From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 088A3C433FE for ; Mon, 18 Apr 2022 13:04:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240763AbiDRNHA (ORCPT ); Mon, 18 Apr 2022 09:07:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43290 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240344AbiDRMzK (ORCPT ); Mon, 18 Apr 2022 08:55:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AA336322; Mon, 18 Apr 2022 05:36:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4462B6118A; Mon, 18 Apr 2022 12:36:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38611C385A1; Mon, 18 Apr 2022 12:36:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285406; bh=zH/7jHL6dugySW0mO3c1m2IWKyPePtsE1XQOH3B06Ns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OfYWN+f3r/HygpbJZONm3VfwgXt8THEDwmxGwgoaz1XnwlJkDqRlUxxiqrhPQwsRl Bk8uqOh3IMOsdjikIXvIosCaOuT3zoCeAaX9eOMjBks6oYuDY2GVu7wdeKXQosrz0u zm44JK2ArF09JZZH4vYIVDNCUZLnAknsxPSHXmo0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Felix Kuehling , Philip Yang , Alex Deucher , Lee Jones Subject: [PATCH 5.10 001/105] drm/amdkfd: Use drm_priv to pass VM from KFD to amdgpu Date: Mon, 18 Apr 2022 14:12:03 +0200 Message-Id: <20220418121145.230114351@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Felix Kuehling commit b40a6ab2cf9213923bf8e821ce7fa7f6a0a26990 upstream. amdgpu_amdkfd_gpuvm_alloc_memory_of_gpu needs the drm_priv to allow mmap to access the BO through the corresponding file descriptor. The VM can also be extracted from drm_priv, so drm_priv can replace the vm parameter in the kfd2kgd interface. Signed-off-by: Felix Kuehling Reviewed-by: Philip Yang Signed-off-by: Alex Deucher [This is a partial cherry-pick of the upstream commit.] Signed-off-by: Lee Jones Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gpuvm.c @@ -1024,11 +1024,15 @@ int amdgpu_amdkfd_gpuvm_acquire_process_ struct dma_fence **ef) { struct amdgpu_device *adev =3D get_amdgpu_device(kgd); - struct drm_file *drm_priv =3D filp->private_data; - struct amdgpu_fpriv *drv_priv =3D drm_priv->driver_priv; - struct amdgpu_vm *avm =3D &drv_priv->vm; + struct amdgpu_fpriv *drv_priv; + struct amdgpu_vm *avm; int ret; =20 + ret =3D amdgpu_file_to_fpriv(filp, &drv_priv); + if (ret) + return ret; + avm =3D &drv_priv->vm; + /* Already a compute VM? */ if (avm->process_info) return -EINVAL; From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2FD5CC433EF for ; Mon, 18 Apr 2022 13:13:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241680AbiDRNPy (ORCPT ); Mon, 18 Apr 2022 09:15:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59696 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241439AbiDRM6p (ORCPT ); Mon, 18 Apr 2022 08:58:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 929ED1FA46; Mon, 18 Apr 2022 05:39:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CB3186119B; Mon, 18 Apr 2022 12:39:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BE82EC385A1; Mon, 18 Apr 2022 12:39:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285545; bh=5fViKXH6yIfHBoQAnKXrMdVGEo8QWYU9eBsjCEJYbQg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VhAUN8HfCigBnaUwtmLWpQXRp3rsKq+OaU8xLlZm+wHPM8hBxryymZv8IFdr4Igwj GrYYzBKkTllyGH0otPzim5fkMR5e3d7Bld/N0u+BQyi+qaP7nBdpNeUiwwrwQ+sNxb H1W6whzYw3n2k8KoaDsBv/mUEjjgL4oqOo7zNmyc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , "David S. Miller" , Xu Jia Subject: [PATCH 5.10 002/105] hamradio: defer 6pack kfree after unregister_netdev Date: Mon, 18 Apr 2022 14:12:04 +0200 Message-Id: <20220418121145.301779931@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 0b9111922b1f399aba6ed1e1b8f2079c3da1aed8 upstream. There is a possible race condition (use-after-free) like below (USE) | (FREE) dev_queue_xmit | __dev_queue_xmit | __dev_xmit_skb | sch_direct_xmit | ... xmit_one | netdev_start_xmit | tty_ldisc_kill __netdev_start_xmit | 6pack_close sp_xmit | kfree sp_encaps | | According to the patch "defer ax25 kfree after unregister_netdev", this patch reorder the kfree after the unregister_netdev to avoid the possible UAF as the unregister_netdev() is well synchronized and won't return if there is a running routine. Signed-off-by: Lin Ma Signed-off-by: David S. Miller Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/hamradio/6pack.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -679,9 +679,11 @@ static void sixpack_close(struct tty_str del_timer_sync(&sp->tx_t); del_timer_sync(&sp->resync_t); =20 - /* Free all 6pack frame buffers. */ + /* Free all 6pack frame buffers after unreg. */ kfree(sp->rbuff); kfree(sp->xbuff); + + free_netdev(sp->dev); } =20 /* Perform I/O control on an active 6pack channel. */ From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB656C433FE for ; Mon, 18 Apr 2022 13:08:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241341AbiDRNHm (ORCPT ); Mon, 18 Apr 2022 09:07:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240186AbiDRMzW (ORCPT ); Mon, 18 Apr 2022 08:55:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 55E48326; Mon, 18 Apr 2022 05:36:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E29296118A; Mon, 18 Apr 2022 12:36:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA223C385A1; Mon, 18 Apr 2022 12:36:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285413; bh=gusPdI5m6azWca8aRq+/AWPc9+WzG59tZwE6lZhDC2U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ty6bYvF9Rg/TPtyyyqapW2KiH2tYDCvFn43qx05/1QbAbHtzv0nx72AVY8EGdCB9t /8X4+ub55XU3f7hAZyLY8jAUPsKZF5TrOY068kRaVp+DHCnPR+FRuL6vrDTOuQ03C4 62RcNzFQfXf24ysCDUJ7ZeS7K/2MIHV6iJ2K6mXs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , Jakub Kicinski , Xu Jia Subject: [PATCH 5.10 003/105] hamradio: remove needs_free_netdev to avoid UAF Date: Mon, 18 Apr 2022 14:12:05 +0200 Message-Id: <20220418121145.362837405@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma commit 81b1d548d00bcd028303c4f3150fa753b9b8aa71 upstream. The former patch "defer 6pack kfree after unregister_netdev" reorders the kfree of two buffer after the unregister_netdev to prevent the race condition. It also adds free_netdev() function in sixpack_close(), which is a direct copy from the similar code in mkiss_close(). However, in sixpack driver, the flag needs_free_netdev is set to true in sp_setup(), hence the unregister_netdev() will free the netdev automatically. Therefore, as the sp is netdev_priv, use-after-free occurs. This patch removes the needs_free_netdev =3D true and just let the free_netdev to finish this deallocation task. Fixes: 0b9111922b1f ("hamradio: defer 6pack kfree after unregister_netdev") Signed-off-by: Lin Ma Link: https://lore.kernel.org/r/20211111141402.7551-1-linma@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Xu Jia Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/hamradio/6pack.c | 1 - 1 file changed, 1 deletion(-) --- a/drivers/net/hamradio/6pack.c +++ b/drivers/net/hamradio/6pack.c @@ -311,7 +311,6 @@ static void sp_setup(struct net_device * { /* Finish setting up the DEVICE info. */ dev->netdev_ops =3D &sp_netdev_ops; - dev->needs_free_netdev =3D true; dev->mtu =3D SIXP_MTU; dev->hard_header_len =3D AX25_MAX_HEADER_LEN; dev->header_ops =3D &ax25_header_ops; From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CFEDC4167E for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241630AbiDRNI1 (ORCPT ); Mon, 18 Apr 2022 09:08:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45124 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240377AbiDRMzj (ORCPT ); Mon, 18 Apr 2022 08:55:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7BB392BCA; Mon, 18 Apr 2022 05:37:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4794AB80EDC; Mon, 18 Apr 2022 12:37:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA05CC385A1; Mon, 18 Apr 2022 12:37:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285449; bh=cjgxeclnMlt0Wf4GDnGqD7fbo9ohrM+9rOQvJXfpy14=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sFeSgsz7ZCmRbBMqJk2WFDyF3nCVXqmv7yrpWwK9ebDBLL3P71flimB/EM7Vt9Rod YFc1YI4YvBkVUxG2BmSUncEjh0Bf8ntxfOtLnJe9SfMJV8WxCb7dnZ1eDq07Qa1NvJ mZjyjELcbXD145LuRB+XUW4G3v81W+q9sFQpQug4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudeep Holla , Mario Limonciello , "Rafael J. Wysocki" Subject: [PATCH 5.10 004/105] cpuidle: PSCI: Move the `has_lpi` check to the beginning of the function Date: Mon, 18 Apr 2022 14:12:06 +0200 Message-Id: <20220418121145.434691010@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mario Limonciello commit 01f6c7338ce267959975da65d86ba34f44d54220 upstream. Currently the first thing checked is whether the PCSI cpu_suspend function has been initialized. Another change will be overloading `acpi_processor_ffh_lpi_probe` and calling it sooner. So make the `has_lpi` check the first thing checked to prepare for that change. Reviewed-by: Sudeep Holla Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm64/kernel/cpuidle.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/arch/arm64/kernel/cpuidle.c +++ b/arch/arm64/kernel/cpuidle.c @@ -54,6 +54,9 @@ static int psci_acpi_cpu_init_idle(unsig struct acpi_lpi_state *lpi; struct acpi_processor *pr =3D per_cpu(processors, cpu); =20 + if (unlikely(!pr || !pr->flags.has_lpi)) + return -EINVAL; + /* * If the PSCI cpu_suspend function hook has not been initialized * idle states must not be enabled, so bail out @@ -61,9 +64,6 @@ static int psci_acpi_cpu_init_idle(unsig if (!psci_ops.cpu_suspend) return -EOPNOTSUPP; =20 - if (unlikely(!pr || !pr->flags.has_lpi)) - return -EINVAL; - count =3D pr->power.count - 1; if (count <=3D 0) return -ENODEV; From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95535C4707F for ; Mon, 18 Apr 2022 13:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242564AbiDRNJO (ORCPT ); Mon, 18 Apr 2022 09:09:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240680AbiDRM5m (ORCPT ); Mon, 18 Apr 2022 08:57:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1D8861EACF; Mon, 18 Apr 2022 05:38:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 683AB60FB6; Mon, 18 Apr 2022 12:38:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 77C17C385A7; Mon, 18 Apr 2022 12:38:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285484; bh=umetmjBoZN3k5LTEYhounpHhZT/+4J5l6xef5aPbhLE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=IKev81Q//bLR1SaxmtPHGyuLgAOtXfy/InAKu6BvpZ6Fi+ybwRoAF90Hu84ggMffF Z/y2dkOZJhmu7GrV2jGHuUBskP3j/4jJohzXi9AUGRZsM4IdiSekXFdaHdAEVMgCmK SukoE9U4zYSYrW9229ohme0IKRuBr1OhEYoWRDk4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudeep Holla , Mario Limonciello , "Rafael J. Wysocki" Subject: [PATCH 5.10 005/105] ACPI: processor idle: Check for architectural support for LPI Date: Mon, 18 Apr 2022 14:12:07 +0200 Message-Id: <20220418121145.500350849@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mario Limonciello commit eb087f305919ee8169ad65665610313e74260463 upstream. When `osc_pc_lpi_support_confirmed` is set through `_OSC` and `_LPI` is populated then the cpuidle driver assumes that LPI is fully functional. However currently the kernel only provides architectural support for LPI on ARM. This leads to high power consumption on X86 platforms that otherwise try to enable LPI. So probe whether or not LPI support is implemented before enabling LPI in the kernel. This is done by overloading `acpi_processor_ffh_lpi_probe` to check whether it returns `-EOPNOTSUPP`. It also means that all future implementations of `acpi_processor_ffh_lpi_probe` will need to follow these semantics as well. Reviewed-by: Sudeep Holla Signed-off-by: Mario Limonciello Signed-off-by: Rafael J. Wysocki Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/acpi/processor_idle.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) --- a/drivers/acpi/processor_idle.c +++ b/drivers/acpi/processor_idle.c @@ -1080,6 +1080,11 @@ static int flatten_lpi_states(struct acp return 0; } =20 +int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) +{ + return -EOPNOTSUPP; +} + static int acpi_processor_get_lpi_info(struct acpi_processor *pr) { int ret, i; @@ -1088,6 +1093,11 @@ static int acpi_processor_get_lpi_info(s struct acpi_device *d =3D NULL; struct acpi_lpi_states_array info[2], *tmp, *prev, *curr; =20 + /* make sure our architecture has support */ + ret =3D acpi_processor_ffh_lpi_probe(pr->id); + if (ret =3D=3D -EOPNOTSUPP) + return ret; + if (!osc_pc_lpi_support_confirmed) return -EOPNOTSUPP; =20 @@ -1139,11 +1149,6 @@ static int acpi_processor_get_lpi_info(s return 0; } =20 -int __weak acpi_processor_ffh_lpi_probe(unsigned int cpu) -{ - return -ENODEV; -} - int __weak acpi_processor_ffh_lpi_enter(struct acpi_lpi_state *lpi) { return -ENODEV; From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9BFBDC4167D for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243030AbiDRNJr (ORCPT ); Mon, 18 Apr 2022 09:09:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59742 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241118AbiDRM6Y (ORCPT ); Mon, 18 Apr 2022 08:58:24 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6654F25285; Mon, 18 Apr 2022 05:38:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A52AD611C3; Mon, 18 Apr 2022 12:38:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AB011C385A1; Mon, 18 Apr 2022 12:38:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285518; bh=alNNadNIHsJMErRxsjJ7H63TWrf8fkGrhjMUjwNjWTE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mqewHlt2FJr4CImUyVA4lmeyFQMsi1v4oT8ea5IYLHVL+XPiJsiaE+LjngXjV8rtz fO9ecQPHGicuYN2+ILMYEhmeAdiKRtSFdkaKePAJdWL55gr/AI0ZYfWDz/4ujKYjJW SCGLdn4W42jM3cjr2amhEUOGJKscA2apzVAxWf48= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , David Sterba Subject: [PATCH 5.10 006/105] btrfs: remove unused variable in btrfs_{start,write}_dirty_block_groups() Date: Mon, 18 Apr 2022 14:12:08 +0200 Message-Id: <20220418121145.565055032@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 6d4a6b515c39f1f8763093e0f828959b2fbc2f45 upstream. Clang's version of -Wunused-but-set-variable recently gained support for unary operations, which reveals two unused variables: fs/btrfs/block-group.c:2949:6: error: variable 'num_started' set but not = used [-Werror,-Wunused-but-set-variable] int num_started =3D 0; ^ fs/btrfs/block-group.c:3116:6: error: variable 'num_started' set but not = used [-Werror,-Wunused-but-set-variable] int num_started =3D 0; ^ 2 errors generated. These variables appear to be unused from their introduction, so just remove them to silence the warnings. Fixes: c9dc4c657850 ("Btrfs: two stage dirty block group writeout") Fixes: 1bbc621ef284 ("Btrfs: allow block group cache writeout outside criti= cal section in commit") CC: stable@vger.kernel.org # 5.4+ Link: https://github.com/ClangBuiltLinux/linux/issues/1614 Signed-off-by: Nathan Chancellor Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/block-group.c | 4 ---- 1 file changed, 4 deletions(-) --- a/fs/btrfs/block-group.c +++ b/fs/btrfs/block-group.c @@ -2570,7 +2570,6 @@ int btrfs_start_dirty_block_groups(struc struct btrfs_path *path =3D NULL; LIST_HEAD(dirty); struct list_head *io =3D &cur_trans->io_bgs; - int num_started =3D 0; int loops =3D 0; =20 spin_lock(&cur_trans->dirty_bgs_lock); @@ -2636,7 +2635,6 @@ again: cache->io_ctl.inode =3D NULL; ret =3D btrfs_write_out_cache(trans, cache, path); if (ret =3D=3D 0 && cache->io_ctl.inode) { - num_started++; should_put =3D 0; =20 /* @@ -2737,7 +2735,6 @@ int btrfs_write_dirty_block_groups(struc int should_put; struct btrfs_path *path; struct list_head *io =3D &cur_trans->io_bgs; - int num_started =3D 0; =20 path =3D btrfs_alloc_path(); if (!path) @@ -2795,7 +2792,6 @@ int btrfs_write_dirty_block_groups(struc cache->io_ctl.inode =3D NULL; ret =3D btrfs_write_out_cache(trans, cache, path); if (ret =3D=3D 0 && cache->io_ctl.inode) { - num_started++; should_put =3D 0; list_add_tail(&cache->io_list, io); } else { From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0EA7C3525B for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243330AbiDRNKC (ORCPT ); Mon, 18 Apr 2022 09:10:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59868 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241275AbiDRM6b (ORCPT ); Mon, 18 Apr 2022 08:58:31 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06712275CB; Mon, 18 Apr 2022 05:38:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 58232B80EDD; Mon, 18 Apr 2022 12:38:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F7DAC385A1; Mon, 18 Apr 2022 12:38:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285530; bh=7pljjTtnQK7vSOC4UMs/AsmTYE4EvmJi4DnLDl8Bdgo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kqgN2cCF9d4QE1+4rePZFDQAn+z6Vc5UM67b+KGIEfmo5Qn3M68DMzQ5MImoTh/tH XL8fQjaH7AL6bd7Ja+j2Yme4KREo43wgXhiTxhoqNBQQoM5265RFwLLc5eCARwrPzw DrkLw0lrxPPGbIfZCfYeuTYJ1M6WQR5dC0BMO8a0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rob Clark , Sasha Levin Subject: [PATCH 5.10 007/105] drm/msm: Add missing put_task_struct() in debugfs path Date: Mon, 18 Apr 2022 14:12:09 +0200 Message-Id: <20220418121145.657156428@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rob Clark [ Upstream commit ac3e4f42d5ec459f701743debd9c1ad2f2247402 ] Fixes: 25faf2f2e065 ("drm/msm: Show process names in gem_describe") Signed-off-by: Rob Clark Link: https://lore.kernel.org/r/20220317184550.227991-1-robdclark@gmail.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/msm/msm_gem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c index 819567e40565..9c05bf6c4551 100644 --- a/drivers/gpu/drm/msm/msm_gem.c +++ b/drivers/gpu/drm/msm/msm_gem.c @@ -849,6 +849,7 @@ void msm_gem_describe(struct drm_gem_object *obj, struc= t seq_file *m) get_pid_task(aspace->pid, PIDTYPE_PID); if (task) { comm =3D kstrdup(task->comm, GFP_KERNEL); + put_task_struct(task); } else { comm =3D NULL; } --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F566C35280 for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243858AbiDRNKa (ORCPT ); Mon, 18 Apr 2022 09:10:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59528 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241315AbiDRM6h (ORCPT ); Mon, 18 Apr 2022 08:58:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 12D3D27B3E; Mon, 18 Apr 2022 05:38:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7E300B80EDB; Mon, 18 Apr 2022 12:38:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA657C385A1; Mon, 18 Apr 2022 12:38:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285533; bh=tv4zKBl+I3vxx2xHCn4Ct8zhqbx9Pth5UP2RUme5oVg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Fq9CW8hKpq3SMnzeoEmYyWfI0CTNJYXzMlz62JRvhtlO6smZEcVBBrS9xoTq9AnHZ fRHgMX0/K+3RvvpU8Sff+8G/p7EuxwnWkpODuKAubWxh47eOlL4CETe0F+9AdFdliL 2m+2GY62x3lWeoKcfAML+PT0+1vW0LZCKI6rRi9I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Claudiu Beznea , Krzysztof Kozlowski , Sasha Levin Subject: [PATCH 5.10 008/105] memory: atmel-ebi: Fix missing of_node_put in atmel_ebi_probe Date: Mon, 18 Apr 2022 14:12:10 +0200 Message-Id: <20220418121145.725814242@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 6f296a9665ba5ac68937bf11f96214eb9de81baa ] The device_node pointer is returned by of_parse_phandle() with refcount incremented. We should use of_node_put() on it when done. Fixes: 87108dc78eb8 ("memory: atmel-ebi: Enable the SMC clock if specified") Signed-off-by: Miaoqian Lin Reviewed-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220309110144.22412-1-linmq006@gmail.com Signed-off-by: Krzysztof Kozlowski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/memory/atmel-ebi.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/drivers/memory/atmel-ebi.c b/drivers/memory/atmel-ebi.c index c267283b01fd..e749dcb3ddea 100644 --- a/drivers/memory/atmel-ebi.c +++ b/drivers/memory/atmel-ebi.c @@ -544,20 +544,27 @@ static int atmel_ebi_probe(struct platform_device *pd= ev) smc_np =3D of_parse_phandle(dev->of_node, "atmel,smc", 0); =20 ebi->smc.regmap =3D syscon_node_to_regmap(smc_np); - if (IS_ERR(ebi->smc.regmap)) - return PTR_ERR(ebi->smc.regmap); + if (IS_ERR(ebi->smc.regmap)) { + ret =3D PTR_ERR(ebi->smc.regmap); + goto put_node; + } =20 ebi->smc.layout =3D atmel_hsmc_get_reg_layout(smc_np); - if (IS_ERR(ebi->smc.layout)) - return PTR_ERR(ebi->smc.layout); + if (IS_ERR(ebi->smc.layout)) { + ret =3D PTR_ERR(ebi->smc.layout); + goto put_node; + } =20 ebi->smc.clk =3D of_clk_get(smc_np, 0); if (IS_ERR(ebi->smc.clk)) { - if (PTR_ERR(ebi->smc.clk) !=3D -ENOENT) - return PTR_ERR(ebi->smc.clk); + if (PTR_ERR(ebi->smc.clk) !=3D -ENOENT) { + ret =3D PTR_ERR(ebi->smc.clk); + goto put_node; + } =20 ebi->smc.clk =3D NULL; } + of_node_put(smc_np); ret =3D clk_prepare_enable(ebi->smc.clk); if (ret) return ret; @@ -608,6 +615,10 @@ static int atmel_ebi_probe(struct platform_device *pde= v) } =20 return of_platform_populate(np, NULL, NULL, dev); + +put_node: + of_node_put(smc_np); + return ret; } =20 static __maybe_unused int atmel_ebi_resume(struct device *dev) --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80FE9C47080 for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243820AbiDRNK3 (ORCPT ); Mon, 18 Apr 2022 09:10:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241329AbiDRM6h (ORCPT ); Mon, 18 Apr 2022 08:58:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3ED762717F; Mon, 18 Apr 2022 05:38:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7BE25611C3; Mon, 18 Apr 2022 12:38:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8990BC385A8; Mon, 18 Apr 2022 12:38:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285535; bh=//rKemMVblAt+PsCEdWfARJOYe6AsaUC7cFKFbKkEkE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P+ch2TAoYt2jRrvDf652aOGAh9TGCZWdgFBnp3P8Swv0PqO2X/LV1DysBQUMptCr9 XnspFs7K5TNFkUz+V7s7IO/155xn5N0UcSKwA9ntRJL008Y8HSkO0QTrbONJJwguy0 iSJSX8p2SGNWr5tq/FMoLJudh2Mtyuntm2R8uqW0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cristian Marussi , Sudeep Holla , Sasha Levin Subject: [PATCH 5.10 009/105] firmware: arm_scmi: Fix sorting of retrieved clock rates Date: Mon, 18 Apr 2022 14:12:11 +0200 Message-Id: <20220418121145.823077625@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Cristian Marussi [ Upstream commit 23274739a5b6166f74d8d9cb5243d7bf6b46aab9 ] During SCMI Clock protocol initialization, after having retrieved from the SCMI platform all the available discrete rates for a specific clock, the clock rates array is sorted, unfortunately using a pointer to its end as a base instead of its start, so that sorting does not work. Fix invocation of sort() passing as base a pointer to the start of the retrieved clock rates array. Link: https://lore.kernel.org/r/20220318092813.49283-1-cristian.marussi@arm= .com Fixes: dccec73de91d ("firmware: arm_scmi: Keep the discrete clock rates sor= ted") Signed-off-by: Cristian Marussi Signed-off-by: Sudeep Holla Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/firmware/arm_scmi/clock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/firmware/arm_scmi/clock.c b/drivers/firmware/arm_scmi/= clock.c index 4645677d86f1..a45678cd9b74 100644 --- a/drivers/firmware/arm_scmi/clock.c +++ b/drivers/firmware/arm_scmi/clock.c @@ -202,7 +202,8 @@ scmi_clock_describe_rates_get(const struct scmi_handle = *handle, u32 clk_id, =20 if (rate_discrete && rate) { clk->list.num_rates =3D tot_rate_cnt; - sort(rate, tot_rate_cnt, sizeof(*rate), rate_cmp_func, NULL); + sort(clk->list.rates, tot_rate_cnt, sizeof(*rate), + rate_cmp_func, NULL); } =20 clk->rate_discrete =3D rate_discrete; --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0C05AC4707A for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243391AbiDRNKE (ORCPT ); Mon, 18 Apr 2022 09:10:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59846 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241364AbiDRM6j (ORCPT ); Mon, 18 Apr 2022 08:58:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0511A27CFD; Mon, 18 Apr 2022 05:38:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 60069611D6; Mon, 18 Apr 2022 12:38:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 661B7C385A1; Mon, 18 Apr 2022 12:38:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285538; bh=AVO+MOL+bqK/XmS+YnMfmQ7LUvClj07a1xA0LE9tqAE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MhsXjK/d0ZDa2hA+lJgj8OFGZ3KYtgwnbIvbN/7yBcR1kyTvBuvq1Q7hhh0q9KjWI 74Ip3Bo7CfJ12khRip256CGBTprMDJEmC7pNg8alS47jN9dE0XAFYiO5yhSpF272wC 26zw2DGfpkxm5PN0HDnlfImxooct/7DodEFxMgjU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dragan Simic , Kyle Copperfield , Kieran Bingham , Dan Carpenter , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 5.10 010/105] media: rockchip/rga: do proper error checking in probe Date: Mon, 18 Apr 2022 14:12:12 +0200 Message-Id: <20220418121145.920599451@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kyle Copperfield [ Upstream commit 6150f276073a1480030242a7e006a89e161d6cd6 ] The latest fix for probe error handling contained a typo that causes probing to fail with the following message: rockchip-rga: probe of ff680000.rga failed with error -12 This patch fixes the typo. Fixes: e58430e1d4fd (media: rockchip/rga: fix error handling in probe) Reviewed-by: Dragan Simic Signed-off-by: Kyle Copperfield Reviewed-by: Kieran Bingham Reviewed-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/media/platform/rockchip/rga/rga.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/media/platform/rockchip/rga/rga.c b/drivers/media/plat= form/rockchip/rga/rga.c index 6759091b15e0..d99ea8973b67 100644 --- a/drivers/media/platform/rockchip/rga/rga.c +++ b/drivers/media/platform/rockchip/rga/rga.c @@ -895,7 +895,7 @@ static int rga_probe(struct platform_device *pdev) } rga->dst_mmu_pages =3D (unsigned int *)__get_free_pages(GFP_KERNEL | __GFP_ZERO, 3); - if (rga->dst_mmu_pages) { + if (!rga->dst_mmu_pages) { ret =3D -ENOMEM; goto free_src_pages; } --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1B1F2C3527A for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243439AbiDRNKJ (ORCPT ); Mon, 18 Apr 2022 09:10:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59452 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241397AbiDRM6l (ORCPT ); Mon, 18 Apr 2022 08:58:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0A7D827FF8; Mon, 18 Apr 2022 05:39:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 98CC260FB6; Mon, 18 Apr 2022 12:39:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7AD44C385A1; Mon, 18 Apr 2022 12:39:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285542; bh=RuI6u+OIMxRckoYB0ZZOJmgmVKvMnxAua/PYBTcCYEo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oVK8vrB2S9T3vlhTWc3sPcmBwGdE5B0OFzY72btiKcXkoRSJq/hLaAMf453vUF/jy YEbJDa9FB+zXcyfaI2eMK6+W9K2qfArAhfPt6dWGQ3VIOw3MQM41AoiEfkt0osEZoY w+9cUx7WL7TTLo18RGzRw+tWtkRTTLEEkxHpBpFU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chuck Lever , Sasha Levin Subject: [PATCH 5.10 011/105] SUNRPC: Fix the svc_deferred_event trace class Date: Mon, 18 Apr 2022 14:12:13 +0200 Message-Id: <20220418121145.985862344@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuck Lever [ Upstream commit 4d5004451ab2218eab94a30e1841462c9316ba19 ] Fix a NULL deref crash that occurs when an svc_rqst is deferred while the sunrpc tracing subsystem is enabled. svc_revisit() sets dr->xprt to NULL, so it can't be relied upon in the tracepoint to provide the remote's address. Unfortunately we can't revert the "svc_deferred_class" hunk in commit ece200ddd54b ("sunrpc: Save remote presentation address in svc_xprt for trace events") because there is now a specific check of event format specifiers for unsafe dereferences. The warning that check emits is: event svc_defer_recv has unsafe dereference of argument 1 A "%pISpc" format specifier with a "struct sockaddr *" is indeed flagged by this check. Instead, take the brute-force approach used by the svcrdma_qp_error tracepoint. Convert the dr::addr field into a presentation address in the TP_fast_assign() arm of the trace event, and store that as a string. This fix can be backported to -stable kernels. In the meantime, commit c6ced22997ad ("tracing: Update print fmt check to handle new __get_sockaddr() macro") is now in v5.18, so this wonky fix can be replaced with __sockaddr() and friends properly during the v5.19 merge window. Fixes: ece200ddd54b ("sunrpc: Save remote presentation address in svc_xprt = for trace events") Signed-off-by: Chuck Lever Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/trace/events/sunrpc.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h index 23db248a7fdb..ed1bbac004d5 100644 --- a/include/trace/events/sunrpc.h +++ b/include/trace/events/sunrpc.h @@ -1874,17 +1874,18 @@ DECLARE_EVENT_CLASS(svc_deferred_event, TP_STRUCT__entry( __field(const void *, dr) __field(u32, xid) - __string(addr, dr->xprt->xpt_remotebuf) + __array(__u8, addr, INET6_ADDRSTRLEN + 10) ), =20 TP_fast_assign( __entry->dr =3D dr; __entry->xid =3D be32_to_cpu(*(__be32 *)(dr->args + (dr->xprt_hlen>>2))); - __assign_str(addr, dr->xprt->xpt_remotebuf); + snprintf(__entry->addr, sizeof(__entry->addr) - 1, + "%pISpc", (struct sockaddr *)&dr->addr); ), =20 - TP_printk("addr=3D%s dr=3D%p xid=3D0x%08x", __get_str(addr), __entry->dr, + TP_printk("addr=3D%s dr=3D%p xid=3D0x%08x", __entry->addr, __entry->dr, __entry->xid) ); =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63AE1C433F5 for ; Mon, 18 Apr 2022 13:04:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241279AbiDRNHW (ORCPT ); Mon, 18 Apr 2022 09:07:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42402 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239663AbiDRMzW (ORCPT ); Mon, 18 Apr 2022 08:55:22 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1865239C; Mon, 18 Apr 2022 05:36:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C3863B80EDC; Mon, 18 Apr 2022 12:36:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14720C385A8; Mon, 18 Apr 2022 12:36:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285416; bh=JZ5JxIChZEnQ/fF6cdLs01N7J4uyPKEaiJkgXtZOHdI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0KAhFLwbju7tytqeS7gc268RrYRI2YEzkwJCSQRAWJebgw4u2bMonk55KQ8TMMUaz 6+b0FPqJ/l9GCmwu3HNUoUcG/eWFEwRpl2jpGrmkJzNRbTsgtgas9DTE+Y8H2TQ1LV m7GTDVNyXkhybrpHRjmxIopwubE96KWaHiqQXCPU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vlad Buslov , Jiri Pirko , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 012/105] net/sched: flower: fix parsing of ethertype following VLAN header Date: Mon, 18 Apr 2022 14:12:14 +0200 Message-Id: <20220418121146.082246896@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vlad Buslov [ Upstream commit 2105f700b53c24aa48b65c15652acc386044d26a ] A tc flower filter matching TCA_FLOWER_KEY_VLAN_ETH_TYPE is expected to match the L2 ethertype following the first VLAN header, as confirmed by linked discussion with the maintainer. However, such rule also matches packets that have additional second VLAN header, even though filter has both eth_type and vlan_ethtype set to "ipv4". Looking at the code this seems to be mostly an artifact of the way flower uses flow dissector. First, even though looking at the uAPI eth_type and vlan_ethtype appear like a distinct fields, in flower they are all mapped to the same key->basic.n_proto. Second, flow dissector skips following VLAN header as no keys for FLOW_DISSECTOR_KEY_CVLAN are set and eventually assigns the value of n_proto to last parsed header. With these, such filters ignore any headers present between first VLAN header and first "non magic" header (ipv4 in this case) that doesn't result FLOW_DISSECT_RET_PROTO_AGAIN. Fix the issue by extending flow dissector VLAN key structure with new 'vlan_eth_type' field that matches first ethertype following previously parsed VLAN header. Modify flower classifier to set the new flow_dissector_key_vlan->vlan_eth_type with value obtained from TCA_FLOWER_KEY_VLAN_ETH_TYPE/TCA_FLOWER_KEY_CVLAN_ETH_TYPE uAPIs. Link: https://lore.kernel.org/all/Yjhgi48BpTGh6dig@nanopsycho/ Fixes: 9399ae9a6cb2 ("net_sched: flower: Add vlan support") Fixes: d64efd0926ba ("net/sched: flower: Add supprt for matching on QinQ vl= an headers") Signed-off-by: Vlad Buslov Reviewed-by: Jiri Pirko Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/flow_dissector.h | 2 ++ net/core/flow_dissector.c | 1 + net/sched/cls_flower.c | 18 +++++++++++++----- 3 files changed, 16 insertions(+), 5 deletions(-) diff --git a/include/net/flow_dissector.h b/include/net/flow_dissector.h index cc10b10dc3a1..5eecf4436965 100644 --- a/include/net/flow_dissector.h +++ b/include/net/flow_dissector.h @@ -59,6 +59,8 @@ struct flow_dissector_key_vlan { __be16 vlan_tci; }; __be16 vlan_tpid; + __be16 vlan_eth_type; + u16 padding; }; =20 struct flow_dissector_mpls_lse { diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c index 813c709c61cf..f9baa9b1c77f 100644 --- a/net/core/flow_dissector.c +++ b/net/core/flow_dissector.c @@ -1171,6 +1171,7 @@ bool __skb_flow_dissect(const struct net *net, VLAN_PRIO_MASK) >> VLAN_PRIO_SHIFT; } key_vlan->vlan_tpid =3D saved_vlan_tpid; + key_vlan->vlan_eth_type =3D proto; } =20 fdret =3D FLOW_DISSECT_RET_PROTO_AGAIN; diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c index 8ff6945b9f8f..35ee6d8226e6 100644 --- a/net/sched/cls_flower.c +++ b/net/sched/cls_flower.c @@ -998,6 +998,7 @@ static int fl_set_key_mpls(struct nlattr **tb, static void fl_set_key_vlan(struct nlattr **tb, __be16 ethertype, int vlan_id_key, int vlan_prio_key, + int vlan_next_eth_type_key, struct flow_dissector_key_vlan *key_val, struct flow_dissector_key_vlan *key_mask) { @@ -1016,6 +1017,11 @@ static void fl_set_key_vlan(struct nlattr **tb, } key_val->vlan_tpid =3D ethertype; key_mask->vlan_tpid =3D cpu_to_be16(~0); + if (tb[vlan_next_eth_type_key]) { + key_val->vlan_eth_type =3D + nla_get_be16(tb[vlan_next_eth_type_key]); + key_mask->vlan_eth_type =3D cpu_to_be16(~0); + } } =20 static void fl_set_key_flag(u32 flower_key, u32 flower_mask, @@ -1497,8 +1503,9 @@ static int fl_set_key(struct net *net, struct nlattr = **tb, =20 if (eth_type_vlan(ethertype)) { fl_set_key_vlan(tb, ethertype, TCA_FLOWER_KEY_VLAN_ID, - TCA_FLOWER_KEY_VLAN_PRIO, &key->vlan, - &mask->vlan); + TCA_FLOWER_KEY_VLAN_PRIO, + TCA_FLOWER_KEY_VLAN_ETH_TYPE, + &key->vlan, &mask->vlan); =20 if (tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]) { ethertype =3D nla_get_be16(tb[TCA_FLOWER_KEY_VLAN_ETH_TYPE]); @@ -1506,6 +1513,7 @@ static int fl_set_key(struct net *net, struct nlattr = **tb, fl_set_key_vlan(tb, ethertype, TCA_FLOWER_KEY_CVLAN_ID, TCA_FLOWER_KEY_CVLAN_PRIO, + TCA_FLOWER_KEY_CVLAN_ETH_TYPE, &key->cvlan, &mask->cvlan); fl_set_key_val(tb, &key->basic.n_proto, TCA_FLOWER_KEY_CVLAN_ETH_TYPE, @@ -2861,13 +2869,13 @@ static int fl_dump_key(struct sk_buff *skb, struct = net *net, goto nla_put_failure; =20 if (mask->basic.n_proto) { - if (mask->cvlan.vlan_tpid) { + if (mask->cvlan.vlan_eth_type) { if (nla_put_be16(skb, TCA_FLOWER_KEY_CVLAN_ETH_TYPE, key->basic.n_proto)) goto nla_put_failure; - } else if (mask->vlan.vlan_tpid) { + } else if (mask->vlan.vlan_eth_type) { if (nla_put_be16(skb, TCA_FLOWER_KEY_VLAN_ETH_TYPE, - key->basic.n_proto)) + key->vlan.vlan_eth_type)) goto nla_put_failure; } } --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 374DAC433EF for ; Mon, 18 Apr 2022 13:08:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241297AbiDRNHc (ORCPT ); Mon, 18 Apr 2022 09:07:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42360 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240284AbiDRMze (ORCPT ); Mon, 18 Apr 2022 08:55:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8D98DB13; Mon, 18 Apr 2022 05:37:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A04960F0E; Mon, 18 Apr 2022 12:37:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31522C385A1; Mon, 18 Apr 2022 12:36:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285419; bh=HICm18fGBgWm5KvYF2B2+IFM7Z6WNKps+wXaamPYpck=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L9mxD4qEKOWECZL+3TPOLBUbpSQGw0zmna/pgGejYJ97TjxQKE3hPv8HLTDHHKqZT vEnmgsqd3SKonb+RbcZw0ObjzvFl9Yygpr0dMHqt0DwnojGKDRwzW9oj95OBvmZeJ8 Apx4fmSetG2O7Fvh/XjkKVSZfdmifgiY4S1fDIr0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 013/105] veth: Ensure eth header is in skbs linear part Date: Mon, 18 Apr 2022 14:12:15 +0200 Message-Id: <20220418121146.158734501@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guillaume Nault [ Upstream commit 726e2c5929de841fdcef4e2bf995680688ae1b87 ] After feeding a decapsulated packet to a veth device with act_mirred, skb_headlen() may be 0. But veth_xmit() calls __dev_forward_skb(), which expects at least ETH_HLEN byte of linear data (as __dev_forward_skb2() calls eth_type_trans(), which pulls ETH_HLEN bytes unconditionally). Use pskb_may_pull() to ensure veth_xmit() respects this constraint. kernel BUG at include/linux/skbuff.h:2328! RIP: 0010:eth_type_trans+0xcf/0x140 Call Trace: __dev_forward_skb2+0xe3/0x160 veth_xmit+0x6e/0x250 [veth] dev_hard_start_xmit+0xc7/0x200 __dev_queue_xmit+0x47f/0x520 ? skb_ensure_writable+0x85/0xa0 ? skb_mpls_pop+0x98/0x1c0 tcf_mirred_act+0x442/0x47e [act_mirred] tcf_action_exec+0x86/0x140 fl_classify+0x1d8/0x1e0 [cls_flower] ? dma_pte_clear_level+0x129/0x1a0 ? dma_pte_clear_level+0x129/0x1a0 ? prb_fill_curr_block+0x2f/0xc0 ? skb_copy_bits+0x11a/0x220 __tcf_classify+0x58/0x110 tcf_classify_ingress+0x6b/0x140 __netif_receive_skb_core.constprop.0+0x47d/0xfd0 ? __iommu_dma_unmap_swiotlb+0x44/0x90 __netif_receive_skb_one_core+0x3d/0xa0 netif_receive_skb+0x116/0x170 be_process_rx+0x22f/0x330 [be2net] be_poll+0x13c/0x370 [be2net] __napi_poll+0x2a/0x170 net_rx_action+0x22f/0x2f0 __do_softirq+0xca/0x2a8 __irq_exit_rcu+0xc1/0xe0 common_interrupt+0x83/0xa0 Fixes: e314dbdc1c0d ("[NET]: Virtual ethernet device driver.") Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/veth.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index f7e3eb309a26..5be8ed910553 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -292,7 +292,7 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struc= t net_device *dev) =20 rcu_read_lock(); rcv =3D rcu_dereference(priv->peer); - if (unlikely(!rcv)) { + if (unlikely(!rcv) || !pskb_may_pull(skb, ETH_HLEN)) { kfree_skb(skb); goto drop; } --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA1FFC433F5 for ; Mon, 18 Apr 2022 13:08:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241311AbiDRNHi (ORCPT ); Mon, 18 Apr 2022 09:07:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240289AbiDRMzf (ORCPT ); Mon, 18 Apr 2022 08:55:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 944A5C08; Mon, 18 Apr 2022 05:37:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 29D8DB80EDD; Mon, 18 Apr 2022 12:37:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63AF3C385A7; Mon, 18 Apr 2022 12:37:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285422; bh=ayTuUEaLywRE6bf1Sw9c4Yv0rsafKHY50S9my7OaabA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OGC9Mfqnk0dsSY/a2jHzsBJ95Aqz5G+mgffyaiA5iJDy3P7ho4D/nkirQ9Qo/koct c5CQoKYukPjn22XtQO+ubLuBDz67j/liebVszaJEhND2CX3WGYQsVh2A5JVTRdvE5/ lVFuAEwK9WsMJjqWnh8es9XS0WMK8tgUAzt14rSM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Linus Torvalds , Andy Shevchenko , Sasha Levin Subject: [PATCH 5.10 014/105] gpiolib: acpi: use correct format characters Date: Mon, 18 Apr 2022 14:12:16 +0200 Message-Id: <20220418121146.252530654@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds [ Upstream commit 213d266ebfb1621aab79cfe63388facc520a1381 ] When compiling with -Wformat, clang emits the following warning: gpiolib-acpi.c:393:4: warning: format specifies type 'unsigned char' but = the argument has type 'int' [-Wformat] pin); ^~~ So warning that '%hhX' is paired with an 'int' is all just completely mindless and wrong. Sadly, I can see a different bogus warning reason why people would want to use '%02hhX'. Again, the *sane* thing from a human perspective is to use '%02X. But if the compiler doesn't do any range analysis at all, it could decide that "Oh, that print format could need up to 8 bytes of space in the result". Using '%02hhX' would cut that down to two. And since we use char ev_name[5]; and currently use "_%c%02hhX" as the format string, even a compiler that doesn't notice that "pin <=3D 255" test that guards this all will go "OK, that's at most 4 bytes and the final NUL termination, so it's fine". While a compiler - like gcc - that only sees that the original source of the 'pin' value is a 'unsigned short' array, and then doesn't take the "pin <=3D 255" into account, will warn like this: gpiolib-acpi.c: In function 'acpi_gpiochip_request_interrupt': gpiolib-acpi.c:206:24: warning: '%02X' directive writing between 2 and 4 = bytes into a region of size 3 [-Wformat-overflow=3D] sprintf(ev_name, "_%c%02X", ^~~~ gpiolib-acpi.c:206:20: note: directive argument in the range [0, 65535] because gcc isn't being very good at that argument range analysis either. In other words, the original use of 'hhx' was bogus to begin with, and due to *another* compiler warning being bad, and we had that bad code being written back in 2016 to work around _that_ compiler warning (commit e40a3ae1f794: "gpio: acpi: work around false-positive -Wstring-overflow warning"). Sadly, two different bad compiler warnings together does not make for one good one. It just makes for even more pain. End result: I think the simplest and cleanest option is simply the proposed change which undoes that '%hhX' change for gcc, and replaces it with just using a slightly bigger stack allocation. It's not like a 5-byte allocation is in any way likely to have saved any actual stack, since all the other variables in that function are 'int' or bigger. False-positive compiler warnings really do make people write worse code, and that's a problem. But on a scale of bad code, I feel that extending the buffer trivially is better than adding a pointless cast that literally makes no sense. At least in this case the end result isn't unreadable or buggy. We've had several cases of bad compiler warnings that caused changes that were actually horrendously wrong. Fixes: e40a3ae1f794 ("gpio: acpi: work around false-positive -Wstring-overf= low warning") Signed-off-by: Linus Torvalds Signed-off-by: Andy Shevchenko Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpio/gpiolib-acpi.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c index 55e4f402ec8b..44ee319da1b3 100644 --- a/drivers/gpio/gpiolib-acpi.c +++ b/drivers/gpio/gpiolib-acpi.c @@ -276,8 +276,8 @@ static acpi_status acpi_gpiochip_alloc_event(struct acp= i_resource *ares, pin =3D agpio->pin_table[0]; =20 if (pin <=3D 255) { - char ev_name[5]; - sprintf(ev_name, "_%c%02hhX", + char ev_name[8]; + sprintf(ev_name, "_%c%02X", agpio->triggering =3D=3D ACPI_EDGE_SENSITIVE ? 'E' : 'L', pin); if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle))) --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6AAE0C43219 for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241485AbiDRNH7 (ORCPT ); Mon, 18 Apr 2022 09:07:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240301AbiDRMzf (ORCPT ); Mon, 18 Apr 2022 08:55:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1E802C33; Mon, 18 Apr 2022 05:37:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9D51D6118A; Mon, 18 Apr 2022 12:37:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8EB02C385A1; Mon, 18 Apr 2022 12:37:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285426; bh=nWwJ6lfcdJvL3BYIz9PfXu+uR1ljjGZ1e0ba5xvWYrA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Sf0s8qHkDfRy6hCnjNk+pOfVqItO95DwRsL1AikYbtk6DS0nh4/dpRch67YhH5QAL 8O2/PGzAyo/W0BjYsSAs3gzthqiDJJcWbmLGrx+W+D0IBjZ8faFtJ7AU8DrHi9RuQo pex+OFFCk3M9p7iPGL3AjZb4IfBndhDEp0VSIItI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Calvin Johnson , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 015/105] net: mdio: Alphabetically sort header inclusion Date: Mon, 18 Apr 2022 14:12:17 +0200 Message-Id: <20220418121146.321642135@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Calvin Johnson [ Upstream commit 1bf343665057312167750509b0c48e8299293ac5 ] Alphabetically sort header inclusion Signed-off-by: Calvin Johnson Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/mdio/mdio-bcm-unimac.c | 16 +++++++--------- drivers/net/mdio/mdio-bitbang.c | 4 ++-- drivers/net/mdio/mdio-cavium.c | 2 +- drivers/net/mdio/mdio-gpio.c | 10 +++++----- drivers/net/mdio/mdio-ipq4019.c | 4 ++-- drivers/net/mdio/mdio-ipq8064.c | 4 ++-- drivers/net/mdio/mdio-mscc-miim.c | 8 ++++---- drivers/net/mdio/mdio-mux-bcm-iproc.c | 10 +++++----- drivers/net/mdio/mdio-mux-gpio.c | 8 ++++---- drivers/net/mdio/mdio-mux-mmioreg.c | 6 +++--- drivers/net/mdio/mdio-mux-multiplexer.c | 2 +- drivers/net/mdio/mdio-mux.c | 6 +++--- drivers/net/mdio/mdio-octeon.c | 8 ++++---- drivers/net/mdio/mdio-thunder.c | 10 +++++----- drivers/net/mdio/mdio-xgene.c | 6 +++--- drivers/net/mdio/of_mdio.c | 10 +++++----- 16 files changed, 56 insertions(+), 58 deletions(-) diff --git a/drivers/net/mdio/mdio-bcm-unimac.c b/drivers/net/mdio/mdio-bcm= -unimac.c index fbd36891ee64..5d171e7f118d 100644 --- a/drivers/net/mdio/mdio-bcm-unimac.c +++ b/drivers/net/mdio/mdio-bcm-unimac.c @@ -5,20 +5,18 @@ * Copyright (C) 2014-2017 Broadcom */ =20 +#include +#include +#include #include -#include -#include -#include #include -#include -#include -#include - #include -#include #include - +#include +#include #include +#include +#include =20 #define MDIO_CMD 0x00 #define MDIO_START_BUSY (1 << 29) diff --git a/drivers/net/mdio/mdio-bitbang.c b/drivers/net/mdio/mdio-bitban= g.c index 5136275c8e73..99588192cc78 100644 --- a/drivers/net/mdio/mdio-bitbang.c +++ b/drivers/net/mdio/mdio-bitbang.c @@ -14,10 +14,10 @@ * Vitaly Bordug */ =20 -#include +#include #include +#include #include -#include =20 #define MDIO_READ 2 #define MDIO_WRITE 1 diff --git a/drivers/net/mdio/mdio-cavium.c b/drivers/net/mdio/mdio-cavium.c index 1afd6fc1a351..95ce274c1be1 100644 --- a/drivers/net/mdio/mdio-cavium.c +++ b/drivers/net/mdio/mdio-cavium.c @@ -4,9 +4,9 @@ */ =20 #include +#include #include #include -#include =20 #include "mdio-cavium.h" =20 diff --git a/drivers/net/mdio/mdio-gpio.c b/drivers/net/mdio/mdio-gpio.c index 1b00235d7dc5..56c8f914f893 100644 --- a/drivers/net/mdio/mdio-gpio.c +++ b/drivers/net/mdio/mdio-gpio.c @@ -17,15 +17,15 @@ * Vitaly Bordug */ =20 -#include -#include +#include #include -#include -#include #include #include -#include +#include #include +#include +#include +#include =20 struct mdio_gpio_info { struct mdiobb_ctrl ctrl; diff --git a/drivers/net/mdio/mdio-ipq4019.c b/drivers/net/mdio/mdio-ipq401= 9.c index 25c25ea6da66..9cd71d896963 100644 --- a/drivers/net/mdio/mdio-ipq4019.c +++ b/drivers/net/mdio/mdio-ipq4019.c @@ -3,10 +3,10 @@ /* Copyright (c) 2020 Sartura Ltd. */ =20 #include -#include -#include #include #include +#include +#include #include #include #include diff --git a/drivers/net/mdio/mdio-ipq8064.c b/drivers/net/mdio/mdio-ipq806= 4.c index f0a6bfa61645..49d4e9aa30bb 100644 --- a/drivers/net/mdio/mdio-ipq8064.c +++ b/drivers/net/mdio/mdio-ipq8064.c @@ -7,12 +7,12 @@ =20 #include #include +#include #include -#include #include #include #include -#include +#include =20 /* MII address register definitions */ #define MII_ADDR_REG_ADDR 0x10 diff --git a/drivers/net/mdio/mdio-mscc-miim.c b/drivers/net/mdio/mdio-mscc= -miim.c index 1c9232fca1e2..037649bef92e 100644 --- a/drivers/net/mdio/mdio-mscc-miim.c +++ b/drivers/net/mdio/mdio-mscc-miim.c @@ -6,14 +6,14 @@ * Copyright (c) 2017 Microsemi Corporation */ =20 -#include -#include -#include -#include #include #include #include +#include +#include #include +#include +#include =20 #define MSCC_MIIM_REG_STATUS 0x0 #define MSCC_MIIM_STATUS_STAT_PENDING BIT(2) diff --git a/drivers/net/mdio/mdio-mux-bcm-iproc.c b/drivers/net/mdio/mdio-= mux-bcm-iproc.c index 42fb5f166136..641cfa41f492 100644 --- a/drivers/net/mdio/mdio-mux-bcm-iproc.c +++ b/drivers/net/mdio/mdio-mux-bcm-iproc.c @@ -3,14 +3,14 @@ * Copyright 2016 Broadcom */ #include -#include +#include #include -#include +#include +#include #include +#include #include -#include -#include -#include +#include =20 #define MDIO_RATE_ADJ_EXT_OFFSET 0x000 #define MDIO_RATE_ADJ_INT_OFFSET 0x004 diff --git a/drivers/net/mdio/mdio-mux-gpio.c b/drivers/net/mdio/mdio-mux-g= pio.c index 10a758fdc9e6..3c7f16f06b45 100644 --- a/drivers/net/mdio/mdio-mux-gpio.c +++ b/drivers/net/mdio/mdio-mux-gpio.c @@ -3,13 +3,13 @@ * Copyright (C) 2011, 2012 Cavium, Inc. */ =20 -#include #include -#include +#include +#include #include +#include #include -#include -#include +#include =20 #define DRV_VERSION "1.1" #define DRV_DESCRIPTION "GPIO controlled MDIO bus multiplexer driver" diff --git a/drivers/net/mdio/mdio-mux-mmioreg.c b/drivers/net/mdio/mdio-mu= x-mmioreg.c index d1a8780e24d8..c02fb2a067ee 100644 --- a/drivers/net/mdio/mdio-mux-mmioreg.c +++ b/drivers/net/mdio/mdio-mux-mmioreg.c @@ -7,13 +7,13 @@ * Copyright 2012 Freescale Semiconductor, Inc. */ =20 -#include #include +#include +#include #include #include -#include #include -#include +#include =20 struct mdio_mux_mmioreg_state { void *mux_handle; diff --git a/drivers/net/mdio/mdio-mux-multiplexer.c b/drivers/net/mdio/mdi= o-mux-multiplexer.c index d6564381aa3e..527acfc3c045 100644 --- a/drivers/net/mdio/mdio-mux-multiplexer.c +++ b/drivers/net/mdio/mdio-mux-multiplexer.c @@ -4,10 +4,10 @@ * Copyright 2019 NXP */ =20 -#include #include #include #include +#include =20 struct mdio_mux_multiplexer_state { struct mux_control *muxc; diff --git a/drivers/net/mdio/mdio-mux.c b/drivers/net/mdio/mdio-mux.c index ccb3ee704eb1..3dde0c2b3e09 100644 --- a/drivers/net/mdio/mdio-mux.c +++ b/drivers/net/mdio/mdio-mux.c @@ -3,12 +3,12 @@ * Copyright (C) 2011, 2012 Cavium, Inc. */ =20 -#include -#include -#include #include +#include #include +#include #include +#include =20 #define DRV_DESCRIPTION "MDIO bus multiplexer driver" =20 diff --git a/drivers/net/mdio/mdio-octeon.c b/drivers/net/mdio/mdio-octeon.c index 6faf39314ac9..e096e68ac667 100644 --- a/drivers/net/mdio/mdio-octeon.c +++ b/drivers/net/mdio/mdio-octeon.c @@ -3,13 +3,13 @@ * Copyright (C) 2009-2015 Cavium, Inc. */ =20 -#include +#include +#include +#include #include #include -#include -#include #include -#include +#include =20 #include "mdio-cavium.h" =20 diff --git a/drivers/net/mdio/mdio-thunder.c b/drivers/net/mdio/mdio-thunde= r.c index dd7430c998a2..822d2cdd2f35 100644 --- a/drivers/net/mdio/mdio-thunder.c +++ b/drivers/net/mdio/mdio-thunder.c @@ -3,14 +3,14 @@ * Copyright (C) 2009-2016 Cavium, Inc. */ =20 -#include -#include -#include +#include #include -#include #include -#include +#include +#include +#include #include +#include =20 #include "mdio-cavium.h" =20 diff --git a/drivers/net/mdio/mdio-xgene.c b/drivers/net/mdio/mdio-xgene.c index 461207cdf5d6..7ab4e26db08c 100644 --- a/drivers/net/mdio/mdio-xgene.c +++ b/drivers/net/mdio/mdio-xgene.c @@ -13,11 +13,11 @@ #include #include #include -#include -#include #include -#include +#include +#include #include +#include #include =20 static bool xgene_mdio_status; diff --git a/drivers/net/mdio/of_mdio.c b/drivers/net/mdio/of_mdio.c index 4daf94bb56a5..ea0bf13e8ac3 100644 --- a/drivers/net/mdio/of_mdio.c +++ b/drivers/net/mdio/of_mdio.c @@ -8,17 +8,17 @@ * out of the OpenFirmware device tree and using it to populate an mii_bus. */ =20 -#include #include -#include #include -#include -#include +#include +#include +#include #include #include #include #include -#include +#include +#include =20 #define DEFAULT_GPIO_RESET_DELAY 10 /* in microseconds */ =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C669C43217 for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241434AbiDRNH4 (ORCPT ); Mon, 18 Apr 2022 09:07:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240296AbiDRMzf (ORCPT ); Mon, 18 Apr 2022 08:55:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCA37FB; Mon, 18 Apr 2022 05:37:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 98B6BB80EDC; Mon, 18 Apr 2022 12:37:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A180CC385A7; Mon, 18 Apr 2022 12:37:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285429; bh=lPXSw59v08NPSWuDxS3W0dFUB6XP8tMGUG8g+kBOXB8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yPf8s2OAJUI7XOCFR3bdiK6J3xT5+V8uwszWDbgCl11785z+vl49VckQNfgX+hiFE HOrQk4ZiFRfzW28rbkpNj+2/CrHsEW6okOiqCBUd/iXxOfB++Zx36Iaz2gb4XUPoJa WQbbytQs+/DjgiWn5pv1xgQJfx+FhFL3uuuk+soo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vadim Pasternak , Ido Schimmel , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 016/105] mlxsw: i2c: Fix initialization error flow Date: Mon, 18 Apr 2022 14:12:18 +0200 Message-Id: <20220418121146.386580868@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Vadim Pasternak [ Upstream commit d452088cdfd5a4ad9d96d847d2273fe958d6339b ] Add mutex_destroy() call in driver initialization error flow. Fixes: 6882b0aee180f ("mlxsw: Introduce support for I2C bus") Signed-off-by: Vadim Pasternak Signed-off-by: Ido Schimmel Link: https://lore.kernel.org/r/20220407070703.2421076-1-idosch@nvidia.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/mellanox/mlxsw/i2c.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/mellanox/mlxsw/i2c.c b/drivers/net/ethern= et/mellanox/mlxsw/i2c.c index 939b692ffc33..ce843ea91464 100644 --- a/drivers/net/ethernet/mellanox/mlxsw/i2c.c +++ b/drivers/net/ethernet/mellanox/mlxsw/i2c.c @@ -650,6 +650,7 @@ static int mlxsw_i2c_probe(struct i2c_client *client, return 0; =20 errout: + mutex_destroy(&mlxsw_i2c->cmd.lock); i2c_set_clientdata(client, NULL); =20 return err; --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 79BFFC4167B for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241553AbiDRNIJ (ORCPT ); Mon, 18 Apr 2022 09:08:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42366 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240293AbiDRMzf (ORCPT ); Mon, 18 Apr 2022 08:55:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 57F661CA; Mon, 18 Apr 2022 05:37:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E83DB60FB6; Mon, 18 Apr 2022 12:37:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E4CA1C385A1; Mon, 18 Apr 2022 12:37:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285432; bh=WD4iaRL10tmK8wqJABIYPrj6QsBjPpiJ24L2xP1XoJs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YAxY1NmlDMNSYiwCH3Nooq1MB6WaJsIpKCQAmXUcJuVMHP3k406ifbxNbUckqM2am +rlXlXlbcvG7REo8U0+0mfm/KVZ8UCGKBiKSZWLgDLKMgpC2zfmfug41JxoW/DcAFC zRl3M3TC5oLXU4+LbFTBqxnYNwFWbupiBQPHDjbQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcelo Ricardo Leitner , Vlad Buslov , Davide Caratti , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 017/105] net/sched: fix initialization order when updating chain 0 head Date: Mon, 18 Apr 2022 14:12:19 +0200 Message-Id: <20220418121146.459866104@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marcelo Ricardo Leitner [ Upstream commit e65812fd22eba32f11abe28cb377cbd64cfb1ba0 ] Currently, when inserting a new filter that needs to sit at the head of chain 0, it will first update the heads pointer on all devices using the (shared) block, and only then complete the initialization of the new element so that it has a "next" element. This can lead to a situation that the chain 0 head is propagated to another CPU before the "next" initialization is done. When this race condition is triggered, packets being matched on that CPU will simply miss all other filters, and will flow through the stack as if there were no other filters installed. If the system is using OVS + TC, such packets will get handled by vswitchd via upcall, which results in much higher latency and reordering. For other applications it may result in packet drops. This is reproducible with a tc only setup, but it varies from system to system. It could be reproduced with a shared block amongst 10 veth tunnels, and an ingress filter mirroring packets to another veth. That's because using the last added veth tunnel to the shared block to do the actual traffic, it makes the race window bigger and easier to trigger. The fix is rather simple, to just initialize the next pointer of the new filter instance (tp) before propagating the head change. The fixes tag is pointing to the original code though this issue should only be observed when using it unlocked. Fixes: 2190d1d0944f ("net: sched: introduce helpers to work with filter cha= ins") Signed-off-by: Marcelo Ricardo Leitner Signed-off-by: Vlad Buslov Reviewed-by: Davide Caratti Link: https://lore.kernel.org/r/b97d5f4eaffeeb9d058155bcab63347527261abf.16= 49341369.git.marcelo.leitner@gmail.com Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sched/cls_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 9a789a057a74..b8ffb7e4f696 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -1656,10 +1656,10 @@ static int tcf_chain_tp_insert(struct tcf_chain *ch= ain, if (chain->flushing) return -EAGAIN; =20 + RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain, chain_info)); if (*chain_info->pprev =3D=3D chain->filter_chain) tcf_chain0_head_change(chain, tp); tcf_proto_get(tp); - RCU_INIT_POINTER(tp->next, tcf_chain_tp_prev(chain, chain_info)); rcu_assign_pointer(*chain_info->pprev, tp); =20 return 0; --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 16EB0C433EF for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241365AbiDRNHs (ORCPT ); Mon, 18 Apr 2022 09:07:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42400 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240307AbiDRMzf (ORCPT ); Mon, 18 Apr 2022 08:55:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 00EE827E; Mon, 18 Apr 2022 05:37:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8C65060F0E; Mon, 18 Apr 2022 12:37:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 682E6C385A1; Mon, 18 Apr 2022 12:37:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285436; bh=DaIqp4KOEnuHyjbsNf5zxoE442cHCX9vE9WYiWHfmzo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b96tF7SppydCDr4HWZ4JB1+EByTdL47YIoNSn73eeEl++odGUhiKXXB2QxBSFWuje Gb3jdpPG3pdKsY8/4T9VC8PrSOmVg3vzxNRK5dpxLeUwa3qhlv1SCsuNbrwhJpCp95 Rj5c8B0lkm0aaNyihZkaSf89nlUngixAKE0ryB98= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Walle , Vladimir Oltean , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 018/105] net: dsa: felix: suppress -EPROBE_DEFER errors Date: Mon, 18 Apr 2022 14:12:20 +0200 Message-Id: <20220418121146.514628290@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Walle [ Upstream commit e6934e4048c91502efcb21da92b7ae37cd8fa741 ] The DSA master might not have been probed yet in which case the probe of the felix switch fails with -EPROBE_DEFER: [ 4.435305] mscc_felix 0000:00:00.5: Failed to register DSA switch: -517 It is not an error. Use dev_err_probe() to demote this particular error to a debug message. Fixes: 56051948773e ("net: dsa: ocelot: add driver for Felix switch family") Signed-off-by: Michael Walle Reviewed-by: Vladimir Oltean Link: https://lore.kernel.org/r/20220408101521.281886-1-michael@walle.cc Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/dsa/ocelot/felix_vsc9959.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/dsa/ocelot/felix_vsc9959.c b/drivers/net/dsa/ocelo= t/felix_vsc9959.c index cd8d9b0e0edb..c96dfc11aa6f 100644 --- a/drivers/net/dsa/ocelot/felix_vsc9959.c +++ b/drivers/net/dsa/ocelot/felix_vsc9959.c @@ -1466,7 +1466,7 @@ static int felix_pci_probe(struct pci_dev *pdev, =20 err =3D dsa_register_switch(ds); if (err) { - dev_err(&pdev->dev, "Failed to register DSA switch: %d\n", err); + dev_err_probe(&pdev->dev, err, "Failed to register DSA switch\n"); goto err_register_ds; } =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35C70C4332F for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241406AbiDRNHx (ORCPT ); Mon, 18 Apr 2022 09:07:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240320AbiDRMzf (ORCPT ); Mon, 18 Apr 2022 08:55:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85685BB8; Mon, 18 Apr 2022 05:37:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 247066119B; Mon, 18 Apr 2022 12:37:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC941C385A7; Mon, 18 Apr 2022 12:37:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285439; bh=wLJ/DC32A5+B2P/ZG4v9x8erR2BC+5mrdsXVZbjlQ2g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zrgMKGLckp2tACZzR415plVFLVp4zEuup8s6VrEICEi19DcKlMkUYJB8wAk8jwPvF zBjC9eLMBp3lcbLB1tFGplzWuKP6u9Q0NuUJwW80KBEO87ZO78bJPRL+qdsIEatZpE Vuq6rteDMdfP0CrHHU7TpEfICUeWeeXC/9QLXYDQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dinh Nguyen , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 019/105] net: ethernet: stmmac: fix altr_tse_pcs function when using a fixed-link Date: Mon, 18 Apr 2022 14:12:21 +0200 Message-Id: <20220418121146.572357322@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dinh Nguyen [ Upstream commit a6aaa00324240967272b451bfa772547bd576ee6 ] When using a fixed-link, the altr_tse_pcs driver crashes due to null-pointer dereference as no phy_device is provided to tse_pcs_fix_mac_speed function. Fix this by adding a check for phy_dev before calling the tse_pcs_fix_mac_speed() function. Also clean up the tse_pcs_fix_mac_speed function a bit. There is no need to check for splitter_base and sgmii_adapter_base because the driver will fail if these 2 variables are not derived from the device tree. Fixes: fb3bbdb85989 ("net: ethernet: Add TSE PCS support to dwmac-socfpga") Signed-off-by: Dinh Nguyen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c | 8 -------- drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h | 4 ++++ drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c | 13 +++++-------- 3 files changed, 9 insertions(+), 16 deletions(-) diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c b/drivers/n= et/ethernet/stmicro/stmmac/altr_tse_pcs.c index cd478d2cd871..00f6d347eaf7 100644 --- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c +++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.c @@ -57,10 +57,6 @@ #define TSE_PCS_USE_SGMII_ENA BIT(0) #define TSE_PCS_IF_USE_SGMII 0x03 =20 -#define SGMII_ADAPTER_CTRL_REG 0x00 -#define SGMII_ADAPTER_DISABLE 0x0001 -#define SGMII_ADAPTER_ENABLE 0x0000 - #define AUTONEGO_LINK_TIMER 20 =20 static int tse_pcs_reset(void __iomem *base, struct tse_pcs *pcs) @@ -202,12 +198,8 @@ void tse_pcs_fix_mac_speed(struct tse_pcs *pcs, struct= phy_device *phy_dev, unsigned int speed) { void __iomem *tse_pcs_base =3D pcs->tse_pcs_base; - void __iomem *sgmii_adapter_base =3D pcs->sgmii_adapter_base; u32 val; =20 - writew(SGMII_ADAPTER_ENABLE, - sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); - pcs->autoneg =3D phy_dev->autoneg; =20 if (phy_dev->autoneg =3D=3D AUTONEG_ENABLE) { diff --git a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h b/drivers/n= et/ethernet/stmicro/stmmac/altr_tse_pcs.h index 442812c0a4bd..694ac25ef426 100644 --- a/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h +++ b/drivers/net/ethernet/stmicro/stmmac/altr_tse_pcs.h @@ -10,6 +10,10 @@ #include #include =20 +#define SGMII_ADAPTER_CTRL_REG 0x00 +#define SGMII_ADAPTER_ENABLE 0x0000 +#define SGMII_ADAPTER_DISABLE 0x0001 + struct tse_pcs { struct device *dev; void __iomem *tse_pcs_base; diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c b/drivers/= net/ethernet/stmicro/stmmac/dwmac-socfpga.c index f37b6d57b2fe..8bb0106cb7ea 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-socfpga.c @@ -18,9 +18,6 @@ =20 #include "altr_tse_pcs.h" =20 -#define SGMII_ADAPTER_CTRL_REG 0x00 -#define SGMII_ADAPTER_DISABLE 0x0001 - #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_GMII_MII 0x0 #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RGMII 0x1 #define SYSMGR_EMACGRP_CTRL_PHYSEL_ENUM_RMII 0x2 @@ -62,16 +59,14 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, uns= igned int speed) { struct socfpga_dwmac *dwmac =3D (struct socfpga_dwmac *)priv; void __iomem *splitter_base =3D dwmac->splitter_base; - void __iomem *tse_pcs_base =3D dwmac->pcs.tse_pcs_base; void __iomem *sgmii_adapter_base =3D dwmac->pcs.sgmii_adapter_base; struct device *dev =3D dwmac->dev; struct net_device *ndev =3D dev_get_drvdata(dev); struct phy_device *phy_dev =3D ndev->phydev; u32 val; =20 - if ((tse_pcs_base) && (sgmii_adapter_base)) - writew(SGMII_ADAPTER_DISABLE, - sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + writew(SGMII_ADAPTER_DISABLE, + sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); =20 if (splitter_base) { val =3D readl(splitter_base + EMAC_SPLITTER_CTRL_REG); @@ -93,7 +88,9 @@ static void socfpga_dwmac_fix_mac_speed(void *priv, unsig= ned int speed) writel(val, splitter_base + EMAC_SPLITTER_CTRL_REG); } =20 - if (tse_pcs_base && sgmii_adapter_base) + writew(SGMII_ADAPTER_ENABLE, + sgmii_adapter_base + SGMII_ADAPTER_CTRL_REG); + if (phy_dev) tse_pcs_fix_mac_speed(&dwmac->pcs, phy_dev, speed); } =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8840AC4321E for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241587AbiDRNIV (ORCPT ); Mon, 18 Apr 2022 09:08:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240355AbiDRMzi (ORCPT ); Mon, 18 Apr 2022 08:55:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F6DCE85; Mon, 18 Apr 2022 05:37:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0B0D4B80EE0; Mon, 18 Apr 2022 12:37:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5BBE7C385C7; Mon, 18 Apr 2022 12:37:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285442; bh=c/sNApAjIfvKZjBOD9lHw5Vy4puycdYaf128XhAsIiU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BXcqdwPKeMwbmVJ13HSb1W5DfCJMFnU89KgDk8ZGFZAMYCqIL6TSZWURBXqhxYac8 A6jJa4roUHrGMZjsrOt6NuffvnPD7wJNDEAKMhBgJKKcPKwDF9AxF8a+vD6DFYT4dZ +RyBZW2w6AHUFo3JgIZ9/IxV55ukNM7hGict8d9U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benedikt Spranger , Kurt Kanzenbach , Vinicius Costa Gomes , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 020/105] net/sched: taprio: Check if socket flags are valid Date: Mon, 18 Apr 2022 14:12:22 +0200 Message-Id: <20220418121146.637026720@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benedikt Spranger [ Upstream commit e8a64bbaaad1f6548cec5508297bc6d45e8ab69e ] A user may set the SO_TXTIME socket option to ensure a packet is send at a given time. The taprio scheduler has to confirm, that it is allowed to send a packet at that given time, by a check against the packet time schedule. The scheduler drop the packet, if the gates are closed at the given send time. The check, if SO_TXTIME is set, may fail since sk_flags are part of an union and the union is used otherwise. This happen, if a socket is not a full socket, like a request socket for example. Add a check to verify, if the union is used for sk_flags. Fixes: 4cfd5779bd6e ("taprio: Add support for txtime-assist mode") Signed-off-by: Benedikt Spranger Reviewed-by: Kurt Kanzenbach Acked-by: Vinicius Costa Gomes Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sched/sch_taprio.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c index 806babdd838d..eca525791013 100644 --- a/net/sched/sch_taprio.c +++ b/net/sched/sch_taprio.c @@ -427,7 +427,8 @@ static int taprio_enqueue(struct sk_buff *skb, struct Q= disc *sch, if (unlikely(!child)) return qdisc_drop(skb, sch, to_free); =20 - if (skb->sk && sock_flag(skb->sk, SOCK_TXTIME)) { + /* sk_flags are only safe to use on full sockets. */ + if (skb->sk && sk_fullsock(skb->sk) && sock_flag(skb->sk, SOCK_TXTIME)) { if (!is_valid_interval(skb, sch)) return qdisc_drop(skb, sch, to_free); } else if (TXTIME_ASSIST_IS_ENABLED(q->flags)) { --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CC879C35294 for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241813AbiDRNIc (ORCPT ); Mon, 18 Apr 2022 09:08:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240360AbiDRMzi (ORCPT ); Mon, 18 Apr 2022 08:55:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F25CEC74; Mon, 18 Apr 2022 05:37:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8F5F1611AD; Mon, 18 Apr 2022 12:37:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 996D6C385BA; Mon, 18 Apr 2022 12:37:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285446; bh=kjdzpzAkNacLqUU5l4Mkqd7ZNHLTMKmnNuM76nBBmnE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SdVuVAq/uOtQHca5xm5PlUyS4hcokQwL7nrKBUGhCT1P9+xY0yuwiy0Q6sndXCzh5 Lt0P/7Xofy68MaL+AHOsG5EgN/q6UO9BvMCnUgCTRu1PIXlqfpzqOASFOHyIrNNq5Z dTZiVUiFOMTRDgjzmp1sBOd9mF5qdNOOr8qOdtWg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rameshkumar Sundaram , Johannes Berg , Sasha Levin Subject: [PATCH 5.10 021/105] cfg80211: hold bss_lock while updating nontrans_list Date: Mon, 18 Apr 2022 14:12:23 +0200 Message-Id: <20220418121146.704752404@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rameshkumar Sundaram [ Upstream commit a5199b5626cd6913cf8776a835bc63d40e0686ad ] Synchronize additions to nontrans_list of transmitting BSS with bss_lock to avoid races. Also when cfg80211_add_nontrans_list() fails __cfg80211_unlink_bss() needs bss_lock to be held (has lockdep assert on bss_lock). So protect the whole block with bss_lock to avoid races and warnings. Found during code review. Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in sc= anning") Signed-off-by: Rameshkumar Sundaram Link: https://lore.kernel.org/r/1649668071-9370-1-git-send-email-quic_rames= s@quicinc.com Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/wireless/scan.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/wireless/scan.c b/net/wireless/scan.c index c1b2655682a8..6dc9b7e22b71 100644 --- a/net/wireless/scan.c +++ b/net/wireless/scan.c @@ -1968,11 +1968,13 @@ cfg80211_inform_single_bss_data(struct wiphy *wiphy, /* this is a nontransmitting bss, we need to add it to * transmitting bss' list if it is not there */ + spin_lock_bh(&rdev->bss_lock); if (cfg80211_add_nontrans_list(non_tx_data->tx_bss, &res->pub)) { if (__cfg80211_unlink_bss(rdev, res)) rdev->bss_generation++; } + spin_unlock_bh(&rdev->bss_lock); } =20 trace_cfg80211_return_bss(&res->pub); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AE543C47081 for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241718AbiDRNI3 (ORCPT ); Mon, 18 Apr 2022 09:08:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41762 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240033AbiDRMzj (ORCPT ); Mon, 18 Apr 2022 08:55:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0EBD6633E; Mon, 18 Apr 2022 05:37:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 924B0B80EE0; Mon, 18 Apr 2022 12:37:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C40F9C385A1; Mon, 18 Apr 2022 12:37:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285452; bh=R/MGdFWFUYLX3NQgsrRnXg/2rEzuiwpwdvMcLPjmzJw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ns35Ozz/zyQ7WJ2eVEjp9Csz3zH70eiKhmEkdboDGFUm9SmL2D0t4AAAmmGdcOYPb JNLFj9DTNM7ma4xUtrHIMcBHu5lkVXKc5YQiXo7Ggoe38aFkiRc0Diu1VX1445d3bX Ck0clqsWqqufNAm0nJ14HgxIcWM77QO5YfxEmfXI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rob Clark , Sasha Levin Subject: [PATCH 5.10 022/105] drm/msm: Fix range size vs end confusion Date: Mon, 18 Apr 2022 14:12:24 +0200 Message-Id: <20220418121146.761869533@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rob Clark [ Upstream commit 537fef808be5ea56f6fc06932162550819a3b3c3 ] The fourth param is size, rather than range_end. Note that we could increase the address space size if we had a way to prevent buffers from spanning a 4G split, mostly just to avoid fw bugs with 64b math. Fixes: 84c31ee16f90 ("drm/msm/a6xx: Add support for per-instance pagetables= ") Signed-off-by: Rob Clark Link: https://lore.kernel.org/r/20220407202836.1211268-1-robdclark@gmail.com Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c b/drivers/gpu/drm/msm/ad= reno/a6xx_gpu.c index 9e09805575db..39563daff4a0 100644 --- a/drivers/gpu/drm/msm/adreno/a6xx_gpu.c +++ b/drivers/gpu/drm/msm/adreno/a6xx_gpu.c @@ -1222,7 +1222,7 @@ a6xx_create_private_address_space(struct msm_gpu *gpu) return ERR_CAST(mmu); =20 return msm_gem_address_space_create(mmu, - "gpu", 0x100000000ULL, 0x1ffffffffULL); + "gpu", 0x100000000ULL, SZ_4G); } =20 static uint32_t a6xx_get_rptr(struct msm_gpu *gpu, struct msm_ringbuffer *= ring) --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA52CC41535 for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241979AbiDRNIk (ORCPT ); Mon, 18 Apr 2022 09:08:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240391AbiDRMzk (ORCPT ); Mon, 18 Apr 2022 08:55:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 790AC63D7; Mon, 18 Apr 2022 05:37:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 15825611EC; Mon, 18 Apr 2022 12:37:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12561C385B2; Mon, 18 Apr 2022 12:37:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285455; bh=A0c8jWrim47aI1vvoqLwuBRVgPZtOLitZHMnc553NXo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vreiq0qulRR1/uG8Vfj/qUHZKX30JqWzwFofiyhx9+5lPSm431qYviE+jHmhoZAC0 3fAISmuZeD/YMbOcs/bYuapkfFJe8cBACq+IvIrYL3cC8WevPLdpwJOehf6/zOnmm3 cos96E7z4KLUhWKmSyt1XcNAeSXPU5Xj67BIXwZg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dmitry Baryshkov , Sean Paul , Stephen Boyd , Rob Clark , Sasha Levin Subject: [PATCH 5.10 023/105] drm/msm/dsi: Use connector directly in msm_dsi_manager_connector_init() Date: Mon, 18 Apr 2022 14:12:25 +0200 Message-Id: <20220418121146.817696550@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stephen Boyd [ Upstream commit 47b7de6b88b962ef339a2427a023d2a23d161654 ] The member 'msm_dsi->connector' isn't assigned until msm_dsi_manager_connector_init() returns (see msm_dsi_modeset_init() and how it assigns the return value). Therefore this pointer is going to be NULL here. Let's use 'connector' which is what was intended. Cc: Dmitry Baryshkov Cc: Sean Paul Fixes: 6d5e78406991 ("drm/msm/dsi: Move dsi panel init into modeset init pa= th") Signed-off-by: Stephen Boyd Reviewed-by: Dmitry Baryshkov Patchwork: https://patchwork.freedesktop.org/patch/478693/ Link: https://lore.kernel.org/r/20220318000731.2823718-1-swboyd@chromium.org Signed-off-by: Dmitry Baryshkov Signed-off-by: Rob Clark Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/msm/dsi/dsi_manager.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/gpu/drm/msm/dsi/dsi_manager.c b/drivers/gpu/drm/msm/ds= i/dsi_manager.c index 1d28dfba2c9b..fb421ca56b3d 100644 --- a/drivers/gpu/drm/msm/dsi/dsi_manager.c +++ b/drivers/gpu/drm/msm/dsi/dsi_manager.c @@ -644,7 +644,7 @@ struct drm_connector *msm_dsi_manager_connector_init(u8= id) return connector; =20 fail: - connector->funcs->destroy(msm_dsi->connector); + connector->funcs->destroy(connector); return ERR_PTR(ret); } =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D8B66C3525B for ; Mon, 18 Apr 2022 13:08:06 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242047AbiDRNIm (ORCPT ); Mon, 18 Apr 2022 09:08:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42304 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240425AbiDRMzo (ORCPT ); Mon, 18 Apr 2022 08:55:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B63EEDEEA; Mon, 18 Apr 2022 05:37:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 23010B80EE3; Mon, 18 Apr 2022 12:37:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3DB23C385A8; Mon, 18 Apr 2022 12:37:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285458; bh=Nl4SxNroLuhIAOnHXzW8cQVvfTtZ7rwCeTqS+oY+gO8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VKQGQaye0eSzgeuXxZFz5K3zvgMxvrZt+UHbsFtmKd8vkEJqoHV1k9NotX+1oQQH6 UbWzmOL6mI7q2qI6qhqaZidcAlMVRFcgIfkX6+rxAKtnxbKbno3SZFVAghy91vzVO9 nuX4AypZqgK6JFOI7l9C6LAIPGPt2bZKvpQhfbxQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+03e3e228510223dabd34@syzkaller.appspotmail.com, Karsten Graul , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 024/105] net/smc: Fix NULL pointer dereference in smc_pnet_find_ib() Date: Mon, 18 Apr 2022 14:12:26 +0200 Message-Id: <20220418121146.878662130@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Karsten Graul [ Upstream commit d22f4f977236f97e01255a80bca2ea93a8094fc8 ] dev_name() was called with dev.parent as argument but without to NULL-check it before. Solve this by checking the pointer before the call to dev_name(). Fixes: af5f60c7e3d5 ("net/smc: allow PCI IDs as ib device names in the pnet= table") Reported-by: syzbot+03e3e228510223dabd34@syzkaller.appspotmail.com Signed-off-by: Karsten Graul Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/smc/smc_pnet.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c index 9007c7e3bae4..30bae60d626c 100644 --- a/net/smc/smc_pnet.c +++ b/net/smc/smc_pnet.c @@ -310,8 +310,9 @@ static struct smc_ib_device *smc_pnet_find_ib(char *ib_= name) list_for_each_entry(ibdev, &smc_ib_devices.list, list) { if (!strncmp(ibdev->ibdev->name, ib_name, sizeof(ibdev->ibdev->name)) || - !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name, - IB_DEVICE_NAME_MAX - 1)) { + (ibdev->ibdev->dev.parent && + !strncmp(dev_name(ibdev->ibdev->dev.parent), ib_name, + IB_DEVICE_NAME_MAX - 1))) { goto out; } } --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 20D79C3527A for ; Mon, 18 Apr 2022 13:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242150AbiDRNIp (ORCPT ); Mon, 18 Apr 2022 09:08:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50980 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240441AbiDRMzp (ORCPT ); Mon, 18 Apr 2022 08:55:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 29A64E0B1; Mon, 18 Apr 2022 05:37:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A79AE611CC; Mon, 18 Apr 2022 12:37:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE24EC385A1; Mon, 18 Apr 2022 12:37:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285462; bh=RSKVNnoqxfmMZybfBYToySTA/cVvPDlog7YmfbBL73w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BNVOcS9/x41RTAb1d33uCPZNuvMPTbSkyDA9RHMCxQpMoaOsnY4JFU8CDGCItvZtQ wc0zIsVjPaaBRuxTC3AMA0mYMQY2lnc/jFh4IM5rsD1gCzv5dGqDA6EGqCvT5xhpsA hAACpDlNhsbbB0blaos+AkglEk2sywhzRjHWSOy4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Garry , Jack Wang , Ajish Koshy , Viswas G , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 025/105] scsi: pm80xx: Mask and unmask upper interrupt vectors 32-63 Date: Mon, 18 Apr 2022 14:12:27 +0200 Message-Id: <20220418121146.941739869@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ajish Koshy [ Upstream commit 294080eacf92a0781e6d43663448a55001ec8c64 ] When upper inbound and outbound queues 32-63 are enabled, we see upper vectors 32-63 in interrupt service routine. We need corresponding registers to handle masking and unmasking of these upper interrupts. To achieve this, we use registers MSGU_ODMR_U(0x34) to mask and MSGU_ODMR_CLR_U(0x3C) to unmask the interrupts. In these registers bit 0-31 represents interrupt vectors 32-63. Link: https://lore.kernel.org/r/20220411064603.668448-2-Ajish.Koshy@microch= ip.com Fixes: 05c6c029a44d ("scsi: pm80xx: Increase number of supported queues") Reviewed-by: John Garry Acked-by: Jack Wang Signed-off-by: Ajish Koshy Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/pm8001/pm80xx_hwi.c | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_= hwi.c index 4c03bf08b543..0543ff3ff1ba 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -1682,10 +1682,11 @@ static void pm80xx_chip_interrupt_enable(struct pm8001_hba_info *pm8001_ha, u8 vec) { #ifdef PM8001_USE_MSIX - u32 mask; - mask =3D (u32)(1 << vec); - - pm8001_cw32(pm8001_ha, 0, MSGU_ODMR_CLR, (u32)(mask & 0xFFFFFFFF)); + if (vec < 32) + pm8001_cw32(pm8001_ha, 0, MSGU_ODMR_CLR, 1U << vec); + else + pm8001_cw32(pm8001_ha, 0, MSGU_ODMR_CLR_U, + 1U << (vec - 32)); return; #endif pm80xx_chip_intx_interrupt_enable(pm8001_ha); @@ -1701,12 +1702,15 @@ static void pm80xx_chip_interrupt_disable(struct pm8001_hba_info *pm8001_ha, u8 vec) { #ifdef PM8001_USE_MSIX - u32 mask; - if (vec =3D=3D 0xFF) - mask =3D 0xFFFFFFFF; + if (vec =3D=3D 0xFF) { + /* disable all vectors 0-31, 32-63 */ + pm8001_cw32(pm8001_ha, 0, MSGU_ODMR, 0xFFFFFFFF); + pm8001_cw32(pm8001_ha, 0, MSGU_ODMR_U, 0xFFFFFFFF); + } else if (vec < 32) + pm8001_cw32(pm8001_ha, 0, MSGU_ODMR, 1U << vec); else - mask =3D (u32)(1 << vec); - pm8001_cw32(pm8001_ha, 0, MSGU_ODMR, (u32)(mask & 0xFFFFFFFF)); + pm8001_cw32(pm8001_ha, 0, MSGU_ODMR_U, + 1U << (vec - 32)); return; #endif pm80xx_chip_intx_interrupt_disable(pm8001_ha); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35E5AC3527C for ; Mon, 18 Apr 2022 13:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242214AbiDRNIv (ORCPT ); Mon, 18 Apr 2022 09:08:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43948 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240499AbiDRM4K (ORCPT ); Mon, 18 Apr 2022 08:56:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3ADECE0B7; Mon, 18 Apr 2022 05:37:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CE28E611CC; Mon, 18 Apr 2022 12:37:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC84AC385A1; Mon, 18 Apr 2022 12:37:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285465; bh=0nK7dR2ySBPmj9A2wp9FXAQ9MRXguoa2VerPK/upLBk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XnO2bB36wi8E/tPp4ckLvkS1NcHM3Wafet8M8VbW7jotgw6Z2Bg8ZsIv9TeRHDvbT dOXhPeRuzFxLWaWLAJ/CqIxc6fBkr4tbjTlef4KaVdoTIjD1VswWpA7AmTNoAqrLxS gQTNlHKjhrKZmuobFBioN07meDDKxD3URf7lPlGY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Damien Le Moal , Jack Wang , Ajish Koshy , Viswas G , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 026/105] scsi: pm80xx: Enable upper inbound, outbound queues Date: Mon, 18 Apr 2022 14:12:28 +0200 Message-Id: <20220418121147.013981195@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ajish Koshy [ Upstream commit bcd8a45223470e00b5f254018174d64a75db4bbe ] Executing driver on servers with more than 32 CPUs were faced with command timeouts. This is because we were not geting completions for commands submitted on IQ32 - IQ63. Set E64Q bit to enable upper inbound and outbound queues 32 to 63 in the MPI main configuration table. Added 500ms delay after successful MPI initialization as mentioned in controller datasheet. Link: https://lore.kernel.org/r/20220411064603.668448-3-Ajish.Koshy@microch= ip.com Fixes: 05c6c029a44d ("scsi: pm80xx: Increase number of supported queues") Reviewed-by: Damien Le Moal Acked-by: Jack Wang Signed-off-by: Ajish Koshy Signed-off-by: Viswas G Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/pm8001/pm80xx_hwi.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/drivers/scsi/pm8001/pm80xx_hwi.c b/drivers/scsi/pm8001/pm80xx_= hwi.c index 0543ff3ff1ba..0305c8999ba5 100644 --- a/drivers/scsi/pm8001/pm80xx_hwi.c +++ b/drivers/scsi/pm8001/pm80xx_hwi.c @@ -765,6 +765,10 @@ static void init_default_table_values(struct pm8001_hb= a_info *pm8001_ha) pm8001_ha->main_cfg_tbl.pm80xx_tbl.pcs_event_log_severity =3D 0x01; pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt =3D 0x01; =20 + /* Enable higher IQs and OQs, 32 to 63, bit 16 */ + if (pm8001_ha->max_q_num > 32) + pm8001_ha->main_cfg_tbl.pm80xx_tbl.fatal_err_interrupt |=3D + 1 << 16; /* Disable end to end CRC checking */ pm8001_ha->main_cfg_tbl.pm80xx_tbl.crc_core_dump =3D (0x1 << 16); =20 @@ -1024,6 +1028,13 @@ static int mpi_init_check(struct pm8001_hba_info *pm= 8001_ha) if (0x0000 !=3D gst_len_mpistate) return -EBUSY; =20 + /* + * As per controller datasheet, after successful MPI + * initialization minimum 500ms delay is required before + * issuing commands. + */ + msleep(500); + return 0; } =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5C4C1C3527D for ; Mon, 18 Apr 2022 13:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242367AbiDRNJC (ORCPT ); Mon, 18 Apr 2022 09:09:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240029AbiDRM4a (ORCPT ); Mon, 18 Apr 2022 08:56:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BC9F812ABB; Mon, 18 Apr 2022 05:37:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 089D2611C9; Mon, 18 Apr 2022 12:37:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D774C385A8; Mon, 18 Apr 2022 12:37:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285468; bh=Ks9zCk+VKhE9egTQtJE0fON4oKo7BKhoDemQDJMo/jQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Ir2gN0yUTD/c+8vpq6eAEC2ie2RXJwaodp8XK48a2s2mD40q7iEctcFcoQxtzZ5FD 2qxo2DVTJEbdVT2Z8cTF+2miFYSJy1v2WblErz7bKE9DDsUJu4jyuP7L0UFzMUFdn7 7HaAaprbqBBg4CL/gmpOT/xMl6f9akn7uKY51tvg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Duncan , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 027/105] scsi: iscsi: Stop queueing during ep_disconnect Date: Mon, 18 Apr 2022 14:12:29 +0200 Message-Id: <20220418121147.070897187@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit 891e2639deae721dc43764a44fa255890dc34313 ] During ep_disconnect we have been doing iscsi_suspend_tx/queue to block new I/O but every driver except cxgbi and iscsi_tcp can still get I/O from __iscsi_conn_send_pdu() if we haven't called iscsi_conn_failure() before ep_disconnect. This could happen if we were terminating the session, and the logout timed out before it was even sent to libiscsi. Fix the issue by adding a helper which reverses the bind_conn call that allows new I/O to be queued. Drivers implementing ep_disconnect can use this to make sure new I/O is not queued to them when handling the disconnect. Link: https://lore.kernel.org/r/20210525181821.7617-3-michael.christie@orac= le.com Reviewed-by: Lee Duncan Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + drivers/scsi/be2iscsi/be_main.c | 1 + drivers/scsi/bnx2i/bnx2i_iscsi.c | 1 + drivers/scsi/cxgbi/cxgb3i/cxgb3i.c | 1 + drivers/scsi/cxgbi/cxgb4i/cxgb4i.c | 1 + drivers/scsi/libiscsi.c | 70 +++++++++++++++++++++--- drivers/scsi/qedi/qedi_iscsi.c | 1 + drivers/scsi/qla4xxx/ql4_os.c | 1 + drivers/scsi/scsi_transport_iscsi.c | 10 +++- include/scsi/libiscsi.h | 1 + include/scsi/scsi_transport_iscsi.h | 1 + 11 files changed, 78 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/= ulp/iser/iscsi_iser.c index 3690e28cc7ea..8857d8322710 100644 --- a/drivers/infiniband/ulp/iser/iscsi_iser.c +++ b/drivers/infiniband/ulp/iser/iscsi_iser.c @@ -988,6 +988,7 @@ static struct iscsi_transport iscsi_iser_transport =3D { /* connection management */ .create_conn =3D iscsi_iser_conn_create, .bind_conn =3D iscsi_iser_conn_bind, + .unbind_conn =3D iscsi_conn_unbind, .destroy_conn =3D iscsi_conn_teardown, .attr_is_visible =3D iser_attr_is_visible, .set_param =3D iscsi_iser_set_param, diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_mai= n.c index 987dc8135a9b..b977e039bb78 100644 --- a/drivers/scsi/be2iscsi/be_main.c +++ b/drivers/scsi/be2iscsi/be_main.c @@ -5810,6 +5810,7 @@ struct iscsi_transport beiscsi_iscsi_transport =3D { .destroy_session =3D beiscsi_session_destroy, .create_conn =3D beiscsi_conn_create, .bind_conn =3D beiscsi_conn_bind, + .unbind_conn =3D iscsi_conn_unbind, .destroy_conn =3D iscsi_conn_teardown, .attr_is_visible =3D beiscsi_attr_is_visible, .set_iface_param =3D beiscsi_iface_set_param, diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_is= csi.c index 21efc73b87be..173d8c6a8cbf 100644 --- a/drivers/scsi/bnx2i/bnx2i_iscsi.c +++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c @@ -2278,6 +2278,7 @@ struct iscsi_transport bnx2i_iscsi_transport =3D { .destroy_session =3D bnx2i_session_destroy, .create_conn =3D bnx2i_conn_create, .bind_conn =3D bnx2i_conn_bind, + .unbind_conn =3D iscsi_conn_unbind, .destroy_conn =3D bnx2i_conn_destroy, .attr_is_visible =3D bnx2i_attr_is_visible, .set_param =3D iscsi_set_param, diff --git a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c b/drivers/scsi/cxgbi/cxgb3i= /cxgb3i.c index 37d99357120f..edcd3fab6973 100644 --- a/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c +++ b/drivers/scsi/cxgbi/cxgb3i/cxgb3i.c @@ -117,6 +117,7 @@ static struct iscsi_transport cxgb3i_iscsi_transport = =3D { /* connection management */ .create_conn =3D cxgbi_create_conn, .bind_conn =3D cxgbi_bind_conn, + .unbind_conn =3D iscsi_conn_unbind, .destroy_conn =3D iscsi_tcp_conn_teardown, .start_conn =3D iscsi_conn_start, .stop_conn =3D iscsi_conn_stop, diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i= /cxgb4i.c index 2c3491528d42..efb3e2b3398e 100644 --- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c +++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c @@ -134,6 +134,7 @@ static struct iscsi_transport cxgb4i_iscsi_transport = =3D { /* connection management */ .create_conn =3D cxgbi_create_conn, .bind_conn =3D cxgbi_bind_conn, + .unbind_conn =3D iscsi_conn_unbind, .destroy_conn =3D iscsi_tcp_conn_teardown, .start_conn =3D iscsi_conn_start, .stop_conn =3D iscsi_conn_stop, diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c index d4e66c595eb8..05799b41974d 100644 --- a/drivers/scsi/libiscsi.c +++ b/drivers/scsi/libiscsi.c @@ -1367,23 +1367,32 @@ void iscsi_session_failure(struct iscsi_session *se= ssion, } EXPORT_SYMBOL_GPL(iscsi_session_failure); =20 -void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err) +static bool iscsi_set_conn_failed(struct iscsi_conn *conn) { struct iscsi_session *session =3D conn->session; =20 - spin_lock_bh(&session->frwd_lock); - if (session->state =3D=3D ISCSI_STATE_FAILED) { - spin_unlock_bh(&session->frwd_lock); - return; - } + if (session->state =3D=3D ISCSI_STATE_FAILED) + return false; =20 if (conn->stop_stage =3D=3D 0) session->state =3D ISCSI_STATE_FAILED; - spin_unlock_bh(&session->frwd_lock); =20 set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx); set_bit(ISCSI_SUSPEND_BIT, &conn->suspend_rx); - iscsi_conn_error_event(conn->cls_conn, err); + return true; +} + +void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err) +{ + struct iscsi_session *session =3D conn->session; + bool needs_evt; + + spin_lock_bh(&session->frwd_lock); + needs_evt =3D iscsi_set_conn_failed(conn); + spin_unlock_bh(&session->frwd_lock); + + if (needs_evt) + iscsi_conn_error_event(conn->cls_conn, err); } EXPORT_SYMBOL_GPL(iscsi_conn_failure); =20 @@ -2117,6 +2126,51 @@ static void iscsi_check_transport_timeouts(struct ti= mer_list *t) spin_unlock(&session->frwd_lock); } =20 +/** + * iscsi_conn_unbind - prevent queueing to conn. + * @cls_conn: iscsi conn ep is bound to. + * @is_active: is the conn in use for boot or is this for EH/termination + * + * This must be called by drivers implementing the ep_disconnect callout. + * It disables queueing to the connection from libiscsi in preparation for + * an ep_disconnect call. + */ +void iscsi_conn_unbind(struct iscsi_cls_conn *cls_conn, bool is_active) +{ + struct iscsi_session *session; + struct iscsi_conn *conn; + + if (!cls_conn) + return; + + conn =3D cls_conn->dd_data; + session =3D conn->session; + /* + * Wait for iscsi_eh calls to exit. We don't wait for the tmf to + * complete or timeout. The caller just wants to know what's running + * is everything that needs to be cleaned up, and no cmds will be + * queued. + */ + mutex_lock(&session->eh_mutex); + + iscsi_suspend_queue(conn); + iscsi_suspend_tx(conn); + + spin_lock_bh(&session->frwd_lock); + if (!is_active) { + /* + * if logout timed out before userspace could even send a PDU + * the state might still be in ISCSI_STATE_LOGGED_IN and + * allowing new cmds and TMFs. + */ + if (session->state =3D=3D ISCSI_STATE_LOGGED_IN) + iscsi_set_conn_failed(conn); + } + spin_unlock_bh(&session->frwd_lock); + mutex_unlock(&session->eh_mutex); +} +EXPORT_SYMBOL_GPL(iscsi_conn_unbind); + static void iscsi_prep_abort_task_pdu(struct iscsi_task *task, struct iscsi_tm *hdr) { diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c index f51723e2d522..8f8036ae9a56 100644 --- a/drivers/scsi/qedi/qedi_iscsi.c +++ b/drivers/scsi/qedi/qedi_iscsi.c @@ -1428,6 +1428,7 @@ struct iscsi_transport qedi_iscsi_transport =3D { .destroy_session =3D qedi_session_destroy, .create_conn =3D qedi_conn_create, .bind_conn =3D qedi_conn_bind, + .unbind_conn =3D iscsi_conn_unbind, .start_conn =3D qedi_conn_start, .stop_conn =3D iscsi_conn_stop, .destroy_conn =3D qedi_conn_destroy, diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index 2c23b692e318..a8b8bf118c76 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -259,6 +259,7 @@ static struct iscsi_transport qla4xxx_iscsi_transport = =3D { .start_conn =3D qla4xxx_conn_start, .create_conn =3D qla4xxx_conn_create, .bind_conn =3D qla4xxx_conn_bind, + .unbind_conn =3D iscsi_conn_unbind, .stop_conn =3D iscsi_conn_stop, .destroy_conn =3D qla4xxx_conn_destroy, .set_param =3D iscsi_set_param, diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index a5759d0e388a..6490211b55d2 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2957,7 +2957,7 @@ static int iscsi_if_ep_connect(struct iscsi_transport= *transport, } =20 static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, - u64 ep_handle) + u64 ep_handle, bool is_active) { struct iscsi_cls_conn *conn; struct iscsi_endpoint *ep; @@ -2974,6 +2974,8 @@ static int iscsi_if_ep_disconnect(struct iscsi_transp= ort *transport, conn->ep =3D NULL; mutex_unlock(&conn->ep_mutex); conn->state =3D ISCSI_CONN_FAILED; + + transport->unbind_conn(conn, is_active); } =20 transport->ep_disconnect(ep); @@ -3005,7 +3007,8 @@ iscsi_if_transport_ep(struct iscsi_transport *transpo= rt, break; case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: rc =3D iscsi_if_ep_disconnect(transport, - ev->u.ep_disconnect.ep_handle); + ev->u.ep_disconnect.ep_handle, + false); break; } return rc; @@ -3730,7 +3733,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghd= r *nlh, uint32_t *group) conn =3D iscsi_conn_lookup(ev->u.b_conn.sid, ev->u.b_conn.cid); =20 if (conn && conn->ep) - iscsi_if_ep_disconnect(transport, conn->ep->id); + iscsi_if_ep_disconnect(transport, conn->ep->id, true); =20 if (!session || !conn) { err =3D -EINVAL; @@ -4649,6 +4652,7 @@ iscsi_register_transport(struct iscsi_transport *tt) int err; =20 BUG_ON(!tt); + WARN_ON(tt->ep_disconnect && !tt->unbind_conn); =20 priv =3D iscsi_if_transport_lookup(tt); if (priv) diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h index 2b5f97224f69..fa00e2543ad6 100644 --- a/include/scsi/libiscsi.h +++ b/include/scsi/libiscsi.h @@ -421,6 +421,7 @@ extern int iscsi_conn_start(struct iscsi_cls_conn *); extern void iscsi_conn_stop(struct iscsi_cls_conn *, int); extern int iscsi_conn_bind(struct iscsi_cls_session *, struct iscsi_cls_co= nn *, int); +extern void iscsi_conn_unbind(struct iscsi_cls_conn *cls_conn, bool is_act= ive); extern void iscsi_conn_failure(struct iscsi_conn *conn, enum iscsi_err err= ); extern void iscsi_session_failure(struct iscsi_session *session, enum iscsi_err err); diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transp= ort_iscsi.h index f28bb20d6271..eb6ed499324d 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -82,6 +82,7 @@ struct iscsi_transport { void (*destroy_session) (struct iscsi_cls_session *session); struct iscsi_cls_conn *(*create_conn) (struct iscsi_cls_session *sess, uint32_t cid); + void (*unbind_conn) (struct iscsi_cls_conn *conn, bool is_active); int (*bind_conn) (struct iscsi_cls_session *session, struct iscsi_cls_conn *cls_conn, uint64_t transport_eph, int is_leading); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71411C4707E for ; Mon, 18 Apr 2022 13:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242438AbiDRNJG (ORCPT ); Mon, 18 Apr 2022 09:09:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240394AbiDRM4m (ORCPT ); Mon, 18 Apr 2022 08:56:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9355B12755; Mon, 18 Apr 2022 05:37:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CFC2D611CC; Mon, 18 Apr 2022 12:37:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DB34AC385B0; Mon, 18 Apr 2022 12:37:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285473; bh=plLRFRABPQzeHzsPhuHHKYd36CfjqlRb/871J9RPo7c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fNWUWWYSSjCIVBO6l43URLG922pn7pYfgOPpGuBDbjPzqbHQ5h+V31jF0vB4AeeGO C0Wt1Tr5Ar0mHsF5Fd2Z2G5MizZ//OSNJZKnPr4NzGcySuWxxCpFMy2uh49HRFcDBp 6syWbWnSljxYUhU7OQh2Aq+MM6CepFi/kOy95/ao= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 028/105] scsi: iscsi: Force immediate failure during shutdown Date: Mon, 18 Apr 2022 14:12:30 +0200 Message-Id: <20220418121147.114581108@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit 06c203a5566beecebb1f8838d026de8a61c8df71 ] If the system is not up, we can just fail immediately since iscsid is not going to ever answer our netlink events. We are already setting the recovery_tmo to 0, but by passing stop_conn STOP_CONN_TERM we never will block the session and start the recovery timer, because for that flag userspace will do the unbind and destroy events which would remove the devices and wake up and kill the eh. Since the conn is dead and the system is going dowm this just has us use STOP_CONN_RECOVER with recovery_tmo=3D0 so we fail immediately. However, if the user has set the recovery_tmo=3D-1 we let the system hang like they requested since they might have used that setting for specific reasons (one known reason is for buggy cluster software). Link: https://lore.kernel.org/r/20210525181821.7617-5-michael.christie@orac= le.com Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index 6490211b55d2..f93660142e35 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2508,11 +2508,17 @@ static void stop_conn_work_fn(struct work_struct *w= ork) session =3D iscsi_session_lookup(sid); if (session) { if (system_state !=3D SYSTEM_RUNNING) { - session->recovery_tmo =3D 0; - iscsi_if_stop_conn(conn, STOP_CONN_TERM); - } else { - iscsi_if_stop_conn(conn, STOP_CONN_RECOVER); + /* + * If the user has set up for the session to + * never timeout then hang like they wanted. + * For all other cases fail right away since + * userspace is not going to relogin. + */ + if (session->recovery_tmo > 0) + session->recovery_tmo =3D 0; } + + iscsi_if_stop_conn(conn, STOP_CONN_RECOVER); } =20 list_del_init(&conn->conn_list_err); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85E1EC3527E for ; Mon, 18 Apr 2022 13:08:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242502AbiDRNJL (ORCPT ); Mon, 18 Apr 2022 09:09:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42110 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238173AbiDRM4n (ORCPT ); Mon, 18 Apr 2022 08:56:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 34B861A816; Mon, 18 Apr 2022 05:37:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A236D6118A; Mon, 18 Apr 2022 12:37:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AE251C385A7; Mon, 18 Apr 2022 12:37:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285476; bh=x85HsX1QKJi6SwkS29AzK7v1ZonuON6s7Mrr8XxuSHw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yGxymUdEWtZMJqXl7IE+y1WOjQmrutkgK2/n1+2CcwNnBWYEYotaR+GwuwSWi3sQF viz8ynYQRqUk+pYfHRDemxU+7UtsyWcGu7ngzX30criZS3rKGNt1jbeXrZvaHzpuvl ksQcO13zKa+JtmOZelp5av58K3W4G96eWH++rHHM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Duncan , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 029/105] scsi: iscsi: Use system_unbound_wq for destroy_work Date: Mon, 18 Apr 2022 14:12:31 +0200 Message-Id: <20220418121147.156679890@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit b25b957d2db1585602c2c70fdf4261a5641fe6b7 ] Use the system_unbound_wq for async session destruction. We don't need a dedicated workqueue for async session destruction because: 1. perf does not seem to be an issue since we only allow 1 active work. 2. it does not have deps with other system works and we can run them in parallel with each other. Link: https://lore.kernel.org/r/20210525181821.7617-6-michael.christie@orac= le.com Reviewed-by: Lee Duncan Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 15 +-------------- 1 file changed, 1 insertion(+), 14 deletions(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index f93660142e35..ed0c7e812445 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -95,8 +95,6 @@ static DECLARE_WORK(stop_conn_work, stop_conn_work_fn); static atomic_t iscsi_session_nr; /* sysfs session id for next new session= */ static struct workqueue_struct *iscsi_eh_timer_workq; =20 -static struct workqueue_struct *iscsi_destroy_workq; - static DEFINE_IDA(iscsi_sess_ida); /* * list of registered transports and lock that must @@ -3717,7 +3715,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghd= r *nlh, uint32_t *group) list_del_init(&session->sess_list); spin_unlock_irqrestore(&sesslock, flags); =20 - queue_work(iscsi_destroy_workq, &session->destroy_work); + queue_work(system_unbound_wq, &session->destroy_work); } break; case ISCSI_UEVENT_UNBIND_SESSION: @@ -4813,18 +4811,8 @@ static __init int iscsi_transport_init(void) goto release_nls; } =20 - iscsi_destroy_workq =3D alloc_workqueue("%s", - WQ_SYSFS | __WQ_LEGACY | WQ_MEM_RECLAIM | WQ_UNBOUND, - 1, "iscsi_destroy"); - if (!iscsi_destroy_workq) { - err =3D -ENOMEM; - goto destroy_wq; - } - return 0; =20 -destroy_wq: - destroy_workqueue(iscsi_eh_timer_workq); release_nls: netlink_kernel_release(nls); unregister_flashnode_bus: @@ -4846,7 +4834,6 @@ static __init int iscsi_transport_init(void) =20 static void __exit iscsi_transport_exit(void) { - destroy_workqueue(iscsi_destroy_workq); destroy_workqueue(iscsi_eh_timer_workq); netlink_kernel_release(nls); bus_unregister(&iscsi_flashnode_bus); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3F35C3527A for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242509AbiDRNSt (ORCPT ); Mon, 18 Apr 2022 09:18:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240420AbiDRM4y (ORCPT ); Mon, 18 Apr 2022 08:56:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 014001B79C; Mon, 18 Apr 2022 05:38:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7A719611C9; Mon, 18 Apr 2022 12:37:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80DF2C385A1; Mon, 18 Apr 2022 12:37:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285478; bh=wOYJ4xq8h4C3v5htC7YR+Oi9/A3186tH71X/lNPHzSI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=L2YSXWYADkTXPH3I26nb2MYQQLuzpLaz/VXAbQdyAtgjQOnuJcdSiK3P6gdS/7RXT auYab5+PK8oUok8aRigaW4RLn+Vyz2PcfEOlrs8EeQN1f37XbooeXYWOnoJz72Mipl qlUh+sAPOzNzL6TslEGnRhNYdYBLLjcZ0Ghwx978= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Duncan , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 030/105] scsi: iscsi: Rel ref after iscsi_lookup_endpoint() Date: Mon, 18 Apr 2022 14:12:32 +0200 Message-Id: <20220418121147.201607054@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit 9e5fe1700896c85040943fdc0d3fee0dd3e0d36f ] Subsequent commits allow the kernel to do ep_disconnect. In that case we will have to get a proper refcount on the ep so one thread does not delete it from under another. Link: https://lore.kernel.org/r/20210525181821.7617-7-michael.christie@orac= le.com Reviewed-by: Lee Duncan Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/infiniband/ulp/iser/iscsi_iser.c | 1 + drivers/scsi/be2iscsi/be_iscsi.c | 19 ++++++++++++------ drivers/scsi/bnx2i/bnx2i_iscsi.c | 23 +++++++++++++++------- drivers/scsi/cxgbi/libcxgbi.c | 12 ++++++++---- drivers/scsi/qedi/qedi_iscsi.c | 25 +++++++++++++++++------- drivers/scsi/qla4xxx/ql4_os.c | 1 + drivers/scsi/scsi_transport_iscsi.c | 25 ++++++++++++++++-------- include/scsi/scsi_transport_iscsi.h | 1 + 8 files changed, 75 insertions(+), 32 deletions(-) diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.c b/drivers/infiniband/= ulp/iser/iscsi_iser.c index 8857d8322710..a16e066989fa 100644 --- a/drivers/infiniband/ulp/iser/iscsi_iser.c +++ b/drivers/infiniband/ulp/iser/iscsi_iser.c @@ -499,6 +499,7 @@ iscsi_iser_conn_bind(struct iscsi_cls_session *cls_sess= ion, iser_conn->iscsi_conn =3D conn; =20 out: + iscsi_put_endpoint(ep); mutex_unlock(&iser_conn->state_mutex); return error; } diff --git a/drivers/scsi/be2iscsi/be_iscsi.c b/drivers/scsi/be2iscsi/be_is= csi.c index a13c203ef7a9..c4881657a807 100644 --- a/drivers/scsi/be2iscsi/be_iscsi.c +++ b/drivers/scsi/be2iscsi/be_iscsi.c @@ -182,6 +182,7 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_ses= sion, struct beiscsi_endpoint *beiscsi_ep; struct iscsi_endpoint *ep; uint16_t cri_index; + int rc =3D 0; =20 ep =3D iscsi_lookup_endpoint(transport_fd); if (!ep) @@ -189,15 +190,17 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_s= ession, =20 beiscsi_ep =3D ep->dd_data; =20 - if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) - return -EINVAL; + if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) { + rc =3D -EINVAL; + goto put_ep; + } =20 if (beiscsi_ep->phba !=3D phba) { beiscsi_log(phba, KERN_ERR, BEISCSI_LOG_CONFIG, "BS_%d : beiscsi_ep->hba=3D%p not equal to phba=3D%p\n", beiscsi_ep->phba, phba); - - return -EEXIST; + rc =3D -EEXIST; + goto put_ep; } cri_index =3D BE_GET_CRI_FROM_CID(beiscsi_ep->ep_cid); if (phba->conn_table[cri_index]) { @@ -209,7 +212,8 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_ses= sion, beiscsi_ep->ep_cid, beiscsi_conn, phba->conn_table[cri_index]); - return -EINVAL; + rc =3D -EINVAL; + goto put_ep; } } =20 @@ -226,7 +230,10 @@ int beiscsi_conn_bind(struct iscsi_cls_session *cls_se= ssion, "BS_%d : cid %d phba->conn_table[%u]=3D%p\n", beiscsi_ep->ep_cid, cri_index, beiscsi_conn); phba->conn_table[cri_index] =3D beiscsi_conn; - return 0; + +put_ep: + iscsi_put_endpoint(ep); + return rc; } =20 static int beiscsi_iface_create_ipv4(struct beiscsi_hba *phba) diff --git a/drivers/scsi/bnx2i/bnx2i_iscsi.c b/drivers/scsi/bnx2i/bnx2i_is= csi.c index 173d8c6a8cbf..649664dc6da4 100644 --- a/drivers/scsi/bnx2i/bnx2i_iscsi.c +++ b/drivers/scsi/bnx2i/bnx2i_iscsi.c @@ -1422,17 +1422,23 @@ static int bnx2i_conn_bind(struct iscsi_cls_session= *cls_session, * Forcefully terminate all in progress connection recovery at the * earliest, either in bind(), send_pdu(LOGIN), or conn_start() */ - if (bnx2i_adapter_ready(hba)) - return -EIO; + if (bnx2i_adapter_ready(hba)) { + ret_code =3D -EIO; + goto put_ep; + } =20 bnx2i_ep =3D ep->dd_data; if ((bnx2i_ep->state =3D=3D EP_STATE_TCP_FIN_RCVD) || - (bnx2i_ep->state =3D=3D EP_STATE_TCP_RST_RCVD)) + (bnx2i_ep->state =3D=3D EP_STATE_TCP_RST_RCVD)) { /* Peer disconnect via' FIN or RST */ - return -EINVAL; + ret_code =3D -EINVAL; + goto put_ep; + } =20 - if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) - return -EINVAL; + if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) { + ret_code =3D -EINVAL; + goto put_ep; + } =20 if (bnx2i_ep->hba !=3D hba) { /* Error - TCP connection does not belong to this device @@ -1443,7 +1449,8 @@ static int bnx2i_conn_bind(struct iscsi_cls_session *= cls_session, iscsi_conn_printk(KERN_ALERT, cls_conn->dd_data, "belong to hba (%s)\n", hba->netdev->name); - return -EEXIST; + ret_code =3D -EEXIST; + goto put_ep; } bnx2i_ep->conn =3D bnx2i_conn; bnx2i_conn->ep =3D bnx2i_ep; @@ -1460,6 +1467,8 @@ static int bnx2i_conn_bind(struct iscsi_cls_session *= cls_session, bnx2i_put_rq_buf(bnx2i_conn, 0); =20 bnx2i_arm_cq_event_coalescing(bnx2i_conn->ep, CNIC_ARM_CQE); +put_ep: + iscsi_put_endpoint(ep); return ret_code; } =20 diff --git a/drivers/scsi/cxgbi/libcxgbi.c b/drivers/scsi/cxgbi/libcxgbi.c index ecb134b4699f..506b561670af 100644 --- a/drivers/scsi/cxgbi/libcxgbi.c +++ b/drivers/scsi/cxgbi/libcxgbi.c @@ -2690,11 +2690,13 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_s= ession, err =3D csk->cdev->csk_ddp_setup_pgidx(csk, csk->tid, ppm->tformat.pgsz_idx_dflt); if (err < 0) - return err; + goto put_ep; =20 err =3D iscsi_conn_bind(cls_session, cls_conn, is_leading); - if (err) - return -EINVAL; + if (err) { + err =3D -EINVAL; + goto put_ep; + } =20 /* calculate the tag idx bits needed for this conn based on cmds_max */ cconn->task_idx_bits =3D (__ilog2_u32(conn->session->cmds_max - 1)) + 1; @@ -2715,7 +2717,9 @@ int cxgbi_bind_conn(struct iscsi_cls_session *cls_ses= sion, /* init recv engine */ iscsi_tcp_hdr_recv_prep(tcp_conn); =20 - return 0; +put_ep: + iscsi_put_endpoint(ep); + return err; } EXPORT_SYMBOL_GPL(cxgbi_bind_conn); =20 diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c index 8f8036ae9a56..5f7e62f19d83 100644 --- a/drivers/scsi/qedi/qedi_iscsi.c +++ b/drivers/scsi/qedi/qedi_iscsi.c @@ -387,6 +387,7 @@ static int qedi_conn_bind(struct iscsi_cls_session *cls= _session, struct qedi_ctx *qedi =3D iscsi_host_priv(shost); struct qedi_endpoint *qedi_ep; struct iscsi_endpoint *ep; + int rc =3D 0; =20 ep =3D iscsi_lookup_endpoint(transport_fd); if (!ep) @@ -394,11 +395,16 @@ static int qedi_conn_bind(struct iscsi_cls_session *c= ls_session, =20 qedi_ep =3D ep->dd_data; if ((qedi_ep->state =3D=3D EP_STATE_TCP_FIN_RCVD) || - (qedi_ep->state =3D=3D EP_STATE_TCP_RST_RCVD)) - return -EINVAL; + (qedi_ep->state =3D=3D EP_STATE_TCP_RST_RCVD)) { + rc =3D -EINVAL; + goto put_ep; + } + + if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) { + rc =3D -EINVAL; + goto put_ep; + } =20 - if (iscsi_conn_bind(cls_session, cls_conn, is_leading)) - return -EINVAL; =20 qedi_ep->conn =3D qedi_conn; qedi_conn->ep =3D qedi_ep; @@ -408,13 +414,18 @@ static int qedi_conn_bind(struct iscsi_cls_session *c= ls_session, qedi_conn->cmd_cleanup_req =3D 0; qedi_conn->cmd_cleanup_cmpl =3D 0; =20 - if (qedi_bind_conn_to_iscsi_cid(qedi, qedi_conn)) - return -EINVAL; + if (qedi_bind_conn_to_iscsi_cid(qedi, qedi_conn)) { + rc =3D -EINVAL; + goto put_ep; + } + =20 spin_lock_init(&qedi_conn->tmf_work_lock); INIT_LIST_HEAD(&qedi_conn->tmf_work_list); init_waitqueue_head(&qedi_conn->wait_queue); - return 0; +put_ep: + iscsi_put_endpoint(ep); + return rc; } =20 static int qedi_iscsi_update_conn(struct qedi_ctx *qedi, diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c index a8b8bf118c76..8d82d2a83059 100644 --- a/drivers/scsi/qla4xxx/ql4_os.c +++ b/drivers/scsi/qla4xxx/ql4_os.c @@ -3238,6 +3238,7 @@ static int qla4xxx_conn_bind(struct iscsi_cls_session= *cls_session, conn =3D cls_conn->dd_data; qla_conn =3D conn->dd_data; qla_conn->qla_ep =3D ep->dd_data; + iscsi_put_endpoint(ep); return 0; } =20 diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index ed0c7e812445..dea0944ebbfa 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -266,9 +266,20 @@ void iscsi_destroy_endpoint(struct iscsi_endpoint *ep) } EXPORT_SYMBOL_GPL(iscsi_destroy_endpoint); =20 +void iscsi_put_endpoint(struct iscsi_endpoint *ep) +{ + put_device(&ep->dev); +} +EXPORT_SYMBOL_GPL(iscsi_put_endpoint); + +/** + * iscsi_lookup_endpoint - get ep from handle + * @handle: endpoint handle + * + * Caller must do a iscsi_put_endpoint. + */ struct iscsi_endpoint *iscsi_lookup_endpoint(u64 handle) { - struct iscsi_endpoint *ep; struct device *dev; =20 dev =3D class_find_device(&iscsi_endpoint_class, NULL, &handle, @@ -276,13 +287,7 @@ struct iscsi_endpoint *iscsi_lookup_endpoint(u64 handl= e) if (!dev) return NULL; =20 - ep =3D iscsi_dev_to_endpoint(dev); - /* - * we can drop this now because the interface will prevent - * removals and lookups from racing. - */ - put_device(dev); - return ep; + return iscsi_dev_to_endpoint(dev); } EXPORT_SYMBOL_GPL(iscsi_lookup_endpoint); =20 @@ -2983,6 +2988,7 @@ static int iscsi_if_ep_disconnect(struct iscsi_transp= ort *transport, } =20 transport->ep_disconnect(ep); + iscsi_put_endpoint(ep); return 0; } =20 @@ -3008,6 +3014,7 @@ iscsi_if_transport_ep(struct iscsi_transport *transpo= rt, =20 ev->r.retcode =3D transport->ep_poll(ep, ev->u.ep_poll.timeout_ms); + iscsi_put_endpoint(ep); break; case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: rc =3D iscsi_if_ep_disconnect(transport, @@ -3691,6 +3698,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghd= r *nlh, uint32_t *group) ev->u.c_bound_session.initial_cmdsn, ev->u.c_bound_session.cmds_max, ev->u.c_bound_session.queue_depth); + iscsi_put_endpoint(ep); break; case ISCSI_UEVENT_DESTROY_SESSION: session =3D iscsi_session_lookup(ev->u.d_session.sid); @@ -3762,6 +3770,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghd= r *nlh, uint32_t *group) mutex_lock(&conn->ep_mutex); conn->ep =3D ep; mutex_unlock(&conn->ep_mutex); + iscsi_put_endpoint(ep); } else iscsi_cls_conn_printk(KERN_ERR, conn, "Could not set ep conn " diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transp= ort_iscsi.h index eb6ed499324d..09992f019dc9 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -444,6 +444,7 @@ extern int iscsi_scan_finished(struct Scsi_Host *shost,= unsigned long time); extern struct iscsi_endpoint *iscsi_create_endpoint(int dd_size); extern void iscsi_destroy_endpoint(struct iscsi_endpoint *ep); extern struct iscsi_endpoint *iscsi_lookup_endpoint(u64 handle); +extern void iscsi_put_endpoint(struct iscsi_endpoint *ep); extern int iscsi_block_scsi_eh(struct scsi_cmnd *cmd); extern struct iscsi_iface *iscsi_create_iface(struct Scsi_Host *shost, struct iscsi_transport *t, --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1ABD4C433EF for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242702AbiDRNJU (ORCPT ); Mon, 18 Apr 2022 09:09:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240701AbiDRM5o (ORCPT ); Mon, 18 Apr 2022 08:57:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2AA0E1E3FC; Mon, 18 Apr 2022 05:38:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3FDF4B80EDC; Mon, 18 Apr 2022 12:38:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73DE6C385A7; Mon, 18 Apr 2022 12:38:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285482; bh=oCcJ/VsXPr4+CXYdZcrsW4SDFGXLhft1BwchC4UJdJk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hrIQmHtkrRwjUVbe5i8SgtI2hp1XiRfWUlYgY/BY945qnbwiQ2sSh/6WB68O+0iU5 zuJgvoqZ3wrAW3qnMU7/AuAWOWwzRTczVq7XOBvgU81pB2JHBrfn+lcQ5Vaj0cTAfe KpdqYODgmaDnLJmctprCREaaZAEfiox0S5s8gnXw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Duncan , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 031/105] scsi: iscsi: Fix in-kernel conn failure handling Date: Mon, 18 Apr 2022 14:12:33 +0200 Message-Id: <20220418121147.246994205@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit 23d6fefbb3f6b1cc29794427588b470ed06ff64e ] Commit 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in kernel space") has the following regressions/bugs that this patch fixes: 1. It can return cmds to upper layers like dm-multipath where that can retry them. After they are successful the fs/app can send new I/O to the same sectors, but we've left the cmds running in FW or in the net layer. We need to be calling ep_disconnect if userspace is not up. This patch only fixes the issue for offload drivers. iscsi_tcp will be fixed in separate commit because it doesn't have a ep_disconnect call. 2. The drivers that implement ep_disconnect expect that it's called before conn_stop. Besides crashes, if the cleanup_task callout is called before ep_disconnect it might free up driver/card resources for session1 then they could be allocated for session2. But because the driver's ep_disconnect is not called it has not cleaned up the firmware so the card is still using the resources for the original cmd. 3. The stop_conn_work_fn can run after userspace has done its recovery and we are happily using the session. We will then end up with various bugs depending on what is going on at the time. We may also run stop_conn_work_fn late after userspace has called stop_conn and ep_disconnect and is now going to call start/bind conn. If stop_conn_work_fn runs after bind but before start, we would leave the conn in a unbound but sort of started state where IO might be allowed even though the drivers have been set in a state where they no longer expect I/O. 4. Returning -EAGAIN in iscsi_if_destroy_conn if we haven't yet run the in kernel stop_conn function is breaking userspace. We should have been doing this for the caller. Link: https://lore.kernel.org/r/20210525181821.7617-8-michael.christie@orac= le.com Fixes: 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in k= ernel space") Reviewed-by: Lee Duncan Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 471 ++++++++++++++++------------ include/scsi/scsi_transport_iscsi.h | 10 +- 2 files changed, 283 insertions(+), 198 deletions(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index dea0944ebbfa..7246f7b2ff03 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -86,15 +86,11 @@ struct iscsi_internal { struct transport_container session_cont; }; =20 -/* Worker to perform connection failure on unresponsive connections - * completely in kernel space. - */ -static void stop_conn_work_fn(struct work_struct *work); -static DECLARE_WORK(stop_conn_work, stop_conn_work_fn); - static atomic_t iscsi_session_nr; /* sysfs session id for next new session= */ static struct workqueue_struct *iscsi_eh_timer_workq; =20 +static struct workqueue_struct *iscsi_conn_cleanup_workq; + static DEFINE_IDA(iscsi_sess_ida); /* * list of registered transports and lock that must @@ -1601,12 +1597,6 @@ static DECLARE_TRANSPORT_CLASS(iscsi_connection_clas= s, static struct sock *nls; static DEFINE_MUTEX(rx_queue_mutex); =20 -/* - * conn_mutex protects the {start,bind,stop,destroy}_conn from racing - * against the kernel stop_connection recovery mechanism - */ -static DEFINE_MUTEX(conn_mutex); - static LIST_HEAD(sesslist); static DEFINE_SPINLOCK(sesslock); static LIST_HEAD(connlist); @@ -2228,6 +2218,123 @@ void iscsi_remove_session(struct iscsi_cls_session = *session) } EXPORT_SYMBOL_GPL(iscsi_remove_session); =20 +static void iscsi_stop_conn(struct iscsi_cls_conn *conn, int flag) +{ + ISCSI_DBG_TRANS_CONN(conn, "Stopping conn.\n"); + + switch (flag) { + case STOP_CONN_RECOVER: + conn->state =3D ISCSI_CONN_FAILED; + break; + case STOP_CONN_TERM: + conn->state =3D ISCSI_CONN_DOWN; + break; + default: + iscsi_cls_conn_printk(KERN_ERR, conn, "invalid stop flag %d\n", + flag); + return; + } + + conn->transport->stop_conn(conn, flag); + ISCSI_DBG_TRANS_CONN(conn, "Stopping conn done.\n"); +} + +static int iscsi_if_stop_conn(struct iscsi_transport *transport, + struct iscsi_uevent *ev) +{ + int flag =3D ev->u.stop_conn.flag; + struct iscsi_cls_conn *conn; + + conn =3D iscsi_conn_lookup(ev->u.stop_conn.sid, ev->u.stop_conn.cid); + if (!conn) + return -EINVAL; + + ISCSI_DBG_TRANS_CONN(conn, "iscsi if conn stop.\n"); + /* + * If this is a termination we have to call stop_conn with that flag + * so the correct states get set. If we haven't run the work yet try to + * avoid the extra run. + */ + if (flag =3D=3D STOP_CONN_TERM) { + cancel_work_sync(&conn->cleanup_work); + iscsi_stop_conn(conn, flag); + } else { + /* + * Figure out if it was the kernel or userspace initiating this. + */ + if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + iscsi_stop_conn(conn, flag); + } else { + ISCSI_DBG_TRANS_CONN(conn, + "flush kernel conn cleanup.\n"); + flush_work(&conn->cleanup_work); + } + /* + * Only clear for recovery to avoid extra cleanup runs during + * termination. + */ + clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); + } + ISCSI_DBG_TRANS_CONN(conn, "iscsi if conn stop done.\n"); + return 0; +} + +static void iscsi_ep_disconnect(struct iscsi_cls_conn *conn, bool is_activ= e) +{ + struct iscsi_cls_session *session =3D iscsi_conn_to_session(conn); + struct iscsi_endpoint *ep; + + ISCSI_DBG_TRANS_CONN(conn, "disconnect ep.\n"); + conn->state =3D ISCSI_CONN_FAILED; + + if (!conn->ep || !session->transport->ep_disconnect) + return; + + ep =3D conn->ep; + conn->ep =3D NULL; + + session->transport->unbind_conn(conn, is_active); + session->transport->ep_disconnect(ep); + ISCSI_DBG_TRANS_CONN(conn, "disconnect ep done.\n"); +} + +static void iscsi_cleanup_conn_work_fn(struct work_struct *work) +{ + struct iscsi_cls_conn *conn =3D container_of(work, struct iscsi_cls_conn, + cleanup_work); + struct iscsi_cls_session *session =3D iscsi_conn_to_session(conn); + + mutex_lock(&conn->ep_mutex); + /* + * If we are not at least bound there is nothing for us to do. Userspace + * will do a ep_disconnect call if offload is used, but will not be + * doing a stop since there is nothing to clean up, so we have to clear + * the cleanup bit here. + */ + if (conn->state !=3D ISCSI_CONN_BOUND && conn->state !=3D ISCSI_CONN_UP) { + ISCSI_DBG_TRANS_CONN(conn, "Got error while conn is already failed. Igno= ring.\n"); + clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); + mutex_unlock(&conn->ep_mutex); + return; + } + + iscsi_ep_disconnect(conn, false); + + if (system_state !=3D SYSTEM_RUNNING) { + /* + * If the user has set up for the session to never timeout + * then hang like they wanted. For all other cases fail right + * away since userspace is not going to relogin. + */ + if (session->recovery_tmo > 0) + session->recovery_tmo =3D 0; + } + + iscsi_stop_conn(conn, STOP_CONN_RECOVER); + mutex_unlock(&conn->ep_mutex); + ISCSI_DBG_TRANS_CONN(conn, "cleanup done.\n"); +} + void iscsi_free_session(struct iscsi_cls_session *session) { ISCSI_DBG_TRANS_SESSION(session, "Freeing session\n"); @@ -2267,7 +2374,7 @@ iscsi_create_conn(struct iscsi_cls_session *session, = int dd_size, uint32_t cid) =20 mutex_init(&conn->ep_mutex); INIT_LIST_HEAD(&conn->conn_list); - INIT_LIST_HEAD(&conn->conn_list_err); + INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn); conn->transport =3D transport; conn->cid =3D cid; conn->state =3D ISCSI_CONN_DOWN; @@ -2324,7 +2431,6 @@ int iscsi_destroy_conn(struct iscsi_cls_conn *conn) =20 spin_lock_irqsave(&connlock, flags); list_del(&conn->conn_list); - list_del(&conn->conn_list_err); spin_unlock_irqrestore(&connlock, flags); =20 transport_unregister_device(&conn->dev); @@ -2451,83 +2557,6 @@ int iscsi_offload_mesg(struct Scsi_Host *shost, } EXPORT_SYMBOL_GPL(iscsi_offload_mesg); =20 -/* - * This can be called without the rx_queue_mutex, if invoked by the kernel - * stop work. But, in that case, it is guaranteed not to race with - * iscsi_destroy by conn_mutex. - */ -static void iscsi_if_stop_conn(struct iscsi_cls_conn *conn, int flag) -{ - /* - * It is important that this path doesn't rely on - * rx_queue_mutex, otherwise, a thread doing allocation on a - * start_session/start_connection could sleep waiting on a - * writeback to a failed iscsi device, that cannot be recovered - * because the lock is held. If we don't hold it here, the - * kernel stop_conn_work_fn has a chance to stop the broken - * session and resolve the allocation. - * - * Still, the user invoked .stop_conn() needs to be serialized - * with stop_conn_work_fn by a private mutex. Not pretty, but - * it works. - */ - mutex_lock(&conn_mutex); - switch (flag) { - case STOP_CONN_RECOVER: - conn->state =3D ISCSI_CONN_FAILED; - break; - case STOP_CONN_TERM: - conn->state =3D ISCSI_CONN_DOWN; - break; - default: - iscsi_cls_conn_printk(KERN_ERR, conn, - "invalid stop flag %d\n", flag); - goto unlock; - } - - conn->transport->stop_conn(conn, flag); -unlock: - mutex_unlock(&conn_mutex); -} - -static void stop_conn_work_fn(struct work_struct *work) -{ - struct iscsi_cls_conn *conn, *tmp; - unsigned long flags; - LIST_HEAD(recovery_list); - - spin_lock_irqsave(&connlock, flags); - if (list_empty(&connlist_err)) { - spin_unlock_irqrestore(&connlock, flags); - return; - } - list_splice_init(&connlist_err, &recovery_list); - spin_unlock_irqrestore(&connlock, flags); - - list_for_each_entry_safe(conn, tmp, &recovery_list, conn_list_err) { - uint32_t sid =3D iscsi_conn_get_sid(conn); - struct iscsi_cls_session *session; - - session =3D iscsi_session_lookup(sid); - if (session) { - if (system_state !=3D SYSTEM_RUNNING) { - /* - * If the user has set up for the session to - * never timeout then hang like they wanted. - * For all other cases fail right away since - * userspace is not going to relogin. - */ - if (session->recovery_tmo > 0) - session->recovery_tmo =3D 0; - } - - iscsi_if_stop_conn(conn, STOP_CONN_RECOVER); - } - - list_del_init(&conn->conn_list_err); - } -} - void iscsi_conn_error_event(struct iscsi_cls_conn *conn, enum iscsi_err er= ror) { struct nlmsghdr *nlh; @@ -2535,12 +2564,9 @@ void iscsi_conn_error_event(struct iscsi_cls_conn *c= onn, enum iscsi_err error) struct iscsi_uevent *ev; struct iscsi_internal *priv; int len =3D nlmsg_total_size(sizeof(*ev)); - unsigned long flags; =20 - spin_lock_irqsave(&connlock, flags); - list_add(&conn->conn_list_err, &connlist_err); - spin_unlock_irqrestore(&connlock, flags); - queue_work(system_unbound_wq, &stop_conn_work); + if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) + queue_work(iscsi_conn_cleanup_workq, &conn->cleanup_work); =20 priv =3D iscsi_if_transport_lookup(conn->transport); if (!priv) @@ -2870,26 +2896,17 @@ static int iscsi_if_destroy_conn(struct iscsi_transport *transport, struct iscsi_ueve= nt *ev) { struct iscsi_cls_conn *conn; - unsigned long flags; =20 conn =3D iscsi_conn_lookup(ev->u.d_conn.sid, ev->u.d_conn.cid); if (!conn) return -EINVAL; =20 - spin_lock_irqsave(&connlock, flags); - if (!list_empty(&conn->conn_list_err)) { - spin_unlock_irqrestore(&connlock, flags); - return -EAGAIN; - } - spin_unlock_irqrestore(&connlock, flags); - + ISCSI_DBG_TRANS_CONN(conn, "Flushing cleanup during destruction\n"); + flush_work(&conn->cleanup_work); ISCSI_DBG_TRANS_CONN(conn, "Destroying transport conn\n"); =20 - mutex_lock(&conn_mutex); if (transport->destroy_conn) transport->destroy_conn(conn); - mutex_unlock(&conn_mutex); - return 0; } =20 @@ -2966,7 +2983,7 @@ static int iscsi_if_ep_connect(struct iscsi_transport= *transport, } =20 static int iscsi_if_ep_disconnect(struct iscsi_transport *transport, - u64 ep_handle, bool is_active) + u64 ep_handle) { struct iscsi_cls_conn *conn; struct iscsi_endpoint *ep; @@ -2977,17 +2994,30 @@ static int iscsi_if_ep_disconnect(struct iscsi_tran= sport *transport, ep =3D iscsi_lookup_endpoint(ep_handle); if (!ep) return -EINVAL; + conn =3D ep->conn; - if (conn) { - mutex_lock(&conn->ep_mutex); - conn->ep =3D NULL; + if (!conn) { + /* + * conn was not even bound yet, so we can't get iscsi conn + * failures yet. + */ + transport->ep_disconnect(ep); + goto put_ep; + } + + mutex_lock(&conn->ep_mutex); + /* Check if this was a conn error and the kernel took ownership */ + if (test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + ISCSI_DBG_TRANS_CONN(conn, "flush kernel conn cleanup.\n"); mutex_unlock(&conn->ep_mutex); - conn->state =3D ISCSI_CONN_FAILED; =20 - transport->unbind_conn(conn, is_active); + flush_work(&conn->cleanup_work); + goto put_ep; } =20 - transport->ep_disconnect(ep); + iscsi_ep_disconnect(conn, false); + mutex_unlock(&conn->ep_mutex); +put_ep: iscsi_put_endpoint(ep); return 0; } @@ -3018,8 +3048,7 @@ iscsi_if_transport_ep(struct iscsi_transport *transpo= rt, break; case ISCSI_UEVENT_TRANSPORT_EP_DISCONNECT: rc =3D iscsi_if_ep_disconnect(transport, - ev->u.ep_disconnect.ep_handle, - false); + ev->u.ep_disconnect.ep_handle); break; } return rc; @@ -3646,18 +3675,129 @@ iscsi_get_host_stats(struct iscsi_transport *trans= port, struct nlmsghdr *nlh) return err; } =20 +static int iscsi_if_transport_conn(struct iscsi_transport *transport, + struct nlmsghdr *nlh) +{ + struct iscsi_uevent *ev =3D nlmsg_data(nlh); + struct iscsi_cls_session *session; + struct iscsi_cls_conn *conn =3D NULL; + struct iscsi_endpoint *ep; + uint32_t pdu_len; + int err =3D 0; + + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_CREATE_CONN: + return iscsi_if_create_conn(transport, ev); + case ISCSI_UEVENT_DESTROY_CONN: + return iscsi_if_destroy_conn(transport, ev); + case ISCSI_UEVENT_STOP_CONN: + return iscsi_if_stop_conn(transport, ev); + } + + /* + * The following cmds need to be run under the ep_mutex so in kernel + * conn cleanup (ep_disconnect + unbind and conn) is not done while + * these are running. They also must not run if we have just run a conn + * cleanup because they would set the state in a way that might allow + * IO or send IO themselves. + */ + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_START_CONN: + conn =3D iscsi_conn_lookup(ev->u.start_conn.sid, + ev->u.start_conn.cid); + break; + case ISCSI_UEVENT_BIND_CONN: + conn =3D iscsi_conn_lookup(ev->u.b_conn.sid, ev->u.b_conn.cid); + break; + case ISCSI_UEVENT_SEND_PDU: + conn =3D iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid); + break; + } + + if (!conn) + return -EINVAL; + + mutex_lock(&conn->ep_mutex); + if (test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + mutex_unlock(&conn->ep_mutex); + ev->r.retcode =3D -ENOTCONN; + return 0; + } + + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_BIND_CONN: + if (conn->ep) { + /* + * For offload boot support where iscsid is restarted + * during the pivot root stage, the ep will be intact + * here when the new iscsid instance starts up and + * reconnects. + */ + iscsi_ep_disconnect(conn, true); + } + + session =3D iscsi_session_lookup(ev->u.b_conn.sid); + if (!session) { + err =3D -EINVAL; + break; + } + + ev->r.retcode =3D transport->bind_conn(session, conn, + ev->u.b_conn.transport_eph, + ev->u.b_conn.is_leading); + if (!ev->r.retcode) + conn->state =3D ISCSI_CONN_BOUND; + + if (ev->r.retcode || !transport->ep_connect) + break; + + ep =3D iscsi_lookup_endpoint(ev->u.b_conn.transport_eph); + if (ep) { + ep->conn =3D conn; + conn->ep =3D ep; + iscsi_put_endpoint(ep); + } else { + err =3D -ENOTCONN; + iscsi_cls_conn_printk(KERN_ERR, conn, + "Could not set ep conn binding\n"); + } + break; + case ISCSI_UEVENT_START_CONN: + ev->r.retcode =3D transport->start_conn(conn); + if (!ev->r.retcode) + conn->state =3D ISCSI_CONN_UP; + break; + case ISCSI_UEVENT_SEND_PDU: + pdu_len =3D nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); + + if ((ev->u.send_pdu.hdr_size > pdu_len) || + (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) { + err =3D -EINVAL; + break; + } + + ev->r.retcode =3D transport->send_pdu(conn, + (struct iscsi_hdr *)((char *)ev + sizeof(*ev)), + (char *)ev + sizeof(*ev) + ev->u.send_pdu.hdr_size, + ev->u.send_pdu.data_size); + break; + default: + err =3D -ENOSYS; + } + + mutex_unlock(&conn->ep_mutex); + return err; +} =20 static int iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *gro= up) { int err =3D 0; u32 portid; - u32 pdu_len; struct iscsi_uevent *ev =3D nlmsg_data(nlh); struct iscsi_transport *transport =3D NULL; struct iscsi_internal *priv; struct iscsi_cls_session *session; - struct iscsi_cls_conn *conn; struct iscsi_endpoint *ep =3D NULL; =20 if (!netlink_capable(skb, CAP_SYS_ADMIN)) @@ -3734,90 +3874,16 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsg= hdr *nlh, uint32_t *group) else err =3D -EINVAL; break; - case ISCSI_UEVENT_CREATE_CONN: - err =3D iscsi_if_create_conn(transport, ev); - break; - case ISCSI_UEVENT_DESTROY_CONN: - err =3D iscsi_if_destroy_conn(transport, ev); - break; - case ISCSI_UEVENT_BIND_CONN: - session =3D iscsi_session_lookup(ev->u.b_conn.sid); - conn =3D iscsi_conn_lookup(ev->u.b_conn.sid, ev->u.b_conn.cid); - - if (conn && conn->ep) - iscsi_if_ep_disconnect(transport, conn->ep->id, true); - - if (!session || !conn) { - err =3D -EINVAL; - break; - } - - mutex_lock(&conn_mutex); - ev->r.retcode =3D transport->bind_conn(session, conn, - ev->u.b_conn.transport_eph, - ev->u.b_conn.is_leading); - if (!ev->r.retcode) - conn->state =3D ISCSI_CONN_BOUND; - mutex_unlock(&conn_mutex); - - if (ev->r.retcode || !transport->ep_connect) - break; - - ep =3D iscsi_lookup_endpoint(ev->u.b_conn.transport_eph); - if (ep) { - ep->conn =3D conn; - - mutex_lock(&conn->ep_mutex); - conn->ep =3D ep; - mutex_unlock(&conn->ep_mutex); - iscsi_put_endpoint(ep); - } else - iscsi_cls_conn_printk(KERN_ERR, conn, - "Could not set ep conn " - "binding\n"); - break; case ISCSI_UEVENT_SET_PARAM: err =3D iscsi_set_param(transport, ev); break; - case ISCSI_UEVENT_START_CONN: - conn =3D iscsi_conn_lookup(ev->u.start_conn.sid, ev->u.start_conn.cid); - if (conn) { - mutex_lock(&conn_mutex); - ev->r.retcode =3D transport->start_conn(conn); - if (!ev->r.retcode) - conn->state =3D ISCSI_CONN_UP; - mutex_unlock(&conn_mutex); - } - else - err =3D -EINVAL; - break; + case ISCSI_UEVENT_CREATE_CONN: + case ISCSI_UEVENT_DESTROY_CONN: case ISCSI_UEVENT_STOP_CONN: - conn =3D iscsi_conn_lookup(ev->u.stop_conn.sid, ev->u.stop_conn.cid); - if (conn) - iscsi_if_stop_conn(conn, ev->u.stop_conn.flag); - else - err =3D -EINVAL; - break; + case ISCSI_UEVENT_START_CONN: + case ISCSI_UEVENT_BIND_CONN: case ISCSI_UEVENT_SEND_PDU: - pdu_len =3D nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); - - if ((ev->u.send_pdu.hdr_size > pdu_len) || - (ev->u.send_pdu.data_size > (pdu_len - ev->u.send_pdu.hdr_size))) { - err =3D -EINVAL; - break; - } - - conn =3D iscsi_conn_lookup(ev->u.send_pdu.sid, ev->u.send_pdu.cid); - if (conn) { - mutex_lock(&conn_mutex); - ev->r.retcode =3D transport->send_pdu(conn, - (struct iscsi_hdr*)((char*)ev + sizeof(*ev)), - (char*)ev + sizeof(*ev) + ev->u.send_pdu.hdr_size, - ev->u.send_pdu.data_size); - mutex_unlock(&conn_mutex); - } - else - err =3D -EINVAL; + err =3D iscsi_if_transport_conn(transport, nlh); break; case ISCSI_UEVENT_GET_STATS: err =3D iscsi_if_get_stats(transport, nlh); @@ -4820,8 +4886,18 @@ static __init int iscsi_transport_init(void) goto release_nls; } =20 + iscsi_conn_cleanup_workq =3D alloc_workqueue("%s", + WQ_SYSFS | WQ_MEM_RECLAIM | WQ_UNBOUND, 0, + "iscsi_conn_cleanup"); + if (!iscsi_conn_cleanup_workq) { + err =3D -ENOMEM; + goto destroy_wq; + } + return 0; =20 +destroy_wq: + destroy_workqueue(iscsi_eh_timer_workq); release_nls: netlink_kernel_release(nls); unregister_flashnode_bus: @@ -4843,6 +4919,7 @@ static __init int iscsi_transport_init(void) =20 static void __exit iscsi_transport_exit(void) { + destroy_workqueue(iscsi_conn_cleanup_workq); destroy_workqueue(iscsi_eh_timer_workq); netlink_kernel_release(nls); bus_unregister(&iscsi_flashnode_bus); diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transp= ort_iscsi.h index 09992f019dc9..c5d7810fd792 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -197,15 +197,23 @@ enum iscsi_connection_state { ISCSI_CONN_BOUND, }; =20 +#define ISCSI_CLS_CONN_BIT_CLEANUP 1 + struct iscsi_cls_conn { struct list_head conn_list; /* item in connlist */ - struct list_head conn_list_err; /* item in connlist_err */ void *dd_data; /* LLD private data */ struct iscsi_transport *transport; uint32_t cid; /* connection id */ + /* + * This protects the conn startup and binding/unbinding of the ep to + * the conn. Unbinding includes ep_disconnect and stop_conn. + */ struct mutex ep_mutex; struct iscsi_endpoint *ep; =20 + unsigned long flags; + struct work_struct cleanup_work; + struct device dev; /* sysfs transport/container device */ enum iscsi_connection_state state; }; --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71EEDC4167D for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242289AbiDRNSc (ORCPT ); Mon, 18 Apr 2022 09:18:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240750AbiDRM5r (ORCPT ); Mon, 18 Apr 2022 08:57:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ADF9F237C3; Mon, 18 Apr 2022 05:38:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DFF3DB80EDC; Mon, 18 Apr 2022 12:38:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 38A76C385AB; Mon, 18 Apr 2022 12:38:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285487; bh=RdZeJRexRc5cYyhfz/1ZZRz8dp2B8bRR03bjXvJaztI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=isiHAfljSsERzfcVnsNLvxYBU6bnfZUeN85ag2pRAV2f1xPX+0+xr2u47xGWyVa3f tqg7NoFQzZ9pCvQMdiwggGybOYWangL5j8+83lTr0ruMVCUvLGCtZxk48WgiIis5Xr +wj2DPUK/2OVqIHQzhlCm+8FnEkUdaPZeevqQaCA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Rangankar , Lee Duncan , Chris Leech , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 032/105] scsi: iscsi: Move iscsi_ep_disconnect() Date: Mon, 18 Apr 2022 14:12:34 +0200 Message-Id: <20220418121147.292355847@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit c34f95e98d8fb750eefd4f3fe58b4f8b5e89253b ] This patch moves iscsi_ep_disconnect() so it can be called earlier in the next patch. Link: https://lore.kernel.org/r/20220408001314.5014-2-michael.christie@orac= le.com Tested-by: Manish Rangankar Reviewed-by: Lee Duncan Reviewed-by: Chris Leech Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 38 ++++++++++++++--------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index 7246f7b2ff03..8f6dc391356d 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2239,6 +2239,25 @@ static void iscsi_stop_conn(struct iscsi_cls_conn *c= onn, int flag) ISCSI_DBG_TRANS_CONN(conn, "Stopping conn done.\n"); } =20 +static void iscsi_ep_disconnect(struct iscsi_cls_conn *conn, bool is_activ= e) +{ + struct iscsi_cls_session *session =3D iscsi_conn_to_session(conn); + struct iscsi_endpoint *ep; + + ISCSI_DBG_TRANS_CONN(conn, "disconnect ep.\n"); + conn->state =3D ISCSI_CONN_FAILED; + + if (!conn->ep || !session->transport->ep_disconnect) + return; + + ep =3D conn->ep; + conn->ep =3D NULL; + + session->transport->unbind_conn(conn, is_active); + session->transport->ep_disconnect(ep); + ISCSI_DBG_TRANS_CONN(conn, "disconnect ep done.\n"); +} + static int iscsi_if_stop_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev) { @@ -2279,25 +2298,6 @@ static int iscsi_if_stop_conn(struct iscsi_transport= *transport, return 0; } =20 -static void iscsi_ep_disconnect(struct iscsi_cls_conn *conn, bool is_activ= e) -{ - struct iscsi_cls_session *session =3D iscsi_conn_to_session(conn); - struct iscsi_endpoint *ep; - - ISCSI_DBG_TRANS_CONN(conn, "disconnect ep.\n"); - conn->state =3D ISCSI_CONN_FAILED; - - if (!conn->ep || !session->transport->ep_disconnect) - return; - - ep =3D conn->ep; - conn->ep =3D NULL; - - session->transport->unbind_conn(conn, is_active); - session->transport->ep_disconnect(ep); - ISCSI_DBG_TRANS_CONN(conn, "disconnect ep done.\n"); -} - static void iscsi_cleanup_conn_work_fn(struct work_struct *work) { struct iscsi_cls_conn *conn =3D container_of(work, struct iscsi_cls_conn, --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95FD6C4332F for ; Mon, 18 Apr 2022 13:12:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242784AbiDRNOo (ORCPT ); Mon, 18 Apr 2022 09:14:44 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59820 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240754AbiDRM5r (ORCPT ); Mon, 18 Apr 2022 08:57:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 341561EAE1; Mon, 18 Apr 2022 05:38:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C45F0611C9; Mon, 18 Apr 2022 12:38:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC17FC385A1; Mon, 18 Apr 2022 12:38:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285490; bh=i7p1YOA6p0fYT/6rbcn2SjUD3Aoez1I2BKuR2Y8Sbf8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gy7Od/FRNmMlYOnPMekhz2LOpNjolo7iQki+gdCbXWlYrjU8Rdg/oITSmv1xNxlLp kjHFTpEWE0x9QqPuVtKaF/0P/GN4tuu9pek1/QONhm3lFdL8yD1antJRiHlEskNIj9 0Tu/TgL5N5zJQZ9dPYdn3XYjlPQ5NABnOktY+/Fg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Rangankar , Lee Duncan , Chris Leech , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 033/105] scsi: iscsi: Fix offload conn cleanup when iscsid restarts Date: Mon, 18 Apr 2022 14:12:35 +0200 Message-Id: <20220418121147.335723112@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit cbd2283aaf47fef4ded4b29124b1ef3beb515f3a ] When userspace restarts during boot or upgrades it won't know about the offload driver's endpoint and connection mappings. iscsid will start by cleaning up the old session by doing a stop_conn call. Later, if we are able to create a new connection, we clean up the old endpoint during the binding stage. The problem is that if we do stop_conn before doing the ep_disconnect call offload, drivers can still be executing I/O. We then might free tasks from the under the card/driver. This moves the ep_disconnect call to before we do the stop_conn call for this case. It will then work and look like a normal recovery/cleanup procedure from the driver's point of view. Link: https://lore.kernel.org/r/20220408001314.5014-3-michael.christie@orac= le.com Tested-by: Manish Rangankar Reviewed-by: Lee Duncan Reviewed-by: Chris Leech Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 48 +++++++++++++++++------------ 1 file changed, 28 insertions(+), 20 deletions(-) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index 8f6dc391356d..38abc3a15692 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2258,6 +2258,23 @@ static void iscsi_ep_disconnect(struct iscsi_cls_con= n *conn, bool is_active) ISCSI_DBG_TRANS_CONN(conn, "disconnect ep done.\n"); } =20 +static void iscsi_if_disconnect_bound_ep(struct iscsi_cls_conn *conn, + struct iscsi_endpoint *ep, + bool is_active) +{ + /* Check if this was a conn error and the kernel took ownership */ + if (!test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + iscsi_ep_disconnect(conn, is_active); + } else { + ISCSI_DBG_TRANS_CONN(conn, "flush kernel conn cleanup.\n"); + mutex_unlock(&conn->ep_mutex); + + flush_work(&conn->cleanup_work); + + mutex_lock(&conn->ep_mutex); + } +} + static int iscsi_if_stop_conn(struct iscsi_transport *transport, struct iscsi_uevent *ev) { @@ -2278,6 +2295,16 @@ static int iscsi_if_stop_conn(struct iscsi_transport= *transport, cancel_work_sync(&conn->cleanup_work); iscsi_stop_conn(conn, flag); } else { + /* + * For offload, when iscsid is restarted it won't know about + * existing endpoints so it can't do a ep_disconnect. We clean + * it up here for userspace. + */ + mutex_lock(&conn->ep_mutex); + if (conn->ep) + iscsi_if_disconnect_bound_ep(conn, conn->ep, true); + mutex_unlock(&conn->ep_mutex); + /* * Figure out if it was the kernel or userspace initiating this. */ @@ -3006,16 +3033,7 @@ static int iscsi_if_ep_disconnect(struct iscsi_trans= port *transport, } =20 mutex_lock(&conn->ep_mutex); - /* Check if this was a conn error and the kernel took ownership */ - if (test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { - ISCSI_DBG_TRANS_CONN(conn, "flush kernel conn cleanup.\n"); - mutex_unlock(&conn->ep_mutex); - - flush_work(&conn->cleanup_work); - goto put_ep; - } - - iscsi_ep_disconnect(conn, false); + iscsi_if_disconnect_bound_ep(conn, ep, false); mutex_unlock(&conn->ep_mutex); put_ep: iscsi_put_endpoint(ep); @@ -3726,16 +3744,6 @@ static int iscsi_if_transport_conn(struct iscsi_tran= sport *transport, =20 switch (nlh->nlmsg_type) { case ISCSI_UEVENT_BIND_CONN: - if (conn->ep) { - /* - * For offload boot support where iscsid is restarted - * during the pivot root stage, the ep will be intact - * here when the new iscsid instance starts up and - * reconnects. - */ - iscsi_ep_disconnect(conn, true); - } - session =3D iscsi_session_lookup(ev->u.b_conn.sid); if (!session) { err =3D -EINVAL; --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25031C3527A for ; Mon, 18 Apr 2022 13:11:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241682AbiDRNMs (ORCPT ); Mon, 18 Apr 2022 09:12:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46406 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240833AbiDRM55 (ORCPT ); Mon, 18 Apr 2022 08:57:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 96A6523BE2; Mon, 18 Apr 2022 05:38:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 796D4B80EDC; Mon, 18 Apr 2022 12:38:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B3FF9C385A7; Mon, 18 Apr 2022 12:38:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285493; bh=zf+c42DAV0GN0eJ5S2P+F9YIgesB9POh7WPlYDoIUWo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kdPxTrpwRamBv6Sj1aVeflUgOR9uzHUlBYCk/bo02yEVBAXVeGcXFAPAxY680fopx HkvSbajk/rHQMCDlUTs9niorR1QiTK/7fjhU9eglAuieKxCSkffj4Tdi9KQyvCsi1q 5F120RkqeIXG61dWZSTg26DLYQrvLWmKf1jyDjBA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Rangankar , Lee Duncan , Chris Leech , Mike Christie , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 034/105] scsi: iscsi: Fix conn cleanup and stop race during iscsid restart Date: Mon, 18 Apr 2022 14:12:36 +0200 Message-Id: <20220418121147.380776788@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie [ Upstream commit 7c6e99c18167ed89729bf167ccb4a7e3ab3115ba ] If iscsid is doing a stop_conn at the same time the kernel is starting error recovery we can hit a race that allows the cleanup work to run on a valid connection. In the race, iscsi_if_stop_conn sees the cleanup bit set, but it calls flush_work on the clean_work before iscsi_conn_error_event has queued it. The flush then returns before the queueing and so the cleanup_work can run later and disconnect/stop a conn while it's in a connected state. The patch: Commit 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in kernel space") added the late stop_conn call bug originally, and the patch: Commit 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel conn failure handling") attempted to fix it but only fixed the normal EH case and left the above race for the iscsid restart case. For the normal EH case we don't hit the race because we only signal userspace to start recovery after we have done the queueing, so the flush will always catch the queued work or see it completed. For iscsid restart cases like boot, we can hit the race because iscsid will call down to the kernel before the kernel has signaled any error, so both code paths can be running at the same time. This adds a lock around the setting of the cleanup bit and queueing so they happen together. Link: https://lore.kernel.org/r/20220408001314.5014-6-michael.christie@orac= le.com Fixes: 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in k= ernel space") Tested-by: Manish Rangankar Reviewed-by: Lee Duncan Reviewed-by: Chris Leech Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 17 +++++++++++++++++ include/scsi/scsi_transport_iscsi.h | 2 ++ 2 files changed, 19 insertions(+) diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transp= ort_iscsi.c index 38abc3a15692..21cc306a0f11 100644 --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2263,9 +2263,12 @@ static void iscsi_if_disconnect_bound_ep(struct iscs= i_cls_conn *conn, bool is_active) { /* Check if this was a conn error and the kernel took ownership */ + spin_lock_irq(&conn->lock); if (!test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + spin_unlock_irq(&conn->lock); iscsi_ep_disconnect(conn, is_active); } else { + spin_unlock_irq(&conn->lock); ISCSI_DBG_TRANS_CONN(conn, "flush kernel conn cleanup.\n"); mutex_unlock(&conn->ep_mutex); =20 @@ -2308,9 +2311,12 @@ static int iscsi_if_stop_conn(struct iscsi_transport= *transport, /* * Figure out if it was the kernel or userspace initiating this. */ + spin_lock_irq(&conn->lock); if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + spin_unlock_irq(&conn->lock); iscsi_stop_conn(conn, flag); } else { + spin_unlock_irq(&conn->lock); ISCSI_DBG_TRANS_CONN(conn, "flush kernel conn cleanup.\n"); flush_work(&conn->cleanup_work); @@ -2319,7 +2325,9 @@ static int iscsi_if_stop_conn(struct iscsi_transport = *transport, * Only clear for recovery to avoid extra cleanup runs during * termination. */ + spin_lock_irq(&conn->lock); clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); + spin_unlock_irq(&conn->lock); } ISCSI_DBG_TRANS_CONN(conn, "iscsi if conn stop done.\n"); return 0; @@ -2340,7 +2348,9 @@ static void iscsi_cleanup_conn_work_fn(struct work_st= ruct *work) */ if (conn->state !=3D ISCSI_CONN_BOUND && conn->state !=3D ISCSI_CONN_UP) { ISCSI_DBG_TRANS_CONN(conn, "Got error while conn is already failed. Igno= ring.\n"); + spin_lock_irq(&conn->lock); clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); + spin_unlock_irq(&conn->lock); mutex_unlock(&conn->ep_mutex); return; } @@ -2400,6 +2410,7 @@ iscsi_create_conn(struct iscsi_cls_session *session, = int dd_size, uint32_t cid) conn->dd_data =3D &conn[1]; =20 mutex_init(&conn->ep_mutex); + spin_lock_init(&conn->lock); INIT_LIST_HEAD(&conn->conn_list); INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn); conn->transport =3D transport; @@ -2591,9 +2602,12 @@ void iscsi_conn_error_event(struct iscsi_cls_conn *c= onn, enum iscsi_err error) struct iscsi_uevent *ev; struct iscsi_internal *priv; int len =3D nlmsg_total_size(sizeof(*ev)); + unsigned long flags; =20 + spin_lock_irqsave(&conn->lock, flags); if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) queue_work(iscsi_conn_cleanup_workq, &conn->cleanup_work); + spin_unlock_irqrestore(&conn->lock, flags); =20 priv =3D iscsi_if_transport_lookup(conn->transport); if (!priv) @@ -3736,11 +3750,14 @@ static int iscsi_if_transport_conn(struct iscsi_tra= nsport *transport, return -EINVAL; =20 mutex_lock(&conn->ep_mutex); + spin_lock_irq(&conn->lock); if (test_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) { + spin_unlock_irq(&conn->lock); mutex_unlock(&conn->ep_mutex); ev->r.retcode =3D -ENOTCONN; return 0; } + spin_unlock_irq(&conn->lock); =20 switch (nlh->nlmsg_type) { case ISCSI_UEVENT_BIND_CONN: diff --git a/include/scsi/scsi_transport_iscsi.h b/include/scsi/scsi_transp= ort_iscsi.h index c5d7810fd792..037c77fb5dc5 100644 --- a/include/scsi/scsi_transport_iscsi.h +++ b/include/scsi/scsi_transport_iscsi.h @@ -211,6 +211,8 @@ struct iscsi_cls_conn { struct mutex ep_mutex; struct iscsi_endpoint *ep; =20 + /* Used when accessing flags and queueing work. */ + spinlock_t lock; unsigned long flags; struct work_struct cleanup_work; =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C64FC433FE for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242833AbiDRNJa (ORCPT ); Mon, 18 Apr 2022 09:09:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240862AbiDRM6A (ORCPT ); Mon, 18 Apr 2022 08:58:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D74B623BD1; Mon, 18 Apr 2022 05:38:18 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0FD3CB80EDE; Mon, 18 Apr 2022 12:38:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7B7EAC385A1; Mon, 18 Apr 2022 12:38:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285495; bh=FwdpkxLnSJ53/l0PCJZf/GNvyxyRvT/+Ukilz4wFld4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bclpOq2XwRv253ZptPaWn1T2lKCcsQe7KeL653l2Rh4Txm5bKfo0O20oKp6GTjv9/ IwLurQuntnzihNXdVPVP1uIIPJjFxqADF6EOku/LMMUhEOI9R5DmDEwdh2BtMo2cqq HabI5E7NFC6vcKglomLFq+REhlUlwFNPq+w6KgSw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Petr Malat , Marcelo Ricardo Leitner , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 035/105] sctp: Initialize daddr on peeled off socket Date: Mon, 18 Apr 2022 14:12:37 +0200 Message-Id: <20220418121147.426483325@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Petr Malat [ Upstream commit 8467dda0c26583547731e7f3ea73fc3856bae3bf ] Function sctp_do_peeloff() wrongly initializes daddr of the original socket instead of the peeled off socket, which makes getpeername() return zeroes instead of the primary address. Initialize the new socket instead. Fixes: d570ee490fb1 ("[SCTP]: Correctly set daddr for IPv6 sockets during p= eeloff") Signed-off-by: Petr Malat Acked-by: Marcelo Ricardo Leitner Link: https://lore.kernel.org/r/20220409063611.673193-1-oss@malat.biz Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/sctp/socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 0a9e2c7d8e5f..e9b4ea3d934f 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -5518,7 +5518,7 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id,= struct socket **sockp) * Set the daddr and initialize id to something more random and also * copy over any ip options. */ - sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sk); + sp->pf->to_sk_daddr(&asoc->peer.primary_addr, sock->sk); sp->pf->copy_ip_options(sk, sock->sk); =20 /* Populate the fields of the newsk from the oldsk and migrate the --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63130C47084 for ; Mon, 18 Apr 2022 13:08:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240289AbiDRNKt (ORCPT ); Mon, 18 Apr 2022 09:10:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240901AbiDRM6C (ORCPT ); Mon, 18 Apr 2022 08:58:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 35FE323BD3; Mon, 18 Apr 2022 05:38:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6442360FB6; Mon, 18 Apr 2022 12:38:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 78EEFC385A7; Mon, 18 Apr 2022 12:38:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285498; bh=xb0hS4BrdUP+xSIwy3hBDuYk5Yqiydpc9Eeeprbd1yE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wIVLrzkLvTKWC7E8mi4+NWZDzD0hPDvQlNvG0btPhskn7dfJTKFw+TZaGgwW6nYy4 iprG7bWJYtYTOToBM7jY9SiL5L77j5Fzv38pVnTQtls0BN7WxaGleDfsYdnByLViD/ TEJUrpnAsC/K3R1ehAGiueF0cQ4oOOFwz83WNPLM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Athira Rajeev , Shuah Khan , Sasha Levin Subject: [PATCH 5.10 036/105] testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set Date: Mon, 18 Apr 2022 14:12:38 +0200 Message-Id: <20220418121147.471586322@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Athira Rajeev [ Upstream commit ce64763c63854b4079f2e036638aa881a1fb3fbc ] The selftest "mqueue/mq_perf_tests.c" use CPU_ALLOC to allocate CPU set. This cpu set is used further in pthread_attr_setaffinity_np and by pthread_create in the code. But in current code, allocated cpu set is not freed. Fix this issue by adding CPU_FREE in the "shutdown" function which is called in most of the error/exit path for the cleanup. There are few error paths which exit without using shutdown. Add a common goto error path with CPU_FREE for these cases. Fixes: 7820b0715b6f ("tools/selftests: add mq_perf_tests") Signed-off-by: Athira Rajeev Signed-off-by: Shuah Khan Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- .../testing/selftests/mqueue/mq_perf_tests.c | 25 +++++++++++++------ 1 file changed, 17 insertions(+), 8 deletions(-) diff --git a/tools/testing/selftests/mqueue/mq_perf_tests.c b/tools/testing= /selftests/mqueue/mq_perf_tests.c index b019e0b8221c..84fda3b49073 100644 --- a/tools/testing/selftests/mqueue/mq_perf_tests.c +++ b/tools/testing/selftests/mqueue/mq_perf_tests.c @@ -180,6 +180,9 @@ void shutdown(int exit_val, char *err_cause, int line_n= o) if (in_shutdown++) return; =20 + /* Free the cpu_set allocated using CPU_ALLOC in main function */ + CPU_FREE(cpu_set); + for (i =3D 0; i < num_cpus_to_pin; i++) if (cpu_threads[i]) { pthread_kill(cpu_threads[i], SIGUSR1); @@ -551,6 +554,12 @@ int main(int argc, char *argv[]) perror("sysconf(_SC_NPROCESSORS_ONLN)"); exit(1); } + + if (getuid() !=3D 0) + ksft_exit_skip("Not running as root, but almost all tests " + "require root in order to modify\nsystem settings. " + "Exiting.\n"); + cpus_online =3D min(MAX_CPUS, sysconf(_SC_NPROCESSORS_ONLN)); cpu_set =3D CPU_ALLOC(cpus_online); if (cpu_set =3D=3D NULL) { @@ -589,7 +598,7 @@ int main(int argc, char *argv[]) cpu_set)) { fprintf(stderr, "Any given CPU may " "only be given once.\n"); - exit(1); + goto err_code; } else CPU_SET_S(cpus_to_pin[cpu], cpu_set_size, cpu_set); @@ -607,7 +616,7 @@ int main(int argc, char *argv[]) queue_path =3D malloc(strlen(option) + 2); if (!queue_path) { perror("malloc()"); - exit(1); + goto err_code; } queue_path[0] =3D '/'; queue_path[1] =3D 0; @@ -622,17 +631,12 @@ int main(int argc, char *argv[]) fprintf(stderr, "Must pass at least one CPU to continuous " "mode.\n"); poptPrintUsage(popt_context, stderr, 0); - exit(1); + goto err_code; } else if (!continuous_mode) { num_cpus_to_pin =3D 1; cpus_to_pin[0] =3D cpus_online - 1; } =20 - if (getuid() !=3D 0) - ksft_exit_skip("Not running as root, but almost all tests " - "require root in order to modify\nsystem settings. " - "Exiting.\n"); - max_msgs =3D fopen(MAX_MSGS, "r+"); max_msgsize =3D fopen(MAX_MSGSIZE, "r+"); if (!max_msgs) @@ -740,4 +744,9 @@ int main(int argc, char *argv[]) sleep(1); } shutdown(0, "", 0); + +err_code: + CPU_FREE(cpu_set); + exit(1); + } --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 60E76C43217 for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242866AbiDRNJf (ORCPT ); Mon, 18 Apr 2022 09:09:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240920AbiDRM6E (ORCPT ); Mon, 18 Apr 2022 08:58:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F3AE624584; Mon, 18 Apr 2022 05:38:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 516EE60FB6; Mon, 18 Apr 2022 12:38:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 59237C385A1; Mon, 18 Apr 2022 12:38:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285501; bh=LPhHKOINSstWKQi+2gwthSkdUK3cVynKL2KKJd2TJDg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=PagOwU5RS5DMAPfwhAis63yCw2fKsIJl1dqVRHmrC239M9+6Aj4VAf2AA0vMvUjtU CioY2t5EFw4Ry8EzpbCYZlKOYMtY66VNBiFhCSYvXbW+cMAED2XcaG51th8iZ5WePA 2WB6dMu2/anKiWaSkluCMHhRo/Je5RSBCnh3efwM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Adrian Hunter , Ian Rogers , Jiri Olsa , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 5.10 037/105] perf tools: Fix misleading add event PMU debug message Date: Mon, 18 Apr 2022 14:12:39 +0200 Message-Id: <20220418121147.514584230@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Adrian Hunter [ Upstream commit f034fc50d3c7d9385c20d505ab4cf56b8fd18ac7 ] Fix incorrect debug message: Attempting to add event pmu 'intel_pt' with '' that may result in non-fatal errors which always appears with perf record -vv and intel_pt e.g. perf record -vv -e intel_pt//u uname The message is incorrect because there will never be non-fatal errors. Suppress the message if the PMU is 'selectable' i.e. meant to be selected directly as an event. Fixes: 4ac22b484d4c79e8 ("perf parse-events: Make add PMU verbose output cl= earer") Signed-off-by: Adrian Hunter Cc: Ian Rogers Cc: Jiri Olsa Link: http://lore.kernel.org/lkml/20220411061758.2458417-1-adrian.hunter@in= tel.com Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- tools/perf/util/parse-events.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c index 3b273580fb84..3a0a7930cd10 100644 --- a/tools/perf/util/parse-events.c +++ b/tools/perf/util/parse-events.c @@ -1442,7 +1442,9 @@ int parse_events_add_pmu(struct parse_events_state *p= arse_state, bool use_uncore_alias; LIST_HEAD(config_terms); =20 - if (verbose > 1) { + pmu =3D parse_state->fake_pmu ?: perf_pmu__find(name); + + if (verbose > 1 && !(pmu && pmu->selectable)) { fprintf(stderr, "Attempting to add event pmu '%s' with '", name); if (head_config) { @@ -1455,7 +1457,6 @@ int parse_events_add_pmu(struct parse_events_state *p= arse_state, fprintf(stderr, "' that may result in non-fatal errors\n"); } =20 - pmu =3D parse_state->fake_pmu ?: perf_pmu__find(name); if (!pmu) { char *err_str; =20 --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED531C433F5 for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242945AbiDRNJm (ORCPT ); Mon, 18 Apr 2022 09:09:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59692 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240985AbiDRM6P (ORCPT ); Mon, 18 Apr 2022 08:58:15 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B7E83245BE; Mon, 18 Apr 2022 05:38:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id A8096CE10A8; Mon, 18 Apr 2022 12:38:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83FDBC385A7; Mon, 18 Apr 2022 12:38:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285505; bh=AirU343CxNtqZLncGkKyVI4Lv0hgeDUndqqP9Ap/MfI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WbiS8H2JxbQ9cnrD9JDM7Sjmk0Tng0MxJ/cxczTc6WGHqOYNHMMPccBGOnGZzd2mz JDYvacU3qcG2d/RTgVYmL345w1cQWVObiGg+rlL49AmXQT8eJheV6pSIfyYh/68JQ7 eIHJTugEtC3GQXIkFpdD1jqaZXyse7USVohsxC6U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lin Ma , Krzysztof Kozlowski , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 038/105] nfc: nci: add flush_workqueue to prevent uaf Date: Mon, 18 Apr 2022 14:12:40 +0200 Message-Id: <20220418121147.550992267@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Lin Ma [ Upstream commit ef27324e2cb7bb24542d6cb2571740eefe6b00dc ] Our detector found a concurrent use-after-free bug when detaching an NCI device. The main reason for this bug is the unexpected scheduling between the used delayed mechanism (timer and workqueue). The race can be demonstrated below: Thread-1 Thread-2 | nci_dev_up() | nci_open_device() | __nci_request(nci_reset_req) | nci_send_cmd | queue_work(cmd_work) nci_unregister_device() | nci_close_device() | ... del_timer_sync(cmd_timer)[1] | ... | Worker nci_free_device() | nci_cmd_work() kfree(ndev)[3] | mod_timer(cmd_timer)[2] In short, the cleanup routine thought that the cmd_timer has already been detached by [1] but the mod_timer can re-attach the timer [2], even it is already released [3], resulting in UAF. This UAF is easy to trigger, crash trace by POC is like below [ 66.703713] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 66.703974] BUG: KASAN: use-after-free in enqueue_timer+0x448/0x490 [ 66.703974] Write of size 8 at addr ffff888009fb7058 by task kworker/u4:= 1/33 [ 66.703974] [ 66.703974] CPU: 1 PID: 33 Comm: kworker/u4:1 Not tainted 5.18.0-rc2 #5 [ 66.703974] Workqueue: nfc2_nci_cmd_wq nci_cmd_work [ 66.703974] Call Trace: [ 66.703974] [ 66.703974] dump_stack_lvl+0x57/0x7d [ 66.703974] print_report.cold+0x5e/0x5db [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] kasan_report+0xbe/0x1c0 [ 66.703974] ? enqueue_timer+0x448/0x490 [ 66.703974] enqueue_timer+0x448/0x490 [ 66.703974] __mod_timer+0x5e6/0xb80 [ 66.703974] ? mark_held_locks+0x9e/0xe0 [ 66.703974] ? try_to_del_timer_sync+0xf0/0xf0 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x17b/0x410 [ 66.703974] ? queue_work_on+0x61/0x80 [ 66.703974] ? lockdep_hardirqs_on+0xbf/0x130 [ 66.703974] process_one_work+0x8bb/0x1510 [ 66.703974] ? lockdep_hardirqs_on_prepare+0x410/0x410 [ 66.703974] ? pwq_dec_nr_in_flight+0x230/0x230 [ 66.703974] ? rwlock_bug.part.0+0x90/0x90 [ 66.703974] ? _raw_spin_lock_irq+0x41/0x50 [ 66.703974] worker_thread+0x575/0x1190 [ 66.703974] ? process_one_work+0x1510/0x1510 [ 66.703974] kthread+0x2a0/0x340 [ 66.703974] ? kthread_complete_and_exit+0x20/0x20 [ 66.703974] ret_from_fork+0x22/0x30 [ 66.703974] [ 66.703974] [ 66.703974] Allocated by task 267: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] __kasan_kmalloc+0x81/0xa0 [ 66.703974] nci_allocate_device+0xd3/0x390 [ 66.703974] nfcmrvl_nci_register_dev+0x183/0x2c0 [ 66.703974] nfcmrvl_nci_uart_open+0xf2/0x1dd [ 66.703974] nci_uart_tty_ioctl+0x2c3/0x4a0 [ 66.703974] tty_ioctl+0x764/0x1310 [ 66.703974] __x64_sys_ioctl+0x122/0x190 [ 66.703974] do_syscall_64+0x3b/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.703974] [ 66.703974] Freed by task 406: [ 66.703974] kasan_save_stack+0x1e/0x40 [ 66.703974] kasan_set_track+0x21/0x30 [ 66.703974] kasan_set_free_info+0x20/0x30 [ 66.703974] __kasan_slab_free+0x108/0x170 [ 66.703974] kfree+0xb0/0x330 [ 66.703974] nfcmrvl_nci_unregister_dev+0x90/0xd0 [ 66.703974] nci_uart_tty_close+0xdf/0x180 [ 66.703974] tty_ldisc_kill+0x73/0x110 [ 66.703974] tty_ldisc_hangup+0x281/0x5b0 [ 66.703974] __tty_hangup.part.0+0x431/0x890 [ 66.703974] tty_release+0x3a8/0xc80 [ 66.703974] __fput+0x1f0/0x8c0 [ 66.703974] task_work_run+0xc9/0x170 [ 66.703974] exit_to_user_mode_prepare+0x194/0x1a0 [ 66.703974] syscall_exit_to_user_mode+0x19/0x50 [ 66.703974] do_syscall_64+0x48/0x90 [ 66.703974] entry_SYSCALL_64_after_hwframe+0x44/0xae To fix the UAF, this patch adds flush_workqueue() to ensure the nci_cmd_work is finished before the following del_timer_sync. This combination will promise the timer is actually detached. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Signed-off-by: Lin Ma Reviewed-by: Krzysztof Kozlowski Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/nfc/nci/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index e38719e2ee58..2cfff70f70e0 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -548,6 +548,10 @@ static int nci_close_device(struct nci_dev *ndev) mutex_lock(&ndev->req_lock); =20 if (!test_and_clear_bit(NCI_UP, &ndev->flags)) { + /* Need to flush the cmd wq in case + * there is a queued/running cmd_work + */ + flush_workqueue(ndev->cmd_wq); del_timer_sync(&ndev->cmd_timer); del_timer_sync(&ndev->data_timer); mutex_unlock(&ndev->req_lock); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B726FC433EF for ; Mon, 18 Apr 2022 13:13:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237029AbiDRNPg (ORCPT ); Mon, 18 Apr 2022 09:15:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59744 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241007AbiDRM6Q (ORCPT ); Mon, 18 Apr 2022 08:58:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2851D24970; Mon, 18 Apr 2022 05:38:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5A256B80EDB; Mon, 18 Apr 2022 12:38:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5B2CC385A1; Mon, 18 Apr 2022 12:38:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285508; bh=13uqSbcFy9CU1E4qNH4I2MjFXcw2DKhAZLaXAqPt79c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YxJoGzNBKTkruwEcgN0Yrxa/gNWuuWqLCvr1nCuRduJCqmX+AEKz+bAmQg3AhpQd9 jQKUK1hZMp8tIDjJntVNBPbdX04LMVT/5rnf7bkF6Jx5AQt3Vay6zbcC6Dd6QvoTG4 zdhJExiL0cxXIzfiodFnjY3EAzjHcaI0KyEWrBUA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harshit Mogalapalli , Ronnie Sahlberg , Steve French , Sasha Levin Subject: [PATCH 5.10 039/105] cifs: potential buffer overflow in handling symlinks Date: Mon, 18 Apr 2022 14:12:41 +0200 Message-Id: <20220418121147.586348885@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harshit Mogalapalli [ Upstream commit 64c4a37ac04eeb43c42d272f6e6c8c12bfcf4304 ] Smatch printed a warning: arch/x86/crypto/poly1305_glue.c:198 poly1305_update_arch() error: __memcpy() 'dctx->buf' too small (16 vs u32max) It's caused because Smatch marks 'link_len' as untrusted since it comes from sscanf(). Add a check to ensure that 'link_len' is not larger than the size of the 'link_str' buffer. Fixes: c69c1b6eaea1 ("cifs: implement CIFSParseMFSymlink()") Signed-off-by: Harshit Mogalapalli Reviewed-by: Ronnie Sahlberg Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/cifs/link.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/cifs/link.c b/fs/cifs/link.c index 94dab4309fbb..85d30fef98a2 100644 --- a/fs/cifs/link.c +++ b/fs/cifs/link.c @@ -97,6 +97,9 @@ parse_mf_symlink(const u8 *buf, unsigned int buf_len, uns= igned int *_link_len, if (rc !=3D 1) return -EINVAL; =20 + if (link_len > CIFS_MF_SYMLINK_LINK_MAXLEN) + return -EINVAL; + rc =3D symlink_hash(link_len, link_str, md5_hash); if (rc) { cifs_dbg(FYI, "%s: MD5 hash failure: %d\n", __func__, rc); --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8773CC43219 for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242983AbiDRNJp (ORCPT ); Mon, 18 Apr 2022 09:09:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241063AbiDRM6U (ORCPT ); Mon, 18 Apr 2022 08:58:20 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7A1DA24BE9; Mon, 18 Apr 2022 05:38:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id A4984CE10A1; Mon, 18 Apr 2022 12:38:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 985B3C385A1; Mon, 18 Apr 2022 12:38:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285512; bh=OVLTAbOrvMnEDfWeixHUkUQ3+om6Pi0e+oQHgaH7RC4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ql07T+5Ikd27H2rtKLvPyqPKshEynuhzlGrt7t0xrvBycC6bVjWdEfnhzYnceWhx3 axK8SYP4oIkTFP1S7ATxgk9W30htAK3Pe88TkmBCgz6ubWM0ZtG7yqoea0vudcYQzi dt+CiZn0SaFWRJCIJn1MW+c8ySMG7Y05d6HByQ1c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Khazhismel Kumykov , Mike Snitzer , Sasha Levin Subject: [PATCH 5.10 040/105] dm mpath: only use ktime_get_ns() in historical selector Date: Mon, 18 Apr 2022 14:12:42 +0200 Message-Id: <20220418121147.616159582@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Khazhismel Kumykov [ Upstream commit ce40426fdc3c92acdba6b5ca74bc7277ffaa6a3d ] Mixing sched_clock() and ktime_get_ns() usage will give bad results. Switch hst_select_path() from using sched_clock() to ktime_get_ns(). Also rename path_service_time()'s 'sched_now' variable to 'now'. Fixes: 2613eab11996 ("dm mpath: add Historical Service Time Path Selector") Signed-off-by: Khazhismel Kumykov Signed-off-by: Mike Snitzer Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/md/dm-historical-service-time.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/drivers/md/dm-historical-service-time.c b/drivers/md/dm-histor= ical-service-time.c index 186f91e2752c..06fe43c13ba3 100644 --- a/drivers/md/dm-historical-service-time.c +++ b/drivers/md/dm-historical-service-time.c @@ -429,7 +429,7 @@ static struct dm_path *hst_select_path(struct path_sele= ctor *ps, { struct selector *s =3D ps->context; struct path_info *pi =3D NULL, *best =3D NULL; - u64 time_now =3D sched_clock(); + u64 time_now =3D ktime_get_ns(); struct dm_path *ret =3D NULL; unsigned long flags; =20 @@ -470,7 +470,7 @@ static int hst_start_io(struct path_selector *ps, struc= t dm_path *path, =20 static u64 path_service_time(struct path_info *pi, u64 start_time) { - u64 sched_now =3D ktime_get_ns(); + u64 now =3D ktime_get_ns(); =20 /* if a previous disk request has finished after this IO was * sent to the hardware, pretend the submission happened @@ -479,11 +479,11 @@ static u64 path_service_time(struct path_info *pi, u6= 4 start_time) if (time_after64(pi->last_finish, start_time)) start_time =3D pi->last_finish; =20 - pi->last_finish =3D sched_now; - if (time_before64(sched_now, start_time)) + pi->last_finish =3D now; + if (time_before64(now, start_time)) return 0; =20 - return sched_now - start_time; + return now - start_time; } =20 static int hst_end_io(struct path_selector *ps, struct dm_path *path, --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1E69C4167B for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243086AbiDRNJv (ORCPT ); Mon, 18 Apr 2022 09:09:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241101AbiDRM6X (ORCPT ); Mon, 18 Apr 2022 08:58:23 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2610A24F30; Mon, 18 Apr 2022 05:38:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 7F90FCE10AF; Mon, 18 Apr 2022 12:38:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69C12C385A1; Mon, 18 Apr 2022 12:38:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285514; bh=JQnow2SOT802oNKrq1lbJ5cGXDWXQkeciol61Csm9AI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FH2w2omKBKUH9XGk2a4iH1XxIBrvv14eNjqAimMuQbXjPtnCbVM9kvgJL7LFd3+Yg HDxe6+M91eZKeBvbkL3gVliVW4wi5u9nvcDh493IdN0UMt9i91jgl2ellz7TP+BRbD qphU7e3OaGgMAkNHgL/L7sRyoqHhJPRG9f72Y1Gs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeremy Linton , Florian Fainelli , Paolo Abeni , Sasha Levin Subject: [PATCH 5.10 041/105] net: bcmgenet: Revert "Use stronger register read/writes to assure ordering" Date: Mon, 18 Apr 2022 14:12:43 +0200 Message-Id: <20220418121147.644952639@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jeremy Linton [ Upstream commit 2df3fc4a84e917a422935cc5bae18f43f9955d31 ] It turns out after digging deeper into this bug, that it was being triggered by GCC12 failing to call the bcmgenet_enable_dma() routine. Given that a gcc12 fix has been merged [1] and the genet driver now works properly when built with gcc12, this commit should be reverted. [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105160 https://gcc.gnu.org/git/?p=3Dgcc.git;a=3Dcommit;h=3Daabb9a261ef060cf24fd626= 713f1d7d9df81aa57 Fixes: 8d3ea3d402db ("net: bcmgenet: Use stronger register read/writes to a= ssure ordering") Signed-off-by: Jeremy Linton Acked-by: Florian Fainelli Link: https://lore.kernel.org/r/20220412210420.1129430-1-jeremy.linton@arm.= com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/broadcom/genet/bcmgenet.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/e= thernet/broadcom/genet/bcmgenet.c index 7dcd5613ee56..a2062144d7ca 100644 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c @@ -76,7 +76,7 @@ static inline void bcmgenet_writel(u32 value, void __iome= m *offset) if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) __raw_writel(value, offset); else - writel(value, offset); + writel_relaxed(value, offset); } =20 static inline u32 bcmgenet_readl(void __iomem *offset) @@ -84,7 +84,7 @@ static inline u32 bcmgenet_readl(void __iomem *offset) if (IS_ENABLED(CONFIG_MIPS) && IS_ENABLED(CONFIG_CPU_BIG_ENDIAN)) return __raw_readl(offset); else - return readl(offset); + return readl_relaxed(offset); } =20 static inline void dmadesc_set_length_status(struct bcmgenet_priv *priv, --=20 2.35.1 From nobody Thu May 14 09:03:00 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6BD85C433F5 for ; Mon, 18 Apr 2022 13:13:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241612AbiDRNPp (ORCPT ); Mon, 18 Apr 2022 09:15:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59858 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241167AbiDRM60 (ORCPT ); Mon, 18 Apr 2022 08:58:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6591824F38; Mon, 18 Apr 2022 05:38:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DFCBBB80EDE; Mon, 18 Apr 2022 12:38:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F886C385A7; Mon, 18 Apr 2022 12:38:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285521; bh=tGzXzQhqgL+alx1Q6zWeqj7q4zL1AuwH2it+jAec/5w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=t4FlZjJbZgcFdBn2/PUQwNgCwdnn2lScEjyzvfs3ZPUGf6noUFNz5R2rO+1RT3IAw BPFqsN7XVo8cAl3JKbXU3xlwHvoCJiYIPkch7bkrMWXVX0OXbXWZqOZ4QwtnFpkOTd MPgDye1cPpdagF81JjSFJLrha8imZ/6mEsYG4CWA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Aurabindo Pillai , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 042/105] drm/amd: Add USBC connector ID Date: Mon, 18 Apr 2022 14:12:44 +0200 Message-Id: <20220418121147.673400790@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Aurabindo Pillai [ Upstream commit c5c948aa894a831f96fccd025e47186b1ee41615 ] [Why&How] Add a dedicated AMDGPU specific ID for use with newer ASICs that support USB-C output Signed-off-by: Aurabindo Pillai Reviewed-by: Alex Deucher Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/ObjectID.h | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/ObjectID.h b/drivers/gpu/drm/amd/am= dgpu/ObjectID.h index 5b393622f592..a0f0a17e224f 100644 --- a/drivers/gpu/drm/amd/amdgpu/ObjectID.h +++ b/drivers/gpu/drm/amd/amdgpu/ObjectID.h @@ -119,6 +119,7 @@ #define CONNECTOR_OBJECT_ID_eDP 0x14 #define CONNECTOR_OBJECT_ID_MXM 0x15 #define CONNECTOR_OBJECT_ID_LVDS_eDP 0x16 +#define CONNECTOR_OBJECT_ID_USBC 0x17 =20 /* deleted */ =20 --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C73D3C41535 for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243208AbiDRNJz (ORCPT ); Mon, 18 Apr 2022 09:09:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241221AbiDRM63 (ORCPT ); Mon, 18 Apr 2022 08:58:29 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 108E22528C; Mon, 18 Apr 2022 05:38:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 258D8CE10A1; Mon, 18 Apr 2022 12:38:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10A4EC385A7; Mon, 18 Apr 2022 12:38:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285524; bh=XAaasCX6xCKcbAojcF/CjsO+BPY94+d8knZvBYpjBU0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=auCWTnjnabFlb+jPxNfs75fnj32Qm236+/rFie09tIqpxSvnVJb8ddziwTd2TEvH8 P22w6sADtYvyJRYPQ3KGkoPjpCMg6xcOiXjaX0pd0aI9BzfKKFZruFcEXC7Qd0/P2t nO3h1gsCzTkQ5/ewanB0iat8vJ3cY16Ua/QvDn0E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Filipe Manana , "Darrick J. Wong" , David Sterba , Sasha Levin Subject: [PATCH 5.10 043/105] btrfs: fix fallocate to use file_modified to update permissions consistently Date: Mon, 18 Apr 2022 14:12:45 +0200 Message-Id: <20220418121147.702720468@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Darrick J. Wong [ Upstream commit 05fd9564e9faf0f23b4676385e27d9405cef6637 ] Since the initial introduction of (posix) fallocate back at the turn of the century, it has been possible to use this syscall to change the user-visible contents of files. This can happen by extending the file size during a preallocation, or through any of the newer modes (punch, zero range). Because the call can be used to change file contents, we should treat it like we do any other modification to a file -- update the mtime, and drop set[ug]id privileges/capabilities. The VFS function file_modified() does all this for us if pass it a locked inode, so let's make fallocate drop permissions correctly. Reviewed-by: Filipe Manana Signed-off-by: Darrick J. Wong Signed-off-by: David Sterba Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/file.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c index f59ec55e5feb..416a1b753ff6 100644 --- a/fs/btrfs/file.c +++ b/fs/btrfs/file.c @@ -2833,8 +2833,9 @@ int btrfs_replace_file_extents(struct inode *inode, s= truct btrfs_path *path, return ret; } =20 -static int btrfs_punch_hole(struct inode *inode, loff_t offset, loff_t len) +static int btrfs_punch_hole(struct file *file, loff_t offset, loff_t len) { + struct inode *inode =3D file_inode(file); struct btrfs_fs_info *fs_info =3D btrfs_sb(inode->i_sb); struct btrfs_root *root =3D BTRFS_I(inode)->root; struct extent_state *cached_state =3D NULL; @@ -2866,6 +2867,10 @@ static int btrfs_punch_hole(struct inode *inode, lof= f_t offset, loff_t len) goto out_only_mutex; } =20 + ret =3D file_modified(file); + if (ret) + goto out_only_mutex; + lockstart =3D round_up(offset, btrfs_inode_sectorsize(BTRFS_I(inode))); lockend =3D round_down(offset + len, btrfs_inode_sectorsize(BTRFS_I(inode))) - 1; @@ -3301,7 +3306,7 @@ static long btrfs_fallocate(struct file *file, int mo= de, return -EOPNOTSUPP; =20 if (mode & FALLOC_FL_PUNCH_HOLE) - return btrfs_punch_hole(inode, offset, len); + return btrfs_punch_hole(file, offset, len); =20 /* * Only trigger disk allocation, don't trigger qgroup reserve @@ -3323,6 +3328,10 @@ static long btrfs_fallocate(struct file *file, int m= ode, goto out; } =20 + ret =3D file_modified(file); + if (ret) + goto out; + /* * TODO: Move these two operations after we have checked * accurate reserved space, or fallocate can still fail but --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC17FC4167E for ; Mon, 18 Apr 2022 13:08:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243263AbiDRNJ7 (ORCPT ); Mon, 18 Apr 2022 09:09:59 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59696 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241237AbiDRM63 (ORCPT ); Mon, 18 Apr 2022 08:58:29 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0D061F615; Mon, 18 Apr 2022 05:38:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 892A5B80EDB; Mon, 18 Apr 2022 12:38:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D4009C385A1; Mon, 18 Apr 2022 12:38:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285527; bh=6m8ulu5yeovjhGdSHv2UnzVM3/FBsEj8ZYy2VGUeLao=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jo8o0TZs3wlXvkUm71dlrcfpBFSWzMHNFJZNGSudnwnTGZJYavxuA+zT91sOgNDVK sgprCtgHGs4X49VLAhO46JNZhXn4dtVRd8Kf9O7wzlVmxysCRLjGqaaaLF86e54No2 i2rl8+y77+IYsCGG66ZUIUYWcQsNMmQT4dKj4g8g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Josef Bacik , David Sterba , Sasha Levin Subject: [PATCH 5.10 044/105] btrfs: do not warn for free space inode in cow_file_range Date: Mon, 18 Apr 2022 14:12:46 +0200 Message-Id: <20220418121147.730198052@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Josef Bacik [ Upstream commit a7d16d9a07bbcb7dcd5214a1bea75c808830bc0d ] This is a long time leftover from when I originally added the free space inode, the point was to catch cases where we weren't honoring the NOCOW flag. However there exists a race with relocation, if we allocate our free space inode in a block group that is about to be relocated, we could trigger the COW path before the relocation has the opportunity to find the extents and delete the free space cache. In production where we have auto-relocation enabled we're seeing this WARN_ON_ONCE() around 5k times in a 2 week period, so not super common but enough that it's at the top of our metrics. We're properly handling the error here, and with us phasing out v1 space cache anyway just drop the WARN_ON_ONCE. Signed-off-by: Josef Bacik Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/inode.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c index f7f4ac01589b..4a5248097d7a 100644 --- a/fs/btrfs/inode.c +++ b/fs/btrfs/inode.c @@ -995,7 +995,6 @@ static noinline int cow_file_range(struct btrfs_inode *= inode, int ret =3D 0; =20 if (btrfs_is_free_space_inode(inode)) { - WARN_ON_ONCE(1); ret =3D -EINVAL; goto out_unlock; } --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 314FAC433EF for ; Mon, 18 Apr 2022 13:12:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240220AbiDRNPL (ORCPT ); Mon, 18 Apr 2022 09:15:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242468AbiDRM76 (ORCPT ); Mon, 18 Apr 2022 08:59:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E73573121E; Mon, 18 Apr 2022 05:41:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EFAA4B80EC3; Mon, 18 Apr 2022 12:41:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2F0A2C385A7; Mon, 18 Apr 2022 12:41:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285678; bh=xVm6RRwV0iebQzfEjV2PEmWJc2EKFy1OV3lmNHvO7uQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hBnOh1VAq+D8KX7JMaZLUMU5A5jXPxE0gHIRnqjt2P2ZXG9H4xyBGJedhLDScxY9Q 3tgJGRTCo/y+okmhStDaMwOXcSi83icOybMawoyVE3NnsGBVxxjYyJOHPa/YkjjLzx 5plDFz+grcf40bT+ylV7CZAM4rlTMtTnHCg95o+Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alvin Lee , Aric Cyr , Alex Hung , Charlene Liu , Daniel Wheeler , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 045/105] drm/amd/display: fix audio format not updated after edid updated Date: Mon, 18 Apr 2022 14:12:47 +0200 Message-Id: <20220418121147.759894866@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Charlene Liu [ Upstream commit 5e8a71cf13bc9184fee915b2220be71b4c6cac74 ] [why] for the case edid change only changed audio format. driver still need to update stream. Reviewed-by: Alvin Lee Reviewed-by: Aric Cyr Acked-by: Alex Hung Signed-off-by: Charlene Liu Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/display/dc/core/dc_resource.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c b/drivers/gp= u/drm/amd/display/dc/core/dc_resource.c index 5c5ccbad9658..1e47afc4ccc1 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc_resource.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc_resource.c @@ -1701,8 +1701,8 @@ bool dc_is_stream_unchanged( if (old_stream->ignore_msa_timing_param !=3D stream->ignore_msa_timing_pa= ram) return false; =20 - // Only Have Audio left to check whether it is same or not. This is a cor= ner case for Tiled sinks - if (old_stream->audio_info.mode_count !=3D stream->audio_info.mode_count) + /*compare audio info*/ + if (memcmp(&old_stream->audio_info, &stream->audio_info, sizeof(stream->a= udio_info)) !=3D 0) return false; =20 return true; --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D7F2C433F5 for ; Mon, 18 Apr 2022 13:13:42 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241500AbiDRNQN (ORCPT ); Mon, 18 Apr 2022 09:16:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59850 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241474AbiDRM6r (ORCPT ); Mon, 18 Apr 2022 08:58:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 35F3C286FB; Mon, 18 Apr 2022 05:39:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2421B80EDF; Mon, 18 Apr 2022 12:39:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 10DA0C385A7; Mon, 18 Apr 2022 12:39:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285548; bh=w7aXpuwOrzhppGfZ0NAyhIFazOsTIW/sc7x6w0mpvO4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=efcOvuTwCCX2zfnznnA4Fmq56I3JRA9lK/PJ9MszPf2FxBZPvr7bGGcq/Sp7xYGDj ptHQUERiOREmYcY1nEZEoXDDR7KnfRniymLbZJT1dS8vOrLcFlnzKcboVvjqd6mloE WWwJPAJPVGfReK9Na1amlD52kNIIxN+jqGHrWGYE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Anthony Koo , Alex Hung , Chiawen Huang , Daniel Wheeler , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 046/105] drm/amd/display: FEC check in timing validation Date: Mon, 18 Apr 2022 14:12:48 +0200 Message-Id: <20220418121147.788986359@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chiawen Huang [ Upstream commit 7d56a154e22ffb3613fdebf83ec34d5225a22993 ] [Why] disable/enable leads FEC mismatch between hw/sw FEC state. [How] check FEC status to fastboot on/off. Reviewed-by: Anthony Koo Acked-by: Alex Hung Signed-off-by: Chiawen Huang Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd= /display/dc/core/dc.c index 93f5229c303e..ac5323596c65 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1173,6 +1173,10 @@ bool dc_validate_seamless_boot_timing(const struct d= c *dc, if (!link->link_enc->funcs->is_dig_enabled(link->link_enc)) return false; =20 + /* Check for FEC status*/ + if (link->link_enc->funcs->fec_is_active(link->link_enc)) + return false; + enc_inst =3D link->link_enc->funcs->get_dig_frontend(link->link_enc); =20 if (enc_inst =3D=3D ENGINE_ID_UNKNOWN) --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42EBAC433FE for ; Mon, 18 Apr 2022 13:08:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241199AbiDRNL1 (ORCPT ); Mon, 18 Apr 2022 09:11:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241872AbiDRM7J (ORCPT ); Mon, 18 Apr 2022 08:59:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B84342ED6A; Mon, 18 Apr 2022 05:39:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 7EC09611E4; Mon, 18 Apr 2022 12:39:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70BC3C385A8; Mon, 18 Apr 2022 12:39:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285582; bh=YRvKQF4TGz2MGn3Qs1SdkPzV6jURwCpAx/ukdGPJ5Jc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LGswZX1aQYZrpeo7kLHyp2/YBLnCZzQG4P4DnQQuTrm3xHQMAo1gEhYw9d9hF3A2a /v3Z2jM/hlJVYkvryxV1JTwvH7Fg53D+9q1cn5EL64Kn2WBPvGbBHbon017C35B43p bQU2R5aikVSL4ebZQvCkjB4sn+eB8ZezIBNV6jqg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chris Park , Alex Hung , "Leo (Hanghong) Ma" , Daniel Wheeler , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 047/105] drm/amd/display: Update VTEM Infopacket definition Date: Mon, 18 Apr 2022 14:12:49 +0200 Message-Id: <20220418121147.816426452@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leo (Hanghong) Ma [ Upstream commit c9fbf6435162ed5fb7201d1d4adf6585c6a8c327 ] [Why & How] The latest HDMI SPEC has updated the VTEM packet structure, so change the VTEM Infopacket defined in the driver side to align with the SPEC. Reviewed-by: Chris Park Acked-by: Alex Hung Signed-off-by: Leo (Hanghong) Ma Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- .../gpu/drm/amd/display/modules/info_packet/info_packet.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c = b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c index 0fdf7a3e96de..96e18050a617 100644 --- a/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c +++ b/drivers/gpu/drm/amd/display/modules/info_packet/info_packet.c @@ -100,7 +100,8 @@ enum vsc_packet_revision { //PB7 =3D MD0 #define MASK_VTEM_MD0__VRR_EN 0x01 #define MASK_VTEM_MD0__M_CONST 0x02 -#define MASK_VTEM_MD0__RESERVED2 0x0C +#define MASK_VTEM_MD0__QMS_EN 0x04 +#define MASK_VTEM_MD0__RESERVED2 0x08 #define MASK_VTEM_MD0__FVA_FACTOR_M1 0xF0 =20 //MD1 @@ -109,7 +110,7 @@ enum vsc_packet_revision { //MD2 #define MASK_VTEM_MD2__BASE_REFRESH_RATE_98 0x03 #define MASK_VTEM_MD2__RB 0x04 -#define MASK_VTEM_MD2__RESERVED3 0xF8 +#define MASK_VTEM_MD2__NEXT_TFR 0xF8 =20 //MD3 #define MASK_VTEM_MD3__BASE_REFRESH_RATE_07 0xFF --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CB11BC38A2B for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242757AbiDRNOc (ORCPT ); Mon, 18 Apr 2022 09:14:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59864 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242186AbiDRM7l (ORCPT ); Mon, 18 Apr 2022 08:59:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BAF1A2FE5E; Mon, 18 Apr 2022 05:40:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6D7ECB80EDD; Mon, 18 Apr 2022 12:40:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6230C385A7; Mon, 18 Apr 2022 12:40:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285617; bh=hnSeruQ5WyddU9pPERbn+e7vShbePPJJ1EYBzggJ3bY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kOxwiLTxVPGmJaLw7pmKAB4NRFpfIxBVoZWXNw4nF6tMI0zcRoWZ1+EmD+OmW0ZnL mDFuD2ZwjJn4C/vSUtFxeigUjIPE1RWgGuWw4e5fxjGKhgr9rpgvozYEldB5XPw56E d2E1SX9Xtop685uh4OjVMVtlTS5LFo7nqY19OSs0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tushar Patel , Felix Kuehling , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 048/105] drm/amdkfd: Fix Incorrect VMIDs passed to HWS Date: Mon, 18 Apr 2022 14:12:50 +0200 Message-Id: <20220418121147.846266718@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tushar Patel [ Upstream commit b7dfbd2e601f3fee545bc158feceba4f340fe7cf ] Compute-only GPUs have more than 8 VMIDs allocated to KFD. Fix this by passing correct number of VMIDs to HWS v2: squash in warning fix (Alex) Signed-off-by: Tushar Patel Reviewed-by: Felix Kuehling Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 2 +- drivers/gpu/drm/amd/amdkfd/kfd_device.c | 11 +++-------- 2 files changed, 4 insertions(+), 9 deletions(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_drv.c index ed13a2f76884..30659c1776e8 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c @@ -632,7 +632,7 @@ MODULE_PARM_DESC(sched_policy, * Maximum number of processes that HWS can schedule concurrently. The max= imum is the * number of VMIDs assigned to the HWS, which is also the default. */ -int hws_max_conc_proc =3D 8; +int hws_max_conc_proc =3D -1; module_param(hws_max_conc_proc, int, 0444); MODULE_PARM_DESC(hws_max_conc_proc, "Max # processes HWS can execute concurrently when sched_policy=3D0 (0 = =3D no concurrency, #VMIDs for KFD =3D Maximum(default))"); diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_device.c b/drivers/gpu/drm/amd/= amdkfd/kfd_device.c index 84313135c2ea..148e43dee657 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_device.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_device.c @@ -664,15 +664,10 @@ bool kgd2kfd_device_init(struct kfd_dev *kfd, - kfd->vm_info.first_vmid_kfd + 1; =20 /* Verify module parameters regarding mapped process number*/ - if ((hws_max_conc_proc < 0) - || (hws_max_conc_proc > kfd->vm_info.vmid_num_kfd)) { - dev_err(kfd_device, - "hws_max_conc_proc %d must be between 0 and %d, use %d instead\n", - hws_max_conc_proc, kfd->vm_info.vmid_num_kfd, - kfd->vm_info.vmid_num_kfd); + if (hws_max_conc_proc >=3D 0) + kfd->max_proc_per_quantum =3D min((u32)hws_max_conc_proc, kfd->vm_info.v= mid_num_kfd); + else kfd->max_proc_per_quantum =3D kfd->vm_info.vmid_num_kfd; - } else - kfd->max_proc_per_quantum =3D hws_max_conc_proc; =20 /* calculate max size of mqds needed for queues */ size =3D max_num_of_queues_per_device * --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F1FA4C43217 for ; Mon, 18 Apr 2022 13:12:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242260AbiDRNNn (ORCPT ); Mon, 18 Apr 2022 09:13:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242336AbiDRM7t (ORCPT ); Mon, 18 Apr 2022 08:59:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 183AB2019E; Mon, 18 Apr 2022 05:40:52 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A807760FB6; Mon, 18 Apr 2022 12:40:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A115DC385A7; Mon, 18 Apr 2022 12:40:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285651; bh=+c2FCMYkIhAQb6pTpNufiCaP0nYl95lV9Tb0t+9Od+o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FGfDPFHK0DOuH+MQyJNuITiZvG57XrwhsVtNJNan7tNQxyXKDKNnFEjKAPMfmws1S s9HnDMkUqWRZIE5PTNI5iJbkCJD3GcyN2GCxMAq1cTGq6VsMp8bfCv+ezI9nL0Vf9f ckYgg+W+v1AzXSjtFf8cNhHYjsNIK1VIPrTNKOX8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, James Zhu , Tianci Yin , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 049/105] drm/amdgpu/vcn: improve vcn dpg stop procedure Date: Mon, 18 Apr 2022 14:12:51 +0200 Message-Id: <20220418121147.873655891@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tianci Yin [ Upstream commit 6ea239adc2a712eb318f04f5c29b018ba65ea38a ] Prior to disabling dpg, VCN need unpausing dpg mode, or VCN will hang in S3 resuming. Reviewed-by: James Zhu Signed-off-by: Tianci Yin Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/am= dgpu/vcn_v3_0.c index 2099f6ebd833..bdb8e596bda6 100644 --- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c +++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c @@ -1429,8 +1429,11 @@ static int vcn_v3_0_start_sriov(struct amdgpu_device= *adev) =20 static int vcn_v3_0_stop_dpg_mode(struct amdgpu_device *adev, int inst_idx) { + struct dpg_pause_state state =3D {.fw_based =3D VCN_DPG_STATE__UNPAUSE}; uint32_t tmp; =20 + vcn_v3_0_pause_dpg_mode(adev, 0, &state); + /* Wait for power status to be 1 */ SOC15_WAIT_ON_RREG(VCN, inst_idx, mmUVD_POWER_STATUS, 1, UVD_POWER_STATUS__UVD_POWER_STATUS_MASK); --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 920BFC38A05 for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242655AbiDRNOV (ORCPT ); Mon, 18 Apr 2022 09:14:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242391AbiDRM7w (ORCPT ); Mon, 18 Apr 2022 08:59:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CCA1A30F5A; Mon, 18 Apr 2022 05:41:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1A72EB80EC3; Mon, 18 Apr 2022 12:41:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6B01EC385A1; Mon, 18 Apr 2022 12:41:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285662; bh=F744J9Wch+6CYGO7v0bbvWisdqdhidN8eTq9iIl7cEI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VkNhazi0syHTqSzhyTx0umdmncVVAybTjLY/fVG6pxA+5BURrWkTORWaWUgPQ+9PX UrvLLnmElsnGjEyjESbnxk0bIjcSLtwSTd94tCfsJKXuj1q5qipSSPnktuh+r18JqD CF8HkpR6A4rioM7WCaob5FHQzSHhLAaSCSuwBzXs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, QintaoShen , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 050/105] drm/amdkfd: Check for potential null return of kmalloc_array() Date: Mon, 18 Apr 2022 14:12:52 +0200 Message-Id: <20220418121147.902154714@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: QintaoShen [ Upstream commit ebbb7bb9e80305820dc2328a371c1b35679f2667 ] As the kmalloc_array() may return null, the 'event_waiters[i].wait' would l= ead to null-pointer dereference. Therefore, it is better to check the return value of kmalloc_array() to avo= id this confusion. Signed-off-by: QintaoShen Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdkfd/kfd_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/= amdkfd/kfd_events.c index ba2c2ce0c55a..159be13ef20b 100644 --- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c +++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c @@ -531,6 +531,8 @@ static struct kfd_event_waiter *alloc_event_waiters(uin= t32_t num_events) event_waiters =3D kmalloc_array(num_events, sizeof(struct kfd_event_waiter), GFP_KERNEL); + if (!event_waiters) + return NULL; =20 for (i =3D 0; (event_waiters) && (i < num_events) ; i++) { init_wait(&event_waiters[i].wait); --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 63A77C38A04 for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242587AbiDRNOH (ORCPT ); Mon, 18 Apr 2022 09:14:07 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51104 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242399AbiDRM7w (ORCPT ); Mon, 18 Apr 2022 08:59:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 276F6201B2; Mon, 18 Apr 2022 05:41:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B91A760FB6; Mon, 18 Apr 2022 12:41:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADAB7C385A1; Mon, 18 Apr 2022 12:41:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285666; bh=oeyh0lVaDlwDWlKs2RBO8CFapC5V+Qr1deEGbcU334c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dj94Xa7VQkrkdKtlFknuxJzuBGz/pG9KlGzk22M6stKQge5K3N83Xkc+djE8Pss5n mJgjRT5/R0YSl4rYTnqP9m426Jv+ZzU/LVaiAfR7C9hor9oQbO40NfGe44GoQDxWNS t/w8dg9JUGIvKDz3ZRJMuAggCLTGnJrOcDdhdaLM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Kelley , "Andrea Parri (Microsoft)" , Wei Liu , Sasha Levin Subject: [PATCH 5.10 051/105] Drivers: hv: vmbus: Prevent load re-ordering when reading ring buffer Date: Mon, 18 Apr 2022 14:12:53 +0200 Message-Id: <20220418121147.931548862@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Kelley [ Upstream commit b6cae15b5710c8097aad26a2e5e752c323ee5348 ] When reading a packet from a host-to-guest ring buffer, there is no memory barrier between reading the write index (to see if there is a packet to read) and reading the contents of the packet. The Hyper-V host uses store-release when updating the write index to ensure that writes of the packet data are completed first. On the guest side, the processor can reorder and read the packet data before the write index, and sometimes get stale packet data. Getting such stale packet data has been observed in a reproducible case in a VM on ARM64. Fix this by using virt_load_acquire() to read the write index, ensuring that reads of the packet data cannot be reordered before it. Preventing such reordering is logically correct, and with this change, getting stale data can no longer be reproduced. Signed-off-by: Michael Kelley Reviewed-by: Andrea Parri (Microsoft) Link: https://lore.kernel.org/r/1648394710-33480-1-git-send-email-mikelley@= microsoft.com Signed-off-by: Wei Liu Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hv/ring_buffer.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c index 356e22159e83..769851b6e74c 100644 --- a/drivers/hv/ring_buffer.c +++ b/drivers/hv/ring_buffer.c @@ -378,7 +378,16 @@ int hv_ringbuffer_read(struct vmbus_channel *channel, static u32 hv_pkt_iter_avail(const struct hv_ring_buffer_info *rbi) { u32 priv_read_loc =3D rbi->priv_read_index; - u32 write_loc =3D READ_ONCE(rbi->ring_buffer->write_index); + u32 write_loc; + + /* + * The Hyper-V host writes the packet data, then uses + * store_release() to update the write_index. Use load_acquire() + * here to prevent loads of the packet data from being re-ordered + * before the read of the write_index and potentially getting + * stale data. + */ + write_loc =3D virt_load_acquire(&rbi->ring_buffer->write_index); =20 if (write_loc >=3D priv_read_loc) return write_loc - priv_read_loc; --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AEE2C38A02 for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242620AbiDRNOR (ORCPT ); Mon, 18 Apr 2022 09:14:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242406AbiDRM7w (ORCPT ); Mon, 18 Apr 2022 08:59:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5F2F4255BC; Mon, 18 Apr 2022 05:41:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EF5D8611FE; Mon, 18 Apr 2022 12:41:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F304BC385A7; Mon, 18 Apr 2022 12:41:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285669; bh=JL1Fzm5L3B6Voqyw7R6oOuWlRX3RSRLX2xong9QrcAk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=edJ12SJ/DrjfLcCrGI+rLik7S0bDuYCNlts/IM5peAiQJ8tcOhoJzP4uO6CMDAAy1 JGMfdlRr9xTGnJ22Mu/DkRL44B+YxvChIjv/MtNCs1S5ojf+3XcL4Jtf8lLGwQIIcb fO6OFqeIWtiVngd5V8/cTtG6N1bksDYqYGQZ4uyg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bodo Stroesser , Xiaoguang Wang , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 052/105] scsi: target: tcmu: Fix possible page UAF Date: Mon, 18 Apr 2022 14:12:54 +0200 Message-Id: <20220418121147.961157504@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaoguang Wang [ Upstream commit a6968f7a367f128d120447360734344d5a3d5336 ] tcmu_try_get_data_page() looks up pages under cmdr_lock, but it does not take refcount properly and just returns page pointer. When tcmu_try_get_data_page() returns, the returned page may have been freed by tcmu_blocks_release(). We need to get_page() under cmdr_lock to avoid concurrent tcmu_blocks_release(). Link: https://lore.kernel.org/r/20220311132206.24515-1-xiaoguang.wang@linux= .alibaba.com Reviewed-by: Bodo Stroesser Signed-off-by: Xiaoguang Wang Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/target/target_core_user.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core= _user.c index c6950f157b99..c283e45ac300 100644 --- a/drivers/target/target_core_user.c +++ b/drivers/target/target_core_user.c @@ -1676,6 +1676,7 @@ static struct page *tcmu_try_get_block_page(struct tc= mu_dev *udev, uint32_t dbi) mutex_lock(&udev->cmdr_lock); page =3D tcmu_get_block_page(udev, dbi); if (likely(page)) { + get_page(page); mutex_unlock(&udev->cmdr_lock); return page; } @@ -1714,6 +1715,7 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) /* For the vmalloc()ed cmd area pages */ addr =3D (void *)(unsigned long)info->mem[mi].addr + offset; page =3D vmalloc_to_page(addr); + get_page(page); } else { uint32_t dbi; =20 @@ -1724,7 +1726,6 @@ static vm_fault_t tcmu_vma_fault(struct vm_fault *vmf) return VM_FAULT_SIGBUS; } =20 - get_page(page); vmf->page =3D page; return 0; } --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4C197C4332F for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242505AbiDRNOD (ORCPT ); Mon, 18 Apr 2022 09:14:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242416AbiDRM7x (ORCPT ); Mon, 18 Apr 2022 08:59:53 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A61126111; Mon, 18 Apr 2022 05:41:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3578960FB6; Mon, 18 Apr 2022 12:41:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27E91C385A1; Mon, 18 Apr 2022 12:41:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285672; bh=frfWCP/WFjSy1bdWI3vnHvvSGgCADe10jnfJswe0OCM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zph4xvoIoWJXwKWBHxAjkTAhaq1ScJiT1KjVziWlVmcCRvU3WpJPX8fNMUyiicomM Evp2foBgS614A9/OYa9Dzm/ElmhCrE/NQ9mpNjAP+mEtKIdBBYCqeBaH+sQoV90tx6 cmzn8aQhsSFyIuKCdMdZdzNvfHSCStFtolDYdRrY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Justin Tee , James Smart , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 053/105] scsi: lpfc: Fix queue failures when recovering from PCI parity error Date: Mon, 18 Apr 2022 14:12:55 +0200 Message-Id: <20220418121147.989206538@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: James Smart [ Upstream commit df0101197c4d9596682901631f3ee193ed354873 ] When recovering from a pci-parity error the driver is failing to re-create queues, causing recovery to fail. Looking deeper, it was found that the interrupt vector count allocated on the recovery was fewer than the vectors originally allocated. This disparity resulted in CPU map entries with stale information. When the driver tries to re-create the queues, it attempts to use the stale information which indicates an eq/interrupt vector that was no longer created. Fix by clearng the cpup map array before enabling and requesting the IRQs in the lpfc_sli_reset_slot_s4 routine(). Link: https://lore.kernel.org/r/20220317032737.45308-4-jsmart2021@gmail.com Co-developed-by: Justin Tee Signed-off-by: Justin Tee Signed-off-by: James Smart Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/lpfc/lpfc_init.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c index 1149bfc42fe6..134e4ee5dc48 100644 --- a/drivers/scsi/lpfc/lpfc_init.c +++ b/drivers/scsi/lpfc/lpfc_init.c @@ -13614,6 +13614,8 @@ lpfc_io_slot_reset_s4(struct pci_dev *pdev) psli->sli_flag &=3D ~LPFC_SLI_ACTIVE; spin_unlock_irq(&phba->hbalock); =20 + /* Init cpu_map array */ + lpfc_cpu_map_array_init(phba); /* Configure and enable interrupt */ intr_mode =3D lpfc_sli4_enable_intr(phba, phba->intr_mode); if (intr_mode =3D=3D LPFC_INTR_ERROR) { --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14B7EC433F5 for ; Mon, 18 Apr 2022 13:12:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242406AbiDRNOk (ORCPT ); Mon, 18 Apr 2022 09:14:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242427AbiDRM74 (ORCPT ); Mon, 18 Apr 2022 08:59:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A66B26114; Mon, 18 Apr 2022 05:41:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2A32761203; Mon, 18 Apr 2022 12:41:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CF6CC385BC; Mon, 18 Apr 2022 12:41:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285675; bh=s9Rpwm6delKvf/66BvJD66oF5cgx4gOOaaAMGNKINik=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hpum7N+W18g0k68DZkB1kW5/0O2gHtZ39yAZxHhmVeldMtcAQrsfF+0XbbtAlDEnV pJPsC0JZC6H/skfrI/GNb86AdfhfwtL4Z7ySaEzjmUrNs3AZ+AobG+UqLYivoVI4Io Q3N2vRqp7LbC/R0bPgVJppxlwJ4waKUJuSn01QTc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tyrel Datwyler , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 054/105] scsi: ibmvscsis: Increase INITIAL_SRP_LIMIT to 1024 Date: Mon, 18 Apr 2022 14:12:56 +0200 Message-Id: <20220418121148.020490911@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tyrel Datwyler [ Upstream commit 0bade8e53279157c7cc9dd95d573b7e82223d78a ] The adapter request_limit is hardcoded to be INITIAL_SRP_LIMIT which is currently an arbitrary value of 800. Increase this value to 1024 which better matches the characteristics of the typical IBMi Initiator that supports 32 LUNs and a queue depth of 32. This change also has the secondary benefit of being a power of two as required by the kfifo API. Since, Commit ab9bb6318b09 ("Partially revert "kfifo: fix kfifo_alloc() and kfifo_init()"") the size of IU pool for each target has been rounded down to 512 when attempting to kfifo_init() those pools with the current request_limit size of 800. Link: https://lore.kernel.org/r/20220322194443.678433-1-tyreld@linux.ibm.com Signed-off-by: Tyrel Datwyler Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c b/drivers/scsi/ibmvsc= si_tgt/ibmvscsi_tgt.c index cc3908c2d2f9..a3431485def8 100644 --- a/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c +++ b/drivers/scsi/ibmvscsi_tgt/ibmvscsi_tgt.c @@ -35,7 +35,7 @@ =20 #define IBMVSCSIS_VERSION "v0.2" =20 -#define INITIAL_SRP_LIMIT 800 +#define INITIAL_SRP_LIMIT 1024 #define DEFAULT_MAX_SECTORS 256 #define MAX_TXU 1024 * 1024 =20 --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76169C433EF for ; Mon, 18 Apr 2022 13:14:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241781AbiDRNQq (ORCPT ); Mon, 18 Apr 2022 09:16:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241529AbiDRM6u (ORCPT ); Mon, 18 Apr 2022 08:58:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BE10328981; Mon, 18 Apr 2022 05:39:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 64BCDB80EE0; Mon, 18 Apr 2022 12:39:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 84D73C385A1; Mon, 18 Apr 2022 12:39:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285552; bh=WxdINBJhJmuQhfsk54MQKM6StE1JaxXVgmu28O0s0EQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dez/LTALV2Lt5bEe0RN8KPsHI9fg9ZzKUGFv0AYqUFhP9sB2+IX7RHY5mX76polrD 8CWxda9NZV44OM0c/Q4CYOc3g7cZM539JiIjMQ9Gk519BnOCIEyGJHk46Bgu3HsNiZ yfMoMMqEn+1YAfLpxBznQVn9qw2/FSyocz2loxtI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Randy Dunlap , "David S. Miller" , Jakub Kicinski , Paolo Abeni , Sasha Levin Subject: [PATCH 5.10 055/105] net: micrel: fix KS8851_MLL Kconfig Date: Mon, 18 Apr 2022 14:12:57 +0200 Message-Id: <20220418121148.048207658@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Randy Dunlap [ Upstream commit c3efcedd272aa6dd5929e20cf902a52ddaa1197a ] KS8851_MLL selects MICREL_PHY, which depends on PTP_1588_CLOCK_OPTIONAL, so make KS8851_MLL also depend on PTP_1588_CLOCK_OPTIONAL since 'select' does not follow any dependency chains. Fixes kconfig warning and build errors: WARNING: unmet direct dependencies detected for MICREL_PHY Depends on [m]: NETDEVICES [=3Dy] && PHYLIB [=3Dy] && PTP_1588_CLOCK_OPTI= ONAL [=3Dm] Selected by [y]: - KS8851_MLL [=3Dy] && NETDEVICES [=3Dy] && ETHERNET [=3Dy] && NET_VENDOR= _MICREL [=3Dy] && HAS_IOMEM [=3Dy] ld: drivers/net/phy/micrel.o: in function `lan8814_ts_info': micrel.c:(.text+0xb35): undefined reference to `ptp_clock_index' ld: drivers/net/phy/micrel.o: in function `lan8814_probe': micrel.c:(.text+0x2586): undefined reference to `ptp_clock_register' Signed-off-by: Randy Dunlap Cc: "David S. Miller" Cc: Jakub Kicinski Cc: Paolo Abeni Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/micrel/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/micrel/Kconfig b/drivers/net/ethernet/mic= rel/Kconfig index 42bc014136fe..9ceb7e1fb169 100644 --- a/drivers/net/ethernet/micrel/Kconfig +++ b/drivers/net/ethernet/micrel/Kconfig @@ -37,6 +37,7 @@ config KS8851 config KS8851_MLL tristate "Micrel KS8851 MLL" depends on HAS_IOMEM + depends on PTP_1588_CLOCK_OPTIONAL select MII select CRC32 select EEPROM_93CX6 --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CCF3C433F5 for ; Mon, 18 Apr 2022 13:13:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241727AbiDRNQW (ORCPT ); Mon, 18 Apr 2022 09:16:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241559AbiDRM6w (ORCPT ); Mon, 18 Apr 2022 08:58:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0778A2DD5F; Mon, 18 Apr 2022 05:39:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 82B70B80EDC; Mon, 18 Apr 2022 12:39:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E939FC385A7; Mon, 18 Apr 2022 12:39:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285555; bh=v0HGRTeIY/aQdkkcBrv7ONr+/xXqUXqC0m+W9mnTLLo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ubN2p4685ixPHEJMSwpa4tgTzjYfiofBXKyUb2hmddO5qDWEkiAEf0yUcFT/dj9fE 3nwGENYRS6gOUwSlFgn6k+A1iI0YMHF1NEZOZYFKLckm/R7pu+nktHx3npz2RdbpaI +eXoZXV4/YVzd4jiyj+AiS/yZlAxmSqDME8Euyxc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Christian Lamparter , Damien Le Moal , Sasha Levin Subject: [PATCH 5.10 056/105] ata: libata-core: Disable READ LOG DMA EXT for Samsung 840 EVOs Date: Mon, 18 Apr 2022 14:12:58 +0200 Message-Id: <20220418121148.077134618@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christian Lamparter [ Upstream commit 5399752299396a3c9df6617f4b3c907d7aa4ded8 ] Samsung' 840 EVO with the latest firmware (EXT0DB6Q) locks up with the a message: "READ LOG DMA EXT failed, trying PIO" during boot. Initially this was discovered because it caused a crash with the sata_dwc_460ex controller on a WD MyBook Live DUO. The reporter "Tice Rex" which has the unique opportunity that he has two Samsung 840 EVO SSD! One with the older firmware "EXT0BB0Q" which booted fine and didn't expose "READ LOG DMA EXT". But the newer/latest firmware "EXT0DB6Q" caused the headaches. BugLink: https://github.com/openwrt/openwrt/issues/9505 Signed-off-by: Christian Lamparter Signed-off-by: Damien Le Moal Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/ata/libata-core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c index d2b544bdc7b5..f963a0a7da46 100644 --- a/drivers/ata/libata-core.c +++ b/drivers/ata/libata-core.c @@ -3974,6 +3974,9 @@ static const struct ata_blacklist_entry ata_device_bl= acklist [] =3D { ATA_HORKAGE_ZERO_AFTER_TRIM, }, { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Samsung SSD 840 EVO*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_NO_DMA_LOG | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ATA_HORKAGE_ZERO_AFTER_TRIM, }, { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F05BC433EF for ; Mon, 18 Apr 2022 13:14:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241402AbiDRNQe (ORCPT ); Mon, 18 Apr 2022 09:16:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60344 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241595AbiDRM6x (ORCPT ); Mon, 18 Apr 2022 08:58:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 27C512DD70; Mon, 18 Apr 2022 05:39:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9FFA0B80EDB; Mon, 18 Apr 2022 12:39:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D59ECC385A1; Mon, 18 Apr 2022 12:39:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285558; bh=Qem81bJBJ4bXuldztS3i1EFkoRvyIMTGFYIioO0Ei+k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lDlgUxXaOrcsgZ8O2bBzT4PKeq5OAJIkf7rIFV5aY5gMEgsY3OzQtmyOwqqUgUZ2W Q92lgWGQpeOl+dIs8Un0KkpSkogr1BypJ2xdVCTMqaubKq//f8JEOsx+QaE/yxu6W+ vMuOKX+0dP02dzbzXrho/5wHc1l+hhRBSyIF36N0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Leo Ruan , Mark Jonas , Philipp Zabel , Sasha Levin Subject: [PATCH 5.10 057/105] gpu: ipu-v3: Fix dev_dbg frequency output Date: Mon, 18 Apr 2022 14:12:59 +0200 Message-Id: <20220418121148.104674531@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Leo Ruan [ Upstream commit 070a88fd4a03f921b73a2059e97d55faaa447dab ] This commit corrects the printing of the IPU clock error percentage if it is between -0.1% to -0.9%. For example, if the pixel clock requested is 27.2 MHz but only 27.0 MHz can be achieved the deviation is -0.8%. But the fixed point math had a flaw and calculated error of 0.2%. Before: Clocks: IPU 270000000Hz DI 24716667Hz Needed 27200000Hz IPU clock can give 27000000 with divider 10, error 0.2% Want 27200000Hz IPU 270000000Hz DI 24716667Hz using IPU, 27000000Hz After: Clocks: IPU 270000000Hz DI 24716667Hz Needed 27200000Hz IPU clock can give 27000000 with divider 10, error -0.8% Want 27200000Hz IPU 270000000Hz DI 24716667Hz using IPU, 27000000Hz Signed-off-by: Leo Ruan Signed-off-by: Mark Jonas Reviewed-by: Philipp Zabel Signed-off-by: Philipp Zabel Link: https://lore.kernel.org/r/20220207151411.5009-1-mark.jonas@de.bosch.c= om Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/ipu-v3/ipu-di.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/gpu/ipu-v3/ipu-di.c b/drivers/gpu/ipu-v3/ipu-di.c index b4a31d506fcc..74eca68891ad 100644 --- a/drivers/gpu/ipu-v3/ipu-di.c +++ b/drivers/gpu/ipu-v3/ipu-di.c @@ -451,8 +451,9 @@ static void ipu_di_config_clock(struct ipu_di *di, =20 error =3D rate / (sig->mode.pixelclock / 1000); =20 - dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %= d.%u%%\n", - rate, div, (signed)(error - 1000) / 10, error % 10); + dev_dbg(di->ipu->dev, " IPU clock can give %lu with divider %u, error %= c%d.%d%%\n", + rate, div, error < 1000 ? '-' : '+', + abs(error - 1000) / 10, abs(error - 1000) % 10); =20 /* Allow a 1% error */ if (error < 1010 && error >=3D 990) { --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2B431C3527C for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243518AbiDRNKM (ORCPT ); Mon, 18 Apr 2022 09:10:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59686 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241632AbiDRM64 (ORCPT ); Mon, 18 Apr 2022 08:58:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4AA2E2DD4E; Mon, 18 Apr 2022 05:39:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B3A96B80EDC; Mon, 18 Apr 2022 12:39:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E97FC385A1; Mon, 18 Apr 2022 12:39:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285561; bh=PdqZVzizgk6/NDj9Gpg1f+LUl/smdkF9TxT+ushn/pk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dwhbjXLFJVyb1K7YNtPNhGG5o70mwbLJIjhzQC3gguifqyxC/4g8l1nBXkG0ESRZd 59GScqI0oQIjhDkQLHz+dPVGS/kRUayBOn388C0e3EO7Dyu0UctmFLGmEOHLccOdxf 4FsuebWimq03QqdpZ2AMAQlLA5Sv23AZCmlngU1Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Bakker , Charles Keepax , Mark Brown , Sasha Levin Subject: [PATCH 5.10 058/105] regulator: wm8994: Add an off-on delay for WM8994 variant Date: Mon, 18 Apr 2022 14:13:00 +0200 Message-Id: <20220418121148.134499476@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jonathan Bakker [ Upstream commit 92d96b603738ec4f35cde7198c303ae264dd47cb ] As per Table 130 of the wm8994 datasheet at [1], there is an off-on delay for LDO1 and LDO2. In the wm8958 datasheet [2], I could not find any reference to it. I could not find a wm1811 datasheet to double-check there, but as no one has complained presumably it works without it. This solves the issue on Samsung Aries boards with a wm8994 where register writes fail when the device is powered off and back-on quickly. [1] https://statics.cirrus.com/pubs/proDatasheet/WM8994_Rev4.6.pdf [2] https://statics.cirrus.com/pubs/proDatasheet/WM8958_v3.5.pdf Signed-off-by: Jonathan Bakker Acked-by: Charles Keepax Link: https://lore.kernel.org/r/CY4PR04MB056771CFB80DC447C30D5A31CB1D9@CY4P= R04MB0567.namprd04.prod.outlook.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/regulator/wm8994-regulator.c | 42 ++++++++++++++++++++++++++-- 1 file changed, 39 insertions(+), 3 deletions(-) diff --git a/drivers/regulator/wm8994-regulator.c b/drivers/regulator/wm899= 4-regulator.c index cadea0344486..40befdd9dfa9 100644 --- a/drivers/regulator/wm8994-regulator.c +++ b/drivers/regulator/wm8994-regulator.c @@ -71,6 +71,35 @@ static const struct regulator_ops wm8994_ldo2_ops =3D { }; =20 static const struct regulator_desc wm8994_ldo_desc[] =3D { + { + .name =3D "LDO1", + .id =3D 1, + .type =3D REGULATOR_VOLTAGE, + .n_voltages =3D WM8994_LDO1_MAX_SELECTOR + 1, + .vsel_reg =3D WM8994_LDO_1, + .vsel_mask =3D WM8994_LDO1_VSEL_MASK, + .ops =3D &wm8994_ldo1_ops, + .min_uV =3D 2400000, + .uV_step =3D 100000, + .enable_time =3D 3000, + .off_on_delay =3D 36000, + .owner =3D THIS_MODULE, + }, + { + .name =3D "LDO2", + .id =3D 2, + .type =3D REGULATOR_VOLTAGE, + .n_voltages =3D WM8994_LDO2_MAX_SELECTOR + 1, + .vsel_reg =3D WM8994_LDO_2, + .vsel_mask =3D WM8994_LDO2_VSEL_MASK, + .ops =3D &wm8994_ldo2_ops, + .enable_time =3D 3000, + .off_on_delay =3D 36000, + .owner =3D THIS_MODULE, + }, +}; + +static const struct regulator_desc wm8958_ldo_desc[] =3D { { .name =3D "LDO1", .id =3D 1, @@ -172,9 +201,16 @@ static int wm8994_ldo_probe(struct platform_device *pd= ev) * regulator core and we need not worry about it on the * error path. */ - ldo->regulator =3D devm_regulator_register(&pdev->dev, - &wm8994_ldo_desc[id], - &config); + if (ldo->wm8994->type =3D=3D WM8994) { + ldo->regulator =3D devm_regulator_register(&pdev->dev, + &wm8994_ldo_desc[id], + &config); + } else { + ldo->regulator =3D devm_regulator_register(&pdev->dev, + &wm8958_ldo_desc[id], + &config); + } + if (IS_ERR(ldo->regulator)) { ret =3D PTR_ERR(ldo->regulator); dev_err(wm8994->dev, "Failed to register LDO%d: %d\n", --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39D50C4707E for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243555AbiDRNKR (ORCPT ); Mon, 18 Apr 2022 09:10:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241682AbiDRM65 (ORCPT ); Mon, 18 Apr 2022 08:58:57 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B6EFB2DD79; Mon, 18 Apr 2022 05:39:27 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0FBF9B80EDB; Mon, 18 Apr 2022 12:39:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3AF86C385AC; Mon, 18 Apr 2022 12:39:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285564; bh=brtuF43pM50XqWsrLtaTVNwuTiY5ZTnr6ySqkkguyiw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cJ0QvUxo0dGED9bEoAR7GvBWRCtgvtdgCmM0XWWe3vXA9v7pTLUJoLXJx47cyXuwR cTwxKP3OremulL0Jb52MmjLbSsnKnEse3pypodR61qPi1uUTos6FnXjp2/cJhtCL+N O2ZSePoGpk2zeFPrhi+ZnJcp1GQ9IcE6JmFLL2SY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Joey Gouly , Mark Rutland , Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH 5.10 059/105] arm64: alternatives: mark patch_alternative() as `noinstr` Date: Mon, 18 Apr 2022 14:13:01 +0200 Message-Id: <20220418121148.162990767@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Joey Gouly [ Upstream commit a2c0b0fbe01419f8f5d1c0b9c581631f34ffce8b ] The alternatives code must be `noinstr` such that it does not patch itself, as the cache invalidation is only performed after all the alternatives have been applied. Mark patch_alternative() as `noinstr`. Mark branch_insn_requires_update() and get_alt_insn() with `__always_inline` since they are both only called through patch_alternative(). Booting a kernel in QEMU TCG with KCSAN=3Dy and ARM64_USE_LSE_ATOMICS=3Dy c= aused a boot hang: [ 0.241121] CPU: All CPU(s) started at EL2 The alternatives code was patching the atomics in __tsan_read4() from LL/SC atomics to LSE atomics. The following fragment is using LL/SC atomics in the .text section: | <__tsan_unaligned_read4+304>: ldxr x6, [x2] | <__tsan_unaligned_read4+308>: add x6, x6, x5 | <__tsan_unaligned_read4+312>: stxr w7, x6, [x2] | <__tsan_unaligned_read4+316>: cbnz w7, <__tsan_unaligned_read4+3= 04> This LL/SC atomic sequence was to be replaced with LSE atomics. However sin= ce the alternatives code was instrumentable, __tsan_read4() was being called a= fter only the first instruction was replaced, which led to the following code in= memory: | <__tsan_unaligned_read4+304>: ldadd x5, x6, [x2] | <__tsan_unaligned_read4+308>: add x6, x6, x5 | <__tsan_unaligned_read4+312>: stxr w7, x6, [x2] | <__tsan_unaligned_read4+316>: cbnz w7, <__tsan_unaligned_read4+3= 04> This caused an infinite loop as the `stxr` instruction never completed succ= essfully, so `w7` was always 0. Signed-off-by: Joey Gouly Cc: Mark Rutland Cc: Catalin Marinas Cc: Will Deacon Link: https://lore.kernel.org/r/20220405104733.11476-1-joey.gouly@arm.com Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm64/kernel/alternative.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternativ= e.c index 73039949b5ce..5f8e4c2df53c 100644 --- a/arch/arm64/kernel/alternative.c +++ b/arch/arm64/kernel/alternative.c @@ -41,7 +41,7 @@ bool alternative_is_applied(u16 cpufeature) /* * Check if the target PC is within an alternative block. */ -static bool branch_insn_requires_update(struct alt_instr *alt, unsigned lo= ng pc) +static __always_inline bool branch_insn_requires_update(struct alt_instr *= alt, unsigned long pc) { unsigned long replptr =3D (unsigned long)ALT_REPL_PTR(alt); return !(pc >=3D replptr && pc <=3D (replptr + alt->alt_len)); @@ -49,7 +49,7 @@ static bool branch_insn_requires_update(struct alt_instr = *alt, unsigned long pc) =20 #define align_down(x, a) ((unsigned long)(x) & ~(((unsigned long)(a)) - 1)) =20 -static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *al= tinsnptr) +static __always_inline u32 get_alt_insn(struct alt_instr *alt, __le32 *ins= nptr, __le32 *altinsnptr) { u32 insn; =20 @@ -94,7 +94,7 @@ static u32 get_alt_insn(struct alt_instr *alt, __le32 *in= snptr, __le32 *altinsnp return insn; } =20 -static void patch_alternative(struct alt_instr *alt, +static noinstr void patch_alternative(struct alt_instr *alt, __le32 *origptr, __le32 *updptr, int nr_inst) { __le32 *replptr; --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D5D9C4707F for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243687AbiDRNKX (ORCPT ); Mon, 18 Apr 2022 09:10:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59820 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241683AbiDRM66 (ORCPT ); Mon, 18 Apr 2022 08:58:58 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 327162E686; Mon, 18 Apr 2022 05:39:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4D716611AD; Mon, 18 Apr 2022 12:39:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5E088C385A7; Mon, 18 Apr 2022 12:39:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285567; bh=FxXsQ/0pA/79CvGYTRmab7Da+yVjb4SEgBgD6c/awrc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=n23plHYSzx2wu8vW+1Wig0D3BG93EanN7HG1uw7+FzddDGzqS0Uts3v663yQvTqkA TvIWoNbmxeGQx0tA8T82n+Ro6XjKS2T9r8OL5lFxLN1tBnAp61rs3Ey+veHlLsz0dP +z+ZmigWpZvRaF+45n7396Yz2CVtS07HFxKGe3gA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Hildenbrand , "Peter Zijlstra (Intel)" , Anshuman Khandual , Catalin Marinas , Will Deacon , Steve Capper , Sasha Levin Subject: [PATCH 5.10 060/105] tlb: hugetlb: Add more sizes to tlb_remove_huge_tlb_entry Date: Mon, 18 Apr 2022 14:13:02 +0200 Message-Id: <20220418121148.191339785@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Steve Capper [ Upstream commit 697a1d44af8ba0477ee729e632f4ade37999249a ] tlb_remove_huge_tlb_entry only considers PMD_SIZE and PUD_SIZE when updating the mmu_gather structure. Unfortunately on arm64 there are two additional huge page sizes that need to be covered: CONT_PTE_SIZE and CONT_PMD_SIZE. Where an end-user attempts to employ contiguous huge pages, a VM_BUG_ON can be experienced due to the fact that the tlb structure hasn't been correctly updated by the relevant tlb_flush_p.._range() call from tlb_remove_huge_tlb_entry. This patch adds inequality logic to the generic implementation of tlb_remove_huge_tlb_entry s.t. CONT_PTE_SIZE and CONT_PMD_SIZE are effectively covered on arm64. Also, as well as ptes, pmds and puds; p4ds are now considered too. Reported-by: David Hildenbrand Suggested-by: Peter Zijlstra (Intel) Cc: Anshuman Khandual Cc: Catalin Marinas Cc: Will Deacon Link: https://lore.kernel.org/linux-mm/811c5c8e-b3a2-85d2-049c-717f17c3a03a= @redhat.com/ Signed-off-by: Steve Capper Acked-by: David Hildenbrand Reviewed-by: Anshuman Khandual Reviewed-by: Catalin Marinas Acked-by: Peter Zijlstra (Intel) Link: https://lore.kernel.org/r/20220330112543.863-1-steve.capper@arm.com Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/asm-generic/tlb.h | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/include/asm-generic/tlb.h b/include/asm-generic/tlb.h index 6661ee1cff47..a0c4b99d2899 100644 --- a/include/asm-generic/tlb.h +++ b/include/asm-generic/tlb.h @@ -563,10 +563,14 @@ static inline void tlb_flush_p4d_range(struct mmu_gat= her *tlb, #define tlb_remove_huge_tlb_entry(h, tlb, ptep, address) \ do { \ unsigned long _sz =3D huge_page_size(h); \ - if (_sz =3D=3D PMD_SIZE) \ - tlb_flush_pmd_range(tlb, address, _sz); \ - else if (_sz =3D=3D PUD_SIZE) \ + if (_sz >=3D P4D_SIZE) \ + tlb_flush_p4d_range(tlb, address, _sz); \ + else if (_sz >=3D PUD_SIZE) \ tlb_flush_pud_range(tlb, address, _sz); \ + else if (_sz >=3D PMD_SIZE) \ + tlb_flush_pmd_range(tlb, address, _sz); \ + else \ + tlb_flush_pte_range(tlb, address, _sz); \ __tlb_remove_tlb_entry(tlb, ptep, address); \ } while (0) =20 --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 492FFC3527D for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243625AbiDRNKU (ORCPT ); Mon, 18 Apr 2022 09:10:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60544 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241729AbiDRM7A (ORCPT ); Mon, 18 Apr 2022 08:59:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EFC7B2E6AB; Mon, 18 Apr 2022 05:39:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4D587611E4; Mon, 18 Apr 2022 12:39:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 57ECBC385A7; Mon, 18 Apr 2022 12:39:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285570; bh=yPzZImCeywqgb6Hi35+BrRKl0GUG10be3drdyior0oY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=uOF2pZMj7/H7yYJdBOLhIpvtK3jLEqyGn56LFHHqozFaIFL4C2ygBVl3o+8WcJYPA 4WDMYiFLvl5uxrn7Ch6nrHJxfQoT5tSdhBrPrL6qg56Q8q1y8qKme5b6Qjbhr7byHj glCxqBe5eCOFCfEgaxCkaMHVZHeJDLftb30sO7D0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andy Chiu , Greentime Hu , Robert Hancock , Radhey Shyam Pandey , Andrew Lunn , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 061/105] net: axienet: setup mdio unconditionally Date: Mon, 18 Apr 2022 14:13:03 +0200 Message-Id: <20220418121148.219972068@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andy Chiu [ Upstream commit d1c4f93e3f0a023024a6f022a61528c06cf1daa9 ] The call to axienet_mdio_setup should not depend on whether "phy-node" pressents on the DT. Besides, since `lp->phy_node` is used if PHY is in SGMII or 100Base-X modes, move it into the if statement. And the next patch will remove `lp->phy_node` from driver's private structure and do an of_node_put on it right away after use since it is not used elsewhere. Signed-off-by: Andy Chiu Reviewed-by: Greentime Hu Reviewed-by: Robert Hancock Reviewed-by: Radhey Shyam Pandey Reviewed-by: Andrew Lunn Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/ne= t/ethernet/xilinx/xilinx_axienet_main.c index bbdcba88c021..3d91baf2e55a 100644 --- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c +++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c @@ -2060,15 +2060,14 @@ static int axienet_probe(struct platform_device *pd= ev) if (ret) goto cleanup_clk; =20 - lp->phy_node =3D of_parse_phandle(pdev->dev.of_node, "phy-handle", 0); - if (lp->phy_node) { - ret =3D axienet_mdio_setup(lp); - if (ret) - dev_warn(&pdev->dev, - "error registering MDIO bus: %d\n", ret); - } + ret =3D axienet_mdio_setup(lp); + if (ret) + dev_warn(&pdev->dev, + "error registering MDIO bus: %d\n", ret); + if (lp->phy_mode =3D=3D PHY_INTERFACE_MODE_SGMII || lp->phy_mode =3D=3D PHY_INTERFACE_MODE_1000BASEX) { + lp->phy_node =3D of_parse_phandle(pdev->dev.of_node, "phy-handle", 0); if (!lp->phy_node) { dev_err(&pdev->dev, "phy-handle required for 1000BaseX/SGMII\n"); ret =3D -EINVAL; --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6C1B5C3527E for ; Mon, 18 Apr 2022 13:08:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243771AbiDRNK1 (ORCPT ); Mon, 18 Apr 2022 09:10:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241769AbiDRM7B (ORCPT ); Mon, 18 Apr 2022 08:59:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 14CDF2E9D0; Mon, 18 Apr 2022 05:39:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5DBC06101A; Mon, 18 Apr 2022 12:39:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 557F7C385A1; Mon, 18 Apr 2022 12:39:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285573; bh=qZSXjs+NYLT5X2fXq/fCtnOcsC+b4SBYHJgC+XXRr28=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nQX/F+5Yt4an6cF348JyiHsqqNzklxSIPv7vUx9TjADV1JxopwnzxV8pC0rMGK5Wi AyIdZnWtm6ogYO3CB331BsIDW1P58kxxn+gRseN0JSEco4vbjwrrJjx2jRmjrmsEEN W/DjUq/fupmUoPpPycROZpkmiySYGKAhkXuRqqgc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcin Kozlowski , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 062/105] net: usb: aqc111: Fix out-of-bounds accesses in RX fixup Date: Mon, 18 Apr 2022 14:13:04 +0200 Message-Id: <20220418121148.249605680@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marcin Kozlowski [ Upstream commit afb8e246527536848b9b4025b40e613edf776a9d ] aqc111_rx_fixup() contains several out-of-bounds accesses that can be triggered by a malicious (or defective) USB device, in particular: - The metadata array (desc_offset..desc_offset+2*pkt_count) can be out of = bounds, causing OOB reads and (on big-endian systems) OOB endianness flips. - A packet can overlap the metadata array, causing a later OOB endianness flip to corrupt data used by a cloned SKB that has already been handed off into the network stack. - A packet SKB can be constructed whose tail is far beyond its end, causing out-of-bounds heap data to be considered part of the SKB's data. Found doing variant analysis. Tested it with another driver (ax88179_178a),= since I don't have a aqc111 device to test it, but the code looks very similar. Signed-off-by: Marcin Kozlowski Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/usb/aqc111.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/net/usb/aqc111.c b/drivers/net/usb/aqc111.c index 0717c18015c9..c9c409518174 100644 --- a/drivers/net/usb/aqc111.c +++ b/drivers/net/usb/aqc111.c @@ -1102,10 +1102,15 @@ static int aqc111_rx_fixup(struct usbnet *dev, stru= ct sk_buff *skb) if (start_of_descs !=3D desc_offset) goto err; =20 - /* self check desc_offset from header*/ - if (desc_offset >=3D skb_len) + /* self check desc_offset from header and make sure that the + * bounds of the metadata array are inside the SKB + */ + if (pkt_count * 2 + desc_offset >=3D skb_len) goto err; =20 + /* Packets must not overlap the metadata array */ + skb_trim(skb, desc_offset); + if (pkt_count =3D=3D 0) goto err; =20 --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 489C9C433F5 for ; Mon, 18 Apr 2022 13:14:40 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232596AbiDRNRN (ORCPT ); Mon, 18 Apr 2022 09:17:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241810AbiDRM7D (ORCPT ); Mon, 18 Apr 2022 08:59:03 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 46FE31FCD4; Mon, 18 Apr 2022 05:39:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E5CADB80EC0; Mon, 18 Apr 2022 12:39:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5C5B0C385A8; Mon, 18 Apr 2022 12:39:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285576; bh=jkM/RKdyK/H5xm4aNkhaPVHUFc65CBbp7zNjhnkRVso=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=euE4yi4u3Qh0i0NUSv2/tw9PMLZTrleGQKRDLBiBjtvOUIEU98SZLaXAytR1S6dWj e9IgE23lPXAx6pKzwa4XeOz2S6eQqgfeNwg7wPy+CDZiyaCyX37n37tqNxEBavxr00 1zKudYPeoHJGdqTTz5Wv+fMBDdMlKo/ef7tPCXc4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaomeng Tong , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 063/105] myri10ge: fix an incorrect free for skb in myri10ge_sw_tso Date: Mon, 18 Apr 2022 14:13:05 +0200 Message-Id: <20220418121148.277931257@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaomeng Tong [ Upstream commit b423e54ba965b4469b48e46fd16941f1e1701697 ] All remaining skbs should be released when myri10ge_xmit fails to transmit a packet. Fix it within another skb_list_walk_safe. Signed-off-by: Xiaomeng Tong Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/myricom/myri10ge/myri10ge.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c b/drivers/net= /ethernet/myricom/myri10ge/myri10ge.c index fc99ad8e4a38..1664e9184c9c 100644 --- a/drivers/net/ethernet/myricom/myri10ge/myri10ge.c +++ b/drivers/net/ethernet/myricom/myri10ge/myri10ge.c @@ -2895,11 +2895,9 @@ static netdev_tx_t myri10ge_sw_tso(struct sk_buff *s= kb, status =3D myri10ge_xmit(curr, dev); if (status !=3D 0) { dev_kfree_skb_any(curr); - if (segs !=3D NULL) { - curr =3D segs; - segs =3D next; + skb_list_walk_safe(next, curr, next) { curr->next =3D NULL; - dev_kfree_skb_any(segs); + dev_kfree_skb_any(curr); } goto drop; } --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A86BC433FE for ; Mon, 18 Apr 2022 13:08:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240924AbiDRNK4 (ORCPT ); Mon, 18 Apr 2022 09:10:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59862 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241837AbiDRM7G (ORCPT ); Mon, 18 Apr 2022 08:59:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7AB102ED4A; Mon, 18 Apr 2022 05:39:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0B1B1B80EDB; Mon, 18 Apr 2022 12:39:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5A465C385AB; Mon, 18 Apr 2022 12:39:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285579; bh=Qn6auaIHQqy9g4NZVcZdSXXlNdVGB9qoFuf8cv48lK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2m/IOkZdVl6RliLHXGlZJruV6HdAS0lGBEvXDT/jNWbvLadBFDGFGUXnohnr4MFu3 hv3YQNySIKiBXgodkuaa7frIjSiZrZ8AJu0mpqS4vvdBgIDYv/+y9RQgA95QQWaOOu mrgiYBBRIe3Ep/AZH2D/bJwNRa8gSuOHY84ai5rE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, George Shen , Alex Hung , Martin Leung , Daniel Wheeler , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 064/105] drm/amd/display: Revert FEC check in validation Date: Mon, 18 Apr 2022 14:13:06 +0200 Message-Id: <20220418121148.306443699@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Martin Leung [ Upstream commit b2075fce104b88b789c15ef1ed2b91dc94198e26 ] why and how: causes failure on install on certain machines Reviewed-by: George Shen Acked-by: Alex Hung Signed-off-by: Martin Leung Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/display/dc/core/dc.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/drivers/gpu/drm/amd/display/dc/core/dc.c b/drivers/gpu/drm/amd= /display/dc/core/dc.c index ac5323596c65..93f5229c303e 100644 --- a/drivers/gpu/drm/amd/display/dc/core/dc.c +++ b/drivers/gpu/drm/amd/display/dc/core/dc.c @@ -1173,10 +1173,6 @@ bool dc_validate_seamless_boot_timing(const struct d= c *dc, if (!link->link_enc->funcs->is_dig_enabled(link->link_enc)) return false; =20 - /* Check for FEC status*/ - if (link->link_enc->funcs->fec_is_active(link->link_enc)) - return false; - enc_inst =3D link->link_enc->funcs->get_dig_frontend(link->link_enc); =20 if (enc_inst =3D=3D ENGINE_ID_UNKNOWN) --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F7D2C433F5 for ; Mon, 18 Apr 2022 13:18:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241286AbiDRNR0 (ORCPT ); Mon, 18 Apr 2022 09:17:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50942 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241879AbiDRM7J (ORCPT ); Mon, 18 Apr 2022 08:59:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 201AD10CE; Mon, 18 Apr 2022 05:39:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 976A16101A; Mon, 18 Apr 2022 12:39:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9B0C2C385A7; Mon, 18 Apr 2022 12:39:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285586; bh=4KgPI7ZD0G86IX3mS4fj0NeBKNa4lw2u47qQaePsz4U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=msqd6vujt56TT9wPSD3+CqmDIZIaTpMtUbQd9RBuzKBZwW/6AGE3iHxwl8h0B/wU0 ohFKDbzbRRBeAxWAgiADL7w0xQFcQNBKUG+tj7usVrBM5HfXfAetkXQ50CkmpERQ4+ wxpUQ8OJ4LJbhZefWsJueOpIdfwyBig66i9KZdW0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wayne Lin , Alex Hung , Roman Li , Daniel Wheeler , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 065/105] drm/amd/display: Fix allocate_mst_payload assert on resume Date: Mon, 18 Apr 2022 14:13:07 +0200 Message-Id: <20220418121148.334708596@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Roman Li [ Upstream commit f4346fb3edf7720db3f7f5e1cab1f667cd024280 ] [Why] On resume we do link detection for all non-MST connectors. MST is handled separately. However the condition for telling if connector is on mst branch is not enough for mst hub case. Link detection for mst branch link leads to mst topology reset. That causes assert in dc_link_allocate_mst_payload() [How] Use link type as indicator for mst link. Reviewed-by: Wayne Lin Acked-by: Alex Hung Signed-off-by: Roman Li Tested-by: Daniel Wheeler Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c b/drivers/gp= u/drm/amd/display/amdgpu_dm/amdgpu_dm.c index e828f9414ba2..7bb151283f44 100644 --- a/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c +++ b/drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c @@ -2022,7 +2022,8 @@ static int dm_resume(void *handle) * this is the case when traversing through already created * MST connectors, should be skipped */ - if (aconnector->mst_port) + if (aconnector->dc_link && + aconnector->dc_link->type =3D=3D dc_connection_mst_branch) continue; =20 mutex_lock(&aconnector->hpd_lock); --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C0E5C433FE for ; Mon, 18 Apr 2022 13:09:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241264AbiDRNLl (ORCPT ); Mon, 18 Apr 2022 09:11:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59826 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S241948AbiDRM72 (ORCPT ); Mon, 18 Apr 2022 08:59:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C7FF6B7C1; Mon, 18 Apr 2022 05:39:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5CCFCB80EDB; Mon, 18 Apr 2022 12:39:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C5EB1C385A1; Mon, 18 Apr 2022 12:39:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285589; bh=xukcHtLpxHrdsA4nZAemtS+kGBMlnhaTnD9PbJpFc+0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rLnIQ2jqI6g3UF1NzXXHMACokSD31T9D5G/wbKjH0x3vvaRtQxvoZN15RvorWtDcM tFebI8u5OMgpNzFWRJHNtDz/4IYeWplBaQSld/7lJ9Azj1xsIQgN5xeCWHmUBNP3cw VJHgUL3RxDDPNIJa/xP7tvd0LmssyijXTSOt/j+s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexey Galakhov , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 066/105] scsi: mvsas: Add PCI ID of RocketRaid 2640 Date: Mon, 18 Apr 2022 14:13:08 +0200 Message-Id: <20220418121148.363727596@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexey Galakhov [ Upstream commit 5f2bce1e222028dc1c15f130109a17aa654ae6e8 ] The HighPoint RocketRaid 2640 is a low-cost SAS controller based on Marvell chip. The chip in question was already supported by the kernel, just the PCI ID of this particular board was missing. Link: https://lore.kernel.org/r/20220309212535.402987-1-agalakhov@gmail.com Signed-off-by: Alexey Galakhov Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/mvsas/mv_init.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/mvsas/mv_init.c b/drivers/scsi/mvsas/mv_init.c index 0cfea7b2ab13..85ca8421fb86 100644 --- a/drivers/scsi/mvsas/mv_init.c +++ b/drivers/scsi/mvsas/mv_init.c @@ -646,6 +646,7 @@ static struct pci_device_id mvs_pci_table[] =3D { { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1300), chip_1300 }, { PCI_VDEVICE(ARECA, PCI_DEVICE_ID_ARECA_1320), chip_1320 }, { PCI_VDEVICE(ADAPTEC2, 0x0450), chip_6440 }, + { PCI_VDEVICE(TTI, 0x2640), chip_6440 }, { PCI_VDEVICE(TTI, 0x2710), chip_9480 }, { PCI_VDEVICE(TTI, 0x2720), chip_9480 }, { PCI_VDEVICE(TTI, 0x2721), chip_9480 }, --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15814C433F5 for ; Mon, 18 Apr 2022 13:09:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241385AbiDRNMD (ORCPT ); Mon, 18 Apr 2022 09:12:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59856 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242066AbiDRM7f (ORCPT ); Mon, 18 Apr 2022 08:59:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67AB61D0DB; Mon, 18 Apr 2022 05:39:54 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A3FCEB80EC0; Mon, 18 Apr 2022 12:39:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0795C385A7; Mon, 18 Apr 2022 12:39:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285592; bh=Uu7VIrb7ME9y2Ns26nkZF0NerK26h//hTrPsKXDKuPU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BznI/IyGTKAxLRAIheAPmhzPpXpKYbz/mfpcajaTT1FQbbTYLDS0/PkUCJM5Ic+LW AWkBrk2rPLJCm46kJMQNfQfJCazFoQzoT5kMM0NOdqlFYU7KO8cQSdcto/d/BexNnG HAjDFthRQHJzWupE9bWV8tbNMAI9XBaH4eHi+4zA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chandrakanth patil , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 067/105] scsi: megaraid_sas: Target with invalid LUN ID is deleted during scan Date: Mon, 18 Apr 2022 14:13:09 +0200 Message-Id: <20220418121148.391815880@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chandrakanth patil [ Upstream commit 56495f295d8e021f77d065b890fc0100e3f9f6d8 ] The megaraid_sas driver supports single LUN for RAID devices. That is LUN 0. All other LUNs are unsupported. When a device scan on a logical target with invalid LUN number is invoked through sysfs, that target ends up getting removed. Add LUN ID validation in the slave destroy function to avoid the target deletion. Link: https://lore.kernel.org/r/20220324094711.48833-1-chandrakanth.patil@b= roadcom.com Signed-off-by: Chandrakanth patil Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/megaraid/megaraid_sas.h | 3 +++ drivers/scsi/megaraid/megaraid_sas_base.c | 7 +++++++ 2 files changed, 10 insertions(+) diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/m= egaraid_sas.h index 6b8ec57e8bdf..c088a848776e 100644 --- a/drivers/scsi/megaraid/megaraid_sas.h +++ b/drivers/scsi/megaraid/megaraid_sas.h @@ -2554,6 +2554,9 @@ struct megasas_instance_template { #define MEGASAS_IS_LOGICAL(sdev) \ ((sdev->channel < MEGASAS_MAX_PD_CHANNELS) ? 0 : 1) =20 +#define MEGASAS_IS_LUN_VALID(sdev) \ + (((sdev)->lun =3D=3D 0) ? 1 : 0) + #define MEGASAS_DEV_INDEX(scp) \ (((scp->device->channel % 2) * MEGASAS_MAX_DEV_PER_CHANNEL) + \ scp->device->id) diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megar= aid/megaraid_sas_base.c index 1a70cc995c28..84a2e9292fd0 100644 --- a/drivers/scsi/megaraid/megaraid_sas_base.c +++ b/drivers/scsi/megaraid/megaraid_sas_base.c @@ -2111,6 +2111,9 @@ static int megasas_slave_alloc(struct scsi_device *sd= ev) goto scan_target; } return -ENXIO; + } else if (!MEGASAS_IS_LUN_VALID(sdev)) { + sdev_printk(KERN_INFO, sdev, "%s: invalid LUN\n", __func__); + return -ENXIO; } =20 scan_target: @@ -2141,6 +2144,10 @@ static void megasas_slave_destroy(struct scsi_device= *sdev) instance =3D megasas_lookup_instance(sdev->host->host_no); =20 if (MEGASAS_IS_LOGICAL(sdev)) { + if (!MEGASAS_IS_LUN_VALID(sdev)) { + sdev_printk(KERN_INFO, sdev, "%s: invalid LUN\n", __func__); + return; + } ld_tgt_id =3D MEGASAS_TARGET_ID(sdev); instance->ld_tgtid_status[ld_tgt_id] =3D LD_TARGET_ID_DELETED; if (megasas_dbg_lvl & LD_PD_DEBUG) --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED177C433FE for ; Mon, 18 Apr 2022 13:09:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241317AbiDRNLw (ORCPT ); Mon, 18 Apr 2022 09:11:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59866 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242073AbiDRM7f (ORCPT ); Mon, 18 Apr 2022 08:59:35 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C8EC2497A; Mon, 18 Apr 2022 05:39:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 85607B80EDD; Mon, 18 Apr 2022 12:39:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E66A7C385A1; Mon, 18 Apr 2022 12:39:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285595; bh=N/9Rui6mpSwGeDNpe/xTbHy8TO3O88n/9VixNIN9aiA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hiMkxIOBG60TCr/JphLkRN+WuGTVWNwXz7nT+fRqZ1akwJgAfjvOE1EMLiFNAnmjS 2uUbRawgkN1kIxjF06o2eUPwTS8bYIswELZL6QodzfmlMo684HxrCPFx3gtdR4tggG OsCFXlZ9srMo4mCKITVcvmQEArQyzxfN4lqVd82c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Duoming Zhou , Jiri Slaby , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.10 068/105] drivers: net: slip: fix NPD bug in sl_tx_timeout() Date: Mon, 18 Apr 2022 14:13:10 +0200 Message-Id: <20220418121148.421376150@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou [ Upstream commit ec4eb8a86ade4d22633e1da2a7d85a846b7d1798 ] When a slip driver is detaching, the slip_close() will act to cleanup necessary resources and sl->tty is set to NULL in slip_close(). Meanwhile, the packet we transmit is blocked, sl_tx_timeout() will be called. Although slip_close() and sl_tx_timeout() use sl->lock to synchronize, we don`t judge whether sl->tty equals to NULL in sl_tx_timeout() and the null pointer dereference bug will happen. (Thread 1) | (Thread 2) | slip_close() | spin_lock_bh(&sl->lock) | ... ... | sl->tty =3D NULL //(1) sl_tx_timeout() | spin_unlock_bh(&sl->lock) spin_lock(&sl->lock); | ... | ... tty_chars_in_buffer(sl->tty)| if (tty->ops->..) //(2) | ... | synchronize_rcu() We set NULL to sl->tty in position (1) and dereference sl->tty in position (2). This patch adds check in sl_tx_timeout(). If sl->tty equals to NULL, sl_tx_timeout() will goto out. Signed-off-by: Duoming Zhou Reviewed-by: Jiri Slaby Link: https://lore.kernel.org/r/20220405132206.55291-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/slip/slip.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index f81fb0b13a94..369bd30fed35 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -468,7 +468,7 @@ static void sl_tx_timeout(struct net_device *dev, unsig= ned int txqueue) spin_lock(&sl->lock); =20 if (netif_queue_stopped(dev)) { - if (!netif_running(dev)) + if (!netif_running(dev) || !sl->tty) goto out; =20 /* May be we must check transmitter timeout here ? --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A67BC433EF for ; Mon, 18 Apr 2022 13:09:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241441AbiDRNMS (ORCPT ); Mon, 18 Apr 2022 09:12:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59852 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242074AbiDRM7f (ORCPT ); Mon, 18 Apr 2022 08:59:35 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6D08227140; Mon, 18 Apr 2022 05:39:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B779D611E4; Mon, 18 Apr 2022 12:39:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86BD4C385A7; Mon, 18 Apr 2022 12:39:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285598; bh=ftcoYDX4lSTjIY+xR9BpC/tIkm4h6JHMIQXWmz8MeKo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pvwTmHS7aDZoGYv8uJDb4gEtKff+z5M2tW/VuZHUkmsuUVI3kyf8RLFVe2fRtZATb PZ75GUK3B99mHzkZ5t6a14RzMZewFyzC0SjHCltvAfuDS0dXrOqz+J03xOAt3UAKvR 0Fk/HEaVEet738iDjafsxC1TLFxaolIUT++nXTm8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Borislav Petkov , Frank Li , Will Deacon , Mark Rutland , Shawn Guo , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , NXP Linux Team , linux-arm-kernel@lists.infradead.org, Sasha Levin Subject: [PATCH 5.10 069/105] perf/imx_ddr: Fix undefined behavior due to shift overflowing the constant Date: Mon, 18 Apr 2022 14:13:11 +0200 Message-Id: <20220418121148.450631845@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Borislav Petkov [ Upstream commit d02b4dd84e1a90f7f1444d027c0289bf355b0d5a ] Fix: In file included from :0:0: In function =E2=80=98ddr_perf_counter_enable=E2=80=99, inlined from =E2=80=98ddr_perf_irq_handler=E2=80=99 at drivers/perf/f= sl_imx8_ddr_perf.c:651:2: ././include/linux/compiler_types.h:352:38: error: call to =E2=80=98__comp= iletime_assert_729=E2=80=99 \ declared with attribute error: FIELD_PREP: mask is not constant _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__) ... See https://lore.kernel.org/r/YkwQ6%2BtIH8GQpuct@zn.tnic for the gory details as to why it triggers with older gccs only. Signed-off-by: Borislav Petkov Cc: Frank Li Cc: Will Deacon Cc: Mark Rutland Cc: Shawn Guo Cc: Sascha Hauer Cc: Pengutronix Kernel Team Cc: Fabio Estevam Cc: NXP Linux Team Cc: linux-arm-kernel@lists.infradead.org Acked-by: Will Deacon Link: https://lore.kernel.org/r/20220405151517.29753-10-bp@alien8.de Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/perf/fsl_imx8_ddr_perf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/perf/fsl_imx8_ddr_perf.c b/drivers/perf/fsl_imx8_ddr_p= erf.c index 7f7bc0993670..e09bbf3890c4 100644 --- a/drivers/perf/fsl_imx8_ddr_perf.c +++ b/drivers/perf/fsl_imx8_ddr_perf.c @@ -29,7 +29,7 @@ #define CNTL_OVER_MASK 0xFFFFFFFE =20 #define CNTL_CSV_SHIFT 24 -#define CNTL_CSV_MASK (0xFF << CNTL_CSV_SHIFT) +#define CNTL_CSV_MASK (0xFFU << CNTL_CSV_SHIFT) =20 #define EVENT_CYCLES_ID 0 #define EVENT_CYCLES_COUNTER 0 --=20 2.35.1 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9CCB4C433F5 for ; Mon, 18 Apr 2022 13:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241855AbiDRNRd (ORCPT ); Mon, 18 Apr 2022 09:17:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59694 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242115AbiDRM7h (ORCPT ); Mon, 18 Apr 2022 08:59:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 897D5102E; Mon, 18 Apr 2022 05:40:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B37FAB80EE1; Mon, 18 Apr 2022 12:40:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E97C6C385A1; Mon, 18 Apr 2022 12:40:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285601; bh=TSlR0DyoCKgQRplhNDleYNwHNDhDfIdpEPWanxOmbAU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zfuDxvLz7PyZItyPSfZMPAJac0Pn6F6t0HN9bYbPpItAqF7rlJ2IOWptoftIFRogq n/Xy55qGjoTWztMngnm13zdSymr8TTQup3ip+jV7cIQcqNjvQ+Cvq91LYQOVACKbqB W6GU0vrgYtVOaUIC4qebw+6P4Y/QRZSJMWVo6iqs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Juergen Gross , =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= , Michal Hocko , David Hildenbrand , Wei Yang , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 070/105] mm, page_alloc: fix build_zonerefs_node() Date: Mon, 18 Apr 2022 14:13:12 +0200 Message-Id: <20220418121148.479008373@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Juergen Gross commit e553f62f10d93551eb883eca227ac54d1a4fad84 upstream. Since commit 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with pages managed by the buddy allocator") only zones with free memory are included in a built zonelist. This is problematic when e.g. all memory of a zone has been ballooned out when zonelists are being rebuilt. The decision whether to rebuild the zonelists when onlining new memory is done based on populated_zone() returning 0 for the zone the memory will be added to. The new zone is added to the zonelists only, if it has free memory pages (managed_zone() returns a non-zero value) after the memory has been onlined. This implies, that onlining memory will always free the added pages to the allocator immediately, but this is not true in all cases: when e.g. running as a Xen guest the onlined new memory will be added only to the ballooned memory list, it will be freed only when the guest is being ballooned up afterwards. Another problem with using managed_zone() for the decision whether a zone is being added to the zonelists is, that a zone with all memory used will in fact be removed from all zonelists in case the zonelists happen to be rebuilt. Use populated_zone() when building a zonelist as it has been done before that commit. There was a report that QubesOS (based on Xen) is hitting this problem. Xen has switched to use the zone device functionality in kernel 5.9 and QubesOS wants to use memory hotplugging for guests in order to be able to start a guest with minimal memory and expand it as needed. This was the report leading to the patch. Link: https://lkml.kernel.org/r/20220407120637.9035-1-jgross@suse.com Fixes: 6aa303defb74 ("mm, vmscan: only allocate and reclaim from zones with= pages managed by the buddy allocator") Signed-off-by: Juergen Gross Reported-by: Marek Marczykowski-G=C3=B3recki Acked-by: Michal Hocko Acked-by: David Hildenbrand Cc: Marek Marczykowski-G=C3=B3recki Reviewed-by: Wei Yang Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- mm/page_alloc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -5653,7 +5653,7 @@ static int build_zonerefs_node(pg_data_t do { zone_type--; zone =3D pgdat->node_zones + zone_type; - if (managed_zone(zone)) { + if (populated_zone(zone)) { zoneref_set_zone(zone, &zonerefs[nr_zones++]); check_highest_zone(zone_type); } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BB654C4332F for ; Mon, 18 Apr 2022 13:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241922AbiDRNRp (ORCPT ); Mon, 18 Apr 2022 09:17:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242102AbiDRM7h (ORCPT ); Mon, 18 Apr 2022 08:59:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40C522F01D; Mon, 18 Apr 2022 05:40:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EB923B80EC3; Mon, 18 Apr 2022 12:40:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 441C9C385A1; Mon, 18 Apr 2022 12:40:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285604; bh=FWWlm14HIdYCNXODzHyl5aCTrLEgR8hcMvnpkDR/Tts=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y2wybi18BqnsItOBTQj09BdBuPMO7vV2vpvcEpEqLBver0YUXLOQ7Gy+CXYkagmkf 0vDjNP7WTiMrtTGUQf1dQJm1Apa2FH/EzGLo9B5bWwJ8HLvuByEgQFwz1SVvhE9VEW h1Nap5x5C+ry2gjfZD7xEsqIyp48Q6XQOSy8qM8c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ivan Babrou , Minchan Kim , Nitin Gupta , Sergey Senozhatsky , Jens Axboe , David Hildenbrand , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 071/105] mm: fix unexpected zeroed page mapping with zram swap Date: Mon, 18 Apr 2022 14:13:13 +0200 Message-Id: <20220418121148.507932753@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Minchan Kim commit e914d8f00391520ecc4495dd0ca0124538ab7119 upstream. Two processes under CLONE_VM cloning, user process can be corrupted by seeing zeroed page unexpectedly. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage valid data swap_slot_free_notify delete zram entry swap_readpage zeroed(invalid) data pte_lock map the *zero data* to userspace pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return and next refault will read zeroed data The swap_slot_free_notify is bogus for CLONE_VM case since it doesn't increase the refcount of swap slot at copy_mm so it couldn't catch up whether it's safe or not to discard data from backing device. In the case, only the lock it could rely on to synchronize swap slot freeing is page table lock. Thus, this patch gets rid of the swap_slot_free_notify function. With this patch, CPU A will see correct data. CPU A CPU B do_swap_page do_swap_page SWP_SYNCHRONOUS_IO path SWP_SYNCHRONOUS_IO path swap_readpage original data pte_lock map the original data swap_free swap_range_free bd_disk->fops->swap_slot_free_notify swap_readpage read zeroed data pte_unlock pte_lock if (!pte_same) goto out_nomap; pte_unlock return on next refault will see mapped data by CPU B The concern of the patch would increase memory consumption since it could keep wasted memory with compressed form in zram as well as uncompressed form in address space. However, most of cases of zram uses no readahead and do_swap_page is followed by swap_free so it will free the compressed form from in zram quickly. Link: https://lkml.kernel.org/r/YjTVVxIAsnKAXjTd@google.com Fixes: 0bcac06f27d7 ("mm, swap: skip swapcache for swapin of synchronous de= vice") Reported-by: Ivan Babrou Tested-by: Ivan Babrou Signed-off-by: Minchan Kim Cc: Nitin Gupta Cc: Sergey Senozhatsky Cc: Jens Axboe Cc: David Hildenbrand Cc: [4.14+] Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- mm/page_io.c | 54 ------------------------------------------------------ 1 file changed, 54 deletions(-) --- a/mm/page_io.c +++ b/mm/page_io.c @@ -69,54 +69,6 @@ void end_swap_bio_write(struct bio *bio) bio_put(bio); } =20 -static void swap_slot_free_notify(struct page *page) -{ - struct swap_info_struct *sis; - struct gendisk *disk; - swp_entry_t entry; - - /* - * There is no guarantee that the page is in swap cache - the software - * suspend code (at least) uses end_swap_bio_read() against a non- - * swapcache page. So we must check PG_swapcache before proceeding with - * this optimization. - */ - if (unlikely(!PageSwapCache(page))) - return; - - sis =3D page_swap_info(page); - if (data_race(!(sis->flags & SWP_BLKDEV))) - return; - - /* - * The swap subsystem performs lazy swap slot freeing, - * expecting that the page will be swapped out again. - * So we can avoid an unnecessary write if the page - * isn't redirtied. - * This is good for real swap storage because we can - * reduce unnecessary I/O and enhance wear-leveling - * if an SSD is used as the as swap device. - * But if in-memory swap device (eg zram) is used, - * this causes a duplicated copy between uncompressed - * data in VM-owned memory and compressed data in - * zram-owned memory. So let's free zram-owned memory - * and make the VM-owned decompressed page *dirty*, - * so the page should be swapped out somewhere again if - * we again wish to reclaim it. - */ - disk =3D sis->bdev->bd_disk; - entry.val =3D page_private(page); - if (disk->fops->swap_slot_free_notify && __swap_count(entry) =3D=3D 1) { - unsigned long offset; - - offset =3D swp_offset(entry); - - SetPageDirty(page); - disk->fops->swap_slot_free_notify(sis->bdev, - offset); - } -} - static void end_swap_bio_read(struct bio *bio) { struct page *page =3D bio_first_page_all(bio); @@ -132,7 +84,6 @@ static void end_swap_bio_read(struct bio } =20 SetPageUptodate(page); - swap_slot_free_notify(page); out: unlock_page(page); WRITE_ONCE(bio->bi_private, NULL); @@ -409,11 +360,6 @@ int swap_readpage(struct page *page, boo if (sis->flags & SWP_SYNCHRONOUS_IO) { ret =3D bdev_read_page(sis->bdev, swap_page_sector(page), page); if (!ret) { - if (trylock_page(page)) { - swap_slot_free_notify(page); - unlock_page(page); - } - count_vm_event(PSWPIN); goto out; } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC242C433EF for ; Mon, 18 Apr 2022 13:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241886AbiDRNRh (ORCPT ); Mon, 18 Apr 2022 09:17:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60562 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242114AbiDRM7h (ORCPT ); Mon, 18 Apr 2022 08:59:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A3802F028; Mon, 18 Apr 2022 05:40:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1A405B80EDB; Mon, 18 Apr 2022 12:40:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6CCD3C385A1; Mon, 18 Apr 2022 12:40:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285607; bh=8p+aReAVSXNj6og1QN3uqqCJu5j0sLTXlG5WVaeT6ko=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d2HoygYAypb58cGcntkTqioHWm7rDp7i+AtTNwBHKLudbYZ9xNX0Di3s5vpTHCQGB 9SrKz9uZDhc6RHpIc7G93nCthZmtVZMm6hdvclL1vGx28h0puYyS0niDdPxBkU1z+i zaAq+ueagBcqVxcdBWgHHJN3U2KXYbFqJBY9EYhQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Patrick Wang , Catalin Marinas , Andrew Morton , Linus Torvalds Subject: [PATCH 5.10 072/105] mm: kmemleak: take a full lowmem check in kmemleak_*_phys() Date: Mon, 18 Apr 2022 14:13:14 +0200 Message-Id: <20220418121148.536397803@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Patrick Wang commit 23c2d497de21f25898fbea70aeb292ab8acc8c94 upstream. The kmemleak_*_phys() apis do not check the address for lowmem's min boundary, while the caller may pass an address below lowmem, which will trigger an oops: # echo scan > /sys/kernel/debug/kmemleak Unable to handle kernel paging request at virtual address ff5fffffffe00000 Oops [#1] Modules linked in: CPU: 2 PID: 134 Comm: bash Not tainted 5.18.0-rc1-next-20220407 #33 Hardware name: riscv-virtio,qemu (DT) epc : scan_block+0x74/0x15c ra : scan_block+0x72/0x15c epc : ffffffff801e5806 ra : ffffffff801e5804 sp : ff200000104abc30 gp : ffffffff815cd4e8 tp : ff60000004cfa340 t0 : 0000000000000200 t1 : 00aaaaaac23954cc t2 : 00000000000003ff s0 : ff200000104abc90 s1 : ffffffff81b0ff28 a0 : 0000000000000000 a1 : ff5fffffffe01000 a2 : ffffffff81b0ff28 a3 : 0000000000000002 a4 : 0000000000000001 a5 : 0000000000000000 a6 : ff200000104abd7c a7 : 0000000000000005 s2 : ff5fffffffe00ff9 s3 : ffffffff815cd998 s4 : ffffffff815d0e90 s5 : ffffffff81b0ff28 s6 : 0000000000000020 s7 : ffffffff815d0eb0 s8 : ffffffffffffffff s9 : ff5fffffffe00000 s10: ff5fffffffe01000 s11: 0000000000000022 t3 : 00ffffffaa17db4c t4 : 000000000000000f t5 : 0000000000000001 t6 : 0000000000000000 status: 0000000000000100 badaddr: ff5fffffffe00000 cause: 000000000000000d scan_gray_list+0x12e/0x1a6 kmemleak_scan+0x2aa/0x57e kmemleak_write+0x32a/0x40c full_proxy_write+0x56/0x82 vfs_write+0xa6/0x2a6 ksys_write+0x6c/0xe2 sys_write+0x22/0x2a ret_from_syscall+0x0/0x2 The callers may not quite know the actual address they pass(e.g. from devicetree). So the kmemleak_*_phys() apis should guarantee the address they finally use is in lowmem range, so check the address for lowmem's min boundary. Link: https://lkml.kernel.org/r/20220413122925.33856-1-patrick.wang.shcn@gm= ail.com Signed-off-by: Patrick Wang Acked-by: Catalin Marinas Cc: Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- mm/kmemleak.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -1123,7 +1123,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_coun= t, gfp_t gfp) { - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) + if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) kmemleak_alloc(__va(phys), size, min_count, gfp); } EXPORT_SYMBOL(kmemleak_alloc_phys); @@ -1137,7 +1137,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); */ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) { - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) + if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) kmemleak_free_part(__va(phys), size); } EXPORT_SYMBOL(kmemleak_free_part_phys); @@ -1149,7 +1149,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); */ void __ref kmemleak_not_leak_phys(phys_addr_t phys) { - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) + if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) kmemleak_not_leak(__va(phys)); } EXPORT_SYMBOL(kmemleak_not_leak_phys); @@ -1161,7 +1161,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); */ void __ref kmemleak_ignore_phys(phys_addr_t phys) { - if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) + if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) kmemleak_ignore(__va(phys)); } EXPORT_SYMBOL(kmemleak_ignore_phys); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EB56CC43219 for ; Mon, 18 Apr 2022 13:18:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242006AbiDRNSA (ORCPT ); Mon, 18 Apr 2022 09:18:00 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242138AbiDRM7i (ORCPT ); Mon, 18 Apr 2022 08:59:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C681C2F390; Mon, 18 Apr 2022 05:40:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 174F7B80EC0; Mon, 18 Apr 2022 12:40:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 724CEC385A8; Mon, 18 Apr 2022 12:40:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285610; bh=eFm/z1FzKhlQoFaHivE7WVio1H+d0l+bTcBspXqzQ4s=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hpaE+1CWEw5CgFfbq9DW/5O3lTLQg2Z8Oi+UAleI94RD33FrdRh56Wu5jyhrCUw1P us3ap4ruGw8NIsLP9cpjA8bkVY70b4n1dtcAdH1Loc04sbdRVb5vIAhkJNeQizWF6Q dOzyT4YdYpIOUmup1iV5k3+o/JN3UaTzfE2pZ0QA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bruno Goncalves , Jan Stancek , Sean Christopherson , Paolo Bonzini Subject: [PATCH 5.10 073/105] KVM: x86/mmu: Resolve nx_huge_pages when kvm.ko is loaded Date: Mon, 18 Apr 2022 14:13:15 +0200 Message-Id: <20220418121148.565894452@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sean Christopherson commit 1d0e84806047f38027d7572adb4702ef7c09b317 upstream. Resolve nx_huge_pages to true/false when kvm.ko is loaded, leaving it as -1 is technically undefined behavior when its value is read out by param_get_bool(), as boolean values are supposed to be '0' or '1'. Alternatively, KVM could define a custom getter for the param, but the auto value doesn't depend on the vendor module in any way, and printing "auto" would be unnecessarily unfriendly to the user. In addition to fixing the undefined behavior, resolving the auto value also fixes the scenario where the auto value resolves to N and no vendor module is loaded. Previously, -1 would result in Y being printed even though KVM would ultimately disable the mitigation. Rename the existing MMU module init/exit helpers to clarify that they're invoked with respect to the vendor module, and add comments to document why KVM has two separate "module init" flows. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D UBSAN: invalid-load in kernel/params.c:320:33 load of value 255 is not a valid value for type '_Bool' CPU: 6 PID: 892 Comm: tail Not tainted 5.17.0-rc3+ #799 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02/06/2015 Call Trace: dump_stack_lvl+0x34/0x44 ubsan_epilogue+0x5/0x40 __ubsan_handle_load_invalid_value.cold+0x43/0x48 param_get_bool.cold+0xf/0x14 param_attr_show+0x55/0x80 module_attr_show+0x1c/0x30 sysfs_kf_seq_show+0x93/0xc0 seq_read_iter+0x11c/0x450 new_sync_read+0x11b/0x1a0 vfs_read+0xf0/0x190 ksys_read+0x5f/0xe0 do_syscall_64+0x3b/0xc0 entry_SYSCALL_64_after_hwframe+0x44/0xae =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Fixes: b8e8c8303ff2 ("kvm: mmu: ITLB_MULTIHIT mitigation") Cc: stable@vger.kernel.org Reported-by: Bruno Goncalves Reported-by: Jan Stancek Signed-off-by: Sean Christopherson Message-Id: <20220331221359.3912754-1-seanjc@google.com> Signed-off-by: Paolo Bonzini Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/x86/include/asm/kvm_host.h | 5 +++-- arch/x86/kvm/mmu/mmu.c | 20 ++++++++++++++++---- arch/x86/kvm/x86.c | 20 ++++++++++++++++++-- 3 files changed, 37 insertions(+), 8 deletions(-) --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -1340,8 +1340,9 @@ static inline int kvm_arch_flush_remote_ return -ENOTSUPP; } =20 -int kvm_mmu_module_init(void); -void kvm_mmu_module_exit(void); +void kvm_mmu_x86_module_init(void); +int kvm_mmu_vendor_module_init(void); +void kvm_mmu_vendor_module_exit(void); =20 void kvm_mmu_destroy(struct kvm_vcpu *vcpu); int kvm_mmu_create(struct kvm_vcpu *vcpu); --- a/arch/x86/kvm/mmu/mmu.c +++ b/arch/x86/kvm/mmu/mmu.c @@ -5876,12 +5876,24 @@ static int set_nx_huge_pages(const char return 0; } =20 -int kvm_mmu_module_init(void) +/* + * nx_huge_pages needs to be resolved to true/false when kvm.ko is loaded,= as + * its default value of -1 is technically undefined behavior for a boolean. + */ +void kvm_mmu_x86_module_init(void) { - int ret =3D -ENOMEM; - if (nx_huge_pages =3D=3D -1) __set_nx_huge_pages(get_nx_auto_mode()); +} + +/* + * The bulk of the MMU initialization is deferred until the vendor module = is + * loaded as many of the masks/values may be modified by VMX or SVM, i.e. = need + * to be reset when a potentially different vendor module is loaded. + */ +int kvm_mmu_vendor_module_init(void) +{ + int ret =3D -ENOMEM; =20 /* * MMU roles use union aliasing which is, generally speaking, an @@ -5955,7 +5967,7 @@ void kvm_mmu_destroy(struct kvm_vcpu *vc mmu_free_memory_caches(vcpu); } =20 -void kvm_mmu_module_exit(void) +void kvm_mmu_vendor_module_exit(void) { mmu_destroy_caches(); percpu_counter_destroy(&kvm_total_used_mmu_pages); --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -8005,7 +8005,7 @@ int kvm_arch_init(void *opaque) goto out_free_x86_emulator_cache; } =20 - r =3D kvm_mmu_module_init(); + r =3D kvm_mmu_vendor_module_init(); if (r) goto out_free_percpu; =20 @@ -8065,7 +8065,7 @@ void kvm_arch_exit(void) cancel_work_sync(&pvclock_gtod_work); #endif kvm_x86_ops.hardware_enable =3D NULL; - kvm_mmu_module_exit(); + kvm_mmu_vendor_module_exit(); free_percpu(user_return_msrs); kmem_cache_destroy(x86_emulator_cache); kmem_cache_destroy(x86_fpu_cache); @@ -11426,3 +11426,19 @@ EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_avic_un EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_avic_incomplete_ipi); EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_avic_ga_log); EXPORT_TRACEPOINT_SYMBOL_GPL(kvm_apicv_update_request); + +static int __init kvm_x86_init(void) +{ + kvm_mmu_x86_module_init(); + return 0; +} +module_init(kvm_x86_init); + +static void __exit kvm_x86_exit(void) +{ + /* + * If module_init() is implemented, module_exit() must also be + * implemented to allow module unload. + */ +} +module_exit(kvm_x86_exit); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7FBE0C4321E for ; Mon, 18 Apr 2022 13:11:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239862AbiDRNMl (ORCPT ); Mon, 18 Apr 2022 09:12:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242151AbiDRM7j (ORCPT ); Mon, 18 Apr 2022 08:59:39 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 52E1F2F3AB; Mon, 18 Apr 2022 05:40:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 9B3A36101A; Mon, 18 Apr 2022 12:40:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9069DC385A9; Mon, 18 Apr 2022 12:40:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285614; bh=5k8FW0xfgGxI6vUMlHLTkoJOHhqS69JmSk5lxa58BJ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=W01ore2y11CYw1abn/b6jdmnQVxH38VXEB9Bn/0d0ubOhE/c+5bNT81u/oZI26vnq uk7QPj3kFqlmi4Ov5Lyj8Z+oZT0jTAy0xqfI0M5+bTQPoEik3gW3DEgZMslCWT+wi4 luT3rvV/PjM/FD5Lb1/Hmnu5hWZD3SGn4Il0J81s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable@kernel.org, Oliver Upton , Marc Zyngier Subject: [PATCH 5.10 074/105] KVM: Dont create VM debugfs files outside of the VM directory Date: Mon, 18 Apr 2022 14:13:16 +0200 Message-Id: <20220418121148.729694346@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Oliver Upton commit a44a4cc1c969afec97dbb2aedaf6f38eaa6253bb upstream. Unfortunately, there is no guarantee that KVM was able to instantiate a debugfs directory for a particular VM. To that end, KVM shouldn't even attempt to create new debugfs files in this case. If the specified parent dentry is NULL, debugfs_create_file() will instantiate files at the root of debugfs. For arm64, it is possible to create the vgic-state file outside of a VM directory, the file is not cleaned up when a VM is destroyed. Nonetheless, the corresponding struct kvm is freed when the VM is destroyed. Nip the problem in the bud for all possible errant debugfs file creations by initializing kvm->debugfs_dentry to -ENOENT. In so doing, debugfs_create_file() will fail instead of creating the file in the root directory. Cc: stable@kernel.org Fixes: 929f45e32499 ("kvm: no need to check return value of debugfs_create = functions") Signed-off-by: Oliver Upton Signed-off-by: Marc Zyngier Link: https://lore.kernel.org/r/20220406235615.1447180-2-oupton@google.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- virt/kvm/kvm_main.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/virt/kvm/kvm_main.c +++ b/virt/kvm/kvm_main.c @@ -673,7 +673,7 @@ static void kvm_destroy_vm_debugfs(struc { int i; =20 - if (!kvm->debugfs_dentry) + if (IS_ERR(kvm->debugfs_dentry)) return; =20 debugfs_remove_recursive(kvm->debugfs_dentry); @@ -693,6 +693,12 @@ static int kvm_create_vm_debugfs(struct struct kvm_stat_data *stat_data; struct kvm_stats_debugfs_item *p; =20 + /* + * Force subsequent debugfs file creations to fail if the VM directory + * is not created. + */ + kvm->debugfs_dentry =3D ERR_PTR(-ENOENT); + if (!debugfs_initialized()) return 0; =20 @@ -4731,7 +4737,7 @@ static void kvm_uevent_notify_change(uns } add_uevent_var(env, "PID=3D%d", kvm->userspace_pid); =20 - if (kvm->debugfs_dentry) { + if (!IS_ERR(kvm->debugfs_dentry)) { char *tmp, *p =3D kmalloc(PATH_MAX, GFP_KERNEL_ACCOUNT); =20 if (p) { From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AC503C38A06 for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242720AbiDRNO0 (ORCPT ); Mon, 18 Apr 2022 09:14:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242196AbiDRM7l (ORCPT ); Mon, 18 Apr 2022 08:59:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D39412FFE0; Mon, 18 Apr 2022 05:40:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 81F76B80EC0; Mon, 18 Apr 2022 12:40:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B4FEBC385A1; Mon, 18 Apr 2022 12:40:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285620; bh=RgOitjdSvptvb7BqW7+O0a0dPGm8B+OvvA7aOT1z36Q=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MeLzuihIeERmgDAn48ixJwUhj0w4lq6an8rk0LRKsx1v7om9/pZWsFFJLs9RZp3mP vQeYccjfjfSKfM9gGOqgStYKvvLyHAbplGveSE+Lfp1CAw/ryS2jHXbm6M7OZJHXwX KMnJXLuGY++R1IVIX6jIOfLU4MSCetFnowiLHZFE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergei Shtylyov , Johan Hovold , Krzysztof Kozlowski Subject: [PATCH 5.10 075/105] memory: renesas-rpc-if: fix platform-device leak in error path Date: Mon, 18 Apr 2022 14:13:17 +0200 Message-Id: <20220418121148.759217557@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johan Hovold commit b452dbf24d7d9a990d70118462925f6ee287d135 upstream. Make sure to free the flash platform device in the event that registration fails during probe. Fixes: ca7d8b980b67 ("memory: add Renesas RPC-IF driver") Cc: stable@vger.kernel.org # 5.8 Cc: Sergei Shtylyov Signed-off-by: Johan Hovold Link: https://lore.kernel.org/r/20220303180632.3194-1-johan@kernel.org Signed-off-by: Krzysztof Kozlowski Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/memory/renesas-rpc-if.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) --- a/drivers/memory/renesas-rpc-if.c +++ b/drivers/memory/renesas-rpc-if.c @@ -592,6 +592,7 @@ static int rpcif_probe(struct platform_d struct platform_device *vdev; struct device_node *flash; const char *name; + int ret; =20 flash =3D of_get_next_child(pdev->dev.of_node, NULL); if (!flash) { @@ -615,7 +616,14 @@ static int rpcif_probe(struct platform_d return -ENOMEM; vdev->dev.parent =3D &pdev->dev; platform_set_drvdata(pdev, vdev); - return platform_device_add(vdev); + + ret =3D platform_device_add(vdev); + if (ret) { + platform_device_put(vdev); + return ret; + } + + return 0; } =20 static int rpcif_remove(struct platform_device *pdev) From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A3E55C3525B for ; Mon, 18 Apr 2022 13:12:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S239502AbiDRNOg (ORCPT ); Mon, 18 Apr 2022 09:14:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59456 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242215AbiDRM7m (ORCPT ); Mon, 18 Apr 2022 08:59:42 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D94FD2FFEE; Mon, 18 Apr 2022 05:40:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 86A13B80EC0; Mon, 18 Apr 2022 12:40:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E0407C385A1; Mon, 18 Apr 2022 12:40:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285623; bh=dJzCn9cIQspghMBiSeA+o7H9D+g3/toGnQtHulXDBOU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cRpEMikYia1nxFhKqOYKhLoAfS6liHhPM42nNNIx6ZatXKet5xmCeCenk83XS4U2m 0M9dQn48ISJwHbWp+JFkmXIqlyCKj76R3UBRsIGonctBbGmj6ypOFxLuxsa/EyGNrg Y29cpUkazqiI8mlwNrQSZrTD+zCACh1XlJ1oGCq8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, PaX Team , "Jason A. Donenfeld" , Kees Cook Subject: [PATCH 5.10 076/105] gcc-plugins: latent_entropy: use /dev/urandom Date: Mon, 18 Apr 2022 14:13:18 +0200 Message-Id: <20220418121148.788977851@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jason A. Donenfeld commit c40160f2998c897231f8454bf797558d30a20375 upstream. While the latent entropy plugin mostly doesn't derive entropy from get_random_const() for measuring the call graph, when __latent_entropy is applied to a constant, then it's initialized statically to output from get_random_const(). In that case, this data is derived from a 64-bit seed, which means a buffer of 512 bits doesn't really have that amount of compile-time entropy. This patch fixes that shortcoming by just buffering chunks of /dev/urandom output and doling it out as requested. At the same time, it's important that we don't break the use of -frandom-seed, for people who want the runtime benefits of the latent entropy plugin, while still having compile-time determinism. In that case, we detect whether gcc's set_random_seed() has been called by making a call to get_random_seed(noinit=3Dtrue) in the plugin init function, which is called after set_random_seed() is called but before anything that calls get_random_seed(noinit=3Dfalse), and seeing if it's zero or not. If it's not zero, we're in deterministic mode, and so we just generate numbers with a basic xorshift prng. Note that we don't detect if -frandom-seed is being used using the documented local_tick variable, because it's assigned via: local_tick =3D (unsigned) tv.tv_sec * 1000 + tv.tv_usec / 1000; which may well overflow and become -1 on its own, and so isn't reliable: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D105171 [kees: The 256 byte rnd_buf size was chosen based on average (250), median (64), and std deviation (575) bytes of used entropy for a defconfig x86_64 build] Fixes: 38addce8b600 ("gcc-plugins: Add latent_entropy plugin") Cc: stable@vger.kernel.org Cc: PaX Team Signed-off-by: Jason A. Donenfeld Signed-off-by: Kees Cook Link: https://lore.kernel.org/r/20220405222815.21155-1-Jason@zx2c4.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- scripts/gcc-plugins/latent_entropy_plugin.c | 44 +++++++++++++++++------= ----- 1 file changed, 27 insertions(+), 17 deletions(-) --- a/scripts/gcc-plugins/latent_entropy_plugin.c +++ b/scripts/gcc-plugins/latent_entropy_plugin.c @@ -86,25 +86,31 @@ static struct plugin_info latent_entropy .help =3D "disable\tturn off latent entropy instrumentation\n", }; =20 -static unsigned HOST_WIDE_INT seed; -/* - * get_random_seed() (this is a GCC function) generates the seed. - * This is a simple random generator without any cryptographic security be= cause - * the entropy doesn't come from here. - */ +static unsigned HOST_WIDE_INT deterministic_seed; +static unsigned HOST_WIDE_INT rnd_buf[32]; +static size_t rnd_idx =3D ARRAY_SIZE(rnd_buf); +static int urandom_fd =3D -1; + static unsigned HOST_WIDE_INT get_random_const(void) { - unsigned int i; - unsigned HOST_WIDE_INT ret =3D 0; - - for (i =3D 0; i < 8 * sizeof(ret); i++) { - ret =3D (ret << 1) | (seed & 1); - seed >>=3D 1; - if (ret & 1) - seed ^=3D 0xD800000000000000ULL; + if (deterministic_seed) { + unsigned HOST_WIDE_INT w =3D deterministic_seed; + w ^=3D w << 13; + w ^=3D w >> 7; + w ^=3D w << 17; + deterministic_seed =3D w; + return deterministic_seed; } =20 - return ret; + if (urandom_fd < 0) { + urandom_fd =3D open("/dev/urandom", O_RDONLY); + gcc_assert(urandom_fd >=3D 0); + } + if (rnd_idx >=3D ARRAY_SIZE(rnd_buf)) { + gcc_assert(read(urandom_fd, rnd_buf, sizeof(rnd_buf)) =3D=3D sizeof(rnd_= buf)); + rnd_idx =3D 0; + } + return rnd_buf[rnd_idx++]; } =20 static tree tree_get_random_const(tree type) @@ -549,8 +555,6 @@ static void latent_entropy_start_unit(vo tree type, id; int quals; =20 - seed =3D get_random_seed(false); - if (in_lto_p) return; =20 @@ -585,6 +589,12 @@ __visible int plugin_init(struct plugin_ const struct plugin_argument * const argv =3D plugin_info->argv; int i; =20 + /* + * Call get_random_seed() with noinit=3Dtrue, so that this returns + * 0 in the case where no seed has been passed via -frandom-seed. + */ + deterministic_seed =3D get_random_seed(true); + static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] =3D { { .base =3D &latent_entropy_decl, From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 06544C43217 for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242056AbiDRNSE (ORCPT ); Mon, 18 Apr 2022 09:18:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242233AbiDRM7n (ORCPT ); Mon, 18 Apr 2022 08:59:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 381F330542; Mon, 18 Apr 2022 05:40:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B8CD5B80EDE; Mon, 18 Apr 2022 12:40:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 03814C385A1; Mon, 18 Apr 2022 12:40:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285626; bh=epETK8RMdi/qHauVcO3oyZYPjLD8fCCYT0QAkxHcJgc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RsBj2/H9g6aj6UmGbT+mEMhMAhszreIyvSfAJzqJgi+1TffVOtac9j2aFfiASCIfv UlhIkDZPlhfahsTcNAP7G64yy5ENzvvNIx30KOL1l+s1SKp0okdXTlSJNyPuYPsuFs zoogEN7HV2u19eyuQaFNJAoYEKnmF2GVJO8OIDCA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bagas Sanjaya , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Kalle Valo Subject: [PATCH 5.10 077/105] ath9k: Properly clear TX status area before reporting to mac80211 Date: Mon, 18 Apr 2022 14:13:19 +0200 Message-Id: <20220418121148.818096123@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen commit 037250f0a45cf9ecf5b52d4b9ff8eadeb609c800 upstream. The ath9k driver was not properly clearing the status area in the ieee80211_tx_info struct before reporting TX status to mac80211. Instead, it was manually filling in fields, which meant that fields introduced later were left as-is. Conveniently, mac80211 actually provides a helper to zero out the status area, so use that to make sure we zero everything. The last commit touching the driver function writing the status information seems to have actually been fixing an issue that was also caused by the area being uninitialised; but it only added clearing of a single field instead of the whole struct. That is now redundant, though, so revert that commit and use it as a convenient Fixes tag. Fixes: cc591d77aba1 ("ath9k: Make sure to zero status.tx_time before report= ing TX status") Reported-by: Bagas Sanjaya Cc: Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Tested-by: Bagas Sanjaya Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220330164409.16645-1-toke@toke.dk Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/ath9k/xmit.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c @@ -2512,6 +2512,8 @@ static void ath_tx_rc_status(struct ath_ struct ath_hw *ah =3D sc->sc_ah; u8 i, tx_rateindex; =20 + ieee80211_tx_info_clear_status(tx_info); + if (txok) tx_info->status.ack_signal =3D ts->ts_rssi; =20 @@ -2554,9 +2556,6 @@ static void ath_tx_rc_status(struct ath_ } =20 tx_info->status.rates[tx_rateindex].count =3D ts->ts_longretry + 1; - - /* we report airtime in ath_tx_count_airtime(), don't report twice */ - tx_info->status.tx_time =3D 0; } =20 static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq) From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 916D3C3527E for ; Mon, 18 Apr 2022 13:11:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241927AbiDRNNG (ORCPT ); Mon, 18 Apr 2022 09:13:06 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59716 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242264AbiDRM7p (ORCPT ); Mon, 18 Apr 2022 08:59:45 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4240420181; Mon, 18 Apr 2022 05:40:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BC8A4B80EC0; Mon, 18 Apr 2022 12:40:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E604C385A1; Mon, 18 Apr 2022 12:40:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285629; bh=zfFhwuW+2QehhZz510GLnDsyoSabLcv+Oi0qhLXKq+8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JkGXa1SktDPIybrOwKM20Lc9p2xy+pF3AjGSpqHIa0OYVdMRwAtclUSumDhpMfBTj TliWrIvPd2/2gI2di6V3OSWbg9jNd0bp0W+gm54XgcYkflldXpTHg3FrWReHfAP7+i WrflHcDtddHgR2hAT3vsLeDc8O/5sAIc8WLO+Dd0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Peter Seiderer , =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Kalle Valo Subject: [PATCH 5.10 078/105] ath9k: Fix usage of driver-private space in tx_info Date: Mon, 18 Apr 2022 14:13:20 +0200 Message-Id: <20220418121148.847148334@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen commit 5a6b06f5927c940fa44026695779c30b7536474c upstream. The ieee80211_tx_info_clear_status() helper also clears the rate counts and the driver-private part of struct ieee80211_tx_info, so using it breaks quite a few other things. So back out of using it, and instead define a ath-internal helper that only clears the area between the status_driver_data and the rates info. Combined with moving the ath_frame_info struct to status_driver_data, this avoids clearing anything we shouldn't be, and so we can keep the existing code for handling the rate information. While fixing this I also noticed that the setting of tx_info->status.rates[tx_rateindex].count on hardware underrun errors was always immediately overridden by the normal setting of the same fields, so rearrange the code so that the underrun detection actually takes effect. The new helper could be generalised to a 'memset_between()' helper, but leave it as a driver-internal helper for now since this needs to go to stable. Cc: stable@vger.kernel.org Reported-by: Peter Seiderer Fixes: 037250f0a45c ("ath9k: Properly clear TX status area before reporting= to mac80211") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Reviewed-by: Peter Seiderer Tested-by: Peter Seiderer Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220404204800.2681133-1-toke@toke.dk Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/wireless/ath/ath9k/main.c | 2 +- drivers/net/wireless/ath/ath9k/xmit.c | 30 ++++++++++++++++++++---------- 2 files changed, 21 insertions(+), 11 deletions(-) --- a/drivers/net/wireless/ath/ath9k/main.c +++ b/drivers/net/wireless/ath/ath9k/main.c @@ -839,7 +839,7 @@ static bool ath9k_txq_list_has_key(struc continue; =20 txinfo =3D IEEE80211_SKB_CB(bf->bf_mpdu); - fi =3D (struct ath_frame_info *)&txinfo->rate_driver_data[0]; + fi =3D (struct ath_frame_info *)&txinfo->status.status_driver_data[0]; if (fi->keyix =3D=3D keyix) return true; } --- a/drivers/net/wireless/ath/ath9k/xmit.c +++ b/drivers/net/wireless/ath/ath9k/xmit.c @@ -141,8 +141,8 @@ static struct ath_frame_info *get_frame_ { struct ieee80211_tx_info *tx_info =3D IEEE80211_SKB_CB(skb); BUILD_BUG_ON(sizeof(struct ath_frame_info) > - sizeof(tx_info->rate_driver_data)); - return (struct ath_frame_info *) &tx_info->rate_driver_data[0]; + sizeof(tx_info->status.status_driver_data)); + return (struct ath_frame_info *) &tx_info->status.status_driver_data[0]; } =20 static void ath_send_bar(struct ath_atx_tid *tid, u16 seqno) @@ -2501,6 +2501,16 @@ skip_tx_complete: spin_unlock_irqrestore(&sc->tx.txbuflock, flags); } =20 +static void ath_clear_tx_status(struct ieee80211_tx_info *tx_info) +{ + void *ptr =3D &tx_info->status; + + memset(ptr + sizeof(tx_info->status.rates), 0, + sizeof(tx_info->status) - + sizeof(tx_info->status.rates) - + sizeof(tx_info->status.status_driver_data)); +} + static void ath_tx_rc_status(struct ath_softc *sc, struct ath_buf *bf, struct ath_tx_status *ts, int nframes, int nbad, int txok) @@ -2512,7 +2522,7 @@ static void ath_tx_rc_status(struct ath_ struct ath_hw *ah =3D sc->sc_ah; u8 i, tx_rateindex; =20 - ieee80211_tx_info_clear_status(tx_info); + ath_clear_tx_status(tx_info); =20 if (txok) tx_info->status.ack_signal =3D ts->ts_rssi; @@ -2528,6 +2538,13 @@ static void ath_tx_rc_status(struct ath_ tx_info->status.ampdu_len =3D nframes; tx_info->status.ampdu_ack_len =3D nframes - nbad; =20 + tx_info->status.rates[tx_rateindex].count =3D ts->ts_longretry + 1; + + for (i =3D tx_rateindex + 1; i < hw->max_rates; i++) { + tx_info->status.rates[i].count =3D 0; + tx_info->status.rates[i].idx =3D -1; + } + if ((ts->ts_status & ATH9K_TXERR_FILT) =3D=3D 0 && (tx_info->flags & IEEE80211_TX_CTL_NO_ACK) =3D=3D 0) { /* @@ -2549,13 +2566,6 @@ static void ath_tx_rc_status(struct ath_ tx_info->status.rates[tx_rateindex].count =3D hw->max_rate_tries; } - - for (i =3D tx_rateindex + 1; i < hw->max_rates; i++) { - tx_info->status.rates[i].count =3D 0; - tx_info->status.rates[i].idx =3D -1; - } - - tx_info->status.rates[tx_rateindex].count =3D ts->ts_longretry + 1; } =20 static void ath_tx_processq(struct ath_softc *sc, struct ath_txq *txq) From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66920C35295 for ; Mon, 18 Apr 2022 13:11:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S241983AbiDRNNR (ORCPT ); Mon, 18 Apr 2022 09:13:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59844 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242285AbiDRM7q (ORCPT ); Mon, 18 Apr 2022 08:59:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6D332FFDB; Mon, 18 Apr 2022 05:40:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CA3EDB80EDB; Mon, 18 Apr 2022 12:40:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 293ACC385A7; Mon, 18 Apr 2022 12:40:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285632; bh=HUvu37Z9AailgtyzSCymtdSt1iU2nxgmgL3q7izu10o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eZ5U2iCovrZGRNJolAmRHpVr5uTlIZTKiOdw2kHgontJTRdWPav+YTDkv8p3pvccU ipfSxc1bQAak/jr7VdIDpIsA/IC3SjciMtFuvqjFq7HvSBuYd6Q863JECGlYX74X+V 0VmXwPU9DTTZXpyUn8ru5WYv9gnK4mPXG7g2Bhc0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, TOTE Robot , Jia-Ju Bai , David Sterba Subject: [PATCH 5.10 079/105] btrfs: fix root ref counts in error handling in btrfs_get_root_ref Date: Mon, 18 Apr 2022 14:13:21 +0200 Message-Id: <20220418121148.875685525@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jia-Ju Bai commit 168a2f776b9762f4021421008512dd7ab7474df1 upstream. In btrfs_get_root_ref(), when btrfs_insert_fs_root() fails, btrfs_put_root() can happen for two reasons: - the root already exists in the tree, in that case it returns the reference obtained in btrfs_lookup_fs_root() - another error so the cleanup is done in the fail label Calling btrfs_put_root() unconditionally would lead to double decrement of the root reference possibly freeing it in the second case. Reported-by: TOTE Robot Fixes: bc44d7c4b2b1 ("btrfs: push btrfs_grab_fs_root into btrfs_get_fs_root= ") CC: stable@vger.kernel.org # 5.10+ Signed-off-by: Jia-Ju Bai Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/disk-io.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/fs/btrfs/disk-io.c +++ b/fs/btrfs/disk-io.c @@ -1596,9 +1596,10 @@ again: =20 ret =3D btrfs_insert_fs_root(fs_info, root); if (ret) { - btrfs_put_root(root); - if (ret =3D=3D -EEXIST) + if (ret =3D=3D -EEXIST) { + btrfs_put_root(root); goto again; + } goto fail; } return root; From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 156D0C4167B for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242091AbiDRNSM (ORCPT ); Mon, 18 Apr 2022 09:18:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59782 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242305AbiDRM7r (ORCPT ); Mon, 18 Apr 2022 08:59:47 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 74BB430572; Mon, 18 Apr 2022 05:40:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0F2C1B80EDE; Mon, 18 Apr 2022 12:40:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 53AFAC385A8; Mon, 18 Apr 2022 12:40:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285635; bh=6NC767/Z/leFqxlxLmfAQXdbf47ApGvrW2i1y2OQ/js=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Rh1uObnc0YNZAiwHwzvWtHyJWJpKbEjFiNBUDB3YsVRqr4WjoePOYhWJ/vflAw/ft vou5sPD5vzuV6gLPSxrMlQ2WCGE4y2APO7AFzCH9h3dy4VPm0jTEx71yR61JJDZr8A 88kvbkOal47P4ALGniVINcGZsUy6Ko4733t+IzyU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Filipe Manana , Naohiro Aota , David Sterba Subject: [PATCH 5.10 080/105] btrfs: mark resumed async balance as writing Date: Mon, 18 Apr 2022 14:13:22 +0200 Message-Id: <20220418121148.904849899@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Naohiro Aota commit a690e5f2db4d1dca742ce734aaff9f3112d63764 upstream. When btrfs balance is interrupted with umount, the background balance resumes on the next mount. There is a potential deadlock with FS freezing here like as described in commit 26559780b953 ("btrfs: zoned: mark relocation as writing"). Mark the process as sb_writing to avoid it. Reviewed-by: Filipe Manana CC: stable@vger.kernel.org # 4.9+ Signed-off-by: Naohiro Aota Reviewed-by: David Sterba Signed-off-by: David Sterba Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/btrfs/volumes.c | 2 ++ 1 file changed, 2 insertions(+) --- a/fs/btrfs/volumes.c +++ b/fs/btrfs/volumes.c @@ -4220,10 +4220,12 @@ static int balance_kthread(void *data) struct btrfs_fs_info *fs_info =3D data; int ret =3D 0; =20 + sb_start_write(fs_info->sb); mutex_lock(&fs_info->balance_mutex); if (fs_info->balance_ctl) ret =3D btrfs_balance(fs_info, fs_info->balance_ctl, NULL); mutex_unlock(&fs_info->balance_mutex); + sb_end_write(fs_info->sb); =20 return ret; } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D423AC47085 for ; Mon, 18 Apr 2022 13:12:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242213AbiDRNNg (ORCPT ); Mon, 18 Apr 2022 09:13:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242314AbiDRM7r (ORCPT ); Mon, 18 Apr 2022 08:59:47 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2D3443057D; Mon, 18 Apr 2022 05:40:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 84E68CE106B; Mon, 18 Apr 2022 12:40:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 593FEC385A1; Mon, 18 Apr 2022 12:40:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285638; bh=Y+MsGdG0Q3lcTQI4YTnOgQCzZdWexdV20tzI8swenUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZaHJ2R3nrtfwi8Occ5LCNxjNPnTlGW4Uqc+eswdvlFLDPG7dkxBImxv/iR++vnF10 GWbfZ4Lf/4v8t5NMSeoy1zaC6XYzihlpCC/puCLMlOxfiU5uSu/09i57dCPLK4lj4g rJ1p0g7+DT2q74PmO3+s4bxcGnsGTDXnTqox4AVE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tim Crawford , Takashi Iwai Subject: [PATCH 5.10 081/105] ALSA: hda/realtek: Add quirk for Clevo PD50PNT Date: Mon, 18 Apr 2022 14:13:23 +0200 Message-Id: <20220418121148.933433451@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tim Crawford commit 9eb6f5c388060d8cef3c8b616cc31b765e022359 upstream. Fixes speaker output and headset detection on Clevo PD50PNT. Signed-off-by: Tim Crawford Cc: Link: https://lore.kernel.org/r/20220405182029.27431-1-tcrawford@system76.c= om Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -2626,6 +2626,7 @@ static const struct snd_pci_quirk alc882 SND_PCI_QUIRK(0x1558, 0x65e1, "Clevo PB51[ED][DF]", ALC1220_FIXUP_CLEVO_P= B51ED_PINS), SND_PCI_QUIRK(0x1558, 0x65e5, "Clevo PC50D[PRS](?:-D|-G)?", ALC1220_FIXUP= _CLEVO_PB51ED_PINS), SND_PCI_QUIRK(0x1558, 0x65f1, "Clevo PC50HS", ALC1220_FIXUP_CLEVO_PB51ED_= PINS), + SND_PCI_QUIRK(0x1558, 0x65f5, "Clevo PD50PN[NRT]", ALC1220_FIXUP_CLEVO_PB= 51ED_PINS), SND_PCI_QUIRK(0x1558, 0x67d1, "Clevo PB71[ER][CDF]", ALC1220_FIXUP_CLEVO_= PB51ED_PINS), SND_PCI_QUIRK(0x1558, 0x67e1, "Clevo PB71[DE][CDF]", ALC1220_FIXUP_CLEVO_= PB51ED_PINS), SND_PCI_QUIRK(0x1558, 0x67e5, "Clevo PC70D[PRS](?:-D|-G)?", ALC1220_FIXUP= _CLEVO_PB51ED_PINS), From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3DD4C47082 for ; Mon, 18 Apr 2022 13:11:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242155AbiDRNNZ (ORCPT ); Mon, 18 Apr 2022 09:13:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59864 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242313AbiDRM7r (ORCPT ); Mon, 18 Apr 2022 08:59:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B86F30574; Mon, 18 Apr 2022 05:40:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AC4AE60FB6; Mon, 18 Apr 2022 12:40:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F7DBC385A1; Mon, 18 Apr 2022 12:40:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285642; bh=Mjxt2i/b04vTLzk5hAVoMByvoXozygDZrgJVQY2xCLc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2a3Qd84p+xntYsoiQfWPN2PToiL0lBnRY4d3Srz83tBEkSAgos8oiVAquJj3s+VMx RaEDHA5T8p6T2idPpNZxmzc8bUR53SN1XV+w5f1uvmQJyZnPI9+pbhcsnV5JPhu156 qYwbUxrVHO0OxEO/XgseJO9smeBYlRhKzzhfjd0c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tao Jin , Takashi Iwai Subject: [PATCH 5.10 082/105] ALSA: hda/realtek: add quirk for Lenovo Thinkpad X12 speakers Date: Mon, 18 Apr 2022 14:13:24 +0200 Message-Id: <20220418121148.961889761@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tao Jin commit 264fb03497ec1c7841bba872571bcd11beed57a7 upstream. For this specific device on Lenovo Thinkpad X12 tablet, the verbs were dumped by qemu running a guest OS that init this codec properly. After studying the dump, it turns out that the same quirk used by the other Lenovo devices can be reused. The patch was tested working against the mainline kernel. Cc: Signed-off-by: Tao Jin Link: https://lore.kernel.org/r/CO6PR03MB6241CD73310B37858FE64C85E1E89@CO6P= R03MB6241.namprd03.prod.outlook.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/pci/hda/patch_realtek.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/pci/hda/patch_realtek.c +++ b/sound/pci/hda/patch_realtek.c @@ -8995,6 +8995,7 @@ static const struct snd_pci_quirk alc269 SND_PCI_QUIRK(0x17aa, 0x505d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), SND_PCI_QUIRK(0x17aa, 0x505f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), SND_PCI_QUIRK(0x17aa, 0x5062, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x508b, "Thinkpad X12 Gen 1", ALC287_FIXUP_LEGION_1= 5IMHG05_SPEAKERS), SND_PCI_QUIRK(0x17aa, 0x5109, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOS= T), SND_PCI_QUIRK(0x17aa, 0x511e, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), SND_PCI_QUIRK(0x17aa, 0x511f, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 18D0FC433FE for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242320AbiDRNNs (ORCPT ); Mon, 18 Apr 2022 09:13:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59654 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242324AbiDRM7s (ORCPT ); Mon, 18 Apr 2022 08:59:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 230C530F49; Mon, 18 Apr 2022 05:40:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A7CF5611CF; Mon, 18 Apr 2022 12:40:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A779CC385A7; Mon, 18 Apr 2022 12:40:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285645; bh=UYHUcoEgKn3na7teYp31D7rfV2SER4dpkGY85jOixaY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1MNicW9XcqvSMDFF2MzOevww4422s4OB2KmqVb9uPezbTg7tgY8YWh5IpWDMoSVuC DylJz3w5ZQKSiAcSCJEHy1qfOnSGj94pM9xm4r5/BxiSK5FJk6Hd5j+bWF9cxMnk1m w2RKZbgNAOc8WG43WtxTye1ngli0fM4y5xRcARlI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Fabio M. De Francesco" , Takashi Iwai , syzbot+205eb15961852c2c5974@syzkaller.appspotmail.com Subject: [PATCH 5.10 083/105] ALSA: pcm: Test for "silence" field in struct "pcm_format_data" Date: Mon, 18 Apr 2022 14:13:25 +0200 Message-Id: <20220418121148.990879701@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fabio M. De Francesco commit 2f7a26abb8241a0208c68d22815aa247c5ddacab upstream. Syzbot reports "KASAN: null-ptr-deref Write in snd_pcm_format_set_silence".[1] It is due to missing validation of the "silence" field of struct "pcm_format_data" in "pcm_formats" array. Add a test for valid "pat" and, if it is not so, return -EINVAL. [1] https://lore.kernel.org/lkml/000000000000d188ef05dc2c7279@google.com/ Reported-and-tested-by: syzbot+205eb15961852c2c5974@syzkaller.appspotmail.c= om Signed-off-by: Fabio M. De Francesco Cc: Link: https://lore.kernel.org/r/20220409012655.9399-1-fmdefrancesco@gmail.c= om Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/core/pcm_misc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/core/pcm_misc.c +++ b/sound/core/pcm_misc.c @@ -429,7 +429,7 @@ int snd_pcm_format_set_silence(snd_pcm_f return 0; width =3D pcm_formats[(INT)format].phys; /* physical width */ pat =3D pcm_formats[(INT)format].silence; - if (! width) + if (!width || !pat) return -EINVAL; /* signed or 1 byte data */ if (pcm_formats[(INT)format].signd =3D=3D 1 || width <=3D 8) { From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3522DC4321E for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242173AbiDRNSR (ORCPT ); Mon, 18 Apr 2022 09:18:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32916 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242333AbiDRM7t (ORCPT ); Mon, 18 Apr 2022 08:59:49 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AAA281FCD0; Mon, 18 Apr 2022 05:40:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 51DF3B80EDB; Mon, 18 Apr 2022 12:40:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F955C385A7; Mon, 18 Apr 2022 12:40:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285648; bh=Ph9hJRhsOem6t2MZ4hC2dNTpwxa/eUuVY6/fsbgX/lU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I3+FZ+JH4752/9/dUV5OtQ0O6vplq1MWnFFEB4R9ckw8zkPjnm12wU/lcMV4GAJMu 0CLp6hmi4DzhMvGb+wUvl39nGVAy7lIFZc7nVGe8jp0vy7Uj0epv7PWT+KJ4WVlv4o punMkYCwF0tr7lNN7m2gre4nnDVxh2tyzGA3kc7Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lee Jones , Johannes Berg Subject: [PATCH 5.10 084/105] nl80211: correctly check NL80211_ATTR_REG_ALPHA2 size Date: Mon, 18 Apr 2022 14:13:26 +0200 Message-Id: <20220418121149.019557205@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Johannes Berg commit 6624bb34b4eb19f715db9908cca00122748765d7 upstream. We need this to be at least two bytes, so we can access alpha2[0] and alpha2[1]. It may be three in case some userspace used NUL-termination since it was NLA_STRING (and we also push it out with NUL-termination). Cc: stable@vger.kernel.org Reported-by: Lee Jones Link: https://lore.kernel.org/r/20220411114201.fd4a31f06541.Ie7ff4be2cf348d= 8cc28ed0d626fc54becf7ea799@changeid Signed-off-by: Johannes Berg Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/wireless/nl80211.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -475,7 +475,8 @@ static const struct nla_policy nl80211_p .len =3D IEEE80211_MAX_MESH_ID_LEN }, [NL80211_ATTR_MPATH_NEXT_HOP] =3D NLA_POLICY_ETH_ADDR_COMPAT, =20 - [NL80211_ATTR_REG_ALPHA2] =3D { .type =3D NLA_STRING, .len =3D 2 }, + /* allow 3 for NUL-termination, we used to declare this NLA_STRING */ + [NL80211_ATTR_REG_ALPHA2] =3D NLA_POLICY_RANGE(NLA_BINARY, 2, 3), [NL80211_ATTR_REG_RULES] =3D { .type =3D NLA_NESTED }, =20 [NL80211_ATTR_BSS_CTS_PROT] =3D { .type =3D NLA_U8 }, From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 539F5C4167E for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242219AbiDRNS0 (ORCPT ); Mon, 18 Apr 2022 09:18:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242360AbiDRM7u (ORCPT ); Mon, 18 Apr 2022 08:59:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2017C201BB; Mon, 18 Apr 2022 05:40:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 53002B80EC3; Mon, 18 Apr 2022 12:40:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9F3D2C385A1; Mon, 18 Apr 2022 12:40:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285654; bh=U6HJbILbFH/jDdPNi6UJqdpoL9mzb5+SE4t1nR22814=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pcwffEIBtbbgB2GSQG4b2TB3JhirTPHq7SviNptScrMSLTpr2cfAQa0ldGy8f8Nwv W5+dhTifypsdVJfLkZrZ2Lx760jaaltPdC6IEapiT98vcmfTq0GQ/Q03PKupxXenXB ec9ReTEksP1HjyHXRYIR8j9NjSFbtQNkov/m8eiE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kongweibin , Nicolas Dichtel , David Ahern , "David S. Miller" Subject: [PATCH 5.10 085/105] ipv6: fix panic when forwarding a pkt with no in6 dev Date: Mon, 18 Apr 2022 14:13:27 +0200 Message-Id: <20220418121149.047517945@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nicolas Dichtel commit e3fa461d8b0e185b7da8a101fe94dfe6dd500ac0 upstream. kongweibin reported a kernel panic in ip6_forward() when input interface has no in6 dev associated. The following tc commands were used to reproduce this panic: tc qdisc del dev vxlan100 root tc qdisc add dev vxlan100 root netem corrupt 5% CC: stable@vger.kernel.org Fixes: ccd27f05ae7b ("ipv6: fix 'disable_policy' for fwd packets") Reported-by: kongweibin Signed-off-by: Nicolas Dichtel Reviewed-by: David Ahern Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv6/ip6_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -508,7 +508,7 @@ int ip6_forward(struct sk_buff *skb) goto drop; =20 if (!net->ipv6.devconf_all->disable_policy && - !idev->cnf.disable_policy && + (!idev || !idev->cnf.disable_policy) && !xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) { __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS); goto drop; From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A1502C433FE for ; Mon, 18 Apr 2022 13:12:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242425AbiDRNN6 (ORCPT ); Mon, 18 Apr 2022 09:13:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59772 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242365AbiDRM7u (ORCPT ); Mon, 18 Apr 2022 08:59:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EA6E9201BF; Mon, 18 Apr 2022 05:40:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 86928611FE; Mon, 18 Apr 2022 12:40:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91101C385A9; Mon, 18 Apr 2022 12:40:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285657; bh=X1NBGVEBB4H5wW2n3F/zW1shQ120PbUXesGnU0MJgW8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2hvtBPBa6ExS0ndzkGcn7LSHoysc1V4ThGku8s2CpmAnwpDNUmrfsT6q91Gqk30lM GOrAmKgvT5qG8OX0wYDH8Pz1gzjeL4HU3xDVcD8RNvEDwSjV9vcBmZoLjdOKQSaFWA X+YSw3YAWsly0W3++18lSjQco26vhNncrMYK9kyQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Melissa Wen , Rodrigo Siqueira , Harry Wentland , Simon Ser , Alex Deucher Subject: [PATCH 5.10 086/105] drm/amd/display: dont ignore alpha property on pre-multiplied mode Date: Mon, 18 Apr 2022 14:13:28 +0200 Message-Id: <20220418121149.076222948@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Melissa Wen commit e4f1541caf60fcbe5a59e9d25805c0b5865e546a upstream. "Pre-multiplied" is the default pixel blend mode for KMS/DRM, as documented in supported_modes of drm_plane_create_blend_mode_property(): https://cgit.freedesktop.org/drm/drm-misc/tree/drivers/gpu/drm/drm_blend.c In this mode, both 'pixel alpha' and 'plane alpha' participate in the calculation, as described by the pixel blend mode formula in KMS/DRM documentation: out.rgb =3D plane_alpha * fg.rgb + (1 - (plane_alpha * fg.alpha)) * bg.rgb Considering the blend config mechanisms we have in the driver so far, the alpha mode that better fits this blend mode is the _PER_PIXEL_ALPHA_COMBINED_GLOBAL_GAIN, where the value for global_gain is the plane alpha (global_alpha). With this change, alpha property stops to be ignored. It also addresses Bug: https://gitlab.freedesktop.org/drm/amd/-/issues/1734 v2: * keep the 8-bit value for global_alpha_value (Nicholas) * correct the logical ordering for combined global gain (Nicholas) * apply to dcn10 too (Nicholas) Signed-off-by: Melissa Wen Tested-by: Rodrigo Siqueira Reviewed-by: Harry Wentland Tested-by: Simon Ser Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 14 +++++++++= ----- drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c | 14 +++++++++= ----- 2 files changed, 18 insertions(+), 10 deletions(-) --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c @@ -2387,14 +2387,18 @@ void dcn10_update_mpcc(struct dc *dc, st &blnd_cfg.black_color); } =20 - if (per_pixel_alpha) - blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; - else - blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; - blnd_cfg.overlap_only =3D false; blnd_cfg.global_gain =3D 0xff; =20 + if (per_pixel_alpha && pipe_ctx->plane_state->global_alpha) { + blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA_COMBINED_G= LOBAL_GAIN; + blnd_cfg.global_gain =3D pipe_ctx->plane_state->global_alpha_value; + } else if (per_pixel_alpha) { + blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; + } else { + blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; + } + if (pipe_ctx->plane_state->global_alpha) blnd_cfg.global_alpha =3D pipe_ctx->plane_state->global_alpha_value; else --- a/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c +++ b/drivers/gpu/drm/amd/display/dc/dcn20/dcn20_hwseq.c @@ -2270,14 +2270,18 @@ void dcn20_update_mpcc(struct dc *dc, st pipe_ctx, &blnd_cfg.black_color); } =20 - if (per_pixel_alpha) - blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; - else - blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; - blnd_cfg.overlap_only =3D false; blnd_cfg.global_gain =3D 0xff; =20 + if (per_pixel_alpha && pipe_ctx->plane_state->global_alpha) { + blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA_COMBINED_G= LOBAL_GAIN; + blnd_cfg.global_gain =3D pipe_ctx->plane_state->global_alpha_value; + } else if (per_pixel_alpha) { + blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_PER_PIXEL_ALPHA; + } else { + blnd_cfg.alpha_mode =3D MPCC_ALPHA_BLEND_MODE_GLOBAL_ALPHA; + } + if (pipe_ctx->plane_state->global_alpha) blnd_cfg.global_alpha =3D pipe_ctx->plane_state->global_alpha_value; else From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 356A6C388F3 for ; Mon, 18 Apr 2022 13:12:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242396AbiDRNNy (ORCPT ); Mon, 18 Apr 2022 09:13:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32934 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242373AbiDRM7u (ORCPT ); Mon, 18 Apr 2022 08:59:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C89B1205C3; Mon, 18 Apr 2022 05:41:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 51625611FE; Mon, 18 Apr 2022 12:41:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4EF11C385A1; Mon, 18 Apr 2022 12:40:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285659; bh=0pNCm8cPtRNE2lPaj50F4TUTtqGyvvsngKx3mqhnaVw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AqIHTnzUMpX1GsCnY6tII6dexTo2YqF7H3DoFOtA286rj2HrFT7o1J+qbSlSS+5iH RVVbVzUpr/whMuVtKG040wHepVGtCdWxgOiEdU7gjcAZ7HfXL9p0rQ0ZWZ4cdm1M5Q GvU0BgN73yg3us+rLVRo1lkC4mJt3pA+pGEK1/Sg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Tomasz=20Mo=C5=84?= , Alex Deucher Subject: [PATCH 5.10 087/105] drm/amdgpu: Enable gfxoff quirk on MacBook Pro Date: Mon, 18 Apr 2022 14:13:29 +0200 Message-Id: <20220418121149.104870040@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tomasz Mo=C5=84 commit 4593c1b6d159f1e5c35c07a7f125e79e5a864302 upstream. Enabling gfxoff quirk results in perfectly usable graphical user interface on MacBook Pro (15-inch, 2019) with Radeon Pro Vega 20 4 GB. Without the quirk, X server is completely unusable as every few seconds there is gpu reset due to ring gfx timeout. Signed-off-by: Tomasz Mo=C5=84 Signed-off-by: Alex Deucher Cc: stable@vger.kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 2 ++ 1 file changed, 2 insertions(+) --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c @@ -1248,6 +1248,8 @@ static const struct amdgpu_gfxoff_quirk { 0x1002, 0x15dd, 0x103c, 0x83e7, 0xd3 }, /* GFXOFF is unstable on C6 parts with a VBIOS 113-RAVEN-114 */ { 0x1002, 0x15dd, 0x1002, 0x15dd, 0xc6 }, + /* Apple MacBook Pro (15-inch, 2019) Radeon Pro Vega 20 4 GB */ + { 0x1002, 0x69af, 0x106b, 0x019a, 0xc0 }, { 0, 0, 0, 0, 0 }, }; =20 From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 38832C4707F for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242993AbiDRNT2 (ORCPT ); Mon, 18 Apr 2022 09:19:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59920 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239634AbiDRNAO (ORCPT ); Mon, 18 Apr 2022 09:00:14 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B911B3153A; Mon, 18 Apr 2022 05:41:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2861C60FB6; Mon, 18 Apr 2022 12:41:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15E07C385A8; Mon, 18 Apr 2022 12:41:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285707; bh=PRKKSlC++3tu0htGySyF7EK6m/IfUhB+bYRdOYfYruw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=aMKbI9dwnPxEWWOfe+ynqFLoB4+1GDXqHoiw+nkoqgiVYk7zZF6uau0DILP973hcW v2F4KYMem8odoR0ladnaWYjFYRrwBlWNwbuJMWazPqkGGu7P6u0P/Ul9e+1OErMOTx cZZiIwr69lazYQKU4bKp8wvAZrf0pKWavWWykm90= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rei Yamamoto , Thomas Gleixner , Ming Lei Subject: [PATCH 5.10 088/105] genirq/affinity: Consider that CPUs on nodes can be unbalanced Date: Mon, 18 Apr 2022 14:13:30 +0200 Message-Id: <20220418121149.133631295@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Rei Yamamoto commit 08d835dff916bfe8f45acc7b92c7af6c4081c8a7 upstream. If CPUs on a node are offline at boot time, the number of nodes is different when building affinity masks for present cpus and when building affinity masks for possible cpus. This causes the following problem: In the case that the number of vectors is less than the number of nodes there are cases where bits of masks for present cpus are overwritten when building masks for possible cpus. Fix this by excluding CPUs, which are not part of the current build mask (present/possible). [ tglx: Massaged changelog and added comment ] Fixes: b82592199032 ("genirq/affinity: Spread IRQs to all available NUMA no= des") Signed-off-by: Rei Yamamoto Signed-off-by: Thomas Gleixner Reviewed-by: Ming Lei Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20220331003309.10891-1-yamamoto.rei@jp.fuji= tsu.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/irq/affinity.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/kernel/irq/affinity.c +++ b/kernel/irq/affinity.c @@ -269,8 +269,9 @@ static int __irq_build_affinity_masks(un */ if (numvecs <=3D nodes) { for_each_node_mask(n, nodemsk) { - cpumask_or(&masks[curvec].mask, &masks[curvec].mask, - node_to_cpumask[n]); + /* Ensure that only CPUs which are in both masks are set */ + cpumask_and(nmsk, cpu_mask, node_to_cpumask[n]); + cpumask_or(&masks[curvec].mask, &masks[curvec].mask, nmsk); if (++curvec =3D=3D last_affv) curvec =3D firstvec; } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9C92CC433F5 for ; Mon, 18 Apr 2022 13:12:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240355AbiDRNP2 (ORCPT ); Mon, 18 Apr 2022 09:15:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59772 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242473AbiDRM77 (ORCPT ); Mon, 18 Apr 2022 08:59:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 01E2431227; Mon, 18 Apr 2022 05:41:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 83D4161239; Mon, 18 Apr 2022 12:41:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 76F19C385A7; Mon, 18 Apr 2022 12:41:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285681; bh=9Mi13LQ3ueDfouVHxT/drIOtDkIQ87aRTzNV+mSmQwE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Vm6Xr/Cmet6I1pNX8GRoKIZXTDHsXDdbNyzqkLmHx/5c9BDmi2WDxdjVbOv6mGoYR pqqKVpG54NsIo2RvmgmEpyAo/v8RBpWp7Uog90wJSxieNLwj1RJxdfodLkEW4ke75P e2t9F1RZ7BVqhOpEnlmvcbqwihPWwIHPcijezvns= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Gortmaker , Thomas Gleixner Subject: [PATCH 5.10 089/105] tick/nohz: Use WARN_ON_ONCE() to prevent console saturation Date: Mon, 18 Apr 2022 14:13:31 +0200 Message-Id: <20220418121149.161626115@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Gortmaker commit 40e97e42961f8c6cc7bd5fe67cc18417e02d78f1 upstream. While running some testing on code that happened to allow the variable tick_nohz_full_running to get set but with no "possible" NOHZ cores to back up that setting, this warning triggered: if (unlikely(tick_do_timer_cpu =3D=3D TICK_DO_TIMER_NONE)) WARN_ON(tick_nohz_full_running); The console was overwhemled with an endless stream of one WARN per tick per core and there was no way to even see what was going on w/o using a serial console to capture it and then trace it back to this. Change it to WARN_ON_ONCE(). Fixes: 08ae95f4fd3b ("nohz_full: Allow the boot CPU to be nohz_full") Signed-off-by: Paul Gortmaker Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/20211206145950.10927-3-paul.gortmaker@windr= iver.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/time/tick-sched.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/time/tick-sched.c +++ b/kernel/time/tick-sched.c @@ -136,7 +136,7 @@ static void tick_sched_do_timer(struct t */ if (unlikely(tick_do_timer_cpu =3D=3D TICK_DO_TIMER_NONE)) { #ifdef CONFIG_NO_HZ_FULL - WARN_ON(tick_nohz_full_running); + WARN_ON_ONCE(tick_nohz_full_running); #endif tick_do_timer_cpu =3D cpu; } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8F999C41535 for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242427AbiDRNSm (ORCPT ); Mon, 18 Apr 2022 09:18:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32936 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242491AbiDRNAA (ORCPT ); Mon, 18 Apr 2022 09:00:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8EA4D31233; Mon, 18 Apr 2022 05:41:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C948A611CF; Mon, 18 Apr 2022 12:41:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B9B57C385A1; Mon, 18 Apr 2022 12:41:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285685; bh=8aq8etiejXnzTulB0gCT3uDujb/HFTZyXETxFWIJ2lg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HXK6rX/eovrQVvgk30dVexpW/40MrTlVcn+wUkCwCJIRTZagIDKk5k5EhAN2J1Vb0 8x8DZDlaq7ChBXo4/h619oCnv+Q5pN626bSHl4NCwMzy+Ga46X/flEuT44ELe7dhan pkzehAJ9gp2sQUJPkLja5ujpRmcMw5OKRzslwSsg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Arnd Bergmann , Bartosz Golaszewski Subject: [PATCH 5.10 090/105] ARM: davinci: da850-evm: Avoid NULL pointer dereference Date: Mon, 18 Apr 2022 14:13:32 +0200 Message-Id: <20220418121149.190039854@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 83a1cde5c74bfb44b49cb2a940d044bb2380f4ea upstream. With newer versions of GCC, there is a panic in da850_evm_config_emac() when booting multi_v5_defconfig in QEMU under the palmetto-bmc machine: Unable to handle kernel NULL pointer dereference at virtual address 00000020 pgd =3D (ptrval) [00000020] *pgd=3D00000000 Internal error: Oops: 5 [#1] PREEMPT ARM Modules linked in: CPU: 0 PID: 1 Comm: swapper Not tainted 5.15.0 #1 Hardware name: Generic DT based system PC is at da850_evm_config_emac+0x1c/0x120 LR is at do_one_initcall+0x50/0x1e0 The emac_pdata pointer in soc_info is NULL because davinci_soc_info only gets populated on davinci machines but da850_evm_config_emac() is called on all machines via device_initcall(). Move the rmii_en assignment below the machine check so that it is only dereferenced when running on a supported SoC. Fixes: bae105879f2f ("davinci: DA850/OMAP-L138 EVM: implement autodetect of= RMII PHY") Signed-off-by: Nathan Chancellor Reviewed-by: Arnd Bergmann Reviewed-by: Bartosz Golaszewski Cc: stable@vger.kernel.org Link: https://lore.kernel.org/r/YcS4xVWs6bQlQSPC@archlinux-ax161/ Signed-off-by: Arnd Bergmann Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/arm/mach-davinci/board-da850-evm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) --- a/arch/arm/mach-davinci/board-da850-evm.c +++ b/arch/arm/mach-davinci/board-da850-evm.c @@ -1101,11 +1101,13 @@ static int __init da850_evm_config_emac( int ret; u32 val; struct davinci_soc_info *soc_info =3D &davinci_soc_info; - u8 rmii_en =3D soc_info->emac_pdata->rmii_en; + u8 rmii_en; =20 if (!machine_is_davinci_da850_evm()) return 0; =20 + rmii_en =3D soc_info->emac_pdata->rmii_en; + cfg_chip3_base =3D DA8XX_SYSCFG0_VIRT(DA8XX_CFGCHIP3_REG); =20 val =3D __raw_readl(cfg_chip3_base); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 80B43C3525B for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242357AbiDRNSg (ORCPT ); Mon, 18 Apr 2022 09:18:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242513AbiDRNAB (ORCPT ); Mon, 18 Apr 2022 09:00:01 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFE393134B; Mon, 18 Apr 2022 05:41:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2D5DB61218; Mon, 18 Apr 2022 12:41:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1E9A8C385A1; Mon, 18 Apr 2022 12:41:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285688; bh=LQPRrzsPuk3UiGHZPzBJ3WvbKAYxjT0D/NxWnxfFlxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XAIqGrCMoOsZ+8Ka+BQyhBE7fqVRr1L/sEn3ANbAp9zjDtlIKBsvQPbJpIuHyK2zS TbtNXxT3GZVNfi97kq+AyzSdAMyuYTkxPMSENWH4W+8voaep7vZ8VElC57yiPNyi4D LFEk+fNOKdsLtjh8nIWv+QJqg6fnTj59tPvhCDCU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Mike Snitzer Subject: [PATCH 5.10 091/105] dm integrity: fix memory corruption when tag_size is less than digest size Date: Mon, 18 Apr 2022 14:13:33 +0200 Message-Id: <20220418121149.218998572@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mikulas Patocka commit 08c1af8f1c13bbf210f1760132f4df24d0ed46d6 upstream. It is possible to set up dm-integrity in such a way that the "tag_size" parameter is less than the actual digest size. In this situation, a part of the digest beyond tag_size is ignored. In this case, dm-integrity would write beyond the end of the ic->recalc_tags array and corrupt memory. The corruption happened in integrity_recalc->integrity_sector_checksum->crypto_shash_final. Fix this corruption by increasing the tags array so that it has enough padding at the end to accomodate the loop in integrity_recalc() being able to write a full digest size for the last member of the tags array. Cc: stable@vger.kernel.org # v4.19+ Signed-off-by: Mikulas Patocka Signed-off-by: Mike Snitzer Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/md/dm-integrity.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/drivers/md/dm-integrity.c +++ b/drivers/md/dm-integrity.c @@ -4232,6 +4232,7 @@ try_smaller_buffer: } =20 if (ic->internal_hash) { + size_t recalc_tags_size; ic->recalc_wq =3D alloc_workqueue("dm-integrity-recalc", WQ_MEM_RECLAIM,= 1); if (!ic->recalc_wq ) { ti->error =3D "Cannot allocate workqueue"; @@ -4245,8 +4246,10 @@ try_smaller_buffer: r =3D -ENOMEM; goto bad; } - ic->recalc_tags =3D kvmalloc_array(RECALC_SECTORS >> ic->sb->log2_sector= s_per_block, - ic->tag_size, GFP_KERNEL); + recalc_tags_size =3D (RECALC_SECTORS >> ic->sb->log2_sectors_per_block) = * ic->tag_size; + if (crypto_shash_digestsize(ic->internal_hash) > ic->tag_size) + recalc_tags_size +=3D crypto_shash_digestsize(ic->internal_hash) - ic->= tag_size; + ic->recalc_tags =3D kvmalloc(recalc_tags_size, GFP_KERNEL); if (!ic->recalc_tags) { ti->error =3D "Cannot allocate tags for recalculating"; r =3D -ENOMEM; From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C1C8BC3527C for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242786AbiDRNTC (ORCPT ); Mon, 18 Apr 2022 09:19:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59900 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242565AbiDRNAJ (ORCPT ); Mon, 18 Apr 2022 09:00:09 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B297B31362; Mon, 18 Apr 2022 05:41:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5CBE8B80EC3; Mon, 18 Apr 2022 12:41:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 976EFC385A1; Mon, 18 Apr 2022 12:41:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285692; bh=X5VqiY22ZhhGMKTjPjEHHjQro/Fe7DdjAuffpRjJ934=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XErRkIWJ5AIWgrBGB4LWoky2wOaXJPmNBkidcvDeNPBv3fH4gTzR/y2320ux05ij0 IbCgi9wXME4kj94Ss1g1qriidtXMt4gy/DaXT4zS2Wq51zBE7g8BkBkkQVC33E7+iS SmteZ2SfHwaDMkK7KAIu5i60BRFkRRfwhVqAdQaA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nadav Amit , Thomas Gleixner Subject: [PATCH 5.10 092/105] smp: Fix offline cpu check in flush_smp_call_function_queue() Date: Mon, 18 Apr 2022 14:13:34 +0200 Message-Id: <20220418121149.248407638@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nadav Amit commit 9e949a3886356fe9112c6f6f34a6e23d1d35407f upstream. The check in flush_smp_call_function_queue() for callbacks that are sent to offline CPUs currently checks whether the queue is empty. However, flush_smp_call_function_queue() has just deleted all the callbacks from the queue and moved all the entries into a local list. This checks would only be positive if some callbacks were added in the short time after llist_del_all() was called. This does not seem to be the intention of this check. Change the check to look at the local list to which the entries were moved instead of the queue from which all the callbacks were just removed. Fixes: 8d056c48e4862 ("CPU hotplug, smp: flush any pending IPI callbacks be= fore CPU offline") Signed-off-by: Nadav Amit Signed-off-by: Thomas Gleixner Link: https://lore.kernel.org/r/20220319072015.1495036-1-namit@vmware.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/smp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/kernel/smp.c +++ b/kernel/smp.c @@ -346,7 +346,7 @@ static void flush_smp_call_function_queu =20 /* There shouldn't be any pending callbacks on an offline CPU. */ if (unlikely(warn_cpu_offline && !cpu_online(smp_processor_id()) && - !warned && !llist_empty(head))) { + !warned && entry !=3D NULL)) { warned =3D true; WARN(1, "IPI on offline CPU %d\n", smp_processor_id()); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E0ACEC4707A for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242811AbiDRNTL (ORCPT ); Mon, 18 Apr 2022 09:19:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242571AbiDRNAK (ORCPT ); Mon, 18 Apr 2022 09:00:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B2C7C31368; Mon, 18 Apr 2022 05:41:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5A028B80EDE; Mon, 18 Apr 2022 12:41:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AA20AC385A1; Mon, 18 Apr 2022 12:41:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285695; bh=X0t+T/PV6H7afRr7VxLAQykE69EkNrL4/q4ZlSkuoE4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=poeKVeqaXl3ARTvZrpqkaVTT4btJArzFmSW1PsLK3MCjJWfdK0bIkft6xAzcH4RAe 64LUsvSsGHq7Q+v7GbL0rT4Rng7Yqu22Rgp7O2h7p8/ywCpkHDGFWcdHhOAWmuHDbu A4eJOYozOsxSGt1pEAwwjvnBK0fgNIZ2H47WN50g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Martin=20Povi=C5=A1er?= , Sven Peter , Wolfram Sang Subject: [PATCH 5.10 093/105] i2c: pasemi: Wait for write xfers to finish Date: Mon, 18 Apr 2022 14:13:35 +0200 Message-Id: <20220418121149.276158364@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Martin Povi=C5=A1er commit bd8963e602c77adc76dbbbfc3417c3cf14fed76b upstream. Wait for completion of write transfers before returning from the driver. At first sight it may seem advantageous to leave write transfers queued for the controller to carry out on its own time, but there's a couple of issues with it: * Driver doesn't check for FIFO space. * The queued writes can complete while the driver is in its I2C read transfer path which means it will get confused by the raising of XEN (the 'transaction ended' signal). This can cause a spurious ENODATA error due to premature reading of the MRXFIFO register. Adding the wait fixes some unreliability issues with the driver. There's some efficiency cost to it (especially with pasemi_smb_waitready doing its polling), but that will be alleviated once the driver receives interrupt support. Fixes: beb58aa39e6e ("i2c: PA Semi SMBus driver") Signed-off-by: Martin Povi=C5=A1er Reviewed-by: Sven Peter Signed-off-by: Wolfram Sang Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/i2c/busses/i2c-pasemi.c | 6 ++++++ 1 file changed, 6 insertions(+) --- a/drivers/i2c/busses/i2c-pasemi.c +++ b/drivers/i2c/busses/i2c-pasemi.c @@ -137,6 +137,12 @@ static int pasemi_i2c_xfer_msg(struct i2 =20 TXFIFO_WR(smbus, msg->buf[msg->len-1] | (stop ? MTXFIFO_STOP : 0)); + + if (stop) { + err =3D pasemi_smb_waitready(smbus); + if (err) + goto reset_out; + } } =20 return 0; From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0DA4C3527D for ; Mon, 18 Apr 2022 13:18:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242852AbiDRNTN (ORCPT ); Mon, 18 Apr 2022 09:19:13 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32928 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242574AbiDRNAK (ORCPT ); Mon, 18 Apr 2022 09:00:10 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3891D2612A; Mon, 18 Apr 2022 05:41:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C811560FB6; Mon, 18 Apr 2022 12:41:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D458AC385A1; Mon, 18 Apr 2022 12:41:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285698; bh=+bJHROMegmTVcDWC4ZKfPap8cszGveXnm0W1xWIE8ko=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bIs2yQXUL950qWWOD6vFsCwuWgJSS572j/OVpjHNknOS3StKy3MfjRt0Faj56HVo8 mj0vQ6E0J+DUdDex9CLxw48ou9oGgs9KN1JCwm78JWnl/5bq1ztshNZC+n3WAosJGl xZWTGqW3EYxQ8iSKukisSkHwo0rjrnjo+g3HWD38= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johannes Berg , Anna-Maria Behnsen , Thomas Gleixner , Frederic Weisbecker Subject: [PATCH 5.10 094/105] timers: Fix warning condition in __run_timers() Date: Mon, 18 Apr 2022 14:13:36 +0200 Message-Id: <20220418121149.304352708@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Anna-Maria Behnsen commit c54bc0fc84214b203f7a0ebfd1bd308ce2abe920 upstream. When the timer base is empty, base::next_expiry is set to base::clk + NEXT_TIMER_MAX_DELTA and base::next_expiry_recalc is false. When no timer is queued until jiffies reaches base::next_expiry value, the warning for not finding any expired timer and base::next_expiry_recalc is false in __run_timers() triggers. To prevent triggering the warning in this valid scenario base::timers_pending needs to be added to the warning condition. Fixes: 31cd0e119d50 ("timers: Recalculate next timer interrupt only when ne= cessary") Reported-by: Johannes Berg Signed-off-by: Anna-Maria Behnsen Signed-off-by: Thomas Gleixner Reviewed-by: Frederic Weisbecker Link: https://lore.kernel.org/r/20220405191732.7438-3-anna-maria@linutronix= .de Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/time/timer.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -1738,11 +1738,14 @@ static inline void __run_timers(struct t time_after_eq(jiffies, base->next_expiry)) { levels =3D collect_expired_timers(base, heads); /* - * The only possible reason for not finding any expired - * timer at this clk is that all matching timers have been - * dequeued. + * The two possible reasons for not finding any expired + * timer at this clk are that all matching timers have been + * dequeued or no timer has been queued since + * base::next_expiry was set to base::clk + + * NEXT_TIMER_MAX_DELTA. */ - WARN_ON_ONCE(!levels && !base->next_expiry_recalc); + WARN_ON_ONCE(!levels && !base->next_expiry_recalc + && base->timers_pending); base->clk++; base->next_expiry =3D __next_timer_interrupt(base); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 117ABC4707E for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242891AbiDRNTR (ORCPT ); Mon, 18 Apr 2022 09:19:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32984 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242600AbiDRNAM (ORCPT ); Mon, 18 Apr 2022 09:00:12 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 648F82654A; Mon, 18 Apr 2022 05:41:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DB13460FB6; Mon, 18 Apr 2022 12:41:41 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCBBEC385A7; Mon, 18 Apr 2022 12:41:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285701; bh=Odt4DJtsfZ7z8p8zyvoADS1a7B/5C/8yhLV1aaCq0Ak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YMDLisGjlo+KkrzHZL0EBleZot6ofZlkHbKlLUyCr5h1Lfo6wX/r3tIY8IyoywGn9 f97g++lGIMmYT+rg5msdST1MF7PtcxcVNyIDuf5QwnHosQmDIOJwjoK5x3iZvMM0GZ /PXaKsDb/ecA/HIrbDqQVOsHuGZ4H7M+hSSnkU9A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wang Zhaoyang1 , Gao Liang , Chao Gao , Kevin Tian , Christoph Hellwig Subject: [PATCH 5.10 095/105] dma-direct: avoid redundant memory sync for swiotlb Date: Mon, 18 Apr 2022 14:13:37 +0200 Message-Id: <20220418121149.333362237@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chao Gao commit 9e02977bfad006af328add9434c8bffa40e053bb upstream. When we looked into FIO performance with swiotlb enabled in VM, we found swiotlb_bounce() is always called one more time than expected for each DMA read request. It turns out that the bounce buffer is copied to original DMA buffer twice after the completion of a DMA request (one is done by in dma_direct_sync_single_for_cpu(), the other by swiotlb_tbl_unmap_single()). But the content in bounce buffer actually doesn't change between the two rounds of copy. So, one round of copy is redundant. Pass DMA_ATTR_SKIP_CPU_SYNC flag to swiotlb_tbl_unmap_single() to skip the memory copy in it. This fix increases FIO 64KB sequential read throughput in a guest with swiotlb=3Dforce by 5.6%. Fixes: 55897af63091 ("dma-direct: merge swiotlb_dma_ops into the dma_direct= code") Reported-by: Wang Zhaoyang1 Reported-by: Gao Liang Signed-off-by: Chao Gao Reviewed-by: Kevin Tian Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/dma/direct.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/kernel/dma/direct.h +++ b/kernel/dma/direct.h @@ -114,6 +114,7 @@ static inline void dma_direct_unmap_page dma_direct_sync_single_for_cpu(dev, addr, size, dir); =20 if (unlikely(is_swiotlb_buffer(phys))) - swiotlb_tbl_unmap_single(dev, phys, size, size, dir, attrs); + swiotlb_tbl_unmap_single(dev, phys, size, size, dir, + attrs | DMA_ATTR_SKIP_CPU_SYNC); } #endif /* _KERNEL_DMA_DIRECT_H */ From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22185C3527E for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242927AbiDRNTW (ORCPT ); Mon, 18 Apr 2022 09:19:22 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59856 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S242621AbiDRNAN (ORCPT ); Mon, 18 Apr 2022 09:00:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8CD4831500; Mon, 18 Apr 2022 05:41:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2556E60FB6; Mon, 18 Apr 2022 12:41:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1B82FC385A1; Mon, 18 Apr 2022 12:41:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285704; bh=TpOrTXLV4U5pm4BdcV8eLd+g6FUlDQpHQ/skxzlTGSw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SciOf3ZQHI86ipRsT9Dmz73eCcPWxKuOG/YOypWx0kvyA/TZ5BPdBKQcCAe8dQ58/ lZmnEpjgshuu5plSslJY8tVfFaiH4x0alxK4QEynW3o9oFOvlq2sF+ando17tEr/EO KciiJHGilruRc+EF064hOOC47VNiSiprABX9+8pk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Rangankar , Lee Duncan , Chris Leech , Mike Christie , "Martin K. Petersen" Subject: [PATCH 5.10 096/105] scsi: iscsi: Fix endpoint reuse regression Date: Mon, 18 Apr 2022 14:13:38 +0200 Message-Id: <20220418121149.362048140@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie commit 0aadafb5c34403a7cced1a8d61877048dc059f70 upstream. This patch fixes a bug where when using iSCSI offload we can free an endpoint while userspace still thinks it's active. That then causes the endpoint ID to be reused for a new connection's endpoint while userspace still thinks the ID is for the original connection. Userspace will then end up disconnecting a running connection's endpoint or trying to bind to another connection's endpoint. This bug is a regression added in: Commit 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel conn failure handling") where we added a in kernel ep_disconnect call to fix a bug in: Commit 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in kernel space") where we would call stop_conn without having done ep_disconnect. This early ep_disconnect call will then free the endpoint and it's ID while userspace still thinks the ID is valid. Fix the early release of the ID by having the in kernel recovery code keep a reference to the endpoint until userspace has called into the kernel to finish cleaning up the endpoint/connection. It requires the previous commit "scsi: iscsi: Release endpoint ID when its freed" which moved the freeing of the ID until when the endpoint is released. Link: https://lore.kernel.org/r/20220408001314.5014-5-michael.christie@orac= le.com Fixes: 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel conn failure handling") Tested-by: Manish Rangankar Reviewed-by: Lee Duncan Reviewed-by: Chris Leech Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2273,7 +2273,11 @@ static void iscsi_if_disconnect_bound_ep mutex_unlock(&conn->ep_mutex); =20 flush_work(&conn->cleanup_work); - + /* + * Userspace is now done with the EP so we can release the ref + * iscsi_cleanup_conn_work_fn took. + */ + iscsi_put_endpoint(ep); mutex_lock(&conn->ep_mutex); } } @@ -2355,6 +2359,12 @@ static void iscsi_cleanup_conn_work_fn(s return; } =20 + /* + * Get a ref to the ep, so we don't release its ID until after + * userspace is done referencing it in iscsi_if_disconnect_bound_ep. + */ + if (conn->ep) + get_device(&conn->ep->dev); iscsi_ep_disconnect(conn, false); =20 if (system_state !=3D SYSTEM_RUNNING) { From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D206C433FE for ; Mon, 18 Apr 2022 13:28:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S242334AbiDRN1l (ORCPT ); Mon, 18 Apr 2022 09:27:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240866AbiDRNCE (ORCPT ); Mon, 18 Apr 2022 09:02:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 38CA832044; Mon, 18 Apr 2022 05:42:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BB8CF6101A; Mon, 18 Apr 2022 12:42:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3F3FC385A1; Mon, 18 Apr 2022 12:42:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285736; bh=UnaUaKS7zR1rVzW7NJZU3R0dr2MLCMu93KZ5KqM0Yto=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LQ14/QO2Q+AtQuHGUTKm+J7mBkxCYU0FY+qr01g5vKwqpbOuGUI4cLcL/eIwEVNyy YXyFH9nQCbj/ikDMfWgaLgkU7iTtZx0woLquB08SPfNvO6BbKJm+yoMLVoiR+e8reV 8jaJ1swL/EhT0lu57sLTXy9XFluhebMGzuQIeOK4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Manish Rangankar , Chris Leech , Mike Christie , "Martin K. Petersen" Subject: [PATCH 5.10 097/105] scsi: iscsi: Fix unbound endpoint error handling Date: Mon, 18 Apr 2022 14:13:39 +0200 Message-Id: <20220418121149.391046489@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mike Christie commit 03690d81974535f228e892a14f0d2d44404fe555 upstream. If a driver raises a connection error before the connection is bound, we can leave a cleanup_work queued that can later run and disconnect/stop a connection that is logged in. The problem is that drivers can call iscsi_conn_error_event for endpoints that are connected but not yet bound when something like the network port they are using is brought down. iscsi_cleanup_conn_work_fn will check for this and exit early, but if the cleanup_work is stuck behind other works, it might not get run until after userspace has done ep_disconnect. Because the endpoint is not yet bound there was no way for ep_disconnect to flush the work. The bug of leaving stop_conns queued was added in: Commit 23d6fefbb3f6 ("scsi: iscsi: Fix in-kernel conn failure handling") and: Commit 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in kernel space") was supposed to fix it, but left this case. This patch moves the conn state check to before we even queue the work so we can avoid queueing. Link: https://lore.kernel.org/r/20220408001314.5014-7-michael.christie@orac= le.com Fixes: 0ab710458da1 ("scsi: iscsi: Perform connection failure entirely in k= ernel space") Tested-by: Manish Rangankar Reviewed-by: Lee Duncan Reviewed-by: Chris Leech Signed-off-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/scsi/scsi_transport_iscsi.c | 65 +++++++++++++++++++------------= ----- 1 file changed, 36 insertions(+), 29 deletions(-) --- a/drivers/scsi/scsi_transport_iscsi.c +++ b/drivers/scsi/scsi_transport_iscsi.c @@ -2224,10 +2224,10 @@ static void iscsi_stop_conn(struct iscsi =20 switch (flag) { case STOP_CONN_RECOVER: - conn->state =3D ISCSI_CONN_FAILED; + WRITE_ONCE(conn->state, ISCSI_CONN_FAILED); break; case STOP_CONN_TERM: - conn->state =3D ISCSI_CONN_DOWN; + WRITE_ONCE(conn->state, ISCSI_CONN_DOWN); break; default: iscsi_cls_conn_printk(KERN_ERR, conn, "invalid stop flag %d\n", @@ -2245,7 +2245,7 @@ static void iscsi_ep_disconnect(struct i struct iscsi_endpoint *ep; =20 ISCSI_DBG_TRANS_CONN(conn, "disconnect ep.\n"); - conn->state =3D ISCSI_CONN_FAILED; + WRITE_ONCE(conn->state, ISCSI_CONN_FAILED); =20 if (!conn->ep || !session->transport->ep_disconnect) return; @@ -2345,21 +2345,6 @@ static void iscsi_cleanup_conn_work_fn(s =20 mutex_lock(&conn->ep_mutex); /* - * If we are not at least bound there is nothing for us to do. Userspace - * will do a ep_disconnect call if offload is used, but will not be - * doing a stop since there is nothing to clean up, so we have to clear - * the cleanup bit here. - */ - if (conn->state !=3D ISCSI_CONN_BOUND && conn->state !=3D ISCSI_CONN_UP) { - ISCSI_DBG_TRANS_CONN(conn, "Got error while conn is already failed. Igno= ring.\n"); - spin_lock_irq(&conn->lock); - clear_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags); - spin_unlock_irq(&conn->lock); - mutex_unlock(&conn->ep_mutex); - return; - } - - /* * Get a ref to the ep, so we don't release its ID until after * userspace is done referencing it in iscsi_if_disconnect_bound_ep. */ @@ -2425,7 +2410,7 @@ iscsi_create_conn(struct iscsi_cls_sessi INIT_WORK(&conn->cleanup_work, iscsi_cleanup_conn_work_fn); conn->transport =3D transport; conn->cid =3D cid; - conn->state =3D ISCSI_CONN_DOWN; + WRITE_ONCE(conn->state, ISCSI_CONN_DOWN); =20 /* this is released in the dev's release function */ if (!get_device(&session->dev)) @@ -2613,10 +2598,30 @@ void iscsi_conn_error_event(struct iscsi struct iscsi_internal *priv; int len =3D nlmsg_total_size(sizeof(*ev)); unsigned long flags; + int state; =20 spin_lock_irqsave(&conn->lock, flags); - if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, &conn->flags)) - queue_work(iscsi_conn_cleanup_workq, &conn->cleanup_work); + /* + * Userspace will only do a stop call if we are at least bound. And, we + * only need to do the in kernel cleanup if in the UP state so cmds can + * be released to upper layers. If in other states just wait for + * userspace to avoid races that can leave the cleanup_work queued. + */ + state =3D READ_ONCE(conn->state); + switch (state) { + case ISCSI_CONN_BOUND: + case ISCSI_CONN_UP: + if (!test_and_set_bit(ISCSI_CLS_CONN_BIT_CLEANUP, + &conn->flags)) { + queue_work(iscsi_conn_cleanup_workq, + &conn->cleanup_work); + } + break; + default: + ISCSI_DBG_TRANS_CONN(conn, "Got conn error in state %d\n", + state); + break; + } spin_unlock_irqrestore(&conn->lock, flags); =20 priv =3D iscsi_if_transport_lookup(conn->transport); @@ -2967,7 +2972,7 @@ iscsi_set_param(struct iscsi_transport * char *data =3D (char*)ev + sizeof(*ev); struct iscsi_cls_conn *conn; struct iscsi_cls_session *session; - int err =3D 0, value =3D 0; + int err =3D 0, value =3D 0, state; =20 if (ev->u.set_param.len > PAGE_SIZE) return -EINVAL; @@ -2984,8 +2989,8 @@ iscsi_set_param(struct iscsi_transport * session->recovery_tmo =3D value; break; default: - if ((conn->state =3D=3D ISCSI_CONN_BOUND) || - (conn->state =3D=3D ISCSI_CONN_UP)) { + state =3D READ_ONCE(conn->state); + if (state =3D=3D ISCSI_CONN_BOUND || state =3D=3D ISCSI_CONN_UP) { err =3D transport->set_param(conn, ev->u.set_param.param, data, ev->u.set_param.len); } else { @@ -3781,7 +3786,7 @@ static int iscsi_if_transport_conn(struc ev->u.b_conn.transport_eph, ev->u.b_conn.is_leading); if (!ev->r.retcode) - conn->state =3D ISCSI_CONN_BOUND; + WRITE_ONCE(conn->state, ISCSI_CONN_BOUND); =20 if (ev->r.retcode || !transport->ep_connect) break; @@ -3800,7 +3805,8 @@ static int iscsi_if_transport_conn(struc case ISCSI_UEVENT_START_CONN: ev->r.retcode =3D transport->start_conn(conn); if (!ev->r.retcode) - conn->state =3D ISCSI_CONN_UP; + WRITE_ONCE(conn->state, ISCSI_CONN_UP); + break; case ISCSI_UEVENT_SEND_PDU: pdu_len =3D nlh->nlmsg_len - sizeof(*nlh) - sizeof(*ev); @@ -4108,10 +4114,11 @@ static ssize_t show_conn_state(struct de { struct iscsi_cls_conn *conn =3D iscsi_dev_to_conn(dev->parent); const char *state =3D "unknown"; + int conn_state =3D READ_ONCE(conn->state); =20 - if (conn->state >=3D 0 && - conn->state < ARRAY_SIZE(connection_state_names)) - state =3D connection_state_names[conn->state]; + if (conn_state >=3D 0 && + conn_state < ARRAY_SIZE(connection_state_names)) + state =3D connection_state_names[conn_state]; =20 return sysfs_emit(buf, "%s\n", state); } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76829C35294 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243099AbiDRNTn (ORCPT ); Mon, 18 Apr 2022 09:19:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240400AbiDRNAR (ORCPT ); Mon, 18 Apr 2022 09:00:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AF79931906; Mon, 18 Apr 2022 05:41:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2EAFBB80EC3; Mon, 18 Apr 2022 12:41:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35CCDC385A1; Mon, 18 Apr 2022 12:41:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285710; bh=K8XrQc/ubFAMXZJhjuTpvI8f92jO4EsjVVLcmWbnMIM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GO8uk7EGdhpYUyeWa7S5ZrvjLWnle2Okln6EqgHbb19qgQCwBNcsllmss50VsSPZ7 a66cpIIROF2YZilYBgJdWJsN/OdhtWIGtKU7aUMMsulgiR7y69AV0VlJ/3102zVrIR w29y2cxXn8eRA+e8kJ7zhReU5btLUbMyOfIHylvE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , "David S. Miller" , Ovidiu Panait Subject: [PATCH 5.10 098/105] ax25: add refcount in ax25_dev to avoid UAF bugs Date: Mon, 18 Apr 2022 14:13:40 +0200 Message-Id: <20220418121149.421321511@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit d01ffb9eee4af165d83b08dd73ebdf9fe94a519b upstream. If we dereference ax25_dev after we call kfree(ax25_dev) in ax25_dev_device_down(), it will lead to concurrency UAF bugs. There are eight syscall functions suffer from UAF bugs, include ax25_bind(), ax25_release(), ax25_connect(), ax25_ioctl(), ax25_getname(), ax25_sendmsg(), ax25_getsockopt() and ax25_info_show(). One of the concurrency UAF can be shown as below: (USE) | (FREE) | ax25_device_event | ax25_dev_device_down ax25_bind | ... ... | kfree(ax25_dev) ax25_fillin_cb() | ... ax25_fillin_cb_from_dev() | ... | The root cause of UAF bugs is that kfree(ax25_dev) in ax25_dev_device_down() is not protected by any locks. When ax25_dev, which there are still pointers point to, is released, the concurrency UAF bug will happen. This patch introduces refcount into ax25_dev in order to guarantee that there are no pointers point to it when ax25_dev is released. Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller [OP: backport to 5.10: adjusted context] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/ax25.h | 10 ++++++++++ net/ax25/af_ax25.c | 2 ++ net/ax25/ax25_dev.c | 12 ++++++++++-- net/ax25/ax25_route.c | 3 +++ 4 files changed, 25 insertions(+), 2 deletions(-) --- a/include/net/ax25.h +++ b/include/net/ax25.h @@ -236,6 +236,7 @@ typedef struct ax25_dev { #if defined(CONFIG_AX25_DAMA_SLAVE) || defined(CONFIG_AX25_DAMA_MASTER) ax25_dama_info dama; #endif + refcount_t refcount; } ax25_dev; =20 typedef struct ax25_cb { @@ -290,6 +291,15 @@ static __inline__ void ax25_cb_put(ax25_ } } =20 +#define ax25_dev_hold(__ax25_dev) \ + refcount_inc(&((__ax25_dev)->refcount)) + +static __inline__ void ax25_dev_put(ax25_dev *ax25_dev) +{ + if (refcount_dec_and_test(&ax25_dev->refcount)) { + kfree(ax25_dev); + } +} static inline __be16 ax25_type_trans(struct sk_buff *skb, struct net_devic= e *dev) { skb->dev =3D dev; --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -98,6 +98,7 @@ again: spin_unlock_bh(&ax25_list_lock); lock_sock(sk); s->ax25_dev =3D NULL; + ax25_dev_put(ax25_dev); release_sock(sk); ax25_disconnect(s, ENETUNREACH); spin_lock_bh(&ax25_list_lock); @@ -446,6 +447,7 @@ static int ax25_ctl_ioctl(const unsigned } =20 out_put: + ax25_dev_put(ax25_dev); ax25_cb_put(ax25); return ret; =20 --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -37,6 +37,7 @@ ax25_dev *ax25_addr_ax25dev(ax25_address for (ax25_dev =3D ax25_dev_list; ax25_dev !=3D NULL; ax25_dev =3D ax25_de= v->next) if (ax25cmp(addr, (ax25_address *)ax25_dev->dev->dev_addr) =3D=3D 0) { res =3D ax25_dev; + ax25_dev_hold(ax25_dev); } spin_unlock_bh(&ax25_dev_lock); =20 @@ -56,6 +57,7 @@ void ax25_dev_device_up(struct net_devic return; } =20 + refcount_set(&ax25_dev->refcount, 1); dev->ax25_ptr =3D ax25_dev; ax25_dev->dev =3D dev; dev_hold(dev); @@ -83,6 +85,7 @@ void ax25_dev_device_up(struct net_devic spin_lock_bh(&ax25_dev_lock); ax25_dev->next =3D ax25_dev_list; ax25_dev_list =3D ax25_dev; + ax25_dev_hold(ax25_dev); spin_unlock_bh(&ax25_dev_lock); =20 ax25_register_dev_sysctl(ax25_dev); @@ -112,20 +115,22 @@ void ax25_dev_device_down(struct net_dev =20 if ((s =3D ax25_dev_list) =3D=3D ax25_dev) { ax25_dev_list =3D s->next; + ax25_dev_put(ax25_dev); spin_unlock_bh(&ax25_dev_lock); dev->ax25_ptr =3D NULL; dev_put(dev); - kfree(ax25_dev); + ax25_dev_put(ax25_dev); return; } =20 while (s !=3D NULL && s->next !=3D NULL) { if (s->next =3D=3D ax25_dev) { s->next =3D ax25_dev->next; + ax25_dev_put(ax25_dev); spin_unlock_bh(&ax25_dev_lock); dev->ax25_ptr =3D NULL; dev_put(dev); - kfree(ax25_dev); + ax25_dev_put(ax25_dev); return; } =20 @@ -133,6 +138,7 @@ void ax25_dev_device_down(struct net_dev } spin_unlock_bh(&ax25_dev_lock); dev->ax25_ptr =3D NULL; + ax25_dev_put(ax25_dev); } =20 int ax25_fwd_ioctl(unsigned int cmd, struct ax25_fwd_struct *fwd) @@ -149,6 +155,7 @@ int ax25_fwd_ioctl(unsigned int cmd, str if (ax25_dev->forward !=3D NULL) return -EINVAL; ax25_dev->forward =3D fwd_dev->dev; + ax25_dev_put(fwd_dev); break; =20 case SIOCAX25DELFWD: @@ -161,6 +168,7 @@ int ax25_fwd_ioctl(unsigned int cmd, str return -EINVAL; } =20 + ax25_dev_put(ax25_dev); return 0; } =20 --- a/net/ax25/ax25_route.c +++ b/net/ax25/ax25_route.c @@ -116,6 +116,7 @@ static int __must_check ax25_rt_add(stru ax25_rt->dev =3D ax25_dev->dev; ax25_rt->digipeat =3D NULL; ax25_rt->ip_mode =3D ' '; + ax25_dev_put(ax25_dev); if (route->digi_count !=3D 0) { if ((ax25_rt->digipeat =3D kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) =3D= =3D NULL) { write_unlock_bh(&ax25_route_lock); @@ -172,6 +173,7 @@ static int ax25_rt_del(struct ax25_route } } } + ax25_dev_put(ax25_dev); write_unlock_bh(&ax25_route_lock); =20 return 0; @@ -214,6 +216,7 @@ static int ax25_rt_opt(struct ax25_route } =20 out: + ax25_dev_put(ax25_dev); write_unlock_bh(&ax25_route_lock); return err; } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55E84C47080 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243068AbiDRNTi (ORCPT ); Mon, 18 Apr 2022 09:19:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59456 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240376AbiDRNAR (ORCPT ); Mon, 18 Apr 2022 09:00:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 17C012655D; Mon, 18 Apr 2022 05:41:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A916160FB6; Mon, 18 Apr 2022 12:41:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C08FC385A7; Mon, 18 Apr 2022 12:41:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285714; bh=8HpcdnZCLo+JrrsX8H3nGWlqqcNPqSwMSCQ4EoYjyw4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gwuRGKOTzG0lfWRIOidbiEmDPIpmd84zLkx30vcB4BlcSNY+zrEwK+zjp0597MCdG 2XhW5Dw+UStDVpVA5qWUj0xCqG7kjLid3CMRxmsyOrLjYIoiuasJERSUjA9IBDJXFY 8nEZs0gTN96fYUjyYlFQSm6oRk7ve5DUNt8gxN4c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , Dan Carpenter , Jakub Kicinski , Ovidiu Panait Subject: [PATCH 5.10 099/105] ax25: fix reference count leaks of ax25_dev Date: Mon, 18 Apr 2022 14:13:41 +0200 Message-Id: <20220418121149.449852261@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 87563a043cef044fed5db7967a75741cc16ad2b1 upstream. The previous commit d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") introduces refcount into ax25_dev, but there are reference leak paths in ax25_ctl_ioctl(), ax25_fwd_ioctl(), ax25_rt_add(), ax25_rt_del() and ax25_rt_opt(). This patch uses ax25_dev_put() and adjusts the position of ax25_addr_ax25dev() to fix reference cout leaks of ax25_dev. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Signed-off-by: Duoming Zhou Reviewed-by: Dan Carpenter Link: https://lore.kernel.org/r/20220203150811.42256-1-duoming@zju.edu.cn Signed-off-by: Jakub Kicinski [OP: backport to 5.10: adjust context] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/ax25.h | 8 +++++--- net/ax25/af_ax25.c | 12 ++++++++---- net/ax25/ax25_dev.c | 24 +++++++++++++++++------- net/ax25/ax25_route.c | 16 +++++++++++----- 4 files changed, 41 insertions(+), 19 deletions(-) --- a/include/net/ax25.h +++ b/include/net/ax25.h @@ -291,10 +291,12 @@ static __inline__ void ax25_cb_put(ax25_ } } =20 -#define ax25_dev_hold(__ax25_dev) \ - refcount_inc(&((__ax25_dev)->refcount)) +static inline void ax25_dev_hold(ax25_dev *ax25_dev) +{ + refcount_inc(&ax25_dev->refcount); +} =20 -static __inline__ void ax25_dev_put(ax25_dev *ax25_dev) +static inline void ax25_dev_put(ax25_dev *ax25_dev) { if (refcount_dec_and_test(&ax25_dev->refcount)) { kfree(ax25_dev); --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -366,21 +366,25 @@ static int ax25_ctl_ioctl(const unsigned if (copy_from_user(&ax25_ctl, arg, sizeof(ax25_ctl))) return -EFAULT; =20 - if ((ax25_dev =3D ax25_addr_ax25dev(&ax25_ctl.port_addr)) =3D=3D NULL) - return -ENODEV; - if (ax25_ctl.digi_count > AX25_MAX_DIGIS) return -EINVAL; =20 if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd !=3D AX25_KILL) return -EINVAL; =20 + ax25_dev =3D ax25_addr_ax25dev(&ax25_ctl.port_addr); + if (!ax25_dev) + return -ENODEV; + digi.ndigi =3D ax25_ctl.digi_count; for (k =3D 0; k < digi.ndigi; k++) digi.calls[k] =3D ax25_ctl.digi_addr[k]; =20 - if ((ax25 =3D ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &d= igi, ax25_dev->dev)) =3D=3D NULL) + ax25 =3D ax25_find_cb(&ax25_ctl.source_addr, &ax25_ctl.dest_addr, &digi, = ax25_dev->dev); + if (!ax25) { + ax25_dev_put(ax25_dev); return -ENOTCONN; + } =20 switch (ax25_ctl.cmd) { case AX25_KILL: --- a/net/ax25/ax25_dev.c +++ b/net/ax25/ax25_dev.c @@ -85,8 +85,8 @@ void ax25_dev_device_up(struct net_devic spin_lock_bh(&ax25_dev_lock); ax25_dev->next =3D ax25_dev_list; ax25_dev_list =3D ax25_dev; - ax25_dev_hold(ax25_dev); spin_unlock_bh(&ax25_dev_lock); + ax25_dev_hold(ax25_dev); =20 ax25_register_dev_sysctl(ax25_dev); } @@ -115,8 +115,8 @@ void ax25_dev_device_down(struct net_dev =20 if ((s =3D ax25_dev_list) =3D=3D ax25_dev) { ax25_dev_list =3D s->next; - ax25_dev_put(ax25_dev); spin_unlock_bh(&ax25_dev_lock); + ax25_dev_put(ax25_dev); dev->ax25_ptr =3D NULL; dev_put(dev); ax25_dev_put(ax25_dev); @@ -126,8 +126,8 @@ void ax25_dev_device_down(struct net_dev while (s !=3D NULL && s->next !=3D NULL) { if (s->next =3D=3D ax25_dev) { s->next =3D ax25_dev->next; - ax25_dev_put(ax25_dev); spin_unlock_bh(&ax25_dev_lock); + ax25_dev_put(ax25_dev); dev->ax25_ptr =3D NULL; dev_put(dev); ax25_dev_put(ax25_dev); @@ -150,25 +150,35 @@ int ax25_fwd_ioctl(unsigned int cmd, str =20 switch (cmd) { case SIOCAX25ADDFWD: - if ((fwd_dev =3D ax25_addr_ax25dev(&fwd->port_to)) =3D=3D NULL) + fwd_dev =3D ax25_addr_ax25dev(&fwd->port_to); + if (!fwd_dev) { + ax25_dev_put(ax25_dev); return -EINVAL; - if (ax25_dev->forward !=3D NULL) + } + if (ax25_dev->forward) { + ax25_dev_put(fwd_dev); + ax25_dev_put(ax25_dev); return -EINVAL; + } ax25_dev->forward =3D fwd_dev->dev; ax25_dev_put(fwd_dev); + ax25_dev_put(ax25_dev); break; =20 case SIOCAX25DELFWD: - if (ax25_dev->forward =3D=3D NULL) + if (!ax25_dev->forward) { + ax25_dev_put(ax25_dev); return -EINVAL; + } ax25_dev->forward =3D NULL; + ax25_dev_put(ax25_dev); break; =20 default: + ax25_dev_put(ax25_dev); return -EINVAL; } =20 - ax25_dev_put(ax25_dev); return 0; } =20 --- a/net/ax25/ax25_route.c +++ b/net/ax25/ax25_route.c @@ -75,11 +75,13 @@ static int __must_check ax25_rt_add(stru ax25_dev *ax25_dev; int i; =20 - if ((ax25_dev =3D ax25_addr_ax25dev(&route->port_addr)) =3D=3D NULL) - return -EINVAL; if (route->digi_count > AX25_MAX_DIGIS) return -EINVAL; =20 + ax25_dev =3D ax25_addr_ax25dev(&route->port_addr); + if (!ax25_dev) + return -EINVAL; + write_lock_bh(&ax25_route_lock); =20 ax25_rt =3D ax25_route_list; @@ -91,6 +93,7 @@ static int __must_check ax25_rt_add(stru if (route->digi_count !=3D 0) { if ((ax25_rt->digipeat =3D kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) =3D= =3D NULL) { write_unlock_bh(&ax25_route_lock); + ax25_dev_put(ax25_dev); return -ENOMEM; } ax25_rt->digipeat->lastrepeat =3D -1; @@ -101,6 +104,7 @@ static int __must_check ax25_rt_add(stru } } write_unlock_bh(&ax25_route_lock); + ax25_dev_put(ax25_dev); return 0; } ax25_rt =3D ax25_rt->next; @@ -108,6 +112,7 @@ static int __must_check ax25_rt_add(stru =20 if ((ax25_rt =3D kmalloc(sizeof(ax25_route), GFP_ATOMIC)) =3D=3D NULL) { write_unlock_bh(&ax25_route_lock); + ax25_dev_put(ax25_dev); return -ENOMEM; } =20 @@ -116,11 +121,11 @@ static int __must_check ax25_rt_add(stru ax25_rt->dev =3D ax25_dev->dev; ax25_rt->digipeat =3D NULL; ax25_rt->ip_mode =3D ' '; - ax25_dev_put(ax25_dev); if (route->digi_count !=3D 0) { if ((ax25_rt->digipeat =3D kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) =3D= =3D NULL) { write_unlock_bh(&ax25_route_lock); kfree(ax25_rt); + ax25_dev_put(ax25_dev); return -ENOMEM; } ax25_rt->digipeat->lastrepeat =3D -1; @@ -133,6 +138,7 @@ static int __must_check ax25_rt_add(stru ax25_rt->next =3D ax25_route_list; ax25_route_list =3D ax25_rt; write_unlock_bh(&ax25_route_lock); + ax25_dev_put(ax25_dev); =20 return 0; } @@ -173,8 +179,8 @@ static int ax25_rt_del(struct ax25_route } } } - ax25_dev_put(ax25_dev); write_unlock_bh(&ax25_route_lock); + ax25_dev_put(ax25_dev); =20 return 0; } @@ -216,8 +222,8 @@ static int ax25_rt_opt(struct ax25_route } =20 out: - ax25_dev_put(ax25_dev); write_unlock_bh(&ax25_route_lock); + ax25_dev_put(ax25_dev); return err; } From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B29DC47081 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243124AbiDRNTp (ORCPT ); Mon, 18 Apr 2022 09:19:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238720AbiDRNAd (ORCPT ); Mon, 18 Apr 2022 09:00:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B37153191A; Mon, 18 Apr 2022 05:41:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3EC46B80EC3; Mon, 18 Apr 2022 12:41:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F6CCC385A1; Mon, 18 Apr 2022 12:41:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285716; bh=ssH+O5U6Zc+kQBJr13MbIlhhEg3a9HKg/eM3zo7oJFg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=obCwdtsEz7pC+NOg0TF/9fSK4ckWG0NYXIeh2vSDsiyzEo2HVZWU1v0+2DG6fFfgh r0iw1VoUI+YxvckvtufgFlZJf72w/k/81xzr2afODjDrZ8/ume5icM8OSTrJjGGb4h zynOmeH0q/byEctpW4nCURVB4YA7nZmrve/TNGmE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , "David S. Miller" , Ovidiu Panait Subject: [PATCH 5.10 100/105] ax25: fix UAF bugs of net_device caused by rebinding operation Date: Mon, 18 Apr 2022 14:13:42 +0200 Message-Id: <20220418121149.477791070@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit feef318c855a361a1eccd880f33e88c460eb63b4 upstream. The ax25_kill_by_device() will set s->ax25_dev =3D NULL and call ax25_disconnect() to change states of ax25_cb and sock, if we call ax25_bind() before ax25_kill_by_device(). However, if we call ax25_bind() again between the window of ax25_kill_by_device() and ax25_dev_device_down(), the values and states changed by ax25_kill_by_device() will be reassigned. Finally, ax25_dev_device_down() will deallocate net_device. If we dereference net_device in syscall functions such as ax25_release(), ax25_sendmsg(), ax25_getsockopt(), ax25_getname() and ax25_info_show(), a UAF bug will occur. One of the possible race conditions is shown below: (USE) | (FREE) ax25_bind() | | ax25_kill_by_device() ax25_bind() | ax25_connect() | ... | ax25_dev_device_down() | ... | dev_put_track(dev, ...) //FREE ax25_release() | ... ax25_send_control() | alloc_skb() //USE | the corresponding fail log is shown below: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: KASAN: use-after-free in ax25_send_control+0x43/0x210 ... Call Trace: ... ax25_send_control+0x43/0x210 ax25_release+0x2db/0x3b0 __sock_release+0x6d/0x120 sock_close+0xf/0x20 __fput+0x11f/0x420 ... Allocated by task 1283: ... __kasan_kmalloc+0x81/0xa0 alloc_netdev_mqs+0x5a/0x680 mkiss_open+0x6c/0x380 tty_ldisc_open+0x55/0x90 ... Freed by task 1969: ... kfree+0xa3/0x2c0 device_release+0x54/0xe0 kobject_put+0xa5/0x120 tty_ldisc_kill+0x3e/0x80 ... In order to fix these UAF bugs caused by rebinding operation, this patch adds dev_hold_track() into ax25_bind() and corresponding dev_put_track() into ax25_kill_by_device(). Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller [OP: backport to 5.10: adjust dev_put_track()->dev_put() and dev_hold_track()->dev_hold()] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ax25/af_ax25.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -98,6 +98,7 @@ again: spin_unlock_bh(&ax25_list_lock); lock_sock(sk); s->ax25_dev =3D NULL; + dev_put(ax25_dev->dev); ax25_dev_put(ax25_dev); release_sock(sk); ax25_disconnect(s, ENETUNREACH); @@ -1122,8 +1123,10 @@ static int ax25_bind(struct socket *sock } } =20 - if (ax25_dev !=3D NULL) + if (ax25_dev) { ax25_fillin_cb(ax25, ax25_dev); + dev_hold(ax25_dev->dev); + } =20 done: ax25_cb_add(ax25); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9FE3CC433F5 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243142AbiDRNTr (ORCPT ); Mon, 18 Apr 2022 09:19:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32932 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240587AbiDRNAh (ORCPT ); Mon, 18 Apr 2022 09:00:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 51D7B3192A; Mon, 18 Apr 2022 05:42:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C9EB561014; Mon, 18 Apr 2022 12:42:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBDA2C385A1; Mon, 18 Apr 2022 12:41:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285720; bh=Bgfz/3+RT7gpooYXFmsclpEyjumlYjpaLsK+AJi+rK8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jzrph/KYPjf7YotaGmvG5s7huyBJ06dtrqrIHlmMBUcT1GkVZVvikjKmuqSzLBlPQ Greezsg/LAh28XnhO7ysdcLnobuuo5uikFAzSbieJZArcuyb3RO+GSpSeZ3/Em3RPt alNtZu49/ZKy/4cPLz/QmYz/z5ffzzCRqo3bJhMY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Thomas Osterried , Duoming Zhou , "David S. Miller" , Ovidiu Panait Subject: [PATCH 5.10 101/105] ax25: Fix refcount leaks caused by ax25_cb_del() Date: Mon, 18 Apr 2022 14:13:43 +0200 Message-Id: <20220418121149.506042116@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 9fd75b66b8f68498454d685dc4ba13192ae069b0 upstream. The previous commit d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") and commit feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding operation") increase the refcounts of ax25_dev and net_device in ax25_bind() and decrease the matching refcounts in ax25_kill_by_device() in order to prevent UAF bugs, but there are reference count leaks. The root cause of refcount leaks is shown below: (Thread 1) | (Thread 2) ax25_bind() | ... | ax25_addr_ax25dev() | ax25_dev_hold() //(1) | ... | dev_hold_track() //(2) | ... | ax25_destroy_socket() | ax25_cb_del() | ... | hlist_del_init() //(3) | | (Thread 3) | ax25_kill_by_device() | ... | ax25_for_each(s, &ax25_list) { | if (s->ax25_dev =3D=3D ax25_dev) //(4) | ... | Firstly, we use ax25_bind() to increase the refcount of ax25_dev in position (1) and increase the refcount of net_device in position (2). Then, we use ax25_cb_del() invoked by ax25_destroy_socket() to delete ax25_cb in hlist in position (3) before calling ax25_kill_by_device(). Finally, the decrements of refcounts in ax25_kill_by_device() will not be executed, because no s->ax25_dev equals to ax25_dev in position (4). This patch adds decrements of refcounts in ax25_release() and use lock_sock() to do synchronization. If refcounts decrease in ax25_release(), the decrements of refcounts in ax25_kill_by_device() will not be executed and vice versa. Fixes: d01ffb9eee4a ("ax25: add refcount in ax25_dev to avoid UAF bugs") Fixes: 87563a043cef ("ax25: fix reference count leaks of ax25_dev") Fixes: feef318c855a ("ax25: fix UAF bugs of net_device caused by rebinding = operation") Reported-by: Thomas Osterried Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller [OP: backport to 5.10: adjust dev_put_track()->dev_put()] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ax25/af_ax25.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -98,8 +98,10 @@ again: spin_unlock_bh(&ax25_list_lock); lock_sock(sk); s->ax25_dev =3D NULL; - dev_put(ax25_dev->dev); - ax25_dev_put(ax25_dev); + if (sk->sk_socket) { + dev_put(ax25_dev->dev); + ax25_dev_put(ax25_dev); + } release_sock(sk); ax25_disconnect(s, ENETUNREACH); spin_lock_bh(&ax25_list_lock); @@ -978,14 +980,20 @@ static int ax25_release(struct socket *s { struct sock *sk =3D sock->sk; ax25_cb *ax25; + ax25_dev *ax25_dev; =20 if (sk =3D=3D NULL) return 0; =20 sock_hold(sk); - sock_orphan(sk); lock_sock(sk); + sock_orphan(sk); ax25 =3D sk_to_ax25(sk); + ax25_dev =3D ax25->ax25_dev; + if (ax25_dev) { + dev_put(ax25_dev->dev); + ax25_dev_put(ax25_dev); + } =20 if (sk->sk_type =3D=3D SOCK_SEQPACKET) { switch (ax25->state) { From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE95CC35295 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243169AbiDRNTw (ORCPT ); Mon, 18 Apr 2022 09:19:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59810 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236411AbiDRNAy (ORCPT ); Mon, 18 Apr 2022 09:00:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1A2F231DDE; Mon, 18 Apr 2022 05:42:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AA72F60FB6; Mon, 18 Apr 2022 12:42:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A7A54C385A1; Mon, 18 Apr 2022 12:42:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285723; bh=Hsx+XDhKuSQxY+nQbguScR7itzsktnoERT/oXIEtSj0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=buNbcGP4gT6eXJ8IwvgqdGSrn4kvNjDT2iYw6eSY+1peONvGHvq6KtOAYbV/QmYK2 o/RLrPKznnTLhGlJ387mgTae1s+a6nU1nZjHhRL2JSh4OGQ0iXYSVASPWIQD72XcnS KvzTc99gn7DR1KJGFsrNir7pwq+h8QuIXlAGvXHY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , Paolo Abeni , Ovidiu Panait Subject: [PATCH 5.10 102/105] ax25: fix UAF bug in ax25_send_control() Date: Mon, 18 Apr 2022 14:13:44 +0200 Message-Id: <20220418121149.534449844@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 5352a761308397a0e6250fdc629bb3f615b94747 upstream. There are UAF bugs in ax25_send_control(), when we call ax25_release() to deallocate ax25_dev. The possible race condition is shown below: (Thread 1) | (Thread 2) ax25_dev_device_up() //(1) | | ax25_kill_by_device() ax25_bind() //(2) | ax25_connect() | ... ax25->state =3D AX25_STATE_1 | ... | ax25_dev_device_down() //(3) (Thread 3) ax25_release() | ax25_dev_put() //(4) FREE | case AX25_STATE_1: | ax25_send_control() | alloc_skb() //USE | The refcount of ax25_dev increases in position (1) and (2), and decreases in position (3) and (4). The ax25_dev will be freed before dereference sites in ax25_send_control(). The following is part of the report: [ 102.297448] BUG: KASAN: use-after-free in ax25_send_control+0x33/0x210 [ 102.297448] Read of size 8 at addr ffff888009e6e408 by task ax25_close/6= 02 [ 102.297448] Call Trace: [ 102.303751] ax25_send_control+0x33/0x210 [ 102.303751] ax25_release+0x356/0x450 [ 102.305431] __sock_release+0x6d/0x120 [ 102.305431] sock_close+0xf/0x20 [ 102.305431] __fput+0x11f/0x420 [ 102.305431] task_work_run+0x86/0xd0 [ 102.307130] get_signal+0x1075/0x1220 [ 102.308253] arch_do_signal_or_restart+0x1df/0xc00 [ 102.308253] exit_to_user_mode_prepare+0x150/0x1e0 [ 102.308253] syscall_exit_to_user_mode+0x19/0x50 [ 102.308253] do_syscall_64+0x48/0x90 [ 102.308253] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 102.308253] RIP: 0033:0x405ae7 This patch defers the free operation of ax25_dev and net_device after all corresponding dereference sites in ax25_release() to avoid UAF. Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()") Signed-off-by: Duoming Zhou Signed-off-by: Paolo Abeni [OP: backport to 5.10: adjust dev_put_track()->dev_put()] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ax25/af_ax25.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -990,10 +990,6 @@ static int ax25_release(struct socket *s sock_orphan(sk); ax25 =3D sk_to_ax25(sk); ax25_dev =3D ax25->ax25_dev; - if (ax25_dev) { - dev_put(ax25_dev->dev); - ax25_dev_put(ax25_dev); - } =20 if (sk->sk_type =3D=3D SOCK_SEQPACKET) { switch (ax25->state) { @@ -1055,6 +1051,10 @@ static int ax25_release(struct socket *s sk->sk_state_change(sk); ax25_destroy_socket(ax25); } + if (ax25_dev) { + dev_put(ax25_dev->dev); + ax25_dev_put(ax25_dev); + } =20 sock->sk =3D NULL; release_sock(sk); From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF995C47084 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243190AbiDRNT4 (ORCPT ); Mon, 18 Apr 2022 09:19:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59824 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240747AbiDRNBd (ORCPT ); Mon, 18 Apr 2022 09:01:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03CC03193A; Mon, 18 Apr 2022 05:42:08 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6731EB80EDC; Mon, 18 Apr 2022 12:42:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF5C7C385A7; Mon, 18 Apr 2022 12:42:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285726; bh=C4maaN8DUSZ2vqk38Yqwf+/UKoGzZQnk0kFfPOYAS4k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RPoOBV2/aDe7BXWdEC05zYbjs5aYDmgUnUp49zTCQ9aqapwG4zqLwwwIIXQvBCp+H QLHXvX2ZSN5fWsEf1Ew46TpwMOD882p5ATTX6zrEXoHCuninX7t2lcoDtJQTqbyc+v DUGHcKCbx655vVLl7xikhbaFSOCzMaSJEMcopmVs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , "David S. Miller" , Ovidiu Panait Subject: [PATCH 5.10 103/105] ax25: fix NPD bug in ax25_disconnect Date: Mon, 18 Apr 2022 14:13:45 +0200 Message-Id: <20220418121149.562408173@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 7ec02f5ac8a5be5a3f20611731243dc5e1d9ba10 upstream. The ax25_disconnect() in ax25_kill_by_device() is not protected by any locks, thus there is a race condition between ax25_disconnect() and ax25_destroy_socket(). when ax25->sk is assigned as NULL by ax25_destroy_socket(), a NULL pointer dereference bug will occur if site (1) or (2) dereferences ax25->sk. ax25_kill_by_device() | ax25_release() ax25_disconnect() | ax25_destroy_socket() ... | if(ax25->sk !=3D NULL) | ... ... | ax25->sk =3D NULL; bh_lock_sock(ax25->sk); //(1) | ... ... | bh_unlock_sock(ax25->sk); //(2)| This patch moves ax25_disconnect() into lock_sock(), which can synchronize with ax25_destroy_socket() in ax25_release(). Fail log: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: kernel NULL pointer dereference, address: 0000000000000088 ... RIP: 0010:_raw_spin_lock+0x7e/0xd0 ... Call Trace: ax25_disconnect+0xf6/0x220 ax25_device_event+0x187/0x250 raw_notifier_call_chain+0x5e/0x70 dev_close_many+0x17d/0x230 rollback_registered_many+0x1f1/0x950 unregister_netdevice_queue+0x133/0x200 unregister_netdev+0x13/0x20 ... Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller [OP: backport to 5.10: adjust context] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ax25/af_ax25.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -102,8 +102,8 @@ again: dev_put(ax25_dev->dev); ax25_dev_put(ax25_dev); } - release_sock(sk); ax25_disconnect(s, ENETUNREACH); + release_sock(sk); spin_lock_bh(&ax25_list_lock); sock_put(sk); /* The entry could have been deleted from the From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E3FA5C352A1 for ; Mon, 18 Apr 2022 13:18:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243214AbiDRNUD (ORCPT ); Mon, 18 Apr 2022 09:20:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240772AbiDRNBe (ORCPT ); Mon, 18 Apr 2022 09:01:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1B40D31DF9; Mon, 18 Apr 2022 05:42:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 97400B80EDC; Mon, 18 Apr 2022 12:42:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1D17C385A7; Mon, 18 Apr 2022 12:42:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285729; bh=wMhghypNB1I3TPQXVLSPKEVFTYAOHRDPNoEgE+ttDMM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VV73LBnZcP0DrX787jjQ0XP9NYnnG8kkW59s3AXkR+QyazXeABeN4il7KZeYux8W5 j4y4qSJlEluwy0lY8BqIpO6jmUp54X2nVV013L+h3K0dn+v2A3vgF6g0FENKa8DqL1 f9bjhMZajqJy9g4v8bsfe9sleyGQsdOnkMY2IQIQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , "David S. Miller" , Ovidiu Panait Subject: [PATCH 5.10 104/105] ax25: Fix NULL pointer dereferences in ax25 timers Date: Mon, 18 Apr 2022 14:13:46 +0200 Message-Id: <20220418121149.591140798@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit fc6d01ff9ef03b66d4a3a23b46fc3c3d8cf92009 upstream. The previous commit 7ec02f5ac8a5 ("ax25: fix NPD bug in ax25_disconnect") move ax25_disconnect into lock_sock() in order to prevent NPD bugs. But there are race conditions that may lead to null pointer dereferences in ax25_heartbeat_expiry(), ax25_t1timer_expiry(), ax25_t2timer_expiry(), ax25_t3timer_expiry() and ax25_idletimer_expiry(), when we use ax25_kill_by_device() to detach the ax25 device. One of the race conditions that cause null pointer dereferences can be shown as below: (Thread 1) | (Thread 2) ax25_connect() | ax25_std_establish_data_link() | ax25_start_t1timer() | mod_timer(&ax25->t1timer,..) | | ax25_kill_by_device() (wait a time) | ... | s->ax25_dev =3D NULL; //(1) ax25_t1timer_expiry() | ax25->ax25_dev->values[..] //(2)| ... ... | We set null to ax25_cb->ax25_dev in position (1) and dereference the null pointer in position (2). The corresponding fail log is shown below: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D BUG: kernel NULL pointer dereference, address: 0000000000000050 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.17.0-rc6-00794-g45690b7d0 RIP: 0010:ax25_t1timer_expiry+0x12/0x40 ... Call Trace: call_timer_fn+0x21/0x120 __run_timers.part.0+0x1ca/0x250 run_timer_softirq+0x2c/0x60 __do_softirq+0xef/0x2f3 irq_exit_rcu+0xb6/0x100 sysvec_apic_timer_interrupt+0xa2/0xd0 ... This patch moves ax25_disconnect() before s->ax25_dev =3D NULL and uses del_timer_sync() to delete timers in ax25_disconnect(). If ax25_disconnect() is called by ax25_kill_by_device() or ax25->ax25_dev is NULL, the reason in ax25_disconnect() will be equal to ENETUNREACH, it will wait all timers to stop before we set null to s->ax25_dev in ax25_kill_by_device(). Fixes: 7ec02f5ac8a5 ("ax25: fix NPD bug in ax25_disconnect") Signed-off-by: Duoming Zhou Signed-off-by: David S. Miller [OP: backport to 5.10: adjust context] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ax25/af_ax25.c | 4 ++-- net/ax25/ax25_subr.c | 20 ++++++++++++++------ 2 files changed, 16 insertions(+), 8 deletions(-) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -89,20 +89,20 @@ again: sk =3D s->sk; if (!sk) { spin_unlock_bh(&ax25_list_lock); - s->ax25_dev =3D NULL; ax25_disconnect(s, ENETUNREACH); + s->ax25_dev =3D NULL; spin_lock_bh(&ax25_list_lock); goto again; } sock_hold(sk); spin_unlock_bh(&ax25_list_lock); lock_sock(sk); + ax25_disconnect(s, ENETUNREACH); s->ax25_dev =3D NULL; if (sk->sk_socket) { dev_put(ax25_dev->dev); ax25_dev_put(ax25_dev); } - ax25_disconnect(s, ENETUNREACH); release_sock(sk); spin_lock_bh(&ax25_list_lock); sock_put(sk); --- a/net/ax25/ax25_subr.c +++ b/net/ax25/ax25_subr.c @@ -261,12 +261,20 @@ void ax25_disconnect(ax25_cb *ax25, int { ax25_clear_queues(ax25); =20 - if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) - ax25_stop_heartbeat(ax25); - ax25_stop_t1timer(ax25); - ax25_stop_t2timer(ax25); - ax25_stop_t3timer(ax25); - ax25_stop_idletimer(ax25); + if (reason =3D=3D ENETUNREACH) { + del_timer_sync(&ax25->timer); + del_timer_sync(&ax25->t1timer); + del_timer_sync(&ax25->t2timer); + del_timer_sync(&ax25->t3timer); + del_timer_sync(&ax25->idletimer); + } else { + if (!ax25->sk || !sock_flag(ax25->sk, SOCK_DESTROY)) + ax25_stop_heartbeat(ax25); + ax25_stop_t1timer(ax25); + ax25_stop_t2timer(ax25); + ax25_stop_t3timer(ax25); + ax25_stop_idletimer(ax25); + } =20 ax25->state =3D AX25_STATE_0; From nobody Thu May 14 09:03:01 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1237DC4332F for ; Mon, 18 Apr 2022 13:18:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S243246AbiDRNUI (ORCPT ); Mon, 18 Apr 2022 09:20:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59854 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240797AbiDRNBl (ORCPT ); Mon, 18 Apr 2022 09:01:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9EF1E32051; Mon, 18 Apr 2022 05:42:15 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4AA01B80EDE; Mon, 18 Apr 2022 12:42:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5BA63C385A1; Mon, 18 Apr 2022 12:42:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1650285732; bh=cRP848vIy3ga5rl075gJtIeJCqlyxFUH8Uk4/yLAK/U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=p0QwFuK+tD1QYc4cQOMjsyU2vIyDZ42xU6EUsuU1VcoCBCK0cKNqQ6qOTQCpxIc3l 5XbXkcpl7gjDDQIih2I6cHHOE72wNZLe/7CM2zDVWiNrkKcoJp6xAeqHWWrv1dpgqG wWAQRC6WXdj55JddR9mRoP2poxJ8VRvTxOtwbj0Y= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Duoming Zhou , Paolo Abeni , Ovidiu Panait Subject: [PATCH 5.10 105/105] ax25: Fix UAF bugs in ax25 timers Date: Mon, 18 Apr 2022 14:13:47 +0200 Message-Id: <20220418121149.619408573@linuxfoundation.org> X-Mailer: git-send-email 2.35.3 In-Reply-To: <20220418121145.140991388@linuxfoundation.org> References: <20220418121145.140991388@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Duoming Zhou commit 82e31755e55fbcea6a9dfaae5fe4860ade17cbc0 upstream. There are race conditions that may lead to UAF bugs in ax25_heartbeat_expiry(), ax25_t1timer_expiry(), ax25_t2timer_expiry(), ax25_t3timer_expiry() and ax25_idletimer_expiry(), when we call ax25_release() to deallocate ax25_dev. One of the UAF bugs caused by ax25_release() is shown below: (Thread 1) | (Thread 2) ax25_dev_device_up() //(1) | ... | ax25_kill_by_device() ax25_bind() //(2) | ax25_connect() | ... ax25_std_establish_data_link() | ax25_start_t1timer() | ax25_dev_device_down() //(3) mod_timer(&ax25->t1timer,..) | | ax25_release() (wait a time) | ... | ax25_dev_put(ax25_dev) //(4)FREE ax25_t1timer_expiry() | ax25->ax25_dev->values[..] //USE| ... ... | We increase the refcount of ax25_dev in position (1) and (2), and decrease the refcount of ax25_dev in position (3) and (4). The ax25_dev will be freed in position (4) and be used in ax25_t1timer_expiry(). The fail log is shown below: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 106.116942] BUG: KASAN: use-after-free in ax25_t1timer_expiry+0x1c/0x60 [ 106.116942] Read of size 8 at addr ffff88800bda9028 by task swapper/0/0 [ 106.116942] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.17.0-06123-g0905= eec574 [ 106.116942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS = rel-14 [ 106.116942] Call Trace: ... [ 106.116942] ax25_t1timer_expiry+0x1c/0x60 [ 106.116942] call_timer_fn+0x122/0x3d0 [ 106.116942] __run_timers.part.0+0x3f6/0x520 [ 106.116942] run_timer_softirq+0x4f/0xb0 [ 106.116942] __do_softirq+0x1c2/0x651 ... This patch adds del_timer_sync() in ax25_release(), which could ensure that all timers stop before we deallocate ax25_dev. Signed-off-by: Duoming Zhou Signed-off-by: Paolo Abeni [OP: backport to 5.10: adjust context] Signed-off-by: Ovidiu Panait Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ax25/af_ax25.c | 5 +++++ 1 file changed, 5 insertions(+) --- a/net/ax25/af_ax25.c +++ b/net/ax25/af_ax25.c @@ -1052,6 +1052,11 @@ static int ax25_release(struct socket *s ax25_destroy_socket(ax25); } if (ax25_dev) { + del_timer_sync(&ax25->timer); + del_timer_sync(&ax25->t1timer); + del_timer_sync(&ax25->t2timer); + del_timer_sync(&ax25->t3timer); + del_timer_sync(&ax25->idletimer); dev_put(ax25_dev->dev); ax25_dev_put(ax25_dev); }