From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 229D0C433EF for ; Tue, 5 Apr 2022 21:53:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1388665AbiDEVz1 (ORCPT ); Tue, 5 Apr 2022 17:55:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354484AbiDEKOU (ORCPT ); Tue, 5 Apr 2022 06:14:20 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6DF1E6B0A7; Tue, 5 Apr 2022 03:00:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 17E4BB818F6; Tue, 5 Apr 2022 10:00:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E266C385A4; Tue, 5 Apr 2022 10:00:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152841; bh=JN2voQsLKDeHnUXro35ETN8vtOXGbkiSccgrfzDI294=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z2dh5Dp5nGM8FMgGiKV7gVpWV+7MI1NrP/pEF6v3CcupBwZ7FPp81xaBxbHnth2sb BFe5K2l4rQ0oQClHaBgZ0aUn4+wJ+TrsrVWKLiWyZSvLGDwUJN4VykBcl7ISE27VDE bhjkYKds6RWxvJzhcIYYz1OHSPrRFUnanU7bTAHQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Halil Pasic , Christoph Hellwig Subject: [PATCH 5.10 001/599] swiotlb: fix info leak with DMA_FROM_DEVICE Date: Tue, 5 Apr 2022 09:24:55 +0200 Message-Id: <20220405070258.852892159@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Halil Pasic commit ddbd89deb7d32b1fbb879f48d68fda1a8ac58e8e upstream. The problem I'm addressing was discovered by the LTP test covering cve-2018-1000204. A short description of what happens follows: 1) The test case issues a command code 00 (TEST UNIT READY) via the SG_IO interface with: dxfer_len =3D=3D 524288, dxdfer_dir =3D=3D SG_DXFER_FROM= _DEV and a corresponding dxferp. The peculiar thing about this is that TUR is not reading from the device. 2) In sg_start_req() the invocation of blk_rq_map_user() effectively bounces the user-space buffer. As if the device was to transfer into it. Since commit a45b599ad808 ("scsi: sg: allocate with __GFP_ZERO in sg_build_indirect()") we make sure this first bounce buffer is allocated with GFP_ZERO. 3) For the rest of the story we keep ignoring that we have a TUR, so the device won't touch the buffer we prepare as if the we had a DMA_FROM_DEVICE type of situation. My setup uses a virtio-scsi device and the buffer allocated by SG is mapped by the function virtqueue_add_split() which uses DMA_FROM_DEVICE for the "in" sgs (here scatter-gather and not scsi generics). This mapping involves bouncing via the swiotlb (we need swiotlb to do virtio in protected guest like s390 Secure Execution, or AMD SEV). 4) When the SCSI TUR is done, we first copy back the content of the second (that is swiotlb) bounce buffer (which most likely contains some previous IO data), to the first bounce buffer, which contains all zeros. Then we copy back the content of the first bounce buffer to the user-space buffer. 5) The test case detects that the buffer, which it zero-initialized, ain't all zeros and fails. One can argue that this is an swiotlb problem, because without swiotlb we leak all zeros, and the swiotlb should be transparent in a sense that it does not affect the outcome (if all other participants are well behaved). Copying the content of the original buffer into the swiotlb buffer is the only way I can think of to make swiotlb transparent in such scenarios. So let's do just that if in doubt, but allow the driver to tell us that the whole mapped buffer is going to be overwritten, in which case we can preserve the old behavior and avoid the performance impact of the extra bounce. Signed-off-by: Halil Pasic Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- Documentation/core-api/dma-attributes.rst | 8 ++++++++ include/linux/dma-mapping.h | 8 ++++++++ kernel/dma/swiotlb.c | 3 ++- 3 files changed, 18 insertions(+), 1 deletion(-) --- a/Documentation/core-api/dma-attributes.rst +++ b/Documentation/core-api/dma-attributes.rst @@ -130,3 +130,11 @@ accesses to DMA buffers in both privileg subsystem that the buffer is fully accessible at the elevated privilege level (and ideally inaccessible or at least read-only at the lesser-privileged levels). + +DMA_ATTR_OVERWRITE +------------------ + +This is a hint to the DMA-mapping subsystem that the device is expected to +overwrite the entire mapped size, thus the caller does not require any of = the +previous buffer contents to be preserved. This allows bounce-buffering +implementations to optimise DMA_FROM_DEVICE transfers. --- a/include/linux/dma-mapping.h +++ b/include/linux/dma-mapping.h @@ -62,6 +62,14 @@ #define DMA_ATTR_PRIVILEGED (1UL << 9) =20 /* + * This is a hint to the DMA-mapping subsystem that the device is expected + * to overwrite the entire mapped size, thus the caller does not require a= ny + * of the previous buffer contents to be preserved. This allows + * bounce-buffering implementations to optimise DMA_FROM_DEVICE transfers. + */ +#define DMA_ATTR_OVERWRITE (1UL << 10) + +/* * A dma_addr_t can hold any valid DMA or bus address for the platform. I= t can * be given to a device to use as a DMA source or target. It is specific = to a * given device and there may be a translation between the CPU physical ad= dress --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -598,7 +598,8 @@ phys_addr_t swiotlb_tbl_map_single(struc =20 tlb_addr =3D slot_addr(io_tlb_start, index) + offset; if (!(attrs & DMA_ATTR_SKIP_CPU_SYNC) && - (dir =3D=3D DMA_TO_DEVICE || dir =3D=3D DMA_BIDIRECTIONAL)) + (!(attrs & DMA_ATTR_OVERWRITE) || dir =3D=3D DMA_TO_DEVICE || + dir =3D=3D DMA_BIDIRECTIONAL)) swiotlb_bounce(orig_addr, tlb_addr, mapping_size, DMA_TO_DEVICE); return tlb_addr; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7AE3C35295 for ; Wed, 6 Apr 2022 00:09:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349790AbiDEXoC (ORCPT ); Tue, 5 Apr 2022 19:44:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354573AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 044E56BDC2; Tue, 5 Apr 2022 03:01:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9460961676; Tue, 5 Apr 2022 10:01:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F159C385A1; Tue, 5 Apr 2022 10:01:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152872; bh=mofzU+Ioylql3jwYOzUHQ6X/mwJ6eaP22Z7z4ZDyVcA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1AhEkmqC9y0wvksfX+j6RsmuiDrmAdBJ5+5+9+VW1VYnWWgR/DBYhIUGJaXvzw35Y zehDdKAyE8rCeVJPTwfb/F6vHadtkJEZ/fgJZo7FaQfXDjXyllq+cFG7O+AfEQLono w3FXpChg8XzPWTdvlr2neU/z1QhYm/mUOMRUyisM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eddie James , Joel Stanley , Johan Hovold Subject: [PATCH 5.10 002/599] USB: serial: pl2303: add IBM device IDs Date: Tue, 5 Apr 2022 09:24:56 +0200 Message-Id: <20220405070258.882801139@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eddie James commit e1d15646565b284e9ef2433234d6cfdaf66695f1 upstream. IBM manufactures a PL2303 device for UPS communications. Add the vendor and product IDs so that the PL2303 driver binds to the device. Signed-off-by: Eddie James Signed-off-by: Joel Stanley Signed-off-by: Eddie James Link: https://lore.kernel.org/r/20220301224446.21236-1-eajames@linux.ibm.com Cc: stable@vger.kernel.org [ johan: amend the SoB chain ] Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 3 +++ 2 files changed, 4 insertions(+) --- a/drivers/usb/serial/pl2303.c +++ b/drivers/usb/serial/pl2303.c @@ -116,6 +116,7 @@ static const struct usb_device_id id_tab { USB_DEVICE(ADLINK_VENDOR_ID, ADLINK_ND6530GC_PRODUCT_ID) }, { USB_DEVICE(SMART_VENDOR_ID, SMART_PRODUCT_ID) }, { USB_DEVICE(AT_VENDOR_ID, AT_VTKIT3_PRODUCT_ID) }, + { USB_DEVICE(IBM_VENDOR_ID, IBM_PRODUCT_ID) }, { } /* Terminating entry */ }; =20 --- a/drivers/usb/serial/pl2303.h +++ b/drivers/usb/serial/pl2303.h @@ -35,6 +35,9 @@ #define ATEN_PRODUCT_UC232B 0x2022 #define ATEN_PRODUCT_ID2 0x2118 =20 +#define IBM_VENDOR_ID 0x04b3 +#define IBM_PRODUCT_ID 0x4016 + #define IODATA_VENDOR_ID 0x04bb #define IODATA_PRODUCT_ID 0x0a03 #define IODATA_PRODUCT_ID_RSAQ5 0x0a0e From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DAE65C47081 for ; Tue, 5 Apr 2022 20:28:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1381300AbiDEU3F (ORCPT ); Tue, 5 Apr 2022 16:29:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43206 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354628AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E28F6BDEC; Tue, 5 Apr 2022 03:01:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AF6DEB81B96; Tue, 5 Apr 2022 10:01:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 203BCC385A2; Tue, 5 Apr 2022 10:01:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152902; bh=j5OThtCkKw8wixPROr3bHPlF7VL+nQO2b6T38K84FyM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zZv/Lqv7Jg7KcklVQW4krWaN+0tQMGr5hM23DcBzl74f/jrjScO9rVLplM4FxDnAl CCHKmGmMqrgD+rPxNVcjFhklT51PqheoxaNw1bjHWyeSrmWiuXMkzT92s3ixYy2Oz9 fwr2ZoZz8Rez9XXpfaHfIGgzB86vt3r9BYM1NBYw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold Subject: [PATCH 5.10 003/599] USB: serial: simple: add Nokia phone driver Date: Tue, 5 Apr 2022 09:24:57 +0200 Message-Id: <20220405070258.912898995@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit c4b9c570965f75d0d55e639747f1e5ccdad2fae0 upstream. Add a new "simple" driver for certain Nokia phones, including Nokia 130 (RM-1035) which exposes two serial ports in "charging only" mode: Bus 001 Device 009: ID 0421:069a Nokia Mobile Phones 130 [RM-1035] (Chargin= g only) Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 2.00 bDeviceClass 0 bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0 8 idVendor 0x0421 Nokia Mobile Phones idProduct 0x069a 130 [RM-1035] (Charging only) bcdDevice 1.00 iManufacturer 1 Nokia iProduct 2 Nokia 130 (RM-1035) iSerial 0 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 0x0037 bNumInterfaces 2 bConfigurationValue 1 iConfiguration 0 bmAttributes 0x80 (Bus Powered) MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 255 Vendor Specific Subclass bInterfaceProtocol 255 Vendor Specific Protocol iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81 EP 1 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x01 EP 1 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 1 bAlternateSetting 0 bNumEndpoints 2 bInterfaceClass 255 Vendor Specific Class bInterfaceSubClass 255 Vendor Specific Subclass bInterfaceProtocol 255 Vendor Specific Protocol iInterface 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82 EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x02 EP 2 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040 1x 64 bytes bInterval 0 Device Status: 0x0000 (Bus Powered) Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220228084919.10656-1-johan@kernel.org Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/serial/Kconfig | 1 + drivers/usb/serial/usb-serial-simple.c | 7 +++++++ 2 files changed, 8 insertions(+) --- a/drivers/usb/serial/Kconfig +++ b/drivers/usb/serial/Kconfig @@ -66,6 +66,7 @@ config USB_SERIAL_SIMPLE - Libtransistor USB console - a number of Motorola phones - Motorola Tetra devices + - Nokia mobile phones - Novatel Wireless GPS receivers - Siemens USB/MPI adapter. - ViVOtech ViVOpay USB device. --- a/drivers/usb/serial/usb-serial-simple.c +++ b/drivers/usb/serial/usb-serial-simple.c @@ -91,6 +91,11 @@ DEVICE(moto_modem, MOTO_IDS); { USB_DEVICE(0x0cad, 0x9016) } /* TPG2200 */ DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); =20 +/* Nokia mobile phone driver */ +#define NOKIA_IDS() \ + { USB_DEVICE(0x0421, 0x069a) } /* Nokia 130 (RM-1035) */ +DEVICE(nokia, NOKIA_IDS); + /* Novatel Wireless GPS driver */ #define NOVATEL_IDS() \ { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ @@ -123,6 +128,7 @@ static struct usb_serial_driver * const &vivopay_device, &moto_modem_device, &motorola_tetra_device, + &nokia_device, &novatel_gps_device, &hp4x_device, &suunto_device, @@ -140,6 +146,7 @@ static const struct usb_device_id id_tab VIVOPAY_IDS(), MOTO_IDS(), MOTOROLA_TETRA_IDS(), + NOKIA_IDS(), NOVATEL_IDS(), HP4X_IDS(), SUUNTO_IDS(), From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5F422C4167B for ; Tue, 5 Apr 2022 20:28:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1376569AbiDEUYI (ORCPT ); Tue, 5 Apr 2022 16:24:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354639AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDC196A42D; Tue, 5 Apr 2022 03:01:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 80295B818F6; Tue, 5 Apr 2022 10:01:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC1EAC385A1; Tue, 5 Apr 2022 10:01:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152916; bh=GPaqH+1yLPZ4DKefbUNcGzaeDWSOf2VM3/SZ0PIjg+o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=v0rjlYdR9iXt0zGFhuU9VCERsJmZP6Rjoat2inqOu3r9YjgfE5FNH16j0oaxRt4wM 6D4YGZNOCaNOu65uP0eBPaYCa45aqvlR7LX7hAU2intBmfSQ69swypVlaNYHZfbyPn U0nJsvGicKSRJPhQSHHVA3zU5WieRdSAfCUZMEIo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , kernel test robot , Arnd Bergmann , "K. Y. Srinivasan" , Haiyang Zhang , Stephen Hemminger , Wei Liu , Dexuan Cui , linux-hyperv@vger.kernel.org, Michael Kelley , =?UTF-8?q?Petr=20=C5=A0tetiar?= Subject: [PATCH 5.10 004/599] hv: utils: add PTP_1588_CLOCK to Kconfig to fix build Date: Tue, 5 Apr 2022 09:24:58 +0200 Message-Id: <20220405070258.943153862@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Randy Dunlap commit 1dc2f2b81a6a9895da59f3915760f6c0c3074492 upstream. The hyperv utilities use PTP clock interfaces and should depend a a kconfig symbol such that they will be built as a loadable module or builtin so that linker errors do not happen. Prevents these build errors: ld: drivers/hv/hv_util.o: in function `hv_timesync_deinit': hv_util.c:(.text+0x37d): undefined reference to `ptp_clock_unregister' ld: drivers/hv/hv_util.o: in function `hv_timesync_init': hv_util.c:(.text+0x738): undefined reference to `ptp_clock_register' Fixes: 3716a49a81ba ("hv_utils: implement Hyper-V PTP source") Signed-off-by: Randy Dunlap Reported-by: kernel test robot Cc: Arnd Bergmann Cc: "K. Y. Srinivasan" Cc: Haiyang Zhang Cc: Stephen Hemminger Cc: Wei Liu Cc: Dexuan Cui Cc: linux-hyperv@vger.kernel.org Cc: Greg Kroah-Hartman Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/20211126023316.25184-1-rdunlap@infradead.org Signed-off-by: Wei Liu Cc: Petr =C5=A0tetiar Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hv/Kconfig | 1 + 1 file changed, 1 insertion(+) --- a/drivers/hv/Kconfig +++ b/drivers/hv/Kconfig @@ -17,6 +17,7 @@ config HYPERV_TIMER config HYPERV_UTILS tristate "Microsoft Hyper-V Utilities driver" depends on HYPERV && CONNECTOR && NLS + depends on PTP_1588_CLOCK_OPTIONAL help Select this option to enable the Hyper-V Utilities. =20 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 559A8C4167B for ; Tue, 5 Apr 2022 22:04:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1391087AbiDEWEu (ORCPT ); Tue, 5 Apr 2022 18:04:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354641AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3D5F6B0BE; Tue, 5 Apr 2022 03:02:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5E6BFB818F6; Tue, 5 Apr 2022 10:02:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A596BC385A1; Tue, 5 Apr 2022 10:01:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152919; bh=1rGSpeBSpvqcj8+jDNvyQPYJVe85AOM5TdBODRr442U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wQKSLGqsO8+nkE8pcebCAYYyGdSwFte02GPuyCGwaAdM7KiFICGq/wN/3zcJoUk94 5J1Lg+/c1goZLytefAwaBQxu5daXaGyr5iz6fldIc5EKWVL4gKRY7vh3NFC5NNBoAh CMGWGtP0lkJI3GaOq5WVZgT8LOZmjRek6rB56tNg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yajun Deng , "David S. Miller" , Pavel Machek Subject: [PATCH 5.10 005/599] netdevice: add the case if dev is NULL Date: Tue, 5 Apr 2022 09:24:59 +0200 Message-Id: <20220405070258.973215990@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yajun Deng commit b37a466837393af72fe8bcb8f1436410f3f173f3 upstream. Add the case if dev is NULL in dev_{put, hold}, so the caller doesn't need to care whether dev is NULL or not. Signed-off-by: Yajun Deng Signed-off-by: David S. Miller Cc: Pavel Machek Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/linux/netdevice.h | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/include/linux/netdevice.h +++ b/include/linux/netdevice.h @@ -3980,7 +3980,8 @@ void netdev_run_todo(void); */ static inline void dev_put(struct net_device *dev) { - this_cpu_dec(*dev->pcpu_refcnt); + if (dev) + this_cpu_dec(*dev->pcpu_refcnt); } =20 /** @@ -3991,7 +3992,8 @@ static inline void dev_put(struct net_de */ static inline void dev_hold(struct net_device *dev) { - this_cpu_inc(*dev->pcpu_refcnt); + if (dev) + this_cpu_inc(*dev->pcpu_refcnt); } =20 /* Carrier loss detection, dial on demand. The functions netif_carrier_on From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C226CC4332F for ; Tue, 5 Apr 2022 19:53:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238210AbiDETza (ORCPT ); Tue, 5 Apr 2022 15:55:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47988 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354640AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40F696B505; Tue, 5 Apr 2022 03:02:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EC7EBB81C83; Tue, 5 Apr 2022 10:02:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C446C385A2; Tue, 5 Apr 2022 10:02:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152921; bh=BQG/RH5+pJWh1aMXf0Q5+t1IqUoha19GhFHJmPF5m5c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1JLJe3+RUE2FJPH/iUuwLpqGvfei4lnsziKOhkEGNg3SkHV4a9ruxNTSLrkQEUCa1 pLH1UG3ChZvxsNOoENduJtx0g0h+ur8jtVsm2diwyUM8t7UGLvcidPbj5Tz0BLuNnc VtGTZ0BwgolK2O1JcvyxzNdIgrtJYZ8dlG/qTDvk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas Zampieri , Nestor Lopez Casado , Jiri Kosina , Sasha Levin Subject: [PATCH 5.10 006/599] HID: logitech-dj: add new lightspeed receiver id Date: Tue, 5 Apr 2022 09:25:00 +0200 Message-Id: <20220405070259.002081260@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lucas Zampieri [ Upstream commit 25666e8ccd952627899b09b68f7c9b68cfeaf028 ] As of logitech lightspeed receiver fw version 04.02.B0009, HIDPP_PARAM_DEVICE_INFO is being reported as 0x11. With patch "HID: logitech-dj: add support for the new lightspeed receiver iteration", the mouse starts to error out with: logitech-djreceiver: unusable device of type UNKNOWN (0x011) connected on slot 1 and becomes unusable. This has been noticed on a Logitech G Pro X Superlight fw MPM 25.01.B0018. Signed-off-by: Lucas Zampieri Acked-by: Nestor Lopez Casado Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hid/hid-logitech-dj.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c index a311b0a33eba..587259b3db97 100644 --- a/drivers/hid/hid-logitech-dj.c +++ b/drivers/hid/hid-logitech-dj.c @@ -1000,6 +1000,7 @@ static void logi_hidpp_recv_queue_notif(struct hid_de= vice *hdev, workitem.reports_supported |=3D STD_KEYBOARD; break; case 0x0f: + case 0x11: device_type =3D "eQUAD Lightspeed 1.2"; logi_hidpp_dev_conn_notif_equad(hdev, hidpp_report, &workitem); workitem.reports_supported |=3D STD_KEYBOARD; --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9280BC4167D for ; Tue, 5 Apr 2022 21:32:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379606AbiDEVdQ (ORCPT ); Tue, 5 Apr 2022 17:33:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354643AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 670476C1D4; Tue, 5 Apr 2022 03:02:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0449961676; Tue, 5 Apr 2022 10:02:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1498EC385A2; Tue, 5 Apr 2022 10:02:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152924; bh=vSw95j1GAoKc3GU1j3gp9FANPdfDZ7j9JLEz9y4X0q8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q6L1uVb/K2qLFs/TtKaHs/JBowQPlt23PMjdub2sxGeno/uSbda4w91iOjzqnBlFo /4Cq16NOIsWgqcSCde4pneZn+nhujae4/V2tJBbrz+hZGX6d1WCMaVbPIilhAuUfT/ aDu656GS0gebmihCoG9dcvBA7ZtGIL7YHFL8mRp4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lina Wang , Steffen Klassert , Sasha Levin Subject: [PATCH 5.10 007/599] xfrm: fix tunnel model fragmentation behavior Date: Tue, 5 Apr 2022 09:25:01 +0200 Message-Id: <20220405070259.031976190@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lina Wang [ Upstream commit 4ff2980b6bd2aa6b4ded3ce3b7c0ccfab29980af ] in tunnel mode, if outer interface(ipv4) is less, it is easily to let inner IPV6 mtu be less than 1280. If so, a Packet Too Big ICMPV6 message is received. When send again, packets are fragmentized with 1280, they are still rejected with ICMPV6(Packet Too Big) by xfrmi_xmit2(). According to RFC4213 Section3.2.2: if (IPv4 path MTU - 20) is less than 1280 if packet is larger than 1280 bytes Send ICMPv6 "packet too big" with MTU=3D1280 Drop packet else Encapsulate but do not set the Don't Fragment flag in the IPv4 header. The resulting IPv4 packet might be fragmented by the IPv4 layer on the encapsulator or by some router along the IPv4 path. endif else if packet is larger than (IPv4 path MTU - 20) Send ICMPv6 "packet too big" with MTU =3D (IPv4 path MTU - 20). Drop packet. else Encapsulate and set the Don't Fragment flag in the IPv4 header. endif endif Packets should be fragmentized with ipv4 outer interface, so change it. After it is fragemtized with ipv4, there will be double fragmenation. No.48 & No.51 are ipv6 fragment packets, No.48 is double fragmentized, then tunneled with IPv4(No.49& No.50), which obey spec. And received peer cannot decrypt it rightly. 48 2002::10 2002::11 1296(length) IPv6 fragment (off=3D= 0 more=3Dy ident=3D0xa20da5bc nxt=3D50) 49 0x0000 (0) 2002::10 2002::11 1304 IPv6 fragment (off=3D= 0 more=3Dy ident=3D0x7448042c nxt=3D44) 50 0x0000 (0) 2002::10 2002::11 200 ESP (SPI=3D0x00035000) 51 2002::10 2002::11 180 Echo (ping) request 52 0x56dc 2002::10 2002::11 248 IPv6 fragment (off=3D= 1232 more=3Dn ident=3D0xa20da5bc nxt=3D50) xfrm6_noneed_fragment has fixed above issues. Finally, it acted like below: 1 0x6206 192.168.1.138 192.168.1.1 1316 Fragmented IP protocol (proto= =3DEncap Security Payload 50, off=3D0, ID=3D6206) [Reassembled in #2] 2 0x6206 2002::10 2002::11 88 IPv6 fragment (off=3D0 more=3Dy= ident=3D0x1f440778 nxt=3D50) 3 0x0000 2002::10 2002::11 248 ICMPv6 Echo (ping) request Signed-off-by: Lina Wang Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/ipv6/xfrm6_output.c | 16 ++++++++++++++++ net/xfrm/xfrm_interface.c | 5 ++++- 2 files changed, 20 insertions(+), 1 deletion(-) diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c index 6abb45a67199..ee349c243878 100644 --- a/net/ipv6/xfrm6_output.c +++ b/net/ipv6/xfrm6_output.c @@ -52,6 +52,19 @@ static int __xfrm6_output_finish(struct net *net, struct= sock *sk, struct sk_buf return xfrm_output(sk, skb); } =20 +static int xfrm6_noneed_fragment(struct sk_buff *skb) +{ + struct frag_hdr *fh; + u8 prevhdr =3D ipv6_hdr(skb)->nexthdr; + + if (prevhdr !=3D NEXTHDR_FRAGMENT) + return 0; + fh =3D (struct frag_hdr *)(skb->data + sizeof(struct ipv6hdr)); + if (fh->nexthdr =3D=3D NEXTHDR_ESP || fh->nexthdr =3D=3D NEXTHDR_AUTH) + return 1; + return 0; +} + static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff= *skb) { struct dst_entry *dst =3D skb_dst(skb); @@ -80,6 +93,9 @@ static int __xfrm6_output(struct net *net, struct sock *s= k, struct sk_buff *skb) xfrm6_local_rxpmtu(skb, mtu); kfree_skb(skb); return -EMSGSIZE; + } else if (toobig && xfrm6_noneed_fragment(skb)) { + skb->ignore_df =3D 1; + goto skip_frag; } else if (!skb->ignore_df && toobig && skb->sk) { xfrm_local_error(skb, mtu); kfree_skb(skb); diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c index 4420c8fd318a..da518b4ca84c 100644 --- a/net/xfrm/xfrm_interface.c +++ b/net/xfrm/xfrm_interface.c @@ -303,7 +303,10 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *de= v, struct flowi *fl) if (mtu < IPV6_MIN_MTU) mtu =3D IPV6_MIN_MTU; =20 - icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); + if (skb->len > 1280) + icmpv6_ndo_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); + else + goto xmit; } else { if (!(ip_hdr(skb)->frag_off & htons(IP_DF))) goto xmit; --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DD2F7C4321E for ; Tue, 5 Apr 2022 20:56:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383568AbiDEUzP (ORCPT ); Tue, 5 Apr 2022 16:55:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354645AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 31CF16C1D5; Tue, 5 Apr 2022 03:02:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C00856172B; Tue, 5 Apr 2022 10:02:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C81E7C385A2; Tue, 5 Apr 2022 10:02:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152927; bh=WShbQXSabFJ84DUQ7BZubSHOJSxU09EfsVqM5MsbdRg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NZQ+XQCemkKza0SQY7bZmfbeOpCdsgMW3TTzPRqeMjdvz7wveWD/PnLIumE+Nx39Z ZpQ5SPZ5tTyWN1eUo/sNGEdy8FkR7IpV8GD8xZ9bTmwtnObzXWU5T06dYHwrdR5DPH hzjXV5H7s9MkO8d1/C6Hq+7PTrEdttOMC+A/4uUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Palmer , Arnd Bergmann , Sasha Levin Subject: [PATCH 5.10 008/599] ARM: mstar: Select HAVE_ARM_ARCH_TIMER Date: Tue, 5 Apr 2022 09:25:02 +0200 Message-Id: <20220405070259.061969249@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Daniel Palmer [ Upstream commit ea49432d184a6a09f84461604b7711a4e9f5ec9c ] The mstar SoCs have an arch timer but HAVE_ARM_ARCH_TIMER wasn't selected. If MSC313E_TIMER isn't selected then the kernel gets stuck at boot because there are no timers available. Signed-off-by: Daniel Palmer Link: https://lore.kernel.org/r/20220301104349.3040422-1-daniel@0x0f.com' Signed-off-by: Arnd Bergmann Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm/mach-mstar/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/arch/arm/mach-mstar/Kconfig b/arch/arm/mach-mstar/Kconfig index 576d1ab293c8..30560fdf87ed 100644 --- a/arch/arm/mach-mstar/Kconfig +++ b/arch/arm/mach-mstar/Kconfig @@ -3,6 +3,7 @@ menuconfig ARCH_MSTARV7 depends on ARCH_MULTI_V7 select ARM_GIC select ARM_HEAVY_MB + select HAVE_ARM_ARCH_TIMER select MST_IRQ help Support for newer MStar/Sigmastar SoC families that are --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED7D8C3527B for ; Tue, 5 Apr 2022 20:34:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348320AbiDEUeW (ORCPT ); Tue, 5 Apr 2022 16:34:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354646AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D73FF6C1D8; Tue, 5 Apr 2022 03:02:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7300561740; Tue, 5 Apr 2022 10:02:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83CF3C385A1; Tue, 5 Apr 2022 10:02:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152929; bh=Q78uqsoC1xavvfYSlRpEWeKITURSQGMxioyCMC1inPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XwVkghYotP1do9MpI6bGZE0ry/7BPjI959j3x24z4rkzOLjmKR8V+sKn1o3I68CQV vpNvmMGAMEMjZmD8V7boM1kuGbPLDI/VnEldeUM36MW/Kw+mxkEUSeB5mpMNlPlSzK 6u28lSwLgtiPhvokXG0G9OIR2a+t9OhY1CobC4nk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Michael S. Tsirkin" , Sasha Levin Subject: [PATCH 5.10 009/599] virtio_console: break out of buf poll on remove Date: Tue, 5 Apr 2022 09:25:03 +0200 Message-Id: <20220405070259.091408163@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael S. Tsirkin [ Upstream commit 0e7174b9d5877130fec41fb4a16e0c2ee4958d44 ] A common pattern for device reset is currently: vdev->config->reset(vdev); .. cleanup .. reset prevents new interrupts from arriving and waits for interrupt handlers to finish. However if - as is common - the handler queues a work request which is flushed during the cleanup stage, we have code adding buffers / trying to get buffers while device is reset. Not good. This was reproduced by running modprobe virtio_console modprobe -r virtio_console in a loop. Fix this up by calling virtio_break_device + flush before reset. Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=3D1786239 Signed-off-by: Michael S. Tsirkin Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/char/virtio_console.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c index 673522874cec..3dd4deb60adb 100644 --- a/drivers/char/virtio_console.c +++ b/drivers/char/virtio_console.c @@ -1959,6 +1959,13 @@ static void virtcons_remove(struct virtio_device *vd= ev) list_del(&portdev->list); spin_unlock_irq(&pdrvdata_lock); =20 + /* Device is going away, exit any polling for buffers */ + virtio_break_device(vdev); + if (use_multiport(portdev)) + flush_work(&portdev->control_work); + else + flush_work(&portdev->config_work); + /* Disable interrupts for vqs */ vdev->config->reset(vdev); /* Finish up work that's lined up */ --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BABE6C35295 for ; Tue, 5 Apr 2022 23:42:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1579326AbiDEX1C (ORCPT ); Tue, 5 Apr 2022 19:27:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45598 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354492AbiDEKOU (ORCPT ); Tue, 5 Apr 2022 06:14:20 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B29B16B0B1; Tue, 5 Apr 2022 03:00:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 205BBCE1B5F; Tue, 5 Apr 2022 10:00:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2C57FC385A3; Tue, 5 Apr 2022 10:00:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152844; bh=6zLz/9Zh1RR3ggBa17qzUrw7ZSDAunI0M98e6yogLJc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZMDYfB+asUD/GJiAvL4y+B4utqK9afahq6DRQssUV9xHSwLr+debeFS/kjT1XBkPJ 7NMqG1xaSJACTkxBmJ6o1QRPQgzY3RivCOfh35g+FuklIkk53A3/g4RuHlKw3ediaK aKbJJmU68So65hNLFwdDLStDsfQZscpJd5m/T53I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Si-Wei Liu , "Michael S. Tsirkin" , Eli Cohen , Jason Wang , Sasha Levin Subject: [PATCH 5.10 010/599] vdpa/mlx5: should verify CTRL_VQ feature exists for MQ Date: Tue, 5 Apr 2022 09:25:04 +0200 Message-Id: <20220405070259.121425630@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Si-Wei Liu [ Upstream commit 30c22f3816ffef8aa21a000e93c4ee1402a6ea65 ] Per VIRTIO v1.1 specification, section 5.1.3.1 Feature bit requirements: "VIRTIO_NET_F_MQ Requires VIRTIO_NET_F_CTRL_VQ". There's assumption in the mlx5_vdpa multiqueue code that MQ must come together with CTRL_VQ. However, there's nowhere in the upper layer to guarantee this assumption would hold. Were there an untrusted driver sending down MQ without CTRL_VQ, it would compromise various spots for e.g. is_index_valid() and is_ctrl_vq_idx(). Although this doesn't end up with immediate panic or security loophole as of today's code, the chance for this to be taken advantage of due to future code change is not zero. Harden the crispy assumption by failing the set_driver_features() call when seeing (MQ && !CTRL_VQ). For that end, verify_min_features() is renamed to verify_driver_features() to reflect the fact that it now does more than just validate the minimum features. verify_driver_features() is now used to accommodate various checks against the driver features for set_driver_features(). Signed-off-by: Si-Wei Liu Link: https://lore.kernel.org/r/1642206481-30721-3-git-send-email-si-wei.li= u@oracle.com Signed-off-by: Michael S. Tsirkin Reviewed-by: Eli Cohen Acked-by: Jason Wang Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/vdpa/mlx5/net/mlx5_vnet.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/vdpa/mlx5/net/mlx5_vnet.c b/drivers/vdpa/mlx5/net/mlx5= _vnet.c index 65d6f8fd81e7..577ff786f11b 100644 --- a/drivers/vdpa/mlx5/net/mlx5_vnet.c +++ b/drivers/vdpa/mlx5/net/mlx5_vnet.c @@ -1482,11 +1482,25 @@ static u64 mlx5_vdpa_get_features(struct vdpa_devic= e *vdev) return ndev->mvdev.mlx_features; } =20 -static int verify_min_features(struct mlx5_vdpa_dev *mvdev, u64 features) +static int verify_driver_features(struct mlx5_vdpa_dev *mvdev, u64 feature= s) { + /* Minimum features to expect */ if (!(features & BIT_ULL(VIRTIO_F_ACCESS_PLATFORM))) return -EOPNOTSUPP; =20 + /* Double check features combination sent down by the driver. + * Fail invalid features due to absence of the depended feature. + * + * Per VIRTIO v1.1 specification, section 5.1.3.1 Feature bit + * requirements: "VIRTIO_NET_F_MQ Requires VIRTIO_NET_F_CTRL_VQ". + * By failing the invalid features sent down by untrusted drivers, + * we're assured the assumption made upon is_index_valid() and + * is_ctrl_vq_idx() will not be compromised. + */ + if ((features & (BIT_ULL(VIRTIO_NET_F_MQ) | BIT_ULL(VIRTIO_NET_F_CTRL_VQ)= )) =3D=3D + BIT_ULL(VIRTIO_NET_F_MQ)) + return -EINVAL; + return 0; } =20 @@ -1544,7 +1558,7 @@ static int mlx5_vdpa_set_features(struct vdpa_device = *vdev, u64 features) =20 print_features(mvdev, features, true); =20 - err =3D verify_min_features(mvdev, features); + err =3D verify_driver_features(mvdev, features); if (err) return err; =20 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0BF17C433F5 for ; Tue, 5 Apr 2022 23:12:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574026AbiDEWyH (ORCPT ); Tue, 5 Apr 2022 18:54:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354547AbiDEKOh (ORCPT ); Tue, 5 Apr 2022 06:14:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C719F6B0B4; Tue, 5 Apr 2022 03:00:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D9FDF61745; Tue, 5 Apr 2022 10:00:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E664BC385A3; Tue, 5 Apr 2022 10:00:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152847; bh=M9qg1+MP8/boX48RlfUxEw5j6AKp+bmFAwZvpIQBwdA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W2hmfR6ggbDvciMX1Au0NIlA5bPPl4QuYhCmAD4nZ2VWJZhVVzjgUUzgR5L845yHI 4Nted6gnJWnUstJgejhi/xffVGgjE3YsGTrvhJwNStjFQUzeq+GorDffL3o+U9snV4 kjhm6A3lFUQhSvMuGA3CPYjZPCxwE672nvCzbjZM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stefano Garzarella , "Michael S. Tsirkin" , Jason Wang , Sasha Levin Subject: [PATCH 5.10 011/599] tools/virtio: fix virtio_test execution Date: Tue, 5 Apr 2022 09:25:05 +0200 Message-Id: <20220405070259.151211501@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stefano Garzarella [ Upstream commit 32f1b53fe8f03d962423ba81f8e92af5839814da ] virtio_test hangs on __vring_new_virtqueue() because `vqs_list_lock` is not initialized. Let's initialize it in vdev_info_init(). Signed-off-by: Stefano Garzarella Link: https://lore.kernel.org/r/20220118150631.167015-1-sgarzare@redhat.com Signed-off-by: Michael S. Tsirkin Acked-by: Jason Wang Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- tools/virtio/virtio_test.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/virtio/virtio_test.c b/tools/virtio/virtio_test.c index cb3f29c09aff..23f142af544a 100644 --- a/tools/virtio/virtio_test.c +++ b/tools/virtio/virtio_test.c @@ -130,6 +130,7 @@ static void vdev_info_init(struct vdev_info* dev, unsig= ned long long features) memset(dev, 0, sizeof *dev); dev->vdev.features =3D features; INIT_LIST_HEAD(&dev->vdev.vqs); + spin_lock_init(&dev->vdev.vqs_list_lock); dev->buf_size =3D 1024; dev->buf =3D malloc(dev->buf_size); assert(dev->buf); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C21EBC433F5 for ; Tue, 5 Apr 2022 20:28:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382327AbiDEU3a (ORCPT ); Tue, 5 Apr 2022 16:29:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46878 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354561AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D7066B0B8; Tue, 5 Apr 2022 03:00:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9769661500; Tue, 5 Apr 2022 10:00:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ACD74C385A4; Tue, 5 Apr 2022 10:00:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152850; bh=0ZUeWdXu1ZgtTPdMCy428BD2+xFElBllT5uy5kE9/yA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cBjDlrRF1nFZZXIhnZO4+vQ2HO38RQmLTj1gc9LXRpp09mzC0bdJZwkN+64/crF21 o/LRHKseqqAyms6bxi/xhgWlB4xGhWHweHTslzEq/bxkwWINSte6cO4eeAP/6LFCxZ V8Mou0I68ScuxFDm9gI00lc10bJRr6RgaFh5AIMw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Andrew Lunn , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 012/599] ethernet: sun: Free the coherent when failing in probing Date: Tue, 5 Apr 2022 09:25:06 +0200 Message-Id: <20220405070259.181233490@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Zheyu Ma [ Upstream commit bb77bd31c281f70ec77c9c4f584950a779e05cf8 ] When the driver fails to register net device, it should free the DMA region first, and then do other cleanup. Signed-off-by: Zheyu Ma Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/sun/sunhme.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/s= unhme.c index 54b53dbdb33c..69fc47089e62 100644 --- a/drivers/net/ethernet/sun/sunhme.c +++ b/drivers/net/ethernet/sun/sunhme.c @@ -3163,7 +3163,7 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, if (err) { printk(KERN_ERR "happymeal(PCI): Cannot register net device, " "aborting.\n"); - goto err_out_iounmap; + goto err_out_free_coherent; } =20 pci_set_drvdata(pdev, hp); @@ -3196,6 +3196,10 @@ static int happy_meal_pci_probe(struct pci_dev *pdev, =20 return 0; =20 +err_out_free_coherent: + dma_free_coherent(hp->dma_dev, PAGE_SIZE, + hp->happy_block, hp->hblock_dvma); + err_out_iounmap: iounmap(hp->gregs); =20 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A659C433FE for ; Tue, 5 Apr 2022 21:09:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1344555AbiDEVIr (ORCPT ); Tue, 5 Apr 2022 17:08:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354560AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B81486B0BA; Tue, 5 Apr 2022 03:00:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4DB7261676; Tue, 5 Apr 2022 10:00:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B710C385A1; Tue, 5 Apr 2022 10:00:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152852; bh=YcAXeTWc0J/20QqSUfzXau2aqRTILZulL3uxemPHlIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ai+UefR7GpFoBcZ+zfqAyXg4RAM7myWFGyMRQ4JmcOQJNmyTG5xJDE6Jm1d3Q6Xvf y/nkioSKiZNZx9UaoXY07yMam40Fkl3Rsbil+Umbs0kOOIGyRxT1lh9zsCyntZwv15 VB57d9G59QsaB+sR9fDJSrfLlDrik0rYDq6iIQ1Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcelo Roberto Jimenez , Bartosz Golaszewski , Sasha Levin Subject: [PATCH 5.10 013/599] gpio: Revert regression in sysfs-gpio (gpiolib.c) Date: Tue, 5 Apr 2022 09:25:07 +0200 Message-Id: <20220405070259.211158709@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marcelo Roberto Jimenez [ Upstream commit fc328a7d1fcce263db0b046917a66f3aa6e68719 ] Some GPIO lines have stopped working after the patch commit 2ab73c6d8323f ("gpio: Support GPIO controllers without pin-ranges") And this has supposedly been fixed in the following patches commit 89ad556b7f96a ("gpio: Avoid using pin ranges with !PINCTRL") commit 6dbbf84603961 ("gpiolib: Don't free if pin ranges are not defined") But an erratic behavior where some GPIO lines work while others do not work has been introduced. This patch reverts those changes so that the sysfs-gpio interface works properly again. Signed-off-by: Marcelo Roberto Jimenez Signed-off-by: Bartosz Golaszewski Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpio/gpiolib.c | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index 00526fdd7691..bbf34d84636d 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -1804,11 +1804,6 @@ static inline void gpiochip_irqchip_free_valid_mask(= struct gpio_chip *gc) */ int gpiochip_generic_request(struct gpio_chip *gc, unsigned offset) { -#ifdef CONFIG_PINCTRL - if (list_empty(&gc->gpiodev->pin_ranges)) - return 0; -#endif - return pinctrl_gpio_request(gc->gpiodev->base + offset); } EXPORT_SYMBOL_GPL(gpiochip_generic_request); @@ -1820,11 +1815,6 @@ EXPORT_SYMBOL_GPL(gpiochip_generic_request); */ void gpiochip_generic_free(struct gpio_chip *gc, unsigned offset) { -#ifdef CONFIG_PINCTRL - if (list_empty(&gc->gpiodev->pin_ranges)) - return; -#endif - pinctrl_gpio_free(gc->gpiodev->base + offset); } EXPORT_SYMBOL_GPL(gpiochip_generic_free); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83108C35296 for ; Tue, 5 Apr 2022 23:52:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1383924AbiDEXhd (ORCPT ); Tue, 5 Apr 2022 19:37:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39644 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354554AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9EB046B507; Tue, 5 Apr 2022 03:00:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 17AC7CE0B18; Tue, 5 Apr 2022 10:00:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D5FCC385A1; Tue, 5 Apr 2022 10:00:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152855; bh=lQb4Mu6T8MYtQv868Z1oDD5YOQPMit2xWh8TfuuwmA4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z3zRUX8MhsyzG3jmOdGOWOV0QComcqc+zLxyDPGPymySah72VfR+6FCLyQiW3tKCs DnixRgGqMGjDvdTLdPIXs91gDjWKk2LlTWv0gP0hToRzNL1RjYfmpWBUzEXcBN4msS 5BjcUUgioN8Gs3vvg49/SCLg2hrT2LLUG1grF1KM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Biju Das , Lad Prabhakar , Geert Uytterhoeven , Mark Brown , Sasha Levin Subject: [PATCH 5.10 014/599] spi: Fix invalid sgs value Date: Tue, 5 Apr 2022 09:25:08 +0200 Message-Id: <20220405070259.241084579@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Biju Das [ Upstream commit 1a4e53d2fc4f68aa654ad96d13ad042e1a8e8a7d ] max_seg_size is unsigned int and it can have a value up to 2^32 (for eg:-RZ_DMAC driver sets dma_set_max_seg_size as U32_MAX) When this value is used in min_t() as an integer type, it becomes -1 and the value of sgs becomes 0. Fix this issue by replacing the 'int' data type with 'unsigned int' in min_t(). Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Reviewed-by: Geert Uytterhoeven Link: https://lore.kernel.org/r/20220307184843.9994-1-biju.das.jz@bp.renesa= s.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/spi/spi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 8c261eac2cee..2396565fc91b 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -881,10 +881,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct d= evice *dev, int i, ret; =20 if (vmalloced_buf || kmap_buf) { - desc_len =3D min_t(int, max_seg_size, PAGE_SIZE); + desc_len =3D min_t(unsigned int, max_seg_size, PAGE_SIZE); sgs =3D DIV_ROUND_UP(len + offset_in_page(buf), desc_len); } else if (virt_addr_valid(buf)) { - desc_len =3D min_t(int, max_seg_size, ctlr->max_dma_len); + desc_len =3D min_t(unsigned int, max_seg_size, ctlr->max_dma_len); sgs =3D DIV_ROUND_UP(len, desc_len); } else { return -EINVAL; --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85DC5C41535 for ; Tue, 5 Apr 2022 21:32:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1378940AbiDEVcm (ORCPT ); Tue, 5 Apr 2022 17:32:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39990 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354557AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 32E2D6B50F; Tue, 5 Apr 2022 03:00:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C347E61673; Tue, 5 Apr 2022 10:00:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D2F11C385A2; Tue, 5 Apr 2022 10:00:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152858; bh=x8Q4wDzx3/rZ0p91J6o/b9ne1uknoW2iH6CqC6u3gDk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1xrx703YQsKKsA4qRuzFmOzgsEhgLH31rbfVigGAVejsCTu/6Zr4UsKJM8R0st0yE oZEUUZf5PFqyTU9exhWz8571uA+OA0th1J2jqg+cf6i13wygfl5ipE6aq47HQTQtVg NBNi+m9TR3kvkdx1EjWhKT8BzsrrwavIC+W3PE5w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zeal Robot , "Minghao Chi (CGEL ZTE)" , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 015/599] net:mcf8390: Use platform_get_irq() to get the interrupt Date: Tue, 5 Apr 2022 09:25:09 +0200 Message-Id: <20220405070259.270111407@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Minghao Chi (CGEL ZTE) [ Upstream commit 2a760554dcba450d3ad61b32375b50ed6d59a87c ] It is not recommened to use platform_get_resource(pdev, IORESOURCE_IRQ) for requesting IRQ's resources any more, as they can be not ready yet in case of DT-booting. platform_get_irq() instead is a recommended way for getting IRQ even if it was not retrieved earlier. It also makes code simpler because we're getting "int" value right away and no conversion from resource to int is required. Reported-by: Zeal Robot Signed-off-by: Minghao Chi (CGEL ZTE) Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/8390/mcf8390.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/net/ethernet/8390/mcf8390.c b/drivers/net/ethernet/839= 0/mcf8390.c index 4ad8031ab669..065fdbe66c42 100644 --- a/drivers/net/ethernet/8390/mcf8390.c +++ b/drivers/net/ethernet/8390/mcf8390.c @@ -406,12 +406,12 @@ static int mcf8390_init(struct net_device *dev) static int mcf8390_probe(struct platform_device *pdev) { struct net_device *dev; - struct resource *mem, *irq; + struct resource *mem; resource_size_t msize; - int ret; + int ret, irq; =20 - irq =3D platform_get_resource(pdev, IORESOURCE_IRQ, 0); - if (irq =3D=3D NULL) { + irq =3D platform_get_irq(pdev, 0); + if (irq < 0) { dev_err(&pdev->dev, "no IRQ specified?\n"); return -ENXIO; } @@ -434,7 +434,7 @@ static int mcf8390_probe(struct platform_device *pdev) SET_NETDEV_DEV(dev, &pdev->dev); platform_set_drvdata(pdev, dev); =20 - dev->irq =3D irq->start; + dev->irq =3D irq; dev->base_addr =3D mem->start; =20 ret =3D mcf8390_init(dev); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1F40EC433FE for ; Tue, 5 Apr 2022 20:28:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1379463AbiDEU20 (ORCPT ); Tue, 5 Apr 2022 16:28:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46882 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354563AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8EF626B517; Tue, 5 Apr 2022 03:01:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 405D9B81C83; Tue, 5 Apr 2022 10:01:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9CADEC385A2; Tue, 5 Apr 2022 10:01:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152861; bh=nvJSjfUzdyfl7X7w93Dpr0la56OjHvfArrJRZFWJl14=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LI/x7LIrJ21QjzBQkkyMfkvX0srwgPJigYl0rFUnD0gxs2bERlWT1PytGYUnDuDdA jQzWE6JGD7YulTBqTTd8nwNpDwQvoLApoSLwyEZx8wYw6MRXO4hSPIuI2WYBJausqV d5+SQOPP3ABqLOWej3E+HCHDMHB7ZN5twcM7Ggkk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bartosz Golaszewski , Michael Walle , Thorsten Leemhuis , Marcelo Roberto Jimenez , Linus Torvalds , Sasha Levin , Guenter Roeck Subject: [PATCH 5.10 016/599] Revert "gpio: Revert regression in sysfs-gpio (gpiolib.c)" Date: Tue, 5 Apr 2022 09:25:10 +0200 Message-Id: <20220405070259.300045137@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bartosz Golaszewski [ Upstream commit 56e337f2cf1326323844927a04e9dbce9a244835 ] This reverts commit fc328a7d1fcce263db0b046917a66f3aa6e68719. This commit - while attempting to fix a regression - has caused a number of other problems. As the fallout from it is more significant than the initial problem itself, revert it for now before we find a correct solution. Link: https://lore.kernel.org/all/20220314192522.GA3031157@roeck-us.net/ Link: https://lore.kernel.org/stable/20220314155509.552218-1-michael@walle.= cc/ Link: https://lore.kernel.org/all/20211217153555.9413-1-marcelo.jimenez@gma= il.com/ Signed-off-by: Bartosz Golaszewski Reported-and-bisected-by: Guenter Roeck Reported-by: Michael Walle Cc: Thorsten Leemhuis Cc: Marcelo Roberto Jimenez Signed-off-by: Linus Torvalds Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpio/gpiolib.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c index bbf34d84636d..00526fdd7691 100644 --- a/drivers/gpio/gpiolib.c +++ b/drivers/gpio/gpiolib.c @@ -1804,6 +1804,11 @@ static inline void gpiochip_irqchip_free_valid_mask(= struct gpio_chip *gc) */ int gpiochip_generic_request(struct gpio_chip *gc, unsigned offset) { +#ifdef CONFIG_PINCTRL + if (list_empty(&gc->gpiodev->pin_ranges)) + return 0; +#endif + return pinctrl_gpio_request(gc->gpiodev->base + offset); } EXPORT_SYMBOL_GPL(gpiochip_generic_request); @@ -1815,6 +1820,11 @@ EXPORT_SYMBOL_GPL(gpiochip_generic_request); */ void gpiochip_generic_free(struct gpio_chip *gc, unsigned offset) { +#ifdef CONFIG_PINCTRL + if (list_empty(&gc->gpiodev->pin_ranges)) + return; +#endif + pinctrl_gpio_free(gc->gpiodev->base + offset); } EXPORT_SYMBOL_GPL(gpiochip_generic_free); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BCC13C433FE for ; Tue, 5 Apr 2022 22:56:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1456082AbiDEWpP (ORCPT ); Tue, 5 Apr 2022 18:45:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46880 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354562AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A27176B51E; Tue, 5 Apr 2022 03:01:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3FFCD6172B; Tue, 5 Apr 2022 10:01:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50B48C385A1; Tue, 5 Apr 2022 10:01:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152863; bh=4RJxg9sFpf0XnO3T0Y7aRhplR65wf1OiryRNWgxLIpg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B7gEK5UKBcfXoYhJULITgftjJOHct5/sg1a67uC3FwgIzgzVhc0ha93JnkM+cunqQ YujLMOYVTvJ8BtV2ul9g+kP37ublEk6iFcGjZWMMaC4jW2XuN6l48/EO/2nhnL/j92 MKUo2IUz3DxcM66SpVuWz5xMnW6HRD3nRahM9Qo8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Geert Uytterhoeven , Biju Das , Lad Prabhakar , Mark Brown , Sasha Levin Subject: [PATCH 5.10 017/599] spi: Fix erroneous sgs value with min_t() Date: Tue, 5 Apr 2022 09:25:11 +0200 Message-Id: <20220405070259.329330392@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Biju Das [ Upstream commit ebc4cb43ea5ada3db46c80156fca58a54b9bbca8 ] While computing sgs in spi_map_buf(), the data type used in min_t() for max_seg_size is 'unsigned int' where as that of ctlr->max_dma_len is 'size_t'. min_t(unsigned int,x,y) gives wrong results if one of x/y is 'size_t' Consider the below examples on a 64-bit machine (ie size_t is 64-bits, and unsigned int is 32-bit). case 1) min_t(unsigned int, 5, 0x100000001); case 2) min_t(size_t, 5, 0x100000001); Case 1 returns '1', where as case 2 returns '5'. As you can see the result from case 1 is wrong. This patch fixes the above issue by using the data type of the parameters that are used in min_t with maximum data length. Fixes: commit 1a4e53d2fc4f68aa ("spi: Fix invalid sgs value") Reported-by: Linus Torvalds Suggested-by: Geert Uytterhoeven Signed-off-by: Biju Das Reviewed-by: Lad Prabhakar Link: https://lore.kernel.org/r/20220316175317.465-1-biju.das.jz@bp.renesas= .com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/spi/spi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c index 2396565fc91b..6ea7b286c80c 100644 --- a/drivers/spi/spi.c +++ b/drivers/spi/spi.c @@ -881,10 +881,10 @@ int spi_map_buf(struct spi_controller *ctlr, struct d= evice *dev, int i, ret; =20 if (vmalloced_buf || kmap_buf) { - desc_len =3D min_t(unsigned int, max_seg_size, PAGE_SIZE); + desc_len =3D min_t(unsigned long, max_seg_size, PAGE_SIZE); sgs =3D DIV_ROUND_UP(len + offset_in_page(buf), desc_len); } else if (virt_addr_valid(buf)) { - desc_len =3D min_t(unsigned int, max_seg_size, ctlr->max_dma_len); + desc_len =3D min_t(size_t, max_seg_size, ctlr->max_dma_len); sgs =3D DIV_ROUND_UP(len, desc_len); } else { return -EINVAL; --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5FF1AC433F5 for ; Tue, 5 Apr 2022 20:16:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1448887AbiDEUKJ (ORCPT ); Tue, 5 Apr 2022 16:10:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55162 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354566AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3F88F6B52D; Tue, 5 Apr 2022 03:01:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E6A2AB81B96; Tue, 5 Apr 2022 10:01:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CD25C385A3; Tue, 5 Apr 2022 10:01:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152866; bh=/yE+Sme9P6DeiwPLI0+q7oIXGmD4IVHQHa6leBP2hnE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=af/ELiisyqwl+uyCdm+JTB8essBYmXtML3uKFtBS6Vzfmg9kZArcJKg7uOgcOupb/ xMS8jydjegpiMyVjy6cM3VfolStTWA7vy5hMUUv9UR4RvjcXQYhdx3GmfXVKNUhxGP Ff1GH9YtFGtNq4q7w6VRKqtea303WQKUwPrGrab4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Walleij , Dmitry Torokhov , Sasha Levin Subject: [PATCH 5.10 018/599] Input: zinitix - do not report shadow fingers Date: Tue, 5 Apr 2022 09:25:12 +0200 Message-Id: <20220405070259.359473809@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Walleij [ Upstream commit e941dc13fd3717122207d74539ab95da07ef797f ] I observed the following problem with the BT404 touch pad running the Phosh UI: When e.g. typing on the virtual keyboard pressing "g" would produce "ggg". After some analysis it turns out the firmware reports that three fingers hit that coordinate at the same time, finger 0, 2 and 4 (of the five available 0,1,2,3,4). DOWN Zinitix-TS 3-0020: finger 0 down (246, 395) Zinitix-TS 3-0020: finger 1 up (0, 0) Zinitix-TS 3-0020: finger 2 down (246, 395) Zinitix-TS 3-0020: finger 3 up (0, 0) Zinitix-TS 3-0020: finger 4 down (246, 395) UP Zinitix-TS 3-0020: finger 0 up (246, 395) Zinitix-TS 3-0020: finger 2 up (246, 395) Zinitix-TS 3-0020: finger 4 up (246, 395) This is one touch and release: i.e. this is all reported on touch (down) and release. There is a field in the struct touch_event called finger_cnt which is actually a bitmask of the fingers active in the event. Rename this field finger_mask as this matches the use contents better, then use for_each_set_bit() to iterate over just the fingers that are actally active. Factor out a finger reporting function zinitix_report_fingers() to handle all fingers. Also be more careful in reporting finger down/up: we were reporting every event with input_mt_report_slot_state(..., true); but this should only be reported on finger down or move, not on finger up, so also add code to check p->sub_status to see what is happening and report correctly. After this my Zinitix BT404 touchscreen report fingers flawlessly. The vendor drive I have notably does not use the "finger_cnt" and contains obviously incorrect code like this: if (touch_dev->touch_info.finger_cnt > MAX_SUPPORTED_FINGER_NUM) touch_dev->touch_info.finger_cnt =3D MAX_SUPPORTED_FINGER_NUM; As MAX_SUPPORTED_FINGER_NUM is an ordinal and the field is a bitmask this seems quite confused. Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220228233017.2270599-1-linus.walleij@lina= ro.org Signed-off-by: Dmitry Torokhov Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/input/touchscreen/zinitix.c | 44 +++++++++++++++++++++++------ 1 file changed, 35 insertions(+), 9 deletions(-) diff --git a/drivers/input/touchscreen/zinitix.c b/drivers/input/touchscree= n/zinitix.c index 6df6f07f1ac6..17b10b81c713 100644 --- a/drivers/input/touchscreen/zinitix.c +++ b/drivers/input/touchscreen/zinitix.c @@ -135,7 +135,7 @@ struct point_coord { =20 struct touch_event { __le16 status; - u8 finger_cnt; + u8 finger_mask; u8 time_stamp; struct point_coord point_coord[MAX_SUPPORTED_FINGER_NUM]; }; @@ -311,11 +311,32 @@ static int zinitix_send_power_on_sequence(struct bt54= 1_ts_data *bt541) static void zinitix_report_finger(struct bt541_ts_data *bt541, int slot, const struct point_coord *p) { + u16 x, y; + + if (unlikely(!(p->sub_status & + (SUB_BIT_UP | SUB_BIT_DOWN | SUB_BIT_MOVE)))) { + dev_dbg(&bt541->client->dev, "unknown finger event %#02x\n", + p->sub_status); + return; + } + + x =3D le16_to_cpu(p->x); + y =3D le16_to_cpu(p->y); + input_mt_slot(bt541->input_dev, slot); - input_mt_report_slot_state(bt541->input_dev, MT_TOOL_FINGER, true); - touchscreen_report_pos(bt541->input_dev, &bt541->prop, - le16_to_cpu(p->x), le16_to_cpu(p->y), true); - input_report_abs(bt541->input_dev, ABS_MT_TOUCH_MAJOR, p->width); + if (input_mt_report_slot_state(bt541->input_dev, MT_TOOL_FINGER, + !(p->sub_status & SUB_BIT_UP))) { + touchscreen_report_pos(bt541->input_dev, + &bt541->prop, x, y, true); + input_report_abs(bt541->input_dev, + ABS_MT_TOUCH_MAJOR, p->width); + dev_dbg(&bt541->client->dev, "finger %d %s (%u, %u)\n", + slot, p->sub_status & SUB_BIT_DOWN ? "down" : "move", + x, y); + } else { + dev_dbg(&bt541->client->dev, "finger %d up (%u, %u)\n", + slot, x, y); + } } =20 static irqreturn_t zinitix_ts_irq_handler(int irq, void *bt541_handler) @@ -323,6 +344,7 @@ static irqreturn_t zinitix_ts_irq_handler(int irq, void= *bt541_handler) struct bt541_ts_data *bt541 =3D bt541_handler; struct i2c_client *client =3D bt541->client; struct touch_event touch_event; + unsigned long finger_mask; int error; int i; =20 @@ -335,10 +357,14 @@ static irqreturn_t zinitix_ts_irq_handler(int irq, vo= id *bt541_handler) goto out; } =20 - for (i =3D 0; i < MAX_SUPPORTED_FINGER_NUM; i++) - if (touch_event.point_coord[i].sub_status & SUB_BIT_EXIST) - zinitix_report_finger(bt541, i, - &touch_event.point_coord[i]); + finger_mask =3D touch_event.finger_mask; + for_each_set_bit(i, &finger_mask, MAX_SUPPORTED_FINGER_NUM) { + const struct point_coord *p =3D &touch_event.point_coord[i]; + + /* Only process contacts that are actually reported */ + if (p->sub_status & SUB_BIT_EXIST) + zinitix_report_finger(bt541, i, p); + } =20 input_mt_sync_frame(bt541->input_dev); input_sync(bt541->input_dev); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1E8CC43217 for ; Wed, 6 Apr 2022 00:35:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1444878AbiDFAYw (ORCPT ); Tue, 5 Apr 2022 20:24:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354567AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 44EEA6BDC0; Tue, 5 Apr 2022 03:01:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D53876172B; Tue, 5 Apr 2022 10:01:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E2B02C385A2; Tue, 5 Apr 2022 10:01:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152869; bh=d/cY7PKqDZsO7roqJnKo+pFXp8Zl8yqMxxZoCi2Jn6o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IOscMeEr3J+uvHlOJw1W1YMSeaEpr83PYtJEVDicnVI12qlJOLBJ2nHqNnvVqjhw/ Z7SYWeHChm5GF4x81ufWS2JynMExa8TUcAWGCUaXZVfHJ0KxPKi/KccwZUU1tunfWU wNVFr6cm6cx0NijgpRe64Wudc+iBUMWdL1eMecCE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TCS Robot , Haimin Zhang , Steffen Klassert , Sasha Levin Subject: [PATCH 5.10 019/599] af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register Date: Tue, 5 Apr 2022 09:25:13 +0200 Message-Id: <20220405070259.388646405@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Haimin Zhang [ Upstream commit 9a564bccb78a76740ea9d75a259942df8143d02c ] Add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register to initialize the buffer of supp_skb to fix a kernel-info-leak issue. 1) Function pfkey_register calls compose_sadb_supported to request a sk_buff. 2) compose_sadb_supported calls alloc_sbk to allocate a sk_buff, but it doesn't zero it. 3) If auth_len is greater 0, then compose_sadb_supported treats the memory as a struct sadb_supported and begins to initialize. But it just initializes the field sadb_supported_len and field sadb_supported_exttype without field sadb_supported_reserved. Reported-by: TCS Robot Signed-off-by: Haimin Zhang Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/key/af_key.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index d1364b858fdf..bd9b5c573b5a 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -1703,7 +1703,7 @@ static int pfkey_register(struct sock *sk, struct sk_= buff *skb, const struct sad =20 xfrm_probe_algs(); =20 - supp_skb =3D compose_sadb_supported(hdr, GFP_KERNEL); + supp_skb =3D compose_sadb_supported(hdr, GFP_KERNEL | __GFP_ZERO); if (!supp_skb) { if (hdr->sadb_msg_satype !=3D SADB_SATYPE_UNSPEC) pfk->registered &=3D ~(1<sadb_msg_satype); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20C7DC433FE for ; Wed, 6 Apr 2022 00:26:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1588147AbiDFAOb (ORCPT ); Tue, 5 Apr 2022 20:14:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354570AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D2D366BDC3; Tue, 5 Apr 2022 03:01:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E1A261673; Tue, 5 Apr 2022 10:01:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75E88C385A1; Tue, 5 Apr 2022 10:01:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152874; bh=FIT3wawucFWfzyjni/wMaQn1OA4tnDnV0gudXsZTwlc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=04Ru8TKdjl+iQgt2jyTgtZfYGclEd5W2LeiaP4VcRq93H5qy9rqA1KoEuzJpDaMj9 l4ZPE/m4fVLnGwrHfpdQtGSlt5haebWGtFHBr1MsKFoGeWZicup49eHIChM8VTktft nniR//qI7nVcT3s9CZWCGN2yJQG2zfrD98/CK2OY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Claudiu Beznea , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 020/599] net: dsa: microchip: add spi_device_id tables Date: Tue, 5 Apr 2022 09:25:14 +0200 Message-Id: <20220405070259.418169239@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Claudiu Beznea [ Upstream commit e981bc74aefc6a177b50c16cfa7023599799cf74 ] Add spi_device_id tables to avoid logs like "SPI driver ksz9477-switch has no spi_device_id". Signed-off-by: Claudiu Beznea Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/dsa/microchip/ksz8795_spi.c | 11 +++++++++++ drivers/net/dsa/microchip/ksz9477_spi.c | 12 ++++++++++++ 2 files changed, 23 insertions(+) diff --git a/drivers/net/dsa/microchip/ksz8795_spi.c b/drivers/net/dsa/micr= ochip/ksz8795_spi.c index 8b00f8e6c02f..5639c5c59e25 100644 --- a/drivers/net/dsa/microchip/ksz8795_spi.c +++ b/drivers/net/dsa/microchip/ksz8795_spi.c @@ -86,12 +86,23 @@ static const struct of_device_id ksz8795_dt_ids[] =3D { }; MODULE_DEVICE_TABLE(of, ksz8795_dt_ids); =20 +static const struct spi_device_id ksz8795_spi_ids[] =3D { + { "ksz8765" }, + { "ksz8794" }, + { "ksz8795" }, + { "ksz8863" }, + { "ksz8873" }, + { }, +}; +MODULE_DEVICE_TABLE(spi, ksz8795_spi_ids); + static struct spi_driver ksz8795_spi_driver =3D { .driver =3D { .name =3D "ksz8795-switch", .owner =3D THIS_MODULE, .of_match_table =3D of_match_ptr(ksz8795_dt_ids), }, + .id_table =3D ksz8795_spi_ids, .probe =3D ksz8795_spi_probe, .remove =3D ksz8795_spi_remove, .shutdown =3D ksz8795_spi_shutdown, diff --git a/drivers/net/dsa/microchip/ksz9477_spi.c b/drivers/net/dsa/micr= ochip/ksz9477_spi.c index 1142768969c2..9bda83d063e8 100644 --- a/drivers/net/dsa/microchip/ksz9477_spi.c +++ b/drivers/net/dsa/microchip/ksz9477_spi.c @@ -88,12 +88,24 @@ static const struct of_device_id ksz9477_dt_ids[] =3D { }; MODULE_DEVICE_TABLE(of, ksz9477_dt_ids); =20 +static const struct spi_device_id ksz9477_spi_ids[] =3D { + { "ksz9477" }, + { "ksz9897" }, + { "ksz9893" }, + { "ksz9563" }, + { "ksz8563" }, + { "ksz9567" }, + { }, +}; +MODULE_DEVICE_TABLE(spi, ksz9477_spi_ids); + static struct spi_driver ksz9477_spi_driver =3D { .driver =3D { .name =3D "ksz9477-switch", .owner =3D THIS_MODULE, .of_match_table =3D of_match_ptr(ksz9477_dt_ids), }, + .id_table =3D ksz9477_spi_ids, .probe =3D ksz9477_spi_probe, .remove =3D ksz9477_spi_remove, .shutdown =3D ksz9477_spi_shutdown, --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4F558C4167B for ; Wed, 6 Apr 2022 01:30:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1842354AbiDFBbI (ORCPT ); Tue, 5 Apr 2022 21:31:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42602 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354574AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 500E848E55; Tue, 5 Apr 2022 03:01:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 14036B81B96; Tue, 5 Apr 2022 10:01:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 74372C385A1; Tue, 5 Apr 2022 10:01:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152877; bh=zTkIlxHMHoKKV9SZz13H6R9GwmKrGgfVELCZXZEtKxU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ajdHqvhKzRh0kbYzIvjKDtoXl7XwunMyB6IEjbLnIm3tiVexgcLb2i/9y9Wgqm0oX 0eqehz8h1/oZscDSEqcoI1XsbfKiX7ufGcNHk9hcjUt0A3aoPBFwrgEykimxM9DUHB KbpzdenUyIGiSfloRUmY2s3XAXtzzH6sdNyfJvvA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tetsuo Handa , Waiman Long , "Peter Zijlstra (Intel)" , Bart Van Assche , Cheng-Jui Wang Subject: [PATCH 5.10 021/599] locking/lockdep: Avoid potential access of invalid memory in lock_class Date: Tue, 5 Apr 2022 09:25:15 +0200 Message-Id: <20220405070259.447667012@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Waiman Long commit 61cc4534b6550997c97a03759ab46b29d44c0017 upstream. It was found that reading /proc/lockdep after a lockdep splat may potentially cause an access to freed memory if lockdep_unregister_key() is called after the splat but before access to /proc/lockdep [1]. This is due to the fact that graph_lock() call in lockdep_unregister_key() fails after the clearing of debug_locks by the splat process. After lockdep_unregister_key() is called, the lock_name may be freed but the corresponding lock_class structure still have a reference to it. That invalid memory pointer will then be accessed when /proc/lockdep is read by a user and a use-after-free (UAF) error will be reported if KASAN is enabled. To fix this problem, lockdep_unregister_key() is now modified to always search for a matching key irrespective of the debug_locks state and zap the corresponding lock class if a matching one is found. [1] https://lore.kernel.org/lkml/77f05c15-81b6-bddd-9650-80d5f23fe330@i-lov= e.sakura.ne.jp/ Fixes: 8b39adbee805 ("locking/lockdep: Make lockdep_unregister_key() honor = 'debug_locks' again") Reported-by: Tetsuo Handa Signed-off-by: Waiman Long Signed-off-by: Peter Zijlstra (Intel) Reviewed-by: Bart Van Assche Cc: Cheng-Jui Wang Link: https://lkml.kernel.org/r/20220103023558.1377055-1-longman@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/locking/lockdep.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) --- a/kernel/locking/lockdep.c +++ b/kernel/locking/lockdep.c @@ -6209,7 +6209,13 @@ void lockdep_reset_lock(struct lockdep_m lockdep_reset_lock_reg(lock); } =20 -/* Unregister a dynamically allocated key. */ +/* + * Unregister a dynamically allocated key. + * + * Unlike lockdep_register_key(), a search is always done to find a matchi= ng + * key irrespective of debug_locks to avoid potential invalid access to fr= eed + * memory in lock_class entry. + */ void lockdep_unregister_key(struct lock_class_key *key) { struct hlist_head *hash_head =3D keyhashentry(key); @@ -6224,10 +6230,8 @@ void lockdep_unregister_key(struct lock_ return; =20 raw_local_irq_save(flags); - if (!graph_lock()) - goto out_irq; + lockdep_lock(); =20 - pf =3D get_pending_free(); hlist_for_each_entry_rcu(k, hash_head, hash_entry) { if (k =3D=3D key) { hlist_del_rcu(&k->hash_entry); @@ -6235,11 +6239,13 @@ void lockdep_unregister_key(struct lock_ break; } } - WARN_ON_ONCE(!found); - __lockdep_free_key_range(pf, key, 1); - call_rcu_zapped(pf); - graph_unlock(); -out_irq: + WARN_ON_ONCE(!found && debug_locks); + if (found) { + pf =3D get_pending_free(); + __lockdep_free_key_range(pf, key, 1); + call_rcu_zapped(pf); + } + lockdep_unlock(); raw_local_irq_restore(flags); =20 /* Wait until is_dynamic_key() has finished accessing k->hash_entry. */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1706C433F5 for ; Wed, 6 Apr 2022 02:08:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1846468AbiDFCER (ORCPT ); Tue, 5 Apr 2022 22:04:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33786 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354572AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 44ECC48E65; Tue, 5 Apr 2022 03:01:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DD408B81C83; Tue, 5 Apr 2022 10:01:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B4B1C385A1; Tue, 5 Apr 2022 10:01:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152880; bh=VwFEHE+CO5lRFmJFYl4MnPfpyZ8Welh346AwcCF/UoQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=flmTRyDC0QWzr7pRoMQ67lyKpYC3ZqOqKVDjk6+1UG3lZYiOld+myEh8GPRSyPYee NkcrNyHN3bbKjWZFfg1KvfYXx3diFaFmYkhgdAh5ReyyFcy8vgP6OUYevN/JxiWM5V 7Frd7kMqvtL0Cj5su9v+4DSXW0370WMl/kbGNUOg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yunfei Wang , Robin Murphy , Miles Chen , Joerg Roedel Subject: [PATCH 5.10 022/599] iommu/iova: Improve 32-bit free space estimate Date: Tue, 5 Apr 2022 09:25:16 +0200 Message-Id: <20220405070259.477224916@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robin Murphy commit 5b61343b50590fb04a3f6be2cdc4868091757262 upstream. For various reasons based on the allocator behaviour and typical use-cases at the time, when the max32_alloc_size optimisation was introduced it seemed reasonable to couple the reset of the tracked size to the update of cached32_node upon freeing a relevant IOVA. However, since subsequent optimisations focused on helping genuine 32-bit devices make best use of even more limited address spaces, it is now a lot more likely for cached32_node to be anywhere in a "full" 32-bit address space, and as such more likely for space to become available from IOVAs below that node being freed. At this point, the short-cut in __cached_rbnode_delete_update() really doesn't hold up any more, and we need to fix the logic to reliably provide the expected behaviour. We still want cached32_node to only move upwards, but we should reset the allocation size if *any* 32-bit space has become available. Reported-by: Yunfei Wang Signed-off-by: Robin Murphy Reviewed-by: Miles Chen Link: https://lore.kernel.org/r/033815732d83ca73b13c11485ac39336f15c3b40.16= 46318408.git.robin.murphy@arm.com Signed-off-by: Joerg Roedel Cc: Miles Chen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iommu/iova.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -138,10 +138,11 @@ __cached_rbnode_delete_update(struct iov cached_iova =3D rb_entry(iovad->cached32_node, struct iova, node); if (free =3D=3D cached_iova || (free->pfn_hi < iovad->dma_32bit_pfn && - free->pfn_lo >=3D cached_iova->pfn_lo)) { + free->pfn_lo >=3D cached_iova->pfn_lo)) iovad->cached32_node =3D rb_next(&free->node); + + if (free->pfn_lo < iovad->dma_32bit_pfn) iovad->max32_alloc_size =3D iovad->dma_32bit_pfn; - } =20 cached_iova =3D rb_entry(iovad->cached_node, struct iova, node); if (free->pfn_lo >=3D cached_iova->pfn_lo) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CE20C4332F for ; Wed, 6 Apr 2022 00:59:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839295AbiDFA66 (ORCPT ); Tue, 5 Apr 2022 20:58:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354571AbiDEKOj (ORCPT ); Tue, 5 Apr 2022 06:14:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 22B4C49266; Tue, 5 Apr 2022 03:01:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CD1A0B818F6; Tue, 5 Apr 2022 10:01:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 16550C385A1; Tue, 5 Apr 2022 10:01:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152883; bh=6Sc/nEp1YQpqCnUiOIwE9hzFknnWAClLQ50pX8UH0x8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CQXszboEfYWMP56gS0810Yw6R2njb9kgB/O56rOSVqk/aG9lFTJDi7fQThcWrcw+9 ZFPJDSVrGFFMA0912737ZmdfSFmLouz7bKeDaLTX8F0ksLlDpaUOKRh23eV6TumZnS Ew3Uj3QDDmcYv0q1vw+kI36G8v/F4lcYcNckOl9U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jason Gunthorpe , Lino Sanfilippo , Stefan Berger , Jason Gunthorpe , Jarkko Sakkinen Subject: [PATCH 5.10 023/599] tpm: fix reference counting for struct tpm_chip Date: Tue, 5 Apr 2022 09:25:17 +0200 Message-Id: <20220405070259.507510462@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lino Sanfilippo commit 7e0438f83dc769465ee663bb5dcf8cc154940712 upstream. The following sequence of operations results in a refcount warning: 1. Open device /dev/tpmrm. 2. Remove module tpm_tis_spi. 3. Write a TPM command to the file descriptor opened at step 1. Reviewed-by: Jarkko Sakkinen Reviewed-by: Jason Gunthorpe Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Stefan Berger Tested-by: Sudip Mukherjee ------------[ cut here ]------------ WARNING: CPU: 3 PID: 1161 at lib/refcount.c:25 kobject_get+0xa0/0xa4 refcount_t: addition on 0; use-after-free. Modules linked in: tpm_tis_spi tpm_tis_core tpm mdio_bcm_unimac brcmfmac sha256_generic libsha256 sha256_arm hci_uart btbcm bluetooth cfg80211 vc4 brcmutil ecdh_generic ecc snd_soc_core crc32_arm_ce libaes raspberrypi_hwmon ac97_bus snd_pcm_dmaengine bcm2711_thermal snd_pcm snd_timer genet snd phy_generic soundcore [last unloaded: spi_bcm2835] CPU: 3 PID: 1161 Comm: hold_open Not tainted 5.10.0ls-main-dirty #2 Hardware name: BCM2711 [] (unwind_backtrace) from [] (show_stack+0x10/0x14) [] (show_stack) from [] (dump_stack+0xc4/0xd8) [] (dump_stack) from [] (__warn+0x104/0x108) [] (__warn) from [] (warn_slowpath_fmt+0x74/0xb8) [] (warn_slowpath_fmt) from [] (kobject_get+0xa0/0xa4) [] (kobject_get) from [] (tpm_try_get_ops+0x14/0x54 [tp= m]) [] (tpm_try_get_ops [tpm]) from [] (tpm_common_write+0x= 38/0x60 [tpm]) [] (tpm_common_write [tpm]) from [] (vfs_write+0xc4/0x3= c0) [] (vfs_write) from [] (ksys_write+0x58/0xcc) [] (ksys_write) from [] (ret_fast_syscall+0x0/0x4c) Exception stack(0xc226bfa8 to 0xc226bff0) bfa0: 00000000 000105b4 00000003 beafe664 00000014 000000= 00 bfc0: 00000000 000105b4 000103f8 00000004 00000000 00000000 b6f9c000 beafe6= 84 bfe0: 0000006c beafe648 0001056c b6eb6944 ---[ end trace d4b8409def9b8b1f ]--- The reason for this warning is the attempt to get the chip->dev reference in tpm_common_write() although the reference counter is already zero. Since commit 8979b02aaf1d ("tpm: Fix reference count to main device") the extra reference used to prevent a premature zero counter is never taken, because the required TPM_CHIP_FLAG_TPM2 flag is never set. Fix this by moving the TPM 2 character device handling from tpm_chip_alloc() to tpm_add_char_device() which is called at a later point in time when the flag has been set in case of TPM2. Commit fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm") already introduced function tpm_devs_release() to release the extra reference but did not implement the required put on chip->devs that results in the call of this function. Fix this by putting chip->devs in tpm_chip_unregister(). Finally move the new implementation for the TPM 2 handling into a new function to avoid multiple checks for the TPM_CHIP_FLAG_TPM2 flag in the good case and error cases. Cc: stable@vger.kernel.org Fixes: fdc915f7f719 ("tpm: expose spaces via a device link /dev/tpmrm") Fixes: 8979b02aaf1d ("tpm: Fix reference count to main device") Co-developed-by: Jason Gunthorpe Signed-off-by: Jason Gunthorpe Signed-off-by: Lino Sanfilippo Tested-by: Stefan Berger Reviewed-by: Jason Gunthorpe Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: Greg Kroah-Hartman --- drivers/char/tpm/tpm-chip.c | 46 +++++------------------------ drivers/char/tpm/tpm.h | 2 + drivers/char/tpm/tpm2-space.c | 65 +++++++++++++++++++++++++++++++++++++= +++++ 3 files changed, 75 insertions(+), 38 deletions(-) --- a/drivers/char/tpm/tpm-chip.c +++ b/drivers/char/tpm/tpm-chip.c @@ -274,14 +274,6 @@ static void tpm_dev_release(struct devic kfree(chip); } =20 -static void tpm_devs_release(struct device *dev) -{ - struct tpm_chip *chip =3D container_of(dev, struct tpm_chip, devs); - - /* release the master device reference */ - put_device(&chip->dev); -} - /** * tpm_class_shutdown() - prepare the TPM device for loss of power. * @dev: device to which the chip is associated. @@ -344,7 +336,6 @@ struct tpm_chip *tpm_chip_alloc(struct d chip->dev_num =3D rc; =20 device_initialize(&chip->dev); - device_initialize(&chip->devs); =20 chip->dev.class =3D tpm_class; chip->dev.class->shutdown_pre =3D tpm_class_shutdown; @@ -352,39 +343,20 @@ struct tpm_chip *tpm_chip_alloc(struct d chip->dev.parent =3D pdev; chip->dev.groups =3D chip->groups; =20 - chip->devs.parent =3D pdev; - chip->devs.class =3D tpmrm_class; - chip->devs.release =3D tpm_devs_release; - /* get extra reference on main device to hold on - * behalf of devs. This holds the chip structure - * while cdevs is in use. The corresponding put - * is in the tpm_devs_release (TPM2 only) - */ - if (chip->flags & TPM_CHIP_FLAG_TPM2) - get_device(&chip->dev); - if (chip->dev_num =3D=3D 0) chip->dev.devt =3D MKDEV(MISC_MAJOR, TPM_MINOR); else chip->dev.devt =3D MKDEV(MAJOR(tpm_devt), chip->dev_num); =20 - chip->devs.devt =3D - MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICES); - rc =3D dev_set_name(&chip->dev, "tpm%d", chip->dev_num); if (rc) goto out; - rc =3D dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); - if (rc) - goto out; =20 if (!pdev) chip->flags |=3D TPM_CHIP_FLAG_VIRTUAL; =20 cdev_init(&chip->cdev, &tpm_fops); - cdev_init(&chip->cdevs, &tpmrm_fops); chip->cdev.owner =3D THIS_MODULE; - chip->cdevs.owner =3D THIS_MODULE; =20 rc =3D tpm2_init_space(&chip->work_space, TPM2_SPACE_BUFFER_SIZE); if (rc) { @@ -396,7 +368,6 @@ struct tpm_chip *tpm_chip_alloc(struct d return chip; =20 out: - put_device(&chip->devs); put_device(&chip->dev); return ERR_PTR(rc); } @@ -445,14 +416,9 @@ static int tpm_add_char_device(struct tp } =20 if (chip->flags & TPM_CHIP_FLAG_TPM2) { - rc =3D cdev_device_add(&chip->cdevs, &chip->devs); - if (rc) { - dev_err(&chip->devs, - "unable to cdev_device_add() %s, major %d, minor %d, err=3D%d\n", - dev_name(&chip->devs), MAJOR(chip->devs.devt), - MINOR(chip->devs.devt), rc); - return rc; - } + rc =3D tpm_devs_add(chip); + if (rc) + goto err_del_cdev; } =20 /* Make the chip available. */ @@ -460,6 +426,10 @@ static int tpm_add_char_device(struct tp idr_replace(&dev_nums_idr, chip, chip->dev_num); mutex_unlock(&idr_lock); =20 + return 0; + +err_del_cdev: + cdev_device_del(&chip->cdev, &chip->dev); return rc; } =20 @@ -641,7 +611,7 @@ void tpm_chip_unregister(struct tpm_chip hwrng_unregister(&chip->hwrng); tpm_bios_log_teardown(chip); if (chip->flags & TPM_CHIP_FLAG_TPM2) - cdev_device_del(&chip->cdevs, &chip->devs); + tpm_devs_remove(chip); tpm_del_char_device(chip); } EXPORT_SYMBOL_GPL(tpm_chip_unregister); --- a/drivers/char/tpm/tpm.h +++ b/drivers/char/tpm/tpm.h @@ -234,6 +234,8 @@ int tpm2_prepare_space(struct tpm_chip * size_t cmdsiz); int tpm2_commit_space(struct tpm_chip *chip, struct tpm_space *space, void= *buf, size_t *bufsiz); +int tpm_devs_add(struct tpm_chip *chip); +void tpm_devs_remove(struct tpm_chip *chip); =20 void tpm_bios_log_setup(struct tpm_chip *chip); void tpm_bios_log_teardown(struct tpm_chip *chip); --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -574,3 +574,68 @@ out: dev_err(&chip->dev, "%s: error %d\n", __func__, rc); return rc; } + +/* + * Put the reference to the main device. + */ +static void tpm_devs_release(struct device *dev) +{ + struct tpm_chip *chip =3D container_of(dev, struct tpm_chip, devs); + + /* release the master device reference */ + put_device(&chip->dev); +} + +/* + * Remove the device file for exposed TPM spaces and release the device + * reference. This may also release the reference to the master device. + */ +void tpm_devs_remove(struct tpm_chip *chip) +{ + cdev_device_del(&chip->cdevs, &chip->devs); + put_device(&chip->devs); +} + +/* + * Add a device file to expose TPM spaces. Also take a reference to the + * main device. + */ +int tpm_devs_add(struct tpm_chip *chip) +{ + int rc; + + device_initialize(&chip->devs); + chip->devs.parent =3D chip->dev.parent; + chip->devs.class =3D tpmrm_class; + + /* + * Get extra reference on main device to hold on behalf of devs. + * This holds the chip structure while cdevs is in use. The + * corresponding put is in the tpm_devs_release. + */ + get_device(&chip->dev); + chip->devs.release =3D tpm_devs_release; + chip->devs.devt =3D MKDEV(MAJOR(tpm_devt), chip->dev_num + TPM_NUM_DEVICE= S); + cdev_init(&chip->cdevs, &tpmrm_fops); + chip->cdevs.owner =3D THIS_MODULE; + + rc =3D dev_set_name(&chip->devs, "tpmrm%d", chip->dev_num); + if (rc) + goto err_put_devs; + + rc =3D cdev_device_add(&chip->cdevs, &chip->devs); + if (rc) { + dev_err(&chip->devs, + "unable to cdev_device_add() %s, major %d, minor %d, err=3D%d\n", + dev_name(&chip->devs), MAJOR(chip->devs.devt), + MINOR(chip->devs.devt), rc); + goto err_put_devs; + } + + return 0; + +err_put_devs: + put_device(&chip->devs); + + return rc; +} From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ECF23C433FE for ; Wed, 6 Apr 2022 01:10:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1840106AbiDFBHL (ORCPT ); Tue, 5 Apr 2022 21:07:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354577AbiDEKOk (ORCPT ); Tue, 5 Apr 2022 06:14:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 28D204991A; Tue, 5 Apr 2022 03:01:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B87E461676; Tue, 5 Apr 2022 10:01:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C345EC385A2; Tue, 5 Apr 2022 10:01:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152886; bh=na5hAgnCaVoKY/ciAWchSLPD1IiKCXLoiXTbpqxLsgQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fHl9h1uYxEAUJxIRukFflygXn3K0GEiuoOJbtR0qq+9jwXChDU6oIUMDUr71vJ+xx a0/+KTSQvSC04oEZQ7qaS7uzHLfeQpY1SmWpsszoNDD+AZgJheEQGmY/ct1Qs+klTH rbuCYzJBIynylu26tSbMcUNZh2zkYkbmrp3eDgBQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xie Yongji , "Michael S. Tsirkin" , Jens Axboe , Lee Jones Subject: [PATCH 5.10 024/599] virtio-blk: Use blk_validate_block_size() to validate block size Date: Tue, 5 Apr 2022 09:25:18 +0200 Message-Id: <20220405070259.539372553@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xie Yongji commit 57a13a5b8157d9a8606490aaa1b805bafe6c37e1 upstream. The block layer can't support a block size larger than page size yet. And a block size that's too small or not a power of two won't work either. If a misconfigured device presents an invalid block size in configuration space, it will result in the kernel crash something like below: [ 506.154324] BUG: kernel NULL pointer dereference, address: 0000000000000= 008 [ 506.160416] RIP: 0010:create_empty_buffers+0x24/0x100 [ 506.174302] Call Trace: [ 506.174651] create_page_buffers+0x4d/0x60 [ 506.175207] block_read_full_page+0x50/0x380 [ 506.175798] ? __mod_lruvec_page_state+0x60/0xa0 [ 506.176412] ? __add_to_page_cache_locked+0x1b2/0x390 [ 506.177085] ? blkdev_direct_IO+0x4a0/0x4a0 [ 506.177644] ? scan_shadow_nodes+0x30/0x30 [ 506.178206] ? lru_cache_add+0x42/0x60 [ 506.178716] do_read_cache_page+0x695/0x740 [ 506.179278] ? read_part_sector+0xe0/0xe0 [ 506.179821] read_part_sector+0x36/0xe0 [ 506.180337] adfspart_check_ICS+0x32/0x320 [ 506.180890] ? snprintf+0x45/0x70 [ 506.181350] ? read_part_sector+0xe0/0xe0 [ 506.181906] bdev_disk_changed+0x229/0x5c0 [ 506.182483] blkdev_get_whole+0x6d/0x90 [ 506.183013] blkdev_get_by_dev+0x122/0x2d0 [ 506.183562] device_add_disk+0x39e/0x3c0 [ 506.184472] virtblk_probe+0x3f8/0x79b [virtio_blk] [ 506.185461] virtio_dev_probe+0x15e/0x1d0 [virtio] So let's use a block layer helper to validate the block size. Signed-off-by: Xie Yongji Acked-by: Michael S. Tsirkin Link: https://lore.kernel.org/r/20211026144015.188-5-xieyongji@bytedance.com Signed-off-by: Jens Axboe Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/block/virtio_blk.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) --- a/drivers/block/virtio_blk.c +++ b/drivers/block/virtio_blk.c @@ -825,9 +825,17 @@ static int virtblk_probe(struct virtio_d err =3D virtio_cread_feature(vdev, VIRTIO_BLK_F_BLK_SIZE, struct virtio_blk_config, blk_size, &blk_size); - if (!err) + if (!err) { + err =3D blk_validate_block_size(blk_size); + if (err) { + dev_err(&vdev->dev, + "virtio_blk: invalid block size: 0x%x\n", + blk_size); + goto out_free_tags; + } + blk_queue_logical_block_size(q, blk_size); - else + } else blk_size =3D queue_logical_block_size(q); =20 /* Use topology information if available */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06179C43219 for ; Tue, 5 Apr 2022 23:26:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234475AbiDEXEY (ORCPT ); Tue, 5 Apr 2022 19:04:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354578AbiDEKOk (ORCPT ); Tue, 5 Apr 2022 06:14:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA3514992D; Tue, 5 Apr 2022 03:01:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6635F61673; Tue, 5 Apr 2022 10:01:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7510AC385A1; Tue, 5 Apr 2022 10:01:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152888; bh=1OSCKvFQFQzzuBKRJqUfVGGEkXXX4lPzgIpFFdda5jo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lLzfyorcFGzzrCHHSqUcS4HEK2PMDHeDcuKui/fXA0+7yeXMd1wdgbfMrvhkMKItS IC3Zvl0xqw7xqa0dWEHfS/hOevE8VMg6DXjbp+iM5iBW68RRux3WUrcTPrsxfLffXx FNd/xHpk2tP8eiMzGOyBzPTqrAvT48JwTjLJ1+Ec= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alan Stern Subject: [PATCH 5.10 025/599] USB: usb-storage: Fix use of bitfields for hardware data in ene_ub6250.c Date: Tue, 5 Apr 2022 09:25:19 +0200 Message-Id: <20220405070259.568382551@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alan Stern commit 1892bf90677abcad7f06e897e308f5c3e3618dd4 upstream. The kernel test robot found a problem with the ene_ub6250 subdriver in usb-storage: It uses structures containing bitfields to represent hardware bits in its SD_STATUS, MS_STATUS, and SM_STATUS bytes. This is not safe; it presumes a particular bit ordering and it assumes the compiler will not insert padding, neither of which is guaranteed. This patch fixes the problem by changing the structures to simple u8 values, with the bitfields replaced by bitmask constants. CC: Signed-off-by: Alan Stern Link: https://lore.kernel.org/r/YjOcbuU106UpJ/V8@rowland.harvard.edu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/storage/ene_ub6250.c | 153 +++++++++++++++++++---------------= ----- 1 file changed, 75 insertions(+), 78 deletions(-) --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -237,36 +237,33 @@ static struct us_unusual_dev ene_ub6250_ #define memstick_logaddr(logadr1, logadr0) ((((u16)(logadr1)) << 8) | (log= adr0)) =20 =20 -struct SD_STATUS { - u8 Insert:1; - u8 Ready:1; - u8 MediaChange:1; - u8 IsMMC:1; - u8 HiCapacity:1; - u8 HiSpeed:1; - u8 WtP:1; - u8 Reserved:1; -}; - -struct MS_STATUS { - u8 Insert:1; - u8 Ready:1; - u8 MediaChange:1; - u8 IsMSPro:1; - u8 IsMSPHG:1; - u8 Reserved1:1; - u8 WtP:1; - u8 Reserved2:1; -}; - -struct SM_STATUS { - u8 Insert:1; - u8 Ready:1; - u8 MediaChange:1; - u8 Reserved:3; - u8 WtP:1; - u8 IsMS:1; -}; +/* SD_STATUS bits */ +#define SD_Insert BIT(0) +#define SD_Ready BIT(1) +#define SD_MediaChange BIT(2) +#define SD_IsMMC BIT(3) +#define SD_HiCapacity BIT(4) +#define SD_HiSpeed BIT(5) +#define SD_WtP BIT(6) + /* Bit 7 reserved */ + +/* MS_STATUS bits */ +#define MS_Insert BIT(0) +#define MS_Ready BIT(1) +#define MS_MediaChange BIT(2) +#define MS_IsMSPro BIT(3) +#define MS_IsMSPHG BIT(4) + /* Bit 5 reserved */ +#define MS_WtP BIT(6) + /* Bit 7 reserved */ + +/* SM_STATUS bits */ +#define SM_Insert BIT(0) +#define SM_Ready BIT(1) +#define SM_MediaChange BIT(2) + /* Bits 3-5 reserved */ +#define SM_WtP BIT(6) +#define SM_IsMS BIT(7) =20 struct ms_bootblock_cis { u8 bCistplDEVICE[6]; /* 0 */ @@ -437,9 +434,9 @@ struct ene_ub6250_info { u8 *bbuf; =20 /* for 6250 code */ - struct SD_STATUS SD_Status; - struct MS_STATUS MS_Status; - struct SM_STATUS SM_Status; + u8 SD_Status; + u8 MS_Status; + u8 SM_Status; =20 /* ----- SD Control Data ---------------- */ /*SD_REGISTER SD_Regs; */ @@ -602,7 +599,7 @@ static int sd_scsi_test_unit_ready(struc { struct ene_ub6250_info *info =3D (struct ene_ub6250_info *) us->extra; =20 - if (info->SD_Status.Insert && info->SD_Status.Ready) + if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) return USB_STOR_TRANSPORT_GOOD; else { ene_sd_init(us); @@ -622,7 +619,7 @@ static int sd_scsi_mode_sense(struct us_ 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; =20 - if (info->SD_Status.WtP) + if (info->SD_Status & SD_WtP) usb_stor_set_xfer_buf(mediaWP, 12, srb); else usb_stor_set_xfer_buf(mediaNoWP, 12, srb); @@ -641,9 +638,9 @@ static int sd_scsi_read_capacity(struct struct ene_ub6250_info *info =3D (struct ene_ub6250_info *) us->extra; =20 usb_stor_dbg(us, "sd_scsi_read_capacity\n"); - if (info->SD_Status.HiCapacity) { + if (info->SD_Status & SD_HiCapacity) { bl_len =3D 0x200; - if (info->SD_Status.IsMMC) + if (info->SD_Status & SD_IsMMC) bl_num =3D info->HC_C_SIZE-1; else bl_num =3D (info->HC_C_SIZE + 1) * 1024 - 1; @@ -693,7 +690,7 @@ static int sd_scsi_read(struct us_data * return USB_STOR_TRANSPORT_ERROR; } =20 - if (info->SD_Status.HiCapacity) + if (info->SD_Status & SD_HiCapacity) bnByte =3D bn; =20 /* set up the command wrapper */ @@ -733,7 +730,7 @@ static int sd_scsi_write(struct us_data return USB_STOR_TRANSPORT_ERROR; } =20 - if (info->SD_Status.HiCapacity) + if (info->SD_Status & SD_HiCapacity) bnByte =3D bn; =20 /* set up the command wrapper */ @@ -1455,7 +1452,7 @@ static int ms_scsi_test_unit_ready(struc struct ene_ub6250_info *info =3D (struct ene_ub6250_info *)(us->extra); =20 /* pr_info("MS_SCSI_Test_Unit_Ready\n"); */ - if (info->MS_Status.Insert && info->MS_Status.Ready) { + if ((info->MS_Status & MS_Insert) && (info->MS_Status & MS_Ready)) { return USB_STOR_TRANSPORT_GOOD; } else { ene_ms_init(us); @@ -1475,7 +1472,7 @@ static int ms_scsi_mode_sense(struct us_ 0x0b, 0x00, 0x80, 0x08, 0x00, 0x00, 0x71, 0xc0, 0x00, 0x00, 0x02, 0x00 }; =20 - if (info->MS_Status.WtP) + if (info->MS_Status & MS_WtP) usb_stor_set_xfer_buf(mediaWP, 12, srb); else usb_stor_set_xfer_buf(mediaNoWP, 12, srb); @@ -1494,7 +1491,7 @@ static int ms_scsi_read_capacity(struct =20 usb_stor_dbg(us, "ms_scsi_read_capacity\n"); bl_len =3D 0x200; - if (info->MS_Status.IsMSPro) + if (info->MS_Status & MS_IsMSPro) bl_num =3D info->MSP_TotalBlock - 1; else bl_num =3D info->MS_Lib.NumberOfLogBlock * info->MS_Lib.blockSize * 2 - = 1; @@ -1649,7 +1646,7 @@ static int ms_scsi_read(struct us_data * if (bn > info->bl_num) return USB_STOR_TRANSPORT_ERROR; =20 - if (info->MS_Status.IsMSPro) { + if (info->MS_Status & MS_IsMSPro) { result =3D ene_load_bincode(us, MSP_RW_PATTERN); if (result !=3D USB_STOR_XFER_GOOD) { usb_stor_dbg(us, "Load MPS RW pattern Fail !!\n"); @@ -1750,7 +1747,7 @@ static int ms_scsi_write(struct us_data if (bn > info->bl_num) return USB_STOR_TRANSPORT_ERROR; =20 - if (info->MS_Status.IsMSPro) { + if (info->MS_Status & MS_IsMSPro) { result =3D ene_load_bincode(us, MSP_RW_PATTERN); if (result !=3D USB_STOR_XFER_GOOD) { pr_info("Load MSP RW pattern Fail !!\n"); @@ -1858,12 +1855,12 @@ static int ene_get_card_status(struct us =20 tmpreg =3D (u16) reg4b; reg4b =3D *(u32 *)(&buf[0x14]); - if (info->SD_Status.HiCapacity && !info->SD_Status.IsMMC) + if ((info->SD_Status & SD_HiCapacity) && !(info->SD_Status & SD_IsMMC)) info->HC_C_SIZE =3D (reg4b >> 8) & 0x3fffff; =20 info->SD_C_SIZE =3D ((tmpreg & 0x03) << 10) | (u16)(reg4b >> 22); info->SD_C_SIZE_MULT =3D (u8)(reg4b >> 7) & 0x07; - if (info->SD_Status.HiCapacity && info->SD_Status.IsMMC) + if ((info->SD_Status & SD_HiCapacity) && (info->SD_Status & SD_IsMMC)) info->HC_C_SIZE =3D *(u32 *)(&buf[0x100]); =20 if (info->SD_READ_BL_LEN > SD_BLOCK_LEN) { @@ -2075,6 +2072,7 @@ static int ene_ms_init(struct us_data *u u16 MSP_BlockSize, MSP_UserAreaBlocks; struct ene_ub6250_info *info =3D (struct ene_ub6250_info *) us->extra; u8 *bbuf =3D info->bbuf; + unsigned int s; =20 printk(KERN_INFO "transport --- ENE_MSInit\n"); =20 @@ -2099,15 +2097,16 @@ static int ene_ms_init(struct us_data *u return USB_STOR_TRANSPORT_ERROR; } /* the same part to test ENE */ - info->MS_Status =3D *(struct MS_STATUS *) bbuf; + info->MS_Status =3D bbuf[0]; =20 - if (info->MS_Status.Insert && info->MS_Status.Ready) { - printk(KERN_INFO "Insert =3D %x\n", info->MS_Status.Insert); - printk(KERN_INFO "Ready =3D %x\n", info->MS_Status.Ready); - printk(KERN_INFO "IsMSPro =3D %x\n", info->MS_Status.IsMSPro); - printk(KERN_INFO "IsMSPHG =3D %x\n", info->MS_Status.IsMSPHG); - printk(KERN_INFO "WtP=3D %x\n", info->MS_Status.WtP); - if (info->MS_Status.IsMSPro) { + s =3D info->MS_Status; + if ((s & MS_Insert) && (s & MS_Ready)) { + printk(KERN_INFO "Insert =3D %x\n", !!(s & MS_Insert)); + printk(KERN_INFO "Ready =3D %x\n", !!(s & MS_Ready)); + printk(KERN_INFO "IsMSPro =3D %x\n", !!(s & MS_IsMSPro)); + printk(KERN_INFO "IsMSPHG =3D %x\n", !!(s & MS_IsMSPHG)); + printk(KERN_INFO "WtP=3D %x\n", !!(s & MS_WtP)); + if (s & MS_IsMSPro) { MSP_BlockSize =3D (bbuf[6] << 8) | bbuf[7]; MSP_UserAreaBlocks =3D (bbuf[10] << 8) | bbuf[11]; info->MSP_TotalBlock =3D MSP_BlockSize * MSP_UserAreaBlocks; @@ -2168,17 +2167,17 @@ static int ene_sd_init(struct us_data *u return USB_STOR_TRANSPORT_ERROR; } =20 - info->SD_Status =3D *(struct SD_STATUS *) bbuf; - if (info->SD_Status.Insert && info->SD_Status.Ready) { - struct SD_STATUS *s =3D &info->SD_Status; + info->SD_Status =3D bbuf[0]; + if ((info->SD_Status & SD_Insert) && (info->SD_Status & SD_Ready)) { + unsigned int s =3D info->SD_Status; =20 ene_get_card_status(us, bbuf); - usb_stor_dbg(us, "Insert =3D %x\n", s->Insert); - usb_stor_dbg(us, "Ready =3D %x\n", s->Ready); - usb_stor_dbg(us, "IsMMC =3D %x\n", s->IsMMC); - usb_stor_dbg(us, "HiCapacity =3D %x\n", s->HiCapacity); - usb_stor_dbg(us, "HiSpeed =3D %x\n", s->HiSpeed); - usb_stor_dbg(us, "WtP =3D %x\n", s->WtP); + usb_stor_dbg(us, "Insert =3D %x\n", !!(s & SD_Insert)); + usb_stor_dbg(us, "Ready =3D %x\n", !!(s & SD_Ready)); + usb_stor_dbg(us, "IsMMC =3D %x\n", !!(s & SD_IsMMC)); + usb_stor_dbg(us, "HiCapacity =3D %x\n", !!(s & SD_HiCapacity)); + usb_stor_dbg(us, "HiSpeed =3D %x\n", !!(s & SD_HiSpeed)); + usb_stor_dbg(us, "WtP =3D %x\n", !!(s & SD_WtP)); } else { usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); return USB_STOR_TRANSPORT_ERROR; @@ -2200,14 +2199,14 @@ static int ene_init(struct us_data *us) =20 misc_reg03 =3D bbuf[0]; if (misc_reg03 & 0x01) { - if (!info->SD_Status.Ready) { + if (!(info->SD_Status & SD_Ready)) { result =3D ene_sd_init(us); if (result !=3D USB_STOR_XFER_GOOD) return USB_STOR_TRANSPORT_ERROR; } } if (misc_reg03 & 0x02) { - if (!info->MS_Status.Ready) { + if (!(info->MS_Status & MS_Ready)) { result =3D ene_ms_init(us); if (result !=3D USB_STOR_XFER_GOOD) return USB_STOR_TRANSPORT_ERROR; @@ -2306,14 +2305,14 @@ static int ene_transport(struct scsi_cmn =20 /*US_DEBUG(usb_stor_show_command(us, srb)); */ scsi_set_resid(srb, 0); - if (unlikely(!(info->SD_Status.Ready || info->MS_Status.Ready))) + if (unlikely(!(info->SD_Status & SD_Ready) || (info->MS_Status & MS_Ready= ))) result =3D ene_init(us); if (result =3D=3D USB_STOR_XFER_GOOD) { result =3D USB_STOR_TRANSPORT_ERROR; - if (info->SD_Status.Ready) + if (info->SD_Status & SD_Ready) result =3D sd_scsi_irp(us, srb); =20 - if (info->MS_Status.Ready) + if (info->MS_Status & MS_Ready) result =3D ms_scsi_irp(us, srb); } return result; @@ -2377,7 +2376,6 @@ static int ene_ub6250_probe(struct usb_i =20 static int ene_ub6250_resume(struct usb_interface *iface) { - u8 tmp =3D 0; struct us_data *us =3D usb_get_intfdata(iface); struct ene_ub6250_info *info =3D (struct ene_ub6250_info *)(us->extra); =20 @@ -2389,17 +2387,16 @@ static int ene_ub6250_resume(struct usb_ mutex_unlock(&us->dev_mutex); =20 info->Power_IsResum =3D true; - /*info->SD_Status.Ready =3D 0; */ - info->SD_Status =3D *(struct SD_STATUS *)&tmp; - info->MS_Status =3D *(struct MS_STATUS *)&tmp; - info->SM_Status =3D *(struct SM_STATUS *)&tmp; + /* info->SD_Status &=3D ~SD_Ready; */ + info->SD_Status =3D 0; + info->MS_Status =3D 0; + info->SM_Status =3D 0; =20 return 0; } =20 static int ene_ub6250_reset_resume(struct usb_interface *iface) { - u8 tmp =3D 0; struct us_data *us =3D usb_get_intfdata(iface); struct ene_ub6250_info *info =3D (struct ene_ub6250_info *)(us->extra); =20 @@ -2411,10 +2408,10 @@ static int ene_ub6250_reset_resume(struc * the device */ info->Power_IsResum =3D true; - /*info->SD_Status.Ready =3D 0; */ - info->SD_Status =3D *(struct SD_STATUS *)&tmp; - info->MS_Status =3D *(struct MS_STATUS *)&tmp; - info->SM_Status =3D *(struct SM_STATUS *)&tmp; + /* info->SD_Status &=3D ~SD_Ready; */ + info->SD_Status =3D 0; + info->MS_Status =3D 0; + info->SM_Status =3D 0; =20 return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AF9ABC433FE for ; Tue, 5 Apr 2022 23:25:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574757AbiDEXBC (ORCPT ); Tue, 5 Apr 2022 19:01:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354622AbiDEKO4 (ORCPT ); Tue, 5 Apr 2022 06:14:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3509A6BDC6; Tue, 5 Apr 2022 03:01:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C69D4B81C83; Tue, 5 Apr 2022 10:01:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2594CC385A1; Tue, 5 Apr 2022 10:01:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152891; bh=ScwmD875nfYCsSx5Q9hrMEVZYdEQUwoF7X66WEA/Ibk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gpi9csjRb+ncSjGxf500Dmi4ClIkBE8cF/7+wV22r+lF1bVqyPnEkvIrNDveTDb+3 WBcf0RmuOsPwFQuv1nRfwAj9CA2ayah9G0Tax5o09U3N7j4UXm82zt3bcvodOvbPlt hVR/hPUtYKNScXWoSeNBi3JsP/BUK7yS307rZsyg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anssi Hannula , Mathias Nyman Subject: [PATCH 5.10 026/599] xhci: fix garbage USBSTS being logged in some cases Date: Tue, 5 Apr 2022 09:25:20 +0200 Message-Id: <20220405070259.597723405@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anssi Hannula commit 3105bc977d7cbf2edc35e24cc7e009686f6e4a56 upstream. xhci_decode_usbsts() is expected to return a zero-terminated string by its only caller, xhci_stop_endpoint_command_watchdog(), which directly logs the return value: xhci_warn(xhci, "USBSTS:%s\n", xhci_decode_usbsts(str, usbsts)); However, if no recognized bits are set in usbsts, the function will return without having called any sprintf() and therefore return an untouched non-zero-terminated caller-provided buffer, causing garbage to be output to log. Fix that by always including the raw value in the output. Note that before commit 4843b4b5ec64 ("xhci: fix even more unsafe memory usage in xhci tracing") the result effect in the failure case was different as a static buffer was used here, but the code still worked incorrectly. Fixes: 9c1aa36efdae ("xhci: Show host status when watchdog triggers and hos= t is assumed dead.") Cc: stable@vger.kernel.org Signed-off-by: Anssi Hannula Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220303110903.1662404-3-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci.h | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -2612,8 +2612,11 @@ static inline const char *xhci_decode_us { int ret =3D 0; =20 + ret =3D sprintf(str, " 0x%08x", usbsts); + if (usbsts =3D=3D ~(u32)0) - return " 0xffffffff"; + return str; + if (usbsts & STS_HALT) ret +=3D sprintf(str + ret, " HCHalted"); if (usbsts & STS_FATAL) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A858CC4321E for ; Tue, 5 Apr 2022 21:24:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348104AbiDEVXU (ORCPT ); Tue, 5 Apr 2022 17:23:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354624AbiDEKO4 (ORCPT ); Tue, 5 Apr 2022 06:14:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8F78F6BDC9; Tue, 5 Apr 2022 03:01:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 50DF8B818F6; Tue, 5 Apr 2022 10:01:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BECE0C385A2; Tue, 5 Apr 2022 10:01:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152894; bh=qtRo7NqPmOBJhZkP7N4XIeizdiNyvQ6+jtWSqnD7YvA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=05+Ya9PEDOYK8tpssy8uf8JkalUEe3pPI3L62kctjQ0du70JKwlcnsJJ8I+cmvIVg qxVyk/8a7zRcJY6LWwX5oXZdmPt5gNt5D2Il9T7oxz5k24aQslEN8nfX9yBq08mFbt nixfBnn2mKdNFAYsl3t7SHkmNL9QgnQf9zXfTGP0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Henry Lin , Mathias Nyman Subject: [PATCH 5.10 027/599] xhci: fix runtime PM imbalance in USB2 resume Date: Tue, 5 Apr 2022 09:25:21 +0200 Message-Id: <20220405070259.627300358@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Henry Lin commit 70c05e4cf63054cd755ca66c1819327b22cb085f upstream. A race between system resume and device-initiated resume may result in runtime PM imbalance on USB2 root hub. If a device-initiated resume starts and system resume xhci_bus_resume() directs U0 before hub driver sees the resuming device in RESUME state, device-initiated resume will not be finished in xhci_handle_usb2_port_link_resume(). In this case, usb_hcd_end_port_resume() call is missing. This changes calls usb_hcd_end_port_resume() if resuming device reaches U0 to keep runtime PM balance. Fixes: a231ec41e6f6 ("xhci: refactor U0 link state handling in get_port_sta= tus") Cc: stable@vger.kernel.org Signed-off-by: Henry Lin Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220303110903.1662404-5-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci-hub.c | 3 +++ 1 file changed, 3 insertions(+) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -1002,6 +1002,9 @@ static void xhci_get_usb2_port_status(st if (link_state =3D=3D XDEV_U2) *status |=3D USB_PORT_STAT_L1; if (link_state =3D=3D XDEV_U0) { + if (bus_state->resume_done[portnum]) + usb_hcd_end_port_resume(&port->rhub->hcd->self, + portnum); bus_state->resume_done[portnum] =3D 0; clear_bit(portnum, &bus_state->resuming_ports); if (bus_state->suspended_ports & (1 << portnum)) { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B4015C4167E for ; Wed, 6 Apr 2022 00:17:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1583259AbiDEXv7 (ORCPT ); Tue, 5 Apr 2022 19:51:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43204 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354627AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A019149258; Tue, 5 Apr 2022 03:01:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 50DBAB818F6; Tue, 5 Apr 2022 10:01:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F8ADC385A1; Tue, 5 Apr 2022 10:01:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152896; bh=ITFT4xuUt8InQXuT17eiq6zZtHoY6F2hARdYffH9X9I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fj4DpUyQGef0WIm/3SpG0bpKyI0sAekNxkuTJV3dE65yQsj1NDpKm2UVi9gCSl/ZW BcR92HQSCduvIpNAeqR7kI0xa5oPnm7kWMuE7hN3szAhB9PyDd88ZsO3c2aS217EEr CwBG3z9spmPnXLnfAukySqN1sNnrtky26poNJe/s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Shtylyov , Pavan Kondeti , Mathias Nyman Subject: [PATCH 5.10 028/599] xhci: make xhci_handshake timeout for xhci_reset() adjustable Date: Tue, 5 Apr 2022 09:25:22 +0200 Message-Id: <20220405070259.660319009@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mathias Nyman commit 14073ce951b5919da450022c050772902f24f054 upstream. xhci_reset() timeout was increased from 250ms to 10 seconds in order to give Renesas 720201 xHC enough time to get ready in probe. xhci_reset() is called with interrupts disabled in other places, and waiting for 10 seconds there is not acceptable. Add a timeout parameter to xhci_reset(), and adjust it back to 250ms when called from xhci_stop() or xhci_shutdown() where interrupts are disabled, and successful reset isn't that critical. This solves issues when deactivating host mode on platforms like SM8450. For now don't change the timeout if xHC is reset in xhci_resume(). No issues are reported for it, and we need the reset to succeed. Locking around that reset needs to be revisited later. Additionally change the signed integer timeout parameter in xhci_handshake() to a u64 to match the timeout value we pass to readl_poll_timeout_atomic() Fixes: 22ceac191211 ("xhci: Increase reset timeout for Renesas 720201 host.= ") Cc: stable@vger.kernel.org Reported-by: Sergey Shtylyov Reported-by: Pavan Kondeti Tested-by: Pavan Kondeti Signed-off-by: Mathias Nyman Link: https://lore.kernel.org/r/20220303110903.1662404-2-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci-hub.c | 2 +- drivers/usb/host/xhci-mem.c | 2 +- drivers/usb/host/xhci.c | 20 +++++++++----------- drivers/usb/host/xhci.h | 7 +++++-- 4 files changed, 16 insertions(+), 15 deletions(-) --- a/drivers/usb/host/xhci-hub.c +++ b/drivers/usb/host/xhci-hub.c @@ -676,7 +676,7 @@ static int xhci_exit_test_mode(struct xh } pm_runtime_allow(xhci_to_hcd(xhci)->self.controller); xhci->test_mode =3D 0; - return xhci_reset(xhci); + return xhci_reset(xhci, XHCI_RESET_SHORT_USEC); } =20 void xhci_set_link_state(struct xhci_hcd *xhci, struct xhci_port *port, --- a/drivers/usb/host/xhci-mem.c +++ b/drivers/usb/host/xhci-mem.c @@ -2595,7 +2595,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, =20 fail: xhci_halt(xhci); - xhci_reset(xhci); + xhci_reset(xhci, XHCI_RESET_SHORT_USEC); xhci_mem_cleanup(xhci); return -ENOMEM; } --- a/drivers/usb/host/xhci.c +++ b/drivers/usb/host/xhci.c @@ -66,7 +66,7 @@ static bool td_on_ring(struct xhci_td *t * handshake done). There are two failure modes: "usec" have passed (maj= or * hardware flakeout), or the register reads as all-ones (hardware removed= ). */ -int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec) +int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us) { u32 result; int ret; @@ -74,7 +74,7 @@ int xhci_handshake(void __iomem *ptr, u3 ret =3D readl_poll_timeout_atomic(ptr, result, (result & mask) =3D=3D done || result =3D=3D U32_MAX, - 1, usec); + 1, timeout_us); if (result =3D=3D U32_MAX) /* card removed */ return -ENODEV; =20 @@ -163,7 +163,7 @@ int xhci_start(struct xhci_hcd *xhci) * Transactions will be terminated immediately, and operational registers * will be set to their defaults. */ -int xhci_reset(struct xhci_hcd *xhci) +int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us) { u32 command; u32 state; @@ -196,8 +196,7 @@ int xhci_reset(struct xhci_hcd *xhci) if (xhci->quirks & XHCI_INTEL_HOST) udelay(1000); =20 - ret =3D xhci_handshake(&xhci->op_regs->command, - CMD_RESET, 0, 10 * 1000 * 1000); + ret =3D xhci_handshake(&xhci->op_regs->command, CMD_RESET, 0, timeout_us); if (ret) return ret; =20 @@ -210,8 +209,7 @@ int xhci_reset(struct xhci_hcd *xhci) * xHCI cannot write to any doorbells or operational registers other * than status until the "Controller Not Ready" flag is cleared. */ - ret =3D xhci_handshake(&xhci->op_regs->status, - STS_CNR, 0, 10 * 1000 * 1000); + ret =3D xhci_handshake(&xhci->op_regs->status, STS_CNR, 0, timeout_us); =20 xhci->usb2_rhub.bus_state.port_c_suspend =3D 0; xhci->usb2_rhub.bus_state.suspended_ports =3D 0; @@ -732,7 +730,7 @@ static void xhci_stop(struct usb_hcd *hc xhci->xhc_state |=3D XHCI_STATE_HALTED; xhci->cmd_ring_state =3D CMD_RING_STATE_STOPPED; xhci_halt(xhci); - xhci_reset(xhci); + xhci_reset(xhci, XHCI_RESET_SHORT_USEC); spin_unlock_irq(&xhci->lock); =20 xhci_cleanup_msix(xhci); @@ -785,7 +783,7 @@ void xhci_shutdown(struct usb_hcd *hcd) xhci_halt(xhci); /* Workaround for spurious wakeups at shutdown with HSW */ if (xhci->quirks & XHCI_SPURIOUS_WAKEUP) - xhci_reset(xhci); + xhci_reset(xhci, XHCI_RESET_SHORT_USEC); spin_unlock_irq(&xhci->lock); =20 xhci_cleanup_msix(xhci); @@ -1170,7 +1168,7 @@ int xhci_resume(struct xhci_hcd *xhci, b xhci_dbg(xhci, "Stop HCD\n"); xhci_halt(xhci); xhci_zero_64b_regs(xhci); - retval =3D xhci_reset(xhci); + retval =3D xhci_reset(xhci, XHCI_RESET_LONG_USEC); spin_unlock_irq(&xhci->lock); if (retval) return retval; @@ -5276,7 +5274,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, =20 xhci_dbg(xhci, "Resetting HCD\n"); /* Reset the internal HC memory state and registers. */ - retval =3D xhci_reset(xhci); + retval =3D xhci_reset(xhci, XHCI_RESET_LONG_USEC); if (retval) return retval; xhci_dbg(xhci, "Reset complete\n"); --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -229,6 +229,9 @@ struct xhci_op_regs { #define CMD_ETE (1 << 14) /* bits 15:31 are reserved (and should be preserved on writes). */ =20 +#define XHCI_RESET_LONG_USEC (10 * 1000 * 1000) +#define XHCI_RESET_SHORT_USEC (250 * 1000) + /* IMAN - Interrupt Management Register */ #define IMAN_IE (1 << 1) #define IMAN_IP (1 << 0) @@ -2068,11 +2071,11 @@ void xhci_free_container_ctx(struct xhci =20 /* xHCI host controller glue */ typedef void (*xhci_get_quirks_t)(struct device *, struct xhci_hcd *); -int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, int usec); +int xhci_handshake(void __iomem *ptr, u32 mask, u32 done, u64 timeout_us); void xhci_quiesce(struct xhci_hcd *xhci); int xhci_halt(struct xhci_hcd *xhci); int xhci_start(struct xhci_hcd *xhci); -int xhci_reset(struct xhci_hcd *xhci); +int xhci_reset(struct xhci_hcd *xhci, u64 timeout_us); int xhci_run(struct usb_hcd *hcd); int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); void xhci_shutdown(struct usb_hcd *hcd); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 803D9C433FE for ; Tue, 5 Apr 2022 23:42:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1578501AbiDEXXm (ORCPT ); Tue, 5 Apr 2022 19:23:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43208 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354630AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A88376BDCA; Tue, 5 Apr 2022 03:01:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 45B3A61676; Tue, 5 Apr 2022 10:01:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 520BDC385A2; Tue, 5 Apr 2022 10:01:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152899; bh=TOHOU80nAEDJOHOVA9Ggqo7X+R5Neb+VHBK7nnlSFOE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fmzBSymc2f13GiJzw/EQ13ujlJ8Acuz0t2KCDR8Are6ww1yhbS0xrNJLN8h/MplD/ lTtiFvXSoMvM/iMPjZWwP6FwgUDg4WsCnSdc0uDAZiTflWZ5gO276XgA8tmVxnYcAE j+5rciAHdzGe0Jb3gPSNLHA9J/yLs0ZGmxtxiqLM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anssi Hannula , Mathias Nyman Subject: [PATCH 5.10 029/599] xhci: fix uninitialized string returned by xhci_decode_ctrl_ctx() Date: Tue, 5 Apr 2022 09:25:23 +0200 Message-Id: <20220405070259.689734553@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anssi Hannula commit 05519b8589a679edb8fa781259893d20bece04ad upstream. xhci_decode_ctrl_ctx() returns the untouched buffer as-is if both "drop" and "add" parameters are zero. Fix the function to return an empty string in that case. It was not immediately clear from the possible call chains whether this issue is currently actually triggerable or not. Note that before commit 4843b4b5ec64 ("xhci: fix even more unsafe memory usage in xhci tracing") the result effect in the failure case was different as a static buffer was used here, but the code still worked incorrectly. Fixes: 90d6d5731da7 ("xhci: Add tracing for input control context") Cc: stable@vger.kernel.org Signed-off-by: Anssi Hannula Signed-off-by: Mathias Nyman commit 4843b4b5ec64 ("xhci: fix even more unsafe memory usage in xhci traci= ng") Link: https://lore.kernel.org/r/20220303110903.1662404-4-mathias.nyman@linu= x.intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/usb/host/xhci.h | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/usb/host/xhci.h +++ b/drivers/usb/host/xhci.h @@ -2458,6 +2458,8 @@ static inline const char *xhci_decode_ct unsigned int bit; int ret =3D 0; =20 + str[0] =3D '\0'; + if (drop) { ret =3D sprintf(str, "Drop:"); for_each_set_bit(bit, &drop, 32) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C234C4332F for ; Tue, 5 Apr 2022 22:55:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234029AbiDEWsu (ORCPT ); Tue, 5 Apr 2022 18:48:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354635AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7688D6BDF0; Tue, 5 Apr 2022 03:01:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D73C161676; Tue, 5 Apr 2022 10:01:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF1ACC385A1; Tue, 5 Apr 2022 10:01:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152905; bh=JAcNIEr1LPWrk+L53Ncmi4AbV1sJxXCTFWiNjxRRQuQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n+ojJfXFdUCTdDxZvbdF7I19pyg5jjBXWcaP7k9NGb3CQyd7borAGd3Ad4Z1pderO rwKZzhc/r3y5vUAtjkYEtsWms/yjBqA9aJmy/FnBSkZrl0r7uep0ZFKLsl5n8IKPo8 lv/AymuHaDZYWaTjjo9o28XWGV6CKGZz5Bcc6zyA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Usyskin , Tomas Winkler Subject: [PATCH 5.10 030/599] mei: me: add Alder Lake N device id. Date: Tue, 5 Apr 2022 09:25:24 +0200 Message-Id: <20220405070259.718547283@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Usyskin commit 7bbbd0845818cffa9fa8ccfe52fa1cad58e7e4f2 upstream. Add Alder Lake N device ID. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20220301071115.96145-1-tomas.winkler@intel.= com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/misc/mei/hw-me-regs.h | 1 + drivers/misc/mei/pci-me.c | 1 + 2 files changed, 2 insertions(+) --- a/drivers/misc/mei/hw-me-regs.h +++ b/drivers/misc/mei/hw-me-regs.h @@ -107,6 +107,7 @@ #define MEI_DEV_ID_ADP_S 0x7AE8 /* Alder Lake Point S */ #define MEI_DEV_ID_ADP_LP 0x7A60 /* Alder Lake Point LP */ #define MEI_DEV_ID_ADP_P 0x51E0 /* Alder Lake Point P */ +#define MEI_DEV_ID_ADP_N 0x54E0 /* Alder Lake Point N */ =20 /* * MEI HW Section --- a/drivers/misc/mei/pci-me.c +++ b/drivers/misc/mei/pci-me.c @@ -113,6 +113,7 @@ static const struct pci_device_id mei_me {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_S, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_LP, MEI_ME_PCH15_CFG)}, {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_P, MEI_ME_PCH15_CFG)}, + {MEI_PCI_DEVICE(MEI_DEV_ID_ADP_N, MEI_ME_PCH15_CFG)}, =20 /* required last entry */ {0, } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AA3AC41535 for ; Wed, 6 Apr 2022 02:02:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1844567AbiDFBtn (ORCPT ); Tue, 5 Apr 2022 21:49:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43202 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354633AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B774949915; Tue, 5 Apr 2022 03:01:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 77D84B81C8B; Tue, 5 Apr 2022 10:01:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8CF0C385A2; Tue, 5 Apr 2022 10:01:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152908; bh=E/V8qGzLRoFzJuYpZWUx/E60yGc/iIh6mMdRxNsZPbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GgceHJx7grJ3SiQdT7TDRqFwWz7edKuM8bTH3rj224P/jE4mv1G8f9EevkXGt3XNA 0MiycCOJT3yUPDPrtu9rO77ipgtKBGL+01+DCJtfs7eLdqYhjUNZkTmgSWt1FJDigp HMfuEaJ1MhYBo0fqIrOiBIPQ6g5+4ihvy9x7Rx4Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Usyskin , Tomas Winkler Subject: [PATCH 5.10 031/599] mei: avoid iterator usage outside of list_for_each_entry Date: Tue, 5 Apr 2022 09:25:25 +0200 Message-Id: <20220405070259.747908078@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Usyskin commit c10187b1c5ebb8681ca467ab7b0ded5ea415d258 upstream. Usage of the iterator outside of the list_for_each_entry is considered harmful. https://lkml.org/lkml/2022/2/17/1032 Do not reference the loop variable outside of the loop, by rearranging the orders of execution. Instead of performing search loop and checking outside the loop if the end of the list was hit and no matching element was found, the execution is performed inside the loop upon a successful match followed by a goto statement to the next step, therefore no condition has to be performed after the loop has ended. Cc: Signed-off-by: Alexander Usyskin Signed-off-by: Tomas Winkler Link: https://lore.kernel.org/r/20220308095926.300412-1-tomas.winkler@intel= .com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/misc/mei/interrupt.c | 35 +++++++++++++++-------------------- 1 file changed, 15 insertions(+), 20 deletions(-) --- a/drivers/misc/mei/interrupt.c +++ b/drivers/misc/mei/interrupt.c @@ -427,31 +427,26 @@ int mei_irq_read_handler(struct mei_devi list_for_each_entry(cl, &dev->file_list, link) { if (mei_cl_hbm_equal(cl, mei_hdr)) { cl_dbg(dev, cl, "got a message\n"); - break; + ret =3D mei_cl_irq_read_msg(cl, mei_hdr, meta_hdr, cmpl_list); + goto reset_slots; } } =20 /* if no recipient cl was found we assume corrupted header */ - if (&cl->link =3D=3D &dev->file_list) { - /* A message for not connected fixed address clients - * should be silently discarded - * On power down client may be force cleaned, - * silently discard such messages - */ - if (hdr_is_fixed(mei_hdr) || - dev->dev_state =3D=3D MEI_DEV_POWER_DOWN) { - mei_irq_discard_msg(dev, mei_hdr, mei_hdr->length); - ret =3D 0; - goto reset_slots; - } - dev_err(dev->dev, "no destination client found 0x%08X\n", - dev->rd_msg_hdr[0]); - ret =3D -EBADMSG; - goto end; + /* A message for not connected fixed address clients + * should be silently discarded + * On power down client may be force cleaned, + * silently discard such messages + */ + if (hdr_is_fixed(mei_hdr) || + dev->dev_state =3D=3D MEI_DEV_POWER_DOWN) { + mei_irq_discard_msg(dev, mei_hdr, mei_hdr->length); + ret =3D 0; + goto reset_slots; } - - ret =3D mei_cl_irq_read_msg(cl, mei_hdr, meta_hdr, cmpl_list); - + dev_err(dev->dev, "no destination client found 0x%08X\n", dev->rd_msg_hdr= [0]); + ret =3D -EBADMSG; + goto end; =20 reset_slots: /* reset the number of slots and header */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39A0BC433EF for ; Wed, 6 Apr 2022 01:30:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1842450AbiDFBbl (ORCPT ); Tue, 5 Apr 2022 21:31:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354637AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9DC554993C; Tue, 5 Apr 2022 03:01:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 43AEFB81B7A; Tue, 5 Apr 2022 10:01:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 821A1C385A2; Tue, 5 Apr 2022 10:01:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152910; bh=9bImAcmj4A53oHrgEvLh7UEsskyu85oh1R6Ve/FzEG0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zNTwFzyUdTp7MGc07TaZbR5mBuvM3mulhAexXPM0i+nEW6a5AHSzFkpW72VfLPrB4 6cy2sW8XzgeDDqG0fzyYSTBheIFHV+aS4ozK6WTMqTQvHpM8ZDqbXUd27hRHhWmHIR x+82wREYBNjFoh3unUW3Fi++fUqEtvl/S4rsWfcw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, James Clark , Mike Leach , Mathieu Poirier , Suzuki K Poulose Subject: [PATCH 5.10 032/599] coresight: Fix TRCCONFIGR.QE sysfs interface Date: Tue, 5 Apr 2022 09:25:26 +0200 Message-Id: <20220405070259.777351752@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: James Clark commit ea75a342aed5ed72c87f38fbe0df2f5df7eae374 upstream. It's impossible to program a valid value for TRCCONFIGR.QE when TRCIDR0.QSUPP=3D=3D0b10. In that case the following is true: Q element support is implemented, and only supports Q elements without instruction counts. TRCCONFIGR.QE can only take the values 0b00 or 0b11. Currently the low bit of QSUPP is checked to see if the low bit of QE can be written to, but as you can see when QSUPP=3D=3D0b10 the low bit is clear= ed making it impossible to ever write the only valid value of 0b11 to QE. 0b10 would be written instead, which is a reserved QE value even for all values of QSUPP. The fix is to allow writing the low bit of QE for any non zero value of QSUPP. This change also ensures that the low bit is always set, even when the user attempts to only set the high bit. Signed-off-by: James Clark Reviewed-by: Mike Leach Fixes: d8c66962084f ("coresight-etm4x: Controls pertaining to the reset, mo= de, pe and events") Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220120113047.2839622-2-james.clark@arm.com Signed-off-by: Mathieu Poirier Signed-off-by: Suzuki K Poulose Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hwtracing/coresight/coresight-etm4x-sysfs.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) --- a/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-sysfs.c @@ -364,8 +364,12 @@ static ssize_t mode_store(struct device mode =3D ETM_MODE_QELEM(config->mode); /* start by clearing QE bits */ config->cfg &=3D ~(BIT(13) | BIT(14)); - /* if supported, Q elements with instruction counts are enabled */ - if ((mode & BIT(0)) && (drvdata->q_support & BIT(0))) + /* + * if supported, Q elements with instruction counts are enabled. + * Always set the low bit for any requested mode. Valid combos are + * 0b00, 0b01 and 0b11. + */ + if (mode && drvdata->q_support) config->cfg |=3D BIT(13); /* * if supported, Q elements with and without instruction From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB0B9C433EF for ; Wed, 6 Apr 2022 01:42:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1843117AbiDFBjd (ORCPT ); Tue, 5 Apr 2022 21:39:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354638AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1D4E66A42A; Tue, 5 Apr 2022 03:01:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C062EB818F6; Tue, 5 Apr 2022 10:01:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E3C2C385A1; Tue, 5 Apr 2022 10:01:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152913; bh=fJfAxLgU5ZYT0blaKUPM/lFIty97wmdikPk91H852pY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lR/79T85yWdRp7NDPgbW2+1cHdE4aPPgDtHIvKlcEddR99AerTPhNKyROp+2upLhk tSSfi366q5AyO93kk2iTU5ZJDoDCs8ww6Nh/JRxuK+erF6cSAq1xc853+aQoEwHpat psmVh8+9OAbxrvLGn+EVluetKvcz9/Orl4Z3fdbY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liam Beguin , Peter Rosin , Andy Shevchenko , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 033/599] iio: afe: rescale: use s64 for temporary scale calculations Date: Tue, 5 Apr 2022 09:25:27 +0200 Message-Id: <20220405070259.808043455@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liam Beguin commit 51593106b608ae4247cc8da928813347da16d025 upstream. All four scaling coefficients can take signed values. Make tmp a signed 64-bit integer and switch to div_s64() to preserve signs during 64-bit divisions. Fixes: 8b74816b5a9a ("iio: afe: rescale: new driver") Signed-off-by: Liam Beguin Reviewed-by: Peter Rosin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220108205319.2046348-5-liambeguin@gmail.c= om Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/afe/iio-rescale.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/drivers/iio/afe/iio-rescale.c +++ b/drivers/iio/afe/iio-rescale.c @@ -38,7 +38,7 @@ static int rescale_read_raw(struct iio_d int *val, int *val2, long mask) { struct rescale *rescale =3D iio_priv(indio_dev); - unsigned long long tmp; + s64 tmp; int ret; =20 switch (mask) { @@ -59,10 +59,10 @@ static int rescale_read_raw(struct iio_d *val2 =3D rescale->denominator; return IIO_VAL_FRACTIONAL; case IIO_VAL_FRACTIONAL_LOG2: - tmp =3D *val * 1000000000LL; - do_div(tmp, rescale->denominator); + tmp =3D (s64)*val * 1000000000LL; + tmp =3D div_s64(tmp, rescale->denominator); tmp *=3D rescale->numerator; - do_div(tmp, 1000000000LL); + tmp =3D div_s64(tmp, 1000000000LL); *val =3D tmp; return ret; default: From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BFC02C3527D for ; Tue, 5 Apr 2022 21:57:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1389242AbiDEV7F (ORCPT ); Tue, 5 Apr 2022 17:59:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43772 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354933AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CEF321818; Tue, 5 Apr 2022 03:04:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 46684B81C8B; Tue, 5 Apr 2022 10:04:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B70F0C385A2; Tue, 5 Apr 2022 10:04:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153046; bh=kSdGlvD8ZiXBvi/chcD7vZ/P+j4sw/QMAyDaUs8nof0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aGY7p+eBgZ7lMZjQjMgxyG1HC7bj/y7amrRs8X6VsChmazMBegYiyShzWqaFOmu2g 43azgj8Vs8qdHhEz+k74CXEOypfldziT7puyzVexVJ83LKYnaUT604/qai+GqOTw7T qTEiqlXmG86dvcrb4pHJEomAYuW22lq/q8vDCtC4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liam Beguin , Peter Rosin , Andy Shevchenko , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 034/599] iio: inkern: apply consumer scale on IIO_VAL_INT cases Date: Tue, 5 Apr 2022 09:25:28 +0200 Message-Id: <20220405070259.838133693@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liam Beguin commit 1bca97ff95c732a516ebb68da72814194980e0a5 upstream. When a consumer calls iio_read_channel_processed() and the channel has an integer scale, the scale channel scale is applied and the processed value is returned as expected. On the other hand, if the consumer calls iio_convert_raw_to_processed() the scaling factor requested by the consumer is not applied. This for example causes the consumer to process mV when expecting uV. Make sure to always apply the scaling factor requested by the consumer. Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") Signed-off-by: Liam Beguin Reviewed-by: Peter Rosin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220108205319.2046348-2-liambeguin@gmail.c= om Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/inkern.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -582,7 +582,7 @@ static int iio_convert_raw_to_processed_ =20 switch (scale_type) { case IIO_VAL_INT: - *processed =3D raw64 * scale_val; + *processed =3D raw64 * scale_val * scale; break; case IIO_VAL_INT_PLUS_MICRO: if (scale_val2 < 0) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D16D8C433FE for ; Tue, 5 Apr 2022 22:31:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1443601AbiDEWUf (ORCPT ); Tue, 5 Apr 2022 18:20:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56050 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354648AbiDEKO5 (ORCPT ); Tue, 5 Apr 2022 06:14:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E4756C1ED; Tue, 5 Apr 2022 03:02:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3CD10B81C83; Tue, 5 Apr 2022 10:02:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83D38C385A1; Tue, 5 Apr 2022 10:02:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152935; bh=gfV629Zgz/51l+/HtStoc6+xPlrAsyPHiNc5Qtfgl50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=emS12iRw6EHfmVh+DpR9Po0LRA9HmErfdCNwW4Ch3J0ydU50zEnHv52C4fPDufOST PTzAU2ZHlzp3MAIhjE0gX2gW6x4ZzO2UsTE0dfKoUZm2WFNqrla0wT098/cZN9F1J3 S27vZyMa/kovuMi6p69Tlxb8+K1ffxXLjTPyw148= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liam Beguin , Peter Rosin , Andy Shevchenko , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 035/599] iio: inkern: apply consumer scale when no channel scale is available Date: Tue, 5 Apr 2022 09:25:29 +0200 Message-Id: <20220405070259.867876473@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liam Beguin commit 14b457fdde38de594a4bc4bd9075019319d978da upstream. When a consumer calls iio_read_channel_processed() and no channel scale is available, it's assumed that the scale is one and the raw value is returned as expected. On the other hand, if the consumer calls iio_convert_raw_to_processed() the scaling factor requested by the consumer is not applied. This for example causes the consumer to process mV when expecting uV. Make sure to always apply the scaling factor requested by the consumer. Fixes: adc8ec5ff183 ("iio: inkern: pass through raw values if no scaling") Signed-off-by: Liam Beguin Reviewed-by: Peter Rosin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220108205319.2046348-3-liambeguin@gmail.c= om Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/inkern.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -573,10 +573,10 @@ static int iio_convert_raw_to_processed_ IIO_CHAN_INFO_SCALE); if (scale_type < 0) { /* - * Just pass raw values as processed if no scaling is - * available. + * If no channel scaling is available apply consumer scale to + * raw value and return. */ - *processed =3D raw; + *processed =3D raw * scale; return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4857C433EF for ; Wed, 6 Apr 2022 01:06:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839929AbiDFBGY (ORCPT ); Tue, 5 Apr 2022 21:06:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45206 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354781AbiDEKPs (ORCPT ); Tue, 5 Apr 2022 06:15:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B5BFC6C92C; Tue, 5 Apr 2022 03:02:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 62725B81B7A; Tue, 5 Apr 2022 10:02:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CF214C385A1; Tue, 5 Apr 2022 10:02:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152966; bh=ZwI7hRZEPXkT1sDAUPYVc50SVib38PFUExf4pza0hMA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q49mN/8Wjh3e4UvAfmrlxtnsXUqmfaptrs1zl3/QDePftqEIMGxhf4KxxnaXKTVJ7 8ZwzJoUNOZUOgr/1gX+s6LkfoRi8wVarLqcez9d4jyh3HPiEUShX2H8TAXOlzPgrN0 XswQMm3SuZ0BSnohCWPw9XiEJDeEvBFbNboLzxPY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liam Beguin , Peter Rosin , Andy Shevchenko , Stable@vger.kernel.org, Jonathan Cameron Subject: [PATCH 5.10 036/599] iio: inkern: make a best effort on offset calculation Date: Tue, 5 Apr 2022 09:25:30 +0200 Message-Id: <20220405070259.898102419@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liam Beguin commit ca85123354e1a65a22170286387b4791997fe864 upstream. iio_convert_raw_to_processed_unlocked() assumes the offset is an integer. Make a best effort to get a valid offset value for fractional cases without breaking implicit truncations. Fixes: 48e44ce0f881 ("iio:inkern: Add function to read the processed value") Signed-off-by: Liam Beguin Reviewed-by: Peter Rosin Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220108205319.2046348-4-liambeguin@gmail.c= om Cc: Signed-off-by: Jonathan Cameron Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/iio/inkern.c | 32 +++++++++++++++++++++++++++----- 1 file changed, 27 insertions(+), 5 deletions(-) --- a/drivers/iio/inkern.c +++ b/drivers/iio/inkern.c @@ -561,13 +561,35 @@ EXPORT_SYMBOL_GPL(iio_read_channel_avera static int iio_convert_raw_to_processed_unlocked(struct iio_channel *chan, int raw, int *processed, unsigned int scale) { - int scale_type, scale_val, scale_val2, offset; + int scale_type, scale_val, scale_val2; + int offset_type, offset_val, offset_val2; s64 raw64 =3D raw; - int ret; =20 - ret =3D iio_channel_read(chan, &offset, NULL, IIO_CHAN_INFO_OFFSET); - if (ret >=3D 0) - raw64 +=3D offset; + offset_type =3D iio_channel_read(chan, &offset_val, &offset_val2, + IIO_CHAN_INFO_OFFSET); + if (offset_type >=3D 0) { + switch (offset_type) { + case IIO_VAL_INT: + break; + case IIO_VAL_INT_PLUS_MICRO: + case IIO_VAL_INT_PLUS_NANO: + /* + * Both IIO_VAL_INT_PLUS_MICRO and IIO_VAL_INT_PLUS_NANO + * implicitely truncate the offset to it's integer form. + */ + break; + case IIO_VAL_FRACTIONAL: + offset_val /=3D offset_val2; + break; + case IIO_VAL_FRACTIONAL_LOG2: + offset_val >>=3D offset_val2; + break; + default: + return -EINVAL; + } + + raw64 +=3D offset_val; + } =20 scale_type =3D iio_channel_read(chan, &scale_val, &scale_val2, IIO_CHAN_INFO_SCALE); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40C16C433FE for ; Tue, 5 Apr 2022 22:55:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1454933AbiDEWjr (ORCPT ); Tue, 5 Apr 2022 18:39:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33786 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354877AbiDEKQ1 (ORCPT ); Tue, 5 Apr 2022 06:16:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 99E4E6CA4F; Tue, 5 Apr 2022 03:03:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 35D2161673; Tue, 5 Apr 2022 10:03:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40820C385A3; Tue, 5 Apr 2022 10:03:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152996; bh=Hxo4l3G3ezXXxyeir2RGiMkhpL4xQTk/wS0+4Y5M1K8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=m2QAZQfFMEE34Ce4A49xmE+/fRUDU4rD45RYMdr1rjV1dchP7GQTBV4vYI+WgXHqT h/J3U7WUt+8/AbwQH/mJxqC+8QZysIr7UZXf+JKESGniMYr9Co1LLdLjI8B8myxnlB ilNN8klUVUgtvWce+UEh2CzU/QuiqTRtr3CMIePE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Johan Hovold Subject: [PATCH 5.10 037/599] greybus: svc: fix an error handling bug in gb_svc_hello() Date: Tue, 5 Apr 2022 09:25:31 +0200 Message-Id: <20220405070259.928010789@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit 5f8583a3b7552092582a92e7bbd2153319929ad7 upstream. Cleanup if gb_svc_queue_deferred_request() fails. Link: https://lore.kernel.org/r/20220202072016.GA6748@kili Fixes: ee2f2074fdb2 ("greybus: svc: reconfig APBridgeA-Switch link to handl= e required load") Cc: stable@vger.kernel.org # 4.9 [johan: fix commit summary prefix and rename label ] Signed-off-by: Dan Carpenter Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220202113347.1288-2-johan@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/greybus/svc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/drivers/greybus/svc.c +++ b/drivers/greybus/svc.c @@ -866,8 +866,14 @@ static int gb_svc_hello(struct gb_operat =20 gb_svc_debugfs_init(svc); =20 - return gb_svc_queue_deferred_request(op); + ret =3D gb_svc_queue_deferred_request(op); + if (ret) + goto err_remove_debugfs; =20 + return 0; + +err_remove_debugfs: + gb_svc_debugfs_exit(svc); err_unregister_device: gb_svc_watchdog_destroy(svc); device_del(&svc->dev); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40679C35273 for ; Tue, 5 Apr 2022 21:57:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1388833AbiDEV5W (ORCPT ); Tue, 5 Apr 2022 17:57:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354908AbiDEKQe (ORCPT ); Tue, 5 Apr 2022 06:16:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64D597662; Tue, 5 Apr 2022 03:03:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1F22AB81C83; Tue, 5 Apr 2022 10:03:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 678D6C385A2; Tue, 5 Apr 2022 10:03:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153026; bh=nYF/5LlqJxR+dXjtyHU6EiTxJe3DQ65PTODezaKI2RE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q+8Kof/KYd1qeCYVqt/KMXszZ86uqZRyqXIOcNNTsw5huzo0uuOYXbiaSHjFBVlja HMlJ7K4i5MfThCAdCCIbuVEG2VX7xcyTt7aONt2Ajas3YAZfdf9XPLMf2lhEPDS2Sm 7nWi+q3m3b+6XnUc/p/5zIcNjMvO6rqYYc/9ehYc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kunihiko Hayashi , Stephen Boyd Subject: [PATCH 5.10 038/599] clk: uniphier: Fix fixed-rate initialization Date: Tue, 5 Apr 2022 09:25:32 +0200 Message-Id: <20220405070259.958975419@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kunihiko Hayashi commit ca85a66710a8a1f6b0719397225c3e9ee0abb692 upstream. Fixed-rate clocks in UniPhier don't have any parent clocks, however, initial data "init.flags" isn't initialized, so it might be determined that there is a parent clock for fixed-rate clock. This sets init.flags to zero as initialization. Cc: Fixes: 734d82f4a678 ("clk: uniphier: add core support code for UniPhier clo= ck driver") Signed-off-by: Kunihiko Hayashi Link: https://lore.kernel.org/r/1646808918-30899-1-git-send-email-hayashi.k= unihiko@socionext.com Signed-off-by: Stephen Boyd Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/clk/uniphier/clk-uniphier-fixed-rate.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/clk/uniphier/clk-uniphier-fixed-rate.c +++ b/drivers/clk/uniphier/clk-uniphier-fixed-rate.c @@ -24,6 +24,7 @@ struct clk_hw *uniphier_clk_register_fix =20 init.name =3D name; init.ops =3D &clk_fixed_rate_ops; + init.flags =3D 0; init.parent_names =3D NULL; init.num_parents =3D 0; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 86048C433FE for ; Wed, 6 Apr 2022 01:19:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356214AbiDFBU5 (ORCPT ); Tue, 5 Apr 2022 21:20:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51346 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354912AbiDEKQe (ORCPT ); Tue, 5 Apr 2022 06:16:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F121D1FA63; Tue, 5 Apr 2022 03:03:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6F552B81C86; Tue, 5 Apr 2022 10:03:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B8A29C385A1; Tue, 5 Apr 2022 10:03:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153032; bh=0EpLQqBQHjcTpSODKHXy71hIZ4eq3bpxMs0J0sqKlmw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t5GWJeQSuuyO0vuwWaQmxXU5zfPI5RT/UDT9yQNo8yek1KtHyXMkRULKPHPORE2Kl NNrZyfuNDvHlkxnNwKuuoVhBZserp1Bf5q1Xd+D9eIlkz3n/H3aOXaURcb4jKLGTJ3 Fh/+KibwiqYzHaXlwNr/xee373efAg7z3mbzma2Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Jann Horn , "Eric W. Biederman" Subject: [PATCH 5.10 039/599] ptrace: Check PTRACE_O_SUSPEND_SECCOMP permission on PTRACE_SEIZE Date: Tue, 5 Apr 2022 09:25:33 +0200 Message-Id: <20220405070259.989212056@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit ee1fee900537b5d9560e9f937402de5ddc8412f3 upstream. Setting PTRACE_O_SUSPEND_SECCOMP is supposed to be a highly privileged operation because it allows the tracee to completely bypass all seccomp filters on kernels with CONFIG_CHECKPOINT_RESTORE=3Dy. It is only supposed = to be settable by a process with global CAP_SYS_ADMIN, and only if that process is not subject to any seccomp filters at all. However, while these permission checks were done on the PTRACE_SETOPTIONS path, they were missing on the PTRACE_SEIZE path, which also sets user-specified ptrace flags. Move the permissions checks out into a helper function and let both ptrace_attach() and ptrace_setoptions() call it. Cc: stable@kernel.org Fixes: 13c4a90119d2 ("seccomp: add ptrace options for suspend/resume") Signed-off-by: Jann Horn Link: https://lkml.kernel.org/r/20220319010838.1386861-1-jannh@google.com Signed-off-by: Eric W. Biederman Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/ptrace.c | 47 ++++++++++++++++++++++++++++++++--------------- 1 file changed, 32 insertions(+), 15 deletions(-) --- a/kernel/ptrace.c +++ b/kernel/ptrace.c @@ -370,6 +370,26 @@ bool ptrace_may_access(struct task_struc return !err; } =20 +static int check_ptrace_options(unsigned long data) +{ + if (data & ~(unsigned long)PTRACE_O_MASK) + return -EINVAL; + + if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { + if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || + !IS_ENABLED(CONFIG_SECCOMP)) + return -EINVAL; + + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + + if (seccomp_mode(¤t->seccomp) !=3D SECCOMP_MODE_DISABLED || + current->ptrace & PT_SUSPEND_SECCOMP) + return -EPERM; + } + return 0; +} + static int ptrace_attach(struct task_struct *task, long request, unsigned long addr, unsigned long flags) @@ -381,8 +401,16 @@ static int ptrace_attach(struct task_str if (seize) { if (addr !=3D 0) goto out; + /* + * This duplicates the check in check_ptrace_options() because + * ptrace_attach() and ptrace_setoptions() have historically + * used different error codes for unknown ptrace options. + */ if (flags & ~(unsigned long)PTRACE_O_MASK) goto out; + retval =3D check_ptrace_options(flags); + if (retval) + return retval; flags =3D PT_PTRACED | PT_SEIZED | (flags << PT_OPT_FLAG_SHIFT); } else { flags =3D PT_PTRACED; @@ -655,22 +683,11 @@ int ptrace_writedata(struct task_struct static int ptrace_setoptions(struct task_struct *child, unsigned long data) { unsigned flags; + int ret; =20 - if (data & ~(unsigned long)PTRACE_O_MASK) - return -EINVAL; - - if (unlikely(data & PTRACE_O_SUSPEND_SECCOMP)) { - if (!IS_ENABLED(CONFIG_CHECKPOINT_RESTORE) || - !IS_ENABLED(CONFIG_SECCOMP)) - return -EINVAL; - - if (!capable(CAP_SYS_ADMIN)) - return -EPERM; - - if (seccomp_mode(¤t->seccomp) !=3D SECCOMP_MODE_DISABLED || - current->ptrace & PT_SUSPEND_SECCOMP) - return -EPERM; - } + ret =3D check_ptrace_options(data); + if (ret) + return ret; =20 /* Avoid intermediate state when all opts are cleared */ flags =3D child->ptrace; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D9D2C433EF for ; Tue, 5 Apr 2022 22:39:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1451649AbiDEWaW (ORCPT ); Tue, 5 Apr 2022 18:30:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51348 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354910AbiDEKQe (ORCPT ); Tue, 5 Apr 2022 06:16:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F110A1FA51; Tue, 5 Apr 2022 03:03:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 73CA7616E7; Tue, 5 Apr 2022 10:03:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 81EA7C385A2; Tue, 5 Apr 2022 10:03:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153034; bh=Utz1YvWbSMLmkIEVCdwmAdUPQ3ARE9UXbQLDcRmNtww=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=u6mnLnflMgYOpHbfwO542++oFAmV0hP+s6VQffMDnuTCzm5S50dwsEoi/ZSrDQz6I wKSujfg15VddflY670zBoOloaE8foesJuEmwmUJnxpY39oI4kYZfqAf4kwHLHNcZD4 pcLpLCsuVMEvef5uJQ1F/c+Rk7XyUJMInr1xHaMA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , Jarkko Sakkinen Subject: [PATCH 5.10 040/599] KEYS: fix length validation in keyctl_pkey_params_get_2() Date: Tue, 5 Apr 2022 09:25:34 +0200 Message-Id: <20220405070300.019395113@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit c51abd96837f600d8fd940b6ab8e2da578575504 upstream. In many cases, keyctl_pkey_params_get_2() is validating the user buffer lengths against the wrong algorithm properties. Fix it to check against the correct properties. Probably this wasn't noticed before because for all asymmetric keys of the "public_key" subtype, max_data_size =3D=3D max_sig_size =3D=3D max_enc_= size =3D=3D max_dec_size. However, this isn't necessarily true for the "asym_tpm" subtype (it should be, but it's not strictly validated). Of course, future key types could have different values as well. Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops f= or asymmetric keys [ver #2]") Cc: # v4.20+ Signed-off-by: Eric Biggers Reviewed-by: Jarkko Sakkinen Signed-off-by: Jarkko Sakkinen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- security/keys/keyctl_pkey.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/security/keys/keyctl_pkey.c +++ b/security/keys/keyctl_pkey.c @@ -135,15 +135,23 @@ static int keyctl_pkey_params_get_2(cons =20 switch (op) { case KEYCTL_PKEY_ENCRYPT: + if (uparams.in_len > info.max_dec_size || + uparams.out_len > info.max_enc_size) + return -EINVAL; + break; case KEYCTL_PKEY_DECRYPT: if (uparams.in_len > info.max_enc_size || uparams.out_len > info.max_dec_size) return -EINVAL; break; case KEYCTL_PKEY_SIGN: + if (uparams.in_len > info.max_data_size || + uparams.out_len > info.max_sig_size) + return -EINVAL; + break; case KEYCTL_PKEY_VERIFY: - if (uparams.in_len > info.max_sig_size || - uparams.out_len > info.max_data_size) + if (uparams.in_len > info.max_data_size || + uparams.in2_len > info.max_sig_size) return -EINVAL; break; default: @@ -151,7 +159,7 @@ static int keyctl_pkey_params_get_2(cons } =20 params->in_len =3D uparams.in_len; - params->out_len =3D uparams.out_len; + params->out_len =3D uparams.out_len; /* Note: same as in2_len */ return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D447EC4167D for ; Wed, 6 Apr 2022 00:21:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345013AbiDFADe (ORCPT ); Tue, 5 Apr 2022 20:03:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354921AbiDEKQf (ORCPT ); Tue, 5 Apr 2022 06:16:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3997820F61; Tue, 5 Apr 2022 03:04:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E3437B81BC0; Tue, 5 Apr 2022 10:03:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37BFBC385A2; Tue, 5 Apr 2022 10:03:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153037; bh=L+a2SzSVzn4E/4douuC9asR0dAPEwbbhzHSIRnZEM04=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UhuwdVodRung1S3ABMSJecGy+oqmmHrZsIIiEycyyrz0nsyIkRt7dlkCyzLwlAQ/h WidNYw+rm6m6ybyUiQqIEcSLFCcgXcz4p5PDh5VenXtWVIkNOKsXbYYQ4woCqHXghd Vl4oUiCCp6lwOF0lOga/yY9y71TquW8xejJC3avg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sasha Levin , Jonathan Corbet , Bagas Sanjaya Subject: [PATCH 5.10 041/599] Documentation: add link to stable release candidate tree Date: Tue, 5 Apr 2022 09:25:35 +0200 Message-Id: <20220405070300.050094235@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bagas Sanjaya commit 587d39b260c4d090166314d64be70b1f6a26b0b5 upstream. There is also stable release candidate tree. Mention it, however with a warning that the tree is for testing purposes. Cc: Greg Kroah-Hartman Cc: Sasha Levin Cc: Jonathan Corbet Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20220314113329.485372-5-bagasdotme@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- Documentation/process/stable-kernel-rules.rst | 9 +++++++++ 1 file changed, 9 insertions(+) --- a/Documentation/process/stable-kernel-rules.rst +++ b/Documentation/process/stable-kernel-rules.rst @@ -170,6 +170,15 @@ Trees =20 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git =20 + - The release candidate of all stable kernel versions can be found at: + + https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stabl= e-rc.git/ + + .. warning:: + The -stable-rc tree is a snapshot in time of the stable-queue tree a= nd + will change frequently, hence will be rebased often. It should only = be + used for testing purposes (e.g. to be consumed by CI systems). + =20 Review committee ---------------- From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 251F6C43219 for ; Tue, 5 Apr 2022 21:50:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1385266AbiDEVtX (ORCPT ); Tue, 5 Apr 2022 17:49:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354930AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E367521810; Tue, 5 Apr 2022 03:04:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 93F8BB81C83; Tue, 5 Apr 2022 10:04:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B7BCC385A2; Tue, 5 Apr 2022 10:03:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153040; bh=GHdBnWH3UX1Xlg0sRoZEr/y66U2ZsPElXuujtK71+AE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i3rF14GhoSeL6bKWctbdAT5E3HXMbO7x0viTfRfgQ2Z/vUjrGq3YqQ/ODDXKhE5cy 7FgxPUjgYlPN/EnAGITw1/7zQWeUZX19Va9MwSqnGOneA9NPpwODxlCHrbmZUvzxt+ nf6iG0Gj079TVPkA3Qc4b6cM38KgDVpSkI7+xojY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sasha Levin , Jonathan Corbet , Bagas Sanjaya Subject: [PATCH 5.10 042/599] Documentation: update stable tree link Date: Tue, 5 Apr 2022 09:25:36 +0200 Message-Id: <20220405070300.079386711@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bagas Sanjaya commit 555d44932c67e617d89bc13c81c7efac5b51fcfa upstream. The link to stable tree is redirected to https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git. Update accordingly. Cc: Greg Kroah-Hartman Cc: Sasha Levin Cc: Jonathan Corbet Cc: stable@vger.kernel.org Cc: linux-kernel@vger.kernel.org Signed-off-by: Bagas Sanjaya Link: https://lore.kernel.org/r/20220314113329.485372-6-bagasdotme@gmail.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- Documentation/process/stable-kernel-rules.rst | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/Documentation/process/stable-kernel-rules.rst +++ b/Documentation/process/stable-kernel-rules.rst @@ -168,7 +168,7 @@ Trees - The finalized and tagged releases of all stable kernels can be found in separate branches per version at: =20 - https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git + https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git =20 - The release candidate of all stable kernel versions can be found at: From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96FABC3527D for ; Tue, 5 Apr 2022 20:17:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1349955AbiDEUPP (ORCPT ); Tue, 5 Apr 2022 16:15:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45146 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354938AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52C5521816; Tue, 5 Apr 2022 03:04:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E411C61673; Tue, 5 Apr 2022 10:04:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF2C3C385A1; Tue, 5 Apr 2022 10:04:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153043; bh=AIwGneCgQREljoh3n2S10EY9Q3wkZzrK2N0v2FayM6A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mHwt02+ECcjSvQWIN5LPheRBZjUPeNGU+moc6qdLICa0jATuj863rM46R4FMYKpS/ k8AGNk8YM1IFuR53in90ov8bFuU1Kr1vLBgYEul541cLkbLtqJv+Ysbhuxs0+zf6hz 2cUunZbcCxCepn6PNgvNkXbsFMzjeUuWer4Sxv2s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ang Tien Sung , Dinh Nguyen Subject: [PATCH 5.10 043/599] firmware: stratix10-svc: add missing callback parameter on RSU Date: Tue, 5 Apr 2022 09:25:37 +0200 Message-Id: <20220405070300.109136732@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ang Tien Sung commit b850b7a8b369322adf699ef48ceff4d902525c8c upstream. Fix a bug whereby, the return response of parameter a1 from an SMC call is not properly set to the callback data during an INTEL_SIP_SMC_RSU_ERROR command. Link: https://lore.kernel.org/lkml/20220216081513.28319-1-tien.sung.ang@int= el.com Fixes: 6b50d882d38d ("firmware: add remote status update client support") Cc: stable@vger.kernel.org Signed-off-by: Ang Tien Sung Signed-off-by: Dinh Nguyen Link: https://lore.kernel.org/r/20220223144146.399263-1-dinguyen@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/firmware/stratix10-svc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/firmware/stratix10-svc.c +++ b/drivers/firmware/stratix10-svc.c @@ -477,7 +477,7 @@ static int svc_normal_to_secure_thread(v case INTEL_SIP_SMC_RSU_ERROR: pr_err("%s: STATUS_ERROR\n", __func__); cbdata->status =3D BIT(SVC_STATUS_ERROR); - cbdata->kaddr1 =3D NULL; + cbdata->kaddr1 =3D &res.a1; cbdata->kaddr2 =3D NULL; cbdata->kaddr3 =3D NULL; pdata->chan->scl->receive_cb(pdata->chan->scl, cbdata); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B7C4DC46467 for ; Tue, 5 Apr 2022 20:56:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1384556AbiDEU4D (ORCPT ); Tue, 5 Apr 2022 16:56:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354668AbiDEKPE (ORCPT ); Tue, 5 Apr 2022 06:15:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AF5C6C1FC; Tue, 5 Apr 2022 03:02:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C7CE2B81C83; Tue, 5 Apr 2022 10:02:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34A57C385A1; Tue, 5 Apr 2022 10:02:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152938; bh=FYy2NuQYAT8A88IIsa/Kesb6XY03e4b5Gwo9kUxcGzI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W4QSI0eo5TkekaQyKimMuXFkAh8+siqnB3BLq2CGd7vMUkDEN8+xly8ljrzPIgugs 06Rcc6yZQKznH50cPU4Brwouyl+IJUc1ocHgz2Wsm8XRrXHLs/DnyeboQZIyRmj1ho i9bZUm1HSn01tzBz84dkHxEuN4Lna4biwTi+7z+o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gwendal Grignou , Srinivas Pandruvada , Jiri Kosina Subject: [PATCH 5.10 044/599] HID: intel-ish-hid: Use dma_alloc_coherent for firmware update Date: Tue, 5 Apr 2022 09:25:38 +0200 Message-Id: <20220405070300.139280160@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gwendal Grignou commit f97ec5d75e9261a5da78dc28a8955b7cc0c4468b upstream. Allocating memory with kmalloc and GPF_DMA32 is not allowed, the allocator will ignore the attribute. Instead, use dma_alloc_coherent() API as we allocate a small amount of memory to transfer firmware fragment to the ISH. On Arcada chromebook, after the patch the warning: "Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0xcc0 (GFP_KERNEL). Fi= x your code!" is gone. The ISH firmware is loaded properly and we can interact with the ISH: > ectool --name cros_ish version ... Build info: arcada_ish_v2.0.3661+3c1a1c1ae0 2022-02-08 05:37:47 @localho= st Tool version: v2.0.12300-900b03ec7f 2022-02-08 10:01:48 @localhost Fixes: commit 91b228107da3 ("HID: intel-ish-hid: ISH firmware loader client= driver") Signed-off-by: Gwendal Grignou Acked-by: Srinivas Pandruvada Cc: stable@vger.kernel.org Signed-off-by: Jiri Kosina Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hid/intel-ish-hid/ishtp-fw-loader.c | 29 ++---------------------= ----- 1 file changed, 3 insertions(+), 26 deletions(-) --- a/drivers/hid/intel-ish-hid/ishtp-fw-loader.c +++ b/drivers/hid/intel-ish-hid/ishtp-fw-loader.c @@ -656,21 +656,12 @@ static int ish_fw_xfer_direct_dma(struct */ payload_max_size &=3D ~(L1_CACHE_BYTES - 1); =20 - dma_buf =3D kmalloc(payload_max_size, GFP_KERNEL | GFP_DMA32); + dma_buf =3D dma_alloc_coherent(devc, payload_max_size, &dma_buf_phy, GFP_= KERNEL); if (!dma_buf) { client_data->flag_retry =3D true; return -ENOMEM; } =20 - dma_buf_phy =3D dma_map_single(devc, dma_buf, payload_max_size, - DMA_TO_DEVICE); - if (dma_mapping_error(devc, dma_buf_phy)) { - dev_err(cl_data_to_dev(client_data), "DMA map failed\n"); - client_data->flag_retry =3D true; - rv =3D -ENOMEM; - goto end_err_dma_buf_release; - } - ldr_xfer_dma_frag.fragment.hdr.command =3D LOADER_CMD_XFER_FRAGMENT; ldr_xfer_dma_frag.fragment.xfer_mode =3D LOADER_XFER_MODE_DIRECT_DMA; ldr_xfer_dma_frag.ddr_phys_addr =3D (u64)dma_buf_phy; @@ -690,14 +681,7 @@ static int ish_fw_xfer_direct_dma(struct ldr_xfer_dma_frag.fragment.size =3D fragment_size; memcpy(dma_buf, &fw->data[fragment_offset], fragment_size); =20 - dma_sync_single_for_device(devc, dma_buf_phy, - payload_max_size, - DMA_TO_DEVICE); - - /* - * Flush cache here because the dma_sync_single_for_device() - * does not do for x86. - */ + /* Flush cache to be sure the data is in main memory. */ clflush_cache_range(dma_buf, payload_max_size); =20 dev_dbg(cl_data_to_dev(client_data), @@ -720,15 +704,8 @@ static int ish_fw_xfer_direct_dma(struct fragment_offset +=3D fragment_size; } =20 - dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); - kfree(dma_buf); - return 0; - end_err_resp_buf_release: - /* Free ISH buffer if not done already, in error case */ - dma_unmap_single(devc, dma_buf_phy, payload_max_size, DMA_TO_DEVICE); -end_err_dma_buf_release: - kfree(dma_buf); + dma_free_coherent(devc, payload_max_size, dma_buf, dma_buf_phy); return rv; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 56C1DC4167B for ; Tue, 5 Apr 2022 20:22:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1358184AbiDEUQc (ORCPT ); Tue, 5 Apr 2022 16:16:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354669AbiDEKPE (ORCPT ); Tue, 5 Apr 2022 06:15:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB32E6C480; Tue, 5 Apr 2022 03:02:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 83571B81C99; Tue, 5 Apr 2022 10:02:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D310CC385A1; Tue, 5 Apr 2022 10:02:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152941; bh=kqaUHqM6O4hl0lTDnmR2y1n4YeTkZq5aA0IYcX8trSU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UEVQwqHod0tOyQAXp3QMYA80CKNqqQJi555gfKK4X3cD2xtTEQtaaAebKt5aDKm5F KkGF4gyZdIToAJK9n8Fypq6x9gz5LaBQKcAhohlh0ByCrDZhEWbLt+O8W0vgk5VMM/ scJQuG0dPTwAvvmCEW1v1UEF4f3ZJNNeJ0PTkiSY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, NeilBrown , Trond Myklebust Subject: [PATCH 5.10 045/599] SUNRPC: avoid race between mod_timer() and del_timer_sync() Date: Tue, 5 Apr 2022 09:25:39 +0200 Message-Id: <20220405070300.168786032@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: NeilBrown commit 3848e96edf4788f772d83990022fa7023a233d83 upstream. xprt_destory() claims XPRT_LOCKED and then calls del_timer_sync(). Both xprt_unlock_connect() and xprt_release() call ->release_xprt() which drops XPRT_LOCKED and *then* xprt_schedule_autodisconnect() which calls mod_timer(). This may result in mod_timer() being called *after* del_timer_sync(). When this happens, the timer may fire long after the xprt has been freed, and run_timer_softirq() will probably crash. The pairing of ->release_xprt() and xprt_schedule_autodisconnect() is always called under ->transport_lock. So if we take ->transport_lock to call del_timer_sync(), we can be sure that mod_timer() will run first (if it runs at all). Cc: stable@vger.kernel.org Signed-off-by: NeilBrown Signed-off-by: Trond Myklebust Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/sunrpc/xprt.c | 7 +++++++ 1 file changed, 7 insertions(+) --- a/net/sunrpc/xprt.c +++ b/net/sunrpc/xprt.c @@ -2037,7 +2037,14 @@ static void xprt_destroy(struct rpc_xprt */ wait_on_bit_lock(&xprt->state, XPRT_LOCKED, TASK_UNINTERRUPTIBLE); =20 + /* + * xprt_schedule_autodisconnect() can run after XPRT_LOCKED + * is cleared. We use ->transport_lock to ensure the mod_timer() + * can only run *before* del_time_sync(), never after. + */ + spin_lock(&xprt->transport_lock); del_timer_sync(&xprt->timer); + spin_unlock(&xprt->transport_lock); =20 /* * Destroy sockets etc from the system workqueue so they can From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35D27C43217 for ; Wed, 6 Apr 2022 00:22:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1588015AbiDFALD (ORCPT ); Tue, 5 Apr 2022 20:11:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354671AbiDEKPE (ORCPT ); Tue, 5 Apr 2022 06:15:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B0D756C483; Tue, 5 Apr 2022 03:02:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 62D81B81B7A; Tue, 5 Apr 2022 10:02:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4870C385A1; Tue, 5 Apr 2022 10:02:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152944; bh=xVHp64TaI74NLn8bKNh6ZVRi72OAW/a3LCS5t+EfIKg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZpfMAjGqk+k+XG9lGd0/2UdwM54Rn8Hth8m2l6SpgaVA1Ly0G6Ky24xISPjQPKzmF TdX+nEZXa47o5Eaf9WIgN/DrHlubFfgtppDeVcWjh5iUowxFRlYbZSDcv8SpB6d151 TuAU3Pvdfu5GOaVmSkbZXgxcNDImlj4KK/MMInvM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Chuck Lever Subject: [PATCH 5.10 046/599] NFSD: prevent underflow in nfssvc_decode_writeargs() Date: Tue, 5 Apr 2022 09:25:40 +0200 Message-Id: <20220405070300.199473865@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit 184416d4b98509fb4c3d8fc3d6dc1437896cc159 upstream. Smatch complains: fs/nfsd/nfsxdr.c:341 nfssvc_decode_writeargs() warn: no lower bound on 'args->len' Change the type to unsigned to prevent this issue. Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/nfsd/nfsproc.c | 2 +- fs/nfsd/xdr.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) --- a/fs/nfsd/nfsproc.c +++ b/fs/nfsd/nfsproc.c @@ -223,7 +223,7 @@ nfsd_proc_write(struct svc_rqst *rqstp) unsigned long cnt =3D argp->len; unsigned int nvecs; =20 - dprintk("nfsd: WRITE %s %d bytes at %d\n", + dprintk("nfsd: WRITE %s %u bytes at %d\n", SVCFH_fmt(&argp->fh), argp->len, argp->offset); =20 --- a/fs/nfsd/xdr.h +++ b/fs/nfsd/xdr.h @@ -33,7 +33,7 @@ struct nfsd_readargs { struct nfsd_writeargs { svc_fh fh; __u32 offset; - int len; + __u32 len; struct kvec first; }; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88686C433EF for ; Wed, 6 Apr 2022 01:48:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1843895AbiDFBmT (ORCPT ); Tue, 5 Apr 2022 21:42:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43774 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354717AbiDEKPQ (ORCPT ); Tue, 5 Apr 2022 06:15:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74D0D6C489; Tue, 5 Apr 2022 03:02:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1FC1FB81C83; Tue, 5 Apr 2022 10:02:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 706B3C385A2; Tue, 5 Apr 2022 10:02:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152946; bh=i2lYnXvB9uh7beCesqpoNaBCXU6jLSBPvK+0DaTe7dc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vvv1cTdqG9HW99q5+q7gEG2wMBuZ/M5AUsad5VjMv18pP6F93IyoFH5M3LjZKXi2c S19C3X2iyP8NbrXp7qumd/eBOXH1TnwUacpjoE8TJzz+YqRXyKj3jrQHvcDfZ9tSgw cu6jQJROQLe/7w8Dbuh8lob1CKQQW8AdwAXFlmo0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Chuck Lever Subject: [PATCH 5.10 047/599] NFSD: prevent integer overflow on 32 bit systems Date: Tue, 5 Apr 2022 09:25:41 +0200 Message-Id: <20220405070300.228545542@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter commit 23a9dbbe0faf124fc4c139615633b9d12a3a89ef upstream. On a 32 bit system, the "len * sizeof(*p)" operation can have an integer overflow. Cc: stable@vger.kernel.org Signed-off-by: Dan Carpenter Signed-off-by: Chuck Lever Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/linux/sunrpc/xdr.h | 2 ++ 1 file changed, 2 insertions(+) --- a/include/linux/sunrpc/xdr.h +++ b/include/linux/sunrpc/xdr.h @@ -603,6 +603,8 @@ xdr_stream_decode_uint32_array(struct xd =20 if (unlikely(xdr_stream_decode_u32(xdr, &len) < 0)) return -EBADMSG; + if (len > SIZE_MAX / sizeof(*p)) + return -EBADMSG; p =3D xdr_inline_decode(xdr, len * sizeof(*p)); if (unlikely(!p)) return -EBADMSG; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 45814C433FE for ; Wed, 6 Apr 2022 00:35:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1443430AbiDFA35 (ORCPT ); Tue, 5 Apr 2022 20:29:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43778 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354753AbiDEKPd (ORCPT ); Tue, 5 Apr 2022 06:15:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E4896C49E; Tue, 5 Apr 2022 03:02:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1ACAA61676; Tue, 5 Apr 2022 10:02:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2EFDEC385A2; Tue, 5 Apr 2022 10:02:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152949; bh=7i9GyVEdKr8KeUI9ldWOHtArIA9zcppjnBFSW/KfIX8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YXUJ9k+ETEz8yNOBi1odi9YxBWwrIooCrCDoNk185+GdsX79hRO2zaPW1etSLSKdR UJ9AqYVUYOXR3itWaDCEWlrlC2heyygwJBbJDDJOlSQpHh3hdJt534ApXbG2km0+ue ruS3FNVkpoMW052dOEm+rK/6KahXpIHM69/2BOdg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pavel Machek , Chao Yu , Jaegeuk Kim Subject: [PATCH 5.10 048/599] f2fs: fix to unlock page correctly in error path of is_alive() Date: Tue, 5 Apr 2022 09:25:42 +0200 Message-Id: <20220405070300.258277744@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chao Yu commit 6d18762ed5cd549fde74fd0e05d4d87bac5a3beb upstream. As Pavel Machek reported in below link [1]: After commit 77900c45ee5c ("f2fs: fix to do sanity check in is_alive()"), node page should be unlock via calling f2fs_put_page() in the error path of is_alive(), otherwise, f2fs may hang when it tries to lock the node page, fix it. [1] https://lore.kernel.org/stable/20220124203637.GA19321@duo.ucw.cz/ Fixes: 77900c45ee5c ("f2fs: fix to do sanity check in is_alive()") Cc: Reported-by: Pavel Machek Signed-off-by: Pavel Machek Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/f2fs/gc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/f2fs/gc.c +++ b/fs/f2fs/gc.c @@ -998,8 +998,10 @@ static bool is_alive(struct f2fs_sb_info set_sbi_flag(sbi, SBI_NEED_FSCK); } =20 - if (f2fs_check_nid_range(sbi, dni->ino)) + if (f2fs_check_nid_range(sbi, dni->ino)) { + f2fs_put_page(node_page, 1); return false; + } =20 *nofs =3D ofs_of_node(node_page); source_blkaddr =3D data_blkaddr(NULL, node_page, ofs_in_node); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 12605C43217 for ; Tue, 5 Apr 2022 20:28:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357912AbiDEUXu (ORCPT ); Tue, 5 Apr 2022 16:23:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354754AbiDEKPd (ORCPT ); Tue, 5 Apr 2022 06:15:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C2DD6C4A1; Tue, 5 Apr 2022 03:02:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DCCB061676; Tue, 5 Apr 2022 10:02:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE996C385A2; Tue, 5 Apr 2022 10:02:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152952; bh=yrOpRFVVR1OsNePMDd/6AbHCRObGltdPhjNrhMNQIVY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fdNHs+QnRGSHXkBJl09wZCIULH5wowUFhRhr3SH+6Vde2mb/R6XHNz+udbbc5xppy UrCDE3ArzdGFXRN8tyl8hVCx32hz0HMLCNY/rEGqRYWaPsjnOumOnm24GwWC8PL+Wg ZF4glYuKj6bwHvWLi7rRLMXpdzIPFiQCZ+VoDcmM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Juhyung Park , Chao Yu , Jaegeuk Kim Subject: [PATCH 5.10 049/599] f2fs: quota: fix loop condition at f2fs_quota_sync() Date: Tue, 5 Apr 2022 09:25:43 +0200 Message-Id: <20220405070300.288062825@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Juhyung Park commit 680af5b824a52faa819167628665804a14f0e0df upstream. cnt should be passed to sb_has_quota_active() instead of type to check active quota properly. Moreover, when the type is -1, the compiler with enough inline knowledge can discard sb_has_quota_active() check altogether, causing a NULL pointer dereference at the following inode_lock(dqopt->files[cnt]): [ 2.796010] Unable to handle kernel NULL pointer dereference at virtual = address 00000000000000a0 [ 2.796024] Mem abort info: [ 2.796025] ESR =3D 0x96000005 [ 2.796028] EC =3D 0x25: DABT (current EL), IL =3D 32 bits [ 2.796029] SET =3D 0, FnV =3D 0 [ 2.796031] EA =3D 0, S1PTW =3D 0 [ 2.796032] Data abort info: [ 2.796034] ISV =3D 0, ISS =3D 0x00000005 [ 2.796035] CM =3D 0, WnR =3D 0 [ 2.796046] user pgtable: 4k pages, 39-bit VAs, pgdp=3D00000003370d1000 [ 2.796048] [00000000000000a0] pgd=3D0000000000000000, pud=3D00000000000= 00000 [ 2.796051] Internal error: Oops: 96000005 [#1] PREEMPT SMP [ 2.796056] CPU: 7 PID: 640 Comm: f2fs_ckpt-259:7 Tainted: G S = 5.4.179-arter97-r8-64666-g2f16e087f9d8 #1 [ 2.796057] Hardware name: Qualcomm Technologies, Inc. Lahaina MTP lemon= adep (DT) [ 2.796059] pstate: 80c00005 (Nzcv daif +PAN +UAO) [ 2.796065] pc : down_write+0x28/0x70 [ 2.796070] lr : f2fs_quota_sync+0x100/0x294 [ 2.796071] sp : ffffffa3f48ffc30 [ 2.796073] x29: ffffffa3f48ffc30 x28: 0000000000000000 [ 2.796075] x27: ffffffa3f6d718b8 x26: ffffffa415fe9d80 [ 2.796077] x25: ffffffa3f7290048 x24: 0000000000000001 [ 2.796078] x23: 0000000000000000 x22: ffffffa3f7290000 [ 2.796080] x21: ffffffa3f72904a0 x20: ffffffa3f7290110 [ 2.796081] x19: ffffffa3f77a9800 x18: ffffffc020aae038 [ 2.796083] x17: ffffffa40e38e040 x16: ffffffa40e38e6d0 [ 2.796085] x15: ffffffa40e38e6cc x14: ffffffa40e38e6d0 [ 2.796086] x13: 00000000000004f6 x12: 00162c44ff493000 [ 2.796088] x11: 0000000000000400 x10: ffffffa40e38c948 [ 2.796090] x9 : 0000000000000000 x8 : 00000000000000a0 [ 2.796091] x7 : 0000000000000000 x6 : 0000d1060f00002a [ 2.796093] x5 : ffffffa3f48ff718 x4 : 000000000000000d [ 2.796094] x3 : 00000000060c0000 x2 : 0000000000000001 [ 2.796096] x1 : 0000000000000000 x0 : 00000000000000a0 [ 2.796098] Call trace: [ 2.796100] down_write+0x28/0x70 [ 2.796102] f2fs_quota_sync+0x100/0x294 [ 2.796104] block_operations+0x120/0x204 [ 2.796106] f2fs_write_checkpoint+0x11c/0x520 [ 2.796107] __checkpoint_and_complete_reqs+0x7c/0xd34 [ 2.796109] issue_checkpoint_thread+0x6c/0xb8 [ 2.796112] kthread+0x138/0x414 [ 2.796114] ret_from_fork+0x10/0x18 [ 2.796117] Code: aa0803e0 aa1f03e1 52800022 aa0103e9 (c8e97d02) [ 2.796120] ---[ end trace 96e942e8eb6a0b53 ]--- [ 2.800116] Kernel panic - not syncing: Fatal exception [ 2.800120] SMP: stopping secondary CPUs Fixes: 9de71ede81e6 ("f2fs: quota: fix potential deadlock") Cc: # v5.15+ Signed-off-by: Juhyung Park Reviewed-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/f2fs/super.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -2278,7 +2278,7 @@ int f2fs_quota_sync(struct super_block * struct f2fs_sb_info *sbi =3D F2FS_SB(sb); struct quota_info *dqopt =3D sb_dqopt(sb); int cnt; - int ret; + int ret =3D 0; =20 /* * Now when everything is written we can discard the pagecache so @@ -2289,8 +2289,8 @@ int f2fs_quota_sync(struct super_block * if (type !=3D -1 && cnt !=3D type) continue; =20 - if (!sb_has_quota_active(sb, type)) - return 0; + if (!sb_has_quota_active(sb, cnt)) + continue; =20 inode_lock(dqopt->files[cnt]); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BECD2C433EF for ; Wed, 6 Apr 2022 01:26:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1841722AbiDFBZ1 (ORCPT ); Tue, 5 Apr 2022 21:25:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354756AbiDEKPd (ORCPT ); Tue, 5 Apr 2022 06:15:33 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2D3A36C4A5; Tue, 5 Apr 2022 03:02:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BE4E161740; Tue, 5 Apr 2022 10:02:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5E64C385A1; Tue, 5 Apr 2022 10:02:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152955; bh=locgQxsyc0MpvAdZeZH1B7amSJ1o7txFD/CTHTitM/g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JkaBythOPpsAqlnM1UmkT7GPGCubDuz0L2jj5NP97f1xYymLODM6pqSeHblqidvGh AAoq35pmx1535L62sEVigAp0dVvWiTTcvv4mrmzX8dSD4sJahLBCz2Z8G1ukpGJHlV iAXo2peRT/GWXjRsoznlcHDN23G9BuhJQmehFsNE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chao Yu , Jaegeuk Kim Subject: [PATCH 5.10 050/599] f2fs: fix to do sanity check on .cp_pack_total_block_count Date: Tue, 5 Apr 2022 09:25:44 +0200 Message-Id: <20220405070300.317859746@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chao Yu commit 5b5b4f85b01604389f7a0f11ef180a725bf0e2d4 upstream. As bughunter reported in bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=3D215709 f2fs may hang when mounting a fuzzed image, the dmesg shows as below: __filemap_get_folio+0x3a9/0x590 pagecache_get_page+0x18/0x60 __get_meta_page+0x95/0x460 [f2fs] get_checkpoint_version+0x2a/0x1e0 [f2fs] validate_checkpoint+0x8e/0x2a0 [f2fs] f2fs_get_valid_checkpoint+0xd0/0x620 [f2fs] f2fs_fill_super+0xc01/0x1d40 [f2fs] mount_bdev+0x18a/0x1c0 f2fs_mount+0x15/0x20 [f2fs] legacy_get_tree+0x28/0x50 vfs_get_tree+0x27/0xc0 path_mount+0x480/0xaa0 do_mount+0x7c/0xa0 __x64_sys_mount+0x8b/0xe0 do_syscall_64+0x38/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae The root cause is cp_pack_total_block_count field in checkpoint was fuzzed to one, as calcuated, two cp pack block locates in the same block address, so then read latter cp pack block, it will block on the page lock due to the lock has already held when reading previous cp pack block, fix it by adding sanity check for cp_pack_total_block_count. Cc: stable@vger.kernel.org Signed-off-by: Chao Yu Signed-off-by: Jaegeuk Kim Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/f2fs/checkpoint.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/fs/f2fs/checkpoint.c +++ b/fs/f2fs/checkpoint.c @@ -851,6 +851,7 @@ static struct page *validate_checkpoint( struct page *cp_page_1 =3D NULL, *cp_page_2 =3D NULL; struct f2fs_checkpoint *cp_block =3D NULL; unsigned long long cur_version =3D 0, pre_version =3D 0; + unsigned int cp_blocks; int err; =20 err =3D get_checkpoint_version(sbi, cp_addr, &cp_block, @@ -858,15 +859,16 @@ static struct page *validate_checkpoint( if (err) return NULL; =20 - if (le32_to_cpu(cp_block->cp_pack_total_block_count) > - sbi->blocks_per_seg) { + cp_blocks =3D le32_to_cpu(cp_block->cp_pack_total_block_count); + + if (cp_blocks > sbi->blocks_per_seg || cp_blocks <=3D F2FS_CP_PACKS) { f2fs_warn(sbi, "invalid cp_pack_total_block_count:%u", le32_to_cpu(cp_block->cp_pack_total_block_count)); goto invalid_cp; } pre_version =3D *version; =20 - cp_addr +=3D le32_to_cpu(cp_block->cp_pack_total_block_count) - 1; + cp_addr +=3D cp_blocks - 1; err =3D get_checkpoint_version(sbi, cp_addr, &cp_block, &cp_page_2, version); if (err) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E4264C43219 for ; Tue, 5 Apr 2022 20:23:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1350551AbiDEUWw (ORCPT ); Tue, 5 Apr 2022 16:22:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43786 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354759AbiDEKPe (ORCPT ); Tue, 5 Apr 2022 06:15:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F389E49256; Tue, 5 Apr 2022 03:02:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8FB4F6172B; Tue, 5 Apr 2022 10:02:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B434C385A1; Tue, 5 Apr 2022 10:02:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152958; bh=k04tRHaCCcaSw16B5b4zqxD/SIoqsMzrPWW5b4SpaUY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uBTJMYh1kpH9daBvUzCX2ZnVWkt5yq09suIO2yPIesh2sIX+o25O2vl7bbH7pawb4 mXLMzzGqhbDq7sgdEfS2LhzRFhHVXATieIv2hXbpGc5KjnezZiKY1A9BebQkw+gIdh iCS3Oe/kZy6MczG3qzcsQXxv9A0Q116hhxc6KD9E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alistair Delva , Rishabh Bhatnagar , Ohad Ben-Cohen , Bjorn Andersson , Mathieu Poirier , Sibi Sankar , linux-remoteproc@vger.kernel.org, kernel-team@android.com Subject: [PATCH 5.10 051/599] remoteproc: Fix count check in rproc_coredump_write() Date: Tue, 5 Apr 2022 09:25:45 +0200 Message-Id: <20220405070300.346945793@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alistair Delva commit f89672cc3681952f2d06314981a6b45f8b0045d1 upstream. Check count for 0, to avoid a potential underflow. Make the check the same as the one in rproc_recovery_write(). Fixes: 3afdc59e4390 ("remoteproc: Add coredump debugfs entry") Signed-off-by: Alistair Delva Cc: Rishabh Bhatnagar Cc: stable@vger.kernel.org Cc: Ohad Ben-Cohen Cc: Bjorn Andersson Cc: Mathieu Poirier Cc: Sibi Sankar Cc: linux-remoteproc@vger.kernel.org Cc: kernel-team@android.com Reviewed-by: Bjorn Andersson Signed-off-by: Bjorn Andersson Link: https://lore.kernel.org/r/20220119232139.1125908-1-adelva@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/remoteproc/remoteproc_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/remoteproc/remoteproc_debugfs.c +++ b/drivers/remoteproc/remoteproc_debugfs.c @@ -76,7 +76,7 @@ static ssize_t rproc_coredump_write(stru int ret, err =3D 0; char buf[20]; =20 - if (count > sizeof(buf)) + if (count < 1 || count > sizeof(buf)) return -EINVAL; =20 ret =3D copy_from_user(buf, user_buf, count); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62D23C4332F for ; Wed, 6 Apr 2022 00:35:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1835895AbiDFAd7 (ORCPT ); Tue, 5 Apr 2022 20:33:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354777AbiDEKPs (ORCPT ); Tue, 5 Apr 2022 06:15:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 328FF6C926; Tue, 5 Apr 2022 03:02:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E8CB1B81B7A; Tue, 5 Apr 2022 10:02:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60021C385A1; Tue, 5 Apr 2022 10:02:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152960; bh=GrLKfpMAhDiFsA9sctGu5r6LDF039bw7+aj2UbXwqKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ybeg6cv8Yu8fCVG7hrfZ3OiGU1k56mzgqLO4ebUgNM2N8eUn77EBJNKbEMfYCvPc3 mhObYVkUNU+JkFMfWkHgWsyTx7IU0Ew3lHu3CnJ8NLM9g8fDQB5jUn7yJJdoLpriuD 2g9UmWiMVmQ41uLunUMmyRD7CWw2czKdOxrmpzK0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Sam Protsenko , Chanho Park Subject: [PATCH 5.10 052/599] pinctrl: samsung: drop pin banks references on error paths Date: Tue, 5 Apr 2022 09:25:46 +0200 Message-Id: <20220405070300.376469907@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit 50ebd19e3585b9792e994cfa8cbee8947fe06371 upstream. The driver iterates over its devicetree children with for_each_child_of_node() and stores for later found node pointer. This has to be put in error paths to avoid leak during re-probing. Fixes: ab663789d697 ("pinctrl: samsung: Match pin banks with their device n= odes") Cc: Signed-off-by: Krzysztof Kozlowski Reviewed-by: Sam Protsenko Reviewed-by: Chanho Park Link: https://lore.kernel.org/r/20220111201426.326777-2-krzysztof.kozlowski= @canonical.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/pinctrl/samsung/pinctrl-samsung.c | 30 +++++++++++++++++++++++--= ----- 1 file changed, 23 insertions(+), 7 deletions(-) --- a/drivers/pinctrl/samsung/pinctrl-samsung.c +++ b/drivers/pinctrl/samsung/pinctrl-samsung.c @@ -1002,6 +1002,16 @@ samsung_pinctrl_get_soc_data_for_of_alia return &(of_data->ctrl[id]); } =20 +static void samsung_banks_of_node_put(struct samsung_pinctrl_drv_data *d) +{ + struct samsung_pin_bank *bank; + unsigned int i; + + bank =3D d->pin_banks; + for (i =3D 0; i < d->nr_banks; ++i, ++bank) + of_node_put(bank->of_node); +} + /* retrieve the soc specific data */ static const struct samsung_pin_ctrl * samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, @@ -1116,19 +1126,19 @@ static int samsung_pinctrl_probe(struct if (ctrl->retention_data) { drvdata->retention_ctrl =3D ctrl->retention_data->init(drvdata, ctrl->retention_data); - if (IS_ERR(drvdata->retention_ctrl)) - return PTR_ERR(drvdata->retention_ctrl); + if (IS_ERR(drvdata->retention_ctrl)) { + ret =3D PTR_ERR(drvdata->retention_ctrl); + goto err_put_banks; + } } =20 ret =3D samsung_pinctrl_register(pdev, drvdata); if (ret) - return ret; + goto err_put_banks; =20 ret =3D samsung_gpiolib_register(pdev, drvdata); - if (ret) { - samsung_pinctrl_unregister(pdev, drvdata); - return ret; - } + if (ret) + goto err_unregister; =20 if (ctrl->eint_gpio_init) ctrl->eint_gpio_init(drvdata); @@ -1138,6 +1148,12 @@ static int samsung_pinctrl_probe(struct platform_set_drvdata(pdev, drvdata); =20 return 0; + +err_unregister: + samsung_pinctrl_unregister(pdev, drvdata); +err_put_banks: + samsung_banks_of_node_put(drvdata); + return ret; } =20 /* From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F022C4167D for ; Wed, 6 Apr 2022 01:13:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1841076AbiDFBPG (ORCPT ); Tue, 5 Apr 2022 21:15:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43808 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354776AbiDEKPs (ORCPT ); Tue, 5 Apr 2022 06:15:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E5CB149C83; Tue, 5 Apr 2022 03:02:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 99C05B81C8B; Tue, 5 Apr 2022 10:02:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17892C385A1; Tue, 5 Apr 2022 10:02:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152963; bh=3TnHiDcoE4UN7piXzw8IEQIziQxDeP2KahwoBf8cuVg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SJYjXxRc8m1RbNetZo3orsE7L7WKKxzlJcvlpQA3GArXcLp0l1/eGibsZSxVbkgrG 59rhFq8iqsiY1HSAkivy/H5uJTeS/cDP8P2OQExwpHLSJrcSeubSoVpctWFyYPQ6x+ D9FRmUG7Ya3eipyyI89HcVDh4KfhHrJgos/l1I4Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mason Yang , Miquel Raynal , Zhengxun Li , Mark Brown Subject: [PATCH 5.10 053/599] spi: mxic: Fix the transmit path Date: Tue, 5 Apr 2022 09:25:47 +0200 Message-Id: <20220405070300.406181228@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miquel Raynal commit 5fd6739e0df7e320bcac103dfb95fe75941fea17 upstream. By working with external hardware ECC engines, we figured out that Under certain circumstances, it is needed for the SPI controller to check INT_TX_EMPTY and INT_RX_NOT_EMPTY in both receive and transmit path (not only in the receive path). The delay penalty being negligible, move this code in the common path. Fixes: b942d80b0a39 ("spi: Add MXIC controller driver") Cc: stable@vger.kernel.org Suggested-by: Mason Yang Signed-off-by: Miquel Raynal Reviewed-by: Zhengxun Li Reviewed-by: Mark Brown Link: https://lore.kernel.org/linux-mtd/20220127091808.1043392-10-miquel.ra= ynal@bootlin.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/spi/spi-mxic.c | 26 +++++++++++--------------- 1 file changed, 11 insertions(+), 15 deletions(-) --- a/drivers/spi/spi-mxic.c +++ b/drivers/spi/spi-mxic.c @@ -304,25 +304,21 @@ static int mxic_spi_data_xfer(struct mxi =20 writel(data, mxic->regs + TXD(nbytes % 4)); =20 - if (rxbuf) { - ret =3D readl_poll_timeout(mxic->regs + INT_STS, sts, - sts & INT_TX_EMPTY, 0, - USEC_PER_SEC); - if (ret) - return ret; + ret =3D readl_poll_timeout(mxic->regs + INT_STS, sts, + sts & INT_TX_EMPTY, 0, USEC_PER_SEC); + if (ret) + return ret; =20 - ret =3D readl_poll_timeout(mxic->regs + INT_STS, sts, - sts & INT_RX_NOT_EMPTY, 0, - USEC_PER_SEC); - if (ret) - return ret; + ret =3D readl_poll_timeout(mxic->regs + INT_STS, sts, + sts & INT_RX_NOT_EMPTY, 0, + USEC_PER_SEC); + if (ret) + return ret; =20 - data =3D readl(mxic->regs + RXD); + data =3D readl(mxic->regs + RXD); + if (rxbuf) { data >>=3D (8 * (4 - nbytes)); memcpy(rxbuf + pos, &data, nbytes); - WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); - } else { - readl(mxic->regs + RXD); } WARN_ON(readl(mxic->regs + INT_STS) & INT_RX_NOT_EMPTY); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C2BD2C4332F for ; Tue, 5 Apr 2022 22:39:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1450845AbiDEW3N (ORCPT ); Tue, 5 Apr 2022 18:29:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45470 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354785AbiDEKPt (ORCPT ); Tue, 5 Apr 2022 06:15:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01F744A3F6; Tue, 5 Apr 2022 03:02:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 910F0616E7; Tue, 5 Apr 2022 10:02:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A1C15C385A1; Tue, 5 Apr 2022 10:02:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152969; bh=j4snWJe9nUqm/qqeWyVMDCxVVL4IKFAL6keBPT7uBzQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PtG+X1ytDp3Hq8oY3J+YWCjtr1RpIq3IngfKKLdt6v6sY7U17SKu4CtrnmTv9LuzF 4hr9aMe9SEnoCh0BtNPFt0S2o6ly8b3jgxdDKxemI2CLzIeogfrRJQlBBqVEVSFaxu Vq/cuOqJiQlsK9bVM8Zru9SQr/vUNXa2SlQhNag8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sean Nyekjaer , Boris Brezillon , Miquel Raynal Subject: [PATCH 5.10 054/599] mtd: rawnand: protect access to rawnand devices while in suspend Date: Tue, 5 Apr 2022 09:25:48 +0200 Message-Id: <20220405070300.435966919@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Nyekjaer commit 8cba323437a49a45756d661f500b324fc2d486fe upstream. Prevent rawnand access while in a suspended state. Commit 013e6292aaf5 ("mtd: rawnand: Simplify the locking") allows the rawnand layer to return errors rather than waiting in a blocking wait. Tested on a iMX6ULL. Fixes: 013e6292aaf5 ("mtd: rawnand: Simplify the locking") Signed-off-by: Sean Nyekjaer Reviewed-by: Boris Brezillon Cc: stable@vger.kernel.org Signed-off-by: Miquel Raynal Link: https://lore.kernel.org/linux-mtd/20220208085213.1838273-1-sean@geani= x.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/mtd/nand/raw/nand_base.c | 44 +++++++++++++++++-----------------= ----- include/linux/mtd/rawnand.h | 2 + 2 files changed, 22 insertions(+), 24 deletions(-) --- a/drivers/mtd/nand/raw/nand_base.c +++ b/drivers/mtd/nand/raw/nand_base.c @@ -297,16 +297,19 @@ static int nand_isbad_bbm(struct nand_ch * * Return: -EBUSY if the chip has been suspended, 0 otherwise */ -static int nand_get_device(struct nand_chip *chip) +static void nand_get_device(struct nand_chip *chip) { - mutex_lock(&chip->lock); - if (chip->suspended) { + /* Wait until the device is resumed. */ + while (1) { + mutex_lock(&chip->lock); + if (!chip->suspended) { + mutex_lock(&chip->controller->lock); + return; + } mutex_unlock(&chip->lock); - return -EBUSY; - } - mutex_lock(&chip->controller->lock); =20 - return 0; + wait_event(chip->resume_wq, !chip->suspended); + } } =20 /** @@ -531,9 +534,7 @@ static int nand_block_markbad_lowlevel(s nand_erase_nand(chip, &einfo, 0); =20 /* Write bad block marker to OOB */ - ret =3D nand_get_device(chip); - if (ret) - return ret; + nand_get_device(chip); =20 ret =3D nand_markbad_bbm(chip, ofs); nand_release_device(chip); @@ -3534,9 +3535,7 @@ static int nand_read_oob(struct mtd_info ops->mode !=3D MTD_OPS_RAW) return -ENOTSUPP; =20 - ret =3D nand_get_device(chip); - if (ret) - return ret; + nand_get_device(chip); =20 if (!ops->datbuf) ret =3D nand_do_read_oob(chip, from, ops); @@ -4119,13 +4118,11 @@ static int nand_write_oob(struct mtd_inf struct mtd_oob_ops *ops) { struct nand_chip *chip =3D mtd_to_nand(mtd); - int ret; + int ret =3D 0; =20 ops->retlen =3D 0; =20 - ret =3D nand_get_device(chip); - if (ret) - return ret; + nand_get_device(chip); =20 switch (ops->mode) { case MTD_OPS_PLACE_OOB: @@ -4181,9 +4178,7 @@ int nand_erase_nand(struct nand_chip *ch return -EINVAL; =20 /* Grab the lock and see if the device is available */ - ret =3D nand_get_device(chip); - if (ret) - return ret; + nand_get_device(chip); =20 /* Shift to get first page */ page =3D (int)(instr->addr >> chip->page_shift); @@ -4270,7 +4265,7 @@ static void nand_sync(struct mtd_info *m pr_debug("%s: called\n", __func__); =20 /* Grab the lock and see if the device is available */ - WARN_ON(nand_get_device(chip)); + nand_get_device(chip); /* Release it and go back */ nand_release_device(chip); } @@ -4287,9 +4282,7 @@ static int nand_block_isbad(struct mtd_i int ret; =20 /* Select the NAND device */ - ret =3D nand_get_device(chip); - if (ret) - return ret; + nand_get_device(chip); =20 nand_select_target(chip, chipnr); =20 @@ -4360,6 +4353,8 @@ static void nand_resume(struct mtd_info __func__); } mutex_unlock(&chip->lock); + + wake_up_all(&chip->resume_wq); } =20 /** @@ -5068,6 +5063,7 @@ static int nand_scan_ident(struct nand_c chip->cur_cs =3D -1; =20 mutex_init(&chip->lock); + init_waitqueue_head(&chip->resume_wq); =20 /* Enforce the right timings for reset/detection */ chip->current_interface_config =3D nand_get_reset_interface_config(); --- a/include/linux/mtd/rawnand.h +++ b/include/linux/mtd/rawnand.h @@ -1083,6 +1083,7 @@ struct nand_manufacturer { * @lock: Lock protecting the suspended field. Also used to serialize acce= sses * to the NAND device * @suspended: Set to 1 when the device is suspended, 0 when it's not + * @resume_wq: wait queue to sleep if rawnand is in suspended state. * @cur_cs: Currently selected target. -1 means no target selected, otherw= ise we * should always have cur_cs >=3D 0 && cur_cs < nanddev_ntargets(= ). * NAND Controller drivers should not modify this value, but they= 're @@ -1135,6 +1136,7 @@ struct nand_chip { /* Internals */ struct mutex lock; unsigned int suspended : 1; + wait_queue_head_t resume_wq; int cur_cs; int read_retries; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF92DC433F5 for ; Tue, 5 Apr 2022 23:25:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1575302AbiDEXDf (ORCPT ); Tue, 5 Apr 2022 19:03:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354783AbiDEKPt (ORCPT ); Tue, 5 Apr 2022 06:15:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D0E846C93B; Tue, 5 Apr 2022 03:02:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 69264616E7; Tue, 5 Apr 2022 10:02:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7023FC385A1; Tue, 5 Apr 2022 10:02:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152971; bh=RM0KKzpT8cLsJyrZoDbIHvg0ONgKHvUQdCMuQWGyK5Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=K96x80/S/LSJC0knU6J/3iAt8q04PSZM5cnYiMCM60AGWEN5n8ImbDJUFrm11wfvT +JHrwEYetQ0F8DUbCEu4BmyM/nXqGTmNBaefhadEnFofjhEa3jre2fpcnzWuKrMeYw NySjXHwMXjmhU219ID1bIuNNiCMjCsZkmyAWa1AE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sebastian Haas , Hangyu Hua , Marc Kleine-Budde Subject: [PATCH 5.10 055/599] can: ems_usb: ems_usb_start_xmit(): fix double dev_kfree_skb() in error path Date: Tue, 5 Apr 2022 09:25:49 +0200 Message-Id: <20220405070300.465505942@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua commit c70222752228a62135cee3409dccefd494a24646 upstream. There is no need to call dev_kfree_skb() when usb_submit_urb() fails beacause can_put_echo_skb() deletes the original skb and can_free_echo_skb() deletes the cloned skb. Link: https://lore.kernel.org/all/20220228083639.38183-1-hbh25y@gmail.com Fixes: 702171adeed3 ("ems_usb: Added support for EMS CPC-USB/ARM7 CAN/USB i= nterface") Cc: stable@vger.kernel.org Cc: Sebastian Haas Signed-off-by: Hangyu Hua Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/can/usb/ems_usb.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/can/usb/ems_usb.c +++ b/drivers/net/can/usb/ems_usb.c @@ -823,7 +823,6 @@ static netdev_tx_t ems_usb_start_xmit(st =20 usb_unanchor_urb(urb); usb_free_coherent(dev->udev, size, buf, urb->transfer_dma); - dev_kfree_skb(skb); =20 atomic_dec(&dev->active_tx_urbs); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C276C4167D for ; Wed, 6 Apr 2022 01:06:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839475AbiDFBDs (ORCPT ); Tue, 5 Apr 2022 21:03:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36678 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354815AbiDEKQF (ORCPT ); Tue, 5 Apr 2022 06:16:05 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DD084A3EF; Tue, 5 Apr 2022 03:02:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CBFFAB81B7A; Tue, 5 Apr 2022 10:02:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 21C59C385A2; Tue, 5 Apr 2022 10:02:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152974; bh=gXLc8Nmru/OE480BeQnP0EBfJ2//XCu6TqSqJ64TlP0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2RwB5jSvOXwXzDawimK4mPbEfTbW9VyQPQ9WmDkkuPFwkNOINCYkVLkQNNdwsh2VQ xxNfZl2HGMLA8YfWCZ+iEwgb898ilZu2yZk+1oRyP50x/xMbCBgoQ8Q/4MdugeeeVq pydvHxcZJhBYPQJMBw5YRbEi/aQCj2/gHNCHb5io= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hulk Robot , Baokun Li , Richard Weinberger Subject: [PATCH 5.10 056/599] jffs2: fix use-after-free in jffs2_clear_xattr_subsystem Date: Tue, 5 Apr 2022 09:25:50 +0200 Message-Id: <20220405070300.494430291@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit 4c7c44ee1650677fbe89d86edbad9497b7679b5c upstream. When we mount a jffs2 image, assume that the first few blocks of the image are normal and contain at least one xattr-related inode, but the next block is abnormal. As a result, an error is returned in jffs2_scan_eraseblock(). jffs2_clear_xattr_subsystem() is then called in jffs2_build_filesystem() and then again in jffs2_do_fill_super(). Finally we can observe the following report: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in jffs2_clear_xattr_subsystem+0x95/0x6ac Read of size 8 at addr ffff8881243384e0 by task mount/719 Call Trace: dump_stack+0x115/0x16b jffs2_clear_xattr_subsystem+0x95/0x6ac jffs2_do_fill_super+0x84f/0xc30 jffs2_fill_super+0x2ea/0x4c0 mtd_get_sb+0x254/0x400 mtd_get_sb_by_nr+0x4f/0xd0 get_tree_mtd+0x498/0x840 jffs2_get_tree+0x25/0x30 vfs_get_tree+0x8d/0x2e0 path_mount+0x50f/0x1e50 do_mount+0x107/0x130 __se_sys_mount+0x1c5/0x2f0 __x64_sys_mount+0xc7/0x160 do_syscall_64+0x45/0x70 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Allocated by task 719: kasan_save_stack+0x23/0x60 __kasan_kmalloc.constprop.0+0x10b/0x120 kasan_slab_alloc+0x12/0x20 kmem_cache_alloc+0x1c0/0x870 jffs2_alloc_xattr_ref+0x2f/0xa0 jffs2_scan_medium.cold+0x3713/0x4794 jffs2_do_mount_fs.cold+0xa7/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] Freed by task 719: kmem_cache_free+0xcc/0x7b0 jffs2_free_xattr_ref+0x78/0x98 jffs2_clear_xattr_subsystem+0xa1/0x6ac jffs2_do_mount_fs.cold+0x5e6/0x2253 jffs2_do_fill_super+0x383/0xc30 jffs2_fill_super+0x2ea/0x4c0 [...] The buggy address belongs to the object at ffff8881243384b8 which belongs to the cache jffs2_xattr_ref of size 48 The buggy address is located 40 bytes inside of 48-byte region [ffff8881243384b8, ffff8881243384e8) [...] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D The triggering of the BUG is shown in the following stack: Reported-by: Hulk Robot Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee ----------------------------------------------------------- jffs2_fill_super jffs2_do_fill_super jffs2_do_mount_fs jffs2_build_filesystem jffs2_scan_medium jffs2_scan_eraseblock <--- ERROR jffs2_clear_xattr_subsystem <--- free jffs2_clear_xattr_subsystem <--- free again ----------------------------------------------------------- An error is returned in jffs2_do_mount_fs(). If the error is returned by jffs2_sum_init(), the jffs2_clear_xattr_subsystem() does not need to be executed. If the error is returned by jffs2_build_filesystem(), the jffs2_clear_xattr_subsystem() also does not need to be executed again. So move jffs2_clear_xattr_subsystem() from 'out_inohash' to 'out_root' to fix this UAF problem. Fixes: aa98d7cf59b5 ("[JFFS2][XATTR] XATTR support on JFFS2 (version. 5)") Cc: stable@vger.kernel.org Reported-by: Hulk Robot Signed-off-by: Baokun Li Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- fs/jffs2/fs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/fs/jffs2/fs.c +++ b/fs/jffs2/fs.c @@ -602,8 +602,8 @@ out_root: jffs2_free_ino_caches(c); jffs2_free_raw_node_refs(c); kvfree(c->blocks); - out_inohash: jffs2_clear_xattr_subsystem(c); + out_inohash: kfree(c->inocache_list); out_wbuf: jffs2_flash_cleanup(c); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA4EFC433F5 for ; Wed, 6 Apr 2022 01:26:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1841881AbiDFB0O (ORCPT ); Tue, 5 Apr 2022 21:26:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46864 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354828AbiDEKQJ (ORCPT ); Tue, 5 Apr 2022 06:16:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C05476C93D; Tue, 5 Apr 2022 03:02:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7B0B0B81BC0; Tue, 5 Apr 2022 10:02:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E368CC385A2; Tue, 5 Apr 2022 10:02:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152977; bh=5IqUjJTSOJ5iA71G3v7PMy802c6wfxcw7Yd0aVsWReA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mJjKbHsoO3GUe++/kLFqcD2SzKBmBUqiFEDb8vXvjWpYciufNHxT/8uo7stwnI10o 9mew8m/PYgT+gm6dmgC2uR6a+xON2tq5Xc2bnMtJikUtvh5kR70S/+iK4R961Ku7Lg 7V9+I0K7LToev98L+SW8DIWLk05bxFuWYcxK+vH0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baokun Li , Richard Weinberger Subject: [PATCH 5.10 057/599] jffs2: fix memory leak in jffs2_do_mount_fs Date: Tue, 5 Apr 2022 09:25:51 +0200 Message-Id: <20220405070300.524656148@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit d051cef784de4d54835f6b6836d98a8f6935772c upstream. If jffs2_build_filesystem() in jffs2_do_mount_fs() returns an error, we can observe the following kmemleak report: Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee -------------------------------------------- unreferenced object 0xffff88811b25a640 (size 64): comm "mount", pid 691, jiffies 4294957728 (age 71.952s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [] kmem_cache_alloc_trace+0x584/0x880 [] jffs2_sum_init+0x86/0x130 [] jffs2_do_mount_fs+0x798/0xac0 [] jffs2_do_fill_super+0x383/0xc30 [] jffs2_fill_super+0x2ea/0x4c0 [...] unreferenced object 0xffff88812c760000 (size 65536): comm "mount", pid 691, jiffies 4294957728 (age 71.952s) hex dump (first 32 bytes): bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb bb ................ backtrace: [] __kmalloc+0x6b9/0x910 [] jffs2_sum_init+0xd7/0x130 [] jffs2_do_mount_fs+0x798/0xac0 [] jffs2_do_fill_super+0x383/0xc30 [] jffs2_fill_super+0x2ea/0x4c0 [...] -------------------------------------------- This is because the resources allocated in jffs2_sum_init() are not released. Call jffs2_sum_exit() to release these resources to solve the problem. Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time i= mprovement)") Cc: stable@vger.kernel.org Signed-off-by: Baokun Li Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- fs/jffs2/build.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/fs/jffs2/build.c +++ b/fs/jffs2/build.c @@ -415,13 +415,15 @@ int jffs2_do_mount_fs(struct jffs2_sb_in jffs2_free_ino_caches(c); jffs2_free_raw_node_refs(c); ret =3D -EIO; - goto out_free; + goto out_sum_exit; } =20 jffs2_calc_trigger_levels(c); =20 return 0; =20 + out_sum_exit: + jffs2_sum_exit(c); out_free: kvfree(c->blocks); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1E3D0C43219 for ; Tue, 5 Apr 2022 23:41:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1577744AbiDEXQk (ORCPT ); Tue, 5 Apr 2022 19:16:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354824AbiDEKQJ (ORCPT ); Tue, 5 Apr 2022 06:16:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 081556C942; Tue, 5 Apr 2022 03:03:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 27995B81BC0; Tue, 5 Apr 2022 10:03:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 982CDC385A2; Tue, 5 Apr 2022 10:02:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152980; bh=sKywzZUH5FV82mHccsP45ibhee3xzG3cgiuNbnWvg4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UcfPgjcOAPrnugsFHpSatzjYB4H2pqVlDPfCD/AevaMvHNwrpIN16dSsSGVu7DAYC keG1EU1d3PcrcyPXvvF4hJKykdvVKPMNwzMG5x/yqGzzYaHbcWPfYJyAcOcJgscw45 frdxn37v6uTEqUQ2KpwhXluDSHnb3yNIYRxlw8kg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Baokun Li , Richard Weinberger Subject: [PATCH 5.10 058/599] jffs2: fix memory leak in jffs2_scan_medium Date: Tue, 5 Apr 2022 09:25:52 +0200 Message-Id: <20220405070300.554274469@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Baokun Li commit 9cdd3128874f5fe759e2c4e1360ab7fb96a8d1df upstream. If an error is returned in jffs2_scan_eraseblock() and some memory has been added to the jffs2_summary *s, we can observe the following kmemleak report: Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee -------------------------------------------- unreferenced object 0xffff88812b889c40 (size 64): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): 40 48 b5 14 81 88 ff ff 01 e0 31 00 00 00 50 00 @H........1...P. 00 00 01 00 00 00 01 00 00 00 02 00 00 00 09 08 ................ backtrace: [] __kmalloc+0x613/0x910 [] jffs2_sum_add_dirent_mem+0x5c/0xa0 [] jffs2_scan_medium.cold+0x36e5/0x4794 [] jffs2_do_mount_fs.cold+0xa7/0x2267 [] jffs2_do_fill_super+0x383/0xc30 [] jffs2_fill_super+0x2ea/0x4c0 [] mtd_get_sb+0x254/0x400 [] mtd_get_sb_by_nr+0x4f/0xd0 [] get_tree_mtd+0x498/0x840 [] jffs2_get_tree+0x25/0x30 [] vfs_get_tree+0x8d/0x2e0 [] path_mount+0x50f/0x1e50 [] do_mount+0x107/0x130 [] __se_sys_mount+0x1c5/0x2f0 [] __x64_sys_mount+0xc7/0x160 [] do_syscall_64+0x45/0x70 unreferenced object 0xffff888114b54840 (size 32): comm "mount", pid 692, jiffies 4294838325 (age 34.288s) hex dump (first 32 bytes): c0 75 b5 14 81 88 ff ff 02 e0 02 00 00 00 02 00 .u.............. 00 00 84 00 00 00 44 00 00 00 6b 6b 6b 6b 6b a5 ......D...kkkkk. backtrace: [] kmem_cache_alloc_trace+0x584/0x880 [] jffs2_sum_add_inode_mem+0x54/0x90 [] jffs2_scan_medium.cold+0x4481/0x4794 [...] unreferenced object 0xffff888114b57280 (size 32): comm "mount", pid 692, jiffies 4294838393 (age 34.357s) hex dump (first 32 bytes): 10 d5 6c 11 81 88 ff ff 08 e0 05 00 00 00 01 00 ..l............. 00 00 38 02 00 00 28 00 00 00 6b 6b 6b 6b 6b a5 ..8...(...kkkkk. backtrace: [] kmem_cache_alloc_trace+0x584/0x880 [] jffs2_sum_add_xattr_mem+0x54/0x90 [] jffs2_scan_medium.cold+0x298c/0x4794 [...] unreferenced object 0xffff8881116cd510 (size 16): comm "mount", pid 692, jiffies 4294838395 (age 34.355s) hex dump (first 16 bytes): 00 00 00 00 00 00 00 00 09 e0 60 02 00 00 6b a5 ..........`...k. backtrace: [] kmem_cache_alloc_trace+0x584/0x880 [] jffs2_sum_add_xref_mem+0x54/0x90 [] jffs2_scan_medium.cold+0x3a20/0x4794 [...] -------------------------------------------- Therefore, we should call jffs2_sum_reset_collected(s) on exit to release the memory added in s. In addition, a new tag "out_buf" is added to prevent the NULL pointer reference caused by s being NULL. (thanks to Zhang Yi for this analysis) Fixes: e631ddba5887 ("[JFFS2] Add erase block summary support (mount time i= mprovement)") Cc: stable@vger.kernel.org Co-developed-with: Zhihao Cheng Signed-off-by: Baokun Li Signed-off-by: Richard Weinberger Signed-off-by: Greg Kroah-Hartman --- fs/jffs2/scan.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/fs/jffs2/scan.c +++ b/fs/jffs2/scan.c @@ -136,7 +136,7 @@ int jffs2_scan_medium(struct jffs2_sb_in if (!s) { JFFS2_WARNING("Can't allocate memory for summary\n"); ret =3D -ENOMEM; - goto out; + goto out_buf; } } =20 @@ -275,13 +275,15 @@ int jffs2_scan_medium(struct jffs2_sb_in } ret =3D 0; out: + jffs2_sum_reset_collected(s); + kfree(s); + out_buf: if (buf_size) kfree(flashbuf); #ifndef __ECOS else mtd_unpoint(c->mtd, 0, c->mtd->size); #endif - kfree(s); return ret; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD892C4332F for ; Wed, 6 Apr 2022 00:21:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235716AbiDEXyG (ORCPT ); Tue, 5 Apr 2022 19:54:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354825AbiDEKQJ (ORCPT ); Tue, 5 Apr 2022 06:16:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A3AC26C954; Tue, 5 Apr 2022 03:03:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2785B616E7; Tue, 5 Apr 2022 10:03:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1534EC385A2; Tue, 5 Apr 2022 10:03:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152982; bh=rMkDyMAy8tgZhH5NoxgtKM/qQKn45VbcqeVtM9To590=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XU3z7/xBlMBv9+JScfsburHoY+ilzEgEEv+iWzo6zRceah95bC8bgh8TABhxRyTRb Fwkp0/DFMDbF6PXLNXkE866flGAsD5WlyLgO9kfTE/AZqJSyGgMX4eNu2R/AeKL6rM +6meoq4Isj24bL0CR23TXFdzOtyH8nWh6rZCw474= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alistair Popple , David Hildenbrand , Mel Gorman , John Hubbard , Zi Yan , Anshuman Khandual , Oscar Salvador , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 059/599] mm/pages_alloc.c: dont create ZONE_MOVABLE beyond the end of a node Date: Tue, 5 Apr 2022 09:25:53 +0200 Message-Id: <20220405070300.584276718@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alistair Popple commit ddbc84f3f595cf1fc8234a191193b5d20ad43938 upstream. ZONE_MOVABLE uses the remaining memory in each node. Its starting pfn is also aligned to MAX_ORDER_NR_PAGES. It is possible for the remaining memory in a node to be less than MAX_ORDER_NR_PAGES, meaning there is not enough room for ZONE_MOVABLE on that node. Unfortunately this condition is not checked for. This leads to zone_movable_pfn[] getting set to a pfn greater than the last pfn in a node. calculate_node_totalpages() then sets zone->present_pages to be greater than zone->spanned_pages which is invalid, as spanned_pages represents the maximum number of pages in a zone assuming no holes. Subsequently it is possible free_area_init_core() will observe a zone of size zero with present pages. In this case it will skip setting up the zone, including the initialisation of free_lists[]. However populated_zone() checks zone->present_pages to see if a zone has memory available. This is used by iterators such as walk_zones_in_node(). pagetypeinfo_showfree() uses this to walk the free_list of each zone in each node, which are assumed to be initialised due to the zone not being empty. As free_area_init_core() never initialised the free_lists[] this results in the following kernel crash when trying to read /proc/pagetypeinfo: BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 0 P4D 0 Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC NOPTI CPU: 0 PID: 456 Comm: cat Not tainted 5.16.0 #461 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2= 014 RIP: 0010:pagetypeinfo_show+0x163/0x460 Code: 9e 82 e8 80 57 0e 00 49 8b 06 b9 01 00 00 00 4c 39 f0 75 16 e9 65 0= 2 00 00 48 83 c1 01 48 81 f9 a0 86 01 00 0f 84 48 02 00 00 <48> 8b 00 4c 39= f0 75 e7 48 c7 c2 80 a2 e2 82 48 c7 c6 79 ef e3 82 RSP: 0018:ffffc90001c4bd10 EFLAGS: 00010003 RAX: 0000000000000000 RBX: ffff88801105f638 RCX: 0000000000000001 RDX: 0000000000000001 RSI: 000000000000068b RDI: ffff8880163dc68b RBP: ffffc90001c4bd90 R08: 0000000000000001 R09: ffff8880163dc67e R10: 656c6261766f6d6e R11: 6c6261766f6d6e55 R12: ffff88807ffb4a00 R13: ffff88807ffb49f8 R14: ffff88807ffb4580 R15: ffff88807ffb3000 FS: 00007f9c83eff5c0(0000) GS:ffff88807dc00000(0000) knlGS:0000000000000= 000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000013c8e000 CR4: 0000000000350ef0 Call Trace: seq_read_iter+0x128/0x460 proc_reg_read_iter+0x51/0x80 new_sync_read+0x113/0x1a0 vfs_read+0x136/0x1d0 ksys_read+0x70/0xf0 __x64_sys_read+0x1a/0x20 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae Fix this by checking that the aligned zone_movable_pfn[] does not exceed the end of the node, and if it does skip creating a movable zone on this node. Link: https://lkml.kernel.org/r/20220215025831.2113067-1-apopple@nvidia.com Fixes: 2a1e274acf0b ("Create the ZONE_MOVABLE zone") Signed-off-by: Alistair Popple Acked-by: David Hildenbrand Acked-by: Mel Gorman Cc: John Hubbard Cc: Zi Yan Cc: Anshuman Khandual Cc: Oscar Salvador Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/page_alloc.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -7402,10 +7402,17 @@ restart: =20 out2: /* Align start of ZONE_MOVABLE on all nids to MAX_ORDER_NR_PAGES */ - for (nid =3D 0; nid < MAX_NUMNODES; nid++) + for (nid =3D 0; nid < MAX_NUMNODES; nid++) { + unsigned long start_pfn, end_pfn; + zone_movable_pfn[nid] =3D roundup(zone_movable_pfn[nid], MAX_ORDER_NR_PAGES); =20 + get_pfn_range_for_nid(nid, &start_pfn, &end_pfn); + if (zone_movable_pfn[nid] >=3D end_pfn) + zone_movable_pfn[nid] =3D 0; + } + out: /* restore the node_state */ node_states[N_MEMORY] =3D saved_node_state; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E1125C4332F for ; Tue, 5 Apr 2022 20:16:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239320AbiDEUMQ (ORCPT ); Tue, 5 Apr 2022 16:12:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354826AbiDEKQJ (ORCPT ); Tue, 5 Apr 2022 06:16:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CAF596C95A; Tue, 5 Apr 2022 03:03:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 77177B81BC0; Tue, 5 Apr 2022 10:03:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9184C385A2; Tue, 5 Apr 2022 10:03:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152985; bh=7T3V9Ql41ZXUXe2eHr5kADkK5LhNNXoQgf53a89Czf8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XoKYqACQi5ksIOTFMur+8DnXtj5FM7/y6D5345l+RubAeqz/+rNP70fgslsOakE2x PmqMXDTaRBRFvloGrW+kvNEm2ndh/5njpPzktJRIvGO9V/DhR9yYlAMwvqycvXqLiB RfCjUovO3aUB8/aVxLGYBNL4N5umklNdd2uOlv8Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rik van Riel , Miaohe Lin , Naoya Horiguchi , Oscar Salvador , John Hubbard , Mel Gorman , Johannes Weiner , Matthew Wilcox , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 060/599] mm: invalidate hwpoison page cache page in fault path Date: Tue, 5 Apr 2022 09:25:54 +0200 Message-Id: <20220405070300.613828921@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rik van Riel commit e53ac7374e64dede04d745ff0e70ff5048378d1f upstream. Sometimes the page offlining code can leave behind a hwpoisoned clean page cache page. This can lead to programs being killed over and over and over again as they fault in the hwpoisoned page, get killed, and then get re-spawned by whatever wanted to run them. This is particularly embarrassing when the page was offlined due to having too many corrected memory errors. Now we are killing tasks due to them trying to access memory that probably isn't even corrupted. This problem can be avoided by invalidating the page from the page fault handler, which already has a branch for dealing with these kinds of pages. With this patch we simply pretend the page fault was successful if the page was invalidated, return to userspace, incur another page fault, read in the file from disk (to a new memory page), and then everything works again. Link: https://lkml.kernel.org/r/20220212213740.423efcea@imladris.surriel.com Signed-off-by: Rik van Riel Reviewed-by: Miaohe Lin Acked-by: Naoya Horiguchi Reviewed-by: Oscar Salvador Cc: John Hubbard Cc: Mel Gorman Cc: Johannes Weiner Cc: Matthew Wilcox Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/memory.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/mm/memory.c +++ b/mm/memory.c @@ -3676,11 +3676,16 @@ static vm_fault_t __do_fault(struct vm_f return ret; =20 if (unlikely(PageHWPoison(vmf->page))) { - if (ret & VM_FAULT_LOCKED) + vm_fault_t poisonret =3D VM_FAULT_HWPOISON; + if (ret & VM_FAULT_LOCKED) { + /* Retry if a clean page was removed from the cache. */ + if (invalidate_inode_page(vmf->page)) + poisonret =3D 0; unlock_page(vmf->page); + } put_page(vmf->page); vmf->page =3D NULL; - return VM_FAULT_HWPOISON; + return poisonret; } =20 if (unlikely(!(ret & VM_FAULT_LOCKED))) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF804C35276 for ; Wed, 6 Apr 2022 00:09:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1581732AbiDEXkm (ORCPT ); Tue, 5 Apr 2022 19:40:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354831AbiDEKQJ (ORCPT ); Tue, 5 Apr 2022 06:16:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A87786C963; Tue, 5 Apr 2022 03:03:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 584ABB81B7A; Tue, 5 Apr 2022 10:03:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A65A5C385A1; Tue, 5 Apr 2022 10:03:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152988; bh=2CdFsRshQUUazXkyVRroFf6QvWwmVI388VjSkd2qLE0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xtJdh4bxL2BXgFaESnVYXjjuWVMbQY6fn0RbRpxpkU2wXWViLq89zaDFY7T8h3Rak VnsKrLTZPHISvexUNW2M9sWNGT9HDeKvJkHd/07SbrLhCngKIIFBIM4RonuG0s84mE rOJwu8vQyjq49Rzr6Jb5yxSI3FNPJ5nS1KNnznTk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hugh Dickins , Oleg Nesterov , "Liam R. Howlett" , Vlastimil Babka , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 061/599] mempolicy: mbind_range() set_policy() after vma_merge() Date: Tue, 5 Apr 2022 09:25:55 +0200 Message-Id: <20220405070300.644104488@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hugh Dickins commit 4e0906008cdb56381638aa17d9c32734eae6d37a upstream. v2.6.34 commit 9d8cebd4bcd7 ("mm: fix mbind vma merge problem") introduced vma_merge() to mbind_range(); but unlike madvise, mlock and mprotect, it put a "continue" to next vma where its precedents go to update flags on current vma before advancing: that left vma with the wrong setting in the infamous vma_merge() case 8. v3.10 commit 1444f92c8498 ("mm: merging memory blocks resets mempolicy") tried to fix that in vma_adjust(), without fully understanding the issue. v3.11 commit 3964acd0dbec ("mm: mempolicy: fix mbind_range() && vma_adjust() interaction") reverted that, and went about the fix in the right way, but chose to optimize out an unnecessary mpol_dup() with a prior mpol_equal() test. But on tmpfs, that also pessimized out the vital call to its ->set_policy(), leaving the new mbind unenforced. The user visible effect was that the pages got allocated on the local node (happened to be 0), after the mbind() caller had specifically asked for them to be allocated on node 1. There was not any page migration involved in the case reported: the pages simply got allocated on the wrong node. Just delete that optimization now (though it could be made conditional on vma not having a set_policy). Also remove the "next" variable: it turned out to be blameless, but also pointless. Link: https://lkml.kernel.org/r/319e4db9-64ae-4bca-92f0-ade85d342ff@google.= com Fixes: 3964acd0dbec ("mm: mempolicy: fix mbind_range() && vma_adjust() inte= raction") Signed-off-by: Hugh Dickins Acked-by: Oleg Nesterov Reviewed-by: Liam R. Howlett Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/mempolicy.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -802,7 +802,6 @@ static int vma_replace_policy(struct vm_ static int mbind_range(struct mm_struct *mm, unsigned long start, unsigned long end, struct mempolicy *new_pol) { - struct vm_area_struct *next; struct vm_area_struct *prev; struct vm_area_struct *vma; int err =3D 0; @@ -817,8 +816,7 @@ static int mbind_range(struct mm_struct if (start > vma->vm_start) prev =3D vma; =20 - for (; vma && vma->vm_start < end; prev =3D vma, vma =3D next) { - next =3D vma->vm_next; + for (; vma && vma->vm_start < end; prev =3D vma, vma =3D vma->vm_next) { vmstart =3D max(start, vma->vm_start); vmend =3D min(end, vma->vm_end); =20 @@ -832,10 +830,6 @@ static int mbind_range(struct mm_struct new_pol, vma->vm_userfaultfd_ctx); if (prev) { vma =3D prev; - next =3D vma->vm_next; - if (mpol_equal(vma_policy(vma), new_pol)) - continue; - /* vma_merge() joined vma && vma->next, case 8 */ goto replace; } if (vma->vm_start !=3D vmstart) { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2801CC433F5 for ; Wed, 6 Apr 2022 00:44:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240759AbiDFAlS (ORCPT ); Tue, 5 Apr 2022 20:41:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46876 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354833AbiDEKQJ (ORCPT ); Tue, 5 Apr 2022 06:16:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2AEB96C967; Tue, 5 Apr 2022 03:03:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9964D616E7; Tue, 5 Apr 2022 10:03:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3746C385A1; Tue, 5 Apr 2022 10:03:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152991; bh=oEwV9TdDwQb2akMVnS/or1jUizn35IGFlLvBM0ImMXQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kxABCOXy4zmFJ13/vkJsRQQEVVcG+j7aMTUy5QQFOSt+vyZHE5P1qXNTNB68Q2EGY T4B1WVhxFMHEQRCTAHslq8SxHDzl1z/AcgkAWRdnY9f147jKnTelsVAusrL3oo9xi6 829OG80HTl93+vhPmtn7rQSnUOobJRq/NIh82bmQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Jack Wang , Damien Le Moal , "Martin K. Petersen" Subject: [PATCH 5.10 062/599] scsi: libsas: Fix sas_ata_qc_issue() handling of NCQ NON DATA commands Date: Tue, 5 Apr 2022 09:25:56 +0200 Message-Id: <20220405070300.674194206@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Damien Le Moal commit 8454563e4c2aafbfb81a383ab423ea8b9b430a25 upstream. To detect for the DMA_NONE (no data transfer) DMA direction, sas_ata_qc_issue() tests if the command protocol is ATA_PROT_NODATA. This test does not include the ATA_CMD_NCQ_NON_DATA command as this command protocol is defined as ATA_PROT_NCQ_NODATA (equal to ATA_PROT_FLAG_NCQ) and not as ATA_PROT_NODATA. To include both NCQ and non-NCQ commands when testing for the DMA_NONE DMA direction, use "!ata_is_data()". Link: https://lore.kernel.org/r/20220220031810.738362-2-damien.lemoal@opens= ource.wdc.com Fixes: 176ddd89171d ("scsi: libsas: Reset num_scatter if libata marks qc as= NODATA") Cc: stable@vger.kernel.org Reviewed-by: John Garry Reviewed-by: Jack Wang Signed-off-by: Damien Le Moal Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/scsi/libsas/sas_ata.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/libsas/sas_ata.c +++ b/drivers/scsi/libsas/sas_ata.c @@ -202,7 +202,7 @@ static unsigned int sas_ata_qc_issue(str task->total_xfer_len =3D qc->nbytes; task->num_scatter =3D qc->n_elem; task->data_dir =3D qc->dma_dir; - } else if (qc->tf.protocol =3D=3D ATA_PROT_NODATA) { + } else if (!ata_is_data(qc->tf.protocol)) { task->data_dir =3D DMA_NONE; } else { for_each_sg(qc->sg, sg, qc->n_elem, si) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D693CC4321E for ; Tue, 5 Apr 2022 21:50:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1384388AbiDEVrM (ORCPT ); Tue, 5 Apr 2022 17:47:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354874AbiDEKQ1 (ORCPT ); Tue, 5 Apr 2022 06:16:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C87DE4A3EE; Tue, 5 Apr 2022 03:03:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 60F1861676; Tue, 5 Apr 2022 10:03:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76059C385A2; Tue, 5 Apr 2022 10:03:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152993; bh=K3N7Oz55lZ1mMlDZ1VzLCz7sH8jxLRpQrtkNfrand/Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2WE0ta/mSc3gNh8/3XkTa6gHzjSGsnAbGI1XMrwnlB1jQPFlE4f2BKygugf3xkOgh shh0z8Kj0gn8OlRIy0dZ/d+96szMB+ZyCMsGjyAkIvjbVJFlMWk8Gv/t8BpmOyTejY lThPWARBrNJyd0f561qhIuLGE1C9XIVugLgEOO3Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Chopra , Ariel Elior , "David S. Miller" Subject: [PATCH 5.10 063/599] qed: display VF trust config Date: Tue, 5 Apr 2022 09:25:57 +0200 Message-Id: <20220405070300.702961936@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manish Chopra commit 4e6e6bec7440b9b76f312f28b1f4e944eebb3abc upstream. Driver does support SR-IOV VFs trust configuration but it does not display it when queried via ip link utility. Cc: stable@vger.kernel.org Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c +++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c @@ -4691,6 +4691,7 @@ static int qed_get_vf_config(struct qed_ tx_rate =3D vf_info->tx_rate; ivi->max_tx_rate =3D tx_rate ? tx_rate : link.speed; ivi->min_tx_rate =3D qed_iov_get_vf_min_rate(hwfn, vf_id); + ivi->trusted =3D vf_info->is_trusted_request; =20 return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9AC85C433EF for ; Tue, 5 Apr 2022 23:25:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574738AbiDEXA5 (ORCPT ); Tue, 5 Apr 2022 19:00:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354878AbiDEKQ1 (ORCPT ); Tue, 5 Apr 2022 06:16:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 021C26CA52; Tue, 5 Apr 2022 03:03:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A9DECB81B7A; Tue, 5 Apr 2022 10:03:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1821CC385A2; Tue, 5 Apr 2022 10:03:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649152999; bh=+Rq5kr++CHOFLK889vTt2MZZI3piacdfiSHz+bWCC4M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ELeuAKEKl+RD4bfE0Lq1+NUaL3GtRTf2dVayasZy9oJgWEzOGP+abPYVoXF7KKEZF /LlGY3oAYE5DRdBnNrjt3J7rQxX9nEqr3JddBbpns5rh63Djj0vaekYhq9ZNaQrn/m L81VZzaYEuwf1ImcSlcrAC86Ynmp52Sp05RApLTY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Chopra , Ariel Elior , "David S. Miller" Subject: [PATCH 5.10 064/599] qed: validate and restrict untrusted VFs vlan promisc mode Date: Tue, 5 Apr 2022 09:25:58 +0200 Message-Id: <20220405070300.732695358@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Manish Chopra commit cbcc44db2cf7b836896733acc0e5ea966136ed22 upstream. Today when VFs are put in promiscuous mode, they can request PF to configure device for them to receive all VLANs traffic regardless of what vlan is configured by the PF (via ip link) and PF allows this config request regardless of whether VF is trusted or not. >From security POV, when VLAN is configured for VF through PF (via ip link), honour such config requests from VF only when they are configured to be trusted, otherwise restrict such VFs vlan promisc mode config. Cc: stable@vger.kernel.org Fixes: f990c82c385b ("qed*: Add support for ndo_set_vf_trust") Signed-off-by: Manish Chopra Signed-off-by: Ariel Elior Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/ethernet/qlogic/qed/qed_sriov.c | 28 +++++++++++++++++++++++= +++-- drivers/net/ethernet/qlogic/qed/qed_sriov.h | 1 + 2 files changed, 27 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c +++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c @@ -2982,12 +2982,16 @@ static int qed_iov_pre_update_vport(stru u8 mask =3D QED_ACCEPT_UCAST_UNMATCHED | QED_ACCEPT_MCAST_UNMATCHED; struct qed_filter_accept_flags *flags =3D ¶ms->accept_flags; struct qed_public_vf_info *vf_info; + u16 tlv_mask; + + tlv_mask =3D BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM) | + BIT(QED_IOV_VP_UPDATE_ACCEPT_ANY_VLAN); =20 /* Untrusted VFs can't even be trusted to know that fact. * Simply indicate everything is configured fine, and trace * configuration 'behind their back'. */ - if (!(*tlvs & BIT(QED_IOV_VP_UPDATE_ACCEPT_PARAM))) + if (!(*tlvs & tlv_mask)) return 0; =20 vf_info =3D qed_iov_get_public_vf_info(hwfn, vfid, true); @@ -3004,6 +3008,13 @@ static int qed_iov_pre_update_vport(stru flags->tx_accept_filter &=3D ~mask; } =20 + if (params->update_accept_any_vlan_flg) { + vf_info->accept_any_vlan =3D params->accept_any_vlan; + + if (vf_info->forced_vlan && !vf_info->is_trusted_configured) + params->accept_any_vlan =3D false; + } + return 0; } =20 @@ -5121,6 +5132,12 @@ static void qed_iov_handle_trust_change( =20 params.update_ctl_frame_check =3D 1; params.mac_chk_en =3D !vf_info->is_trusted_configured; + params.update_accept_any_vlan_flg =3D 0; + + if (vf_info->accept_any_vlan && vf_info->forced_vlan) { + params.update_accept_any_vlan_flg =3D 1; + params.accept_any_vlan =3D vf_info->accept_any_vlan; + } =20 if (vf_info->rx_accept_mode & mask) { flags->update_rx_mode_config =3D 1; @@ -5136,13 +5153,20 @@ static void qed_iov_handle_trust_change( if (!vf_info->is_trusted_configured) { flags->rx_accept_filter &=3D ~mask; flags->tx_accept_filter &=3D ~mask; + params.accept_any_vlan =3D false; } =20 if (flags->update_rx_mode_config || flags->update_tx_mode_config || - params.update_ctl_frame_check) + params.update_ctl_frame_check || + params.update_accept_any_vlan_flg) { + DP_VERBOSE(hwfn, QED_MSG_IOV, + "vport update config for %s VF[abs 0x%x rel 0x%x]\n", + vf_info->is_trusted_configured ? "trusted" : "untrusted", + vf->abs_vf_id, vf->relative_vf_id); qed_sp_vport_update(hwfn, ¶ms, QED_SPQ_MODE_EBLOCK, NULL); + } } } =20 --- a/drivers/net/ethernet/qlogic/qed/qed_sriov.h +++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.h @@ -62,6 +62,7 @@ struct qed_public_vf_info { bool is_trusted_request; u8 rx_accept_mode; u8 tx_accept_mode; + bool accept_any_vlan; }; =20 struct qed_iov_vf_init_params { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44D4AC35276 for ; Wed, 6 Apr 2022 00:09:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1448645AbiDEXq1 (ORCPT ); Tue, 5 Apr 2022 19:46:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51080 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354880AbiDEKQ1 (ORCPT ); Tue, 5 Apr 2022 06:16:27 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A59536CA57; Tue, 5 Apr 2022 03:03:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 59A7BB81C83; Tue, 5 Apr 2022 10:03:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0C8CC385A1; Tue, 5 Apr 2022 10:03:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153002; bh=CdMOvF6r2GW8m2roTh6MVKEvGZyY1x+ccDj8OjjuD2Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tJH7rDCygMn1Cv72cdUzy7vHQo4t/dKRN5Ld30YeVojdZ02+vi574gFjd8b+jxxS8 4V/ppz5FJzYmv/5G6iI8NVKlJwsvToswPptpFsrQkExebbBvzlN/X2IJuVNrwdH4jN Z06GFNWR7AKXDbq+sUor1yyFuV3cSnBexu0QKP44= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nikita Shubin , Palmer Dabbelt Subject: [PATCH 5.10 065/599] riscv: Fix fill_callchain return value Date: Tue, 5 Apr 2022 09:25:59 +0200 Message-Id: <20220405070300.761769226@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nikita Shubin commit 2b2b574ac587ec5bd7716a356492a85ab8b0ce9f upstream. perf_callchain_store return 0 on success, -1 otherwise, fix fill_callchain to return correct bool value. Fixes: dbeb90b0c1eb ("riscv: Add perf callchain support") Signed-off-by: Nikita Shubin Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/riscv/kernel/perf_callchain.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/riscv/kernel/perf_callchain.c +++ b/arch/riscv/kernel/perf_callchain.c @@ -77,7 +77,7 @@ void perf_callchain_user(struct perf_cal =20 bool fill_callchain(unsigned long pc, void *entry) { - return perf_callchain_store(entry, pc); + return perf_callchain_store(entry, pc) =3D=3D 0; } =20 void notrace walk_stackframe(struct task_struct *task, From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34C2DC433FE for ; Wed, 6 Apr 2022 00:44:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837060AbiDFAnz (ORCPT ); Tue, 5 Apr 2022 20:43:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43200 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354886AbiDEKQ3 (ORCPT ); Tue, 5 Apr 2022 06:16:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC1576CA5F; Tue, 5 Apr 2022 03:03:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 58E6C61676; Tue, 5 Apr 2022 10:03:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6FCA5C385A2; Tue, 5 Apr 2022 10:03:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153004; bh=U6NPccItde/lV+Aupb+80yWZKd2ruP1llhPD9xnH5U8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pT1wAOnJ0uwWI58A2hHL4QQuSrcZ6VBVdvCEd+WHHxxvpS57T8LTHVmldRTLuEhAd OO2bAjiL9lvND75vAJgFDpbc+cEcHo9J/569ei+JVIdBughmyE1kubkwv19Xn1u6a5 Gbu8YdzOXaoW5FLkiNGpaGqoeJNzH+h8nEg1hS74= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Vyukov , syzbot+0600986d88e2d4d7ebb8@syzkaller.appspotmail.com, Palmer Dabbelt Subject: [PATCH 5.10 066/599] riscv: Increase stack size under KASAN Date: Tue, 5 Apr 2022 09:26:00 +0200 Message-Id: <20220405070300.791256999@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dmitry Vyukov commit b81d591386c3a50b96dddcf663628ea0df0bf2b3 upstream. KASAN requires more stack space because of compiler instrumentation. Increase stack size as other arches do. Signed-off-by: Dmitry Vyukov Reported-by: syzbot+0600986d88e2d4d7ebb8@syzkaller.appspotmail.com Fixes: 8ad8b72721d0 ("riscv: Add KASAN support") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/riscv/include/asm/thread_info.h | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/arch/riscv/include/asm/thread_info.h +++ b/arch/riscv/include/asm/thread_info.h @@ -11,11 +11,17 @@ #include #include =20 +#ifdef CONFIG_KASAN +#define KASAN_STACK_ORDER 1 +#else +#define KASAN_STACK_ORDER 0 +#endif + /* thread information allocation */ #ifdef CONFIG_64BIT -#define THREAD_SIZE_ORDER (2) +#define THREAD_SIZE_ORDER (2 + KASAN_STACK_ORDER) #else -#define THREAD_SIZE_ORDER (1) +#define THREAD_SIZE_ORDER (1 + KASAN_STACK_ORDER) #endif #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9746AC43217 for ; Tue, 5 Apr 2022 22:04:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1390769AbiDEWE0 (ORCPT ); Tue, 5 Apr 2022 18:04:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354890AbiDEKQa (ORCPT ); Tue, 5 Apr 2022 06:16:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F154D13D09; Tue, 5 Apr 2022 03:03:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A7423B81BC0; Tue, 5 Apr 2022 10:03:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2042BC385A2; Tue, 5 Apr 2022 10:03:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153007; bh=JYK4yYmxxNHgDv07Zrecz68AmrIqH+sR9RKYuvJdm1E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Eu9ZBh5Tk811ICPl0N4/lw/rmd+xN1O4cSzIKTGgZMaQobDUBNny1d6JmW5//rDLV 0yCOTQKwZZEbNin+O76nv0F8YufinG5hOqSLltB2mISV67kVylSm18y+UXcQKYKBZ8 8vedA1T/WzisD4RQprtXybl8T9q3iS66AFG4uJtQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Jos=C3=A9=20Exp=C3=B3sito?= , Hans de Goede , Peter Hutterer , Benjamin Tissoires , Dmitry Torokhov Subject: [PATCH 5.10 067/599] Revert "Input: clear BTN_RIGHT/MIDDLE on buttonpads" Date: Tue, 5 Apr 2022 09:26:01 +0200 Message-Id: <20220405070300.820802423@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jos=C3=A9 Exp=C3=B3sito commit 8b188fba75195745026e11d408e4a7e94e01d701 upstream. This reverts commit 37ef4c19b4c659926ce65a7ac709ceaefb211c40. The touchpad present in the Dell Precision 7550 and 7750 laptops reports a HID_DG_BUTTONTYPE of type MT_BUTTONTYPE_CLICKPAD. However, the device is not a clickpad, it is a touchpad with physical buttons. In order to fix this issue, a quirk for the device was introduced in libinput [1] [2] to disable the INPUT_PROP_BUTTONPAD property: [Precision 7x50 Touchpad] MatchBus=3Di2c MatchUdevType=3Dtouchpad MatchDMIModalias=3Ddmi:*svnDellInc.:pnPrecision7?50* AttrInputPropDisable=3DINPUT_PROP_BUTTONPAD However, because of the change introduced in 37ef4c19b4 ("Input: clear BTN_RIGHT/MIDDLE on buttonpads") the BTN_RIGHT key bit is not mapped anymore breaking the device right click button and making impossible to workaround it in user space. In order to avoid breakage on other present or future devices, revert the patch causing the issue. Signed-off-by: Jos=C3=A9 Exp=C3=B3sito Reviewed-by: Hans de Goede Acked-by: Peter Hutterer Acked-by: Benjamin Tissoires Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220321184404.20025-1-jose.exposito89@gmai= l.com Signed-off-by: Dmitry Torokhov Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/input/input.c | 6 ------ 1 file changed, 6 deletions(-) --- a/drivers/input/input.c +++ b/drivers/input/input.c @@ -2179,12 +2179,6 @@ int input_register_device(struct input_d /* KEY_RESERVED is not supposed to be transmitted to userspace. */ __clear_bit(KEY_RESERVED, dev->keybit); =20 - /* Buttonpads should not map BTN_RIGHT and/or BTN_MIDDLE. */ - if (test_bit(INPUT_PROP_BUTTONPAD, dev->propbit)) { - __clear_bit(BTN_RIGHT, dev->keybit); - __clear_bit(BTN_MIDDLE, dev->keybit); - } - /* Make sure that bitmasks not mentioned in dev->evbit are clean. */ input_cleanse_bitmasks(dev); =20 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71536C4321E for ; Tue, 5 Apr 2022 22:55:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1454997AbiDEWj4 (ORCPT ); Tue, 5 Apr 2022 18:39:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354891AbiDEKQa (ORCPT ); Tue, 5 Apr 2022 06:16:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 086941EC59; Tue, 5 Apr 2022 03:03:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 83C32B81BC0; Tue, 5 Apr 2022 10:03:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E699DC385A2; Tue, 5 Apr 2022 10:03:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153010; bh=wNJfEXrgpnKMvZf6+BAYCVLT6J3zV7sbQTTAQ0iJVB8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Qum0FCjjByGOTBeACSjKY6laKODz2BUSqttPco7Ff/apbm11TDYlRaI5rNt31prD5 HHIsqs27UeQqjGixve0TVMkl2VLq5TRTHUE9Vcts5qSWIUSK0SLyslnK1+7pl5qpMa ltPjNY2NdwCcxlhykn/K318I6c1XXNxG8nNxUCRU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Paulo Alcantara (SUSE)" , Steve French Subject: [PATCH 5.10 068/599] cifs: prevent bad output lengths in smb2_ioctl_query_info() Date: Tue, 5 Apr 2022 09:26:02 +0200 Message-Id: <20220405070300.849885230@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paulo Alcantara commit b92e358757b91c2827af112cae9af513f26a3f34 upstream. When calling smb2_ioctl_query_info() with smb_query_info::flags=3DPASSTHRU_FSCTL and smb_query_info::output_buffer_length=3D0, the following would return 0x10 buffer =3D memdup_user(arg + sizeof(struct smb_query_info), qi.output_buffer_length); if (IS_ERR(buffer)) { kfree(vars); return PTR_ERR(buffer); } rather than a valid pointer thus making IS_ERR() check fail. This would then cause a NULL ptr deference in @buffer when accessing it later in smb2_ioctl_query_ioctl(). While at it, prevent having a @buffer smaller than 8 bytes to correctly handle SMB2_SET_INFO FileEndOfFileInformation requests when smb_query_info::flags=3DPASSTHRU_SET_INFO. Here is a small C reproducer which triggers a NULL ptr in @buffer when passing an invalid smb_query_info::flags #include #include #include #include #include #include #define die(s) perror(s), exit(1) #define QUERY_INFO 0xc018cf07 int main(int argc, char *argv[]) { int fd; if (argc < 2) exit(1); fd =3D open(argv[1], O_RDONLY); if (fd =3D=3D -1) die("open"); if (ioctl(fd, QUERY_INFO, (uint32_t[]) { 0, 0, 0, 4, 0, 0}) =3D=3D -1) die("ioctl"); close(fd); return 0; } mount.cifs //srv/share /mnt -o ... gcc repro.c && ./a.out /mnt/f0 [ 114.138620] general protection fault, probably for non-canonical addres= s 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 114.139310] KASAN: null-ptr-deref in range [0x0000000000000000-0x000000= 0000000007] [ 114.139775] CPU: 2 PID: 995 Comm: a.out Not tainted 5.17.0-rc8 #1 [ 114.140148] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS re= l-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 114.140818] RIP: 0010:smb2_ioctl_query_info+0x206/0x410 [cifs] [ 114.141221] Code: 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c8= 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 28 4c 89 fa 48 c1 ea 03 <8= 0> 3c 02 00 0f 85 9c 01 00 00 49 8b 3f e8 58 02 fb ff 48 8b 14 24 [ 114.142348] RSP: 0018:ffffc90000b47b00 EFLAGS: 00010256 [ 114.142692] RAX: dffffc0000000000 RBX: ffff888115503200 RCX: ffffffffa0= 20580d [ 114.143119] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffa0= 43a380 [ 114.143544] RBP: ffff888115503278 R08: 0000000000000001 R09: 0000000000= 000003 [ 114.143983] R10: fffffbfff4087470 R11: 0000000000000001 R12: ffff888115= 503288 [ 114.144424] R13: 00000000ffffffea R14: ffff888115503228 R15: 0000000000= 000000 [ 114.144852] FS: 00007f7aeabdf740(0000) GS:ffff888151600000(0000) knlGS= :0000000000000000 [ 114.145338] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.145692] CR2: 00007f7aeacfdf5e CR3: 000000012000e000 CR4: 0000000000= 350ee0 [ 114.146131] Call Trace: [ 114.146291] [ 114.146432] ? smb2_query_reparse_tag+0x890/0x890 [cifs] [ 114.146800] ? cifs_mapchar+0x460/0x460 [cifs] [ 114.147121] ? rcu_read_lock_sched_held+0x3f/0x70 [ 114.147412] ? cifs_strndup_to_utf16+0x15b/0x250 [cifs] [ 114.147775] ? dentry_path_raw+0xa6/0xf0 [ 114.148024] ? cifs_convert_path_to_utf16+0x198/0x220 [cifs] [ 114.148413] ? smb2_check_message+0x1080/0x1080 [cifs] [ 114.148766] ? rcu_read_lock_sched_held+0x3f/0x70 [ 114.149065] cifs_ioctl+0x1577/0x3320 [cifs] [ 114.149371] ? lock_downgrade+0x6f0/0x6f0 [ 114.149631] ? cifs_readdir+0x2e60/0x2e60 [cifs] [ 114.149956] ? rcu_read_lock_sched_held+0x3f/0x70 [ 114.150250] ? __rseq_handle_notify_resume+0x80b/0xbe0 [ 114.150562] ? __up_read+0x192/0x710 [ 114.150791] ? __ia32_sys_rseq+0xf0/0xf0 [ 114.151025] ? __x64_sys_openat+0x11f/0x1d0 [ 114.151296] __x64_sys_ioctl+0x127/0x190 [ 114.151549] do_syscall_64+0x3b/0x90 [ 114.151768] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 114.152079] RIP: 0033:0x7f7aead043df [ 114.152306] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00= 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <4= 1> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00 [ 114.153431] RSP: 002b:00007ffc2e0c1f80 EFLAGS: 00000246 ORIG_RAX: 00000= 00000000010 [ 114.153890] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f7aea= d043df [ 114.154315] RDX: 00007ffc2e0c1ff0 RSI: 00000000c018cf07 RDI: 0000000000= 000003 [ 114.154747] RBP: 00007ffc2e0c2010 R08: 00007f7aeae03db0 R09: 00007f7aea= e24c4e [ 114.155192] R10: 00007f7aeabf7d40 R11: 0000000000000246 R12: 00007ffc2e= 0c2128 [ 114.155642] R13: 0000000000401176 R14: 0000000000403df8 R15: 00007f7aea= e57000 [ 114.156071] [ 114.156218] Modules linked in: cifs cifs_arc4 cifs_md4 bpf_preload [ 114.156608] ---[ end trace 0000000000000000 ]--- [ 114.156898] RIP: 0010:smb2_ioctl_query_info+0x206/0x410 [cifs] [ 114.157792] Code: 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c8= 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 28 4c 89 fa 48 c1 ea 03 <8= 0> 3c 02 00 0f 85 9c 01 00 00 49 8b 3f e8 58 02 fb ff 48 8b 14 24 [ 114.159293] RSP: 0018:ffffc90000b47b00 EFLAGS: 00010256 [ 114.159641] RAX: dffffc0000000000 RBX: ffff888115503200 RCX: ffffffffa0= 20580d [ 114.160093] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffa0= 43a380 [ 114.160699] RBP: ffff888115503278 R08: 0000000000000001 R09: 0000000000= 000003 [ 114.161196] R10: fffffbfff4087470 R11: 0000000000000001 R12: ffff888115= 503288 [ 114.155642] R13: 0000000000401176 R14: 0000000000403df8 R15: 00007f7aea= e57000 [ 114.156071] [ 114.156218] Modules linked in: cifs cifs_arc4 cifs_md4 bpf_preload [ 114.156608] ---[ end trace 0000000000000000 ]--- [ 114.156898] RIP: 0010:smb2_ioctl_query_info+0x206/0x410 [cifs] [ 114.157792] Code: 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 c8= 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 28 4c 89 fa 48 c1 ea 03 <8= 0> 3c 02 00 0f 85 9c 01 00 00 49 8b 3f e8 58 02 fb ff 48 8b 14 24 [ 114.159293] RSP: 0018:ffffc90000b47b00 EFLAGS: 00010256 [ 114.159641] RAX: dffffc0000000000 RBX: ffff888115503200 RCX: ffffffffa0= 20580d [ 114.160093] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffa0= 43a380 [ 114.160699] RBP: ffff888115503278 R08: 0000000000000001 R09: 0000000000= 000003 [ 114.161196] R10: fffffbfff4087470 R11: 0000000000000001 R12: ffff888115= 503288 [ 114.161823] R13: 00000000ffffffea R14: ffff888115503228 R15: 0000000000= 000000 [ 114.162274] FS: 00007f7aeabdf740(0000) GS:ffff888151600000(0000) knlGS= :0000000000000000 [ 114.162853] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 114.163218] CR2: 00007f7aeacfdf5e CR3: 000000012000e000 CR4: 0000000000= 350ee0 [ 114.163691] Kernel panic - not syncing: Fatal exception [ 114.164087] Kernel Offset: disabled [ 114.164316] ---[ end Kernel panic - not syncing: Fatal exception ]--- Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/cifs/smb2ops.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -1551,11 +1551,12 @@ smb2_ioctl_query_info(const unsigned int if (smb3_encryption_required(tcon)) flags |=3D CIFS_TRANSFORM_REQ; =20 - buffer =3D memdup_user(arg + sizeof(struct smb_query_info), - qi.output_buffer_length); - if (IS_ERR(buffer)) { - kfree(vars); - return PTR_ERR(buffer); + if (qi.output_buffer_length) { + buffer =3D memdup_user(arg + sizeof(struct smb_query_info), qi.output_bu= ffer_length); + if (IS_ERR(buffer)) { + kfree(vars); + return PTR_ERR(buffer); + } } =20 /* Open */ @@ -1618,10 +1619,13 @@ smb2_ioctl_query_info(const unsigned int /* Can eventually relax perm check since server enforces too */ if (!capable(CAP_SYS_ADMIN)) rc =3D -EPERM; - else { + else if (qi.output_buffer_length < 8) + rc =3D -EINVAL; + else { rqst[1].rq_iov =3D &vars->si_iov[0]; rqst[1].rq_nvec =3D 1; =20 + /* MS-FSCC 2.4.13 FileEndOfFileInformation */ size[0] =3D 8; data[0] =3D buffer; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70C49C4321E for ; Wed, 6 Apr 2022 00:44:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837094AbiDFAo3 (ORCPT ); Tue, 5 Apr 2022 20:44:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354895AbiDEKQa (ORCPT ); Tue, 5 Apr 2022 06:16:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB7801EC6C; Tue, 5 Apr 2022 03:03:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 67D0BB81C83; Tue, 5 Apr 2022 10:03:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A795BC385A1; Tue, 5 Apr 2022 10:03:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153013; bh=aCbbdPixcwIho1+I8XR8vWB+qjI/awM6brOxeWszHtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=udHx2SwARwzAuJwIrdp0pWrU+5y94U3d3mNf4429dXB5BjgpVTt0rofLsnoA9JbhB 9AMs8/LjvoZU6QM4dUxs5etOamLs7yo5H/zTOOJveXLfqZO9t3IQHivV6t9rLEyf/h lDWuwp/hpF2vssk56AZitxlBPnwF23AGfldd4I6Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Paulo Alcantara (SUSE)" , Steve French Subject: [PATCH 5.10 069/599] cifs: fix NULL ptr dereference in smb2_ioctl_query_info() Date: Tue, 5 Apr 2022 09:26:03 +0200 Message-Id: <20220405070300.879921948@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paulo Alcantara commit d6f5e358452479fa8a773b5c6ccc9e4ec5a20880 upstream. When calling smb2_ioctl_query_info() with invalid smb_query_info::flags, a NULL ptr dereference is triggered when trying to kfree() uninitialised rqst[n].rq_iov array. This also fixes leaked paths that are created in SMB2_open_init() which required SMB2_open_free() to properly free them. Here is a small C reproducer that triggers it #include #include #include #include #include #include #define die(s) perror(s), exit(1) #define QUERY_INFO 0xc018cf07 int main(int argc, char *argv[]) { int fd; if (argc < 2) exit(1); fd =3D open(argv[1], O_RDONLY); if (fd =3D=3D -1) die("open"); if (ioctl(fd, QUERY_INFO, (uint32_t[]) { 0, 0, 0, 4, 0, 0}) =3D=3D -1) die("ioctl"); close(fd); return 0; } mount.cifs //srv/share /mnt -o ... gcc repro.c && ./a.out /mnt/f0 [ 1832.124468] CIFS: VFS: \\w22-dc.zelda.test\test Invalid passthru query = flags: 0x4 [ 1832.125043] general protection fault, probably for non-canonical addres= s 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI [ 1832.125764] KASAN: null-ptr-deref in range [0x0000000000000000-0x000000= 0000000007] [ 1832.126241] CPU: 3 PID: 1133 Comm: a.out Not tainted 5.17.0-rc8 #2 [ 1832.126630] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS re= l-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 1832.127322] RIP: 0010:smb2_ioctl_query_info+0x7a3/0xe30 [cifs] [ 1832.127749] Code: 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 6c 05= 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 74 24 28 4c 89 f2 48 c1 ea 03 <8= 0> 3c 02 00 0f 85 cb 04 00 00 49 8b 3e e8 bb fc fa ff 48 89 da 48 [ 1832.128911] RSP: 0018:ffffc90000957b08 EFLAGS: 00010256 [ 1832.129243] RAX: dffffc0000000000 RBX: ffff888117e9b850 RCX: ffffffffa0= 20580d [ 1832.129691] RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffffffa0= 43a2c0 [ 1832.130137] RBP: ffff888117e9b878 R08: 0000000000000001 R09: 0000000000= 000003 [ 1832.130585] R10: fffffbfff4087458 R11: 0000000000000001 R12: ffff888117= e9b800 [ 1832.131037] R13: 00000000ffffffea R14: 0000000000000000 R15: ffff888117= e9b8a8 [ 1832.131485] FS: 00007fcee9900740(0000) GS:ffff888151a00000(0000) knlGS= :0000000000000000 [ 1832.131993] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1832.132354] CR2: 00007fcee9a1ef5e CR3: 0000000114cd2000 CR4: 0000000000= 350ee0 [ 1832.132801] Call Trace: [ 1832.132962] [ 1832.133104] ? smb2_query_reparse_tag+0x890/0x890 [cifs] [ 1832.133489] ? cifs_mapchar+0x460/0x460 [cifs] [ 1832.133822] ? rcu_read_lock_sched_held+0x3f/0x70 [ 1832.134125] ? cifs_strndup_to_utf16+0x15b/0x250 [cifs] [ 1832.134502] ? lock_downgrade+0x6f0/0x6f0 [ 1832.134760] ? cifs_convert_path_to_utf16+0x198/0x220 [cifs] [ 1832.135170] ? smb2_check_message+0x1080/0x1080 [cifs] [ 1832.135545] cifs_ioctl+0x1577/0x3320 [cifs] [ 1832.135864] ? lock_downgrade+0x6f0/0x6f0 [ 1832.136125] ? cifs_readdir+0x2e60/0x2e60 [cifs] [ 1832.136468] ? rcu_read_lock_sched_held+0x3f/0x70 [ 1832.136769] ? __rseq_handle_notify_resume+0x80b/0xbe0 [ 1832.137096] ? __up_read+0x192/0x710 [ 1832.137327] ? __ia32_sys_rseq+0xf0/0xf0 [ 1832.137578] ? __x64_sys_openat+0x11f/0x1d0 [ 1832.137850] __x64_sys_ioctl+0x127/0x190 [ 1832.138103] do_syscall_64+0x3b/0x90 [ 1832.138378] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 1832.138702] RIP: 0033:0x7fcee9a253df [ 1832.138937] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00= 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 44 24 10 b8 10 00 00 00 0f 05 <4= 1> 89 c0 3d 00 f0 ff ff 77 1f 48 8b 44 24 18 64 48 2b 04 25 28 00 [ 1832.140107] RSP: 002b:00007ffeba94a8a0 EFLAGS: 00000246 ORIG_RAX: 00000= 00000000010 [ 1832.140606] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcee9= a253df [ 1832.141058] RDX: 00007ffeba94a910 RSI: 00000000c018cf07 RDI: 0000000000= 000003 [ 1832.141503] RBP: 00007ffeba94a930 R08: 00007fcee9b24db0 R09: 00007fcee9= b45c4e [ 1832.141948] R10: 00007fcee9918d40 R11: 0000000000000246 R12: 00007ffeba= 94aa48 [ 1832.142396] R13: 0000000000401176 R14: 0000000000403df8 R15: 00007fcee9= b78000 [ 1832.142851] [ 1832.142994] Modules linked in: cifs cifs_arc4 cifs_md4 bpf_preload [las= t unloaded: cifs] Cc: stable@vger.kernel.org Signed-off-by: Paulo Alcantara (SUSE) Signed-off-by: Steve French Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/cifs/smb2ops.c | 124 ++++++++++++++++++++++++++++---------------------= ----- 1 file changed, 65 insertions(+), 59 deletions(-) --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -1526,6 +1526,7 @@ smb2_ioctl_query_info(const unsigned int unsigned int size[2]; void *data[2]; int create_options =3D is_dir ? CREATE_NOT_FILE : CREATE_NOT_DIR; + void (*free_req1_func)(struct smb_rqst *r); =20 vars =3D kzalloc(sizeof(*vars), GFP_ATOMIC); if (vars =3D=3D NULL) @@ -1535,17 +1536,18 @@ smb2_ioctl_query_info(const unsigned int =20 resp_buftype[0] =3D resp_buftype[1] =3D resp_buftype[2] =3D CIFS_NO_BUFFE= R; =20 - if (copy_from_user(&qi, arg, sizeof(struct smb_query_info))) - goto e_fault; - + if (copy_from_user(&qi, arg, sizeof(struct smb_query_info))) { + rc =3D -EFAULT; + goto free_vars; + } if (qi.output_buffer_length > 1024) { - kfree(vars); - return -EINVAL; + rc =3D -EINVAL; + goto free_vars; } =20 if (!ses || !server) { - kfree(vars); - return -EIO; + rc =3D -EIO; + goto free_vars; } =20 if (smb3_encryption_required(tcon)) @@ -1554,8 +1556,8 @@ smb2_ioctl_query_info(const unsigned int if (qi.output_buffer_length) { buffer =3D memdup_user(arg + sizeof(struct smb_query_info), qi.output_bu= ffer_length); if (IS_ERR(buffer)) { - kfree(vars); - return PTR_ERR(buffer); + rc =3D PTR_ERR(buffer); + goto free_vars; } } =20 @@ -1594,48 +1596,45 @@ smb2_ioctl_query_info(const unsigned int rc =3D SMB2_open_init(tcon, server, &rqst[0], &oplock, &oparms, path); if (rc) - goto iqinf_exit; + goto free_output_buffer; smb2_set_next_command(tcon, &rqst[0]); =20 /* Query */ if (qi.flags & PASSTHRU_FSCTL) { /* Can eventually relax perm check since server enforces too */ - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN)) { rc =3D -EPERM; - else { - rqst[1].rq_iov =3D &vars->io_iov[0]; - rqst[1].rq_nvec =3D SMB2_IOCTL_IOV_SIZE; - - rc =3D SMB2_ioctl_init(tcon, server, - &rqst[1], - COMPOUND_FID, COMPOUND_FID, - qi.info_type, true, buffer, - qi.output_buffer_length, - CIFSMaxBufSize - - MAX_SMB2_CREATE_RESPONSE_SIZE - - MAX_SMB2_CLOSE_RESPONSE_SIZE); + goto free_open_req; } + rqst[1].rq_iov =3D &vars->io_iov[0]; + rqst[1].rq_nvec =3D SMB2_IOCTL_IOV_SIZE; + + rc =3D SMB2_ioctl_init(tcon, server, &rqst[1], COMPOUND_FID, COMPOUND_FI= D, + qi.info_type, true, buffer, qi.output_buffer_length, + CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE - + MAX_SMB2_CLOSE_RESPONSE_SIZE); + free_req1_func =3D SMB2_ioctl_free; } else if (qi.flags =3D=3D PASSTHRU_SET_INFO) { /* Can eventually relax perm check since server enforces too */ - if (!capable(CAP_SYS_ADMIN)) + if (!capable(CAP_SYS_ADMIN)) { rc =3D -EPERM; - else if (qi.output_buffer_length < 8) + goto free_open_req; + } + if (qi.output_buffer_length < 8) { rc =3D -EINVAL; - else { - rqst[1].rq_iov =3D &vars->si_iov[0]; - rqst[1].rq_nvec =3D 1; - - /* MS-FSCC 2.4.13 FileEndOfFileInformation */ - size[0] =3D 8; - data[0] =3D buffer; - - rc =3D SMB2_set_info_init(tcon, server, - &rqst[1], - COMPOUND_FID, COMPOUND_FID, - current->tgid, - FILE_END_OF_FILE_INFORMATION, - SMB2_O_INFO_FILE, 0, data, size); + goto free_open_req; } + rqst[1].rq_iov =3D &vars->si_iov[0]; + rqst[1].rq_nvec =3D 1; + + /* MS-FSCC 2.4.13 FileEndOfFileInformation */ + size[0] =3D 8; + data[0] =3D buffer; + + rc =3D SMB2_set_info_init(tcon, server, &rqst[1], COMPOUND_FID, COMPOUND= _FID, + current->tgid, FILE_END_OF_FILE_INFORMATION, + SMB2_O_INFO_FILE, 0, data, size); + free_req1_func =3D SMB2_set_info_free; } else if (qi.flags =3D=3D PASSTHRU_QUERY_INFO) { rqst[1].rq_iov =3D &vars->qi_iov[0]; rqst[1].rq_nvec =3D 1; @@ -1646,6 +1645,7 @@ smb2_ioctl_query_info(const unsigned int qi.info_type, qi.additional_information, qi.input_buffer_length, qi.output_buffer_length, buffer); + free_req1_func =3D SMB2_query_info_free; } else { /* unknown flags */ cifs_tcon_dbg(VFS, "Invalid passthru query flags: 0x%x\n", qi.flags); @@ -1653,7 +1653,7 @@ smb2_ioctl_query_info(const unsigned int } =20 if (rc) - goto iqinf_exit; + goto free_open_req; smb2_set_next_command(tcon, &rqst[1]); smb2_set_related(&rqst[1]); =20 @@ -1664,14 +1664,14 @@ smb2_ioctl_query_info(const unsigned int rc =3D SMB2_close_init(tcon, server, &rqst[2], COMPOUND_FID, COMPOUND_FID, false); if (rc) - goto iqinf_exit; + goto free_req_1; smb2_set_related(&rqst[2]); =20 rc =3D compound_send_recv(xid, ses, server, flags, 3, rqst, resp_buftype, rsp_iov); if (rc) - goto iqinf_exit; + goto out; =20 /* No need to bump num_remote_opens since handle immediately closed */ if (qi.flags & PASSTHRU_FSCTL) { @@ -1681,18 +1681,22 @@ smb2_ioctl_query_info(const unsigned int qi.input_buffer_length =3D le32_to_cpu(io_rsp->OutputCount); if (qi.input_buffer_length > 0 && le32_to_cpu(io_rsp->OutputOffset) + qi.input_buffer_length - > rsp_iov[1].iov_len) - goto e_fault; + > rsp_iov[1].iov_len) { + rc =3D -EFAULT; + goto out; + } =20 if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length, - sizeof(qi.input_buffer_length))) - goto e_fault; + sizeof(qi.input_buffer_length))) { + rc =3D -EFAULT; + goto out; + } =20 if (copy_to_user((void __user *)pqi + sizeof(struct smb_query_info), (const void *)io_rsp + le32_to_cpu(io_rsp->OutputOffset), qi.input_buffer_length)) - goto e_fault; + rc =3D -EFAULT; } else { pqi =3D (struct smb_query_info __user *)arg; qi_rsp =3D (struct smb2_query_info_rsp *)rsp_iov[1].iov_base; @@ -1700,28 +1704,30 @@ smb2_ioctl_query_info(const unsigned int qi.input_buffer_length =3D le32_to_cpu(qi_rsp->OutputBufferLength); if (copy_to_user(&pqi->input_buffer_length, &qi.input_buffer_length, - sizeof(qi.input_buffer_length))) - goto e_fault; + sizeof(qi.input_buffer_length))) { + rc =3D -EFAULT; + goto out; + } =20 if (copy_to_user(pqi + 1, qi_rsp->Buffer, qi.input_buffer_length)) - goto e_fault; + rc =3D -EFAULT; } =20 - iqinf_exit: - cifs_small_buf_release(rqst[0].rq_iov[0].iov_base); - cifs_small_buf_release(rqst[1].rq_iov[0].iov_base); - cifs_small_buf_release(rqst[2].rq_iov[0].iov_base); +out: free_rsp_buf(resp_buftype[0], rsp_iov[0].iov_base); free_rsp_buf(resp_buftype[1], rsp_iov[1].iov_base); free_rsp_buf(resp_buftype[2], rsp_iov[2].iov_base); - kfree(vars); + SMB2_close_free(&rqst[2]); +free_req_1: + free_req1_func(&rqst[1]); +free_open_req: + SMB2_open_free(&rqst[0]); +free_output_buffer: kfree(buffer); +free_vars: + kfree(vars); return rc; - -e_fault: - rc =3D -EFAULT; - goto iqinf_exit; } =20 static ssize_t From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 380CBC433FE for ; Wed, 6 Apr 2022 00:44:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239487AbiDFAlZ (ORCPT ); Tue, 5 Apr 2022 20:41:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34414 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354894AbiDEKQa (ORCPT ); Tue, 5 Apr 2022 06:16:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE5F01EC70; Tue, 5 Apr 2022 03:03:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4BC2961673; Tue, 5 Apr 2022 10:03:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E194C385A3; Tue, 5 Apr 2022 10:03:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153015; bh=VyPMBV7TTks1pk5+FCIN8TMQLHba/6ctFX8uhteFhYs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LskSVzGlRmjzi4YGfA0SUg3U9G6ZcjRYvz/RZBwaaqJL+Bqrdtq/hAQrHWSZ/XciP fteWlj1DWBNgIUrVltra7ris/xaMVEAgg0TynX3uTrRyFIEVaMg4R2t3uerF/uxX1C tA87DZB7/RSIWhbIKKQkasWXKSKM6uAitFzAyQ3Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaomeng Tong , Takashi Iwai Subject: [PATCH 5.10 070/599] ALSA: cs4236: fix an incorrect NULL check on list iterator Date: Tue, 5 Apr 2022 09:26:04 +0200 Message-Id: <20220405070300.909450661@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaomeng Tong commit 0112f822f8a6d8039c94e0bc9b264d7ffc5d4704 upstream. The bug is here: err =3D snd_card_cs423x_pnp(dev, card->private_data, pdev, cdev); The list iterator value 'cdev' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found. To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'cdev' as a dedicated pointer to point to the found element. And snd_card_cs423x_pnp() itself has NULL check for cdev. Cc: stable@vger.kernel.org Fixes: c2b73d1458014 ("ALSA: cs4236: cs4232 and cs4236 driver merge to solv= e PnP BIOS detection") Signed-off-by: Xiaomeng Tong Link: https://lore.kernel.org/r/20220327060822.4735-1-xiam0nd.tong@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- sound/isa/cs423x/cs4236.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/sound/isa/cs423x/cs4236.c +++ b/sound/isa/cs423x/cs4236.c @@ -544,7 +544,7 @@ static int snd_cs423x_pnpbios_detect(str static int dev; int err; struct snd_card *card; - struct pnp_dev *cdev; + struct pnp_dev *cdev, *iter; char cid[PNP_ID_LEN]; =20 if (pnp_device_is_isapnp(pdev)) @@ -560,9 +560,11 @@ static int snd_cs423x_pnpbios_detect(str strcpy(cid, pdev->id[0].id); cid[5] =3D '1'; cdev =3D NULL; - list_for_each_entry(cdev, &(pdev->protocol->devices), protocol_list) { - if (!strcmp(cdev->id[0].id, cid)) + list_for_each_entry(iter, &(pdev->protocol->devices), protocol_list) { + if (!strcmp(iter->id[0].id, cid)) { + cdev =3D iter; break; + } } err =3D snd_cs423x_card_new(&pdev->dev, dev, &card); if (err < 0) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A2D7C433FE for ; Wed, 6 Apr 2022 01:30:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1842140AbiDFB1M (ORCPT ); Tue, 5 Apr 2022 21:27:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43504 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354897AbiDEKQa (ORCPT ); Tue, 5 Apr 2022 06:16:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1DDFF11A; Tue, 5 Apr 2022 03:03:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BFCDFB81C83; Tue, 5 Apr 2022 10:03:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3657DC385A1; Tue, 5 Apr 2022 10:03:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153018; bh=f5R8xVr5kUHPjjSTgAHG6sQa1CUFc8FtQRCPyki1CVU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Su8Kv7LySmkbtMOFxVAm3X2D5GZ6oFbGE0WcJPZFM32Vy8WYdbHXSAvKpCvfvZMV2 9t0w6lUI1uIn8DUI9lBh24lFTcb+9JhU+wmMDWog0BpkiJeVus851OE9aMAcMP5Xo+ If5IsarbPepD7SRSX049g9wRzkHgKI2X03XSmg0c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mohan Kumar , Takashi Iwai Subject: [PATCH 5.10 071/599] ALSA: hda: Avoid unsol event during RPM suspending Date: Tue, 5 Apr 2022 09:26:05 +0200 Message-Id: <20220405070300.939324041@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mohan Kumar commit 6ddc2f749621d5d45ca03edc9f0616bcda136d29 upstream. There is a corner case with unsol event handling during codec runtime suspending state. When the codec runtime suspend call initiated, the codec->in_pm atomic variable would be 0, currently the codec runtime suspend function calls snd_hdac_enter_pm() which will just increments the codec->in_pm atomic variable. Consider unsol event happened just after this step and before snd_hdac_leave_pm() in the codec runtime suspend function. The snd_hdac_power_up_pm() in the unsol event flow in hdmi_present_sense_via_verbs() function would just increment the codec->in_pm atomic variable without calling pm_runtime_get_sync function. As codec runtime suspend flow is already in progress and in parallel unsol event is also accessing the codec verbs, as soon as codec suspend flow completes and clocks are switched off before completing the unsol event handling as both functions doesn't wait for each other. This will result in below errors [ 589.428020] tegra-hda 3510000.hda: azx_get_response timeout, switching to polling mode: last cmd=3D0x505f2f57 [ 589.428344] tegra-hda 3510000.hda: spurious response 0x80000074:0x5, last cmd=3D0x505f2f57 [ 589.428547] tegra-hda 3510000.hda: spurious response 0x80000065:0x5, last cmd=3D0x505f2f57 To avoid this, the unsol event flow should not perform any codec verb related operations during RPM_SUSPENDING state. Signed-off-by: Mohan Kumar Cc: Link: https://lore.kernel.org/r/20220329155940.26331-1-mkumard@nvidia.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- sound/pci/hda/patch_hdmi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/sound/pci/hda/patch_hdmi.c +++ b/sound/pci/hda/patch_hdmi.c @@ -1608,6 +1608,7 @@ static void hdmi_present_sense_via_verbs struct hda_codec *codec =3D per_pin->codec; struct hdmi_spec *spec =3D codec->spec; struct hdmi_eld *eld =3D &spec->temp_eld; + struct device *dev =3D hda_codec_dev(codec); hda_nid_t pin_nid =3D per_pin->pin_nid; int dev_id =3D per_pin->dev_id; /* @@ -1621,8 +1622,13 @@ static void hdmi_present_sense_via_verbs int present; int ret; =20 +#ifdef CONFIG_PM + if (dev->power.runtime_status =3D=3D RPM_SUSPENDING) + return; +#endif + ret =3D snd_hda_power_up_pm(codec); - if (ret < 0 && pm_runtime_suspended(hda_codec_dev(codec))) + if (ret < 0 && pm_runtime_suspended(dev)) goto out; =20 present =3D snd_hda_jack_pin_sense(codec, pin_nid, dev_id); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17396C4321E for ; Tue, 5 Apr 2022 22:24:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1390938AbiDEWSB (ORCPT ); Tue, 5 Apr 2022 18:18:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43228 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354898AbiDEKQa (ORCPT ); Tue, 5 Apr 2022 06:16:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2503D6F; Tue, 5 Apr 2022 03:03:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DBCE761676; Tue, 5 Apr 2022 10:03:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ECC6DC385A2; Tue, 5 Apr 2022 10:03:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153021; bh=o/wY+3yctkPi5FJvL2q9uklsoW1kryd7x+W0kjRFZwE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WnkU0pUHgj5rClZ8GecWVPkkshAlqgZjZvO4VqwxPRuUhfdaamQHRNsBghMx3OMxy WktvYyhfYWOzjqxtxXGBJsfeqgKGGnK2TnrLSrJE+9LcepoEe8pW5q+0vRlVer55QA l2Qib7FFH0nOhfVkp3L8mruKTFk1s5UeAUW/lzwA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com, Takashi Iwai Subject: [PATCH 5.10 072/599] ALSA: pcm: Fix potential AB/BA lock with buffer_mutex and mmap_lock Date: Tue, 5 Apr 2022 09:26:06 +0200 Message-Id: <20220405070300.968767695@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit bc55cfd5718c7c23e5524582e9fa70b4d10f2433 upstream. syzbot caught a potential deadlock between the PCM runtime->buffer_mutex and the mm->mmap_lock. It was brought by the recent fix to cover the racy read/write and other ioctls, and in that commit, I overlooked a (hopefully only) corner case that may take the revert lock, namely, the OSS mmap. The OSS mmap operation exceptionally allows to re-configure the parameters inside the OSS mmap syscall, where mm->mmap_mutex is already held. Meanwhile, the copy_from/to_user calls at read/write operations also take the mm->mmap_lock internally, hence it may lead to a AB/BA deadlock. A similar problem was already seen in the past and we fixed it with a refcount (in commit b248371628aa). The former fix covered only the call paths with OSS read/write and OSS ioctls, while we need to cover the concurrent access via both ALSA and OSS APIs now. This patch addresses the problem above by replacing the buffer_mutex lock in the read/write operations with a refcount similar as we've used for OSS. The new field, runtime->buffer_accessing, keeps the number of concurrent read/write operations. Unlike the former buffer_mutex protection, this protects only around the copy_from/to_user() calls; the other codes are basically protected by the PCM stream lock. The refcount can be a negative, meaning blocked by the ioctls. If a negative value is seen, the read/write aborts with -EBUSY. In the ioctl side, OTOH, they check this refcount, too, and set to a negative value for blocking unless it's already being accessed. Reported-by: syzbot+6e5c88838328e99c7e1c@syzkaller.appspotmail.com Fixes: dca947d4d26d ("ALSA: pcm: Fix races among concurrent read/write and = buffer changes") Cc: Link: https://lore.kernel.org/r/000000000000381a0d05db622a81@google.com Link: https://lore.kernel.org/r/20220330120903.4738-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/sound/pcm.h | 1 + sound/core/pcm.c | 1 + sound/core/pcm_lib.c | 9 +++++---- sound/core/pcm_native.c | 39 ++++++++++++++++++++++++++++++++------- 4 files changed, 39 insertions(+), 11 deletions(-) --- a/include/sound/pcm.h +++ b/include/sound/pcm.h @@ -399,6 +399,7 @@ struct snd_pcm_runtime { struct fasync_struct *fasync; bool stop_operating; /* sync_stop will be called */ struct mutex buffer_mutex; /* protect for buffer changes */ + atomic_t buffer_accessing; /* >0: in r/w operation, <0: blocked */ =20 /* -- private section -- */ void *private_data; --- a/sound/core/pcm.c +++ b/sound/core/pcm.c @@ -970,6 +970,7 @@ int snd_pcm_attach_substream(struct snd_ =20 runtime->status->state =3D SNDRV_PCM_STATE_OPEN; mutex_init(&runtime->buffer_mutex); + atomic_set(&runtime->buffer_accessing, 0); =20 substream->runtime =3D runtime; substream->private_data =3D pcm->private_data; --- a/sound/core/pcm_lib.c +++ b/sound/core/pcm_lib.c @@ -1871,11 +1871,9 @@ static int wait_for_avail(struct snd_pcm if (avail >=3D runtime->twake) break; snd_pcm_stream_unlock_irq(substream); - mutex_unlock(&runtime->buffer_mutex); =20 tout =3D schedule_timeout(wait_time); =20 - mutex_lock(&runtime->buffer_mutex); snd_pcm_stream_lock_irq(substream); set_current_state(TASK_INTERRUPTIBLE); switch (runtime->status->state) { @@ -2169,7 +2167,6 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(str =20 nonblock =3D !!(substream->f_flags & O_NONBLOCK); =20 - mutex_lock(&runtime->buffer_mutex); snd_pcm_stream_lock_irq(substream); err =3D pcm_accessible_state(runtime); if (err < 0) @@ -2224,10 +2221,15 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(str err =3D -EINVAL; goto _end_unlock; } + if (!atomic_inc_unless_negative(&runtime->buffer_accessing)) { + err =3D -EBUSY; + goto _end_unlock; + } snd_pcm_stream_unlock_irq(substream); err =3D writer(substream, appl_ofs, data, offset, frames, transfer); snd_pcm_stream_lock_irq(substream); + atomic_dec(&runtime->buffer_accessing); if (err < 0) goto _end_unlock; err =3D pcm_accessible_state(runtime); @@ -2257,7 +2259,6 @@ snd_pcm_sframes_t __snd_pcm_lib_xfer(str if (xfer > 0 && err >=3D 0) snd_pcm_update_state(substream, runtime); snd_pcm_stream_unlock_irq(substream); - mutex_unlock(&runtime->buffer_mutex); return xfer > 0 ? (snd_pcm_sframes_t)xfer : err; } EXPORT_SYMBOL(__snd_pcm_lib_xfer); --- a/sound/core/pcm_native.c +++ b/sound/core/pcm_native.c @@ -667,6 +667,24 @@ static int snd_pcm_hw_params_choose(stru return 0; } =20 +/* acquire buffer_mutex; if it's in r/w operation, return -EBUSY, otherwise + * block the further r/w operations + */ +static int snd_pcm_buffer_access_lock(struct snd_pcm_runtime *runtime) +{ + if (!atomic_dec_unless_positive(&runtime->buffer_accessing)) + return -EBUSY; + mutex_lock(&runtime->buffer_mutex); + return 0; /* keep buffer_mutex, unlocked by below */ +} + +/* release buffer_mutex and clear r/w access flag */ +static void snd_pcm_buffer_access_unlock(struct snd_pcm_runtime *runtime) +{ + mutex_unlock(&runtime->buffer_mutex); + atomic_inc(&runtime->buffer_accessing); +} + #if IS_ENABLED(CONFIG_SND_PCM_OSS) #define is_oss_stream(substream) ((substream)->oss.oss) #else @@ -677,14 +695,16 @@ static int snd_pcm_hw_params(struct snd_ struct snd_pcm_hw_params *params) { struct snd_pcm_runtime *runtime; - int err =3D 0, usecs; + int err, usecs; unsigned int bits; snd_pcm_uframes_t frames; =20 if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime =3D substream->runtime; - mutex_lock(&runtime->buffer_mutex); + err =3D snd_pcm_buffer_access_lock(runtime); + if (err < 0) + return err; snd_pcm_stream_lock_irq(substream); switch (runtime->status->state) { case SNDRV_PCM_STATE_OPEN: @@ -801,7 +821,7 @@ static int snd_pcm_hw_params(struct snd_ snd_pcm_lib_free_pages(substream); } unlock: - mutex_unlock(&runtime->buffer_mutex); + snd_pcm_buffer_access_unlock(runtime); return err; } =20 @@ -846,7 +866,9 @@ static int snd_pcm_hw_free(struct snd_pc if (PCM_RUNTIME_CHECK(substream)) return -ENXIO; runtime =3D substream->runtime; - mutex_lock(&runtime->buffer_mutex); + result =3D snd_pcm_buffer_access_lock(runtime); + if (result < 0) + return result; snd_pcm_stream_lock_irq(substream); switch (runtime->status->state) { case SNDRV_PCM_STATE_SETUP: @@ -865,7 +887,7 @@ static int snd_pcm_hw_free(struct snd_pc snd_pcm_set_state(substream, SNDRV_PCM_STATE_OPEN); cpu_latency_qos_remove_request(&substream->latency_pm_qos_req); unlock: - mutex_unlock(&runtime->buffer_mutex); + snd_pcm_buffer_access_unlock(runtime); return result; } =20 @@ -1350,12 +1372,15 @@ static int snd_pcm_action_nonatomic(cons =20 /* Guarantee the group members won't change during non-atomic action */ down_read(&snd_pcm_link_rwsem); - mutex_lock(&substream->runtime->buffer_mutex); + res =3D snd_pcm_buffer_access_lock(substream->runtime); + if (res < 0) + goto unlock; if (snd_pcm_stream_linked(substream)) res =3D snd_pcm_action_group(ops, substream, state, false); else res =3D snd_pcm_action_single(ops, substream, state); - mutex_unlock(&substream->runtime->buffer_mutex); + snd_pcm_buffer_access_unlock(substream->runtime); + unlock: up_read(&snd_pcm_link_rwsem); return res; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22704C433F5 for ; Tue, 5 Apr 2022 22:39:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1452388AbiDEWbp (ORCPT ); Tue, 5 Apr 2022 18:31:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43736 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354907AbiDEKQe (ORCPT ); Tue, 5 Apr 2022 06:16:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 09E44101E; Tue, 5 Apr 2022 03:03:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9A1A461673; Tue, 5 Apr 2022 10:03:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A9B21C385A1; Tue, 5 Apr 2022 10:03:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153024; bh=6+YGF0hCD/pWlHdjsLpdbUkPVcBYuxgy1fm5r8lcUk8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rr+kRtr31DbQlaSc+qWdhyDzF3nl5AB7updI3yzHAwTNv0vZsTQqr/R1aSvc3fotg pHQZno/oWqkF1C8N92HrTOZ1eqSng7/IHnc2sXdga7acNjoVYT6zZ7JeD3KFrY94KD ZpsZDW8zc3zZhpSY8LVXlDtXDD/3c1wANNtCDJsg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Dan Carpenter , Kai-Heng Feng , Takashi Iwai Subject: [PATCH 5.10 073/599] ALSA: hda/realtek: Fix audio regression on Mi Notebook Pro 2020 Date: Tue, 5 Apr 2022 09:26:07 +0200 Message-Id: <20220405070300.998662975@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kai-Heng Feng commit f30741cded62f87bb4b1cc58bc627f076abcaba8 upstream. Commit 5aec98913095 ("ALSA: hda/realtek - ALC236 headset MIC recording issue") is to solve recording issue met on AL236, by matching codec variant ALC269_TYPE_ALC257 and ALC269_TYPE_ALC256. This match can be too broad and Mi Notebook Pro 2020 is broken by the patch. Instead, use codec ID to be narrow down the scope, in order to make ALC256 unaffected. Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=3D215484 Fixes: 5aec98913095 ("ALSA: hda/realtek - ALC236 headset MIC recording issu= e") Reported-by: kernel test robot Reported-by: Dan Carpenter Cc: Signed-off-by: Kai-Heng Feng Link: https://lore.kernel.org/r/20220330061335.1015533-1-kai.heng.feng@cano= nical.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- sound/pci/hda/patch_realtek.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -3615,8 +3615,8 @@ static void alc256_shutup(struct hda_cod /* If disable 3k pulldown control for alc257, the Mic detection will not = work correctly * when booting with headset plugged. So skip setting it for the codec al= c257 */ - if (spec->codec_variant !=3D ALC269_TYPE_ALC257 && - spec->codec_variant !=3D ALC269_TYPE_ALC256) + if (codec->core.vendor_id !=3D 0x10ec0236 && + codec->core.vendor_id !=3D 0x10ec0257) alc_update_coef_idx(codec, 0x46, 0, 3 << 12); =20 if (!spec->no_shutup_pins) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1142C433EF for ; Tue, 5 Apr 2022 22:56:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1457599AbiDEWrc (ORCPT ); Tue, 5 Apr 2022 18:47:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51344 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354909AbiDEKQe (ORCPT ); Tue, 5 Apr 2022 06:16:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 00EF51A3AA; Tue, 5 Apr 2022 03:03:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A04BFB81BC0; Tue, 5 Apr 2022 10:03:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E6B14C385A1; Tue, 5 Apr 2022 10:03:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153029; bh=l+NxciS2SavS2cTgrzI35NkhgFF0jOkZeeASdvT/Inc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l+DlTtWqsNyIlDQ9gHkjeg15cDTr0I/12xuFXQYlDE7vYx7pyCrUCYcUp3r10Ql4O b0L+O+wh6vUYCdpS5p4XyWCunCvlGIOcp3HGM+AsNqYx8amrB20MqNQ2iQ1Ky2sku8 aVwJfD5rDeLqaUl+5JhlzFXunUlJMADrFVp4ZE1k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Charan Teja Kalla , David Rientjes , Michal Hocko , Minchan Kim , Nadav Amit , Stephen Rothwell , Suren Baghdasaryan , Vlastimil Babka , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 074/599] mm: madvise: skip unmapped vma holes passed to process_madvise Date: Tue, 5 Apr 2022 09:26:08 +0200 Message-Id: <20220405070301.028073179@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Charan Teja Kalla commit 08095d6310a7ce43256b4251577bc66a25c6e1a6 upstream. The process_madvise() system call is expected to skip holes in vma passed through 'struct iovec' vector list. But do_madvise, which process_madvise() calls for each vma, returns ENOMEM in case of unmapped holes, despite the VMA is processed. Thus process_madvise() should treat ENOMEM as expected and consider the VMA passed to as processed and continue processing other vma's in the vector list. Returning -ENOMEM to user, despite the VMA is processed, will be unable to figure out where to start the next madvise. Link: https://lkml.kernel.org/r/4f091776142f2ebf7b94018146de72318474e686.16= 47008754.git.quic_charante@quicinc.com Fixes: ecb8ac8b1f14("mm/madvise: introduce process_madvise() syscall: an ex= ternal memory hinting API") Signed-off-by: Charan Teja Kalla Cc: David Rientjes Cc: Michal Hocko Cc: Minchan Kim Cc: Nadav Amit Cc: Stephen Rothwell Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/madvise.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1222,9 +1222,16 @@ SYSCALL_DEFINE5(process_madvise, int, pi =20 while (iov_iter_count(&iter)) { iovec =3D iov_iter_iovec(&iter); + /* + * do_madvise returns ENOMEM if unmapped holes are present + * in the passed VMA. process_madvise() is expected to skip + * unmapped holes passed to it in the 'struct iovec' list + * and not fail because of them. Thus treat -ENOMEM return + * from do_madvise as valid and continue processing. + */ ret =3D do_madvise(mm, (unsigned long)iovec.iov_base, iovec.iov_len, behavior); - if (ret < 0) + if (ret < 0 && ret !=3D -ENOMEM) break; iov_iter_advance(&iter, iovec.iov_len); } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AAE12C433F5 for ; Tue, 5 Apr 2022 23:42:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1452357AbiDEXXZ (ORCPT ); Tue, 5 Apr 2022 19:23:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42160 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356093AbiDEKW4 (ORCPT ); Tue, 5 Apr 2022 06:22:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B95F6B2474; Tue, 5 Apr 2022 03:06:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 434A4B81C83; Tue, 5 Apr 2022 10:06:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 801EFC385A2; Tue, 5 Apr 2022 10:06:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153163; bh=AXf40jmtpW45Xp9Oodq8bYKgJRTHlXh5sFHwX9zHIQY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZYMfOARH3FgULwHAcHbvUPtgmznSK8mNYvKgPYIaHqAs1pZJ6ZgVwhvJFvU59Korq q1oy69j/QQ2Um2pA+VZ9NgPba3buJa02k/RXmOk0wts/1DxpD0CqPdwYRdr/oeBHWD IGeCodM0oJ3eOUHYaVh7o6ciMNSXS4RtAtsObhic= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Charan Teja Kalla , Suren Baghdasaryan , Vlastimil Babka , David Rientjes , Stephen Rothwell , Minchan Kim , Nadav Amit , Michal Hocko , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 075/599] mm: madvise: return correct bytes advised with process_madvise Date: Tue, 5 Apr 2022 09:26:09 +0200 Message-Id: <20220405070301.057867860@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Charan Teja Kalla commit 5bd009c7c9a9e888077c07535dc0c70aeab242c3 upstream. Patch series "mm: madvise: return correct bytes processed with process_madvise", v2. With the process_madvise(), always choose to return non zero processed bytes over an error. This can help the user to know on which VMA, passed in the 'struct iovec' vector list, is failed to advise thus can take the decission of retrying/skipping on that VMA. This patch (of 2): The process_madvise() system call returns error even after processing some VMA's passed in the 'struct iovec' vector list which leaves the user confused to know where to restart the advise next. It is also against this syscall man page[1] documentation where it mentions that "return value may be less than the total number of requested bytes, if an error occurred after some iovec elements were already processed.". Consider a user passed 10 VMA's in the 'struct iovec' vector list of which 9 are processed but one. Then it just returns the error caused on that failed VMA despite the first 9 VMA's processed, leaving the user confused about on which VMA it is failed. Returning the number of bytes processed here can help the user to know which VMA it is failed on and thus can retry/skip the advise on that VMA. [1]https://man7.org/linux/man-pages/man2/process_madvise.2.html. Link: https://lkml.kernel.org/r/cover.1647008754.git.quic_charante@quicinc.= com Link: https://lkml.kernel.org/r/125b61a0edcee5c2db8658aed9d06a43a19ccafc.16= 47008754.git.quic_charante@quicinc.com Fixes: ecb8ac8b1f14("mm/madvise: introduce process_madvise() syscall: an ex= ternal memory hinting API") Signed-off-by: Charan Teja Kalla Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Rientjes Cc: Stephen Rothwell Cc: Minchan Kim Cc: Nadav Amit Cc: Michal Hocko Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/madvise.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1236,8 +1236,7 @@ SYSCALL_DEFINE5(process_madvise, int, pi iov_iter_advance(&iter, iovec.iov_len); } =20 - if (ret =3D=3D 0) - ret =3D total_len - iov_iter_count(&iter); + ret =3D (total_len - iov_iter_count(&iter)) ? : ret; =20 release_mm: mmput(mm); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A02BC4321E for ; Wed, 6 Apr 2022 02:07:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1846389AbiDFCEC (ORCPT ); Tue, 5 Apr 2022 22:04:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45148 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354936AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3848622C; Tue, 5 Apr 2022 03:04:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E4087B81C86; Tue, 5 Apr 2022 10:04:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5BD30C385A1; Tue, 5 Apr 2022 10:04:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153048; bh=3z3jzRHy3464weK3HR2VtlPoQjepKQ2VowKCdolR2nc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=N1Bn+W02k0eBNlR9xJNshEzU3y4tFwqi3R9IF9hpWsxtXbXRv6eYXzloebkLUAxOh Y6cECJzjcklrkCTv+zD28xd5mHRgBzWNUKHuBsOOL0ZflGt/9I7tK19JTurw0dFXC7 OomQ+FRLUjD/vduDBeDS6LgKkm1dcH1fovbHm1O0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Charan Teja Kalla , Michal Hocko , Suren Baghdasaryan , Vlastimil Babka , David Rientjes , Nadav Amit , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 076/599] Revert "mm: madvise: skip unmapped vma holes passed to process_madvise" Date: Tue, 5 Apr 2022 09:26:10 +0200 Message-Id: <20220405070301.087589272@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Charan Teja Kalla commit e6b0a7b357659c332231621e4315658d062c23ee upstream. This reverts commit 08095d6310a7 ("mm: madvise: skip unmapped vma holes passed to process_madvise") as process_madvise() fails to return the exact processed bytes in other cases too. As an example: if process_madvise() hits mlocked pages after processing some initial bytes passed in [start, end), it just returns EINVAL although some bytes are processed. Thus making an exception only for ENOMEM is partially fixing the problem of returning the proper advised bytes. Thus revert this patch and return proper bytes advised. Link: https://lkml.kernel.org/r/e73da1304a88b6a8a11907045117cccf4c2b8374.16= 48046642.git.quic_charante@quicinc.com Fixes: 08095d6310a7ce ("mm: madvise: skip unmapped vma holes passed to proc= ess_madvise") Signed-off-by: Charan Teja Kalla Acked-by: Michal Hocko Cc: Suren Baghdasaryan Cc: Vlastimil Babka Cc: David Rientjes Cc: Nadav Amit Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/madvise.c | 9 +-------- 1 file changed, 1 insertion(+), 8 deletions(-) --- a/mm/madvise.c +++ b/mm/madvise.c @@ -1222,16 +1222,9 @@ SYSCALL_DEFINE5(process_madvise, int, pi =20 while (iov_iter_count(&iter)) { iovec =3D iov_iter_iovec(&iter); - /* - * do_madvise returns ENOMEM if unmapped holes are present - * in the passed VMA. process_madvise() is expected to skip - * unmapped holes passed to it in the 'struct iovec' list - * and not fail because of them. Thus treat -ENOMEM return - * from do_madvise as valid and continue processing. - */ ret =3D do_madvise(mm, (unsigned long)iovec.iov_base, iovec.iov_len, behavior); - if (ret < 0 && ret !=3D -ENOMEM) + if (ret < 0) break; iov_iter_advance(&iter, iovec.iov_len); } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3AF0AC4332F for ; Tue, 5 Apr 2022 21:50:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1385302AbiDEVt3 (ORCPT ); Tue, 5 Apr 2022 17:49:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59182 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355358AbiDEKTZ (ORCPT ); Tue, 5 Apr 2022 06:19:25 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B926D13F4F; Tue, 5 Apr 2022 03:04:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2621BB81BC0; Tue, 5 Apr 2022 10:04:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8ED03C385A1; Tue, 5 Apr 2022 10:04:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153078; bh=eIHtbjrdsYsyO9vjQmEJzlYHgDTIqtUdRD6j/Q59o9U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lPjcY0BM4ZDsw+RrJ+nCdbXd0iRmhmK3j6QGDYSq9RbDkUUBVkdB6B52X1YwL11uJ vjbKDM5D2ouKFM6/xBto6hQq+uv8UHB6wNd4LOEF+ZgNFRyw27oISPJzz5of6nP0DL WVxNRn+d/8Jo6vf3WD9A8vxuMcmG9uTWQH5ov7qY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rik van Riel , Miaohe Lin , Naoya Horiguchi , Oscar Salvador , Mel Gorman , Johannes Weiner , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 077/599] mm,hwpoison: unmap poisoned page before invalidation Date: Tue, 5 Apr 2022 09:26:11 +0200 Message-Id: <20220405070301.117379793@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rik van Riel commit 3149c79f3cb0e2e3bafb7cfadacec090cbd250d3 upstream. In some cases it appears the invalidation of a hwpoisoned page fails because the page is still mapped in another process. This can cause a program to be continuously restarted and die when it page faults on the page that was not invalidated. Avoid that problem by unmapping the hwpoisoned page when we find it. Another issue is that sometimes we end up oopsing in finish_fault, if the code tries to do something with the now-NULL vmf->page. I did not hit this error when submitting the previous patch because there are several opportunities for alloc_set_pte to bail out before accessing vmf->page, and that apparently happened on those systems, and most of the time on other systems, too. However, across several million systems that error does occur a handful of times a day. It can be avoided by returning VM_FAULT_NOPAGE which will cause do_read_fault to return before calling finish_fault. Link: https://lkml.kernel.org/r/20220325161428.5068d97e@imladris.surriel.com Fixes: e53ac7374e64 ("mm: invalidate hwpoison page cache page in fault path= ") Signed-off-by: Rik van Riel Reviewed-by: Miaohe Lin Tested-by: Naoya Horiguchi Reviewed-by: Oscar Salvador Cc: Mel Gorman Cc: Johannes Weiner Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/memory.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) --- a/mm/memory.c +++ b/mm/memory.c @@ -3676,14 +3676,18 @@ static vm_fault_t __do_fault(struct vm_f return ret; =20 if (unlikely(PageHWPoison(vmf->page))) { + struct page *page =3D vmf->page; vm_fault_t poisonret =3D VM_FAULT_HWPOISON; if (ret & VM_FAULT_LOCKED) { + if (page_mapped(page)) + unmap_mapping_pages(page_mapping(page), + page->index, 1, false); /* Retry if a clean page was removed from the cache. */ - if (invalidate_inode_page(vmf->page)) - poisonret =3D 0; - unlock_page(vmf->page); + if (invalidate_inode_page(page)) + poisonret =3D VM_FAULT_NOPAGE; + unlock_page(page); } - put_page(vmf->page); + put_page(page); vmf->page =3D NULL; return poisonret; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8F89C4321E for ; Wed, 6 Apr 2022 00:10:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1582559AbiDEXsk (ORCPT ); Tue, 5 Apr 2022 19:48:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355833AbiDEKWI (ORCPT ); Tue, 5 Apr 2022 06:22:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E51DB9F6C7; Tue, 5 Apr 2022 03:05:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 29C956172B; Tue, 5 Apr 2022 10:05:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0A2C6C385A2; Tue, 5 Apr 2022 10:05:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153109; bh=MSTbhPiz+0gIdLuJbCp8xgfsyCNe3dcUzSOKZ3PzUac=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lnKPSqQ1PP6ZLhBthUQjLUPe+oa9LUZ600hkdiFrBtwtmuHUuZWZyS1fiJMqV6pUT WzEMlaqElnSA/65kRilAWWZJmKRXrNXpIzqOLTBODXniAalUiDaPOpWlReUj9g+gMQ QF/ZWF2nSsUysyCx1dOtyBq2/Isrcbig+b3doFtk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuan-Ying Lee , Catalin Marinas , Matthias Brugger , Chinwen Chang , Nicholas Tang , Yee Lee , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 078/599] mm/kmemleak: reset tag when compare object pointer Date: Tue, 5 Apr 2022 09:26:12 +0200 Message-Id: <20220405070301.147117364@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuan-Ying Lee commit bfc8089f00fa526dea983844c880fa8106c33ac4 upstream. When we use HW-tag based kasan and enable vmalloc support, we hit the following bug. It is due to comparison between tagged object and non-tagged pointer. We need to reset the kasan tag when we need to compare tagged object and non-tagged pointer. kmemleak: [name:kmemleak&]Scan area larger than object 0xffffffe77076f440 CPU: 4 PID: 1 Comm: init Tainted: G S W 5.15.25-android13-0-= g5cacf919c2bc #1 Hardware name: MT6983(ENG) (DT) Call trace: add_scan_area+0xc4/0x244 kmemleak_scan_area+0x40/0x9c layout_and_allocate+0x1e8/0x288 load_module+0x2c8/0xf00 __se_sys_finit_module+0x190/0x1d0 __arm64_sys_finit_module+0x20/0x30 invoke_syscall+0x60/0x170 el0_svc_common+0xc8/0x114 do_el0_svc+0x28/0xa0 el0_svc+0x60/0xf8 el0t_64_sync_handler+0x88/0xec el0t_64_sync+0x1b4/0x1b8 kmemleak: [name:kmemleak&]Object 0xf5ffffe77076b000 (size 32768): kmemleak: [name:kmemleak&] comm "init", pid 1, jiffies 4294894197 kmemleak: [name:kmemleak&] min_count =3D 0 kmemleak: [name:kmemleak&] count =3D 0 kmemleak: [name:kmemleak&] flags =3D 0x1 kmemleak: [name:kmemleak&] checksum =3D 0 kmemleak: [name:kmemleak&] backtrace: module_alloc+0x9c/0x120 move_module+0x34/0x19c layout_and_allocate+0x1c4/0x288 load_module+0x2c8/0xf00 __se_sys_finit_module+0x190/0x1d0 __arm64_sys_finit_module+0x20/0x30 invoke_syscall+0x60/0x170 el0_svc_common+0xc8/0x114 do_el0_svc+0x28/0xa0 el0_svc+0x60/0xf8 el0t_64_sync_handler+0x88/0xec el0t_64_sync+0x1b4/0x1b8 Link: https://lkml.kernel.org/r/20220318034051.30687-1-Kuan-Ying.Lee@mediat= ek.com Signed-off-by: Kuan-Ying Lee Reviewed-by: Catalin Marinas Cc: Matthias Brugger Cc: Chinwen Chang Cc: Nicholas Tang Cc: Yee Lee Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- mm/kmemleak.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -787,6 +787,8 @@ static void add_scan_area(unsigned long unsigned long flags; struct kmemleak_object *object; struct kmemleak_scan_area *area =3D NULL; + unsigned long untagged_ptr; + unsigned long untagged_objp; =20 object =3D find_and_get_object(ptr, 1); if (!object) { @@ -795,6 +797,9 @@ static void add_scan_area(unsigned long return; } =20 + untagged_ptr =3D (unsigned long)kasan_reset_tag((void *)ptr); + untagged_objp =3D (unsigned long)kasan_reset_tag((void *)object->pointer); + if (scan_area_cache) area =3D kmem_cache_alloc(scan_area_cache, gfp_kmemleak_mask(gfp)); =20 @@ -806,8 +811,8 @@ static void add_scan_area(unsigned long goto out_unlock; } if (size =3D=3D SIZE_MAX) { - size =3D object->pointer + object->size - ptr; - } else if (ptr + size > object->pointer + object->size) { + size =3D untagged_objp + object->size - untagged_ptr; + } else if (untagged_ptr + size > untagged_objp + object->size) { kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr); dump_object_info(object); kmem_cache_free(scan_area_cache, area); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EF963C43219 for ; Tue, 5 Apr 2022 20:40:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1381790AbiDEUlS (ORCPT ); Tue, 5 Apr 2022 16:41:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59278 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356050AbiDEKWu (ORCPT ); Tue, 5 Apr 2022 06:22:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 827C2AC044; Tue, 5 Apr 2022 03:05:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E35C56167E; Tue, 5 Apr 2022 10:05:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 018ECC385A2; Tue, 5 Apr 2022 10:05:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153140; bh=9ZFDDhY/swhbtnUTI1swTrMLKGNPHHThkWr5qPxbwOQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=f6XievaABNZMfONiAbv7emK3iXl6bwBXnTP+KT0LLjU+bLLL59PGD6dNFcDrW21y/ Xk2uRXGQux8cn3+BBOWH6KRuW540EmnMMBuTeZ16W3vtDqo8Sy6qkD230WT9q1tbea vWxDQQU0Lk04o/o2pUT2ufhJ7AUsbUk0VO3Utwvw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Milan Broz , Mike Snitzer Subject: [PATCH 5.10 079/599] dm integrity: set journal entry unused when shrinking device Date: Tue, 5 Apr 2022 09:26:13 +0200 Message-Id: <20220405070301.176421140@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit cc09e8a9dec4f0e8299e80a7a2a8e6f54164a10b upstream. Commit f6f72f32c22c ("dm integrity: don't replay journal data past the end of the device") skips journal replay if the target sector points beyond the end of the device. Unfortunatelly, it doesn't set the journal entry unused, which resulted in this BUG being triggered: BUG_ON(!journal_entry_is_unused(je)) Fix this by calling journal_entry_set_unused() for this case. Fixes: f6f72f32c22c ("dm integrity: don't replay journal data past the end = of the device") Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Mikulas Patocka Tested-by: Milan Broz [snitzer: revised header] Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/md/dm-integrity.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -2354,9 +2354,11 @@ static void do_journal_write(struct dm_i dm_integrity_io_error(ic, "invalid sector in journal", -EIO); sec &=3D ~(sector_t)(ic->sectors_per_block - 1); } + if (unlikely(sec >=3D ic->provided_data_sectors)) { + journal_entry_set_unused(je); + continue; + } } - if (unlikely(sec >=3D ic->provided_data_sectors)) - continue; get_area_and_offset(ic, sec, &area, &offset); restore_last_bytes(ic, access_journal_data(ic, i, j), je); for (k =3D j + 1; k < ic->journal_section_entries; k++) { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3FCA4C35276 for ; Wed, 6 Apr 2022 00:44:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837446AbiDFApu (ORCPT ); Tue, 5 Apr 2022 20:45:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60622 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356062AbiDEKWu (ORCPT ); Tue, 5 Apr 2022 06:22:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2576AFB26; Tue, 5 Apr 2022 03:05:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 41437616E7; Tue, 5 Apr 2022 10:05:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C947C385A1; Tue, 5 Apr 2022 10:05:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153148; bh=snHYWxAODpPiNnfZch9ZVvvzENGs29YpUjIn62J5ic8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AIFfDY/Tr+2fTl9aR9oEv22NYYeidd30mC+Ey7Z/J1/T8mYEOvB+16EIv2OV3VDYc 3vBf7n3SSXd0Jp0LiReNaWzLZf4D99sd04LkBeK+Wx1jXFIANxlp9AeR1CQFoWABdb 7TPNMZ+7n2JFSDgREhzxbgKjSXkPykr2ZptBEN4g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars Ellenberg , =?UTF-8?q?Christoph=20B=C3=B6hmwalder?= , Jens Axboe Subject: [PATCH 5.10 080/599] drbd: fix potential silent data corruption Date: Tue, 5 Apr 2022 09:26:14 +0200 Message-Id: <20220405070301.207270711@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Lars Ellenberg commit f4329d1f848ac35757d9cc5487669d19dfc5979c upstream. Scenario: Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --------- bio chain generated by blk_queue_split(). Some split bio fails and propagates its error status to the "parent" bio. But then the (last part of the) parent bio itself completes without error. We would clobber the already recorded error status with BLK_STS_OK, causing silent data corruption. Reproducer: ----------- How to trigger this in the real world within seconds: DRBD on top of degraded parity raid, small stripe_cache_size, large read_ahead setting. Drop page cache (sysctl vm.drop_caches=3D1, fadvise "DONTNEED", umount and mount again, "reboot"). Cause significant read ahead. Large read ahead request is split by blk_queue_split(). Parts of the read ahead that are already in the stripe cache, or find an available stripe cache to use, can be serviced. Parts of the read ahead that would need "too much work", would need to wait for a "stripe_head" to become available, are rejected immediately. For larger read ahead requests that are split in many pieces, it is very likely that some "splits" will be serviced, but then the stripe cache is exhausted/busy, and the remaining ones will be rejected. Signed-off-by: Lars Ellenberg Signed-off-by: Christoph B=C3=B6hmwalder Cc: # 4.13.x Link: https://lore.kernel.org/r/20220330185551.3553196-1-christoph.boehmwal= der@linbit.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman --- drivers/block/drbd/drbd_req.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/block/drbd/drbd_req.c +++ b/drivers/block/drbd/drbd_req.c @@ -177,7 +177,8 @@ void start_new_tl_epoch(struct drbd_conn void complete_master_bio(struct drbd_device *device, struct bio_and_error *m) { - m->bio->bi_status =3D errno_to_blk_status(m->error); + if (unlikely(m->error)) + m->bio->bi_status =3D errno_to_blk_status(m->error); bio_endio(m->bio); dec_ap_bio(device); } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 252F5C4167D for ; Wed, 6 Apr 2022 01:26:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1841809AbiDFBZz (ORCPT ); Tue, 5 Apr 2022 21:25:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57390 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356071AbiDEKWv (ORCPT ); Tue, 5 Apr 2022 06:22:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 144D6B0A4A; Tue, 5 Apr 2022 03:05:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BE035B81B7A; Tue, 5 Apr 2022 10:05:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E323C385A2; Tue, 5 Apr 2022 10:05:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153151; bh=1srLbwnp+33mPNfQrlU4NgdphoWy2lW4na0w7ivP5IM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rsTmzPp4nG0VL3O7GrslZznBD+dfkzYIglRzgC2nbOzNymg7gSnqYdMLGGWS3iKGH 4eRkNibNmSwC+C08j6YpBXSEBeLJoV/zVvDztVO3zZ3umoYXyNgY/cYaq5+Q7iR6ob Ch3y42CEcKoGusyo9/ifUKjgXaO8DzhuX3OPLK48= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+2339c27f5c66c652843e@syzkaller.appspotmail.com, Oliver Hartkopp , Marc Kleine-Budde Subject: [PATCH 5.10 081/599] can: isotp: sanitize CAN ID checks in isotp_bind() Date: Tue, 5 Apr 2022 09:26:15 +0200 Message-Id: <20220405070301.236975712@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Hartkopp commit 3ea566422cbde9610c2734980d1286ab681bb40e upstream. Syzbot created an environment that lead to a state machine status that can not be reached with a compliant CAN ID address configuration. The provided address information consisted of CAN ID 0x6000001 and 0xC28001 which both boil down to 11 bit CAN IDs 0x001 in sending and receiving. Sanitize the SFF/EFF CAN ID values before performing the address checks. Fixes: e057dd3fc20f ("can: add ISO 15765-2:2016 transport protocol") Link: https://lore.kernel.org/all/20220316164258.54155-1-socketcan@hartkopp= .net Reported-by: syzbot+2339c27f5c66c652843e@syzkaller.appspotmail.com Signed-off-by: Oliver Hartkopp Signed-off-by: Marc Kleine-Budde Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- net/can/isotp.c | 38 ++++++++++++++++++++------------------ 1 file changed, 20 insertions(+), 18 deletions(-) --- a/net/can/isotp.c +++ b/net/can/isotp.c @@ -1102,6 +1102,7 @@ static int isotp_bind(struct socket *soc struct net *net =3D sock_net(sk); int ifindex; struct net_device *dev; + canid_t tx_id, rx_id; int err =3D 0; int notify_enetdown =3D 0; int do_rx_reg =3D 1; @@ -1109,8 +1110,18 @@ static int isotp_bind(struct socket *soc if (len < ISOTP_MIN_NAMELEN) return -EINVAL; =20 - if (addr->can_addr.tp.tx_id & (CAN_ERR_FLAG | CAN_RTR_FLAG)) - return -EADDRNOTAVAIL; + /* sanitize tx/rx CAN identifiers */ + tx_id =3D addr->can_addr.tp.tx_id; + if (tx_id & CAN_EFF_FLAG) + tx_id &=3D (CAN_EFF_FLAG | CAN_EFF_MASK); + else + tx_id &=3D CAN_SFF_MASK; + + rx_id =3D addr->can_addr.tp.rx_id; + if (rx_id & CAN_EFF_FLAG) + rx_id &=3D (CAN_EFF_FLAG | CAN_EFF_MASK); + else + rx_id &=3D CAN_SFF_MASK; =20 if (!addr->can_ifindex) return -ENODEV; @@ -1122,21 +1133,13 @@ static int isotp_bind(struct socket *soc do_rx_reg =3D 0; =20 /* do not validate rx address for functional addressing */ - if (do_rx_reg) { - if (addr->can_addr.tp.rx_id =3D=3D addr->can_addr.tp.tx_id) { - err =3D -EADDRNOTAVAIL; - goto out; - } - - if (addr->can_addr.tp.rx_id & (CAN_ERR_FLAG | CAN_RTR_FLAG)) { - err =3D -EADDRNOTAVAIL; - goto out; - } + if (do_rx_reg && rx_id =3D=3D tx_id) { + err =3D -EADDRNOTAVAIL; + goto out; } =20 if (so->bound && addr->can_ifindex =3D=3D so->ifindex && - addr->can_addr.tp.rx_id =3D=3D so->rxid && - addr->can_addr.tp.tx_id =3D=3D so->txid) + rx_id =3D=3D so->rxid && tx_id =3D=3D so->txid) goto out; =20 dev =3D dev_get_by_index(net, addr->can_ifindex); @@ -1160,8 +1163,7 @@ static int isotp_bind(struct socket *soc ifindex =3D dev->ifindex; =20 if (do_rx_reg) - can_rx_register(net, dev, addr->can_addr.tp.rx_id, - SINGLE_MASK(addr->can_addr.tp.rx_id), + can_rx_register(net, dev, rx_id, SINGLE_MASK(rx_id), isotp_rcv, sk, "isotp", sk); =20 dev_put(dev); @@ -1181,8 +1183,8 @@ static int isotp_bind(struct socket *soc =20 /* switch to new settings */ so->ifindex =3D ifindex; - so->rxid =3D addr->can_addr.tp.rx_id; - so->txid =3D addr->can_addr.tp.tx_id; + so->rxid =3D rx_id; + so->txid =3D tx_id; so->bound =3D 1; =20 out: From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A87CBC433EF for ; Tue, 5 Apr 2022 20:17:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1452839AbiDEULJ (ORCPT ); Tue, 5 Apr 2022 16:11:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34702 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356078AbiDEKWv (ORCPT ); Tue, 5 Apr 2022 06:22:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2B76FB0A7B; Tue, 5 Apr 2022 03:05:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BB19EB81B7A; Tue, 5 Apr 2022 10:05:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27599C385A1; Tue, 5 Apr 2022 10:05:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153154; bh=/vSptA5YddKrMRYEVwozcLIsPiINX27TrXq69pfeqmQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ED59cCxGMywuTenfBfVaK0a0JxHxw+SW51ixwpakoMiGP7q19D9wrgdZp+edGvJJR A4GcBCZvERuKACs6Mj4/cnjZuK3fucq/ncT7TfZztji8aBZa9jY8I+TrOcUd3zhunJ pnGqmKsH5/y0Yy+KrUGDgXRI595yr59ApO/KQFOE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andreas Gruenbacher , Anand Jain Subject: [PATCH 5.10 082/599] powerpc/kvm: Fix kvm_use_magic_page Date: Tue, 5 Apr 2022 09:26:16 +0200 Message-Id: <20220405070301.266586275@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andreas Gruenbacher commit 0c8eb2884a42d992c7726539328b7d3568f22143 upstream. When switching from __get_user to fault_in_pages_readable, commit 9f9eae5ce717 broke kvm_use_magic_page: like __get_user, fault_in_pages_readable returns 0 on success. Fixes: 9f9eae5ce717 ("powerpc/kvm: Prefer fault_in_pages_readable function") Cc: stable@vger.kernel.org # v4.18+ Signed-off-by: Andreas Gruenbacher Signed-off-by: Anand Jain Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/powerpc/kernel/kvm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/powerpc/kernel/kvm.c +++ b/arch/powerpc/kernel/kvm.c @@ -669,7 +669,7 @@ static void __init kvm_use_magic_page(vo on_each_cpu(kvm_map_magic_page, &features, 1); =20 /* Quick self-test to see if the mapping works */ - if (!fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { + if (fault_in_pages_readable((const char *)KVM_MAGIC_PAGE, sizeof(u32))) { kvm_patching_worked =3D false; return; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4AB5C43219 for ; Tue, 5 Apr 2022 21:15:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357544AbiDEVPW (ORCPT ); Tue, 5 Apr 2022 17:15:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42166 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356081AbiDEKWw (ORCPT ); Tue, 5 Apr 2022 06:22:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 83749B0A4E; Tue, 5 Apr 2022 03:05:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1EA886167E; Tue, 5 Apr 2022 10:05:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 212E7C385A1; Tue, 5 Apr 2022 10:05:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153157; bh=o4/uCDFOiPoentGHBOsBJhXAVLVr9+YO14P1/ZT+Y2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iDpu8xY0oxL6tNyYLyICQ1Y93UiBl2b6St+vxL+wMvBrzmOInP7zrePTYD9w0OswK N2FHLg0MOMwdDp7O6vhF58XpFji5fya+Zl9A7tSXEJa6SzWalXNidPSUVaVrtuM9VG Q71CYUaBjntUeIu7ARhfh6Li8DLSm6yiWDiI0olE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Willem de Bruijn , Xin Long , Jakub Kicinski , Antonio Quartulli Subject: [PATCH 5.10 083/599] udp: call udp_encap_enable for v6 sockets when enabling encap Date: Tue, 5 Apr 2022 09:26:17 +0200 Message-Id: <20220405070301.296870531@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xin Long commit a4a600dd301ccde6ea239804ec1f19364a39d643 upstream. When enabling encap for a ipv6 socket without udp_encap_needed_key increased, UDP GRO won't work for v4 mapped v6 address packets as sk will be NULL in udp4_gro_receive(). This patch is to enable it by increasing udp_encap_needed_key for v6 sockets in udp_tunnel_encap_enable(), and correspondingly decrease udp_encap_needed_key in udpv6_destroy_sock(). v1->v2: - add udp_encap_disable() and export it. v2->v3: - add the change for rxrpc and bareudp into one patch, as Alex suggested. v3->v4: - move rxrpc part to another patch. Acked-by: Willem de Bruijn Signed-off-by: Xin Long Signed-off-by: Jakub Kicinski Tested-by: Antonio Quartulli Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/bareudp.c | 6 ------ include/net/udp.h | 1 + include/net/udp_tunnel.h | 3 +-- net/ipv4/udp.c | 6 ++++++ net/ipv6/udp.c | 4 +++- 5 files changed, 11 insertions(+), 9 deletions(-) --- a/drivers/net/bareudp.c +++ b/drivers/net/bareudp.c @@ -246,12 +246,6 @@ static int bareudp_socket_create(struct tunnel_cfg.encap_destroy =3D NULL; setup_udp_tunnel_sock(bareudp->net, sock, &tunnel_cfg); =20 - /* As the setup_udp_tunnel_sock does not call udp_encap_enable if the - * socket type is v6 an explicit call to udp_encap_enable is needed. - */ - if (sock->sk->sk_family =3D=3D AF_INET6) - udp_encap_enable(); - rcu_assign_pointer(bareudp->sock, sock); return 0; } --- a/include/net/udp.h +++ b/include/net/udp.h @@ -467,6 +467,7 @@ void udp_init(void); =20 DECLARE_STATIC_KEY_FALSE(udp_encap_needed_key); void udp_encap_enable(void); +void udp_encap_disable(void); #if IS_ENABLED(CONFIG_IPV6) DECLARE_STATIC_KEY_FALSE(udpv6_encap_needed_key); void udpv6_encap_enable(void); --- a/include/net/udp_tunnel.h +++ b/include/net/udp_tunnel.h @@ -177,9 +177,8 @@ static inline void udp_tunnel_encap_enab #if IS_ENABLED(CONFIG_IPV6) if (sock->sk->sk_family =3D=3D PF_INET6) ipv6_stub->udpv6_encap_enable(); - else #endif - udp_encap_enable(); + udp_encap_enable(); } =20 #define UDP_TUNNEL_NIC_MAX_TABLES 4 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -598,6 +598,12 @@ void udp_encap_enable(void) } EXPORT_SYMBOL(udp_encap_enable); =20 +void udp_encap_disable(void) +{ + static_branch_dec(&udp_encap_needed_key); +} +EXPORT_SYMBOL(udp_encap_disable); + /* Handler for tunnels with arbitrary destination ports: no socket lookup,= go * through error handlers in encapsulations looking for a match. */ --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -1610,8 +1610,10 @@ void udpv6_destroy_sock(struct sock *sk) if (encap_destroy) encap_destroy(sk); } - if (up->encap_enabled) + if (up->encap_enabled) { static_branch_dec(&udpv6_encap_needed_key); + udp_encap_disable(); + } } =20 inet6_destroy_sock(sk); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 28008C433F5 for ; Tue, 5 Apr 2022 23:51:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1577206AbiDEXaV (ORCPT ); Tue, 5 Apr 2022 19:30:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42296 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356087AbiDEKWy (ORCPT ); Tue, 5 Apr 2022 06:22:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60621B0A68; Tue, 5 Apr 2022 03:06:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F10C8616E7; Tue, 5 Apr 2022 10:06:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0ACE6C385A1; Tue, 5 Apr 2022 10:05:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153160; bh=Kd1EwI8DEHPHhzj8Tdinpg96Cd7BY48Ei1VqwLuA90w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2lzwdQaSFBGS/4AkWoJaz1/chsZQwNRFGNn2wwBg9xqJMjWFFi9aq0NXvzwE6iBTc GF+hrCUYZKbqX9IVF4wqpuJvL/+6v1I9a+aIoGLrH8mO4XTTrd2T8thR6CdQeRtLGL OqS5QTZdzdguUYuX9OUJm2XkzPyB46lFWhhDVF5o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Engraf , Catalin Marinas , Will Deacon , Mark Brown Subject: [PATCH 5.10 084/599] arm64: signal: nofpsimd: Do not allocate fp/simd context when not available Date: Tue, 5 Apr 2022 09:26:18 +0200 Message-Id: <20220405070301.326435854@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Engraf commit 0a32c88ddb9af30e8a16d41d7b9b824c27d29459 upstream. Commit 6d502b6ba1b2 ("arm64: signal: nofpsimd: Handle fp/simd context for signal frames") introduced saving the fp/simd context for signal handling only when support is available. But setup_sigframe_layout() always reserves memory for fp/simd context. The additional memory is not touched because preserve_fpsimd_context() is not called and thus the magic is invalid. This may lead to an error when parse_user_sigframe() checks the fp/simd area and does not find a valid magic number. Signed-off-by: David Engraf Reviwed-by: Mark Brown Fixes: 6d502b6ba1b267b3 ("arm64: signal: nofpsimd: Handle fp/simd context f= or signal frames") Cc: # 5.6.x Reviewed-by: Catalin Marinas Link: https://lore.kernel.org/r/20220225104008.820289-1-david.engraf@sysgo.= com Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm64/kernel/signal.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -572,10 +572,12 @@ static int setup_sigframe_layout(struct { int err; =20 - err =3D sigframe_alloc(user, &user->fpsimd_offset, - sizeof(struct fpsimd_context)); - if (err) - return err; + if (system_supports_fpsimd()) { + err =3D sigframe_alloc(user, &user->fpsimd_offset, + sizeof(struct fpsimd_context)); + if (err) + return err; + } =20 /* fault information, if valid */ if (add_all || current->thread.fault_code) { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D324AC433EF for ; Tue, 5 Apr 2022 23:52:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1580961AbiDEXfD (ORCPT ); Tue, 5 Apr 2022 19:35:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:36194 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354939AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 966F322B0A; Tue, 5 Apr 2022 03:04:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3064F616E7; Tue, 5 Apr 2022 10:04:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 37597C385A1; Tue, 5 Apr 2022 10:04:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153051; bh=CivaMEJcjGKzvh+1Jmorpx4K3eBk7/KE099dJ8YzTMc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Z+i7eNfSAupJFZLZgL+vBAvTuZSbmYp+cwX7XXEE2d494grbYw5wRHwHUBJrSX8uy /T8tW/W4TD7MBhXdKLeTyvZchNmX+0BX3z2ZYiE8i9fh1BPuWg4EISShRxHHbnaYCF KBcGfdbM/mRo1S2T60BtMm3P9iOiXS3FZLt2GSLY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Nishanth Menon Subject: [PATCH 5.10 085/599] arm64: dts: ti: k3-am65: Fix gic-v3 compatible regs Date: Tue, 5 Apr 2022 09:26:19 +0200 Message-Id: <20220405070301.356958388@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nishanth Menon commit 8cae268b70f387ff9e697ccd62fb2384079124e7 upstream. Though GIC ARE option is disabled for no GIC-v2 compatibility, Cortex-A53 is free to implement the CPU interface as long as it communicates with the GIC using the stream protocol. This requires that the SoC integration mark out the PERIPHBASE[1] as reserved area within the SoC. See longer discussion in [2] for further information. Update the GIC register map to indicate offsets from PERIPHBASE based on [3]. Without doing this, systems like kvm will not function with gic-v2 emulation. [1] https://developer.arm.com/documentation/ddi0500/e/system-control/aarch6= 4-register-descriptions/configuration-base-address-register--el1 [2] https://lore.kernel.org/all/87k0e0tirw.wl-maz@kernel.org/ [3] https://developer.arm.com/documentation/ddi0500/e/generic-interrupt-con= troller-cpu-interface/gic-programmers-model/memory-map Cc: stable@vger.kernel.org # 5.10+ Fixes: ea47eed33a3f ("arm64: dts: ti: Add Support for AM654 SoC") Reported-by: Marc Zyngier Signed-off-by: Nishanth Menon Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20220215201008.15235-2-nm@ti.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm64/boot/dts/ti/k3-am65-main.dtsi | 5 ++++- arch/arm64/boot/dts/ti/k3-am65.dtsi | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) --- a/arch/arm64/boot/dts/ti/k3-am65-main.dtsi +++ b/arch/arm64/boot/dts/ti/k3-am65-main.dtsi @@ -35,7 +35,10 @@ #interrupt-cells =3D <3>; interrupt-controller; reg =3D <0x00 0x01800000 0x00 0x10000>, /* GICD */ - <0x00 0x01880000 0x00 0x90000>; /* GICR */ + <0x00 0x01880000 0x00 0x90000>, /* GICR */ + <0x00 0x6f000000 0x00 0x2000>, /* GICC */ + <0x00 0x6f010000 0x00 0x1000>, /* GICH */ + <0x00 0x6f020000 0x00 0x2000>; /* GICV */ /* * vcpumntirq: * virtual CPU interface maintenance interrupt --- a/arch/arm64/boot/dts/ti/k3-am65.dtsi +++ b/arch/arm64/boot/dts/ti/k3-am65.dtsi @@ -84,6 +84,7 @@ <0x00 0x46000000 0x00 0x46000000 0x00 0x00200000>, <0x00 0x47000000 0x00 0x47000000 0x00 0x00068400>, <0x00 0x50000000 0x00 0x50000000 0x00 0x8000000>, + <0x00 0x6f000000 0x00 0x6f000000 0x00 0x00310000>, /* A53 PERIPHBASE */ <0x00 0x70000000 0x00 0x70000000 0x00 0x200000>, <0x05 0x00000000 0x05 0x00000000 0x01 0x0000000>, <0x07 0x00000000 0x07 0x00000000 0x01 0x0000000>; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55BFBC47080 for ; Tue, 5 Apr 2022 23:42:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1579191AbiDEX0b (ORCPT ); Tue, 5 Apr 2022 19:26:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354937AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 754562AE08; Tue, 5 Apr 2022 03:04:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 00BC9616E7; Tue, 5 Apr 2022 10:04:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0DF34C385A2; Tue, 5 Apr 2022 10:04:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153054; bh=o7AP/mczemchuXo0tATB5IVkecPPmtTYKUbdBPS5QO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DP0NTeNARDozpWrldnVP9csvk90NvE1LPRqJUrJy7AizZ8SZBksYyAJMzGNUXQi64 IWNhm+L/c6ceIei6hRstRpjeZOSXxpmBR75Ln2AVJSrEtTMzgM3xL7Magk7DhpGTU9 AtD5pkrpWj3QzAju8+86SCC0BBjOzAtW4iPEAe98= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Nishanth Menon Subject: [PATCH 5.10 086/599] arm64: dts: ti: k3-j721e: Fix gic-v3 compatible regs Date: Tue, 5 Apr 2022 09:26:20 +0200 Message-Id: <20220405070301.388085537@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nishanth Menon commit a06ed27f3bc63ab9e10007dc0118d910908eb045 upstream. Though GIC ARE option is disabled for no GIC-v2 compatibility, Cortex-A72 is free to implement the CPU interface as long as it communicates with the GIC using the stream protocol. This requires that the SoC integration mark out the PERIPHBASE[1] as reserved area within the SoC. See longer discussion in [2] for further information. Update the GIC register map to indicate offsets from PERIPHBASE based on [3]. Without doing this, systems like kvm will not function with gic-v2 emulation. [1] https://developer.arm.com/documentation/100095/0002/system-control/aarc= h64-register-descriptions/configuration-base-address-register--el1 [2] https://lore.kernel.org/all/87k0e0tirw.wl-maz@kernel.org/ [3] https://developer.arm.com/documentation/100095/0002/way1382452674438 Cc: stable@vger.kernel.org # 5.10+ Fixes: 2d87061e70de ("arm64: dts: ti: Add Support for J721E SoC") Reported-by: Marc Zyngier Signed-off-by: Nishanth Menon Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20220215201008.15235-3-nm@ti.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm64/boot/dts/ti/k3-j721e-main.dtsi | 5 ++++- arch/arm64/boot/dts/ti/k3-j721e.dtsi | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) --- a/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi +++ b/arch/arm64/boot/dts/ti/k3-j721e-main.dtsi @@ -108,7 +108,10 @@ #interrupt-cells =3D <3>; interrupt-controller; reg =3D <0x00 0x01800000 0x00 0x10000>, /* GICD */ - <0x00 0x01900000 0x00 0x100000>; /* GICR */ + <0x00 0x01900000 0x00 0x100000>, /* GICR */ + <0x00 0x6f000000 0x00 0x2000>, /* GICC */ + <0x00 0x6f010000 0x00 0x1000>, /* GICH */ + <0x00 0x6f020000 0x00 0x2000>; /* GICV */ =20 /* vcpumntirq: virtual CPU interface maintenance interrupt */ interrupts =3D ; --- a/arch/arm64/boot/dts/ti/k3-j721e.dtsi +++ b/arch/arm64/boot/dts/ti/k3-j721e.dtsi @@ -136,6 +136,7 @@ <0x00 0x0e000000 0x00 0x0e000000 0x00 0x01800000>, /* PCIe Core*/ <0x00 0x10000000 0x00 0x10000000 0x00 0x10000000>, /* PCIe DAT */ <0x00 0x64800000 0x00 0x64800000 0x00 0x00800000>, /* C71 */ + <0x00 0x6f000000 0x00 0x6f000000 0x00 0x00310000>, /* A72 PERIPHBASE */ <0x44 0x00000000 0x44 0x00000000 0x00 0x08000000>, /* PCIe2 DAT */ <0x44 0x10000000 0x44 0x10000000 0x00 0x08000000>, /* PCIe3 DAT */ <0x4d 0x80800000 0x4d 0x80800000 0x00 0x00800000>, /* C66_0 */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54C86C3527B for ; Tue, 5 Apr 2022 23:17:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574352AbiDEWzq (ORCPT ); Tue, 5 Apr 2022 18:55:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45472 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354941AbiDEKQg (ORCPT ); Tue, 5 Apr 2022 06:16:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C79429CA2; Tue, 5 Apr 2022 03:04:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5544CB81BC0; Tue, 5 Apr 2022 10:04:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3639C385A2; Tue, 5 Apr 2022 10:04:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153057; bh=ODSRxNeQPv3kjyymodGtEnar1cFgVjua8tmYL335+po=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vV4HKGMLFEO5LuyvElHAgX06z+2oULe8kHvtTdClrDHnTyVRD5Y2E5FvqUfUDTHTx mBsBtfGM6eieoz/w/R5PzlcCrAAuwGZd5sKfdRRo7r1GY0E802/+iaOn3Grc2cCS4Y rbW3l5EGbfTgPDv6nIyeFkX8eyF/cA+EZZF0yvqo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Nishanth Menon Subject: [PATCH 5.10 087/599] arm64: dts: ti: k3-j7200: Fix gic-v3 compatible regs Date: Tue, 5 Apr 2022 09:26:21 +0200 Message-Id: <20220405070301.418580791@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nishanth Menon commit 1a307cc299430dd7139d351a3b8941f493dfa885 upstream. Though GIC ARE option is disabled for no GIC-v2 compatibility, Cortex-A72 is free to implement the CPU interface as long as it communicates with the GIC using the stream protocol. This requires that the SoC integration mark out the PERIPHBASE[1] as reserved area within the SoC. See longer discussion in [2] for further information. Update the GIC register map to indicate offsets from PERIPHBASE based on [3]. Without doing this, systems like kvm will not function with gic-v2 emulation. [1] https://developer.arm.com/documentation/100095/0002/system-control/aarc= h64-register-descriptions/configuration-base-address-register--el1 [2] https://lore.kernel.org/all/87k0e0tirw.wl-maz@kernel.org/ [3] https://developer.arm.com/documentation/100095/0002/way1382452674438 Cc: stable@vger.kernel.org Fixes: d361ed88455f ("arm64: dts: ti: Add support for J7200 SoC") Reported-by: Marc Zyngier Signed-off-by: Nishanth Menon Acked-by: Marc Zyngier Link: https://lore.kernel.org/r/20220215201008.15235-4-nm@ti.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm64/boot/dts/ti/k3-j7200-main.dtsi | 5 ++++- arch/arm64/boot/dts/ti/k3-j7200.dtsi | 1 + 2 files changed, 5 insertions(+), 1 deletion(-) --- a/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi +++ b/arch/arm64/boot/dts/ti/k3-j7200-main.dtsi @@ -47,7 +47,10 @@ #interrupt-cells =3D <3>; interrupt-controller; reg =3D <0x00 0x01800000 0x00 0x10000>, /* GICD */ - <0x00 0x01900000 0x00 0x100000>; /* GICR */ + <0x00 0x01900000 0x00 0x100000>, /* GICR */ + <0x00 0x6f000000 0x00 0x2000>, /* GICC */ + <0x00 0x6f010000 0x00 0x1000>, /* GICH */ + <0x00 0x6f020000 0x00 0x2000>; /* GICV */ =20 /* vcpumntirq: virtual CPU interface maintenance interrupt */ interrupts =3D ; --- a/arch/arm64/boot/dts/ti/k3-j7200.dtsi +++ b/arch/arm64/boot/dts/ti/k3-j7200.dtsi @@ -127,6 +127,7 @@ <0x00 0x00a40000 0x00 0x00a40000 0x00 0x00000800>, /* timesync router = */ <0x00 0x01000000 0x00 0x01000000 0x00 0x0d000000>, /* Most peripherals= */ <0x00 0x30000000 0x00 0x30000000 0x00 0x0c400000>, /* MAIN NAVSS */ + <0x00 0x6f000000 0x00 0x6f000000 0x00 0x00310000>, /* A72 PERIPHBASE */ <0x00 0x70000000 0x00 0x70000000 0x00 0x00800000>, /* MSMC RAM */ <0x00 0x18000000 0x00 0x18000000 0x00 0x08000000>, /* PCIe1 DAT0 */ <0x41 0x00000000 0x41 0x00000000 0x01 0x00000000>, /* PCIe1 DAT1 */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7CC5EC47080 for ; Tue, 5 Apr 2022 20:28:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1380236AbiDEU2q (ORCPT ); Tue, 5 Apr 2022 16:28:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50084 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354978AbiDEKQu (ORCPT ); Tue, 5 Apr 2022 06:16:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8F2B11C0A; Tue, 5 Apr 2022 03:04:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32B07B81C99; Tue, 5 Apr 2022 10:04:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7D21BC385A6; Tue, 5 Apr 2022 10:04:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153059; bh=r4l+owIcrNQ3efGn/1bGA3KGQMB6wEfh4CiEt6UHA3Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PFneB6CrddJXe6VeQFalHJpQxA4Z4mwjlFB4Peyy/AGcytZh6c2IA1qWHrOgIvlEY mW8o62cQqOzawG9Gb+RDoJBH2gMYfUXwNLaTA7jYdIT7LXm8BT6IBMX1bOzTPiPgCB o8B2DLaWUrVjROuDSaxsiyzFBR2um2PrCwgGoYWI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sakari Ailus , "Rafael J. Wysocki" Subject: [PATCH 5.10 088/599] ACPI: properties: Consistently return -ENOENT if there are no more references Date: Tue, 5 Apr 2022 09:26:22 +0200 Message-Id: <20220405070301.448435301@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sakari Ailus commit babc92da5928f81af951663fc436997352e02d3a upstream. __acpi_node_get_property_reference() is documented to return -ENOENT if the caller requests a property reference at an index that does not exist, not -EINVAL which it actually does. Fix this by returning -ENOENT consistenly, independently of whether the property value is a plain reference or a package. Fixes: c343bc2ce2c6 ("ACPI: properties: Align return codes of __acpi_node_g= et_property_reference()") Cc: 4.14+ # 4.14+ Signed-off-by: Sakari Ailus Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/acpi/property.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/acpi/property.c +++ b/drivers/acpi/property.c @@ -685,7 +685,7 @@ int __acpi_node_get_property_reference(c */ if (obj->type =3D=3D ACPI_TYPE_LOCAL_REFERENCE) { if (index) - return -EINVAL; + return -ENOENT; =20 ret =3D acpi_bus_get_device(obj->reference.handle, &device); if (ret) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5079C433EF for ; Tue, 5 Apr 2022 23:52:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1580362AbiDEXeZ (ORCPT ); Tue, 5 Apr 2022 19:34:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1354981AbiDEKQu (ORCPT ); Tue, 5 Apr 2022 06:16:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D8789DE9F; Tue, 5 Apr 2022 03:04:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1E0546174B; Tue, 5 Apr 2022 10:04:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32017C385A2; Tue, 5 Apr 2022 10:04:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153062; bh=z3BpInOZg7lcxumibtyoEA2UOYtY6znbUUxMJ1KDSLk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qcKRcJdX+ymKjtFLlxmtWtPzKKrsMRvLPwF/zEIk08ieiVfzdXOrcudTzLm7Mtapv vq+AN7IeMQlMDqrMIRGdefkNlow2K+QlIGywoAwIIBUcme0749sXJYfVNBUZwbuyN2 z19DOl+ANRsoqkFWGpUtwAhpD00IZlnee6n52TVo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bill Messmer , Jann Horn , Kees Cook Subject: [PATCH 5.10 089/599] coredump: Also dump first pages of non-executable ELF libraries Date: Tue, 5 Apr 2022 09:26:23 +0200 Message-Id: <20220405070301.478765187@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit 84158b7f6a0624b81800b4e7c90f7fb7fdecf66c upstream. When I rewrote the VMA dumping logic for coredumps, I changed it to recognize ELF library mappings based on the file being executable instead of the mapping having an ELF header. But turns out, distros ship many ELF libraries as non-executable, so the heuristic goes wrong... Restore the old behavior where FILTER(ELF_HEADERS) dumps the first page of any offset-0 readable mapping that starts with the ELF magic. This fix is technically layer-breaking a bit, because it checks for something ELF-specific in fs/coredump.c; but since we probably want to share this between standard ELF and FDPIC ELF anyway, I guess it's fine? And this also keeps the change small for backporting. Cc: stable@vger.kernel.org Fixes: 429a22e776a2 ("coredump: rework elf/elf_fdpic vma_dump_size() into c= ommon helper") Reported-by: Bill Messmer Signed-off-by: Jann Horn Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220126025739.2014888-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/coredump.c | 39 ++++++++++++++++++++++++++++++++++----- 1 file changed, 34 insertions(+), 5 deletions(-) --- a/fs/coredump.c +++ b/fs/coredump.c @@ -41,6 +41,7 @@ #include #include #include +#include =20 #include #include @@ -969,6 +970,8 @@ static bool always_dump_vma(struct vm_ar return false; } =20 +#define DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER 1 + /* * Decide how much of @vma's contents should be included in a core dump. */ @@ -1028,9 +1031,20 @@ static unsigned long vma_dump_size(struc * dump the first page to aid in determining what was mapped here. */ if (FILTER(ELF_HEADERS) && - vma->vm_pgoff =3D=3D 0 && (vma->vm_flags & VM_READ) && - (READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) !=3D 0) - return PAGE_SIZE; + vma->vm_pgoff =3D=3D 0 && (vma->vm_flags & VM_READ)) { + if ((READ_ONCE(file_inode(vma->vm_file)->i_mode) & 0111) !=3D 0) + return PAGE_SIZE; + + /* + * ELF libraries aren't always executable. + * We'll want to check whether the mapping starts with the ELF + * magic, but not now - we're holding the mmap lock, + * so copy_from_user() doesn't work here. + * Use a placeholder instead, and fix it up later in + * dump_vma_snapshot(). + */ + return DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER; + } =20 #undef FILTER =20 @@ -1105,8 +1119,6 @@ int dump_vma_snapshot(struct coredump_pa m->end =3D vma->vm_end; m->flags =3D vma->vm_flags; m->dump_size =3D vma_dump_size(vma, cprm->mm_flags); - - vma_data_size +=3D m->dump_size; } =20 mmap_write_unlock(mm); @@ -1116,6 +1128,23 @@ int dump_vma_snapshot(struct coredump_pa return -EFAULT; } =20 + for (i =3D 0; i < *vma_count; i++) { + struct core_vma_metadata *m =3D (*vma_meta) + i; + + if (m->dump_size =3D=3D DUMP_SIZE_MAYBE_ELFHDR_PLACEHOLDER) { + char elfmag[SELFMAG]; + + if (copy_from_user(elfmag, (void __user *)m->start, SELFMAG) || + memcmp(elfmag, ELFMAG, SELFMAG) !=3D 0) { + m->dump_size =3D 0; + } else { + m->dump_size =3D PAGE_SIZE; + } + } + + vma_data_size +=3D m->dump_size; + } + *vma_data_size_ptr =3D vma_data_size; return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D28CC4167D for ; Wed, 6 Apr 2022 00:50:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837783AbiDFAsE (ORCPT ); Tue, 5 Apr 2022 20:48:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43772 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355220AbiDEKSh (ORCPT ); Tue, 5 Apr 2022 06:18:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E9857DFAF; Tue, 5 Apr 2022 03:04:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9C9D6B81BC0; Tue, 5 Apr 2022 10:04:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ECDE2C385A2; Tue, 5 Apr 2022 10:04:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153065; bh=5PuHhTgGRWjN2ZSLN0sTtYu1icC2v3HqNQf4rFfQXxg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fs4r4icO8d0tOTWWZyoODCs5fA+HwVuntBnM+V8xyfg7XJT6fJxYuzLn2YvRi+YhV Jlw/ck3nsf/1Ol7ApGgqyWtao39FO9xWwu3RwNTHmrltBavWVlVxJ7k//ykQognsuQ Rte6WuKY09cEq8xIZGYnj5oZiGXlNWfqulGm2o8o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Steven Rostedt , Ritesh Harjani , Jan Kara , Harshad Shirwadkar , Theodore Tso Subject: [PATCH 5.10 090/599] ext4: fix ext4_fc_stats trace point Date: Tue, 5 Apr 2022 09:26:24 +0200 Message-Id: <20220405070301.508624107@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ritesh Harjani commit 7af1974af0a9ba8a8ed2e3e947d87dd4d9a78d27 upstream. ftrace's __print_symbolic() requires that any enum values used in the symbol to string translation table be wrapped in a TRACE_DEFINE_ENUM so that the enum value can be decoded from the ftrace ring buffer by user space tooling. This patch also fixes few other problems found in this trace point. e.g. dereferencing structures in TP_printk which should not be done at any cost. Also to avoid checkpatch warnings, this patch removes those whitespaces/tab stops issues. Cc: stable@kernel.org Fixes: aa75f4d3daae ("ext4: main fast-commit commit path") Reported-by: Steven Rostedt Signed-off-by: Ritesh Harjani Reviewed-by: Jan Kara Reviewed-by: Steven Rostedt (Google) Reviewed-by: Harshad Shirwadkar Link: https://lore.kernel.org/r/b4b9691414c35c62e570b723e661c80674169f9a.16= 47057583.git.riteshh@linux.ibm.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- include/trace/events/ext4.h | 80 +++++++++++++++++++++++++++------------= ----- 1 file changed, 50 insertions(+), 30 deletions(-) --- a/include/trace/events/ext4.h +++ b/include/trace/events/ext4.h @@ -95,6 +95,17 @@ TRACE_DEFINE_ENUM(ES_REFERENCED_B); { FALLOC_FL_COLLAPSE_RANGE, "COLLAPSE_RANGE"}, \ { FALLOC_FL_ZERO_RANGE, "ZERO_RANGE"}) =20 +TRACE_DEFINE_ENUM(EXT4_FC_REASON_XATTR); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_CROSS_RENAME); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_JOURNAL_FLAG_CHANGE); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_NOMEM); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_SWAP_BOOT); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_RESIZE); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_RENAME_DIR); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_FALLOC_RANGE); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_INODE_JOURNAL_DATA); +TRACE_DEFINE_ENUM(EXT4_FC_REASON_MAX); + #define show_fc_reason(reason) \ __print_symbolic(reason, \ { EXT4_FC_REASON_XATTR, "XATTR"}, \ @@ -2899,41 +2910,50 @@ TRACE_EVENT(ext4_fc_commit_stop, =20 #define FC_REASON_NAME_STAT(reason) \ show_fc_reason(reason), \ - __entry->sbi->s_fc_stats.fc_ineligible_reason_count[reason] + __entry->fc_ineligible_rc[reason] =20 TRACE_EVENT(ext4_fc_stats, - TP_PROTO(struct super_block *sb), + TP_PROTO(struct super_block *sb), + + TP_ARGS(sb), + + TP_STRUCT__entry( + __field(dev_t, dev) + __array(unsigned int, fc_ineligible_rc, EXT4_FC_REASON_MAX) + __field(unsigned long, fc_commits) + __field(unsigned long, fc_ineligible_commits) + __field(unsigned long, fc_numblks) + ), =20 - TP_ARGS(sb), + TP_fast_assign( + int i; =20 - TP_STRUCT__entry( - __field(dev_t, dev) - __field(struct ext4_sb_info *, sbi) - __field(int, count) - ), - - TP_fast_assign( - __entry->dev =3D sb->s_dev; - __entry->sbi =3D EXT4_SB(sb); - ), - - TP_printk("dev %d:%d fc ineligible reasons:\n" - "%s:%d, %s:%d, %s:%d, %s:%d, %s:%d, %s:%d, %s:%d, %s:%d, %s:%d; " - "num_commits:%ld, ineligible: %ld, numblks: %ld", - MAJOR(__entry->dev), MINOR(__entry->dev), - FC_REASON_NAME_STAT(EXT4_FC_REASON_XATTR), - FC_REASON_NAME_STAT(EXT4_FC_REASON_CROSS_RENAME), - FC_REASON_NAME_STAT(EXT4_FC_REASON_JOURNAL_FLAG_CHANGE), - FC_REASON_NAME_STAT(EXT4_FC_REASON_NOMEM), - FC_REASON_NAME_STAT(EXT4_FC_REASON_SWAP_BOOT), - FC_REASON_NAME_STAT(EXT4_FC_REASON_RESIZE), - FC_REASON_NAME_STAT(EXT4_FC_REASON_RENAME_DIR), - FC_REASON_NAME_STAT(EXT4_FC_REASON_FALLOC_RANGE), - FC_REASON_NAME_STAT(EXT4_FC_REASON_INODE_JOURNAL_DATA), - __entry->sbi->s_fc_stats.fc_num_commits, - __entry->sbi->s_fc_stats.fc_ineligible_commits, - __entry->sbi->s_fc_stats.fc_numblks) + __entry->dev =3D sb->s_dev; + for (i =3D 0; i < EXT4_FC_REASON_MAX; i++) { + __entry->fc_ineligible_rc[i] =3D + EXT4_SB(sb)->s_fc_stats.fc_ineligible_reason_count[i]; + } + __entry->fc_commits =3D EXT4_SB(sb)->s_fc_stats.fc_num_commits; + __entry->fc_ineligible_commits =3D + EXT4_SB(sb)->s_fc_stats.fc_ineligible_commits; + __entry->fc_numblks =3D EXT4_SB(sb)->s_fc_stats.fc_numblks; + ), =20 + TP_printk("dev %d,%d fc ineligible reasons:\n" + "%s:%u, %s:%u, %s:%u, %s:%u, %s:%u, %s:%u, %s:%u, %s:%u, %s:%u " + "num_commits:%lu, ineligible: %lu, numblks: %lu", + MAJOR(__entry->dev), MINOR(__entry->dev), + FC_REASON_NAME_STAT(EXT4_FC_REASON_XATTR), + FC_REASON_NAME_STAT(EXT4_FC_REASON_CROSS_RENAME), + FC_REASON_NAME_STAT(EXT4_FC_REASON_JOURNAL_FLAG_CHANGE), + FC_REASON_NAME_STAT(EXT4_FC_REASON_NOMEM), + FC_REASON_NAME_STAT(EXT4_FC_REASON_SWAP_BOOT), + FC_REASON_NAME_STAT(EXT4_FC_REASON_RESIZE), + FC_REASON_NAME_STAT(EXT4_FC_REASON_RENAME_DIR), + FC_REASON_NAME_STAT(EXT4_FC_REASON_FALLOC_RANGE), + FC_REASON_NAME_STAT(EXT4_FC_REASON_INODE_JOURNAL_DATA), + __entry->fc_commits, __entry->fc_ineligible_commits, + __entry->fc_numblks) ); =20 #define DEFINE_TRACE_DENTRY_EVENT(__type) \ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6035AC4167E for ; Wed, 6 Apr 2022 00:22:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1587108AbiDFAHi (ORCPT ); Tue, 5 Apr 2022 20:07:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43766 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355228AbiDEKSh (ORCPT ); Tue, 5 Apr 2022 06:18:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9F9CD38B8; Tue, 5 Apr 2022 03:04:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4F9B0B81C8B; Tue, 5 Apr 2022 10:04:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A2AD3C385B5; Tue, 5 Apr 2022 10:04:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153068; bh=f+uDxiRuFTIs+PAR4oqtQd+ZBsuICTSJlk0ujjCc4CI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YEJpdx0J7DQItPB7Z9D6P7CDHH9E4BnXLbgnh1sCtTh/29FIhMa0La9DwWffEJ6CI n1fR57EAMOukvUYuKagZ5SoFgqBv6wM/I2fBz1b9uIvxtwx1YY9L2rIMQMIiCmPDB6 YIHJRTU0ID3sIeKqs4iMgXct6RTm093SMaT33tcM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ye Bin , stable@kernel.org, Theodore Tso Subject: [PATCH 5.10 091/599] ext4: fix fs corruption when tring to remove a non-empty directory with IO error Date: Tue, 5 Apr 2022 09:26:25 +0200 Message-Id: <20220405070301.537777044@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ye Bin commit 7aab5c84a0f6ec2290e2ba4a6b245178b1bf949a upstream. We inject IO error when rmdir non empty direcory, then got issue as follows: step1: mkfs.ext4 -F /dev/sda step2: mount /dev/sda test step3: cd test step4: mkdir -p 1/2 step5: rmdir 1 [ 110.920551] ext4_empty_dir: inject fault [ 110.921926] EXT4-fs warning (device sda): ext4_rmdir:3113: inode #12: comm rmdir: empty directory '1' has too many links (3) step6: cd .. step7: umount test step8: fsck.ext4 -f /dev/sda e2fsck 1.42.9 (28-Dec-2013) Pass 1: Checking inodes, blocks, and sizes Pass 2: Checking directory structure Entry '..' in .../??? (13) has deleted/unused inode 12. Clear? yes Pass 3: Checking directory connectivity Unconnected directory inode 13 (...) Connect to /lost+found? yes Pass 4: Checking reference counts Inode 13 ref count is 3, should be 2. Fix? yes Pass 5: Checking group summary information /dev/sda: ***** FILE SYSTEM WAS MODIFIED ***** /dev/sda: 12/131072 files (0.0% non-contiguous), 26157/524288 blocks ext4_rmdir if (!ext4_empty_dir(inode)) goto end_rmdir; ext4_empty_dir bh =3D ext4_read_dirblock(inode, 0, DIRENT_HTREE); if (IS_ERR(bh)) return true; Now if read directory block failed, 'ext4_empty_dir' will return true, assu= me directory is empty. Obviously, it will lead to above issue. To solve this issue, if read directory block failed 'ext4_empty_dir' just return false. To avoid making things worse when file system is already corrupted, 'ext4_empty_dir' also return false. Signed-off-by: Ye Bin Cc: stable@kernel.org Link: https://lore.kernel.org/r/20220228024815.3952506-1-yebin10@huawei.com Signed-off-by: Theodore Ts'o Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/ext4/inline.c | 9 ++++----- fs/ext4/namei.c | 10 +++++----- 2 files changed, 9 insertions(+), 10 deletions(-) --- a/fs/ext4/inline.c +++ b/fs/ext4/inline.c @@ -1768,19 +1768,20 @@ bool empty_inline_dir(struct inode *dir, void *inline_pos; unsigned int offset; struct ext4_dir_entry_2 *de; - bool ret =3D true; + bool ret =3D false; =20 err =3D ext4_get_inode_loc(dir, &iloc); if (err) { EXT4_ERROR_INODE_ERR(dir, -err, "error %d getting inode %lu block", err, dir->i_ino); - return true; + return false; } =20 down_read(&EXT4_I(dir)->xattr_sem); if (!ext4_has_inline_data(dir)) { *has_inline_data =3D 0; + ret =3D true; goto out; } =20 @@ -1789,7 +1790,6 @@ bool empty_inline_dir(struct inode *dir, ext4_warning(dir->i_sb, "bad inline directory (dir #%lu) - no `..'", dir->i_ino); - ret =3D true; goto out; } =20 @@ -1808,16 +1808,15 @@ bool empty_inline_dir(struct inode *dir, dir->i_ino, le32_to_cpu(de->inode), le16_to_cpu(de->rec_len), de->name_len, inline_size); - ret =3D true; goto out; } if (le32_to_cpu(de->inode)) { - ret =3D false; goto out; } offset +=3D ext4_rec_len_from_disk(de->rec_len, inline_size); } =20 + ret =3D true; out: up_read(&EXT4_I(dir)->xattr_sem); brelse(iloc.bh); --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -2868,14 +2868,14 @@ bool ext4_empty_dir(struct inode *inode) sb =3D inode->i_sb; if (inode->i_size < EXT4_DIR_REC_LEN(1) + EXT4_DIR_REC_LEN(2)) { EXT4_ERROR_INODE(inode, "invalid size"); - return true; + return false; } /* The first directory block must not be a hole, * so treat it as DIRENT_HTREE */ bh =3D ext4_read_dirblock(inode, 0, DIRENT_HTREE); if (IS_ERR(bh)) - return true; + return false; =20 de =3D (struct ext4_dir_entry_2 *) bh->b_data; if (ext4_check_dir_entry(inode, NULL, de, bh, bh->b_data, bh->b_size, @@ -2883,7 +2883,7 @@ bool ext4_empty_dir(struct inode *inode) le32_to_cpu(de->inode) !=3D inode->i_ino || strcmp(".", de->name)) { ext4_warning_inode(inode, "directory missing '.'"); brelse(bh); - return true; + return false; } offset =3D ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); de =3D ext4_next_entry(de, sb->s_blocksize); @@ -2892,7 +2892,7 @@ bool ext4_empty_dir(struct inode *inode) le32_to_cpu(de->inode) =3D=3D 0 || strcmp("..", de->name)) { ext4_warning_inode(inode, "directory missing '..'"); brelse(bh); - return true; + return false; } offset +=3D ext4_rec_len_from_disk(de->rec_len, sb->s_blocksize); while (offset < inode->i_size) { @@ -2906,7 +2906,7 @@ bool ext4_empty_dir(struct inode *inode) continue; } if (IS_ERR(bh)) - return true; + return false; } de =3D (struct ext4_dir_entry_2 *) (bh->b_data + (offset & (sb->s_blocksize - 1))); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF718C433F5 for ; Wed, 6 Apr 2022 01:48:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1843789AbiDFBmE (ORCPT ); Tue, 5 Apr 2022 21:42:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43806 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355232AbiDEKSh (ORCPT ); Tue, 5 Apr 2022 06:18:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40D52D93; Tue, 5 Apr 2022 03:04:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EFB86B81C86; Tue, 5 Apr 2022 10:04:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 65696C385A1; Tue, 5 Apr 2022 10:04:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153070; bh=Y44RZZtZoW5GEwA5ktM/IoJ5Tnlzo8j8Re6ddG35/IE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xRA2GAmk89KJENgJ2KGbAOfr+vwO3x+FSmkbhiTMJQcv+wyX9MSZ0bN1M5Go9LYLc qczhe1FuiISYolCCdA7vQpw/Y+1OEpRJe9Z1hfn1DKa1FRND8HGP3QBM9Z6knffBTh OebHQbwEY8+TlQM7Wj4GUuc30mH2D4chzRJwD0es= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Lin Ma , "David S. Miller" Subject: [PATCH 5.10 092/599] drivers: hamradio: 6pack: fix UAF bug caused by mod_timer() Date: Tue, 5 Apr 2022 09:26:26 +0200 Message-Id: <20220405070301.566657774@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit efe4186e6a1b54bf38b9e05450d43b0da1fd7739 upstream. When a 6pack device is detaching, the sixpack_close() will act to cleanup necessary resources. Although del_timer_sync() in sixpack_close() won't return if there is an active timer, one could use mod_timer() in sp_xmit_on_air() to wake up timer again by calling userspace syscall such as ax25_sendmsg(), ax25_connect() and ax25_ioctl(). This unexpected waked handler, sp_xmit_on_air(), realizes nothing about the undergoing cleanup and may still call pty_write() to use driver layer resources that have already been released. One of the possible race conditions is shown below: (USE) | (FREE) ax25_sendmsg() | ax25_queue_xmit() | ... | sp_xmit() | sp_encaps() | sixpack_close() sp_xmit_on_air() | del_timer_sync(&sp->tx_t) mod_timer(&sp->tx_t,...) | ... | unregister_netdev() | ... (wait a while) | tty_release() | tty_release_struct() | release_tty() sp_xmit_on_air() | tty_kref_put(tty_struct) //FREE pty_write(tty_struct) //USE | ... The corresponding fail log is shown below: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in __run_timers.part.0+0x170/0x470 Write of size 8 at addr ffff88800a652ab8 by task swapper/2/0 ... Call Trace: ... queue_work_on+0x3f/0x50 pty_write+0xcd/0xe0pty_write+0xcd/0xe0 sp_xmit_on_air+0xb2/0x1f0 call_timer_fn+0x28/0x150 __run_timers.part.0+0x3c2/0x470 run_timer_softirq+0x3b/0x80 __do_softirq+0xf1/0x380 ... This patch reorders the del_timer_sync() after the unregister_netdev() to avoid UAF bugs. Because the unregister_netdev() is well synchronized, it flushs out any pending queues, waits the refcount of net_device decreases to zero and removes net_device from kernel. There is not any running routines after executing unregister_netdev(). Therefore, we could not arouse timer from userspace again. Signed-off-by: Duoming Zhou Reviewed-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/hamradio/6pack.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -674,14 +674,14 @@ static void sixpack_close(struct tty_str */ netif_stop_queue(sp->dev); =20 + unregister_netdev(sp->dev); + del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t); =20 /* Free all 6pack frame buffers. */ kfree(sp->rbuff); kfree(sp->xbuff); - - unregister_netdev(sp->dev); } =20 /* Perform I/O control on an active 6pack channel. */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 62E4EC4707F for ; Tue, 5 Apr 2022 20:40:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1357762AbiDEUkB (ORCPT ); Tue, 5 Apr 2022 16:40:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355248AbiDEKSn (ORCPT ); Tue, 5 Apr 2022 06:18:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48D8FFD3A; Tue, 5 Apr 2022 03:04:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E633FB81C8B; Tue, 5 Apr 2022 10:04:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 425AEC385A2; Tue, 5 Apr 2022 10:04:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153073; bh=CLWf3OMHKzeZvde0sUqk3oNEVx0H7Xs+0c0PJsByIdQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YSm5xkFUkayn6nZEAuWe5/Uqv1Ga1MBxQSR+bKv1Reqj56WS6jYqVbPtBV25L81R3 92n/WnjMs3nuATnm8o/FKBlsCkKQ8Mxo/PhFHBmRhO8R64IZqxtI0BpHMeFqw66pu/ n7NKasoh0mO4zFUNfeLHfyVclaZsNuiA5Smj3rqk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pekka Pessi , Jon Hunter , Thierry Reding , Jassi Brar Subject: [PATCH 5.10 093/599] mailbox: tegra-hsp: Flush whole channel Date: Tue, 5 Apr 2022 09:26:27 +0200 Message-Id: <20220405070301.595991009@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pekka Pessi commit 60de2d2dc284e0dd1c2c897d08625bde24ef3454 upstream. The txdone can re-fill the mailbox. Keep polling the mailbox during the flush until all the messages have been delivered. This fixes an issue with the Tegra Combined UART (TCU) where output can get truncated under high traffic load. Signed-off-by: Pekka Pessi Tested-by: Jon Hunter Fixes: 91b1b1c3da8a ("mailbox: tegra-hsp: Add support for shared mailboxes") Cc: stable@vger.kernel.org Signed-off-by: Thierry Reding Reviewed-by: Jon Hunter Signed-off-by: Jassi Brar Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/mailbox/tegra-hsp.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/drivers/mailbox/tegra-hsp.c +++ b/drivers/mailbox/tegra-hsp.c @@ -410,6 +410,11 @@ static int tegra_hsp_mailbox_flush(struc value =3D tegra_hsp_channel_readl(ch, HSP_SM_SHRD_MBOX); if ((value & HSP_SM_SHRD_MBOX_FULL) =3D=3D 0) { mbox_chan_txdone(chan, 0); + + /* Wait until channel is empty */ + if (chan->active_req !=3D NULL) + continue; + return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 828ECC4332F for ; Wed, 6 Apr 2022 00:40:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1836491AbiDFAgZ (ORCPT ); Tue, 5 Apr 2022 20:36:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51960 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355268AbiDEKSu (ORCPT ); Tue, 5 Apr 2022 06:18:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4363C10FE1; Tue, 5 Apr 2022 03:04:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CDB5F61673; Tue, 5 Apr 2022 10:04:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE4FEC385A2; Tue, 5 Apr 2022 10:04:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153076; bh=uos+dZQFyuLbUjPtiaSV8Nc9hZwgOh9eP9pCprv8FZs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EMOpZ/6zfwaZ/KCCdwYhL17zUXNW2udDxGs2Zq+CTaC2r/tOsEG41czJSWiiSUD1s DF9oOqmmW0fc9iQV7MbH28XJKuRiX9luX7mx9gKZzk5UNtUjHBXq/fVik3eSUspq2W dF6xPXmOgGwIEneCrH8xpG++dT6t8oChCIGfONPI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Shinichiro Kawasaki , Jens Axboe Subject: [PATCH 5.10 094/599] block: limit request dispatch loop duration Date: Tue, 5 Apr 2022 09:26:28 +0200 Message-Id: <20220405070301.627744791@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Shin'ichiro Kawasaki commit 572299f03afd676dd4e20669cdaf5ed0fe1379d4 upstream. When IO requests are made continuously and the target block device handles requests faster than request arrival, the request dispatch loop keeps on repeating to dispatch the arriving requests very long time, more than a minute. Since the loop runs as a workqueue worker task, the very long loop duration triggers workqueue watchdog timeout and BUG [1]. To avoid the very long loop duration, break the loop periodically. When opportunity to dispatch requests still exists, check need_resched(). If need_resched() returns true, the dispatch loop already consumed its time slice, then reschedule the dispatch work and break the loop. With heavy IO load, need_resched() does not return true for 20~30 seconds. To cover such case, check time spent in the dispatch loop with jiffies. If more than 1 second is spent, reschedule the dispatch work and break the loop. [1] [ 609.691437] BUG: workqueue lockup - pool cpus=3D10 node=3D1 flags=3D0x0 = nice=3D-20 stuck for 35s! [ 609.701820] Showing busy workqueues and worker pools: [ 609.707915] workqueue events: flags=3D0x0 [ 609.712615] pwq 0: cpus=3D0 node=3D0 flags=3D0x0 nice=3D0 active=3D1/2= 56 refcnt=3D2 [ 609.712626] pending: drm_fb_helper_damage_work [drm_kms_helper] [ 609.712687] workqueue events_freezable: flags=3D0x4 [ 609.732943] pwq 0: cpus=3D0 node=3D0 flags=3D0x0 nice=3D0 active=3D1/2= 56 refcnt=3D2 [ 609.732952] pending: pci_pme_list_scan [ 609.732968] workqueue events_power_efficient: flags=3D0x80 [ 609.751947] pwq 0: cpus=3D0 node=3D0 flags=3D0x0 nice=3D0 active=3D1/2= 56 refcnt=3D2 [ 609.751955] pending: neigh_managed_work [ 609.752018] workqueue kblockd: flags=3D0x18 [ 609.769480] pwq 21: cpus=3D10 node=3D1 flags=3D0x0 nice=3D-20 active= =3D3/256 refcnt=3D4 [ 609.769488] in-flight: 1020:blk_mq_run_work_fn [ 609.769498] pending: blk_mq_timeout_work, blk_mq_run_work_fn [ 609.769744] pool 21: cpus=3D10 node=3D1 flags=3D0x0 nice=3D-20 hung=3D35= s workers=3D2 idle: 67 [ 639.899730] BUG: workqueue lockup - pool cpus=3D10 node=3D1 flags=3D0x0 = nice=3D-20 stuck for 66s! [ 639.909513] Showing busy workqueues and worker pools: [ 639.915404] workqueue events: flags=3D0x0 [ 639.920197] pwq 0: cpus=3D0 node=3D0 flags=3D0x0 nice=3D0 active=3D1/2= 56 refcnt=3D2 [ 639.920215] pending: drm_fb_helper_damage_work [drm_kms_helper] [ 639.920365] workqueue kblockd: flags=3D0x18 [ 639.939932] pwq 21: cpus=3D10 node=3D1 flags=3D0x0 nice=3D-20 active= =3D3/256 refcnt=3D4 [ 639.939942] in-flight: 1020:blk_mq_run_work_fn [ 639.939955] pending: blk_mq_timeout_work, blk_mq_run_work_fn [ 639.940212] pool 21: cpus=3D10 node=3D1 flags=3D0x0 nice=3D-20 hung=3D66= s workers=3D2 idle: 67 Fixes: 6e6fcbc27e778 ("blk-mq: support batching dispatch in case of io") Signed-off-by: Shin'ichiro Kawasaki Cc: stable@vger.kernel.org # v5.10+ Link: https://lore.kernel.org/linux-block/20220310091649.zypaem5lkyfadymg@s= hindev/ Link: https://lore.kernel.org/r/20220318022641.133484-1-shinichiro.kawasaki= @wdc.com Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- block/blk-mq-sched.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/block/blk-mq-sched.c +++ b/block/blk-mq-sched.c @@ -194,11 +194,18 @@ static int __blk_mq_do_dispatch_sched(st =20 static int blk_mq_do_dispatch_sched(struct blk_mq_hw_ctx *hctx) { + unsigned long end =3D jiffies + HZ; int ret; =20 do { ret =3D __blk_mq_do_dispatch_sched(hctx); - } while (ret =3D=3D 1); + if (ret !=3D 1) + break; + if (need_resched() || time_is_before_jiffies(end)) { + blk_mq_delay_run_hw_queue(hctx, 0); + break; + } + } while (1); =20 return ret; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 781F7C433FE for ; Wed, 6 Apr 2022 01:48:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1844029AbiDFBm5 (ORCPT ); Tue, 5 Apr 2022 21:42:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51344 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1349506AbiDEKTR (ORCPT ); Tue, 5 Apr 2022 06:19:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BA974140C2; Tue, 5 Apr 2022 03:04:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 246E96167E; Tue, 5 Apr 2022 10:04:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38FD9C385A2; Tue, 5 Apr 2022 10:04:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153081; bh=65v/Mhq1vJHIlp0/ueHvsif4fe6gAfi+72RU4MfFwZI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Q7acPTJNdWq8cHIvG38SQPnxxvIQn7juIaBpmKRW5A4eH36+Q23gGLpnQXphKjmQ9 0IlgEnF7b+ViDVoYksVvLO7ZHfdSBR/sus/LruMsiwrT3gVpk6sBBVD8S+lJ4GIc9S rHguGuR2RX023f3NRXW3hrbkTP+17f3GVzX6CnRg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tejun Heo , Josef Bacik , Jens Axboe Subject: [PATCH 5.10 095/599] block: dont merge across cgroup boundaries if blkcg is enabled Date: Tue, 5 Apr 2022 09:26:29 +0200 Message-Id: <20220405070301.658077817@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tejun Heo commit 6b2b04590b51aa4cf395fcd185ce439cab5961dc upstream. blk-iocost and iolatency are cgroup aware rq-qos policies but they didn't disable merges across different cgroups. This obviously can lead to accounting and control errors but more importantly to priority inversions - e.g. an IO which belongs to a higher priority cgroup or IO class may end up getting throttled incorrectly because it gets merged to an IO issued from a low priority cgroup. Fix it by adding blk_cgroup_mergeable() which is called from merge paths and rejects cross-cgroup and cross-issue_as_root merges. Signed-off-by: Tejun Heo Fixes: d70675121546 ("block: introduce blk-iolatency io controller") Cc: stable@vger.kernel.org # v4.19+ Cc: Josef Bacik Link: https://lore.kernel.org/r/Yi/eE/6zFNyWJ+qd@slm.duckdns.org Signed-off-by: Jens Axboe Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- block/blk-merge.c | 11 +++++++++++ include/linux/blk-cgroup.h | 17 +++++++++++++++++ 2 files changed, 28 insertions(+) --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -7,6 +7,7 @@ #include #include #include +#include =20 #include =20 @@ -554,6 +555,9 @@ static inline unsigned int blk_rq_get_ma static inline int ll_new_hw_segment(struct request *req, struct bio *bio, unsigned int nr_phys_segs) { + if (!blk_cgroup_mergeable(req, bio)) + goto no_merge; + if (blk_integrity_merge_bio(req->q, req, bio) =3D=3D false) goto no_merge; =20 @@ -650,6 +654,9 @@ static int ll_merge_requests_fn(struct r if (total_phys_segments > blk_rq_get_max_segments(req)) return 0; =20 + if (!blk_cgroup_mergeable(req, next->bio)) + return 0; + if (blk_integrity_merge_rq(q, req, next) =3D=3D false) return 0; =20 @@ -861,6 +868,10 @@ bool blk_rq_merge_ok(struct request *rq, if (rq->rq_disk !=3D bio->bi_disk) return false; =20 + /* don't merge across cgroup boundaries */ + if (!blk_cgroup_mergeable(rq, bio)) + return false; + /* only merge integrity protected bio into ditto rq */ if (blk_integrity_merge_bio(rq->q, rq, bio) =3D=3D false) return false; --- a/include/linux/blk-cgroup.h +++ b/include/linux/blk-cgroup.h @@ -24,6 +24,7 @@ #include #include #include +#include =20 /* percpu_counter batch for blkg_[rw]stats, per-cpu drift doesn't matter */ #define BLKG_STAT_CPU_BATCH (INT_MAX / 2) @@ -599,6 +600,21 @@ static inline void blkcg_clear_delay(str atomic_dec(&blkg->blkcg->css.cgroup->congestion_count); } =20 +/** + * blk_cgroup_mergeable - Determine whether to allow or disallow merges + * @rq: request to merge into + * @bio: bio to merge + * + * @bio and @rq should belong to the same cgroup and their issue_as_root s= hould + * match. The latter is necessary as we don't want to throttle e.g. a meta= data + * update because it happens to be next to a regular IO. + */ +static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bi= o) +{ + return rq->bio->bi_blkg =3D=3D bio->bi_blkg && + bio_issue_as_root_blkg(rq->bio) =3D=3D bio_issue_as_root_blkg(bio); +} + void blk_cgroup_bio_start(struct bio *bio); void blkcg_add_delay(struct blkcg_gq *blkg, u64 now, u64 delta); void blkcg_schedule_throttle(struct request_queue *q, bool use_memdelay); @@ -654,6 +670,7 @@ static inline void blkg_put(struct blkcg static inline bool blkcg_punt_bio_submit(struct bio *bio) { return false; } static inline void blkcg_bio_issue_init(struct bio *bio) { } static inline void blk_cgroup_bio_start(struct bio *bio) { } +static inline bool blk_cgroup_mergeable(struct request *rq, struct bio *bi= o) { return true; } =20 #define blk_queue_for_each_rl(rl, q) \ for ((rl) =3D &(q)->root_rl; (rl); (rl) =3D NULL) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06593C433F5 for ; Tue, 5 Apr 2022 22:39:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1452064AbiDEWbU (ORCPT ); Tue, 5 Apr 2022 18:31:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355323AbiDEKTV (ORCPT ); Tue, 5 Apr 2022 06:19:21 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 91B26167C8; Tue, 5 Apr 2022 03:04:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BE41261673; Tue, 5 Apr 2022 10:04:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1A38C385A2; Tue, 5 Apr 2022 10:04:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153084; bh=rc1NwCWd8u+M5IBIMATcIr0JQ05JfKrMq+26TiR0vLM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sL2QfIIU0gUIN7edkwzKK2cjaiiUMQPHPqL4ptzMCLY0y1guCaaghE674MI1A2d0q z0tGb8ImYBVxEeY8MXMKDPta/g2Io4aL5LT9c6MxTjuocalR9ZV0zH1lWaYJFZa2U1 lCwVKJ0BgKEaRyebdSPklmtl0r++RZ+0HSlvhrXY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jani Nikula , Shawn C Lee , intel-gfx , Cooper Chiou Subject: [PATCH 5.10 096/599] drm/edid: check basic audio support on CEA extension block Date: Tue, 5 Apr 2022 09:26:30 +0200 Message-Id: <20220405070301.688093566@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cooper Chiou commit 5662abf6e21338be6d085d6375d3732ac6147fd2 upstream. Tag code stored in bit7:5 for CTA block byte[3] is not the same as CEA extension block definition. Only check CEA block has basic audio support. v3: update commit message. Cc: stable@vger.kernel.org Cc: Jani Nikula Cc: Shawn C Lee Cc: intel-gfx Signed-off-by: Cooper Chiou Signed-off-by: Lee Shawn C Fixes: e28ad544f462 ("drm/edid: parse CEA blocks embedded in DisplayID") Reviewed-by: Jani Nikula Signed-off-by: Jani Nikula Link: https://patchwork.freedesktop.org/patch/msgid/20220324061218.32739-1-= shawn.c.lee@intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/drm_edid.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/drm_edid.c +++ b/drivers/gpu/drm/drm_edid.c @@ -4806,7 +4806,8 @@ bool drm_detect_monitor_audio(struct edi if (!edid_ext) goto end; =20 - has_audio =3D ((edid_ext[3] & EDID_BASIC_AUDIO) !=3D 0); + has_audio =3D (edid_ext[0] =3D=3D CEA_EXT && + (edid_ext[3] & EDID_BASIC_AUDIO) !=3D 0); =20 if (has_audio) { DRM_DEBUG_KMS("Monitor has basic audio support\n"); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93664C41535 for ; Tue, 5 Apr 2022 22:39:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1453227AbiDEWcq (ORCPT ); Tue, 5 Apr 2022 18:32:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53526 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355365AbiDEKTd (ORCPT ); Tue, 5 Apr 2022 06:19:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A700327FEC; Tue, 5 Apr 2022 03:04:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 38758B81BC0; Tue, 5 Apr 2022 10:04:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8CEDFC385A2; Tue, 5 Apr 2022 10:04:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153086; bh=Cw2NlYAm/sub3uTEA3b2qIyrR3JDeMkKrC26amsoKtQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oHAJy/+PL51AzoM/nN/TOBZmwl/pMjG3u2J+3waXchDLT4BF3+Xkz/WUVQCjvJBad /uLI/rAHmHXnoYQAzr0HqhdXf6s4kt4800yKn+4529B/4tEaq5RupOeEanG4VroTQ4 48mr4uFudAR+p/Jo8BT5Z4O4xtAz9IsNhLXR3uRo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Zheyu Ma , Helge Deller Subject: [PATCH 5.10 097/599] video: fbdev: sm712fb: Fix crash in smtcfb_read() Date: Tue, 5 Apr 2022 09:26:31 +0200 Message-Id: <20220405070301.717839647@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller commit bd771cf5c4254511cc4abb88f3dab3bd58bdf8e8 upstream. Zheyu Ma reported this crash in the sm712fb driver when reading three bytes from the framebuffer: BUG: unable to handle page fault for address: ffffc90001ffffff RIP: 0010:smtcfb_read+0x230/0x3e0 Call Trace: vfs_read+0x198/0xa00 ? do_sys_openat2+0x27d/0x350 ? __fget_light+0x54/0x340 ksys_read+0xce/0x190 do_syscall_64+0x43/0x90 Fix it by removing the open-coded endianess fixup-code and by moving the pointer post decrement out the fb_readl() function. Reported-by: Zheyu Ma Signed-off-by: Helge Deller Tested-by: Zheyu Ma Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/video/fbdev/sm712fb.c | 25 +++++++------------------ 1 file changed, 7 insertions(+), 18 deletions(-) --- a/drivers/video/fbdev/sm712fb.c +++ b/drivers/video/fbdev/sm712fb.c @@ -1047,7 +1047,7 @@ static ssize_t smtcfb_read(struct fb_inf if (count + p > total_size) count =3D total_size - p; =20 - buffer =3D kmalloc((count > PAGE_SIZE) ? PAGE_SIZE : count, GFP_KERNEL); + buffer =3D kmalloc(PAGE_SIZE, GFP_KERNEL); if (!buffer) return -ENOMEM; =20 @@ -1059,25 +1059,14 @@ static ssize_t smtcfb_read(struct fb_inf while (count) { c =3D (count > PAGE_SIZE) ? PAGE_SIZE : count; dst =3D buffer; - for (i =3D c >> 2; i--;) { - *dst =3D fb_readl(src++); - *dst =3D big_swap(*dst); + for (i =3D (c + 3) >> 2; i--;) { + u32 val; + + val =3D fb_readl(src); + *dst =3D big_swap(val); + src++; dst++; } - if (c & 3) { - u8 *dst8 =3D (u8 *)dst; - u8 __iomem *src8 =3D (u8 __iomem *)src; - - for (i =3D c & 3; i--;) { - if (i & 1) { - *dst8++ =3D fb_readb(++src8); - } else { - *dst8++ =3D fb_readb(--src8); - src8 +=3D 2; - } - } - src =3D (u32 __iomem *)src8; - } =20 if (copy_to_user(buf, buffer, c)) { err =3D -EFAULT; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 890C7C35273 for ; Tue, 5 Apr 2022 20:17:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1346692AbiDEUOV (ORCPT ); Tue, 5 Apr 2022 16:14:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58028 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355400AbiDEKTm (ORCPT ); Tue, 5 Apr 2022 06:19:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 89B5D52B02; Tue, 5 Apr 2022 03:04:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 27700B81B7A; Tue, 5 Apr 2022 10:04:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 60516C385A3; Tue, 5 Apr 2022 10:04:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153089; bh=WkVJKsAZU6/G2MI9GVZ2hWhJPA+RrSP8pqdwsnsB1Zs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VCYLGgzGH+tyynZoKaGx4HxuKZjriv9EVAIowOiwIGKMtWXZ/OcsXbwe0q3Vd/Ilp +v14bK9F2RWyP4UZ/sanwM1xy8V9pXAkkMFMyoEWK/KEI0jRdVMmi284Nf4mxVA3Cl uSCpfDnMZ4q3cGkE3uDu1xldSJfR2S/9Eh3iT8rs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Michael Schmitz , Helge Deller Subject: [PATCH 5.10 098/599] video: fbdev: atari: Atari 2 bpp (STe) palette bugfix Date: Tue, 5 Apr 2022 09:26:32 +0200 Message-Id: <20220405070301.747958724@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Schmitz commit c8be5edbd36ceed2ff3d6b8f8e40643c3f396ea3 upstream. The code to set the shifter STe palette registers has a long standing operator precedence bug, manifesting as colors set on a 2 bits per pixel frame buffer coming up with a distinctive blue tint. Add parentheses around the calculation of the per-color palette data before shifting those into their respective bit field position. This bug goes back a long way (2.4 days at the very least) so there won't be a Fixes: tag. Tested on ARAnyM as well on Falcon030 hardware. Cc: stable@vger.kernel.org Reported-by: Geert Uytterhoeven Link: https://lore.kernel.org/all/CAMuHMdU3ievhXxKR_xi_v3aumnYW7UNUO6qMdhgf= yWTyVSsCkQ@mail.gmail.com Tested-by: Michael Schmitz Tested-by: Geert Uytterhoeven Signed-off-by: Michael Schmitz Signed-off-by: Helge Deller Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/video/fbdev/atafb.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) --- a/drivers/video/fbdev/atafb.c +++ b/drivers/video/fbdev/atafb.c @@ -1691,9 +1691,9 @@ static int falcon_setcolreg(unsigned int ((blue & 0xfc00) >> 8)); if (regno < 16) { shifter_tt.color_reg[regno] =3D - (((red & 0xe000) >> 13) | ((red & 0x1000) >> 12) << 8) | - (((green & 0xe000) >> 13) | ((green & 0x1000) >> 12) << 4) | - ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); + ((((red & 0xe000) >> 13) | ((red & 0x1000) >> 12)) << 8) | + ((((green & 0xe000) >> 13) | ((green & 0x1000) >> 12)) << 4) | + ((blue & 0xe000) >> 13) | ((blue & 0x1000) >> 12); ((u32 *)info->pseudo_palette)[regno] =3D ((red & 0xf800) | ((green & 0xfc00) >> 5) | ((blue & 0xf800) >> 11)); @@ -1979,9 +1979,9 @@ static int stste_setcolreg(unsigned int green >>=3D 12; if (ATARIHW_PRESENT(EXTD_SHIFTER)) shifter_tt.color_reg[regno] =3D - (((red & 0xe) >> 1) | ((red & 1) << 3) << 8) | - (((green & 0xe) >> 1) | ((green & 1) << 3) << 4) | - ((blue & 0xe) >> 1) | ((blue & 1) << 3); + ((((red & 0xe) >> 1) | ((red & 1) << 3)) << 8) | + ((((green & 0xe) >> 1) | ((green & 1) << 3)) << 4) | + ((blue & 0xe) >> 1) | ((blue & 1) << 3); else shifter_tt.color_reg[regno] =3D ((red & 0xe) << 7) | From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54ED8C35276 for ; Wed, 6 Apr 2022 00:17:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1583353AbiDEXw3 (ORCPT ); Tue, 5 Apr 2022 19:52:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53588 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355429AbiDEKTm (ORCPT ); Tue, 5 Apr 2022 06:19:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 835646EC77; Tue, 5 Apr 2022 03:04:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F291EB81BC0; Tue, 5 Apr 2022 10:04:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 40DF3C385A1; Tue, 5 Apr 2022 10:04:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153092; bh=EUPH0vkDEVeXCVAVBEpenWoJnK05JcGiufawvmrh8I0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lm5bWzJ2ZqWsN2FKXn/Aic1kq2nBzWDrD0rwllJmEUOiZKQ44BsQsNXbqUwwBtVtd urBXn0ZiVEN4aqbZz5r171VVtosGUxB5SZAGV8cDuWxP1MrLB8tosApcQsm4PvYj/a hbcCN4tfqXBw5816iFX41KE/WaMwQMd+8tPKohKs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tudor Ambarus , Alexander Dahl , Nicolas Ferre Subject: [PATCH 5.10 099/599] ARM: dts: at91: sama5d2: Fix PMERRLOC resource size Date: Tue, 5 Apr 2022 09:26:33 +0200 Message-Id: <20220405070301.778257710@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tudor Ambarus commit 0fb578a529ac7aca326a9fa475b4a6f58a756fda upstream. PMERRLOC resource size was set to 0x100, which resulted in HSMC_ERRLOCx register being truncated to offset x =3D 21, causing error correction to fail if more than 22 bit errors and if 24 or 32 bit error correction was supported. Fixes: d9c41bf30cf8 ("ARM: dts: at91: Declare EBI/NAND controllers") Signed-off-by: Tudor Ambarus Cc: # 4.13.x Acked-by: Alexander Dahl Signed-off-by: Nicolas Ferre Link: https://lore.kernel.org/r/20220111132301.906712-1-tudor.ambarus@micro= chip.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/sama5d2.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/arm/boot/dts/sama5d2.dtsi +++ b/arch/arm/boot/dts/sama5d2.dtsi @@ -413,7 +413,7 @@ pmecc: ecc-engine@f8014070 { compatible =3D "atmel,sama5d2-pmecc"; reg =3D <0xf8014070 0x490>, - <0xf8014500 0x100>; + <0xf8014500 0x200>; }; }; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7954DC433EF for ; Wed, 6 Apr 2022 00:50:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837273AbiDFApW (ORCPT ); Tue, 5 Apr 2022 20:45:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355439AbiDEKTn (ORCPT ); Tue, 5 Apr 2022 06:19:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5F91270856; Tue, 5 Apr 2022 03:04:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EE99E616E7; Tue, 5 Apr 2022 10:04:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0AE4CC385A2; Tue, 5 Apr 2022 10:04:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153095; bh=rxSC1Q8UZg6s7D6ZuFhMZ73XWIIqRVLONcnqQ9q8kC4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MdLBi5hTK8fVCbu0DONnN+jz2iq9KblTE2m4qtStmrBMir+bTNhlNwzrqHpuWZbjd ooJ/rBzRlH8yvmla4G7rJAJ+VEYmlDQ80aQb41QtHWhNKtqxxiiGT7VZaCDM+ZGugP AqKlFtGw0UmpaegKKWFZZZatpjA9DKIy3N6dk00A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Marek Szyprowski , Alim Akhtar Subject: [PATCH 5.10 100/599] ARM: dts: exynos: fix UART3 pins configuration in Exynos5250 Date: Tue, 5 Apr 2022 09:26:34 +0200 Message-Id: <20220405070301.808905613@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit 372d7027fed43c8570018e124cf78b89523a1f8e upstream. The gpa1-4 pin was put twice in UART3 pin configuration of Exynos5250, instead of proper pin gpa1-5. Fixes: f8bfe2b050f3 ("ARM: dts: add pin state information in client nodes f= or Exynos5 platforms") Cc: Signed-off-by: Krzysztof Kozlowski Tested-by: Marek Szyprowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20211230195325.328220-1-krzysztof.kozlowski= @canonical.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/exynos5250-pinctrl.dtsi | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/arm/boot/dts/exynos5250-pinctrl.dtsi +++ b/arch/arm/boot/dts/exynos5250-pinctrl.dtsi @@ -260,7 +260,7 @@ }; =20 uart3_data: uart3-data { - samsung,pins =3D "gpa1-4", "gpa1-4"; + samsung,pins =3D "gpa1-4", "gpa1-5"; samsung,pin-function =3D ; samsung,pin-pud =3D ; samsung,pin-drv =3D ; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B8E6FC47084 for ; Tue, 5 Apr 2022 22:09:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1392214AbiDEWJc (ORCPT ); Tue, 5 Apr 2022 18:09:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51088 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355473AbiDEKUB (ORCPT ); Tue, 5 Apr 2022 06:20:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 921C874DCD; Tue, 5 Apr 2022 03:04:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BBE4F616E7; Tue, 5 Apr 2022 10:04:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBE46C385A1; Tue, 5 Apr 2022 10:04:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153098; bh=/maTMZpPyHrPXM73DSYyKjXwq5K+XsJdIA6vi+YbTEU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gtld/7Q3wSJ+kDjVXTOsiTFnZ8FFPyOJAq4M8NnE2PHnoeMpyOf8O6AeeOb5o4kXF 7H229JlYApuJGPeazZx7VuakxpVOkDVEiQAR9xzPNIfk/+yi2ilUJDhSdritAgePE0 cqlQ928BbicjQ72985SkKuUSoOuJPICykqJsBcac= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Alim Akhtar Subject: [PATCH 5.10 101/599] ARM: dts: exynos: add missing HDMI supplies on SMDK5250 Date: Tue, 5 Apr 2022 09:26:35 +0200 Message-Id: <20220405070301.837755352@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit 60a9914cb2061ba612a3f14f6ad329912b486360 upstream. Add required VDD supplies to HDMI block on SMDK5250. Without them, the HDMI driver won't probe. Because of lack of schematics, use same supplies as on Arndale 5250 board (voltage matches). Cc: # v3.15+ Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20220208171823.226211-2-krzysztof.kozlowski= @canonical.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/exynos5250-smdk5250.dts | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/arm/boot/dts/exynos5250-smdk5250.dts +++ b/arch/arm/boot/dts/exynos5250-smdk5250.dts @@ -118,6 +118,9 @@ status =3D "okay"; ddc =3D <&i2c_2>; hpd-gpios =3D <&gpx3 7 GPIO_ACTIVE_HIGH>; + vdd-supply =3D <&ldo8_reg>; + vdd_osc-supply =3D <&ldo10_reg>; + vdd_pll-supply =3D <&ldo8_reg>; }; =20 &i2c_0 { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D98A8C433F5 for ; Wed, 6 Apr 2022 00:44:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837600AbiDFAp6 (ORCPT ); Tue, 5 Apr 2022 20:45:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60386 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355712AbiDEKVn (ORCPT ); Tue, 5 Apr 2022 06:21:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C3FC7C15B; Tue, 5 Apr 2022 03:05:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 46863B81B7A; Tue, 5 Apr 2022 10:05:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9458EC385A2; Tue, 5 Apr 2022 10:05:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153101; bh=kHivgI89ExcwhIzHs0s0eahszGcG5QZveN98bO2rNkA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZakrJ9BKjDOHGl480Db8DJ7JsIukLr0vRbcvXY8U5HpfhqPkSKtFDl8Hl0VeGujc7 z9HS+d1GrEImsq6DTPDkEF+BLT6TYJcWtb2iM2VgLKL5Rgs3tIWIkfiVCslzwPuRxV TIITbasITW2kAMiDkyjoWgId5BQteAwydT4tWP4M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Krzysztof Kozlowski , Alim Akhtar Subject: [PATCH 5.10 102/599] ARM: dts: exynos: add missing HDMI supplies on SMDK5420 Date: Tue, 5 Apr 2022 09:26:36 +0200 Message-Id: <20220405070301.868219337@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Krzysztof Kozlowski commit 453a24ded415f7fce0499c6b0a2c7b28f84911f2 upstream. Add required VDD supplies to HDMI block on SMDK5420. Without them, the HDMI driver won't probe. Because of lack of schematics, use same supplies as on Arndale Octa and Odroid XU3 boards (voltage matches). Cc: # v3.15+ Signed-off-by: Krzysztof Kozlowski Reviewed-by: Alim Akhtar Link: https://lore.kernel.org/r/20220208171823.226211-3-krzysztof.kozlowski= @canonical.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/exynos5420-smdk5420.dts | 3 +++ 1 file changed, 3 insertions(+) --- a/arch/arm/boot/dts/exynos5420-smdk5420.dts +++ b/arch/arm/boot/dts/exynos5420-smdk5420.dts @@ -124,6 +124,9 @@ hpd-gpios =3D <&gpx3 7 GPIO_ACTIVE_HIGH>; pinctrl-names =3D "default"; pinctrl-0 =3D <&hdmi_hpd_irq>; + vdd-supply =3D <&ldo6_reg>; + vdd_osc-supply =3D <&ldo7_reg>; + vdd_pll-supply =3D <&ldo6_reg>; }; =20 &hsi2c_4 { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C09A6C4707A for ; Tue, 5 Apr 2022 23:41:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1577876AbiDEXRT (ORCPT ); Tue, 5 Apr 2022 19:17:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41188 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355724AbiDEKVn (ORCPT ); Tue, 5 Apr 2022 06:21:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 20E3B83031; Tue, 5 Apr 2022 03:05:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4EF58616E7; Tue, 5 Apr 2022 10:05:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C3A8C385A1; Tue, 5 Apr 2022 10:05:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153103; bh=WNP6Khvhm5d3jm0balr1Rh0ZzmOjXFEoQMP607kv07Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LZaaORXGZrzM8ACna2UqYMCn+X5a5WJdVs75my7PK07Tt9Tb/M10I2HXO8C7FeRyA 7ZJ3qBOhkt8Hy1+XlVjk/Q5u2YlzL5kdt2RZUk8yFuLc1GJ1N1BZlCThVip8x8XamD 8uMV3lna+ryZgURKTl71iHsyMOj1C/mqqEbUDgZg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jocelyn Falempe , Javier Martinez Canillas , Lyude Paul , Thomas Zimmermann Subject: [PATCH 5.10 103/599] mgag200 fix memmapsl configuration in GCTL6 register Date: Tue, 5 Apr 2022 09:26:37 +0200 Message-Id: <20220405070301.898742921@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jocelyn Falempe commit 028a73e10705af1ffd51f2537460f616dc58680e upstream. On some servers with MGA G200_SE_A (rev 42), booting with Legacy BIOS, the hardware hangs when using kdump and kexec into the kdump kernel. This happens when the uncompress code tries to write "Decompressing Linux" to the VGA Console. It can be reproduced by writing to the VGA console (0xB8000) after booting to graphic mode, it generates the following error: kernel:NMI: PCI system error (SERR) for reason a0 on CPU 0. kernel:Dazed and confused, but trying to continue The root cause is the configuration of the MGA GCTL6 register According to the GCTL6 register documentation: bit 0 is gcgrmode: 0: Enables alpha mode, and the character generator addressing system is activated. 1: Enables graphics mode, and the character addressing system is not used. bit 1 is chainodd even: 0: The A0 signal of the memory address bus is used during system memory addressing. 1: Allows A0 to be replaced by either the A16 signal of the system address (ifmemmapsl is =E2=80=9800=E2=80=99), or by the hpgoddev (MISC= <5>, odd/even page select) field, described on page 3-294). bit 3-2 are memmapsl: Memory map select bits 1 and 0. VGA. These bits select where the video memory is mapped, as shown below: 00 =3D> A0000h - BFFFFh 01 =3D> A0000h - AFFFFh 10 =3D> B0000h - B7FFFh 11 =3D> B8000h - BFFFFh bit 7-4 are reserved. Current code set it to 0x05 =3D> memmapsl to b01 =3D> 0xa0000 (graphic mode) But on x86, the VGA console is at 0xb8000 (text mode) In arch/x86/boot/compressed/misc.c debug strings are written to 0xb8000 As the driver doesn't use this mapping at 0xa0000, it is safe to set it to 0xb8000 instead, to avoid kernel hang on G200_SE_A rev42, with kexec/kdump. Thus changing the value 0x05 to 0x0d Signed-off-by: Jocelyn Falempe Reviewed-by: Javier Martinez Canillas Acked-by: Lyude Paul Cc: stable@vger.kernel.org Signed-off-by: Thomas Zimmermann Link: https://patchwork.freedesktop.org/patch/msgid/20220119102905.1194787-= 1-jfalempe@redhat.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/mgag200/mgag200_mode.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/gpu/drm/mgag200/mgag200_mode.c +++ b/drivers/gpu/drm/mgag200/mgag200_mode.c @@ -1243,7 +1243,10 @@ static void mgag200_set_format_regs(stru WREG_GFX(3, 0x00); WREG_GFX(4, 0x00); WREG_GFX(5, 0x40); - WREG_GFX(6, 0x05); + /* GCTL6 should be 0x05, but we configure memmapsl to 0xb8000 (text mode), + * so that it doesn't hang when running kexec/kdump on G200_SE rev42. + */ + WREG_GFX(6, 0x0d); WREG_GFX(7, 0x0f); WREG_GFX(8, 0x0f); =20 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DCFAC433FE for ; Tue, 5 Apr 2022 23:18:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229806AbiDEW5A (ORCPT ); Tue, 5 Apr 2022 18:57:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355855AbiDEKWK (ORCPT ); Tue, 5 Apr 2022 06:22:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F0905A5E99; Tue, 5 Apr 2022 03:05:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 029EDB81BC0; Tue, 5 Apr 2022 10:05:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47514C385A1; Tue, 5 Apr 2022 10:05:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153106; bh=WIur+IZSr4WUw7s7h6O+Yd9AzCOgKPc5ajD44zcjWiQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wOYXBUt6/TgcyMpG/9m0FsB6UWaj57sIeySZ1nmVN1AVnZec87qOKMERNfGdSSPQf hcyGfmzOGtPdjHz1M3h4taTpYZX9TvaffFiOWzsGw/HBi6kBPRs1jJjf+hElhTg7FI +CK2Y+cMJqW/jK4HQpFqKIASF8ui3wFN72TWqJnM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Colin Ian King , Stable@vger.kernel.org, Christian Lamparter , Kalle Valo Subject: [PATCH 5.10 104/599] carl9170: fix missing bit-wise or operator for tx_params Date: Tue, 5 Apr 2022 09:26:38 +0200 Message-Id: <20220405070301.928654551@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Colin Ian King commit 02a95374b5eebdbd3b6413fd7ddec151d2ea75a1 upstream. Currently tx_params is being re-assigned with a new value and the previous setting IEEE80211_HT_MCS_TX_RX_DIFF is being overwritten. The assignment operator is incorrect, the original intent was to bit-wise or the value in. Fix this by replacing the =3D operator with |=3D instead. Kudos to Christian Lamparter for suggesting the correct fix. Fixes: fe8ee9ad80b2 ("carl9170: mac80211 glue and command interface") Signed-off-by: Colin Ian King Cc: Acked-by: Christian Lamparter Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220125004406.344422-1-colin.i.king@gmail.= com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/carl9170/main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/net/wireless/ath/carl9170/main.c +++ b/drivers/net/wireless/ath/carl9170/main.c @@ -1916,7 +1916,7 @@ static int carl9170_parse_eeprom(struct WARN_ON(!(tx_streams >=3D 1 && tx_streams <=3D IEEE80211_HT_MCS_TX_MAX_STREAMS)); =20 - tx_params =3D (tx_streams - 1) << + tx_params |=3D (tx_streams - 1) << IEEE80211_HT_MCS_TX_MAX_STREAMS_SHIFT; =20 carl9170_band_2GHz.ht_cap.mcs.tx_params |=3D tx_params; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6A8A3C4321E for ; Tue, 5 Apr 2022 22:09:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1391383AbiDEWFY (ORCPT ); Tue, 5 Apr 2022 18:05:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355857AbiDEKWK (ORCPT ); Tue, 5 Apr 2022 06:22:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 411A7A5EAD; Tue, 5 Apr 2022 03:05:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2F3C16167E; Tue, 5 Apr 2022 10:05:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 32416C385A1; Tue, 5 Apr 2022 10:05:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153112; bh=ZcVQpwvFrXJtLOsqi3jPXEcTtdIZsDWqBIA96z9gCqY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ePSBlrTNElE/oHLICPC9XdCdNoLK9p1Eqqasiy+Pdb+6KH9vb//bmeV1785Q7G6CM NaMm5Es2xtQM9AC+OqSd/N0293aFVyOxtap0hULlSX+W6Xzc5FFLkepO3aVmTwT30n y8HjL49zx4NR9xiBJ702r2cfl5+TLsOM6ACWBtfM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sebastian Andrzej Siewior , Jann Horn , Kees Cook Subject: [PATCH 5.10 105/599] pstore: Dont use semaphores in always-atomic-context code Date: Tue, 5 Apr 2022 09:26:39 +0200 Message-Id: <20220405070301.958868258@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jann Horn commit 8126b1c73108bc691f5643df19071a59a69d0bc6 upstream. pstore_dump() is *always* invoked in atomic context (nowadays in an RCU read-side critical section, before that under a spinlock). It doesn't make sense to try to use semaphores here. This is mostly a revert of commit ea84b580b955 ("pstore: Convert buf_lock to semaphore"), except that two parts aren't restored back exactly as they were: - keep the lock initialization in pstore_register - in efi_pstore_write(), always set the "block" flag to false - omit "is_locked", that was unnecessary since commit 959217c84c27 ("pstore: Actually give up during locking failure") - fix the bailout message The actual problem that the buggy commit was trying to address may have been that the use of preemptible() in efi_pstore_write() was wrong - it only looks at preempt_count() and the state of IRQs, but __rcu_read_lock() doesn't touch either of those under CONFIG_PREEMPT_RCU. (Sidenote: CONFIG_PREEMPT_RCU means that the scheduler can preempt tasks in RCU read-side critical sections, but you're not allowed to actively block/reschedule.) Lockdep probably never caught the problem because it's very rare that you actually hit the contended case, so lockdep always just sees the down_trylock(), not the down_interruptible(), and so it can't tell that there's a problem. Fixes: ea84b580b955 ("pstore: Convert buf_lock to semaphore") Cc: stable@vger.kernel.org Acked-by: Sebastian Andrzej Siewior Signed-off-by: Jann Horn Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220314185953.2068993-1-jannh@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/firmware/efi/efi-pstore.c | 2 +- fs/pstore/platform.c | 38 ++++++++++++++++++---------------= ----- include/linux/pstore.h | 6 +++--- 3 files changed, 22 insertions(+), 24 deletions(-) --- a/drivers/firmware/efi/efi-pstore.c +++ b/drivers/firmware/efi/efi-pstore.c @@ -266,7 +266,7 @@ static int efi_pstore_write(struct pstor efi_name[i] =3D name[i]; =20 ret =3D efivar_entry_set_safe(efi_name, vendor, PSTORE_EFI_ATTRIBUTES, - preemptible(), record->size, record->psi->buf); + false, record->size, record->psi->buf); =20 if (record->reason =3D=3D KMSG_DUMP_OOPS && try_module_get(THIS_MODULE)) if (!schedule_work(&efivar_work)) --- a/fs/pstore/platform.c +++ b/fs/pstore/platform.c @@ -143,21 +143,22 @@ static void pstore_timer_kick(void) mod_timer(&pstore_timer, jiffies + msecs_to_jiffies(pstore_update_ms)); } =20 -/* - * Should pstore_dump() wait for a concurrent pstore_dump()? If - * not, the current pstore_dump() will report a failure to dump - * and return. - */ -static bool pstore_cannot_wait(enum kmsg_dump_reason reason) +static bool pstore_cannot_block_path(enum kmsg_dump_reason reason) { - /* In NMI path, pstore shouldn't block regardless of reason. */ + /* + * In case of NMI path, pstore shouldn't be blocked + * regardless of reason. + */ if (in_nmi()) return true; =20 switch (reason) { /* In panic case, other cpus are stopped by smp_send_stop(). */ case KMSG_DUMP_PANIC: - /* Emergency restart shouldn't be blocked. */ + /* + * Emergency restart shouldn't be blocked by spinning on + * pstore_info::buf_lock. + */ case KMSG_DUMP_EMERG: return true; default: @@ -388,21 +389,19 @@ static void pstore_dump(struct kmsg_dump unsigned long total =3D 0; const char *why; unsigned int part =3D 1; + unsigned long flags =3D 0; int ret; =20 why =3D kmsg_dump_reason_str(reason); =20 - if (down_trylock(&psinfo->buf_lock)) { - /* Failed to acquire lock: give up if we cannot wait. */ - if (pstore_cannot_wait(reason)) { - pr_err("dump skipped in %s path: may corrupt error record\n", - in_nmi() ? "NMI" : why); - return; - } - if (down_interruptible(&psinfo->buf_lock)) { - pr_err("could not grab semaphore?!\n"); + if (pstore_cannot_block_path(reason)) { + if (!spin_trylock_irqsave(&psinfo->buf_lock, flags)) { + pr_err("dump skipped in %s path because of concurrent dump\n", + in_nmi() ? "NMI" : why); return; } + } else { + spin_lock_irqsave(&psinfo->buf_lock, flags); } =20 oopscount++; @@ -464,8 +463,7 @@ static void pstore_dump(struct kmsg_dump total +=3D record.size; part++; } - - up(&psinfo->buf_lock); + spin_unlock_irqrestore(&psinfo->buf_lock, flags); } =20 static struct kmsg_dumper pstore_dumper =3D { @@ -591,7 +589,7 @@ int pstore_register(struct pstore_info * psi->write_user =3D pstore_write_user_compat; psinfo =3D psi; mutex_init(&psinfo->read_mutex); - sema_init(&psinfo->buf_lock, 1); + spin_lock_init(&psinfo->buf_lock); =20 if (psi->flags & PSTORE_FLAGS_DMESG) allocate_buf_for_compression(); --- a/include/linux/pstore.h +++ b/include/linux/pstore.h @@ -14,7 +14,7 @@ #include #include #include -#include +#include #include #include =20 @@ -87,7 +87,7 @@ struct pstore_record { * @owner: module which is responsible for this backend driver * @name: name of the backend driver * - * @buf_lock: semaphore to serialize access to @buf + * @buf_lock: spinlock to serialize access to @buf * @buf: preallocated crash dump buffer * @bufsize: size of @buf available for crash dump bytes (must match * smallest number of bytes available for writing to a @@ -178,7 +178,7 @@ struct pstore_info { struct module *owner; const char *name; =20 - struct semaphore buf_lock; + spinlock_t buf_lock; char *buf; size_t bufsize; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 33F50C35273 for ; Tue, 5 Apr 2022 23:42:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1578281AbiDEXTO (ORCPT ); Tue, 5 Apr 2022 19:19:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59190 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355862AbiDEKWM (ORCPT ); Tue, 5 Apr 2022 06:22:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9C03EA8EEE; Tue, 5 Apr 2022 03:05:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BB46DB81B7A; Tue, 5 Apr 2022 10:05:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05CEFC385A2; Tue, 5 Apr 2022 10:05:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153115; bh=rMKBD1koYZ8J49XDOyG6OKlNOGIa8Bmni21RPT14hTI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UR3xJu0e8n2U3uYtX8UbCLJcQNBJtHSuU7dGBNkVoukwcSet/yPkAgh0YCVV+ZXFE QhmpOrWX4S97LUnV1nOSlDl4M58CY/R2ccbSZr3M27uMK2lz8ycnv6A7WjnsWftbgc TXV0Co8OiNq2nRHvbd+4NFAlxkh9uugHxbvVGSvk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Srinivas Pandruvada , "Rafael J. Wysocki" Subject: [PATCH 5.10 106/599] thermal: int340x: Increase bitmap size Date: Tue, 5 Apr 2022 09:26:40 +0200 Message-Id: <20220405070301.988199673@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Srinivas Pandruvada commit 668f69a5f863b877bc3ae129efe9a80b6f055141 upstream. The number of policies are 10, so can't be supported by the bitmap size of u8. Even though there are no platfoms with these many policies, but for correctness increase to u32. Signed-off-by: Srinivas Pandruvada Fixes: 16fc8eca1975 ("thermal/int340x_thermal: Add additional UUIDs") Cc: 5.1+ # 5.1+ Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c @@ -53,7 +53,7 @@ struct int3400_thermal_priv { struct art *arts; int trt_count; struct trt *trts; - u8 uuid_bitmap; + u32 uuid_bitmap; int rel_misc_dev_res; int current_uuid_index; char *data_vault; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46B7AC3527B for ; Tue, 5 Apr 2022 22:55:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1455762AbiDEWny (ORCPT ); Tue, 5 Apr 2022 18:43:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355885AbiDEKWN (ORCPT ); Tue, 5 Apr 2022 06:22:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0DBCCA94E6; Tue, 5 Apr 2022 03:05:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C05E56179D; Tue, 5 Apr 2022 10:05:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C7A16C385A1; Tue, 5 Apr 2022 10:05:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153118; bh=uFktpmXq//VwMEg/Xye+cAieCQG7ieCXEqG53n4shp0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=k1edwaR86fqUkCCb2wYi7sS4HwmwkfkyLqdF8Gemhg2DZE6GuKupMlKJj95AcNZ1W +ussXk/ZKsYr9NOVMV7sPrBy/O7pZ1ZAMr715lgSGp7ITZ8TLBfzEyY3PU+os50qgJ DfcGnQn+UvKUZLGwLvzeYkKhqtkkT8g+Pka9BnGI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Dirk=20M=C3=BCller?= , Paul Menzel , Song Liu Subject: [PATCH 5.10 107/599] lib/raid6/test: fix multiple definition linking error Date: Tue, 5 Apr 2022 09:26:41 +0200 Message-Id: <20220405070302.019502809@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dirk M=C3=BCller commit a5359ddd052860bacf957e65fe819c63e974b3a6 upstream. GCC 10+ defaults to -fno-common, which enforces proper declaration of external references using "extern". without this change a link would fail with: lib/raid6/test/algos.c:28: multiple definition of `raid6_call'; lib/raid6/test/test.c:22: first defined here the pq.h header that is included already includes an extern declaration so we can just remove the redundant one here. Cc: Signed-off-by: Dirk M=C3=BCller Reviewed-by: Paul Menzel Signed-off-by: Song Liu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- lib/raid6/test/test.c | 1 - 1 file changed, 1 deletion(-) --- a/lib/raid6/test/test.c +++ b/lib/raid6/test/test.c @@ -19,7 +19,6 @@ #define NDISKS 16 /* Including P and Q */ =20 const char raid6_empty_zero_page[PAGE_SIZE] __attribute__((aligned(PAGE_SI= ZE))); -struct raid6_calls raid6_call; =20 char *dataptrs[NDISKS]; char data[NDISKS][PAGE_SIZE] __attribute__((aligned(PAGE_SIZE))); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BDF03C4332F for ; Tue, 5 Apr 2022 22:09:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1441967AbiDEWKZ (ORCPT ); Tue, 5 Apr 2022 18:10:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355914AbiDEKWN (ORCPT ); Tue, 5 Apr 2022 06:22:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E03F8A94F9; Tue, 5 Apr 2022 03:05:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 716996176C; Tue, 5 Apr 2022 10:05:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A99CC385A2; Tue, 5 Apr 2022 10:05:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153120; bh=a8+piJX+cvN46+N4b66kvO89qmaPutp2JJ3Mr5BFjS8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xJZdE3c8DcJABBQjmFcPe/Iy6ZOa7Tuwu8J8TfdNpzv2010j4kaY5xvIFtOvlk+pI 4gBq7hIPWOGCqgDouNUkkcqArhRm3wL6bXbuNFp03L75ewBN+P0fmOQRdMcAlYhrsp HlZcbVl3rlJg5OpKQlito+hUrrz39aW2FHbiXKTc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ariadne Conill , Michael Kerrisk , Matthew Wilcox , Christian Brauner , Rich Felker , Eric Biederman , Alexander Viro , linux-fsdevel@vger.kernel.org, Kees Cook , Andy Lutomirski Subject: [PATCH 5.10 108/599] exec: Force single empty string when argv is empty Date: Tue, 5 Apr 2022 09:26:42 +0200 Message-Id: <20220405070302.048480898@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kees Cook commit dcd46d897adb70d63e025f175a00a89797d31a43 upstream. Quoting[1] Ariadne Conill: "In several other operating systems, it is a hard requirement that the second argument to execve(2) be the name of a program, thus prohibiting a scenario where argc < 1. POSIX 2017 also recommends this behaviour, but it is not an explicit requirement[2]: The argument arg0 should point to a filename string that is associated with the process being started by one of the exec functions. ... Interestingly, Michael Kerrisk opened an issue about this in 2008[3], but there was no consensus to support fixing this issue then. Hopefully now that CVE-2021-4034 shows practical exploitative use[4] of this bug in a shellcode, we can reconsider. This issue is being tracked in the KSPP issue tracker[5]." While the initial code searches[6][7] turned up what appeared to be mostly corner case tests, trying to that just reject argv =3D=3D NULL (or an immediately terminated pointer list) quickly started tripping[8] existing userspace programs. The next best approach is forcing a single empty string into argv and adjusting argc to match. The number of programs depending on argc =3D=3D 0 seems a smaller set than those calling execve with a NULL argv. Account for the additional stack space in bprm_stack_limits(). Inject an empty string when argc =3D=3D 0 (and set argc =3D 1). Warn about the case so userspace has some notice about the change: process './argc0' launched './argc0' with NULL argv: empty string added Additionally WARN() and reject NULL argv usage for kernel threads. [1] https://lore.kernel.org/lkml/20220127000724.15106-1-ariadne@dereference= d.org/ [2] https://pubs.opengroup.org/onlinepubs/9699919799/functions/exec.html [3] https://bugzilla.kernel.org/show_bug.cgi?id=3D8408 [4] https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt [5] https://github.com/KSPP/linux/issues/176 [6] https://codesearch.debian.net/search?q=3Dexecve%5C+*%5C%28%5B%5E%2C%5D%= 2B%2C+*NULL&literal=3D0 [7] https://codesearch.debian.net/search?q=3Dexeclp%3F%5Cs*%5C%28%5B%5E%2C%= 5D%2B%2C%5Cs*NULL&literal=3D0 [8] https://lore.kernel.org/lkml/20220131144352.GE16385@xsang-OptiPlex-9020/ Reported-by: Ariadne Conill Reported-by: Michael Kerrisk Cc: Matthew Wilcox Cc: Christian Brauner Cc: Rich Felker Cc: Eric Biederman Cc: Alexander Viro Cc: linux-fsdevel@vger.kernel.org Cc: stable@vger.kernel.org Signed-off-by: Kees Cook Acked-by: Christian Brauner Acked-by: Ariadne Conill Acked-by: Andy Lutomirski Link: https://lore.kernel.org/r/20220201000947.2453721-1-keescook@chromium.= org Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- fs/exec.c | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) --- a/fs/exec.c +++ b/fs/exec.c @@ -494,8 +494,14 @@ static int bprm_stack_limits(struct linu * the stack. They aren't stored until much later when we can't * signal to the parent that the child has run out of stack space. * Instead, calculate it here so it's possible to fail gracefully. + * + * In the case of argc =3D 0, make sure there is space for adding a + * empty string (which will bump argc to 1), to ensure confused + * userspace programs don't start processing from argv[1], thinking + * argc can never be 0, to keep them from walking envp by accident. + * See do_execveat_common(). */ - ptr_size =3D (bprm->argc + bprm->envc) * sizeof(void *); + ptr_size =3D (max(bprm->argc, 1) + bprm->envc) * sizeof(void *); if (limit <=3D ptr_size) return -E2BIG; limit -=3D ptr_size; @@ -1886,6 +1892,9 @@ static int do_execveat_common(int fd, st } =20 retval =3D count(argv, MAX_ARG_STRINGS); + if (retval =3D=3D 0) + pr_warn_once("process '%s' launched '%s' with NULL argv: empty string ad= ded\n", + current->comm, bprm->filename); if (retval < 0) goto out_free; bprm->argc =3D retval; @@ -1912,6 +1921,19 @@ static int do_execveat_common(int fd, st if (retval < 0) goto out_free; =20 + /* + * When argv is empty, add an empty string ("") as argv[0] to + * ensure confused userspace programs that start processing + * from argv[1] won't end up walking envp. See also + * bprm_stack_limits(). + */ + if (bprm->argc =3D=3D 0) { + retval =3D copy_string_kernel("", bprm); + if (retval < 0) + goto out_free; + bprm->argc =3D 1; + } + retval =3D bprm_execve(bprm, fd, filename, flags); out_free: free_bprm(bprm); @@ -1940,6 +1962,8 @@ int kernel_execve(const char *kernel_fil } =20 retval =3D count_strings_kernel(argv); + if (WARN_ON_ONCE(retval =3D=3D 0)) + retval =3D -EINVAL; if (retval < 0) goto out_free; bprm->argc =3D retval; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA99CC4167E for ; Tue, 5 Apr 2022 21:27:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233607AbiDEV0I (ORCPT ); Tue, 5 Apr 2022 17:26:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59182 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355908AbiDEKWN (ORCPT ); Tue, 5 Apr 2022 06:22:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BB15BA9957; Tue, 5 Apr 2022 03:05:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4AA4E61500; Tue, 5 Apr 2022 10:05:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5781AC385A2; Tue, 5 Apr 2022 10:05:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153123; bh=C/750eIEw2xnKQ7Z3W6sdUklRUAe3atwbovg2TFjKWM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I1gqnRvMswRkH8MRdOj8yW2FjDZHeIj2W5Oa9ORu+l0v7U06YDP3T0QqtDK6FFpVf C+KUBjpzPafGcwNtQFb2Dcr9RwcQLT5rWIb6AT1N3XoOvfjXj9SVHs9cTQ5zKYOe0m 5pLBjTrRTho2C5nIAthUmUk1+q2QmE9mdWlqXQWE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Biggers , Herbert Xu Subject: [PATCH 5.10 109/599] crypto: rsa-pkcs1pad - only allow with rsa Date: Tue, 5 Apr 2022 09:26:43 +0200 Message-Id: <20220405070302.078174380@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit 9b30430ea356f237945e52f8a3a42158877bd5a9 upstream. The pkcs1pad template can be instantiated with an arbitrary akcipher algorithm, which doesn't make sense; it is specifically an RSA padding scheme. Make it check that the underlying algorithm really is RSA. Fixes: 3d5b1ecdea6f ("crypto: rsa - RSA padding algorithm") Cc: # v4.5+ Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- crypto/rsa-pkcs1pad.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -621,6 +621,11 @@ static int pkcs1pad_create(struct crypto =20 rsa_alg =3D crypto_spawn_akcipher_alg(&ctx->spawn); =20 + if (strcmp(rsa_alg->base.cra_name, "rsa") !=3D 0) { + err =3D -EINVAL; + goto err_free_inst; + } + err =3D -ENAMETOOLONG; hash_name =3D crypto_attr_alg_name(tb[2]); if (IS_ERR(hash_name)) { From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E30D7C4332F for ; Wed, 6 Apr 2022 00:22:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1587898AbiDFAKo (ORCPT ); Tue, 5 Apr 2022 20:10:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355928AbiDEKWO (ORCPT ); Tue, 5 Apr 2022 06:22:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 45A0DAA010; Tue, 5 Apr 2022 03:05:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2DE0B81C83; Tue, 5 Apr 2022 10:05:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1F958C385A1; Tue, 5 Apr 2022 10:05:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153126; bh=jLJHdncUYIgkXzg4FNI//hgrXP1ygYahSZ/ZDNplSPI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pmq56trnaWM/ZLl807DnxuOPUx6afykG188YNkm95olR/CmqPAjtY/7JyriasW4Ub Hl+fSA1FM/anTRMb4OcFCJGCYq9Mfe896e3g5vgQFRbQ5gNjpe7IXI+Bh+i6f2xs66 0XS8sA6E+clfZHdwp2OT9pQ/WWzhKzW4va7Wk+6c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vitaly Chikunov , Eric Biggers , Herbert Xu Subject: [PATCH 5.10 110/599] crypto: rsa-pkcs1pad - correctly get hash from source scatterlist Date: Tue, 5 Apr 2022 09:26:44 +0200 Message-Id: <20220405070302.109508656@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit e316f7179be22912281ce6331d96d7c121fb2b17 upstream. Commit c7381b012872 ("crypto: akcipher - new verify API for public key algorithms") changed akcipher_alg::verify to take in both the signature and the actual hash and do the signature verification, rather than just return the hash expected by the signature as was the case before. To do this, it implemented a hack where the signature and hash are concatenated with each other in one scatterlist. Obviously, for this to work correctly, akcipher_alg::verify needs to correctly extract the two items from the scatterlist it is given. Unfortunately, it doesn't correctly extract the hash in the case where the signature is longer than the RSA key size, as it assumes that the signature's length is equal to the RSA key size. This causes a prefix of the hash, or even the entire hash, to be taken from the *signature*. (Note, the case of a signature longer than the RSA key size should not be allowed in the first place; a separate patch will fix that.) It is unclear whether the resulting scheme has any useful security properties. Fix this by correctly extracting the hash from the scatterlist. Fixes: c7381b012872 ("crypto: akcipher - new verify API for public key algo= rithms") Cc: # v5.2+ Reviewed-by: Vitaly Chikunov Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -495,7 +495,7 @@ static int pkcs1pad_verify_complete(stru sg_nents_for_len(req->src, req->src_len + req->dst_len), req_ctx->out_buf + ctx->key_size, - req->dst_len, ctx->key_size); + req->dst_len, req->src_len); /* Do the actual verification step. */ if (memcmp(req_ctx->out_buf + ctx->key_size, out_buf + pos, req->dst_len) !=3D 0) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7B195C43217 for ; Wed, 6 Apr 2022 00:59:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839354AbiDFA7K (ORCPT ); Tue, 5 Apr 2022 20:59:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355939AbiDEKWP (ORCPT ); Tue, 5 Apr 2022 06:22:15 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14A0FAA028; Tue, 5 Apr 2022 03:05:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7AEBEB81C83; Tue, 5 Apr 2022 10:05:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCFB8C385A1; Tue, 5 Apr 2022 10:05:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153129; bh=wxo5Qgm4ML6MQghSIyIPjrQXgvNxgJgLaqb67pNgPhk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=l29fCfWEI3Rz6M2cYx1+nX7bH2z+G4kXgRtREj59wJa4ybjVwgjhOamYVJV5tXG9n mCLTOPuu6g7Qy8iKiub14v86VevCMqUfoO9dl3AaMZOMvoQkyH3l/uCHsoEF6n2nwO AIXZyhl/5WML11iIjMeWZoTbYEfJX/nCEUCMTH3U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tadeusz Struk , Vitaly Chikunov , Eric Biggers , Herbert Xu Subject: [PATCH 5.10 111/599] crypto: rsa-pkcs1pad - restore signature length check Date: Tue, 5 Apr 2022 09:26:45 +0200 Message-Id: <20220405070302.140155099@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit d3481accd974541e6a5d6a1fb588924a3519c36e upstream. RSA PKCS#1 v1.5 signatures are required to be the same length as the RSA key size. RFC8017 specifically requires the verifier to check this (https://datatracker.ietf.org/doc/html/rfc8017#section-8.2.2). Commit a49de377e051 ("crypto: Add hash param to pkcs1pad") changed the kernel to allow longer signatures, but didn't explain this part of the change; it seems to be unrelated to the rest of the commit. Revert this change, since it doesn't appear to be correct. We can be pretty sure that no one is relying on overly-long signatures (which would have to be front-padded with zeroes) being supported, given that they would have been broken since commit c7381b012872 ("crypto: akcipher - new verify API for public key algorithms"). Fixes: a49de377e051 ("crypto: Add hash param to pkcs1pad") Cc: # v4.6+ Cc: Tadeusz Struk Suggested-by: Vitaly Chikunov Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- crypto/rsa-pkcs1pad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -538,7 +538,7 @@ static int pkcs1pad_verify(struct akciph =20 if (WARN_ON(req->dst) || WARN_ON(!req->dst_len) || - !ctx->key_size || req->src_len < ctx->key_size) + !ctx->key_size || req->src_len !=3D ctx->key_size) return -EINVAL; =20 req_ctx->out_buf =3D kmalloc(ctx->key_size + req->dst_len, GFP_KERNEL); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B5E1CC433FE for ; Tue, 5 Apr 2022 22:55:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1456418AbiDEWpx (ORCPT ); Tue, 5 Apr 2022 18:45:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59652 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355947AbiDEKWT (ORCPT ); Tue, 5 Apr 2022 06:22:19 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6BFD4AA033; Tue, 5 Apr 2022 03:05:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8120661500; Tue, 5 Apr 2022 10:05:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93154C385A1; Tue, 5 Apr 2022 10:05:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153132; bh=+3MwjoxU6y9Rz147dPjjPlPFEMsY7UQgaL93494ZQ1o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0c+9N1sgS4QH5TQF1mWJ0lbEN6m7LTHWDJrV7xQc15pyTvSbv4LZ/5cYEkBR01VS5 4OK3OUP3VHnXh9zx9vXYOjmVmji4M0Dw6e+fpnryzggRwUfYWSLP1FMeE0UeGsMwto oS64/5IDJ4BvydCg36f3f+Lsku8o6Lxh0BMmsaPE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tadeusz Struk , Eric Biggers , Herbert Xu Subject: [PATCH 5.10 112/599] crypto: rsa-pkcs1pad - fix buffer overread in pkcs1pad_verify_complete() Date: Tue, 5 Apr 2022 09:26:46 +0200 Message-Id: <20220405070302.170606384@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers commit a24611ea356c7f3f0ec926da11b9482ac1f414fd upstream. Before checking whether the expected digest_info is present, we need to check that there are enough bytes remaining. Fixes: a49de377e051 ("crypto: Add hash param to pkcs1pad") Cc: # v4.6+ Cc: Tadeusz Struk Signed-off-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- crypto/rsa-pkcs1pad.c | 2 ++ 1 file changed, 2 insertions(+) --- a/crypto/rsa-pkcs1pad.c +++ b/crypto/rsa-pkcs1pad.c @@ -476,6 +476,8 @@ static int pkcs1pad_verify_complete(stru pos++; =20 if (digest_info) { + if (digest_info->size > dst_len - pos) + goto done; if (crypto_memneq(out_buf + pos, digest_info->data, digest_info->size)) goto done; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A7FCDC4332F for ; Wed, 6 Apr 2022 01:10:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1840416AbiDFBKD (ORCPT ); Tue, 5 Apr 2022 21:10:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356019AbiDEKWq (ORCPT ); Tue, 5 Apr 2022 06:22:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 64C13AC049; Tue, 5 Apr 2022 03:05:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1B7BDB81C83; Tue, 5 Apr 2022 10:05:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7EFC2C385A2; Tue, 5 Apr 2022 10:05:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153134; bh=ZAmbnSi66YJBiK3yZR8/bo7oAsS7FS1Ko/w5oHmOhSE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NzYbWlbVKWvukKj07INWpbLNuyZcuw4W18FRXQmoBoUX4rux3cJAhhqfbgqPXV/ts Bu5yLlP0s4MpDMxAIZOQcqGE5NgsJHZTUJBvZF+wFB/7S7B0yjPMgCZ5YIB4FX+XAG b01m4GX5eYU7IT5l5DddDpeL2TxE/BnTHovo3oQk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mingzhe Zou , Coly Li Subject: [PATCH 5.10 113/599] bcache: fixup multiple threads crash Date: Tue, 5 Apr 2022 09:26:47 +0200 Message-Id: <20220405070302.200363585@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mingzhe Zou commit 887554ab96588de2917b6c8c73e552da082e5368 upstream. When multiple threads to check btree nodes in parallel, the main thread wait for all threads to stop or CACHE_SET_IO_DISABLE flag: wait_event_interruptible(check_state->wait, atomic_read(&check_state->started) =3D=3D 0 || test_bit(CACHE_SET_IO_DISABLE, &c->flags)); However, the bch_btree_node_read and bch_btree_node_read_done maybe call bch_cache_set_error, then the CACHE_SET_IO_DISABLE will be set. If the flag already set, the main thread return error. At the same time, maybe some threads still running and read NULL pointer, the kernel will crash. This patch change the event wait condition, the main thread must wait for all threads to stop. Fixes: 8e7102273f597 ("bcache: make bch_btree_check() to be multithreaded") Signed-off-by: Mingzhe Zou Cc: stable@vger.kernel.org # v5.7+ Signed-off-by: Coly Li Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/md/bcache/btree.c | 6 ++++-- drivers/md/bcache/writeback.c | 6 ++++-- 2 files changed, 8 insertions(+), 4 deletions(-) --- a/drivers/md/bcache/btree.c +++ b/drivers/md/bcache/btree.c @@ -2060,9 +2060,11 @@ int bch_btree_check(struct cache_set *c) } } =20 + /* + * Must wait for all threads to stop. + */ wait_event_interruptible(check_state->wait, - atomic_read(&check_state->started) =3D=3D 0 || - test_bit(CACHE_SET_IO_DISABLE, &c->flags)); + atomic_read(&check_state->started) =3D=3D 0); =20 for (i =3D 0; i < check_state->total_threads; i++) { if (check_state->infos[i].result) { --- a/drivers/md/bcache/writeback.c +++ b/drivers/md/bcache/writeback.c @@ -952,9 +952,11 @@ void bch_sectors_dirty_init(struct bcach } } =20 + /* + * Must wait for all threads to stop. + */ wait_event_interruptible(state->wait, - atomic_read(&state->started) =3D=3D 0 || - test_bit(CACHE_SET_IO_DISABLE, &c->flags)); + atomic_read(&state->started) =3D=3D 0); =20 out: kfree(state); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5970BC433EF for ; Wed, 6 Apr 2022 01:33:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S245621AbiDFBcR (ORCPT ); Tue, 5 Apr 2022 21:32:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59232 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356025AbiDEKWr (ORCPT ); Tue, 5 Apr 2022 06:22:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 086A1AA000; Tue, 5 Apr 2022 03:05:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 46BE06167E; Tue, 5 Apr 2022 10:05:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 516F0C385A2; Tue, 5 Apr 2022 10:05:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153137; bh=CRkojIeG8hfsFSBTHg4oYYawOOdZgescy1u4wNygcPs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MvrN48pLoehhK0fZbYK4we3bnZ9kfoZ8K5fWKcvdCo447guioiSwYDLg0n0sqKCS5 FJRy/kmkHoTS9uP3Ly+6fwF3Rb2FCqcSaK6TW7hI3J80il7duNrfBtN0oGZ3ygTRFj 03ePlSnDyHEmf4iOxZldRbR/GBs4Q8eSqBZAS0CQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jan-Benedict Glaw , Sudip Mukherjee , "Maciej W. Rozycki" , Thomas Bogendoerfer Subject: [PATCH 5.10 114/599] DEC: Limit PMAX memory probing to R3k systems Date: Tue, 5 Apr 2022 09:26:48 +0200 Message-Id: <20220405070302.231375636@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Maciej W. Rozycki commit 244eae91a94c6dab82b3232967d10eeb9dfa21c6 upstream. Recent tightening of the opcode table in binutils so as to consistently disallow the assembly or disassembly of CP0 instructions not supported by the processor architecture chosen has caused a regression like below: arch/mips/dec/prom/locore.S: Assembler messages: arch/mips/dec/prom/locore.S:29: Error: opcode not supported on this process= or: r4600 (mips3) `rfe' in a piece of code used to probe for memory with PMAX DECstation models, which have non-REX firmware. Those computers always have an R2000 CPU and consequently the exception handler used in memory probing uses the RFE instruction, which those processors use. While adding 64-bit support this code was correctly excluded for 64-bit configurations, however it should have also been excluded for irrelevant 32-bit configurations. Do this now then, and only enable PMAX memory probing for R3k systems. Reported-by: Jan-Benedict Glaw Reported-by: Sudip Mukherjee Signed-off-by: Maciej W. Rozycki Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org # v2.6.12+ Signed-off-by: Thomas Bogendoerfer Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/mips/dec/prom/Makefile | 2 +- arch/mips/include/asm/dec/prom.h | 15 +++++---------- 2 files changed, 6 insertions(+), 11 deletions(-) --- a/arch/mips/dec/prom/Makefile +++ b/arch/mips/dec/prom/Makefile @@ -6,4 +6,4 @@ =20 lib-y +=3D init.o memory.o cmdline.o identify.o console.o =20 -lib-$(CONFIG_32BIT) +=3D locore.o +lib-$(CONFIG_CPU_R3000) +=3D locore.o --- a/arch/mips/include/asm/dec/prom.h +++ b/arch/mips/include/asm/dec/prom.h @@ -43,16 +43,11 @@ */ #define REX_PROM_MAGIC 0x30464354 =20 -#ifdef CONFIG_64BIT - -#define prom_is_rex(magic) 1 /* KN04 and KN05 are REX PROMs. */ - -#else /* !CONFIG_64BIT */ - -#define prom_is_rex(magic) ((magic) =3D=3D REX_PROM_MAGIC) - -#endif /* !CONFIG_64BIT */ - +/* KN04 and KN05 are REX PROMs, so only do the check for R3k systems. */ +static inline bool prom_is_rex(u32 magic) +{ + return !IS_ENABLED(CONFIG_CPU_R3000) || magic =3D=3D REX_PROM_MAGIC; +} =20 /* * 3MIN/MAXINE PROM entry points for DS5000/1xx's, DS5000/xx's and From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98021C43217 for ; Tue, 5 Apr 2022 23:52:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1580780AbiDEXeu (ORCPT ); Tue, 5 Apr 2022 19:34:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356057AbiDEKWu (ORCPT ); Tue, 5 Apr 2022 06:22:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C99DAF1E9; Tue, 5 Apr 2022 03:05:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9C14E6167E; Tue, 5 Apr 2022 10:05:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB82CC385A2; Tue, 5 Apr 2022 10:05:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153143; bh=68aLZg2k8y7k/NuHYgwWso1X6n6Cr9BCaz8zPh9HeQ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d/ApYtfnojLm0fPOSp6NvHaprXjioGcuSxcTM78kLxX3hKcZ+tT5uRDwR4I7hbsHn 8jEYcgiL2C3Tp1J8y+Xs/taAHK8XnrZVnUQCf0VCV1zKuog5j6Dj3nZsgt8Kce1FVF G2kErwxHR9KlFTb3nCGTFFjtjr4UcpN4Q5xRv3UI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?=D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB?= , Sean Young , Mauro Carvalho Chehab Subject: [PATCH 5.10 115/599] media: gpio-ir-tx: fix transmit with long spaces on Orange Pi PC Date: Tue, 5 Apr 2022 09:26:49 +0200 Message-Id: <20220405070302.261443204@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Sean Young commit 5ad05ecad4326ddaa26a83ba2233a67be24c1aaa upstream. Calling udelay for than 1000us does not always yield the correct results. Cc: stable@vger.kernel.org Reported-by: =D0=9C=D0=B8=D1=85=D0=B0=D0=B8=D0=BB Signed-off-by: Sean Young Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/media/rc/gpio-ir-tx.c | 28 +++++++++++++++++++++------- 1 file changed, 21 insertions(+), 7 deletions(-) --- a/drivers/media/rc/gpio-ir-tx.c +++ b/drivers/media/rc/gpio-ir-tx.c @@ -48,11 +48,29 @@ static int gpio_ir_tx_set_carrier(struct return 0; } =20 +static void delay_until(ktime_t until) +{ + /* + * delta should never exceed 0.5 seconds (IR_MAX_DURATION) and on + * m68k ndelay(s64) does not compile; so use s32 rather than s64. + */ + s32 delta; + + while (true) { + delta =3D ktime_us_delta(until, ktime_get()); + if (delta <=3D 0) + return; + + /* udelay more than 1ms may not work */ + delta =3D min(delta, 1000); + udelay(delta); + } +} + static void gpio_ir_tx_unmodulated(struct gpio_ir *gpio_ir, uint *txbuf, uint count) { ktime_t edge; - s32 delta; int i; =20 local_irq_disable(); @@ -63,9 +81,7 @@ static void gpio_ir_tx_unmodulated(struc gpiod_set_value(gpio_ir->gpio, !(i % 2)); =20 edge =3D ktime_add_us(edge, txbuf[i]); - delta =3D ktime_us_delta(edge, ktime_get()); - if (delta > 0) - udelay(delta); + delay_until(edge); } =20 gpiod_set_value(gpio_ir->gpio, 0); @@ -97,9 +113,7 @@ static void gpio_ir_tx_modulated(struct if (i % 2) { // space edge =3D ktime_add_us(edge, txbuf[i]); - delta =3D ktime_us_delta(edge, ktime_get()); - if (delta > 0) - udelay(delta); + delay_until(edge); } else { // pulse ktime_t last =3D ktime_add_us(edge, txbuf[i]); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 07E20C433FE for ; Wed, 6 Apr 2022 00:26:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1588279AbiDFAPL (ORCPT ); Tue, 5 Apr 2022 20:15:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356063AbiDEKWu (ORCPT ); Tue, 5 Apr 2022 06:22:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A2974AFAF6; Tue, 5 Apr 2022 03:05:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4611BB81C8B; Tue, 5 Apr 2022 10:05:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82AB9C385A1; Tue, 5 Apr 2022 10:05:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153145; bh=FfNwEj5eBOvMP9PBsPuBHQPW0+9oDk1g85u2cjFPK2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lHpE1sk5GoErAPaTqquGRoxiArZiXGXY4XAxy9IuXJjj1tkb8Ag2LTfOQ+bfZKW6g V7f6aD3NzXIBvxr1MmIymevEvFRfalPnhxGa5736elLSqqMYpNPxjW5rci/m2GSNww bUmWNqFiGI3fk+UVQIkyO+olO6MSAUkR+6ytZ/JU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Lad, Prabhakar" , Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab , Lad@vger.kernel.org Subject: [PATCH 5.10 116/599] media: davinci: vpif: fix unbalanced runtime PM get Date: Tue, 5 Apr 2022 09:26:50 +0200 Message-Id: <20220405070302.292031818@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit 4a321de239213300a714fa0353a5f1272d381a44 upstream. Make sure to balance the runtime PM usage counter on driver unbind. Fixes: 407ccc65bfd2 ("[media] davinci: vpif: add pm_runtime support") Cc: stable@vger.kernel.org # 3.9 Cc: Lad, Prabhakar Signed-off-by: Johan Hovold Reviewed-by: Lad Prabhakar Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/media/platform/davinci/vpif.c | 1 + 1 file changed, 1 insertion(+) --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -497,6 +497,7 @@ static int vpif_probe(struct platform_de =20 static int vpif_remove(struct platform_device *pdev) { + pm_runtime_put(&pdev->dev); pm_runtime_disable(&pdev->dev); return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 32967C35273 for ; Tue, 5 Apr 2022 20:10:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356719AbiDEUDu (ORCPT ); Tue, 5 Apr 2022 16:03:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356220AbiDEKXa (ORCPT ); Tue, 5 Apr 2022 06:23:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 60BE8BAB88; Tue, 5 Apr 2022 03:07:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F09B46167E; Tue, 5 Apr 2022 10:07:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 105EFC385A1; Tue, 5 Apr 2022 10:07:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153276; bh=sUjtqpLKMHu18jX7PBFfofAGO5LsbRcb2dWLAoSItpw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VWHCwsj4NkcRgOdQMPRrc/YVAgHKnowNtgLY/c96OdWLAEXfQeclrxU8+zPzY+iXs oKN7lwrLbL3tDhWwEPhD+8/KM0e5nl+jY8mIN0obkhPlwMVAU7faaBi5hYEIa8LJPJ Gs7hydBweaMw4CDI60DAYsEV6mKR2j1mMJ2bFeCg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kevin Hilman , Johan Hovold , Hans Verkuil , Mauro Carvalho Chehab Subject: [PATCH 5.10 117/599] media: davinci: vpif: fix unbalanced runtime PM enable Date: Tue, 5 Apr 2022 09:26:51 +0200 Message-Id: <20220405070302.322672550@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit d42b3ad105b5d3481f6a56bc789aa2b27aa09325 upstream. Make sure to disable runtime PM before returning on probe errors. Fixes: 479f7a118105 ("[media] davinci: vpif: adaptions for DT support") Cc: stable@vger.kernel.org Cc: Kevin Hilman Signed-off-by: Johan Hovold Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/media/platform/davinci/vpif.c | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) --- a/drivers/media/platform/davinci/vpif.c +++ b/drivers/media/platform/davinci/vpif.c @@ -428,6 +428,7 @@ static int vpif_probe(struct platform_de static struct resource *res, *res_irq; struct platform_device *pdev_capture, *pdev_display; struct device_node *endpoint =3D NULL; + int ret; =20 res =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); vpif_base =3D devm_ioremap_resource(&pdev->dev, res); @@ -458,8 +459,8 @@ static int vpif_probe(struct platform_de res_irq =3D platform_get_resource(pdev, IORESOURCE_IRQ, 0); if (!res_irq) { dev_warn(&pdev->dev, "Missing IRQ resource.\n"); - pm_runtime_put(&pdev->dev); - return -EINVAL; + ret =3D -EINVAL; + goto err_put_rpm; } =20 pdev_capture =3D devm_kzalloc(&pdev->dev, sizeof(*pdev_capture), @@ -493,6 +494,12 @@ static int vpif_probe(struct platform_de } =20 return 0; + +err_put_rpm: + pm_runtime_put(&pdev->dev); + pm_runtime_disable(&pdev->dev); + + return ret; } =20 static int vpif_remove(struct platform_device *pdev) From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34998C43219 for ; Wed, 6 Apr 2022 00:26:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1588693AbiDFARA (ORCPT ); Tue, 5 Apr 2022 20:17:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42278 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356096AbiDEKW4 (ORCPT ); Tue, 5 Apr 2022 06:22:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 94164B2478; Tue, 5 Apr 2022 03:06:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4397AB81C8B; Tue, 5 Apr 2022 10:06:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DCA1C385A3; Tue, 5 Apr 2022 10:06:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153166; bh=vCNxLByh22qWpvDtzrk7nKcRMnmgzftlBFDb7fx5dWY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lUwiV5xyHTAkVuB5Q3pq6nFnxuRhdmpAyZ9w2ffxMN4yHVmsl0k2Jn2NUI8+w25ig YghWYKtbolUGS/+EMui35oIlWHXEL2KuTJxikJU5IEQoBiyEPW/1z4eppG5K2S3OZv O/i6VZt6PEv/o7TOZHwEtEQYUvnb6rNXUdqhOgQM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Max Filippov Subject: [PATCH 5.10 118/599] xtensa: fix stop_machine_cpuslocked call in patch_text Date: Tue, 5 Apr 2022 09:26:52 +0200 Message-Id: <20220405070302.351684079@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Max Filippov commit f406f2d03e07afc199dd8cf501f361dde6be8a69 upstream. patch_text must invoke patch_text_stop_machine on all online CPUs, but it calls stop_machine_cpuslocked with NULL cpumask. As a result only one CPU runs patch_text_stop_machine potentially leaving stale icache entries on other CPUs. Fix that by calling stop_machine_cpuslocked with cpu_online_mask as the last argument. Cc: stable@vger.kernel.org Fixes: 64711f9a47d4 ("xtensa: implement jump_label support") Signed-off-by: Max Filippov Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/xtensa/kernel/jump_label.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/arch/xtensa/kernel/jump_label.c +++ b/arch/xtensa/kernel/jump_label.c @@ -61,7 +61,7 @@ static void patch_text(unsigned long add .data =3D data, }; stop_machine_cpuslocked(patch_text_stop_machine, - &patch, NULL); + &patch, cpu_online_mask); } else { unsigned long flags; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 178ECC433FE for ; Wed, 6 Apr 2022 00:59:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839186AbiDFA6i (ORCPT ); Tue, 5 Apr 2022 20:58:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60268 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356136AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C2D53B8205; Tue, 5 Apr 2022 03:06:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 007C26172B; Tue, 5 Apr 2022 10:06:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1533BC385A1; Tue, 5 Apr 2022 10:06:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153196; bh=2eXIeeRexCOuSEo8b3vylFyzhx8jNayZAmwbHZPfjpM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YaKNiIlOd0pHE1gSJjqFn//1vKvGB8uQXfDan7EleO0XkoGI2x/EyC2V37hAt9o9I 84pjNpOXRwB4riJeBUr0+vwKOOM3Abf9D7q7T6Y8sliXJefqZp4kFlCU3TOftgeh2I kQcLxmPq1e9Jkv9QpW1I+gmZW4KXNDH14RB6E1Hg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Max Filippov Subject: [PATCH 5.10 119/599] xtensa: fix xtensa_wsr always writing 0 Date: Tue, 5 Apr 2022 09:26:53 +0200 Message-Id: <20220405070302.380374239@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Max Filippov commit a3d0245c58f962ee99d4440ea0eaf45fb7f5a5cc upstream. The commit cad6fade6e78 ("xtensa: clean up WSR*/RSR*/get_sr/set_sr") replaced 'WSR' macro in the function xtensa_wsr with 'xtensa_set_sr', but variable 'v' in the xtensa_set_sr body shadowed the argument 'v' passed to it, resulting in wrong value written to debug registers. Fix that by removing intermediate variable from the xtensa_set_sr macro body. Cc: stable@vger.kernel.org Fixes: cad6fade6e78 ("xtensa: clean up WSR*/RSR*/get_sr/set_sr") Signed-off-by: Max Filippov Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/xtensa/include/asm/processor.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/arch/xtensa/include/asm/processor.h +++ b/arch/xtensa/include/asm/processor.h @@ -226,8 +226,8 @@ extern unsigned long get_wchan(struct ta =20 #define xtensa_set_sr(x, sr) \ ({ \ - unsigned int v =3D (unsigned int)(x); \ - __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: "a"(v)); \ + __asm__ __volatile__ ("wsr %0, "__stringify(sr) :: \ + "a"((unsigned int)(x))); \ }) =20 #define xtensa_get_sr(sr) \ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BEF2C4332F for ; Wed, 6 Apr 2022 00:21:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1587071AbiDFAHW (ORCPT ); Tue, 5 Apr 2022 20:07:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59198 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356153AbiDEKXA (ORCPT ); Tue, 5 Apr 2022 06:23:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E01ABA31A; Tue, 5 Apr 2022 03:07:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 783446176C; Tue, 5 Apr 2022 10:07:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8522CC385A1; Tue, 5 Apr 2022 10:07:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153226; bh=o65J34RLJto+GKz4V0046wtNQI+MbpXjeDjAO3L02e8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D2CJkdkLIzPMxh5weljZ82aERDjYM3X3psAh84CT3QcmV/j9MS5Jbd2C7l/qLxkgw ch6cdSejW/syoWVAxE71GaX1+DrvwmT7yv6PQA68FJq4+2WOMYDnltVfwQZ1N+v0Zw Bvc4ieDxrGBPKlXcGSvjtVuHTEg7P5hL7id/Qhbw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Arend van Spriel , Hector Martin , Andy Shevchenko , Kalle Valo Subject: [PATCH 5.10 120/599] brcmfmac: firmware: Allocate space for default boardrev in nvram Date: Tue, 5 Apr 2022 09:26:54 +0200 Message-Id: <20220405070302.409619396@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hector Martin commit d19d8e3ba256f81ea4a27209dbbd1f0a00ef1903 upstream. If boardrev is missing from the NVRAM we add a default one, but this might need more space in the output buffer than was allocated. Ensure we have enough padding for this in the buffer. Fixes: 46f2b38a91b0 ("brcmfmac: insert default boardrev in nvram data if mi= ssing") Reviewed-by: Arend van Spriel Cc: stable@vger.kernel.org Signed-off-by: Hector Martin Reviewed-by: Andy Shevchenko Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220131160713.245637-3-marcan@marcan.st Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/firmware.c @@ -207,6 +207,8 @@ static int brcmf_init_nvram_parser(struc size =3D BRCMF_FW_MAX_NVRAM_SIZE; else size =3D data_len; + /* Add space for properties we may add */ + size +=3D strlen(BRCMF_FW_DEFAULT_BOARDREV) + 1; /* Alloc for extra 0 byte + roundup by 4 + length field */ size +=3D 1 + 3 + sizeof(u32); nvp->nvram =3D kzalloc(size, GFP_KERNEL); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 839CBC433F5 for ; Wed, 6 Apr 2022 02:11:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1573251AbiDFCKK (ORCPT ); Tue, 5 Apr 2022 22:10:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41188 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356201AbiDEKXY (ORCPT ); Tue, 5 Apr 2022 06:23:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3E7BBAB83; Tue, 5 Apr 2022 03:07:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 84812B81C88; Tue, 5 Apr 2022 10:07:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE19DC385A1; Tue, 5 Apr 2022 10:07:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153257; bh=tK6afXarxi7FhsDLlwqx1kKdUhq4SqCojETP3BwMOyA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OJoJhiN2Y45kJaFz3d1ImBT5qQKGyifL6ieS9J7D8JvjiTeJXzuvhpofy1yIz0tia l8ruDMmFVwZP46Joi1EuGNRxG0CuzvOQVfNewJS29/opg4FMk4ThdVVcgWQGc7crd/ iL7SGqbAZqKz54/xFAPxqNLAkfrCrp0DduxzwxN0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Walleij , Arend van Spriel , Hector Martin , Andy Shevchenko , Kalle Valo Subject: [PATCH 5.10 121/599] brcmfmac: pcie: Release firmwares in the brcmf_pcie_setup error path Date: Tue, 5 Apr 2022 09:26:55 +0200 Message-Id: <20220405070302.439232619@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hector Martin commit 5e90f0f3ead014867dade7a22f93958119f5efab upstream. This avoids leaking memory if brcmf_chip_get_raminfo fails. Note that the CLM blob is released in the device remove path. Fixes: 82f93cf46d60 ("brcmfmac: get chip's default RAM info during PCIe set= up") Reviewed-by: Linus Walleij Reviewed-by: Arend van Spriel Cc: stable@vger.kernel.org Signed-off-by: Hector Martin Reviewed-by: Andy Shevchenko Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220131160713.245637-2-marcan@marcan.st Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -1775,6 +1775,8 @@ static void brcmf_pcie_setup(struct devi ret =3D brcmf_chip_get_raminfo(devinfo->ci); if (ret) { brcmf_err(bus, "Failed to get RAM info\n"); + release_firmware(fw); + brcmf_fw_nvram_free(nvram); goto fail; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1D5BC433FE for ; Tue, 5 Apr 2022 20:15:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1390762AbiDEUGV (ORCPT ); Tue, 5 Apr 2022 16:06:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59474 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356211AbiDEKX3 (ORCPT ); Tue, 5 Apr 2022 06:23:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2C917BAB85; Tue, 5 Apr 2022 03:07:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D6E7AB81B7A; Tue, 5 Apr 2022 10:07:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 52C89C385A3; Tue, 5 Apr 2022 10:07:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153262; bh=cRcvYA0ZjvQz+nWD1R4JP2z+TPVh/MJBg1Uk8za6sYo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Wv08+E8tMR2l/BZjJe3wJ0/5wG0gRtrEERrCQQViuHiQFUmMgqTOQpF8uzDfZwaTc o+IkCFMdDaJabYo03qiHnxE5wVFORqHGMy+0GubeI6QBC/W6n0FmLVxr4YdUt3JZr1 Mdman42vU5hgQ/VaL2ypH0FeP2xRNHrKJY2fuOWc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Walleij , Arend van Spriel , Andy Shevchenko , Hector Martin , Kalle Valo Subject: [PATCH 5.10 122/599] brcmfmac: pcie: Replace brcmf_pcie_copy_mem_todev with memcpy_toio Date: Tue, 5 Apr 2022 09:26:56 +0200 Message-Id: <20220405070302.469176578@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hector Martin commit 9466987f246758eb7e9071ae58005253f631271e upstream. The alignment check was wrong (e.g. & 4 instead of & 3), and the logic was also inefficient if the length was not a multiple of 4, since it would needlessly fall back to copying the entire buffer bytewise. We already have a perfectly good memcpy_toio function, so just call that instead of rolling our own copy logic here. brcmf_pcie_init_ringbuffers was already using it anyway. Fixes: 9e37f045d5e7 ("brcmfmac: Adding PCIe bus layer support.") Reviewed-by: Linus Walleij Reviewed-by: Arend van Spriel Reviewed-by: Andy Shevchenko Cc: stable@vger.kernel.org Signed-off-by: Hector Martin Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220131160713.245637-6-marcan@marcan.st Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 48 +----------= ----- 1 file changed, 4 insertions(+), 44 deletions(-) --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -12,6 +12,7 @@ #include #include #include +#include #include =20 #include @@ -447,47 +448,6 @@ brcmf_pcie_write_ram32(struct brcmf_pcie =20 =20 static void -brcmf_pcie_copy_mem_todev(struct brcmf_pciedev_info *devinfo, u32 mem_offs= et, - void *srcaddr, u32 len) -{ - void __iomem *address =3D devinfo->tcm + mem_offset; - __le32 *src32; - __le16 *src16; - u8 *src8; - - if (((ulong)address & 4) || ((ulong)srcaddr & 4) || (len & 4)) { - if (((ulong)address & 2) || ((ulong)srcaddr & 2) || (len & 2)) { - src8 =3D (u8 *)srcaddr; - while (len) { - iowrite8(*src8, address); - address++; - src8++; - len--; - } - } else { - len =3D len / 2; - src16 =3D (__le16 *)srcaddr; - while (len) { - iowrite16(le16_to_cpu(*src16), address); - address +=3D 2; - src16++; - len--; - } - } - } else { - len =3D len / 4; - src32 =3D (__le32 *)srcaddr; - while (len) { - iowrite32(le32_to_cpu(*src32), address); - address +=3D 4; - src32++; - len--; - } - } -} - - -static void brcmf_pcie_copy_dev_tomem(struct brcmf_pciedev_info *devinfo, u32 mem_offs= et, void *dstaddr, u32 len) { @@ -1561,8 +1521,8 @@ static int brcmf_pcie_download_fw_nvram( return err; =20 brcmf_dbg(PCIE, "Download FW %s\n", devinfo->fw_name); - brcmf_pcie_copy_mem_todev(devinfo, devinfo->ci->rambase, - (void *)fw->data, fw->size); + memcpy_toio(devinfo->tcm + devinfo->ci->rambase, + (void *)fw->data, fw->size); =20 resetintr =3D get_unaligned_le32(fw->data); release_firmware(fw); @@ -1576,7 +1536,7 @@ static int brcmf_pcie_download_fw_nvram( brcmf_dbg(PCIE, "Download NVRAM %s\n", devinfo->nvram_name); address =3D devinfo->ci->rambase + devinfo->ci->ramsize - nvram_len; - brcmf_pcie_copy_mem_todev(devinfo, address, nvram, nvram_len); + memcpy_toio(devinfo->tcm + address, nvram, nvram_len); brcmf_fw_nvram_free(nvram); } else { brcmf_dbg(PCIE, "No matching NVRAM file found %s\n", From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20638C433F5 for ; Wed, 6 Apr 2022 01:18:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1445326AbiDFBQD (ORCPT ); Tue, 5 Apr 2022 21:16:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59108 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356214AbiDEKX3 (ORCPT ); Tue, 5 Apr 2022 06:23:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1A927BAB86; Tue, 5 Apr 2022 03:07:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CD0EFB81B7A; Tue, 5 Apr 2022 10:07:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C63FC385A2; Tue, 5 Apr 2022 10:07:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153265; bh=MYXKRL6zh+SFfUS482sv3pgx8X+jfhG4h+6uNd7kH6E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MfGfuq0ZKBHeV5m7fFAsnq54loGklAkmjDfZPT5eIk/xHFrDVV3PbAeq6tvcgwikl Qi/BlEUakg6U218wO0q5OZg5udI9GlvK3N9u3M5+Fy9VRxSXcG8f8XboBvlEPO47gJ tZQSrgz31h3sozKVExz/oW56ouFakuYLjKWUp5Y4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Walleij , Arend van Spriel , Hector Martin , Andy Shevchenko , Kalle Valo Subject: [PATCH 5.10 123/599] brcmfmac: pcie: Fix crashes due to early IRQs Date: Tue, 5 Apr 2022 09:26:57 +0200 Message-Id: <20220405070302.498797711@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hector Martin commit b50255c83b914defd61a57fbc81d452334b63f4c upstream. The driver was enabling IRQs before the message processing was initialized. This could cause IRQs to come in too early and crash the driver. Instead, move the IRQ enable and hostready to a bus preinit function, at which point everything is properly initialized. Fixes: 9e37f045d5e7 ("brcmfmac: Adding PCIe bus layer support.") Reviewed-by: Linus Walleij Reviewed-by: Arend van Spriel Cc: stable@vger.kernel.org Signed-off-by: Hector Martin Reviewed-by: Andy Shevchenko Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220131160713.245637-7-marcan@marcan.st Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c | 16 +++++++++++= ++--- 1 file changed, 13 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/pcie.c @@ -1306,6 +1306,18 @@ static void brcmf_pcie_down(struct devic { } =20 +static int brcmf_pcie_preinit(struct device *dev) +{ + struct brcmf_bus *bus_if =3D dev_get_drvdata(dev); + struct brcmf_pciedev *buspub =3D bus_if->bus_priv.pcie; + + brcmf_dbg(PCIE, "Enter\n"); + + brcmf_pcie_intr_enable(buspub->devinfo); + brcmf_pcie_hostready(buspub->devinfo); + + return 0; +} =20 static int brcmf_pcie_tx(struct device *dev, struct sk_buff *skb) { @@ -1414,6 +1426,7 @@ static int brcmf_pcie_reset(struct devic } =20 static const struct brcmf_bus_ops brcmf_pcie_bus_ops =3D { + .preinit =3D brcmf_pcie_preinit, .txdata =3D brcmf_pcie_tx, .stop =3D brcmf_pcie_down, .txctl =3D brcmf_pcie_tx_ctlpkt, @@ -1786,9 +1799,6 @@ static void brcmf_pcie_setup(struct devi =20 init_waitqueue_head(&devinfo->mbdata_resp_wait); =20 - brcmf_pcie_intr_enable(devinfo); - brcmf_pcie_hostready(devinfo); - ret =3D brcmf_attach(&devinfo->pdev->dev); if (ret) goto fail; From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCE7BC433FE for ; Tue, 5 Apr 2022 22:12:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239004AbiDEWOD (ORCPT ); Tue, 5 Apr 2022 18:14:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60904 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356216AbiDEKXa (ORCPT ); Tue, 5 Apr 2022 06:23:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE0E3BAB87; Tue, 5 Apr 2022 03:07:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6757AB81C88; Tue, 5 Apr 2022 10:07:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1EA2C385A1; Tue, 5 Apr 2022 10:07:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153268; bh=5SKEbDrLT6+O1PlKgj+zrudt8PadU0+bYVvcmroswKE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wl1HRdf2VkrSjNrSj//IE136964rDpZFCpYYzHMkoO0ykx80IaUPFaIODYSeCzsJF 74S/Qkb4c0q5qKJ2TMQSJQnwKybyBRO/DnlowTxOaMG4h8gw8WnFlOUOTyOVEDlmjH JIyhM/hp5nQi+sjiwvpAaiwAvHullvmCGgpVCSQ0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Lucas De Marchi , Jani Nikula Subject: [PATCH 5.10 124/599] drm/i915/opregion: check port number bounds for SWSCI display power state Date: Tue, 5 Apr 2022 09:26:58 +0200 Message-Id: <20220405070302.527802109@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jani Nikula commit 24a644ebbfd3b13cda702f98907f9dd123e34bf9 upstream. The mapping from enum port to whatever port numbering scheme is used by the SWSCI Display Power State Notification is odd, and the memory of it has faded. In any case, the parameter only has space for ports numbered [0..4], and UBSAN reports bit shift beyond it when the platform has port F or more. Since the SWSCI functionality is supposed to be obsolete for new platforms (i.e. ones that might have port F or more), just bail out early if the mapped and mangled port number is beyond what the Display Power State Notification can support. Fixes: 9c4b0a683193 ("drm/i915: add opregion function to notify bios of enc= oder enable/disable") Cc: # v3.13+ Cc: Ville Syrj=C3=A4l=C3=A4 Cc: Lucas De Marchi Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/4800 Signed-off-by: Jani Nikula Reviewed-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/cc363f42d6b5a5932b6d218= fefcc8bdfb15dbbe5.1644489329.git.jani.nikula@intel.com Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/display/intel_opregion.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) --- a/drivers/gpu/drm/i915/display/intel_opregion.c +++ b/drivers/gpu/drm/i915/display/intel_opregion.c @@ -376,6 +376,21 @@ int intel_opregion_notify_encoder(struct return -EINVAL; } =20 + /* + * The port numbering and mapping here is bizarre. The now-obsolete + * swsci spec supports ports numbered [0..4]. Port E is handled as a + * special case, but port F and beyond are not. The functionality is + * supposed to be obsolete for new platforms. Just bail out if the port + * number is out of bounds after mapping. + */ + if (port > 4) { + drm_dbg_kms(&dev_priv->drm, + "[ENCODER:%d:%s] port %c (index %u) out of bounds for display power= state notification\n", + intel_encoder->base.base.id, intel_encoder->base.name, + port_name(intel_encoder->port), port); + return -EINVAL; + } + if (!enable) parm |=3D 4 << 8; =20 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C21DC43217 for ; Tue, 5 Apr 2022 20:15:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1444388AbiDEUIM (ORCPT ); Tue, 5 Apr 2022 16:08:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60768 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356221AbiDEKXa (ORCPT ); Tue, 5 Apr 2022 06:23:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 935E54AE19; Tue, 5 Apr 2022 03:07:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4B504B81B7A; Tue, 5 Apr 2022 10:07:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7C612C385A2; Tue, 5 Apr 2022 10:07:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153271; bh=ES3X17Y01QRt0jn6W30I/2/ntU0WYkz9qFCvGLKNurI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ByjWzPeRt33PcSqfOiefYDAu/94DutCw+3ksofD56A0g2Ckk+ltq5a7MvFiLUc3CN Er4Ppzr9fyBCxJKGn+KCExylr0BdchSl102SkYZIaeZGFmHH35aRi8yf+NaRMlpZoP 9LDyvmN1BCL1J63KO6nxrMGXZbb+TPLVuOHBeUow= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mastan Katragadda , Adam Zabrocki , Jackson Cody , Chris Wilson , Jon Bloomfield , Sudeep Dutt , Matthew Auld , Joonas Lahtinen Subject: [PATCH 5.10 125/599] drm/i915/gem: add missing boundary check in vm_access Date: Tue, 5 Apr 2022 09:26:59 +0200 Message-Id: <20220405070302.558663250@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mastan Katragadda commit 3886a86e7e6cc6ce2ce93c440fecd8f42aed0ce7 upstream. A missing bounds check in vm_access() can lead to an out-of-bounds read or write in the adjacent memory area, since the len attribute is not validated before the memcpy later in the function, potentially hitting: [ 183.637831] BUG: unable to handle page fault for address: ffffc90000c860= 00 [ 183.637934] #PF: supervisor read access in kernel mode [ 183.637997] #PF: error_code(0x0000) - not-present page [ 183.638059] PGD 100000067 P4D 100000067 PUD 100258067 PMD 106341067 PTE 0 [ 183.638144] Oops: 0000 [#2] PREEMPT SMP NOPTI [ 183.638201] CPU: 3 PID: 1790 Comm: poc Tainted: G D 5.17.= 0-rc6-ci-drm-11296+ #1 [ 183.638298] Hardware name: Intel Corporation CoffeeLake Client Platform/= CoffeeLake H DDR4 RVP, BIOS CNLSFWR1.R00.X208.B00.1905301319 05/30/2019 [ 183.638430] RIP: 0010:memcpy_erms+0x6/0x10 [ 183.640213] RSP: 0018:ffffc90001763d48 EFLAGS: 00010246 [ 183.641117] RAX: ffff888109c14000 RBX: ffff888111bece40 RCX: 00000000000= 00ffc [ 183.642029] RDX: 0000000000001000 RSI: ffffc90000c86000 RDI: ffff888109c= 14004 [ 183.642946] RBP: 0000000000000ffc R08: 800000000000016b R09: 00000000000= 00000 [ 183.643848] R10: ffffc90000c85000 R11: 0000000000000048 R12: 00000000000= 01000 [ 183.644742] R13: ffff888111bed190 R14: ffff888109c14000 R15: 00000000000= 01000 [ 183.645653] FS: 00007fe5ef807540(0000) GS:ffff88845b380000(0000) knlGS:= 0000000000000000 [ 183.646570] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 183.647481] CR2: ffffc90000c86000 CR3: 000000010ff02006 CR4: 00000000003= 706e0 [ 183.648384] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 183.649271] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 183.650142] Call Trace: [ 183.650988] [ 183.651793] vm_access+0x1f0/0x2a0 [i915] [ 183.652726] __access_remote_vm+0x224/0x380 [ 183.653561] mem_rw.isra.0+0xf9/0x190 [ 183.654402] vfs_read+0x9d/0x1b0 [ 183.655238] ksys_read+0x63/0xe0 [ 183.656065] do_syscall_64+0x38/0xc0 [ 183.656882] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 183.657663] RIP: 0033:0x7fe5ef725142 [ 183.659351] RSP: 002b:00007ffe1e81c7e8 EFLAGS: 00000246 ORIG_RAX: 000000= 0000000000 [ 183.660227] RAX: ffffffffffffffda RBX: 0000557055dfb780 RCX: 00007fe5ef7= 25142 [ 183.661104] RDX: 0000000000001000 RSI: 00007ffe1e81d880 RDI: 00000000000= 00005 [ 183.661972] RBP: 00007ffe1e81e890 R08: 0000000000000030 R09: 00000000000= 00046 [ 183.662832] R10: 0000557055dfc2e0 R11: 0000000000000246 R12: 0000557055d= fb1c0 [ 183.663691] R13: 00007ffe1e81e980 R14: 0000000000000000 R15: 00000000000= 00000 Changes since v1: - Updated if condition with range_overflows_t [Chris Wilson] Fixes: 9f909e215fea ("drm/i915: Implement vm_ops->access for gdb access int= o mmaps") Signed-off-by: Mastan Katragadda Suggested-by: Adam Zabrocki Reported-by: Jackson Cody Cc: Chris Wilson Cc: Jon Bloomfield Cc: Sudeep Dutt Cc: # v5.8+ Reviewed-by: Matthew Auld [mauld: tidy up the commit message and add Cc: stable] Signed-off-by: Matthew Auld Link: https://patchwork.freedesktop.org/patch/msgid/20220303060428.1668844-= 1-mastanx.katragadda@intel.com (cherry picked from commit 661412e301e2ca86799aa4f400d1cf0bd38c57c6) Signed-off-by: Joonas Lahtinen Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/gem/i915_gem_mman.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/gpu/drm/i915/gem/i915_gem_mman.c +++ b/drivers/gpu/drm/i915/gem/i915_gem_mman.c @@ -423,7 +423,7 @@ vm_access(struct vm_area_struct *area, u return -EACCES; =20 addr -=3D area->vm_start; - if (addr >=3D obj->base.size) + if (range_overflows_t(u64, addr, len, obj->base.size)) return -EINVAL; =20 /* As this is primarily for debugging, let's focus on simplicity */ From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8CC9DC433FE for ; Wed, 6 Apr 2022 00:21:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1583987AbiDEX5j (ORCPT ); Tue, 5 Apr 2022 19:57:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60622 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356219AbiDEKXa (ORCPT ); Tue, 5 Apr 2022 06:23:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B10354AE3E; Tue, 5 Apr 2022 03:07:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4C1D06172B; Tue, 5 Apr 2022 10:07:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5CA61C385A2; Tue, 5 Apr 2022 10:07:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153273; bh=x/BbDqLS16fO//8ZLAlr4JSJFLAy2lcDbX54ZoBLp9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qzJIlItemYtHABHJH3NE5rupX2FkYiB8h5e1eJyRBc53TuC0AoBZnBSY8MfxV/8dd o60D9XDdxNf+9DPn5/hvePDZm3eobhkPDXr5qbWIcLgvNid8Ikd9+r1WXy3uP5bDXS T5ZaRTdVczrnheXrszcRARR0j6rCgjRwPoeH/imM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liguang Zhang , Bjorn Helgaas , Lukas Wunner Subject: [PATCH 5.10 126/599] PCI: pciehp: Clear cmd_busy bit in polling mode Date: Tue, 5 Apr 2022 09:27:00 +0200 Message-Id: <20220405070302.589741179@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liguang Zhang commit 92912b175178c7e895f5e5e9f1e30ac30319162b upstream. Writes to a Downstream Port's Slot Control register are PCIe hotplug "commands." If the Port supports Command Completed events, software must wait for a command to complete before writing to Slot Control again. pcie_do_write_cmd() sets ctrl->cmd_busy when it writes to Slot Control. If software notification is enabled, i.e., PCI_EXP_SLTCTL_HPIE and PCI_EXP_SLTCTL_CCIE are set, ctrl->cmd_busy is cleared by pciehp_isr(). But when software notification is disabled, as it is when pcie_init() powers off an empty slot, pcie_wait_cmd() uses pcie_poll_cmd() to poll for command completion, and it neglects to clear ctrl->cmd_busy, which leads to spurious timeouts: pcieport 0000:00:03.0: pciehp: Timeout on hotplug command 0x01c0 (issued = 2264 msec ago) pcieport 0000:00:03.0: pciehp: Timeout on hotplug command 0x05c0 (issued = 2288 msec ago) Clear ctrl->cmd_busy in pcie_poll_cmd() when it detects a Command Completed event (PCI_EXP_SLTSTA_CC). [bhelgaas: commit log] Fixes: a5dd4b4b0570 ("PCI: pciehp: Wait for hotplug command completion wher= e necessary") Link: https://lore.kernel.org/r/20211111054258.7309-1-zhangliguang@linux.al= ibaba.com Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D215143 Link: https://lore.kernel.org/r/20211126173309.GA12255@wunner.de Signed-off-by: Liguang Zhang Signed-off-by: Bjorn Helgaas Reviewed-by: Lukas Wunner Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/pci/hotplug/pciehp_hpc.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/pci/hotplug/pciehp_hpc.c +++ b/drivers/pci/hotplug/pciehp_hpc.c @@ -98,6 +98,8 @@ static int pcie_poll_cmd(struct controll if (slot_status & PCI_EXP_SLTSTA_CC) { pcie_capability_write_word(pdev, PCI_EXP_SLTSTA, PCI_EXP_SLTSTA_CC); + ctrl->cmd_busy =3D 0; + smp_mb(); return 1; } msleep(10); From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5CC29C433EF for ; Tue, 5 Apr 2022 20:22:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1353941AbiDEUPq (ORCPT ); Tue, 5 Apr 2022 16:15:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44352 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356097AbiDEKW4 (ORCPT ); Tue, 5 Apr 2022 06:22:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD06FB3DC0; Tue, 5 Apr 2022 03:06:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 69AAC61500; Tue, 5 Apr 2022 10:06:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79B6EC385A2; Tue, 5 Apr 2022 10:06:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153168; bh=p9Up1pKixUzPNTVM3bn7wF1Y6Yvz1yHN+lyh/GIlfco=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yckrU2yvLiXoDhtH8D3jzVmQp0Ub/IqqJefb32rvNWjHLPzJ3ex7Rbv7Ax7NsRpIp POd62DtBkqpA69DPL+IBwmb3Yroc/KSfO5aV0eVOdOsmza43DTB31yHi0ZxvWuAKua 8RVK0WPJEbNjAaKwacnnrUFV4NbOlVM0cgOxcE+M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Zyngier , Lorenzo Pieralisi , Rob Herring , Toan Le , =?UTF-8?q?Krzysztof=20Wilczy=C5=84ski?= , Bjorn Helgaas , =?UTF-8?q?St=C3=A9phane=20Graber?= , dann frazier Subject: [PATCH 5.10 127/599] PCI: xgene: Revert "PCI: xgene: Fix IB window setup" Date: Tue, 5 Apr 2022 09:27:01 +0200 Message-Id: <20220405070302.620225933@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Marc Zyngier commit 825da4e9cec68713fbb02dc6f71fe1bf65fe8050 upstream. Commit c7a75d07827a ("PCI: xgene: Fix IB window setup") tried to fix the damages that 6dce5aa59e0b ("PCI: xgene: Use inbound resources for setup") caused, but actually didn't improve anything for some plarforms (at least Mustang and m400 are still broken). Given that 6dce5aa59e0b has been reverted, revert this patch as well, restoring the PCIe support on XGene to its pre-5.5, working state. Link: https://lore.kernel.org/r/YjN8pT5e6/8cRohQ@xps13.dannf Link: https://lore.kernel.org/r/20220321104843.949645-3-maz@kernel.org Fixes: c7a75d07827a ("PCI: xgene: Fix IB window setup") Signed-off-by: Marc Zyngier Signed-off-by: Lorenzo Pieralisi Cc: stable@vger.kernel.org Cc: Rob Herring Cc: Toan Le Cc: Lorenzo Pieralisi Cc: Krzysztof Wilczy=C5=84ski Cc: Bjorn Helgaas Cc: St=C3=A9phane Graber Cc: dann frazier Signed-off-by: Greg Kroah-Hartman Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-xgene.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/pci/controller/pci-xgene.c +++ b/drivers/pci/controller/pci-xgene.c @@ -467,7 +467,7 @@ static int xgene_pcie_select_ib_reg(u8 * return 1; } =20 - if ((size > SZ_1K) && (size < SZ_4G) && !(*ib_reg_mask & (1 << 0))) { + if ((size > SZ_1K) && (size < SZ_1T) && !(*ib_reg_mask & (1 << 0))) { *ib_reg_mask |=3D (1 << 0); return 0; } From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3C95EC433F5 for ; Tue, 5 Apr 2022 23:17:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574467AbiDEW4P (ORCPT ); Tue, 5 Apr 2022 18:56:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57388 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356106AbiDEKW5 (ORCPT ); Tue, 5 Apr 2022 06:22:57 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D80B9B53DE; Tue, 5 Apr 2022 03:06:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 748B1616E7; Tue, 5 Apr 2022 10:06:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83049C385A2; Tue, 5 Apr 2022 10:06:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153171; bh=p0x3iE9iHU+TnN1lV2HCUqC+rnmu1M2H6SPMk7b2q7o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=O88VJVvnzrD9M17JdnfPlAxoQ11yqBfwgZ3qlaRjjh2HlH/Ay3vJuwJXgASBT+hFv UkgnPCVH1oB/svjDpmTfIdmhTqa/7prgF6jJXvtplCrrRnADCHPgdqFm3Bq6DS6kBb SbZNaFLnKZ7H9UOJl5rHRGGxIbz/rn9k3YDiNYAo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Konrad Dybcio , kernel test robot , Julia Lawall , Mark Brown , Sasha Levin Subject: [PATCH 5.10 128/599] regulator: qcom_smd: fix for_each_child.cocci warnings Date: Tue, 5 Apr 2022 09:27:02 +0200 Message-Id: <20220405070302.650785657@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: kernel test robot [ Upstream commit 6390d42c21efff0b4c10956a38e341f4e84ecd3d ] drivers/regulator/qcom_smd-regulator.c:1318:1-33: WARNING: Function "for_ea= ch_available_child_of_node" should have of_node_put() before return around = line 1321. Semantic patch information: False positives can be due to function calls within the for_each loop that may encapsulate an of_node_put. Generated by: scripts/coccinelle/iterators/for_each_child.cocci Fixes: 14e2976fbabd ("regulator: qcom_smd: Align probe function with rpmh-r= egulator") CC: Konrad Dybcio Reported-by: kernel test robot Signed-off-by: kernel test robot Signed-off-by: Julia Lawall Link: https://lore.kernel.org/r/alpine.DEB.2.22.394.2201151210170.3051@hadr= ien Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/regulator/qcom_smd-regulator.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/regulator/qcom_smd-regulator.c b/drivers/regulator/qco= m_smd-regulator.c index 03e146e98abd..8d784a2a09d8 100644 --- a/drivers/regulator/qcom_smd-regulator.c +++ b/drivers/regulator/qcom_smd-regulator.c @@ -1185,8 +1185,10 @@ static int rpm_reg_probe(struct platform_device *pde= v) =20 for_each_available_child_of_node(dev->of_node, node) { vreg =3D devm_kzalloc(&pdev->dev, sizeof(*vreg), GFP_KERNEL); - if (!vreg) + if (!vreg) { + of_node_put(node); return -ENOMEM; + } =20 ret =3D rpm_regulator_init_vreg(vreg, dev, node, rpm, vreg_data); =20 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DF613C4332F for ; Wed, 6 Apr 2022 00:17:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1582745AbiDEXtc (ORCPT ); Tue, 5 Apr 2022 19:49:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42286 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356111AbiDEKW5 (ORCPT ); Tue, 5 Apr 2022 06:22:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 27A81B6D0C; Tue, 5 Apr 2022 03:06:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DDBD4B81C83; Tue, 5 Apr 2022 10:06:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 49B46C385A2; Tue, 5 Apr 2022 10:06:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153174; bh=viDQ5oPXUO4Bg2RdHflKhjqajjnXbG/LyDSk6gx4X20=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DTeR510pL7pqgmVHNC2PJahYoYIPUOEE6r8rxd7CZmfdQANJGDJIMI+UOHUsCiZ1Z trIy+GW/LqkZlCtAclyIEaOD8OYVOcwBgktgYRJWfGOnabnMzUrCUKVw7qoz7H9ovQ Z+a000mIOnMI0QTvht2WjqVf0z+gg28n6tED4j3s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20G=C3=B6ttsche?= , Nick Desaulniers , Paul Moore , Sasha Levin Subject: [PATCH 5.10 129/599] selinux: check return value of sel_make_avc_files Date: Tue, 5 Apr 2022 09:27:03 +0200 Message-Id: <20220405070302.680256821@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Christian G=C3=B6ttsche [ Upstream commit bcb62828e3e8c813b6613db6eb7fd9657db248fc ] sel_make_avc_files() might fail and return a negative errno value on memory allocation failures. Re-add the check of the return value, dropped in 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table"). Reported by clang-analyzer: security/selinux/selinuxfs.c:2129:2: warning: Value stored to 'ret' is never read [deadcode.DeadStores] ret =3D sel_make_avc_files(dentry); ^ ~~~~~~~~~~~~~~~~~~~~~~~~~~ Fixes: 66f8e2f03c02 ("selinux: sidtab reverse lookup hash table") Signed-off-by: Christian G=C3=B6ttsche Reviewed-by: Nick Desaulniers [PM: description line wrapping, added proper commit ref] Signed-off-by: Paul Moore Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- security/selinux/selinuxfs.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 2b745ae8cb98..d893c2280f59 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2124,6 +2124,8 @@ static int sel_fill_super(struct super_block *sb, str= uct fs_context *fc) } =20 ret =3D sel_make_avc_files(dentry); + if (ret) + goto err; =20 dentry =3D sel_make_dir(sb->s_root, "ss", &fsi->last_ino); if (IS_ERR(dentry)) { --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 692A0C43217 for ; Tue, 5 Apr 2022 23:17:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574161AbiDEWyp (ORCPT ); Tue, 5 Apr 2022 18:54:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59112 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356116AbiDEKW5 (ORCPT ); Tue, 5 Apr 2022 06:22:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E2270B6D3F; Tue, 5 Apr 2022 03:06:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8E53CB81B7A; Tue, 5 Apr 2022 10:06:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F3E1FC385A2; Tue, 5 Apr 2022 10:06:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153177; bh=piYDhvcPiHRMVSJo0+7xzS/0UFmC8rIlzj+3qDoFJYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kREmpbv9hDat+42IM72gPQ4qoQd88eZyxSxpg4FwaBwkMnVYbUlhoBOE+9LZ+udHA 6JuwzJh8eTZV0bIouQXn5yKdaRgedGnOirRBgQrvcX3LGZh+TIO70hBW+mJ9yv7glB xIWTr90JiTmcB7taeIyJfH0juWKf9HaIg0ZOTaqU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sunil Goutham , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 130/599] hwrng: cavium - Check health status while reading random data Date: Tue, 5 Apr 2022 09:27:04 +0200 Message-Id: <20220405070302.709977322@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sunil Goutham [ Upstream commit 680efb33546be8960ccbb2f4e0e43034d9c93b30 ] This RNG device is present on Marvell OcteonTx2 silicons as well and also provides entropy health status. HW continuously checks health condition of entropy and reports faults. Fault is in terms of co-processor cycles since last fault detected. This doesn't get cleared and only updated when new fault is detected. Also there are chances of detecting false positives. So to detect a entropy failure SW has to check if failures are persistent ie cycles elapsed is frequently updated by HW. This patch adds support to detect health failures using below algo. 1. Consider any fault detected before 10ms as a false positive and ignore. 10ms is chosen randomly, no significance. 2. Upon first failure detection make a note of cycles elapsed and when this error happened in realtime (cntvct). 3. Upon subsequent failure, check if this is new or a old one by comparing current cycles with the ones since last failure. cycles or time since last failure is calculated using cycles and time info captured at (2). HEALTH_CHECK status register is not available to VF, hence had to map PF registers. Also since cycles are in terms of co-processor cycles, had to retrieve co-processor clock rate from RST device. Signed-off-by: Sunil Goutham Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/char/hw_random/Kconfig | 2 +- drivers/char/hw_random/cavium-rng-vf.c | 194 +++++++++++++++++++++++-- drivers/char/hw_random/cavium-rng.c | 11 +- 3 files changed, 190 insertions(+), 17 deletions(-) diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig index 5952210526aa..31d367949fad 100644 --- a/drivers/char/hw_random/Kconfig +++ b/drivers/char/hw_random/Kconfig @@ -427,7 +427,7 @@ config HW_RANDOM_MESON =20 config HW_RANDOM_CAVIUM tristate "Cavium ThunderX Random Number Generator support" - depends on HW_RANDOM && PCI && (ARM64 || (COMPILE_TEST && 64BIT)) + depends on HW_RANDOM && PCI && ARM64 default HW_RANDOM help This driver provides kernel-side support for the Random Number diff --git a/drivers/char/hw_random/cavium-rng-vf.c b/drivers/char/hw_rando= m/cavium-rng-vf.c index 3de4a6a443ef..6f66919652bf 100644 --- a/drivers/char/hw_random/cavium-rng-vf.c +++ b/drivers/char/hw_random/cavium-rng-vf.c @@ -1,10 +1,7 @@ +// SPDX-License-Identifier: GPL-2.0 /* - * Hardware Random Number Generator support for Cavium, Inc. - * Thunder processor family. - * - * This file is subject to the terms and conditions of the GNU General Pub= lic - * License. See the file "COPYING" in the main directory of this archive - * for more details. + * Hardware Random Number Generator support. + * Cavium Thunder, Marvell OcteonTx/Tx2 processor families. * * Copyright (C) 2016 Cavium, Inc. */ @@ -15,16 +12,146 @@ #include #include =20 +#include + +/* PCI device IDs */ +#define PCI_DEVID_CAVIUM_RNG_PF 0xA018 +#define PCI_DEVID_CAVIUM_RNG_VF 0xA033 + +#define HEALTH_STATUS_REG 0x38 + +/* RST device info */ +#define PCI_DEVICE_ID_RST_OTX2 0xA085 +#define RST_BOOT_REG 0x1600ULL +#define CLOCK_BASE_RATE 50000000ULL +#define MSEC_TO_NSEC(x) (x * 1000000) + struct cavium_rng { struct hwrng ops; void __iomem *result; + void __iomem *pf_regbase; + struct pci_dev *pdev; + u64 clock_rate; + u64 prev_error; + u64 prev_time; }; =20 +static inline bool is_octeontx(struct pci_dev *pdev) +{ + if (midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX_83XX, + MIDR_CPU_VAR_REV(0, 0), + MIDR_CPU_VAR_REV(3, 0)) || + midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX_81XX, + MIDR_CPU_VAR_REV(0, 0), + MIDR_CPU_VAR_REV(3, 0)) || + midr_is_cpu_model_range(read_cpuid_id(), MIDR_THUNDERX, + MIDR_CPU_VAR_REV(0, 0), + MIDR_CPU_VAR_REV(3, 0))) + return true; + + return false; +} + +static u64 rng_get_coprocessor_clkrate(void) +{ + u64 ret =3D CLOCK_BASE_RATE * 16; /* Assume 800Mhz as default */ + struct pci_dev *pdev; + void __iomem *base; + + pdev =3D pci_get_device(PCI_VENDOR_ID_CAVIUM, + PCI_DEVICE_ID_RST_OTX2, NULL); + if (!pdev) + goto error; + + base =3D pci_ioremap_bar(pdev, 0); + if (!base) + goto error_put_pdev; + + /* RST: PNR_MUL * 50Mhz gives clockrate */ + ret =3D CLOCK_BASE_RATE * ((readq(base + RST_BOOT_REG) >> 33) & 0x3F); + + iounmap(base); + +error_put_pdev: + pci_dev_put(pdev); + +error: + return ret; +} + +static int check_rng_health(struct cavium_rng *rng) +{ + u64 cur_err, cur_time; + u64 status, cycles; + u64 time_elapsed; + + + /* Skip checking health for OcteonTx */ + if (!rng->pf_regbase) + return 0; + + status =3D readq(rng->pf_regbase + HEALTH_STATUS_REG); + if (status & BIT_ULL(0)) { + dev_err(&rng->pdev->dev, "HWRNG: Startup health test failed\n"); + return -EIO; + } + + cycles =3D status >> 1; + if (!cycles) + return 0; + + cur_time =3D arch_timer_read_counter(); + + /* RNM_HEALTH_STATUS[CYCLES_SINCE_HEALTH_FAILURE] + * Number of coprocessor cycles times 2 since the last failure. + * This field doesn't get cleared/updated until another failure. + */ + cycles =3D cycles / 2; + cur_err =3D (cycles * 1000000000) / rng->clock_rate; /* In nanosec */ + + /* Ignore errors that happenned a long time ago, these + * are most likely false positive errors. + */ + if (cur_err > MSEC_TO_NSEC(10)) { + rng->prev_error =3D 0; + rng->prev_time =3D 0; + return 0; + } + + if (rng->prev_error) { + /* Calculate time elapsed since last error + * '1' tick of CNTVCT is 10ns, since it runs at 100Mhz. + */ + time_elapsed =3D (cur_time - rng->prev_time) * 10; + time_elapsed +=3D rng->prev_error; + + /* Check if current error is a new one or the old one itself. + * If error is a new one then consider there is a persistent + * issue with entropy, declare hardware failure. + */ + if (cur_err < time_elapsed) { + dev_err(&rng->pdev->dev, "HWRNG failure detected\n"); + rng->prev_error =3D cur_err; + rng->prev_time =3D cur_time; + return -EIO; + } + } + + rng->prev_error =3D cur_err; + rng->prev_time =3D cur_time; + return 0; +} + /* Read data from the RNG unit */ static int cavium_rng_read(struct hwrng *rng, void *dat, size_t max, bool = wait) { struct cavium_rng *p =3D container_of(rng, struct cavium_rng, ops); unsigned int size =3D max; + int err =3D 0; + + err =3D check_rng_health(p); + if (err) + return err; =20 while (size >=3D 8) { *((u64 *)dat) =3D readq(p->result); @@ -39,6 +166,39 @@ static int cavium_rng_read(struct hwrng *rng, void *dat= , size_t max, bool wait) return max; } =20 +static int cavium_map_pf_regs(struct cavium_rng *rng) +{ + struct pci_dev *pdev; + + /* Health status is not supported on 83xx, skip mapping PF CSRs */ + if (is_octeontx(rng->pdev)) { + rng->pf_regbase =3D NULL; + return 0; + } + + pdev =3D pci_get_device(PCI_VENDOR_ID_CAVIUM, + PCI_DEVID_CAVIUM_RNG_PF, NULL); + if (!pdev) { + dev_err(&pdev->dev, "Cannot find RNG PF device\n"); + return -EIO; + } + + rng->pf_regbase =3D ioremap(pci_resource_start(pdev, 0), + pci_resource_len(pdev, 0)); + if (!rng->pf_regbase) { + dev_err(&pdev->dev, "Failed to map PF CSR region\n"); + pci_dev_put(pdev); + return -ENOMEM; + } + + pci_dev_put(pdev); + + /* Get co-processor clock rate */ + rng->clock_rate =3D rng_get_coprocessor_clkrate(); + + return 0; +} + /* Map Cavium RNG to an HWRNG object */ static int cavium_rng_probe_vf(struct pci_dev *pdev, const struct pci_device_id *id) @@ -50,6 +210,8 @@ static int cavium_rng_probe_vf(struct pci_dev *pdev, if (!rng) return -ENOMEM; =20 + rng->pdev =3D pdev; + /* Map the RNG result */ rng->result =3D pcim_iomap(pdev, 0, 0); if (!rng->result) { @@ -67,6 +229,11 @@ static int cavium_rng_probe_vf(struct pci_dev *pdev, =20 pci_set_drvdata(pdev, rng); =20 + /* Health status is available only at PF, hence map PF registers. */ + ret =3D cavium_map_pf_regs(rng); + if (ret) + return ret; + ret =3D devm_hwrng_register(&pdev->dev, &rng->ops); if (ret) { dev_err(&pdev->dev, "Error registering device as HWRNG.\n"); @@ -76,10 +243,18 @@ static int cavium_rng_probe_vf(struct pci_dev *pdev, return 0; } =20 +/* Remove the VF */ +static void cavium_rng_remove_vf(struct pci_dev *pdev) +{ + struct cavium_rng *rng; + + rng =3D pci_get_drvdata(pdev); + iounmap(rng->pf_regbase); +} =20 static const struct pci_device_id cavium_rng_vf_id_table[] =3D { - { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, 0xa033), 0, 0, 0}, - {0,}, + { PCI_DEVICE(PCI_VENDOR_ID_CAVIUM, PCI_DEVID_CAVIUM_RNG_VF) }, + { 0, } }; MODULE_DEVICE_TABLE(pci, cavium_rng_vf_id_table); =20 @@ -87,8 +262,9 @@ static struct pci_driver cavium_rng_vf_driver =3D { .name =3D "cavium_rng_vf", .id_table =3D cavium_rng_vf_id_table, .probe =3D cavium_rng_probe_vf, + .remove =3D cavium_rng_remove_vf, }; module_pci_driver(cavium_rng_vf_driver); =20 MODULE_AUTHOR("Omer Khaliq "); -MODULE_LICENSE("GPL"); +MODULE_LICENSE("GPL v2"); diff --git a/drivers/char/hw_random/cavium-rng.c b/drivers/char/hw_random/c= avium-rng.c index 63d6e68c24d2..b96579222408 100644 --- a/drivers/char/hw_random/cavium-rng.c +++ b/drivers/char/hw_random/cavium-rng.c @@ -1,10 +1,7 @@ +// SPDX-License-Identifier: GPL-2.0 /* - * Hardware Random Number Generator support for Cavium Inc. - * Thunder processor family. - * - * This file is subject to the terms and conditions of the GNU General Pub= lic - * License. See the file "COPYING" in the main directory of this archive - * for more details. + * Hardware Random Number Generator support. + * Cavium Thunder, Marvell OcteonTx/Tx2 processor families. * * Copyright (C) 2016 Cavium, Inc. */ @@ -91,4 +88,4 @@ static struct pci_driver cavium_rng_pf_driver =3D { =20 module_pci_driver(cavium_rng_pf_driver); MODULE_AUTHOR("Omer Khaliq "); -MODULE_LICENSE("GPL"); +MODULE_LICENSE("GPL v2"); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B696FC433F5 for ; Wed, 6 Apr 2022 00:57:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839046AbiDFA6B (ORCPT ); Tue, 5 Apr 2022 20:58:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42168 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356120AbiDEKW6 (ORCPT ); Tue, 5 Apr 2022 06:22:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0750CB6E4A; Tue, 5 Apr 2022 03:06:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 968886172B; Tue, 5 Apr 2022 10:06:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A34EAC385A3; Tue, 5 Apr 2022 10:06:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153180; bh=gLRfcfw5hLBS9tnt1abhOUV0hMKG5+3gLd24ZnKwaqU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WQz0NST+SpZ8D8hkAi4BT4MK6CwEcz9IvKDbd7IO3VjGYGtmEosL/P1/Z167hNVeW 8JSqCrl7v8BxB70qRGya9i7XYR27ArwUjrL4UYqUfwGg0X1oCF3UJaKaNItqGO638q nwk25Na83K6Fzs12/bxaYuExdhzFXPuVjrYSW0M4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Geert Uytterhoeven , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 131/599] hwrng: cavium - HW_RANDOM_CAVIUM should depend on ARCH_THUNDER Date: Tue, 5 Apr 2022 09:27:05 +0200 Message-Id: <20220405070302.739838362@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Geert Uytterhoeven [ Upstream commit ab7d88549e2f7ae116afd303f32e1950cb790a1d ] The Cavium ThunderX Random Number Generator is only present on Cavium ThunderX SoCs, and not available as an independent PCIe endpoint. Hence add a dependency on ARCH_THUNDER, to prevent asking the user about this driver when configuring a kernel without Cavium Thunder SoC support. Fixes: cc2f1908c6b8f625 ("hwrng: cavium - Add Cavium HWRNG driver for Thund= erX SoC.") Signed-off-by: Geert Uytterhoeven Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/char/hw_random/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/hw_random/Kconfig b/drivers/char/hw_random/Kconfig index 31d367949fad..a7d9e4600d40 100644 --- a/drivers/char/hw_random/Kconfig +++ b/drivers/char/hw_random/Kconfig @@ -427,7 +427,7 @@ config HW_RANDOM_MESON =20 config HW_RANDOM_CAVIUM tristate "Cavium ThunderX Random Number Generator support" - depends on HW_RANDOM && PCI && ARM64 + depends on HW_RANDOM && PCI && ARCH_THUNDER default HW_RANDOM help This driver provides kernel-side support for the Random Number --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 021EFC433EF for ; Tue, 5 Apr 2022 23:18:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1448336AbiDEW6p (ORCPT ); Tue, 5 Apr 2022 18:58:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356126AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2D76EB7140; Tue, 5 Apr 2022 03:06:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 418D7616E7; Tue, 5 Apr 2022 10:06:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57B31C385A2; Tue, 5 Apr 2022 10:06:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153182; bh=4indgIxOVeCiK3xftlvX5TxwsieTy/0NnuibO7kTWwg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jC0kKB4rMSdCgs7i/v4ND1qoFOzFnMZEs83ZPYy3fS7SvyrCNkTISaTO/jbD4qWxb SITGnBxZu8OJpi16G4Gubr7B/6IQ2HkEopbsAE7VsWiQapqNSep56kAg2/mK0Sb4s/ Ft8hTNdV/i0pLboCHjqVrHQdv+/41o730JPos+C4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 132/599] crypto: sun8i-ss - really disable hash on A80 Date: Tue, 5 Apr 2022 09:27:06 +0200 Message-Id: <20220405070302.769540814@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Corentin Labbe [ Upstream commit 881fc7fba6c3e7d77d608b9a50b01a89d5e0c61b ] When adding hashes support to sun8i-ss, I have added them only on A83T. But I forgot that 0 is a valid algorithm ID, so hashes are enabled on A80 b= ut with an incorrect ID. Anyway, even with correct IDs, hashes do not work on A80 and I cannot find why. So let's disable all of them on A80. Fixes: d9b45418a917 ("crypto: sun8i-ss - support hash algorithms") Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c b/drivers/cr= ypto/allwinner/sun8i-ss/sun8i-ss-core.c index 80e89066dbd1..319fe3279a71 100644 --- a/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c +++ b/drivers/crypto/allwinner/sun8i-ss/sun8i-ss-core.c @@ -30,6 +30,8 @@ static const struct ss_variant ss_a80_variant =3D { .alg_cipher =3D { SS_ALG_AES, SS_ALG_DES, SS_ALG_3DES, }, + .alg_hash =3D { SS_ID_NOTSUPP, SS_ID_NOTSUPP, SS_ID_NOTSUPP, SS_ID_NOTSUP= P, + }, .op_mode =3D { SS_OP_ECB, SS_OP_CBC, }, .ss_clks =3D { --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85474C35280 for ; Tue, 5 Apr 2022 23:34:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1575512AbiDEXIE (ORCPT ); Tue, 5 Apr 2022 19:08:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57682 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356125AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 42314B7169; Tue, 5 Apr 2022 03:06:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EEBAAB81C8B; Tue, 5 Apr 2022 10:06:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 39579C385A1; Tue, 5 Apr 2022 10:06:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153185; bh=EIqZGIC3MEY6zK++/3lavNvUv7djR+iZn/Z4aFTomR0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MlqGPqZrka7B7VyvIQ5jLmqWkaqX/E+H5xVYym/dRzmiAXcf4mD2m8QmZWowXXIVQ XnV8UTdtzEgvf0TBmXSECnaGo031A9lhyEmlhaY1cmqiDdZTcvP+xqonWXWM/Qe2NY UMCfaQFr8z/+2eCFGZm87R+gIq/qMtiz/Uv7pkVs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 133/599] crypto: authenc - Fix sleep in atomic context in decrypt_tail Date: Tue, 5 Apr 2022 09:27:07 +0200 Message-Id: <20220405070302.799140357@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Herbert Xu [ Upstream commit 66eae850333d639fc278d6f915c6fc01499ea893 ] The function crypto_authenc_decrypt_tail discards its flags argument and always relies on the flags from the original request when starting its sub-request. This is clearly wrong as it may cause the SLEEPABLE flag to be set when it shouldn't. Fixes: 92d95ba91772 ("crypto: authenc - Convert to new AEAD interface") Reported-by: Corentin Labbe Signed-off-by: Herbert Xu Tested-by: Corentin Labbe Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- crypto/authenc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/authenc.c b/crypto/authenc.c index 670bf1a01d00..17f674a7cdff 100644 --- a/crypto/authenc.c +++ b/crypto/authenc.c @@ -253,7 +253,7 @@ static int crypto_authenc_decrypt_tail(struct aead_requ= est *req, dst =3D scatterwalk_ffwd(areq_ctx->dst, req->dst, req->assoclen); =20 skcipher_request_set_tfm(skreq, ctx->enc); - skcipher_request_set_callback(skreq, aead_request_flags(req), + skcipher_request_set_callback(skreq, flags, req->base.complete, req->base.data); skcipher_request_set_crypt(skreq, src, dst, req->cryptlen - authsize, req->iv); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C1A3C433FE for ; Tue, 5 Apr 2022 23:41:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1577927AbiDEXRl (ORCPT ); Tue, 5 Apr 2022 19:17:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356132AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 050D0B7C4C; Tue, 5 Apr 2022 03:06:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A40A0B81C83; Tue, 5 Apr 2022 10:06:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F27EDC385A2; Tue, 5 Apr 2022 10:06:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153188; bh=ptSRzUMxPsDpFQvmnSaM+FCNXlPRlJK5ik2D7AfvW6I=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rA9JlnT4nkaxZ26Og3CGjmGLUZUVgHaqh+OL/VaqQk3/KjCMAfvecS/Inpu3rlMhq Bz1Aq7U4OjlpQN26/qVxdeKfqNZa8dl6MHhz3zvPpwdQB6Wgn8i/U2YCyxFFXm1l3X ztVmMBxvTboc6iUkkQ5D1aAOIiMLP2p8QxcJviqI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tomas Paukrt , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 134/599] crypto: mxs-dcp - Fix scatterlist processing Date: Tue, 5 Apr 2022 09:27:08 +0200 Message-Id: <20220405070302.829074106@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tomas Paukrt [ Upstream commit 28e9b6d8199a3f124682b143800c2dacdc3d70dd ] This patch fixes a bug in scatterlist processing that may cause incorrect A= ES block encryption/decryption. Fixes: 2e6d793e1bf0 ("crypto: mxs-dcp - Use sg_mapping_iter to copy data") Signed-off-by: Tomas Paukrt Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/crypto/mxs-dcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/crypto/mxs-dcp.c b/drivers/crypto/mxs-dcp.c index 5edc91cdb4e6..a9d3e675f7ff 100644 --- a/drivers/crypto/mxs-dcp.c +++ b/drivers/crypto/mxs-dcp.c @@ -330,7 +330,7 @@ static int mxs_dcp_aes_block_crypt(struct crypto_async_= request *arq) memset(key + AES_KEYSIZE_128, 0, AES_KEYSIZE_128); } =20 - for_each_sg(req->src, src, sg_nents(src), i) { + for_each_sg(req->src, src, sg_nents(req->src), i) { src_buf =3D sg_virt(src); len =3D sg_dma_len(src); tlen +=3D len; --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 896ADC4332F for ; Wed, 6 Apr 2022 01:00:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1391272AbiDFA7t (ORCPT ); Tue, 5 Apr 2022 20:59:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356133AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 004E4B7C4E; Tue, 5 Apr 2022 03:06:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 90237616E7; Tue, 5 Apr 2022 10:06:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3E20C385A1; Tue, 5 Apr 2022 10:06:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153191; bh=vNkM5Ky6z1GAZFgDUWtTdGzCXe99L1wkWi6vyvVsa6E=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fNv+eo2lQZwMOBZRRPy64U+7K4LvQGw+3z3SiPj9g3BA2kOhxX031H/UXRg9pFcs+ mtmvwNZ68LoI+xSkTFdwL67Fw9wbbW8BPgpo+dG5lhJg5Z6sQkipELfiRQUGNnJHi0 RQxdwmDzH5roTrK/JiQBpcz/2du75ONPDcUvsjic= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jiasheng Jiang , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 5.10 135/599] thermal: int340x: Check for NULL after calling kmemdup() Date: Tue, 5 Apr 2022 09:27:09 +0200 Message-Id: <20220405070302.858414522@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiasheng Jiang [ Upstream commit 38b16d6cfe54c820848bcfc999bc5e8a7da1cefb ] As the potential failure of the allocation, kmemdup() may return NULL. Then, 'bin_attr_data_vault.private' will be NULL, but 'bin_attr_data_vault.size' is not 0, which is not consistent. Therefore, it is better to check the return value of kmemdup() to avoid the confusion. Fixes: 0ba13c763aac ("thermal/int340x_thermal: Export GDDV") Signed-off-by: Jiasheng Jiang [ rjw: Subject and changelog edits ] Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/thermal/intel/int340x_thermal/int3400_thermal.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c b/driv= ers/thermal/intel/int340x_thermal/int3400_thermal.c index 793d7b58fc65..55f5bc7cd20b 100644 --- a/drivers/thermal/intel/int340x_thermal/int3400_thermal.c +++ b/drivers/thermal/intel/int340x_thermal/int3400_thermal.c @@ -466,6 +466,11 @@ static void int3400_setup_gddv(struct int3400_thermal_= priv *priv) priv->data_vault =3D kmemdup(obj->package.elements[0].buffer.pointer, obj->package.elements[0].buffer.length, GFP_KERNEL); + if (!priv->data_vault) { + kfree(buffer.pointer); + return; + } + bin_attr_data_vault.private =3D priv->data_vault; bin_attr_data_vault.size =3D obj->package.elements[0].buffer.length; kfree(buffer.pointer); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CD119C43219 for ; Tue, 5 Apr 2022 22:55:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1456619AbiDEWq1 (ORCPT ); Tue, 5 Apr 2022 18:46:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356137AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0AD59B7C6C; Tue, 5 Apr 2022 03:06:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C9F96176C; Tue, 5 Apr 2022 10:06:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 67FFCC385A2; Tue, 5 Apr 2022 10:06:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153193; bh=+wLlyC9LKuDGwI7yL9rGWrb0r1NuK/aUtCI4Q8IbSAs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ykdVknljmILF+45ZJKLWCHaKTsWUFt8Jzyu0jSBtNhw3XbAxQBemHIv6a4Rj7+b3T U6TOXx5c+OZM09Zl20vMlxxEDT41azJa0P7g3ffAcB28zTUR6sgMnb8wLbLrMedeCe iWbfQuZgcYKTLMNw+zxjjjloD7uc5t5Y98q+HJ0w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Mark Brown , Sasha Levin Subject: [PATCH 5.10 136/599] spi: tegra114: Add missing IRQ check in tegra_spi_probe Date: Tue, 5 Apr 2022 09:27:10 +0200 Message-Id: <20220405070302.888146683@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 4f92724d4b92c024e721063f520d66e11ca4b54b ] This func misses checking for platform_get_irq()'s call and may passes the negative error codes to request_threaded_irq(), which takes unsigned IRQ #, causing it to fail with -EINVAL, overriding an original error code. Stop calling request_threaded_irq() with invalid IRQ #s. Fixes: f333a331adfa ("spi/tegra114: add spi driver") Signed-off-by: Miaoqian Lin Link: https://lore.kernel.org/r/20220128165238.25615-1-linmq006@gmail.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/spi/spi-tegra114.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/spi/spi-tegra114.c b/drivers/spi/spi-tegra114.c index a2e5907276e7..ed42665b1224 100644 --- a/drivers/spi/spi-tegra114.c +++ b/drivers/spi/spi-tegra114.c @@ -1353,6 +1353,10 @@ static int tegra_spi_probe(struct platform_device *p= dev) tspi->phys =3D r->start; =20 spi_irq =3D platform_get_irq(pdev, 0); + if (spi_irq < 0) { + ret =3D spi_irq; + goto exit_free_master; + } tspi->irq =3D spi_irq; =20 tspi->clk =3D devm_clk_get(&pdev->dev, "spi"); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E8C5C4321E for ; Wed, 6 Apr 2022 00:57:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1839006AbiDFA5u (ORCPT ); Tue, 5 Apr 2022 20:57:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59204 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356140AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1988BB8219; Tue, 5 Apr 2022 03:06:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AA41D61777; Tue, 5 Apr 2022 10:06:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF061C385A1; Tue, 5 Apr 2022 10:06:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153199; bh=EagtgJoqyPZf7J5pgJP96eRgqDmMIx2ztSMpC7BaJm4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RwynnHPRs5YlwlbXuyqGBU+37FTZTxbNncEyjGNYCsxfunw+g8hW6nemjZ9ZgviW2 FXrtnWVowruDDU4oWrgnFErQkiN5CFtOsyKhbbhgdUvjuHpc9y8Yy8uy7qeCVYjDAv VsdG6Gx5HEpXpqS3eoJpd26+lC0ljfuYKzAuKy1U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jianyong Wu , Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH 5.10 137/599] arm64/mm: avoid fixmap race condition when create pud mapping Date: Tue, 5 Apr 2022 09:27:11 +0200 Message-Id: <20220405070302.917553358@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jianyong Wu [ Upstream commit ee017ee353506fcec58e481673e4331ff198a80e ] The 'fixmap' is a global resource and is used recursively by create pud mapping(), leading to a potential race condition in the presence of a concurrent call to alloc_init_pud(): kernel_init thread virtio-mem workqueue thread =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D alloc_init_pud(...) alloc_init_pud(...) pudp =3D pud_set_fixmap_offset(...) pudp =3D pud_set_fixmap_offse= t(...) READ_ONCE(*pudp) pud_clear_fixmap(...) READ_ONCE(*pudp) // CRASH! As kernel may sleep during creating pud mapping, introduce a mutex lock to serialise use of the fixmap entries by alloc_init_pud(). However, there is no need for locking in early boot stage and it doesn't work well with KASLR enabled when early boot. So, enable lock when system_state doesn't equal to "SYSTEM_BOOTING". Signed-off-by: Jianyong Wu Reviewed-by: Catalin Marinas Fixes: f4710445458c ("arm64: mm: use fixmap when creating page tables") Link: https://lore.kernel.org/r/20220201114400.56885-1-jianyong.wu@arm.com Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- arch/arm64/mm/mmu.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c index 991e599f7057..a9ec8c739d37 100644 --- a/arch/arm64/mm/mmu.c +++ b/arch/arm64/mm/mmu.c @@ -61,6 +61,7 @@ static pmd_t bm_pmd[PTRS_PER_PMD] __page_aligned_bss __ma= ybe_unused; static pud_t bm_pud[PTRS_PER_PUD] __page_aligned_bss __maybe_unused; =20 static DEFINE_SPINLOCK(swapper_pgdir_lock); +static DEFINE_MUTEX(fixmap_lock); =20 void set_swapper_pgd(pgd_t *pgdp, pgd_t pgd) { @@ -314,6 +315,12 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long = addr, unsigned long end, } BUG_ON(p4d_bad(p4d)); =20 + /* + * No need for locking during early boot. And it doesn't work as + * expected with KASLR enabled. + */ + if (system_state !=3D SYSTEM_BOOTING) + mutex_lock(&fixmap_lock); pudp =3D pud_set_fixmap_offset(p4dp, addr); do { pud_t old_pud =3D READ_ONCE(*pudp); @@ -344,6 +351,8 @@ static void alloc_init_pud(pgd_t *pgdp, unsigned long a= ddr, unsigned long end, } while (pudp++, addr =3D next, addr !=3D end); =20 pud_clear_fixmap(); + if (system_state !=3D SYSTEM_BOOTING) + mutex_unlock(&fixmap_lock); } =20 static void __create_pgd_mapping(pgd_t *pgdir, phys_addr_t phys, --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 90AB6C3527E for ; Tue, 5 Apr 2022 21:09:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1348274AbiDEVJe (ORCPT ); Tue, 5 Apr 2022 17:09:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59282 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356139AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6EA89B82DB; Tue, 5 Apr 2022 03:06:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1B4D3B81BC0; Tue, 5 Apr 2022 10:06:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 698A2C385A2; Tue, 5 Apr 2022 10:06:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153201; bh=Jc+JzbY33FN9h8pyG2ldw03fJ9OJVncRfFwxDY8PMaw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cRcBN7VuWCLHl/tVwMvLnN5CXZElXBW5knDGQCY9lD23YyHSshcrlGzI+LfzoQGis 48khSqBAW5WL83oxXVL2J3SYVGBQqoomWtmgk9CzXCc5pQQSUWOGsaQ9pbNhLpHjpm wtew+7LcKicxRGY85hFPK4N4FeVfTw1EwIZAAgE0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "kernelci.org bot" , Muhammad Usama Anjum , Dave Hansen , Sasha Levin Subject: [PATCH 5.10 138/599] selftests/x86: Add validity check and allow field splitting Date: Tue, 5 Apr 2022 09:27:12 +0200 Message-Id: <20220405070302.948561867@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Muhammad Usama Anjum [ Upstream commit b06e15ebd5bfb670f93c7f11a29b8299c1178bc6 ] Add check to test if CC has a string. CC can have multiple sub-strings like "ccache gcc". Erorr pops up if it is treated as single string and double quotes are used around it. This can be fixed by removing the quotes and not treating CC as a single string. Fixes: e9886ace222e ("selftests, x86: Rework x86 target architecture detect= ion") Reported-by: "kernelci.org bot" Signed-off-by: Muhammad Usama Anjum Signed-off-by: Dave Hansen Link: https://lkml.kernel.org/r/20220214184109.3739179-2-usama.anjum@collab= ora.com Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- tools/testing/selftests/x86/check_cc.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/x86/check_cc.sh b/tools/testing/selfte= sts/x86/check_cc.sh index 3e2089c8cf54..8c669c0d662e 100755 --- a/tools/testing/selftests/x86/check_cc.sh +++ b/tools/testing/selftests/x86/check_cc.sh @@ -7,7 +7,7 @@ CC=3D"$1" TESTPROG=3D"$2" shift 2 =20 -if "$CC" -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then +if [ -n "$CC" ] && $CC -o /dev/null "$TESTPROG" -O0 "$@" 2>/dev/null; then echo 1 else echo 0 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 327ACC4167B for ; Wed, 6 Apr 2022 00:50:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1837749AbiDFArU (ORCPT ); Tue, 5 Apr 2022 20:47:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356143AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9D122B82F0; Tue, 5 Apr 2022 03:06:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3A2F86176C; Tue, 5 Apr 2022 10:06:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 50D42C385A2; Tue, 5 Apr 2022 10:06:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153204; bh=dXBza7TD+YoPMa9zfIkCunjP9xDZ6gtzlNfgpEIYRcc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=X1zS2iT3k/YNOMxNiIdAWK6u1+QsOcMBlj6O7nOff08GtzA4VeIVlpeKLxsXs5JOz FzgWlDWHITpYGsgg+9UwunvAdyKoJZU1I3DFCdNIsBRMHwyT2A+8HjmXWPGNT3eqqk pZez0I7NIGyOObeOQ6NRo3sym5JmTvv3DlLi8rYw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Corentin Labbe , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 139/599] crypto: rockchip - ECB does not need IV Date: Tue, 5 Apr 2022 09:27:13 +0200 Message-Id: <20220405070302.978452967@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Corentin Labbe [ Upstream commit 973d74e93820d99d8ea203882631c76edab699c9 ] When loading rockchip crypto module, testmgr complains that ivsize of ecb-d= es3-ede-rk is not the same than generic implementation. In fact ECB does not use an IV. Fixes: ce0183cb6464b ("crypto: rockchip - switch to skcipher API") Signed-off-by: Corentin Labbe Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/crypto/rockchip/rk3288_crypto_skcipher.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/crypto/rockchip/rk3288_crypto_skcipher.c b/drivers/cry= pto/rockchip/rk3288_crypto_skcipher.c index 1cece1a7d3f0..5bbf0d2722e1 100644 --- a/drivers/crypto/rockchip/rk3288_crypto_skcipher.c +++ b/drivers/crypto/rockchip/rk3288_crypto_skcipher.c @@ -506,7 +506,6 @@ struct rk_crypto_tmp rk_ecb_des3_ede_alg =3D { .exit =3D rk_ablk_exit_tfm, .min_keysize =3D DES3_EDE_KEY_SIZE, .max_keysize =3D DES3_EDE_KEY_SIZE, - .ivsize =3D DES_BLOCK_SIZE, .setkey =3D rk_tdes_setkey, .encrypt =3D rk_des3_ede_ecb_encrypt, .decrypt =3D rk_des3_ede_ecb_decrypt, --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C819EC433F5 for ; Wed, 6 Apr 2022 01:13:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1840965AbiDFBOZ (ORCPT ); Tue, 5 Apr 2022 21:14:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60264 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356145AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 457FEB9192; Tue, 5 Apr 2022 03:06:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D41DA6176C; Tue, 5 Apr 2022 10:06:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7B6FC385A2; Tue, 5 Apr 2022 10:06:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153207; bh=NtlPD9CTty6noCRJOfFwOvQ/dLso2c2lHtPEiGjUHoU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JBWB7Ce4XbnQTDpg3gQIkDmEugntHb2d5WQctQ9Qfl72HkJxO6RgWN3jxJ5Eje2TM ACeGAqrFWs7Jv/nh4wSxxHK5NhMGC0LrQYnuUzsCsKnewMKK/vwWlpugz031tEfMuo kErSGZXC2k8yaYqQcbLp/6mHUsG5AsQpIK2bVjrY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Richard Guy Briggs , Paul Moore , Sasha Levin Subject: [PATCH 5.10 140/599] audit: log AUDIT_TIME_* records only from rules Date: Tue, 5 Apr 2022 09:27:14 +0200 Message-Id: <20220405070303.007776602@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Richard Guy Briggs [ Upstream commit 272ceeaea355214b301530e262a0df8600bfca95 ] AUDIT_TIME_* events are generated when there are syscall rules present that are not related to time keeping. This will produce noisy log entries that could flood the logs and hide events we really care about. Rather than immediately produce the AUDIT_TIME_* records, store the data in the context and log it at syscall exit time respecting the filter rules. Note: This eats the audit_buffer, unlike any others in show_special(). Please see https://bugzilla.redhat.com/show_bug.cgi?id=3D1991919 Fixes: 7e8eda734d30 ("ntp: Audit NTP parameters adjustment") Fixes: 2d87a0674bd6 ("timekeeping: Audit clock adjustments") Signed-off-by: Richard Guy Briggs [PM: fixed style/whitespace issues] Signed-off-by: Paul Moore Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/audit.h | 4 +++ kernel/auditsc.c | 87 +++++++++++++++++++++++++++++++++++++----------- 2 files changed, 71 insertions(+), 20 deletions(-) diff --git a/kernel/audit.h b/kernel/audit.h index 3b9c0945225a..1918019e6aaf 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -191,6 +191,10 @@ struct audit_context { struct { char *name; } module; + struct { + struct audit_ntp_data ntp_data; + struct timespec64 tk_injoffset; + } time; }; int fds[2]; struct audit_proctitle proctitle; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 638f424859ed..07e2788bbbf1 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1214,6 +1214,53 @@ static void audit_log_fcaps(struct audit_buffer *ab,= struct audit_names *name) from_kuid(&init_user_ns, name->fcap.rootid)); } =20 +static void audit_log_time(struct audit_context *context, struct audit_buf= fer **ab) +{ + const struct audit_ntp_data *ntp =3D &context->time.ntp_data; + const struct timespec64 *tk =3D &context->time.tk_injoffset; + static const char * const ntp_name[] =3D { + "offset", + "freq", + "status", + "tai", + "tick", + "adjust", + }; + int type; + + if (context->type =3D=3D AUDIT_TIME_ADJNTPVAL) { + for (type =3D 0; type < AUDIT_NTP_NVALS; type++) { + if (ntp->vals[type].newval !=3D ntp->vals[type].oldval) { + if (!*ab) { + *ab =3D audit_log_start(context, + GFP_KERNEL, + AUDIT_TIME_ADJNTPVAL); + if (!*ab) + return; + } + audit_log_format(*ab, "op=3D%s old=3D%lli new=3D%lli", + ntp_name[type], + ntp->vals[type].oldval, + ntp->vals[type].newval); + audit_log_end(*ab); + *ab =3D NULL; + } + } + } + if (tk->tv_sec !=3D 0 || tk->tv_nsec !=3D 0) { + if (!*ab) { + *ab =3D audit_log_start(context, GFP_KERNEL, + AUDIT_TIME_INJOFFSET); + if (!*ab) + return; + } + audit_log_format(*ab, "sec=3D%lli nsec=3D%li", + (long long)tk->tv_sec, tk->tv_nsec); + audit_log_end(*ab); + *ab =3D NULL; + } +} + static void show_special(struct audit_context *context, int *call_panic) { struct audit_buffer *ab; @@ -1319,6 +1366,11 @@ static void show_special(struct audit_context *conte= xt, int *call_panic) audit_log_format(ab, "(null)"); =20 break; + case AUDIT_TIME_ADJNTPVAL: + case AUDIT_TIME_INJOFFSET: + /* this call deviates from the rest, eating the buffer */ + audit_log_time(context, &ab); + break; } audit_log_end(ab); } @@ -2560,31 +2612,26 @@ void __audit_fanotify(unsigned int response) =20 void __audit_tk_injoffset(struct timespec64 offset) { - audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_INJOFFSET, - "sec=3D%lli nsec=3D%li", - (long long)offset.tv_sec, offset.tv_nsec); -} - -static void audit_log_ntp_val(const struct audit_ntp_data *ad, - const char *op, enum audit_ntp_type type) -{ - const struct audit_ntp_val *val =3D &ad->vals[type]; - - if (val->newval =3D=3D val->oldval) - return; + struct audit_context *context =3D audit_context(); =20 - audit_log(audit_context(), GFP_KERNEL, AUDIT_TIME_ADJNTPVAL, - "op=3D%s old=3D%lli new=3D%lli", op, val->oldval, val->newval); + /* only set type if not already set by NTP */ + if (!context->type) + context->type =3D AUDIT_TIME_INJOFFSET; + memcpy(&context->time.tk_injoffset, &offset, sizeof(offset)); } =20 void __audit_ntp_log(const struct audit_ntp_data *ad) { - audit_log_ntp_val(ad, "offset", AUDIT_NTP_OFFSET); - audit_log_ntp_val(ad, "freq", AUDIT_NTP_FREQ); - audit_log_ntp_val(ad, "status", AUDIT_NTP_STATUS); - audit_log_ntp_val(ad, "tai", AUDIT_NTP_TAI); - audit_log_ntp_val(ad, "tick", AUDIT_NTP_TICK); - audit_log_ntp_val(ad, "adjust", AUDIT_NTP_ADJUST); + struct audit_context *context =3D audit_context(); + int type; + + for (type =3D 0; type < AUDIT_NTP_NVALS; type++) + if (ad->vals[type].newval !=3D ad->vals[type].oldval) { + /* unconditionally set type, overwriting TK */ + context->type =3D AUDIT_TIME_ADJNTPVAL; + memcpy(&context->time.ntp_data, ad, sizeof(*ad)); + break; + } } =20 void __audit_log_nfcfg(const char *name, u8 af, unsigned int nentries, --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1BCFDC433F5 for ; Wed, 6 Apr 2022 01:48:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234838AbiDFBnW (ORCPT ); Tue, 5 Apr 2022 21:43:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57676 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356141AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85F2AB91B0; Tue, 5 Apr 2022 03:06:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 296B0B81BC0; Tue, 5 Apr 2022 10:06:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 97DA0C385A2; Tue, 5 Apr 2022 10:06:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153210; bh=l8H9mNVX3/c3Zvv4QunPOJ64g8VnA9sVr/ivBIz7tgA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BioVvXU6zzXmAE7uRF6V5B7Vsq8GSp5vvsNYsYhfGCsyeWW+a3kVxeLa0wypahbbz kmwXy8mXwex2BZRZ8ApJ8wu+2JvhGzKbWvGSNEcsuXqaLurR34w2ovFGO5H0/Jt7P/ 1/HiMiqZYN2XsFU4U4iofwnVEVuB4xEAJ6KbeVow= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , Mimi Zohar , Sasha Levin Subject: [PATCH 5.10 141/599] EVM: fix the evm= __setup handler return value Date: Tue, 5 Apr 2022 09:27:15 +0200 Message-Id: <20220405070303.038894331@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit f2544f5e6c691679d56bb38637d2f347075b36fa ] __setup() handlers should return 1 if the parameter is handled. Returning 0 causes the entire string to be added to init's environment strings (limited to 32 strings), unnecessarily polluting it. Using the documented string "evm=3Dfix" causes an Unknown parameter message: Unknown kernel command line parameters "BOOT_IMAGE=3D/boot/bzImage-517rc5 evm=3Dfix", will be passed to user spa= ce. and that string is added to init's environment string space: Run /sbin/init as init process with arguments: /sbin/init with environment: HOME=3D/ TERM=3Dlinux BOOT_IMAGE=3D/boot/bzImage-517rc5 evm=3Dfix With this change, using "evm=3Dfix" acts as expected and an invalid option ("evm=3Devm") causes a warning to be printed: evm: invalid "evm" mode but init's environment is not polluted with this string, as expected. Fixes: 7102ebcd65c1 ("evm: permit only valid security.evm xattrs to be upda= ted") Signed-off-by: Randy Dunlap Reported-by: Igor Zhbanov Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Signed-off-by: Mimi Zohar Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- security/integrity/evm/evm_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm= _main.c index b929c683aba1..0033364ac404 100644 --- a/security/integrity/evm/evm_main.c +++ b/security/integrity/evm/evm_main.c @@ -62,7 +62,7 @@ static int __init evm_set_fixmode(char *str) else pr_err("invalid \"%s\" mode", str); =20 - return 0; + return 1; } __setup("evm=3D", evm_set_fixmode); =20 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5753FC433F5 for ; Wed, 6 Apr 2022 02:08:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1846841AbiDFCIs (ORCPT ); Tue, 5 Apr 2022 22:08:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42468 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356146AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 48A2DB91B9; Tue, 5 Apr 2022 03:06:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id F0448B81C86; Tue, 5 Apr 2022 10:06:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6598EC385A2; Tue, 5 Apr 2022 10:06:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153212; bh=m9IdsWkhwEHDsIk1mPp3Sw2dqcl6n6tF8/nLt+2Yvdk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Nd6nxQv+19zHv8YcO1A4c6PQEcbdWePO8R6uH1ipLcyO37loPUHSQoP77H0OcESFl INloMuJTPrx1iNgGlfbKel8Sh8uxHyQ+wN3NOgd6ppb/7/dzhBfDA4daYthg+MQtdc j+3jOEKAlVTlV9VIIpNkUHXYsivCm4jMq7+81OYU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Gilad Ben-Yossef , Corentin Labbe , Herbert Xu , Sasha Levin Subject: [PATCH 5.10 142/599] crypto: ccree - dont attempt 0 len DMA mappings Date: Tue, 5 Apr 2022 09:27:16 +0200 Message-Id: <20220405070303.067867519@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Gilad Ben-Yossef [ Upstream commit 1fb37b5692c915edcc2448a6b37255738c7c77e0 ] Refuse to try mapping zero bytes as this may cause a fault on some configurations / platforms and it seems the prev. attempt is not enough and we need to be more explicit. Signed-off-by: Gilad Ben-Yossef Reported-by: Corentin Labbe Fixes: ce0fc6db38de ("crypto: ccree - protect against empty or NULL scatterlists") Tested-by: Corentin Labbe Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/crypto/ccree/cc_buffer_mgr.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/crypto/ccree/cc_buffer_mgr.c b/drivers/crypto/ccree/cc= _buffer_mgr.c index a5e041d9d2cf..11e0278c8631 100644 --- a/drivers/crypto/ccree/cc_buffer_mgr.c +++ b/drivers/crypto/ccree/cc_buffer_mgr.c @@ -258,6 +258,13 @@ static int cc_map_sg(struct device *dev, struct scatte= rlist *sg, { int ret =3D 0; =20 + if (!nbytes) { + *mapped_nents =3D 0; + *lbytes =3D 0; + *nents =3D 0; + return 0; + } + *nents =3D cc_get_sgl_nents(dev, sg, nbytes, lbytes); if (*nents > max_sg_nents) { *nents =3D 0; --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 363FEC433FE for ; Tue, 5 Apr 2022 23:17:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1574132AbiDEWyf (ORCPT ); Tue, 5 Apr 2022 18:54:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59382 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356144AbiDEKW7 (ORCPT ); Tue, 5 Apr 2022 06:22:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5A5D1BA304; Tue, 5 Apr 2022 03:06:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 03434B81C86; Tue, 5 Apr 2022 10:06:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 42538C385A2; Tue, 5 Apr 2022 10:06:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153215; bh=pgtTMJ3lOChN0sZhtkEWGnw/cn/E2bkd2HKG/XVMGcY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Io+E+qvbUfo87R0h9hCWQpD8RT7LopNftIzdErXeEBf6PZ1xO8BO+FzQGXR/R+Ugt j340dKuqz7pJ2Q138V8+OOSzQVwoLgUMA0vp6TsTIEr9UiHCgSdyS/aeZXPHSRKIkp PZkS44pRav44bZ9jmBp1LH8KAuVIaYEtKgUglm9o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wang Qing , Andy Shevchenko , Mark Brown , Sasha Levin Subject: [PATCH 5.10 143/599] spi: pxa2xx-pci: Balance reference count for PCI DMA device Date: Tue, 5 Apr 2022 09:27:17 +0200 Message-Id: <20220405070303.098160106@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Shevchenko [ Upstream commit 609d7ffdc42199a0ec949db057e3b4be6745d6c5 ] The pci_get_slot() increases its reference count, the caller must decrement the reference count by calling pci_dev_put(). Fixes: 743485ea3bee ("spi: pxa2xx-pci: Do a specific setup in a separate fu= nction") Fixes: 25014521603f ("spi: pxa2xx-pci: Enable DMA for Intel Merrifield") Reported-by: Wang Qing Signed-off-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220223191637.31147-1-andriy.shevchenko@li= nux.intel.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/spi/spi-pxa2xx-pci.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/drivers/spi/spi-pxa2xx-pci.c b/drivers/spi/spi-pxa2xx-pci.c index aafac128bb5f..4eb979a096c7 100644 --- a/drivers/spi/spi-pxa2xx-pci.c +++ b/drivers/spi/spi-pxa2xx-pci.c @@ -74,14 +74,23 @@ static bool lpss_dma_filter(struct dma_chan *chan, void= *param) return true; } =20 +static void lpss_dma_put_device(void *dma_dev) +{ + pci_dev_put(dma_dev); +} + static int lpss_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) { struct pci_dev *dma_dev; + int ret; =20 c->num_chipselect =3D 1; c->max_clk_rate =3D 50000000; =20 dma_dev =3D pci_get_slot(dev->bus, PCI_DEVFN(PCI_SLOT(dev->devfn), 0)); + ret =3D devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); + if (ret) + return ret; =20 if (c->tx_param) { struct dw_dma_slave *slave =3D c->tx_param; @@ -105,8 +114,9 @@ static int lpss_spi_setup(struct pci_dev *dev, struct p= xa_spi_info *c) =20 static int mrfld_spi_setup(struct pci_dev *dev, struct pxa_spi_info *c) { - struct pci_dev *dma_dev =3D pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); struct dw_dma_slave *tx, *rx; + struct pci_dev *dma_dev; + int ret; =20 switch (PCI_FUNC(dev->devfn)) { case 0: @@ -131,6 +141,11 @@ static int mrfld_spi_setup(struct pci_dev *dev, struct= pxa_spi_info *c) return -ENODEV; } =20 + dma_dev =3D pci_get_slot(dev->bus, PCI_DEVFN(21, 0)); + ret =3D devm_add_action_or_reset(&dev->dev, lpss_dma_put_device, dma_dev); + if (ret) + return ret; + tx =3D c->tx_param; tx->dma_dev =3D &dma_dev->dev; =20 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 952BCC43219 for ; Wed, 6 Apr 2022 00:57:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1838650AbiDFA4M (ORCPT ); Tue, 5 Apr 2022 20:56:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60522 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356151AbiDEKXA (ORCPT ); Tue, 5 Apr 2022 06:23:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7FB11BA306; Tue, 5 Apr 2022 03:06:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1E264616E7; Tue, 5 Apr 2022 10:06:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B393C385A1; Tue, 5 Apr 2022 10:06:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153218; bh=gC9mmqjdDsldH0jwpnx+SrEPMbxFmXtb97UEUB0tsx4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GJwBvBYQzSP5ZBfXV8oNcaGoEpVZCQNKLlJ6mjua7P8Pw+IbCgDpWcwPw5Nhwy1dQ zm+D7uVZwrF/vEYfaW+j1BOGrn2ePCONSZE8znCKW0f7k1md8SAhrCX1vX4f3BajFY qGyBv/cd3zUBfhZ+v6lz+8LxHVCFzTY/klJqzTHM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Patrick Rudolph , Marcello Sylvester Bauer , Alan Tull , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 144/599] hwmon: (pmbus) Add mutex to regulator ops Date: Tue, 5 Apr 2022 09:27:18 +0200 Message-Id: <20220405070303.128456382@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Patrick Rudolph [ Upstream commit 686d303ee6301261b422ea51e64833d7909a2c36 ] On PMBUS devices with multiple pages, the regulator ops need to be protected with the update mutex. This prevents accidentally changing the page in a separate thread while operating on the PMBUS_OPERATION register. Tested on Infineon xdpe11280 while a separate thread polls for sensor data. Signed-off-by: Patrick Rudolph Signed-off-by: Marcello Sylvester Bauer Link: https://lore.kernel.org/r/b991506bcbf665f7af185945f70bf9d5cf04637c.16= 45804976.git.sylv@sylv.io Fixes: ddbb4db4ced1b ("hwmon: (pmbus) Add regulator support") Cc: Alan Tull Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hwmon/pmbus/pmbus_core.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_c= ore.c index 71798fde2ef0..7a13057007d9 100644 --- a/drivers/hwmon/pmbus/pmbus_core.c +++ b/drivers/hwmon/pmbus/pmbus_core.c @@ -2255,10 +2255,14 @@ static int pmbus_regulator_is_enabled(struct regula= tor_dev *rdev) { struct device *dev =3D rdev_get_dev(rdev); struct i2c_client *client =3D to_i2c_client(dev->parent); + struct pmbus_data *data =3D i2c_get_clientdata(client); u8 page =3D rdev_get_id(rdev); int ret; =20 + mutex_lock(&data->update_lock); ret =3D pmbus_read_byte_data(client, page, PMBUS_OPERATION); + mutex_unlock(&data->update_lock); + if (ret < 0) return ret; =20 @@ -2269,11 +2273,17 @@ static int _pmbus_regulator_on_off(struct regulator= _dev *rdev, bool enable) { struct device *dev =3D rdev_get_dev(rdev); struct i2c_client *client =3D to_i2c_client(dev->parent); + struct pmbus_data *data =3D i2c_get_clientdata(client); u8 page =3D rdev_get_id(rdev); + int ret; =20 - return pmbus_update_byte_data(client, page, PMBUS_OPERATION, - PB_OPERATION_CONTROL_ON, - enable ? PB_OPERATION_CONTROL_ON : 0); + mutex_lock(&data->update_lock); + ret =3D pmbus_update_byte_data(client, page, PMBUS_OPERATION, + PB_OPERATION_CONTROL_ON, + enable ? PB_OPERATION_CONTROL_ON : 0); + mutex_unlock(&data->update_lock); + + return ret; } =20 static int pmbus_regulator_enable(struct regulator_dev *rdev) --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BC244C352A8 for ; Tue, 5 Apr 2022 21:37:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1382577AbiDEVi7 (ORCPT ); Tue, 5 Apr 2022 17:38:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60252 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356149AbiDEKXA (ORCPT ); Tue, 5 Apr 2022 06:23:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0105EBA30E; Tue, 5 Apr 2022 03:07:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id ABB87B81C98; Tue, 5 Apr 2022 10:07:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F2968C385A2; Tue, 5 Apr 2022 10:07:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153221; bh=twS32qAeCTY/7ABgIeeyA6EBH7JxCA+yeGiHVh5MOYc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uaNMzYDgnuf28LSll95TeeNj95U2saQFV/hfSDEKJLXvZ/XfXbJMCWpJlXoiw2OIw 7MyQXIbPk6vYXt9Pfn/Wpva1TnnRQ0+bNRL6tZtmhZKYM1GgSHldfek1hhtEH28u0B KL7p10L7b3RiulQTvwW+UrLX29t7lWKXfxx9PIbY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guenter Roeck , Armin Wolf , Hans de Goede , Sasha Levin Subject: [PATCH 5.10 145/599] hwmon: (sch56xx-common) Replace WDOG_ACTIVE with WDOG_HW_RUNNING Date: Tue, 5 Apr 2022 09:27:19 +0200 Message-Id: <20220405070303.157959665@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Armin Wolf [ Upstream commit 647d6f09bea7dacf4cdb6d4ea7e3051883955297 ] If the watchdog was already enabled by the BIOS after booting, the watchdog infrastructure needs to regularly send keepalives to prevent a unexpected reset. WDOG_ACTIVE only serves as an status indicator for userspace, we want to use WDOG_HW_RUNNING instead. Since my Fujitsu Esprimo P720 does not support the watchdog, this change is compile-tested only. Suggested-by: Guenter Roeck Fixes: fb551405c0f8 (watchdog: sch56xx: Use watchdog core) Signed-off-by: Armin Wolf Link: https://lore.kernel.org/r/20220131211935.3656-5-W_Armin@gmx.de Reviewed-by: Hans de Goede Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/hwmon/sch56xx-common.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwmon/sch56xx-common.c b/drivers/hwmon/sch56xx-common.c index 6c84780e358e..066b12990fbf 100644 --- a/drivers/hwmon/sch56xx-common.c +++ b/drivers/hwmon/sch56xx-common.c @@ -424,7 +424,7 @@ struct sch56xx_watchdog_data *sch56xx_watchdog_register= (struct device *parent, if (nowayout) set_bit(WDOG_NO_WAY_OUT, &data->wddev.status); if (output_enable & SCH56XX_WDOG_OUTPUT_ENABLE) - set_bit(WDOG_ACTIVE, &data->wddev.status); + set_bit(WDOG_HW_RUNNING, &data->wddev.status); =20 /* Since the watchdog uses a downcounter there is no register to read the BIOS set timeout from (if any was set at all) -> --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 853ACC4167D for ; Tue, 5 Apr 2022 20:40:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235036AbiDEUhP (ORCPT ); Tue, 5 Apr 2022 16:37:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59332 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356150AbiDEKXA (ORCPT ); Tue, 5 Apr 2022 06:23:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BAC8CBA316; Tue, 5 Apr 2022 03:07:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 65FA6B81C98; Tue, 5 Apr 2022 10:07:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4549C385A1; Tue, 5 Apr 2022 10:07:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153224; bh=BcSDo9r3IFVheWMF8RqV0FJSBjYtjvRasfb3M1YVooo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wXnKDTTBAUycApl018fTHgrcjZ9XBdFBP1idxk3RyGf5jhf4YnuCRZ+VDxW3ct98l GW/oh3Wiek/Y+vrE2ooZfwerl7fTaGTqy6c2k8hxtYETrkIeahIJNVgiredmqAbdx3 4rt2CqC1ECJMnYRpINtLoeAvC2w8zELoyQp4B2fI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christoph Hellwig , Keith Busch , Chaitanya Kulkarni , Sasha Levin Subject: [PATCH 5.10 146/599] nvme: cleanup __nvme_check_ids Date: Tue, 5 Apr 2022 09:27:20 +0200 Message-Id: <20220405070303.187179042@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christoph Hellwig [ Upstream commit fd8099e7918cd2df39ef306dd1d1af7178a15b81 ] Pass the actual nvme_ns_ids used for the comparison instead of the ns_head that isn't needed and use a more descriptive function name. Signed-off-by: Christoph Hellwig Reviewed-by: Keith Busch Reviewed-by: Chaitanya Kulkarni Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- drivers/nvme/host/core.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c index 71c85c99e86c..853b9a24f744 100644 --- a/drivers/nvme/host/core.c +++ b/drivers/nvme/host/core.c @@ -3681,16 +3681,15 @@ static struct nvme_ns_head *nvme_find_ns_head(struc= t nvme_subsystem *subsys, return NULL; } =20 -static int __nvme_check_ids(struct nvme_subsystem *subsys, - struct nvme_ns_head *new) +static int nvme_subsys_check_duplicate_ids(struct nvme_subsystem *subsys, + struct nvme_ns_ids *ids) { struct nvme_ns_head *h; =20 lockdep_assert_held(&subsys->lock); =20 list_for_each_entry(h, &subsys->nsheads, entry) { - if (nvme_ns_ids_valid(&new->ids) && - nvme_ns_ids_equal(&new->ids, &h->ids)) + if (nvme_ns_ids_valid(ids) && nvme_ns_ids_equal(ids, &h->ids)) return -EINVAL; } =20 @@ -3724,7 +3723,7 @@ static struct nvme_ns_head *nvme_alloc_ns_head(struct= nvme_ctrl *ctrl, head->ids =3D *ids; kref_init(&head->ref); =20 - ret =3D __nvme_check_ids(ctrl->subsys, head); + ret =3D nvme_subsys_check_duplicate_ids(ctrl->subsys, &head->ids); if (ret) { dev_err(ctrl->device, "duplicate IDs for nsid %d\n", nsid); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D6DE0C4167E for ; Tue, 5 Apr 2022 20:40:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1343886AbiDEUiW (ORCPT ); Tue, 5 Apr 2022 16:38:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58046 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356157AbiDEKXB (ORCPT ); Tue, 5 Apr 2022 06:23:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2F5E2BA328; Tue, 5 Apr 2022 03:07:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D1224B81C98; Tue, 5 Apr 2022 10:07:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4272EC385A1; Tue, 5 Apr 2022 10:07:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153229; bh=eDJaTrxhffV10w/kMeoNpwmv2L902VAwr21OzAVA9Cs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gfZMgpW6Mprj/xL92mTKoO4Yo5GT65sVf90YgeerSAh+u4TsxxjyG96ksfaUxz45N 8k0/XP1Gj2XuQKVkuo7Nf6NLliEp5czdz9uLq2ocIhaiJKcHBIdUwVr6triPmwauqR DV6b/NOpdagEUETZ6HsWi3pZu54k7eCX6gzeSIug= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hannes Reinecke , Bart Van Assche , Eric Biggers , Christoph Hellwig , Jens Axboe , Sasha Levin Subject: [PATCH 5.10 147/599] block: dont delete queue kobject before its children Date: Tue, 5 Apr 2022 09:27:21 +0200 Message-Id: <20220405070303.216643436@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Biggers [ Upstream commit 0f69288253e9fc7c495047720e523b9f1aba5712 ] kobjects aren't supposed to be deleted before their child kobjects are deleted. Apparently this is usually benign; however, a WARN will be triggered if one of the child kobjects has a named attribute group: sysfs group 'modes' not found for kobject 'crypto' WARNING: CPU: 0 PID: 1 at fs/sysfs/group.c:278 sysfs_remove_group+0x72/= 0x80 ... Call Trace: sysfs_remove_groups+0x29/0x40 fs/sysfs/group.c:312 __kobject_del+0x20/0x80 lib/kobject.c:611 kobject_cleanup+0xa4/0x140 lib/kobject.c:696 kobject_release lib/kobject.c:736 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x53/0x70 lib/kobject.c:753 blk_crypto_sysfs_unregister+0x10/0x20 block/blk-crypto-sysfs.c:159 blk_unregister_queue+0xb0/0x110 block/blk-sysfs.c:962 del_gendisk+0x117/0x250 block/genhd.c:610 Fix this by moving the kobject_del() and the corresponding kobject_uevent() to the correct place. Fixes: 2c2086afc2b8 ("block: Protect less code with sysfs_lock in blk_{un,}= register_queue()") Reviewed-by: Hannes Reinecke Reviewed-by: Greg Kroah-Hartman Reviewed-by: Bart Van Assche Signed-off-by: Eric Biggers Reviewed-by: Christoph Hellwig Link: https://lore.kernel.org/r/20220124215938.2769-3-ebiggers@kernel.org Signed-off-by: Jens Axboe Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- block/blk-sysfs.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index b513f1683af0..8c5816364dd1 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -958,15 +958,17 @@ void blk_unregister_queue(struct gendisk *disk) */ if (queue_is_mq(q)) blk_mq_unregister_dev(disk_to_dev(disk), q); - - kobject_uevent(&q->kobj, KOBJ_REMOVE); - kobject_del(&q->kobj); blk_trace_remove_sysfs(disk_to_dev(disk)); =20 mutex_lock(&q->sysfs_lock); if (q->elevator) elv_unregister_queue(q); mutex_unlock(&q->sysfs_lock); + + /* Now that we've deleted all child objects, we can delete the queue. */ + kobject_uevent(&q->kobj, KOBJ_REMOVE); + kobject_del(&q->kobj); + mutex_unlock(&q->sysfs_dir_lock); =20 kobject_put(&disk_to_dev(disk)->kobj); --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2E4C6C4332F for ; Tue, 5 Apr 2022 20:15:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1444234AbiDEUII (ORCPT ); Tue, 5 Apr 2022 16:08:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356161AbiDEKXC (ORCPT ); Tue, 5 Apr 2022 06:23:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 54713BA32B; Tue, 5 Apr 2022 03:07:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E5DCA6172B; Tue, 5 Apr 2022 10:07:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0602FC385A2; Tue, 5 Apr 2022 10:07:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153232; bh=ElByU9jTyxtaqxRWd0JpP6hYFDGkrLID+hTJ/RPQIHM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DVDnYzdE7fOA4oqNaRbPOq0pXpFj+NRNSjVzcl1ZYwepaOycG0bf0IQFhKzRrh/G/ 1vyGDi/aNv63zKqqhCEfDVTb5DMdsGFtJ2Mebe9dRjH18wOGbV4NNSbDY4sowc6r6C tTDbtyCycxV8a7Jft2kb1LH8BXmJAt3S2HV+hjV0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 5.10 148/599] PM: hibernate: fix __setup handler error handling Date: Tue, 5 Apr 2022 09:27:22 +0200 Message-Id: <20220405070303.246857642@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit ba7ffcd4c4da374b0f64666354eeeda7d3827131 ] If an invalid value is used in "resumedelay=3D", it is silently ignored. Add a warning message and then let the __setup handler return 1 to indicate that the kernel command line option has been handled. Fixes: 317cf7e5e85e3 ("PM / hibernate: convert simple_strtoul to kstrtoul") Signed-off-by: Randy Dunlap Reported-by: Igor Zhbanov Link: lore.kernel.org/r/64644a2f-4a20-bab3-1e15-3b2cdd0defe3@omprussia.ru Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin Tested-by: Bagas Sanjaya Tested-by: Florian Fainelli Tested-by: Fox Chen Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Slade Watkins Tested-by: Sudip Mukherjee --- kernel/power/hibernate.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/power/hibernate.c b/kernel/power/hibernate.c index bf640fd6142a..522cb1387462 100644 --- a/kernel/power/hibernate.c +++ b/kernel/power/hibernate.c @@ -1323,7 +1323,7 @@ static int __init resumedelay_setup(char *str) int rc =3D kstrtouint(str, 0, &resume_delay); =20 if (rc) - return rc; + pr_warn("resumedelay: bad option string '%s'\n", str); return 1; } =20 --=20 2.34.1 From nobody Fri Jun 19 09:37:49 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 705B4C35276 for ; Wed, 6 Apr 2022 00:22:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1587689AbiDFAKH (ORCPT ); Tue, 5 Apr 2022 20:10:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59190 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356159AbiDEKXC (ORCPT ); Tue, 5 Apr 2022 06:23:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3A487BA333; Tue, 5 Apr 2022 03:07:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CA4196172B; Tue, 5 Apr 2022 10:07:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C4108C385A1; Tue, 5 Apr 2022 10:07:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1649153235; bh=b8Qd5YjBw56ZuJkM45Vc+wnfV5Hs4Cwi5z4/YAVLJ+M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j9XIr9/+RPVq6lHIbK3Cbp4fSe+cky0tk0lFUH3QLXjXq0Zj3uourPwrys3nArRX6 xj8CoERnZZR6DRhlC3hO856ZqhFcR50No5TFnwIK/r6OEqbfpQrbRkmNcrQttx5NYT Xc+v6YVqFpuFNXUBgBUmu7aGbPZh5LB5ozCW7//4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , Igor Zhbanov , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 5.10 149/599] PM: suspend: fix return value of __setup handler Date: Tue, 5 Apr 2022 09:27:23 +0200 Message-Id: <20220405070303.276849651@linuxfoundation.org> X-Mailer: git-send-email 2.35.1 In-Reply-To: <20220405070258.802373272@linuxfoundation.org> References: <20220405070258.802373272@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit 7a64ca17e4dd50d5f910769167f3553902777844 ] If an invalid option is given for "test_suspend=3D