
[ 21.061312] __device_attach+0xed/0x190
[ 21.061812] device_initial_probe+0xe/0x20
[ 21.062229] bus_probe_device+0x4d/0xd0
[ 21.062590] device_add+0x308/0x590
[ 21.062912] usb_set_configuration+0x7b6/0xaf0
[ 21.063403] usb_generic_driver_probe+0x36/0x80
[ 21.063714] usb_probe_device+0x7b/0x130
[ 21.063936] really_probe+0x1ba/0x4c0
[ 21.064111] __driver_probe_device+0xb2/0x180
[ 21.064577] driver_probe_device+0x5a/0x100
[ 21.065019] __device_attach_driver+0xe9/0x160
[ 21.065403] ? __pfx___device_attach_driver+0x10/0x10
[ 21.065820] bus_for_each_drv+0xa9/0x100
[ 21.066094] __device_attach+0xed/0x190
[ 21.066535] device_initial_probe+0xe/0x20
[ 21.066992] bus_probe_device+0x4d/0xd0
[ 21.067250] device_add+0x308/0x590
[ 21.067501] usb_new_device+0x347/0x610
[ 21.067817] hub_event+0x156b/0x1e30
[ 21.068060] ? process_scheduled_works+0x48b/0xaf0
[ 21.068337] process_scheduled_works+0x5a3/0xaf0
[ 21.068668] worker_thread+0x3cf/0x560
[ 21.068932] ? kthread+0x109/0x1b0
[ 21.069133] kthread+0x197/0x1b0
[ 21.069343] ? __pfx_worker_thread+0x10/0x10
[ 21.069598] ? __pfx_kthread+0x10/0x10
[ 21.069908] ret_from_fork+0x32/0x40
[ 21.070169] ? __pfx_kthread+0x10/0x10
[ 21.070424] ret_from_fork_asm+0x1a/0x30
[ 21.070737] </TASK>
Cc: stable@vger.kernel.org
Reported-by: syzbot+0584f746fde3d52b4675@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=0584f746fde3d52b4675
Reported-by: syzbot+dd320d114deb3f5bb79b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=dd320d114deb3f5bb79b
Fixes: a3fbc2e6bb05 ("media: mc-entity.c: use WARN_ON, validate link pads")
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
Reviewed-by: Ricardo Ribalda <ribalda@chromium.org>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Link: https://lore.kernel.org/r/20240913180601.1400596-2-cascardo@igalia.com
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/uvc/uvc_driver.c | 70 ++++++++++++++++++++++---------------
1 file changed, 43 insertions(+), 27 deletions(-)
--- a/drivers/media/usb/uvc/uvc_driver.c
+++ b/drivers/media/usb/uvc/uvc_driver.c
@@ -775,14 +775,27 @@ static const u8 uvc_media_transport_inpu
UVC_GUID_UVC_MEDIA_TRANSPORT_INPUT;
static const u8 uvc_processing_guid[16] = UVC_GUID_UVC_PROCESSING;
-static struct uvc_entity *uvc_alloc_entity(u16 type, u16 id,
- unsigned int num_pads, unsigned int extra_size)
+static struct uvc_entity *uvc_alloc_new_entity(struct uvc_device *dev, u16 type,
+ u16 id, unsigned int num_pads,
+ unsigned int extra_size)
{
struct uvc_entity *entity;
unsigned int num_inputs;
unsigned int size;
unsigned int i;
+ /* Per UVC 1.1+ spec 3.7.2, the ID should be non-zero. */
+ if (id == 0) {
+ dev_err(&dev->udev->dev, "Found Unit with invalid ID 0.\n");
+ return ERR_PTR(-EINVAL);
+ }
+
+ /* Per UVC 1.1+ spec 3.7.2, the ID is unique. */
+ if (uvc_entity_by_id(dev, id)) {
+ dev_err(&dev->udev->dev, "Found multiple Units with ID %u\n", id);
+ return ERR_PTR(-EINVAL);
+ }
+
extra_size = roundup(extra_size, sizeof(*entity->pads));
if (num_pads)
num_inputs = type & UVC_TERM_OUTPUT ? num_pads : num_pads - 1;
@@ -792,7 +805,7 @@ static struct uvc_entity *uvc_alloc_enti
+ num_inputs;
entity = kzalloc(size, GFP_KERNEL);
if (entity == NULL)
- return NULL;
+ return ERR_PTR(-ENOMEM);
entity->id = id;
entity->type = type;
@@ -904,10 +917,10 @@ static int uvc_parse_vendor_control(stru
break;
}
- unit = uvc_alloc_entity(UVC_VC_EXTENSION_UNIT, buffer[3],
- p + 1, 2*n);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, UVC_VC_EXTENSION_UNIT,
+ buffer[3], p + 1, 2 * n);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
@@ -1016,10 +1029,10 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- term = uvc_alloc_entity(type | UVC_TERM_INPUT, buffer[3],
- 1, n + p);
- if (term == NULL)
- return -ENOMEM;
+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_INPUT,
+ buffer[3], 1, n + p);
+ if (IS_ERR(term))
+ return PTR_ERR(term);
if (UVC_ENTITY_TYPE(term) == UVC_ITT_CAMERA) {
term->camera.bControlSize = n;
@@ -1075,10 +1088,10 @@ static int uvc_parse_standard_control(st
return 0;
}
- term = uvc_alloc_entity(type | UVC_TERM_OUTPUT, buffer[3],
- 1, 0);
- if (term == NULL)
- return -ENOMEM;
+ term = uvc_alloc_new_entity(dev, type | UVC_TERM_OUTPUT,
+ buffer[3], 1, 0);
+ if (IS_ERR(term))
+ return PTR_ERR(term);
memcpy(term->baSourceID, &buffer[7], 1);
@@ -1097,9 +1110,10 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, 0);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
+ p + 1, 0);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->baSourceID, &buffer[5], p);
@@ -1119,9 +1133,9 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- unit = uvc_alloc_entity(buffer[2], buffer[3], 2, n);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3], 2, n);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->baSourceID, &buffer[4], 1);
unit->processing.wMaxMultiplier =
@@ -1148,9 +1162,10 @@ static int uvc_parse_standard_control(st
return -EINVAL;
}
- unit = uvc_alloc_entity(buffer[2], buffer[3], p + 1, n);
- if (unit == NULL)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, buffer[2], buffer[3],
+ p + 1, n);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
memcpy(unit->guid, &buffer[4], 16);
unit->extension.bNumControls = buffer[20];
@@ -1290,9 +1305,10 @@ static int uvc_gpio_parse(struct uvc_dev
return dev_err_probe(&dev->udev->dev, irq,
"No IRQ for privacy GPIO\n");
- unit = uvc_alloc_entity(UVC_EXT_GPIO_UNIT, UVC_EXT_GPIO_UNIT_ID, 0, 1);
- if (!unit)
- return -ENOMEM;
+ unit = uvc_alloc_new_entity(dev, UVC_EXT_GPIO_UNIT,
+ UVC_EXT_GPIO_UNIT_ID, 0, 1);
+ if (IS_ERR(unit))
+ return PTR_ERR(unit);
unit->gpio.gpio_privacy = gpio_privacy;
unit->gpio.irq = irq;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 040/146] tracing: Fix function timing profiler to initialize hashtable
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 039/146] media: uvcvideo: Require entities to have a non-zero unique ID Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 041/146] kunit: Fix potential null dereference in kunit_device_driver_test() Greg Kroah-Hartman
` (113 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu (Google),
Steven Rostedt (Google)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Masami Hiramatsu (Google) <mhiramat@kernel.org>
commit c54a1a06daa78613519b4d24495b0d175b8af63f upstream.
Since the new fgraph requires to initialize fgraph_ops.ops.func_hash before
calling register_ftrace_graph(), initialize it with default (tracing all
functions) parameter.
Cc: stable@vger.kernel.org
Fixes: 5fccc7552ccb ("ftrace: Add subops logic to allow one ops to manage many")
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -883,6 +883,10 @@ static void profile_graph_return(struct
}
static struct fgraph_ops fprofiler_ops = {
+ .ops = {
+ .flags = FTRACE_OPS_FL_INITIALIZED,
+ INIT_OPS_HASH(fprofiler_ops.ops)
+ },
.entryfunc = &profile_graph_entry,
.retfunc = &profile_graph_return,
};
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 041/146] kunit: Fix potential null dereference in kunit_device_driver_test()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 040/146] tracing: Fix function timing profiler to initialize hashtable Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 042/146] kunit: string-stream: Fix a UAF bug in kunit_init_suite() Greg Kroah-Hartman
` (112 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zichen Xie, David Gow, Shuah Khan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zichen Xie <zichenxie0106@gmail.com>
commit 435c20eed572a95709b1536ff78832836b2f91b1 upstream.
kunit_kzalloc() may return a NULL pointer, dereferencing it without
NULL check may lead to NULL dereference.
Add a NULL check for test_state.
Link: https://lore.kernel.org/r/20241115054335.21673-1-zichenxie0106@gmail.com
Fixes: d03c720e03bd ("kunit: Add APIs for managing devices")
Signed-off-by: Zichen Xie <zichenxie0106@gmail.com>
Cc: stable@vger.kernel.org
Reviewed-by: David Gow <davidgow@google.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/kunit/kunit-test.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/lib/kunit/kunit-test.c b/lib/kunit/kunit-test.c
index 37e02be1e710..d9c781c859fd 100644
--- a/lib/kunit/kunit-test.c
+++ b/lib/kunit/kunit-test.c
@@ -805,6 +805,8 @@ static void kunit_device_driver_test(struct kunit *test)
struct device *test_device;
struct driver_test_state *test_state = kunit_kzalloc(test, sizeof(*test_state), GFP_KERNEL);
+ KUNIT_ASSERT_NOT_ERR_OR_NULL(test, test_state);
+
test->priv = test_state;
test_driver = kunit_driver_create(test, "my_driver");
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 042/146] kunit: string-stream: Fix a UAF bug in kunit_init_suite()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 041/146] kunit: Fix potential null dereference in kunit_device_driver_test() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 043/146] ovl: Filter invalid inodes with missing lookup function Greg Kroah-Hartman
` (111 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kuan-Wei Chiu, Jinjie Ruan,
David Gow, Shuah Khan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 39e21403c978862846fa68b7f6d06f9cca235194 upstream.
In kunit_debugfs_create_suite(), if alloc_string_stream() fails in the
kunit_suite_for_each_test_case() loop, the "suite->log = stream"
has assigned before, and the error path only free the suite->log's stream
memory but not set it to NULL, so the later string_stream_clear() of
suite->log in kunit_init_suite() will cause below UAF bug.
Set stream pointer to NULL after free to fix it.
Unable to handle kernel paging request at virtual address 006440150000030d
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000
CM = 0, WnR = 0, TnD = 0, TagAccess = 0
GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[006440150000030d] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Dumping ftrace buffer:
(ftrace buffer empty)
Modules linked in: iio_test_gts industrialio_gts_helper cfg80211 rfkill ipv6 [last unloaded: iio_test_gts]
CPU: 5 UID: 0 PID: 6253 Comm: modprobe Tainted: G B W N 6.12.0-rc4+ #458
Tainted: [B]=BAD_PAGE, [W]=WARN, [N]=TEST
Hardware name: linux,dummy-virt (DT)
pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : string_stream_clear+0x54/0x1ac
lr : string_stream_clear+0x1a8/0x1ac
sp : ffffffc080b47410
x29: ffffffc080b47410 x28: 006440550000030d x27: ffffff80c96b5e98
x26: ffffff80c96b5e80 x25: ffffffe461b3f6c0 x24: 0000000000000003
x23: ffffff80c96b5e88 x22: 1ffffff019cdf4fc x21: dfffffc000000000
x20: ffffff80ce6fa7e0 x19: 032202a80000186d x18: 0000000000001840
x17: 0000000000000000 x16: 0000000000000000 x15: ffffffe45c355cb4
x14: ffffffe45c35589c x13: ffffffe45c03da78 x12: ffffffb810168e75
x11: 1ffffff810168e74 x10: ffffffb810168e74 x9 : dfffffc000000000
x8 : 0000000000000004 x7 : 0000000000000003 x6 : 0000000000000001
x5 : ffffffc080b473a0 x4 : 0000000000000000 x3 : 0000000000000000
x2 : 0000000000000001 x1 : ffffffe462fbf620 x0 : dfffffc000000000
Call trace:
string_stream_clear+0x54/0x1ac
__kunit_test_suites_init+0x108/0x1d8
kunit_exec_run_tests+0xb8/0x100
kunit_module_notify+0x400/0x55c
notifier_call_chain+0xfc/0x3b4
blocking_notifier_call_chain+0x68/0x9c
do_init_module+0x24c/0x5c8
load_module+0x4acc/0x4e90
init_module_from_file+0xd4/0x128
idempotent_init_module+0x2d4/0x57c
__arm64_sys_finit_module+0xac/0x100
invoke_syscall+0x6c/0x258
el0_svc_common.constprop.0+0x160/0x22c
do_el0_svc+0x44/0x5c
el0_svc+0x48/0xb8
el0t_64_sync_handler+0x13c/0x158
el0t_64_sync+0x190/0x194
Code: f9400753 d2dff800 f2fbffe0 d343fe7c (38e06b80)
---[ end trace 0000000000000000 ]---
Kernel panic - not syncing: Oops: Fatal exception
Link: https://lore.kernel.org/r/20241112080314.407966-1-ruanjinjie@huawei.com
Cc: stable@vger.kernel.org
Fixes: a3fdf784780c ("kunit: string-stream: Decouple string_stream from kunit")
Suggested-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Reviewed-by: Kuan-Wei Chiu <visitorckw@gmail.com>
Reviewed-by: David Gow <davidgow@google.com>
Signed-off-by: Shuah Khan <skhan@linuxfoundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/kunit/debugfs.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/lib/kunit/debugfs.c
+++ b/lib/kunit/debugfs.c
@@ -212,8 +212,11 @@ void kunit_debugfs_create_suite(struct k
err:
string_stream_destroy(suite->log);
- kunit_suite_for_each_test_case(suite, test_case)
+ suite->log = NULL;
+ kunit_suite_for_each_test_case(suite, test_case) {
string_stream_destroy(test_case->log);
+ test_case->log = NULL;
+ }
}
void kunit_debugfs_destroy_suite(struct kunit_suite *suite)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 043/146] ovl: Filter invalid inodes with missing lookup function
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 042/146] kunit: string-stream: Fix a UAF bug in kunit_init_suite() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 044/146] maple_tree: refine mas_store_root() on storing NULL Greg Kroah-Hartman
` (110 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, syzbot+a8c9d476508bd14a90e5,
Miklos Szeredi, Vasiliy Kovalev, Amir Goldstein
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasiliy Kovalev <kovalev@altlinux.org>
commit c8b359dddb418c60df1a69beea01d1b3322bfe83 upstream.
Add a check to the ovl_dentry_weird() function to prevent the
processing of directory inodes that lack the lookup function.
This is important because such inodes can cause errors in overlayfs
when passed to the lowerstack.
Reported-by: syzbot+a8c9d476508bd14a90e5@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=a8c9d476508bd14a90e5
Suggested-by: Miklos Szeredi <miklos@szeredi.hu>
Link: https://lore.kernel.org/linux-unionfs/CAJfpegvx-oS9XGuwpJx=Xe28_jzWx5eRo1y900_ZzWY+=gGzUg@mail.gmail.com/
Signed-off-by: Vasiliy Kovalev <kovalev@altlinux.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/util.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -197,6 +197,9 @@ void ovl_dentry_init_flags(struct dentry
bool ovl_dentry_weird(struct dentry *dentry)
{
+ if (!d_can_lookup(dentry) && !d_is_file(dentry) && !d_is_symlink(dentry))
+ return true;
+
return dentry->d_flags & (DCACHE_NEED_AUTOMOUNT |
DCACHE_MANAGE_TRANSIT |
DCACHE_OP_HASH |
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 044/146] maple_tree: refine mas_store_root() on storing NULL
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 043/146] ovl: Filter invalid inodes with missing lookup function Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 045/146] ftrace: Fix regression with module command in stack_trace_filter Greg Kroah-Hartman
` (109 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Wei Yang, Liam R. Howlett,
Sidhartha Kumar, Lorenzo Stoakes, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yang <richard.weiyang@gmail.com>
commit 0ea120b278ad7f7cfeeb606e150ad04b192df60b upstream.
Currently, when storing NULL on mas_store_root(), the behavior could be
improved.
Storing NULLs over the entire tree may result in a node being used to
store a single range. Further stores of NULL may cause the node and
tree to be corrupt and cause incorrect behaviour. Fixing the store to
the root null fixes the issue by ensuring that a range of 0 - ULONG_MAX
results in an empty tree.
Users of the tree may experience incorrect values returned if the tree
was expanded to store values, then overwritten by all NULLS, then
continued to store NULLs over the empty area.
For example possible cases are:
* store NULL at any range result a new node
* store NULL at range [m, n] where m > 0 to a single entry tree result
a new node with range [m, n] set to NULL
* store NULL at range [m, n] where m > 0 to an empty tree result
consecutive NULL slot
* it allows for multiple NULL entries by expanding root
to store NULLs to an empty tree
This patch tries to improve in:
* memory efficient by setting to empty tree instead of using a node
* remove the possibility of consecutive NULL slot which will prohibit
extended null in later operation
Link: https://lkml.kernel.org/r/20241031231627.14316-5-richard.weiyang@gmail.com
Fixes: 54a611b60590 ("Maple Tree: add new data structure")
Signed-off-by: Wei Yang <richard.weiyang@gmail.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Liam R. Howlett <Liam.Howlett@Oracle.com>
Cc: Sidhartha Kumar <sidhartha.kumar@oracle.com>
Cc: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
lib/maple_tree.c | 13 ++++++++++++-
1 file changed, 12 insertions(+), 1 deletion(-)
--- a/lib/maple_tree.c
+++ b/lib/maple_tree.c
@@ -3439,9 +3439,20 @@ static inline int mas_root_expand(struct
return slot;
}
+/*
+ * mas_store_root() - Storing value into root.
+ * @mas: The maple state
+ * @entry: The entry to store.
+ *
+ * There is no root node now and we are storing a value into the root - this
+ * function either assigns the pointer or expands into a node.
+ */
static inline void mas_store_root(struct ma_state *mas, void *entry)
{
- if (likely((mas->last != 0) || (mas->index != 0)))
+ if (!entry) {
+ if (!mas->index)
+ rcu_assign_pointer(mas->tree->ma_root, NULL);
+ } else if (likely((mas->last != 0) || (mas->index != 0)))
mas_root_expand(mas, entry);
else if (((unsigned long) (entry) & 3) == 2)
mas_root_expand(mas, entry);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 045/146] ftrace: Fix regression with module command in stack_trace_filter
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 044/146] maple_tree: refine mas_store_root() on storing NULL Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 046/146] vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event Greg Kroah-Hartman
` (108 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Masami Hiramatsu, Mark Rutland,
Mathieu Desnoyers, guoweikang, Steven Rostedt (Google)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: guoweikang <guoweikang.kernel@gmail.com>
commit 45af52e7d3b8560f21d139b3759735eead8b1653 upstream.
When executing the following command:
# echo "write*:mod:ext3" > /sys/kernel/tracing/stack_trace_filter
The current mod command causes a null pointer dereference. While commit
0f17976568b3f ("ftrace: Fix regression with module command in stack_trace_filter")
has addressed part of the issue, it left a corner case unhandled, which still
results in a kernel crash.
Cc: stable@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Link: https://lore.kernel.org/20241120052750.275463-1-guoweikang.kernel@gmail.com
Fixes: 04ec7bb642b77 ("tracing: Have the trace_array hold the list of registered func probes");
Signed-off-by: guoweikang <guoweikang.kernel@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/trace/ftrace.c | 3 +++
1 file changed, 3 insertions(+)
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -5080,6 +5080,9 @@ ftrace_mod_callback(struct trace_array *
char *func;
int ret;
+ if (!tr)
+ return -ENODEV;
+
/* match_records() modifies func, and we need the original */
func = kstrdup(func_orig, GFP_KERNEL);
if (!func)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 046/146] vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 045/146] ftrace: Fix regression with module command in stack_trace_filter Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 047/146] zram: clear IDLE flag after recompression Greg Kroah-Hartman
` (107 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, MengEn Sun, JinLiang Zheng,
Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: MengEn Sun <mengensun@tencent.com>
commit 2ea80b039b9af0b71c00378523b71c254fb99c23 upstream.
Since 5.14-rc1, NUMA events will only be folded from per-CPU statistics to
per zone and global statistics when the user actually needs it.
Currently, the kernel has performs the fold operation when reading
/proc/vmstat, but does not perform the fold operation in /proc/zoneinfo.
This can lead to inaccuracies in the following statistics in zoneinfo:
- numa_hit
- numa_miss
- numa_foreign
- numa_interleave
- numa_local
- numa_other
Therefore, before printing per-zone vm_numa_event when reading
/proc/zoneinfo, we should also perform the fold operation.
Link: https://lkml.kernel.org/r/1730433998-10461-1-git-send-email-mengensun@tencent.com
Fixes: f19298b9516c ("mm/vmstat: convert NUMA statistics to basic NUMA counters")
Signed-off-by: MengEn Sun <mengensun@tencent.com>
Reviewed-by: JinLiang Zheng <alexjlzheng@tencent.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/vmstat.c | 1 +
1 file changed, 1 insertion(+)
--- a/mm/vmstat.c
+++ b/mm/vmstat.c
@@ -1780,6 +1780,7 @@ static void zoneinfo_show_print(struct s
zone_page_state(zone, i));
#ifdef CONFIG_NUMA
+ fold_vm_zone_numa_events(zone);
for (i = 0; i < NR_VM_NUMA_EVENT_ITEMS; i++)
seq_printf(m, "\n %-12s %lu", numa_stat_name(i),
zone_numa_event_state(zone, i));
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 047/146] zram: clear IDLE flag after recompression
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 046/146] vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 048/146] iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables Greg Kroah-Hartman
` (106 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Sergey Senozhatsky, Shin Kawamura,
Brian Geffon, Minchan Kim, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Senozhatsky <senozhatsky@chromium.org>
commit f85219096648b251a81e9fe24a1974590cfc417d upstream.
Patch series "zram: IDLE flag handling fixes", v2.
zram can wrongly preserve ZRAM_IDLE flag on its entries which can result
in premature post-processing (writeback and recompression) of such
entries.
This patch (of 2)
Recompression should clear ZRAM_IDLE flag on the entries it has accessed,
because otherwise some entries, specifically those for which recompression
has failed, become immediate candidate entries for another post-processing
(e.g. writeback).
Consider the following case:
- recompression marks entries IDLE every 4 hours and attempts
to recompress them
- some entries are incompressible, so we keep them intact and
hence preserve IDLE flag
- writeback marks entries IDLE every 8 hours and writebacks
IDLE entries, however we have IDLE entries left from
recompression, so writeback prematurely writebacks those
entries.
The bug was reported by Shin Kawamura.
Link: https://lkml.kernel.org/r/20241028153629.1479791-1-senozhatsky@chromium.org
Link: https://lkml.kernel.org/r/20241028153629.1479791-2-senozhatsky@chromium.org
Fixes: 84b33bf78889 ("zram: introduce recompress sysfs knob")
Signed-off-by: Sergey Senozhatsky <senozhatsky@chromium.org>
Reported-by: Shin Kawamura <kawasin@google.com>
Acked-by: Brian Geffon <bgeffon@google.com>
Cc: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/zram/zram_drv.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -1692,6 +1692,13 @@ static int zram_recompress(struct zram *
if (ret)
return ret;
+ /*
+ * We touched this entry so mark it as non-IDLE. This makes sure that
+ * we don't preserve IDLE flag and don't incorrectly pick this entry
+ * for different post-processing type (e.g. writeback).
+ */
+ zram_clear_flag(zram, index, ZRAM_IDLE);
+
class_index_old = zs_lookup_class_index(zram->mem_pool, comp_len_old);
/*
* Iterate the secondary comp algorithms list (in order of priority)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 048/146] iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 047/146] zram: clear IDLE flag after recompression Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 049/146] iommu/arm-smmu: Defer probe of clients after smmu device bound Greg Kroah-Hartman
` (105 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Mostafa Saleh, Will Deacon
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mostafa Saleh <smostafa@google.com>
commit d71fa842d33c48ac2809ae11d2379b5a788792cb upstream.
ARM_LPAE_LVL_IDX() takes into account concatenated PGDs and can return
an index spanning multiple page-table pages given a sufficiently large
input address. However, when the resulting index is used to calculate
the number of remaining entries in the page, the possibility of
concatenation is ignored and we end up computing a negative upper bound:
max_entries = ARM_LPAE_PTES_PER_TABLE(data) - map_idx_start;
On the map path, this results in a negative 'mapped' value being
returned but on the unmap path we can leak child tables if they are
skipped in __arm_lpae_free_pgtable().
Introduce an arm_lpae_max_entries() helper to convert a table index into
the remaining number of entries within a single page-table page.
Cc: <stable@vger.kernel.org>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Link: https://lore.kernel.org/r/20241024162516.2005652-2-smostafa@google.com
[will: Tweaked comment and commit message]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/io-pgtable-arm.c | 18 +++++++++++++++---
1 file changed, 15 insertions(+), 3 deletions(-)
--- a/drivers/iommu/io-pgtable-arm.c
+++ b/drivers/iommu/io-pgtable-arm.c
@@ -199,6 +199,18 @@ static phys_addr_t iopte_to_paddr(arm_lp
return (paddr | (paddr << (48 - 12))) & (ARM_LPAE_PTE_ADDR_MASK << 4);
}
+/*
+ * Convert an index returned by ARM_LPAE_PGD_IDX(), which can point into
+ * a concatenated PGD, into the maximum number of entries that can be
+ * mapped in the same table page.
+ */
+static inline int arm_lpae_max_entries(int i, struct arm_lpae_io_pgtable *data)
+{
+ int ptes_per_table = ARM_LPAE_PTES_PER_TABLE(data);
+
+ return ptes_per_table - (i & (ptes_per_table - 1));
+}
+
static bool selftest_running = false;
static dma_addr_t __arm_lpae_dma_addr(void *pages)
@@ -390,7 +402,7 @@ static int __arm_lpae_map(struct arm_lpa
/* If we can install a leaf entry at this level, then do so */
if (size == block_size) {
- max_entries = ARM_LPAE_PTES_PER_TABLE(data) - map_idx_start;
+ max_entries = arm_lpae_max_entries(map_idx_start, data);
num_entries = min_t(int, pgcount, max_entries);
ret = arm_lpae_init_pte(data, iova, paddr, prot, lvl, num_entries, ptep);
if (!ret)
@@ -592,7 +604,7 @@ static size_t arm_lpae_split_blk_unmap(s
if (size == split_sz) {
unmap_idx_start = ARM_LPAE_LVL_IDX(iova, lvl, data);
- max_entries = ptes_per_table - unmap_idx_start;
+ max_entries = arm_lpae_max_entries(unmap_idx_start, data);
num_entries = min_t(int, pgcount, max_entries);
}
@@ -650,7 +662,7 @@ static size_t __arm_lpae_unmap(struct ar
/* If the size matches this level, we're in the right place */
if (size == ARM_LPAE_BLOCK_SIZE(lvl, data)) {
- max_entries = ARM_LPAE_PTES_PER_TABLE(data) - unmap_idx_start;
+ max_entries = arm_lpae_max_entries(unmap_idx_start, data);
num_entries = min_t(int, pgcount, max_entries);
/* Find and handle non-leaf entries */
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 049/146] iommu/arm-smmu: Defer probe of clients after smmu device bound
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 048/146] iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 050/146] leds: lp55xx: Remove redundant test for invalid channel number Greg Kroah-Hartman
` (104 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Prakash Gupta, Pratyush Brahma,
Will Deacon
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pratyush Brahma <quic_pbrahma@quicinc.com>
commit 229e6ee43d2a160a1592b83aad620d6027084aad upstream.
Null pointer dereference occurs due to a race between smmu
driver probe and client driver probe, when of_dma_configure()
for client is called after the iommu_device_register() for smmu driver
probe has executed but before the driver_bound() for smmu driver
has been called.
Following is how the race occurs:
T1:Smmu device probe T2: Client device probe
really_probe()
arm_smmu_device_probe()
iommu_device_register()
really_probe()
platform_dma_configure()
of_dma_configure()
of_dma_configure_id()
of_iommu_configure()
iommu_probe_device()
iommu_init_device()
arm_smmu_probe_device()
arm_smmu_get_by_fwnode()
driver_find_device_by_fwnode()
driver_find_device()
next_device()
klist_next()
/* null ptr
assigned to smmu */
/* null ptr dereference
while smmu->streamid_mask */
driver_bound()
klist_add_tail()
When this null smmu pointer is dereferenced later in
arm_smmu_probe_device, the device crashes.
Fix this by deferring the probe of the client device
until the smmu device has bound to the arm smmu driver.
Fixes: 021bb8420d44 ("iommu/arm-smmu: Wire up generic configuration support")
Cc: stable@vger.kernel.org
Co-developed-by: Prakash Gupta <quic_guptap@quicinc.com>
Signed-off-by: Prakash Gupta <quic_guptap@quicinc.com>
Signed-off-by: Pratyush Brahma <quic_pbrahma@quicinc.com>
Link: https://lore.kernel.org/r/20241004090428.2035-1-quic_pbrahma@quicinc.com
[will: Add comment]
Signed-off-by: Will Deacon <will@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/iommu/arm/arm-smmu/arm-smmu.c
+++ b/drivers/iommu/arm/arm-smmu/arm-smmu.c
@@ -1437,6 +1437,17 @@ static struct iommu_device *arm_smmu_pro
goto out_free;
} else {
smmu = arm_smmu_get_by_fwnode(fwspec->iommu_fwnode);
+
+ /*
+ * Defer probe if the relevant SMMU instance hasn't finished
+ * probing yet. This is a fragile hack and we'd ideally
+ * avoid this race in the core code. Until that's ironed
+ * out, however, this is the most pragmatic option on the
+ * table.
+ */
+ if (!smmu)
+ return ERR_PTR(dev_err_probe(dev, -EPROBE_DEFER,
+ "smmu dev has not bound yet\n"));
}
ret = -EINVAL;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 050/146] leds: lp55xx: Remove redundant test for invalid channel number
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 049/146] iommu/arm-smmu: Defer probe of clients after smmu device bound Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 051/146] mm/damon/vaddr: fix issue in damon_va_evenly_split_region() Greg Kroah-Hartman
` (103 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Michal Vokáč, Lee Jones
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Vokáč <michal.vokac@ysoft.com>
commit 09b1ef9813a0742674f7efe26104403ca94a1b4a upstream.
Since commit 92a81562e695 ("leds: lp55xx: Add multicolor framework
support to lp55xx") there are two subsequent tests if the chan_nr
(reg property) is in valid range. One in the lp55xx_init_led()
function and one in the lp55xx_parse_common_child() function that
was added with the mentioned commit.
There are two issues with that.
First is in the lp55xx_parse_common_child() function where the reg
property is tested right after it is read from the device tree.
Test for the upper range is not correct though. Valid reg values are
0 to (max_channel - 1) so it should be >=.
Second issue is that in case the parsed value is out of the range
the probe just fails and no error message is shown as the code never
reaches the second test that prints and error message.
Remove the test form lp55xx_parse_common_child() function completely
and keep the one in lp55xx_init_led() function to deal with it.
Fixes: 92a81562e695 ("leds: lp55xx: Add multicolor framework support to lp55xx")
Cc: stable@vger.kernel.org
Signed-off-by: Michal Vokáč <michal.vokac@ysoft.com>
Link: https://lore.kernel.org/r/20241017150812.3563629-1-michal.vokac@ysoft.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/leds-lp55xx-common.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/leds/leds-lp55xx-common.c
+++ b/drivers/leds/leds-lp55xx-common.c
@@ -1132,9 +1132,6 @@ static int lp55xx_parse_common_child(str
if (ret)
return ret;
- if (*chan_nr < 0 || *chan_nr > cfg->max_channel)
- return -EINVAL;
-
return 0;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 051/146] mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 050/146] leds: lp55xx: Remove redundant test for invalid channel number Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 052/146] powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang Greg Kroah-Hartman
` (102 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zheng Yejian, SeongJae Park,
Fernand Sieber, Leonard Foerster, Shakeel Butt, Ye Weihua,
Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zheng Yejian <zhengyejian@huaweicloud.com>
commit f3c7a1ede435e2e45177d7a490a85fb0a0ec96d1 upstream.
Patch series "mm/damon/vaddr: Fix issue in
damon_va_evenly_split_region()". v2.
According to the logic of damon_va_evenly_split_region(), currently
following split case would not meet the expectation:
Suppose DAMON_MIN_REGION=0x1000,
Case: Split [0x0, 0x3000) into 2 pieces, then the result would be
acutually 3 regions:
[0x0, 0x1000), [0x1000, 0x2000), [0x2000, 0x3000)
but NOT the expected 2 regions:
[0x0, 0x1000), [0x1000, 0x3000) !!!
The root cause is that when calculating size of each split piece in
damon_va_evenly_split_region():
`sz_piece = ALIGN_DOWN(sz_orig / nr_pieces, DAMON_MIN_REGION);`
both the dividing and the ALIGN_DOWN may cause loss of precision, then
each time split one piece of size 'sz_piece' from origin 'start' to 'end'
would cause more pieces are split out than expected!!!
To fix it, count for each piece split and make sure no more than
'nr_pieces'. In addition, add above case into damon_test_split_evenly().
And add 'nr_piece == 1' check in damon_va_evenly_split_region() for better
code readability and add a corresponding kunit testcase.
This patch (of 2):
According to the logic of damon_va_evenly_split_region(), currently
following split case would not meet the expectation:
Suppose DAMON_MIN_REGION=0x1000,
Case: Split [0x0, 0x3000) into 2 pieces, then the result would be
acutually 3 regions:
[0x0, 0x1000), [0x1000, 0x2000), [0x2000, 0x3000)
but NOT the expected 2 regions:
[0x0, 0x1000), [0x1000, 0x3000) !!!
The root cause is that when calculating size of each split piece in
damon_va_evenly_split_region():
`sz_piece = ALIGN_DOWN(sz_orig / nr_pieces, DAMON_MIN_REGION);`
both the dividing and the ALIGN_DOWN may cause loss of precision,
then each time split one piece of size 'sz_piece' from origin 'start' to
'end' would cause more pieces are split out than expected!!!
To fix it, count for each piece split and make sure no more than
'nr_pieces'. In addition, add above case into damon_test_split_evenly().
After this patch, damon-operations test passed:
# ./tools/testing/kunit/kunit.py run damon-operations
[...]
============== damon-operations (6 subtests) ===============
[PASSED] damon_test_three_regions_in_vmas
[PASSED] damon_test_apply_three_regions1
[PASSED] damon_test_apply_three_regions2
[PASSED] damon_test_apply_three_regions3
[PASSED] damon_test_apply_three_regions4
[PASSED] damon_test_split_evenly
================ [PASSED] damon-operations =================
Link: https://lkml.kernel.org/r/20241022083927.3592237-1-zhengyejian@huaweicloud.com
Link: https://lkml.kernel.org/r/20241022083927.3592237-2-zhengyejian@huaweicloud.com
Fixes: 3f49584b262c ("mm/damon: implement primitives for the virtual memory address spaces")
Signed-off-by: Zheng Yejian <zhengyejian@huaweicloud.com>
Reviewed-by: SeongJae Park <sj@kernel.org>
Cc: Fernand Sieber <sieberf@amazon.com>
Cc: Leonard Foerster <foersleo@amazon.de>
Cc: Shakeel Butt <shakeel.butt@linux.dev>
Cc: Ye Weihua <yeweihua4@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/damon/tests/vaddr-kunit.h | 1 +
mm/damon/vaddr.c | 4 ++--
2 files changed, 3 insertions(+), 2 deletions(-)
--- a/mm/damon/tests/vaddr-kunit.h
+++ b/mm/damon/tests/vaddr-kunit.h
@@ -300,6 +300,7 @@ static void damon_test_split_evenly(stru
damon_test_split_evenly_fail(test, 0, 100, 0);
damon_test_split_evenly_succ(test, 0, 100, 10);
damon_test_split_evenly_succ(test, 5, 59, 5);
+ damon_test_split_evenly_succ(test, 0, 3, 2);
damon_test_split_evenly_fail(test, 5, 6, 2);
}
--- a/mm/damon/vaddr.c
+++ b/mm/damon/vaddr.c
@@ -67,6 +67,7 @@ static int damon_va_evenly_split_region(
unsigned long sz_orig, sz_piece, orig_end;
struct damon_region *n = NULL, *next;
unsigned long start;
+ unsigned int i;
if (!r || !nr_pieces)
return -EINVAL;
@@ -80,8 +81,7 @@ static int damon_va_evenly_split_region(
r->ar.end = r->ar.start + sz_piece;
next = damon_next_region(r);
- for (start = r->ar.end; start + sz_piece <= orig_end;
- start += sz_piece) {
+ for (start = r->ar.end, i = 1; i < nr_pieces; start += sz_piece, i++) {
n = damon_new_region(start, start + sz_piece);
if (!n)
return -ENOMEM;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 052/146] powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 051/146] mm/damon/vaddr: fix issue in damon_va_evenly_split_region() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 053/146] cpufreq: scmi: Fix cleanup path when boost enablement fails Greg Kroah-Hartman
` (101 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nathan Chancellor, Michael Ellerman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit d677ce521334d8f1f327cafc8b1b7854b0833158 upstream.
Under certain conditions, the 64-bit '-mstack-protector-guard' flags may
end up in the 32-bit vDSO flags, resulting in build failures due to the
structure of clang's argument parsing of the stack protector options,
which validates the arguments of the stack protector guard flags
unconditionally in the frontend, choking on the 64-bit values when
targeting 32-bit:
clang: error: invalid value 'r13' in 'mstack-protector-guard-reg=', expected one of: r2
clang: error: invalid value 'r13' in 'mstack-protector-guard-reg=', expected one of: r2
make[3]: *** [arch/powerpc/kernel/vdso/Makefile:85: arch/powerpc/kernel/vdso/vgettimeofday-32.o] Error 1
make[3]: *** [arch/powerpc/kernel/vdso/Makefile:87: arch/powerpc/kernel/vdso/vgetrandom-32.o] Error 1
Remove these flags by adding them to the CC32FLAGSREMOVE variable, which
already handles situations similar to this. Additionally, reformat and
align a comment better for the expanding CONFIG_CC_IS_CLANG block.
Cc: stable@vger.kernel.org # v6.1+
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://patch.msgid.link/20241030-powerpc-vdso-drop-stackp-flags-clang-v1-1-d95e7376d29c@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/kernel/vdso/Makefile | 8 ++++++--
1 file changed, 6 insertions(+), 2 deletions(-)
--- a/arch/powerpc/kernel/vdso/Makefile
+++ b/arch/powerpc/kernel/vdso/Makefile
@@ -54,10 +54,14 @@ ldflags-y += $(filter-out $(CC_AUTO_VAR_
CC32FLAGS := -m32
CC32FLAGSREMOVE := -mcmodel=medium -mabi=elfv1 -mabi=elfv2 -mcall-aixdesc
- # This flag is supported by clang for 64-bit but not 32-bit so it will cause
- # an unused command line flag warning for this file.
ifdef CONFIG_CC_IS_CLANG
+# This flag is supported by clang for 64-bit but not 32-bit so it will cause
+# an unused command line flag warning for this file.
CC32FLAGSREMOVE += -fno-stack-clash-protection
+# -mstack-protector-guard values from the 64-bit build are not valid for the
+# 32-bit one. clang validates the values passed to these arguments during
+# parsing, even when -fno-stack-protector is passed afterwards.
+CC32FLAGSREMOVE += -mstack-protector-guard%
endif
LD32FLAGS := -Wl,-soname=linux-vdso32.so.1
AS32FLAGS := -D__VDSO32__
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 053/146] cpufreq: scmi: Fix cleanup path when boost enablement fails
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 052/146] powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 054/146] clk: qcom: gcc-qcs404: fix initial rate of GPLL3 Greg Kroah-Hartman
` (100 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Sibi Sankar, Viresh Kumar
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sibi Sankar <quic_sibis@quicinc.com>
commit 8c776a54d9ef3e945db2fe407ad6ad4525422943 upstream.
Include free_cpufreq_table in the cleanup path when boost enablement fails.
cc: stable@vger.kernel.org
Fixes: a8e949d41c72 ("cpufreq: scmi: Enable boost support")
Signed-off-by: Sibi Sankar <quic_sibis@quicinc.com>
Signed-off-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/scmi-cpufreq.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/cpufreq/scmi-cpufreq.c
+++ b/drivers/cpufreq/scmi-cpufreq.c
@@ -287,7 +287,7 @@ static int scmi_cpufreq_init(struct cpuf
ret = cpufreq_enable_boost_support();
if (ret) {
dev_warn(cpu_dev, "failed to enable boost: %d\n", ret);
- goto out_free_opp;
+ goto out_free_table;
} else {
scmi_cpufreq_hw_attr[1] = &cpufreq_freq_attr_scaling_boost_freqs;
scmi_cpufreq_driver.boost_enabled = true;
@@ -296,6 +296,8 @@ static int scmi_cpufreq_init(struct cpuf
return 0;
+out_free_table:
+ dev_pm_opp_free_cpufreq_table(cpu_dev, &freq_table);
out_free_opp:
dev_pm_opp_remove_all_dynamic(cpu_dev);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 054/146] clk: qcom: gcc-qcs404: fix initial rate of GPLL3
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 053/146] cpufreq: scmi: Fix cleanup path when boost enablement fails Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 055/146] ad7780: fix division by zero in ad7780_write_raw() Greg Kroah-Hartman
` (99 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Gabor Juhos, Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gabor Juhos <j4g8y7@gmail.com>
commit 36d202241d234fa4ac50743510d098ad52bd193a upstream.
The comment before the config of the GPLL3 PLL says that the
PLL should run at 930 MHz. In contrary to this, calculating
the frequency from the current configuration values by using
19.2 MHz as input frequency defined in 'qcs404.dtsi', it gives
921.6 MHz:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x0
$ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l
921600000.00000000000000000000
Set 'alpha_hi' in the configuration to a value used in downstream
kernels [1][2] in order to get the correct output rate:
$ xo=19200000; l=48; alpha=0x0; alpha_hi=0x70
$ echo "$xo * ($((l)) + $(((alpha_hi << 32 | alpha) >> 8)) / 2^32)" | bc -l
930000000.00000000000000000000
The change is based on static code analysis, compile tested only.
[1] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/kernel.lnx.5.4.r56-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L335
[2} https://git.codelinaro.org/clo/la/kernel/msm-5.15/-/blob/kernel.lnx.5.15.r49-rel/drivers/clk/qcom/gcc-qcs404.c?ref_type=heads#L127
Cc: stable@vger.kernel.org
Fixes: 652f1813c113 ("clk: qcom: gcc: Add global clock controller driver for QCS404")
Signed-off-by: Gabor Juhos <j4g8y7@gmail.com>
Link: https://lore.kernel.org/r/20241022-fix-gcc-qcs404-gpll3-v1-1-c4d30d634d19@gmail.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/qcom/gcc-qcs404.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/clk/qcom/gcc-qcs404.c
+++ b/drivers/clk/qcom/gcc-qcs404.c
@@ -131,6 +131,7 @@ static struct clk_alpha_pll gpll1_out_ma
/* 930MHz configuration */
static const struct alpha_pll_config gpll3_config = {
.l = 48,
+ .alpha_hi = 0x70,
.alpha = 0x0,
.alpha_en_mask = BIT(24),
.post_div_mask = 0xf << 8,
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 055/146] ad7780: fix division by zero in ad7780_write_raw()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 054/146] clk: qcom: gcc-qcs404: fix initial rate of GPLL3 Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 056/146] nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write() Greg Kroah-Hartman
` (98 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zicheng Qu, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <quzicheng@huawei.com>
commit c174b53e95adf2eece2afc56cd9798374919f99a upstream.
In the ad7780_write_raw() , val2 can be zero, which might lead to a
division by zero error in DIV_ROUND_CLOSEST(). The ad7780_write_raw()
is based on iio_info's write_raw. While val is explicitly declared that
can be zero (in read mode), val2 is not specified to be non-zero.
Fixes: 9085daa4abcc ("staging: iio: ad7780: add gain & filter gpio support")
Cc: stable@vger.kernel.org
Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
Link: https://patch.msgid.link/20241028142027.1032332-1-quzicheng@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7780.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/adc/ad7780.c
+++ b/drivers/iio/adc/ad7780.c
@@ -152,7 +152,7 @@ static int ad7780_write_raw(struct iio_d
switch (m) {
case IIO_CHAN_INFO_SCALE:
- if (val != 0)
+ if (val != 0 || val2 == 0)
return -EINVAL;
vref = st->int_vref_mv * 1000000LL;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 056/146] nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 055/146] ad7780: fix division by zero in ad7780_write_raw() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 057/146] driver core: fw_devlink: Stop trying to optimize cycle detection logic Greg Kroah-Hartman
` (97 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stable, Marek Vasut,
Srinivas Kandagatla
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Marek Vasut <marex@denx.de>
commit da9596955c05966768364ab1cad2f43fcddc6f06 upstream.
The bin_attr_nvmem_write() must check the read_only flag and block
writes on read-only devices, now that a nvmem device can be switched
between read-write and read-only mode at runtime using the force_ro
attribute. Add the missing check.
Fixes: 9d7eb234ac7a ("nvmem: core: Implement force_ro sysfs attribute")
Cc: Stable@vger.kernel.org
Signed-off-by: Marek Vasut <marex@denx.de>
Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
Link: https://lore.kernel.org/r/20241030140253.40445-2-srinivas.kandagatla@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/nvmem/core.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/nvmem/core.c
+++ b/drivers/nvmem/core.c
@@ -267,7 +267,7 @@ static ssize_t bin_attr_nvmem_write(stru
count = round_down(count, nvmem->word_size);
- if (!nvmem->reg_write)
+ if (!nvmem->reg_write || nvmem->read_only)
return -EPERM;
rc = nvmem_reg_write(nvmem, pos, buf, count);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 057/146] driver core: fw_devlink: Stop trying to optimize cycle detection logic
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 056/146] nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 058/146] spmi: pmic-arb: fix return path in for_each_available_child_of_node() Greg Kroah-Hartman
` (96 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Tomi Valkeinen, stable,
Saravana Kannan
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Saravana Kannan <saravanak@google.com>
commit bac3b10b78e54b7da3cede397258f75a2180609b upstream.
In attempting to optimize fw_devlink runtime, I introduced numerous cycle
detection bugs by foregoing cycle detection logic under specific
conditions. Each fix has further narrowed the conditions for optimization.
It's time to give up on these optimization attempts and just run the cycle
detection logic every time fw_devlink tries to create a device link.
The specific bug report that triggered this fix involved a supplier fwnode
that never gets a device created for it. Instead, the supplier fwnode is
represented by the device that corresponds to an ancestor fwnode.
In this case, fw_devlink didn't do any cycle detection because the cycle
detection logic is only run when a device link is created between the
devices that correspond to the actual consumer and supplier fwnodes.
With this change, fw_devlink will run cycle detection logic even when
creating SYNC_STATE_ONLY proxy device links from a device that is an
ancestor of a consumer fwnode.
Reported-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Closes: https://lore.kernel.org/all/1a1ab663-d068-40fb-8c94-f0715403d276@ideasonboard.com/
Fixes: 6442d79d880c ("driver core: fw_devlink: Improve detection of overlapping cycles")
Cc: stable <stable@kernel.org>
Tested-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Signed-off-by: Saravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/r/20241030171009.1853340-1-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/core.c | 55 ++++++++++++++++++++++------------------------------
1 file changed, 24 insertions(+), 31 deletions(-)
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -1989,10 +1989,10 @@ static struct device *fwnode_get_next_pa
*
* Return true if one or more cycles were found. Otherwise, return false.
*/
-static bool __fw_devlink_relax_cycles(struct device *con,
+static bool __fw_devlink_relax_cycles(struct fwnode_handle *con_handle,
struct fwnode_handle *sup_handle)
{
- struct device *sup_dev = NULL, *par_dev = NULL;
+ struct device *sup_dev = NULL, *par_dev = NULL, *con_dev = NULL;
struct fwnode_link *link;
struct device_link *dev_link;
bool ret = false;
@@ -2009,22 +2009,22 @@ static bool __fw_devlink_relax_cycles(st
sup_handle->flags |= FWNODE_FLAG_VISITED;
- sup_dev = get_dev_from_fwnode(sup_handle);
-
/* Termination condition. */
- if (sup_dev == con) {
+ if (sup_handle == con_handle) {
pr_debug("----- cycle: start -----\n");
ret = true;
goto out;
}
+ sup_dev = get_dev_from_fwnode(sup_handle);
+ con_dev = get_dev_from_fwnode(con_handle);
/*
* If sup_dev is bound to a driver and @con hasn't started binding to a
* driver, sup_dev can't be a consumer of @con. So, no need to check
* further.
*/
if (sup_dev && sup_dev->links.status == DL_DEV_DRIVER_BOUND &&
- con->links.status == DL_DEV_NO_DRIVER) {
+ con_dev && con_dev->links.status == DL_DEV_NO_DRIVER) {
ret = false;
goto out;
}
@@ -2033,7 +2033,7 @@ static bool __fw_devlink_relax_cycles(st
if (link->flags & FWLINK_FLAG_IGNORE)
continue;
- if (__fw_devlink_relax_cycles(con, link->supplier)) {
+ if (__fw_devlink_relax_cycles(con_handle, link->supplier)) {
__fwnode_link_cycle(link);
ret = true;
}
@@ -2048,7 +2048,7 @@ static bool __fw_devlink_relax_cycles(st
else
par_dev = fwnode_get_next_parent_dev(sup_handle);
- if (par_dev && __fw_devlink_relax_cycles(con, par_dev->fwnode)) {
+ if (par_dev && __fw_devlink_relax_cycles(con_handle, par_dev->fwnode)) {
pr_debug("%pfwf: cycle: child of %pfwf\n", sup_handle,
par_dev->fwnode);
ret = true;
@@ -2066,7 +2066,7 @@ static bool __fw_devlink_relax_cycles(st
!(dev_link->flags & DL_FLAG_CYCLE))
continue;
- if (__fw_devlink_relax_cycles(con,
+ if (__fw_devlink_relax_cycles(con_handle,
dev_link->supplier->fwnode)) {
pr_debug("%pfwf: cycle: depends on %pfwf\n", sup_handle,
dev_link->supplier->fwnode);
@@ -2114,11 +2114,6 @@ static int fw_devlink_create_devlink(str
if (link->flags & FWLINK_FLAG_IGNORE)
return 0;
- if (con->fwnode == link->consumer)
- flags = fw_devlink_get_flags(link->flags);
- else
- flags = FW_DEVLINK_FLAGS_PERMISSIVE;
-
/*
* In some cases, a device P might also be a supplier to its child node
* C. However, this would defer the probe of C until the probe of P
@@ -2139,25 +2134,23 @@ static int fw_devlink_create_devlink(str
return -EINVAL;
/*
- * SYNC_STATE_ONLY device links don't block probing and supports cycles.
- * So, one might expect that cycle detection isn't necessary for them.
- * However, if the device link was marked as SYNC_STATE_ONLY because
- * it's part of a cycle, then we still need to do cycle detection. This
- * is because the consumer and supplier might be part of multiple cycles
- * and we need to detect all those cycles.
+ * Don't try to optimize by not calling the cycle detection logic under
+ * certain conditions. There's always some corner case that won't get
+ * detected.
*/
- if (!device_link_flag_is_sync_state_only(flags) ||
- flags & DL_FLAG_CYCLE) {
- device_links_write_lock();
- if (__fw_devlink_relax_cycles(con, sup_handle)) {
- __fwnode_link_cycle(link);
- flags = fw_devlink_get_flags(link->flags);
- pr_debug("----- cycle: end -----\n");
- dev_info(con, "Fixed dependency cycle(s) with %pfwf\n",
- sup_handle);
- }
- device_links_write_unlock();
+ device_links_write_lock();
+ if (__fw_devlink_relax_cycles(link->consumer, sup_handle)) {
+ __fwnode_link_cycle(link);
+ pr_debug("----- cycle: end -----\n");
+ pr_info("%pfwf: Fixed dependency cycle(s) with %pfwf\n",
+ link->consumer, sup_handle);
}
+ device_links_write_unlock();
+
+ if (con->fwnode == link->consumer)
+ flags = fw_devlink_get_flags(link->flags);
+ else
+ flags = FW_DEVLINK_FLAGS_PERMISSIVE;
if (sup_handle->flags & FWNODE_FLAG_NOT_DEVICE)
sup_dev = fwnode_get_next_parent_dev(sup_handle);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 058/146] spmi: pmic-arb: fix return path in for_each_available_child_of_node()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 057/146] driver core: fw_devlink: Stop trying to optimize cycle detection logic Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 059/146] ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow Greg Kroah-Hartman
` (95 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Neil Armstrong,
Stephen Boyd
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit 77adf4b1f3e1fdb319f7ee515e5924bb77df3916 upstream.
This loop requires explicit calls to of_node_put() upon early exits
(break, goto, return) to decrement the child refcounter and avoid memory
leaks if the child is not required out of the loop.
A more robust solution is using the scoped variant of the macro, which
automatically calls of_node_put() when the child goes out of scope.
Cc: stable@vger.kernel.org
Fixes: 979987371739 ("spmi: pmic-arb: Add multi bus support")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/20241001-spmi-pmic-arb-scoped-v1-1-5872bab34ed6@gmail.com
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Signed-off-by: Stephen Boyd <sboyd@kernel.org>
Link: https://lore.kernel.org/r/20241109002829.160973-2-sboyd@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spmi/spmi-pmic-arb.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/spmi/spmi-pmic-arb.c
+++ b/drivers/spmi/spmi-pmic-arb.c
@@ -1763,14 +1763,13 @@ static int spmi_pmic_arb_register_buses(
{
struct device *dev = &pdev->dev;
struct device_node *node = dev->of_node;
- struct device_node *child;
int ret;
/* legacy mode doesn't provide child node for the bus */
if (of_device_is_compatible(node, "qcom,spmi-pmic-arb"))
return spmi_pmic_arb_bus_init(pdev, node, pmic_arb);
- for_each_available_child_of_node(node, child) {
+ for_each_available_child_of_node_scoped(node, child) {
if (of_node_name_eq(child, "spmi")) {
ret = spmi_pmic_arb_bus_init(pdev, child, pmic_arb);
if (ret)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 059/146] ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 058/146] spmi: pmic-arb: fix return path in for_each_available_child_of_node() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 060/146] s390/entry: Mark IRQ entries to fix stack depot warnings Greg Kroah-Hartman
` (94 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Clement LE GOFFIC, Mark Rutland,
Russell King (Oracle), Linus Walleij, Melon Liu
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit d6e6a74d4cea853b5321eeabb69c611148eedefe upstream.
When sync:ing the VMALLOC area to other CPUs, make sure to also
sync the KASAN shadow memory for the VMALLOC area, so that we
don't get stale entries for the shadow memory in the top level PGD.
Since we are now copying PGDs in two instances, create a helper
function named memcpy_pgd() to do the actual copying, and
create a helper to map the addresses of VMALLOC_START and
VMALLOC_END into the corresponding shadow memory.
Co-developed-by: Melon Liu <melon1335@163.com>
Cc: stable@vger.kernel.org
Fixes: 565cbaad83d8 ("ARM: 9202/1: kasan: support CONFIG_KASAN_VMALLOC")
Link: https://lore.kernel.org/linux-arm-kernel/a1a1d062-f3a2-4d05-9836-3b098de9db6d@foss.st.com/
Reported-by: Clement LE GOFFIC <clement.legoffic@foss.st.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Suggested-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Acked-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/ioremap.c | 33 +++++++++++++++++++++++++++++----
1 file changed, 29 insertions(+), 4 deletions(-)
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -23,6 +23,7 @@
*/
#include <linux/module.h>
#include <linux/errno.h>
+#include <linux/kasan.h>
#include <linux/mm.h>
#include <linux/vmalloc.h>
#include <linux/io.h>
@@ -115,16 +116,40 @@ int ioremap_page(unsigned long virt, uns
}
EXPORT_SYMBOL(ioremap_page);
+#ifdef CONFIG_KASAN
+static unsigned long arm_kasan_mem_to_shadow(unsigned long addr)
+{
+ return (unsigned long)kasan_mem_to_shadow((void *)addr);
+}
+#else
+static unsigned long arm_kasan_mem_to_shadow(unsigned long addr)
+{
+ return 0;
+}
+#endif
+
+static void memcpy_pgd(struct mm_struct *mm, unsigned long start,
+ unsigned long end)
+{
+ end = ALIGN(end, PGDIR_SIZE);
+ memcpy(pgd_offset(mm, start), pgd_offset_k(start),
+ sizeof(pgd_t) * (pgd_index(end) - pgd_index(start)));
+}
+
void __check_vmalloc_seq(struct mm_struct *mm)
{
int seq;
do {
seq = atomic_read(&init_mm.context.vmalloc_seq);
- memcpy(pgd_offset(mm, VMALLOC_START),
- pgd_offset_k(VMALLOC_START),
- sizeof(pgd_t) * (pgd_index(VMALLOC_END) -
- pgd_index(VMALLOC_START)));
+ memcpy_pgd(mm, VMALLOC_START, VMALLOC_END);
+ if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
+ unsigned long start =
+ arm_kasan_mem_to_shadow(VMALLOC_START);
+ unsigned long end =
+ arm_kasan_mem_to_shadow(VMALLOC_END);
+ memcpy_pgd(mm, start, end);
+ }
/*
* Use a store-release so that other CPUs that observe the
* counter's new value are guaranteed to see the results of the
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 060/146] s390/entry: Mark IRQ entries to fix stack depot warnings
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 059/146] ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 061/146] ARM: 9430/1: entry: Do a dummy read from VMAP shadow Greg Kroah-Hartman
` (93 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Heiko Carstens, Vasily Gorbik
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vasily Gorbik <gor@linux.ibm.com>
commit 45c9f2b856a075a34873d00788d2e8a250c1effd upstream.
The stack depot filters out everything outside of the top interrupt
context as an uninteresting or irrelevant part of the stack traces. This
helps with stack trace de-duplication, avoiding an explosion of saved
stack traces that share the same IRQ context code path but originate
from different randomly interrupted points, eventually exhausting the
stack depot.
Filtering uses in_irqentry_text() to identify functions within the
.irqentry.text and .softirqentry.text sections, which then become the
last stack trace entries being saved.
While __do_softirq() is placed into the .softirqentry.text section by
common code, populating .irqentry.text is architecture-specific.
Currently, the .irqentry.text section on s390 is empty, which prevents
stack depot filtering and de-duplication and could result in warnings
like:
Stack depot reached limit capacity
WARNING: CPU: 0 PID: 286113 at lib/stackdepot.c:252 depot_alloc_stack+0x39a/0x3c8
with PREEMPT and KASAN enabled.
Fix this by moving the IO/EXT interrupt handlers from .kprobes.text into
the .irqentry.text section and updating the kprobes blacklist to include
the .irqentry.text section.
This is done only for asynchronous interrupts and explicitly not for
program checks, which are synchronous and where the context beyond the
program check is important to preserve. Despite machine checks being
somewhat in between, they are extremely rare, and preserving context
when possible is also of value.
SVCs and Restart Interrupts are not relevant, one being always at the
boundary to user space and the other being a one-time thing.
IRQ entries filtering is also optionally used in ftrace function graph,
where the same logic applies.
Cc: stable@vger.kernel.org # 5.15+
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/entry.S | 4 ++++
arch/s390/kernel/kprobes.c | 6 ++++++
2 files changed, 10 insertions(+)
--- a/arch/s390/kernel/entry.S
+++ b/arch/s390/kernel/entry.S
@@ -450,9 +450,13 @@ SYM_CODE_START(\name)
SYM_CODE_END(\name)
.endm
+ .section .irqentry.text, "ax"
+
INT_HANDLER ext_int_handler,__LC_EXT_OLD_PSW,do_ext_irq
INT_HANDLER io_int_handler,__LC_IO_OLD_PSW,do_io_irq
+ .section .kprobes.text, "ax"
+
/*
* Machine check handler routines
*/
--- a/arch/s390/kernel/kprobes.c
+++ b/arch/s390/kernel/kprobes.c
@@ -489,6 +489,12 @@ int __init arch_init_kprobes(void)
return 0;
}
+int __init arch_populate_kprobe_blacklist(void)
+{
+ return kprobe_add_area_blacklist((unsigned long)__irqentry_text_start,
+ (unsigned long)__irqentry_text_end);
+}
+
int arch_trampoline_kprobe(struct kprobe *p)
{
return 0;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 061/146] ARM: 9430/1: entry: Do a dummy read from VMAP shadow
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 060/146] s390/entry: Mark IRQ entries to fix stack depot warnings Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 062/146] ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire() Greg Kroah-Hartman
` (92 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Clement LE GOFFIC, Ard Biesheuvel,
Linus Walleij, Russell King (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 44e9a3bb76e5f2eecd374c8176b2c5163c8bb2e2 upstream.
When switching task, in addition to a dummy read from the new
VMAP stack, also do a dummy read from the VMAP stack's
corresponding KASAN shadow memory to sync things up in
the new MM context.
Cc: stable@vger.kernel.org
Fixes: a1c510d0adc6 ("ARM: implement support for vmap'ed stacks")
Link: https://lore.kernel.org/linux-arm-kernel/a1a1d062-f3a2-4d05-9836-3b098de9db6d@foss.st.com/
Reported-by: Clement LE GOFFIC <clement.legoffic@foss.st.com>
Suggested-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/kernel/entry-armv.S | 8 ++++++++
1 file changed, 8 insertions(+)
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -25,6 +25,7 @@
#include <asm/tls.h>
#include <asm/system_info.h>
#include <asm/uaccess-asm.h>
+#include <asm/kasan_def.h>
#include "entry-header.S"
#include <asm/probes.h>
@@ -561,6 +562,13 @@ ENTRY(__switch_to)
@ entries covering the vmalloc region.
@
ldr r2, [ip]
+#ifdef CONFIG_KASAN_VMALLOC
+ @ Also dummy read from the KASAN shadow memory for the new stack if we
+ @ are using KASAN
+ mov_l r2, KASAN_SHADOW_OFFSET
+ add r2, r2, ip, lsr #KASAN_SHADOW_SCALE_SHIFT
+ ldr r2, [r2]
+#endif
#endif
@ When CONFIG_THREAD_INFO_IN_TASK=n, the update of SP itself is what
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 062/146] ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 061/146] ARM: 9430/1: entry: Do a dummy read from VMAP shadow Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 063/146] net: stmmac: set initial EEE policy configuration Greg Kroah-Hartman
` (91 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Mark Rutland, Linus Walleij,
Russell King (Oracle)
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Walleij <linus.walleij@linaro.org>
commit 93ee385254d53849c01dd8ab9bc9d02790ee7f0e upstream.
The code for syncing vmalloc memory PGD pointers is using
atomic_read() in pair with atomic_set_release() but the
proper pairing is atomic_read_acquire() paired with
atomic_set_release().
This is done to clearly instruct the compiler to not
reorder the memcpy() or similar calls inside the section
so that we do not observe changes to init_mm. memcpy()
calls should be identified by the compiler as having
unpredictable side effects, but let's try to be on the
safe side.
Cc: stable@vger.kernel.org
Fixes: d31e23aff011 ("ARM: mm: make vmalloc_seq handling SMP safe")
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arm/mm/ioremap.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arm/mm/ioremap.c
+++ b/arch/arm/mm/ioremap.c
@@ -141,7 +141,7 @@ void __check_vmalloc_seq(struct mm_struc
int seq;
do {
- seq = atomic_read(&init_mm.context.vmalloc_seq);
+ seq = atomic_read_acquire(&init_mm.context.vmalloc_seq);
memcpy_pgd(mm, VMALLOC_START, VMALLOC_END);
if (IS_ENABLED(CONFIG_KASAN_VMALLOC)) {
unsigned long start =
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 063/146] net: stmmac: set initial EEE policy configuration
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 062/146] ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 064/146] vfio/qat: fix overflow check in qat_vf_resume_write() Greg Kroah-Hartman
` (90 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Choong Yong Liang, Jacob Keller,
Paolo Abeni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Choong Yong Liang <yong.liang.choong@linux.intel.com>
commit 59c5e1411a0a13ebb930f4ebba495cc4eb14f8f2 upstream.
Set the initial eee_cfg values to have 'ethtool --show-eee ' display
the initial EEE configuration.
Fixes: 49168d1980e2 ("net: phy: Add phy_support_eee() indicating MAC support EEE")
Cc: <stable@vger.kernel.org>
Signed-off-by: Choong Yong Liang <yong.liang.choong@linux.intel.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://patch.msgid.link/20241120083818.1079456-1-yong.liang.choong@linux.intel.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1205,6 +1205,9 @@ static int stmmac_init_phy(struct net_de
return -ENODEV;
}
+ if (priv->dma_cap.eee)
+ phy_support_eee(phydev);
+
ret = phylink_connect_phy(priv->phylink, phydev);
} else {
fwnode_handle_put(phy_fwnode);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 064/146] vfio/qat: fix overflow check in qat_vf_resume_write()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (62 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 063/146] net: stmmac: set initial EEE policy configuration Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 065/146] PCI: qcom: Disable ASPM L0s for X1E80100 Greg Kroah-Hartman
` (89 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijie Zhao, Giovanni Cabiddu,
Xin Zeng, Alex Williamson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
commit 9283b7392570421c22a6c8058614f5b76a46b81c upstream.
The unsigned variable `size_t len` is cast to the signed type `loff_t`
when passed to the function check_add_overflow(). This function considers
the type of the destination, which is of type loff_t (signed),
potentially leading to an overflow. This issue is similar to the one
described in the link below.
Remove the cast.
Note that even if check_add_overflow() is bypassed, by setting `len` to
a value that is greater than LONG_MAX (which is considered as a negative
value after the cast), the function copy_from_user(), invoked a few lines
later, will not perform any copy and return `len` as (len > INT_MAX)
causing qat_vf_resume_write() to fail with -EFAULT.
Fixes: bb208810b1ab ("vfio/qat: Add vfio_pci driver for Intel QAT SR-IOV VF devices")
CC: stable@vger.kernel.org # 6.10+
Link: https://lore.kernel.org/all/138bd2e2-ede8-4bcc-aa7b-f3d9de167a37@moroto.mountain
Reported-by: Zijie Zhao <zzjas98@gmail.com>
Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
Reviewed-by: Xin Zeng <xin.zeng@intel.com>
Link: https://lore.kernel.org/r/20241021123843.42979-1-giovanni.cabiddu@intel.com
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/vfio/pci/qat/main.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/vfio/pci/qat/main.c b/drivers/vfio/pci/qat/main.c
index be3644ced17b..c78cb6de9390 100644
--- a/drivers/vfio/pci/qat/main.c
+++ b/drivers/vfio/pci/qat/main.c
@@ -304,7 +304,7 @@ static ssize_t qat_vf_resume_write(struct file *filp, const char __user *buf,
offs = &filp->f_pos;
if (*offs < 0 ||
- check_add_overflow((loff_t)len, *offs, &end))
+ check_add_overflow(len, *offs, &end))
return -EOVERFLOW;
if (end > mig_dev->state_size)
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 065/146] PCI: qcom: Disable ASPM L0s for X1E80100
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (63 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 064/146] vfio/qat: fix overflow check in qat_vf_resume_write() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 066/146] perf jevents: fix breakage when do perf stat on system metric Greg Kroah-Hartman
` (88 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Qiang Yu, Krzysztof Wilczyński,
Dmitry Baryshkov, Johan Hovold, Manivannan Sadhasivam
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Qiang Yu <quic_qianyu@quicinc.com>
commit fba6045161d686adc102b6ef71b2fd1e5f90a616 upstream.
Currently, the cfg_1_9_0 which is being used for X1E80100 doesn't disable
ASPM L0s. However, hardware team recommends to disable L0s as the PHY init
sequence is not tuned support L0s. Hence reuse cfg_sc8280xp for X1E80100.
Note that the config_sid() callback is not present in cfg_sc8280xp, don't
concern about this because config_sid() callback is originally a no-op
for X1E80100.
Fixes: 6d0c39324c5f ("PCI: qcom: Add X1E80100 PCIe support")
Link: https://lore.kernel.org/r/20241101030902.579789-5-quic_qianyu@quicinc.com
Signed-off-by: Qiang Yu <quic_qianyu@quicinc.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Johan Hovold <johan+linaro@kernel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Cc: <stable@vger.kernel.org> # 6.9
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-qcom.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/controller/dwc/pcie-qcom.c
+++ b/drivers/pci/controller/dwc/pcie-qcom.c
@@ -1845,7 +1845,7 @@ static const struct of_device_id qcom_pc
{ .compatible = "qcom,pcie-sm8450-pcie0", .data = &cfg_1_9_0 },
{ .compatible = "qcom,pcie-sm8450-pcie1", .data = &cfg_1_9_0 },
{ .compatible = "qcom,pcie-sm8550", .data = &cfg_1_9_0 },
- { .compatible = "qcom,pcie-x1e80100", .data = &cfg_1_9_0 },
+ { .compatible = "qcom,pcie-x1e80100", .data = &cfg_sc8280xp },
{ }
};
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 066/146] perf jevents: fix breakage when do perf stat on system metric
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (64 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 065/146] PCI: qcom: Disable ASPM L0s for X1E80100 Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 067/146] remoteproc: qcom_q6v5_pas: disable auto boot for wpss Greg Kroah-Hartman
` (87 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, James Clark, Xu Yang, Ian Rogers,
Adrian Hunter, Albert Ou, Alexander Shishkin, Alexandre Ghiti,
Athira Rajeev, Benjamin Gray, Ben Zong-You Xie, Bibo Mao,
Clément Le Goffic, Dima Kogan, Dr. David Alan Gilbert,
Huacai Chen, Ingo Molnar, Jiri Olsa, John Garry, Kan Liang,
Leo Yan, Mark Rutland, Masami Hiramatsu, Mike Leach, Namhyung Kim,
Palmer Dabbelt, Paul Walmsley, Peter Zijlstra, Ravi Bangoria,
Sandipan Das, Will Deacon, Yicong Yang, linux-arm-kernel,
linux-riscv, Arnaldo Carvalho de Melo
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Xu Yang <xu.yang_2@nxp.com>
commit 4a159e6049f319bef6f9e6d2ccdd322f57d24830 upstream.
When do perf stat on sys metric, perf tool output nothing now:
$ perf stat -a -M imx95_ddr_read.all -I 1000
$
This command runs on an arm64 machine and the Soc has one DDR hw pmu
except one armv8_cortex_a55 pmu. Their maps show as follows:
const struct pmu_events_map pmu_events_map[] = {
{
.arch = "arm64",
.cpuid = "0x00000000410fd050",
.event_table = {
.pmus = pmu_events__arm_cortex_a55,
.num_pmus = ARRAY_SIZE(pmu_events__arm_cortex_a55)
},
.metric_table = {
.pmus = NULL,
.num_pmus = 0
}
},
static const struct pmu_sys_events pmu_sys_event_tables[] = {
{
.event_table = {
.pmus = pmu_events__freescale_imx95_sys,
.num_pmus = ARRAY_SIZE(pmu_events__freescale_imx95_sys)
},
.metric_table = {
.pmus = pmu_metrics__freescale_imx95_sys,
.num_pmus = ARRAY_SIZE(pmu_metrics__freescale_imx95_sys)
},
.name = "pmu_events__freescale_imx95_sys",
},
Currently, pmu_metrics_table__find() will return NULL when only do perf
stat on sys metric. Then parse_groups() will never be called to parse
sys metric_name, finally perf tool will exit directly. This should be a
common problem.
To fix the issue, this will keep the logic before commit f20c15d13f01
("perf pmu-events: Remember the perf_events_map for a PMU") to return a
empty metric table rather than a NULL pointer.
This should be fine since the removed part just check if the table match
provided metric_name. Without these code, the code in parse_groups()
will also check the validity of metrci_name too.
Fixes: f20c15d13f017d4b ("perf pmu-events: Remember the perf_events_map for a PMU")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Xu Yang <xu.yang_2@nxp.com>
Tested-by: Xu Yang <xu.yang_2@nxp.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Alexandre Ghiti <alexghiti@rivosinc.com>
Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Cc: Benjamin Gray <bgray@linux.ibm.com>
Cc: Ben Zong-You Xie <ben717@andestech.com>
Cc: Bibo Mao <maobibo@loongson.cn>
Cc: Clément Le Goffic <clement.legoffic@foss.st.com>
Cc: Dima Kogan <dima@secretsauce.net>
Cc: Dr. David Alan Gilbert <linux@treblig.org>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: John Garry <john.g.garry@oracle.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mike Leach <mike.leach@linaro.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: Sandipan Das <sandipan.das@amd.com>
Cc: Will Deacon <will@kernel.org>
Cc: Yicong Yang <yangyicong@hisilicon.com>
Cc: linux-arm-kernel@lists.infradead.org
Cc: linux-riscv@lists.infradead.org
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20241107162035.52206-2-irogers@google.com
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
tools/perf/pmu-events/empty-pmu-events.c | 12 +-----------
tools/perf/pmu-events/jevents.py | 12 +-----------
2 files changed, 2 insertions(+), 22 deletions(-)
--- a/tools/perf/pmu-events/empty-pmu-events.c
+++ b/tools/perf/pmu-events/empty-pmu-events.c
@@ -539,17 +539,7 @@ const struct pmu_metrics_table *perf_pmu
if (!map)
return NULL;
- if (!pmu)
- return &map->metric_table;
-
- for (size_t i = 0; i < map->metric_table.num_pmus; i++) {
- const struct pmu_table_entry *table_pmu = &map->metric_table.pmus[i];
- const char *pmu_name = &big_c_string[table_pmu->pmu_name.offset];
-
- if (pmu__name_match(pmu, pmu_name))
- return &map->metric_table;
- }
- return NULL;
+ return &map->metric_table;
}
const struct pmu_events_table *find_core_events_table(const char *arch, const char *cpuid)
--- a/tools/perf/pmu-events/jevents.py
+++ b/tools/perf/pmu-events/jevents.py
@@ -1089,17 +1089,7 @@ const struct pmu_metrics_table *perf_pmu
if (!map)
return NULL;
- if (!pmu)
- return &map->metric_table;
-
- for (size_t i = 0; i < map->metric_table.num_pmus; i++) {
- const struct pmu_table_entry *table_pmu = &map->metric_table.pmus[i];
- const char *pmu_name = &big_c_string[table_pmu->pmu_name.offset];
-
- if (pmu__name_match(pmu, pmu_name))
- return &map->metric_table;
- }
- return NULL;
+ return &map->metric_table;
}
const struct pmu_events_table *find_core_events_table(const char *arch, const char *cpuid)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 067/146] remoteproc: qcom_q6v5_pas: disable auto boot for wpss
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (65 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 066/146] perf jevents: fix breakage when do perf stat on system metric Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 068/146] PCI: imx6: Fix suspend/resume support on i.MX6QDL Greg Kroah-Hartman
` (86 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Balaji Pothunoori, Dmitry Baryshkov,
Bjorn Andersson
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Balaji Pothunoori <quic_bpothuno@quicinc.com>
commit 8a47704d64c9afda80e7f399ba2cf898cfcc45b2 upstream.
Currently, the rproc "atomic_t power" variable is incremented during:
a. WPSS rproc auto boot.
b. AHB power on for ath11k.
During AHB power off (rmmod ath11k_ahb.ko), rproc_shutdown fails
to unload the WPSS firmware because the rproc->power value is '2',
causing the atomic_dec_and_test(&rproc->power) condition to fail.
Consequently, during AHB power on (insmod ath11k_ahb.ko),
QMI_WLANFW_HOST_CAP_REQ_V01 fails due to the host and firmware QMI
states being out of sync.
Fixes: 300ed425dfa9 ("remoteproc: qcom_q6v5_pas: Add SC7280 ADSP, CDSP & WPSS")
Cc: stable@vger.kernel.org
Signed-off-by: Balaji Pothunoori <quic_bpothuno@quicinc.com>
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Link: https://lore.kernel.org/r/20241018105911.165415-1-quic_bpothuno@quicinc.com
Signed-off-by: Bjorn Andersson <andersson@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/remoteproc/qcom_q6v5_pas.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/remoteproc/qcom_q6v5_pas.c b/drivers/remoteproc/qcom_q6v5_pas.c
index 5034d214ac13..96da94b5d2c2 100644
--- a/drivers/remoteproc/qcom_q6v5_pas.c
+++ b/drivers/remoteproc/qcom_q6v5_pas.c
@@ -1356,7 +1356,7 @@ static const struct adsp_data sc7280_wpss_resource = {
.crash_reason_smem = 626,
.firmware_name = "wpss.mdt",
.pas_id = 6,
- .auto_boot = true,
+ .auto_boot = false,
.proxy_pd_names = (char*[]){
"cx",
"mx",
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 068/146] PCI: imx6: Fix suspend/resume support on i.MX6QDL
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (66 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 067/146] remoteproc: qcom_q6v5_pas: disable auto boot for wpss Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 069/146] mm/slub: Avoid list corruption when removing a slab from the full list Greg Kroah-Hartman
` (85 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Stefan Eichenberger,
Krzysztof Wilczyński, Manivannan Sadhasivam, Richard Zhu
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stefan Eichenberger <stefan.eichenberger@toradex.com>
commit 0a726f542d7c8cc0f9c5ed7df5a4bd4b59ac21b3 upstream.
The suspend/resume functionality is currently broken on the i.MX6QDL
platform, as documented in the NXP errata (ERR005723):
https://www.nxp.com/docs/en/errata/IMX6DQCE.pdf
This patch addresses the issue by sharing most of the suspend/resume
sequences used by other i.MX devices, while avoiding modifications to
critical registers that disrupt the PCIe functionality. It targets the
same problem as the following downstream commit:
https://github.com/nxp-imx/linux-imx/commit/4e92355e1f79d225ea842511fcfd42b343b32995
Unlike the downstream commit, this patch also resets the connected PCIe
device if possible. Without this reset, certain drivers, such as ath10k
or iwlwifi, will crash on resume. The device reset is also done by the
driver on other i.MX platforms, making this patch consistent with
existing practices.
Upon resuming, the kernel will hang and display an error. Here's an
example of the error encountered with the ath10k driver:
ath10k_pci 0000:01:00.0: Unable to change power state from D3hot to D0, device inaccessible
Unhandled fault: imprecise external abort (0x1406) at 0x0106f944
Without this patch, suspend/resume will fail on i.MX6QDL devices if a
PCIe device is connected.
Link: https://lore.kernel.org/r/20241030103250.83640-1-eichest@gmail.com
Signed-off-by: Stefan Eichenberger <stefan.eichenberger@toradex.com>
[kwilczynski: commit log, added tag for stable releases]
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Acked-by: Richard Zhu <hongxing.zhu@nxp.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pci-imx6.c | 57 +++++++++++++++++++++++++++-------
1 file changed, 46 insertions(+), 11 deletions(-)
--- a/drivers/pci/controller/dwc/pci-imx6.c
+++ b/drivers/pci/controller/dwc/pci-imx6.c
@@ -82,6 +82,11 @@ enum imx_pcie_variants {
#define IMX_PCIE_FLAG_HAS_SERDES BIT(6)
#define IMX_PCIE_FLAG_SUPPORT_64BIT BIT(7)
#define IMX_PCIE_FLAG_CPU_ADDR_FIXUP BIT(8)
+/*
+ * Because of ERR005723 (PCIe does not support L2 power down) we need to
+ * workaround suspend resume on some devices which are affected by this errata.
+ */
+#define IMX_PCIE_FLAG_BROKEN_SUSPEND BIT(9)
#define imx_check_flag(pci, val) (pci->drvdata->flags & val)
@@ -1237,9 +1242,19 @@ static int imx_pcie_suspend_noirq(struct
return 0;
imx_pcie_msi_save_restore(imx_pcie, true);
- imx_pcie_pm_turnoff(imx_pcie);
- imx_pcie_stop_link(imx_pcie->pci);
- imx_pcie_host_exit(pp);
+ if (imx_check_flag(imx_pcie, IMX_PCIE_FLAG_BROKEN_SUSPEND)) {
+ /*
+ * The minimum for a workaround would be to set PERST# and to
+ * set the PCIE_TEST_PD flag. However, we can also disable the
+ * clock which saves some power.
+ */
+ imx_pcie_assert_core_reset(imx_pcie);
+ imx_pcie->drvdata->enable_ref_clk(imx_pcie, false);
+ } else {
+ imx_pcie_pm_turnoff(imx_pcie);
+ imx_pcie_stop_link(imx_pcie->pci);
+ imx_pcie_host_exit(pp);
+ }
return 0;
}
@@ -1253,14 +1268,32 @@ static int imx_pcie_resume_noirq(struct
if (!(imx_pcie->drvdata->flags & IMX_PCIE_FLAG_SUPPORTS_SUSPEND))
return 0;
- ret = imx_pcie_host_init(pp);
- if (ret)
- return ret;
- imx_pcie_msi_save_restore(imx_pcie, false);
- dw_pcie_setup_rc(pp);
+ if (imx_check_flag(imx_pcie, IMX_PCIE_FLAG_BROKEN_SUSPEND)) {
+ ret = imx_pcie->drvdata->enable_ref_clk(imx_pcie, true);
+ if (ret)
+ return ret;
+ ret = imx_pcie_deassert_core_reset(imx_pcie);
+ if (ret)
+ return ret;
+ /*
+ * Using PCIE_TEST_PD seems to disable MSI and powers down the
+ * root complex. This is why we have to setup the rc again and
+ * why we have to restore the MSI register.
+ */
+ ret = dw_pcie_setup_rc(&imx_pcie->pci->pp);
+ if (ret)
+ return ret;
+ imx_pcie_msi_save_restore(imx_pcie, false);
+ } else {
+ ret = imx_pcie_host_init(pp);
+ if (ret)
+ return ret;
+ imx_pcie_msi_save_restore(imx_pcie, false);
+ dw_pcie_setup_rc(pp);
- if (imx_pcie->link_is_up)
- imx_pcie_start_link(imx_pcie->pci);
+ if (imx_pcie->link_is_up)
+ imx_pcie_start_link(imx_pcie->pci);
+ }
return 0;
}
@@ -1485,7 +1518,9 @@ static const struct imx_pcie_drvdata drv
[IMX6Q] = {
.variant = IMX6Q,
.flags = IMX_PCIE_FLAG_IMX_PHY |
- IMX_PCIE_FLAG_IMX_SPEED_CHANGE,
+ IMX_PCIE_FLAG_IMX_SPEED_CHANGE |
+ IMX_PCIE_FLAG_BROKEN_SUSPEND |
+ IMX_PCIE_FLAG_SUPPORTS_SUSPEND,
.dbi_length = 0x200,
.gpr = "fsl,imx6q-iomuxc-gpr",
.clk_names = imx6q_clks,
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 069/146] mm/slub: Avoid list corruption when removing a slab from the full list
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (67 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 068/146] PCI: imx6: Fix suspend/resume support on i.MX6QDL Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 070/146] f2fs: fix to drop all discards after creating snapshot on lvm device Greg Kroah-Hartman
` (84 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hyeonggon Yoo, Vlastimil Babka,
yuan.gao, Christoph Lameter
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: yuan.gao <yuan.gao@ucloud.cn>
commit dbc16915279a548a204154368da23d402c141c81 upstream.
Boot with slub_debug=UFPZ.
If allocated object failed in alloc_consistency_checks, all objects of
the slab will be marked as used, and then the slab will be removed from
the partial list.
When an object belonging to the slab got freed later, the remove_full()
function is called. Because the slab is neither on the partial list nor
on the full list, it eventually lead to a list corruption (actually a
list poison being detected).
So we need to mark and isolate the slab page with metadata corruption,
do not put it back in circulation.
Because the debug caches avoid all the fastpaths, reusing the frozen bit
to mark slab page with metadata corruption seems to be fine.
[ 4277.385669] list_del corruption, ffffea00044b3e50->next is LIST_POISON1 (dead000000000100)
[ 4277.387023] ------------[ cut here ]------------
[ 4277.387880] kernel BUG at lib/list_debug.c:56!
[ 4277.388680] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 4277.389562] CPU: 5 PID: 90 Comm: kworker/5:1 Kdump: loaded Tainted: G OE 6.6.1-1 #1
[ 4277.392113] Workqueue: xfs-inodegc/vda1 xfs_inodegc_worker [xfs]
[ 4277.393551] RIP: 0010:__list_del_entry_valid_or_report+0x7b/0xc0
[ 4277.394518] Code: 48 91 82 e8 37 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 28 49 91 82 e8 26 f9 9a ff 0f 0b 48 89 fe 48 c7 c7 58 49 91
[ 4277.397292] RSP: 0018:ffffc90000333b38 EFLAGS: 00010082
[ 4277.398202] RAX: 000000000000004e RBX: ffffea00044b3e50 RCX: 0000000000000000
[ 4277.399340] RDX: 0000000000000002 RSI: ffffffff828f8715 RDI: 00000000ffffffff
[ 4277.400545] RBP: ffffea00044b3e40 R08: 0000000000000000 R09: ffffc900003339f0
[ 4277.401710] R10: 0000000000000003 R11: ffffffff82d44088 R12: ffff888112cf9910
[ 4277.402887] R13: 0000000000000001 R14: 0000000000000001 R15: ffff8881000424c0
[ 4277.404049] FS: 0000000000000000(0000) GS:ffff88842fd40000(0000) knlGS:0000000000000000
[ 4277.405357] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4277.406389] CR2: 00007f2ad0b24000 CR3: 0000000102a3a006 CR4: 00000000007706e0
[ 4277.407589] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 4277.408780] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 4277.410000] PKRU: 55555554
[ 4277.410645] Call Trace:
[ 4277.411234] <TASK>
[ 4277.411777] ? die+0x32/0x80
[ 4277.412439] ? do_trap+0xd6/0x100
[ 4277.413150] ? __list_del_entry_valid_or_report+0x7b/0xc0
[ 4277.414158] ? do_error_trap+0x6a/0x90
[ 4277.414948] ? __list_del_entry_valid_or_report+0x7b/0xc0
[ 4277.415915] ? exc_invalid_op+0x4c/0x60
[ 4277.416710] ? __list_del_entry_valid_or_report+0x7b/0xc0
[ 4277.417675] ? asm_exc_invalid_op+0x16/0x20
[ 4277.418482] ? __list_del_entry_valid_or_report+0x7b/0xc0
[ 4277.419466] ? __list_del_entry_valid_or_report+0x7b/0xc0
[ 4277.420410] free_to_partial_list+0x515/0x5e0
[ 4277.421242] ? xfs_iext_remove+0x41a/0xa10 [xfs]
[ 4277.422298] xfs_iext_remove+0x41a/0xa10 [xfs]
[ 4277.423316] ? xfs_inodegc_worker+0xb4/0x1a0 [xfs]
[ 4277.424383] xfs_bmap_del_extent_delay+0x4fe/0x7d0 [xfs]
[ 4277.425490] __xfs_bunmapi+0x50d/0x840 [xfs]
[ 4277.426445] xfs_itruncate_extents_flags+0x13a/0x490 [xfs]
[ 4277.427553] xfs_inactive_truncate+0xa3/0x120 [xfs]
[ 4277.428567] xfs_inactive+0x22d/0x290 [xfs]
[ 4277.429500] xfs_inodegc_worker+0xb4/0x1a0 [xfs]
[ 4277.430479] process_one_work+0x171/0x340
[ 4277.431227] worker_thread+0x277/0x390
[ 4277.431962] ? __pfx_worker_thread+0x10/0x10
[ 4277.432752] kthread+0xf0/0x120
[ 4277.433382] ? __pfx_kthread+0x10/0x10
[ 4277.434134] ret_from_fork+0x2d/0x50
[ 4277.434837] ? __pfx_kthread+0x10/0x10
[ 4277.435566] ret_from_fork_asm+0x1b/0x30
[ 4277.436280] </TASK>
Fixes: 643b113849d8 ("slub: enable tracking of full slabs")
Suggested-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Suggested-by: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>
Signed-off-by: yuan.gao <yuan.gao@ucloud.cn>
Reviewed-by: Hyeonggon Yoo <42.hyeyoo@gmail.com>
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slab.h | 5 +++++
mm/slub.c | 9 ++++++++-
2 files changed, 13 insertions(+), 1 deletion(-)
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -73,6 +73,11 @@ struct slab {
struct {
unsigned inuse:16;
unsigned objects:15;
+ /*
+ * If slab debugging is enabled then the
+ * frozen bit can be reused to indicate
+ * that the slab was corrupted
+ */
unsigned frozen:1;
};
};
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1423,6 +1423,11 @@ static int check_slab(struct kmem_cache
slab->inuse, slab->objects);
return 0;
}
+ if (slab->frozen) {
+ slab_err(s, slab, "Slab disabled since SLUB metadata consistency check failed");
+ return 0;
+ }
+
/* Slab_pad_check fixes things up after itself */
slab_pad_check(s, slab);
return 1;
@@ -1603,6 +1608,7 @@ bad:
slab_fix(s, "Marking all objects used");
slab->inuse = slab->objects;
slab->freelist = NULL;
+ slab->frozen = 1; /* mark consistency-failed slab as frozen */
}
return false;
}
@@ -2744,7 +2750,8 @@ static void *alloc_single_from_partial(s
slab->inuse++;
if (!alloc_debug_processing(s, slab, object, orig_size)) {
- remove_partial(n, slab);
+ if (folio_test_slab(slab_folio(slab)))
+ remove_partial(n, slab);
return NULL;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 070/146] f2fs: fix to drop all discards after creating snapshot on lvm device
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (68 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 069/146] mm/slub: Avoid list corruption when removing a slab from the full list Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 071/146] ceph: extract entity name from device id Greg Kroah-Hartman
` (83 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Piergiorgio Sartor, Chao Yu,
Jaegeuk Kim
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chao Yu <chao@kernel.org>
commit bc8aeb04fd80cb8cfae3058445c84410fd0beb5e upstream.
Piergiorgio reported a bug in bugzilla as below:
------------[ cut here ]------------
WARNING: CPU: 2 PID: 969 at fs/f2fs/segment.c:1330
RIP: 0010:__submit_discard_cmd+0x27d/0x400 [f2fs]
Call Trace:
__issue_discard_cmd+0x1ca/0x350 [f2fs]
issue_discard_thread+0x191/0x480 [f2fs]
kthread+0xcf/0x100
ret_from_fork+0x31/0x50
ret_from_fork_asm+0x1a/0x30
w/ below testcase, it can reproduce this bug quickly:
- pvcreate /dev/vdb
- vgcreate myvg1 /dev/vdb
- lvcreate -L 1024m -n mylv1 myvg1
- mount /dev/myvg1/mylv1 /mnt/f2fs
- dd if=/dev/zero of=/mnt/f2fs/file bs=1M count=20
- sync
- rm /mnt/f2fs/file
- sync
- lvcreate -L 1024m -s -n mylv1-snapshot /dev/myvg1/mylv1
- umount /mnt/f2fs
The root cause is: it will update discard_max_bytes of mounted lvm
device to zero after creating snapshot on this lvm device, then,
__submit_discard_cmd() will pass parameter @nr_sects w/ zero value
to __blkdev_issue_discard(), it returns a NULL bio pointer, result
in panic.
This patch changes as below for fixing:
1. Let's drop all remained discards in f2fs_unfreeze() if snapshot
of lvm device is created.
2. Checking discard_max_bytes before submitting discard during
__submit_discard_cmd().
Cc: stable@vger.kernel.org
Fixes: 35ec7d574884 ("f2fs: split discard command in prior to block layer")
Reported-by: Piergiorgio Sartor <piergiorgio.sartor@nexgo.de>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=219484
Signed-off-by: Chao Yu <chao@kernel.org>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/f2fs/segment.c | 16 +++++++++-------
fs/f2fs/super.c | 12 ++++++++++++
2 files changed, 21 insertions(+), 7 deletions(-)
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1290,16 +1290,18 @@ static int __submit_discard_cmd(struct f
wait_list, issued);
return 0;
}
-
- /*
- * Issue discard for conventional zones only if the device
- * supports discard.
- */
- if (!bdev_max_discard_sectors(bdev))
- return -EOPNOTSUPP;
}
#endif
+ /*
+ * stop issuing discard for any of below cases:
+ * 1. device is conventional zone, but it doesn't support discard.
+ * 2. device is regulare device, after snapshot it doesn't support
+ * discard.
+ */
+ if (!bdev_max_discard_sectors(bdev))
+ return -EOPNOTSUPP;
+
trace_f2fs_issue_discard(bdev, dc->di.start, dc->di.len);
lstart = dc->di.lstart;
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -1748,6 +1748,18 @@ static int f2fs_freeze(struct super_bloc
static int f2fs_unfreeze(struct super_block *sb)
{
+ struct f2fs_sb_info *sbi = F2FS_SB(sb);
+
+ /*
+ * It will update discard_max_bytes of mounted lvm device to zero
+ * after creating snapshot on this lvm device, let's drop all
+ * remained discards.
+ * We don't need to disable real-time discard because discard_max_bytes
+ * will recover after removal of snapshot.
+ */
+ if (test_opt(sbi, DISCARD) && !f2fs_hw_support_discard(sbi))
+ f2fs_issue_discard_timeout(sbi);
+
clear_sbi_flag(F2FS_SB(sb), SBI_IS_FREEZING);
return 0;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 071/146] ceph: extract entity name from device id
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (69 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 070/146] f2fs: fix to drop all discards after creating snapshot on lvm device Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 072/146] ceph: pass cred pointer to ceph_mds_auth_match() Greg Kroah-Hartman
` (82 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Patrick Donnelly, Ilya Dryomov
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Patrick Donnelly <pdonnell@redhat.com>
commit 955710afcb3bb63e21e186451ed5eba85fa14d0b upstream.
Previously, the "name" in the new device syntax "<name>@<fsid>.<fsname>"
was ignored because (presumably) tests were done using mount.ceph which
also passed the entity name using "-o name=foo". If mounting is done
without the mount.ceph helper, the new device id syntax fails to set
the name properly.
Cc: stable@vger.kernel.org
Link: https://tracker.ceph.com/issues/68516
Signed-off-by: Patrick Donnelly <pdonnell@redhat.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/super.c | 10 +++++++++-
1 file changed, 9 insertions(+), 1 deletion(-)
--- a/fs/ceph/super.c
+++ b/fs/ceph/super.c
@@ -285,7 +285,9 @@ static int ceph_parse_new_source(const c
size_t len;
struct ceph_fsid fsid;
struct ceph_parse_opts_ctx *pctx = fc->fs_private;
+ struct ceph_options *opts = pctx->copts;
struct ceph_mount_options *fsopt = pctx->opts;
+ const char *name_start = dev_name;
char *fsid_start, *fs_name_start;
if (*dev_name_end != '=') {
@@ -296,8 +298,14 @@ static int ceph_parse_new_source(const c
fsid_start = strchr(dev_name, '@');
if (!fsid_start)
return invalfc(fc, "missing cluster fsid");
- ++fsid_start; /* start of cluster fsid */
+ len = fsid_start - name_start;
+ kfree(opts->name);
+ opts->name = kstrndup(name_start, len, GFP_KERNEL);
+ if (!opts->name)
+ return -ENOMEM;
+ dout("using %s entity name", opts->name);
+ ++fsid_start; /* start of cluster fsid */
fs_name_start = strchr(fsid_start, '.');
if (!fs_name_start)
return invalfc(fc, "missing file system name");
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 072/146] ceph: pass cred pointer to ceph_mds_auth_match()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (70 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 071/146] ceph: extract entity name from device id Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 073/146] ceph: fix cred leak in ceph_mds_check_access() Greg Kroah-Hartman
` (81 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Max Kellermann, Xiubo Li,
Ilya Dryomov
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit 23426309a4064b25a961e1c72961d8bfc7c8c990 upstream.
This eliminates a redundant get_current_cred() call, because
ceph_mds_check_access() has already obtained this pointer.
As a side effect, this also fixes a reference leak in
ceph_mds_auth_match(): by omitting the get_current_cred() call, no
additional cred reference is taken.
Cc: stable@vger.kernel.org
Fixes: 596afb0b8933 ("ceph: add ceph_mds_check_access() helper")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -5609,9 +5609,9 @@ void send_flush_mdlog(struct ceph_mds_se
static int ceph_mds_auth_match(struct ceph_mds_client *mdsc,
struct ceph_mds_cap_auth *auth,
+ const struct cred *cred,
char *tpath)
{
- const struct cred *cred = get_current_cred();
u32 caller_uid = from_kuid(&init_user_ns, cred->fsuid);
u32 caller_gid = from_kgid(&init_user_ns, cred->fsgid);
struct ceph_client *cl = mdsc->fsc->client;
@@ -5734,7 +5734,7 @@ int ceph_mds_check_access(struct ceph_md
for (i = 0; i < mdsc->s_cap_auths_num; i++) {
struct ceph_mds_cap_auth *s = &mdsc->s_cap_auths[i];
- err = ceph_mds_auth_match(mdsc, s, tpath);
+ err = ceph_mds_auth_match(mdsc, s, cred, tpath);
if (err < 0) {
return err;
} else if (err > 0) {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 073/146] ceph: fix cred leak in ceph_mds_check_access()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (71 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 072/146] ceph: pass cred pointer to ceph_mds_auth_match() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 074/146] mtd: spinand: winbond: Fix 512GW and 02JW OOB layout Greg Kroah-Hartman
` (80 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Max Kellermann, Xiubo Li,
Ilya Dryomov
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Max Kellermann <max.kellermann@ionos.com>
commit c5cf420303256dcd6ff175643e9e9558543c2047 upstream.
get_current_cred() increments the reference counter, but the
put_cred() call was missing.
Cc: stable@vger.kernel.org
Fixes: 596afb0b8933 ("ceph: add ceph_mds_check_access() helper")
Signed-off-by: Max Kellermann <max.kellermann@ionos.com>
Reviewed-by: Xiubo Li <xiubli@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ceph/mds_client.c | 3 +++
1 file changed, 3 insertions(+)
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -5736,6 +5736,7 @@ int ceph_mds_check_access(struct ceph_md
err = ceph_mds_auth_match(mdsc, s, cred, tpath);
if (err < 0) {
+ put_cred(cred);
return err;
} else if (err > 0) {
/* always follow the last auth caps' permision */
@@ -5751,6 +5752,8 @@ int ceph_mds_check_access(struct ceph_md
}
}
+ put_cred(cred);
+
doutc(cl, "root_squash_perms %d, rw_perms_s %p\n", root_squash_perms,
rw_perms_s);
if (root_squash_perms && rw_perms_s == NULL) {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 074/146] mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (72 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 073/146] ceph: fix cred leak in ceph_mds_check_access() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 075/146] mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information Greg Kroah-Hartman
` (79 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Frieder Schrempf
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit c1247de51cab53fc357a73804c11fb4fba55b2d9 upstream.
Both W25N512GW and W25N02JW chips have 64 bytes of OOB and thus cannot
use the layout for 128 bytes OOB. Reference the correct layout instead.
Fixes: 6a804fb72de5 ("mtd: spinand: winbond: add support for serial NAND flash")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Link: https://lore.kernel.org/linux-mtd/20241009125002.191109-2-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/spi/winbond.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/mtd/nand/spi/winbond.c
+++ b/drivers/mtd/nand/spi/winbond.c
@@ -215,7 +215,7 @@ static const struct spinand_info winbond
&write_cache_variants,
&update_cache_variants),
0,
- SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
+ SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
SPINAND_INFO("W25N512GW",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x20),
NAND_MEMORG(1, 2048, 64, 64, 512, 10, 1, 1, 1),
@@ -224,7 +224,7 @@ static const struct spinand_info winbond
&write_cache_variants,
&update_cache_variants),
0,
- SPINAND_ECCINFO(&w25n02kv_ooblayout, w25n02kv_ecc_get_status)),
+ SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
SPINAND_INFO("W25N02KWZEIR",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x22),
NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 075/146] mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (73 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 074/146] mtd: spinand: winbond: Fix 512GW and 02JW OOB layout Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 076/146] util_macros.h: fix/rework find_closest() macros Greg Kroah-Hartman
` (78 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Miquel Raynal, Frieder Schrempf
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miquel Raynal <miquel.raynal@bootlin.com>
commit fee9b240916df82a8b07aef0fdfe96785417a164 upstream.
These four chips:
* W25N512GW
* W25N01GW
* W25N01JW
* W25N02JW
all require a single bit of ECC strength and thus feature an on-die
Hamming-like ECC engine. There is no point in filling a ->get_status()
callback for them because the main ECC status bytes are located in
standard places, and retrieving the number of bitflips in case of
corrected chunk is both useless and unsupported (if there are bitflips,
then there is 1 at most, so no need to query the chip for that).
Without this change, a kernel warning triggers every time a bit flips.
Fixes: 6a804fb72de5 ("mtd: spinand: winbond: add support for serial NAND flash")
Cc: stable@vger.kernel.org
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Reviewed-by: Frieder Schrempf <frieder.schrempf@kontron.de>
Link: https://lore.kernel.org/linux-mtd/20241009125002.191109-3-miquel.raynal@bootlin.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mtd/nand/spi/winbond.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/mtd/nand/spi/winbond.c
+++ b/drivers/mtd/nand/spi/winbond.c
@@ -201,30 +201,30 @@ static const struct spinand_info winbond
SPINAND_INFO("W25N01JW",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xbc, 0x21),
NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
- NAND_ECCREQ(4, 512),
+ NAND_ECCREQ(1, 512),
SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
&write_cache_variants,
&update_cache_variants),
0,
- SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
+ SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
SPINAND_INFO("W25N02JWZEIF",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xbf, 0x22),
NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 2, 1),
- NAND_ECCREQ(4, 512),
+ NAND_ECCREQ(1, 512),
SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
&write_cache_variants,
&update_cache_variants),
0,
- SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
+ SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
SPINAND_INFO("W25N512GW",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x20),
NAND_MEMORG(1, 2048, 64, 64, 512, 10, 1, 1, 1),
- NAND_ECCREQ(4, 512),
+ NAND_ECCREQ(1, 512),
SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
&write_cache_variants,
&update_cache_variants),
0,
- SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
+ SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
SPINAND_INFO("W25N02KWZEIR",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x22),
NAND_MEMORG(1, 2048, 128, 64, 2048, 40, 1, 1, 1),
@@ -237,12 +237,12 @@ static const struct spinand_info winbond
SPINAND_INFO("W25N01GWZEIG",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xba, 0x21),
NAND_MEMORG(1, 2048, 64, 64, 1024, 20, 1, 1, 1),
- NAND_ECCREQ(4, 512),
+ NAND_ECCREQ(1, 512),
SPINAND_INFO_OP_VARIANTS(&read_cache_variants,
&write_cache_variants,
&update_cache_variants),
0,
- SPINAND_ECCINFO(&w25m02gv_ooblayout, w25n02kv_ecc_get_status)),
+ SPINAND_ECCINFO(&w25m02gv_ooblayout, NULL)),
SPINAND_INFO("W25N04KV",
SPINAND_ID(SPINAND_READID_METHOD_OPCODE_DUMMY, 0xaa, 0x23),
NAND_MEMORG(1, 2048, 128, 64, 4096, 40, 2, 1, 1),
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 076/146] util_macros.h: fix/rework find_closest() macros
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (74 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 075/146] mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 077/146] s390/stacktrace: Use break instead of return statement Greg Kroah-Hartman
` (77 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexandru Ardelean,
Bartosz Golaszewski, Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexandru Ardelean <aardelean@baylibre.com>
commit bc73b4186736341ab5cd2c199da82db6e1134e13 upstream.
A bug was found in the find_closest() (find_closest_descending() is also
affected after some testing), where for certain values with small
progressions, the rounding (done by averaging 2 values) causes an
incorrect index to be returned. The rounding issues occur for
progressions of 1, 2 and 3. It goes away when the progression/interval
between two values is 4 or larger.
It's particularly bad for progressions of 1. For example if there's an
array of 'a = { 1, 2, 3 }', using 'find_closest(2, a ...)' would return 0
(the index of '1'), rather than returning 1 (the index of '2'). This
means that for exact values (with a progression of 1), find_closest() will
misbehave and return the index of the value smaller than the one we're
searching for.
For progressions of 2 and 3, the exact values are obtained correctly; but
values aren't approximated correctly (as one would expect). Starting with
progressions of 4, all seems to be good (one gets what one would expect).
While one could argue that 'find_closest()' should not be used for arrays
with progressions of 1 (i.e. '{1, 2, 3, ...}', the macro should still
behave correctly.
The bug was found while testing the 'drivers/iio/adc/ad7606.c',
specifically the oversampling feature.
For reference, the oversampling values are listed as:
static const unsigned int ad7606_oversampling_avail[7] = {
1, 2, 4, 8, 16, 32, 64,
};
When doing:
1. $ echo 1 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
1 # this is fine
2. $ echo 2 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
1 # this is wrong; 2 should be returned here
3. $ echo 3 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
2 # this is fine
4. $ echo 4 > /sys/bus/iio/devices/iio\:device0/oversampling_ratio
$ cat /sys/bus/iio/devices/iio\:device0/oversampling_ratio
4 # this is fine
And from here-on, the values are as correct (one gets what one would
expect.)
While writing a kunit test for this bug, a peculiar issue was found for the
array in the 'drivers/hwmon/ina2xx.c' & 'drivers/iio/adc/ina2xx-adc.c'
drivers. While running the kunit test (for 'ina226_avg_tab' from these
drivers):
* idx = find_closest([-1 to 2], ina226_avg_tab, ARRAY_SIZE(ina226_avg_tab));
This returns idx == 0, so value.
* idx = find_closest(3, ina226_avg_tab, ARRAY_SIZE(ina226_avg_tab));
This returns idx == 0, value 1; and now one could argue whether 3 is
closer to 4 or to 1. This quirk only appears for value '3' in this
array, but it seems to be a another rounding issue.
* And from 4 onwards the 'find_closest'() works fine (one gets what one
would expect).
This change reworks the find_closest() macros to also check the difference
between the left and right elements when 'x'. If the distance to the right
is smaller (than the distance to the left), the index is incremented by 1.
This also makes redundant the need for using the DIV_ROUND_CLOSEST() macro.
In order to accommodate for any mix of negative + positive values, the
internal variables '__fc_x', '__fc_mid_x', '__fc_left' & '__fc_right' are
forced to 'long' type. This also addresses any potential bugs/issues with
'x' being of an unsigned type. In those situations any comparison between
signed & unsigned would be promoted to a comparison between 2 unsigned
numbers; this is especially annoying when '__fc_left' & '__fc_right'
underflow.
The find_closest_descending() macro was also reworked and duplicated from
the find_closest(), and it is being iterated in reverse. The main reason
for this is to get the same indices as 'find_closest()' (but in reverse).
The comparison for '__fc_right < __fc_left' favors going the array in
ascending order.
For example for array '{ 1024, 512, 256, 128, 64, 16, 4, 1 }' and x = 3, we
get:
__fc_mid_x = 2
__fc_left = -1
__fc_right = -2
Then '__fc_right < __fc_left' evaluates to true and '__fc_i++' becomes 7
which is not quite incorrect, but 3 is closer to 4 than to 1.
This change has been validated with the kunit from the next patch.
Link: https://lkml.kernel.org/r/20241105145406.554365-1-aardelean@baylibre.com
Fixes: 95d119528b0b ("util_macros.h: add find_closest() macro")
Signed-off-by: Alexandru Ardelean <aardelean@baylibre.com>
Cc: Bartosz Golaszewski <bartosz.golaszewski@linaro.org>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/util_macros.h | 56 +++++++++++++++++++++++++++++++-------------
1 file changed, 40 insertions(+), 16 deletions(-)
--- a/include/linux/util_macros.h
+++ b/include/linux/util_macros.h
@@ -4,19 +4,6 @@
#include <linux/math.h>
-#define __find_closest(x, a, as, op) \
-({ \
- typeof(as) __fc_i, __fc_as = (as) - 1; \
- typeof(x) __fc_x = (x); \
- typeof(*a) const *__fc_a = (a); \
- for (__fc_i = 0; __fc_i < __fc_as; __fc_i++) { \
- if (__fc_x op DIV_ROUND_CLOSEST(__fc_a[__fc_i] + \
- __fc_a[__fc_i + 1], 2)) \
- break; \
- } \
- (__fc_i); \
-})
-
/**
* find_closest - locate the closest element in a sorted array
* @x: The reference value.
@@ -25,8 +12,27 @@
* @as: Size of 'a'.
*
* Returns the index of the element closest to 'x'.
+ * Note: If using an array of negative numbers (or mixed positive numbers),
+ * then be sure that 'x' is of a signed-type to get good results.
*/
-#define find_closest(x, a, as) __find_closest(x, a, as, <=)
+#define find_closest(x, a, as) \
+({ \
+ typeof(as) __fc_i, __fc_as = (as) - 1; \
+ long __fc_mid_x, __fc_x = (x); \
+ long __fc_left, __fc_right; \
+ typeof(*a) const *__fc_a = (a); \
+ for (__fc_i = 0; __fc_i < __fc_as; __fc_i++) { \
+ __fc_mid_x = (__fc_a[__fc_i] + __fc_a[__fc_i + 1]) / 2; \
+ if (__fc_x <= __fc_mid_x) { \
+ __fc_left = __fc_x - __fc_a[__fc_i]; \
+ __fc_right = __fc_a[__fc_i + 1] - __fc_x; \
+ if (__fc_right < __fc_left) \
+ __fc_i++; \
+ break; \
+ } \
+ } \
+ (__fc_i); \
+})
/**
* find_closest_descending - locate the closest element in a sorted array
@@ -36,9 +42,27 @@
* @as: Size of 'a'.
*
* Similar to find_closest() but 'a' is expected to be sorted in descending
- * order.
+ * order. The iteration is done in reverse order, so that the comparison
+ * of '__fc_right' & '__fc_left' also works for unsigned numbers.
*/
-#define find_closest_descending(x, a, as) __find_closest(x, a, as, >=)
+#define find_closest_descending(x, a, as) \
+({ \
+ typeof(as) __fc_i, __fc_as = (as) - 1; \
+ long __fc_mid_x, __fc_x = (x); \
+ long __fc_left, __fc_right; \
+ typeof(*a) const *__fc_a = (a); \
+ for (__fc_i = __fc_as; __fc_i >= 1; __fc_i--) { \
+ __fc_mid_x = (__fc_a[__fc_i] + __fc_a[__fc_i - 1]) / 2; \
+ if (__fc_x <= __fc_mid_x) { \
+ __fc_left = __fc_x - __fc_a[__fc_i]; \
+ __fc_right = __fc_a[__fc_i - 1] - __fc_x; \
+ if (__fc_right < __fc_left) \
+ __fc_i--; \
+ break; \
+ } \
+ } \
+ (__fc_i); \
+})
/**
* is_insidevar - check if the @ptr points inside the @var memory range.
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 077/146] s390/stacktrace: Use break instead of return statement
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (75 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 076/146] util_macros.h: fix/rework find_closest() macros Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 078/146] scsi: ufs: exynos: Add check inside exynos_ufs_config_smu() Greg Kroah-Hartman
` (76 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jens Remus, Heiko Carstens
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Carstens <hca@linux.ibm.com>
commit 588a9836a4ef7ec3bfcffda526dfa399637e6cfc upstream.
arch_stack_walk_user_common() contains a return statement instead of a
break statement in case store_ip() fails while trying to store a callchain
entry of a user space process.
This may lead to a missing pagefault_enable() call.
If this happens any subsequent page fault of the process won't be resolved
by the page fault handler and this in turn will lead to the process being
killed.
Use a break instead of a return statement to fix this.
Fixes: ebd912ff9919 ("s390/stacktrace: Merge perf_callchain_user() and arch_stack_walk_user()")
Cc: stable@vger.kernel.org
Reviewed-by: Jens Remus <jremus@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/s390/kernel/stacktrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/s390/kernel/stacktrace.c b/arch/s390/kernel/stacktrace.c
index 9f59837d159e..40edfde25f5b 100644
--- a/arch/s390/kernel/stacktrace.c
+++ b/arch/s390/kernel/stacktrace.c
@@ -151,7 +151,7 @@ void arch_stack_walk_user_common(stack_trace_consume_fn consume_entry, void *coo
break;
}
if (!store_ip(consume_entry, cookie, entry, perf, ip))
- return;
+ break;
first = false;
}
pagefault_enable();
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 078/146] scsi: ufs: exynos: Add check inside exynos_ufs_config_smu()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (76 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 077/146] s390/stacktrace: Use break instead of return statement Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 079/146] scsi: ufs: exynos: Fix hibern8 notify callbacks Greg Kroah-Hartman
` (75 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Griffin, Tudor Ambarus,
Martin K. Petersen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <peter.griffin@linaro.org>
commit c662cedea14efdcf373d8d886ec18019d50e0772 upstream.
Move the EXYNOS_UFS_OPT_UFSPR_SECURE check inside
exynos_ufs_config_smu().
This way all call sites will benefit from the check. This fixes a bug
currently in the exynos_ufs_resume() path on gs101 as it calls
exynos_ufs_config_smu() and we end up accessing registers that can only
be accessed from secure world which results in a serror.
Fixes: d11e0a318df8 ("scsi: ufs: exynos: Add support for Tensor gs101 SoC")
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://lore.kernel.org/r/20241031150033.3440894-5-peter.griffin@linaro.org
Cc: stable@vger.kernel.org
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/host/ufs-exynos.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/ufs/host/ufs-exynos.c
+++ b/drivers/ufs/host/ufs-exynos.c
@@ -724,6 +724,9 @@ static void exynos_ufs_config_smu(struct
{
u32 reg, val;
+ if (ufs->opts & EXYNOS_UFS_OPT_UFSPR_SECURE)
+ return;
+
exynos_ufs_disable_auto_ctrl_hcc_save(ufs, &val);
/* make encryption disabled by default */
@@ -1440,8 +1443,8 @@ static int exynos_ufs_init(struct ufs_hb
if (ret)
goto out;
exynos_ufs_specify_phy_time_attr(ufs);
- if (!(ufs->opts & EXYNOS_UFS_OPT_UFSPR_SECURE))
- exynos_ufs_config_smu(ufs);
+
+ exynos_ufs_config_smu(ufs);
hba->host->dma_alignment = DATA_UNIT_SIZE - 1;
return 0;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 079/146] scsi: ufs: exynos: Fix hibern8 notify callbacks
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (77 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 078/146] scsi: ufs: exynos: Add check inside exynos_ufs_config_smu() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 080/146] i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled Greg Kroah-Hartman
` (74 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Peter Griffin, Tudor Ambarus,
Martin K. Petersen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Griffin <peter.griffin@linaro.org>
commit ceef938bbf8b93ba3a218b4adc244cde94b582aa upstream.
v1 of the patch which introduced the ufshcd_vops_hibern8_notify()
callback used a bool instead of an enum. In v2 this was updated to an
enum based on the review feedback in [1].
ufs-exynos hibernate calls have always been broken upstream as it
follows the v1 bool implementation.
Link: https://patchwork.kernel.org/project/linux-scsi/patch/001f01d23994$719997c0$54ccc740$@samsung.com/ [1]
Fixes: 55f4b1f73631 ("scsi: ufs: ufs-exynos: Add UFS host support for Exynos SoCs")
Signed-off-by: Peter Griffin <peter.griffin@linaro.org>
Link: https://lore.kernel.org/r/20241031150033.3440894-13-peter.griffin@linaro.org
Cc: stable@vger.kernel.org
Reviewed-by: Tudor Ambarus <tudor.ambarus@linaro.org>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ufs/host/ufs-exynos.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/ufs/host/ufs-exynos.c
+++ b/drivers/ufs/host/ufs-exynos.c
@@ -1487,12 +1487,12 @@ static void exynos_ufs_dev_hw_reset(stru
hci_writel(ufs, 1 << 0, HCI_GPIO_OUT);
}
-static void exynos_ufs_pre_hibern8(struct ufs_hba *hba, u8 enter)
+static void exynos_ufs_pre_hibern8(struct ufs_hba *hba, enum uic_cmd_dme cmd)
{
struct exynos_ufs *ufs = ufshcd_get_variant(hba);
struct exynos_ufs_uic_attr *attr = ufs->drv_data->uic_attr;
- if (!enter) {
+ if (cmd == UIC_CMD_DME_HIBER_EXIT) {
if (ufs->opts & EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL)
exynos_ufs_disable_auto_ctrl_hcc(ufs);
exynos_ufs_ungate_clks(ufs);
@@ -1520,11 +1520,11 @@ static void exynos_ufs_pre_hibern8(struc
}
}
-static void exynos_ufs_post_hibern8(struct ufs_hba *hba, u8 enter)
+static void exynos_ufs_post_hibern8(struct ufs_hba *hba, enum uic_cmd_dme cmd)
{
struct exynos_ufs *ufs = ufshcd_get_variant(hba);
- if (!enter) {
+ if (cmd == UIC_CMD_DME_HIBER_EXIT) {
u32 cur_mode = 0;
u32 pwrmode;
@@ -1543,7 +1543,7 @@ static void exynos_ufs_post_hibern8(stru
if (!(ufs->opts & EXYNOS_UFS_OPT_SKIP_CONNECTION_ESTAB))
exynos_ufs_establish_connt(ufs);
- } else {
+ } else if (cmd == UIC_CMD_DME_HIBER_ENTER) {
ufs->entry_hibern8_t = ktime_get();
exynos_ufs_gate_clks(ufs);
if (ufs->opts & EXYNOS_UFS_OPT_BROKEN_AUTO_CLK_CTRL)
@@ -1630,15 +1630,15 @@ static int exynos_ufs_pwr_change_notify(
}
static void exynos_ufs_hibern8_notify(struct ufs_hba *hba,
- enum uic_cmd_dme enter,
+ enum uic_cmd_dme cmd,
enum ufs_notify_change_status notify)
{
switch ((u8)notify) {
case PRE_CHANGE:
- exynos_ufs_pre_hibern8(hba, enter);
+ exynos_ufs_pre_hibern8(hba, cmd);
break;
case POST_CHANGE:
- exynos_ufs_post_hibern8(hba, enter);
+ exynos_ufs_post_hibern8(hba, cmd);
break;
}
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 080/146] i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (78 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 079/146] scsi: ufs: exynos: Fix hibern8 notify callbacks Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 081/146] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() Greg Kroah-Hartman
` (73 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Miquel Raynal, Jinjie Ruan,
Alexandre Belloni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jinjie Ruan <ruanjinjie@huawei.com>
commit 18599e93e4e814ce146186026c6abf83c14d5798 upstream.
It is not valid to call pm_runtime_set_suspended() for devices
with runtime PM enabled because it returns -EAGAIN if it is enabled
already and working. So, call pm_runtime_disable() before to fix it.
Cc: stable@vger.kernel.org # v5.17
Fixes: 05be23ef78f7 ("i3c: master: svc: add runtime pm support")
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Jinjie Ruan <ruanjinjie@huawei.com>
Link: https://lore.kernel.org/r/20240930091913.2545510-1-ruanjinjie@huawei.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/svc-i3c-master.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -1827,8 +1827,8 @@ static int svc_i3c_master_probe(struct p
rpm_disable:
pm_runtime_dont_use_autosuspend(&pdev->dev);
pm_runtime_put_noidle(&pdev->dev);
- pm_runtime_set_suspended(&pdev->dev);
pm_runtime_disable(&pdev->dev);
+ pm_runtime_set_suspended(&pdev->dev);
err_disable_clks:
svc_i3c_master_unprepare_clks(master);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 081/146] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (79 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 080/146] i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 082/146] i3c: master: svc: fix possible assignment of the same address to two devices Greg Kroah-Hartman
` (72 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Miquel Raynal, Frank Li,
Alexandre Belloni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 3082990592f7c6d7510a9133afa46e31bbe26533 upstream.
if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
^^^ here check "init_dyn_addr"
i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr, ...)
^^^^
free "dyn_addr"
Fix copy/paste error "dyn_addr" by replacing it with "init_dyn_addr".
Cc: stable@kernel.org
Fixes: 3a379bbcea0a ("i3c: Add core I3C infrastructure")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20241001162608.224039-1-Frank.Li@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i3c/master.c
+++ b/drivers/i3c/master.c
@@ -1417,7 +1417,7 @@ static void i3c_master_put_i3c_addrs(str
I3C_ADDR_SLOT_FREE);
if (dev->boardinfo && dev->boardinfo->init_dyn_addr)
- i3c_bus_set_addr_slot_status(&master->bus, dev->info.dyn_addr,
+ i3c_bus_set_addr_slot_status(&master->bus, dev->boardinfo->init_dyn_addr,
I3C_ADDR_SLOT_FREE);
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 082/146] i3c: master: svc: fix possible assignment of the same address to two devices
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (80 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 081/146] i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 083/146] i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter Greg Kroah-Hartman
` (71 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Miquel Raynal, Frank Li,
Alexandre Belloni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 3b2ac810d86eb96e882db80a3320a3848b133208 upstream.
svc_i3c_master_do_daa() {
...
for (i = 0; i < dev_nb; i++) {
ret = i3c_master_add_i3c_dev_locked(m, addrs[i]);
if (ret)
goto rpm_out;
}
}
If two devices (A and B) are detected in DAA and address 0xa is assigned to
device A and 0xb to device B, a failure in i3c_master_add_i3c_dev_locked()
for device A (addr: 0xa) could prevent device B (addr: 0xb) from being
registered on the bus. The I3C stack might still consider 0xb a free
address. If a subsequent Hotjoin occurs, 0xb might be assigned to Device A,
causing both devices A and B to use the same address 0xb, violating the I3C
specification.
The return value for i3c_master_add_i3c_dev_locked() should not be checked
because subsequent steps will scan the entire I3C bus, independent of
whether i3c_master_add_i3c_dev_locked() returns success.
If device A registration fails, there is still a chance to register device
B. i3c_master_add_i3c_dev_locked() can reset DAA if a failure occurs while
retrieving device information.
Cc: stable@kernel.org
Fixes: 317bacf960a4 ("i3c: master: add enable(disable) hot join in sys entry")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20241002-svc-i3c-hj-v6-6-7e6e1d3569ae@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/svc-i3c-master.c | 27 +++++++++++++++++++++------
1 file changed, 21 insertions(+), 6 deletions(-)
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -1056,12 +1056,27 @@ static int svc_i3c_master_do_daa(struct
if (ret)
goto rpm_out;
- /* Register all devices who participated to the core */
- for (i = 0; i < dev_nb; i++) {
- ret = i3c_master_add_i3c_dev_locked(m, addrs[i]);
- if (ret)
- goto rpm_out;
- }
+ /*
+ * Register all devices who participated to the core
+ *
+ * If two devices (A and B) are detected in DAA and address 0xa is assigned to
+ * device A and 0xb to device B, a failure in i3c_master_add_i3c_dev_locked()
+ * for device A (addr: 0xa) could prevent device B (addr: 0xb) from being
+ * registered on the bus. The I3C stack might still consider 0xb a free
+ * address. If a subsequent Hotjoin occurs, 0xb might be assigned to Device A,
+ * causing both devices A and B to use the same address 0xb, violating the I3C
+ * specification.
+ *
+ * The return value for i3c_master_add_i3c_dev_locked() should not be checked
+ * because subsequent steps will scan the entire I3C bus, independent of
+ * whether i3c_master_add_i3c_dev_locked() returns success.
+ *
+ * If device A registration fails, there is still a chance to register device
+ * B. i3c_master_add_i3c_dev_locked() can reset DAA if a failure occurs while
+ * retrieving device information.
+ */
+ for (i = 0; i < dev_nb; i++)
+ i3c_master_add_i3c_dev_locked(m, addrs[i]);
/* Configure IBI auto-rules */
ret = svc_i3c_update_ibirules(master);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 083/146] i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (81 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 082/146] i3c: master: svc: fix possible assignment of the same address to two devices Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 084/146] PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible Greg Kroah-Hartman
` (70 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, stable, Miquel Raynal, Frank Li,
Alexandre Belloni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frank Li <Frank.Li@nxp.com>
commit 25bc99be5fe53853053ceeaa328068c49dc1e799 upstream.
Fix issue where disabling IBI on one device disables the entire IBI
interrupt. Modify bit 7:0 of enabled_events to serve as an IBI enable
counter, ensuring that the system IBI interrupt is disabled only when all
I3C devices have IBI disabled.
Cc: stable@kernel.org
Fixes: 7ff730ca458e ("i3c: master: svc: enable the interrupt in the enable ibi function")
Reviewed-by: Miquel Raynal <miquel.raynal@bootlin.com>
Signed-off-by: Frank Li <Frank.Li@nxp.com>
Link: https://lore.kernel.org/r/20241101165002.2479794-1-Frank.Li@nxp.com
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i3c/master/svc-i3c-master.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
--- a/drivers/i3c/master/svc-i3c-master.c
+++ b/drivers/i3c/master/svc-i3c-master.c
@@ -130,8 +130,8 @@
#define SVC_I3C_PPBAUD_MAX 15
#define SVC_I3C_QUICK_I2C_CLK 4170000
-#define SVC_I3C_EVENT_IBI BIT(0)
-#define SVC_I3C_EVENT_HOTJOIN BIT(1)
+#define SVC_I3C_EVENT_IBI GENMASK(7, 0)
+#define SVC_I3C_EVENT_HOTJOIN BIT(31)
struct svc_i3c_cmd {
u8 addr;
@@ -214,7 +214,7 @@ struct svc_i3c_master {
spinlock_t lock;
} ibi;
struct mutex lock;
- int enabled_events;
+ u32 enabled_events;
u32 mctrl_config;
};
@@ -1639,7 +1639,7 @@ static int svc_i3c_master_enable_ibi(str
return ret;
}
- master->enabled_events |= SVC_I3C_EVENT_IBI;
+ master->enabled_events++;
svc_i3c_master_enable_interrupts(master, SVC_I3C_MINT_SLVSTART);
return i3c_master_enec_locked(m, dev->info.dyn_addr, I3C_CCC_EVENT_SIR);
@@ -1651,7 +1651,7 @@ static int svc_i3c_master_disable_ibi(st
struct svc_i3c_master *master = to_svc_i3c_master(m);
int ret;
- master->enabled_events &= ~SVC_I3C_EVENT_IBI;
+ master->enabled_events--;
if (!master->enabled_events)
svc_i3c_master_disable_interrupts(master);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 084/146] PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (82 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 083/146] i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 085/146] PCI: keystone: Add link up check to ks_pcie_other_map_bus() Greg Kroah-Hartman
` (69 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kishon Vijay Abraham I,
Siddharth Vadapalli, Krzysztof Wilczyński
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <kishon@ti.com>
commit 5a938ed9481b0c06cb97aec45e722a80568256fd upstream.
commit 23284ad677a9 ("PCI: keystone: Add support for PCIe EP in AM654x
Platforms") introduced configuring "enum dw_pcie_device_mode" as part of
device data ("struct ks_pcie_of_data"). However it failed to set the
mode for "ti,keystone-pcie" compatible.
Since the mode defaults to "DW_PCIE_UNKNOWN_TYPE", the following error
message is displayed for the v3.65a controller:
"INVALID device type 0"
Despite the driver probing successfully, the controller may not be
functional in the Root Complex mode of operation.
So, set the mode as Root Complex for "ti,keystone-pcie" compatible to
fix this.
Fixes: 23284ad677a9 ("PCI: keystone: Add support for PCIe EP in AM654x Platforms")
Link: https://lore.kernel.org/r/20240524105714.191642-2-s-vadapalli@ti.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
[kwilczynski: commit log, added tag for stable releases]
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pci-keystone.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -1093,6 +1093,7 @@ static int ks_pcie_am654_set_mode(struct
static const struct ks_pcie_of_data ks_pcie_rc_of_data = {
.host_ops = &ks_pcie_host_ops,
+ .mode = DW_PCIE_RC_TYPE,
.version = DW_PCIE_VER_365A,
};
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 085/146] PCI: keystone: Add link up check to ks_pcie_other_map_bus()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (83 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 084/146] PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 086/146] PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy() Greg Kroah-Hartman
` (68 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kishon Vijay Abraham I,
Siddharth Vadapalli, Krzysztof Wilczyński
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kishon Vijay Abraham I <kishon@ti.com>
commit 9e9ec8d8692a6f64d81ef67d4fb6255af6be684b upstream.
K2G forwards the error triggered by a link-down state (e.g., no connected
endpoint device) on the system bus for PCI configuration transactions;
these errors are reported as an SError at system level, which is fatal and
hangs the system.
So, apply fix similar to how it was done in the DesignWare Core driver
commit 15b23906347c ("PCI: dwc: Add link up check in dw_child_pcie_ops.map_bus()").
Fixes: 10a797c6e54a ("PCI: dwc: keystone: Use pci_ops for config space accessors")
Link: https://lore.kernel.org/r/20240524105714.191642-3-s-vadapalli@ti.com
Signed-off-by: Kishon Vijay Abraham I <kishon@ti.com>
Signed-off-by: Siddharth Vadapalli <s-vadapalli@ti.com>
[kwilczynski: commit log, added tag for stable releases]
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pci-keystone.c | 11 +++++++++++
1 file changed, 11 insertions(+)
--- a/drivers/pci/controller/dwc/pci-keystone.c
+++ b/drivers/pci/controller/dwc/pci-keystone.c
@@ -455,6 +455,17 @@ static void __iomem *ks_pcie_other_map_b
struct keystone_pcie *ks_pcie = to_keystone_pcie(pci);
u32 reg;
+ /*
+ * Checking whether the link is up here is a last line of defense
+ * against platforms that forward errors on the system bus as
+ * SError upon PCI configuration transactions issued when the link
+ * is down. This check is racy by definition and does not stop
+ * the system from triggering an SError if the link goes down
+ * after this check is performed.
+ */
+ if (!dw_pcie_link_up(pci))
+ return NULL;
+
reg = CFG_BUS(bus->number) | CFG_DEVICE(PCI_SLOT(devfn)) |
CFG_FUNC(PCI_FUNC(devfn));
if (!pci_is_root_bus(bus->parent))
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 086/146] PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (84 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 085/146] PCI: keystone: Add link up check to ks_pcie_other_map_bus() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 087/146] PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf() Greg Kroah-Hartman
` (67 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Manivannan Sadhasivam,
Bjorn Helgaas, Krzysztof Wilczyński
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit 4acc902ed3743edd4ac2d3846604a99d17104359 upstream.
pci_epc_destroy() invokes pci_bus_release_domain_nr() to release the PCI
domain ID, but there are two issues:
- 'epc->dev' is passed to pci_bus_release_domain_nr() which was already
freed by device_unregister(), leading to a use-after-free issue.
- Domain ID corresponds to the EPC device parent, so passing 'epc->dev'
is also wrong.
Fix these issues by passing 'epc->dev.parent' to
pci_bus_release_domain_nr() and also do it before device_unregister().
Fixes: 0328947c5032 ("PCI: endpoint: Assign PCI domain number for endpoint controllers")
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Link: https://lore.kernel.org/r/20241107-epc_rfc-v2-1-da5b6a99a66f@quicinc.com
[mani: reworded subject and description]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/endpoint/pci-epc-core.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/pci/endpoint/pci-epc-core.c
+++ b/drivers/pci/endpoint/pci-epc-core.c
@@ -837,11 +837,10 @@ EXPORT_SYMBOL_GPL(pci_epc_bus_master_ena
void pci_epc_destroy(struct pci_epc *epc)
{
pci_ep_cfs_remove_epc_group(epc->group);
- device_unregister(&epc->dev);
-
#ifdef CONFIG_PCI_DOMAINS_GENERIC
- pci_bus_release_domain_nr(&epc->dev, epc->domain_nr);
+ pci_bus_release_domain_nr(epc->dev.parent, epc->domain_nr);
#endif
+ device_unregister(&epc->dev);
}
EXPORT_SYMBOL_GPL(pci_epc_destroy);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 087/146] PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (85 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 086/146] PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:36 ` [PATCH 6.12 088/146] slab: Fix too strict alignment check in create_cache() Greg Kroah-Hartman
` (66 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zijun Hu, Manivannan Sadhasivam,
Bjorn Helgaas, Krzysztof Wilczyński
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zijun Hu <quic_zijuhu@quicinc.com>
commit 688d2eb4c6fcfdcdaed0592f9df9196573ff5ce2 upstream.
In addition to a primary endpoint controller, an endpoint function may be
associated with a secondary endpoint controller, epf->sec_epc, to provide
NTB (non-transparent bridge) functionality.
Previously, pci_epc_remove_epf() incorrectly cleared epf->epc instead of
epf->sec_epc when removing from the secondary endpoint controller.
Extend the epc->list_lock coverage and clear either epf->epc or
epf->sec_epc as indicated.
Link: https://lore.kernel.org/r/20241107-epc_rfc-v2-2-da5b6a99a66f@quicinc.com
Fixes: 63840ff53223 ("PCI: endpoint: Add support to associate secondary EPC with EPF")
Signed-off-by: Zijun Hu <quic_zijuhu@quicinc.com>
Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[mani: reworded subject and description]
Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org>
[bhelgaas: commit log]
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/endpoint/pci-epc-core.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/drivers/pci/endpoint/pci-epc-core.c
+++ b/drivers/pci/endpoint/pci-epc-core.c
@@ -660,18 +660,18 @@ void pci_epc_remove_epf(struct pci_epc *
if (IS_ERR_OR_NULL(epc) || !epf)
return;
+ mutex_lock(&epc->list_lock);
if (type == PRIMARY_INTERFACE) {
func_no = epf->func_no;
list = &epf->list;
+ epf->epc = NULL;
} else {
func_no = epf->sec_epc_func_no;
list = &epf->sec_epc_list;
+ epf->sec_epc = NULL;
}
-
- mutex_lock(&epc->list_lock);
clear_bit(func_no, &epc->function_num_map);
list_del(list);
- epf->epc = NULL;
mutex_unlock(&epc->list_lock);
}
EXPORT_SYMBOL_GPL(pci_epc_remove_epf);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 088/146] slab: Fix too strict alignment check in create_cache()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (86 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 087/146] PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf() Greg Kroah-Hartman
@ 2024-12-06 14:36 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 089/146] fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero Greg Kroah-Hartman
` (65 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:36 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Guenter Roeck, Geert Uytterhoeven,
Jens Axboe, Vlastimil Babka
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Geert Uytterhoeven <geert@linux-m68k.org>
commit 9008fe8fad8255edfdbecea32d7eb0485d939d0d upstream.
On m68k, where the minimum alignment of unsigned long is 2 bytes:
Kernel panic - not syncing: __kmem_cache_create_args: Failed to create slab 'io_kiocb'. Error -22
CPU: 0 UID: 0 PID: 1 Comm: swapper Not tainted 6.12.0-atari-03776-g7eaa1f99261a #1783
Stack from 0102fe5c:
0102fe5c 00514a2b 00514a2b ffffff00 00000001 0051f5ed 00425e78 00514a2b
0041eb74 ffffffea 00000310 0051f5ed ffffffea ffffffea 00601f60 00000044
0102ff20 000e7a68 0051ab8e 004383b8 0051f5ed ffffffea 000000b8 00000007
01020c00 00000000 000e77f0 0041e5f0 005f67c0 0051f5ed 000000b6 0102fef4
00000310 0102fef4 00000000 00000016 005f676c 0060a34c 00000010 00000004
00000038 0000009a 01000000 000000b8 005f668e 0102e000 00001372 0102ff88
Call Trace: [<00425e78>] dump_stack+0xc/0x10
[<0041eb74>] panic+0xd8/0x26c
[<000e7a68>] __kmem_cache_create_args+0x278/0x2e8
[<000e77f0>] __kmem_cache_create_args+0x0/0x2e8
[<0041e5f0>] memset+0x0/0x8c
[<005f67c0>] io_uring_init+0x54/0xd2
The minimal alignment of an integral type may differ from its size,
hence is not safe to assume that an arbitrary freeptr_t (which is
basically an unsigned long) is always aligned to 4 or 8 bytes.
As nothing seems to require the additional alignment, it is safe to fix
this by relaxing the check to the actual minimum alignment of freeptr_t.
Fixes: aaa736b186239b7d ("io_uring: specify freeptr usage for SLAB_TYPESAFE_BY_RCU io_kiocb cache")
Fixes: d345bd2e9834e2da ("mm: add kmem_cache_create_rcu()")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Closes: https://lore.kernel.org/37c588d4-2c32-4aad-a19e-642961f200d7@roeck-us.net
Cc: <stable@vger.kernel.org>
Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/slab_common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -230,7 +230,7 @@ static struct kmem_cache *create_cache(c
if (args->use_freeptr_offset &&
(args->freeptr_offset >= object_size ||
!(flags & SLAB_TYPESAFE_BY_RCU) ||
- !IS_ALIGNED(args->freeptr_offset, sizeof(freeptr_t))))
+ !IS_ALIGNED(args->freeptr_offset, __alignof__(freeptr_t))))
goto out;
err = -ENOMEM;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 089/146] fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (87 preceding siblings ...)
2024-12-06 14:36 ` [PATCH 6.12 088/146] slab: Fix too strict alignment check in create_cache() Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 090/146] thermal: int3400: Fix reading of current_uuid for active policy Greg Kroah-Hartman
` (64 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Alexander Gordeev, Jiri Olsa,
Christian Brauner
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Olsa <jolsa@kernel.org>
commit 088f294609d8f8816dc316681aef2eb61982e0da upstream.
If iov_iter_zero succeeds after failed copy_from_kernel_nofault,
we need to reset the ret value to zero otherwise it will be returned
as final return value of read_kcore_iter.
This fixes objdump -d dump over /proc/kcore for me.
Cc: stable@vger.kernel.org
Cc: Alexander Gordeev <agordeev@linux.ibm.com>
Fixes: 3d5854d75e31 ("fs/proc/kcore.c: allow translation of physical memory addresses")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Link: https://lore.kernel.org/r/20241121231118.3212000-1-jolsa@kernel.org
Acked-by: Alexander Gordeev <agordeev@linux.ibm.com>
Signed-off-by: Christian Brauner <brauner@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/proc/kcore.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/proc/kcore.c
+++ b/fs/proc/kcore.c
@@ -600,6 +600,7 @@ static ssize_t read_kcore_iter(struct ki
ret = -EFAULT;
goto out;
}
+ ret = 0;
/*
* We know the bounce buffer is safe to copy from, so
* use _copy_to_iter() directly.
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 090/146] thermal: int3400: Fix reading of current_uuid for active policy
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (88 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 089/146] fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 091/146] leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths Greg Kroah-Hartman
` (63 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Srinivas Pandruvada,
Rafael J. Wysocki
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
commit 7082503622986537f57bdb5ef23e69e70cfad881 upstream.
When the current_uuid attribute is set to the active policy UUID,
reading back the same attribute is returning "INVALID" instead of
the active policy UUID on some platforms before Ice Lake.
In platforms before Ice Lake, firmware provides a list of supported
thermal policies. In this case, user space can select any of the
supported thermal policies via a write to attribute "current_uuid".
In commit c7ff29763989 ("thermal: int340x: Update OS policy capability
handshake")', the OS policy handshake was updated to support Ice Lake
and later platforms and it treated priv->current_uuid_index=0 as
invalid. However, priv->current_uuid_index=0 is for the active policy,
only priv->current_uuid_index=-1 is invalid.
Fix this issue by updating the priv->current_uuid_index check.
Fixes: c7ff29763989 ("thermal: int340x: Update OS policy capability handshake")
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: 5.18+ <stable@vger.kernel.org> # 5.18+
Link: https://patch.msgid.link/20241114200213.422303-1-srinivas.pandruvada@linux.intel.com
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
+++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c
@@ -137,7 +137,7 @@ static ssize_t current_uuid_show(struct
struct int3400_thermal_priv *priv = dev_get_drvdata(dev);
int i, length = 0;
- if (priv->current_uuid_index > 0)
+ if (priv->current_uuid_index >= 0)
return sprintf(buf, "%s\n",
int3400_thermal_uuids[priv->current_uuid_index]);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 091/146] leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (89 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 090/146] thermal: int3400: Fix reading of current_uuid for active policy Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 092/146] ovl: properly handle large files in ovl_security_fileattr Greg Kroah-Hartman
` (62 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Javier Carrasco, Lee Jones
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit 73b03b27736e440e3009fe1319cbc82d2cd1290c upstream.
The device_for_each_child_node() macro requires explicit calls to
fwnode_handle_put() upon early exits to avoid memory leaks, and in
this case the error paths are handled after jumping to
'out_flash_realease', which misses that required call to
to decrement the refcount of the child node.
A more elegant and robust solution is using the scoped variant of the
loop, which automatically handles such early exits.
Fix the child node refcounting in the error paths by using
device_for_each_child_node_scoped().
Cc: stable@vger.kernel.org
Fixes: 679f8652064b ("leds: Add mt6360 driver")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Link: https://lore.kernel.org/r/20240927-leds_device_for_each_child_node_scoped-v1-1-95c0614b38c8@gmail.com
Signed-off-by: Lee Jones <lee@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/leds/flash/leds-mt6360.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/leds/flash/leds-mt6360.c
+++ b/drivers/leds/flash/leds-mt6360.c
@@ -784,7 +784,6 @@ static void mt6360_v4l2_flash_release(st
static int mt6360_led_probe(struct platform_device *pdev)
{
struct mt6360_priv *priv;
- struct fwnode_handle *child;
size_t count;
int i = 0, ret;
@@ -811,7 +810,7 @@ static int mt6360_led_probe(struct platf
return -ENODEV;
}
- device_for_each_child_node(&pdev->dev, child) {
+ device_for_each_child_node_scoped(&pdev->dev, child) {
struct mt6360_led *led = priv->leds + i;
struct led_init_data init_data = { .fwnode = child, };
u32 reg, led_color;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 092/146] ovl: properly handle large files in ovl_security_fileattr
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (90 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 091/146] leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 093/146] mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation Greg Kroah-Hartman
` (61 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Oleksandr Tymoshenko, Amir Goldstein
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oleksandr Tymoshenko <ovt@google.com>
commit 3b6b99ef15ea37635604992ede9ebcccef38a239 upstream.
dentry_open in ovl_security_fileattr fails for any file
larger than 2GB if open method of the underlying filesystem
calls generic_file_open (e.g. fusefs).
The issue can be reproduce using the following script:
(passthrough_ll is an example app from libfuse).
$ D=/opt/test/mnt
$ mkdir -p ${D}/{source,base,top/uppr,top/work,ovlfs}
$ dd if=/dev/zero of=${D}/source/zero.bin bs=1G count=2
$ passthrough_ll -o source=${D}/source ${D}/base
$ mount -t overlay overlay \
-olowerdir=${D}/base,upperdir=${D}/top/uppr,workdir=${D}/top/work \
${D}/ovlfs
$ chmod 0777 ${D}/mnt/ovlfs/zero.bin
Running this script results in "Value too large for defined data type"
error message from chmod.
Signed-off-by: Oleksandr Tymoshenko <ovt@google.com>
Fixes: 72db82115d2b ("ovl: copy up sync/noatime fileattr flags")
Cc: stable@vger.kernel.org # v5.15+
Signed-off-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/overlayfs/inode.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -616,8 +616,13 @@ static int ovl_security_fileattr(const s
struct file *file;
unsigned int cmd;
int err;
+ unsigned int flags;
- file = dentry_open(realpath, O_RDONLY, current_cred());
+ flags = O_RDONLY;
+ if (force_o_largefile())
+ flags |= O_LARGEFILE;
+
+ file = dentry_open(realpath, flags, current_cred());
if (IS_ERR(file))
return PTR_ERR(file);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 093/146] mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (91 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 092/146] ovl: properly handle large files in ovl_security_fileattr Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 094/146] dm: Fix typo in error message Greg Kroah-Hartman
` (60 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Adrian Huang,
Uladzislau Rezki (Sony), Jiwei Sun, Baoquan He,
Alexander Potapenko, Andrey Konovalov, Andrey Ryabinin,
Christoph Hellwig, Dmitry Vyukov, Vincenzo Frascino,
Andrew Morton
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Adrian Huang <ahuang12@lenovo.com>
commit 9e9e085effe9b7e342138fde3cf8577d22509932 upstream.
When compiling kernel source 'make -j $(nproc)' with the up-and-running
KASAN-enabled kernel on a 256-core machine, the following soft lockup is
shown:
watchdog: BUG: soft lockup - CPU#28 stuck for 22s! [kworker/28:1:1760]
CPU: 28 PID: 1760 Comm: kworker/28:1 Kdump: loaded Not tainted 6.10.0-rc5 #95
Workqueue: events drain_vmap_area_work
RIP: 0010:smp_call_function_many_cond+0x1d8/0xbb0
Code: 38 c8 7c 08 84 c9 0f 85 49 08 00 00 8b 45 08 a8 01 74 2e 48 89 f1 49 89 f7 48 c1 e9 03 41 83 e7 07 4c 01 e9 41 83 c7 03 f3 90 <0f> b6 01 41 38 c7 7c 08 84 c0 0f 85 d4 06 00 00 8b 45 08 a8 01 75
RSP: 0018:ffffc9000cb3fb60 EFLAGS: 00000202
RAX: 0000000000000011 RBX: ffff8883bc4469c0 RCX: ffffed10776e9949
RDX: 0000000000000002 RSI: ffff8883bb74ca48 RDI: ffffffff8434dc50
RBP: ffff8883bb74ca40 R08: ffff888103585dc0 R09: ffff8884533a1800
R10: 0000000000000004 R11: ffffffffffffffff R12: ffffed1077888d39
R13: dffffc0000000000 R14: ffffed1077888d38 R15: 0000000000000003
FS: 0000000000000000(0000) GS:ffff8883bc400000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005577b5c8d158 CR3: 0000000004850000 CR4: 0000000000350ef0
Call Trace:
<IRQ>
? watchdog_timer_fn+0x2cd/0x390
? __pfx_watchdog_timer_fn+0x10/0x10
? __hrtimer_run_queues+0x300/0x6d0
? sched_clock_cpu+0x69/0x4e0
? __pfx___hrtimer_run_queues+0x10/0x10
? srso_return_thunk+0x5/0x5f
? ktime_get_update_offsets_now+0x7f/0x2a0
? srso_return_thunk+0x5/0x5f
? srso_return_thunk+0x5/0x5f
? hrtimer_interrupt+0x2ca/0x760
? __sysvec_apic_timer_interrupt+0x8c/0x2b0
? sysvec_apic_timer_interrupt+0x6a/0x90
</IRQ>
<TASK>
? asm_sysvec_apic_timer_interrupt+0x16/0x20
? smp_call_function_many_cond+0x1d8/0xbb0
? __pfx_do_kernel_range_flush+0x10/0x10
on_each_cpu_cond_mask+0x20/0x40
flush_tlb_kernel_range+0x19b/0x250
? srso_return_thunk+0x5/0x5f
? kasan_release_vmalloc+0xa7/0xc0
purge_vmap_node+0x357/0x820
? __pfx_purge_vmap_node+0x10/0x10
__purge_vmap_area_lazy+0x5b8/0xa10
drain_vmap_area_work+0x21/0x30
process_one_work+0x661/0x10b0
worker_thread+0x844/0x10e0
? srso_return_thunk+0x5/0x5f
? __kthread_parkme+0x82/0x140
? __pfx_worker_thread+0x10/0x10
kthread+0x2a5/0x370
? __pfx_kthread+0x10/0x10
ret_from_fork+0x30/0x70
? __pfx_kthread+0x10/0x10
ret_from_fork_asm+0x1a/0x30
</TASK>
Debugging Analysis:
1. The following ftrace log shows that the lockup CPU spends too much
time iterating vmap_nodes and flushing TLB when purging vm_area
structures. (Some info is trimmed).
kworker: funcgraph_entry: | drain_vmap_area_work() {
kworker: funcgraph_entry: | mutex_lock() {
kworker: funcgraph_entry: 1.092 us | __cond_resched();
kworker: funcgraph_exit: 3.306 us | }
... ...
kworker: funcgraph_entry: | flush_tlb_kernel_range() {
... ...
kworker: funcgraph_exit: # 7533.649 us | }
... ...
kworker: funcgraph_entry: 2.344 us | mutex_unlock();
kworker: funcgraph_exit: $ 23871554 us | }
The drain_vmap_area_work() spends over 23 seconds.
There are 2805 flush_tlb_kernel_range() calls in the ftrace log.
* One is called in __purge_vmap_area_lazy().
* Others are called by purge_vmap_node->kasan_release_vmalloc.
purge_vmap_node() iteratively releases kasan vmalloc
allocations and flushes TLB for each vmap_area.
- [Rough calculation] Each flush_tlb_kernel_range() runs
about 7.5ms.
-- 2804 * 7.5ms = 21.03 seconds.
-- That's why a soft lock is triggered.
2. Extending the soft lockup time can work around the issue (For example,
# echo 60 > /proc/sys/kernel/watchdog_thresh). This confirms the
above-mentioned speculation: drain_vmap_area_work() spends too much
time.
If we combine all TLB flush operations of the KASAN shadow virtual
address into one operation in the call path
'purge_vmap_node()->kasan_release_vmalloc()', the running time of
drain_vmap_area_work() can be saved greatly. The idea is from the
flush_tlb_kernel_range() call in __purge_vmap_area_lazy(). And, the
soft lockup won't be triggered.
Here is the test result based on 6.10:
[6.10 wo/ the patch]
1. ftrace latency profiling (record a trace if the latency > 20s).
echo 20000000 > /sys/kernel/debug/tracing/tracing_thresh
echo drain_vmap_area_work > /sys/kernel/debug/tracing/set_graph_function
echo function_graph > /sys/kernel/debug/tracing/current_tracer
echo 1 > /sys/kernel/debug/tracing/tracing_on
2. Run `make -j $(nproc)` to compile the kernel source
3. Once the soft lockup is reproduced, check the ftrace log:
cat /sys/kernel/debug/tracing/trace
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
76) $ 50412985 us | } /* __purge_vmap_area_lazy */
76) $ 50412997 us | } /* drain_vmap_area_work */
76) $ 29165911 us | } /* __purge_vmap_area_lazy */
76) $ 29165926 us | } /* drain_vmap_area_work */
91) $ 53629423 us | } /* __purge_vmap_area_lazy */
91) $ 53629434 us | } /* drain_vmap_area_work */
91) $ 28121014 us | } /* __purge_vmap_area_lazy */
91) $ 28121026 us | } /* drain_vmap_area_work */
[6.10 w/ the patch]
1. Repeat step 1-2 in "[6.10 wo/ the patch]"
2. The soft lockup is not triggered and ftrace log is empty.
cat /sys/kernel/debug/tracing/trace
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
3. Setting 'tracing_thresh' to 10/5 seconds does not get any ftrace
log.
4. Setting 'tracing_thresh' to 1 second gets ftrace log.
cat /sys/kernel/debug/tracing/trace
# tracer: function_graph
#
# CPU DURATION FUNCTION CALLS
# | | | | | | |
23) $ 1074942 us | } /* __purge_vmap_area_lazy */
23) $ 1074950 us | } /* drain_vmap_area_work */
The worst execution time of drain_vmap_area_work() is about 1 second.
Link: https://lore.kernel.org/lkml/ZqFlawuVnOMY2k3E@pc638.lan/
Link: https://lkml.kernel.org/r/20240726165246.31326-1-ahuang12@lenovo.com
Fixes: 282631cb2447 ("mm: vmalloc: remove global purge_vmap_area_root rb-tree")
Signed-off-by: Adrian Huang <ahuang12@lenovo.com>
Co-developed-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Tested-by: Jiwei Sun <sunjw10@lenovo.com>
Reviewed-by: Baoquan He <bhe@redhat.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Konovalov <andreyknvl@gmail.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/kasan.h | 12 +++++++++---
mm/kasan/shadow.c | 14 ++++++++++----
mm/vmalloc.c | 34 ++++++++++++++++++++++++++--------
3 files changed, 45 insertions(+), 15 deletions(-)
diff --git a/include/linux/kasan.h b/include/linux/kasan.h
index 00a3bf7c0d8f..6bbfc8aa42e8 100644
--- a/include/linux/kasan.h
+++ b/include/linux/kasan.h
@@ -29,6 +29,9 @@ typedef unsigned int __bitwise kasan_vmalloc_flags_t;
#define KASAN_VMALLOC_VM_ALLOC ((__force kasan_vmalloc_flags_t)0x02u)
#define KASAN_VMALLOC_PROT_NORMAL ((__force kasan_vmalloc_flags_t)0x04u)
+#define KASAN_VMALLOC_PAGE_RANGE 0x1 /* Apply exsiting page range */
+#define KASAN_VMALLOC_TLB_FLUSH 0x2 /* TLB flush */
+
#if defined(CONFIG_KASAN_GENERIC) || defined(CONFIG_KASAN_SW_TAGS)
#include <linux/pgtable.h>
@@ -564,7 +567,8 @@ void kasan_populate_early_vm_area_shadow(void *start, unsigned long size);
int kasan_populate_vmalloc(unsigned long addr, unsigned long size);
void kasan_release_vmalloc(unsigned long start, unsigned long end,
unsigned long free_region_start,
- unsigned long free_region_end);
+ unsigned long free_region_end,
+ unsigned long flags);
#else /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
@@ -579,7 +583,8 @@ static inline int kasan_populate_vmalloc(unsigned long start,
static inline void kasan_release_vmalloc(unsigned long start,
unsigned long end,
unsigned long free_region_start,
- unsigned long free_region_end) { }
+ unsigned long free_region_end,
+ unsigned long flags) { }
#endif /* CONFIG_KASAN_GENERIC || CONFIG_KASAN_SW_TAGS */
@@ -614,7 +619,8 @@ static inline int kasan_populate_vmalloc(unsigned long start,
static inline void kasan_release_vmalloc(unsigned long start,
unsigned long end,
unsigned long free_region_start,
- unsigned long free_region_end) { }
+ unsigned long free_region_end,
+ unsigned long flags) { }
static inline void *kasan_unpoison_vmalloc(const void *start,
unsigned long size,
diff --git a/mm/kasan/shadow.c b/mm/kasan/shadow.c
index d6210ca48dda..88d1c9dcb507 100644
--- a/mm/kasan/shadow.c
+++ b/mm/kasan/shadow.c
@@ -489,7 +489,8 @@ static int kasan_depopulate_vmalloc_pte(pte_t *ptep, unsigned long addr,
*/
void kasan_release_vmalloc(unsigned long start, unsigned long end,
unsigned long free_region_start,
- unsigned long free_region_end)
+ unsigned long free_region_end,
+ unsigned long flags)
{
void *shadow_start, *shadow_end;
unsigned long region_start, region_end;
@@ -522,12 +523,17 @@ void kasan_release_vmalloc(unsigned long start, unsigned long end,
__memset(shadow_start, KASAN_SHADOW_INIT, shadow_end - shadow_start);
return;
}
- apply_to_existing_page_range(&init_mm,
+
+
+ if (flags & KASAN_VMALLOC_PAGE_RANGE)
+ apply_to_existing_page_range(&init_mm,
(unsigned long)shadow_start,
size, kasan_depopulate_vmalloc_pte,
NULL);
- flush_tlb_kernel_range((unsigned long)shadow_start,
- (unsigned long)shadow_end);
+
+ if (flags & KASAN_VMALLOC_TLB_FLUSH)
+ flush_tlb_kernel_range((unsigned long)shadow_start,
+ (unsigned long)shadow_end);
}
}
diff --git a/mm/vmalloc.c b/mm/vmalloc.c
index 634162271c00..5480b77f4167 100644
--- a/mm/vmalloc.c
+++ b/mm/vmalloc.c
@@ -2182,6 +2182,25 @@ decay_va_pool_node(struct vmap_node *vn, bool full_decay)
reclaim_list_global(&decay_list);
}
+static void
+kasan_release_vmalloc_node(struct vmap_node *vn)
+{
+ struct vmap_area *va;
+ unsigned long start, end;
+
+ start = list_first_entry(&vn->purge_list, struct vmap_area, list)->va_start;
+ end = list_last_entry(&vn->purge_list, struct vmap_area, list)->va_end;
+
+ list_for_each_entry(va, &vn->purge_list, list) {
+ if (is_vmalloc_or_module_addr((void *) va->va_start))
+ kasan_release_vmalloc(va->va_start, va->va_end,
+ va->va_start, va->va_end,
+ KASAN_VMALLOC_PAGE_RANGE);
+ }
+
+ kasan_release_vmalloc(start, end, start, end, KASAN_VMALLOC_TLB_FLUSH);
+}
+
static void purge_vmap_node(struct work_struct *work)
{
struct vmap_node *vn = container_of(work,
@@ -2190,20 +2209,17 @@ static void purge_vmap_node(struct work_struct *work)
struct vmap_area *va, *n_va;
LIST_HEAD(local_list);
+ if (IS_ENABLED(CONFIG_KASAN_VMALLOC))
+ kasan_release_vmalloc_node(vn);
+
vn->nr_purged = 0;
list_for_each_entry_safe(va, n_va, &vn->purge_list, list) {
unsigned long nr = va_size(va) >> PAGE_SHIFT;
- unsigned long orig_start = va->va_start;
- unsigned long orig_end = va->va_end;
unsigned int vn_id = decode_vn_id(va->flags);
list_del_init(&va->list);
- if (is_vmalloc_or_module_addr((void *)orig_start))
- kasan_release_vmalloc(orig_start, orig_end,
- va->va_start, va->va_end);
-
nr_purged_pages += nr;
vn->nr_purged++;
@@ -4784,7 +4800,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
&free_vmap_area_list);
if (va)
kasan_release_vmalloc(orig_start, orig_end,
- va->va_start, va->va_end);
+ va->va_start, va->va_end,
+ KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH);
vas[area] = NULL;
}
@@ -4834,7 +4851,8 @@ struct vm_struct **pcpu_get_vm_areas(const unsigned long *offsets,
&free_vmap_area_list);
if (va)
kasan_release_vmalloc(orig_start, orig_end,
- va->va_start, va->va_end);
+ va->va_start, va->va_end,
+ KASAN_VMALLOC_PAGE_RANGE | KASAN_VMALLOC_TLB_FLUSH);
vas[area] = NULL;
kfree(vms[area]);
}
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 094/146] dm: Fix typo in error message
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (92 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 093/146] mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 095/146] dm thin: Add missing destroy_work_on_stack() Greg Kroah-Hartman
` (59 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ssuhung Yeh, Mikulas Patocka
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ssuhung Yeh <ssuhung@gmail.com>
commit 2deb70d3e66d538404d9e71bff236e6d260da66e upstream.
Remove the redundant "i" at the beginning of the error message. This "i"
came from commit 1c1318866928 ("dm: prefer
'"%s...", __func__'"), the "i" is accidentally left.
Signed-off-by: Ssuhung Yeh <ssuhung@gmail.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Fixes: 1c1318866928 ("dm: prefer '"%s...", __func__'")
Cc: stable@vger.kernel.org # v6.3+
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/persistent-data/dm-space-map-common.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/md/persistent-data/dm-space-map-common.c
+++ b/drivers/md/persistent-data/dm-space-map-common.c
@@ -51,7 +51,7 @@ static int index_check(const struct dm_b
block_size - sizeof(__le32),
INDEX_CSUM_XOR));
if (csum_disk != mi_le->csum) {
- DMERR_LIMIT("i%s failed: csum %u != wanted %u", __func__,
+ DMERR_LIMIT("%s failed: csum %u != wanted %u", __func__,
le32_to_cpu(csum_disk), le32_to_cpu(mi_le->csum));
return -EILSEQ;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 095/146] dm thin: Add missing destroy_work_on_stack()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (93 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 094/146] dm: Fix typo in error message Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 096/146] PCI: dwc: ep: Fix advertised resizable BAR size regression Greg Kroah-Hartman
` (58 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yuan Can, Mikulas Patocka
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yuan Can <yuancan@huawei.com>
commit e74fa2447bf9ed03d085b6d91f0256cc1b53f1a8 upstream.
This commit add missed destroy_work_on_stack() operations for pw->worker in
pool_work_wait().
Fixes: e7a3e871d895 ("dm thin: cleanup noflush_work to use a proper completion")
Cc: stable@vger.kernel.org
Signed-off-by: Yuan Can <yuancan@huawei.com>
Signed-off-by: Mikulas Patocka <mpatocka@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/md/dm-thin.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -2484,6 +2484,7 @@ static void pool_work_wait(struct pool_w
init_completion(&pw->complete);
queue_work(pool->wq, &pw->worker);
wait_for_completion(&pw->complete);
+ destroy_work_on_stack(&pw->worker);
}
/*----------------------------------------------------------------*/
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 096/146] PCI: dwc: ep: Fix advertised resizable BAR size regression
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (94 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 095/146] dm thin: Add missing destroy_work_on_stack() Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 097/146] PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes Greg Kroah-Hartman
` (57 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Niklas Cassel,
Krzysztof Wilczyński
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Niklas Cassel <cassel@kernel.org>
commit 118397c9baaac0b7ec81896f8d755d09aa82c485 upstream.
The advertised resizable BAR size was fixed in commit 72e34b8593e0 ("PCI:
dwc: endpoint: Fix advertised resizable BAR size").
Commit 867ab111b242 ("PCI: dwc: ep: Add a generic dw_pcie_ep_linkdown()
API to handle Link Down event") was included shortly after this, and
moved the code to another function. When the code was moved, this fix
was mistakenly lost.
According to the spec, it is illegal to not have a bit set in
PCI_REBAR_CAP, and 1 MB is the smallest size allowed.
So, set bit 4 in PCI_REBAR_CAP, so that we actually advertise support
for a 1 MB BAR size.
Fixes: 867ab111b242 ("PCI: dwc: ep: Add a generic dw_pcie_ep_linkdown() API to handle Link Down event")
Link: https://lore.kernel.org/r/20241116005950.2480427-2-cassel@kernel.org
Link: https://lore.kernel.org/r/20240606-pci-deinit-v1-3-4395534520dc@linaro.org
Link: https://lore.kernel.org/r/20240307111520.3303774-1-cassel@kernel.org
Signed-off-by: Niklas Cassel <cassel@kernel.org>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/controller/dwc/pcie-designware-ep.c
+++ b/drivers/pci/controller/dwc/pcie-designware-ep.c
@@ -689,7 +689,7 @@ static void dw_pcie_ep_init_non_sticky_r
* for 1 MB BAR size only.
*/
for (i = 0; i < nbars; i++, offset += PCI_REBAR_CTRL)
- dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, 0x0);
+ dw_pcie_writel_dbi(pci, offset + PCI_REBAR_CAP, BIT(4));
}
dw_pcie_setup(pci);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 097/146] PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (95 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 096/146] PCI: dwc: ep: Fix advertised resizable BAR size regression Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 098/146] PCI: rockchip-ep: Fix address translation unit programming Greg Kroah-Hartman
` (56 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Herve Codina, Andrea della Porta,
Bjorn Helgaas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrea della Porta <andrea.porta@suse.com>
commit 5e316d34b53039346e252d0019e2f4167af2c0ef upstream.
When populating "ranges" property for a PCI bridge or endpoint,
of_pci_prop_ranges() incorrectly uses the CPU address of the resource. In
such PCI nodes, the window should instead be in PCI address space. Call
pci_bus_address() on the resource in order to obtain the PCI bus address.
[Previous discussion at:
https://lore.kernel.org/all/8b4fa91380fc4754ea80f47330c613e4f6b6592c.1724159867.git.andrea.porta@suse.com/]
Link: https://lore.kernel.org/r/20241108094256.28933-1-andrea.porta@suse.com
Fixes: 407d1a51921e ("PCI: Create device tree node for bridge")
Tested-by: Herve Codina <herve.codina@bootlin.com>
Signed-off-by: Andrea della Porta <andrea.porta@suse.com>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/of_property.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pci/of_property.c
+++ b/drivers/pci/of_property.c
@@ -126,7 +126,7 @@ static int of_pci_prop_ranges(struct pci
if (of_pci_get_addr_flags(&res[j], &flags))
continue;
- val64 = res[j].start;
+ val64 = pci_bus_address(pdev, &res[j] - pdev->resource);
of_pci_set_address(pdev, rp[i].parent_addr, val64, 0, flags,
false);
if (pci_is_bridge(pdev)) {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 098/146] PCI: rockchip-ep: Fix address translation unit programming
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (96 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 097/146] PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 099/146] nfsd: make sure exp active before svc_export_show Greg Kroah-Hartman
` (55 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Damien Le Moal,
Krzysztof Wilczyński, Bjorn Helgaas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Damien Le Moal <dlemoal@kernel.org>
commit 64f093c4d99d797b68b407a9d8767aadc3e3ea7a upstream.
The Rockchip PCIe endpoint controller handles PCIe transfers addresses
by masking the lower bits of the programmed PCI address and using the
same number of lower bits masked from the CPU address space used for the
mapping. For a PCI mapping of <size> bytes starting from <pci_addr>,
the number of bits masked is the number of address bits changing in the
address range [pci_addr..pci_addr + size - 1].
However, rockchip_pcie_prog_ep_ob_atu() calculates num_pass_bits only
using the size of the mapping, resulting in an incorrect number of mask
bits depending on the value of the PCI address to map.
Fix this by introducing the helper function
rockchip_pcie_ep_ob_atu_num_bits() to correctly calculate the number of
mask bits to use to program the address translation unit. The number of
mask bits is calculated depending on both the PCI address and size of
the mapping, and clamped between 8 and 20 using the macros
ROCKCHIP_PCIE_AT_MIN_NUM_BITS and ROCKCHIP_PCIE_AT_MAX_NUM_BITS. As
defined in the Rockchip RK3399 TRM V1.3 Part2, Sections 17.5.5.1.1 and
17.6.8.2.1, this clamping is necessary because:
1) The lower 8 bits of the PCI address to be mapped by the outbound
region are ignored. So a minimum of 8 address bits are needed and
imply that the PCI address must be aligned to 256.
2) The outbound memory regions are 1MB in size. So while we can specify
up to 63-bits for the PCI address (num_bits filed uses bits 0 to 5 of
the outbound address region 0 register), we must limit the number of
valid address bits to 20 to match the memory window maximum size (1
<< 20 = 1MB).
Fixes: cf590b078391 ("PCI: rockchip: Add EP driver for Rockchip PCIe controller")
Link: https://lore.kernel.org/r/20241017015849.190271-2-dlemoal@kernel.org
Signed-off-by: Damien Le Moal <dlemoal@kernel.org>
Signed-off-by: Krzysztof Wilczyński <kwilczynski@kernel.org>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pci/controller/pcie-rockchip-ep.c | 16 +++++++++++++---
drivers/pci/controller/pcie-rockchip.h | 4 ++++
2 files changed, 17 insertions(+), 3 deletions(-)
--- a/drivers/pci/controller/pcie-rockchip-ep.c
+++ b/drivers/pci/controller/pcie-rockchip-ep.c
@@ -63,15 +63,25 @@ static void rockchip_pcie_clear_ep_ob_at
ROCKCHIP_PCIE_AT_OB_REGION_DESC1(region));
}
+static int rockchip_pcie_ep_ob_atu_num_bits(struct rockchip_pcie *rockchip,
+ u64 pci_addr, size_t size)
+{
+ int num_pass_bits = fls64(pci_addr ^ (pci_addr + size - 1));
+
+ return clamp(num_pass_bits,
+ ROCKCHIP_PCIE_AT_MIN_NUM_BITS,
+ ROCKCHIP_PCIE_AT_MAX_NUM_BITS);
+}
+
static void rockchip_pcie_prog_ep_ob_atu(struct rockchip_pcie *rockchip, u8 fn,
u32 r, u64 cpu_addr, u64 pci_addr,
size_t size)
{
- int num_pass_bits = fls64(size - 1);
+ int num_pass_bits;
u32 addr0, addr1, desc0;
- if (num_pass_bits < 8)
- num_pass_bits = 8;
+ num_pass_bits = rockchip_pcie_ep_ob_atu_num_bits(rockchip,
+ pci_addr, size);
addr0 = ((num_pass_bits - 1) & PCIE_CORE_OB_REGION_ADDR0_NUM_BITS) |
(lower_32_bits(pci_addr) & PCIE_CORE_OB_REGION_ADDR0_LO_ADDR);
--- a/drivers/pci/controller/pcie-rockchip.h
+++ b/drivers/pci/controller/pcie-rockchip.h
@@ -245,6 +245,10 @@
(PCIE_EP_PF_CONFIG_REGS_BASE + (((fn) << 12) & GENMASK(19, 12)))
#define ROCKCHIP_PCIE_EP_VIRT_FUNC_BASE(fn) \
(PCIE_EP_PF_CONFIG_REGS_BASE + 0x10000 + (((fn) << 12) & GENMASK(19, 12)))
+
+#define ROCKCHIP_PCIE_AT_MIN_NUM_BITS 8
+#define ROCKCHIP_PCIE_AT_MAX_NUM_BITS 20
+
#define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR0(fn, bar) \
(PCIE_CORE_AXI_CONF_BASE + 0x0828 + (fn) * 0x0040 + (bar) * 0x0008)
#define ROCKCHIP_PCIE_AT_IB_EP_FUNC_BAR_ADDR1(fn, bar) \
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 099/146] nfsd: make sure exp active before svc_export_show
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (97 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 098/146] PCI: rockchip-ep: Fix address translation unit programming Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 100/146] nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur Greg Kroah-Hartman
` (54 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Yang Erkun, Jeff Layton, Chuck Lever
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <yangerkun@huawei.com>
commit be8f982c369c965faffa198b46060f8853e0f1f0 upstream.
The function `e_show` was called with protection from RCU. This only
ensures that `exp` will not be freed. Therefore, the reference count for
`exp` can drop to zero, which will trigger a refcount use-after-free
warning when `exp_get` is called. To resolve this issue, use
`cache_get_rcu` to ensure that `exp` remains active.
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: CPU: 3 PID: 819 at lib/refcount.c:25
refcount_warn_saturate+0xb1/0x120
CPU: 3 UID: 0 PID: 819 Comm: cat Not tainted 6.12.0-rc3+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
RIP: 0010:refcount_warn_saturate+0xb1/0x120
...
Call Trace:
<TASK>
e_show+0x20b/0x230 [nfsd]
seq_read_iter+0x589/0x770
seq_read+0x1e5/0x270
vfs_read+0x125/0x530
ksys_read+0xc1/0x160
do_syscall_64+0x5f/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Fixes: bf18f163e89c ("NFSD: Using exp_get for export getting")
Cc: stable@vger.kernel.org # 4.20+
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/export.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/fs/nfsd/export.c
+++ b/fs/nfsd/export.c
@@ -1425,9 +1425,12 @@ static int e_show(struct seq_file *m, vo
return 0;
}
- exp_get(exp);
+ if (!cache_get_rcu(&exp->h))
+ return 0;
+
if (cache_check(cd, &exp->h, NULL))
return 0;
+
exp_put(exp);
return svc_export_show(m, cd, cp);
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 100/146] nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (98 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 099/146] nfsd: make sure exp active before svc_export_show Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 101/146] iio: accel: kx022a: Fix raw read format Greg Kroah-Hartman
` (53 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Jeff Layton, Yang Erkun, Chuck Lever
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yang Erkun <yangerkun@huawei.com>
commit 98100e88dd8865999dc6379a3356cd799795fe7b upstream.
The action force umount(umount -f) will attempt to kill all rpc_task even
umount operation may ultimately fail if some files remain open.
Consequently, if an action attempts to open a file, it can potentially
send two rpc_task to nfs server.
NFS CLIENT
thread1 thread2
open("file")
...
nfs4_do_open
_nfs4_do_open
_nfs4_open_and_get_state
_nfs4_proc_open
nfs4_run_open_task
/* rpc_task1 */
rpc_run_task
rpc_wait_for_completion_task
umount -f
nfs_umount_begin
rpc_killall_tasks
rpc_signal_task
rpc_task1 been wakeup
and return -512
_nfs4_do_open // while loop
...
nfs4_run_open_task
/* rpc_task2 */
rpc_run_task
rpc_wait_for_completion_task
While processing an open request, nfsd will first attempt to find or
allocate an nfs4_openowner. If it finds an nfs4_openowner that is not
marked as NFS4_OO_CONFIRMED, this nfs4_openowner will released. Since
two rpc_task can attempt to open the same file simultaneously from the
client to server, and because two instances of nfsd can run
concurrently, this situation can lead to lots of memory leak.
Additionally, when we echo 0 to /proc/fs/nfsd/threads, warning will be
triggered.
NFS SERVER
nfsd1 nfsd2 echo 0 > /proc/fs/nfsd/threads
nfsd4_open
nfsd4_process_open1
find_or_alloc_open_stateowner
// alloc oo1, stateid1
nfsd4_open
nfsd4_process_open1
find_or_alloc_open_stateowner
// find oo1, without NFS4_OO_CONFIRMED
release_openowner
unhash_openowner_locked
list_del_init(&oo->oo_perclient)
// cannot find this oo
// from client, LEAK!!!
alloc_stateowner // alloc oo2
nfsd4_process_open2
init_open_stateid
// associate oo1
// with stateid1, stateid1 LEAK!!!
nfs4_get_vfs_file
// alloc nfsd_file1 and nfsd_file_mark1
// all LEAK!!!
nfsd4_process_open2
...
write_threads
...
nfsd_destroy_serv
nfsd_shutdown_net
nfs4_state_shutdown_net
nfs4_state_destroy_net
destroy_client
__destroy_client
// won't find oo1!!!
nfsd_shutdown_generic
nfsd_file_cache_shutdown
kmem_cache_destroy
for nfsd_file_slab
and nfsd_file_mark_slab
// bark since nfsd_file1
// and nfsd_file_mark1
// still alive
=======================================================================
BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on
__kmem_cache_shutdown()
-----------------------------------------------------------------------
Slab 0xffd4000004438a80 objects=34 used=1 fp=0xff11000110e2ad28
flags=0x17ffffc0000240(workingset|head|node=0|zone=2|lastcpupid=0x1fffff)
CPU: 4 UID: 0 PID: 757 Comm: sh Not tainted 6.12.0-rc6+ #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.16.1-2.fc37 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x53/0x70
slab_err+0xb0/0xf0
__kmem_cache_shutdown+0x15c/0x310
kmem_cache_destroy+0x66/0x160
nfsd_file_cache_shutdown+0xac/0x210 [nfsd]
nfsd_destroy_serv+0x251/0x2a0 [nfsd]
nfsd_svc+0x125/0x1e0 [nfsd]
write_threads+0x16a/0x2a0 [nfsd]
nfsctl_transaction_write+0x74/0xa0 [nfsd]
vfs_write+0x1ae/0x6d0
ksys_write+0xc1/0x160
do_syscall_64+0x5f/0x170
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Disabling lock debugging due to kernel taint
Object 0xff11000110e2ac38 @offset=3128
Allocated in nfsd_file_do_acquire+0x20f/0xa30 [nfsd] age=1635 cpu=3
pid=800
nfsd_file_do_acquire+0x20f/0xa30 [nfsd]
nfsd_file_acquire_opened+0x5f/0x90 [nfsd]
nfs4_get_vfs_file+0x4c9/0x570 [nfsd]
nfsd4_process_open2+0x713/0x1070 [nfsd]
nfsd4_open+0x74b/0x8b0 [nfsd]
nfsd4_proc_compound+0x70b/0xc20 [nfsd]
nfsd_dispatch+0x1b4/0x3a0 [nfsd]
svc_process_common+0x5b8/0xc50 [sunrpc]
svc_process+0x2ab/0x3b0 [sunrpc]
svc_handle_xprt+0x681/0xa20 [sunrpc]
nfsd+0x183/0x220 [nfsd]
kthread+0x199/0x1e0
ret_from_fork+0x31/0x60
ret_from_fork_asm+0x1a/0x30
Add nfs4_openowner_unhashed to help found unhashed nfs4_openowner, and
break nfsd4_open process to fix this problem.
Cc: stable@vger.kernel.org # v5.4+
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Yang Erkun <yangerkun@huawei.com>
Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nfsd/nfs4state.c | 19 +++++++++++++++++++
1 file changed, 19 insertions(+)
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c
@@ -1660,6 +1660,14 @@ static void release_open_stateid(struct
free_ol_stateid_reaplist(&reaplist);
}
+static bool nfs4_openowner_unhashed(struct nfs4_openowner *oo)
+{
+ lockdep_assert_held(&oo->oo_owner.so_client->cl_lock);
+
+ return list_empty(&oo->oo_owner.so_strhash) &&
+ list_empty(&oo->oo_perclient);
+}
+
static void unhash_openowner_locked(struct nfs4_openowner *oo)
{
struct nfs4_client *clp = oo->oo_owner.so_client;
@@ -4975,6 +4983,12 @@ retry:
spin_lock(&oo->oo_owner.so_client->cl_lock);
spin_lock(&fp->fi_lock);
+ if (nfs4_openowner_unhashed(oo)) {
+ mutex_unlock(&stp->st_mutex);
+ stp = NULL;
+ goto out_unlock;
+ }
+
retstp = nfsd4_find_existing_open(fp, open);
if (retstp)
goto out_unlock;
@@ -6126,6 +6140,11 @@ nfsd4_process_open2(struct svc_rqst *rqs
if (!stp) {
stp = init_open_stateid(fp, open);
+ if (!stp) {
+ status = nfserr_jukebox;
+ goto out;
+ }
+
if (!open->op_stp)
new_stp = true;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 101/146] iio: accel: kx022a: Fix raw read format
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (99 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 100/146] nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 102/146] iio: invensense: fix multiple odr switch when FIFO is off Greg Kroah-Hartman
` (52 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Kalle Niemi, Matti Vaittinen, Stable,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matti Vaittinen <mazziesaccount@gmail.com>
commit b7d2bc99b3bdc03fff9b416dd830632346d83530 upstream.
The KX022A provides the accelerometer data in two subsequent registers.
The registers are laid out so that the value obtained via bulk-read of
these registers can be interpreted as signed 16-bit little endian value.
The read value is converted to cpu_endianes and stored into 32bit integer.
The le16_to_cpu() casts value to unsigned 16-bit value, and when this is
assigned to 32-bit integer the resulting value will always be positive.
This has not been a problem to users (at least not all users) of the sysfs
interface, who know the data format based on the scan info and who have
converted the read value back to 16-bit signed value. This isn't
compliant with the ABI however.
This, however, will be a problem for those who use the in-kernel
interfaces, especially the iio_read_channel_processed_scale().
The iio_read_channel_processed_scale() performs multiplications to the
returned (always positive) raw value, which will cause strange results
when the data from the sensor has been negative.
Fix the read_raw format by casting the result of the le_to_cpu() to
signed 16-bit value before assigning it to the integer. This will make
the negative readings to be correctly reported as negative.
This fix will be visible to users by changing values returned via sysfs
to appear in correct (negative) format.
Reported-by: Kalle Niemi <kaleposti@gmail.com>
Fixes: 7c1d1677b322 ("iio: accel: Support Kionix/ROHM KX022A accelerometer")
Signed-off-by: Matti Vaittinen <mazziesaccount@gmail.com>
Tested-by: Kalle Niemi <kaleposti@gmail.com>
Cc: <Stable@vger.kernel.org>
Link: https://patch.msgid.link/ZyIxm_zamZfIGrnB@mva-rohm
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/accel/kionix-kx022a.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/accel/kionix-kx022a.c
+++ b/drivers/iio/accel/kionix-kx022a.c
@@ -594,7 +594,7 @@ static int kx022a_get_axis(struct kx022a
if (ret)
return ret;
- *val = le16_to_cpu(data->buffer[0]);
+ *val = (s16)le16_to_cpu(data->buffer[0]);
return IIO_VAL_INT;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 102/146] iio: invensense: fix multiple odr switch when FIFO is off
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (100 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 101/146] iio: accel: kx022a: Fix raw read format Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 103/146] iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() Greg Kroah-Hartman
` (51 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Jean-Baptiste Maneyrol,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
commit ef5f5e7b6f73f79538892a8be3a3bee2342acc9f upstream.
When multiple ODR switch happens during FIFO off, the change could
not be taken into account if you get back to previous FIFO on value.
For example, if you run sensor buffer at 50Hz, stop, change to
200Hz, then back to 50Hz and restart buffer, data will be timestamped
at 200Hz. This due to testing against mult and not new_mult.
To prevent this, let's just run apply_odr automatically when FIFO is
off. It will also simplify driver code.
Update inv_mpu6050 and inv_icm42600 to delete now useless apply_odr.
Fixes: 95444b9eeb8c ("iio: invensense: fix odr switching to same value")
Cc: stable@vger.kernel.org
Signed-off-by: Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
Link: https://patch.msgid.link/20241021-invn-inv-sensors-timestamp-fix-switch-fifo-off-v2-1-39ffd43edcc4@tdk.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/common/inv_sensors/inv_sensors_timestamp.c | 4 ++++
drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 --
drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 3 ---
drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 1 -
4 files changed, 4 insertions(+), 6 deletions(-)
--- a/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
+++ b/drivers/iio/common/inv_sensors/inv_sensors_timestamp.c
@@ -70,6 +70,10 @@ int inv_sensors_timestamp_update_odr(str
if (mult != ts->mult)
ts->new_mult = mult;
+ /* When FIFO is off, directly apply the new ODR */
+ if (!fifo)
+ inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
+
return 0;
}
EXPORT_SYMBOL_NS_GPL(inv_sensors_timestamp_update_odr, IIO_INV_SENSORS_TIMESTAMP);
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c
@@ -200,7 +200,6 @@ static int inv_icm42600_accel_update_sca
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
struct inv_icm42600_sensor_state *accel_st = iio_priv(indio_dev);
- struct inv_sensors_timestamp *ts = &accel_st->ts;
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
unsigned int fifo_en = 0;
unsigned int sleep_temp = 0;
@@ -229,7 +228,6 @@ static int inv_icm42600_accel_update_sca
}
/* update data FIFO write */
- inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
out_unlock:
--- a/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
+++ b/drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c
@@ -99,8 +99,6 @@ static int inv_icm42600_gyro_update_scan
const unsigned long *scan_mask)
{
struct inv_icm42600_state *st = iio_device_get_drvdata(indio_dev);
- struct inv_icm42600_sensor_state *gyro_st = iio_priv(indio_dev);
- struct inv_sensors_timestamp *ts = &gyro_st->ts;
struct inv_icm42600_sensor_conf conf = INV_ICM42600_SENSOR_CONF_INIT;
unsigned int fifo_en = 0;
unsigned int sleep_gyro = 0;
@@ -128,7 +126,6 @@ static int inv_icm42600_gyro_update_scan
}
/* update data FIFO write */
- inv_sensors_timestamp_apply_odr(ts, 0, 0, 0);
ret = inv_icm42600_buffer_set_fifo_en(st, fifo_en | st->fifo.en);
out_unlock:
--- a/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
+++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c
@@ -112,7 +112,6 @@ int inv_mpu6050_prepare_fifo(struct inv_
if (enable) {
/* reset timestamping */
inv_sensors_timestamp_reset(&st->timestamp);
- inv_sensors_timestamp_apply_odr(&st->timestamp, 0, 0, 0);
/* reset FIFO */
d = st->chip_config.user_ctrl | INV_MPU6050_BIT_FIFO_RST;
ret = regmap_write(st->map, st->reg->user_ctrl, d);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 103/146] iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (101 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 102/146] iio: invensense: fix multiple odr switch when FIFO is off Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 104/146] iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer Greg Kroah-Hartman
` (50 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Zicheng Qu, Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <quzicheng@huawei.com>
commit 3993ca4add248f0f853f54f9273a7de850639f33 upstream.
In the fwnode_iio_channel_get_by_name(), iterating over parent nodes to
acquire IIO channels via fwnode_for_each_parent_node(). The variable
chan was mistakenly attempted on the original node instead of the
current parent node. This patch corrects the logic to ensure that
__fwnode_iio_channel_get_by_name() is called with the correct parent
node.
Cc: stable@vger.kernel.org # v6.6+
Fixes: 1e64b9c5f9a0 ("iio: inkern: move to fwnode properties")
Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
Link: https://patch.msgid.link/20241102092525.2389952-1-quzicheng@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/inkern.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/inkern.c
+++ b/drivers/iio/inkern.c
@@ -269,7 +269,7 @@ struct iio_channel *fwnode_iio_channel_g
return ERR_PTR(-ENODEV);
}
- chan = __fwnode_iio_channel_get_by_name(fwnode, name);
+ chan = __fwnode_iio_channel_get_by_name(parent, name);
if (!IS_ERR(chan) || PTR_ERR(chan) != -ENODEV) {
fwnode_handle_put(parent);
return chan;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 104/146] iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (102 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 103/146] iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 105/146] iio: gts: fix infinite loop for gain_to_scaletables() Greg Kroah-Hartman
` (49 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Nuno Sa, Zicheng Qu,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nuno Sa <nuno.sa@analog.com>
commit 3a4187ec454e19903fd15f6e1825a4b84e59a4cd upstream.
The AD7923 was updated to support devices with 8 channels, but the size
of tx_buf and ring_xfer was not increased accordingly, leading to a
potential buffer overflow in ad7923_update_scan_mode().
Fixes: 851644a60d20 ("iio: adc: ad7923: Add support for the ad7908/ad7918/ad7928")
Cc: stable@vger.kernel.org
Signed-off-by: Nuno Sa <nuno.sa@analog.com>
Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
Link: https://patch.msgid.link/20241029134637.2261336-1-quzicheng@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/adc/ad7923.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/iio/adc/ad7923.c
+++ b/drivers/iio/adc/ad7923.c
@@ -48,7 +48,7 @@
struct ad7923_state {
struct spi_device *spi;
- struct spi_transfer ring_xfer[5];
+ struct spi_transfer ring_xfer[9];
struct spi_transfer scan_single_xfer[2];
struct spi_message ring_msg;
struct spi_message scan_single_msg;
@@ -64,7 +64,7 @@ struct ad7923_state {
* Length = 8 channels + 4 extra for 8 byte timestamp
*/
__be16 rx_buf[12] __aligned(IIO_DMA_MINALIGN);
- __be16 tx_buf[4];
+ __be16 tx_buf[8];
};
struct ad7923_chip_info {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 105/146] iio: gts: fix infinite loop for gain_to_scaletables()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (103 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 104/146] iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 106/146] powerpc: Fix stack protector Kconfig test for clang Greg Kroah-Hartman
` (48 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Zicheng Qu, Matti Vaittinen,
Jonathan Cameron
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Zicheng Qu <quzicheng@huawei.com>
commit 7452f8a0814bb73f739ee0dab60f099f3361b151 upstream.
In iio_gts_build_avail_time_table(), it is checked that gts->num_itime is
non-zero, but gts->num_itime is not checked in gain_to_scaletables(). The
variable time_idx is initialized as gts->num_itime - 1. This implies that
time_idx might initially be set to -1 (0 - 1 = -1). Consequently, using
while (time_idx--) could lead to an infinite loop.
Cc: stable@vger.kernel.org # v6.6+
Fixes: 38416c28e168 ("iio: light: Add gain-time-scale helpers")
Signed-off-by: Zicheng Qu <quzicheng@huawei.com>
Reviewed-by: Matti Vaittinen <mazziesaccount@gmail.com>
Link: https://patch.msgid.link/20241031014626.2313077-1-quzicheng@huawei.com
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/iio/industrialio-gts-helper.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/iio/industrialio-gts-helper.c
+++ b/drivers/iio/industrialio-gts-helper.c
@@ -205,7 +205,7 @@ static int gain_to_scaletables(struct ii
memcpy(all_gains, gains[time_idx], gain_bytes);
new_idx = gts->num_hwgain;
- while (time_idx--) {
+ while (time_idx-- > 0) {
for (j = 0; j < gts->num_hwgain; j++) {
int candidate = gains[time_idx][j];
int chk;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 106/146] powerpc: Fix stack protector Kconfig test for clang
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (104 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 105/146] iio: gts: fix infinite loop for gain_to_scaletables() Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 107/146] powerpc: Adjust adding stack protector flags to KBUILD_CLAGS " Greg Kroah-Hartman
` (47 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keith Packard, Nathan Chancellor,
Michael Ellerman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit 46e1879deea22eed31e9425d58635895fc0e8040 upstream.
Clang's in-progress per-task stack protector support [1] does not work
with the current Kconfig checks because '-mstack-protector-guard-offset'
is not provided, unlike all other architecture Kconfig checks.
$ fd Kconfig -x rg -l mstack-protector-guard-offset
./arch/arm/Kconfig
./arch/riscv/Kconfig
./arch/arm64/Kconfig
This produces an error from clang, which is interpreted as the flags not
being supported at all when they really are.
$ clang --target=powerpc64-linux-gnu \
-mstack-protector-guard=tls \
-mstack-protector-guard-reg=r13 \
-c -o /dev/null -x c /dev/null
clang: error: '-mstack-protector-guard=tls' is used without '-mstack-protector-guard-offset', and there is no default
This argument will always be provided by the build system, so mirror
other architectures and use '-mstack-protector-guard-offset=0' for
testing support, which fixes the issue for clang and does not regress
support with GCC.
Even with the first problem addressed, the 32-bit test continues to fail
because Kbuild uses the powerpc64le-linux-gnu target for clang and
nothing flips the target to 32-bit, resulting in an error about an
invalid register valid:
$ clang --target=powerpc64le-linux-gnu \
-mstack-protector-guard=tls
-mstack-protector-guard-reg=r2 \
-mstack-protector-guard-offset=0 \
-x c -c -o /dev/null /dev/null
clang: error: invalid value 'r2' in 'mstack-protector-guard-reg=', expected one of: r13
While GCC allows arbitrary registers, the implementation of
'-mstack-protector-guard=tls' in LLVM shares the same code path as the
user space thread local storage implementation, which uses a fixed
register (2 for 32-bit and 13 for 62-bit), so the command line parsing
enforces this limitation.
Use the Kconfig macro '$(m32-flag)', which expands to '-m32' when
supported, in the stack protector support cc-option call to properly
switch the target to a 32-bit one, which matches what happens in Kbuild.
While the 64-bit macro does not strictly need it, add the equivalent
64-bit option for symmetry.
Cc: stable@vger.kernel.org # 6.1+
Link: https://github.com/llvm/llvm-project/pull/110928 [1]
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://patch.msgid.link/20241009-powerpc-fix-stackprotector-test-clang-v2-1-12fb86b31857@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/Kconfig | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/arch/powerpc/Kconfig
+++ b/arch/powerpc/Kconfig
@@ -275,8 +275,8 @@ config PPC
select HAVE_RSEQ
select HAVE_SETUP_PER_CPU_AREA if PPC64
select HAVE_SOFTIRQ_ON_OWN_STACK
- select HAVE_STACKPROTECTOR if PPC32 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r2)
- select HAVE_STACKPROTECTOR if PPC64 && $(cc-option,-mstack-protector-guard=tls -mstack-protector-guard-reg=r13)
+ select HAVE_STACKPROTECTOR if PPC32 && $(cc-option,$(m32-flag) -mstack-protector-guard=tls -mstack-protector-guard-reg=r2 -mstack-protector-guard-offset=0)
+ select HAVE_STACKPROTECTOR if PPC64 && $(cc-option,$(m64-flag) -mstack-protector-guard=tls -mstack-protector-guard-reg=r13 -mstack-protector-guard-offset=0)
select HAVE_STATIC_CALL if PPC32
select HAVE_SYSCALL_TRACEPOINTS
select HAVE_VIRT_CPU_ACCOUNTING
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 107/146] powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (105 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 106/146] powerpc: Fix stack protector Kconfig test for clang Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 108/146] binder: fix node UAF in binder_add_freeze_work() Greg Kroah-Hartman
` (46 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Keith Packard, Nathan Chancellor,
Michael Ellerman
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathan Chancellor <nathan@kernel.org>
commit bee08a9e6ab03caf14481d97b35a258400ffab8f upstream.
After fixing the HAVE_STACKPROTECTER checks for clang's in-progress
per-task stack protector support [1], the build fails during prepare0
because '-mstack-protector-guard-offset' has not been added to
KBUILD_CFLAGS yet but the other '-mstack-protector-guard' flags have.
clang: error: '-mstack-protector-guard=tls' is used without '-mstack-protector-guard-offset', and there is no default
clang: error: '-mstack-protector-guard=tls' is used without '-mstack-protector-guard-offset', and there is no default
make[4]: *** [scripts/Makefile.build:229: scripts/mod/empty.o] Error 1
make[4]: *** [scripts/Makefile.build:102: scripts/mod/devicetable-offsets.s] Error 1
Mirror other architectures and add all '-mstack-protector-guard' flags
to KBUILD_CFLAGS atomically during stack_protector_prepare, which
resolves the issue and allows clang's implementation to fully work with
the kernel.
Cc: stable@vger.kernel.org # 6.1+
Link: https://github.com/llvm/llvm-project/pull/110928 [1]
Reviewed-by: Keith Packard <keithp@keithp.com>
Tested-by: Keith Packard <keithp@keithp.com>
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://patch.msgid.link/20241009-powerpc-fix-stackprotector-test-clang-v2-2-12fb86b31857@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/powerpc/Makefile | 13 ++++---------
1 file changed, 4 insertions(+), 9 deletions(-)
--- a/arch/powerpc/Makefile
+++ b/arch/powerpc/Makefile
@@ -100,13 +100,6 @@ KBUILD_AFLAGS += -m$(BITS)
KBUILD_LDFLAGS += -m elf$(BITS)$(LDEMULATION)
endif
-cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard=tls
-ifdef CONFIG_PPC64
-cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard-reg=r13
-else
-cflags-$(CONFIG_STACKPROTECTOR) += -mstack-protector-guard-reg=r2
-endif
-
LDFLAGS_vmlinux-y := -Bstatic
LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) := -pie
LDFLAGS_vmlinux-$(CONFIG_RELOCATABLE) += -z notext
@@ -402,9 +395,11 @@ prepare: stack_protector_prepare
PHONY += stack_protector_prepare
stack_protector_prepare: prepare0
ifdef CONFIG_PPC64
- $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "PACA_CANARY") print $$3;}' include/generated/asm-offsets.h))
+ $(eval KBUILD_CFLAGS += -mstack-protector-guard=tls -mstack-protector-guard-reg=r13 \
+ -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "PACA_CANARY") print $$3;}' include/generated/asm-offsets.h))
else
- $(eval KBUILD_CFLAGS += -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h))
+ $(eval KBUILD_CFLAGS += -mstack-protector-guard=tls -mstack-protector-guard-reg=r2 \
+ -mstack-protector-guard-offset=$(shell awk '{if ($$2 == "TASK_CANARY") print $$3;}' include/generated/asm-offsets.h))
endif
endif
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 108/146] binder: fix node UAF in binder_add_freeze_work()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (106 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 107/146] powerpc: Adjust adding stack protector flags to KBUILD_CLAGS " Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 109/146] binder: fix OOB " Greg Kroah-Hartman
` (45 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Todd Kjos, Carlos Llamas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit dc8aea47b928cc153b591b3558829ce42f685074 upstream.
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped in
order to acquire the node->lock first (lock nesting order). This can
race with binder_node_release() and trigger a use-after-free:
==================================================================
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0xe4/0x19c
Write of size 4 at addr ffff53c04c29dd04 by task freeze/640
CPU: 5 UID: 0 PID: 640 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #17
Hardware name: linux,dummy-virt (DT)
Call trace:
_raw_spin_lock+0xe4/0x19c
binder_add_freeze_work+0x148/0x478
binder_ioctl+0x1e70/0x25ac
__arm64_sys_ioctl+0x124/0x190
Allocated by task 637:
__kmalloc_cache_noprof+0x12c/0x27c
binder_new_node+0x50/0x700
binder_transaction+0x35ac/0x6f74
binder_thread_write+0xfb8/0x42a0
binder_ioctl+0x18f0/0x25ac
__arm64_sys_ioctl+0x124/0x190
Freed by task 637:
kfree+0xf0/0x330
binder_thread_read+0x1e88/0x3a68
binder_ioctl+0x16d8/0x25ac
__arm64_sys_ioctl+0x124/0x190
==================================================================
Fix the race by taking a temporary reference on the node before
releasing the proc->inner lock. This ensures the node remains alive
while in use.
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-2-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 978740537a1a..4d90203ea048 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5552,6 +5552,7 @@ static bool binder_txns_pending_ilocked(struct binder_proc *proc)
static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
{
+ struct binder_node *prev = NULL;
struct rb_node *n;
struct binder_ref *ref;
@@ -5560,7 +5561,10 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
struct binder_node *node;
node = rb_entry(n, struct binder_node, rb_node);
+ binder_inc_node_tmpref_ilocked(node);
binder_inner_proc_unlock(proc);
+ if (prev)
+ binder_put_node(prev);
binder_node_lock(node);
hlist_for_each_entry(ref, &node->refs, node_entry) {
/*
@@ -5586,10 +5590,13 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
}
binder_inner_proc_unlock(ref->proc);
}
+ prev = node;
binder_node_unlock(node);
binder_inner_proc_lock(proc);
}
binder_inner_proc_unlock(proc);
+ if (prev)
+ binder_put_node(prev);
}
static int binder_ioctl_freeze(struct binder_freeze_info *info,
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 109/146] binder: fix OOB in binder_add_freeze_work()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (107 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 108/146] binder: fix node UAF in binder_add_freeze_work() Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 110/146] binder: fix freeze UAF in binder_release_work() Greg Kroah-Hartman
` (44 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Todd Kjos, Carlos Llamas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 011e69a1b23011c0db3af4b8293fdd4522cc97b0 upstream.
In binder_add_freeze_work() we iterate over the proc->nodes with the
proc->inner_lock held. However, this lock is temporarily dropped to
acquire the node->lock first (lock nesting order). This can race with
binder_deferred_release() which removes the nodes from the proc->nodes
rbtree and adds them into binder_dead_nodes list. This leads to a broken
iteration in binder_add_freeze_work() as rb_next() will use data from
binder_dead_nodes, triggering an out-of-bounds access:
==================================================================
BUG: KASAN: global-out-of-bounds in rb_next+0xfc/0x124
Read of size 8 at addr ffffcb84285f7170 by task freeze/660
CPU: 8 UID: 0 PID: 660 Comm: freeze Not tainted 6.11.0-07343-ga727812a8d45 #18
Hardware name: linux,dummy-virt (DT)
Call trace:
rb_next+0xfc/0x124
binder_add_freeze_work+0x344/0x534
binder_ioctl+0x1e70/0x25ac
__arm64_sys_ioctl+0x124/0x190
The buggy address belongs to the variable:
binder_dead_nodes+0x10/0x40
[...]
==================================================================
This is possible because proc->nodes (rbtree) and binder_dead_nodes
(list) share entries in binder_node through a union:
struct binder_node {
[...]
union {
struct rb_node rb_node;
struct hlist_node dead_node;
};
Fix the race by checking that the proc is still alive. If not, simply
break out of the iteration.
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-3-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 4d90203ea048..8bca2de6fa24 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5593,6 +5593,8 @@ static void binder_add_freeze_work(struct binder_proc *proc, bool is_frozen)
prev = node;
binder_node_unlock(node);
binder_inner_proc_lock(proc);
+ if (proc->is_dead)
+ break;
}
binder_inner_proc_unlock(proc);
if (prev)
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 110/146] binder: fix freeze UAF in binder_release_work()
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (108 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 109/146] binder: fix OOB " Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 111/146] binder: fix BINDER_WORK_FROZEN_BINDER debug logs Greg Kroah-Hartman
` (43 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Todd Kjos, Alice Ryhl, Carlos Llamas
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 7e20434cbca814cb91a0a261ca0106815ef48e5f upstream.
When a binder reference is cleaned up, any freeze work queued in the
associated process should also be removed. Otherwise, the reference is
freed while its ref->freeze.work is still queued in proc->work leading
to a use-after-free issue as shown by the following KASAN report:
==================================================================
BUG: KASAN: slab-use-after-free in binder_release_work+0x398/0x3d0
Read of size 8 at addr ffff31600ee91488 by task kworker/5:1/211
CPU: 5 UID: 0 PID: 211 Comm: kworker/5:1 Not tainted 6.11.0-rc7-00382-gfc6c92196396 #22
Hardware name: linux,dummy-virt (DT)
Workqueue: events binder_deferred_func
Call trace:
binder_release_work+0x398/0x3d0
binder_deferred_func+0xb60/0x109c
process_one_work+0x51c/0xbd4
worker_thread+0x608/0xee8
Allocated by task 703:
__kmalloc_cache_noprof+0x130/0x280
binder_thread_write+0xdb4/0x42a0
binder_ioctl+0x18f0/0x25ac
__arm64_sys_ioctl+0x124/0x190
invoke_syscall+0x6c/0x254
Freed by task 211:
kfree+0xc4/0x230
binder_deferred_func+0xae8/0x109c
process_one_work+0x51c/0xbd4
worker_thread+0x608/0xee8
==================================================================
This commit fixes the issue by ensuring any queued freeze work is removed
when cleaning up a binder reference.
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Acked-by: Todd Kjos <tkjos@android.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-4-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 8bca2de6fa24..d955135ee37a 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -1225,6 +1225,12 @@ static void binder_cleanup_ref_olocked(struct binder_ref *ref)
binder_dequeue_work(ref->proc, &ref->death->work);
binder_stats_deleted(BINDER_STAT_DEATH);
}
+
+ if (ref->freeze) {
+ binder_dequeue_work(ref->proc, &ref->freeze->work);
+ binder_stats_deleted(BINDER_STAT_FREEZE);
+ }
+
binder_stats_deleted(BINDER_STAT_REF);
}
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 111/146] binder: fix BINDER_WORK_FROZEN_BINDER debug logs
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (109 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 110/146] binder: fix freeze UAF in binder_release_work() Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 112/146] binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION " Greg Kroah-Hartman
` (42 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Todd Kjos, Carlos Llamas, Alice Ryhl
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 830d7db744b42c693bf1db7e94db86d7efd91f0e upstream.
The BINDER_WORK_FROZEN_BINDER type is not handled in the binder_logs
entries and it shows up as "unknown work" when logged:
proc 649
context binder-test
thread 649: l 00 need_return 0 tr 0
ref 13: desc 1 node 8 s 1 w 0 d 0000000053c4c0c3
unknown work: type 10
This patch add the freeze work type and is now logged as such:
proc 637
context binder-test
thread 637: l 00 need_return 0 tr 0
ref 8: desc 1 node 3 s 1 w 0 d 00000000dc39e9c6
has frozen binder
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Acked-by: Todd Kjos <tkjos@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-5-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -6408,6 +6408,9 @@ static void print_binder_work_ilocked(st
case BINDER_WORK_CLEAR_DEATH_NOTIFICATION:
seq_printf(m, "%shas cleared death notification\n", prefix);
break;
+ case BINDER_WORK_FROZEN_BINDER:
+ seq_printf(m, "%shas frozen binder\n", prefix);
+ break;
default:
seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
break;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 112/146] binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (110 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 111/146] binder: fix BINDER_WORK_FROZEN_BINDER debug logs Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 113/146] binder: allow freeze notification for dead nodes Greg Kroah-Hartman
` (41 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Carlos Llamas, Todd Kjos
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 595ea72efff9fa65bc52b6406e0822f90841f266 upstream.
proc 699
context binder-test
thread 699: l 00 need_return 0 tr 0
ref 25: desc 1 node 20 s 1 w 0 d 00000000c03e09a3
unknown work: type 11
proc 640
context binder-test
thread 640: l 00 need_return 0 tr 0
ref 8: desc 1 node 3 s 1 w 0 d 000000002bb493e1
has cleared freeze notification
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-6-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 2be9f3559ed7..73dc6cbc1681 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -6411,6 +6411,9 @@ static void print_binder_work_ilocked(struct seq_file *m,
case BINDER_WORK_FROZEN_BINDER:
seq_printf(m, "%shas frozen binder\n", prefix);
break;
+ case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION:
+ seq_printf(m, "%shas cleared freeze notification\n", prefix);
+ break;
default:
seq_printf(m, "%sunknown work: type %d\n", prefix, w->type);
break;
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 113/146] binder: allow freeze notification for dead nodes
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (111 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 112/146] binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION " Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 114/146] binder: fix memleak of proc->delivered_freeze Greg Kroah-Hartman
` (40 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alice Ryhl, Carlos Llamas, Todd Kjos
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit ca63c66935b978441055e3d87d30225267f99329 upstream.
Alice points out that binder_request_freeze_notification() should not
return EINVAL when the relevant node is dead [1]. The node can die at
any point even if the user input is valid. Instead, allow the request
to be allocated but skip the initial notification for dead nodes. This
avoids propagating unnecessary errors back to userspace.
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Suggested-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/all/CAH5fLghapZJ4PbbkC8V5A6Zay-_sgTzwVpwqk6RWWUNKKyJC_Q@mail.gmail.com/ [1]
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-7-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 28 +++++++++++++---------------
1 file changed, 13 insertions(+), 15 deletions(-)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 73dc6cbc1681..415fc9759249 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -3856,7 +3856,6 @@ binder_request_freeze_notification(struct binder_proc *proc,
{
struct binder_ref_freeze *freeze;
struct binder_ref *ref;
- bool is_frozen;
freeze = kzalloc(sizeof(*freeze), GFP_KERNEL);
if (!freeze)
@@ -3872,32 +3871,31 @@ binder_request_freeze_notification(struct binder_proc *proc,
}
binder_node_lock(ref->node);
-
- if (ref->freeze || !ref->node->proc) {
- binder_user_error("%d:%d invalid BC_REQUEST_FREEZE_NOTIFICATION %s\n",
- proc->pid, thread->pid,
- ref->freeze ? "already set" : "dead node");
+ if (ref->freeze) {
+ binder_user_error("%d:%d BC_REQUEST_FREEZE_NOTIFICATION already set\n",
+ proc->pid, thread->pid);
binder_node_unlock(ref->node);
binder_proc_unlock(proc);
kfree(freeze);
return -EINVAL;
}
- binder_inner_proc_lock(ref->node->proc);
- is_frozen = ref->node->proc->is_frozen;
- binder_inner_proc_unlock(ref->node->proc);
binder_stats_created(BINDER_STAT_FREEZE);
INIT_LIST_HEAD(&freeze->work.entry);
freeze->cookie = handle_cookie->cookie;
freeze->work.type = BINDER_WORK_FROZEN_BINDER;
- freeze->is_frozen = is_frozen;
-
ref->freeze = freeze;
- binder_inner_proc_lock(proc);
- binder_enqueue_work_ilocked(&ref->freeze->work, &proc->todo);
- binder_wakeup_proc_ilocked(proc);
- binder_inner_proc_unlock(proc);
+ if (ref->node->proc) {
+ binder_inner_proc_lock(ref->node->proc);
+ freeze->is_frozen = ref->node->proc->is_frozen;
+ binder_inner_proc_unlock(ref->node->proc);
+
+ binder_inner_proc_lock(proc);
+ binder_enqueue_work_ilocked(&freeze->work, &proc->todo);
+ binder_wakeup_proc_ilocked(proc);
+ binder_inner_proc_unlock(proc);
+ }
binder_node_unlock(ref->node);
binder_proc_unlock(proc);
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 114/146] binder: fix memleak of proc->delivered_freeze
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (112 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 113/146] binder: allow freeze notification for dead nodes Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 115/146] binder: add delivered_freeze to debugfs output Greg Kroah-Hartman
` (39 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Llamas, Alice Ryhl, Todd Kjos
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit 1db76ec2b4b206ff943e292a0b55e68ff3443598 upstream.
If a freeze notification is cleared with BC_CLEAR_FREEZE_NOTIFICATION
before calling binder_freeze_notification_done(), then it is detached
from its reference (e.g. ref->freeze) but the work remains queued in
proc->delivered_freeze. This leads to a memory leak when the process
exits as any pending entries in proc->delivered_freeze are not freed:
unreferenced object 0xffff38e8cfa36180 (size 64):
comm "binder-util", pid 655, jiffies 4294936641
hex dump (first 32 bytes):
b8 e9 9e c8 e8 38 ff ff b8 e9 9e c8 e8 38 ff ff .....8.......8..
0b 00 00 00 00 00 00 00 3c 1f 4b 00 00 00 00 00 ........<.K.....
backtrace (crc 95983b32):
[<000000000d0582cf>] kmemleak_alloc+0x34/0x40
[<000000009c99a513>] __kmalloc_cache_noprof+0x208/0x280
[<00000000313b1704>] binder_thread_write+0xdec/0x439c
[<000000000cbd33bb>] binder_ioctl+0x1b68/0x22cc
[<000000002bbedeeb>] __arm64_sys_ioctl+0x124/0x190
[<00000000b439adee>] invoke_syscall+0x6c/0x254
[<00000000173558fc>] el0_svc_common.constprop.0+0xac/0x230
[<0000000084f72311>] do_el0_svc+0x40/0x58
[<000000008b872457>] el0_svc+0x38/0x78
[<00000000ee778653>] el0t_64_sync_handler+0x120/0x12c
[<00000000a8ec61bf>] el0t_64_sync+0x190/0x194
This patch fixes the leak by ensuring that any pending entries in
proc->delivered_freeze are freed during binder_deferred_release().
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-8-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 415fc9759249..7c09b5e38e32 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -5155,6 +5155,16 @@ static void binder_release_work(struct binder_proc *proc,
} break;
case BINDER_WORK_NODE:
break;
+ case BINDER_WORK_CLEAR_FREEZE_NOTIFICATION: {
+ struct binder_ref_freeze *freeze;
+
+ freeze = container_of(w, struct binder_ref_freeze, work);
+ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
+ "undelivered freeze notification, %016llx\n",
+ (u64)freeze->cookie);
+ kfree(freeze);
+ binder_stats_deleted(BINDER_STAT_FREEZE);
+ } break;
default:
pr_err("unexpected work type, %d, not freed\n",
wtype);
@@ -6273,6 +6283,7 @@ static void binder_deferred_release(struct binder_proc *proc)
binder_release_work(proc, &proc->todo);
binder_release_work(proc, &proc->delivered_death);
+ binder_release_work(proc, &proc->delivered_freeze);
binder_debug(BINDER_DEBUG_OPEN_CLOSE,
"%s: %d threads %d, nodes %d (ref %d), refs %d, active transactions %d\n",
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 115/146] binder: add delivered_freeze to debugfs output
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (113 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 114/146] binder: fix memleak of proc->delivered_freeze Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 116/146] dt-bindings: net: fec: add pps channel property Greg Kroah-Hartman
` (38 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Carlos Llamas, Todd Kjos, Alice Ryhl
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Carlos Llamas <cmllamas@google.com>
commit cb2aeb2ec25884133110ffe5a67ff3cf7dee5ceb upstream.
Add the pending proc->delivered_freeze work to the debugfs output. This
information was omitted in the original implementation of the freeze
notification and can be valuable for debugging issues.
Fixes: d579b04a52a1 ("binder: frozen notification")
Cc: stable@vger.kernel.org
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Acked-by: Todd Kjos <tkjos@google.com>
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Link: https://lore.kernel.org/r/20240926233632.821189-9-cmllamas@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/android/binder.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 7c09b5e38e32..ef353ca13c35 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@ -6569,6 +6569,10 @@ static void print_binder_proc(struct seq_file *m,
seq_puts(m, " has delivered dead binder\n");
break;
}
+ list_for_each_entry(w, &proc->delivered_freeze, entry) {
+ seq_puts(m, " has delivered freeze binder\n");
+ break;
+ }
binder_inner_proc_unlock(proc);
if (!print_all && m->count == header_pos)
m->count = start_pos;
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 116/146] dt-bindings: net: fec: add pps channel property
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (114 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 115/146] binder: add delivered_freeze to debugfs output Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 117/146] net: fec: refactor PPS channel configuration Greg Kroah-Hartman
` (37 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Conor Dooley,
Paolo Abeni, =20Bence?=
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
commit 1aa772be0444a2bd06957f6d31865e80e6ae4244 upstream.
Add fsl,pps-channel property to select where to connect the PPS signal.
This depends on the internal SoC routing and on the board, for example
on the i.MX8 SoC it can be connected to an external pin (using channel 1)
or to internal eDMA as DMA request (channel 0).
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Acked-by: Conor Dooley <conor.dooley@microchip.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Csókás, Bence <csokas.bence@prolan.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 +++++++
1 file changed, 7 insertions(+)
--- a/Documentation/devicetree/bindings/net/fsl,fec.yaml
+++ b/Documentation/devicetree/bindings/net/fsl,fec.yaml
@@ -183,6 +183,13 @@ properties:
description:
Register bits of stop mode control, the format is <&gpr req_gpr req_bit>.
+ fsl,pps-channel:
+ $ref: /schemas/types.yaml#/definitions/uint32
+ default: 0
+ description:
+ Specifies to which timer instance the PPS signal is routed.
+ enum: [0, 1, 2, 3]
+
mdio:
$ref: mdio.yaml#
unevaluatedProperties: false
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 117/146] net: fec: refactor PPS channel configuration
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (115 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 116/146] dt-bindings: net: fec: add pps channel property Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 118/146] net: fec: make PPS channel configurable Greg Kroah-Hartman
` (36 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Francesco Dolcini, Frank Li,
=20Bence?=, Paolo Abeni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
commit bf8ca67e21671e7a56e31da45360480b28f185f1 upstream.
Preparation patch to allow for PPS channel configuration, no functional
change intended.
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Reviewed-by: Csókás, Bence <csokas.bence@prolan.hu>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Csókás, Bence <csokas.bence@prolan.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/fec_ptp.c | 9 ++++-----
1 file changed, 4 insertions(+), 5 deletions(-)
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -84,8 +84,7 @@
#define FEC_CC_MULT (1 << 31)
#define FEC_COUNTER_PERIOD (1 << 31)
#define PPS_OUPUT_RELOAD_PERIOD NSEC_PER_SEC
-#define FEC_CHANNLE_0 0
-#define DEFAULT_PPS_CHANNEL FEC_CHANNLE_0
+#define DEFAULT_PPS_CHANNEL 0
#define FEC_PTP_MAX_NSEC_PERIOD 4000000000ULL
#define FEC_PTP_MAX_NSEC_COUNTER 0x80000000ULL
@@ -524,8 +523,9 @@ static int fec_ptp_enable(struct ptp_clo
unsigned long flags;
int ret = 0;
+ fep->pps_channel = DEFAULT_PPS_CHANNEL;
+
if (rq->type == PTP_CLK_REQ_PPS) {
- fep->pps_channel = DEFAULT_PPS_CHANNEL;
fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
ret = fec_ptp_enable_pps(fep, on);
@@ -536,10 +536,9 @@ static int fec_ptp_enable(struct ptp_clo
if (rq->perout.flags)
return -EOPNOTSUPP;
- if (rq->perout.index != DEFAULT_PPS_CHANNEL)
+ if (rq->perout.index != fep->pps_channel)
return -EOPNOTSUPP;
- fep->pps_channel = DEFAULT_PPS_CHANNEL;
period.tv_sec = rq->perout.period.sec;
period.tv_nsec = rq->perout.period.nsec;
period_ns = timespec64_to_ns(&period);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 118/146] net: fec: make PPS channel configurable
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (116 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 117/146] net: fec: refactor PPS channel configuration Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 119/146] drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n Greg Kroah-Hartman
` (35 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Frank Li, Rafael Beims,
Francesco Dolcini, =20Bence?=, Paolo Abeni
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Francesco Dolcini <francesco.dolcini@toradex.com>
commit 566c2d83887f0570056833102adc5b88e681b0c7 upstream.
Depending on the SoC where the FEC is integrated into the PPS channel
might be routed to different timer instances. Make this configurable
from the devicetree.
When the related DT property is not present fallback to the previous
default and use channel 0.
Reviewed-by: Frank Li <Frank.Li@nxp.com>
Tested-by: Rafael Beims <rafael.beims@toradex.com>
Signed-off-by: Francesco Dolcini <francesco.dolcini@toradex.com>
Reviewed-by: Csókás, Bence <csokas.bence@prolan.hu>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Csókás, Bence <csokas.bence@prolan.hu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/freescale/fec_ptp.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c
@@ -523,8 +523,6 @@ static int fec_ptp_enable(struct ptp_clo
unsigned long flags;
int ret = 0;
- fep->pps_channel = DEFAULT_PPS_CHANNEL;
-
if (rq->type == PTP_CLK_REQ_PPS) {
fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
@@ -706,12 +704,16 @@ void fec_ptp_init(struct platform_device
{
struct net_device *ndev = platform_get_drvdata(pdev);
struct fec_enet_private *fep = netdev_priv(ndev);
+ struct device_node *np = fep->pdev->dev.of_node;
int irq;
int ret;
fep->ptp_caps.owner = THIS_MODULE;
strscpy(fep->ptp_caps.name, "fec ptp", sizeof(fep->ptp_caps.name));
+ fep->pps_channel = DEFAULT_PPS_CHANNEL;
+ of_property_read_u32(np, "fsl,pps-channel", &fep->pps_channel);
+
fep->ptp_caps.max_adj = 250000000;
fep->ptp_caps.n_alarm = 0;
fep->ptp_caps.n_ext_ts = 0;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 119/146] drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (117 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 118/146] net: fec: make PPS channel configurable Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 120/146] drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check Greg Kroah-Hartman
` (34 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lyude Paul, Daniel Vetter
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lyude Paul <lyude@redhat.com>
commit 319e53f155907cf2c6dabc16ec9dce0179bc04d1 upstream.
It turns out that if you happen to have a kernel config where
CONFIG_DRM_PANIC is disabled and spinlock debugging is enabled, along with
KMS being enabled - we'll end up trying to acquire an uninitialized
spin_lock with drm_panic_lock() when we try to do a commit:
rvkms rvkms.0: [drm:drm_atomic_commit] committing 0000000068d2ade1
INFO: trying to register non-static key.
The code is fine but needs lockdep annotation, or maybe
you didn't initialize this object before use?
turning off the locking correctness validator.
CPU: 4 PID: 1347 Comm: modprobe Not tainted 6.10.0-rc1Lyude-Test+ #272
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS edk2-20240524-3.fc40 05/24/2024
Call Trace:
<TASK>
dump_stack_lvl+0x77/0xa0
assign_lock_key+0x114/0x120
register_lock_class+0xa8/0x2c0
__lock_acquire+0x7d/0x2bd0
? __vmap_pages_range_noflush+0x3a8/0x550
? drm_atomic_helper_swap_state+0x2ad/0x3a0
lock_acquire+0xec/0x290
? drm_atomic_helper_swap_state+0x2ad/0x3a0
? lock_release+0xee/0x310
_raw_spin_lock_irqsave+0x4e/0x70
? drm_atomic_helper_swap_state+0x2ad/0x3a0
drm_atomic_helper_swap_state+0x2ad/0x3a0
drm_atomic_helper_commit+0xb1/0x270
drm_atomic_commit+0xaf/0xe0
? __pfx___drm_printfn_info+0x10/0x10
drm_client_modeset_commit_atomic+0x1a1/0x250
drm_client_modeset_commit_locked+0x4b/0x180
drm_client_modeset_commit+0x27/0x50
__drm_fb_helper_restore_fbdev_mode_unlocked+0x76/0x90
drm_fb_helper_set_par+0x38/0x40
fbcon_init+0x3c4/0x690
visual_init+0xc0/0x120
do_bind_con_driver+0x409/0x4c0
do_take_over_console+0x233/0x280
do_fb_registered+0x11f/0x210
fbcon_fb_registered+0x2c/0x60
register_framebuffer+0x248/0x2a0
__drm_fb_helper_initial_config_and_unlock+0x58a/0x720
drm_fbdev_generic_client_hotplug+0x6e/0xb0
drm_client_register+0x76/0xc0
_RNvXs_CsHeezP08sTT_5rvkmsNtB4_5RvkmsNtNtCs1cdwasc6FUb_6kernel8platform6Driver5probe+0xed2/0x1060 [rvkms]
? _RNvMs_NtCs1cdwasc6FUb_6kernel8platformINtB4_7AdapterNtCsHeezP08sTT_5rvkms5RvkmsE14probe_callbackBQ_+0x2b/0x70 [rvkms]
? acpi_dev_pm_attach+0x25/0x110
? platform_probe+0x6a/0xa0
? really_probe+0x10b/0x400
? __driver_probe_device+0x7c/0x140
? driver_probe_device+0x22/0x1b0
? __device_attach_driver+0x13a/0x1c0
? __pfx___device_attach_driver+0x10/0x10
? bus_for_each_drv+0x114/0x170
? __device_attach+0xd6/0x1b0
? bus_probe_device+0x9e/0x120
? device_add+0x288/0x4b0
? platform_device_add+0x75/0x230
? platform_device_register_full+0x141/0x180
? rust_helper_platform_device_register_simple+0x85/0xb0
? _RNvMs2_NtCs1cdwasc6FUb_6kernel8platformNtB5_6Device13create_simple+0x1d/0x60
? _RNvXs0_CsHeezP08sTT_5rvkmsNtB5_5RvkmsNtCs1cdwasc6FUb_6kernel6Module4init+0x11e/0x160 [rvkms]
? 0xffffffffc083f000
? init_module+0x20/0x1000 [rvkms]
? kernfs_xattr_get+0x3e/0x80
? do_one_initcall+0x148/0x3f0
? __lock_acquire+0x5ef/0x2bd0
? __lock_acquire+0x5ef/0x2bd0
? __lock_acquire+0x5ef/0x2bd0
? put_cpu_partial+0x51/0x1d0
? lock_acquire+0xec/0x290
? put_cpu_partial+0x51/0x1d0
? lock_release+0xee/0x310
? put_cpu_partial+0x51/0x1d0
? fs_reclaim_acquire+0x69/0xf0
? lock_acquire+0xec/0x290
? fs_reclaim_acquire+0x69/0xf0
? kfree+0x22f/0x340
? lock_release+0xee/0x310
? kmalloc_trace_noprof+0x48/0x340
? do_init_module+0x22/0x240
? kmalloc_trace_noprof+0x155/0x340
? do_init_module+0x60/0x240
? __se_sys_finit_module+0x2e0/0x3f0
? do_syscall_64+0xa4/0x180
? syscall_exit_to_user_mode+0x108/0x140
? do_syscall_64+0xb0/0x180
? vma_end_read+0xd0/0xe0
? do_user_addr_fault+0x309/0x640
? clear_bhb_loop+0x45/0xa0
? clear_bhb_loop+0x45/0xa0
? clear_bhb_loop+0x45/0xa0
? entry_SYSCALL_64_after_hwframe+0x76/0x7e
</TASK>
Fix this by stubbing these macros out when this config option isn't
enabled, along with fixing the unused variable warning that introduces.
Signed-off-by: Lyude Paul <lyude@redhat.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Fixes: e2a1cda3e0c7 ("drm/panic: Add drm panic locking")
Cc: <stable@vger.kernel.org> # v6.10+
Link: https://patchwork.freedesktop.org/patch/msgid/20240916230103.611490-1-lyude@redhat.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/drm_atomic_helper.c | 2 +-
include/drm/drm_panic.h | 14 ++++++++++++++
2 files changed, 15 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c
index 43cdf39019a4..5186d2114a50 100644
--- a/drivers/gpu/drm/drm_atomic_helper.c
+++ b/drivers/gpu/drm/drm_atomic_helper.c
@@ -3015,7 +3015,7 @@ int drm_atomic_helper_swap_state(struct drm_atomic_state *state,
bool stall)
{
int i, ret;
- unsigned long flags;
+ unsigned long flags = 0;
struct drm_connector *connector;
struct drm_connector_state *old_conn_state, *new_conn_state;
struct drm_crtc *crtc;
diff --git a/include/drm/drm_panic.h b/include/drm/drm_panic.h
index 54085d5d05c3..f4e1fa9ae607 100644
--- a/include/drm/drm_panic.h
+++ b/include/drm/drm_panic.h
@@ -64,6 +64,8 @@ struct drm_scanout_buffer {
};
+#ifdef CONFIG_DRM_PANIC
+
/**
* drm_panic_trylock - try to enter the panic printing critical section
* @dev: struct drm_device
@@ -149,4 +151,16 @@ struct drm_scanout_buffer {
#define drm_panic_unlock(dev, flags) \
raw_spin_unlock_irqrestore(&(dev)->mode_config.panic_lock, flags)
+#else
+
+static inline bool drm_panic_trylock(struct drm_device *dev, unsigned long flags)
+{
+ return true;
+}
+
+static inline void drm_panic_lock(struct drm_device *dev, unsigned long flags) {}
+static inline void drm_panic_unlock(struct drm_device *dev, unsigned long flags) {}
+
+#endif
+
#endif /* __DRM_PANIC_H__ */
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 120/146] drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (118 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 119/146] drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 121/146] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check Greg Kroah-Hartman
` (33 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Alain Volmat
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit c1ab40a1fdfee732c7e6ff2fb8253760293e47e8 upstream.
The return value of drm_atomic_get_crtc_state() needs to be
checked. To avoid use of error pointer 'crtc_state' in case
of the failure.
Cc: stable@vger.kernel.org
Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://patchwork.freedesktop.org/patch/msgid/20240913090926.2023716-1-make24@iscas.ac.cn
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/sti/sti_hqvdp.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/sti/sti_hqvdp.c
+++ b/drivers/gpu/drm/sti/sti_hqvdp.c
@@ -1037,6 +1037,9 @@ static int sti_hqvdp_atomic_check(struct
return 0;
crtc_state = drm_atomic_get_crtc_state(state, crtc);
+ if (IS_ERR(crtc_state))
+ return PTR_ERR(crtc_state);
+
mode = &crtc_state->mode;
dst_x = new_plane_state->crtc_x;
dst_y = new_plane_state->crtc_y;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 121/146] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (119 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 120/146] drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 122/146] drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member Greg Kroah-Hartman
` (32 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Alain Volmat
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit e965e771b069421c233d674c3c8cd8c7f7245f42 upstream.
The return value of drm_atomic_get_crtc_state() needs to be
checked. To avoid use of error pointer 'crtc_state' in case
of the failure.
Cc: stable@vger.kernel.org
Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Acked-by: Alain Volmat <alain.volmat@foss.st.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20240909063359.1197065-1-make24@iscas.ac.cn
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/sti/sti_gdp.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/sti/sti_gdp.c
+++ b/drivers/gpu/drm/sti/sti_gdp.c
@@ -638,6 +638,9 @@ static int sti_gdp_atomic_check(struct d
mixer = to_sti_mixer(crtc);
crtc_state = drm_atomic_get_crtc_state(state, crtc);
+ if (IS_ERR(crtc_state))
+ return PTR_ERR(crtc_state);
+
mode = &crtc_state->mode;
dst_x = new_plane_state->crtc_x;
dst_y = new_plane_state->crtc_y;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 122/146] drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (120 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 121/146] drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 123/146] drm/sti: avoid potential dereference of error pointers Greg Kroah-Hartman
` (31 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Hugo Villeneuve, Neil Armstrong,
Jessica Zhang
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugo Villeneuve <hvilleneuve@dimonoff.com>
commit 66ae275365be4f118abe2254a0ced1d913af93f2 upstream.
Now that the driver has been converted to use wrapped MIPI DCS functions,
the num_init_cmds structure member is no longer needed, so remove it.
Fixes: 35583e129995 ("drm/panel: panel-jadard-jd9365da-h3: use wrapped MIPI DCS functions")
Cc: stable@vger.kernel.org
Signed-off-by: Hugo Villeneuve <hvilleneuve@dimonoff.com>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Reviewed-by: Jessica Zhang <quic_jesszhan@quicinc.com>
Link: https://lore.kernel.org/r/20240930170503.1324560-1-hugo@hugovil.com
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20240930170503.1324560-1-hugo@hugovil.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c
+++ b/drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c
@@ -26,7 +26,6 @@ struct jadard_panel_desc {
unsigned int lanes;
enum mipi_dsi_pixel_format format;
int (*init)(struct jadard *jadard);
- u32 num_init_cmds;
bool lp11_before_reset;
bool reset_before_power_off_vcioo;
unsigned int vcioo_to_lp11_delay_ms;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 123/146] drm/sti: avoid potential dereference of error pointers
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (121 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 122/146] drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 124/146] drm/fbdev-dma: Select FB_DEFERRED_IO Greg Kroah-Hartman
` (30 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Ma Ke, Alain Volmat
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ma Ke <make24@iscas.ac.cn>
commit 831214f77037de02afc287eae93ce97f218d8c04 upstream.
The return value of drm_atomic_get_crtc_state() needs to be
checked. To avoid use of error pointer 'crtc_state' in case
of the failure.
Cc: stable@vger.kernel.org
Fixes: dd86dc2f9ae1 ("drm/sti: implement atomic_check for the planes")
Signed-off-by: Ma Ke <make24@iscas.ac.cn>
Link: https://patchwork.freedesktop.org/patch/msgid/20240913090412.2022848-1-make24@iscas.ac.cn
Signed-off-by: Alain Volmat <alain.volmat@foss.st.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/sti/sti_cursor.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/sti/sti_cursor.c
+++ b/drivers/gpu/drm/sti/sti_cursor.c
@@ -200,6 +200,9 @@ static int sti_cursor_atomic_check(struc
return 0;
crtc_state = drm_atomic_get_crtc_state(state, crtc);
+ if (IS_ERR(crtc_state))
+ return PTR_ERR(crtc_state);
+
mode = &crtc_state->mode;
dst_x = new_plane_state->crtc_x;
dst_y = new_plane_state->crtc_y;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 124/146] drm/fbdev-dma: Select FB_DEFERRED_IO
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (122 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 123/146] drm/sti: avoid potential dereference of error pointers Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 125/146] drm/mediatek: Fix child node refcount handling in early exit Greg Kroah-Hartman
` (29 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Thomas Zimmermann, kernel test robot,
Javier Martinez Canillas, Maarten Lankhorst, Maxime Ripard,
Jonathan Cavitt
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Zimmermann <tzimmermann@suse.de>
commit 67c40c9b2ec5f375bf78274d4e9ef0e3b8315bea upstream.
Commit 808a40b69468 ("drm/fbdev-dma: Implement damage handling and
deferred I/O") added deferred I/O for fbdev-dma. Also select the
Kconfig symbol FB_DEFERRED_IO (via FB_DMAMEM_HELPERS_DEFERRED). Fixes
build errors about missing fbdefio, such as
drivers/gpu/drm/drm_fbdev_dma.c:218:26: error: 'struct drm_fb_helper' has no member named 'fbdefio'
218 | fb_helper->fbdefio.delay = HZ / 20;
| ^~
drivers/gpu/drm/drm_fbdev_dma.c:219:26: error: 'struct drm_fb_helper' has no member named 'fbdefio'
219 | fb_helper->fbdefio.deferred_io = drm_fb_helper_deferred_io;
| ^~
drivers/gpu/drm/drm_fbdev_dma.c:221:21: error: 'struct fb_info' has no member named 'fbdefio'
221 | info->fbdefio = &fb_helper->fbdefio;
| ^~
drivers/gpu/drm/drm_fbdev_dma.c:221:43: error: 'struct drm_fb_helper' has no member named 'fbdefio'
221 | info->fbdefio = &fb_helper->fbdefio;
| ^~
Signed-off-by: Thomas Zimmermann <tzimmermann@suse.de>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202410050241.Mox9QRjP-lkp@intel.com/
Fixes: 808a40b69468 ("drm/fbdev-dma: Implement damage handling and deferred I/O")
Cc: Thomas Zimmermann <tzimmermann@suse.de>
Cc: Javier Martinez Canillas <javierm@redhat.com>
Cc: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
Cc: Maxime Ripard <mripard@kernel.org>
Cc: <stable@vger.kernel.org> # v6.11+
Reviewed-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241014085740.582287-4-tzimmermann@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/Kconfig | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -327,7 +327,7 @@ config DRM_TTM_HELPER
config DRM_GEM_DMA_HELPER
tristate
depends on DRM
- select FB_DMAMEM_HELPERS if DRM_FBDEV_EMULATION
+ select FB_DMAMEM_HELPERS_DEFERRED if DRM_FBDEV_EMULATION
help
Choose this if you need the GEM DMA helper functions
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 125/146] drm/mediatek: Fix child node refcount handling in early exit
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (123 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 124/146] drm/fbdev-dma: Select FB_DEFERRED_IO Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 126/146] drm/bridge: it6505: Fix inverted reset polarity Greg Kroah-Hartman
` (28 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Javier Carrasco, CK Hu, Chen-Yu Tsai,
AngeloGioacchino Del Regno, Chun-Kuang Hu
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Javier Carrasco <javier.carrasco.cruz@gmail.com>
commit f708e8b4cfd16e5c8cd8d7fcfcb2fb2c6ed93af3 upstream.
Early exits (goto, break, return) from for_each_child_of_node() required
an explicit call to of_node_put(), which was not introduced with the
break if cnt == MAX_CRTC.
Add the missing of_node_put() before the break.
Cc: stable@vger.kernel.org
Fixes: d761b9450e31 ("drm/mediatek: Add cnt checking for coverity issue")
Signed-off-by: Javier Carrasco <javier.carrasco.cruz@gmail.com>
Reviewed-by: CK Hu <ck.hu@mediatek.com>
Reviewed-by: Chen-Yu Tsai <wenst@chromium.org>
Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com>
Link: https://patchwork.kernel.org/project/dri-devel/patch/20241011-mtk_drm_drv_memleak-v1-1-2b40c74c8d75@gmail.com/
Signed-off-by: Chun-Kuang Hu <chunkuang.hu@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/mediatek/mtk_drm_drv.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_drv.c
@@ -405,8 +405,10 @@ static bool mtk_drm_get_all_drm_priv(str
if (temp_drm_priv->mtk_drm_bound)
cnt++;
- if (cnt == MAX_CRTC)
+ if (cnt == MAX_CRTC) {
+ of_node_put(node);
break;
+ }
}
if (drm_priv->data->mmsys_dev_num == cnt) {
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 126/146] drm/bridge: it6505: Fix inverted reset polarity
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (124 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 125/146] drm/mediatek: Fix child node refcount handling in early exit Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 127/146] drm/etnaviv: flush shader L1 cache after user commandstream Greg Kroah-Hartman
` (27 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Dmitry Baryshkov, Neil Armstrong,
Chen-Yu Tsai
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chen-Yu Tsai <wenst@chromium.org>
commit c5f3f21728b069412e8072b8b1d0a3d9d3ab0265 upstream.
The IT6505 bridge chip has a active low reset line. Since it is a
"reset" and not an "enable" line, the GPIO should be asserted to
put it in reset and deasserted to bring it out of reset during
the power on sequence.
The polarity was inverted when the driver was first introduced, likely
because the device family that was targeted had an inverting level
shifter on the reset line.
The MT8186 Corsola devices already have the IT6505 in their device tree,
but the whole display pipeline is actually disabled and won't be enabled
until some remaining issues are sorted out. The other known user is
the MT8183 Kukui / Jacuzzi family; their device trees currently do not
have the IT6505 included.
Fix the polarity in the driver while there are no actual users.
Fixes: b5c84a9edcd4 ("drm/bridge: add it6505 driver")
Cc: stable@vger.kernel.org
Reviewed-by: Dmitry Baryshkov <dmitry.baryshkov@linaro.org>
Reviewed-by: Neil Armstrong <neil.armstrong@linaro.org>
Link: https://patchwork.freedesktop.org/patch/msgid/20241029095411.657616-1-wenst@chromium.org
Signed-off-by: Chen-Yu Tsai <wenst@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/bridge/ite-it6505.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/bridge/ite-it6505.c
+++ b/drivers/gpu/drm/bridge/ite-it6505.c
@@ -2614,9 +2614,9 @@ static int it6505_poweron(struct it6505
/* time interval between OVDD and SYSRSTN at least be 10ms */
if (pdata->gpiod_reset) {
usleep_range(10000, 20000);
- gpiod_set_value_cansleep(pdata->gpiod_reset, 0);
- usleep_range(1000, 2000);
gpiod_set_value_cansleep(pdata->gpiod_reset, 1);
+ usleep_range(1000, 2000);
+ gpiod_set_value_cansleep(pdata->gpiod_reset, 0);
usleep_range(25000, 35000);
}
@@ -2647,7 +2647,7 @@ static int it6505_poweroff(struct it6505
disable_irq_nosync(it6505->irq);
if (pdata->gpiod_reset)
- gpiod_set_value_cansleep(pdata->gpiod_reset, 0);
+ gpiod_set_value_cansleep(pdata->gpiod_reset, 1);
if (pdata->pwr18) {
err = regulator_disable(pdata->pwr18);
@@ -3135,7 +3135,7 @@ static int it6505_init_pdata(struct it65
return PTR_ERR(pdata->ovdd);
}
- pdata->gpiod_reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_LOW);
+ pdata->gpiod_reset = devm_gpiod_get(dev, "reset", GPIOD_OUT_HIGH);
if (IS_ERR(pdata->gpiod_reset)) {
dev_err(dev, "gpiod_reset gpio not found");
return PTR_ERR(pdata->gpiod_reset);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 127/146] drm/etnaviv: flush shader L1 cache after user commandstream
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (125 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 126/146] drm/bridge: it6505: Fix inverted reset polarity Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 128/146] drm: xlnx: zynqmp_dpsub: fix hotplug detection Greg Kroah-Hartman
` (26 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Christian Gmeiner, Lucas Stach
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lucas Stach <l.stach@pengutronix.de>
commit 4f8dbadef085ab447a01a8d4806a3f629fea05ed upstream.
The shader L1 cache is a writeback cache for shader loads/stores
and thus must be flushed before any BOs backing the shader buffers
are potentially freed.
Cc: stable@vger.kernel.org
Reviewed-by: Christian Gmeiner <cgmeiner@igalia.com>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
+++ b/drivers/gpu/drm/etnaviv/etnaviv_buffer.c
@@ -482,7 +482,8 @@ void etnaviv_buffer_queue(struct etnaviv
} else {
CMD_LOAD_STATE(buffer, VIVS_GL_FLUSH_CACHE,
VIVS_GL_FLUSH_CACHE_DEPTH |
- VIVS_GL_FLUSH_CACHE_COLOR);
+ VIVS_GL_FLUSH_CACHE_COLOR |
+ VIVS_GL_FLUSH_CACHE_SHADER_L1);
if (has_blt) {
CMD_LOAD_STATE(buffer, VIVS_BLT_ENABLE, 0x1);
CMD_LOAD_STATE(buffer, VIVS_BLT_SET_COMMAND, 0x1);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 128/146] drm: xlnx: zynqmp_dpsub: fix hotplug detection
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (126 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 127/146] drm/etnaviv: flush shader L1 cache after user commandstream Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs Greg Kroah-Hartman
` (25 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Steffen Dirkwinkel, Tomi Valkeinen
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
commit 71ba1c9b1c717831920c3d432404ee5a707e04b4 upstream.
drm_kms_helper_poll_init needs to be called after zynqmp_dpsub_kms_init.
zynqmp_dpsub_kms_init creates the connector and without it we don't
enable hotplug detection.
Fixes: eb2d64bfcc17 ("drm: xlnx: zynqmp_dpsub: Report HPD through the bridge")
Cc: stable@vger.kernel.org
Signed-off-by: Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ideasonboard.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241028134218.54727-1-lists@steffen.cc
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/xlnx/zynqmp_kms.c
+++ b/drivers/gpu/drm/xlnx/zynqmp_kms.c
@@ -509,12 +509,12 @@ int zynqmp_dpsub_drm_init(struct zynqmp_
if (ret)
return ret;
- drm_kms_helper_poll_init(drm);
-
ret = zynqmp_dpsub_kms_init(dpsub);
if (ret < 0)
goto err_poll_fini;
+ drm_kms_helper_poll_init(drm);
+
/* Reset all components and register the DRM device. */
drm_mode_config_reset(drm);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (127 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 128/146] drm: xlnx: zynqmp_dpsub: fix hotplug detection Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 17:03 ` Dixit, Ashutosh
2024-12-06 14:37 ` [PATCH 6.12 130/146] drm/xe/migrate: fix pat index usage Greg Kroah-Hartman
` (24 subsequent siblings)
153 siblings, 1 reply; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Umesh Nerlige Ramappa, John Harrison,
Jonathan Cavitt, Ashutosh Dixit
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jonathan Cavitt <jonathan.cavitt@intel.com>
commit 55858fa7eb2f163f7aa34339fd3399ba4ff564c6 upstream.
Several OA registers and allowlist registers were missing from the
save/restore list for GuC and could be lost during an engine reset. Add
them to the list.
v2:
- Fix commit message (Umesh)
- Add missing closes (Ashutosh)
v3:
- Add missing fixes (Ashutosh)
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2249
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Suggested-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Suggested-by: John Harrison <john.c.harrison@intel.com>
Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
CC: stable@vger.kernel.org # v6.11+
Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241023200716.82624-1-jonathan.cavitt@intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_guc_ads.c | 14 ++++++++++++++
1 file changed, 14 insertions(+)
--- a/drivers/gpu/drm/xe/xe_guc_ads.c
+++ b/drivers/gpu/drm/xe/xe_guc_ads.c
@@ -13,6 +13,7 @@
#include "regs/xe_engine_regs.h"
#include "regs/xe_gt_regs.h"
#include "regs/xe_guc_regs.h"
+#include "regs/xe_oa_regs.h"
#include "xe_bo.h"
#include "xe_gt.h"
#include "xe_gt_ccs_mode.h"
@@ -601,6 +602,11 @@ static unsigned int guc_mmio_regset_writ
guc_mmio_regset_write_one(ads, regset_map, e->reg, count++);
}
+ for (i = 0; i < RING_MAX_NONPRIV_SLOTS; i++)
+ guc_mmio_regset_write_one(ads, regset_map,
+ RING_FORCE_TO_NONPRIV(hwe->mmio_base, i),
+ count++);
+
/* Wa_1607983814 */
if (needs_wa_1607983814(xe) && hwe->class == XE_ENGINE_CLASS_RENDER) {
for (i = 0; i < LNCFCMOCS_REG_COUNT; i++) {
@@ -609,6 +615,14 @@ static unsigned int guc_mmio_regset_writ
}
}
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL0, count++);
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL1, count++);
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL2, count++);
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL3, count++);
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL4, count++);
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL5, count++);
+ guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL6, count++);
+
return count;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
2024-12-06 14:37 ` [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs Greg Kroah-Hartman
@ 2024-12-06 17:03 ` Dixit, Ashutosh
2024-12-07 6:35 ` Greg Kroah-Hartman
0 siblings, 1 reply; 157+ messages in thread
From: Dixit, Ashutosh @ 2024-12-06 17:03 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, Umesh Nerlige Ramappa, John Harrison,
Jonathan Cavitt
On Fri, 06 Dec 2024 06:37:40 -0800, Greg Kroah-Hartman wrote:
>
Hi Greg,
> 6.12-stable review patch. If anyone has any objections, please let me
> know.
No this patch should *NOT* be added. It was later reverted in:
0191fddf5374 ("Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"")
Thanks.
--
Ashutosh
>
> ------------------
>
> From: Jonathan Cavitt <jonathan.cavitt@intel.com>
>
> commit 55858fa7eb2f163f7aa34339fd3399ba4ff564c6 upstream.
>
> Several OA registers and allowlist registers were missing from the
> save/restore list for GuC and could be lost during an engine reset. Add
> them to the list.
>
> v2:
> - Fix commit message (Umesh)
> - Add missing closes (Ashutosh)
>
> v3:
> - Add missing fixes (Ashutosh)
>
> Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/2249
> Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
> Suggested-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
> Suggested-by: John Harrison <john.c.harrison@intel.com>
> Signed-off-by: Jonathan Cavitt <jonathan.cavitt@intel.com>
> CC: stable@vger.kernel.org # v6.11+
> Reviewed-by: Umesh Nerlige Ramappa <umesh.nerlige.ramappa@intel.com>
> Reviewed-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
> Signed-off-by: Ashutosh Dixit <ashutosh.dixit@intel.com>
> Link: https://patchwork.freedesktop.org/patch/msgid/20241023200716.82624-1-jonathan.cavitt@intel.com
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> ---
> drivers/gpu/drm/xe/xe_guc_ads.c | 14 ++++++++++++++
> 1 file changed, 14 insertions(+)
>
> --- a/drivers/gpu/drm/xe/xe_guc_ads.c
> +++ b/drivers/gpu/drm/xe/xe_guc_ads.c
> @@ -13,6 +13,7 @@
> #include "regs/xe_engine_regs.h"
> #include "regs/xe_gt_regs.h"
> #include "regs/xe_guc_regs.h"
> +#include "regs/xe_oa_regs.h"
> #include "xe_bo.h"
> #include "xe_gt.h"
> #include "xe_gt_ccs_mode.h"
> @@ -601,6 +602,11 @@ static unsigned int guc_mmio_regset_writ
> guc_mmio_regset_write_one(ads, regset_map, e->reg, count++);
> }
>
> + for (i = 0; i < RING_MAX_NONPRIV_SLOTS; i++)
> + guc_mmio_regset_write_one(ads, regset_map,
> + RING_FORCE_TO_NONPRIV(hwe->mmio_base, i),
> + count++);
> +
> /* Wa_1607983814 */
> if (needs_wa_1607983814(xe) && hwe->class == XE_ENGINE_CLASS_RENDER) {
> for (i = 0; i < LNCFCMOCS_REG_COUNT; i++) {
> @@ -609,6 +615,14 @@ static unsigned int guc_mmio_regset_writ
> }
> }
>
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL0, count++);
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL1, count++);
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL2, count++);
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL3, count++);
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL4, count++);
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL5, count++);
> + guc_mmio_regset_write_one(ads, regset_map, EU_PERF_CNTL6, count++);
> +
> return count;
> }
>
>
>
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
2024-12-06 17:03 ` Dixit, Ashutosh
@ 2024-12-07 6:35 ` Greg Kroah-Hartman
0 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-07 6:35 UTC (permalink / raw)
To: Dixit, Ashutosh
Cc: stable, patches, Umesh Nerlige Ramappa, John Harrison,
Jonathan Cavitt
On Fri, Dec 06, 2024 at 09:03:06AM -0800, Dixit, Ashutosh wrote:
> On Fri, 06 Dec 2024 06:37:40 -0800, Greg Kroah-Hartman wrote:
> >
>
> Hi Greg,
>
> > 6.12-stable review patch. If anyone has any objections, please let me
> > know.
>
> No this patch should *NOT* be added. It was later reverted in:
>
> 0191fddf5374 ("Revert "drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs"")
Oops, I missed that, sorry. I've queued the revert up now as well.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 157+ messages in thread
* [PATCH 6.12 130/146] drm/xe/migrate: fix pat index usage
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (128 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 129/146] drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 131/146] Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable" Greg Kroah-Hartman
` (23 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Auld, Matthew Brost,
Nirmoy Das, Thomas Hellström
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <matthew.auld@intel.com>
commit 23346f85163de83aca6dc30dde3944131cf54706 upstream.
XE_CACHE_WB must be converted into the per-platform pat index for that
particular caching mode, otherwise we are just encoding whatever happens
to be the value of that enum.
Fixes: e8babb280b5e ("drm/xe: Convert multiple bind ops into single job")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Nirmoy Das <nirmoy.das@intel.com>
Cc: <stable@vger.kernel.org> # v6.12+
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241126181259.159713-3-matthew.auld@intel.com
(cherry picked from commit f3dc9246f9c3cd5a7d8fd70cfd805bfc52214e2e)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_migrate.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/xe/xe_migrate.c b/drivers/gpu/drm/xe/xe_migrate.c
index cfd31ae49cc1..48e205a40fd2 100644
--- a/drivers/gpu/drm/xe/xe_migrate.c
+++ b/drivers/gpu/drm/xe/xe_migrate.c
@@ -1350,6 +1350,7 @@ __xe_migrate_update_pgtables(struct xe_migrate *m,
/* For sysmem PTE's, need to map them in our hole.. */
if (!IS_DGFX(xe)) {
+ u16 pat_index = xe->pat.idx[XE_CACHE_WB];
u32 ptes, ofs;
ppgtt_ofs = NUM_KERNEL_PDE - 1;
@@ -1409,7 +1410,7 @@ __xe_migrate_update_pgtables(struct xe_migrate *m,
pt_bo->update_index = current_update;
addr = vm->pt_ops->pte_encode_bo(pt_bo, 0,
- XE_CACHE_WB, 0);
+ pat_index, 0);
bb->cs[bb->len++] = lower_32_bits(addr);
bb->cs[bb->len++] = upper_32_bits(addr);
}
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 131/146] Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable"
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (129 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 130/146] drm/xe/migrate: fix pat index usage Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 132/146] drm/xe/migrate: use XE_BO_FLAG_PAGETABLE Greg Kroah-Hartman
` (22 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Shixiong Ou
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alex Deucher <alexander.deucher@amd.com>
commit 979bfe291b5b30a9132c2fd433247e677b24c6aa upstream.
This reverts commit 949658cb9b69ab9d22a42a662b2fdc7085689ed8.
This causes a blank screen on boot.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3696
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: Shixiong Ou <oushixiong@kylinos.cn>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 10 ----------
1 file changed, 10 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index f9c73c55f04f..f9996304d943 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -1255,16 +1255,6 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
goto exit;
}
}
-
- if (dret && radeon_connector->hpd.hpd != RADEON_HPD_NONE &&
- !radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) &&
- connector->connector_type == DRM_MODE_CONNECTOR_HDMIA) {
- DRM_DEBUG_KMS("EDID is readable when HPD disconnected\n");
- schedule_delayed_work(&rdev->hotplug_work, msecs_to_jiffies(1000));
- ret = connector_status_disconnected;
- goto exit;
- }
-
if (dret) {
radeon_connector->detected_by_load = false;
radeon_connector_free_edid(connector);
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 132/146] drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (130 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 131/146] Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable" Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 133/146] drm/xe/guc_submit: fix race around suspend_pending Greg Kroah-Hartman
` (21 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Auld, Matthew Brost,
Nirmoy Das, Thomas Hellström
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <matthew.auld@intel.com>
commit c78f4399188369a55eed69cbf19a8aad2a65ac75 upstream.
On some HW we want to avoid the host caching PTEs, since access from GPU
side can be incoherent. However here the special migrate object is
mapping PTEs which are written from the host and potentially cached. Use
XE_BO_FLAG_PAGETABLE to ensure that non-cached mapping is used, on
platforms where this matters.
Fixes: 7a060d786cc1 ("drm/xe/mtl: Map PPGTT as CPU:WC")
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: Nirmoy Das <nirmoy.das@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Nirmoy Das <nirmoy.das@intel.com>
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241126181259.159713-4-matthew.auld@intel.com
(cherry picked from commit febc689b27d28973cd02f667548a5dca383d859a)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_migrate.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/xe/xe_migrate.c
+++ b/drivers/gpu/drm/xe/xe_migrate.c
@@ -209,7 +209,8 @@ static int xe_migrate_prepare_vm(struct
num_entries * XE_PAGE_SIZE,
ttm_bo_type_kernel,
XE_BO_FLAG_VRAM_IF_DGFX(tile) |
- XE_BO_FLAG_PINNED);
+ XE_BO_FLAG_PINNED |
+ XE_BO_FLAG_PAGETABLE);
if (IS_ERR(bo))
return PTR_ERR(bo);
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 133/146] drm/xe/guc_submit: fix race around suspend_pending
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (131 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 132/146] drm/xe/migrate: use XE_BO_FLAG_PAGETABLE Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 134/146] drm/amdkfd: Use the correct wptr size Greg Kroah-Hartman
` (20 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Matthew Auld, Matthew Brost,
Thomas Hellström
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Matthew Auld <matthew.auld@intel.com>
commit 87651f31ae4e6e6e7e6c7270b9b469405e747407 upstream.
Currently in some testcases we can trigger:
xe 0000:03:00.0: [drm] Assertion `exec_queue_destroyed(q)` failed!
....
WARNING: CPU: 18 PID: 2640 at drivers/gpu/drm/xe/xe_guc_submit.c:1826 xe_guc_sched_done_handler+0xa54/0xef0 [xe]
xe 0000:03:00.0: [drm] *ERROR* GT1: DEREGISTER_DONE: Unexpected engine state 0x00a1, guc_id=57
Looking at a snippet of corresponding ftrace for this GuC id we can see:
162.673311: xe_sched_msg_add: dev=0000:03:00.0, gt=1 guc_id=57, opcode=3
162.673317: xe_sched_msg_recv: dev=0000:03:00.0, gt=1 guc_id=57, opcode=3
162.673319: xe_exec_queue_scheduling_disable: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0x29, flags=0x0
162.674089: xe_exec_queue_kill: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0x29, flags=0x0
162.674108: xe_exec_queue_close: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0xa9, flags=0x0
162.674488: xe_exec_queue_scheduling_done: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0xa9, flags=0x0
162.678452: xe_exec_queue_deregister: dev=0000:03:00.0, 1:0x2, gt=1, width=1, guc_id=57, guc_state=0xa1, flags=0x0
It looks like we try to suspend the queue (opcode=3), setting
suspend_pending and triggering a disable_scheduling. The user then
closes the queue. However the close will also forcefully signal the
suspend fence after killing the queue, later when the G2H response for
disable_scheduling comes back we have now cleared suspend_pending when
signalling the suspend fence, so the disable_scheduling now incorrectly
tries to also deregister the queue. This leads to warnings since the queue
has yet to even be marked for destruction. We also seem to trigger
errors later with trying to double unregister the same queue.
To fix this tweak the ordering when handling the response to ensure we
don't race with a disable_scheduling that didn't actually intend to
perform an unregister. The destruction path should now also correctly
wait for any pending_disable before marking as destroyed.
Fixes: dd08ebf6c352 ("drm/xe: Introduce a new DRM driver for Intel GPUs")
Closes: https://gitlab.freedesktop.org/drm/xe/kernel/-/issues/3371
Signed-off-by: Matthew Auld <matthew.auld@intel.com>
Cc: Matthew Brost <matthew.brost@intel.com>
Cc: <stable@vger.kernel.org> # v6.8+
Reviewed-by: Matthew Brost <matthew.brost@intel.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20241122161914.321263-6-matthew.auld@intel.com
(cherry picked from commit f161809b362f027b6d72bd998e47f8f0bad60a2e)
Signed-off-by: Thomas Hellström <thomas.hellstrom@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/xe/xe_guc_submit.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--- a/drivers/gpu/drm/xe/xe_guc_submit.c
+++ b/drivers/gpu/drm/xe/xe_guc_submit.c
@@ -1846,16 +1846,29 @@ static void handle_sched_done(struct xe_
xe_gt_assert(guc_to_gt(guc), runnable_state == 0);
xe_gt_assert(guc_to_gt(guc), exec_queue_pending_disable(q));
- clear_exec_queue_pending_disable(q);
if (q->guc->suspend_pending) {
suspend_fence_signal(q);
+ clear_exec_queue_pending_disable(q);
} else {
if (exec_queue_banned(q) || check_timeout) {
smp_wmb();
wake_up_all(&guc->ct.wq);
}
- if (!check_timeout)
+ if (!check_timeout && exec_queue_destroyed(q)) {
+ /*
+ * Make sure to clear the pending_disable only
+ * after sampling the destroyed state. We want
+ * to ensure we don't trigger the unregister too
+ * early with something intending to only
+ * disable scheduling. The caller doing the
+ * destroy must wait for an ongoing
+ * pending_disable before marking as destroyed.
+ */
+ clear_exec_queue_pending_disable(q);
deregister_exec_queue(guc, q);
+ } else {
+ clear_exec_queue_pending_disable(q);
+ }
}
}
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 134/146] drm/amdkfd: Use the correct wptr size
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (132 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 133/146] drm/xe/guc_submit: fix race around suspend_pending Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 135/146] drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3 Greg Kroah-Hartman
` (19 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
commit cdc6705f98ea3f854a60ba8c9b19228e197ae384 upstream.
Write pointer could be 32-bit or 64-bit. Use the correct size during
initialization.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c
@@ -125,7 +125,7 @@ static bool kq_initialize(struct kernel_
memset(kq->pq_kernel_addr, 0, queue_size);
memset(kq->rptr_kernel, 0, sizeof(*kq->rptr_kernel));
- memset(kq->wptr_kernel, 0, sizeof(*kq->wptr_kernel));
+ memset(kq->wptr_kernel, 0, dev->kfd->device_info.doorbell_size);
prop.queue_size = queue_size;
prop.is_interop = false;
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 135/146] drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (133 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 134/146] drm/amdkfd: Use the correct wptr size Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 136/146] drm/amd: Add some missing straps from NBIO 7.11.0 Greg Kroah-Hartman
` (18 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kenneth Feng, Yang Wang,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <kenneth.feng@amd.com>
commit 6719ab8234ce4b0c0e9aa93aaa94961e5b2bc852 upstream.
add gen5 display to the user on smu v14.0.2/3
Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
Reviewed-by: Yang Wang <kevinyang.wang@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.11.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 ++++++--
drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 2 +-
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +-
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 6 ++++--
4 files changed, 12 insertions(+), 6 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c
@@ -1695,7 +1695,9 @@ static int smu_smc_hw_setup(struct smu_c
return ret;
}
- if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4)
+ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN5)
+ pcie_gen = 4;
+ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN4)
pcie_gen = 3;
else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3)
pcie_gen = 2;
@@ -1708,7 +1710,9 @@ static int smu_smc_hw_setup(struct smu_c
* Bit 15:8: PCIE GEN, 0 to 3 corresponds to GEN1 to GEN4
* Bit 7:0: PCIE lane width, 1 to 7 corresponds is x1 to x32
*/
- if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16)
+ if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X32)
+ pcie_width = 7;
+ else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X16)
pcie_width = 6;
else if (adev->pm.pcie_mlw_mask & CAIL_PCIE_LINK_WIDTH_SUPPORT_X12)
pcie_width = 5;
--- a/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h
+++ b/drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h
@@ -53,7 +53,7 @@
#define CTF_OFFSET_MEM 5
extern const int decoded_link_speed[5];
-extern const int decoded_link_width[7];
+extern const int decoded_link_width[8];
#define DECODE_GEN_SPEED(gen_speed_idx) (decoded_link_speed[gen_speed_idx])
#define DECODE_LANE_WIDTH(lane_width_idx) (decoded_link_width[lane_width_idx])
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c
@@ -49,7 +49,7 @@
#define regMP1_SMN_IH_SW_INT_CTRL_mp1_14_0_0_BASE_IDX 0
const int decoded_link_speed[5] = {1, 2, 3, 4, 5};
-const int decoded_link_width[7] = {0, 1, 2, 4, 8, 12, 16};
+const int decoded_link_width[8] = {0, 1, 2, 4, 8, 12, 16, 32};
/*
* DO NOT use these for err/warn/info/debug messages.
* Use dev_err, dev_warn, dev_info and dev_dbg instead.
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
@@ -1186,13 +1186,15 @@ static int smu_v14_0_2_print_clk_levels(
(pcie_table->pcie_gen[i] == 0) ? "2.5GT/s," :
(pcie_table->pcie_gen[i] == 1) ? "5.0GT/s," :
(pcie_table->pcie_gen[i] == 2) ? "8.0GT/s," :
- (pcie_table->pcie_gen[i] == 3) ? "16.0GT/s," : "",
+ (pcie_table->pcie_gen[i] == 3) ? "16.0GT/s," :
+ (pcie_table->pcie_gen[i] == 4) ? "32.0GT/s," : "",
(pcie_table->pcie_lane[i] == 1) ? "x1" :
(pcie_table->pcie_lane[i] == 2) ? "x2" :
(pcie_table->pcie_lane[i] == 3) ? "x4" :
(pcie_table->pcie_lane[i] == 4) ? "x8" :
(pcie_table->pcie_lane[i] == 5) ? "x12" :
- (pcie_table->pcie_lane[i] == 6) ? "x16" : "",
+ (pcie_table->pcie_lane[i] == 6) ? "x16" :
+ (pcie_table->pcie_lane[i] == 7) ? "x32" : "",
pcie_table->clk_freq[i],
(gen_speed == DECODE_GEN_SPEED(pcie_table->pcie_gen[i])) &&
(lane_width == DECODE_LANE_WIDTH(pcie_table->pcie_lane[i])) ?
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 136/146] drm/amd: Add some missing straps from NBIO 7.11.0
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (134 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 135/146] drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3 Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 137/146] drm/amdgpu: fix usage slab after free Greg Kroah-Hartman
` (17 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Mario Limonciello
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 902fbbf429b8213232b18de0ddfd5c0f3851cb8f upstream.
Earlier ASICs have strap information exported, and this is missing
for NBIO 7.11.0.
Cc: stable@vger.kernel.org
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Fixes: ca8c68142ad8 ("drm/amdgpu: add nbio 7.11 registers")
Link: https://lore.kernel.org/r/20241118174611.10700-1-mario.limonciello@amd.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 +
drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 13 ++++++++++
2 files changed, 15 insertions(+)
--- a/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h
+++ b/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_offset.h
@@ -7571,6 +7571,8 @@
// base address: 0x10100000
#define regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0 0xd000
#define regRCC_STRAP0_RCC_DEV0_EPF0_STRAP0_BASE_IDX 5
+#define regRCC_DEV0_EPF5_STRAP4 0xd284
+#define regRCC_DEV0_EPF5_STRAP4_BASE_IDX 5
// addressBlock: nbio_nbif0_bif_rst_bif_rst_regblk
--- a/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h
+++ b/drivers/gpu/drm/amd/include/asic_reg/nbio/nbio_7_11_0_sh_mask.h
@@ -50665,6 +50665,19 @@
#define RCC_STRAP0_RCC_DEV0_EPF0_STRAP0__STRAP_D1_SUPPORT_DEV0_F0_MASK 0x40000000L
#define RCC_STRAP0_RCC_DEV0_EPF0_STRAP0__STRAP_D2_SUPPORT_DEV0_F0_MASK 0x80000000L
+//RCC_DEV0_EPF5_STRAP4
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_64BIT_EN_DEV0_F5__SHIFT 0x14
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_EN_DEV0_F5__SHIFT 0x15
+#define RCC_DEV0_EPF5_STRAP4__STRAP_FLR_EN_DEV0_F5__SHIFT 0x16
+#define RCC_DEV0_EPF5_STRAP4__STRAP_PME_SUPPORT_DEV0_F5__SHIFT 0x17
+#define RCC_DEV0_EPF5_STRAP4__STRAP_INTERRUPT_PIN_DEV0_F5__SHIFT 0x1c
+#define RCC_DEV0_EPF5_STRAP4__STRAP_AUXPWR_SUPPORT_DEV0_F5__SHIFT 0x1f
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_64BIT_EN_DEV0_F5_MASK 0x00100000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_ATOMIC_EN_DEV0_F5_MASK 0x00200000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_FLR_EN_DEV0_F5_MASK 0x00400000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_PME_SUPPORT_DEV0_F5_MASK 0x0F800000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_INTERRUPT_PIN_DEV0_F5_MASK 0x70000000L
+#define RCC_DEV0_EPF5_STRAP4__STRAP_AUXPWR_SUPPORT_DEV0_F5_MASK 0x80000000L
// addressBlock: nbio_nbif0_bif_rst_bif_rst_regblk
//HARD_RST_CTRL
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 137/146] drm/amdgpu: fix usage slab after free
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (135 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 136/146] drm/amd: Add some missing straps from NBIO 7.11.0 Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 138/146] drm/amd/pm: skip setting the power source on smu v14.0.2/3 Greg Kroah-Hartman
` (16 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Christian König, Alex Deucher,
Vitaly Prosyak
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vitaly Prosyak <vitaly.prosyak@amd.com>
commit b61badd20b443eabe132314669bb51a263982e5c upstream.
[ +0.000021] BUG: KASAN: slab-use-after-free in drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
[ +0.000027] Read of size 8 at addr ffff8881b8605f88 by task amd_pci_unplug/2147
[ +0.000023] CPU: 6 PID: 2147 Comm: amd_pci_unplug Not tainted 6.10.0+ #1
[ +0.000016] Hardware name: ASUS System Product Name/ROG STRIX B550-F GAMING (WI-FI), BIOS 1401 12/03/2020
[ +0.000016] Call Trace:
[ +0.000008] <TASK>
[ +0.000009] dump_stack_lvl+0x76/0xa0
[ +0.000017] print_report+0xce/0x5f0
[ +0.000017] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
[ +0.000019] ? srso_return_thunk+0x5/0x5f
[ +0.000015] ? kasan_complete_mode_report_info+0x72/0x200
[ +0.000016] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
[ +0.000019] kasan_report+0xbe/0x110
[ +0.000015] ? drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
[ +0.000023] __asan_report_load8_noabort+0x14/0x30
[ +0.000014] drm_sched_entity_flush+0x6cb/0x7a0 [gpu_sched]
[ +0.000020] ? srso_return_thunk+0x5/0x5f
[ +0.000013] ? __kasan_check_write+0x14/0x30
[ +0.000016] ? __pfx_drm_sched_entity_flush+0x10/0x10 [gpu_sched]
[ +0.000020] ? srso_return_thunk+0x5/0x5f
[ +0.000013] ? __kasan_check_write+0x14/0x30
[ +0.000013] ? srso_return_thunk+0x5/0x5f
[ +0.000013] ? enable_work+0x124/0x220
[ +0.000015] ? __pfx_enable_work+0x10/0x10
[ +0.000013] ? srso_return_thunk+0x5/0x5f
[ +0.000014] ? free_large_kmalloc+0x85/0xf0
[ +0.000016] drm_sched_entity_destroy+0x18/0x30 [gpu_sched]
[ +0.000020] amdgpu_vce_sw_fini+0x55/0x170 [amdgpu]
[ +0.000735] ? __kasan_check_read+0x11/0x20
[ +0.000016] vce_v4_0_sw_fini+0x80/0x110 [amdgpu]
[ +0.000726] amdgpu_device_fini_sw+0x331/0xfc0 [amdgpu]
[ +0.000679] ? mutex_unlock+0x80/0xe0
[ +0.000017] ? __pfx_amdgpu_device_fini_sw+0x10/0x10 [amdgpu]
[ +0.000662] ? srso_return_thunk+0x5/0x5f
[ +0.000014] ? __kasan_check_write+0x14/0x30
[ +0.000013] ? srso_return_thunk+0x5/0x5f
[ +0.000013] ? mutex_unlock+0x80/0xe0
[ +0.000016] amdgpu_driver_release_kms+0x16/0x80 [amdgpu]
[ +0.000663] drm_minor_release+0xc9/0x140 [drm]
[ +0.000081] drm_release+0x1fd/0x390 [drm]
[ +0.000082] __fput+0x36c/0xad0
[ +0.000018] __fput_sync+0x3c/0x50
[ +0.000014] __x64_sys_close+0x7d/0xe0
[ +0.000014] x64_sys_call+0x1bc6/0x2680
[ +0.000014] do_syscall_64+0x70/0x130
[ +0.000014] ? srso_return_thunk+0x5/0x5f
[ +0.000014] ? irqentry_exit_to_user_mode+0x60/0x190
[ +0.000015] ? srso_return_thunk+0x5/0x5f
[ +0.000014] ? irqentry_exit+0x43/0x50
[ +0.000012] ? srso_return_thunk+0x5/0x5f
[ +0.000013] ? exc_page_fault+0x7c/0x110
[ +0.000015] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ +0.000014] RIP: 0033:0x7ffff7b14f67
[ +0.000013] Code: ff e8 0d 16 02 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 73 ba f7 ff
[ +0.000026] RSP: 002b:00007fffffffe378 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ +0.000019] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ffff7b14f67
[ +0.000014] RDX: 0000000000000000 RSI: 00007ffff7f6f47a RDI: 0000000000000003
[ +0.000014] RBP: 00007fffffffe3a0 R08: 0000555555569890 R09: 0000000000000000
[ +0.000014] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffffffe5c8
[ +0.000013] R13: 00005555555552a9 R14: 0000555555557d48 R15: 00007ffff7ffd040
[ +0.000020] </TASK>
[ +0.000016] Allocated by task 383 on cpu 7 at 26.880319s:
[ +0.000014] kasan_save_stack+0x28/0x60
[ +0.000008] kasan_save_track+0x18/0x70
[ +0.000007] kasan_save_alloc_info+0x38/0x60
[ +0.000007] __kasan_kmalloc+0xc1/0xd0
[ +0.000007] kmalloc_trace_noprof+0x180/0x380
[ +0.000007] drm_sched_init+0x411/0xec0 [gpu_sched]
[ +0.000012] amdgpu_device_init+0x695f/0xa610 [amdgpu]
[ +0.000658] amdgpu_driver_load_kms+0x1a/0x120 [amdgpu]
[ +0.000662] amdgpu_pci_probe+0x361/0xf30 [amdgpu]
[ +0.000651] local_pci_probe+0xe7/0x1b0
[ +0.000009] pci_device_probe+0x248/0x890
[ +0.000008] really_probe+0x1fd/0x950
[ +0.000008] __driver_probe_device+0x307/0x410
[ +0.000007] driver_probe_device+0x4e/0x150
[ +0.000007] __driver_attach+0x223/0x510
[ +0.000006] bus_for_each_dev+0x102/0x1a0
[ +0.000007] driver_attach+0x3d/0x60
[ +0.000006] bus_add_driver+0x2ac/0x5f0
[ +0.000006] driver_register+0x13d/0x490
[ +0.000008] __pci_register_driver+0x1ee/0x2b0
[ +0.000007] llc_sap_close+0xb0/0x160 [llc]
[ +0.000009] do_one_initcall+0x9c/0x3e0
[ +0.000008] do_init_module+0x241/0x760
[ +0.000008] load_module+0x51ac/0x6c30
[ +0.000006] __do_sys_init_module+0x234/0x270
[ +0.000007] __x64_sys_init_module+0x73/0xc0
[ +0.000006] x64_sys_call+0xe3/0x2680
[ +0.000006] do_syscall_64+0x70/0x130
[ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ +0.000015] Freed by task 2147 on cpu 6 at 160.507651s:
[ +0.000013] kasan_save_stack+0x28/0x60
[ +0.000007] kasan_save_track+0x18/0x70
[ +0.000007] kasan_save_free_info+0x3b/0x60
[ +0.000007] poison_slab_object+0x115/0x1c0
[ +0.000007] __kasan_slab_free+0x34/0x60
[ +0.000007] kfree+0xfa/0x2f0
[ +0.000007] drm_sched_fini+0x19d/0x410 [gpu_sched]
[ +0.000012] amdgpu_fence_driver_sw_fini+0xc4/0x2f0 [amdgpu]
[ +0.000662] amdgpu_device_fini_sw+0x77/0xfc0 [amdgpu]
[ +0.000653] amdgpu_driver_release_kms+0x16/0x80 [amdgpu]
[ +0.000655] drm_minor_release+0xc9/0x140 [drm]
[ +0.000071] drm_release+0x1fd/0x390 [drm]
[ +0.000071] __fput+0x36c/0xad0
[ +0.000008] __fput_sync+0x3c/0x50
[ +0.000007] __x64_sys_close+0x7d/0xe0
[ +0.000007] x64_sys_call+0x1bc6/0x2680
[ +0.000007] do_syscall_64+0x70/0x130
[ +0.000007] entry_SYSCALL_64_after_hwframe+0x76/0x7e
[ +0.000014] The buggy address belongs to the object at ffff8881b8605f80
which belongs to the cache kmalloc-64 of size 64
[ +0.000020] The buggy address is located 8 bytes inside of
freed 64-byte region [ffff8881b8605f80, ffff8881b8605fc0)
[ +0.000028] The buggy address belongs to the physical page:
[ +0.000011] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b8605
[ +0.000008] anon flags: 0x17ffffc0000000(node=0|zone=2|lastcpupid=0x1fffff)
[ +0.000007] page_type: 0xffffefff(slab)
[ +0.000009] raw: 0017ffffc0000000 ffff8881000428c0 0000000000000000 dead000000000001
[ +0.000006] raw: 0000000000000000 0000000000200020 00000001ffffefff 0000000000000000
[ +0.000006] page dumped because: kasan: bad access detected
[ +0.000012] Memory state around the buggy address:
[ +0.000011] ffff8881b8605e80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ +0.000015] ffff8881b8605f00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
[ +0.000015] >ffff8881b8605f80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ +0.000013] ^
[ +0.000011] ffff8881b8606000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
[ +0.000014] ffff8881b8606080: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
[ +0.000013] ==================================================================
The issue reproduced on VG20 during the IGT pci_unplug test.
The root cause of the issue is that the function drm_sched_fini is called before drm_sched_entity_kill.
In drm_sched_fini, the drm_sched_rq structure is freed, but this structure is later accessed by
each entity within the run queue, leading to invalid memory access.
To resolve this, the order of cleanup calls is updated:
Before:
amdgpu_fence_driver_sw_fini
amdgpu_device_ip_fini
After:
amdgpu_device_ip_fini
amdgpu_fence_driver_sw_fini
This updated order ensures that all entities in the IPs are cleaned up first, followed by proper
cleanup of the schedulers.
Additional Investigation:
During debugging, another issue was identified in the amdgpu_vce_sw_fini function. The vce.vcpu_bo
buffer must be freed only as the final step in the cleanup process to prevent any premature
access during earlier cleanup stages.
v2: Using Christian suggestion call drm_sched_entity_destroy before drm_sched_fini.
Cc: Christian König <christian.koenig@amd.com>
Cc: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Vitaly Prosyak <vitaly.prosyak@amd.com>
Reviewed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +++---
2 files changed, 4 insertions(+), 4 deletions(-)
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c
@@ -4584,8 +4584,8 @@ void amdgpu_device_fini_sw(struct amdgpu
int idx;
bool px;
- amdgpu_fence_driver_sw_fini(adev);
amdgpu_device_ip_fini(adev);
+ amdgpu_fence_driver_sw_fini(adev);
amdgpu_ucode_release(&adev->firmware.gpu_info_fw);
adev->accel_working = false;
dma_fence_put(rcu_dereference_protected(adev->gang_submit, true));
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c
@@ -214,15 +214,15 @@ int amdgpu_vce_sw_fini(struct amdgpu_dev
drm_sched_entity_destroy(&adev->vce.entity);
- amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
- (void **)&adev->vce.cpu_addr);
-
for (i = 0; i < adev->vce.num_rings; i++)
amdgpu_ring_fini(&adev->vce.ring[i]);
amdgpu_ucode_release(&adev->vce.fw);
mutex_destroy(&adev->vce.idle_mutex);
+ amdgpu_bo_free_kernel(&adev->vce.vcpu_bo, &adev->vce.gpu_addr,
+ (void **)&adev->vce.cpu_addr);
+
return 0;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 138/146] drm/amd/pm: skip setting the power source on smu v14.0.2/3
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (136 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 137/146] drm/amdgpu: fix usage slab after free Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 139/146] drm/amd: Fix initialization mistake for NBIO 7.11 devices Greg Kroah-Hartman
` (15 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kenneth Feng, Lijo Lazar,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <kenneth.feng@amd.com>
commit 76c7f08094767b5df3b60e18d1bdecddd4a5c844 upstream.
skip setting power source on smu v14.0.2/3
Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.11.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 1 -
1 file changed, 1 deletion(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
@@ -2769,7 +2769,6 @@ static const struct pptable_funcs smu_v1
.get_unique_id = smu_v14_0_2_get_unique_id,
.get_power_limit = smu_v14_0_2_get_power_limit,
.set_power_limit = smu_v14_0_2_set_power_limit,
- .set_power_source = smu_v14_0_set_power_source,
.get_power_profile_mode = smu_v14_0_2_get_power_profile_mode,
.set_power_profile_mode = smu_v14_0_2_set_power_profile_mode,
.run_btc = smu_v14_0_run_btc,
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 139/146] drm/amd: Fix initialization mistake for NBIO 7.11 devices
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (137 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 138/146] drm/amd/pm: skip setting the power source on smu v14.0.2/3 Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 140/146] drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 Greg Kroah-Hartman
` (14 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Alex Deucher, Mario Limonciello
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mario Limonciello <mario.limonciello@amd.com>
commit 349af06a3abd0bb3787ee2daf3ac508412fe8dcc upstream.
There is a strapping issue on NBIO 7.11.x that can lead to spurious PME
events while in the D0 state.
Cc: stable@vger.kernel.org
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Link: https://lore.kernel.org/r/20241118174611.10700-2-mario.limonciello@amd.com
Signed-off-by: Mario Limonciello <mario.limonciello@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c
+++ b/drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c
@@ -275,6 +275,15 @@ static void nbio_v7_11_init_registers(st
if (def != data)
WREG32_SOC15(NBIO, 0, regBIF_BIF256_CI256_RC3X4_USB4_PCIE_MST_CTRL_3, data);
+ switch (adev->ip_versions[NBIO_HWIP][0]) {
+ case IP_VERSION(7, 11, 0):
+ case IP_VERSION(7, 11, 1):
+ case IP_VERSION(7, 11, 2):
+ case IP_VERSION(7, 11, 3):
+ data = RREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF5_STRAP4) & ~BIT(23);
+ WREG32_SOC15(NBIO, 0, regRCC_DEV0_EPF5_STRAP4, data);
+ break;
+ }
}
static void nbio_v7_11_update_medium_grain_clock_gating(struct amdgpu_device *adev,
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 140/146] drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (138 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 139/146] drm/amd: Fix initialization mistake for NBIO 7.11 devices Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 141/146] drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3 Greg Kroah-Hartman
` (13 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Umio Yasuno, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Umio Yasuno <coelacanth_dream@protonmail.com>
commit 2abf2f7032df4c4e7f6cf7906da59d0e614897d6 upstream.
These were missed before.
Closes: https://gitlab.freedesktop.org/drm/amd/-/issues/3751
Signed-off-by: Umio Yasuno <coelacanth_dream@protonmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c
@@ -2061,6 +2061,8 @@ static ssize_t smu_v13_0_7_get_gpu_metri
gpu_metrics->average_dclk1_frequency = metrics->AverageDclk1Frequency;
gpu_metrics->current_gfxclk = metrics->CurrClock[PPCLK_GFXCLK];
+ gpu_metrics->current_socclk = metrics->CurrClock[PPCLK_SOCCLK];
+ gpu_metrics->current_uclk = metrics->CurrClock[PPCLK_UCLK];
gpu_metrics->current_vclk0 = metrics->CurrClock[PPCLK_VCLK_0];
gpu_metrics->current_dclk0 = metrics->CurrClock[PPCLK_DCLK_0];
gpu_metrics->current_vclk1 = metrics->CurrClock[PPCLK_VCLK_1];
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 141/146] drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (139 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 140/146] drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7 Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 142/146] drm/amd/pm: Remove arcturus min power limit Greg Kroah-Hartman
` (12 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Kenneth Feng, Lijo Lazar,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kenneth Feng <kenneth.feng@amd.com>
commit b0df0e777874549c128b43f7bf4989a2ed24b37a upstream.
disable pcie speed switching on Intel platform for smu v14.0.2/3
based on Intel's requirement.
v2: align the setting with smu v13.
Signed-off-by: Kenneth Feng <kenneth.feng@amd.com>
Reviewed-by: Lijo Lazar <lijo.lazar@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org # 6.11.x
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 26 ++++++++++++++++---
1 file changed, 23 insertions(+), 3 deletions(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c
@@ -1477,15 +1477,35 @@ static int smu_v14_0_2_update_pcie_param
struct smu_14_0_dpm_context *dpm_context = smu->smu_dpm.dpm_context;
struct smu_14_0_pcie_table *pcie_table =
&dpm_context->dpm_tables.pcie_table;
+ int num_of_levels = pcie_table->num_of_link_levels;
uint32_t smu_pcie_arg;
int ret, i;
- for (i = 0; i < pcie_table->num_of_link_levels; i++) {
- if (pcie_table->pcie_gen[i] > pcie_gen_cap)
+ if (!num_of_levels)
+ return 0;
+
+ if (!(smu->adev->pm.pp_feature & PP_PCIE_DPM_MASK)) {
+ if (pcie_table->pcie_gen[num_of_levels - 1] < pcie_gen_cap)
+ pcie_gen_cap = pcie_table->pcie_gen[num_of_levels - 1];
+
+ if (pcie_table->pcie_lane[num_of_levels - 1] < pcie_width_cap)
+ pcie_width_cap = pcie_table->pcie_lane[num_of_levels - 1];
+
+ /* Force all levels to use the same settings */
+ for (i = 0; i < num_of_levels; i++) {
pcie_table->pcie_gen[i] = pcie_gen_cap;
- if (pcie_table->pcie_lane[i] > pcie_width_cap)
pcie_table->pcie_lane[i] = pcie_width_cap;
+ }
+ } else {
+ for (i = 0; i < num_of_levels; i++) {
+ if (pcie_table->pcie_gen[i] > pcie_gen_cap)
+ pcie_table->pcie_gen[i] = pcie_gen_cap;
+ if (pcie_table->pcie_lane[i] > pcie_width_cap)
+ pcie_table->pcie_lane[i] = pcie_width_cap;
+ }
+ }
+ for (i = 0; i < num_of_levels; i++) {
smu_pcie_arg = i << 16;
smu_pcie_arg |= pcie_table->pcie_gen[i] << 8;
smu_pcie_arg |= pcie_table->pcie_lane[i];
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 142/146] drm/amd/pm: Remove arcturus min power limit
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (140 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 141/146] drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3 Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 143/146] drm/amd/display: Fix handling of plane refcount Greg Kroah-Hartman
` (11 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable; +Cc: Greg Kroah-Hartman, patches, Lijo Lazar, Kenneth Feng,
Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lijo Lazar <lijo.lazar@amd.com>
commit da868898cf4c5ddbd1f7406e356edce5d7211eb5 upstream.
As per power team, there is no need to impose a lower bound on arcturus
power limit. Any unreasonable limit set will result in frequent
throttling.
Signed-off-by: Lijo Lazar <lijo.lazar@amd.com>
Reviewed-by: Kenneth Feng <kenneth.feng@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
+++ b/drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c
@@ -1344,8 +1344,12 @@ static int arcturus_get_power_limit(stru
*default_power_limit = power_limit;
if (max_power_limit)
*max_power_limit = power_limit;
+ /**
+ * No lower bound is imposed on the limit. Any unreasonable limit set
+ * will result in frequent throttling.
+ */
if (min_power_limit)
- *min_power_limit = power_limit;
+ *min_power_limit = 0;
return 0;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 143/146] drm/amd/display: Fix handling of plane refcount
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (141 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 142/146] drm/amd/pm: Remove arcturus min power limit Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 144/146] drm/amd/display: update pipe selection policy to check head pipe Greg Kroah-Hartman
` (10 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Josip Pavic, Joshua Aberback,
Hamza Mahfooz, Daniel Wheeler, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Joshua Aberback <joshua.aberback@amd.com>
commit 27227a234c1487cb7a684615f0749c455218833a upstream.
[Why]
The mechanism to backup and restore plane states doesn't maintain
refcount, which can cause issues if the refcount of the plane changes
in between backup and restore operations, such as memory leaks if the
refcount was supposed to go down, or double frees / invalid memory
accesses if the refcount was supposed to go up.
[How]
Cache and re-apply current refcount when restoring plane states.
Cc: stable@vger.kernel.org
Reviewed-by: Josip Pavic <josip.pavic@amd.com>
Signed-off-by: Joshua Aberback <joshua.aberback@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/gpu/drm/amd/display/dc/core/dc.c
+++ b/drivers/gpu/drm/amd/display/dc/core/dc.c
@@ -3066,7 +3066,10 @@ static void restore_planes_and_stream_st
return;
for (i = 0; i < status->plane_count; i++) {
+ /* refcount will always be valid, restore everything else */
+ struct kref refcount = status->plane_states[i]->refcount;
*status->plane_states[i] = scratch->plane_states[i];
+ status->plane_states[i]->refcount = refcount;
}
*stream = scratch->stream_state;
}
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 144/146] drm/amd/display: update pipe selection policy to check head pipe
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (142 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 143/146] drm/amd/display: Fix handling of plane refcount Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 145/146] drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto Greg Kroah-Hartman
` (9 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Kazlauskas, Yihan Zhu,
Hamza Mahfooz, Daniel Wheeler, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Yihan Zhu <Yihan.Zhu@amd.com>
commit 8fef253c94a5312b9150b2ff8e633b331bac7e88 upstream.
[Why]
No check on head pipe during the dml to dc hw mapping will allow illegal
pipe usage. This will result in a wrong pipe topology to cause mpcc tree
totally mess up then cause a display hang.
[How]
Avoid to use the pipe is head in all check and avoid ODM slice during
preferred pipe check.
Cc: stable@vger.kernel.org
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Yihan Zhu <Yihan.Zhu@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 23 +++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
--- a/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c
+++ b/drivers/gpu/drm/amd/display/dc/dml2/dml2_dc_resource_mgmt.c
@@ -258,12 +258,25 @@ static unsigned int find_preferred_pipe_
* However this condition comes with a caveat. We need to ignore pipes that will
* require a change in OPP but still have the same stream id. For example during
* an MPC to ODM transiton.
+ *
+ * Adding check to avoid pipe select on the head pipe by utilizing dc resource
+ * helper function resource_get_primary_dpp_pipe and comparing the pipe index.
*/
if (existing_state) {
for (i = 0; i < pipe_count; i++) {
if (existing_state->res_ctx.pipe_ctx[i].stream && existing_state->res_ctx.pipe_ctx[i].stream->stream_id == stream_id) {
+ struct pipe_ctx *head_pipe =
+ resource_is_pipe_type(&existing_state->res_ctx.pipe_ctx[i], DPP_PIPE) ?
+ resource_get_primary_dpp_pipe(&existing_state->res_ctx.pipe_ctx[i]) :
+ NULL;
+
+ // we should always respect the head pipe from selection
+ if (head_pipe && head_pipe->pipe_idx == i)
+ continue;
if (existing_state->res_ctx.pipe_ctx[i].plane_res.hubp &&
- existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i)
+ existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i &&
+ (existing_state->res_ctx.pipe_ctx[i].prev_odm_pipe ||
+ existing_state->res_ctx.pipe_ctx[i].next_odm_pipe))
continue;
preferred_pipe_candidates[num_preferred_candidates++] = i;
@@ -292,6 +305,14 @@ static unsigned int find_last_resort_pip
*/
if (existing_state) {
for (i = 0; i < pipe_count; i++) {
+ struct pipe_ctx *head_pipe =
+ resource_is_pipe_type(&existing_state->res_ctx.pipe_ctx[i], DPP_PIPE) ?
+ resource_get_primary_dpp_pipe(&existing_state->res_ctx.pipe_ctx[i]) :
+ NULL;
+
+ // we should always respect the head pipe from selection
+ if (head_pipe && head_pipe->pipe_idx == i)
+ continue;
if ((existing_state->res_ctx.pipe_ctx[i].plane_res.hubp &&
existing_state->res_ctx.pipe_ctx[i].plane_res.hubp->opp_id != i) ||
existing_state->res_ctx.pipe_ctx[i].stream_res.tg)
^ permalink raw reply [flat|nested] 157+ messages in thread* [PATCH 6.12 145/146] drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (143 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 144/146] drm/amd/display: update pipe selection policy to check head pipe Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 14:37 ` [PATCH 6.12 146/146] posix-timers: Target group sigqueue to current task only if not exiting Greg Kroah-Hartman
` (8 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Nicholas Kazlauskas, Ovidiu Bunea,
Hamza Mahfooz, Daniel Wheeler, Alex Deucher
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ovidiu Bunea <Ovidiu.Bunea@amd.com>
commit a3e6079bd93d5c66a43bf6a5f90e5b98465dc7b3 upstream.
There are cases where an OTG is remapped from driving a regular HDMI
display to a DP/eDP display. There are also cases where DTBCLK needs to
be enabled for HPO, but DTBCLK DTO programming may be done while OTG is
still enabled which is dangerous as the PIPE_DTO_SRC_SEL programming may
change the pixel clock generator source for a mapped and running OTG and
cause it to hang.
Remove the PIPE_DTO_SRC_SEL programming from this sequence since it is
already done in program_pixel_clk(). Additionally, make sure that
program_pixel_clk sets DTBCLK DTO as source for special HDMI cases.
Cc: stable@vger.kernel.org # 6.11+
Reviewed-by: Nicholas Kazlauskas <nicholas.kazlauskas@amd.com>
Signed-off-by: Ovidiu Bunea <Ovidiu.Bunea@amd.com>
Signed-off-by: Hamza Mahfooz <hamza.mahfooz@amd.com>
Tested-by: Daniel Wheeler <daniel.wheeler@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
.../drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
diff --git a/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c b/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c
index 838d72eaa87f..b363f5360818 100644
--- a/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c
+++ b/drivers/gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c
@@ -1392,10 +1392,10 @@ static void dccg35_set_dtbclk_dto(
/* The recommended programming sequence to enable DTBCLK DTO to generate
* valid pixel HPO DPSTREAM ENCODER, specifies that DTO source select should
- * be set only after DTO is enabled
+ * be set only after DTO is enabled.
+ * PIPEx_DTO_SRC_SEL should not be programmed during DTBCLK update since OTG may still be on, and the
+ * programming is handled in program_pix_clk() regardless, so it can be removed from here.
*/
- REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst],
- PIPE_DTO_SRC_SEL[params->otg_inst], 2);
} else {
switch (params->otg_inst) {
case 0:
@@ -1412,9 +1412,12 @@ static void dccg35_set_dtbclk_dto(
break;
}
- REG_UPDATE_2(OTG_PIXEL_RATE_CNTL[params->otg_inst],
- DTBCLK_DTO_ENABLE[params->otg_inst], 0,
- PIPE_DTO_SRC_SEL[params->otg_inst], params->is_hdmi ? 0 : 1);
+ /**
+ * PIPEx_DTO_SRC_SEL should not be programmed during DTBCLK update since OTG may still be on, and the
+ * programming is handled in program_pix_clk() regardless, so it can be removed from here.
+ */
+ REG_UPDATE(OTG_PIXEL_RATE_CNTL[params->otg_inst],
+ DTBCLK_DTO_ENABLE[params->otg_inst], 0);
REG_WRITE(DTBCLK_DTO_MODULO[params->otg_inst], 0);
REG_WRITE(DTBCLK_DTO_PHASE[params->otg_inst], 0);
--
2.47.1
^ permalink raw reply related [flat|nested] 157+ messages in thread* [PATCH 6.12 146/146] posix-timers: Target group sigqueue to current task only if not exiting
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (144 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 145/146] drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto Greg Kroah-Hartman
@ 2024-12-06 14:37 ` Greg Kroah-Hartman
2024-12-06 16:34 ` [PATCH 6.12 000/146] 6.12.4-rc1 review Luna Jernberg
` (7 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Greg Kroah-Hartman @ 2024-12-06 14:37 UTC (permalink / raw)
To: stable
Cc: Greg Kroah-Hartman, patches, Anthony Mallet, Oleg Nesterov,
Frederic Weisbecker, Thomas Gleixner
6.12-stable review patch. If anyone has any objections, please let me know.
------------------
From: Frederic Weisbecker <frederic@kernel.org>
commit 63dffecfba3eddcf67a8f76d80e0c141f93d44a5 upstream.
A sigqueue belonging to a posix timer, which target is not a specific
thread but a whole thread group, is preferrably targeted to the current
task if it is part of that thread group.
However nothing prevents a posix timer event from queueing such a
sigqueue from a reaped yet running task. The interruptible code space
between exit_notify() and the final call to schedule() is enough for
posix_timer_fn() hrtimer to fire.
If that happens while the current task is part of the thread group
target, it is proposed to handle it but since its sighand pointer may
have been cleared already, the sigqueue is dropped even if there are
other tasks running within the group that could handle it.
As a result posix timers with thread group wide target may miss signals
when some of their threads are exiting.
Fix this with verifying that the current task hasn't been through
exit_notify() before proposing it as a preferred target so as to ensure
that its sighand is still here and stable.
complete_signal() might still reconsider the choice and find a better
target within the group if current has passed retarget_shared_pending()
already.
Fixes: bcb7ee79029d ("posix-timers: Prefer delivery of signals to the current thread")
Reported-by: Anthony Mallet <anthony.mallet@laas.fr>
Suggested-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Frederic Weisbecker <frederic@kernel.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20241122234811.60455-1-frederic@kernel.org
Closes: https://lore.kernel.org/all/26411.57288.238690.681680@gargle.gargle.HOWL
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/signal.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1986,14 +1986,15 @@ int send_sigqueue(struct sigqueue *q, st
* into t->pending).
*
* Where type is not PIDTYPE_PID, signals must be delivered to the
- * process. In this case, prefer to deliver to current if it is in
- * the same thread group as the target process, which avoids
- * unnecessarily waking up a potentially idle task.
+ * process. In this case, prefer to deliver to current if it is in the
+ * same thread group as the target process and its sighand is stable,
+ * which avoids unnecessarily waking up a potentially idle task.
*/
t = pid_task(pid, type);
if (!t)
goto ret;
- if (type != PIDTYPE_PID && same_thread_group(t, current))
+ if (type != PIDTYPE_PID &&
+ same_thread_group(t, current) && !current->exit_state)
t = current;
if (!likely(lock_task_sighand(t, &flags)))
goto ret;
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (145 preceding siblings ...)
2024-12-06 14:37 ` [PATCH 6.12 146/146] posix-timers: Target group sigqueue to current task only if not exiting Greg Kroah-Hartman
@ 2024-12-06 16:34 ` Luna Jernberg
2024-12-06 18:05 ` Mark Brown
` (6 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Luna Jernberg @ 2024-12-06 16:34 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
Works as it should
Tested-by: Luna Jernberg <droidbittin@gmail.com>
AMD Ryzen 5 5600 6-Core Processor:
https://www.inet.se/produkt/5304697/amd-ryzen-5-5600-3-5-ghz-35mb on a
https://www.gigabyte.com/Motherboard/B550-AORUS-ELITE-V2-rev-12
https://www.inet.se/produkt/1903406/gigabyte-b550-aorus-elite-v2
motherboard :)
running Arch Linux with the testing repos enabled:
https://archlinux.org/ https://archboot.com/
https://wiki.archlinux.org/title/Arch_Testing_Team
Den fre 6 dec. 2024 kl 15:39 skrev Greg Kroah-Hartman
<gregkh@linuxfoundation.org>:
>
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
> Pseudo-Shortlog of commits:
>
> Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> Linux 6.12.4-rc1
>
> Frederic Weisbecker <frederic@kernel.org>
> posix-timers: Target group sigqueue to current task only if not exiting
>
> Ovidiu Bunea <Ovidiu.Bunea@amd.com>
> drm/amd/display: Remove PIPE_DTO_SRC_SEL programming from set_dtbclk_dto
>
> Yihan Zhu <Yihan.Zhu@amd.com>
> drm/amd/display: update pipe selection policy to check head pipe
>
> Joshua Aberback <joshua.aberback@amd.com>
> drm/amd/display: Fix handling of plane refcount
>
> Lijo Lazar <lijo.lazar@amd.com>
> drm/amd/pm: Remove arcturus min power limit
>
> Kenneth Feng <kenneth.feng@amd.com>
> drm/amd/pm: disable pcie speed switching on Intel platform for smu v14.0.2/3
>
> Umio Yasuno <coelacanth_dream@protonmail.com>
> drm/amd/pm: update current_socclk and current_uclk in gpu_metrics on smu v13.0.7
>
> Mario Limonciello <mario.limonciello@amd.com>
> drm/amd: Fix initialization mistake for NBIO 7.11 devices
>
> Kenneth Feng <kenneth.feng@amd.com>
> drm/amd/pm: skip setting the power source on smu v14.0.2/3
>
> Vitaly Prosyak <vitaly.prosyak@amd.com>
> drm/amdgpu: fix usage slab after free
>
> Mario Limonciello <mario.limonciello@amd.com>
> drm/amd: Add some missing straps from NBIO 7.11.0
>
> Kenneth Feng <kenneth.feng@amd.com>
> drm/amdgpu/pm: add gen5 display to the user on smu v14.0.2/3
>
> Lijo Lazar <lijo.lazar@amd.com>
> drm/amdkfd: Use the correct wptr size
>
> Matthew Auld <matthew.auld@intel.com>
> drm/xe/guc_submit: fix race around suspend_pending
>
> Matthew Auld <matthew.auld@intel.com>
> drm/xe/migrate: use XE_BO_FLAG_PAGETABLE
>
> Alex Deucher <alexander.deucher@amd.com>
> Revert "drm/radeon: Delay Connector detecting when HPD singals is unstable"
>
> Matthew Auld <matthew.auld@intel.com>
> drm/xe/migrate: fix pat index usage
>
> Jonathan Cavitt <jonathan.cavitt@intel.com>
> drm/xe/xe_guc_ads: save/restore OA registers and allowlist regs
>
> Steffen Dirkwinkel <s.dirkwinkel@beckhoff.com>
> drm: xlnx: zynqmp_dpsub: fix hotplug detection
>
> Lucas Stach <l.stach@pengutronix.de>
> drm/etnaviv: flush shader L1 cache after user commandstream
>
> Chen-Yu Tsai <wenst@chromium.org>
> drm/bridge: it6505: Fix inverted reset polarity
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> drm/mediatek: Fix child node refcount handling in early exit
>
> Thomas Zimmermann <tzimmermann@suse.de>
> drm/fbdev-dma: Select FB_DEFERRED_IO
>
> Ma Ke <make24@iscas.ac.cn>
> drm/sti: avoid potential dereference of error pointers
>
> Hugo Villeneuve <hvilleneuve@dimonoff.com>
> drm: panel: jd9365da-h3: Remove unused num_init_cmds structure member
>
> Ma Ke <make24@iscas.ac.cn>
> drm/sti: avoid potential dereference of error pointers in sti_gdp_atomic_check
>
> Ma Ke <make24@iscas.ac.cn>
> drm/sti: avoid potential dereference of error pointers in sti_hqvdp_atomic_check
>
> Lyude Paul <lyude@redhat.com>
> drm/panic: Fix uninitialized spinlock acquisition with CONFIG_DRM_PANIC=n
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> net: fec: make PPS channel configurable
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> net: fec: refactor PPS channel configuration
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> dt-bindings: net: fec: add pps channel property
>
> Carlos Llamas <cmllamas@google.com>
> binder: add delivered_freeze to debugfs output
>
> Carlos Llamas <cmllamas@google.com>
> binder: fix memleak of proc->delivered_freeze
>
> Carlos Llamas <cmllamas@google.com>
> binder: allow freeze notification for dead nodes
>
> Carlos Llamas <cmllamas@google.com>
> binder: fix BINDER_WORK_CLEAR_FREEZE_NOTIFICATION debug logs
>
> Carlos Llamas <cmllamas@google.com>
> binder: fix BINDER_WORK_FROZEN_BINDER debug logs
>
> Carlos Llamas <cmllamas@google.com>
> binder: fix freeze UAF in binder_release_work()
>
> Carlos Llamas <cmllamas@google.com>
> binder: fix OOB in binder_add_freeze_work()
>
> Carlos Llamas <cmllamas@google.com>
> binder: fix node UAF in binder_add_freeze_work()
>
> Nathan Chancellor <nathan@kernel.org>
> powerpc: Adjust adding stack protector flags to KBUILD_CLAGS for clang
>
> Nathan Chancellor <nathan@kernel.org>
> powerpc: Fix stack protector Kconfig test for clang
>
> Zicheng Qu <quzicheng@huawei.com>
> iio: gts: fix infinite loop for gain_to_scaletables()
>
> Nuno Sa <nuno.sa@analog.com>
> iio: adc: ad7923: Fix buffer overflow for tx_buf and ring_xfer
>
> Zicheng Qu <quzicheng@huawei.com>
> iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name()
>
> Jean-Baptiste Maneyrol <jean-baptiste.maneyrol@tdk.com>
> iio: invensense: fix multiple odr switch when FIFO is off
>
> Matti Vaittinen <mazziesaccount@gmail.com>
> iio: accel: kx022a: Fix raw read format
>
> Yang Erkun <yangerkun@huawei.com>
> nfsd: fix nfs4_openowner leak when concurrent nfsd4_open occur
>
> Yang Erkun <yangerkun@huawei.com>
> nfsd: make sure exp active before svc_export_show
>
> Damien Le Moal <dlemoal@kernel.org>
> PCI: rockchip-ep: Fix address translation unit programming
>
> Andrea della Porta <andrea.porta@suse.com>
> PCI: of_property: Assign PCI instead of CPU bus address to dynamic PCI nodes
>
> Niklas Cassel <cassel@kernel.org>
> PCI: dwc: ep: Fix advertised resizable BAR size regression
>
> Yuan Can <yuancan@huawei.com>
> dm thin: Add missing destroy_work_on_stack()
>
> Ssuhung Yeh <ssuhung@gmail.com>
> dm: Fix typo in error message
>
> Adrian Huang <ahuang12@lenovo.com>
> mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation
>
> Oleksandr Tymoshenko <ovt@google.com>
> ovl: properly handle large files in ovl_security_fileattr
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> leds: flash: mt6360: Fix device_for_each_child_node() refcounting in error paths
>
> Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
> thermal: int3400: Fix reading of current_uuid for active policy
>
> Jiri Olsa <jolsa@kernel.org>
> fs/proc/kcore.c: Clear ret value in read_kcore_iter after successful iov_iter_zero
>
> Geert Uytterhoeven <geert@linux-m68k.org>
> slab: Fix too strict alignment check in create_cache()
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> PCI: endpoint: Clear secondary (not primary) EPC in pci_epc_remove_epf()
>
> Zijun Hu <quic_zijuhu@quicinc.com>
> PCI: endpoint: Fix PCI domain ID release in pci_epc_destroy()
>
> Kishon Vijay Abraham I <kishon@kernel.org>
> PCI: keystone: Add link up check to ks_pcie_other_map_bus()
>
> Kishon Vijay Abraham I <kishon@kernel.org>
> PCI: keystone: Set mode as Root Complex for "ti,keystone-pcie" compatible
>
> Frank Li <Frank.Li@nxp.com>
> i3c: master: svc: Modify enabled_events bit 7:0 to act as IBI enable counter
>
> Frank Li <Frank.Li@nxp.com>
> i3c: master: svc: fix possible assignment of the same address to two devices
>
> Frank Li <Frank.Li@nxp.com>
> i3c: master: Fix miss free init_dyn_addr at i3c_master_put_i3c_addrs()
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> i3c: master: svc: Fix pm_runtime_set_suspended() with runtime pm enabled
>
> Peter Griffin <peter.griffin@linaro.org>
> scsi: ufs: exynos: Fix hibern8 notify callbacks
>
> Peter Griffin <peter.griffin@linaro.org>
> scsi: ufs: exynos: Add check inside exynos_ufs_config_smu()
>
> Heiko Carstens <hca@linux.ibm.com>
> s390/stacktrace: Use break instead of return statement
>
> Alexandru Ardelean <aardelean@baylibre.com>
> util_macros.h: fix/rework find_closest() macros
>
> Miquel Raynal <miquel.raynal@bootlin.com>
> mtd: spinand: winbond: Fix 512GW, 01GW, 01JW and 02JW ECC information
>
> Miquel Raynal <miquel.raynal@bootlin.com>
> mtd: spinand: winbond: Fix 512GW and 02JW OOB layout
>
> Max Kellermann <max.kellermann@ionos.com>
> ceph: fix cred leak in ceph_mds_check_access()
>
> Max Kellermann <max.kellermann@ionos.com>
> ceph: pass cred pointer to ceph_mds_auth_match()
>
> Patrick Donnelly <pdonnell@redhat.com>
> ceph: extract entity name from device id
>
> Chao Yu <chao@kernel.org>
> f2fs: fix to drop all discards after creating snapshot on lvm device
>
> yuan.gao <yuan.gao@ucloud.cn>
> mm/slub: Avoid list corruption when removing a slab from the full list
>
> Stefan Eichenberger <stefan.eichenberger@toradex.com>
> PCI: imx6: Fix suspend/resume support on i.MX6QDL
>
> Balaji Pothunoori <quic_bpothuno@quicinc.com>
> remoteproc: qcom_q6v5_pas: disable auto boot for wpss
>
> Xu Yang <xu.yang_2@nxp.com>
> perf jevents: fix breakage when do perf stat on system metric
>
> Qiang Yu <quic_qianyu@quicinc.com>
> PCI: qcom: Disable ASPM L0s for X1E80100
>
> Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> vfio/qat: fix overflow check in qat_vf_resume_write()
>
> Choong Yong Liang <yong.liang.choong@linux.intel.com>
> net: stmmac: set initial EEE policy configuration
>
> Linus Walleij <linus.walleij@linaro.org>
> ARM: 9431/1: mm: Pair atomic_set_release() with _read_acquire()
>
> Linus Walleij <linus.walleij@linaro.org>
> ARM: 9430/1: entry: Do a dummy read from VMAP shadow
>
> Vasily Gorbik <gor@linux.ibm.com>
> s390/entry: Mark IRQ entries to fix stack depot warnings
>
> Linus Walleij <linus.walleij@linaro.org>
> ARM: 9429/1: ioremap: Sync PGDs for VMALLOC shadow
>
> Javier Carrasco <javier.carrasco.cruz@gmail.com>
> spmi: pmic-arb: fix return path in for_each_available_child_of_node()
>
> Saravana Kannan <saravanak@google.com>
> driver core: fw_devlink: Stop trying to optimize cycle detection logic
>
> Marek Vasut <marex@denx.de>
> nvmem: core: Check read_only flag for force_ro in bin_attr_nvmem_write()
>
> Zicheng Qu <quzicheng@huawei.com>
> ad7780: fix division by zero in ad7780_write_raw()
>
> Gabor Juhos <j4g8y7@gmail.com>
> clk: qcom: gcc-qcs404: fix initial rate of GPLL3
>
> Sibi Sankar <quic_sibis@quicinc.com>
> cpufreq: scmi: Fix cleanup path when boost enablement fails
>
> Nathan Chancellor <nathan@kernel.org>
> powerpc/vdso: Drop -mstack-protector-guard flags in 32-bit files with clang
>
> Zheng Yejian <zhengyejian@huaweicloud.com>
> mm/damon/vaddr: fix issue in damon_va_evenly_split_region()
>
> Michal Vokáč <michal.vokac@ysoft.com>
> leds: lp55xx: Remove redundant test for invalid channel number
>
> Pratyush Brahma <quic_pbrahma@quicinc.com>
> iommu/arm-smmu: Defer probe of clients after smmu device bound
>
> Mostafa Saleh <smostafa@google.com>
> iommu/io-pgtable-arm: Fix stage-2 map/unmap for concatenated tables
>
> Sergey Senozhatsky <senozhatsky@chromium.org>
> zram: clear IDLE flag after recompression
>
> MengEn Sun <mengensun@tencent.com>
> vmstat: call fold_vm_zone_numa_events() before show per zone NUMA event
>
> guoweikang <guoweikang.kernel@gmail.com>
> ftrace: Fix regression with module command in stack_trace_filter
>
> Wei Yang <richard.weiyang@gmail.com>
> maple_tree: refine mas_store_root() on storing NULL
>
> Vasiliy Kovalev <kovalev@altlinux.org>
> ovl: Filter invalid inodes with missing lookup function
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> kunit: string-stream: Fix a UAF bug in kunit_init_suite()
>
> Zichen Xie <zichenxie0106@gmail.com>
> kunit: Fix potential null dereference in kunit_device_driver_test()
>
> Masami Hiramatsu (Google) <mhiramat@kernel.org>
> tracing: Fix function timing profiler to initialize hashtable
>
> Thadeu Lima de Souza Cascardo <cascardo@igalia.com>
> media: uvcvideo: Require entities to have a non-zero unique ID
>
> Ricardo Ribalda <ribalda@chromium.org>
> media: uvcvideo: Stop stream during unregister
>
> Gaosheng Cui <cuigaosheng1@huawei.com>
> media: platform: allegro-dvt: Fix possible memory leak in allocate_buffers_internal()
>
> Bryan O'Donoghue <bryan.odonoghue@linaro.org>
> media: ov08x40: Fix burst write sequence
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> media: gspca: ov534-ov772x: Fix off-by-one error in set_frame_rate()
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> media: venus: Fix pm_runtime_set_suspended() with runtime pm enabled
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> media: amphion: Fix pm_runtime_set_suspended() with runtime pm enabled
>
> Romain Gantois <romain.gantois@bootlin.com>
> net: phy: dp83869: fix status reporting for 1000base-x autonegotiation
>
> Ard Biesheuvel <ardb@kernel.org>
> efi/libstub: Free correct pointer on failure
>
> Joe Hattori <joe@pf.is.s.u-tokyo.ac.jp>
> media: platform: exynos4-is: Fix an OF node reference leak in fimc_md_is_isp_available
>
> Li Zetao <lizetao1@huawei.com>
> media: ts2020: fix null-ptr-deref in ts2020_probe()
>
> Benjamin Gaignard <benjamin.gaignard@collabora.com>
> media: verisilicon: av1: Fix reference video buffer pointer assignment
>
> John Keeping <jkeeping@inmusicbrands.com>
> media: platform: rga: fix 32-bit DMA limitation
>
> Ming Qian <ming.qian@nxp.com>
> media: imx-jpeg: Ensure power suppliers be suspended before detach them
>
> Alexander Shiyan <eagle.alexander923@gmail.com>
> media: i2c: tc358743: Fix crash in the probe error path when using polling
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> arm64: dts: freescale: imx8mp-verdin: Fix SD regulator startup delay
>
> Jinjie Ruan <ruanjinjie@huawei.com>
> media: i2c: dw9768: Fix pm_runtime_set_suspended() with runtime pm enabled
>
> Guoqing Jiang <guoqing.jiang@canonical.com>
> media: mtk-jpeg: Fix null-ptr-deref during unload module
>
> Ming Qian <ming.qian@nxp.com>
> media: imx-jpeg: Set video drvdata before register video device
>
> Ming Qian <ming.qian@nxp.com>
> media: amphion: Set video drvdata before register video device
>
> Vladimir Zapolskiy <vladimir.zapolskiy@linaro.org>
> media: qcom: camss: fix error path on configuration of power domains
>
> Chen-Yu Tsai <wenst@chromium.org>
> arm64: dts: mediatek: mt8186-corsola: Fix IT6505 reset line polarity
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> arm64: dts: ti: k3-am62-verdin: Fix SD regulator startup delay
>
> Francesco Dolcini <francesco.dolcini@toradex.com>
> arm64: dts: freescale: imx8mm-verdin: Fix SD regulator startup delay
>
> Chen-Yu Tsai <wenst@chromium.org>
> arm64: dts: mediatek: mt8186-corsola: Fix GPU supply coupling max-spread
>
> Dragan Simic <dsimic@manjaro.org>
> arm64: dts: allwinner: pinephone: Add mount matrix to accelerometer
>
> Yuan Can <yuancan@huawei.com>
> md/md-bitmap: Add missing destroy_work_on_stack()
>
> Xiao Ni <xni@redhat.com>
> md/raid5: Wait sync io to finish before changing group cnt
>
> Daniel Borkmann <daniel@iogearbox.net>
> netkit: Add option for scrubbing skb meta data
>
> Will Deacon <will@kernel.org>
> iommu/tegra241-cmdqv: Fix unused variable warning
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: ref-verify: fix use-after-free after invalid ref action
>
> Lizhi Xu <lizhi.xu@windriver.com>
> btrfs: add a sanity check for btrfs root in btrfs_search_slot()
>
> Filipe Manana <fdmanana@suse.com>
> btrfs: don't loop for nowait writes when checking for cross references
>
> Johannes Thumshirn <johannes.thumshirn@wdc.com>
> btrfs: fix use-after-free in btrfs_encoded_read_endio()
>
> Mark Harmstone <maharmstone@fb.com>
> btrfs: move priv off stack in btrfs_encoded_read_regular_fill_pages()
>
> Mark Harmstone <maharmstone@fb.com>
> btrfs: change btrfs_encoded_read() so that reading of extent is done by caller
>
> David Sterba <dsterba@suse.com>
> btrfs: drop unused parameter file_offset from btrfs_encoded_read_regular_fill_pages()
>
> Ojaswin Mujoo <ojaswin@linux.ibm.com>
> quota: flush quota_release_work upon quota writeback
>
> Long Li <leo.lilong@huawei.com>
> xfs: remove unknown compat feature check in superblock write validation
>
>
> -------------
>
> Diffstat:
>
> Documentation/devicetree/bindings/net/fsl,fec.yaml | 7 ++
> Makefile | 4 +-
> arch/arm/kernel/entry-armv.S | 8 ++
> arch/arm/mm/ioremap.c | 35 ++++++-
> .../boot/dts/allwinner/sun50i-a64-pinephone.dtsi | 3 +
> arch/arm64/boot/dts/freescale/imx8mm-verdin.dtsi | 2 +-
> arch/arm64/boot/dts/freescale/imx8mp-verdin.dtsi | 2 +-
> arch/arm64/boot/dts/mediatek/mt8186-corsola.dtsi | 6 +-
> arch/arm64/boot/dts/ti/k3-am62-verdin.dtsi | 2 +-
> arch/powerpc/Kconfig | 4 +-
> arch/powerpc/Makefile | 13 +--
> arch/powerpc/kernel/vdso/Makefile | 8 +-
> arch/s390/kernel/entry.S | 4 +
> arch/s390/kernel/kprobes.c | 6 ++
> arch/s390/kernel/stacktrace.c | 2 +-
> drivers/android/binder.c | 64 ++++++++++---
> drivers/base/core.c | 55 +++++------
> drivers/block/zram/zram_drv.c | 7 ++
> drivers/clk/qcom/gcc-qcs404.c | 1 +
> drivers/cpufreq/scmi-cpufreq.c | 4 +-
> drivers/firmware/efi/libstub/efi-stub.c | 2 +-
> drivers/gpu/drm/Kconfig | 2 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 2 +-
> drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c | 6 +-
> drivers/gpu/drm/amd/amdgpu/nbio_v7_11.c | 9 ++
> drivers/gpu/drm/amd/amdkfd/kfd_kernel_queue.c | 2 +-
> drivers/gpu/drm/amd/display/dc/core/dc.c | 3 +
> .../gpu/drm/amd/display/dc/dccg/dcn35/dcn35_dccg.c | 15 +--
> .../amd/display/dc/dml2/dml2_dc_resource_mgmt.c | 23 ++++-
> .../amd/include/asic_reg/nbio/nbio_7_11_0_offset.h | 2 +
> .../include/asic_reg/nbio/nbio_7_11_0_sh_mask.h | 13 +++
> drivers/gpu/drm/amd/pm/swsmu/amdgpu_smu.c | 8 +-
> drivers/gpu/drm/amd/pm/swsmu/inc/smu_v14_0.h | 2 +-
> drivers/gpu/drm/amd/pm/swsmu/smu11/arcturus_ppt.c | 6 +-
> .../gpu/drm/amd/pm/swsmu/smu13/smu_v13_0_7_ppt.c | 2 +
> drivers/gpu/drm/amd/pm/swsmu/smu14/smu_v14_0.c | 2 +-
> .../gpu/drm/amd/pm/swsmu/smu14/smu_v14_0_2_ppt.c | 37 ++++++--
> drivers/gpu/drm/bridge/ite-it6505.c | 8 +-
> drivers/gpu/drm/drm_atomic_helper.c | 2 +-
> drivers/gpu/drm/etnaviv/etnaviv_buffer.c | 3 +-
> drivers/gpu/drm/mediatek/mtk_drm_drv.c | 4 +-
> drivers/gpu/drm/panel/panel-jadard-jd9365da-h3.c | 1 -
> drivers/gpu/drm/radeon/radeon_connectors.c | 10 --
> drivers/gpu/drm/sti/sti_cursor.c | 3 +
> drivers/gpu/drm/sti/sti_gdp.c | 3 +
> drivers/gpu/drm/sti/sti_hqvdp.c | 3 +
> drivers/gpu/drm/xe/xe_guc_ads.c | 14 +++
> drivers/gpu/drm/xe/xe_guc_submit.c | 17 +++-
> drivers/gpu/drm/xe/xe_migrate.c | 6 +-
> drivers/gpu/drm/xlnx/zynqmp_kms.c | 4 +-
> drivers/i3c/master.c | 2 +-
> drivers/i3c/master/svc-i3c-master.c | 39 +++++---
> drivers/iio/accel/kionix-kx022a.c | 2 +-
> drivers/iio/adc/ad7780.c | 2 +-
> drivers/iio/adc/ad7923.c | 4 +-
> .../iio/common/inv_sensors/inv_sensors_timestamp.c | 4 +
> drivers/iio/imu/inv_icm42600/inv_icm42600_accel.c | 2 -
> drivers/iio/imu/inv_icm42600/inv_icm42600_gyro.c | 3 -
> drivers/iio/imu/inv_mpu6050/inv_mpu_trigger.c | 1 -
> drivers/iio/industrialio-gts-helper.c | 2 +-
> drivers/iio/inkern.c | 2 +-
> drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c | 2 +
> drivers/iommu/arm/arm-smmu/arm-smmu.c | 11 +++
> drivers/iommu/io-pgtable-arm.c | 18 +++-
> drivers/leds/flash/leds-mt6360.c | 3 +-
> drivers/leds/leds-lp55xx-common.c | 3 -
> drivers/md/dm-thin.c | 1 +
> drivers/md/md-bitmap.c | 1 +
> drivers/md/persistent-data/dm-space-map-common.c | 2 +-
> drivers/md/raid5.c | 4 +
> drivers/media/dvb-frontends/ts2020.c | 8 +-
> drivers/media/i2c/dw9768.c | 10 +-
> drivers/media/i2c/ov08x40.c | 33 ++++++-
> drivers/media/i2c/tc358743.c | 4 +-
> drivers/media/platform/allegro-dvt/allegro-core.c | 4 +-
> drivers/media/platform/amphion/vpu_drv.c | 2 +-
> drivers/media/platform/amphion/vpu_v4l2.c | 2 +-
> .../media/platform/mediatek/jpeg/mtk_jpeg_core.c | 10 ++
> .../media/platform/mediatek/jpeg/mtk_jpeg_dec_hw.c | 11 ---
> drivers/media/platform/nxp/imx-jpeg/mxc-jpeg.c | 4 +-
> drivers/media/platform/qcom/camss/camss.c | 19 ++--
> drivers/media/platform/qcom/venus/core.c | 2 +-
> drivers/media/platform/rockchip/rga/rga.c | 2 +-
> .../media/platform/samsung/exynos4-is/media-dev.h | 5 +-
> .../verisilicon/rockchip_vpu981_hw_av1_dec.c | 3 +-
> drivers/media/usb/gspca/ov534.c | 2 +-
> drivers/media/usb/uvc/uvc_driver.c | 102 +++++++++++++++------
> drivers/mtd/nand/spi/winbond.c | 16 ++--
> drivers/net/ethernet/freescale/fec_ptp.c | 11 ++-
> drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +
> drivers/net/netkit.c | 68 +++++++++++---
> drivers/net/phy/dp83869.c | 20 +++-
> drivers/nvmem/core.c | 2 +-
> drivers/pci/controller/dwc/pci-imx6.c | 57 +++++++++---
> drivers/pci/controller/dwc/pci-keystone.c | 12 +++
> drivers/pci/controller/dwc/pcie-designware-ep.c | 2 +-
> drivers/pci/controller/dwc/pcie-qcom.c | 2 +-
> drivers/pci/controller/pcie-rockchip-ep.c | 16 +++-
> drivers/pci/controller/pcie-rockchip.h | 4 +
> drivers/pci/endpoint/pci-epc-core.c | 11 +--
> drivers/pci/of_property.c | 2 +-
> drivers/remoteproc/qcom_q6v5_pas.c | 2 +-
> drivers/spmi/spmi-pmic-arb.c | 3 +-
> .../intel/int340x_thermal/int3400_thermal.c | 2 +-
> drivers/ufs/host/ufs-exynos.c | 23 +++--
> drivers/vfio/pci/qat/main.c | 2 +-
> fs/btrfs/btrfs_inode.h | 12 ++-
> fs/btrfs/ctree.c | 6 +-
> fs/btrfs/extent-tree.c | 2 +-
> fs/btrfs/inode.c | 94 ++++++++++---------
> fs/btrfs/ioctl.c | 32 ++++++-
> fs/btrfs/ref-verify.c | 1 +
> fs/btrfs/send.c | 2 +-
> fs/ceph/mds_client.c | 7 +-
> fs/ceph/super.c | 10 +-
> fs/f2fs/segment.c | 16 ++--
> fs/f2fs/super.c | 12 +++
> fs/nfsd/export.c | 5 +-
> fs/nfsd/nfs4state.c | 19 ++++
> fs/overlayfs/inode.c | 7 +-
> fs/overlayfs/util.c | 3 +
> fs/proc/kcore.c | 1 +
> fs/quota/dquot.c | 2 +
> fs/xfs/libxfs/xfs_sb.c | 7 --
> include/drm/drm_panic.h | 14 +++
> include/linux/kasan.h | 12 ++-
> include/linux/util_macros.h | 56 +++++++----
> include/uapi/linux/if_link.h | 15 +++
> kernel/signal.c | 9 +-
> kernel/trace/ftrace.c | 7 ++
> lib/kunit/debugfs.c | 5 +-
> lib/kunit/kunit-test.c | 2 +
> lib/maple_tree.c | 13 ++-
> mm/damon/tests/vaddr-kunit.h | 1 +
> mm/damon/vaddr.c | 4 +-
> mm/kasan/shadow.c | 14 ++-
> mm/slab.h | 5 +
> mm/slab_common.c | 2 +-
> mm/slub.c | 9 +-
> mm/vmalloc.c | 34 +++++--
> mm/vmstat.c | 1 +
> tools/perf/pmu-events/empty-pmu-events.c | 12 +--
> tools/perf/pmu-events/jevents.py | 12 +--
> 143 files changed, 1071 insertions(+), 434 deletions(-)
>
>
>
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (146 preceding siblings ...)
2024-12-06 16:34 ` [PATCH 6.12 000/146] 6.12.4-rc1 review Luna Jernberg
@ 2024-12-06 18:05 ` Mark Brown
2024-12-06 23:08 ` Florian Fainelli
` (5 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Mark Brown @ 2024-12-06 18:05 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar
[-- Attachment #1: Type: text/plain, Size: 345 bytes --]
On Fri, Dec 06, 2024 at 03:35:31PM +0100, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Tested-by: Mark Brown <broonie@kernel.org>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (147 preceding siblings ...)
2024-12-06 18:05 ` Mark Brown
@ 2024-12-06 23:08 ` Florian Fainelli
2024-12-06 23:58 ` Peter Schneider
` (4 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Florian Fainelli @ 2024-12-06 23:08 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, sudipm.mukherjee, srw, rwarsow,
conor, hargar, broonie
On 12/6/24 06:35, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
On ARCH_BRCMSTB using 32-bit and 64-bit ARM kernels, build tested on
BMIPS_GENERIC:
Tested-by: Florian Fainelli <florian.fainelli@broadcom.com>
--
Florian
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (148 preceding siblings ...)
2024-12-06 23:08 ` Florian Fainelli
@ 2024-12-06 23:58 ` Peter Schneider
2024-12-07 5:04 ` Takeshi Ogasawara
` (3 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Peter Schneider @ 2024-12-06 23:58 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, hargar, broonie
Am 06.12.2024 um 15:35 schrieb Greg Kroah-Hartman:
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
Builds, boots and works on my 2-socket Ivy Bridge Xeon E5-2697 v2 server. No dmesg
oddities or regressions found.
Tested-by: Peter Schneider <pschneider1968@googlemail.com>
Beste Grüße,
Peter Schneider
--
Climb the mountain not to plant your flag, but to embrace the challenge,
enjoy the air and behold the view. Climb it so you can see the world,
not so the world can see you. -- David McCullough Jr.
OpenPGP: 0xA3828BD796CCE11A8CADE8866E3A92C92C3FF244
Download: https://www.peters-netzplatz.de/download/pschneider1968_pub.asc
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@googlemail.com
https://keys.mailvelope.com/pks/lookup?op=get&search=pschneider1968@gmail.com
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (149 preceding siblings ...)
2024-12-06 23:58 ` Peter Schneider
@ 2024-12-07 5:04 ` Takeshi Ogasawara
2024-12-07 7:45 ` Ron Economos
` (2 subsequent siblings)
153 siblings, 0 replies; 157+ messages in thread
From: Takeshi Ogasawara @ 2024-12-07 5:04 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
Hi Greg
On Fri, Dec 6, 2024 at 11:39 PM Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
6.12.4-rc1 tested.
Build successfully completed.
Boot successfully completed.
No dmesg regressions.
Video output normal.
Sound output normal.
Lenovo ThinkPad X1 Carbon Gen10(Intel i7-1260P(x86_64) arch linux)
Linux version 6.12.4-rc1rv (takeshi@ThinkPadX1Gen10J0764) (gcc (GCC)
14.2.1 20240910, GNU ld (GNU Binutils) 2.43.0) #1 SMP PREEMPT_DYNAMIC
Sat Dec 7 13:07:21 JST 2024
Thanks
Tested-by: Takeshi Ogasawara <takeshi.ogasawara@futuring-girl.com>
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (150 preceding siblings ...)
2024-12-07 5:04 ` Takeshi Ogasawara
@ 2024-12-07 7:45 ` Ron Economos
2024-12-07 9:02 ` Muhammad Usama Anjum
2024-12-07 19:30 ` Naresh Kamboju
153 siblings, 0 replies; 157+ messages in thread
From: Ron Economos @ 2024-12-07 7:45 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: patches, linux-kernel, torvalds, akpm, linux, shuah, patches,
lkft-triage, pavel, jonathanh, f.fainelli, sudipm.mukherjee, srw,
rwarsow, conor, hargar, broonie
On 12/6/24 06:35, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Built and booted successfully on RISC-V RV64 (HiFive Unmatched).
Tested-by: Ron Economos <re@w6rz.net>
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (151 preceding siblings ...)
2024-12-07 7:45 ` Ron Economos
@ 2024-12-07 9:02 ` Muhammad Usama Anjum
2024-12-07 19:30 ` Naresh Kamboju
153 siblings, 0 replies; 157+ messages in thread
From: Muhammad Usama Anjum @ 2024-12-07 9:02 UTC (permalink / raw)
To: Greg Kroah-Hartman, stable
Cc: Usama.Anjum, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
On 12/6/24 7:35 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>
> -------------
OVERVIEW
Builds: 29 passed, 0 failed
Boot tests: 70 passed, 1 failed
CI systems: maestro
REVISION
Commit
name: v6.12.3-146-ge572189f6a25
hash: 91ba615b0f093358fd3961fb76f3479193cd18f6
Checked out from
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
BUILDS
No build failures found
BOOT TESTS
Failures
i386:(defconfig)
-hp-14b-na0052xx-zork
CI system: maestro
UBSAN: shift-out-of-bounds in drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c:1333:47
https://kcidb.kernelci.org/d/test/test?var-datasource=edquppk2ghfcwc&var-origin=maestro&var-build_architecture=$__all&var-build_config_name=$__all&var-id=maestro:6753358b6de2c3ffbb72658a&from=now-100y&to=now&timezone=browser&var-test_path=&var-issue_presence=$__all
See complete and up-to-date report at:
https://kcidb.kernelci.org/d/revision/revision?orgId=1&var-git_commit_hash=91ba615b0f093358fd3961fb76f3479193cd18f6&var-patchset_hash=
Tested-by: kernelci.org bot <bot@kernelci.org>
Thanks,
KernelCI team
^ permalink raw reply [flat|nested] 157+ messages in thread* Re: [PATCH 6.12 000/146] 6.12.4-rc1 review
2024-12-06 14:35 [PATCH 6.12 000/146] 6.12.4-rc1 review Greg Kroah-Hartman
` (152 preceding siblings ...)
2024-12-07 9:02 ` Muhammad Usama Anjum
@ 2024-12-07 19:30 ` Naresh Kamboju
153 siblings, 0 replies; 157+ messages in thread
From: Naresh Kamboju @ 2024-12-07 19:30 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: stable, patches, linux-kernel, torvalds, akpm, linux, shuah,
patches, lkft-triage, pavel, jonathanh, f.fainelli,
sudipm.mukherjee, srw, rwarsow, conor, hargar, broonie
On Fri, 6 Dec 2024 at 20:09, Greg Kroah-Hartman
<gregkh@linuxfoundation.org> wrote:
>
> This is the start of the stable review cycle for the 6.12.4 release.
> There are 146 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sun, 08 Dec 2024 14:34:52 +0000.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v6.x/stable-review/patch-6.12.4-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-6.12.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.
Tested-by: Linux Kernel Functional Testing <lkft@linaro.org>
## Build
* kernel: 6.12.4-rc1
* git: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
* git commit: 91ba615b0f093358fd3961fb76f3479193cd18f6
* git describe: v6.12.3-147-g91ba615b0f09
* test details:
https://qa-reports.linaro.org/lkft/linux-stable-rc-linux-6.12.y/build/v6.12.3-147-g91ba615b0f09
## Test Regressions (compared to v6.12.1-827-g1b3321bcbfba)
## Metric Regressions (compared to v6.12.1-827-g1b3321bcbfba)
## Test Fixes (compared to v6.12.1-827-g1b3321bcbfba)
## Metric Fixes (compared to v6.12.1-827-g1b3321bcbfba)
## Test result summary
total: 158647, pass: 131960, fail: 2855, skip: 23832, xfail: 0
## Build Summary
* arc: 5 total, 5 passed, 0 failed
* arm: 138 total, 136 passed, 2 failed
* arm64: 52 total, 52 passed, 0 failed
* i386: 18 total, 18 passed, 0 failed
* mips: 34 total, 33 passed, 1 failed
* parisc: 4 total, 3 passed, 1 failed
* powerpc: 40 total, 39 passed, 1 failed
* riscv: 24 total, 23 passed, 1 failed
* s390: 22 total, 21 passed, 1 failed
* sh: 5 total, 5 passed, 0 failed
* sparc: 4 total, 3 passed, 1 failed
* x86_64: 44 total, 44 passed, 0 failed
## Test suites summary
* boot
* commands
* kselftest-arm64
* kselftest-breakpoints
* kselftest-capabilities
* kselftest-cgroup
* kselftest-clone3
* kselftest-core
* kselftest-cpu-hotplug
* kselftest-cpufreq
* kselftest-efivarfs
* kselftest-exec
* kselftest-filesystems
* kselftest-filesystems-binderfs
* kselftest-filesystems-epoll
* kselftest-firmware
* kselftest-fpu
* kselftest-ftrace
* kselftest-futex
* kselftest-gpio
* kselftest-intel_pstate
* kselftest-ipc
* kselftest-kcmp
* kselftest-kvm
* kselftest-livepatch
* kselftest-membarrier
* kselftest-memfd
* kselftest-mincore
* kselftest-mqueue
* kselftest-net
* kselftest-net-mptcp
* kselftest-openat2
* kselftest-ptrace
* kselftest-rseq
* kselftest-rtc
* kselftest-rust
* kselftest-seccomp
* kselftest-sigaltstack
* kselftest-size
* kselftest-tc-testing
* kselftest-timers
* kselftest-tmpfs
* kselftest-tpm2
* kselftest-user_events
* kselftest-vDSO
* kselftest-watchdog
* kselftest-x86
* kunit
* kvm-unit-tests
* libgpiod
* libhugetlbfs
* log-parser-boot
* log-parser-test
* ltp-commands
* ltp-containers
* ltp-controllers
* ltp-crypto
* ltp-cve
* ltp-dio
* ltp-fcntl-locktests
* ltp-filecaps
* ltp-fs
* ltp-fs_bind
* ltp-fs_perms_simple
* ltp-hugetlb
* ltp-ipc
* ltp-math
* ltp-mm
* ltp-nptl
* ltp-pty
* ltp-sched
* ltp-smoke
* ltp-syscalls
* ltp-tracing
* perf
* rcutorture
--
Linaro LKFT
https://lkft.linaro.org
^ permalink raw reply [flat|nested] 157+ messages in thread