From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF182C433EF for ; Mon, 28 Feb 2022 17:39:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233629AbiB1Rjk (ORCPT ); Mon, 28 Feb 2022 12:39:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238453AbiB1Rhx (ORCPT ); Mon, 28 Feb 2022 12:37:53 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 463202A26F; Mon, 28 Feb 2022 09:32:36 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 105D56135F; Mon, 28 Feb 2022 17:32:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1FCC1C340E7; Mon, 28 Feb 2022 17:32:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069555; bh=hB1FCymVo+iKu6qvqLsvVFV56s88lMs8Vo0RdBY0W/M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g7X5rHOK255RLPKh1Llv2JZqSrDmEpMUN5GgwTzHOnyiKjwLIiU7JlXbvArXzB9qd XUwBVXgUOZTbhkyRd9gNUOpP+hWfho7TFkoVyJUyPegxwKUxSq5cr6H3NMFp6cqiQe LuK6zi5DdCDAcY/CXmgeE1DD2ypu4I/TRygo1Gl8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhao Gongyi , Zhang Qiao , Waiman Long , =?UTF-8?q?Michal=20Koutn=C3=BD?= , Tejun Heo Subject: [PATCH 5.10 01/80] cgroup/cpuset: Fix a race between cpuset_attach() and cpu hotplug Date: Mon, 28 Feb 2022 18:23:42 +0100 Message-Id: <20220228172311.956462417@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhang Qiao commit 05c7b7a92cc87ff8d7fde189d0fade250697573c upstream. As previously discussed(https://lkml.org/lkml/2022/1/20/51), cpuset_attach() is affected with similar cpu hotplug race, as follow scenario: cpuset_attach() cpu hotplug --------------------------- ---------------------- down_write(cpuset_rwsem) guarantee_online_cpus() // (load cpus_attach) sched_cpu_deactivate set_cpu_active() // will change cpu_active_mask set_cpus_allowed_ptr(cpus_attach) __set_cpus_allowed_ptr_locked() // (if the intersection of cpus_attach and cpu_active_mask is empty, will return -EINVAL) up_write(cpuset_rwsem) To avoid races such as described above, protect cpuset_attach() call with cpu_hotplug_lock. Fixes: be367d099270 ("cgroups: let ss->can_attach and ss->attach do whole t= hreadgroups at a time") Cc: stable@vger.kernel.org # v2.6.32+ Reported-by: Zhao Gongyi Signed-off-by: Zhang Qiao Acked-by: Waiman Long Reviewed-by: Michal Koutn=C3=BD Signed-off-by: Tejun Heo Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/cgroup/cpuset.c | 2 ++ 1 file changed, 2 insertions(+) --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -2212,6 +2212,7 @@ static void cpuset_attach(struct cgroup_ cgroup_taskset_first(tset, &css); cs =3D css_cs(css); =20 + cpus_read_lock(); percpu_down_write(&cpuset_rwsem); =20 /* prepare for attach */ @@ -2267,6 +2268,7 @@ static void cpuset_attach(struct cgroup_ wake_up(&cpuset_attach_wq); =20 percpu_up_write(&cpuset_rwsem); + cpus_read_unlock(); } =20 /* The various types of files and directories in a cpuset file system */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40BE5C433EF for ; Mon, 28 Feb 2022 17:39:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238313AbiB1RkH (ORCPT ); Mon, 28 Feb 2022 12:40:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34830 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238555AbiB1Rh7 (ORCPT ); Mon, 28 Feb 2022 12:37:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 131182C112; Mon, 28 Feb 2022 09:32:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A501461357; Mon, 28 Feb 2022 17:32:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BAE78C340E7; Mon, 28 Feb 2022 17:32:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069577; bh=fXo5sVlNeCDci8c+hZ/nvBWmQ0GyfX0Ko19pBf54fJE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oKtu3vb7I3/PTOI+osUOCuTxM4tGiCx1jKNhLRUzE88C0R/DvpuMs7GtkseJ/4kBZ J96aDUEkubmVPnqa49Ez0mojDZPeDu+2kxcI2o3UuqSHq6cIxxiIxiKhHBrPD8w4t8 0MxXAfpN2kO/7fzxAJODr47BxtXTH66A0Ss8DRAw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wenqing Liu , Su Yue , David Sterba Subject: [PATCH 5.10 02/80] btrfs: tree-checker: check item_size for inode_item Date: Mon, 28 Feb 2022 18:23:43 +0100 Message-Id: <20220228172312.019638010@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Su Yue commit 0c982944af27d131d3b74242f3528169f66950ad upstream. while mounting the crafted image, out-of-bounds access happens: [350.429619] UBSAN: array-index-out-of-bounds in fs/btrfs/struct-funcs.c:= 161:1 [350.429636] index 1048096 is out of range for type 'page *[16]' [350.429650] CPU: 0 PID: 9 Comm: kworker/u8:1 Not tainted 5.16.0-rc4 #1 [350.429652] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.1= 3.0-1ubuntu1.1 04/01/2014 [350.429653] Workqueue: btrfs-endio-meta btrfs_work_helper [btrfs] [350.429772] Call Trace: [350.429774] [350.429776] dump_stack_lvl+0x47/0x5c [350.429780] ubsan_epilogue+0x5/0x50 [350.429786] __ubsan_handle_out_of_bounds+0x66/0x70 [350.429791] btrfs_get_16+0xfd/0x120 [btrfs] [350.429832] check_leaf+0x754/0x1a40 [btrfs] [350.429874] ? filemap_read+0x34a/0x390 [350.429878] ? load_balance+0x175/0xfc0 [350.429881] validate_extent_buffer+0x244/0x310 [btrfs] [350.429911] btrfs_validate_metadata_buffer+0xf8/0x100 [btrfs] [350.429935] end_bio_extent_readpage+0x3af/0x850 [btrfs] [350.429969] ? newidle_balance+0x259/0x480 [350.429972] end_workqueue_fn+0x29/0x40 [btrfs] [350.429995] btrfs_work_helper+0x71/0x330 [btrfs] [350.430030] ? __schedule+0x2fb/0xa40 [350.430033] process_one_work+0x1f6/0x400 [350.430035] ? process_one_work+0x400/0x400 [350.430036] worker_thread+0x2d/0x3d0 [350.430037] ? process_one_work+0x400/0x400 [350.430038] kthread+0x165/0x190 [350.430041] ? set_kthread_struct+0x40/0x40 [350.430043] ret_from_fork+0x1f/0x30 [350.430047] [350.430077] BTRFS warning (device loop0): bad eb member start: ptr 0xffe= 20f4e start 20975616 member offset 4293005178 size 2 check_leaf() is checking the leaf: corrupt leaf: root=3D4 block=3D29396992 slot=3D1, bad key order, prev (16= 140901064495857664 1 0) current (1 204 12582912) leaf 29396992 items 6 free space 3565 generation 6 owner DEV_TREE leaf 29396992 flags 0x1(WRITTEN) backref revision 1 fs uuid a62e00e8-e94e-4200-8217-12444de93c2e chunk uuid cecbd0f7-9ca0-441e-ae9f-f782f9732bd8 item 0 key (16140901064495857664 INODE_ITEM 0) itemoff 3955 itemsize 40 generation 0 transid 0 size 0 nbytes 17592186044416 block group 0 mode 52667 links 33 uid 0 gid 2104132511 rdev 94223634821= 136 sequence 100305 flags 0x2409000(none) atime 0.0 (1970-01-01 08:00:00) ctime 2973280098083405823.4294967295 (-269783007-01-01 21:37:03) mtime 18446744071572723616.4026825121 (1902-04-16 12:40:00) otime 9249929404488876031.4294967295 (622322949-04-16 04:25:58) item 1 key (1 DEV_EXTENT 12582912) itemoff 3907 itemsize 48 dev extent chunk_tree 3 chunk_objectid 256 chunk_offset 12582912 length 8388608 chunk_tree_uuid cecbd0f7-9ca0-441e-ae9f-f782f9732bd8 The corrupted leaf of device tree has an inode item. The leaf passed checksum and others checks in validate_extent_buffer until check_leaf_item(= ). Because of the key type BTRFS_INODE_ITEM, check_inode_item() is called even= we are in the device tree. Since the item offset + sizeof(struct btrfs_inode_item) > eb->len, out-of-bounds acce= ss is triggered. The item end vs leaf boundary check has been done before check_leaf_item(), so fix it by checking item size in check_inode_item() before access of the inode item in extent buffer. Other check functions except check_dev_item() in check_leaf_item() have their item size checks. The commit for check_dev_item() is followed. No regression observed during running fstests. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=3D215299 CC: stable@vger.kernel.org # 5.10+ CC: Wenqing Liu Signed-off-by: Su Yue Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/btrfs/tree-checker.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/fs/btrfs/tree-checker.c +++ b/fs/btrfs/tree-checker.c @@ -989,6 +989,7 @@ static int check_inode_item(struct exten struct btrfs_inode_item *iitem; u64 super_gen =3D btrfs_super_generation(fs_info->super_copy); u32 valid_mask =3D (S_IFMT | S_ISUID | S_ISGID | S_ISVTX | 0777); + const u32 item_size =3D btrfs_item_size_nr(leaf, slot); u32 mode; int ret; =20 @@ -996,6 +997,12 @@ static int check_inode_item(struct exten if (ret < 0) return ret; =20 + if (unlikely(item_size !=3D sizeof(*iitem))) { + generic_err(leaf, slot, "invalid item size: has %u expect %zu", + item_size, sizeof(*iitem)); + return -EUCLEAN; + } + iitem =3D btrfs_item_ptr(leaf, slot, struct btrfs_inode_item); =20 /* Here we use super block generation + 1 to handle log tree */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D922C433F5 for ; Mon, 28 Feb 2022 17:40:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238413AbiB1Rlb (ORCPT ); Mon, 28 Feb 2022 12:41:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42016 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238556AbiB1Rh7 (ORCPT ); Mon, 28 Feb 2022 12:37:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B8F815620A; Mon, 28 Feb 2022 09:33:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 551A561357; Mon, 28 Feb 2022 17:33:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7249BC340E7; Mon, 28 Feb 2022 17:32:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069579; bh=sSEoqc+9YPIsgkNANlmTg3KrERRDy6bUKBQeTnevo34=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0HhU0Tm3QH/oWmNtuuluvpyJrw36pGaYGqqZ4yrfREsTmg5kQY/7hrAkjlbh2oh6C aHvvv67qWOyoMs8sfY7tGRBD4mebw7AU0qz4MQ5CceiTFCEf+eydGU/C6uPRKsoOsW DRcZsy2NSlUVqaojWUpUei9iYPlAelae2tPzTf5c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Su Yue , David Sterba Subject: [PATCH 5.10 03/80] btrfs: tree-checker: check item_size for dev_item Date: Mon, 28 Feb 2022 18:23:44 +0100 Message-Id: <20220228172312.111075326@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Su Yue commit ea1d1ca4025ac6c075709f549f9aa036b5b6597d upstream. Check item size before accessing the device item to avoid out of bound access, similar to inode_item check. Signed-off-by: Su Yue Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/btrfs/tree-checker.c | 8 ++++++++ 1 file changed, 8 insertions(+) --- a/fs/btrfs/tree-checker.c +++ b/fs/btrfs/tree-checker.c @@ -947,6 +947,7 @@ static int check_dev_item(struct extent_ struct btrfs_key *key, int slot) { struct btrfs_dev_item *ditem; + const u32 item_size =3D btrfs_item_size_nr(leaf, slot); =20 if (key->objectid !=3D BTRFS_DEV_ITEMS_OBJECTID) { dev_item_err(leaf, slot, @@ -954,6 +955,13 @@ static int check_dev_item(struct extent_ key->objectid, BTRFS_DEV_ITEMS_OBJECTID); return -EUCLEAN; } + + if (unlikely(item_size !=3D sizeof(*ditem))) { + dev_item_err(leaf, slot, "invalid item size: has %u expect %zu", + item_size, sizeof(*ditem)); + return -EUCLEAN; + } + ditem =3D btrfs_item_ptr(leaf, slot, struct btrfs_dev_item); if (btrfs_device_id(leaf, ditem) !=3D key->offset) { dev_item_err(leaf, slot, From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0CF3AC433F5 for ; Mon, 28 Feb 2022 17:39:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234553AbiB1RkM (ORCPT ); Mon, 28 Feb 2022 12:40:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238557AbiB1Rh7 (ORCPT ); Mon, 28 Feb 2022 12:37:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 62646532D5; Mon, 28 Feb 2022 09:33:03 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F2AB861357; Mon, 28 Feb 2022 17:33:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13347C340E7; Mon, 28 Feb 2022 17:33:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069582; bh=tZIKfWR+H3BlXKJ0ATaZf8/I7giSuWW2xGUyyzNSUi8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g7mYw/Hvvfl54+g1oM0honJewVBlwWMl0CqT5EIUSBezp8pefuHQ+/M15YgUyJhxN MmbzcKQSbjualafAMOYOSqlMAiNaBfKXlRKWRTMXChTLIRgtaHhQr5BHx/R1ljy2hX rR2hCjg1drI48AygvVAaB/6RifMT2YQnZSSInsuk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Siarhei Volkau , Paul Cercueil , Stephen Boyd Subject: [PATCH 5.10 04/80] clk: jz4725b: fix mmc0 clock gating Date: Mon, 28 Feb 2022 18:23:45 +0100 Message-Id: <20220228172312.187959801@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Siarhei Volkau commit 2f0754f27a230fee6e6d753f07585cee03bedfe3 upstream. The mmc0 clock gate bit was mistakenly assigned to "i2s" clock. You can find that the same bit is assigned to "mmc0" too. It leads to mmc0 hang for a long time after any sound activity also it prevented PM_SLEEP to work properly. I guess it was introduced by copy-paste from jz4740 driver where it is really controls I2S clock gate. Fixes: 226dfa4726eb ("clk: Add Ingenic jz4725b CGU driver") Signed-off-by: Siarhei Volkau Tested-by: Siarhei Volkau Reviewed-by: Paul Cercueil Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220205171849.687805-2-lis8215@gmail.com Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/clk/ingenic/jz4725b-cgu.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/drivers/clk/ingenic/jz4725b-cgu.c +++ b/drivers/clk/ingenic/jz4725b-cgu.c @@ -139,11 +139,10 @@ static const struct ingenic_cgu_clk_info }, =20 [JZ4725B_CLK_I2S] =3D { - "i2s", CGU_CLK_MUX | CGU_CLK_DIV | CGU_CLK_GATE, + "i2s", CGU_CLK_MUX | CGU_CLK_DIV, .parents =3D { JZ4725B_CLK_EXT, JZ4725B_CLK_PLL_HALF, -1, -1 }, .mux =3D { CGU_REG_CPCCR, 31, 1 }, .div =3D { CGU_REG_I2SCDR, 0, 1, 9, -1, -1, -1 }, - .gate =3D { CGU_REG_CLKGR, 6 }, }, =20 [JZ4725B_CLK_SPI] =3D { From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 832CFC433EF for ; Mon, 28 Feb 2022 17:39:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231363AbiB1RkR (ORCPT ); Mon, 28 Feb 2022 12:40:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238560AbiB1Rh7 (ORCPT ); Mon, 28 Feb 2022 12:37:59 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B353656774; Mon, 28 Feb 2022 09:33:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 69C87B815A2; Mon, 28 Feb 2022 17:33:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BEC71C340F1; Mon, 28 Feb 2022 17:33:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069585; bh=BE0A3YwIThRV+VkyFnMVWWNT3tx20/s6xi8uCN8f3es=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R7VaXNmParvzACtTxM+F1C6U4U2wtBzLJtytES8nWdY0T4liF5n1r6bzeE/3t+KrA c2FysWYhUIOaZl9Bb4IWiJOFJbyBFQBMIauW23zlmjeV+8ZhK8NqsWu3dfIGC3sbI1 j7BqwoZ1wlHwb4wQXvy94CA0um/EjeKf7k8fJT0w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+1e3ea63db39f2b4440e0@syzkaller.appspotmail.com, Stefano Garzarella , Jason Wang , "David S. Miller" , syzbot+3140b17cb44a7b174008@syzkaller.appspotmail.com Subject: [PATCH 5.10 05/80] vhost/vsock: dont check owner in vhost_vsock_stop() while releasing Date: Mon, 28 Feb 2022 18:23:46 +0100 Message-Id: <20220228172312.337422451@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stefano Garzarella commit a58da53ffd70294ebea8ecd0eb45fd0d74add9f9 upstream. vhost_vsock_stop() calls vhost_dev_check_owner() to check the device ownership. It expects current->mm to be valid. vhost_vsock_stop() is also called by vhost_vsock_dev_release() when the user has not done close(), so when we are in do_exit(). In this case current->mm is invalid and we're releasing the device, so we should clean it anyway. Let's check the owner only when vhost_vsock_stop() is called by an ioctl. When invoked from release we can not fail so we don't check return code of vhost_vsock_stop(). We need to stop vsock even if it's not the owner. Fixes: 433fc58e6bf2 ("VSOCK: Introduce vhost_vsock.ko") Cc: stable@vger.kernel.org Reported-by: syzbot+1e3ea63db39f2b4440e0@syzkaller.appspotmail.com Reported-and-tested-by: syzbot+3140b17cb44a7b174008@syzkaller.appspotmail.c= om Signed-off-by: Stefano Garzarella Acked-by: Jason Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/vhost/vsock.c | 21 ++++++++++++++------- 1 file changed, 14 insertions(+), 7 deletions(-) --- a/drivers/vhost/vsock.c +++ b/drivers/vhost/vsock.c @@ -573,16 +573,18 @@ err: return ret; } =20 -static int vhost_vsock_stop(struct vhost_vsock *vsock) +static int vhost_vsock_stop(struct vhost_vsock *vsock, bool check_owner) { size_t i; - int ret; + int ret =3D 0; =20 mutex_lock(&vsock->dev.mutex); =20 - ret =3D vhost_dev_check_owner(&vsock->dev); - if (ret) - goto err; + if (check_owner) { + ret =3D vhost_dev_check_owner(&vsock->dev); + if (ret) + goto err; + } =20 for (i =3D 0; i < ARRAY_SIZE(vsock->vqs); i++) { struct vhost_virtqueue *vq =3D &vsock->vqs[i]; @@ -697,7 +699,12 @@ static int vhost_vsock_dev_release(struc * inefficient. Room for improvement here. */ vsock_for_each_connected_socket(vhost_vsock_reset_orphans); =20 - vhost_vsock_stop(vsock); + /* Don't check the owner, because we are in the release path, so we + * need to stop the vsock device in any case. + * vhost_vsock_stop() can not fail in this case, so we don't need to + * check the return code. + */ + vhost_vsock_stop(vsock, false); vhost_vsock_flush(vsock); vhost_dev_stop(&vsock->dev); =20 @@ -801,7 +808,7 @@ static long vhost_vsock_dev_ioctl(struct if (start) return vhost_vsock_start(vsock); else - return vhost_vsock_stop(vsock); + return vhost_vsock_stop(vsock, true); case VHOST_GET_FEATURES: features =3D VHOST_VSOCK_FEATURES; if (copy_to_user(argp, &features, sizeof(features))) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF45FC433F5 for ; Mon, 28 Feb 2022 17:40:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238388AbiB1RlZ (ORCPT ); Mon, 28 Feb 2022 12:41:25 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238565AbiB1RiA (ORCPT ); Mon, 28 Feb 2022 12:38:00 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E993F39141; Mon, 28 Feb 2022 09:33:10 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8555961358; Mon, 28 Feb 2022 17:33:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B94FC340E7; Mon, 28 Feb 2022 17:33:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069589; bh=0kLHFsDZCk0ZTM/V8Kf2IsrIaPAGMGwqKe7xccMH9p4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lRa8uq80OicttXBp0ASyLvR2FI/D2+19WAZpOFK3uZthNCORQ5zYrEREKpx9LJcUq GNONo3O8lTv5obPS6b13taoXE4oQKFChox3HJoRs8A+RZHGl6YCnCezr9s5ATmPfHt b67mdYdunjjpk6yp1TlgYocNgKYu5xucFcXkgAhA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller Subject: [PATCH 5.10 06/80] parisc/unaligned: Fix fldd and fstd unaligned handlers on 32-bit kernel Date: Mon, 28 Feb 2022 18:23:47 +0100 Message-Id: <20220228172312.435153056@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit dd2288f4a020d693360e3e8d72f8b9d9c25f5ef6 upstream. Usually the kernel provides fixup routines to emulate the fldd and fstd floating-point instructions if they load or store 8-byte from/to a not natuarally aligned memory location. On a 32-bit kernel I noticed that those unaligned handlers didn't worked and instead the application got a SEGV. While checking the code I found two problems: First, the OPCODE_FLDD_L and OPCODE_FSTD_L cases were ifdef'ed out by the CONFIG_PA20 option, and as such those weren't built on a pure 32-bit kernel. This is now fixed by moving the CONFIG_PA20 #ifdef to prevent the compilati= on of OPCODE_LDD_L and OPCODE_FSTD_L only, and handling the fldd and fstd instructions. The second problem are two bugs in the 32-bit inline assembly code, where t= he wrong registers where used. The calculation of the natural alignment used %2 (vall) instead of %3 (ior), and the first word was stored back to address %1 (valh) instead of %3 (ior). Signed-off-by: Helge Deller Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/parisc/kernel/unaligned.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/arch/parisc/kernel/unaligned.c +++ b/arch/parisc/kernel/unaligned.c @@ -397,7 +397,7 @@ static int emulate_std(struct pt_regs *r __asm__ __volatile__ ( " mtsp %4, %%sr1\n" " zdep %2, 29, 2, %%r19\n" -" dep %%r0, 31, 2, %2\n" +" dep %%r0, 31, 2, %3\n" " mtsar %%r19\n" " zvdepi -2, 32, %%r19\n" "1: ldw 0(%%sr1,%3),%%r20\n" @@ -409,7 +409,7 @@ static int emulate_std(struct pt_regs *r " andcm %%r21, %%r19, %%r21\n" " or %1, %%r20, %1\n" " or %2, %%r21, %2\n" -"3: stw %1,0(%%sr1,%1)\n" +"3: stw %1,0(%%sr1,%3)\n" "4: stw %%r1,4(%%sr1,%3)\n" "5: stw %2,8(%%sr1,%3)\n" " copy %%r0, %0\n" @@ -596,7 +596,6 @@ void handle_unaligned(struct pt_regs *re ret =3D ERR_NOTHANDLED; /* "undefined", but lets kill them. */ break; } -#ifdef CONFIG_PA20 switch (regs->iir & OPCODE2_MASK) { case OPCODE_FLDD_L: @@ -607,14 +606,15 @@ void handle_unaligned(struct pt_regs *re flop=3D1; ret =3D emulate_std(regs, R2(regs->iir),1); break; +#ifdef CONFIG_PA20 case OPCODE_LDD_L: ret =3D emulate_ldd(regs, R2(regs->iir),0); break; case OPCODE_STD_L: ret =3D emulate_std(regs, R2(regs->iir),0); break; - } #endif + } switch (regs->iir & OPCODE3_MASK) { case OPCODE_FLDW_L: From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 229A9C433EF for ; Mon, 28 Feb 2022 17:40:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238371AbiB1RlU (ORCPT ); Mon, 28 Feb 2022 12:41:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33622 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238571AbiB1RiA (ORCPT ); Mon, 28 Feb 2022 12:38:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 590E54F9FC; Mon, 28 Feb 2022 09:33:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0C2A1B815A2; Mon, 28 Feb 2022 17:33:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DAA3C340E7; Mon, 28 Feb 2022 17:33:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069592; bh=InIoslegLjVX1Yt8uC/7lVQLPHklSm5DBQNu2ZKpfd0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fPY0Nrf3kxdPatZLPerEaPwu5oUkOgv1X8hUZM8j7coN4gl1cS/DU/n55tWAlwnmS uB+X2NaHd6ljLV3Lnrnz74aKGECHBmp8L3Ul3YtWb+jiMGwY4dGgiUgj4LMUoVyJg4 xCcXITDEFc2vhwKyjehHcim29Z4YVerTq/2QfxIo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller Subject: [PATCH 5.10 07/80] parisc/unaligned: Fix ldw() and stw() unalignment handlers Date: Mon, 28 Feb 2022 18:23:48 +0100 Message-Id: <20220228172312.491283200@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit a97279836867b1cb50a3d4f0b1bf60e0abe6d46c upstream. Fix 3 bugs: a) emulate_stw() doesn't return the error code value, so faulting instructions are not reported and aborted. b) Tell emulate_ldw() to handle fldw_l as floating point instruction c) Tell emulate_ldw() to handle ldw_m as integer instruction Signed-off-by: Helge Deller Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/parisc/kernel/unaligned.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/arch/parisc/kernel/unaligned.c +++ b/arch/parisc/kernel/unaligned.c @@ -340,7 +340,7 @@ static int emulate_stw(struct pt_regs *r : "r" (val), "r" (regs->ior), "r" (regs->isr) : "r19", "r20", "r21", "r22", "r1", FIXUP_BRANCH_CLOBBER ); =20 - return 0; + return ret; } static int emulate_std(struct pt_regs *regs, int frreg, int flop) { @@ -619,10 +619,10 @@ void handle_unaligned(struct pt_regs *re { case OPCODE_FLDW_L: flop=3D1; - ret =3D emulate_ldw(regs, R2(regs->iir),0); + ret =3D emulate_ldw(regs, R2(regs->iir), 1); break; case OPCODE_LDW_M: - ret =3D emulate_ldw(regs, R2(regs->iir),1); + ret =3D emulate_ldw(regs, R2(regs->iir), 0); break; =20 case OPCODE_FSTW_L: From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7F27C433EF for ; Mon, 28 Feb 2022 17:40:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234055AbiB1RlS (ORCPT ); Mon, 28 Feb 2022 12:41:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238573AbiB1RiA (ORCPT ); Mon, 28 Feb 2022 12:38:00 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4485153E0A; Mon, 28 Feb 2022 09:33:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D17E761359; Mon, 28 Feb 2022 17:33:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7B62C340E7; Mon, 28 Feb 2022 17:33:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069595; bh=/3wMuk5dVomCtEwH4m1c/LTp++Sgz0IwaN6J265Drmk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PoSby5mww/dfFpnWSvghIxIroMPBOsStH7CzuHkp5+9nySLLWMbKwOUwWJKTOtK4x mbSEXzAnRmPoEHoGIblFvq6e13rivGKPLl8Rj1RoIJBC/+H9Se3SxlRr6KLgHjHuO1 V5hkEYN1Is9NJ/vMlH8LoqAMHyOZyGK39GeJEwk8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang Zhang , Paolo Bonzini Subject: [PATCH 5.10 08/80] KVM: x86/mmu: make apf token non-zero to fix bug Date: Mon, 28 Feb 2022 18:23:49 +0100 Message-Id: <20220228172312.554378128@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang Zhang commit 6f3c1fc53d86d580d8d6d749c4af23705e4f6f79 upstream. In current async pagefault logic, when a page is ready, KVM relies on kvm_arch_can_dequeue_async_page_present() to determine whether to deliver a READY event to the Guest. This function test token value of struct kvm_vcpu_pv_apf_data, which must be reset to zero by Guest kernel when a READY event is finished by Guest. If value is zero meaning that a READY event is done, so the KVM can deliver another. But the kvm_arch_setup_async_pf() may produce a valid token with zero value, which is confused with previous mention and may lead the loss of this READY event. This bug may cause task blocked forever in Guest: INFO: task stress:7532 blocked for more than 1254 seconds. Not tainted 5.10.0 #16 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. task:stress state:D stack: 0 pid: 7532 ppid: 1409 flags:0x00000080 Call Trace: __schedule+0x1e7/0x650 schedule+0x46/0xb0 kvm_async_pf_task_wait_schedule+0xad/0xe0 ? exit_to_user_mode_prepare+0x60/0x70 __kvm_handle_async_pf+0x4f/0xb0 ? asm_exc_page_fault+0x8/0x30 exc_page_fault+0x6f/0x110 ? asm_exc_page_fault+0x8/0x30 asm_exc_page_fault+0x1e/0x30 RIP: 0033:0x402d00 RSP: 002b:00007ffd31912500 EFLAGS: 00010206 RAX: 0000000000071000 RBX: ffffffffffffffff RCX: 00000000021a32b0 RDX: 000000000007d011 RSI: 000000000007d000 RDI: 00000000021262b0 RBP: 00000000021262b0 R08: 0000000000000003 R09: 0000000000000086 R10: 00000000000000eb R11: 00007fefbdf2baa0 R12: 0000000000000000 R13: 0000000000000002 R14: 000000000007d000 R15: 0000000000001000 Signed-off-by: Liang Zhang Message-Id: <20220222031239.1076682-1-zhangliang5@huawei.com> Cc: stable@vger.kernel.org Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/x86/kvm/mmu/mmu.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -3631,12 +3631,23 @@ static void shadow_page_table_clear_floo walk_shadow_page_lockless_end(vcpu); } =20 +static u32 alloc_apf_token(struct kvm_vcpu *vcpu) +{ + /* make sure the token value is not 0 */ + u32 id =3D vcpu->arch.apf.id; + + if (id << 12 =3D=3D 0) + vcpu->arch.apf.id =3D 1; + + return (vcpu->arch.apf.id++ << 12) | vcpu->vcpu_id; +} + static bool kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gpa_t cr2_or_gp= a, gfn_t gfn) { struct kvm_arch_async_pf arch; =20 - arch.token =3D (vcpu->arch.apf.id++ << 12) | vcpu->vcpu_id; + arch.token =3D alloc_apf_token(vcpu); arch.gfn =3D gfn; arch.direct_map =3D vcpu->arch.mmu->direct_map; arch.cr3 =3D vcpu->arch.mmu->get_guest_pgd(vcpu); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB9EAC433EF for ; Mon, 28 Feb 2022 17:40:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238396AbiB1Rl2 (ORCPT ); Mon, 28 Feb 2022 12:41:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33620 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238574AbiB1RiA (ORCPT ); Mon, 28 Feb 2022 12:38:00 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A0DE0522F7; Mon, 28 Feb 2022 09:33:20 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4E775B815A6; Mon, 28 Feb 2022 17:33:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C0DAC340E7; Mon, 28 Feb 2022 17:33:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069598; bh=LcVPZohZIkyfGskbcpephwf6doAGXodWIzwd7jNBeaA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=TQ0dBSmsj9551NlibONSIytFz+VpCYOAcMc8l5RUPj/N1HJ9MTKyuYwJc16Cx9/5o bl5k2NKnOHcthFO7tMhFtrM8lCcqq5GiPJ+b/fEYWSK+NEz1C9o5NRd2wWPA8ZwZ3P zyO0ME9oiRN0Akmcg1tc0fkbrox7ITDD2pw/1QZ8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Evan Quan , Alex Deucher Subject: [PATCH 5.10 09/80] drm/amdgpu: disable MMHUB PG for Picasso Date: Mon, 28 Feb 2022 18:23:50 +0100 Message-Id: <20220228172312.634310034@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Evan Quan commit f626dd0ff05043e5a7154770cc7cda66acee33a3 upstream. MMHUB PG needs to be disabled for Picasso for stability reasons. Signed-off-by: Evan Quan Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/soc15.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/amd/amdgpu/soc15.c +++ b/drivers/gpu/drm/amd/amdgpu/soc15.c @@ -1194,8 +1194,11 @@ static int soc15_common_early_init(void AMD_CG_SUPPORT_SDMA_MGCG | AMD_CG_SUPPORT_SDMA_LS; =20 + /* + * MMHUB PG needs to be disabled for Picasso for + * stability reasons. + */ adev->pg_flags =3D AMD_PG_SUPPORT_SDMA | - AMD_PG_SUPPORT_MMHUB | AMD_PG_SUPPORT_VCN; } else { adev->cg_flags =3D AMD_CG_SUPPORT_GFX_MGCG | From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C718C433FE for ; Mon, 28 Feb 2022 17:39:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233818AbiB1Rjq (ORCPT ); Mon, 28 Feb 2022 12:39:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42016 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238454AbiB1Rhx (ORCPT ); Mon, 28 Feb 2022 12:37:53 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5ED942DD53; Mon, 28 Feb 2022 09:32:39 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C042961365; Mon, 28 Feb 2022 17:32:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D4C97C340E7; Mon, 28 Feb 2022 17:32:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069558; bh=BrSgRq3SdVWbYi1p7gAqEbYKLkAs4kDps2u2XRj4XnE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QZ19c7kxxJMHC1ZYELX1tR343hCnG5fdR0Rtj/V0JYYp2AUKNIumFYBMlJd/dcBrN aEN7dM0lNh6BpqXUIEOiFWd++ftPkGnBzn0udlA4OWoNDsc78b4+WxxVc807YA3EF2 uUjOr1uzt+HBxwA/lFvVrqLd3ivSLTHlLifxn+Ak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Menzel , =?UTF-8?q?Christian=20K=C3=B6nig?= , Qiang Yu , Alex Deucher Subject: [PATCH 5.10 10/80] drm/amdgpu: check vm ready by amdgpu_vm->evicting flag Date: Mon, 28 Feb 2022 18:23:51 +0100 Message-Id: <20220228172312.712322810@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Qiang Yu commit c1a66c3bc425ff93774fb2f6eefa67b83170dd7e upstream. Workstation application ANSA/META v21.1.4 get this error dmesg when running CI test suite provided by ANSA/META: [drm:amdgpu_gem_va_ioctl [amdgpu]] *ERROR* Couldn't update BO_VA (-16) This is caused by: 1. create a 256MB buffer in invisible VRAM 2. CPU map the buffer and access it causes vm_fault and try to move it to visible VRAM 3. force visible VRAM space and traverse all VRAM bos to check if evicting this bo is valuable 4. when checking a VM bo (in invisible VRAM), amdgpu_vm_evictable() will set amdgpu_vm->evicting, but latter due to not in visible VRAM, won't really evict it so not add it to amdgpu_vm->evicted 5. before next CS to clear the amdgpu_vm->evicting, user VM ops ioctl will pass amdgpu_vm_ready() (check amdgpu_vm->evicted) but fail in amdgpu_vm_bo_update_mapping() (check amdgpu_vm->evicting) and get this error log This error won't affect functionality as next CS will finish the waiting VM ops. But we'd better clear the error log by checking the amdgpu_vm->evicting flag in amdgpu_vm_ready() to stop calling amdgpu_vm_bo_update_mapping() later. Another reason is amdgpu_vm->evicted list holds all BOs (both user buffer and page table), but only page table BOs' eviction prevent VM ops. amdgpu_vm->evicting flag is set only for page table BOs, so we should use evicting flag instead of evicted list in amdgpu_vm_ready(). The side effect of this change is: previously blocked VM op (user buffer in "evicted" list but no page table in it) gets done immediately. v2: update commit comments. Acked-by: Paul Menzel Reviewed-by: Christian K=C3=B6nig Signed-off-by: Qiang Yu Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c @@ -715,11 +715,16 @@ int amdgpu_vm_validate_pt_bos(struct amd * Check if all VM PDs/PTs are ready for updates * * Returns: - * True if eviction list is empty. + * True if VM is not evicting. */ bool amdgpu_vm_ready(struct amdgpu_vm *vm) { - return list_empty(&vm->evicted); + bool ret; + + amdgpu_vm_eviction_lock(vm); + ret =3D !vm->evicting; + amdgpu_vm_eviction_unlock(vm); + return ret; } =20 /** From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6641C433EF for ; Mon, 28 Feb 2022 17:39:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232354AbiB1Rjt (ORCPT ); Mon, 28 Feb 2022 12:39:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238490AbiB1Rhz (ORCPT ); Mon, 28 Feb 2022 12:37:55 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D507543AEE; Mon, 28 Feb 2022 09:32:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 470FCB815AC; Mon, 28 Feb 2022 17:32:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8BB6EC340E7; Mon, 28 Feb 2022 17:32:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069561; bh=KwnSvAIvypkgAY4He7R23xQE0ck3L9g5jFxUpjd0lPM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LHjTpN5nJsuPnfL/fxAhcvhJ6Z4xw5l9+X5klu/LMt8oZhXB6BYjwDUS5vgeePR81 BCyTcDRVfp//p62PkkqHdn2RCoh3k2G9e2FDbnZnyPlQ9jcHif761S4sRB/qwlNY4O 5w5PrLc2cl7kNMTjQQvH+mDlRg1G0IGvUogW7Es8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stanislav Lisovskiy , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Tvrtko Ursulin Subject: [PATCH 5.10 11/80] drm/i915: Correctly populate use_sagv_wm for all pipes Date: Mon, 28 Feb 2022 18:23:52 +0100 Message-Id: <20220228172312.814623524@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ville Syrj=C3=A4l=C3=A4 commit afc189df6bcc6be65961deb54e15ec60e7f85337 upstream. When changing between SAGV vs. no SAGV on tgl+ we have to update the use_sagv_wm flag for all the crtcs or else an active pipe not already in the state will end up using the wrong watermarks. That is especially bad when we end up with the tighter non-SAGV watermarks with SAGV enabled. Usually ends up in underruns. Cc: stable@vger.kernel.org Reviewed-by: Stanislav Lisovskiy Fixes: 7241c57d3140 ("drm/i915: Add TGL+ SAGV support") Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20220218064039.12834-2-= ville.syrjala@linux.intel.com (cherry picked from commit 8dd8ffb824ca7b897ce9f2082ffa7e64831c22dc) Signed-off-by: Tvrtko Ursulin Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/intel_pm.c | 22 +++++++++++----------- 1 file changed, 11 insertions(+), 11 deletions(-) --- a/drivers/gpu/drm/i915/intel_pm.c +++ b/drivers/gpu/drm/i915/intel_pm.c @@ -3996,6 +3996,17 @@ static int intel_compute_sagv_mask(struc return ret; } =20 + if (intel_can_enable_sagv(dev_priv, new_bw_state) !=3D + intel_can_enable_sagv(dev_priv, old_bw_state)) { + ret =3D intel_atomic_serialize_global_state(&new_bw_state->base); + if (ret) + return ret; + } else if (new_bw_state->pipe_sagv_reject !=3D old_bw_state->pipe_sagv_re= ject) { + ret =3D intel_atomic_lock_global_state(&new_bw_state->base); + if (ret) + return ret; + } + for_each_new_intel_crtc_in_state(state, crtc, new_crtc_state, i) { struct skl_pipe_wm *pipe_wm =3D &new_crtc_state->wm.skl.optimal; @@ -4010,17 +4021,6 @@ static int intel_compute_sagv_mask(struc intel_can_enable_sagv(dev_priv, new_bw_state); } =20 - if (intel_can_enable_sagv(dev_priv, new_bw_state) !=3D - intel_can_enable_sagv(dev_priv, old_bw_state)) { - ret =3D intel_atomic_serialize_global_state(&new_bw_state->base); - if (ret) - return ret; - } else if (new_bw_state->pipe_sagv_reject !=3D old_bw_state->pipe_sagv_re= ject) { - ret =3D intel_atomic_lock_global_state(&new_bw_state->base); - if (ret) - return ret; - } - return 0; } =20 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A08AC433F5 for ; Mon, 28 Feb 2022 17:42:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237788AbiB1Rml (ORCPT ); Mon, 28 Feb 2022 12:42:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238491AbiB1Rhz (ORCPT ); Mon, 28 Feb 2022 12:37:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 899CF36B77; Mon, 28 Feb 2022 09:32:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2651661357; Mon, 28 Feb 2022 17:32:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40C15C340E7; Mon, 28 Feb 2022 17:32:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069563; bh=NVZ/13wV06YZ+xr1T2jgfLSQQ++PaVN1I5onuZqPhSI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t/sI5IH1FZeexemT6JOHm2JL3RGvK2TRsPn9XCtzAMx/xF85rz5ydMdxtbwVsdfPk EaBbmGk2EzINjSKgSEGNi14WWqdzBpVkiji30PLgVCdYE7BTxCdEuH6ZtdifwvofOK cnwns0pbxIKAj3pJNZTzsV003nTcyJnF6fOowvu0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Grant Grundler , "David S. Miller" Subject: [PATCH 5.10 12/80] sr9700: sanity check for packet length Date: Mon, 28 Feb 2022 18:23:53 +0100 Message-Id: <20220228172313.117161674@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit e9da0b56fe27206b49f39805f7dcda8a89379062 upstream. A malicious device can leak heap data to user space providing bogus frame lengths. Introduce a sanity check. Signed-off-by: Oliver Neukum Reviewed-by: Grant Grundler Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/usb/sr9700.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/usb/sr9700.c +++ b/drivers/net/usb/sr9700.c @@ -410,7 +410,7 @@ static int sr9700_rx_fixup(struct usbnet /* ignore the CRC length */ len =3D (skb->data[1] | (skb->data[2] << 8)) - 4; =20 - if (len > ETH_FRAME_LEN) + if (len > ETH_FRAME_LEN || len > skb->len) return 0; =20 /* the last packet of current skb */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 935B5C433F5 for ; Mon, 28 Feb 2022 17:42:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238513AbiB1Rmg (ORCPT ); Mon, 28 Feb 2022 12:42:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238493AbiB1Rh4 (ORCPT ); Mon, 28 Feb 2022 12:37:56 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 042B945ADD; Mon, 28 Feb 2022 09:32:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D63C561359; Mon, 28 Feb 2022 17:32:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC8ACC340E7; Mon, 28 Feb 2022 17:32:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069566; bh=TP4BwGbN624ZpZnVOC+khdGnLxAgv8yriN6zeGOsyyM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h7fZ6gQ+7Y7/uPdxtdy8aM8Y1dWAKqoT6rU3n2iXmKqdJfWTctoBae+QZogURjsDe viS5LFtiTgr2RafLwkTckbwtdz4bwursiGCV3Ysg92QoQ6R/Hcw1gpIGzoQfGqToWS RMlfY0DNYyGfD1M1Du1m1r/bZ/krlHfXFXGo2jT4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , Ross Maynard , "David S. Miller" Subject: [PATCH 5.10 13/80] USB: zaurus: support another broken Zaurus Date: Mon, 28 Feb 2022 18:23:54 +0100 Message-Id: <20220228172313.217510281@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit 6605cc67ca18b9d583eb96e18a20f5f4e726103c upstream. This SL-6000 says Direct Line, not Ethernet v2: added Reporter and Link Signed-off-by: Oliver Neukum Reported-by: Ross Maynard Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215361 Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/usb/cdc_ether.c | 12 ++++++++++++ drivers/net/usb/zaurus.c | 12 ++++++++++++ 2 files changed, 24 insertions(+) --- a/drivers/net/usb/cdc_ether.c +++ b/drivers/net/usb/cdc_ether.c @@ -570,6 +570,11 @@ static const struct usb_device_id produc .bInterfaceSubClass =3D USB_CDC_SUBCLASS_ETHERNET, \ .bInterfaceProtocol =3D USB_CDC_PROTO_NONE =20 +#define ZAURUS_FAKE_INTERFACE \ + .bInterfaceClass =3D USB_CLASS_COMM, \ + .bInterfaceSubClass =3D USB_CDC_SUBCLASS_MDLM, \ + .bInterfaceProtocol =3D USB_CDC_PROTO_NONE + /* SA-1100 based Sharp Zaurus ("collie"), or compatible; * wire-incompatible with true CDC Ethernet implementations. * (And, it seems, needlessly so...) @@ -625,6 +630,13 @@ static const struct usb_device_id produc .driver_info =3D 0, }, { .match_flags =3D USB_DEVICE_ID_MATCH_INT_INFO + | USB_DEVICE_ID_MATCH_DEVICE, + .idVendor =3D 0x04DD, + .idProduct =3D 0x9032, /* SL-6000 */ + ZAURUS_FAKE_INTERFACE, + .driver_info =3D 0, +}, { + .match_flags =3D USB_DEVICE_ID_MATCH_INT_INFO | USB_DEVICE_ID_MATCH_DEVICE, .idVendor =3D 0x04DD, /* reported with some C860 units */ --- a/drivers/net/usb/zaurus.c +++ b/drivers/net/usb/zaurus.c @@ -256,6 +256,11 @@ static const struct usb_device_id produc .bInterfaceSubClass =3D USB_CDC_SUBCLASS_ETHERNET, \ .bInterfaceProtocol =3D USB_CDC_PROTO_NONE =20 +#define ZAURUS_FAKE_INTERFACE \ + .bInterfaceClass =3D USB_CLASS_COMM, \ + .bInterfaceSubClass =3D USB_CDC_SUBCLASS_MDLM, \ + .bInterfaceProtocol =3D USB_CDC_PROTO_NONE + /* SA-1100 based Sharp Zaurus ("collie"), or compatible. */ { .match_flags =3D USB_DEVICE_ID_MATCH_INT_INFO @@ -315,6 +320,13 @@ static const struct usb_device_id produc .driver_info =3D ZAURUS_PXA_INFO, }, { .match_flags =3D USB_DEVICE_ID_MATCH_INT_INFO + | USB_DEVICE_ID_MATCH_DEVICE, + .idVendor =3D 0x04DD, + .idProduct =3D 0x9032, /* SL-6000 */ + ZAURUS_FAKE_INTERFACE, + .driver_info =3D (unsigned long)&bogus_mdlm_info, +}, { + .match_flags =3D USB_DEVICE_ID_MATCH_INT_INFO | USB_DEVICE_ID_MATCH_DEVICE, .idVendor =3D 0x04DD, /* reported with some C860 units */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F7B9C433F5 for ; Mon, 28 Feb 2022 17:39:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238230AbiB1Rjx (ORCPT ); Mon, 28 Feb 2022 12:39:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238538AbiB1Rh6 (ORCPT ); Mon, 28 Feb 2022 12:37:58 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 909E750059; Mon, 28 Feb 2022 09:32:51 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4C4ECB815B3; Mon, 28 Feb 2022 17:32:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3F51C340F1; Mon, 28 Feb 2022 17:32:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069569; bh=C6gmUbI3lDqmvA6/v3kymtV/MNnaqkTM8sJlK3mLUn4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CSQ2m6AVeIMWcvfSIO85c9pHFAdMZJuuFz9a3BzQr0KBAHO7oa4PWcMxdyUBEZweH AiGB/VsuUDP0jxye1jekLnnr4GAvoj9Zs1v1BhPY+bIUN4NzE+MgO5fx4xj5fIdvR/ C9IkLFJ8AtKido6oJXtx3mwhIwPrDQkUkWEdYFbM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Oliver Neukum , "David S. Miller" Subject: [PATCH 5.10 14/80] CDC-NCM: avoid overflow in sanity checking Date: Mon, 28 Feb 2022 18:23:55 +0100 Message-Id: <20220228172313.354550555@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Neukum commit 8d2b1a1ec9f559d30b724877da4ce592edc41fdc upstream. A broken device may give an extreme offset like 0xFFF0 and a reasonable length for a fragment. In the sanity check as formulated now, this will create an integer overflow, defeating the sanity check. Both offset and offset + len need to be checked in such a manner that no overflow can occur. And those quantities should be unsigned. Signed-off-by: Oliver Neukum Reviewed-by: Greg Kroah-Hartman Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/usb/cdc_ncm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/net/usb/cdc_ncm.c +++ b/drivers/net/usb/cdc_ncm.c @@ -1702,10 +1702,10 @@ int cdc_ncm_rx_fixup(struct usbnet *dev, { struct sk_buff *skb; struct cdc_ncm_ctx *ctx =3D (struct cdc_ncm_ctx *)dev->data[0]; - int len; + unsigned int len; int nframes; int x; - int offset; + unsigned int offset; union { struct usb_cdc_ncm_ndp16 *ndp16; struct usb_cdc_ncm_ndp32 *ndp32; @@ -1777,8 +1777,8 @@ next_ndp: break; } =20 - /* sanity checking */ - if (((offset + len) > skb_in->len) || + /* sanity checking - watch out for integer wrap*/ + if ((offset > skb_in->len) || (len > skb_in->len - offset) || (len > ctx->rx_max) || (len < ETH_HLEN)) { netif_dbg(dev, rx_err, dev->net, "invalid frame detected (ignored) offset[%u]=3D%u, length=3D%u, skb= =3D%p\n", From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1931AC433FE for ; Mon, 28 Feb 2022 17:39:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238233AbiB1RkA (ORCPT ); Mon, 28 Feb 2022 12:40:00 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238542AbiB1Rh6 (ORCPT ); Mon, 28 Feb 2022 12:37:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E4B8D517CB; Mon, 28 Feb 2022 09:32:52 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3FD5E61358; Mon, 28 Feb 2022 17:32:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5874DC340E7; Mon, 28 Feb 2022 17:32:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069571; bh=Yw6SyZzdlpXfPY/msMJMT04oO7U+wsIO7oEnIK954Oo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q+IE83pH5qU2EAw1ZeU3IwZQyXPMo5gL7t/czI3FawRMigW9ZE4+aAm2lpL6UdLV4 K9IAKDz+L6+8+zYsO6HtZCPe68esZnR2tYIgm7xb/a9+YDR6uIyFdkieKbnWam0D20 5LUG1v6JOFU5Es4LLsuVOAKp+NYPIOVHMw616JeY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pablo Neira Ayuso , Nick Gregory Subject: [PATCH 5.10 15/80] netfilter: nf_tables_offload: incorrect flow offload action array size Date: Mon, 28 Feb 2022 18:23:56 +0100 Message-Id: <20220228172313.447748713@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso commit b1a5983f56e371046dcf164f90bfaf704d2b89f6 upstream. immediate verdict expression needs to allocate one slot in the flow offload action array, however, immediate data expression does not need to do so. fwd and dup expression need to allocate one slot, this is missing. Add a new offload_action interface to report if this expression needs to allocate one slot in the flow offload action array. Fixes: be2861dc36d7 ("netfilter: nft_{fwd,dup}_netdev: add offload support") Reported-and-tested-by: Nick Gregory Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/net/netfilter/nf_tables.h | 2 +- include/net/netfilter/nf_tables_offload.h | 2 -- net/netfilter/nf_tables_offload.c | 3 ++- net/netfilter/nft_dup_netdev.c | 6 ++++++ net/netfilter/nft_fwd_netdev.c | 6 ++++++ net/netfilter/nft_immediate.c | 12 +++++++++++- 6 files changed, 26 insertions(+), 5 deletions(-) --- a/include/net/netfilter/nf_tables.h +++ b/include/net/netfilter/nf_tables.h @@ -825,7 +825,7 @@ struct nft_expr_ops { int (*offload)(struct nft_offload_ctx *ctx, struct nft_flow_rule *flow, const struct nft_expr *expr); - u32 offload_flags; + bool (*offload_action)(const struct nft_expr *expr); const struct nft_expr_type *type; void *data; }; --- a/include/net/netfilter/nf_tables_offload.h +++ b/include/net/netfilter/nf_tables_offload.h @@ -67,8 +67,6 @@ struct nft_flow_rule { struct flow_rule *rule; }; =20 -#define NFT_OFFLOAD_F_ACTION (1 << 0) - void nft_flow_rule_set_addr_type(struct nft_flow_rule *flow, enum flow_dissector_key_id addr_type); =20 --- a/net/netfilter/nf_tables_offload.c +++ b/net/netfilter/nf_tables_offload.c @@ -94,7 +94,8 @@ struct nft_flow_rule *nft_flow_rule_crea =20 expr =3D nft_expr_first(rule); while (nft_expr_more(rule, expr)) { - if (expr->ops->offload_flags & NFT_OFFLOAD_F_ACTION) + if (expr->ops->offload_action && + expr->ops->offload_action(expr)) num_actions++; =20 expr =3D nft_expr_next(expr); --- a/net/netfilter/nft_dup_netdev.c +++ b/net/netfilter/nft_dup_netdev.c @@ -67,6 +67,11 @@ static int nft_dup_netdev_offload(struct return nft_fwd_dup_netdev_offload(ctx, flow, FLOW_ACTION_MIRRED, oif); } =20 +static bool nft_dup_netdev_offload_action(const struct nft_expr *expr) +{ + return true; +} + static struct nft_expr_type nft_dup_netdev_type; static const struct nft_expr_ops nft_dup_netdev_ops =3D { .type =3D &nft_dup_netdev_type, @@ -75,6 +80,7 @@ static const struct nft_expr_ops nft_dup .init =3D nft_dup_netdev_init, .dump =3D nft_dup_netdev_dump, .offload =3D nft_dup_netdev_offload, + .offload_action =3D nft_dup_netdev_offload_action, }; =20 static struct nft_expr_type nft_dup_netdev_type __read_mostly =3D { --- a/net/netfilter/nft_fwd_netdev.c +++ b/net/netfilter/nft_fwd_netdev.c @@ -77,6 +77,11 @@ static int nft_fwd_netdev_offload(struct return nft_fwd_dup_netdev_offload(ctx, flow, FLOW_ACTION_REDIRECT, oif); } =20 +static bool nft_fwd_netdev_offload_action(const struct nft_expr *expr) +{ + return true; +} + struct nft_fwd_neigh { enum nft_registers sreg_dev:8; enum nft_registers sreg_addr:8; @@ -219,6 +224,7 @@ static const struct nft_expr_ops nft_fwd .dump =3D nft_fwd_netdev_dump, .validate =3D nft_fwd_validate, .offload =3D nft_fwd_netdev_offload, + .offload_action =3D nft_fwd_netdev_offload_action, }; =20 static const struct nft_expr_ops * --- a/net/netfilter/nft_immediate.c +++ b/net/netfilter/nft_immediate.c @@ -213,6 +213,16 @@ static int nft_immediate_offload(struct return 0; } =20 +static bool nft_immediate_offload_action(const struct nft_expr *expr) +{ + const struct nft_immediate_expr *priv =3D nft_expr_priv(expr); + + if (priv->dreg =3D=3D NFT_REG_VERDICT) + return true; + + return false; +} + static const struct nft_expr_ops nft_imm_ops =3D { .type =3D &nft_imm_type, .size =3D NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), @@ -224,7 +234,7 @@ static const struct nft_expr_ops nft_imm .dump =3D nft_immediate_dump, .validate =3D nft_immediate_validate, .offload =3D nft_immediate_offload, - .offload_flags =3D NFT_OFFLOAD_F_ACTION, + .offload_action =3D nft_immediate_offload_action, }; =20 struct nft_expr_type nft_imm_type __read_mostly =3D { From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42CD9C433EF for ; Mon, 28 Feb 2022 17:40:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238426AbiB1Rlf (ORCPT ); Mon, 28 Feb 2022 12:41:35 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238558AbiB1Rh7 (ORCPT ); Mon, 28 Feb 2022 12:37:59 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7186E53B5C; Mon, 28 Feb 2022 09:32:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0DD4E609EE; Mon, 28 Feb 2022 17:32:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15C6BC340E7; Mon, 28 Feb 2022 17:32:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069574; bh=6SylHDLmOv0JwBhMhYAiI6qLnfRWw42Ro4CXXV9oZEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tb/pcXxpS9vyO0cbG5j7CLBUdyH8DnKNRN3Wx6YwpTbP9TlTTs+QzDANoKDHbnQSC Im/L7ZfE+BrUR/Fxb8OBqZtK6540eE2i/PAIFtDaohNWRUb2Rxx1o28b/ZCc0dhkcA wZJAfxLAtAw4homyK9tr4DmlI+b9m+63jI/1Zv2Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Brian Geffon , Willis Kung , Dave Hansen Subject: [PATCH 5.10 16/80] x86/fpu: Correct pkru/xstate inconsistency Date: Mon, 28 Feb 2022 18:23:57 +0100 Message-Id: <20220228172313.553949149@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Brian Geffon When eagerly switching PKRU in switch_fpu_finish() it checks that current is not a kernel thread as kernel threads will never use PKRU. It's possible that this_cpu_read_stable() on current_task (ie. get_current()) is returning an old cached value. To resolve this reference next_p directly rather than relying on current. As written it's possible when switching from a kernel thread to a userspace thread to observe a cached PF_KTHREAD flag and never restore the PKRU. And as a result this issue only occurs when switching from a kernel thread to a userspace thread, switching from a non kernel thread works perfectly fine because all that is considered in that situation are the flags from some other non kernel task and the next fpu is passed in to switch_fpu_finish(). This behavior only exists between 5.2 and 5.13 when it was fixed by a rewrite decoupling PKRU from xstate, in: commit 954436989cc5 ("x86/fpu: Remove PKRU handling from switch_fpu_finis= h()") Unfortunately backporting the fix from 5.13 is probably not realistic as it's part of a 60+ patch series which rewrites most of the PKRU handling. Fixes: 0cecca9d03c9 ("x86/fpu: Eager switch PKRU state") Signed-off-by: Brian Geffon Signed-off-by: Willis Kung Tested-by: Willis Kung Cc: # v5.4.x Cc: # v5.10.x Acked-by: Dave Hansen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/x86/include/asm/fpu/internal.h | 13 ++++++++----- arch/x86/kernel/process_32.c | 6 ++---- arch/x86/kernel/process_64.c | 6 ++---- 3 files changed, 12 insertions(+), 13 deletions(-) --- a/arch/x86/include/asm/fpu/internal.h +++ b/arch/x86/include/asm/fpu/internal.h @@ -531,9 +531,11 @@ static inline void __fpregs_load_activat * The FPU context is only stored/restored for a user task and * PF_KTHREAD is used to distinguish between kernel and user threads. */ -static inline void switch_fpu_prepare(struct fpu *old_fpu, int cpu) +static inline void switch_fpu_prepare(struct task_struct *prev, int cpu) { - if (static_cpu_has(X86_FEATURE_FPU) && !(current->flags & PF_KTHREAD)) { + struct fpu *old_fpu =3D &prev->thread.fpu; + + if (static_cpu_has(X86_FEATURE_FPU) && !(prev->flags & PF_KTHREAD)) { if (!copy_fpregs_to_fpstate(old_fpu)) old_fpu->last_cpu =3D -1; else @@ -552,10 +554,11 @@ static inline void switch_fpu_prepare(st * Load PKRU from the FPU context if available. Delay loading of the * complete FPU state until the return to userland. */ -static inline void switch_fpu_finish(struct fpu *new_fpu) +static inline void switch_fpu_finish(struct task_struct *next) { u32 pkru_val =3D init_pkru_value; struct pkru_state *pk; + struct fpu *next_fpu =3D &next->thread.fpu; =20 if (!static_cpu_has(X86_FEATURE_FPU)) return; @@ -569,7 +572,7 @@ static inline void switch_fpu_finish(str * PKRU state is switched eagerly because it needs to be valid before we * return to userland e.g. for a copy_to_user() operation. */ - if (!(current->flags & PF_KTHREAD)) { + if (!(next->flags & PF_KTHREAD)) { /* * If the PKRU bit in xsave.header.xfeatures is not set, * then the PKRU component was in init state, which means @@ -578,7 +581,7 @@ static inline void switch_fpu_finish(str * in memory is not valid. This means pkru_val has to be * set to 0 and not to init_pkru_value. */ - pk =3D get_xsave_addr(&new_fpu->state.xsave, XFEATURE_PKRU); + pk =3D get_xsave_addr(&next_fpu->state.xsave, XFEATURE_PKRU); pkru_val =3D pk ? pk->pkru : 0; } __write_pkru(pkru_val); --- a/arch/x86/kernel/process_32.c +++ b/arch/x86/kernel/process_32.c @@ -159,14 +159,12 @@ __switch_to(struct task_struct *prev_p, { struct thread_struct *prev =3D &prev_p->thread, *next =3D &next_p->thread; - struct fpu *prev_fpu =3D &prev->fpu; - struct fpu *next_fpu =3D &next->fpu; int cpu =3D smp_processor_id(); =20 /* never put a printk in __switch_to... printk() calls wake_up*() indirec= tly */ =20 if (!test_thread_flag(TIF_NEED_FPU_LOAD)) - switch_fpu_prepare(prev_fpu, cpu); + switch_fpu_prepare(prev_p, cpu); =20 /* * Save away %gs. No need to save %fs, as it was saved on the @@ -213,7 +211,7 @@ __switch_to(struct task_struct *prev_p, =20 this_cpu_write(current_task, next_p); =20 - switch_fpu_finish(next_fpu); + switch_fpu_finish(next_p); =20 /* Load the Intel cache allocation PQR MSR. */ resctrl_sched_in(); --- a/arch/x86/kernel/process_64.c +++ b/arch/x86/kernel/process_64.c @@ -535,15 +535,13 @@ __switch_to(struct task_struct *prev_p, { struct thread_struct *prev =3D &prev_p->thread; struct thread_struct *next =3D &next_p->thread; - struct fpu *prev_fpu =3D &prev->fpu; - struct fpu *next_fpu =3D &next->fpu; int cpu =3D smp_processor_id(); =20 WARN_ON_ONCE(IS_ENABLED(CONFIG_DEBUG_ENTRY) && this_cpu_read(irq_count) !=3D -1); =20 if (!test_thread_flag(TIF_NEED_FPU_LOAD)) - switch_fpu_prepare(prev_fpu, cpu); + switch_fpu_prepare(prev_p, cpu); =20 /* We must save %fs and %gs before load_TLS() because * %fs and %gs may be cleared by load_TLS(). @@ -595,7 +593,7 @@ __switch_to(struct task_struct *prev_p, this_cpu_write(current_task, next_p); this_cpu_write(cpu_current_top_of_stack, task_top_of_stack(next_p)); =20 - switch_fpu_finish(next_fpu); + switch_fpu_finish(next_p); =20 /* Reload sp0. */ update_task_stack(next_p); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7BFF8C433EF for ; Mon, 28 Feb 2022 17:46:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235182AbiB1RrT (ORCPT ); Mon, 28 Feb 2022 12:47:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238753AbiB1RnC (ORCPT ); Mon, 28 Feb 2022 12:43:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 37DCE99EE9; Mon, 28 Feb 2022 09:35:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EAAACB815B3; Mon, 28 Feb 2022 17:35:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49771C340F0; Mon, 28 Feb 2022 17:35:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069704; bh=dBtYkSvhfP/MKC7GzCnKXVVASZczZWYeyfLous7eP6w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j4/DU0AH/Ouu/cYb/Lg8IhDvX2yb7qqm20Wr4/fuusL59kXAUVUXMjptmxAHsoKD/ 3SsuBwTXHTlHNgXW72DfRhM7OgQ1WxHNKaLF82Q36BTZrpF5Z+kQvFih4S9rFgj2kS 9FLv+QqpF+BHtQHNQBncLpyPAp0u+mFwzhMQOTd8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sumit Garg , Jens Wiklander Subject: [PATCH 5.10 17/80] tee: export teedev_open() and teedev_close_context() Date: Mon, 28 Feb 2022 18:23:58 +0100 Message-Id: <20220228172313.674843211@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jens Wiklander commit 1e2c3ef0496e72ba9001da5fd1b7ed56ccb30597 upstream. Exports the two functions teedev_open() and teedev_close_context() in order to make it easier to create a driver internal struct tee_context. Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tee/tee_core.c | 6 ++++-- include/linux/tee_drv.h | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 2 deletions(-) --- a/drivers/tee/tee_core.c +++ b/drivers/tee/tee_core.c @@ -43,7 +43,7 @@ static DEFINE_SPINLOCK(driver_lock); static struct class *tee_class; static dev_t tee_devt; =20 -static struct tee_context *teedev_open(struct tee_device *teedev) +struct tee_context *teedev_open(struct tee_device *teedev) { int rc; struct tee_context *ctx; @@ -70,6 +70,7 @@ err: return ERR_PTR(rc); =20 } +EXPORT_SYMBOL_GPL(teedev_open); =20 void teedev_ctx_get(struct tee_context *ctx) { @@ -96,13 +97,14 @@ void teedev_ctx_put(struct tee_context * kref_put(&ctx->refcount, teedev_ctx_release); } =20 -static void teedev_close_context(struct tee_context *ctx) +void teedev_close_context(struct tee_context *ctx) { struct tee_device *teedev =3D ctx->teedev; =20 teedev_ctx_put(ctx); tee_device_put(teedev); } +EXPORT_SYMBOL_GPL(teedev_close_context); =20 static int tee_open(struct inode *inode, struct file *filp) { --- a/include/linux/tee_drv.h +++ b/include/linux/tee_drv.h @@ -582,4 +582,18 @@ struct tee_client_driver { #define to_tee_client_driver(d) \ container_of(d, struct tee_client_driver, driver) =20 +/** + * teedev_open() - Open a struct tee_device + * @teedev: Device to open + * + * @return a pointer to struct tee_context on success or an ERR_PTR on fai= lure. + */ +struct tee_context *teedev_open(struct tee_device *teedev); + +/** + * teedev_close_context() - closes a struct tee_context + * @ctx: The struct tee_context to close + */ +void teedev_close_context(struct tee_context *ctx); + #endif /*__TEE_DRV_H*/ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C3F18C433EF for ; Mon, 28 Feb 2022 17:40:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231419AbiB1RlD (ORCPT ); Mon, 28 Feb 2022 12:41:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238588AbiB1RiB (ORCPT ); Mon, 28 Feb 2022 12:38:01 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9928B5715F; Mon, 28 Feb 2022 09:33:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EABDC61374; Mon, 28 Feb 2022 17:33:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B271C340E7; Mon, 28 Feb 2022 17:33:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069603; bh=AlViE/H7ZXnf4ci5Vul7W8Ps8FfyT9x32LR/bzpcLZs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=siy4q2CVDfE4pCvgYF/rblB55H/t5ZVPUQd/EsLRWYc2XArz14ksT0acaYRZuayre eusmUGzuHcjW38ZkXUmfudVFja/DPrimZZeBc1DKHTt4y70+3a3nz+YA5MsrWgvznJ gncBA/T43I8iK0mI9RXP3tEgfZSr5Kpgds7thrUU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars Persson , Sumit Garg , Jens Wiklander Subject: [PATCH 5.10 18/80] optee: use driver internal tee_context for some rpc Date: Mon, 28 Feb 2022 18:23:59 +0100 Message-Id: <20220228172313.789030930@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jens Wiklander commit aceeafefff736057e8f93f19bbfbef26abd94604 upstream. Adds a driver private tee_context by moving the tee_context in struct optee_notif to struct optee. This tee_context was previously used when doing internal calls to secure world to deliver notification. The new driver internal tee_context is now also when allocating driver private shared memory. This decouples the shared memory object from its original tee_context. This is needed when the life time of such a memory allocation outlives the client tee_context. This patch fixes the problem described below: The addition of a shutdown hook by commit f25889f93184 ("optee: fix tee out of memory failure seen during kexec reboot") introduced a kernel shutdown regression that can be triggered after running the OP-TEE xtest suites. Once the shutdown hook is called it is not possible to communicate any more with the supplicant process because the system is not scheduling task any longer. Thus if the optee driver shutdown path receives a supplicant RPC request from the OP-TEE we will deadlock the kernel's shutdown. Fixes: f25889f93184 ("optee: fix tee out of memory failure seen during kexe= c reboot") Fixes: 217e0250cccb ("tee: use reference counting for tee_context") Reported-by: Lars Persson Cc: stable@vger.kernel.org Reviewed-by: Sumit Garg Signed-off-by: Jens Wiklander [JW: backport to 5.10-stable + update commit message] Signed-off-by: Jens Wiklander Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tee/optee/core.c | 8 ++++++++ drivers/tee/optee/optee_private.h | 2 ++ drivers/tee/optee/rpc.c | 8 +++++--- 3 files changed, 15 insertions(+), 3 deletions(-) --- a/drivers/tee/optee/core.c +++ b/drivers/tee/optee/core.c @@ -588,6 +588,7 @@ static int optee_remove(struct platform_ /* Unregister OP-TEE specific client devices on TEE bus */ optee_unregister_devices(); =20 + teedev_close_context(optee->ctx); /* * Ask OP-TEE to free all cached shared memory objects to decrease * reference counters and also avoid wild pointers in secure world @@ -633,6 +634,7 @@ static int optee_probe(struct platform_d struct optee *optee =3D NULL; void *memremaped_shm =3D NULL; struct tee_device *teedev; + struct tee_context *ctx; u32 sec_caps; int rc; =20 @@ -719,6 +721,12 @@ static int optee_probe(struct platform_d optee_supp_init(&optee->supp); optee->memremaped_shm =3D memremaped_shm; optee->pool =3D pool; + ctx =3D teedev_open(optee->teedev); + if (IS_ERR(ctx)) { + rc =3D PTR_ERR(ctx); + goto err; + } + optee->ctx =3D ctx; =20 /* * Ensure that there are no pre-existing shm objects before enabling --- a/drivers/tee/optee/optee_private.h +++ b/drivers/tee/optee/optee_private.h @@ -70,6 +70,7 @@ struct optee_supp { * struct optee - main service struct * @supp_teedev: supplicant device * @teedev: client device + * @ctx: driver internal TEE context * @invoke_fn: function to issue smc or hvc * @call_queue: queue of threads waiting to call @invoke_fn * @wait_queue: queue of threads from secure world waiting for a @@ -87,6 +88,7 @@ struct optee { struct tee_device *supp_teedev; struct tee_device *teedev; optee_invoke_fn *invoke_fn; + struct tee_context *ctx; struct optee_call_queue call_queue; struct optee_wait_queue wait_queue; struct optee_supp supp; --- a/drivers/tee/optee/rpc.c +++ b/drivers/tee/optee/rpc.c @@ -284,6 +284,7 @@ static struct tee_shm *cmd_alloc_suppl(s } =20 static void handle_rpc_func_cmd_shm_alloc(struct tee_context *ctx, + struct optee *optee, struct optee_msg_arg *arg, struct optee_call_ctx *call_ctx) { @@ -313,7 +314,8 @@ static void handle_rpc_func_cmd_shm_allo shm =3D cmd_alloc_suppl(ctx, sz); break; case OPTEE_MSG_RPC_SHM_TYPE_KERNEL: - shm =3D tee_shm_alloc(ctx, sz, TEE_SHM_MAPPED | TEE_SHM_PRIV); + shm =3D tee_shm_alloc(optee->ctx, sz, + TEE_SHM_MAPPED | TEE_SHM_PRIV); break; default: arg->ret =3D TEEC_ERROR_BAD_PARAMETERS; @@ -470,7 +472,7 @@ static void handle_rpc_func_cmd(struct t break; case OPTEE_MSG_RPC_CMD_SHM_ALLOC: free_pages_list(call_ctx); - handle_rpc_func_cmd_shm_alloc(ctx, arg, call_ctx); + handle_rpc_func_cmd_shm_alloc(ctx, optee, arg, call_ctx); break; case OPTEE_MSG_RPC_CMD_SHM_FREE: handle_rpc_func_cmd_shm_free(ctx, arg); @@ -501,7 +503,7 @@ void optee_handle_rpc(struct tee_context =20 switch (OPTEE_SMC_RETURN_GET_RPC_FUNC(param->a0)) { case OPTEE_SMC_RPC_FUNC_ALLOC: - shm =3D tee_shm_alloc(ctx, param->a1, + shm =3D tee_shm_alloc(optee->ctx, param->a1, TEE_SHM_MAPPED | TEE_SHM_PRIV); if (!IS_ERR(shm) && !tee_shm_get_pa(shm, 0, &pa)) { reg_pair_from_64(¶m->a1, ¶m->a2, pa); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5378DC433EF for ; Mon, 28 Feb 2022 17:41:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238489AbiB1RmR (ORCPT ); Mon, 28 Feb 2022 12:42:17 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238203AbiB1Ri3 (ORCPT ); Mon, 28 Feb 2022 12:38:29 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9C958C7D4; Mon, 28 Feb 2022 09:33:55 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A9439B815B4; Mon, 28 Feb 2022 17:33:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 093DEC340E7; Mon, 28 Feb 2022 17:33:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069633; bh=6dmsWtF2WF6CEy7yiT59gPr76gbVM+Z8NfW08yZAGbI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qTKFgpSxNPkCY9ajyp3ocfMu1ipQPPAlMIXw4jxW5UaNdkBDJ7Uj7kHovNEvPLgUR UmIVQtU+MrAPvCkCLrozCB52rPBN8M5qDwaE3+DO/PeSvuesRa15ap+ijtE894xsmB xrIxyg0ZpUiKj77SdBvbKBgOfFMHBSyc4ZywCKEA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jakub Kicinski , Xin Long Subject: [PATCH 5.10 19/80] ping: remove pr_err from ping_lookup Date: Mon, 28 Feb 2022 18:24:00 +0100 Message-Id: <20220228172313.907429531@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long commit cd33bdcbead882c2e58fdb4a54a7bd75b610a452 upstream. As Jakub noticed, prints should be avoided on the datapath. Also, as packets would never come to the else branch in ping_lookup(), remove pr_err() from ping_lookup(). Fixes: 35a79e64de29 ("ping: fix the dif and sdif check in ping_lookup") Reported-by: Jakub Kicinski Signed-off-by: Xin Long Link: https://lore.kernel.org/r/1ef3f2fcd31bd681a193b1fcf235eee1603819bd.16= 45674068.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/ipv4/ping.c | 1 - 1 file changed, 1 deletion(-) --- a/net/ipv4/ping.c +++ b/net/ipv4/ping.c @@ -187,7 +187,6 @@ static struct sock *ping_lookup(struct n (int)ident, &ipv6_hdr(skb)->daddr, dif); #endif } else { - pr_err("ping: protocol(%x) is not supported\n", ntohs(skb->protocol)); return NULL; } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1CDDC43219 for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238929AbiB1Rnc (ORCPT ); Mon, 28 Feb 2022 12:43:32 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238380AbiB1RkJ (ORCPT ); Mon, 28 Feb 2022 12:40:09 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EEA093989; Mon, 28 Feb 2022 09:34:24 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C5236614D0; Mon, 28 Feb 2022 17:34:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4D08C340E7; Mon, 28 Feb 2022 17:34:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069663; bh=P9+8LyoE7wfKYtVa8BQKxcGYP08SrbQhU1GkxwKfPiQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=R/cXiPaCEr/us3K8n8Tq4DENR2khWXoL9KrAWql3hwMo63nO68y4wPrpq6v+CJpV0 79dbZ449DRhfQwNb8li/nwT29bW/LF7HeGojUH+VVKCd7YBBn3YTbvfEIJD7nl5Acb /0v4sIHc6OmdwCU9ICj0s5eCFaCuG2WfuhKi/O/w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Bayduraev , Jiri Olsa , Adrian Hunter , Alexander Antonov , Alexander Shishkin , Alexei Budankov , Andi Kleen , Ingo Molnar , Namhyung Kim , Peter Zijlstra , Arnaldo Carvalho de Melo Subject: [PATCH 5.10 20/80] perf data: Fix double free in perf_session__delete() Date: Mon, 28 Feb 2022 18:24:01 +0100 Message-Id: <20220228172314.124646966@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexey Bayduraev commit 69560e366fc4d5fca7bebb0e44edbfafc8bcaf05 upstream. When perf_data__create_dir() fails, it calls close_dir(), but perf_session__delete() also calls close_dir() and since dir.version and dir.nr were initialized by perf_data__create_dir(), a double free occurs. This patch moves the initialization of dir.version and dir.nr after successful initialization of dir.files, that prevents double freeing. This behavior is already implemented in perf_data__open_dir(). Fixes: 145520631130bd64 ("perf data: Add perf_data__(create_dir|close_dir) = functions") Signed-off-by: Alexey Bayduraev Acked-by: Jiri Olsa Cc: Adrian Hunter Cc: Alexander Antonov Cc: Alexander Shishkin Cc: Alexei Budankov Cc: Andi Kleen Cc: Ingo Molnar Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20220218152341.5197-2-alexey.v.bayduraev@li= nux.intel.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- tools/perf/util/data.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) --- a/tools/perf/util/data.c +++ b/tools/perf/util/data.c @@ -44,10 +44,6 @@ int perf_data__create_dir(struct perf_da if (!files) return -ENOMEM; =20 - data->dir.version =3D PERF_DIR_VERSION; - data->dir.files =3D files; - data->dir.nr =3D nr; - for (i =3D 0; i < nr; i++) { struct perf_data_file *file =3D &files[i]; =20 @@ -62,6 +58,9 @@ int perf_data__create_dir(struct perf_da file->fd =3D ret; } =20 + data->dir.version =3D PERF_DIR_VERSION; + data->dir.files =3D files; + data->dir.nr =3D nr; return 0; =20 out_err: From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9EED5C433F5 for ; Mon, 28 Feb 2022 17:45:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238484AbiB1Rp4 (ORCPT ); Mon, 28 Feb 2022 12:45:56 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58764 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238565AbiB1Rmv (ORCPT ); Mon, 28 Feb 2022 12:42:51 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D5FA498F52; Mon, 28 Feb 2022 09:34:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 722B6B815BB; Mon, 28 Feb 2022 17:34:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8C94C340E7; Mon, 28 Feb 2022 17:34:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069688; bh=Lx0IS8Gmlt0ON9JS9/mUQFsYYSB2G4HV4Wd3sTPvW9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MXHurM8SrVst+2U3xZXrAh7Zq6MsKQUlskr9n5ld5UVxUp5CI2XymNwJsjbl0srbq ypSmnzQc2fyCVomg086BbFlNMplACk0ZxhGl9D9fX77/ALetph2XeN7A9a5/SrL1Aa xW0U2Gs5xUy15oFZs3ZXW5PWyTA3k9Ni56qoiq+U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Chopra , Alok Prasad , Ariel Elior , Jakub Kicinski Subject: [PATCH 5.10 21/80] bnx2x: fix driver load from initrd Date: Mon, 28 Feb 2022 18:24:02 +0100 Message-Id: <20220228172314.216735723@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manish Chopra commit e13ad1443684f7afaff24cf207e85e97885256bd upstream. Commit b7a49f73059f ("bnx2x: Utilize firmware 7.13.21.0") added new firmware support in the driver with maintaining older firmware compatibility. However, older firmware was not added in MODULE_FIRMWARE() which caused missing firmware files in initrd image leading to driver load failure from initrd. This patch adds MODULE_FIRMWARE() for older firmware version to have firmware files included in initrd. Fixes: b7a49f73059f ("bnx2x: Utilize firmware 7.13.21.0") Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215627 Signed-off-by: Manish Chopra Signed-off-by: Alok Prasad Signed-off-by: Ariel Elior Link: https://lore.kernel.org/r/20220223085720.12021-1-manishc@marvell.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c @@ -100,6 +100,9 @@ MODULE_LICENSE("GPL"); MODULE_FIRMWARE(FW_FILE_NAME_E1); MODULE_FIRMWARE(FW_FILE_NAME_E1H); MODULE_FIRMWARE(FW_FILE_NAME_E2); +MODULE_FIRMWARE(FW_FILE_NAME_E1_V15); +MODULE_FIRMWARE(FW_FILE_NAME_E1H_V15); +MODULE_FIRMWARE(FW_FILE_NAME_E2_V15); =20 int bnx2x_num_queues; module_param_named(num_queues, bnx2x_num_queues, int, 0444); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 327E3C433F5 for ; Mon, 28 Feb 2022 17:45:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236836AbiB1Rpt (ORCPT ); Mon, 28 Feb 2022 12:45:49 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238597AbiB1Rmw (ORCPT ); Mon, 28 Feb 2022 12:42:52 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2A0C98F75; Mon, 28 Feb 2022 09:34:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 256DAB815BD; Mon, 28 Feb 2022 17:34:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F9DFC340E7; Mon, 28 Feb 2022 17:34:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069690; bh=CwDkQx48lBSew6PWqY2oO+ckQUI0hhOjTPxUMJG/TJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tMVDc5aLCJ/OIPrEi1ODruEzmFNKCSUH0SDXo+VckAOLPOo4/C/EV8QEe4gX32Q5H 8khmBCnhAfG8TFnPuaWzvNjK0jx071H/xaO9I0AkRFujUo7575i+Y2i885ILzGW2er FVaK+ZwdDQbg8XZh1TsswzrJBJ/s6CEmzbJiuFJo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Somnath Kotur , Michael Chan , "David S. Miller" Subject: [PATCH 5.10 22/80] bnxt_en: Fix active FEC reporting to ethtool Date: Mon, 28 Feb 2022 18:24:03 +0100 Message-Id: <20220228172314.299795213@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Somnath Kotur commit 84d3c83e6ea7d46cf3de3a54578af73eb24a64f2 upstream. ethtool --show-fec does not show anything when the Active FEC setting in the chip is set to None. Fix it to properly return ETHTOOL_FEC_OFF in that case. Fixes: 8b2775890ad8 ("bnxt_en: Report FEC settings to ethtool.") Signed-off-by: Somnath Kotur Signed-off-by: Michael Chan Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c @@ -1926,6 +1926,9 @@ static int bnxt_get_fecparam(struct net_ case PORT_PHY_QCFG_RESP_ACTIVE_FEC_FEC_RS272_IEEE_ACTIVE: fec->active_fec |=3D ETHTOOL_FEC_LLRS; break; + case PORT_PHY_QCFG_RESP_ACTIVE_FEC_FEC_NONE_ACTIVE: + fec->active_fec |=3D ETHTOOL_FEC_OFF; + break; } return 0; } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99C69C4332F for ; Mon, 28 Feb 2022 17:44:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238438AbiB1Rp2 (ORCPT ); Mon, 28 Feb 2022 12:45:28 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37560 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238630AbiB1Rmx (ORCPT ); Mon, 28 Feb 2022 12:42:53 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E5F399691; Mon, 28 Feb 2022 09:34:56 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B81C3B815C2; Mon, 28 Feb 2022 17:34:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23D4FC340F0; Mon, 28 Feb 2022 17:34:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069693; bh=KLaLLUQPngVoDMNbNCaJS0hsozS2e+bOD7SbsptBLbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CRSbYcIoj9gGyQmlt7IbTBhmgFzzDgfFMElFHSay+a3Xfm2RTMevC280fG9GVMsom jia6HGd6nSUAM6Vph01AJ9RRYubqoQev/k4jM4DrBn7Eshq1TgUOkvteS+RDQHH2WB +W9ft+nH/Tf93xG0AdmHLS4idR4UrAlDomrpUZJI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jon Hunter , Dmitry Osipenko , Dmitry Osipenko , Guenter Roeck Subject: [PATCH 5.10 23/80] hwmon: Handle failure to register sensor with thermal zone correctly Date: Mon, 28 Feb 2022 18:24:04 +0100 Message-Id: <20220228172314.419623059@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guenter Roeck commit 1b5f517cca36292076d9e38fa6e33a257703e62e upstream. If an attempt is made to a sensor with a thermal zone and it fails, the call to devm_thermal_zone_of_sensor_register() may return -ENODEV. This may result in crashes similar to the following. Unable to handle kernel NULL pointer dereference at virtual address 0000000= 0000003cd ... Internal error: Oops: 96000021 [#1] PREEMPT SMP ... pstate: 60400009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=3D--) pc : mutex_lock+0x18/0x60 lr : thermal_zone_device_update+0x40/0x2e0 sp : ffff800014c4fc60 x29: ffff800014c4fc60 x28: ffff365ee3f6e000 x27: ffffdde218426790 x26: ffff365ee3f6e000 x25: 0000000000000000 x24: ffff365ee3f6e000 x23: ffffdde218426870 x22: ffff365ee3f6e000 x21: 00000000000003cd x20: ffff365ee8bf3308 x19: ffffffffffffffed x18: 0000000000000000 x17: ffffdde21842689c x16: ffffdde1cb7a0b7c x15: 0000000000000040 x14: ffffdde21a4889a0 x13: 0000000000000228 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000000 x9 : 0000000000000000 x8 : 0000000001120000 x7 : 0000000000000001 x6 : 0000000000000000 x5 : 0068000878e20f07 x4 : 0000000000000000 x3 : 00000000000003cd x2 : ffff365ee3f6e000 x1 : 0000000000000000 x0 : 00000000000003cd Call trace: mutex_lock+0x18/0x60 hwmon_notify_event+0xfc/0x110 0xffffdde1cb7a0a90 0xffffdde1cb7a0b7c irq_thread_fn+0x2c/0xa0 irq_thread+0x134/0x240 kthread+0x178/0x190 ret_from_fork+0x10/0x20 Code: d503201f d503201f d2800001 aa0103e4 (c8e47c02) Jon Hunter reports that the exact call sequence is: hwmon_notify_event() --> hwmon_thermal_notify() --> thermal_zone_device_update() --> update_temperature() --> mutex_lock() The hwmon core needs to handle all errors returned from calls to devm_thermal_zone_of_sensor_register(). If the call fails with -ENODEV, report that the sensor was not attached to a thermal zone but continue to register the hwmon device. Reported-by: Jon Hunter Cc: Dmitry Osipenko Fixes: 1597b374af222 ("hwmon: Add notification support") Reviewed-by: Dmitry Osipenko Tested-by: Jon Hunter Signed-off-by: Guenter Roeck Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hwmon/hwmon.c | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) --- a/drivers/hwmon/hwmon.c +++ b/drivers/hwmon/hwmon.c @@ -178,12 +178,14 @@ static int hwmon_thermal_add_sensor(stru =20 tzd =3D devm_thermal_zone_of_sensor_register(dev, index, tdata, &hwmon_thermal_ops); - /* - * If CONFIG_THERMAL_OF is disabled, this returns -ENODEV, - * so ignore that error but forward any other error. - */ - if (IS_ERR(tzd) && (PTR_ERR(tzd) !=3D -ENODEV)) - return PTR_ERR(tzd); + if (IS_ERR(tzd)) { + if (PTR_ERR(tzd) !=3D -ENODEV) + return PTR_ERR(tzd); + dev_info(dev, "temp%d_input not attached to any thermal zone\n", + index + 1); + devm_kfree(dev, tdata); + return 0; + } =20 err =3D devm_add_action(dev, hwmon_thermal_remove_sensor, &tdata->node); if (err) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 51688C433F5 for ; Mon, 28 Feb 2022 17:45:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238588AbiB1Rph (ORCPT ); Mon, 28 Feb 2022 12:45:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238634AbiB1Rmx (ORCPT ); Mon, 28 Feb 2022 12:42:53 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2E8299969B; Mon, 28 Feb 2022 09:34:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BAB10614B9; Mon, 28 Feb 2022 17:34:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD159C340F1; Mon, 28 Feb 2022 17:34:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069696; bh=etOvP7NoP4v2nHmtWiP7+UhZSaqYO7n/CO0EwG2H8EM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i/rR29b7bGbZU4wLq8N1ECywapktFuQpEI4r/fJIJgU1n9zjyhs0Y2nLGgVz33CnO NHvWg46JPId2m3rMq2/hcb5a+OpNHnf/hkc/yIZIZqa9FvYYRrmu3UY9zmlMf2eYb8 JoFi4Les7x89jxdKXMYbRMAcdgN6bX2sUIgvvk2I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Felix Maurer , Daniel Borkmann , Yonghong Song , John Fastabend Subject: [PATCH 5.10 24/80] bpf: Do not try bpf_msg_push_data with len 0 Date: Mon, 28 Feb 2022 18:24:05 +0100 Message-Id: <20220228172314.510618848@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Felix Maurer commit 4a11678f683814df82fca9018d964771e02d7e6d upstream. If bpf_msg_push_data() is called with len 0 (as it happens during selftests/bpf/test_sockmap), we do not need to do anything and can return early. Calling bpf_msg_push_data() with len 0 previously lead to a wrong ENOMEM error: we later called get_order(copy + len); if len was 0, copy + len was also often 0 and get_order() returned some undefined value (at the moment 52). alloc_pages() caught that and failed, but then bpf_msg_push_dat= a() returned ENOMEM. This was wrong because we are most probably not out of memory and actually do not need any additional memory. Fixes: 6fff607e2f14b ("bpf: sk_msg program helper bpf_msg_push_data") Signed-off-by: Felix Maurer Signed-off-by: Daniel Borkmann Acked-by: Yonghong Song Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/df69012695c7094ccb1943ca02b4920db3537466.= 1644421921.git.fmaurer@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/core/filter.c | 3 +++ 1 file changed, 3 insertions(+) --- a/net/core/filter.c +++ b/net/core/filter.c @@ -2730,6 +2730,9 @@ BPF_CALL_4(bpf_msg_push_data, struct sk_ if (unlikely(flags)) return -EINVAL; =20 + if (unlikely(len =3D=3D 0)) + return 0; + /* First find the starting scatterlist element */ i =3D msg->sg.start; do { From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EFE2BC433F5 for ; Mon, 28 Feb 2022 17:48:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237974AbiB1RtT (ORCPT ); Mon, 28 Feb 2022 12:49:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238668AbiB1Rmy (ORCPT ); Mon, 28 Feb 2022 12:42:54 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D89A1996B1; Mon, 28 Feb 2022 09:34:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6C12E614AB; Mon, 28 Feb 2022 17:34:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84168C340E7; Mon, 28 Feb 2022 17:34:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069698; bh=FeXWa6P1qRtmPfj0mdtYpxdTQB265wDqpUFzlISXYoI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EmMgkFqcfXWAqOnd3J1zems8l5b/RiMWtgCWT+GSQsCLC8gPhcnYYbaLAw3hkvcUL BjqYYCUQdgLECMxFhX7ZaK3mYA5tmaUJDzFYnWoakZyng2IhVuYE8nKSk6RN1friGM IavfzTXoiardSnFOXgcIeJJtOaTXc2ckoWBjLX2E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Felix Maurer , Alexei Starovoitov , John Fastabend Subject: [PATCH 5.10 25/80] selftests: bpf: Check bpf_msg_push_data return value Date: Mon, 28 Feb 2022 18:24:06 +0100 Message-Id: <20220228172314.611913643@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Felix Maurer commit 61d06f01f9710b327a53492e5add9f972eb909b3 upstream. bpf_msg_push_data may return a non-zero value to indicate an error. The return value should be checked to prevent undetected errors. To indicate an error, the BPF programs now perform a different action than their intended one to make the userspace test program notice the error, i.e., the programs supposed to pass/redirect drop, the program supposed to drop passes. Fixes: 84fbfe026acaa ("bpf: test_sockmap add options to use msg_push_data") Signed-off-by: Felix Maurer Signed-off-by: Alexei Starovoitov Acked-by: John Fastabend Link: https://lore.kernel.org/bpf/89f767bb44005d6b4dd1f42038c438f76b3ebfad.= 1644601294.git.fmaurer@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- tools/testing/selftests/bpf/progs/test_sockmap_kern.h | 26 ++++++++++++-= ----- 1 file changed, 18 insertions(+), 8 deletions(-) --- a/tools/testing/selftests/bpf/progs/test_sockmap_kern.h +++ b/tools/testing/selftests/bpf/progs/test_sockmap_kern.h @@ -235,7 +235,7 @@ SEC("sk_msg1") int bpf_prog4(struct sk_msg_md *msg) { int *bytes, zero =3D 0, one =3D 1, two =3D 2, three =3D 3, four =3D 4, fi= ve =3D 5; - int *start, *end, *start_push, *end_push, *start_pop, *pop; + int *start, *end, *start_push, *end_push, *start_pop, *pop, err =3D 0; =20 bytes =3D bpf_map_lookup_elem(&sock_apply_bytes, &zero); if (bytes) @@ -249,8 +249,11 @@ int bpf_prog4(struct sk_msg_md *msg) bpf_msg_pull_data(msg, *start, *end, 0); start_push =3D bpf_map_lookup_elem(&sock_bytes, &two); end_push =3D bpf_map_lookup_elem(&sock_bytes, &three); - if (start_push && end_push) - bpf_msg_push_data(msg, *start_push, *end_push, 0); + if (start_push && end_push) { + err =3D bpf_msg_push_data(msg, *start_push, *end_push, 0); + if (err) + return SK_DROP; + } start_pop =3D bpf_map_lookup_elem(&sock_bytes, &four); pop =3D bpf_map_lookup_elem(&sock_bytes, &five); if (start_pop && pop) @@ -263,6 +266,7 @@ int bpf_prog6(struct sk_msg_md *msg) { int zero =3D 0, one =3D 1, two =3D 2, three =3D 3, four =3D 4, five =3D 5= , key =3D 0; int *bytes, *start, *end, *start_push, *end_push, *start_pop, *pop, *f; + int err =3D 0; __u64 flags =3D 0; =20 bytes =3D bpf_map_lookup_elem(&sock_apply_bytes, &zero); @@ -279,8 +283,11 @@ int bpf_prog6(struct sk_msg_md *msg) =20 start_push =3D bpf_map_lookup_elem(&sock_bytes, &two); end_push =3D bpf_map_lookup_elem(&sock_bytes, &three); - if (start_push && end_push) - bpf_msg_push_data(msg, *start_push, *end_push, 0); + if (start_push && end_push) { + err =3D bpf_msg_push_data(msg, *start_push, *end_push, 0); + if (err) + return SK_DROP; + } =20 start_pop =3D bpf_map_lookup_elem(&sock_bytes, &four); pop =3D bpf_map_lookup_elem(&sock_bytes, &five); @@ -338,7 +345,7 @@ SEC("sk_msg5") int bpf_prog10(struct sk_msg_md *msg) { int *bytes, *start, *end, *start_push, *end_push, *start_pop, *pop; - int zero =3D 0, one =3D 1, two =3D 2, three =3D 3, four =3D 4, five =3D 5; + int zero =3D 0, one =3D 1, two =3D 2, three =3D 3, four =3D 4, five =3D 5= , err =3D 0; =20 bytes =3D bpf_map_lookup_elem(&sock_apply_bytes, &zero); if (bytes) @@ -352,8 +359,11 @@ int bpf_prog10(struct sk_msg_md *msg) bpf_msg_pull_data(msg, *start, *end, 0); start_push =3D bpf_map_lookup_elem(&sock_bytes, &two); end_push =3D bpf_map_lookup_elem(&sock_bytes, &three); - if (start_push && end_push) - bpf_msg_push_data(msg, *start_push, *end_push, 0); + if (start_push && end_push) { + err =3D bpf_msg_push_data(msg, *start_push, *end_push, 0); + if (err) + return SK_PASS; + } start_pop =3D bpf_map_lookup_elem(&sock_bytes, &four); pop =3D bpf_map_lookup_elem(&sock_bytes, &five); if (start_pop && pop) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 84408C433F5 for ; Mon, 28 Feb 2022 17:45:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238620AbiB1Rpm (ORCPT ); Mon, 28 Feb 2022 12:45:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238683AbiB1Rmz (ORCPT ); Mon, 28 Feb 2022 12:42:55 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 839C199ECB; Mon, 28 Feb 2022 09:35:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 20609614AC; Mon, 28 Feb 2022 17:35:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39A17C340E7; Mon, 28 Feb 2022 17:35:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069701; bh=4ssv4qucDRLkoQOkBmUQ+RTT/LFAQquKHJQzOIfWk9U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xIsoUkxz70HQnQO5JbaLpn+aK7Dr3Ry4pvLnetopKhT3Wlp9RdMxrWiIRKPu+Qa+c DuTzqwwYPVp7Uai8A1pVnymaF3xGFoGKJ7SYa+EK7cDTbYYVmxJDO4hXaE12AbHMDc wyrnBYNupdb9FoR012GUzlmvK2fKzLjy2Z+whM94= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Eric Dumazet , Alexei Starovoitov , Stanislav Fomichev , Brian Vazquez Subject: [PATCH 5.10 26/80] bpf: Add schedule points in batch ops Date: Mon, 28 Feb 2022 18:24:07 +0100 Message-Id: <20220228172314.737638550@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 75134f16e7dd0007aa474b281935c5f42e79f2c8 upstream. syzbot reported various soft lockups caused by bpf batch operations. INFO: task kworker/1:1:27 blocked for more than 140 seconds. INFO: task hung in rcu_barrier Nothing prevents batch ops to process huge amount of data, we need to add schedule points in them. Note that maybe_wait_bpf_programs(map) calls from generic_map_delete_batch() can be factorized by moving the call after the loop. This will be done later in -next tree once we get this fix merged, unless there is strong opinion doing this optimization sooner. Fixes: aa2e93b8e58e ("bpf: Add generic support for update and delete batch = ops") Fixes: cb4d03ab499d ("bpf: Add generic support for lookup batch op") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: Alexei Starovoitov Reviewed-by: Stanislav Fomichev Acked-by: Brian Vazquez Link: https://lore.kernel.org/bpf/20220217181902.808742-1-eric.dumazet@gmai= l.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/bpf/syscall.c | 3 +++ 1 file changed, 3 insertions(+) --- a/kernel/bpf/syscall.c +++ b/kernel/bpf/syscall.c @@ -1308,6 +1308,7 @@ int generic_map_delete_batch(struct bpf_ maybe_wait_bpf_programs(map); if (err) break; + cond_resched(); } if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp))) err =3D -EFAULT; @@ -1365,6 +1366,7 @@ int generic_map_update_batch(struct bpf_ =20 if (err) break; + cond_resched(); } =20 if (copy_to_user(&uattr->batch.count, &cp, sizeof(cp))) @@ -1462,6 +1464,7 @@ int generic_map_lookup_batch(struct bpf_ swap(prev_key, key); retry =3D MAP_LOOKUP_RETRIES; cp++; + cond_resched(); } =20 if (err =3D=3D -EFAULT) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 02154C433F5 for ; Mon, 28 Feb 2022 17:40:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238269AbiB1Rk7 (ORCPT ); Mon, 28 Feb 2022 12:40:59 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42234 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238623AbiB1RiD (ORCPT ); Mon, 28 Feb 2022 12:38:03 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A78C8574B7; Mon, 28 Feb 2022 09:33:28 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 51251B815B8; Mon, 28 Feb 2022 17:33:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B57CFC340E7; Mon, 28 Feb 2022 17:33:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069606; bh=4kI2/S/n0O9DmlesOVz381oQ0Q7ZzS08IRJIbGGKo1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UGn1aFEV3USaW6G7q0KBh2UJ3EycY6RtwJgkQV+6O0NzCCLIB7UKwH9oi/qbo75uU y18DmsAzHeKPmt7qNBlFnFxJ4BgYOP7ByT6oeixR9zq572f22ACrQNG5tRyFyNrbOa /f2bV46G7ZiV10jN+Ty9Fpa+YAusJ5y+6HFerRhk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Jens Axboe , Pavel Begunkov , io-uring , syzbot Subject: [PATCH 5.10 27/80] io_uring: add a schedule point in io_add_buffers() Date: Mon, 28 Feb 2022 18:24:08 +0100 Message-Id: <20220228172314.816217341@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit f240762f88b4b1b58561939ffd44837759756477 upstream. Looping ~65535 times doing kmalloc() calls can trigger soft lockups, especially with DEBUG features (like KASAN). [ 253.536212] watchdog: BUG: soft lockup - CPU#64 stuck for 26s! [b2194178= 89:12575] [ 253.544433] Modules linked in: vfat fat i2c_mux_pca954x i2c_mux spidev c= dc_acm xhci_pci xhci_hcd sha3_generic gq(O) [ 253.544451] CPU: 64 PID: 12575 Comm: b219417889 Tainted: G S O = 5.17.0-smp-DEV #801 [ 253.544457] RIP: 0010:kernel_text_address (./include/asm-generic/section= s.h:192 ./include/linux/kallsyms.h:29 kernel/extable.c:67 kernel/extable.c:= 98) [ 253.544464] Code: 0f 93 c0 48 c7 c1 e0 63 d7 a4 48 39 cb 0f 92 c1 20 c1 = 0f b6 c1 5b 5d c3 90 0f 1f 44 00 00 55 48 89 e5 41 57 41 56 53 48 89 fb <48= > c7 c0 00 00 80 a0 41 be 01 00 00 00 48 39 c7 72 0c 48 c7 c0 40 [ 253.544468] RSP: 0018:ffff8882d8baf4c0 EFLAGS: 00000246 [ 253.544471] RAX: 1ffff1105b175e00 RBX: ffffffffa13ef09a RCX: 00000000a13= ef001 [ 253.544474] RDX: ffffffffa13ef09a RSI: ffff8882d8baf558 RDI: ffffffffa13= ef09a [ 253.544476] RBP: ffff8882d8baf4d8 R08: ffff8882d8baf5e0 R09: 00000000000= 00004 [ 253.544479] R10: ffff8882d8baf5e8 R11: ffffffffa0d59a50 R12: ffff8882eab= 20380 [ 253.544481] R13: ffffffffa0d59a50 R14: dffffc0000000000 R15: 1ffff1105b1= 75eb0 [ 253.544483] FS: 00000000016d3380(0000) GS:ffff88af48c00000(0000) knlGS:= 0000000000000000 [ 253.544486] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 253.544488] CR2: 00000000004af0f0 CR3: 00000002eabfa004 CR4: 00000000003= 706e0 [ 253.544491] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 253.544492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 253.544494] Call Trace: [ 253.544496] [ 253.544498] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544505] __kernel_text_address (kernel/extable.c:78) [ 253.544508] unwind_get_return_address (arch/x86/kernel/unwind_frame.c:19) [ 253.544514] arch_stack_walk (arch/x86/kernel/stacktrace.c:27) [ 253.544517] ? io_queue_sqe (fs/io_uring.c:7143) [ 253.544521] stack_trace_save (kernel/stacktrace.c:123) [ 253.544527] ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:45= mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544531] ? ____kasan_kmalloc (mm/kasan/common.c:39 mm/kasan/common.c:= 45 mm/kasan/common.c:436 mm/kasan/common.c:515) [ 253.544533] ? __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544535] ? kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/sla= b.c:3567) [ 253.544541] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_= uring.c:6828) [ 253.544544] ? __io_queue_sqe (fs/io_uring.c:?) [ 253.544551] __kasan_kmalloc (mm/kasan/common.c:524) [ 253.544553] kmem_cache_alloc_trace (./include/linux/kasan.h:270 mm/slab.= c:3567) [ 253.544556] ? io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_= uring.c:6828) [ 253.544560] io_issue_sqe (fs/io_uring.c:4556 fs/io_uring.c:4589 fs/io_ur= ing.c:6828) [ 253.544564] ? __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c= :436 mm/kasan/common.c:469) [ 253.544567] ? __kasan_slab_alloc (mm/kasan/common.c:39 mm/kasan/common.c= :45 mm/kasan/common.c:436 mm/kasan/common.c:469) [ 253.544569] ? kmem_cache_alloc_bulk (mm/slab.h:732 mm/slab.c:3546) [ 253.544573] ? __io_alloc_req_refill (fs/io_uring.c:2078) [ 253.544578] ? io_submit_sqes (fs/io_uring.c:7441) [ 253.544581] ? __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c= :10096) [ 253.544584] ? __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544587] ? do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/c= ommon.c:80) [ 253.544590] ? entry_SYSCALL_64_after_hwframe (??:?) [ 253.544596] __io_queue_sqe (fs/io_uring.c:?) [ 253.544600] io_queue_sqe (fs/io_uring.c:7143) [ 253.544603] io_submit_sqe (fs/io_uring.c:?) [ 253.544608] io_submit_sqes (fs/io_uring.c:?) [ 253.544612] __se_sys_io_uring_enter (fs/io_uring.c:10154 fs/io_uring.c:1= 0096) [ 253.544616] __x64_sys_io_uring_enter (fs/io_uring.c:10096) [ 253.544619] do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/com= mon.c:80) [ 253.544623] entry_SYSCALL_64_after_hwframe (??:?) Fixes: ddf0322db79c ("io_uring: add IORING_OP_PROVIDE_BUFFERS") Signed-off-by: Eric Dumazet Cc: Jens Axboe Cc: Pavel Begunkov Cc: io-uring Reported-by: syzbot Link: https://lore.kernel.org/r/20220215041003.2394784-1-eric.dumazet@gmail= .com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -4058,6 +4058,7 @@ static int io_add_buffers(struct io_prov } else { list_add_tail(&buf->list, &(*head)->list); } + cond_resched(); } =20 return i ? i : -ENOMEM; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BC29C433EF for ; Mon, 28 Feb 2022 17:39:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235021AbiB1Rka (ORCPT ); Mon, 28 Feb 2022 12:40:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42788 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238662AbiB1RiH (ORCPT ); Mon, 28 Feb 2022 12:38:07 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9252B5838A; Mon, 28 Feb 2022 09:33:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 278B7B815B3; Mon, 28 Feb 2022 17:33:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70D74C340F0; Mon, 28 Feb 2022 17:33:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069608; bh=mtl1djDTMOd0mA6i58EyWhCnA6etY0mXHN8V+K6Gigc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aAcqzGie07tzPOUZbfaVnEmrwOelnBKwGCVI/uaIf7quVsFaL4GJaXx91oZnH5o3N uidfBHoiSAjaFyjoIlwXAGWRO6RdXyssNMp5T9D0ucOBhBSWSqQjkwE4jgHtXFLI3D HlxIXGK4QaRxLtjZfoyaV1FriipORbaT0IOvQzyA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , Jakub Kicinski Subject: [PATCH 5.10 28/80] net: __pskb_pull_tail() & pskb_carve_frag_list() drop_monitor friends Date: Mon, 28 Feb 2022 18:24:09 +0100 Message-Id: <20220228172314.912824184@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit ef527f968ae05c6717c39f49c8709a7e2c19183a upstream. Whenever one of these functions pull all data from an skb in a frag_list, use consume_skb() instead of kfree_skb() to avoid polluting drop monitoring. Fixes: 6fa01ccd8830 ("skbuff: Add pskb_extract() helper function") Signed-off-by: Eric Dumazet Link: https://lore.kernel.org/r/20220220154052.1308469-1-eric.dumazet@gmail= .com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/core/skbuff.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -2139,7 +2139,7 @@ void *__pskb_pull_tail(struct sk_buff *s /* Free pulled out fragments. */ while ((list =3D skb_shinfo(skb)->frag_list) !=3D insp) { skb_shinfo(skb)->frag_list =3D list->next; - kfree_skb(list); + consume_skb(list); } /* And insert new clone at head. */ if (clone) { @@ -6044,7 +6044,7 @@ static int pskb_carve_frag_list(struct s /* Free pulled out fragments. */ while ((list =3D shinfo->frag_list) !=3D insp) { shinfo->frag_list =3D list->next; - kfree_skb(list); + consume_skb(list); } /* And insert new clone at head. */ if (clone) { From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 97E53C433F5 for ; Mon, 28 Feb 2022 17:39:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233216AbiB1Rk1 (ORCPT ); Mon, 28 Feb 2022 12:40:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238677AbiB1RiM (ORCPT ); Mon, 28 Feb 2022 12:38:12 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8ABE558396; Mon, 28 Feb 2022 09:33:32 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 26F0961365; Mon, 28 Feb 2022 17:33:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AD56C340E7; Mon, 28 Feb 2022 17:33:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069611; bh=qK+VQoyk07Wrq8YomqxayQN8UuSK0Eki19yVr7Lbo+4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HNFuLAFzsqLcmjiBg618j2sq0m7uLgpa3M1WIlKkJ5HNKMxTqGSLURYueNToZw4DS JG4IHVXyM4ofXEHSz6U1tLIMuF1DfJvkI3aaLt3SFX1899bkqt5m5BsqPunJsR7K6h 55QjMP7+29nkIIXB0MLx/mS+biAqvynii2TQuHgY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" Subject: [PATCH 5.10 29/80] tipc: Fix end of loop tests for list_for_each_entry() Date: Mon, 28 Feb 2022 18:24:10 +0100 Message-Id: <20220228172315.013367868@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit a1f8fec4dac8bc7b172b2bdbd881e015261a6322 upstream. These tests are supposed to check if the loop exited via a break or not. However the tests are wrong because if we did not exit via a break then "p" is not a valid pointer. In that case, it's the equivalent of "if (*(u32 *)sr =3D=3D *last_key) {". That's going to work most of the tim= e, but there is a potential for those to be equal. Fixes: 1593123a6a49 ("tipc: add name table dump to new netlink api") Fixes: 1a1a143daf84 ("tipc: add publication dump to new netlink api") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/tipc/name_table.c | 2 +- net/tipc/socket.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) --- a/net/tipc/name_table.c +++ b/net/tipc/name_table.c @@ -931,7 +931,7 @@ static int __tipc_nl_add_nametable_publ( list_for_each_entry(p, &sr->all_publ, all_publ) if (p->key =3D=3D *last_key) break; - if (p->key !=3D *last_key) + if (list_entry_is_head(p, &sr->all_publ, all_publ)) return -EPIPE; } else { p =3D list_first_entry(&sr->all_publ, --- a/net/tipc/socket.c +++ b/net/tipc/socket.c @@ -3743,7 +3743,7 @@ static int __tipc_nl_list_sk_publ(struct if (p->key =3D=3D *last_publ) break; } - if (p->key !=3D *last_publ) { + if (list_entry_is_head(p, &tsk->publications, binding_sock)) { /* We never set seq or call nl_dump_check_consistent() * this means that setting prev_seq here will cause the * consistence check to fail in the netlink callback From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1EF81C433F5 for ; Mon, 28 Feb 2022 17:39:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235883AbiB1Rkg (ORCPT ); Mon, 28 Feb 2022 12:40:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238700AbiB1RiO (ORCPT ); Mon, 28 Feb 2022 12:38:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 486FB580DF; Mon, 28 Feb 2022 09:33:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CAE3B61359; Mon, 28 Feb 2022 17:33:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E69D5C340E7; Mon, 28 Feb 2022 17:33:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069614; bh=Ef5KvnxkJ6Iv+ke4WtsG7da/lgdJDeo+xBjd0/3QwCU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O7MMXh3IOvqyjz22OlOZdRBJdyO2MhJR4ahO+somweMK/kMgPwATHULogJiQnoLST hbUjLUoZnj3OLBNbjgWYC3k/sZ9TXAPSFM3Vc9ctwf2cNLsJbZCGteCbUuzLbWfLQf XsXz/58cwX+qOsS2RQcQu8Zqw6PTcPjQSWOxneM4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tao Liu , Willem de Bruijn , "David S. Miller" Subject: [PATCH 5.10 30/80] gso: do not skip outer ip header in case of ipip and net_failover Date: Mon, 28 Feb 2022 18:24:11 +0100 Message-Id: <20220228172315.246668594@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tao Liu commit cc20cced0598d9a5ff91ae4ab147b3b5e99ee819 upstream. We encounter a tcp drop issue in our cloud environment. Packet GROed in host forwards to a VM virtio_net nic with net_failover enabled. VM acts as a IPVS LB with ipip encapsulation. The full path like: host gro -> vm virtio_net rx -> net_failover rx -> ipvs fullnat -> ipip encap -> net_failover tx -> virtio_net tx When net_failover transmits a ipip pkt (gso_type =3D 0x0103, which means SKB_GSO_TCPV4, SKB_GSO_DODGY and SKB_GSO_IPXIP4), there is no gso did because it supports TSO and GSO_IPXIP4. But network_header points to inner ip header. Call Trace: tcp4_gso_segment ------> return NULL inet_gso_segment ------> inner iph, network_header points to ipip_gso_segment inet_gso_segment ------> outer iph skb_mac_gso_segment Afterwards virtio_net transmits the pkt, only inner ip header is modified. And the outer one just keeps unchanged. The pkt will be dropped in remote host. Call Trace: inet_gso_segment ------> inner iph, outer iph is skipped skb_mac_gso_segment __skb_gso_segment validate_xmit_skb validate_xmit_skb_list sch_direct_xmit __qdisc_run __dev_queue_xmit ------> virtio_net dev_hard_start_xmit __dev_queue_xmit ------> net_failover ip_finish_output2 ip_output iptunnel_xmit ip_tunnel_xmit ipip_tunnel_xmit ------> ipip dev_hard_start_xmit __dev_queue_xmit ip_finish_output2 ip_output ip_forward ip_rcv __netif_receive_skb_one_core netif_receive_skb_internal napi_gro_receive receive_buf virtnet_poll net_rx_action The root cause of this issue is specific with the rare combination of SKB_GSO_DODGY and a tunnel device that adds an SKB_GSO_ tunnel option. SKB_GSO_DODGY is set from external virtio_net. We need to reset network header when callbacks.gso_segment() returns NULL. This patch also includes ipv6_gso_segment(), considering SIT, etc. Fixes: cb32f511a70b ("ipip: add GSO/TSO support") Signed-off-by: Tao Liu Reviewed-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/ipv4/af_inet.c | 5 ++++- net/ipv6/ip6_offload.c | 2 ++ 2 files changed, 6 insertions(+), 1 deletion(-) --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -1374,8 +1374,11 @@ struct sk_buff *inet_gso_segment(struct } =20 ops =3D rcu_dereference(inet_offloads[proto]); - if (likely(ops && ops->callbacks.gso_segment)) + if (likely(ops && ops->callbacks.gso_segment)) { segs =3D ops->callbacks.gso_segment(skb, features); + if (!segs) + skb->network_header =3D skb_mac_header(skb) + nhoff - skb->head; + } =20 if (IS_ERR_OR_NULL(segs)) goto out; --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -113,6 +113,8 @@ static struct sk_buff *ipv6_gso_segment( if (likely(ops && ops->callbacks.gso_segment)) { skb_reset_transport_header(skb); segs =3D ops->callbacks.gso_segment(skb, features); + if (!segs) + skb->network_header =3D skb_mac_header(skb) + nhoff - skb->head; } =20 if (IS_ERR_OR_NULL(segs)) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B722CC433F5 for ; Mon, 28 Feb 2022 17:40:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237235AbiB1Rkv (ORCPT ); Mon, 28 Feb 2022 12:40:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42236 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238749AbiB1RiR (ORCPT ); Mon, 28 Feb 2022 12:38:17 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DD5575E67; Mon, 28 Feb 2022 09:33:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 88E1BB815B3; Mon, 28 Feb 2022 17:33:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9A31DC340E7; Mon, 28 Feb 2022 17:33:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069617; bh=nNMUWYZoTVLjwuNczjXsh38Fgsr2bcYrwAKn9EBa2vs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BK6qdzH3OjlBmn9Rx9Q1uL75ju/jsfs2Q/peD0ESsfMmwe4c1Ljdaxo0R7X76gkUl tim9nqqb/4sgTHdSXSBqO8VekPSL7eXDbnCHIOBWVX0QGUjMDqKfxIdXpJk1RyP9U7 X/QvqNnnE7AVIYcASstF6hAFa6HuCiNwlFomBuYE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Blakey , Jakub Kicinski Subject: [PATCH 5.10 31/80] openvswitch: Fix setting ipv6 fields causing hw csum failure Date: Mon, 28 Feb 2022 18:24:12 +0100 Message-Id: <20220228172315.332806257@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Blakey commit d9b5ae5c1b241b91480aa30408be12fe91af834a upstream. Ipv6 ttl, label and tos fields are modified without first pulling/pushing the ipv6 header, which would have updated the hw csum (if available). This might cause csum validation when sending the packet to the stack, as can be seen in the trace below. Fix this by updating skb->csum if available. Trace resulted by ipv6 ttl dec and then sending packet to conntrack [actions: set(ipv6(hlimit=3D63)),ct(zone=3D99)]: [295241.900063] s_pf0vf2: hw csum failure [295241.923191] Call Trace: [295241.925728] [295241.927836] dump_stack+0x5c/0x80 [295241.931240] __skb_checksum_complete+0xac/0xc0 [295241.935778] nf_conntrack_tcp_packet+0x398/0xba0 [nf_conntrack] [295241.953030] nf_conntrack_in+0x498/0x5e0 [nf_conntrack] [295241.958344] __ovs_ct_lookup+0xac/0x860 [openvswitch] [295241.968532] ovs_ct_execute+0x4a7/0x7c0 [openvswitch] [295241.979167] do_execute_actions+0x54a/0xaa0 [openvswitch] [295242.001482] ovs_execute_actions+0x48/0x100 [openvswitch] [295242.006966] ovs_dp_process_packet+0x96/0x1d0 [openvswitch] [295242.012626] ovs_vport_receive+0x6c/0xc0 [openvswitch] [295242.028763] netdev_frame_hook+0xc0/0x180 [openvswitch] [295242.034074] __netif_receive_skb_core+0x2ca/0xcb0 [295242.047498] netif_receive_skb_internal+0x3e/0xc0 [295242.052291] napi_gro_receive+0xba/0xe0 [295242.056231] mlx5e_handle_rx_cqe_mpwrq_rep+0x12b/0x250 [mlx5_core] [295242.062513] mlx5e_poll_rx_cq+0xa0f/0xa30 [mlx5_core] [295242.067669] mlx5e_napi_poll+0xe1/0x6b0 [mlx5_core] [295242.077958] net_rx_action+0x149/0x3b0 [295242.086762] __do_softirq+0xd7/0x2d6 [295242.090427] irq_exit+0xf7/0x100 [295242.093748] do_IRQ+0x7f/0xd0 [295242.096806] common_interrupt+0xf/0xf [295242.100559] [295242.102750] RIP: 0033:0x7f9022e88cbd [295242.125246] RSP: 002b:00007f9022282b20 EFLAGS: 00000246 ORIG_RAX: fffff= fffffffffda [295242.132900] RAX: 0000000000000005 RBX: 0000000000000010 RCX: 0000000000= 000000 [295242.140120] RDX: 00007f9022282ba8 RSI: 00007f9022282a30 RDI: 00007f9014= 005c30 [295242.147337] RBP: 00007f9014014d60 R08: 0000000000000020 R09: 00007f9025= 4a8340 [295242.154557] R10: 00007f9022282a28 R11: 0000000000000246 R12: 0000000000= 000000 [295242.161775] R13: 00007f902308c000 R14: 000000000000002b R15: 00007f9022= b71f40 Fixes: 3fdbd1ce11e5 ("openvswitch: add ipv6 'set' action") Signed-off-by: Paul Blakey Link: https://lore.kernel.org/r/20220223163416.24096-1-paulb@nvidia.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/net/checksum.h | 5 +++++ net/openvswitch/actions.c | 46 ++++++++++++++++++++++++++++++++++++++---= ----- 2 files changed, 43 insertions(+), 8 deletions(-) --- a/include/net/checksum.h +++ b/include/net/checksum.h @@ -139,6 +139,11 @@ static inline void csum_replace2(__sum16 *sum =3D ~csum16_add(csum16_sub(~(*sum), old), new); } =20 +static inline void csum_replace(__wsum *csum, __wsum old, __wsum new) +{ + *csum =3D csum_add(csum_sub(*csum, old), new); +} + struct sk_buff; void inet_proto_csum_replace4(__sum16 *sum, struct sk_buff *skb, __be32 from, __be32 to, bool pseudohdr); --- a/net/openvswitch/actions.c +++ b/net/openvswitch/actions.c @@ -422,12 +422,43 @@ static void set_ipv6_addr(struct sk_buff memcpy(addr, new_addr, sizeof(__be32[4])); } =20 -static void set_ipv6_fl(struct ipv6hdr *nh, u32 fl, u32 mask) +static void set_ipv6_dsfield(struct sk_buff *skb, struct ipv6hdr *nh, u8 i= pv6_tclass, u8 mask) { + u8 old_ipv6_tclass =3D ipv6_get_dsfield(nh); + + ipv6_tclass =3D OVS_MASKED(old_ipv6_tclass, ipv6_tclass, mask); + + if (skb->ip_summed =3D=3D CHECKSUM_COMPLETE) + csum_replace(&skb->csum, (__force __wsum)(old_ipv6_tclass << 12), + (__force __wsum)(ipv6_tclass << 12)); + + ipv6_change_dsfield(nh, ~mask, ipv6_tclass); +} + +static void set_ipv6_fl(struct sk_buff *skb, struct ipv6hdr *nh, u32 fl, u= 32 mask) +{ + u32 ofl; + + ofl =3D nh->flow_lbl[0] << 16 | nh->flow_lbl[1] << 8 | nh->flow_lbl[2]; + fl =3D OVS_MASKED(ofl, fl, mask); + /* Bits 21-24 are always unmasked, so this retains their values. */ - OVS_SET_MASKED(nh->flow_lbl[0], (u8)(fl >> 16), (u8)(mask >> 16)); - OVS_SET_MASKED(nh->flow_lbl[1], (u8)(fl >> 8), (u8)(mask >> 8)); - OVS_SET_MASKED(nh->flow_lbl[2], (u8)fl, (u8)mask); + nh->flow_lbl[0] =3D (u8)(fl >> 16); + nh->flow_lbl[1] =3D (u8)(fl >> 8); + nh->flow_lbl[2] =3D (u8)fl; + + if (skb->ip_summed =3D=3D CHECKSUM_COMPLETE) + csum_replace(&skb->csum, (__force __wsum)htonl(ofl), (__force __wsum)hto= nl(fl)); +} + +static void set_ipv6_ttl(struct sk_buff *skb, struct ipv6hdr *nh, u8 new_t= tl, u8 mask) +{ + new_ttl =3D OVS_MASKED(nh->hop_limit, new_ttl, mask); + + if (skb->ip_summed =3D=3D CHECKSUM_COMPLETE) + csum_replace(&skb->csum, (__force __wsum)(nh->hop_limit << 8), + (__force __wsum)(new_ttl << 8)); + nh->hop_limit =3D new_ttl; } =20 static void set_ip_ttl(struct sk_buff *skb, struct iphdr *nh, u8 new_ttl, @@ -545,18 +576,17 @@ static int set_ipv6(struct sk_buff *skb, } } if (mask->ipv6_tclass) { - ipv6_change_dsfield(nh, ~mask->ipv6_tclass, key->ipv6_tclass); + set_ipv6_dsfield(skb, nh, key->ipv6_tclass, mask->ipv6_tclass); flow_key->ip.tos =3D ipv6_get_dsfield(nh); } if (mask->ipv6_label) { - set_ipv6_fl(nh, ntohl(key->ipv6_label), + set_ipv6_fl(skb, nh, ntohl(key->ipv6_label), ntohl(mask->ipv6_label)); flow_key->ipv6.label =3D *(__be32 *)nh & htonl(IPV6_FLOWINFO_FLOWLABEL); } if (mask->ipv6_hlimit) { - OVS_SET_MASKED(nh->hop_limit, key->ipv6_hlimit, - mask->ipv6_hlimit); + set_ipv6_ttl(skb, nh, key->ipv6_hlimit, mask->ipv6_hlimit); flow_key->ip.ttl =3D nh->hop_limit; } return 0; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CC09C433EF for ; Mon, 28 Feb 2022 17:40:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236078AbiB1Rkm (ORCPT ); Mon, 28 Feb 2022 12:40:42 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238748AbiB1RiR (ORCPT ); Mon, 28 Feb 2022 12:38:17 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CF7EF75E71; Mon, 28 Feb 2022 09:33:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 671D061359; Mon, 28 Feb 2022 17:33:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7EE84C340F0; Mon, 28 Feb 2022 17:33:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069619; bh=R5DMwCwK+whreYg186mFVdawgTW45Ryu8lb5CGcImaI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v2c/x5ct0L19HTBl840Gh19hC0lfP5sBoQHyE8mRIT/kPWvCKj1X3VoVq6VnZ/cEQ xhD0+lrBPhtnc6VRxw2n+VKdKNWeWM+INQm6UBFXWfJc5kIooMrt1VdqeJS0xpe9BK xQaO8rZtfQKvRccGS+4ZZWLpEePIWqw15kc1JWoE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Matthias Reichl , Maxime Ripard Subject: [PATCH 5.10 32/80] drm/edid: Always set RGB444 Date: Mon, 28 Feb 2022 18:24:13 +0100 Message-Id: <20220228172315.423171903@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Maxime Ripard commit ecbd4912a693b862e25cba0a6990a8c95b00721e upstream. In order to fill the drm_display_info structure each time an EDID is read, the code currently will call drm_add_display_info with the parsed EDID. drm_add_display_info will then call drm_reset_display_info to reset all the fields to 0, and then set them to the proper value depending on the EDID. In the color_formats case, we will thus report that we don't support any color format, and then fill it back with RGB444 plus the additional formats described in the EDID Feature Support byte. However, since that byte only contains format-related bits since the 1.4 specification, this doesn't happen if the EDID is following an earlier specification. In turn, it means that for one of these EDID, we end up with color_formats set to 0. The EDID 1.3 specification never really specifies what it means by RGB exactly, but since both HDMI and DVI will use RGB444, it's fairly safe to assume it's supposed to be RGB444. Let's move the addition of RGB444 to color_formats earlier in drm_add_display_info() so that it's always set for a digital display. Fixes: da05a5a71ad8 ("drm: parse color format support for digital displays") Cc: Ville Syrj=C3=A4l=C3=A4 Reported-by: Matthias Reichl Signed-off-by: Maxime Ripard Reviewed-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20220203115416.1137308-= 1-maxime@cerno.tech Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/drm_edid.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -5132,6 +5132,7 @@ u32 drm_add_display_info(struct drm_conn if (!(edid->input & DRM_EDID_INPUT_DIGITAL)) return quirks; =20 + info->color_formats |=3D DRM_COLOR_FORMAT_RGB444; drm_parse_cea_ext(connector, edid); =20 /* @@ -5180,7 +5181,6 @@ u32 drm_add_display_info(struct drm_conn DRM_DEBUG("%s: Assigning EDID-1.4 digital sink color depth as %d bpc.\n", connector->name, info->bpc); =20 - info->color_formats |=3D DRM_COLOR_FORMAT_RGB444; if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB444) info->color_formats |=3D DRM_COLOR_FORMAT_YCRCB444; if (edid->features & DRM_EDID_FEATURE_RGB_YCRCB422) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9887EC433EF for ; Mon, 28 Feb 2022 17:40:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232346AbiB1Rkq (ORCPT ); Mon, 28 Feb 2022 12:40:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34828 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238788AbiB1RiW (ORCPT ); Mon, 28 Feb 2022 12:38:22 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 485C77D02D; Mon, 28 Feb 2022 09:33:45 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 025E1B815C5; Mon, 28 Feb 2022 17:33:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 36509C340F1; Mon, 28 Feb 2022 17:33:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069622; bh=2V6guBmpGFOk5qPU8UnCpHCk4D2ma3AaHaBwJoIQgjg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dwKdU2enUihdMnIycqxP/Zewx9TMXM4aBfds1nbuXQMd8DOLLxcO64I2HKPRiYyMX hxw7VuyH1acq+605PtYIZyOHAqx2jqRwu517xKz+3uJLAMt/ncKExEXSQB7uuYDsAd rEg4Sff1cX6yKI18EIYHRRS7zindkSYQhH2OIjRw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gal Pressman , Tariq Toukan , Saeed Mahameed Subject: [PATCH 5.10 33/80] net/mlx5e: Fix wrong return value on ioctl EEPROM query failure Date: Mon, 28 Feb 2022 18:24:14 +0100 Message-Id: <20220228172315.506900227@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gal Pressman commit 0b89429722353d112f8b8b29ca397e95fa994d27 upstream. The ioctl EEPROM query wrongly returns success on read failures, fix that by returning the appropriate error code. Fixes: bb64143eee8c ("net/mlx5e: Add ethtool support for dump module EEPROM= ") Signed-off-by: Gal Pressman Reviewed-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_ethtool.c @@ -1746,7 +1746,7 @@ static int mlx5e_get_module_eeprom(struc if (size_read < 0) { netdev_err(priv->netdev, "%s: mlx5_query_eeprom failed:0x%x\n", __func__, size_read); - return 0; + return size_read; } =20 i +=3D size_read; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 658FEC433F5 for ; Mon, 28 Feb 2022 17:40:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238338AbiB1RlG (ORCPT ); Mon, 28 Feb 2022 12:41:06 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233239AbiB1RiY (ORCPT ); Mon, 28 Feb 2022 12:38:24 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 805A285669; Mon, 28 Feb 2022 09:33:47 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63C62B815B4; Mon, 28 Feb 2022 17:33:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7BB2C340E7; Mon, 28 Feb 2022 17:33:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069625; bh=9UeXGo99m0LxgDlUp16RQJ3NOi3KlH6cTMp6KlLsTGw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L1fGNzSeSMaoTRaNByosBmWCM39Y98GxrKl0NSnDHqlQDnCCFhHhf0d2SHjOLlBGN XWsTNv++qSFSFI53fNJm26lMZHmjapH6zrUzqH3W2aZYqudxhMk7jSJL33WP3Hy56f vmOYVQVzACGWPUFqhRHPX2pzkyx8dIN5VCScJAZQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Blakey , Marcelo Ricardo Leitner , "David S. Miller" Subject: [PATCH 5.10 34/80] net/sched: act_ct: Fix flow table lookup after ct clear or switching zones Date: Mon, 28 Feb 2022 18:24:15 +0100 Message-Id: <20220228172315.596722738@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Blakey commit 2f131de361f6d0eaff17db26efdb844c178432f8 upstream. Flow table lookup is skipped if packet either went through ct clear action (which set the IP_CT_UNTRACKED flag on the packet), or while switching zones and there is already a connection associated with the packet. This will result in no SW offload of the connection, and the and connection not being removed from flow table with TCP teardown (fin/rst packet). To fix the above, remove these unneccary checks in flow table lookup. Fixes: 46475bb20f4b ("net/sched: act_ct: Software offload of established fl= ows") Signed-off-by: Paul Blakey Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/sched/act_ct.c | 5 ----- 1 file changed, 5 deletions(-) --- a/net/sched/act_ct.c +++ b/net/sched/act_ct.c @@ -514,11 +514,6 @@ static bool tcf_ct_flow_table_lookup(str struct nf_conn *ct; u8 dir; =20 - /* Previously seen or loopback */ - ct =3D nf_ct_get(skb, &ctinfo); - if ((ct && !nf_ct_is_template(ct)) || ctinfo =3D=3D IP_CT_UNTRACKED) - return false; - switch (family) { case NFPROTO_IPV4: if (!tcf_ct_flow_table_fill_tuple_ipv4(skb, &tuple, &tcph)) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFE5DC433EF for ; Mon, 28 Feb 2022 17:41:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233850AbiB1Rll (ORCPT ); Mon, 28 Feb 2022 12:41:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235379AbiB1RiZ (ORCPT ); Mon, 28 Feb 2022 12:38:25 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 79A8A8595E; Mon, 28 Feb 2022 09:33:50 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2ED47B815B3; Mon, 28 Feb 2022 17:33:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80DF6C36AE7; Mon, 28 Feb 2022 17:33:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069627; bh=lQ+7k5oeZm6QWxae9IbuqKGb12GEJxBClUai0U7CMSM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JuQz/aegm32fyo9g9NtMgafoxlwfmAv5WpOI0DqHRsCC9uwStZggswN3S75OPcga5 UauwcOv5gHZXqIQ9gb+dW7gV5iSpdPbAH9COhp+T4aywmUZtWeYUo0B6JYEFnUNRKe JKEFTzd68ySGQl/AYB+alkVvdxr1ma+SkdNdRNrM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaoke Wang , "David S. Miller" Subject: [PATCH 5.10 35/80] net: ll_temac: check the return value of devm_kmalloc() Date: Mon, 28 Feb 2022 18:24:16 +0100 Message-Id: <20220228172315.690261354@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaoke Wang commit b352c3465bb808ab700d03f5bac2f7a6f37c5350 upstream. devm_kmalloc() returns a pointer to allocated memory on success, NULL on failure. While lp->indirect_lock is allocated by devm_kmalloc() without proper check. It is better to check the value of it to prevent potential wrong memory access. Fixes: f14f5c11f051 ("net: ll_temac: Support indirect_mutex share within TE= MAC IP") Signed-off-by: Xiaoke Wang Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/xilinx/ll_temac_main.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/ethernet/xilinx/ll_temac_main.c +++ b/drivers/net/ethernet/xilinx/ll_temac_main.c @@ -1421,6 +1421,8 @@ static int temac_probe(struct platform_d lp->indirect_lock =3D devm_kmalloc(&pdev->dev, sizeof(*lp->indirect_lock), GFP_KERNEL); + if (!lp->indirect_lock) + return -ENOMEM; spin_lock_init(lp->indirect_lock); } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A6C75C433EF for ; Mon, 28 Feb 2022 17:41:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238477AbiB1RmP (ORCPT ); Mon, 28 Feb 2022 12:42:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237387AbiB1Ri2 (ORCPT ); Mon, 28 Feb 2022 12:38:28 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 78D538A6C9; Mon, 28 Feb 2022 09:33:53 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 012AAB815BA; Mon, 28 Feb 2022 17:33:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3D2C8C340E7; Mon, 28 Feb 2022 17:33:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069630; bh=31R7M9ttApfrfSsmOywRvC7exLj0JmDK2xRcnkyqv7A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1V03lX4sJKkXPqAZ5kQWJLmtRdGbYxiAe3K3E1xMaJ5LjTVnNnDFJkXA+JtiQFC25 0vI2MaoDAXctZkffjtLBEm4XdsZ8O8R9s1VwsEvvHP7UlvM57vKae929L1D3mMlAg5 7OBlXUxIWC8VG1GBVACZ1e/qqfmaAx7Xl+BDoOqo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Masahiro Yamada , Nick Desaulniers , Andrew Morton , Christophe Leroy , "David S. Miller" Subject: [PATCH 5.10 36/80] net: Force inlining of checksum functions in net/checksum.h Date: Mon, 28 Feb 2022 18:24:17 +0100 Message-Id: <20220228172315.795212309@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe Leroy commit 5486f5bf790b5c664913076c3194b8f916a5c7ad upstream. All functions defined as static inline in net/checksum.h are meant to be inlined for performance reason. But since commit ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly") the compiler is allowed to uninline functions when it wants. Fair enough in the general case, but for tiny performance critical checksum helpers that's counter-productive. The problem mainly arises when selecting CONFIG_CC_OPTIMISE_FOR_SIZE, Those helpers being 'static inline' in header files you suddenly find them duplicated many times in the resulting vmlinux. Here is a typical exemple when building powerpc pmac32_defconfig with CONFIG_CC_OPTIMISE_FOR_SIZE. csum_sub() appears 4 times: c04a23cc : c04a23cc: 7c 84 20 f8 not r4,r4 c04a23d0: 7c 63 20 14 addc r3,r3,r4 c04a23d4: 7c 63 01 94 addze r3,r3 c04a23d8: 4e 80 00 20 blr ... c04a2ce8: 4b ff f6 e5 bl c04a23cc ... c04a2d2c: 4b ff f6 a1 bl c04a23cc ... c04a2d54: 4b ff f6 79 bl c04a23cc ... c04a754c : c04a754c: 7c 84 20 f8 not r4,r4 c04a7550: 7c 63 20 14 addc r3,r3,r4 c04a7554: 7c 63 01 94 addze r3,r3 c04a7558: 4e 80 00 20 blr ... c04ac930: 4b ff ac 1d bl c04a754c ... c04ad264: 4b ff a2 e9 bl c04a754c ... c04e3b08 : c04e3b08: 7c 84 20 f8 not r4,r4 c04e3b0c: 7c 63 20 14 addc r3,r3,r4 c04e3b10: 7c 63 01 94 addze r3,r3 c04e3b14: 4e 80 00 20 blr ... c04e5788: 4b ff e3 81 bl c04e3b08 ... c04e65c8: 4b ff d5 41 bl c04e3b08 ... c0512d34 : c0512d34: 7c 84 20 f8 not r4,r4 c0512d38: 7c 63 20 14 addc r3,r3,r4 c0512d3c: 7c 63 01 94 addze r3,r3 c0512d40: 4e 80 00 20 blr ... c0512dfc: 4b ff ff 39 bl c0512d34 ... c05138bc: 4b ff f4 79 bl c0512d34 ... Restore the expected behaviour by using __always_inline for all functions defined in net/checksum.h vmlinux size is even reduced by 256 bytes with this patch: text data bss dec hex filename 6980022 2515362 194384 9689768 93daa8 vmlinux.before 6979862 2515266 194384 9689512 93d9a8 vmlinux.now Fixes: ac7c3e4ff401 ("compiler: enable CONFIG_OPTIMIZE_INLINING forcibly") Cc: Masahiro Yamada Cc: Nick Desaulniers Cc: Andrew Morton Signed-off-by: Christophe Leroy Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/net/checksum.h | 43 ++++++++++++++++++++++--------------------- 1 file changed, 22 insertions(+), 21 deletions(-) --- a/include/net/checksum.h +++ b/include/net/checksum.h @@ -22,7 +22,7 @@ #include =20 #ifndef _HAVE_ARCH_COPY_AND_CSUM_FROM_USER -static inline +static __always_inline __wsum csum_and_copy_from_user (const void __user *src, void *dst, int len) { @@ -33,7 +33,7 @@ __wsum csum_and_copy_from_user (const vo #endif =20 #ifndef HAVE_CSUM_COPY_USER -static __inline__ __wsum csum_and_copy_to_user +static __always_inline __wsum csum_and_copy_to_user (const void *src, void __user *dst, int len) { __wsum sum =3D csum_partial(src, len, ~0U); @@ -45,7 +45,7 @@ static __inline__ __wsum csum_and_copy_t #endif =20 #ifndef _HAVE_ARCH_CSUM_AND_COPY -static inline __wsum +static __always_inline __wsum csum_partial_copy_nocheck(const void *src, void *dst, int len) { memcpy(dst, src, len); @@ -54,7 +54,7 @@ csum_partial_copy_nocheck(const void *sr #endif =20 #ifndef HAVE_ARCH_CSUM_ADD -static inline __wsum csum_add(__wsum csum, __wsum addend) +static __always_inline __wsum csum_add(__wsum csum, __wsum addend) { u32 res =3D (__force u32)csum; res +=3D (__force u32)addend; @@ -62,12 +62,12 @@ static inline __wsum csum_add(__wsum csu } #endif =20 -static inline __wsum csum_sub(__wsum csum, __wsum addend) +static __always_inline __wsum csum_sub(__wsum csum, __wsum addend) { return csum_add(csum, ~addend); } =20 -static inline __sum16 csum16_add(__sum16 csum, __be16 addend) +static __always_inline __sum16 csum16_add(__sum16 csum, __be16 addend) { u16 res =3D (__force u16)csum; =20 @@ -75,12 +75,12 @@ static inline __sum16 csum16_add(__sum16 return (__force __sum16)(res + (res < (__force u16)addend)); } =20 -static inline __sum16 csum16_sub(__sum16 csum, __be16 addend) +static __always_inline __sum16 csum16_sub(__sum16 csum, __be16 addend) { return csum16_add(csum, ~addend); } =20 -static inline __wsum +static __always_inline __wsum csum_block_add(__wsum csum, __wsum csum2, int offset) { u32 sum =3D (__force u32)csum2; @@ -92,36 +92,37 @@ csum_block_add(__wsum csum, __wsum csum2 return csum_add(csum, (__force __wsum)sum); } =20 -static inline __wsum +static __always_inline __wsum csum_block_add_ext(__wsum csum, __wsum csum2, int offset, int len) { return csum_block_add(csum, csum2, offset); } =20 -static inline __wsum +static __always_inline __wsum csum_block_sub(__wsum csum, __wsum csum2, int offset) { return csum_block_add(csum, ~csum2, offset); } =20 -static inline __wsum csum_unfold(__sum16 n) +static __always_inline __wsum csum_unfold(__sum16 n) { return (__force __wsum)n; } =20 -static inline __wsum csum_partial_ext(const void *buff, int len, __wsum su= m) +static __always_inline +__wsum csum_partial_ext(const void *buff, int len, __wsum sum) { return csum_partial(buff, len, sum); } =20 #define CSUM_MANGLED_0 ((__force __sum16)0xffff) =20 -static inline void csum_replace_by_diff(__sum16 *sum, __wsum diff) +static __always_inline void csum_replace_by_diff(__sum16 *sum, __wsum diff) { *sum =3D csum_fold(csum_add(diff, ~csum_unfold(*sum))); } =20 -static inline void csum_replace4(__sum16 *sum, __be32 from, __be32 to) +static __always_inline void csum_replace4(__sum16 *sum, __be32 from, __be3= 2 to) { __wsum tmp =3D csum_sub(~csum_unfold(*sum), (__force __wsum)from); =20 @@ -134,7 +135,7 @@ static inline void csum_replace4(__sum16 * m : old value of a 16bit field * m' : new value of a 16bit field */ -static inline void csum_replace2(__sum16 *sum, __be16 old, __be16 new) +static __always_inline void csum_replace2(__sum16 *sum, __be16 old, __be16= new) { *sum =3D ~csum16_add(csum16_sub(~(*sum), old), new); } @@ -153,16 +154,16 @@ void inet_proto_csum_replace16(__sum16 * void inet_proto_csum_replace_by_diff(__sum16 *sum, struct sk_buff *skb, __wsum diff, bool pseudohdr); =20 -static inline void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *= skb, - __be16 from, __be16 to, - bool pseudohdr) +static __always_inline +void inet_proto_csum_replace2(__sum16 *sum, struct sk_buff *skb, + __be16 from, __be16 to, bool pseudohdr) { inet_proto_csum_replace4(sum, skb, (__force __be32)from, (__force __be32)to, pseudohdr); } =20 -static inline __wsum remcsum_adjust(void *ptr, __wsum csum, - int start, int offset) +static __always_inline __wsum remcsum_adjust(void *ptr, __wsum csum, + int start, int offset) { __sum16 *psum =3D (__sum16 *)(ptr + offset); __wsum delta; @@ -178,7 +179,7 @@ static inline __wsum remcsum_adjust(void return delta; } =20 -static inline void remcsum_unadjust(__sum16 *psum, __wsum delta) +static __always_inline void remcsum_unadjust(__sum16 *psum, __wsum delta) { *psum =3D csum_fold(csum_sub(delta, (__force __wsum)*psum)); } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 324B4C433F5 for ; Mon, 28 Feb 2022 17:41:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236429AbiB1RmV (ORCPT ); Mon, 28 Feb 2022 12:42:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33680 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238397AbiB1Ril (ORCPT ); Mon, 28 Feb 2022 12:38:41 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DA7298E1BC; Mon, 28 Feb 2022 09:33:58 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6501FB815B8; Mon, 28 Feb 2022 17:33:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C616EC340E7; Mon, 28 Feb 2022 17:33:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069636; bh=Bpsb1rp0neLYVsyJi0rU++lKp9fmwiwEbLY+ew+FR2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YnSqX/PTuZ1Gh07f2KfflsQS9XTKgWQsZbVNKrAYyqVuBKzj6xLdQPWWYStNiuPhH kdStfcd1j9Cllwai5cFcH5NUA2Pr14wvS6KJYYtmShJ2uY6IpG+1ZQWRq8iKFY6+kg bOVZlRwpwVkybwtjxo2G/CId2v75z9mx4esVjtlA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Simon Horman , Jakub Kicinski Subject: [PATCH 5.10 37/80] nfp: flower: Fix a potential leak in nfp_tunnel_add_shared_mac() Date: Mon, 28 Feb 2022 18:24:18 +0100 Message-Id: <20220228172316.011577137@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET commit 3a14d0888eb4b0045884126acc69abfb7b87814d upstream. ida_simple_get() returns an id between min (0) and max (NFP_MAX_MAC_INDEX) inclusive. So NFP_MAX_MAC_INDEX (0xff) is a valid id. In order for the error handling path to work correctly, the 'invalid' value for 'ida_idx' should not be in the 0..NFP_MAX_MAC_INDEX range, inclusive. So set it to -1. Fixes: 20cce8865098 ("nfp: flower: enable MAC address sharing for offloadab= le devs") Signed-off-by: Christophe JAILLET Signed-off-by: Simon Horman Link: https://lore.kernel.org/r/20220218131535.100258-1-simon.horman@corigi= ne.com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c +++ b/drivers/net/ethernet/netronome/nfp/flower/tunnel_conf.c @@ -922,8 +922,8 @@ nfp_tunnel_add_shared_mac(struct nfp_app int port, bool mod) { struct nfp_flower_priv *priv =3D app->priv; - int ida_idx =3D NFP_MAX_MAC_INDEX, err; struct nfp_tun_offloaded_mac *entry; + int ida_idx =3D -1, err; u16 nfp_mac_idx =3D 0; =20 entry =3D nfp_tunnel_lookup_offloaded_macs(app, netdev->dev_addr); @@ -997,7 +997,7 @@ err_remove_hash: err_free_entry: kfree(entry); err_free_ida: - if (ida_idx !=3D NFP_MAX_MAC_INDEX) + if (ida_idx !=3D -1) ida_simple_remove(&priv->tun.mac_off_ids, ida_idx); =20 return err; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C614BC433EF for ; Mon, 28 Feb 2022 17:42:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238523AbiB1Rmo (ORCPT ); Mon, 28 Feb 2022 12:42:44 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238412AbiB1Riw (ORCPT ); Mon, 28 Feb 2022 12:38:52 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8AE868F609; Mon, 28 Feb 2022 09:34:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 27B29B815BE; Mon, 28 Feb 2022 17:34:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7DB1AC340F0; Mon, 28 Feb 2022 17:33:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069638; bh=2KB33yasltd30ZmQPOUidFoxcAPmgj0nafDIvmwvRMg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W6ZGzQmHh6EOwt3f71bHBTyrSIrljxmuyOIzbz0PDSxaXf710gPHZNkTCUzMWWhVM vt6TR+g2mDsqk0EMJsaML5eELmLkoNOxIWewSi3GpQgdFVZnKS+Tbpc41yLqVYwkn/ PgA+21v6bBKHV3Zk3FoKoVO/ahBxdGFNvZ566BRM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fernando Fernandez Mancera , Florian Westphal , Pablo Neira Ayuso Subject: [PATCH 5.10 38/80] netfilter: nf_tables: fix memory leak during stateful obj update Date: Mon, 28 Feb 2022 18:24:19 +0100 Message-Id: <20220228172316.104997082@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Florian Westphal commit dad3bdeef45f81a6e90204bcc85360bb76eccec7 upstream. stateful objects can be updated from the control plane. The transaction logic allocates a temporary object for this purpose. The ->init function was called for this object, so plain kfree() leaks resources. We must call ->destroy function of the object. nft_obj_destroy does this, but it also decrements the module refcount, but the update path doesn't increment it. To avoid special-casing the update object release, do module_get for the update case too and release it via nft_obj_destroy(). Fixes: d62d0ba97b58 ("netfilter: nf_tables: Introduce stateful object updat= e operation") Cc: Fernando Fernandez Mancera Signed-off-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/netfilter/nf_tables_api.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -5924,12 +5924,15 @@ static int nf_tables_updobj(const struct { struct nft_object *newobj; struct nft_trans *trans; - int err; + int err =3D -ENOMEM; + + if (!try_module_get(type->owner)) + return -ENOENT; =20 trans =3D nft_trans_alloc(ctx, NFT_MSG_NEWOBJ, sizeof(struct nft_trans_obj)); if (!trans) - return -ENOMEM; + goto err_trans; =20 newobj =3D nft_obj_init(ctx, type, attr); if (IS_ERR(newobj)) { @@ -5946,6 +5949,8 @@ static int nf_tables_updobj(const struct =20 err_free_trans: kfree(trans); +err_trans: + module_put(type->owner); return err; } =20 @@ -7555,7 +7560,7 @@ static void nft_obj_commit_update(struct if (obj->ops->update) obj->ops->update(obj, newobj); =20 - kfree(newobj); + nft_obj_destroy(&trans->ctx, newobj); } =20 static void nft_commit_release(struct nft_trans *trans) @@ -8202,7 +8207,7 @@ static int __nf_tables_abort(struct net break; case NFT_MSG_NEWOBJ: if (nft_trans_obj_update(trans)) { - kfree(nft_trans_obj_newobj(trans)); + nft_obj_destroy(&trans->ctx, nft_trans_obj_newobj(trans)); nft_trans_destroy(trans); } else { trans->ctx.table->use--; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F9A8C433EF for ; Mon, 28 Feb 2022 17:44:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238534AbiB1Rms (ORCPT ); Mon, 28 Feb 2022 12:42:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238318AbiB1RjU (ORCPT ); Mon, 28 Feb 2022 12:39:20 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9CF7A8F98C; Mon, 28 Feb 2022 09:34:02 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 22902614CB; Mon, 28 Feb 2022 17:34:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32A02C340E7; Mon, 28 Feb 2022 17:34:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069641; bh=qt3niuXE92R7t+jTdXk/hjGHrViVT+Y+HW2d36IGo6Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=V2tLVqVGp2KiOHDUXklT4/yTzQxGnvohJBjjBUrOFyd5DApGydtwmKJY38wMU9g3v jfUHQmWySUT0cgxe2jaSFnFLZ5ZcyN3/Zefp0QAkWGUa0h4UfnenPq7WFILQUVcDhk 1eonPWDdT20CoEGhKMvCiC55+LrpL+lTM8T2Ozis= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Fabio M. De Francesco" , Karsten Graul , Jakub Kicinski , syzbot+4f322a6d84e991c38775@syzkaller.appspotmail.com, Tony Lu Subject: [PATCH 5.10 39/80] net/smc: Use a mutex for locking "struct smc_pnettable" Date: Mon, 28 Feb 2022 18:24:20 +0100 Message-Id: <20220228172316.191390981@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fabio M. De Francesco commit 7ff57e98fb78ad94edafbdc7435f2d745e9e6bb5 upstream. smc_pnetid_by_table_ib() uses read_lock() and then it calls smc_pnet_apply_= ib() which, in turn, calls mutex_lock(&smc_ib_devices.mutex). read_lock() disables preemption. Therefore, the code acquires a mutex while= in atomic context and it leads to a SAC bug. Fix this bug by replacing the rwlock with a mutex. Reported-and-tested-by: syzbot+4f322a6d84e991c38775@syzkaller.appspotmail.c= om Fixes: 64e28b52c7a6 ("net/smc: add pnet table namespace support") Confirmed-by: Tony Lu Signed-off-by: Fabio M. De Francesco Acked-by: Karsten Graul Link: https://lore.kernel.org/r/20220223100252.22562-1-fmdefrancesco@gmail.= com Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/smc/smc_pnet.c | 42 +++++++++++++++++++++--------------------- net/smc/smc_pnet.h | 2 +- 2 files changed, 22 insertions(+), 22 deletions(-) --- a/net/smc/smc_pnet.c +++ b/net/smc/smc_pnet.c @@ -112,7 +112,7 @@ static int smc_pnet_remove_by_pnetid(str pnettable =3D &sn->pnettable; =20 /* remove table entry */ - write_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) { if (!pnet_name || @@ -130,7 +130,7 @@ static int smc_pnet_remove_by_pnetid(str rc =3D 0; } } - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); =20 /* if this is not the initial namespace, stop here */ if (net !=3D &init_net) @@ -191,7 +191,7 @@ static int smc_pnet_add_by_ndev(struct n sn =3D net_generic(net, smc_net_id); pnettable =3D &sn->pnettable; =20 - write_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) { if (pnetelem->type =3D=3D SMC_PNET_ETH && !pnetelem->ndev && !strncmp(pnetelem->eth_name, ndev->name, IFNAMSIZ)) { @@ -205,7 +205,7 @@ static int smc_pnet_add_by_ndev(struct n break; } } - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); return rc; } =20 @@ -223,7 +223,7 @@ static int smc_pnet_remove_by_ndev(struc sn =3D net_generic(net, smc_net_id); pnettable =3D &sn->pnettable; =20 - write_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry_safe(pnetelem, tmp_pe, &pnettable->pnetlist, list) { if (pnetelem->type =3D=3D SMC_PNET_ETH && pnetelem->ndev =3D=3D ndev) { dev_put(pnetelem->ndev); @@ -236,7 +236,7 @@ static int smc_pnet_remove_by_ndev(struc break; } } - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); return rc; } =20 @@ -371,7 +371,7 @@ static int smc_pnet_add_eth(struct smc_p =20 rc =3D -EEXIST; new_netdev =3D true; - write_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { if (tmp_pe->type =3D=3D SMC_PNET_ETH && !strncmp(tmp_pe->eth_name, eth_name, IFNAMSIZ)) { @@ -381,9 +381,9 @@ static int smc_pnet_add_eth(struct smc_p } if (new_netdev) { list_add_tail(&new_pe->list, &pnettable->pnetlist); - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); } else { - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); kfree(new_pe); goto out_put; } @@ -445,7 +445,7 @@ static int smc_pnet_add_ib(struct smc_pn new_pe->ib_port =3D ib_port; =20 new_ibdev =3D true; - write_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { if (tmp_pe->type =3D=3D SMC_PNET_IB && !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX)) { @@ -455,9 +455,9 @@ static int smc_pnet_add_ib(struct smc_pn } if (new_ibdev) { list_add_tail(&new_pe->list, &pnettable->pnetlist); - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); } else { - write_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); kfree(new_pe); } return (new_ibdev) ? 0 : -EEXIST; @@ -602,7 +602,7 @@ static int _smc_pnet_dump(struct net *ne pnettable =3D &sn->pnettable; =20 /* dump pnettable entries */ - read_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry(pnetelem, &pnettable->pnetlist, list) { if (pnetid && !smc_pnet_match(pnetelem->pnet_name, pnetid)) continue; @@ -617,7 +617,7 @@ static int _smc_pnet_dump(struct net *ne break; } } - read_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); return idx; } =20 @@ -859,7 +859,7 @@ int smc_pnet_net_init(struct net *net) struct smc_pnetids_ndev *pnetids_ndev =3D &sn->pnetids_ndev; =20 INIT_LIST_HEAD(&pnettable->pnetlist); - rwlock_init(&pnettable->lock); + mutex_init(&pnettable->lock); INIT_LIST_HEAD(&pnetids_ndev->list); rwlock_init(&pnetids_ndev->lock); =20 @@ -939,7 +939,7 @@ static int smc_pnet_find_ndev_pnetid_by_ sn =3D net_generic(net, smc_net_id); pnettable =3D &sn->pnettable; =20 - read_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry(pnetelem, &pnettable->pnetlist, list) { if (pnetelem->type =3D=3D SMC_PNET_ETH && ndev =3D=3D pnetelem->ndev) { /* get pnetid of netdev device */ @@ -948,7 +948,7 @@ static int smc_pnet_find_ndev_pnetid_by_ break; } } - read_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); return rc; } =20 @@ -1129,7 +1129,7 @@ int smc_pnetid_by_table_ib(struct smc_ib sn =3D net_generic(&init_net, smc_net_id); pnettable =3D &sn->pnettable; =20 - read_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { if (tmp_pe->type =3D=3D SMC_PNET_IB && !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX) && @@ -1139,7 +1139,7 @@ int smc_pnetid_by_table_ib(struct smc_ib break; } } - read_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); =20 return rc; } @@ -1158,7 +1158,7 @@ int smc_pnetid_by_table_smcd(struct smcd sn =3D net_generic(&init_net, smc_net_id); pnettable =3D &sn->pnettable; =20 - read_lock(&pnettable->lock); + mutex_lock(&pnettable->lock); list_for_each_entry(tmp_pe, &pnettable->pnetlist, list) { if (tmp_pe->type =3D=3D SMC_PNET_IB && !strncmp(tmp_pe->ib_name, ib_name, IB_DEVICE_NAME_MAX)) { @@ -1167,7 +1167,7 @@ int smc_pnetid_by_table_smcd(struct smcd break; } } - read_unlock(&pnettable->lock); + mutex_unlock(&pnettable->lock); =20 return rc; } --- a/net/smc/smc_pnet.h +++ b/net/smc/smc_pnet.h @@ -29,7 +29,7 @@ struct smc_link_group; * @pnetlist: List of PNETIDs */ struct smc_pnettable { - rwlock_t lock; + struct mutex lock; struct list_head pnetlist; }; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1CC1C43217 for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238855AbiB1RnQ (ORCPT ); Mon, 28 Feb 2022 12:43:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235998AbiB1RjY (ORCPT ); Mon, 28 Feb 2022 12:39:24 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3AA490CD2; Mon, 28 Feb 2022 09:34:06 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8A1DAB815A6; Mon, 28 Feb 2022 17:34:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DD3C7C340E7; Mon, 28 Feb 2022 17:34:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069644; bh=UetJ5oyp/PARJAuwEtlGVz+riQ4VPsAix6ryU2qb2oE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m4BKFHjXwJF2MEwlom7CGw7Es27Z1W41P9SQoYkVHm0eKrlttinX21j782q1PZ3jy Mw6P0D/yzOO7sV49kjIeQPvQ82eurj/Q0qdcRgzDCMrG2jIEgKeZ9zP/NuxvYcVuYs JTHJ9myZGBlcVONfz3ohS9k/X85x+Y7oohXDAa30= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Tissoires , Maximilian Luz , Hans de Goede Subject: [PATCH 5.10 40/80] surface: surface3_power: Fix battery readings on batteries without a serial number Date: Mon, 28 Feb 2022 18:24:21 +0100 Message-Id: <20220228172316.417155470@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hans de Goede commit 21d90aaee8d5c2a097ef41f1430d97661233ecc6 upstream. The battery on the 2nd hand Surface 3 which I recently bought appears to not have a serial number programmed in. This results in any I2C reads from the registers containing the serial number failing with an I2C NACK. This was causing mshw0011_bix() to fail causing the battery readings to not work at all. Ignore EREMOTEIO (I2C NACK) errors when retrieving the serial number and continue with an empty serial number to fix this. Fixes: b1f81b496b0d ("platform/x86: surface3_power: MSHW0011 rev-eng implem= entation") BugLink: https://github.com/linux-surface/linux-surface/issues/608 Reviewed-by: Benjamin Tissoires Reviewed-by: Maximilian Luz Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220224101848.7219-1-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/platform/x86/surface3_power.c | 13 ++++++++++--- 1 file changed, 10 insertions(+), 3 deletions(-) --- a/drivers/platform/x86/surface3_power.c +++ b/drivers/platform/x86/surface3_power.c @@ -233,14 +233,21 @@ static int mshw0011_bix(struct mshw0011_ } bix->last_full_charg_capacity =3D ret; =20 - /* get serial number */ + /* + * Get serial number, on some devices (with unofficial replacement + * battery?) reading any of the serial number range addresses gets + * nacked in this case just leave the serial number empty. + */ ret =3D i2c_smbus_read_i2c_block_data(client, MSHW0011_BAT0_REG_SERIAL_NO, sizeof(buf), buf); - if (ret !=3D sizeof(buf)) { + if (ret =3D=3D -EREMOTEIO) { + /* no serial number available */ + } else if (ret !=3D sizeof(buf)) { dev_err(&client->dev, "Error reading serial no: %d\n", ret); return ret; + } else { + snprintf(bix->serial, ARRAY_SIZE(bix->serial), "%3pE%6pE", buf + 7, buf); } - snprintf(bix->serial, ARRAY_SIZE(bix->serial), "%3pE%6pE", buf + 7, buf); =20 /* get cycle count */ ret =3D i2c_smbus_read_word_data(client, MSHW0011_BAT0_REG_CYCLE_CNT); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82740C4332F for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238836AbiB1RnH (ORCPT ); Mon, 28 Feb 2022 12:43:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238011AbiB1Rjb (ORCPT ); Mon, 28 Feb 2022 12:39:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AC05A91341; Mon, 28 Feb 2022 09:34:09 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 38A20B815B8; Mon, 28 Feb 2022 17:34:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 924E3C340E7; Mon, 28 Feb 2022 17:34:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069646; bh=+l3jU0nvv1HAdt1l7oH7jBuox343EAywraz1n02pq30=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ntvs8eFVBoMNXhP6oGQ3QWz7uHVUVDtt6CniZRzKh2E9HSHIvnasC89O0Tg/qA/rj Jk19Ycx9Er5SXx00CWmtNL+PrCGG6DSiv2WJiWvYKRl8cHXkp6IrxFcYcuDX8tpV7n nC2VWhD6y8wftdrfN/OG12J2Fw8fGnT9SfhoaAyo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" Subject: [PATCH 5.10 41/80] udp_tunnel: Fix end of loop test in udp_tunnel_nic_unregister() Date: Mon, 28 Feb 2022 18:24:22 +0100 Message-Id: <20220228172316.511306586@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit de7b2efacf4e83954aed3f029d347dfc0b7a4f49 upstream. This test is checking if we exited the list via break or not. However if it did not exit via a break then "node" does not point to a valid udp_tunnel_nic_shared_node struct. It will work because of the way the structs are laid out it's the equivalent of "if (info->shared->udp_tunnel_nic_info !=3D dev)" which will always be true, but it's not the right way to test. Fixes: 74cc6d182d03 ("udp_tunnel: add the ability to share port tables") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/ipv4/udp_tunnel_nic.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv4/udp_tunnel_nic.c +++ b/net/ipv4/udp_tunnel_nic.c @@ -846,7 +846,7 @@ udp_tunnel_nic_unregister(struct net_dev list_for_each_entry(node, &info->shared->devices, list) if (node->dev =3D=3D dev) break; - if (node->dev !=3D dev) + if (list_entry_is_head(node, &info->shared->devices, list)) return; =20 list_del(&node->list); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42DF0C433FE for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238557AbiB1Rmv (ORCPT ); Mon, 28 Feb 2022 12:42:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236529AbiB1Rjh (ORCPT ); Mon, 28 Feb 2022 12:39:37 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4EAD09137D; Mon, 28 Feb 2022 09:34:12 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ED32CB815BD; Mon, 28 Feb 2022 17:34:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4AB31C340E7; Mon, 28 Feb 2022 17:34:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069649; bh=HCABU+6noVfxghNDpa+0Ktp/7wxrthhz8I3ynmU7u1U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1T3lV/w8Bl2voMkafNnIzw5SX6s/fUy/ee8GvUJ4YDJk2RxYaSDQnZp3D+/16byya ITXUMsLeKK17jv5PdTGWpn9s02HXOOkb4v08wIE9BXb10DAbws9t+1EmjPtXqhopBh ocqYfqt7l3dn94wGxlUm90pr+g5T9MN9YjrjK7Y8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Gottlieb , Mark Bloch , Saeed Mahameed Subject: [PATCH 5.10 42/80] net/mlx5: Fix possible deadlock on rule deletion Date: Mon, 28 Feb 2022 18:24:23 +0100 Message-Id: <20220228172316.633802535@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maor Gottlieb commit b645e57debca846f51b3209907546ea857ddd3f5 upstream. Add missing call to up_write_ref_node() which releases the semaphore in case the FTE doesn't have destinations, such in drop rule case. Fixes: 465e7baab6d9 ("net/mlx5: Fix deletion of duplicate rules") Signed-off-by: Maor Gottlieb Reviewed-by: Mark Bloch Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c @@ -2034,6 +2034,8 @@ void mlx5_del_flow_rules(struct mlx5_flo fte->node.del_hw_func =3D NULL; up_write_ref_node(&fte->node, false); tree_put_node(&fte->node, false); + } else { + up_write_ref_node(&fte->node, false); } kfree(handle); } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62E01C433F5 for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238635AbiB1Rmx (ORCPT ); Mon, 28 Feb 2022 12:42:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233680AbiB1Rjx (ORCPT ); Mon, 28 Feb 2022 12:39:53 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2715392857; Mon, 28 Feb 2022 09:34:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B170CB815B4; Mon, 28 Feb 2022 17:34:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 06C84C340E7; Mon, 28 Feb 2022 17:34:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069652; bh=QO6fTW2VcelMu6EAiAhXnvwL+tqQreU8tzQFXXvOUVg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g/bLjDb48qbJ1MBrDveAwlZ/L+AZOF5+gtPcRe0cb/f6PlPgeR2rMPyX4pq15q8d7 KYU0UiTpJ7mGmGL9oVR3J9ozy32Mte3H5rGLDG0DSxK53jPRlQQP2rybiIpl3yRVSH vDa7PtqwkBz1hObV91ATPylE7BAR6j4n24yG8zus= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ariel Levkovich , Maor Dickman , Saeed Mahameed Subject: [PATCH 5.10 43/80] net/mlx5: Fix wrong limitation of metadata match on ecpf Date: Mon, 28 Feb 2022 18:24:24 +0100 Message-Id: <20220228172316.750087654@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ariel Levkovich commit 07666c75ad17d7389b18ac0235c8cf41e1504ea8 upstream. Match metadata support check returns false for ecpf device. However, this support does exist for ecpf and therefore this limitation should be removed to allow feature such as stacked devices and internal port offloaded to be supported. Fixes: 92ab1eb392c6 ("net/mlx5: E-Switch, Enable vport metadata matching if= firmware supports it") Signed-off-by: Ariel Levkovich Reviewed-by: Maor Dickman Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c | 4 ---- 1 file changed, 4 deletions(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c @@ -2037,10 +2037,6 @@ esw_check_vport_match_metadata_supported if (!MLX5_CAP_ESW_FLOWTABLE(esw->dev, flow_source)) return false; =20 - if (mlx5_core_is_ecpf_esw_manager(esw->dev) || - mlx5_ecpf_vport_exists(esw->dev)) - return false; - return true; } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA73AC4167D for ; Mon, 28 Feb 2022 17:44:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238803AbiB1RnD (ORCPT ); Mon, 28 Feb 2022 12:43:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37082 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238312AbiB1RkG (ORCPT ); Mon, 28 Feb 2022 12:40:06 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B27B092D12; Mon, 28 Feb 2022 09:34:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A87A2614BF; Mon, 28 Feb 2022 17:34:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0FD4C340E7; Mon, 28 Feb 2022 17:34:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069655; bh=6b7f/+0qvIxkDMPm2Xppd3Oe6OpoLqQPKu5Y52UCEIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Emo4c44qd8bgnEd2e57KORqRX1ox28tv+UpwfaGj4WLUpXa+VagjyXa8wG2xpLzgu h0/i8i+lDf6D9cjDuLZ+lAzCMoDVu/YvkkD+57C5qAINLkQKYFHn8RCWicFnGuhhKD zaO0x3uSTXS7qBdrXg75zLQB7FT2gMTxi9cX4/Pg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tariq Toukan , Saeed Mahameed Subject: [PATCH 5.10 44/80] net/mlx5e: kTLS, Use CHECKSUM_UNNECESSARY for device-offloaded packets Date: Mon, 28 Feb 2022 18:24:25 +0100 Message-Id: <20220228172316.905882012@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tariq Toukan commit 7eaf1f37b8817c608c4e959d69986ef459d345cd upstream. For RX TLS device-offloaded packets, the HW spec guarantees checksum validation for the offloaded packets, but does not define whether the CQE.checksum field matches the original packet (ciphertext) or the decrypted one (plaintext). This latitude allows architetctural improvements between generations of chips, resulting in different decisions regarding the value type of CQE.checksum. Hence, for these packets, the device driver should not make use of this CQE field. Here we block CHECKSUM_COMPLETE usage for RX TLS device-offloaded packets, and use CHECKSUM_UNNECESSARY instead. Value of the packet's tcp_hdr.csum is not modified by the HW, and it always matches the original ciphertext. Fixes: 1182f3659357 ("net/mlx5e: kTLS, Add kTLS RX HW offload support") Signed-off-by: Tariq Toukan Signed-off-by: Saeed Mahameed Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c @@ -985,7 +985,8 @@ static inline void mlx5e_handle_csum(str } =20 /* True when explicitly set via priv flag, or XDP prog is loaded */ - if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state)) + if (test_bit(MLX5E_RQ_STATE_NO_CSUM_COMPLETE, &rq->state) || + get_cqe_tls_offload(cqe)) goto csum_unnecessary; =20 /* CQE csum doesn't cover padding octets in short ethernet From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C00DC433FE for ; Mon, 28 Feb 2022 17:44:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238878AbiB1Rn1 (ORCPT ); Mon, 28 Feb 2022 12:43:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236441AbiB1RkI (ORCPT ); Mon, 28 Feb 2022 12:40:08 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D820593185; Mon, 28 Feb 2022 09:34:18 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7A042614BB; Mon, 28 Feb 2022 17:34:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B7ACC340E7; Mon, 28 Feb 2022 17:34:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069657; bh=0RtYBQzJmD78NjmUnjR65nAJ5Z8h/s9oL/ps01pFpog=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aNOfOn8LkfaD4+rkfYx9ueGqYYtmyOkkAGlbW0kPE5xcSk0xWgnhUd9hzejsc57I3 1s4e+bIEmRrLM/CR3WUp7Qx/zU5HeFK74qd80ad4ugMn8KE26594OyyRSrBRe0IK45 G7ZRNQF4Q9b7q1CiiVVg+j88Xga8Hvz/gOWpkxrc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zhou Qingyang , Mark Brown , Sasha Levin Subject: [PATCH 5.10 45/80] spi: spi-zynq-qspi: Fix a NULL pointer dereference in zynq_qspi_exec_mem_op() Date: Mon, 28 Feb 2022 18:24:26 +0100 Message-Id: <20220228172317.075616514@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zhou Qingyang [ Upstream commit ab3824427b848da10e9fe2727f035bbeecae6ff4 ] In zynq_qspi_exec_mem_op(), kzalloc() is directly used in memset(), which could lead to a NULL pointer dereference on failure of kzalloc(). Fix this bug by adding a check of tmpbuf. This bug was found by a static analyzer. The analysis employs differential checking to identify inconsistent security operations (e.g., checks or kfrees) between two code paths and confirms that the inconsistent operations are not recovered in the current function or the callers, so they constitute bugs. Note that, as a bug found by static analysis, it can be a false positive or hard to trigger. Multiple researchers have cross-reviewed the bug. Builds with CONFIG_SPI_ZYNQ_QSPI=3Dm show no new warnings, and our static analyzer no longer warns about this code. Fixes: 67dca5e580f1 ("spi: spi-mem: Add support for Zynq QSPI controller") Signed-off-by: Zhou Qingyang Link: https://lore.kernel.org/r/20211130172253.203700-1-zhou1615@umn.edu Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/spi/spi-zynq-qspi.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/spi/spi-zynq-qspi.c b/drivers/spi/spi-zynq-qspi.c index b635835729d66..13c0b15fe1764 100644 --- a/drivers/spi/spi-zynq-qspi.c +++ b/drivers/spi/spi-zynq-qspi.c @@ -570,6 +570,9 @@ static int zynq_qspi_exec_mem_op(struct spi_mem *mem, =20 if (op->dummy.nbytes) { tmpbuf =3D kzalloc(op->dummy.nbytes, GFP_KERNEL); + if (!tmpbuf) + return -ENOMEM; + memset(tmpbuf, 0xff, op->dummy.nbytes); reinit_completion(&xqspi->data_completion); xqspi->txbuf =3D tmpbuf; --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C9B7BC433EF for ; Mon, 28 Feb 2022 17:44:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238729AbiB1RnB (ORCPT ); Mon, 28 Feb 2022 12:43:01 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33614 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238352AbiB1RkH (ORCPT ); Mon, 28 Feb 2022 12:40:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D9D5D931A6; Mon, 28 Feb 2022 09:34:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 32184614B9; Mon, 28 Feb 2022 17:34:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43D5AC340E7; Mon, 28 Feb 2022 17:34:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069660; bh=UKU2ZL74yrXmSvnoOCq0NG2pCsbfm6eBJT405A9w8+o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Sg/ESZeu+1uy77WNhqxd2xkxMsWVMFnsU+hsuvU9C64e4Z4SMkH6ttlif8hQ7Stmn gqjXn26mWdoEUjraeI+E3BG1q3nbSF5a/brGiELjFEJmYiQHWcAtvcsiacsDFqZhre AQbOETEAfLiTlSzUxSrXnzSIJlsHRd/QFL9mWOwA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Prasad Kumpatla , Charles Keepax , Marek Szyprowski , Mark Brown , Sasha Levin Subject: [PATCH 5.10 46/80] regmap-irq: Update interrupt clear register for proper reset Date: Mon, 28 Feb 2022 18:24:27 +0100 Message-Id: <20220228172317.218502231@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Prasad Kumpatla [ Upstream commit d04ad245d67a3991dfea5e108e4c452c2ab39bac ] With the existing logic where clear_ack is true (HW doesn=E2=80=99t support auto clear for ICR), interrupt clear register reset is not handled properly. Due to this only the first interrupts get processed properly and further interrupts are blocked due to not resetting interrupt clear register. Example for issue case where Invert_ack is false and clear_ack is true: Say Default ISR=3D0x00 & ICR=3D0x00 and ISR is triggered with 2 interrupts making ISR =3D 0x11. Step 1: Say ISR is set 0x11 (store status_buff =3D ISR). ISR needs to be cleared with the help of ICR once the Interrupt is processed. Step 2: Write ICR =3D 0x11 (status_buff), this will clear the ISR to 0x= 00. Step 3: Issue - In the existing code, ICR is written with ICR =3D ~(status_buff) i.e ICR =3D 0xEE -> This will block all the inte= rrupts from raising except for interrupts 0 and 4. So expectation here= is to reset ICR, which will unblock all the interrupts. if (chip->clear_ack) { if (chip->ack_invert && !ret) ........ else if (!ret) ret =3D regmap_write(map, reg, ~data->status_buf[i]); So writing 0 and 0xff (when ack_invert is true) should have no effect, other than clearing the ACKs just set. Fixes: 3a6f0fb7b8eb ("regmap: irq: Add support to clear ack registers") Signed-off-by: Prasad Kumpatla Reviewed-by: Charles Keepax Tested-by: Marek Szyprowski Link: https://lore.kernel.org/r/20220217085007.30218-1-quic_pkumpatl@quicin= c.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/base/regmap/regmap-irq.c | 20 ++++++-------------- 1 file changed, 6 insertions(+), 14 deletions(-) diff --git a/drivers/base/regmap/regmap-irq.c b/drivers/base/regmap/regmap-= irq.c index ad5c2de395d1f..87c5c421e0f46 100644 --- a/drivers/base/regmap/regmap-irq.c +++ b/drivers/base/regmap/regmap-irq.c @@ -170,11 +170,9 @@ static void regmap_irq_sync_unlock(struct irq_data *da= ta) ret =3D regmap_write(map, reg, d->mask_buf[i]); if (d->chip->clear_ack) { if (d->chip->ack_invert && !ret) - ret =3D regmap_write(map, reg, - d->mask_buf[i]); + ret =3D regmap_write(map, reg, UINT_MAX); else if (!ret) - ret =3D regmap_write(map, reg, - ~d->mask_buf[i]); + ret =3D regmap_write(map, reg, 0); } if (ret !=3D 0) dev_err(d->map->dev, "Failed to ack 0x%x: %d\n", @@ -509,11 +507,9 @@ static irqreturn_t regmap_irq_thread(int irq, void *d) data->status_buf[i]); if (chip->clear_ack) { if (chip->ack_invert && !ret) - ret =3D regmap_write(map, reg, - data->status_buf[i]); + ret =3D regmap_write(map, reg, UINT_MAX); else if (!ret) - ret =3D regmap_write(map, reg, - ~data->status_buf[i]); + ret =3D regmap_write(map, reg, 0); } if (ret !=3D 0) dev_err(map->dev, "Failed to ack 0x%x: %d\n", @@ -745,13 +741,9 @@ int regmap_add_irq_chip_fwnode(struct fwnode_handle *f= wnode, d->status_buf[i] & d->mask_buf[i]); if (chip->clear_ack) { if (chip->ack_invert && !ret) - ret =3D regmap_write(map, reg, - (d->status_buf[i] & - d->mask_buf[i])); + ret =3D regmap_write(map, reg, UINT_MAX); else if (!ret) - ret =3D regmap_write(map, reg, - ~(d->status_buf[i] & - d->mask_buf[i])); + ret =3D regmap_write(map, reg, 0); } if (ret !=3D 0) { dev_err(map->dev, "Failed to ack 0x%x: %d\n", --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1C68C4167B for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238959AbiB1Rnh (ORCPT ); Mon, 28 Feb 2022 12:43:37 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232457AbiB1RkL (ORCPT ); Mon, 28 Feb 2022 12:40:11 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 05750939A2; Mon, 28 Feb 2022 09:34:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 92FA2614BF; Mon, 28 Feb 2022 17:34:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7A97EC340F1; Mon, 28 Feb 2022 17:34:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069666; bh=PWwrxyeosz7l+auz8ADjZ6EBf7VCWUWVcJbBrZQCDts=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RliMiRJnJDktl1NRydHIbO+HdvHp8xMis5KXviGuCYpMskW5shOtIXjm3dZVc44lK f4BhiNt1a7ig/Q/U09rWx+Cf7BBpk3ObN2oNm77aeUDs1URKISfwib0Yd0d8DOr0aT zNtAJh2Jsx7AqsTshq0Txl8BO4ZJGxqYugyAznJA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Md Haris Iqbal , Jack Wang , Jason Gunthorpe , Sasha Levin Subject: [PATCH 5.10 47/80] RDMA/rtrs-clt: Fix possible double free in error case Date: Mon, 28 Feb 2022 18:24:28 +0100 Message-Id: <20220228172317.357284660@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Md Haris Iqbal [ Upstream commit 8700af2cc18c919b2a83e74e0479038fd113c15d ] Callback function rtrs_clt_dev_release() for put_device() calls kfree(clt) to free memory. We shouldn't call kfree(clt) again, and we can't use the clt after kfree too. Replace device_register() with device_initialize() and device_add() so that dev_set_name can() be used appropriately. Move mutex_destroy() to the release function so it can be called in the alloc_clt err path. Fixes: eab098246625 ("RDMA/rtrs-clt: Refactor the failure cases in alloc_cl= t") Link: https://lore.kernel.org/r/20220217030929.323849-1-haris.iqbal@ionos.c= om Reported-by: Miaoqian Lin Signed-off-by: Md Haris Iqbal Reviewed-by: Jack Wang Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 37 ++++++++++++++------------ 1 file changed, 20 insertions(+), 17 deletions(-) diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ul= p/rtrs/rtrs-clt.c index 46fad202a380e..8937530a42d3d 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c @@ -2540,6 +2540,8 @@ static void rtrs_clt_dev_release(struct device *dev) { struct rtrs_clt *clt =3D container_of(dev, struct rtrs_clt, dev); =20 + mutex_destroy(&clt->paths_ev_mutex); + mutex_destroy(&clt->paths_mutex); kfree(clt); } =20 @@ -2571,6 +2573,8 @@ static struct rtrs_clt *alloc_clt(const char *sessnam= e, size_t paths_num, return ERR_PTR(-ENOMEM); } =20 + clt->dev.class =3D rtrs_clt_dev_class; + clt->dev.release =3D rtrs_clt_dev_release; uuid_gen(&clt->paths_uuid); INIT_LIST_HEAD_RCU(&clt->paths_list); clt->paths_num =3D paths_num; @@ -2588,43 +2592,41 @@ static struct rtrs_clt *alloc_clt(const char *sessn= ame, size_t paths_num, init_waitqueue_head(&clt->permits_wait); mutex_init(&clt->paths_ev_mutex); mutex_init(&clt->paths_mutex); + device_initialize(&clt->dev); =20 - clt->dev.class =3D rtrs_clt_dev_class; - clt->dev.release =3D rtrs_clt_dev_release; err =3D dev_set_name(&clt->dev, "%s", sessname); if (err) - goto err; + goto err_put; + /* * Suppress user space notification until * sysfs files are created */ dev_set_uevent_suppress(&clt->dev, true); - err =3D device_register(&clt->dev); - if (err) { - put_device(&clt->dev); - goto err; - } + err =3D device_add(&clt->dev); + if (err) + goto err_put; =20 clt->kobj_paths =3D kobject_create_and_add("paths", &clt->dev.kobj); if (!clt->kobj_paths) { err =3D -ENOMEM; - goto err_dev; + goto err_del; } err =3D rtrs_clt_create_sysfs_root_files(clt); if (err) { kobject_del(clt->kobj_paths); kobject_put(clt->kobj_paths); - goto err_dev; + goto err_del; } dev_set_uevent_suppress(&clt->dev, false); kobject_uevent(&clt->dev.kobj, KOBJ_ADD); =20 return clt; -err_dev: - device_unregister(&clt->dev); -err: +err_del: + device_del(&clt->dev); +err_put: free_percpu(clt->pcpu_path); - kfree(clt); + put_device(&clt->dev); return ERR_PTR(err); } =20 @@ -2643,9 +2645,10 @@ static void free_clt(struct rtrs_clt *clt) wait_for_inflight_permits(clt); free_permits(clt); free_percpu(clt->pcpu_path); - mutex_destroy(&clt->paths_ev_mutex); - mutex_destroy(&clt->paths_mutex); - /* release callback will free clt in last put */ + + /* + * release callback will free clt and destroy mutexes in last put + */ device_unregister(&clt->dev); } =20 --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1DF7EC3525B for ; Mon, 28 Feb 2022 17:44:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238998AbiB1Rni (ORCPT ); Mon, 28 Feb 2022 12:43:38 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238391AbiB1RkO (ORCPT ); Mon, 28 Feb 2022 12:40:14 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DBFB2939BA; Mon, 28 Feb 2022 09:34:29 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 73028614BB; Mon, 28 Feb 2022 17:34:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 89CDFC340E7; Mon, 28 Feb 2022 17:34:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069668; bh=IiacSrL8ob66hiYq0YoGi1dM+cEsZe0gKs70eha+nJw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=guf2BuAg3XgR2ilCjvZJ5XUmAip69nvMQvgzX7LoE/hVAKXI7SpRrs/6SfuUzPibY /fgylctLpT/mRAHpAOp2W6B5CSHX0p4U1rXOL7UL7m7D2K8ObP4zzuU93wwQianlE0 jTGQFM0VWY62LUOhftzqbx+U0+x1KrxBBvmeM+lE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guoqing Jiang , Md Haris Iqbal , Jack Wang , Jason Gunthorpe , Sasha Levin Subject: [PATCH 5.10 48/80] RDMA/rtrs-clt: Kill wait_for_inflight_permits Date: Mon, 28 Feb 2022 18:24:29 +0100 Message-Id: <20220228172317.471329041@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guoqing Jiang [ Upstream commit 25a033f5a75873cfdd36eca3c702363b682afb42 ] Let's wait the inflight permits before free it. Link: https://lore.kernel.org/r/20201217141915.56989-10-jinpu.wang@cloud.io= nos.com Signed-off-by: Guoqing Jiang Reviewed-by: Md Haris Iqbal Signed-off-by: Jack Wang Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 17 ++++++----------- 1 file changed, 6 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ul= p/rtrs/rtrs-clt.c index 8937530a42d3d..5a3c11b0b3102 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c @@ -1328,6 +1328,12 @@ static int alloc_permits(struct rtrs_clt *clt) =20 static void free_permits(struct rtrs_clt *clt) { + if (clt->permits_map) { + size_t sz =3D clt->queue_depth; + + wait_event(clt->permits_wait, + find_first_bit(clt->permits_map, sz) >=3D sz); + } kfree(clt->permits_map); clt->permits_map =3D NULL; kfree(clt->permits); @@ -2630,19 +2636,8 @@ static struct rtrs_clt *alloc_clt(const char *sessna= me, size_t paths_num, return ERR_PTR(err); } =20 -static void wait_for_inflight_permits(struct rtrs_clt *clt) -{ - if (clt->permits_map) { - size_t sz =3D clt->queue_depth; - - wait_event(clt->permits_wait, - find_first_bit(clt->permits_map, sz) >=3D sz); - } -} - static void free_clt(struct rtrs_clt *clt) { - wait_for_inflight_permits(clt); free_permits(clt); free_percpu(clt->pcpu_path); =20 --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D3884C4321E for ; Mon, 28 Feb 2022 17:44:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239054AbiB1Rnl (ORCPT ); Mon, 28 Feb 2022 12:43:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37350 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238268AbiB1RkQ (ORCPT ); Mon, 28 Feb 2022 12:40:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 43892986C7; Mon, 28 Feb 2022 09:34:34 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D704FB815A6; Mon, 28 Feb 2022 17:34:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42F08C340E7; Mon, 28 Feb 2022 17:34:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069671; bh=/TC6U4bhgC1qLOu19zfPJeKQe7FGvbvv3H7xnnBIuCo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uErlsgpPhFHGJScBWxdya2ARdDl9/o2V11y51UkZs7g/FPbxx7NBKnkGzQyh8IMrG QXcvQK768fAWoqDIYfP+6OyGV++KHFxkqC0MSgbeIILDw3F5ca6I6Zq7CLxZMYgUQx chpPYHjHGLmI5XpnkGQfN1wF+MVsxVFRPUTXC0TA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Md Haris Iqbal , Jack Wang , Jason Gunthorpe , Sasha Levin Subject: [PATCH 5.10 49/80] RDMA/rtrs-clt: Move free_permit from free_clt to rtrs_clt_close Date: Mon, 28 Feb 2022 18:24:30 +0100 Message-Id: <20220228172317.581029281@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Md Haris Iqbal [ Upstream commit c46fa8911b17e3f808679061a8af8bee219f4602 ] Error path of rtrs_clt_open() calls free_clt(), where free_permit is called. This is wrong since error path of rtrs_clt_open() does not need to call free_permit(). Also, moving free_permits() call to rtrs_clt_close(), makes it more aligned with the call to alloc_permit() in rtrs_clt_open(). Fixes: 6a98d71daea1 ("RDMA/rtrs: client: main functionality") Link: https://lore.kernel.org/r/20220217030929.323849-2-haris.iqbal@ionos.c= om Signed-off-by: Md Haris Iqbal Reviewed-by: Jack Wang Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/infiniband/ulp/rtrs/rtrs-clt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt.c b/drivers/infiniband/ul= p/rtrs/rtrs-clt.c index 5a3c11b0b3102..13634eda833de 100644 --- a/drivers/infiniband/ulp/rtrs/rtrs-clt.c +++ b/drivers/infiniband/ulp/rtrs/rtrs-clt.c @@ -2638,7 +2638,6 @@ static struct rtrs_clt *alloc_clt(const char *sessnam= e, size_t paths_num, =20 static void free_clt(struct rtrs_clt *clt) { - free_permits(clt); free_percpu(clt->pcpu_path); =20 /* @@ -2759,6 +2758,7 @@ void rtrs_clt_close(struct rtrs_clt *clt) rtrs_clt_destroy_sess_files(sess, NULL); kobject_put(&sess->kobj); } + free_permits(clt); free_clt(clt); } EXPORT_SYMBOL(rtrs_clt_close); --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 232C0C433EF for ; Mon, 28 Feb 2022 17:44:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236665AbiB1RpO (ORCPT ); Mon, 28 Feb 2022 12:45:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236769AbiB1Rkg (ORCPT ); Mon, 28 Feb 2022 12:40:36 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60BBA986DE; Mon, 28 Feb 2022 09:34:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D7536614AC; Mon, 28 Feb 2022 17:34:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC80DC340E7; Mon, 28 Feb 2022 17:34:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069674; bh=XFprmJuZOhsQUKyrrUZXt41mOVKvj1+Gs65IZBSSPBM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aab0QNVRVhhgQbnqGfF/AF+TfWconvb7TXxhwB/ZLxyPw7jDqEs2G67oCbVOdLbg5 z0oP31OX53gM0hEFUG75VUnbnpJMDWEKXoaQ7/f5QDK3RezqGs/RNBRB/YgPpxTvah lVVKBwBxX93MdGMoCO5pz/5AohdOfy4+cTDWiJ4I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, ChenXiaoSong , Laibin Qiu , Christoph Hellwig , Sasha Levin Subject: [PATCH 5.10 50/80] configfs: fix a race in configfs_{,un}register_subsystem() Date: Mon, 28 Feb 2022 18:24:31 +0100 Message-Id: <20220228172317.705510418@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: ChenXiaoSong [ Upstream commit 84ec758fb2daa236026506868c8796b0500c047d ] When configfs_register_subsystem() or configfs_unregister_subsystem() is executing link_group() or unlink_group(), it is possible that two processes add or delete list concurrently. Some unfortunate interleavings of them can cause kernel panic. One of cases is: A --> B --> C --> D A <-- B <-- C <-- D delete list_head *B | delete list_head *C Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --------------------------------|----------------------------------- configfs_unregister_subsystem | configfs_unregister_subsystem unlink_group | unlink_group unlink_obj | unlink_obj list_del_init | list_del_init __list_del_entry | __list_del_entry __list_del | __list_del // next =3D=3D C | next->prev =3D prev | | next->prev =3D prev prev->next =3D next | | // prev =3D=3D B | prev->next =3D next Fix this by adding mutex when calling link_group() or unlink_group(), but parent configfs_subsystem is NULL when config_item is root. So I create a mutex configfs_subsystem_mutex. Fixes: 7063fbf22611 ("[PATCH] configfs: User-driven configuration filesyste= m") Signed-off-by: ChenXiaoSong Signed-off-by: Laibin Qiu Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin --- fs/configfs/dir.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 32ddad3ec5d53..5ad27e484014f 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -36,6 +36,14 @@ */ DEFINE_SPINLOCK(configfs_dirent_lock); =20 +/* + * All of link_obj/unlink_obj/link_group/unlink_group require that + * subsys->su_mutex is held. + * But parent configfs_subsystem is NULL when config_item is root. + * Use this mutex when config_item is root. + */ +static DEFINE_MUTEX(configfs_subsystem_mutex); + static void configfs_d_iput(struct dentry * dentry, struct inode * inode) { @@ -1884,7 +1892,9 @@ int configfs_register_subsystem(struct configfs_subsy= stem *subsys) group->cg_item.ci_name =3D group->cg_item.ci_namebuf; =20 sd =3D root->d_fsdata; + mutex_lock(&configfs_subsystem_mutex); link_group(to_config_group(sd->s_element), group); + mutex_unlock(&configfs_subsystem_mutex); =20 inode_lock_nested(d_inode(root), I_MUTEX_PARENT); =20 @@ -1909,7 +1919,9 @@ int configfs_register_subsystem(struct configfs_subsy= stem *subsys) inode_unlock(d_inode(root)); =20 if (err) { + mutex_lock(&configfs_subsystem_mutex); unlink_group(group); + mutex_unlock(&configfs_subsystem_mutex); configfs_release_fs(); } put_fragment(frag); @@ -1956,7 +1968,9 @@ void configfs_unregister_subsystem(struct configfs_su= bsystem *subsys) =20 dput(dentry); =20 + mutex_lock(&configfs_subsystem_mutex); unlink_group(group); + mutex_unlock(&configfs_subsystem_mutex); configfs_release_fs(); } =20 --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE232C433FE for ; Mon, 28 Feb 2022 17:44:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237448AbiB1RpH (ORCPT ); Mon, 28 Feb 2022 12:45:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34698 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237296AbiB1Rkv (ORCPT ); Mon, 28 Feb 2022 12:40:51 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 036AC986EF; Mon, 28 Feb 2022 09:34:37 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8E24D614B9; Mon, 28 Feb 2022 17:34:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A4A3BC340E7; Mon, 28 Feb 2022 17:34:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069677; bh=G+HCGVUC2PQfxtePcridXiIDi4gJcTA+2ZpAax29vKo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QHgU06fUNLY1TrGmW764DiZoqlDkmhsNJqckWCjKLN/0sg8DdoHC4zXc+FTUAuIvP hmg9iHy1pOMbtVh6u3w0NXT4VzV0Abcw5YbKVeRkBNHuRzOaMr3UHJrCXnSWMXBkuF 1fcdmv0p+z+N0//ymjGVxSKNYHTmGUK968QFkWaw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+831661966588c802aae9@syzkaller.appspotmail.com, Bart Van Assche , Leon Romanovsky , Jason Gunthorpe , Sasha Levin Subject: [PATCH 5.10 51/80] RDMA/ib_srp: Fix a deadlock Date: Mon, 28 Feb 2022 18:24:32 +0100 Message-Id: <20220228172317.898897092@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bart Van Assche [ Upstream commit 081bdc9fe05bb23248f5effb6f811da3da4b8252 ] Remove the flush_workqueue(system_long_wq) call since flushing system_long_wq is deadlock-prone and since that call is redundant with a preceding cancel_work_sync() Link: https://lore.kernel.org/r/20220215210511.28303-3-bvanassche@acm.org Fixes: ef6c49d87c34 ("IB/srp: Eliminate state SRP_TARGET_DEAD") Reported-by: syzbot+831661966588c802aae9@syzkaller.appspotmail.com Signed-off-by: Bart Van Assche Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/infiniband/ulp/srp/ib_srp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/s= rp/ib_srp.c index 86d5c4c92b363..b4ccb333a8342 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -4045,9 +4045,11 @@ static void srp_remove_one(struct ib_device *device,= void *client_data) spin_unlock(&host->target_lock); =20 /* - * Wait for tl_err and target port removal tasks. + * srp_queue_remove_work() queues a call to + * srp_remove_target(). The latter function cancels + * target->tl_err_work so waiting for the remove works to + * finish is sufficient. */ - flush_workqueue(system_long_wq); flush_workqueue(srp_remove_wq); =20 kfree(host); --=20 2.34.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4A3A5C43217 for ; Mon, 28 Feb 2022 17:44:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238235AbiB1RpS (ORCPT ); Mon, 28 Feb 2022 12:45:18 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238359AbiB1RlQ (ORCPT ); Mon, 28 Feb 2022 12:41:16 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6E8B4939F4; Mon, 28 Feb 2022 09:34:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2719BB815A6; Mon, 28 Feb 2022 17:34:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A393C340E7; Mon, 28 Feb 2022 17:34:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069679; bh=HNlEnn31gDfp78Stg/+wfklDNtibWpDYzDPpIk7TOvg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=A07PLgZGVsnut3Qr9ON+rO5LIs/Bg1u1Na3jFW8EfRmz1K88mjeaNcvK9FJuX+zHq MBWNrq224dj2NBKccZLmUTDcyVj1v/w8x0KesDXlRJB8drDdPt3EVUVZLAPIXPGa09 wgxa7n1XzVpQNTDWJeQxErWLlWJzWfbOJ+L36e1E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Bristot de Oliveira , Tom Zanussi , "Steven Rostedt (Google)" Subject: [PATCH 5.10 52/80] tracing: Have traceon and traceoff trigger honor the instance Date: Mon, 28 Feb 2022 18:24:33 +0100 Message-Id: <20220228172318.001204707@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steven Rostedt (Google) commit 302e9edd54985f584cfc180098f3554774126969 upstream. If a trigger is set on an event to disable or enable tracing within an instance, then tracing should be disabled or enabled in the instance and not at the top level, which is confusing to users. Link: https://lkml.kernel.org/r/20220223223837.14f94ec3@rorschach.local.home Cc: stable@vger.kernel.org Fixes: ae63b31e4d0e2 ("tracing: Separate out trace events from global varia= bles") Tested-by: Daniel Bristot de Oliveira Reviewed-by: Tom Zanussi Signed-off-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/trace/trace_events_trigger.c | 52 +++++++++++++++++++++++++++++++= ----- 1 file changed, 46 insertions(+), 6 deletions(-) --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -940,6 +940,16 @@ static void traceon_trigger(struct event_trigger_data *data, void *rec, struct ring_buffer_event *event) { + struct trace_event_file *file =3D data->private_data; + + if (file) { + if (tracer_tracing_is_on(file->tr)) + return; + + tracer_tracing_on(file->tr); + return; + } + if (tracing_is_on()) return; =20 @@ -950,8 +960,15 @@ static void traceon_count_trigger(struct event_trigger_data *data, void *rec, struct ring_buffer_event *event) { - if (tracing_is_on()) - return; + struct trace_event_file *file =3D data->private_data; + + if (file) { + if (tracer_tracing_is_on(file->tr)) + return; + } else { + if (tracing_is_on()) + return; + } =20 if (!data->count) return; @@ -959,13 +976,26 @@ traceon_count_trigger(struct event_trigg if (data->count !=3D -1) (data->count)--; =20 - tracing_on(); + if (file) + tracer_tracing_on(file->tr); + else + tracing_on(); } =20 static void traceoff_trigger(struct event_trigger_data *data, void *rec, struct ring_buffer_event *event) { + struct trace_event_file *file =3D data->private_data; + + if (file) { + if (!tracer_tracing_is_on(file->tr)) + return; + + tracer_tracing_off(file->tr); + return; + } + if (!tracing_is_on()) return; =20 @@ -976,8 +1006,15 @@ static void traceoff_count_trigger(struct event_trigger_data *data, void *rec, struct ring_buffer_event *event) { - if (!tracing_is_on()) - return; + struct trace_event_file *file =3D data->private_data; + + if (file) { + if (!tracer_tracing_is_on(file->tr)) + return; + } else { + if (!tracing_is_on()) + return; + } =20 if (!data->count) return; @@ -985,7 +1022,10 @@ traceoff_count_trigger(struct event_trig if (data->count !=3D -1) (data->count)--; =20 - tracing_off(); + if (file) + tracer_tracing_off(file->tr); + else + tracing_off(); } =20 static int From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C120C433FE for ; Mon, 28 Feb 2022 17:44:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238318AbiB1RpW (ORCPT ); Mon, 28 Feb 2022 12:45:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34822 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237641AbiB1RlS (ORCPT ); Mon, 28 Feb 2022 12:41:18 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B95BD939A6; Mon, 28 Feb 2022 09:34:43 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3A11A614AC; Mon, 28 Feb 2022 17:34:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41FC2C340E7; Mon, 28 Feb 2022 17:34:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069682; bh=b15eEKyFsvxhv7wzv4TWKHP+1e+cw/Eu+//k6NfN7gs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U9aosH6gwTMj3VD+e3iNSb8i5hW6HB7eJpMehDo3nTp7keDFGk4w96DrddTZCf17S OX/x2fyAseCOF5Bhpb49HGa+vhYsrz8+RVpA9yaz4JZXZQUOWVT6WoIh5n83hcZhdH S5ZaciiVfvBfNhDPxOMVnve+YA5MXiwDWx+WFrHQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christophe JAILLET , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 53/80] iio: adc: men_z188_adc: Fix a resource leak in an error handling path Date: Mon, 28 Feb 2022 18:24:34 +0100 Message-Id: <20220228172318.106142861@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christophe JAILLET commit e0a2e37f303828d030a83f33ffe14b36cb88d563 upstream. If iio_device_register() fails, a previous ioremap() is left unbalanced. Update the error handling path and add the missing iounmap() call, as already done in the remove function. Fixes: 74aeac4da66f ("iio: adc: Add MEN 16z188 ADC driver") Signed-off-by: Christophe JAILLET Link: https://lore.kernel.org/r/320fc777863880247c2aff4a9d1a54ba69abf080.16= 43445149.git.christophe.jaillet@wanadoo.fr Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/adc/men_z188_adc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/drivers/iio/adc/men_z188_adc.c +++ b/drivers/iio/adc/men_z188_adc.c @@ -103,6 +103,7 @@ static int men_z188_probe(struct mcb_dev struct z188_adc *adc; struct iio_dev *indio_dev; struct resource *mem; + int ret; =20 indio_dev =3D devm_iio_device_alloc(&dev->dev, sizeof(struct z188_adc)); if (!indio_dev) @@ -128,8 +129,14 @@ static int men_z188_probe(struct mcb_dev adc->mem =3D mem; mcb_set_drvdata(dev, indio_dev); =20 - return iio_device_register(indio_dev); + ret =3D iio_device_register(indio_dev); + if (ret) + goto err_unmap; =20 + return 0; + +err_unmap: + iounmap(adc->base); err: mcb_release_mem(mem); return -ENXIO; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3BE12C433EF for ; Mon, 28 Feb 2022 17:48:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238551AbiB1RtN (ORCPT ); Mon, 28 Feb 2022 12:49:13 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235865AbiB1RmR (ORCPT ); Mon, 28 Feb 2022 12:42:17 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 59B0498F43; Mon, 28 Feb 2022 09:34:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E5C06614D8; Mon, 28 Feb 2022 17:34:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 097ACC340F0; Mon, 28 Feb 2022 17:34:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069685; bh=x8gsEUFvD/6HJ5lGf/pH1UHKiTAOjFi55OMQrV1AT0s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UD7/wdkjzye8m3VMlB9y9SY8P7TvcBG7Np5AKQfUvnRxjafVAvA4GwBaRSEFOVtM2 RQOfYSgRYm3RxhHFtC3QjuhHio3Yf8VlzzrI2GzHaXZHfz7UonX900vkwx5JVnZS1v 3LJbNGJsjDadHG+9SITl0xkicBFdHc/UbqlHTfqI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cosmin Tanislav , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 54/80] iio: adc: ad7124: fix mask used for setting AIN_BUFP & AIN_BUFM bits Date: Mon, 28 Feb 2022 18:24:35 +0100 Message-Id: <20220228172318.205347914@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cosmin Tanislav commit 0e33d15f1dce9e3a80a970ea7f0b27837168aeca upstream. According to page 90 of the datasheet [1], AIN_BUFP is bit 6 and AIN_BUFM is bit 5 of the CONFIG_0 -> CONFIG_7 registers. Fix the mask used for setting these bits. [1]: https://www.analog.com/media/en/technical-documentation/data-sheets/ad= 7124-8.pdf Fixes: 0eaecea6e487 ("iio: adc: ad7124: Add buffered input support") Signed-off-by: Cosmin Tanislav Link: https://lore.kernel.org/r/20220112200036.694490-1-cosmin.tanislav@ana= log.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/adc/ad7124.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/adc/ad7124.c +++ b/drivers/iio/adc/ad7124.c @@ -74,7 +74,7 @@ #define AD7124_CONFIG_REF_SEL(x) FIELD_PREP(AD7124_CONFIG_REF_SEL_MSK, x) #define AD7124_CONFIG_PGA_MSK GENMASK(2, 0) #define AD7124_CONFIG_PGA(x) FIELD_PREP(AD7124_CONFIG_PGA_MSK, x) -#define AD7124_CONFIG_IN_BUFF_MSK GENMASK(7, 6) +#define AD7124_CONFIG_IN_BUFF_MSK GENMASK(6, 5) #define AD7124_CONFIG_IN_BUFF(x) FIELD_PREP(AD7124_CONFIG_IN_BUFF_MSK, x) =20 /* AD7124_FILTER_X */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2A7AC433F5 for ; Mon, 28 Feb 2022 17:49:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238968AbiB1RuY (ORCPT ); Mon, 28 Feb 2022 12:50:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239376AbiB1RoH (ORCPT ); Mon, 28 Feb 2022 12:44:07 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C3299D0DA; Mon, 28 Feb 2022 09:36:17 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CCA3C614CF; Mon, 28 Feb 2022 17:36:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E483AC340E7; Mon, 28 Feb 2022 17:36:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069776; bh=ruIwVuDKnSdCObgpLqgb2P1doA3BgN+QgTg0ljHVBdM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z1Sz46zr+Hexyg1gWdqOHxIxVUh8mk2KGddSPbTQt4BHELqQ6tGSSyUv0T3DXuBUc O7k1GBPsG+FoCZIiWa5jrdCyeS60GsjXEJ41tLEDkaeLnz6O69WMpzdOr1TWm6R4BF RpvSD3/8EHgWdsUC+RLWBHyONB6Tr4w9ga4y7aWc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mario Tesi , Lorenzo Bianconi , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 55/80] iio: imu: st_lsm6dsx: wait for settling time in st_lsm6dsx_read_oneshot Date: Mon, 28 Feb 2022 18:24:36 +0100 Message-Id: <20220228172318.323596740@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lorenzo Bianconi commit ea85bf906466191b58532bb19f4fbb4591f0a77e upstream. We need to wait for sensor settling time (~ 3/ODR) before reading data in st_lsm6dsx_read_oneshot routine in order to avoid corrupted samples. Fixes: 290a6ce11d93 ("iio: imu: add support to lsm6dsx driver") Reported-by: Mario Tesi Tested-by: Mario Tesi Signed-off-by: Lorenzo Bianconi Link: https://lore.kernel.org/r/b41ebda5535895298716c76d939f9f165fcd2d13.16= 44098120.git.lorenzo@kernel.org Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) --- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c @@ -1558,8 +1558,12 @@ static int st_lsm6dsx_read_oneshot(struc if (err < 0) return err; =20 + /* + * we need to wait for sensor settling time before + * reading data in order to avoid corrupted samples + */ delay =3D 1000000000 / sensor->odr; - usleep_range(delay, 2 * delay); + usleep_range(3 * delay, 4 * delay); =20 err =3D st_lsm6dsx_read_locked(hw, addr, &data, sizeof(data)); if (err < 0) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6904FC433EF for ; Mon, 28 Feb 2022 17:45:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238497AbiB1RqD (ORCPT ); Mon, 28 Feb 2022 12:46:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238770AbiB1RnC (ORCPT ); Mon, 28 Feb 2022 12:43:02 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EF54D99EF7; Mon, 28 Feb 2022 09:35:09 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 95778B815A6; Mon, 28 Feb 2022 17:35:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3974C340E7; Mon, 28 Feb 2022 17:35:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069707; bh=CyB4oYiKOTMEY4anc6QUGu8RyPzv4rRKP64iSBqTi28=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XEWGQ1jpWDiVEKfQKeg5NxTh5jy2dSGJlCEnR6jpigxkZDHFech2p4L63/a5ezsqi RIpgcuWXvAYuKFEmkRUXI7otVNo1lDw67ZUEkt3Vv/WJKrANv9VztNSMRjIBoirU1e 4eC+ilDLlcuita5THQZHPrPg1504zXPSqsWlELrA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Andy Shevchenko , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 56/80] iio: Fix error handling for PM Date: Mon, 28 Feb 2022 18:24:37 +0100 Message-Id: <20220228172318.444062098@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin commit 632fe0bb8c5b9c06ec961f575ee42a6fff5eceeb upstream. The pm_runtime_enable will increase power disable depth. If the probe fails, we should use pm_runtime_disable() to balance pm_runtime_enable(). In the PM Runtime docs: Drivers in ->remove() callback should undo the runtime PM changes done in ->probe(). Usually this means calling pm_runtime_disable(), pm_runtime_dont_use_autosuspend() etc. We should do this in error handling. Fix this problem for the following drivers: bmc150, bmg160, kmx61, kxcj-1013, mma9551, mma9553. Fixes: 7d0ead5c3f00 ("iio: Reconcile operation order between iio_register/u= nregister and pm functions") Signed-off-by: Miaoqian Lin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220106112309.16879-1-linmq006@gmail.com Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/accel/bmc150-accel-core.c | 5 ++++- drivers/iio/accel/kxcjk-1013.c | 5 ++++- drivers/iio/accel/mma9551.c | 5 ++++- drivers/iio/accel/mma9553.c | 5 ++++- drivers/iio/gyro/bmg160_core.c | 5 ++++- drivers/iio/imu/kmx61.c | 5 ++++- drivers/iio/magnetometer/bmc150_magn.c | 5 +++-- 7 files changed, 27 insertions(+), 8 deletions(-) --- a/drivers/iio/accel/bmc150-accel-core.c +++ b/drivers/iio/accel/bmc150-accel-core.c @@ -1648,11 +1648,14 @@ int bmc150_accel_core_probe(struct devic ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(dev, "Unable to register iio device\n"); - goto err_trigger_unregister; + goto err_pm_cleanup; } =20 return 0; =20 +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); err_trigger_unregister: bmc150_accel_unregister_triggers(data, BMC150_ACCEL_TRIGGERS - 1); err_buffer_cleanup: --- a/drivers/iio/accel/kxcjk-1013.c +++ b/drivers/iio/accel/kxcjk-1013.c @@ -1429,11 +1429,14 @@ static int kxcjk1013_probe(struct i2c_cl ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(&client->dev, "unable to register iio device\n"); - goto err_buffer_cleanup; + goto err_pm_cleanup; } =20 return 0; =20 +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(&client->dev); + pm_runtime_disable(&client->dev); err_buffer_cleanup: iio_triggered_buffer_cleanup(indio_dev); err_trigger_unregister: --- a/drivers/iio/accel/mma9551.c +++ b/drivers/iio/accel/mma9551.c @@ -495,11 +495,14 @@ static int mma9551_probe(struct i2c_clie ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(&client->dev, "unable to register iio device\n"); - goto out_poweroff; + goto err_pm_cleanup; } =20 return 0; =20 +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(&client->dev); + pm_runtime_disable(&client->dev); out_poweroff: mma9551_set_device_state(client, false); =20 --- a/drivers/iio/accel/mma9553.c +++ b/drivers/iio/accel/mma9553.c @@ -1134,12 +1134,15 @@ static int mma9553_probe(struct i2c_clie ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(&client->dev, "unable to register iio device\n"); - goto out_poweroff; + goto err_pm_cleanup; } =20 dev_dbg(&indio_dev->dev, "Registered device %s\n", name); return 0; =20 +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(&client->dev); + pm_runtime_disable(&client->dev); out_poweroff: mma9551_set_device_state(client, false); return ret; --- a/drivers/iio/gyro/bmg160_core.c +++ b/drivers/iio/gyro/bmg160_core.c @@ -1170,11 +1170,14 @@ int bmg160_core_probe(struct device *dev ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(dev, "unable to register iio device\n"); - goto err_buffer_cleanup; + goto err_pm_cleanup; } =20 return 0; =20 +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(dev); + pm_runtime_disable(dev); err_buffer_cleanup: iio_triggered_buffer_cleanup(indio_dev); err_trigger_unregister: --- a/drivers/iio/imu/kmx61.c +++ b/drivers/iio/imu/kmx61.c @@ -1392,7 +1392,7 @@ static int kmx61_probe(struct i2c_client ret =3D iio_device_register(data->acc_indio_dev); if (ret < 0) { dev_err(&client->dev, "Failed to register acc iio device\n"); - goto err_buffer_cleanup_mag; + goto err_pm_cleanup; } =20 ret =3D iio_device_register(data->mag_indio_dev); @@ -1405,6 +1405,9 @@ static int kmx61_probe(struct i2c_client =20 err_iio_unregister_acc: iio_device_unregister(data->acc_indio_dev); +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(&client->dev); + pm_runtime_disable(&client->dev); err_buffer_cleanup_mag: if (client->irq > 0) iio_triggered_buffer_cleanup(data->mag_indio_dev); --- a/drivers/iio/magnetometer/bmc150_magn.c +++ b/drivers/iio/magnetometer/bmc150_magn.c @@ -941,13 +941,14 @@ int bmc150_magn_probe(struct device *dev ret =3D iio_device_register(indio_dev); if (ret < 0) { dev_err(dev, "unable to register iio device\n"); - goto err_disable_runtime_pm; + goto err_pm_cleanup; } =20 dev_dbg(dev, "Registered device %s\n", name); return 0; =20 -err_disable_runtime_pm: +err_pm_cleanup: + pm_runtime_dont_use_autosuspend(dev); pm_runtime_disable(dev); err_buffer_cleanup: iio_triggered_buffer_cleanup(indio_dev); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D5B70C43217 for ; Mon, 28 Feb 2022 17:49:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238797AbiB1Rts (ORCPT ); Mon, 28 Feb 2022 12:49:48 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33884 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239093AbiB1Rnn (ORCPT ); Mon, 28 Feb 2022 12:43:43 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 278159BADB; Mon, 28 Feb 2022 09:35:40 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CB6A0B815B3; Mon, 28 Feb 2022 17:35:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B6F1C340E7; Mon, 28 Feb 2022 17:35:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069737; bh=proz3bvdxjhOT5DfiHRULI1RvpCIjSBWFGd5tXjZbDQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OU3IoXKUKNU8WMWHG69Uc5/JRsrxr8KxSI1oIZF5Ow+LxIgPIn/nBOWAceI7V4yw3 pUrE2Td0ft16oJKh2CjO53tT4WBcLQCIlOvFcQaKu1mZRXwLKA7M8s28l/4tKryAK5 DwEPtXWB0Aga8EU2znyO+El1LSbcvMU7NgZHWFEo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Phil Elwell Subject: [PATCH 5.10 57/80] sc16is7xx: Fix for incorrect data being transmitted Date: Mon, 28 Feb 2022 18:24:38 +0100 Message-Id: <20220228172318.578931953@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Phil Elwell commit eebb0f4e894f1e9577a56b337693d1051dd6ebfd upstream. UART drivers are meant to use the port spinlock within certain methods, to protect against reentrancy. The sc16is7xx driver does very little locking, presumably because when added it triggers "scheduling while atomic" errors. This is due to the use of mutexes within the regmap abstraction layer, and the mutex implementation's habit of sleeping the current thread while waiting for access. Unfortunately this lack of interlocking can lead to corruption of outbound data, which occurs when the buffer used for I2C transmission is used simultaneously by two threads - a work queue thread running sc16is7xx_tx_proc, and an IRQ thread in sc16is7xx_port_irq, both of which can call sc16is7xx_handle_tx. An earlier patch added efr_lock, a mutex that controls access to the EFR register. This mutex is already claimed in the IRQ handler, and all that is required is to claim the same mutex in sc16is7xx_tx_proc. See: https://github.com/raspberrypi/linux/issues/4885 Fixes: 6393ff1c4435 ("sc16is7xx: Use threaded IRQ") Cc: stable Signed-off-by: Phil Elwell Link: https://lore.kernel.org/r/20220216160802.1026013-1-phil@raspberrypi.c= om Signed-off-by: Greg Kroah-Hartman Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tty/serial/sc16is7xx.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c index 64e7e6c8145f..38d1c0748533 100644 --- a/drivers/tty/serial/sc16is7xx.c +++ b/drivers/tty/serial/sc16is7xx.c @@ -734,12 +734,15 @@ static irqreturn_t sc16is7xx_irq(int irq, void *dev_i= d) static void sc16is7xx_tx_proc(struct kthread_work *ws) { struct uart_port *port =3D &(to_sc16is7xx_one(ws, tx_work)->port); + struct sc16is7xx_port *s =3D dev_get_drvdata(port->dev); =20 if ((port->rs485.flags & SER_RS485_ENABLED) && (port->rs485.delay_rts_before_send > 0)) msleep(port->rs485.delay_rts_before_send); =20 + mutex_lock(&s->efr_lock); sc16is7xx_handle_tx(port); + mutex_unlock(&s->efr_lock); } =20 static void sc16is7xx_reconf_rs485(struct uart_port *port) --=20 2.35.1 From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F228C433EF for ; Mon, 28 Feb 2022 17:46:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238733AbiB1Rq5 (ORCPT ); Mon, 28 Feb 2022 12:46:57 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239236AbiB1Rnw (ORCPT ); Mon, 28 Feb 2022 12:43:52 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BF1159D042; Mon, 28 Feb 2022 09:35:59 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 752D5B815BB; Mon, 28 Feb 2022 17:35:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1981C340E7; Mon, 28 Feb 2022 17:35:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069757; bh=3eRJEy+ZjS94CDexDLediyf+S+DU9xrQ07WNDcrwUXM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ODtqK3JSqz2UqK83TvM4wvYoeprRI/dG0D+8UyjRYW0OTPHq8frzKWY4asj7R5UaX AgS/CXUYDSHjrYa+TeywifyU+R/Cu8hD3HaXDV/E3tGwZ6wpPjJfu609fr/TYwgNqs u3VE3F1I+vCzBYEc1X3GbT+Xi69E1FlRbQMj2lpo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Damien Le Moal Subject: [PATCH 5.10 58/80] ata: pata_hpt37x: disable primary channel on HPT371 Date: Mon, 28 Feb 2022 18:24:39 +0100 Message-Id: <20220228172318.715057524@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sergey Shtylyov commit 8d093e02e898b24c58788b0289e3202317a96d2a upstream. The HPT371 chip physically has only one channel, the secondary one, however the primary channel registers do exist! Thus we have to manually disable the non-existing channel if the BIOS hasn't done this already. Similarly to the pata_hpt3x2n driver, always disable the primary channel. Fixes: 669a5db411d8 ("[libata] Add a bunch of PATA drivers.") Cc: stable@vger.kernel.org Signed-off-by: Sergey Shtylyov Signed-off-by: Damien Le Moal Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/ata/pata_hpt37x.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) --- a/drivers/ata/pata_hpt37x.c +++ b/drivers/ata/pata_hpt37x.c @@ -918,6 +918,20 @@ static int hpt37x_init_one(struct pci_de pci_write_config_byte(dev, 0x5a, irqmask); =20 /* + * HPT371 chips physically have only one channel, the secondary one, + * but the primary channel registers do exist! Go figure... + * So, we manually disable the non-existing channel here + * (if the BIOS hasn't done this already). + */ + if (dev->device =3D=3D PCI_DEVICE_ID_TTI_HPT371) { + u8 mcr1; + + pci_read_config_byte(dev, 0x50, &mcr1); + mcr1 &=3D ~0x04; + pci_write_config_byte(dev, 0x50, mcr1); + } + + /* * default to pci clock. make sure MA15/16 are set to output * to prevent drives having problems with 40-pin cables. Needed * for some drives such as IBM-DTLA which will not enter ready From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 13819C433F5 for ; Mon, 28 Feb 2022 17:46:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238741AbiB1RrD (ORCPT ); Mon, 28 Feb 2022 12:47:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239239AbiB1Rnw (ORCPT ); Mon, 28 Feb 2022 12:43:52 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C468695A2D; Mon, 28 Feb 2022 09:36:00 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 58AFF614CD; Mon, 28 Feb 2022 17:36:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 72B3CC340E7; Mon, 28 Feb 2022 17:35:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069759; bh=rzjIv3Y6uxvOnI6bDTKnF+WA7ReFM5LSD1pxUEbn0uM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IrOXe58J1BRT9GBFuaZYZUaV40EeQkPpyaf/cvAlFcNmescUv/cc8aXAk6F2hPYr9 ExVuBbRztgmqknApWz6yG5wphtnBcXUzUmtDOHNxhBeZSrVnS7dg+Nnxs8mB8XBdWi 1yRR4FpODSwLUgkmHAm5WW2Vgdx26viqWgcm7tPA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmytro Bagrii , Johan Hovold Subject: [PATCH 5.10 59/80] Revert "USB: serial: ch341: add new Product ID for CH341A" Date: Mon, 28 Feb 2022 18:24:40 +0100 Message-Id: <20220228172318.877750584@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dmytro Bagrii commit 198a7ebd5fa17b4d0be8cb70240ee1be885175c0 upstream. This reverts commit 46ee4abb10a07bd8f8ce910ee6b4ae6a947d7f63. CH341 has Product ID 0x5512 in EPP/MEM mode which is used for I2C/SPI/GPIO interfaces. In asynchronous serial interface mode CH341 has PID 0x5523 which is already in the table. Mode is selected by corresponding jumper setting. Signed-off-by: Dmytro Bagrii Link: https://lore.kernel.org/r/20220210164137.4376-1-dimich.dmb@gmail.com Link: https://lore.kernel.org/r/YJ0OCS/sh+1ifD/q@hovoldconsulting.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/serial/ch341.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/usb/serial/ch341.c +++ b/drivers/usb/serial/ch341.c @@ -81,7 +81,6 @@ #define CH341_QUIRK_SIMULATE_BREAK BIT(1) =20 static const struct usb_device_id id_table[] =3D { - { USB_DEVICE(0x1a86, 0x5512) }, { USB_DEVICE(0x1a86, 0x5523) }, { USB_DEVICE(0x1a86, 0x7522) }, { USB_DEVICE(0x1a86, 0x7523) }, From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3034EC433F5 for ; Mon, 28 Feb 2022 17:46:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237989AbiB1RrW (ORCPT ); Mon, 28 Feb 2022 12:47:22 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33884 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239277AbiB1Rny (ORCPT ); Mon, 28 Feb 2022 12:43:54 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 505569D071; Mon, 28 Feb 2022 09:36:05 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D0026B815A6; Mon, 28 Feb 2022 17:36:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27D95C340E7; Mon, 28 Feb 2022 17:36:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069762; bh=p8i4Tq1JhKBA4elh4tr7Rvc8i93blPcxJzdKjp36pJI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rpo1EM54pLOv5QW0PK7VMUJtqwZnVToCS6I8cT1SK0XoqAfzZm1tLuvgJItx/CL8U 8jAWK+6y2vyiDqJRQMUWslGSLnaRMTIKhGS+2P7PqDWpDwtVn62+6kSJMOvcEMgdVb 1HKhdh9ca9H4vtwbhrut37ls71BKOixttMnmjsZE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Daehwan Jung Subject: [PATCH 5.10 60/80] usb: gadget: rndis: add spinlock for rndis response list Date: Mon, 28 Feb 2022 18:24:41 +0100 Message-Id: <20220228172319.012429864@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daehwan Jung commit aaaba1c86d04dac8e49bf508b492f81506257da3 upstream. There's no lock for rndis response list. It could cause list corruption if there're two different list_add at the same time like below. It's better to add in rndis_add_response / rndis_free_response / rndis_get_next_response to prevent any race condition on response list. [ 361.894299] [1: irq/191-dwc3:16979] list_add corruption. next->prev should be prev (ffffff80651764d0), but was ffffff883dc36f80. (next=3Dffffff80651764d0). [ 361.904380] [1: irq/191-dwc3:16979] Call trace: [ 361.904391] [1: irq/191-dwc3:16979] __list_add_valid+0x74/0x90 [ 361.904401] [1: irq/191-dwc3:16979] rndis_msg_parser+0x168/0x8c0 [ 361.904409] [1: irq/191-dwc3:16979] rndis_command_complete+0x24/0x84 [ 361.904417] [1: irq/191-dwc3:16979] usb_gadget_giveback_request+0x20/= 0xe4 [ 361.904426] [1: irq/191-dwc3:16979] dwc3_gadget_giveback+0x44/0x60 [ 361.904434] [1: irq/191-dwc3:16979] dwc3_ep0_complete_data+0x1e8/0x3a0 [ 361.904442] [1: irq/191-dwc3:16979] dwc3_ep0_interrupt+0x29c/0x3dc [ 361.904450] [1: irq/191-dwc3:16979] dwc3_process_event_entry+0x78/0x6= cc [ 361.904457] [1: irq/191-dwc3:16979] dwc3_process_event_buf+0xa0/0x1ec [ 361.904465] [1: irq/191-dwc3:16979] dwc3_thread_interrupt+0x34/0x5c Fixes: f6281af9d62e ("usb: gadget: rndis: use list_for_each_entry_safe") Cc: stable Signed-off-by: Daehwan Jung Link: https://lore.kernel.org/r/1645507768-77687-1-git-send-email-dh10.jung= @samsung.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/gadget/function/rndis.c | 8 ++++++++ drivers/usb/gadget/function/rndis.h | 1 + 2 files changed, 9 insertions(+) --- a/drivers/usb/gadget/function/rndis.c +++ b/drivers/usb/gadget/function/rndis.c @@ -922,6 +922,7 @@ struct rndis_params *rndis_register(void params->resp_avail =3D resp_avail; params->v =3D v; INIT_LIST_HEAD(¶ms->resp_queue); + spin_lock_init(¶ms->resp_lock); pr_debug("%s: configNr =3D %d\n", __func__, i); =20 return params; @@ -1015,12 +1016,14 @@ void rndis_free_response(struct rndis_pa { rndis_resp_t *r, *n; =20 + spin_lock(¶ms->resp_lock); list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { if (r->buf =3D=3D buf) { list_del(&r->list); kfree(r); } } + spin_unlock(¶ms->resp_lock); } EXPORT_SYMBOL_GPL(rndis_free_response); =20 @@ -1030,14 +1033,17 @@ u8 *rndis_get_next_response(struct rndis =20 if (!length) return NULL; =20 + spin_lock(¶ms->resp_lock); list_for_each_entry_safe(r, n, ¶ms->resp_queue, list) { if (!r->send) { r->send =3D 1; *length =3D r->length; + spin_unlock(¶ms->resp_lock); return r->buf; } } =20 + spin_unlock(¶ms->resp_lock); return NULL; } EXPORT_SYMBOL_GPL(rndis_get_next_response); @@ -1054,7 +1060,9 @@ static rndis_resp_t *rndis_add_response( r->length =3D length; r->send =3D 0; =20 + spin_lock(¶ms->resp_lock); list_add_tail(&r->list, ¶ms->resp_queue); + spin_unlock(¶ms->resp_lock); return r; } =20 --- a/drivers/usb/gadget/function/rndis.h +++ b/drivers/usb/gadget/function/rndis.h @@ -174,6 +174,7 @@ typedef struct rndis_params { void (*resp_avail)(void *v); void *v; struct list_head resp_queue; + spinlock_t resp_lock; } rndis_params; =20 /* RNDIS Message parser and other useless functions */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 75550C433F5 for ; Mon, 28 Feb 2022 17:46:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238644AbiB1Rrb (ORCPT ); Mon, 28 Feb 2022 12:47:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33452 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239298AbiB1Rn4 (ORCPT ); Mon, 28 Feb 2022 12:43:56 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A58C9D0CA; Mon, 28 Feb 2022 09:36:07 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 890D0B815BA; Mon, 28 Feb 2022 17:36:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D81F1C340E7; Mon, 28 Feb 2022 17:36:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069765; bh=uCerF8BX4XGwIHz+tAyMMigidC2NZyRMn7ck9WmU0ek=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EzbyMZ23fHmVGgVETgrGMRCveXNSwpgbVRWxL7dubO5MK8veJZqzy3X+RO8eRq/N7 srqp+mPz8C8mxjrwlzAL9hTV+vCqiLeMUBW0pIfJ6Hck3moL6a7YYJvld6yqABf9+/ sf0+aO7eCcxeTbU9fNwaolYqoE5Qa7Dgxvcqxg5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Szymon Heidrich , stable Subject: [PATCH 5.10 61/80] USB: gadget: validate endpoint index for xilinx udc Date: Mon, 28 Feb 2022 18:24:42 +0100 Message-Id: <20220228172319.145029646@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Szymon Heidrich commit 7f14c7227f342d9932f9b918893c8814f86d2a0d upstream. Assure that host may not manipulate the index to point past endpoint array. Signed-off-by: Szymon Heidrich Cc: stable Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/gadget/udc/udc-xilinx.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/gadget/udc/udc-xilinx.c +++ b/drivers/usb/gadget/udc/udc-xilinx.c @@ -1612,6 +1612,8 @@ static void xudc_getstatus(struct xusb_u break; case USB_RECIP_ENDPOINT: epnum =3D udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; + if (epnum >=3D XUSB_MAX_ENDPOINTS) + goto stall; target_ep =3D &udc->ep[epnum]; epcfgreg =3D udc->read_fn(udc->addr + target_ep->offset); halt =3D epcfgreg & XUSB_EP_CFG_STALL_MASK; @@ -1679,6 +1681,10 @@ static void xudc_set_clear_feature(struc case USB_RECIP_ENDPOINT: if (!udc->setup.wValue) { endpoint =3D udc->setup.wIndex & USB_ENDPOINT_NUMBER_MASK; + if (endpoint >=3D XUSB_MAX_ENDPOINTS) { + xudc_ep0_stall(udc); + return; + } target_ep =3D &udc->ep[endpoint]; outinbit =3D udc->setup.wIndex & USB_ENDPOINT_DIR_MASK; outinbit =3D outinbit >> 7; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3D152C433F5 for ; Mon, 28 Feb 2022 17:46:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235721AbiB1Rr1 (ORCPT ); Mon, 28 Feb 2022 12:47:27 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58912 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239303AbiB1Rn4 (ORCPT ); Mon, 28 Feb 2022 12:43:56 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DAB689D05A; Mon, 28 Feb 2022 09:36:08 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7AD0D614CD; Mon, 28 Feb 2022 17:36:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A84FC340E7; Mon, 28 Feb 2022 17:36:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069767; bh=5OcLa9xhiQm5sSpWziM/BAipFWqf/w/nCCjsk6ZkN4A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SaAQXE1Fe/ZGXcHE+fZD8E3wn0csvwYw1gzYZfTcU6IMJNdYTQao1IyyTiWWA5d4E Tk34uWSreSQuCD36HWBW7PLY/qyiI1Bc1ov76jq2uwepwfRONd8pknui9B1pxVhCso WeRykPpwC9+ke86+Jp3iqFZsQnBgXwWF/S41wdOM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Al Viro , "Steven Rostedt (Google)" Subject: [PATCH 5.10 62/80] tracefs: Set the group ownership in apply_options() not parse_options() Date: Mon, 28 Feb 2022 18:24:43 +0100 Message-Id: <20220228172319.275058355@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steven Rostedt (Google) commit 851e99ebeec3f4a672bb5010cf1ece095acee447 upstream. Al Viro brought it to my attention that the dentries may not be filled when the parse_options() is called, causing the call to set_gid() to possibly crash. It should only be called if parse_options() succeeds totally anyway. He suggested the logical place to do the update is in apply_options(). Link: https://lore.kernel.org/all/20220225165219.737025658@goodmis.org/ Link: https://lkml.kernel.org/r/20220225153426.1c4cab6b@gandalf.local.home Cc: stable@vger.kernel.org Acked-by: Al Viro Reported-by: Al Viro Fixes: 48b27b6b5191 ("tracefs: Set all files to the same group ownership as= the mount option") Signed-off-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/tracefs/inode.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/fs/tracefs/inode.c +++ b/fs/tracefs/inode.c @@ -262,7 +262,6 @@ static int tracefs_parse_options(char *d if (!gid_valid(gid)) return -EINVAL; opts->gid =3D gid; - set_gid(tracefs_mount->mnt_root, gid); break; case Opt_mode: if (match_octal(&args[0], &option)) @@ -289,7 +288,9 @@ static int tracefs_apply_options(struct inode->i_mode |=3D opts->mode; =20 inode->i_uid =3D opts->uid; - inode->i_gid =3D opts->gid; + + /* Set all the group ids to the mount option */ + set_gid(sb->s_root, opts->gid); =20 return 0; } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1C5C2C433EF for ; Mon, 28 Feb 2022 17:49:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238861AbiB1RuV (ORCPT ); Mon, 28 Feb 2022 12:50:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33624 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239337AbiB1RoB (ORCPT ); Mon, 28 Feb 2022 12:44:01 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4483E9680C; Mon, 28 Feb 2022 09:36:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E0E0FB815BE; Mon, 28 Feb 2022 17:36:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F8B9C340E7; Mon, 28 Feb 2022 17:36:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069770; bh=DzwcJXbODgTKFsEgFpXDiJ68s9xoeQXLilc34DuJJns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oBCJrl2McNyL8DAHhOjdxComLhReldIWlxgSsAs4XcZZqp5yD4kgPUKIbzN1v1qN3 PMEnMBjp1dqMCYk0IHZqSO9Pe/BABBQc5SfZwHRzJppeXjoAPqQVhNvFwOIiIIrYy8 w1h+bCmKdUEnA2zIq2xhlj8A5WDUn6za+PKn3Lm8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Slark Xiao , Johan Hovold Subject: [PATCH 5.10 63/80] USB: serial: option: add support for DW5829e Date: Mon, 28 Feb 2022 18:24:44 +0100 Message-Id: <20220228172319.396037783@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Slark Xiao commit 6ecb3f0b18b320320460a42e40d6fb603f6ded96 upstream. Dell DW5829e same as DW5821e except CAT level. DW5821e supports CAT16 but DW5829e supports CAT9. There are 2 types product of DW5829e: normal and eSIM. So we will add 2 PID for DW5829e. And for each PID, it support MBIM or RMNET. Let's see test evidence as below: DW5829e MBIM mode: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 4 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 2 P: Vendor=3D413c ProdID=3D81e6 Rev=3D03.18 S: Manufacturer=3DDell Inc. S: Product=3DDW5829e Snapdragon X20 LTE S: SerialNumber=3D0123456789ABCDEF C: #Ifs=3D 7 Cfg#=3D 2 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3Doption I: If#=3D0x6 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) DW5829e RMNET mode: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 5 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D413c ProdID=3D81e6 Rev=3D03.18 S: Manufacturer=3DDell Inc. S: Product=3DDW5829e Snapdragon X20 LTE S: SerialNumber=3D0123456789ABCDEF C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 1 Cls=3D03(HID ) Sub=3D00 Prot=3D00 Driver= =3Dusbhid I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3Doption DW5829e-eSIM MBIM mode: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 6 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 2 P: Vendor=3D413c ProdID=3D81e4 Rev=3D03.18 S: Manufacturer=3DDell Inc. S: Product=3DDW5829e-eSIM Snapdragon X20 LTE S: SerialNumber=3D0123456789ABCDEF C: #Ifs=3D 7 Cfg#=3D 2 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 1 Cls=3D02(commc) Sub=3D0e Prot=3D00 Driver= =3Dcdc_mbim I: If#=3D0x1 Alt=3D 1 #EPs=3D 2 Cls=3D0a(data ) Sub=3D00 Prot=3D02 Driver= =3Dcdc_mbim I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3Doption I: If#=3D0x6 Alt=3D 0 #EPs=3D 1 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3D(none) DW5829e-eSIM RMNET mode: T: Bus=3D04 Lev=3D01 Prnt=3D01 Port=3D01 Cnt=3D01 Dev#=3D 7 Spd=3D5000 Mx= Ch=3D 0 D: Ver=3D 3.10 Cls=3Def(misc ) Sub=3D02 Prot=3D01 MxPS=3D 9 #Cfgs=3D 1 P: Vendor=3D413c ProdID=3D81e4 Rev=3D03.18 S: Manufacturer=3DDell Inc. S: Product=3DDW5829e-eSIM Snapdragon X20 LTE S: SerialNumber=3D0123456789ABCDEF C: #Ifs=3D 6 Cfg#=3D 1 Atr=3Da0 MxPwr=3D896mA I: If#=3D0x0 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3Dqmi_wwan I: If#=3D0x1 Alt=3D 0 #EPs=3D 1 Cls=3D03(HID ) Sub=3D00 Prot=3D00 Driver= =3Dusbhid I: If#=3D0x2 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x3 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x4 Alt=3D 0 #EPs=3D 3 Cls=3Dff(vend.) Sub=3D00 Prot=3D00 Driver= =3Doption I: If#=3D0x5 Alt=3D 0 #EPs=3D 2 Cls=3Dff(vend.) Sub=3Dff Prot=3Dff Driver= =3Doption BTW, the interface 0x6 of MBIM mode is GNSS port, which not same as NMEA port. So it's banned from serial option driver. The remaining interfaces 0x2-0x5 are: MODEM, MODEM, NMEA, DIAG. Signed-off-by: Slark Xiao Link: https://lore.kernel.org/r/20220214021401.6264-1-slark_xiao@163.com [ johan: drop unnecessary reservation of interface 1 ] Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -198,6 +198,8 @@ static void option_instat_callback(struc =20 #define DELL_PRODUCT_5821E 0x81d7 #define DELL_PRODUCT_5821E_ESIM 0x81e0 +#define DELL_PRODUCT_5829E_ESIM 0x81e4 +#define DELL_PRODUCT_5829E 0x81e6 =20 #define KYOCERA_VENDOR_ID 0x0c88 #define KYOCERA_PRODUCT_KPC650 0x17da @@ -1063,6 +1065,10 @@ static const struct usb_device_id option .driver_info =3D RSVD(0) | RSVD(1) | RSVD(6) }, { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E_ESIM), .driver_info =3D RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E), + .driver_info =3D RSVD(0) | RSVD(6) }, + { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5829E_ESIM), + .driver_info =3D RSVD(0) | RSVD(6) }, { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100= , ADU-310 */ { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7A358C433EF for ; Mon, 28 Feb 2022 17:49:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238841AbiB1RuT (ORCPT ); Mon, 28 Feb 2022 12:50:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58794 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239332AbiB1Rn6 (ORCPT ); Mon, 28 Feb 2022 12:43:58 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93AAC88B14; Mon, 28 Feb 2022 09:36:14 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 095D6614AB; Mon, 28 Feb 2022 17:36:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC75FC340F0; Mon, 28 Feb 2022 17:36:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069773; bh=TG+mq0mWCM/MrB0JN5FlEuzzUbsrlAfNgtd+H9v3LVM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d3WUjGdsmLGfTvCb/z/PZLN/Zpoy38aqr8n9q8RYNhb2OuD/ssAjPoKrRGzlfjdYS BJLeMTGgtY/fFwVkOymijDVCYondd+4KgOQSlugWNdf5/OVI6uXncpWcAd4Zxkmhvt qIfP/6+mhpseMU3ZlKNyG9YbubzzsM6fx8glXtcQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniele Palmas , Johan Hovold Subject: [PATCH 5.10 64/80] USB: serial: option: add Telit LE910R1 compositions Date: Mon, 28 Feb 2022 18:24:45 +0100 Message-Id: <20220228172319.505272887@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniele Palmas commit cfc4442c642d568014474b6718ccf65dc7ca6099 upstream. Add support for the following Telit LE910R1 compositions: 0x701a: rndis, tty, tty, tty 0x701b: ecm, tty, tty, tty 0x9201: tty Signed-off-by: Daniele Palmas Link: https://lore.kernel.org/r/20220218134552.4051-1-dnlplm@gmail.com Cc: stable@vger.kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -1279,10 +1279,16 @@ static const struct usb_device_id option .driver_info =3D NCTRL(2) }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x7011, 0xff), /* Telit LE9= 10-S1 (ECM) */ .driver_info =3D NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701a, 0xff), /* Telit LE9= 10R1 (RNDIS) */ + .driver_info =3D NCTRL(2) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x701b, 0xff), /* Telit LE9= 10R1 (ECM) */ + .driver_info =3D NCTRL(2) }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9010), /* Telit SBL FN980 flashing dev= ice */ .driver_info =3D NCTRL(0) | ZLP }, { USB_DEVICE(TELIT_VENDOR_ID, 0x9200), /* Telit LE910S1 flashing devic= e */ .driver_info =3D NCTRL(0) | ZLP }, + { USB_DEVICE(TELIT_VENDOR_ID, 0x9201), /* Telit LE910R1 flashing devic= e */ + .driver_info =3D NCTRL(0) | ZLP }, { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0= xff, 0xff) }, /* ZTE WCDMA products */ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0002, 0xff, 0xff, 0xff), .driver_info =3D RSVD(1) }, From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BD64C433EF for ; Mon, 28 Feb 2022 17:45:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238518AbiB1RqK (ORCPT ); Mon, 28 Feb 2022 12:46:10 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238800AbiB1RnD (ORCPT ); Mon, 28 Feb 2022 12:43:03 -0500 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5AF909A4D7; Mon, 28 Feb 2022 09:35:13 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id C6B72CE17C8; Mon, 28 Feb 2022 17:35:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9365C340E7; Mon, 28 Feb 2022 17:35:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069710; bh=bdeZ2090sDqU+izv81ASqcBTYUENGg4bAPv8rFcJ7GI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=J40PupWfLXIhC5rz7DccAz/yRzPv7RDX/Q/uHf5WzcuQpQFFge218lmX1r5gs+22l 6jQXBJ89nHhWghgiCDcuWj9B/EbdVEvKntftX6/4IMnP1iZZ1La7Ew2I6YuJVJ1W7k B0WZPqxFH1p35ZsK4grRvUF+1Brxj5/Qo/D52pag= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Fabrice Gasnier Subject: [PATCH 5.10 65/80] usb: dwc2: drd: fix soft connect when gadget is unconfigured Date: Mon, 28 Feb 2022 18:24:46 +0100 Message-Id: <20220228172319.625573384@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fabrice Gasnier commit 32fde84362c40961726a5c91f35ad37355ccc0c6 upstream. When the gadget driver hasn't been (yet) configured, and the cable is connected to a HOST, the SFTDISCON gets cleared unconditionally, so the HOST tries to enumerate it. At the host side, this can result in a stuck USB port or worse. When getting lucky, some dmesg can be observed at the host side: new high-speed USB device number ... device descriptor read/64, error -110 Fix it in drd, by checking the enabled flag before calling dwc2_hsotg_core_connect(). It will be called later, once configured, by the normal flow: - udc_bind_to_driver - usb_gadget_connect - dwc2_hsotg_pullup - dwc2_hsotg_core_connect Fixes: 17f934024e84 ("usb: dwc2: override PHY input signals with usb role s= witch support") Cc: stable Signed-off-by: Fabrice Gasnier Link: https://lore.kernel.org/r/1644999135-13478-1-git-send-email-fabrice.g= asnier@foss.st.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/dwc2/core.h | 2 ++ drivers/usb/dwc2/drd.c | 6 ++++-- 2 files changed, 6 insertions(+), 2 deletions(-) --- a/drivers/usb/dwc2/core.h +++ b/drivers/usb/dwc2/core.h @@ -1406,6 +1406,7 @@ void dwc2_hsotg_core_connect(struct dwc2 void dwc2_hsotg_disconnect(struct dwc2_hsotg *dwc2); int dwc2_hsotg_set_test_mode(struct dwc2_hsotg *hsotg, int testmode); #define dwc2_is_device_connected(hsotg) (hsotg->connected) +#define dwc2_is_device_enabled(hsotg) (hsotg->enabled) int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg); int dwc2_restore_device_registers(struct dwc2_hsotg *hsotg, int remote_wak= eup); int dwc2_gadget_enter_hibernation(struct dwc2_hsotg *hsotg); @@ -1434,6 +1435,7 @@ static inline int dwc2_hsotg_set_test_mo int testmode) { return 0; } #define dwc2_is_device_connected(hsotg) (0) +#define dwc2_is_device_enabled(hsotg) (0) static inline int dwc2_backup_device_registers(struct dwc2_hsotg *hsotg) { return 0; } static inline int dwc2_restore_device_registers(struct dwc2_hsotg *hsotg, --- a/drivers/usb/dwc2/drd.c +++ b/drivers/usb/dwc2/drd.c @@ -109,8 +109,10 @@ static int dwc2_drd_role_sw_set(struct u already =3D dwc2_ovr_avalid(hsotg, true); } else if (role =3D=3D USB_ROLE_DEVICE) { already =3D dwc2_ovr_bvalid(hsotg, true); - /* This clear DCTL.SFTDISCON bit */ - dwc2_hsotg_core_connect(hsotg); + if (dwc2_is_device_enabled(hsotg)) { + /* This clear DCTL.SFTDISCON bit */ + dwc2_hsotg_core_connect(hsotg); + } } else { if (dwc2_is_device_mode(hsotg)) { if (!dwc2_ovr_bvalid(hsotg, false)) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0E68FC433EF for ; Mon, 28 Feb 2022 17:45:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238677AbiB1RqP (ORCPT ); Mon, 28 Feb 2022 12:46:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58812 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238819AbiB1RnE (ORCPT ); Mon, 28 Feb 2022 12:43:04 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7358F888C6; Mon, 28 Feb 2022 09:35:15 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 22136B815B8; Mon, 28 Feb 2022 17:35:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 61D85C340E7; Mon, 28 Feb 2022 17:35:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069712; bh=0uozSdYEpm4wPeKQjXI6P7p2CNOcuYuCBw5SCjpmGnI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kh1wzB47HUC8WebH65qHm7Um323sAd4KwztMzHj4lgA7N6nS43iR5Qvc47bFaAqlr j4HS7hpKPevWemQJviaOvNI1NTHAgZCEh2NA5SasPQhEoUmoAR0BOIX344fOu8ms9+ ZpVuqqBttx9BhfXj+hl08glEez4LkjZwzv7tFP3o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hans de Goede Subject: [PATCH 5.10 66/80] usb: dwc3: pci: Fix Bay Trail phy GPIO mappings Date: Mon, 28 Feb 2022 18:24:47 +0100 Message-Id: <20220228172319.741053910@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hans de Goede commit 62e3f0afe246720f7646eb1b034a6897dac34405 upstream. When the Bay Trail phy GPIO mappings where added cs and reset were swapped, this did not cause any issues sofar, because sofar they were always driven high/low at the same time. Note the new mapping has been verified both in /sys/kernel/debug/gpio output on Android factory images on multiple devices, as well as in the schematics for some devices. Fixes: 5741022cbdf3 ("usb: dwc3: pci: Add GPIO lookup table on platforms wi= thout ACPI GPIO resources") Cc: stable Signed-off-by: Hans de Goede Link: https://lore.kernel.org/r/20220213130524.18748-3-hdegoede@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/dwc3/dwc3-pci.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/usb/dwc3/dwc3-pci.c +++ b/drivers/usb/dwc3/dwc3-pci.c @@ -81,8 +81,8 @@ static const struct acpi_gpio_mapping ac static struct gpiod_lookup_table platform_bytcr_gpios =3D { .dev_id =3D "0000:00:16.0", .table =3D { - GPIO_LOOKUP("INT33FC:00", 54, "reset", GPIO_ACTIVE_HIGH), - GPIO_LOOKUP("INT33FC:02", 14, "cs", GPIO_ACTIVE_HIGH), + GPIO_LOOKUP("INT33FC:00", 54, "cs", GPIO_ACTIVE_HIGH), + GPIO_LOOKUP("INT33FC:02", 14, "reset", GPIO_ACTIVE_HIGH), {} }, }; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8B6DC433F5 for ; Mon, 28 Feb 2022 17:48:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238707AbiB1RtX (ORCPT ); Mon, 28 Feb 2022 12:49:23 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238862AbiB1RnT (ORCPT ); Mon, 28 Feb 2022 12:43:19 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 094F19A4E5; Mon, 28 Feb 2022 09:35:16 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1414B61375; Mon, 28 Feb 2022 17:35:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 18F12C340E7; Mon, 28 Feb 2022 17:35:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069715; bh=KpiCJSOCMTZiDWqLlKadY57iMfFkeIoGxU63WBrxqjU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qMWxNYJlj5Z+NOjQ7RPc9XhatS7IzX7Tm5PN8AN12D1rXfIyZIyUEpI8WBpnC+hMA YNZUziD6/sBq0Yeov+1phCtZn9TFRpuRV8DMD5/bbW7tEkfulY3aBAaP82feSWFUTl rS9DOf/jWxmUMn+9WjAj8TwWswg/JEX/9VnijVlw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Marek Szyprowski , Sebastian Andrzej Siewior Subject: [PATCH 5.10 67/80] usb: dwc3: gadget: Let the interrupt handler disable bottom halves. Date: Mon, 28 Feb 2022 18:24:48 +0100 Message-Id: <20220228172319.855409031@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sebastian Andrzej Siewior commit 84918a89d6efaff075de570b55642b6f4ceeac6d upstream. The interrupt service routine registered for the gadget is a primary handler which mask the interrupt source and a threaded handler which handles the source of the interrupt. Since the threaded handler is voluntary threaded, the IRQ-core does not disable bottom halves before invoke the handler like it does for the forced-threaded handler. Due to changes in networking it became visible that a network gadget's completions handler may schedule a softirq which remains unprocessed. The gadget's completion handler is usually invoked either in hard-IRQ or soft-IRQ context. In this context it is enough to just raise the softirq because the softirq itself will be handled once that context is left. In the case of the voluntary threaded handler, there is nothing that will process pending softirqs. Which means it remain queued until another random interrupt (on this CPU) fires and handles it on its exit path or another thread locks and unlocks a lock with the bh suffix. Worst case is that the CPU goes idle and the NOHZ complains about unhandled softirqs. Disable bottom halves before acquiring the lock (and disabling interrupts) and enable them after dropping the lock. This ensures that any pending softirqs will handled right away. Link: https://lkml.kernel.org/r/c2a64979-73d1-2c22-e048-c275c9f81558@samsun= g.com Fixes: e5f68b4a3e7b0 ("Revert "usb: dwc3: gadget: remove unnecessary _irqsa= ve()"") Cc: stable Reported-by: Marek Szyprowski Tested-by: Marek Szyprowski Signed-off-by: Sebastian Andrzej Siewior Link: https://lore.kernel.org/r/Yg/YPejVQH3KkRVd@linutronix.de Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/dwc3/gadget.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/dwc3/gadget.c +++ b/drivers/usb/dwc3/gadget.c @@ -3775,9 +3775,11 @@ static irqreturn_t dwc3_thread_interrupt unsigned long flags; irqreturn_t ret =3D IRQ_NONE; =20 + local_bh_disable(); spin_lock_irqsave(&dwc->lock, flags); ret =3D dwc3_process_event_buf(evt); spin_unlock_irqrestore(&dwc->lock, flags); + local_bh_enable(); =20 return ret; } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8739DC433EF for ; Mon, 28 Feb 2022 17:48:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238893AbiB1Rta (ORCPT ); Mon, 28 Feb 2022 12:49:30 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238915AbiB1Rnb (ORCPT ); Mon, 28 Feb 2022 12:43:31 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 86D4F7DE24; Mon, 28 Feb 2022 09:35:21 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B0767B815A6; Mon, 28 Feb 2022 17:35:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10E5DC340F4; Mon, 28 Feb 2022 17:35:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069718; bh=6ttKOQ9m0Pb17Q3CVH254bmmxO+Df4LgDPnSSCUWaO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uYyMkKsFTd+xcVnVjq3vQpuKdpsYgw9JFUHGEqhNeFtXSwVYdFiCnwJwIDaF1SUzD W9TPWiqIourEJccIc0CugDExkPDwCvH0mGuykWyzRT8PkQD8nWSCDzB2Tu/m7TCXLu Ht3jN/OyKvufJSNlk0pmUawLdn76+CH5H/cZ1t/A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Puma Hsu , Mathias Nyman Subject: [PATCH 5.10 68/80] xhci: re-initialize the HC during resume if HCE was set Date: Mon, 28 Feb 2022 18:24:49 +0100 Message-Id: <20220228172319.973285316@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Puma Hsu commit 8b328f8002bcf29ef517ee4bf234e09aabec4d2e upstream. When HCE(Host Controller Error) is set, it means an internal error condition has been detected. Software needs to re-initialize the HC, so add this check in xhci resume. Cc: stable@vger.kernel.org Signed-off-by: Puma Hsu Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220215123320.1253947-2-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1091,6 +1091,7 @@ int xhci_resume(struct xhci_hcd *xhci, b int retval =3D 0; bool comp_timer_running =3D false; bool pending_portevent =3D false; + bool reinit_xhc =3D false; =20 if (!hcd->state) return 0; @@ -1107,10 +1108,11 @@ int xhci_resume(struct xhci_hcd *xhci, b set_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); =20 spin_lock_irq(&xhci->lock); - if ((xhci->quirks & XHCI_RESET_ON_RESUME) || xhci->broken_suspend) - hibernated =3D true; =20 - if (!hibernated) { + if (hibernated || xhci->quirks & XHCI_RESET_ON_RESUME || xhci->broken_sus= pend) + reinit_xhc =3D true; + + if (!reinit_xhc) { /* * Some controllers might lose power during suspend, so wait * for controller not ready bit to clear, just as in xHC init. @@ -1143,12 +1145,17 @@ int xhci_resume(struct xhci_hcd *xhci, b spin_unlock_irq(&xhci->lock); return -ETIMEDOUT; } - temp =3D readl(&xhci->op_regs->status); } =20 - /* If restore operation fails, re-initialize the HC during resume */ - if ((temp & STS_SRE) || hibernated) { + temp =3D readl(&xhci->op_regs->status); + + /* re-initialize the HC on Restore Error, or Host Controller Error */ + if (temp & (STS_SRE | STS_HCE)) { + reinit_xhc =3D true; + xhci_warn(xhci, "xHC error in resume, USBSTS 0x%x, Reinit\n", temp); + } =20 + if (reinit_xhc) { if ((xhci->quirks & XHCI_COMP_MODE_QUIRK) && !(xhci_all_ports_seen_u0(xhci))) { del_timer_sync(&xhci->comp_mode_recovery_timer); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DEDC8C433FE for ; Mon, 28 Feb 2022 17:45:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238712AbiB1RqU (ORCPT ); Mon, 28 Feb 2022 12:46:20 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238936AbiB1Rnd (ORCPT ); Mon, 28 Feb 2022 12:43:33 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E41399A99B; Mon, 28 Feb 2022 09:35:23 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6681EB815BA; Mon, 28 Feb 2022 17:35:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BBC50C340F1; Mon, 28 Feb 2022 17:35:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069721; bh=/IPjo5Im5eTlmflgA6jvO3M2vFnLOiss2A90CD++VY8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e4Oh6kv0+APDqSjGsLv9WZwKjTZUlDyxC9DPhkctNJPIicWoz1N4GMtmk1zE6yzWM OxAIyaNU/NAoaKLLGgua+Cnz8kFcvb2HYk8v45l/Te5gMcuhcQcOmlHfrv0BqpWzJ9 MPkl0EqNTLnlXwFmCUbCjaddiNEq4M6hJkq+7/1U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hongyu Xie , Mathias Nyman Subject: [PATCH 5.10 69/80] xhci: Prevent futile URB re-submissions due to incorrect return value. Date: Mon, 28 Feb 2022 18:24:50 +0100 Message-Id: <20220228172320.092444120@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hongyu Xie commit 243a1dd7ba48c120986dd9e66fee74bcb7751034 upstream. The -ENODEV return value from xhci_check_args() is incorrectly changed to -EINVAL in a couple places before propagated further. xhci_check_args() returns 4 types of value, -ENODEV, -EINVAL, 1 and 0. xhci_urb_enqueue and xhci_check_streams_endpoint return -EINVAL if the return value of xhci_check_args <=3D 0. This causes problems for example r8152_submit_rx, calling usb_submit_urb in drivers/net/usb/r8152.c. r8152_submit_rx will never get -ENODEV after submiting an urb when xHC is halted because xhci_urb_enqueue returns -EINVAL in the very beginning. [commit message and header edit -Mathias] Fixes: 203a86613fb3 ("xhci: Avoid NULL pointer deref when host dies.") Cc: stable@vger.kernel.org Signed-off-by: Hongyu Xie Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220215123320.1253947-3-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -1487,9 +1487,12 @@ static int xhci_urb_enqueue(struct usb_h struct urb_priv *urb_priv; int num_tds; =20 - if (!urb || xhci_check_args(hcd, urb->dev, urb->ep, - true, true, __func__) <=3D 0) + if (!urb) return -EINVAL; + ret =3D xhci_check_args(hcd, urb->dev, urb->ep, + true, true, __func__); + if (ret <=3D 0) + return ret ? ret : -EINVAL; =20 slot_id =3D urb->dev->slot_id; ep_index =3D xhci_get_endpoint_index(&urb->ep->desc); @@ -3289,7 +3292,7 @@ static int xhci_check_streams_endpoint(s return -EINVAL; ret =3D xhci_check_args(xhci_to_hcd(xhci), udev, ep, 1, true, __func__); if (ret <=3D 0) - return -EINVAL; + return ret ? ret : -EINVAL; if (usb_ss_max_streams(&ep->ss_ep_comp) =3D=3D 0) { xhci_warn(xhci, "WARN: SuperSpeed Endpoint Companion" " descriptor for ep 0x%x does not support streams\n", From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63442C433EF for ; Mon, 28 Feb 2022 17:46:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236582AbiB1Rqg (ORCPT ); Mon, 28 Feb 2022 12:46:36 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238962AbiB1Rnh (ORCPT ); Mon, 28 Feb 2022 12:43:37 -0500 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2EDCB954B2; Mon, 28 Feb 2022 09:35:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 95D3DCE17C5; Mon, 28 Feb 2022 17:35:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 708A1C340E7; Mon, 28 Feb 2022 17:35:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069724; bh=75MWno/6iwHpcgT6nktESUZAi0xeKcfnKzoYK9SOqBE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cCe8JC2ODNt86LPWDueHWVnyGulgUj8rcrEIS+K/VOXXiZ6IxBL1LAK3dzR0WHvMj aGZ4I3FbDsvlMUghZj8Pk00+aVKF4C4uV5n9IORdgNFPyq0sSriQg96rJSzhHkwO+q ZVqbr8lTHeB6brTDElwAkl17geb+B+OBBGD2ksqg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rob Herring , =?UTF-8?q?M=C3=A5rten=20Lindahl?= Subject: [PATCH 5.10 70/80] driver core: Free DMA range map when device is released Date: Mon, 28 Feb 2022 18:24:51 +0100 Message-Id: <20220228172320.196970358@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: M=C3=A5rten Lindahl commit d8f7a5484f2188e9af2d9e4e587587d724501b12 upstream. When unbinding/binding a driver with DMA mapped memory, the DMA map is not freed before the driver is reloaded. This leads to a memory leak when the DMA map is overwritten when reprobing the driver. This can be reproduced with a platform driver having a dma-range: dummy { ... #address-cells =3D <0x2>; #size-cells =3D <0x2>; ranges; dma-ranges =3D <...>; ... }; and then unbinding/binding it: ~# echo soc:dummy >/sys/bus/platform/drivers//unbind DMA map object 0xffffff800b0ae540 still being held by &pdev->dev ~# echo soc:dummy >/sys/bus/platform/drivers//bind ~# echo scan > /sys/kernel/debug/kmemleak ~# cat /sys/kernel/debug/kmemleak unreferenced object 0xffffff800b0ae540 (size 64): comm "sh", pid 833, jiffies 4295174550 (age 2535.352s) hex dump (first 32 bytes): 00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 80 00 00 00 00 00 00 00 80 00 00 00 00 ................ backtrace: [] create_object.isra.0+0x108/0x344 [] kmemleak_alloc+0x8c/0xd0 [] __kmalloc+0x440/0x6f0 [] of_dma_get_range+0x124/0x220 [] of_dma_configure_id+0x40/0x2d0 [] platform_dma_configure+0x5c/0xa4 [] really_probe+0x8c/0x514 [] __driver_probe_device+0x9c/0x19c [] device_driver_attach+0x54/0xbc [] bind_store+0xc4/0x120 [] drv_attr_store+0x30/0x44 [] sysfs_kf_write+0x50/0x60 [] kernfs_fop_write_iter+0x124/0x1b4 [] new_sync_write+0xdc/0x160 [] vfs_write+0x23c/0x2a0 [] ksys_write+0x64/0xec To prevent this we should free the dma_range_map when the device is released. Fixes: e0d072782c73 ("dma-mapping: introduce DMA range map, supplanting dma= _pfn_offset") Cc: stable Suggested-by: Rob Herring Reviewed-by: Rob Herring Signed-off-by: M=C3=A5rten Lindahl Link: https://lore.kernel.org/r/20220216094128.4025861-1-marten.lindahl@axi= s.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/base/dd.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/base/dd.c +++ b/drivers/base/dd.c @@ -592,6 +592,9 @@ re_probe: drv->remove(dev); =20 devres_release_all(dev); + arch_teardown_dma_ops(dev); + kfree(dev->dma_range_map); + dev->dma_range_map =3D NULL; driver_sysfs_remove(dev); dev->driver =3D NULL; dev_set_drvdata(dev, NULL); @@ -1168,6 +1171,8 @@ static void __device_release_driver(stru =20 devres_release_all(dev); arch_teardown_dma_ops(dev); + kfree(dev->dma_range_map); + dev->dma_range_map =3D NULL; dev->driver =3D NULL; dev_set_drvdata(dev, NULL); if (dev->pm_domain && dev->pm_domain->dismiss) From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9036FC433EF for ; Mon, 28 Feb 2022 17:45:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236962AbiB1Rqb (ORCPT ); Mon, 28 Feb 2022 12:46:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33788 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238967AbiB1Rnh (ORCPT ); Mon, 28 Feb 2022 12:43:37 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3D9B954BB; Mon, 28 Feb 2022 09:35:27 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3BD79614B9; Mon, 28 Feb 2022 17:35:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 533A8C340E7; Mon, 28 Feb 2022 17:35:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069726; bh=VmStJ6T+OyAkIxE+FbIqLnB7hnpBeUANqtODQkwTNfE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=h4IPsyVfhut9/scPEEE3HCFAJ2kMU08OcKuqC79Afyo3HqDN/kd/lOZkCIzYflKEj nzzd+eaiqC09/NgfTRQa5anrzgN23RqfTHEHAObYUoOu3EOsgLjx+3IhbS7tKqtgQw Ro3ZwJ7u6XZGM3caL5Mrn5u20FfpQROXGI804Lxc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+c94a3675a626f6333d74@syzkaller.appspotmail.com, Leon Romanovsky , Jason Gunthorpe Subject: [PATCH 5.10 71/80] RDMA/cma: Do not change route.addr.src_addr outside state checks Date: Mon, 28 Feb 2022 18:24:52 +0100 Message-Id: <20220228172320.302966455@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason Gunthorpe commit 22e9f71072fa605cbf033158db58e0790101928d upstream. If the state is not idle then resolve_prepare_src() should immediately fail and no change to global state should happen. However, it unconditionally overwrites the src_addr trying to build a temporary any address. For instance if the state is already RDMA_CM_LISTEN then this will corrupt the src_addr and would cause the test in cma_cancel_operation(): if (cma_any_addr(cma_src_addr(id_priv)) && !id_priv->cma_dev) Which would manifest as this trace from syzkaller: BUG: KASAN: use-after-free in __list_add_valid+0x93/0xa0 lib/list_debug.c= :26 Read of size 8 at addr ffff8881546491e0 by task syz-executor.1/32204 CPU: 1 PID: 32204 Comm: syz-executor.1 Not tainted 5.12.0-rc8-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS G= oogle 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x141/0x1d7 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:= 232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416 __list_add_valid+0x93/0xa0 lib/list_debug.c:26 __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] cma_listen_on_all drivers/infiniband/core/cma.c:2557 [inline] rdma_listen+0x787/0xe00 drivers/infiniband/core/cma.c:3751 ucma_listen+0x16a/0x210 drivers/infiniband/core/ucma.c:1102 ucma_write+0x259/0x350 drivers/infiniband/core/ucma.c:1732 vfs_write+0x28e/0xa30 fs/read_write.c:603 ksys_write+0x1ee/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xae This is indicating that an rdma_id_private was destroyed without doing cma_cancel_listens(). Instead of trying to re-use the src_addr memory to indirectly create an any address derived from the dst build one explicitly on the stack and bind to that as any other normal flow would do. rdma_bind_addr() will copy it over the src_addr once it knows the state is valid. This is similar to commit bc0bdc5afaa7 ("RDMA/cma: Do not change route.addr.src_addr.ss_family") Link: https://lore.kernel.org/r/0-v2-e975c8fd9ef2+11e-syz_cma_srcaddr_jgg@n= vidia.com Cc: stable@vger.kernel.org Fixes: 732d41c545bb ("RDMA/cma: Make the locking for automatic state transi= tion more clear") Reported-by: syzbot+c94a3675a626f6333d74@syzkaller.appspotmail.com Reviewed-by: Leon Romanovsky Signed-off-by: Jason Gunthorpe Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/infiniband/core/cma.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-) --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -3321,22 +3321,30 @@ err: static int cma_bind_addr(struct rdma_cm_id *id, struct sockaddr *src_addr, const struct sockaddr *dst_addr) { - if (!src_addr || !src_addr->sa_family) { - src_addr =3D (struct sockaddr *) &id->route.addr.src_addr; - src_addr->sa_family =3D dst_addr->sa_family; - if (IS_ENABLED(CONFIG_IPV6) && - dst_addr->sa_family =3D=3D AF_INET6) { - struct sockaddr_in6 *src_addr6 =3D (struct sockaddr_in6 *) src_addr; - struct sockaddr_in6 *dst_addr6 =3D (struct sockaddr_in6 *) dst_addr; - src_addr6->sin6_scope_id =3D dst_addr6->sin6_scope_id; - if (ipv6_addr_type(&dst_addr6->sin6_addr) & IPV6_ADDR_LINKLOCAL) - id->route.addr.dev_addr.bound_dev_if =3D dst_addr6->sin6_scope_id; - } else if (dst_addr->sa_family =3D=3D AF_IB) { - ((struct sockaddr_ib *) src_addr)->sib_pkey =3D - ((struct sockaddr_ib *) dst_addr)->sib_pkey; - } + struct sockaddr_storage zero_sock =3D {}; + + if (src_addr && src_addr->sa_family) + return rdma_bind_addr(id, src_addr); + + /* + * When the src_addr is not specified, automatically supply an any addr + */ + zero_sock.ss_family =3D dst_addr->sa_family; + if (IS_ENABLED(CONFIG_IPV6) && dst_addr->sa_family =3D=3D AF_INET6) { + struct sockaddr_in6 *src_addr6 =3D + (struct sockaddr_in6 *)&zero_sock; + struct sockaddr_in6 *dst_addr6 =3D + (struct sockaddr_in6 *)dst_addr; + + src_addr6->sin6_scope_id =3D dst_addr6->sin6_scope_id; + if (ipv6_addr_type(&dst_addr6->sin6_addr) & IPV6_ADDR_LINKLOCAL) + id->route.addr.dev_addr.bound_dev_if =3D + dst_addr6->sin6_scope_id; + } else if (dst_addr->sa_family =3D=3D AF_IB) { + ((struct sockaddr_ib *)&zero_sock)->sib_pkey =3D + ((struct sockaddr_ib *)dst_addr)->sib_pkey; } - return rdma_bind_addr(id, src_addr); + return rdma_bind_addr(id, (struct sockaddr *)&zero_sock); } =20 /* From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7857AC433FE for ; Mon, 28 Feb 2022 17:46:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236852AbiB1Rqk (ORCPT ); Mon, 28 Feb 2022 12:46:40 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33388 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239007AbiB1Rnj (ORCPT ); Mon, 28 Feb 2022 12:43:39 -0500 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1657895A0A; Mon, 28 Feb 2022 09:35:31 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AADFAB815B3; Mon, 28 Feb 2022 17:35:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D4DAC340E7; Mon, 28 Feb 2022 17:35:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069729; bh=wULsamJpKaffE3j7FpnLDFPH68dEIsas4l0dRXZQw+g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nanz34UF0btiFG+abNGD4poW9Arbi1ZBAAzbEOzSy4UO2utkKjdCM4aIdawWYv6AT scv7lKSjJGLdUQTtUOX9Q+kLNzbhKJbZL9VBhY51BqIZXZBzujouGQmvNv1oy6WnCG CFMff9RDlhXhtZMwpUXawvzzyqxrPk58+69yVp6M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuansheng Liu , "Rafael J. Wysocki" Subject: [PATCH 5.10 72/80] thermal: int340x: fix memory leak in int3400_notify() Date: Mon, 28 Feb 2022 18:24:53 +0100 Message-Id: <20220228172320.417862377@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuansheng Liu commit 3abea10e6a8f0e7804ed4c124bea2d15aca977c8 upstream. It is easy to hit the below memory leaks in my TigerLake platform: unreferenced object 0xffff927c8b91dbc0 (size 32): comm "kworker/0:2", pid 112, jiffies 4294893323 (age 83.604s) hex dump (first 32 bytes): 4e 41 4d 45 3d 49 4e 54 33 34 30 30 20 54 68 65 NAME=3DINT3400 The 72 6d 61 6c 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 rmal.kkkkkkkkkk. backtrace: [] __kmalloc_track_caller+0x2fe/0x4a0 [] kvasprintf+0x65/0xd0 [] kasprintf+0x4e/0x70 [] int3400_notify+0x82/0x120 [int3400_thermal] [] acpi_ev_notify_dispatch+0x54/0x71 [] acpi_os_execute_deferred+0x17/0x30 [] process_one_work+0x21a/0x3f0 [] worker_thread+0x4a/0x3b0 [] kthread+0xfd/0x130 [] ret_from_fork+0x1f/0x30 Fix it by calling kfree() accordingly. Fixes: 38e44da59130 ("thermal: int3400_thermal: process "thermal table chan= ged" event") Signed-off-by: Chuansheng Liu Cc: 4.14+ # 4.14+ Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c @@ -402,6 +402,10 @@ static void int3400_notify(acpi_handle h thermal_prop[3] =3D kasprintf(GFP_KERNEL, "EVENT=3D%d", therm_event); thermal_prop[4] =3D NULL; kobject_uevent_env(&priv->thermal->device.kobj, KOBJ_CHANGE, thermal_prop= ); + kfree(thermal_prop[0]); + kfree(thermal_prop[1]); + kfree(thermal_prop[2]); + kfree(thermal_prop[3]); } =20 static int int3400_thermal_get_temp(struct thermal_zone_device *thermal, From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD629C433F5 for ; Mon, 28 Feb 2022 17:48:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238898AbiB1Rte (ORCPT ); Mon, 28 Feb 2022 12:49:34 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239031AbiB1Rnk (ORCPT ); Mon, 28 Feb 2022 12:43:40 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1201B9AD8E; Mon, 28 Feb 2022 09:35:33 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A0C3961359; Mon, 28 Feb 2022 17:35:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B62F2C340E7; Mon, 28 Feb 2022 17:35:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069732; bh=gr45w1REbf3yzOWTxHlcU8BXdSX+zSG8eQlbz3GOI5Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xKfBNajcsa/MXqWrSroeBYytAYSRNEjEqd94KtVS7TCeGgjw4NdltEM4WuuBtB9D1 7vHVfXwmLmDVD2Gsy8eblF2r5CMskXwYyquEeYe6mGvZnVAZdSEBUWhyZN2jVdI2iI +p0hGCkYcdi2ytuFxnMZNORM40dWIm0Ht/8oUxkQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Changbin Du , Palmer Dabbelt Subject: [PATCH 5.10 73/80] riscv: fix oops caused by irqsoff latency tracer Date: Mon, 28 Feb 2022 18:24:54 +0100 Message-Id: <20220228172320.535642879@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Changbin Du commit 22e2100b1b07d6f5acc71cc1acb53f680c677d77 upstream. The trace_hardirqs_{on,off}() require the caller to setup frame pointer properly. This because these two functions use macro 'CALLER_ADDR1' (aka. __builtin_return_address(1)) to acquire caller info. If the $fp is used for other purpose, the code generated this macro (as below) could trigger memory access fault. 0xffffffff8011510e <+80>: ld a1,-16(s0) 0xffffffff80115112 <+84>: ld s2,-8(a1) # <-- paging fault here The oops message during booting if compiled with 'irqoff' tracer enabled: [ 0.039615][ T0] Unable to handle kernel NULL pointer dereference at = virtual address 00000000000000f8 [ 0.041925][ T0] Oops [#1] [ 0.042063][ T0] Modules linked in: [ 0.042864][ T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.17.0-rc1= -00233-g9a20c48d1ed2 #29 [ 0.043568][ T0] Hardware name: riscv-virtio,qemu (DT) [ 0.044343][ T0] epc : trace_hardirqs_on+0x56/0xe2 [ 0.044601][ T0] ra : restore_all+0x12/0x6e [ 0.044721][ T0] epc : ffffffff80126a5c ra : ffffffff80003b94 sp : ff= ffffff81403db0 [ 0.044801][ T0] gp : ffffffff8163acd8 tp : ffffffff81414880 t0 : 00= 00000000000020 [ 0.044882][ T0] t1 : 0098968000000000 t2 : 0000000000000000 s0 : ff= ffffff81403de0 [ 0.044967][ T0] s1 : 0000000000000000 a0 : 0000000000000001 a1 : 00= 00000000000100 [ 0.045046][ T0] a2 : 0000000000000000 a3 : 0000000000000000 a4 : 00= 00000000000000 [ 0.045124][ T0] a5 : 0000000000000000 a6 : 0000000000000000 a7 : 00= 00000054494d45 [ 0.045210][ T0] s2 : ffffffff80003b94 s3 : ffffffff81a8f1b0 s4 : ff= ffffff80e27b50 [ 0.045289][ T0] s5 : ffffffff81414880 s6 : ffffffff8160fa00 s7 : 00= 000000800120e8 [ 0.045389][ T0] s8 : 0000000080013100 s9 : 000000000000007f s10: 00= 00000000000000 [ 0.045474][ T0] s11: 0000000000000000 t3 : 7fffffffffffffff t4 : 00= 00000000000000 [ 0.045548][ T0] t5 : 0000000000000000 t6 : ffffffff814aa368 [ 0.045620][ T0] status: 0000000200000100 badaddr: 00000000000000f8 c= ause: 000000000000000d [ 0.046402][ T0] [] restore_all+0x12/0x6e This because the $fp(aka. $s0) register is not used as frame pointer in the assembly entry code. resume_kernel: REG_L s0, TASK_TI_PREEMPT_COUNT(tp) bnez s0, restore_all REG_L s0, TASK_TI_FLAGS(tp) andi s0, s0, _TIF_NEED_RESCHED beqz s0, restore_all call preempt_schedule_irq j restore_all To fix above issue, here we add one extra level wrapper for function trace_hardirqs_{on,off}() so they can be safely called by low level entry code. Signed-off-by: Changbin Du Fixes: 3c4697982982 ("riscv: Enable LOCKDEP_SUPPORT & fixup TRACE_IRQFLAGS_= SUPPORT") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/riscv/kernel/Makefile | 2 ++ arch/riscv/kernel/entry.S | 10 +++++----- arch/riscv/kernel/trace_irq.c | 27 +++++++++++++++++++++++++++ arch/riscv/kernel/trace_irq.h | 11 +++++++++++ 4 files changed, 45 insertions(+), 5 deletions(-) create mode 100644 arch/riscv/kernel/trace_irq.c create mode 100644 arch/riscv/kernel/trace_irq.h --- a/arch/riscv/kernel/Makefile +++ b/arch/riscv/kernel/Makefile @@ -44,6 +44,8 @@ obj-$(CONFIG_MODULE_SECTIONS) +=3D module- obj-$(CONFIG_FUNCTION_TRACER) +=3D mcount.o ftrace.o obj-$(CONFIG_DYNAMIC_FTRACE) +=3D mcount-dyn.o =20 +obj-$(CONFIG_TRACE_IRQFLAGS) +=3D trace_irq.o + obj-$(CONFIG_RISCV_BASE_PMU) +=3D perf_event.o obj-$(CONFIG_PERF_EVENTS) +=3D perf_callchain.o obj-$(CONFIG_HAVE_PERF_REGS) +=3D perf_regs.o --- a/arch/riscv/kernel/entry.S +++ b/arch/riscv/kernel/entry.S @@ -98,7 +98,7 @@ _save_context: .option pop =20 #ifdef CONFIG_TRACE_IRQFLAGS - call trace_hardirqs_off + call __trace_hardirqs_off #endif =20 #ifdef CONFIG_CONTEXT_TRACKING @@ -131,7 +131,7 @@ skip_context_tracking: andi t0, s1, SR_PIE beqz t0, 1f #ifdef CONFIG_TRACE_IRQFLAGS - call trace_hardirqs_on + call __trace_hardirqs_on #endif csrs CSR_STATUS, SR_IE =20 @@ -222,7 +222,7 @@ ret_from_exception: REG_L s0, PT_STATUS(sp) csrc CSR_STATUS, SR_IE #ifdef CONFIG_TRACE_IRQFLAGS - call trace_hardirqs_off + call __trace_hardirqs_off #endif #ifdef CONFIG_RISCV_M_MODE /* the MPP value is too large to be used as an immediate arg for addi */ @@ -258,10 +258,10 @@ restore_all: REG_L s1, PT_STATUS(sp) andi t0, s1, SR_PIE beqz t0, 1f - call trace_hardirqs_on + call __trace_hardirqs_on j 2f 1: - call trace_hardirqs_off + call __trace_hardirqs_off 2: #endif REG_L a0, PT_STATUS(sp) --- /dev/null +++ b/arch/riscv/kernel/trace_irq.c @@ -0,0 +1,27 @@ +// SPDX-License-Identifier: GPL-2.0 +/* + * Copyright (C) 2022 Changbin Du + */ + +#include +#include +#include "trace_irq.h" + +/* + * trace_hardirqs_on/off require the caller to setup frame pointer properl= y. + * Otherwise, CALLER_ADDR1 might trigger an pagging exception in kernel. + * Here we add one extra level so they can be safely called by low + * level entry code which $fp is used for other purpose. + */ + +void __trace_hardirqs_on(void) +{ + trace_hardirqs_on(); +} +NOKPROBE_SYMBOL(__trace_hardirqs_on); + +void __trace_hardirqs_off(void) +{ + trace_hardirqs_off(); +} +NOKPROBE_SYMBOL(__trace_hardirqs_off); --- /dev/null +++ b/arch/riscv/kernel/trace_irq.h @@ -0,0 +1,11 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Copyright (C) 2022 Changbin Du + */ +#ifndef __TRACE_IRQ_H +#define __TRACE_IRQ_H + +void __trace_hardirqs_on(void); +void __trace_hardirqs_off(void); + +#endif /* __TRACE_IRQ_H */ From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C54EC433F5 for ; Mon, 28 Feb 2022 17:49:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238718AbiB1Rtz (ORCPT ); Mon, 28 Feb 2022 12:49:55 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239073AbiB1Rnm (ORCPT ); Mon, 28 Feb 2022 12:43:42 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C6B629AE62; Mon, 28 Feb 2022 09:35:35 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 58852614B9; Mon, 28 Feb 2022 17:35:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E3AFC340E7; Mon, 28 Feb 2022 17:35:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069734; bh=v5QaB1hFhjLaOCClqrmwreuVmYnWVQQ3HcouUHL0f/E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=QR4Uv8UgwKGBO4Xwy6U4hUW4SO4zZFgmG3ngkAYtUdW9u3qpmSlvQT4YJZd+ko8BE v32CIfPOxYW9PO9v6c+05JoBSl3jgzT5XOs5FX4rGBGRH5vLQkTVjoQgsBk1Gi5k/p bbQCaocqa0fI3cmeqMeuwlPleWNxEpY4ntlKqcTk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 5.10 74/80] tty: n_gsm: fix encoding of control signal octet bit DV Date: Mon, 28 Feb 2022 18:24:55 +0100 Message-Id: <20220228172320.674874690@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: daniel.starke@siemens.com commit 737b0ef3be6b319d6c1fd64193d1603311969326 upstream. n_gsm is based on the 3GPP 07.010 and its newer version is the 3GPP 27.010. See https://portal.3gpp.org/desktopmodules/Specifications/SpecificationDeta= ils.aspx?specificationId=3D1516 The changes from 07.010 to 27.010 are non-functional. Therefore, I refer to the newer 27.010 here. Chapter 5.4.6.3.7 describes the encoding of the control signal octet used by the MSC (modem status command). The same encoding is also used in convergence layer type 2 as described in chapter 5.5.2. Table 7 and 24 both require the DV (data valid) bit to be set 1 for outgoing control signal octets sent by the DTE (data terminal equipment), i.e. for the initiator side. Currently, the DV bit is only set if CD (carrier detect) is on, regardless of the side. This patch fixes this behavior by setting the DV bit on the initiator side unconditionally. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220218073123.2121-1-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -434,7 +434,7 @@ static u8 gsm_encode_modem(const struct modembits |=3D MDM_RTR; if (dlci->modem_tx & TIOCM_RI) modembits |=3D MDM_IC; - if (dlci->modem_tx & TIOCM_CD) + if (dlci->modem_tx & TIOCM_CD || dlci->gsm->initiator) modembits |=3D MDM_DV; return modembits; } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8DDA7C433EF for ; Mon, 28 Feb 2022 17:49:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238755AbiB1Rtl (ORCPT ); Mon, 28 Feb 2022 12:49:41 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33890 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239095AbiB1Rnn (ORCPT ); Mon, 28 Feb 2022 12:43:43 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A59279BAE7; Mon, 28 Feb 2022 09:35:41 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D5888614C9; Mon, 28 Feb 2022 17:35:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E8349C340E7; Mon, 28 Feb 2022 17:35:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069740; bh=ZiqWtC7lTeskoDYpo8BmFDZ0NEqc4zUEXVUcbwg7D5w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sHOlbHomJvs22oxNK0fWL0TQe0RifXHnF+YJ4nYpVars/UIxdxYB8f2mJVMWRgISC 8pn//+AM1Zz6Y72Lw4NczWMyMBRYia3iPCHQHsXl36+Nr007qH3VIC3GtCQ4mtdx3s snzBbqi1iU9wf0UN1RzuIfG09To6gDZBleq50OM8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 5.10 75/80] tty: n_gsm: fix proper link termination after failed open Date: Mon, 28 Feb 2022 18:24:56 +0100 Message-Id: <20220228172320.800541582@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: daniel.starke@siemens.com commit e3b7468f082d106459e86e8dc6fb9bdd65553433 upstream. Trying to open a DLCI by sending a SABM frame may fail with a timeout. The link is closed on the initiator side without informing the responder about this event. The responder assumes the link is open after sending a UA frame to answer the SABM frame. The link gets stuck in a half open state. This patch fixes this by initiating the proper link termination procedure after link setup timeout instead of silently closing it down. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220218073123.2121-3-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1485,7 +1485,7 @@ static void gsm_dlci_t1(struct timer_lis dlci->mode =3D DLCI_MODE_ADM; gsm_dlci_open(dlci); } else { - gsm_dlci_close(dlci); + gsm_dlci_begin_close(dlci); /* prevent half open link */ } =20 break; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A83F3C433F5 for ; Mon, 28 Feb 2022 17:46:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238572AbiB1Rqn (ORCPT ); Mon, 28 Feb 2022 12:46:43 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33492 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239120AbiB1Rnp (ORCPT ); Mon, 28 Feb 2022 12:43:45 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1171C9BAF3; Mon, 28 Feb 2022 09:35:44 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 99619614CD; Mon, 28 Feb 2022 17:35:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A5210C340E7; Mon, 28 Feb 2022 17:35:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069743; bh=W+oyjTCIxWodUCtLNaLKp1/WhBPmLkZ4yWLomJTkxbk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U1MoFrqmeI/sVDkE2Cl0IFXtRVc/xhO2+qzILeg4n6QTGuxNKlS8y7sKeLSe58QEN njAGe1Rv3UkrRhtnvAfxOeM8eSZOPFs9Umhtmu53pTY9XzwlAuTW2xlconsjBwBxFV yaAWrY7QRKCYVI9ONcsA6qTxJG5U4hvm4h3f4270= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 5.10 76/80] tty: n_gsm: fix NULL pointer access due to DLCI release Date: Mon, 28 Feb 2022 18:24:57 +0100 Message-Id: <20220228172320.940705546@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: daniel.starke@siemens.com commit 96b169f05cdcc844b400695184d77e42071d14f2 upstream. The here fixed commit made the tty hangup asynchronous to avoid a circular locking warning. I could not reproduce this warning. Furthermore, due to the asynchronous hangup the function call now gets queued up while the underlying tty is being freed. Depending on the timing this results in a NULL pointer access in the global work queue scheduler. To be precise in process_one_work(). Therefore, the previous commit made the issue worse which it tried to fix. This patch fixes this by falling back to the old behavior which uses a blocking tty hangup call before freeing up the associated tty. Fixes: 7030082a7415 ("tty: n_gsm: avoid recursive locking with async port h= angup") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220218073123.2121-4-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1719,7 +1719,12 @@ static void gsm_dlci_release(struct gsm_ gsm_destroy_network(dlci); mutex_unlock(&dlci->mutex); =20 - tty_hangup(tty); + /* We cannot use tty_hangup() because in tty_kref_put() the tty + * driver assumes that the hangup queue is free and reuses it to + * queue release_one_tty() -> NULL pointer panic in + * process_one_work(). + */ + tty_vhangup(tty); =20 tty_port_tty_set(&dlci->port, NULL); tty_kref_put(tty); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EEDA0C433EF for ; Mon, 28 Feb 2022 17:49:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238555AbiB1RuD (ORCPT ); Mon, 28 Feb 2022 12:50:03 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33532 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239131AbiB1Rnq (ORCPT ); Mon, 28 Feb 2022 12:43:46 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4373A888EC; Mon, 28 Feb 2022 09:35:46 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4E2FD614D7; Mon, 28 Feb 2022 17:35:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 67F7EC340E7; Mon, 28 Feb 2022 17:35:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069745; bh=gX/p0ceuW7Kpbk3evbg7OliBpZrysDMIj4z/kSgC/w4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qembD20uqNcd+0zmpgQk1gJUU4fPxOyYSgr8gtwhxqHDt19Rn753ZrWarLviyVaNe OmKCleH0mZJVc78fVF3cXzONqtN5rC3WqG+fVIPBV23ICKp0Ci8H0h4zOqXvxbYghe zsav8l0+V+ME6Hq0JO3yA9b7/H7SHsspZjHVy0LQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 5.10 77/80] tty: n_gsm: fix wrong tty control line for flow control Date: Mon, 28 Feb 2022 18:24:58 +0100 Message-Id: <20220228172321.078445700@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: daniel.starke@siemens.com commit c19d93542a6081577e6da9bf5e887979c72e80c1 upstream. tty flow control is handled via gsmtty_throttle() and gsmtty_unthrottle(). Both functions propagate the outgoing hardware flow control state to the remote side via MSC (modem status command) frames. The local state is taken from the RTS (ready to send) flag of the tty. However, RTS gets mapped to DTR (data terminal ready), which is wrong. This patch corrects this by mapping RTS to RTS. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220218073123.2121-5-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -3178,9 +3178,9 @@ static void gsmtty_throttle(struct tty_s if (dlci->state =3D=3D DLCI_CLOSED) return; if (C_CRTSCTS(tty)) - dlci->modem_tx &=3D ~TIOCM_DTR; + dlci->modem_tx &=3D ~TIOCM_RTS; dlci->throttled =3D true; - /* Send an MSC with DTR cleared */ + /* Send an MSC with RTS cleared */ gsmtty_modem_update(dlci, 0); } =20 @@ -3190,9 +3190,9 @@ static void gsmtty_unthrottle(struct tty if (dlci->state =3D=3D DLCI_CLOSED) return; if (C_CRTSCTS(tty)) - dlci->modem_tx |=3D TIOCM_DTR; + dlci->modem_tx |=3D TIOCM_RTS; dlci->throttled =3D false; - /* Send an MSC with DTR set */ + /* Send an MSC with RTS set */ gsmtty_modem_update(dlci, 0); } From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0844AC433EF for ; Mon, 28 Feb 2022 17:46:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238747AbiB1RrO (ORCPT ); Mon, 28 Feb 2022 12:47:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58814 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239161AbiB1Rnr (ORCPT ); Mon, 28 Feb 2022 12:43:47 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4601A88B0D; Mon, 28 Feb 2022 09:35:49 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 10BE3614B9; Mon, 28 Feb 2022 17:35:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21505C340E7; Mon, 28 Feb 2022 17:35:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069748; bh=Aj8Bvvtsr7L/vKmvvYvbff75UEWBXBwwcFdt35525dQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qv+Sq8kMAiEU2iW9NPCILsIAnggvXgy4Cr/xgdsN0S31HiH7odbt1kj6uCJ9+QqfW OwxZ9CybhMHwmh8XlMP7LCUKlxaq3zb+5tMWAAX0D67ZpErrqOI1QY0gwrscQ6v2hw nxpoUI9/NrV2+5tjyG/nWoNM256vDASToCbGzmPE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Starke Subject: [PATCH 5.10 78/80] tty: n_gsm: fix deadlock in gsmtty_open() Date: Mon, 28 Feb 2022 18:24:59 +0100 Message-Id: <20220228172321.207530421@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: daniel.starke@siemens.com commit a2ab75b8e76e455af7867e3835fd9cdf386b508f upstream. In the current implementation the user may open a virtual tty which then could fail to establish the underlying DLCI. The function gsmtty_open() gets stuck in tty_port_block_til_ready() while waiting for a carrier rise. This happens if the remote side fails to acknowledge the link establishment request in time or completely. At some point gsm_dlci_close() is called to abort the link establishment attempt. The function tries to inform the associated virtual tty by performing a hangup. But the blocking loop within tty_port_block_til_ready() is not informed about this event. The patch proposed here fixes this by resetting the initialization state of the virtual tty to ensure the loop exits and triggering it to make tty_port_block_til_ready() return. Fixes: e1eaea46bb40 ("tty: n_gsm line discipline") Cc: stable@vger.kernel.org Signed-off-by: Daniel Starke Link: https://lore.kernel.org/r/20220218073123.2121-7-daniel.starke@siemens= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -1426,6 +1426,9 @@ static void gsm_dlci_close(struct gsm_dl if (dlci->addr !=3D 0) { tty_port_tty_hangup(&dlci->port, false); kfifo_reset(&dlci->fifo); + /* Ensure that gsmtty_open() can return. */ + tty_port_set_initialized(&dlci->port, 0); + wake_up_interruptible(&dlci->port.open_wait); } else dlci->gsm->dead =3D true; wake_up(&dlci->gsm->event); From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CF6DC433F5 for ; Mon, 28 Feb 2022 17:46:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233953AbiB1RrL (ORCPT ); Mon, 28 Feb 2022 12:47:11 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239174AbiB1Rns (ORCPT ); Mon, 28 Feb 2022 12:43:48 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E803288B39; Mon, 28 Feb 2022 09:35:51 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C8AF7614AC; Mon, 28 Feb 2022 17:35:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D422FC340F0; Mon, 28 Feb 2022 17:35:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069751; bh=OW5+OUNm89gARk4f1MrpkJRAi39Z9FkxXGUPPWLts+E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cMivaxcq4vgGNiOPBA5tlidcqkypZJy+Quwejc01uoKYxsw4l7tahpsJIzFI+WAs2 b2SgZjQOKZnN1K14KZKpwSPkV8Ox/cUQXED08q9iHq5nc9cMV7y2mrAhplsdZPLacC 26XzMJ8Sw/Q5F+FHpVEcxtY8tBmBLcXgBCJ2dWRo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Thierry Reding , Linus Walleij , Bartosz Golaszewski Subject: [PATCH 5.10 79/80] gpio: tegra186: Fix chip_data type confusion Date: Mon, 28 Feb 2022 18:25:00 +0100 Message-Id: <20220228172321.327400372@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marc Zyngier commit d1e972ace42390de739cde87d96043dcbe502286 upstream. The tegra186 GPIO driver makes the assumption that the pointer returned by irq_data_get_irq_chip_data() is a pointer to a tegra_gpio structure. Unfortunately, it is actually a pointer to the inner gpio_chip structure, as mandated by the gpiolib infrastructure. Nice try. The saving grace is that the gpio_chip is the first member of tegra_gpio, so the bug has gone undetected since... forever. Fix it by performing a container_of() on the pointer. This results in no additional code, and makes it possible to understand how the whole thing works. Fixes: 5b2b135a87fc ("gpio: Add Tegra186 support") Signed-off-by: Marc Zyngier Cc: Thierry Reding Cc: Linus Walleij Cc: Bartosz Golaszewski Link: https://lore.kernel.org/r/20220211093904.1112679-1-maz@kernel.org Signed-off-by: Linus Walleij Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpio/gpio-tegra186.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) --- a/drivers/gpio/gpio-tegra186.c +++ b/drivers/gpio/gpio-tegra186.c @@ -337,9 +337,12 @@ static int tegra186_gpio_of_xlate(struct return offset + pin; } =20 +#define to_tegra_gpio(x) container_of((x), struct tegra_gpio, gpio) + static void tegra186_irq_ack(struct irq_data *data) { - struct tegra_gpio *gpio =3D irq_data_get_irq_chip_data(data); + struct gpio_chip *gc =3D irq_data_get_irq_chip_data(data); + struct tegra_gpio *gpio =3D to_tegra_gpio(gc); void __iomem *base; =20 base =3D tegra186_gpio_get_base(gpio, data->hwirq); @@ -351,7 +354,8 @@ static void tegra186_irq_ack(struct irq_ =20 static void tegra186_irq_mask(struct irq_data *data) { - struct tegra_gpio *gpio =3D irq_data_get_irq_chip_data(data); + struct gpio_chip *gc =3D irq_data_get_irq_chip_data(data); + struct tegra_gpio *gpio =3D to_tegra_gpio(gc); void __iomem *base; u32 value; =20 @@ -366,7 +370,8 @@ static void tegra186_irq_mask(struct irq =20 static void tegra186_irq_unmask(struct irq_data *data) { - struct tegra_gpio *gpio =3D irq_data_get_irq_chip_data(data); + struct gpio_chip *gc =3D irq_data_get_irq_chip_data(data); + struct tegra_gpio *gpio =3D to_tegra_gpio(gc); void __iomem *base; u32 value; =20 @@ -381,7 +386,8 @@ static void tegra186_irq_unmask(struct i =20 static int tegra186_irq_set_type(struct irq_data *data, unsigned int type) { - struct tegra_gpio *gpio =3D irq_data_get_irq_chip_data(data); + struct gpio_chip *gc =3D irq_data_get_irq_chip_data(data); + struct tegra_gpio *gpio =3D to_tegra_gpio(gc); void __iomem *base; u32 value; From nobody Tue Jun 23 18:14:07 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7EA7FC433F5 for ; Mon, 28 Feb 2022 17:46:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231990AbiB1Rqx (ORCPT ); Mon, 28 Feb 2022 12:46:53 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58716 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239220AbiB1Rnv (ORCPT ); Mon, 28 Feb 2022 12:43:51 -0500 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 661A59BBA1; Mon, 28 Feb 2022 09:35:57 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id B1EBACE17AC; Mon, 28 Feb 2022 17:35:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D7D76C340E7; Mon, 28 Feb 2022 17:35:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1646069754; bh=HPk5hm2HB6OtjumJUjenYe8eRWx4uz9qEzBAfyzBkdo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MS9STqSTbPyOulapWIdVlxH1wt/o35oS5FXvzT8aYlossjfQ0zovlA1jcKh92BZKF hIya1MWY3Gz8/yAZ8WqpAGGIuxGV7ZZgQl/GJgKtdqu3UhoVfN/z9gXocCl+YPShuC aS9JamZ1B3bGDHAjKYWEOYyZHzvzELl6bH+Eq8xw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaohe Lin , Mike Rapoport Subject: [PATCH 5.10 80/80] memblock: use kfree() to release kmalloced memblock regions Date: Mon, 28 Feb 2022 18:25:01 +0100 Message-Id: <20220228172321.477435372@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220228172311.789892158@linuxfoundation.org> References: <20220228172311.789892158@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaohe Lin commit c94afc46cae7ad41b2ad6a99368147879f4b0e56 upstream. memblock.{reserved,memory}.regions may be allocated using kmalloc() in memblock_double_array(). Use kfree() to release these kmalloced regions indicated by memblock_{reserved,memory}_in_slab. Signed-off-by: Miaohe Lin Fixes: 3010f876500f ("mm: discard memblock data later") Signed-off-by: Mike Rapoport Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/memblock.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/mm/memblock.c +++ b/mm/memblock.c @@ -366,14 +366,20 @@ void __init memblock_discard(void) addr =3D __pa(memblock.reserved.regions); size =3D PAGE_ALIGN(sizeof(struct memblock_region) * memblock.reserved.max); - __memblock_free_late(addr, size); + if (memblock_reserved_in_slab) + kfree(memblock.reserved.regions); + else + __memblock_free_late(addr, size); } =20 if (memblock.memory.regions !=3D memblock_memory_init_regions) { addr =3D __pa(memblock.memory.regions); size =3D PAGE_ALIGN(sizeof(struct memblock_region) * memblock.memory.max); - __memblock_free_late(addr, size); + if (memblock_memory_in_slab) + kfree(memblock.memory.regions); + else + __memblock_free_late(addr, size); } =20 memblock_memory =3D NULL;