From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAAFCC433EF for ; Wed, 15 Dec 2021 17:29:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245582AbhLOR30 (ORCPT ); Wed, 15 Dec 2021 12:29:26 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43074 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235573AbhLOR0G (ORCPT ); Wed, 15 Dec 2021 12:26:06 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A84F8B81F1C; Wed, 15 Dec 2021 17:26:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFAA2C36AE4; Wed, 15 Dec 2021 17:26:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589163; bh=uQ71ymvsLObC1MxyD5OYIQF7b6+fPeug+XJ63B3dg4o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kd+MZnWuNHVGIROWsBDkxogzgG6e+g3q2z2a1KGbTSrSI3ofe2aRONrJ6mepLgD9X 83/TymGZk2jsnFrNXyuWske0mZuh1U9gc1FCN65bHrZsJJD7pobfdTdsZIdMuoiw4m RGNJrPO27fUXvfWhkvz1p/25tznJy9Q9hUlcTe1g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com, Tadeusz Struk , Krzysztof Kozlowski , Jakub Kicinski Subject: [PATCH 5.4 01/18] nfc: fix segfault in nfc_genl_dump_devices_done Date: Wed, 15 Dec 2021 18:21:22 +0100 Message-Id: <20211215172022.845618851@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tadeusz Struk commit fd79a0cbf0b2e34bcc45b13acf962e2032a82203 upstream. When kmalloc in nfc_genl_dump_devices() fails then nfc_genl_dump_devices_done() segfaults as below KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 PID: 25 Comm: kworker/0:1 Not tainted 5.16.0-rc4-01180-g2a987e65025e= -dirty #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-6.fc35 0= 4/01/2014 Workqueue: events netlink_sock_destruct_work RIP: 0010:klist_iter_exit+0x26/0x80 Call Trace: class_dev_iter_exit+0x15/0x20 nfc_genl_dump_devices_done+0x3b/0x50 genl_lock_done+0x84/0xd0 netlink_sock_destruct+0x8f/0x270 __sk_destruct+0x64/0x3b0 sk_destruct+0xa8/0xd0 __sk_free+0x2e8/0x3d0 sk_free+0x51/0x90 netlink_sock_destruct_work+0x1c/0x20 process_one_work+0x411/0x710 worker_thread+0x6fd/0xa80 Link: https://syzkaller.appspot.com/bug?id=3Dfc0fa5a53db9edd261d56e74325419= faf18bd0df Reported-by: syzbot+f9f76f4a0766420b4a02@syzkaller.appspotmail.com Signed-off-by: Tadeusz Struk Reviewed-by: Krzysztof Kozlowski Link: https://lore.kernel.org/r/20211208182742.340542-1-tadeusz.struk@linar= o.org Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- net/nfc/netlink.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/net/nfc/netlink.c +++ b/net/nfc/netlink.c @@ -644,8 +644,10 @@ static int nfc_genl_dump_devices_done(st { struct class_dev_iter *iter =3D (struct class_dev_iter *) cb->args[0]; =20 - nfc_device_iter_exit(iter); - kfree(iter); + if (iter) { + nfc_device_iter_exit(iter); + kfree(iter); + } =20 return 0; } From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55899C433F5 for ; Wed, 15 Dec 2021 17:27:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232052AbhLOR1u (ORCPT ); Wed, 15 Dec 2021 12:27:50 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47184 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245720AbhLOR03 (ORCPT ); Wed, 15 Dec 2021 12:26:29 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5CE9F61A1D; Wed, 15 Dec 2021 17:26:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3B857C36AF5; Wed, 15 Dec 2021 17:26:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589188; bh=GQokSa4i+2CGdyoT/xYJ7/ZpQkkuAmTHc9GaFqI9gjM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EjeEElBbCtaIJEmx1Ttb+UIGJjS1ar4acze3iRxnHSVrfu8hLuKpvEehPkZWc3IdD whukdVQn3DGp1XhQ5Mtl60gFvT4W87AyG5SgI/7kPP5KaYuFtq6bE16wOD4EMcPXRt egJl3h5BZMoQUhKhGFwnFVr9DbOBpCH+Wu3IwNso= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Philip Chen , Douglas Anderson , Stephen Boyd , Rob Clark , Sasha Levin Subject: [PATCH 5.4 02/18] drm/msm/dsi: set default num_data_lanes Date: Wed, 15 Dec 2021 18:21:23 +0100 Message-Id: <20211215172022.885526193@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Philip Chen [ Upstream commit cd92cc187c053ab010a1570e2d61d68394a5c725 ] If "data_lanes" property of the dsi output endpoint is missing in the DT, num_data_lanes would be 0 by default, which could cause dsi_host_attach() to fail if dsi->lanes is set to a non-zero value by the bridge driver. According to the binding document of msm dsi controller, the input/output endpoint of the controller is expected to have 4 lanes. So let's set num_data_lanes to 4 by default. Signed-off-by: Philip Chen Reviewed-by: Douglas Anderson Reviewed-by: Stephen Boyd Link: https://lore.kernel.org/r/20211030100812.1.I6cd9af36b723fed277d34539d= 3b2ba4ca233ad2d@changeid Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/gpu/drm/msm/dsi/dsi_host.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/d= si_host.c index 5613234823f7d..423c4ae2be10d 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_host.c +++ b/drivers/gpu/drm/msm/dsi/dsi_host.c @@ -1669,6 +1669,8 @@ static int dsi_host_parse_lane_data(struct msm_dsi_ho= st *msm_host, if (!prop) { DRM_DEV_DEBUG(dev, "failed to find data lane mapping, using default\n"); + /* Set the number of date lanes to 4 by default. */ + msm_host->num_data_lanes =3D 4; return 0; } =20 --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8BD4C433F5 for ; Wed, 15 Dec 2021 17:27:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238684AbhLOR1w (ORCPT ); Wed, 15 Dec 2021 12:27:52 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47230 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343902AbhLOR0c (ORCPT ); Wed, 15 Dec 2021 12:26:32 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A0EE619F2; Wed, 15 Dec 2021 17:26:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0CBFAC36AE0; Wed, 15 Dec 2021 17:26:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589191; bh=sX7UhzPJ4H9WBt7wxIbx9QexK09hqwkNtTwVlGFbYx8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JQVdtRPYtzOm4ODptbEqEmYWp9vT2YkqXQXqFjsMlM5NKMwy9bjdE3vIJkEaj1W4u NCZ/v/+9uX+bBHpMjx3jPX0yN6zUHnjzQdbdRDDPIj9jzXfpG4f/QPwKYYdSucZsgX y3PPFDK5EZxkHFER07rjkAJbIc1v4IETDlvjmitg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Stapelberg , Erik Ekman , Tariq Toukan , "David S. Miller" , Sasha Levin Subject: [PATCH 5.4 03/18] net/mlx4_en: Update reported link modes for 1/10G Date: Wed, 15 Dec 2021 18:21:24 +0100 Message-Id: <20211215172022.926003439@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Erik Ekman [ Upstream commit 2191b1dfef7d45f44b5008d2148676d9f2c82874 ] When link modes were initially added in commit 2c762679435dc ("net/mlx4_en: Use PTYS register to query ethtool settings") and later updated for the new ethtool API in commit 3d8f7cc78d0eb ("net: mlx4: use new ETHTOOL_G/SSETTINGS API") the only 1/10G non-baseT link modes configured were 1000baseKX, 10000baseKX4 and 10000baseKR. It looks like these got picked to represent other modes since nothing better was available. Switch to using more specific link modes added in commit 5711a98221443 ("net: ethtool: add support for 1000BaseX and missing 10G link modes"). Tested with MCX311A-XCAT connected via DAC. Before: % sudo ethtool enp3s0 Settings for enp3s0: Supported ports: [ FIBRE ] Supported link modes: 1000baseKX/Full 10000baseKR/Full Supported pause frame use: Symmetric Receive-only Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: 1000baseKX/Full 10000baseKR/Full Advertised pause frame use: Symmetric Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: 10000Mb/s Duplex: Full Auto-negotiation: off Port: Direct Attach Copper PHYAD: 0 Transceiver: internal Supports Wake-on: d Wake-on: d Current message level: 0x00000014 (20) link ifdown Link detected: yes With this change: % sudo ethtool enp3s0 Settings for enp3s0: Supported ports: [ FIBRE ] Supported link modes: 1000baseX/Full 10000baseCR/Full 10000baseSR/Full Supported pause frame use: Symmetric Receive-only Supports auto-negotiation: No Supported FEC modes: Not reported Advertised link modes: 1000baseX/Full 10000baseCR/Full 10000baseSR/Full Advertised pause frame use: Symmetric Advertised auto-negotiation: No Advertised FEC modes: Not reported Speed: 10000Mb/s Duplex: Full Auto-negotiation: off Port: Direct Attach Copper PHYAD: 0 Transceiver: internal Supports Wake-on: d Wake-on: d Current message level: 0x00000014 (20) link ifdown Link detected: yes Tested-by: Michael Stapelberg Signed-off-by: Erik Ekman Reviewed-by: Tariq Toukan Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/net/ethernet/mellanox/mlx4/en_ethtool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/= ethernet/mellanox/mlx4/en_ethtool.c index 426786a349c3c..dd029d91bbc2d 100644 --- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c @@ -663,7 +663,7 @@ void __init mlx4_en_init_ptys2ethtool_map(void) MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_T, SPEED_1000, ETHTOOL_LINK_MODE_1000baseT_Full_BIT); MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_CX_SGMII, SPEED_1000, - ETHTOOL_LINK_MODE_1000baseKX_Full_BIT); + ETHTOOL_LINK_MODE_1000baseX_Full_BIT); MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_1000BASE_KX, SPEED_1000, ETHTOOL_LINK_MODE_1000baseKX_Full_BIT); MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_T, SPEED_10000, @@ -675,9 +675,9 @@ void __init mlx4_en_init_ptys2ethtool_map(void) MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_KR, SPEED_10000, ETHTOOL_LINK_MODE_10000baseKR_Full_BIT); MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_CR, SPEED_10000, - ETHTOOL_LINK_MODE_10000baseKR_Full_BIT); + ETHTOOL_LINK_MODE_10000baseCR_Full_BIT); MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_10GBASE_SR, SPEED_10000, - ETHTOOL_LINK_MODE_10000baseKR_Full_BIT); + ETHTOOL_LINK_MODE_10000baseSR_Full_BIT); MLX4_BUILD_PTYS2ETHTOOL_CONFIG(MLX4_20GBASE_KR2, SPEED_20000, ETHTOOL_LINK_MODE_20000baseMLD2_Full_BIT, ETHTOOL_LINK_MODE_20000baseKR2_Full_BIT); --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 09B60C433EF for ; Wed, 15 Dec 2021 17:29:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245671AbhLOR3k (ORCPT ); Wed, 15 Dec 2021 12:29:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35756 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344134AbhLOR1Q (ORCPT ); Wed, 15 Dec 2021 12:27:16 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F636C061A72; Wed, 15 Dec 2021 09:26:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E49CF619E8; Wed, 15 Dec 2021 17:26:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9D60C36AE2; Wed, 15 Dec 2021 17:26:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589194; bh=eDprUhMM8vftWzn2Cl89AMWfd58wb49TmTCNevGQdHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oA7R9uQGl3//oWNC8UTODpqOanGR3yEThiJokD41o7eKG9rm7BsmCOIhJUathAlIq YMp0aKWCqck+2w4Pj7VNHCqSIcR1POP+8iNEQOoZ1qeSJNTx3m1OhTZcmqHxpFUIyJ yUJEd9Vhr5ymxD5v9BPMWHgAMRw7OjfItm2WOnGE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller , kernel test robot , Sasha Levin Subject: [PATCH 5.4 04/18] parisc/agp: Annotate parisc agp init functions with __init Date: Wed, 15 Dec 2021 18:21:25 +0100 Message-Id: <20211215172022.959076270@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller [ Upstream commit 8d88382b7436551a9ebb78475c546b670790cbf6 ] Signed-off-by: Helge Deller Reported-by: kernel test robot Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/char/agp/parisc-agp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/char/agp/parisc-agp.c b/drivers/char/agp/parisc-agp.c index ed3c4c42fc23b..d68d05d5d3838 100644 --- a/drivers/char/agp/parisc-agp.c +++ b/drivers/char/agp/parisc-agp.c @@ -281,7 +281,7 @@ agp_ioc_init(void __iomem *ioc_regs) return 0; } =20 -static int +static int __init lba_find_capability(int cap) { struct _parisc_agp_info *info =3D &parisc_agp_info; @@ -366,7 +366,7 @@ parisc_agp_setup(void __iomem *ioc_hpa, void __iomem *l= ba_hpa) return error; } =20 -static int +static int __init find_quicksilver(struct device *dev, void *data) { struct parisc_device **lba =3D data; @@ -378,7 +378,7 @@ find_quicksilver(struct device *dev, void *data) return 0; } =20 -static int +static int __init parisc_agp_init(void) { extern struct sba_device *sba_list; --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 81C6BC433EF for ; Wed, 15 Dec 2021 17:28:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234826AbhLOR2B (ORCPT ); Wed, 15 Dec 2021 12:28:01 -0500 Received: from ams.source.kernel.org ([145.40.68.75]:43388 "EHLO ams.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245681AbhLOR0j (ORCPT ); Wed, 15 Dec 2021 12:26:39 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 51876B82029; Wed, 15 Dec 2021 17:26:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97595C36AE3; Wed, 15 Dec 2021 17:26:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589197; bh=ieMRINSLQZOaXtUuMPBG7qs30pirXAP4drjmkWcEZrE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H/Edioqusbjk1kWegEPM8v0Y57UwSWFCuJGHwTWYnDAmZQv6vuqmvF0V1oG1xnLbG NgDIBl/eF2YVjtZNZ3NnlCopY/9GJnnvSQKRqCA2BQulnpVWDcBqoR3zFHudsohk8g DG4ucUfrRqtOWAE2PyTCbZOB3rvfAEue/wQhMDI0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ondrej Jirman , John Keeping , Wolfram Sang , Sasha Levin Subject: [PATCH 5.4 05/18] i2c: rk3x: Handle a spurious start completion interrupt flag Date: Wed, 15 Dec 2021 18:21:26 +0100 Message-Id: <20211215172022.997127046@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ondrej Jirman [ Upstream commit 02fe0fbd8a21e183687925c3a266ae27dda9840f ] In a typical read transfer, start completion flag is being set after read finishes (notice ipd bit 4 being set): trasnfer poll=3D0 i2c start rk3x-i2c fdd40000.i2c: IRQ: state 1, ipd: 10 i2c read rk3x-i2c fdd40000.i2c: IRQ: state 2, ipd: 1b i2c stop rk3x-i2c fdd40000.i2c: IRQ: state 4, ipd: 33 This causes I2C transfer being aborted in polled mode from a stop completion handler: trasnfer poll=3D1 i2c start rk3x-i2c fdd40000.i2c: IRQ: state 1, ipd: 10 i2c read rk3x-i2c fdd40000.i2c: IRQ: state 2, ipd: 0 rk3x-i2c fdd40000.i2c: IRQ: state 2, ipd: 1b i2c stop rk3x-i2c fdd40000.i2c: IRQ: state 4, ipd: 13 i2c stop rk3x-i2c fdd40000.i2c: unexpected irq in STOP: 0x10 Clearing the START flag after read fixes the issue without any obvious side effects. This issue was dicovered on RK3566 when adding support for powering off the RK817 PMIC. Signed-off-by: Ondrej Jirman Reviewed-by: John Keeping Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/i2c/busses/i2c-rk3x.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/i2c/busses/i2c-rk3x.c b/drivers/i2c/busses/i2c-rk3x.c index 1a33007b03e9e..1107a5e7229e4 100644 --- a/drivers/i2c/busses/i2c-rk3x.c +++ b/drivers/i2c/busses/i2c-rk3x.c @@ -422,8 +422,8 @@ static void rk3x_i2c_handle_read(struct rk3x_i2c *i2c, = unsigned int ipd) if (!(ipd & REG_INT_MBRF)) return; =20 - /* ack interrupt */ - i2c_writel(i2c, REG_INT_MBRF, REG_IPD); + /* ack interrupt (read also produces a spurious START flag, clear it too)= */ + i2c_writel(i2c, REG_INT_MBRF | REG_INT_START, REG_IPD); =20 /* Can only handle a maximum of 32 bytes at a time */ if (len > 32) --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0246C433EF for ; Wed, 15 Dec 2021 17:29:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245558AbhLOR3h (ORCPT ); Wed, 15 Dec 2021 12:29:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344172AbhLOR1T (ORCPT ); Wed, 15 Dec 2021 12:27:19 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 61EEBC061B38; Wed, 15 Dec 2021 09:26:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2CF2DB8202B; Wed, 15 Dec 2021 17:26:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6EDECC36AE0; Wed, 15 Dec 2021 17:26:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589200; bh=GljZQAYQaPdwuLlC83Tu22QFdiowAkNukuHcVIvkNkQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=by2VbiAL+GRoFUH4OruejpvSHhKe9bY41lMf3FtXVhrZnDsieh/MdOYw607uBG5WS 6a585uXOgSaVETL1bFc6L66DiXE6RHb3ymLJhuHAmFPp9c5xPJ4F+YglLG/N+uWH+0 K30gafGx0m5LDM5l4NaTuQwtO8ixesoYPGftzFao= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzkaller , Harshit Mogalapalli , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.4 06/18] net: netlink: af_netlink: Prevent empty skb by adding a check on len. Date: Wed, 15 Dec 2021 18:21:27 +0100 Message-Id: <20211215172023.027312030@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harshit Mogalapalli [ Upstream commit f123cffdd8fe8ea6c7fded4b88516a42798797d0 ] Adding a check on len parameter to avoid empty skb. This prevents a division error in netem_enqueue function which is caused when skb->len=3D0 and skb->data_len=3D0 in the randomized corruption step as shown below. skb->data[prandom_u32() % skb_headlen(skb)] ^=3D 1<<(prandom_u32() % 8); Crash Report: [ 343.170349] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 343.216110] netem: version 1.3 [ 343.235841] divide error: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 343.236680] CPU: 3 PID: 4288 Comm: reproducer Not tainted 5.16.0-rc1+ [ 343.237569] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 [ 343.238707] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem] [ 343.239499] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f 74 f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03 [ 343.241883] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246 [ 343.242589] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX: 0000000000000000 [ 343.243542] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI: ffff88800f8eda40 [ 343.244474] RBP: ffff88800bcd7458 R08: 0000000000000000 R09: ffffffff94fb8445 [ 343.245403] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12: 0000000000000000 [ 343.246355] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15: 0000000000000020 [ 343.247291] FS: 00007fdde2bd7700(0000) GS:ffff888109780000(0000) knlGS:0000000000000000 [ 343.248350] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 343.249120] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4: 00000000000006e0 [ 343.250076] Call Trace: [ 343.250423] [ 343.250713] ? memcpy+0x4d/0x60 [ 343.251162] ? netem_init+0xa0/0xa0 [sch_netem] [ 343.251795] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.252443] netem_enqueue+0xe28/0x33c0 [sch_netem] [ 343.253102] ? stack_trace_save+0x87/0xb0 [ 343.253655] ? filter_irq_stacks+0xb0/0xb0 [ 343.254220] ? netem_init+0xa0/0xa0 [sch_netem] [ 343.254837] ? __kasan_check_write+0x14/0x20 [ 343.255418] ? _raw_spin_lock+0x88/0xd6 [ 343.255953] dev_qdisc_enqueue+0x50/0x180 [ 343.256508] __dev_queue_xmit+0x1a7e/0x3090 [ 343.257083] ? netdev_core_pick_tx+0x300/0x300 [ 343.257690] ? check_kcov_mode+0x10/0x40 [ 343.258219] ? _raw_spin_unlock_irqrestore+0x29/0x40 [ 343.258899] ? __kasan_init_slab_obj+0x24/0x30 [ 343.259529] ? setup_object.isra.71+0x23/0x90 [ 343.260121] ? new_slab+0x26e/0x4b0 [ 343.260609] ? kasan_poison+0x3a/0x50 [ 343.261118] ? kasan_unpoison+0x28/0x50 [ 343.261637] ? __kasan_slab_alloc+0x71/0x90 [ 343.262214] ? memcpy+0x4d/0x60 [ 343.262674] ? write_comp_data+0x2f/0x90 [ 343.263209] ? __kasan_check_write+0x14/0x20 [ 343.263802] ? __skb_clone+0x5d6/0x840 [ 343.264329] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.264958] dev_queue_xmit+0x1c/0x20 [ 343.265470] netlink_deliver_tap+0x652/0x9c0 [ 343.266067] netlink_unicast+0x5a0/0x7f0 [ 343.266608] ? netlink_attachskb+0x860/0x860 [ 343.267183] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.267820] ? write_comp_data+0x2f/0x90 [ 343.268367] netlink_sendmsg+0x922/0xe80 [ 343.268899] ? netlink_unicast+0x7f0/0x7f0 [ 343.269472] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.270099] ? write_comp_data+0x2f/0x90 [ 343.270644] ? netlink_unicast+0x7f0/0x7f0 [ 343.271210] sock_sendmsg+0x155/0x190 [ 343.271721] ____sys_sendmsg+0x75f/0x8f0 [ 343.272262] ? kernel_sendmsg+0x60/0x60 [ 343.272788] ? write_comp_data+0x2f/0x90 [ 343.273332] ? write_comp_data+0x2f/0x90 [ 343.273869] ___sys_sendmsg+0x10f/0x190 [ 343.274405] ? sendmsg_copy_msghdr+0x80/0x80 [ 343.274984] ? slab_post_alloc_hook+0x70/0x230 [ 343.275597] ? futex_wait_setup+0x240/0x240 [ 343.276175] ? security_file_alloc+0x3e/0x170 [ 343.276779] ? write_comp_data+0x2f/0x90 [ 343.277313] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.277969] ? write_comp_data+0x2f/0x90 [ 343.278515] ? __fget_files+0x1ad/0x260 [ 343.279048] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.279685] ? write_comp_data+0x2f/0x90 [ 343.280234] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.280874] ? sockfd_lookup_light+0xd1/0x190 [ 343.281481] __sys_sendmsg+0x118/0x200 [ 343.281998] ? __sys_sendmsg_sock+0x40/0x40 [ 343.282578] ? alloc_fd+0x229/0x5e0 [ 343.283070] ? write_comp_data+0x2f/0x90 [ 343.283610] ? write_comp_data+0x2f/0x90 [ 343.284135] ? __sanitizer_cov_trace_pc+0x21/0x60 [ 343.284776] ? ktime_get_coarse_real_ts64+0xb8/0xf0 [ 343.285450] __x64_sys_sendmsg+0x7d/0xc0 [ 343.285981] ? syscall_enter_from_user_mode+0x4d/0x70 [ 343.286664] do_syscall_64+0x3a/0x80 [ 343.287158] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 343.287850] RIP: 0033:0x7fdde24cf289 [ 343.288344] Code: 01 00 48 81 c4 80 00 00 00 e9 f1 fe ff ff 0f 1f 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d b7 db 2c 00 f7 d8 64 89 01 48 [ 343.290729] RSP: 002b:00007fdde2bd6d98 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 343.291730] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fdde24cf289 [ 343.292673] RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000004 [ 343.293618] RBP: 00007fdde2bd6e20 R08: 0000000100000001 R09: 0000000000000000 [ 343.294557] R10: 0000000100000001 R11: 0000000000000246 R12: 0000000000000000 [ 343.295493] R13: 0000000000021000 R14: 0000000000000000 R15: 00007fdde2bd7700 [ 343.296432] [ 343.296735] Modules linked in: sch_netem ip6_vti ip_vti ip_gre ipip sit ip_tunnel geneve macsec macvtap tap ipvlan macvlan 8021q garp mrp hsr wireguard libchacha20poly1305 chacha_x86_64 poly1305_x86_64 ip6_udp_tunnel udp_tunnel libblake2s blake2s_x86_64 libblake2s_generic curve25519_x86_64 libcurve25519_generic libchacha xfrm_interface xfrm6_tunnel tunnel4 veth netdevsim psample batman_adv nlmon dummy team bonding tls vcan ip6_gre ip6_tunnel tunnel6 gre tun ip6t_rpfilter ipt_REJECT nf_reject_ipv4 ip6t_REJECT nf_reject_ipv6 xt_conntrack ip_set ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_security ip6table_raw iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_security iptable_raw ebtable_filter ebtables rfkill ip6table_filter ip6_tables iptable_filter ppdev bochs drm_vram_helper drm_ttm_helper ttm drm_kms_helper cec parport_pc drm joydev floppy parport sg syscopyarea sysfillrect sysimgblt i2c_piix4 qemu_fw_cfg fb_sys_fops pcspkr [ 343.297459] ip_tables xfs virtio_net net_failover failover sd_mod sr_mod cdrom t10_pi ata_generic pata_acpi ata_piix libata virtio_pci virtio_pci_legacy_dev serio_raw virtio_pci_modern_dev dm_mirror dm_region_hash dm_log dm_mod [ 343.311074] Dumping ftrace buffer: [ 343.311532] (ftrace buffer empty) [ 343.312040] ---[ end trace a2e3db5a6ae05099 ]--- [ 343.312691] RIP: 0010:netem_enqueue+0x1590/0x33c0 [sch_netem] [ 343.313481] Code: 89 85 58 ff ff ff e8 5f 5d e9 d3 48 8b b5 48 ff ff ff 8b 8d 50 ff ff ff 8b 85 58 ff ff ff 48 8b bd 70 ff ff ff 31 d2 2b 4f 74 f1 48 b8 00 00 00 00 00 fc ff df 49 01 d5 4c 89 e9 48 c1 e9 03 [ 343.315893] RSP: 0018:ffff88800bcd7368 EFLAGS: 00010246 [ 343.316622] RAX: 00000000ba7c0a9c RBX: 0000000000000001 RCX: 0000000000000000 [ 343.317585] RDX: 0000000000000000 RSI: ffff88800f8edb10 RDI: ffff88800f8eda40 [ 343.318549] RBP: ffff88800bcd7458 R08: 0000000000000000 R09: ffffffff94fb8445 [ 343.319503] R10: ffffffff94fb8336 R11: ffffffff94fb8445 R12: 0000000000000000 [ 343.320455] R13: ffff88800a5a7000 R14: ffff88800a5b5800 R15: 0000000000000020 [ 343.321414] FS: 00007fdde2bd7700(0000) GS:ffff888109780000(0000) knlGS:0000000000000000 [ 343.322489] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 343.323283] CR2: 00000000200000c0 CR3: 000000000ef4c000 CR4: 00000000000006e0 [ 343.324264] Kernel panic - not syncing: Fatal exception in interrupt [ 343.333717] Dumping ftrace buffer: [ 343.334175] (ftrace buffer empty) [ 343.334653] Kernel Offset: 0x13600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) [ 343.336027] Rebooting in 86400 seconds.. Reported-by: syzkaller Signed-off-by: Harshit Mogalapalli Link: https://lore.kernel.org/r/20211129175328.55339-1-harshit.m.mogalapall= i@oracle.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- net/netlink/af_netlink.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index cb35680db9b29..891e029ad0f89 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1862,6 +1862,11 @@ static int netlink_sendmsg(struct socket *sock, stru= ct msghdr *msg, size_t len) if (msg->msg_flags&MSG_OOB) return -EOPNOTSUPP; =20 + if (len =3D=3D 0) { + pr_warn_once("Zero length message leads to an empty skb\n"); + return -ENODATA; + } + err =3D scm_send(sock, msg, &scm, true); if (err < 0) return err; --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD32FC4332F for ; Wed, 15 Dec 2021 17:28:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238170AbhLOR2H (ORCPT ); Wed, 15 Dec 2021 12:28:07 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47380 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343657AbhLOR0n (ORCPT ); Wed, 15 Dec 2021 12:26:43 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 588ED61A05; Wed, 15 Dec 2021 17:26:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3C763C36AE0; Wed, 15 Dec 2021 17:26:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589202; bh=ijfdEIMXipzfofjjcBwYmFaTIINZkUL3W1yDWk+poaM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z1WlBOpEF1Rxb8l5JroIp/cfRGirb3R+idYu+dpKgHBa1zwF2yz++8vHaumHl1v1A VRrl+q23R1I1O0G8D70YFf5pCjUha4xH3YYyQusX6wIsDjMQ3pr6jqNQ4qBjZBUM2N uQ6jbZFAzbZQ91v4/g1Oj/MP+9jHOZWO+cyWAfQM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jun Lei , Bhawanpreet Lakha , Mustapha Ghaddar , Daniel Wheeler , Alex Deucher , Sasha Levin Subject: [PATCH 5.4 07/18] drm/amd/display: Fix for the no Audio bug with Tiled Displays Date: Wed, 15 Dec 2021 18:21:28 +0100 Message-Id: <20211215172023.064501876@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mustapha Ghaddar [ Upstream commit 5ceaebcda9061c04f439c93961f0819878365c0f ] [WHY] It seems like after a series of plug/unplugs we end up in a situation where tiled display doesnt support Audio. [HOW] The issue seems to be related to when we check streams changed after an HPD, we should be checking the audio_struct as well to see if any of its values changed. Reviewed-by: Jun Lei Acked-by: Bhawanpreet Lakha Signed-off-by: Mustapha Ghaddar Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gp= u/drm/amd/display/dc/core/dc_resource.c index f25ac17f47fa9..95a5310e9e661 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1546,6 +1546,10 @@ bool dc_is_stream_unchanged( if (old_stream->ignore_msa_timing_param !=3D stream->ignore_msa_timing_pa= ram) return false; =20 + // Only Have Audio left to check whether it is same or not. This is a cor= ner case for Tiled sinks + if (old_stream->audio_info.mode_count !=3D stream->audio_info.mode_count) + return false; + return true; } =20 --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4600CC433F5 for ; Wed, 15 Dec 2021 17:29:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343513AbhLOR3n (ORCPT ); Wed, 15 Dec 2021 12:29:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35442 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245755AbhLOR1c (ORCPT ); Wed, 15 Dec 2021 12:27:32 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 75A00C061747; Wed, 15 Dec 2021 09:26:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1461061A04; Wed, 15 Dec 2021 17:26:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFC21C36AE0; Wed, 15 Dec 2021 17:26:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589205; bh=90oVr+l1nw0SKDOGAbCUXHNjVu4a5/eCBcOj63Rg83E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VtjF1WD82kCUVDurhQWyzOs9o7CP2LSSjrlUPzJ38/k1p4PjqK4l9B5axFlwnFjiN JGaE4z4oxs3cAFTsaAF1i/gVe7A+oFIGdQAe5Jx1Swzfc/qHxgi+1HefGeeJgllunP hIugfZmCdsozRej+K8ix62VS0ctKUsGsCzxDVSsw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harry Wentland , Rodrigo Siqueira , Perry Yuan , Alex Deucher , Sasha Levin Subject: [PATCH 5.4 08/18] drm/amd/display: add connector type check for CRC source set Date: Wed, 15 Dec 2021 18:21:29 +0100 Message-Id: <20211215172023.096486424@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Perry Yuan [ Upstream commit 2da34b7bb59e1caa9a336e0e20a76b8b6a4abea2 ] [Why] IGT bypass test will set crc source as DPRX,and display DM didn`t check connection type, it run the test on the HDMI connector ,then the kernel will be crashed because aux->transfer is set null for HDMI connection. This patch will skip the invalid connection test and fix kernel crash issue. [How] Check the connector type while setting the pipe crc source as DPRX or auto,if the type is not DP or eDP, the crtc crc source will not be set and report error code to IGT test,IGT will show the this subtest as no valid crtc/connector combinations found. 116.779714] [IGT] amd_bypass: starting subtest 8bpc-bypass-mode [ 117.730996] BUG: kernel NULL pointer dereference, address: 00000000000000= 00 [ 117.731001] #PF: supervisor instruction fetch in kernel mode [ 117.731003] #PF: error_code(0x0010) - not-present page [ 117.731004] PGD 0 P4D 0 [ 117.731006] Oops: 0010 [#1] SMP NOPTI [ 117.731009] CPU: 11 PID: 2428 Comm: amd_bypass Tainted: G OE 5.11.0-34-ge= neric #36~20.04.1-Ubuntu [ 117.731011] Hardware name: AMD CZN/, BIOS AB.FD 09/07/2021 [ 117.731012] RIP: 0010:0x0 [ 117.731015] Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. [ 117.731016] RSP: 0018:ffffa8d64225bab8 EFLAGS: 00010246 [ 117.731017] RAX: 0000000000000000 RBX: 0000000000000020 RCX: ffffa8d64225= bb5e [ 117.731018] RDX: ffff93151d921880 RSI: ffffa8d64225bac8 RDI: ffff931511a1= a9d8 [ 117.731022] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 117.731023] CR2: ffffffffffffffd6 CR3: 000000010d5a4000 CR4: 000000000075= 0ee0 [ 117.731023] PKRU: 55555554 [ 117.731024] Call Trace: [ 117.731027] drm_dp_dpcd_access+0x72/0x110 [drm_kms_helper] [ 117.731036] drm_dp_dpcd_read+0xb7/0xf0 [drm_kms_helper] [ 117.731040] drm_dp_start_crc+0x38/0xb0 [drm_kms_helper] [ 117.731047] amdgpu_dm_crtc_set_crc_source+0x1ae/0x3e0 [amdgpu] [ 117.731149] crtc_crc_open+0x174/0x220 [drm] [ 117.731162] full_proxy_open+0x168/0x1f0 [ 117.731165] ? open_proxy_open+0x100/0x100 BugLink: https://gitlab.freedesktop.org/drm/amd/-/issues/1546 Reviewed-by: Harry Wentland Reviewed-by: Rodrigo Siqueira Signed-off-by: Perry Yuan Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c b/driver= s/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c index f0b001b3af578..883ee517673bd 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_crc.c @@ -221,6 +221,14 @@ int amdgpu_dm_crtc_set_crc_source(struct drm_crtc *crt= c, const char *src_name) ret =3D -EINVAL; goto cleanup; } + + if ((aconn->base.connector_type !=3D DRM_MODE_CONNECTOR_DisplayPort) && + (aconn->base.connector_type !=3D DRM_MODE_CONNECTOR_eDP)) { + DRM_DEBUG_DRIVER("No DP connector available for CRC source\n"); + ret =3D -EINVAL; + goto cleanup; + } + } =20 if (amdgpu_dm_crtc_configure_crc_source(crtc, crtc_state, source)) { --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42475C433EF for ; Wed, 15 Dec 2021 17:28:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237834AbhLOR2V (ORCPT ); Wed, 15 Dec 2021 12:28:21 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47470 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343939AbhLOR0t (ORCPT ); Wed, 15 Dec 2021 12:26:49 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D759E61A0D; Wed, 15 Dec 2021 17:26:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA1C7C36AE0; Wed, 15 Dec 2021 17:26:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589208; bh=67IQHyjtgvsS8cup5Ojt+DPWEsjdJNnKB4Pxob3ISXE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TJei2CwhLpIKEdmkGf2uWKZZgifEqYtLwnPjSHor5zgmojwOS6HiLaAkIL8N+VI5s ED9GSX+g+TxowYERTcUjWwhU1ylM+y3SsKKgQIjgvHTrWFFm7Zzbmzyr+EeM7OQePU VlouIi3tBBXZYQvTF3tnPs9GnK3stmikN+IVr5HU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chen Jun , "Steven Rostedt (VMware)" , Sasha Levin Subject: [PATCH 5.4 09/18] tracing: Fix a kmemleak false positive in tracing_map Date: Wed, 15 Dec 2021 18:21:30 +0100 Message-Id: <20211215172023.127635880@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chen Jun [ Upstream commit f25667e5980a4333729cac3101e5de1bb851f71a ] Doing the command: echo 'hist:key=3Dcommon_pid.execname,common_timestamp' > /sys/kernel/debu= g/tracing/events/xxx/trigger Triggers many kmemleak reports: unreferenced object 0xffff0000c7ea4980 (size 128): comm "bash", pid 338, jiffies 4294912626 (age 9339.324s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f3469921>] kmem_cache_alloc_trace+0x4c0/0x6f0 [<0000000054ca40c3>] hist_trigger_elt_data_alloc+0x140/0x178 [<00000000633bd154>] tracing_map_init+0x1f8/0x268 [<000000007e814ab9>] event_hist_trigger_func+0xca0/0x1ad0 [<00000000bf8520ed>] trigger_process_regex+0xd4/0x128 [<00000000f549355a>] event_trigger_write+0x7c/0x120 [<00000000b80f898d>] vfs_write+0xc4/0x380 [<00000000823e1055>] ksys_write+0x74/0xf8 [<000000008a9374aa>] __arm64_sys_write+0x24/0x30 [<0000000087124017>] do_el0_svc+0x88/0x1c0 [<00000000efd0dcd1>] el0_svc+0x1c/0x28 [<00000000dbfba9b3>] el0_sync_handler+0x88/0xc0 [<00000000e7399680>] el0_sync+0x148/0x180 unreferenced object 0xffff0000c7ea4980 (size 128): comm "bash", pid 338, jiffies 4294912626 (age 9339.324s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000f3469921>] kmem_cache_alloc_trace+0x4c0/0x6f0 [<0000000054ca40c3>] hist_trigger_elt_data_alloc+0x140/0x178 [<00000000633bd154>] tracing_map_init+0x1f8/0x268 [<000000007e814ab9>] event_hist_trigger_func+0xca0/0x1ad0 [<00000000bf8520ed>] trigger_process_regex+0xd4/0x128 [<00000000f549355a>] event_trigger_write+0x7c/0x120 [<00000000b80f898d>] vfs_write+0xc4/0x380 [<00000000823e1055>] ksys_write+0x74/0xf8 [<000000008a9374aa>] __arm64_sys_write+0x24/0x30 [<0000000087124017>] do_el0_svc+0x88/0x1c0 [<00000000efd0dcd1>] el0_svc+0x1c/0x28 [<00000000dbfba9b3>] el0_sync_handler+0x88/0xc0 [<00000000e7399680>] el0_sync+0x148/0x180 The reason is elts->pages[i] is alloced by get_zeroed_page. and kmemleak will not scan the area alloced by get_zeroed_page. The address stored in elts->pages will be regarded as leaked. That is, the elts->pages[i] will have pointers loaded onto it as well, and without telling kmemleak about it, those pointers will look like memory without a reference. To fix this, call kmemleak_alloc to tell kmemleak to scan elts->pages[i] Link: https://lkml.kernel.org/r/20211124140801.87121-1-chenjun102@huawei.com Signed-off-by: Chen Jun Signed-off-by: Steven Rostedt (VMware) Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- kernel/trace/tracing_map.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c index 10657b8dc2c2d..83c2a0598c648 100644 --- a/kernel/trace/tracing_map.c +++ b/kernel/trace/tracing_map.c @@ -15,6 +15,7 @@ #include #include #include +#include =20 #include "tracing_map.h" #include "trace.h" @@ -307,6 +308,7 @@ void tracing_map_array_free(struct tracing_map_array *a) for (i =3D 0; i < a->n_pages; i++) { if (!a->pages[i]) break; + kmemleak_free(a->pages[i]); free_page((unsigned long)a->pages[i]); } =20 @@ -342,6 +344,7 @@ struct tracing_map_array *tracing_map_array_alloc(unsig= ned int n_elts, a->pages[i] =3D (void *)get_zeroed_page(GFP_KERNEL); if (!a->pages[i]) goto free; + kmemleak_alloc(a->pages[i], PAGE_SIZE, 1, GFP_KERNEL); } out: return a; --=20 2.33.0 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA963C433EF for ; Wed, 15 Dec 2021 17:28:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237865AbhLOR21 (ORCPT ); Wed, 15 Dec 2021 12:28:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35666 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343970AbhLOR05 (ORCPT ); Wed, 15 Dec 2021 12:26:57 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E2A8C061398; Wed, 15 Dec 2021 09:26:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DC626619E5; Wed, 15 Dec 2021 17:26:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C18C0C36AE0; Wed, 15 Dec 2021 17:26:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589166; bh=SnBigIvs/HVsrn0PyTHMB/PiIuT8aYdW0BVwrDDaEi4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GbH4iVaXmsuqoQYZ++zapRSjcNN0B9M9h9VJEVUsyWFWIwXBLku/udFron8peQFoE atKvB96cc5JgMexWHVu++mDnZ6Yns36DlU22SFSGk/RoXNg8yha5AkGuFEpewbhDrA AZK8UkS6S0hyNgAl5qWLRKlyux5EjgHQNlONwNUc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Christopherson , Vitaly Kuznetsov , Paolo Bonzini Subject: [PATCH 5.4 10/18] KVM: x86: Ignore sparse banks size for an "all CPUs", non-sparse IPI req Date: Wed, 15 Dec 2021 18:21:31 +0100 Message-Id: <20211215172023.159555109@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit 3244867af8c065e51969f1bffe732d3ebfd9a7d2 upstream. Do not bail early if there are no bits set in the sparse banks for a non-sparse, a.k.a. "all CPUs", IPI request. Per the Hyper-V spec, it is legal to have a variable length of '0', e.g. VP_SET's BankContents in this case, if the request can be serviced without the extra info. It is possible that for a given invocation of a hypercall that does accept variable sized input headers that all the header input fits entirely within the fixed size header. In such cases the variable sized input header is zero-sized and the corresponding bits in the hypercall input should be set to zero. Bailing early results in KVM failing to send IPIs to all CPUs as expected by the guest. Fixes: 214ff83d4473 ("KVM: x86: hyperv: implement PV IPI send hypercalls") Cc: stable@vger.kernel.org Signed-off-by: Sean Christopherson Reviewed-by: Vitaly Kuznetsov Message-Id: <20211207220926.718794-2-seanjc@google.com> Signed-off-by: Paolo Bonzini Signed-off-by: Vitaly Kuznetsov Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- arch/x86/kvm/hyperv.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/arch/x86/kvm/hyperv.c +++ b/arch/x86/kvm/hyperv.c @@ -1501,11 +1501,13 @@ static u64 kvm_hv_send_ipi(struct kvm_vc =20 all_cpus =3D send_ipi_ex.vp_set.format =3D=3D HV_GENERIC_SET_ALL; =20 + if (all_cpus) + goto check_and_send_ipi; + if (!sparse_banks_len) goto ret_success; =20 - if (!all_cpus && - kvm_read_guest(kvm, + if (kvm_read_guest(kvm, ingpa + offsetof(struct hv_send_ipi_ex, vp_set.bank_contents), sparse_banks, @@ -1513,6 +1515,7 @@ static u64 kvm_hv_send_ipi(struct kvm_vc return HV_STATUS_INVALID_HYPERCALL_INPUT; } =20 +check_and_send_ipi: if ((vector < HV_IPI_LOW_VECTOR) || (vector > HV_IPI_HIGH_VECTOR)) return HV_STATUS_INVALID_HYPERCALL_INPUT; =20 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F839C4332F for ; Wed, 15 Dec 2021 17:28:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343662AbhLOR2l (ORCPT ); Wed, 15 Dec 2021 12:28:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35698 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344037AbhLOR1I (ORCPT ); Wed, 15 Dec 2021 12:27:08 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DDC84C0613B4; Wed, 15 Dec 2021 09:26:11 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 80FA2B8202B; Wed, 15 Dec 2021 17:26:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8D94DC36AE2; Wed, 15 Dec 2021 17:26:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589169; bh=Sq/71RSsotFYaoRHT5gT82Pvznye7HKyEPNdxT3OD5g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y0G75yRp4NYpUb7/I1GAOlplhK6ZtfrnliGpKLGBSeNXiLP7o9Dmh2O9yXG2IJwco IBSRdjmoMyVbtFN705FTv21KaZmxmcNRDWfXC9fWcWhY057XhZhLOPRw2cr2yQa0CE WkX3QB5n4LWwutUfXg1Nt08D5kUN51ZlMRZlIfzY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xinjie Zheng , Sujithra Periasamy , Ondrej Mosnacek , Paul Moore , Vijay Balakrishna Subject: [PATCH 5.4 11/18] selinux: fix race condition when computing ocontext SIDs Date: Wed, 15 Dec 2021 18:21:32 +0100 Message-Id: <20211215172023.192907977@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ondrej Mosnacek commit cbfcd13be5cb2a07868afe67520ed181956579a7 upstream. Current code contains a lot of racy patterns when converting an ocontext's context structure to an SID. This is being done in a "lazy" fashion, such that the SID is looked up in the SID table only when it's first needed and then cached in the "sid" field of the ocontext structure. However, this is done without any locking or memory barriers and is thus unsafe. Between commits 24ed7fdae669 ("selinux: use separate table for initial SID lookup") and 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table"), this race condition lead to an actual observable bug, because a pointer to the shared sid field was passed directly to sidtab_context_to_sid(), which was using this location to also store an intermediate value, which could have been read by other threads and interpreted as an SID. In practice this caused e.g. new mounts to get a wrong (seemingly random) filesystem context, leading to strange denials. This bug has been spotted in the wild at least twice, see [1] and [2]. Fix the race condition by making all the racy functions use a common helper that ensures the ocontext::sid accesses are made safely using the appropriate SMP constructs. Note that security_netif_sid() was populating the sid field of both contexts stored in the ocontext, but only the first one was actually used. The SELinux wiki's documentation on the "netifcon" policy statement [3] suggests that using only the first context is intentional. I kept only the handling of the first context here, as there is really no point in doing the SID lookup for the unused one. I wasn't able to reproduce the bug mentioned above on any kernel that includes commit 66f8e2f03c02, even though it has been reported that the issue occurs with that commit, too, just less frequently. Thus, I wasn't able to verify that this patch fixes the issue, but it makes sense to avoid the race condition regardless. [1] https://github.com/containers/container-selinux/issues/89 [2] https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproje= ct.org/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/ [3] https://selinuxproject.org/page/NetworkStatements#netifcon Cc: stable@vger.kernel.org Cc: Xinjie Zheng Reported-by: Sujithra Periasamy Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Ondrej Mosnacek Signed-off-by: Paul Moore [vijayb: Backport contextual differences are due to v5.10 RCU related changes are not in 5.4] Signed-off-by: Vijay Balakrishna Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- security/selinux/ss/services.c | 159 ++++++++++++++++++++++--------------= ----- 1 file changed, 87 insertions(+), 72 deletions(-) --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -2251,6 +2251,43 @@ size_t security_policydb_len(struct seli } =20 /** + * ocontext_to_sid - Helper to safely get sid for an ocontext + * @sidtab: SID table + * @c: ocontext structure + * @index: index of the context entry (0 or 1) + * @out_sid: pointer to the resulting SID value + * + * For all ocontexts except OCON_ISID the SID fields are populated + * on-demand when needed. Since updating the SID value is an SMP-sensitive + * operation, this helper must be used to do that safely. + * + * WARNING: This function may return -ESTALE, indicating that the caller + * must retry the operation after re-acquiring the policy pointer! + */ +static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c, + size_t index, u32 *out_sid) +{ + int rc; + u32 sid; + + /* Ensure the associated sidtab entry is visible to this thread. */ + sid =3D smp_load_acquire(&c->sid[index]); + if (!sid) { + rc =3D sidtab_context_to_sid(sidtab, &c->context[index], &sid); + if (rc) + return rc; + + /* + * Ensure the new sidtab entry is visible to other threads + * when they see the SID. + */ + smp_store_release(&c->sid[index], sid); + } + *out_sid =3D sid; + return 0; +} + +/** * security_port_sid - Obtain the SID for a port. * @protocol: protocol number * @port: port number @@ -2262,10 +2299,12 @@ int security_port_sid(struct selinux_sta struct policydb *policydb; struct sidtab *sidtab; struct ocontext *c; - int rc =3D 0; + int rc; =20 read_lock(&state->ss->policy_rwlock); =20 +retry: + rc =3D 0; policydb =3D &state->ss->policydb; sidtab =3D state->ss->sidtab; =20 @@ -2279,14 +2318,11 @@ int security_port_sid(struct selinux_sta } =20 if (c) { - if (!c->sid[0]) { - rc =3D sidtab_context_to_sid(sidtab, - &c->context[0], - &c->sid[0]); - if (rc) - goto out; - } - *out_sid =3D c->sid[0]; + rc =3D ocontext_to_sid(sidtab, c, 0, out_sid); + if (rc =3D=3D -ESTALE) + goto retry; + if (rc) + goto out; } else { *out_sid =3D SECINITSID_PORT; } @@ -2308,10 +2344,12 @@ int security_ib_pkey_sid(struct selinux_ struct policydb *policydb; struct sidtab *sidtab; struct ocontext *c; - int rc =3D 0; + int rc; =20 read_lock(&state->ss->policy_rwlock); =20 +retry: + rc =3D 0; policydb =3D &state->ss->policydb; sidtab =3D state->ss->sidtab; =20 @@ -2326,14 +2364,11 @@ int security_ib_pkey_sid(struct selinux_ } =20 if (c) { - if (!c->sid[0]) { - rc =3D sidtab_context_to_sid(sidtab, - &c->context[0], - &c->sid[0]); - if (rc) - goto out; - } - *out_sid =3D c->sid[0]; + rc =3D ocontext_to_sid(sidtab, c, 0, out_sid); + if (rc =3D=3D -ESTALE) + goto retry; + if (rc) + goto out; } else *out_sid =3D SECINITSID_UNLABELED; =20 @@ -2354,10 +2389,12 @@ int security_ib_endport_sid(struct selin struct policydb *policydb; struct sidtab *sidtab; struct ocontext *c; - int rc =3D 0; + int rc; =20 read_lock(&state->ss->policy_rwlock); =20 +retry: + rc =3D 0; policydb =3D &state->ss->policydb; sidtab =3D state->ss->sidtab; =20 @@ -2373,14 +2410,11 @@ int security_ib_endport_sid(struct selin } =20 if (c) { - if (!c->sid[0]) { - rc =3D sidtab_context_to_sid(sidtab, - &c->context[0], - &c->sid[0]); - if (rc) - goto out; - } - *out_sid =3D c->sid[0]; + rc =3D ocontext_to_sid(sidtab, c, 0, out_sid); + if (rc =3D=3D -ESTALE) + goto retry; + if (rc) + goto out; } else *out_sid =3D SECINITSID_UNLABELED; =20 @@ -2399,11 +2433,13 @@ int security_netif_sid(struct selinux_st { struct policydb *policydb; struct sidtab *sidtab; - int rc =3D 0; + int rc; struct ocontext *c; =20 read_lock(&state->ss->policy_rwlock); =20 +retry: + rc =3D 0; policydb =3D &state->ss->policydb; sidtab =3D state->ss->sidtab; =20 @@ -2415,19 +2451,11 @@ int security_netif_sid(struct selinux_st } =20 if (c) { - if (!c->sid[0] || !c->sid[1]) { - rc =3D sidtab_context_to_sid(sidtab, - &c->context[0], - &c->sid[0]); - if (rc) - goto out; - rc =3D sidtab_context_to_sid(sidtab, - &c->context[1], - &c->sid[1]); - if (rc) - goto out; - } - *if_sid =3D c->sid[0]; + rc =3D ocontext_to_sid(sidtab, c, 0, if_sid); + if (rc =3D=3D -ESTALE) + goto retry; + if (rc) + goto out; } else *if_sid =3D SECINITSID_NETIF; =20 @@ -2469,6 +2497,7 @@ int security_node_sid(struct selinux_sta =20 read_lock(&state->ss->policy_rwlock); =20 +retry: policydb =3D &state->ss->policydb; sidtab =3D state->ss->sidtab; =20 @@ -2511,14 +2540,11 @@ int security_node_sid(struct selinux_sta } =20 if (c) { - if (!c->sid[0]) { - rc =3D sidtab_context_to_sid(sidtab, - &c->context[0], - &c->sid[0]); - if (rc) - goto out; - } - *out_sid =3D c->sid[0]; + rc =3D ocontext_to_sid(sidtab, c, 0, out_sid); + if (rc =3D=3D -ESTALE) + goto retry; + if (rc) + goto out; } else { *out_sid =3D SECINITSID_NODE; } @@ -2677,7 +2703,7 @@ static inline int __security_genfs_sid(s u16 sclass; struct genfs *genfs; struct ocontext *c; - int rc, cmp =3D 0; + int cmp =3D 0; =20 while (path[0] =3D=3D '/' && path[1] =3D=3D '/') path++; @@ -2691,9 +2717,8 @@ static inline int __security_genfs_sid(s break; } =20 - rc =3D -ENOENT; if (!genfs || cmp) - goto out; + return -ENOENT; =20 for (c =3D genfs->head; c; c =3D c->next) { len =3D strlen(c->u.name); @@ -2702,20 +2727,10 @@ static inline int __security_genfs_sid(s break; } =20 - rc =3D -ENOENT; if (!c) - goto out; + return -ENOENT; =20 - if (!c->sid[0]) { - rc =3D sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]); - if (rc) - goto out; - } - - *sid =3D c->sid[0]; - rc =3D 0; -out: - return rc; + return ocontext_to_sid(sidtab, c, 0, sid); } =20 /** @@ -2750,13 +2765,15 @@ int security_fs_use(struct selinux_state { struct policydb *policydb; struct sidtab *sidtab; - int rc =3D 0; + int rc; struct ocontext *c; struct superblock_security_struct *sbsec =3D sb->s_security; const char *fstype =3D sb->s_type->name; =20 read_lock(&state->ss->policy_rwlock); =20 +retry: + rc =3D 0; policydb =3D &state->ss->policydb; sidtab =3D state->ss->sidtab; =20 @@ -2769,13 +2786,11 @@ int security_fs_use(struct selinux_state =20 if (c) { sbsec->behavior =3D c->v.behavior; - if (!c->sid[0]) { - rc =3D sidtab_context_to_sid(sidtab, &c->context[0], - &c->sid[0]); - if (rc) - goto out; - } - sbsec->sid =3D c->sid[0]; + rc =3D ocontext_to_sid(sidtab, c, 0, &sbsec->sid); + if (rc =3D=3D -ESTALE) + goto retry; + if (rc) + goto out; } else { rc =3D __security_genfs_sid(state, fstype, "/", SECCLASS_DIR, &sbsec->sid); From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEE4BC433F5 for ; Wed, 15 Dec 2021 17:28:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343927AbhLOR2n (ORCPT ); Wed, 15 Dec 2021 12:28:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344059AbhLOR1K (ORCPT ); Wed, 15 Dec 2021 12:27:10 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9D310C0613B5; Wed, 15 Dec 2021 09:26:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 45606B8204A; Wed, 15 Dec 2021 17:26:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F59EC36AE2; Wed, 15 Dec 2021 17:26:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589172; bh=emMZ2g/cfMNEvsT0EsNPtAE7YXkJz8+dxp22diq2jh8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oXVQmnT1W7V9/QAPJHbjFsV3lRyqDJuwgN1Xt4DQVLRAC/pXFW1OzmJcLrprQzXo3 4T/WfJ9jJQqiEgWj3bdzViNr+fPcjyAn3WSoAbGzTWnj1B5vtMNo7YWF9sJC4Nltqe IVKbWwhZmrSvNFWarTBHRyK+XiNseCr/ZcDysz0k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bui Quang Minh , Alexei Starovoitov , Connor OBrien Subject: [PATCH 5.4 12/18] bpf: Fix integer overflow in argument calculation for bpf_map_area_alloc Date: Wed, 15 Dec 2021 18:21:33 +0100 Message-Id: <20211215172023.233762350@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bui Quang Minh commit 7dd5d437c258bbf4cc15b35229e5208b87b8b4e0 upstream. In 32-bit architecture, the result of sizeof() is a 32-bit integer so the expression becomes the multiplication between 2 32-bit integer which can potentially leads to integer overflow. As a result, bpf_map_area_alloc() allocates less memory than needed. Fix this by casting 1 operand to u64. Fixes: 0d2c4f964050 ("bpf: Eliminate rlimit-based memory accounting for soc= kmap and sockhash maps") Fixes: 99c51064fb06 ("devmap: Use bpf_map_area_alloc() for allocating hash = buckets") Fixes: 546ac1ffb70d ("bpf: add devmap, a map for storing net device referen= ces") Signed-off-by: Bui Quang Minh Signed-off-by: Alexei Starovoitov Link: https://lore.kernel.org/bpf/20210613143440.71975-1-minhquangbui99@gma= il.com Signed-off-by: Connor O'Brien Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- kernel/bpf/devmap.c | 4 ++-- net/core/sock_map.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) --- a/kernel/bpf/devmap.c +++ b/kernel/bpf/devmap.c @@ -94,7 +94,7 @@ static struct hlist_head *dev_map_create int i; struct hlist_head *hash; =20 - hash =3D bpf_map_area_alloc(entries * sizeof(*hash), numa_node); + hash =3D bpf_map_area_alloc((u64) entries * sizeof(*hash), numa_node); if (hash !=3D NULL) for (i =3D 0; i < entries; i++) INIT_HLIST_HEAD(&hash[i]); @@ -159,7 +159,7 @@ static int dev_map_init_map(struct bpf_d =20 spin_lock_init(&dtab->index_lock); } else { - dtab->netdev_map =3D bpf_map_area_alloc(dtab->map.max_entries * + dtab->netdev_map =3D bpf_map_area_alloc((u64) dtab->map.max_entries * sizeof(struct bpf_dtab_netdev *), dtab->map.numa_node); if (!dtab->netdev_map) --- a/net/core/sock_map.c +++ b/net/core/sock_map.c @@ -48,7 +48,7 @@ static struct bpf_map *sock_map_alloc(un if (err) goto free_stab; =20 - stab->sks =3D bpf_map_area_alloc(stab->map.max_entries * + stab->sks =3D bpf_map_area_alloc((u64) stab->map.max_entries * sizeof(struct sock *), stab->map.numa_node); if (stab->sks) From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89E0FC433FE for ; Wed, 15 Dec 2021 17:29:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238676AbhLOR3f (ORCPT ); Wed, 15 Dec 2021 12:29:35 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:46996 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S245583AbhLOR0Q (ORCPT ); Wed, 15 Dec 2021 12:26:16 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6001F619E5; Wed, 15 Dec 2021 17:26:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 48482C36AE0; Wed, 15 Dec 2021 17:26:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589174; bh=HLAnwe27aqyD2NF+CqJU491kv2QJeG07NWGo/qz7i6E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I9fE0IXLmCGi9u9HRhu93LtMsuIqTidsKJUbG7Qf52e6mWiBUHwnTp+DMMXuUvxHU upAiRo7jf+BKXVIaEUM3NvXKgDjD57ioD7qOhtrfeixvMdhtvuB68FmLUvfrSK843K e/JTYRedbI4O1PUURU5m2QGMzblJEpO8fH8+5Gqw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Armin Wolf , =?UTF-8?q?Pali=20Roh=C3=A1r?= , Guenter Roeck Subject: [PATCH 5.4 13/18] hwmon: (dell-smm) Fix warning on /proc/i8k creation error Date: Wed, 15 Dec 2021 18:21:34 +0100 Message-Id: <20211215172023.264891956@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Armin Wolf commit dbd3e6eaf3d813939b28e8a66e29d81cdc836445 upstream. The removal function is called regardless of whether /proc/i8k was created successfully or not, the later causing a WARN() on module removal. Fix that by only registering the removal function if /proc/i8k was created successfully. Tested on a Inspiron 3505. Fixes: 039ae58503f3 ("hwmon: Allow to compile dell-smm-hwmon driver without= /proc/i8k") Signed-off-by: Armin Wolf Acked-by: Pali Roh=C3=A1r Link: https://lore.kernel.org/r/20211112171440.59006-1-W_Armin@gmx.de Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- drivers/hwmon/dell-smm-hwmon.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/hwmon/dell-smm-hwmon.c +++ b/drivers/hwmon/dell-smm-hwmon.c @@ -588,15 +588,18 @@ static const struct file_operations i8k_ .unlocked_ioctl =3D i8k_ioctl, }; =20 +static struct proc_dir_entry *entry; + static void __init i8k_init_procfs(void) { /* Register the proc entry */ - proc_create("i8k", 0, NULL, &i8k_fops); + entry =3D proc_create("i8k", 0, NULL, &i8k_fops); } =20 static void __exit i8k_exit_procfs(void) { - remove_proc_entry("i8k", NULL); + if (entry) + remove_proc_entry("i8k", NULL); } =20 #else From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC1C4C433FE for ; Wed, 15 Dec 2021 17:27:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245723AbhLOR1k (ORCPT ); Wed, 15 Dec 2021 12:27:40 -0500 Received: from dfw.source.kernel.org ([139.178.84.217]:47020 "EHLO dfw.source.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343870AbhLOR0T (ORCPT ); Wed, 15 Dec 2021 12:26:19 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2DB54619C9; Wed, 15 Dec 2021 17:26:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0BF60C36AE2; Wed, 15 Dec 2021 17:26:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589177; bh=fAE9/ddDMcBj5ODExvjdGpl9n7pr4qdE04SoHfwEi6A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Klk1TP5O/FPPSF402hKLotoPKlfZDvg+ZROuxkVKRDxbe21I7hbzxOF+BPYszBECC jRbVMI8Ml//ILfBmphtoAcJ2dgx18YDBoELVT7rwZYyr9U5SrwcPd4u+LXnO102S9M 2XHXM3gjm6FFH2PtLPM0wW+OLDKgdgBvuUyaiBlg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Mike Rapoport , Tony Lindgren , Mark-PK Tsai Subject: [PATCH 5.4 14/18] memblock: free_unused_memmap: use pageblock units instead of MAX_ORDER Date: Wed, 15 Dec 2021 18:21:35 +0100 Message-Id: <20211215172023.296167632@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Rapoport commit e2a86800d58639b3acde7eaeb9eb393dca066e08 upstream. The code that frees unused memory map uses rounds start and end of the holes that are freed to MAX_ORDER_NR_PAGES to preserve continuity of the memory map for MAX_ORDER regions. Lots of core memory management functionality relies on homogeneity of the memory map within each pageblock which size may differ from MAX_ORDER in certain configurations. Although currently, for the architectures that use free_unused_memmap(), pageblock_order and MAX_ORDER are equivalent, it is cleaner to have common notation thought mm code. Replace MAX_ORDER_NR_PAGES with pageblock_nr_pages and update the comments to make it more clear why the alignment to pageblock boundaries is required. Signed-off-by: Mike Rapoport Tested-by: Tony Lindgren Link: https://lore.kernel.org/lkml/20210630071211.21011-1-rppt@kernel.org/ [backport upstream modification in mm/memblock.c to arch/arm/mm/init.c] Signed-off-by: Mark-PK Tsai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- arch/arm/mm/init.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -373,11 +373,11 @@ static void __init free_unused_memmap(vo ALIGN(prev_end, PAGES_PER_SECTION)); #else /* - * Align down here since the VM subsystem insists that the - * memmap entries are valid from the bank start aligned to - * MAX_ORDER_NR_PAGES. + * Align down here since many operations in VM subsystem + * presume that there are no holes in the memory map inside + * a pageblock */ - start =3D round_down(start, MAX_ORDER_NR_PAGES); + start =3D round_down(start, pageblock_nr_pages); #endif /* * If we had a previous bank, and there is a space @@ -387,12 +387,12 @@ static void __init free_unused_memmap(vo free_memmap(prev_end, start); =20 /* - * Align up here since the VM subsystem insists that the - * memmap entries are valid from the bank end aligned to - * MAX_ORDER_NR_PAGES. + * Align up here since many operations in VM subsystem + * presume that there are no holes in the memory map inside + * a pageblock */ prev_end =3D ALIGN(memblock_region_memory_end_pfn(reg), - MAX_ORDER_NR_PAGES); + pageblock_nr_pages); } =20 #ifdef CONFIG_SPARSEMEM From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50108C433F5 for ; Wed, 15 Dec 2021 17:28:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343953AbhLOR2o (ORCPT ); Wed, 15 Dec 2021 12:28:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344102AbhLOR1O (ORCPT ); Wed, 15 Dec 2021 12:27:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48900C06137A; Wed, 15 Dec 2021 09:26:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DD8D6619F2; Wed, 15 Dec 2021 17:26:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3F2FC36AE2; Wed, 15 Dec 2021 17:26:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589180; bh=xoLehgCkf7T0Iptmtru5f1UbP/+yuh5g2mtCEMlYPhM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DhrdJIPk6NZ/0W8SM7nGGKNQZb0OVkekWCNEBRNKvZZGrchLjErVENt4M7lNbTgQp gQeCfMiO6tMm+oW3EGhpmTUwh49GhG/YM/bh+chDFG/ppvXhVLaO2aAoeDryQQ3kxj ML6Ra8bWR+JZk/mP8XmWdjjlNCrJ8StviqRx8ZWY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Mike Rapoport , Tony Lindgren , Mark-PK Tsai Subject: [PATCH 5.4 15/18] memblock: align freed memory map on pageblock boundaries with SPARSEMEM Date: Wed, 15 Dec 2021 18:21:36 +0100 Message-Id: <20211215172023.327233538@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Rapoport commit f921f53e089a12a192808ac4319f28727b35dc0f upstream. When CONFIG_SPARSEMEM=3Dy the ranges of the memory map that are freed are n= ot aligned to the pageblock boundaries which breaks assumptions about homogeneity of the memory map throughout core mm code. Make sure that the freed memory map is always aligned on pageblock boundaries regardless of the memory model selection. Signed-off-by: Mike Rapoport Tested-by: Tony Lindgren Link: https://lore.kernel.org/lkml/20210630071211.21011-1-rppt@kernel.org/ [backport upstream modification in mm/memblock.c to arch/arm/mm/init.c] Signed-off-by: Mark-PK Tsai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- arch/arm/mm/init.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -371,14 +371,14 @@ static void __init free_unused_memmap(vo */ start =3D min(start, ALIGN(prev_end, PAGES_PER_SECTION)); -#else +#endif /* * Align down here since many operations in VM subsystem * presume that there are no holes in the memory map inside * a pageblock */ start =3D round_down(start, pageblock_nr_pages); -#endif + /* * If we had a previous bank, and there is a space * between the current bank and the previous, free it. @@ -396,9 +396,11 @@ static void __init free_unused_memmap(vo } =20 #ifdef CONFIG_SPARSEMEM - if (!IS_ALIGNED(prev_end, PAGES_PER_SECTION)) + if (!IS_ALIGNED(prev_end, PAGES_PER_SECTION)) { + prev_end =3D ALIGN(prev_end, pageblock_nr_pages); free_memmap(prev_end, ALIGN(prev_end, PAGES_PER_SECTION)); + } #endif } =20 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F7F4C433EF for ; Wed, 15 Dec 2021 17:28:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238604AbhLOR2q (ORCPT ); Wed, 15 Dec 2021 12:28:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344111AbhLOR1O (ORCPT ); Wed, 15 Dec 2021 12:27:14 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A49F2C06137E; Wed, 15 Dec 2021 09:26:25 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63A72B82049; Wed, 15 Dec 2021 17:26:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 99C44C36AE2; Wed, 15 Dec 2021 17:26:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589183; bh=Y86ow4ktgKGqvGzBEuntdwaatnH7tNTUPsrzvkLuNJw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=esIyVeJAM5Pwd0TIUX7T0673257pZ/5jjAmsV9imRdXdrp6a39LlH+R5Rjw9FqaWM EgTKE+rFIyRGnnhVd79G/wUqlqfUegefG/ZVXBtm/NPxX8bjRwkoewdAeFEi1e9ztG IWg/oAYSa895BAdJgp8nAbc8IblVs9mDE1Si72T0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Mike Rapoport , Tony Lindgren , Mark-PK Tsai Subject: [PATCH 5.4 16/18] memblock: ensure there is no overflow in memblock_overlaps_region() Date: Wed, 15 Dec 2021 18:21:37 +0100 Message-Id: <20211215172023.368732496@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Rapoport commit 023accf5cdc1e504a9b04187ec23ff156fe53d90 upstream. There maybe an overflow in memblock_overlaps_region() if it is called with base and size such that base + size > PHYS_ADDR_MAX Make sure that memblock_overlaps_region() caps the size to prevent such overflow and remove now duplicated call to memblock_cap_size() from memblock_is_region_reserved(). Signed-off-by: Mike Rapoport Tested-by: Tony Lindgren Link: https://lore.kernel.org/lkml/20210630071211.21011-1-rppt@kernel.org/ Signed-off-by: Mark-PK Tsai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- mm/memblock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/mm/memblock.c +++ b/mm/memblock.c @@ -164,6 +164,8 @@ bool __init_memblock memblock_overlaps_r { unsigned long i; =20 + memblock_cap_size(base, &size); + for (i =3D 0; i < type->cnt; i++) if (memblock_addrs_overlap(base, size, type->regions[i].base, type->regions[i].size)) @@ -1760,7 +1762,6 @@ bool __init_memblock memblock_is_region_ */ bool __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_ad= dr_t size) { - memblock_cap_size(base, &size); return memblock_overlaps_region(&memblock.reserved, base, size); } =20 From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 65A50C433EF for ; Wed, 15 Dec 2021 17:28:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238025AbhLOR2v (ORCPT ); Wed, 15 Dec 2021 12:28:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35520 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1344115AbhLOR1P (ORCPT ); Wed, 15 Dec 2021 12:27:15 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E83F8C061223; Wed, 15 Dec 2021 09:26:26 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8697E61A1E; Wed, 15 Dec 2021 17:26:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 676C7C36AE0; Wed, 15 Dec 2021 17:26:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589186; bh=sJ41gabWO8bBl42PJ5QxtocqtbnYycvo0KydMNJ5724=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zM7gUgrPA7eR6oj4cF9LEiIs+VRKJtsDgLGpr6npP5xZbhfxZz9W2ocyqp5eTTMx3 wcZiMNJx/icgQL9dcvJIX3Nb3CV0w2xMftGYiJGxcmEGXw6x68/qKSyo7yTOfyBCvJ UJlxAo6p72WFqv8C7rKss8ALZNkAb+9NCUo6CITE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Mike Rapoport , Kefeng Wang , Tony Lindgren , Mark-PK Tsai Subject: [PATCH 5.4 17/18] arm: extend pfn_valid to take into account freed memory map alignment Date: Wed, 15 Dec 2021 18:21:38 +0100 Message-Id: <20211215172023.403037125@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Rapoport commit a4d5613c4dc6d413e0733e37db9d116a2a36b9f3 upstream. When unused memory map is freed the preserved part of the memory map is extended to match pageblock boundaries because lots of core mm functionality relies on homogeneity of the memory map within pageblock boundaries. Since pfn_valid() is used to check whether there is a valid memory map entry for a PFN, make it return true also for PFNs that have memory map entries even if there is no actual memory populated there. Signed-off-by: Mike Rapoport Tested-by: Kefeng Wang Tested-by: Tony Lindgren Link: https://lore.kernel.org/lkml/20210630071211.21011-1-rppt@kernel.org/ Signed-off-by: Mark-PK Tsai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- arch/arm/mm/init.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/arch/arm/mm/init.c +++ b/arch/arm/mm/init.c @@ -176,11 +176,22 @@ static void __init zone_sizes_init(unsig int pfn_valid(unsigned long pfn) { phys_addr_t addr =3D __pfn_to_phys(pfn); + unsigned long pageblock_size =3D PAGE_SIZE * pageblock_nr_pages; =20 if (__phys_to_pfn(addr) !=3D pfn) return 0; =20 - return memblock_is_map_memory(__pfn_to_phys(pfn)); + /* + * If address less than pageblock_size bytes away from a present + * memory chunk there still will be a memory map entry for it + * because we round freed memory map to the pageblock boundaries. + */ + if (memblock_overlaps_region(&memblock.memory, + ALIGN_DOWN(addr, pageblock_size), + pageblock_size)) + return 1; + + return 0; } EXPORT_SYMBOL(pfn_valid); #endif From nobody Wed Jul 1 21:29:54 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DC55C433EF for ; Wed, 15 Dec 2021 17:29:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343719AbhLOR3r (ORCPT ); Wed, 15 Dec 2021 12:29:47 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1343512AbhLOR1c (ORCPT ); Wed, 15 Dec 2021 12:27:32 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7F959C0698C3; Wed, 15 Dec 2021 09:26:56 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 18891B82046; Wed, 15 Dec 2021 17:26:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 492AAC36AE2; Wed, 15 Dec 2021 17:26:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1639589213; bh=k0sAWTy0/CNHPEMxlawDonpGRQ5c68ushY7QL0irNPg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e3/CE+y4rgzeTh2kzfuT2BEFLdnKib1xQPVVRN6EYmG3PkOYb2S3f23KPUNFryIrP 5W8u0zVXIU3ZxtaQtzxxaUmitXC8Qr583UpEckhvuWFY0DIAHbLPvtD2Vekmo95kt5 A1XbpH3LYpeystz0MArhAX9pjQISPK4PjIPAkZk0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Guenter Roeck , Mike Rapoport , Mark-PK Tsai Subject: [PATCH 5.4 18/18] arm: ioremap: dont abuse pfn_valid() to check if pfn is in RAM Date: Wed, 15 Dec 2021 18:21:39 +0100 Message-Id: <20211215172023.433970063@linuxfoundation.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20211215172022.795825673@linuxfoundation.org> References: <20211215172022.795825673@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Rapoport commit 024591f9a6e0164ec23301784d1e6d8f6cacbe59 upstream. The semantics of pfn_valid() is to check presence of the memory map for a PFN and not whether a PFN is in RAM. The memory map may be present for a hole in the physical memory and if such hole corresponds to an MMIO range, __arm_ioremap_pfn_caller() will produce a WARN() and fail: [ 2.863406] WARNING: CPU: 0 PID: 1 at arch/arm/mm/ioremap.c:287 __arm_io= remap_pfn_caller+0xf0/0x1dc [ 2.864812] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.13.0-09882-ga180= bd1d7e16 #1 [ 2.865263] Hardware name: Generic DT based system [ 2.865711] Backtrace: [ 2.866063] [<80b07e58>] (dump_backtrace) from [<80b080ac>] (show_stack+= 0x20/0x24) [ 2.866633] r7:00000009 r6:0000011f r5:60000153 r4:80ddd1c0 [ 2.866922] [<80b0808c>] (show_stack) from [<80b18df0>] (dump_stack_lvl+= 0x58/0x74) [ 2.867117] [<80b18d98>] (dump_stack_lvl) from [<80b18e20>] (dump_stack+= 0x14/0x1c) [ 2.867309] r5:80118cac r4:80dc6774 [ 2.867404] [<80b18e0c>] (dump_stack) from [<80122fcc>] (__warn+0xe4/0x1= 50) [ 2.867583] [<80122ee8>] (__warn) from [<80b08850>] (warn_slowpath_fmt+0= x88/0xc0) [ 2.867774] r7:0000011f r6:80dc6774 r5:00000000 r4:814c4000 [ 2.867917] [<80b087cc>] (warn_slowpath_fmt) from [<80118cac>] (__arm_io= remap_pfn_caller+0xf0/0x1dc) [ 2.868158] r9:00000001 r8:9ef00000 r7:80e8b0d4 r6:0009ef00 r5:00000000= r4:00100000 [ 2.868346] [<80118bbc>] (__arm_ioremap_pfn_caller) from [<80118df8>] (_= _arm_ioremap_caller+0x60/0x68) [ 2.868581] r9:9ef00000 r8:821b6dc0 r7:00100000 r6:00000000 r5:815d1010= r4:80118d98 [ 2.868761] [<80118d98>] (__arm_ioremap_caller) from [<80118fcc>] (iorem= ap+0x28/0x30) [ 2.868958] [<80118fa4>] (ioremap) from [<8062871c>] (__devm_ioremap_res= ource+0x154/0x1c8) [ 2.869169] r5:815d1010 r4:814c5d2c [ 2.869263] [<806285c8>] (__devm_ioremap_resource) from [<8062899c>] (de= vm_ioremap_resource+0x14/0x18) [ 2.869495] r9:9e9f57a0 r8:814c4000 r7:815d1000 r6:815d1010 r5:8177c078= r4:815cf400 [ 2.869676] [<80628988>] (devm_ioremap_resource) from [<8091c6e4>] (fsi_= master_acf_probe+0x1a8/0x5d8) [ 2.869909] [<8091c53c>] (fsi_master_acf_probe) from [<80723dbc>] (platf= orm_probe+0x68/0xc8) [ 2.870124] r9:80e9dadc r8:00000000 r7:815d1010 r6:810c1000 r5:815d1010= r4:00000000 [ 2.870306] [<80723d54>] (platform_probe) from [<80721208>] (really_prob= e+0x1cc/0x470) [ 2.870512] r7:815d1010 r6:810c1000 r5:00000000 r4:815d1010 [ 2.870651] [<8072103c>] (really_probe) from [<807215cc>] (__driver_prob= e_device+0x120/0x1fc) [ 2.870872] r7:815d1010 r6:810c1000 r5:810c1000 r4:815d1010 [ 2.871013] [<807214ac>] (__driver_probe_device) from [<807216e8>] (driv= er_probe_device+0x40/0xd8) [ 2.871244] r9:80e9dadc r8:00000000 r7:815d1010 r6:810c1000 r5:812feaa0= r4:812fe994 [ 2.871428] [<807216a8>] (driver_probe_device) from [<80721a58>] (__driv= er_attach+0xa8/0x1d4) [ 2.871647] r9:80e9dadc r8:00000000 r7:00000000 r6:810c1000 r5:815d1054= r4:815d1010 [ 2.871830] [<807219b0>] (__driver_attach) from [<8071ee8c>] (bus_for_ea= ch_dev+0x88/0xc8) [ 2.872040] r7:00000000 r6:814c4000 r5:807219b0 r4:810c1000 [ 2.872194] [<8071ee04>] (bus_for_each_dev) from [<80722208>] (driver_at= tach+0x28/0x30) [ 2.872418] r7:810a2aa0 r6:00000000 r5:821b6000 r4:810c1000 [ 2.872570] [<807221e0>] (driver_attach) from [<8071f80c>] (bus_add_driv= er+0x114/0x200) [ 2.872788] [<8071f6f8>] (bus_add_driver) from [<80722ec4>] (driver_regi= ster+0x98/0x128) [ 2.873011] r7:81011d0c r6:814c4000 r5:00000000 r4:810c1000 [ 2.873167] [<80722e2c>] (driver_register) from [<80725240>] (__platform= _driver_register+0x2c/0x34) [ 2.873408] r5:814dcb80 r4:80f2a764 [ 2.873513] [<80725214>] (__platform_driver_register) from [<80f2a784>] = (fsi_master_acf_init+0x20/0x28) [ 2.873766] [<80f2a764>] (fsi_master_acf_init) from [<80f014a8>] (do_one= _initcall+0x108/0x290) [ 2.874007] [<80f013a0>] (do_one_initcall) from [<80f01840>] (kernel_ini= t_freeable+0x1ac/0x230) [ 2.874248] r9:80e9dadc r8:80f3987c r7:80f3985c r6:00000007 r5:814dcb80= r4:80f627a4 [ 2.874456] [<80f01694>] (kernel_init_freeable) from [<80b19f44>] (kerne= l_init+0x20/0x138) [ 2.874691] r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:0000000= 0 r5:80b19f24 [ 2.874894] r4:00000000 [ 2.874977] [<80b19f24>] (kernel_init) from [<80100170>] (ret_from_fork+= 0x14/0x24) [ 2.875231] Exception stack(0x814c5fb0 to 0x814c5ff8) [ 2.875535] 5fa0: 00000000 00000000 = 00000000 00000000 [ 2.875849] 5fc0: 00000000 00000000 00000000 00000000 00000000 00000000 = 00000000 00000000 [ 2.876133] 5fe0: 00000000 00000000 00000000 00000000 00000013 00000000 [ 2.876363] r5:80b19f24 r4:00000000 [ 2.876683] ---[ end trace b2f74b8536829970 ]--- [ 2.876911] fsi-master-acf gpio-fsi: ioremap failed for resource [mem 0x= 9ef00000-0x9effffff] [ 2.877492] fsi-master-acf gpio-fsi: Error -12 mapping coldfire memory [ 2.877689] fsi-master-acf: probe of gpio-fsi failed with error -12 Use memblock_is_map_memory() instead of pfn_valid() to check if a PFN is in RAM or not. Reported-by: Guenter Roeck Fixes: a4d5613c4dc6 ("arm: extend pfn_valid to take into account freed memo= ry map alignment") Signed-off-by: Mike Rapoport Tested-by: Guenter Roeck Link: https://lore.kernel.org/lkml/20210630071211.21011-1-rppt@kernel.org/ Signed-off-by: Mark-PK Tsai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan --- arch/arm/mm/ioremap.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/arm/mm/ioremap.c +++ b/arch/arm/mm/ioremap.c @@ -27,6 +27,7 @@ #include #include #include +#include =20 #include #include @@ -301,7 +302,8 @@ static void __iomem * __arm_ioremap_pfn_ * Don't allow RAM to be mapped with mismatched attributes - this * causes problems with ARMv6+ */ - if (WARN_ON(pfn_valid(pfn) && mtype !=3D MT_MEMORY_RW)) + if (WARN_ON(memblock_is_map_memory(PFN_PHYS(pfn)) && + mtype !=3D MT_MEMORY_RW)) return NULL; =20 area =3D get_vm_area_caller(size, VM_IOREMAP, caller);