From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 823AAC04A68 for ; Wed, 27 Jul 2022 16:32:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235481AbiG0Qb6 (ORCPT ); Wed, 27 Jul 2022 12:31:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237332AbiG0QbL (ORCPT ); Wed, 27 Jul 2022 12:31:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5B4E152DCA; Wed, 27 Jul 2022 09:25:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4CDBD619CB; Wed, 27 Jul 2022 16:24:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5D348C433C1; Wed, 27 Jul 2022 16:24:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939088; bh=eK8XCS3A41MxgxlDFeO9bCfc1XOeWvk+98vg4pkjDfY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OcPjFfyWyYUV62JQBPZF63i9E+rseWsMFyS5U71eR2YotwxTBIU4LuTOSujXeqoHr phxy3YCltNOGNG3c6Rj6zmI8urgyI9snqYyNFVknown84vHmDxn9DYwJEqfij+JBJK eiHtMZuaRFhdbK5LFEiX8Lrt2dlzr13cBPMmxZIs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ben Dooks , Bin Meng , Palmer Dabbelt Subject: [PATCH 4.19 01/62] riscv: add as-options for modules with assembly compontents Date: Wed, 27 Jul 2022 18:10:10 +0200 Message-Id: <20220727161004.224433015@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ben Dooks commit c1f6eff304e4dfa4558b6a8c6b2d26a91db6c998 upstream. When trying to load modules built for RISC-V which include assembly files the kernel loader errors with "unexpected relocation type 'R_RISCV_ALIGN'" due to R_RISCV_ALIGN relocations being generated by the assembler. The R_RISCV_ALIGN relocations can be removed at the expense of code space by adding -mno-relax to gcc and as. In commit 7a8e7da42250138 ("RISC-V: Fixes to module loading") -mno-relax is added to the build variable KBUILD_CFLAGS_MODULE. See [1] for more info. The issue is that when kbuild builds a .S file, it invokes gcc with the -mno-relax flag, but this is not being passed through to the assembler. Adding -Wa,-mno-relax to KBUILD_AFLAGS_MODULE ensures that the assembler is invoked correctly. This may have now been fixed in gcc[2] and this addition should not stop newer gcc and as from working. [1] https://github.com/riscv/riscv-elf-psabi-doc/issues/183 [2] https://github.com/gcc-mirror/gcc/commit/3b0a7d624e64eeb81e4d5e8c62c46d= 86ef521857 Signed-off-by: Ben Dooks Reviewed-by: Bin Meng Link: https://lore.kernel.org/r/20220529152200.609809-1-ben.dooks@codethink= .co.uk Fixes: ab1ef68e5401 ("RISC-V: Add sections of PLT and GOT for kernel module= ") Cc: stable@vger.kernel.org Signed-off-by: Palmer Dabbelt Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/riscv/Makefile | 1 + 1 file changed, 1 insertion(+) --- a/arch/riscv/Makefile +++ b/arch/riscv/Makefile @@ -66,6 +66,7 @@ ifeq ($(CONFIG_MODULE_SECTIONS),y) endif =20 KBUILD_CFLAGS_MODULE +=3D $(call cc-option,-mno-relax) +KBUILD_AFLAGS_MODULE +=3D $(call as-option,-Wa$(comma)-mno-relax) =20 # GCC versions that support the "-mstrict-align" option default to allowing # unaligned accesses. While unaligned accesses are explicitly allowed in = the From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C845C04A68 for ; Wed, 27 Jul 2022 16:30:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235176AbiG0Qap (ORCPT ); Wed, 27 Jul 2022 12:30:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235743AbiG0QaJ (ORCPT ); Wed, 27 Jul 2022 12:30:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DB42205D8; Wed, 27 Jul 2022 09:25:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3C1A061A00; Wed, 27 Jul 2022 16:25:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4DD8EC433B5; Wed, 27 Jul 2022 16:25:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939102; bh=XMG+02M3UD6e2ITIRgYttn2ny5b0sKywMMqd2QA8CFY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=i5rvaMoHbQYvPWjDDT52R2nmS007qDdIoj4AaM/nQt4ccqWq0J4vmzdBjcuJGdgV4 IY/iP+2cWL4bhtf2DaKTXrzfOFU1j/F0qjxbqYMaExmZTtuhmGI3WP7sS4ufp7xaCj FB+w26tOA/I6aYWKisMZNSSmy6r9bU65w/heBb6k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Juergen Gross , Demi Marie Obenour , Oleksandr Tyshchenko Subject: [PATCH 4.19 02/62] xen/gntdev: Ignore failure to unmap INVALID_GRANT_HANDLE Date: Wed, 27 Jul 2022 18:10:11 +0200 Message-Id: <20220727161004.261003054@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Demi Marie Obenour commit 166d3863231667c4f64dee72b77d1102cdfad11f upstream. The error paths of gntdev_mmap() can call unmap_grant_pages() even though not all of the pages have been successfully mapped. This will trigger the WARN_ON()s in __unmap_grant_pages_done(). The number of warnings can be very large; I have observed thousands of lines of warnings in the systemd journal. Avoid this problem by only warning on unmapping failure if the handle being unmapped is not INVALID_GRANT_HANDLE. The handle field of any page that was not successfully mapped will be INVALID_GRANT_HANDLE, so this catches all cases where unmapping can legitimately fail. Fixes: dbe97cff7dd9 ("xen/gntdev: Avoid blocking in unmap_grant_pages()") Cc: stable@vger.kernel.org Suggested-by: Juergen Gross Signed-off-by: Demi Marie Obenour Reviewed-by: Oleksandr Tyshchenko Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220710230522.1563-1-demi@invisiblethingsl= ab.com Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/xen/gntdev.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/xen/gntdev.c +++ b/drivers/xen/gntdev.c @@ -416,7 +416,8 @@ static void __unmap_grant_pages_done(int unsigned int offset =3D data->unmap_ops - map->unmap_ops; =20 for (i =3D 0; i < data->count; i++) { - WARN_ON(map->unmap_ops[offset+i].status); + WARN_ON(map->unmap_ops[offset+i].status && + map->unmap_ops[offset+i].handle !=3D -1); pr_debug("unmap handle=3D%d st=3D%d\n", map->unmap_ops[offset+i].handle, map->unmap_ops[offset+i].status); From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A0348C04A68 for ; Wed, 27 Jul 2022 16:31:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237605AbiG0QbD (ORCPT ); Wed, 27 Jul 2022 12:31:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236924AbiG0Qag (ORCPT ); Wed, 27 Jul 2022 12:30:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0A4FA2BB07; Wed, 27 Jul 2022 09:25:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E94AD619FE; Wed, 27 Jul 2022 16:25:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0141FC433D7; Wed, 27 Jul 2022 16:25:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939105; bh=cMmgLo8sVs5a68Lp4rfu0ycU74LR5qPbIhOo1hm/mhw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T9r7ne1SQtQNwv66jVcM6Hf7+ywaAB9lLTaqEZcQIukkvWGcyIMdCgslzJS3j5Xkr YEPYcMollR99JtKvqowuErPvlcLpZ29+LiiX6NzG7+RYSdbNxRxHCDFUDvNv8DkcWY 9yeub8/vP78BA1sLIzP4XC37XrifxGVBPtA5FrUw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hangyu Hua , Steffen Klassert , Sasha Levin Subject: [PATCH 4.19 03/62] xfrm: xfrm_policy: fix a possible double xfrm_pols_put() in xfrm_bundle_lookup() Date: Wed, 27 Jul 2022 18:10:12 +0200 Message-Id: <20220727161004.296631438@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hangyu Hua [ Upstream commit f85daf0e725358be78dfd208dea5fd665d8cb901 ] xfrm_policy_lookup() will call xfrm_pol_hold_rcu() to get a refcount of pols[0]. This refcount can be dropped in xfrm_expand_policies() when xfrm_expand_policies() return error. pols[0]'s refcount is balanced in here. But xfrm_bundle_lookup() will also call xfrm_pols_put() with num_pols =3D=3D 1 to drop this refcount when xfrm_expand_policies() return error. This patch also fix an illegal address access. pols[0] will save a error point when xfrm_policy_lookup fails. This lead to xfrm_pols_put to resolve an illegal address in xfrm_bundle_lookup's error path. Fix these by setting num_pols =3D 0 in xfrm_expand_policies()'s error path. Fixes: 80c802f3073e ("xfrm: cache bundles instead of policies for outgoing = flows") Signed-off-by: Hangyu Hua Signed-off-by: Steffen Klassert Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/xfrm/xfrm_policy.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c index bb1c94e20e82..3582f77bab6a 100644 --- a/net/xfrm/xfrm_policy.c +++ b/net/xfrm/xfrm_policy.c @@ -1697,8 +1697,10 @@ static int xfrm_expand_policies(const struct flowi *= fl, u16 family, *num_xfrms =3D 0; return 0; } - if (IS_ERR(pols[0])) + if (IS_ERR(pols[0])) { + *num_pols =3D 0; return PTR_ERR(pols[0]); + } =20 *num_xfrms =3D pols[0]->xfrm_nr; =20 @@ -1713,6 +1715,7 @@ static int xfrm_expand_policies(const struct flowi *f= l, u16 family, if (pols[1]) { if (IS_ERR(pols[1])) { xfrm_pols_put(pols, *num_pols); + *num_pols =3D 0; return PTR_ERR(pols[1]); } (*num_pols)++; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 806C8C04A68 for ; Wed, 27 Jul 2022 16:30:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235932AbiG0Qan (ORCPT ); Wed, 27 Jul 2022 12:30:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34418 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237414AbiG0Q36 (ORCPT ); Wed, 27 Jul 2022 12:29:58 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F408C2645; Wed, 27 Jul 2022 09:25:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7D754B821C8; Wed, 27 Jul 2022 16:25:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C56F2C433C1; Wed, 27 Jul 2022 16:25:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939108; bh=0ZqCx0f3w4xzVKM7hqpvqH6GcIZzjcZOSWtNS/jyHXo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=KxwUsWxjZRgnmEijLf3r70Nd71s5NCyDo2MDjdyRMoMRSVFRfjIKr0sQYEJ9MqniG d8w5hRz9nNgbLMIBVt3HGSecFH5w2Str2tFHkq5Ev5hcZ4nHsp3Sf4Ih/chrGN4Koh df/BvJHZeGIojRJnZS2APalXDMK0dcVxq+SCCyoU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Miaoqian Lin , Linus Walleij , Sebastian Reichel , Sasha Levin Subject: [PATCH 4.19 04/62] power/reset: arm-versatile: Fix refcount leak in versatile_reboot_probe Date: Wed, 27 Jul 2022 18:10:13 +0200 Message-Id: <20220727161004.335900070@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Miaoqian Lin [ Upstream commit 80192eff64eee9b3bc0594a47381937b94b9d65a ] of_find_matching_node_and_match() returns a node pointer with refcount incremented, we should use of_node_put() on it when not need anymore. Add missing of_node_put() to avoid refcount leak. Fixes: 0e545f57b708 ("power: reset: driver for the Versatile syscon reboot") Signed-off-by: Miaoqian Lin Reviewed-by: Linus Walleij Signed-off-by: Sebastian Reichel Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/power/reset/arm-versatile-reboot.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/power/reset/arm-versatile-reboot.c b/drivers/power/res= et/arm-versatile-reboot.c index 06d34ab47df5..8022c782f6ff 100644 --- a/drivers/power/reset/arm-versatile-reboot.c +++ b/drivers/power/reset/arm-versatile-reboot.c @@ -150,6 +150,7 @@ static int __init versatile_reboot_probe(void) versatile_reboot_type =3D (enum versatile_reboot)reboot_id->data; =20 syscon_regmap =3D syscon_node_to_regmap(np); + of_node_put(np); if (IS_ERR(syscon_regmap)) return PTR_ERR(syscon_regmap); =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 15855C04A68 for ; Wed, 27 Jul 2022 16:32:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237695AbiG0Qct (ORCPT ); Wed, 27 Jul 2022 12:32:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237774AbiG0QcI (ORCPT ); Wed, 27 Jul 2022 12:32:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AE59752FF7; Wed, 27 Jul 2022 09:26:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 58E3BB821B9; Wed, 27 Jul 2022 16:25:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9ACF0C433D6; Wed, 27 Jul 2022 16:25:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939111; bh=0shjkcSBi+T8g6LRNkb44QHNKoxRXpDclFPnVHF93Kg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ohJ5fksWyueltRhV5fabtn3japyvlNQj19Vg1G6kJdLMbtOl+bYmCO0dFGjbs1hhx ORsALQhp2NzZ+p/Tj2pgncPGVLQ0sJpZ1FBMaGOVUZLGCAmOyMUbaajgOCI2mR6RDa ov9Lsh64XD7w8sRBo5NRld/dl67n/bu1tdrbTsqs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hacash Robot , William Dean , Linus Walleij , Sasha Levin Subject: [PATCH 4.19 05/62] pinctrl: ralink: Check for null return of devm_kcalloc Date: Wed, 27 Jul 2022 18:10:14 +0200 Message-Id: <20220727161004.385752294@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: William Dean [ Upstream commit c3b821e8e406d5650e587b7ac624ac24e9b780a8 ] Because of the possible failure of the allocation, data->domains might be NULL pointer and will cause the dereference of the NULL pointer later. Therefore, it might be better to check it and directly return -ENOMEM without releasing data manually if fails, because the comment of the devm_kmalloc() says "Memory allocated with this function is automatically freed on driver detach.". Fixes: a86854d0c599b ("treewide: devm_kzalloc() -> devm_kcalloc()") Reported-by: Hacash Robot Signed-off-by: William Dean Link: https://lore.kernel.org/r/20220710154922.2610876-1-williamsukatube@16= 3.com Signed-off-by: Linus Walleij Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c b/drivers/stag= ing/mt7621-pinctrl/pinctrl-rt2880.c index ad811c0438cc..031526cb1b21 100644 --- a/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c +++ b/drivers/staging/mt7621-pinctrl/pinctrl-rt2880.c @@ -267,6 +267,8 @@ static int rt2880_pinmux_pins(struct rt2880_priv *p) p->func[i]->pin_count, sizeof(int), GFP_KERNEL); + if (!p->func[i]->pins) + return -ENOMEM; for (j =3D 0; j < p->func[i]->pin_count; j++) p->func[i]->pins[j] =3D p->func[i]->pin_first + j; =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 35824C04A68 for ; Wed, 27 Jul 2022 16:31:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237699AbiG0QbV (ORCPT ); Wed, 27 Jul 2022 12:31:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34552 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236065AbiG0Qan (ORCPT ); Wed, 27 Jul 2022 12:30:43 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D6CE52454; Wed, 27 Jul 2022 09:25:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 85ACB619F6; Wed, 27 Jul 2022 16:25:14 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8A27BC433C1; Wed, 27 Jul 2022 16:25:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939113; bh=Btiv1hzgkHyKbTO+WO6YHAWnfk85J+1PYPGcL6n2wHU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ER6e7rCStFIa4gjfZiWYDxmMFCmycHzi5xxRJj9nRS/rARCsOluzPmobgRUdHUKnH fEvhswOer5Xq7WRsHzNeqWWJEVSKCJ1eVnpIdLUHVP+Dj72fKkV7AFfobX7uVEoV0V U6lGJvys9JjhRrE0HxoIL5NQlF6+JejUpqUeaHf4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Jihong , "Peter Zijlstra (Intel)" , Sasha Levin Subject: [PATCH 4.19 06/62] perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() Date: Wed, 27 Jul 2022 18:10:15 +0200 Message-Id: <20220727161004.416583079@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Peter Zijlstra [ Upstream commit 68e3c69803dada336893640110cb87221bb01dcf ] Yang Jihing reported a race between perf_event_set_output() and perf_mmap_close(): CPU1 CPU2 perf_mmap_close(e2) if (atomic_dec_and_test(&e2->rb->mmap_count)) // 1 - > 0 detach_rest =3D true ioctl(e1, IOC_SET_OUTPUT, e2) perf_event_set_output(e1, e2) ... list_for_each_entry_rcu(e, &e2->rb->event_list, rb_entry) ring_buffer_attach(e, NULL); // e1 isn't yet added and // therefore not detached ring_buffer_attach(e1, e2->rb) list_add_rcu(&e1->rb_entry, &e2->rb->event_list) After this; e1 is attached to an unmapped rb and a subsequent perf_mmap() will loop forever more: again: mutex_lock(&e->mmap_mutex); if (event->rb) { ... if (!atomic_inc_not_zero(&e->rb->mmap_count)) { ... mutex_unlock(&e->mmap_mutex); goto again; } } The loop in perf_mmap_close() holds e2->mmap_mutex, while the attach in perf_event_set_output() holds e1->mmap_mutex. As such there is no serialization to avoid this race. Change perf_event_set_output() to take both e1->mmap_mutex and e2->mmap_mutex to alleviate that problem. Additionally, have the loop in perf_mmap() detach the rb directly, this avoids having to wait for the concurrent perf_mmap_close() to get around to doing it to make progress. Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole") Reported-by: Yang Jihong Signed-off-by: Peter Zijlstra (Intel) Tested-by: Yang Jihong Link: https://lkml.kernel.org/r/YsQ3jm2GR38SW7uD@worktop.programming.kicks-= ass.net Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/events/core.c | 45 ++++++++++++++++++++++++++++++-------------- 1 file changed, 31 insertions(+), 14 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 88dd1398ae88..ba66ea3ca705 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5719,10 +5719,10 @@ static int perf_mmap(struct file *file, struct vm_a= rea_struct *vma) =20 if (!atomic_inc_not_zero(&event->rb->mmap_count)) { /* - * Raced against perf_mmap_close() through - * perf_event_set_output(). Try again, hope for better - * luck. + * Raced against perf_mmap_close(); remove the + * event and try again. */ + ring_buffer_attach(event, NULL); mutex_unlock(&event->mmap_mutex); goto again; } @@ -10396,14 +10396,25 @@ static int perf_copy_attr(struct perf_event_attr = __user *uattr, goto out; } =20 +static void mutex_lock_double(struct mutex *a, struct mutex *b) +{ + if (b < a) + swap(a, b); + + mutex_lock(a); + mutex_lock_nested(b, SINGLE_DEPTH_NESTING); +} + static int perf_event_set_output(struct perf_event *event, struct perf_event *output_= event) { struct ring_buffer *rb =3D NULL; int ret =3D -EINVAL; =20 - if (!output_event) + if (!output_event) { + mutex_lock(&event->mmap_mutex); goto set; + } =20 /* don't allow circular references */ if (event =3D=3D output_event) @@ -10441,8 +10452,15 @@ perf_event_set_output(struct perf_event *event, st= ruct perf_event *output_event) event->pmu !=3D output_event->pmu) goto out; =20 + /* + * Hold both mmap_mutex to serialize against perf_mmap_close(). Since + * output_event is already on rb->event_list, and the list iteration + * restarts after every removal, it is guaranteed this new event is + * observed *OR* if output_event is already removed, it's guaranteed we + * observe !rb->mmap_count. + */ + mutex_lock_double(&event->mmap_mutex, &output_event->mmap_mutex); set: - mutex_lock(&event->mmap_mutex); /* Can't redirect output if we've got an active mmap() */ if (atomic_read(&event->mmap_count)) goto unlock; @@ -10452,6 +10470,12 @@ perf_event_set_output(struct perf_event *event, st= ruct perf_event *output_event) rb =3D ring_buffer_get(output_event); if (!rb) goto unlock; + + /* did we race against perf_mmap_close() */ + if (!atomic_read(&rb->mmap_count)) { + ring_buffer_put(rb); + goto unlock; + } } =20 ring_buffer_attach(event, rb); @@ -10459,20 +10483,13 @@ perf_event_set_output(struct perf_event *event, s= truct perf_event *output_event) ret =3D 0; unlock: mutex_unlock(&event->mmap_mutex); + if (output_event) + mutex_unlock(&output_event->mmap_mutex); =20 out: return ret; } =20 -static void mutex_lock_double(struct mutex *a, struct mutex *b) -{ - if (b < a) - swap(a, b); - - mutex_lock(a); - mutex_lock_nested(b, SINGLE_DEPTH_NESTING); -} - static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id) { bool nmi_safe =3D false; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D2765C04A68 for ; Wed, 27 Jul 2022 16:31:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237666AbiG0QbR (ORCPT ); Wed, 27 Jul 2022 12:31:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34496 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237446AbiG0Qal (ORCPT ); Wed, 27 Jul 2022 12:30:41 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7DCBA5247E; Wed, 27 Jul 2022 09:25:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4C6DC617EF; Wed, 27 Jul 2022 16:25:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 55C4BC433C1; Wed, 27 Jul 2022 16:25:16 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939116; bh=HaPcLU8OTjq/O0rBKkVeU0xDiBOTbO2unGt7nLpjxW8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qd3j45M7StFg0v59aBfnVpx7lnyVh1kVNSr2Yt8ssgGx7EikG2HJvBki1RPoAsVWz gLnjwMKhQq5WW8DDQO9gzjxdW+Dd24V9uzF36xNMR8HHCz6VuN/koNfv4w9B9p4OiL 1AnX5BzJtpwBeDY7FXiMM+4A2gvVKB6512sA6UO4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 07/62] ip: Fix data-races around sysctl_ip_fwd_use_pmtu. Date: Wed, 27 Jul 2022 18:10:16 +0200 Message-Id: <20220727161004.448768084@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 60c158dc7b1f0558f6cadd5b50d0386da0000d50 ] While reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: f87c10a8aa1e ("ipv4: introduce ip_dst_mtu_maybe_forward and protect = forwarding path against pmtu spoofing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/ip.h | 2 +- net/ipv4/route.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/ip.h b/include/net/ip.h index d1a4efedbc03..471463bfe6f9 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -402,7 +402,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(con= st struct dst_entry *dst, struct net *net =3D dev_net(dst->dev); unsigned int mtu; =20 - if (net->ipv4.sysctl_ip_fwd_use_pmtu || + if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) || ip_mtu_locked(dst) || !forwarding) return dst_mtu(dst); diff --git a/net/ipv4/route.c b/net/ipv4/route.c index d7f17581df7d..57e2316529d0 100644 --- a/net/ipv4/route.c +++ b/net/ipv4/route.c @@ -1419,7 +1419,7 @@ u32 ip_mtu_from_fib_result(struct fib_result *res, __= be32 daddr) struct net_device *dev =3D nh->nh_dev; u32 mtu =3D 0; =20 - if (dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu || + if (READ_ONCE(dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu) || fi->fib_metrics->metrics[RTAX_LOCK - 1] & (1 << RTAX_MTU)) mtu =3D fi->fib_mtu; =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8B6BAC04A68 for ; Wed, 27 Jul 2022 16:31:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236029AbiG0Qb2 (ORCPT ); Wed, 27 Jul 2022 12:31:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33802 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235481AbiG0Qan (ORCPT ); Wed, 27 Jul 2022 12:30:43 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0D62652453; Wed, 27 Jul 2022 09:25:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B99AFB821C1; Wed, 27 Jul 2022 16:25:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 15915C433C1; Wed, 27 Jul 2022 16:25:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939119; bh=DociUfqFdcsu742ZqlLz7PGIUm+Z5z2Wi1z0E5XlUmI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=sgUL1HMMpxGEPUE8h7PcMd+ahLS9jdLdtne1Z3jom0ZfpxtZ1zQT8HQ6FPOMeLH2y FChzJTxOgBP850y1CNMcYlfFmn9oq30vw3f17Z+z6GZ/OnBmPYIBYJHBXoV/eGGFW5 d3xAIP8u/5FbtnUDIhCUK9Frq4L96A6wcaUYuBzk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 08/62] ip: Fix data-races around sysctl_ip_nonlocal_bind. Date: Wed, 27 Jul 2022 18:10:17 +0200 Message-Id: <20220727161004.497909453@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 289d3b21fb0bfc94c4e98f10635bba1824e5f83c ] While reading sysctl_ip_nonlocal_bind, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/inet_sock.h | 2 +- net/sctp/protocol.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h index a80fd0ac4563..e3d943813ff8 100644 --- a/include/net/inet_sock.h +++ b/include/net/inet_sock.h @@ -357,7 +357,7 @@ static inline bool inet_get_convert_csum(struct sock *s= k) static inline bool inet_can_nonlocal_bind(struct net *net, struct inet_sock *inet) { - return net->ipv4.sysctl_ip_nonlocal_bind || + return READ_ONCE(net->ipv4.sysctl_ip_nonlocal_bind) || inet->freebind || inet->transparent; } =20 diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c index 7207a9769f1a..8db8209c5b61 100644 --- a/net/sctp/protocol.c +++ b/net/sctp/protocol.c @@ -373,7 +373,7 @@ static int sctp_v4_available(union sctp_addr *addr, str= uct sctp_sock *sp) if (addr->v4.sin_addr.s_addr !=3D htonl(INADDR_ANY) && ret !=3D RTN_LOCAL && !sp->inet.freebind && - !net->ipv4.sysctl_ip_nonlocal_bind) + !READ_ONCE(net->ipv4.sysctl_ip_nonlocal_bind)) return 0; =20 if (ipv6_only_sock(sctp_opt2sk(sp))) --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D006C04A68 for ; Wed, 27 Jul 2022 16:31:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237403AbiG0Qby (ORCPT ); Wed, 27 Jul 2022 12:31:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35338 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237147AbiG0QbK (ORCPT ); Wed, 27 Jul 2022 12:31:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ABE9E52E45; Wed, 27 Jul 2022 09:25:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6DEF6B821BB; Wed, 27 Jul 2022 16:25:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7EE3C433D6; Wed, 27 Jul 2022 16:25:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939122; bh=hLk9idVTGAKCBX/2RyA8w4Od30zWdtZkT7LgLKR6RRI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EU/hixzLBuKDc5sN3J15fknPTO6unCyA04e7F2nqQoB3hW7WioQsRregv8bJhC/FY w4bLm1rK/i3J6xwyRVnlTbcJ8vCBco9zP3Dw/N6R9XnhTyULFYHn2d6HoT6DKu4r9w 93S27HKvs0xkMeXxGFth8cDT+omxj9A+1WqljsLE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 09/62] ip: Fix a data-race around sysctl_fwmark_reflect. Date: Wed, 27 Jul 2022 18:10:18 +0200 Message-Id: <20220727161004.538362937@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 85d0b4dbd74b95cc492b1f4e34497d3f894f5d9a ] While reading sysctl_fwmark_reflect, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: e110861f8609 ("net: add a sysctl to reflect the fwmark on replies") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/ip.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/ip.h b/include/net/ip.h index 471463bfe6f9..0f820e68bd8f 100644 --- a/include/net/ip.h +++ b/include/net/ip.h @@ -341,7 +341,7 @@ void ipfrag_init(void); void ip_static_sysctl_init(void); =20 #define IP4_REPLY_MARK(net, mark) \ - ((net)->ipv4.sysctl_fwmark_reflect ? (mark) : 0) + (READ_ONCE((net)->ipv4.sysctl_fwmark_reflect) ? (mark) : 0) =20 static inline bool ip_is_fragment(const struct iphdr *iph) { --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34457C04A68 for ; Wed, 27 Jul 2022 16:30:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237433AbiG0QaE (ORCPT ); Wed, 27 Jul 2022 12:30:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237705AbiG0Q3U (ORCPT ); Wed, 27 Jul 2022 12:29:20 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6FE4C51413; Wed, 27 Jul 2022 09:24:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id AB0FBB821C3; Wed, 27 Jul 2022 16:24:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 13217C43470; Wed, 27 Jul 2022 16:24:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939091; bh=KBgj1OBe0JaxOawd5I4mNB9N4o8Hfa8jfOhoRmlyiUc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RprgFDREQ4vU2fXJSG69UCaNQ0iijvrUQX4Ch3100tUrQoQkEKA20mU5myYx4I5fo HMT7wqKexTZKVfB7VPKJzpQRjbjjN+pr0ieAZ70Qx/vD2r/pgfDNNDsGxLbI71i79+ R+mGLLVrYGgedNLfcAbzM+TJRghIiRZu3QP7kvPc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 10/62] tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. Date: Wed, 27 Jul 2022 18:10:19 +0200 Message-Id: <20220727161004.580313911@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 1a0008f9df59451d0a17806c1ee1a19857032fa8 ] While reading sysctl_tcp_fwmark_accept, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 84f39b08d786 ("net: support marking accepting TCP sockets") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/inet_sock.h | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h index e3d943813ff8..d5552ff1d361 100644 --- a/include/net/inet_sock.h +++ b/include/net/inet_sock.h @@ -111,7 +111,8 @@ static inline struct inet_request_sock *inet_rsk(const = struct request_sock *sk) =20 static inline u32 inet_request_mark(const struct sock *sk, struct sk_buff = *skb) { - if (!sk->sk_mark && sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept) + if (!sk->sk_mark && + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fwmark_accept)) return skb->mark; =20 return sk->sk_mark; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A2D3DC04A68 for ; Wed, 27 Jul 2022 16:32:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237418AbiG0Qce (ORCPT ); Wed, 27 Jul 2022 12:32:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33906 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237705AbiG0QcA (ORCPT ); Wed, 27 Jul 2022 12:32:00 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [145.40.73.55]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 198A952FCD; Wed, 27 Jul 2022 09:25:59 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id DFC02CE2303; Wed, 27 Jul 2022 16:24:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CEDC8C433D7; Wed, 27 Jul 2022 16:24:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939094; bh=1HcNia9FqHE2hkx0BFQITQ6ChPd0Zwd2QPUi9++C3qg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jc6LmH8ZIxC4/IxhFnCC3wNvNSrq7dU3pRwRlTZ8LzcOWBXXcSJ2vMNlE5AZGBRxA B+zIny/NWxaVKATlXMIvXZM+hRz483UYtJvcGNu70vsumqc+7627TNLlXfwLReRGL0 uFF6Jt4BUKqtKDodcLU3VJDS9lZ7egQo7dU4UCY8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 11/62] tcp: Fix data-races around sysctl_tcp_mtu_probing. Date: Wed, 27 Jul 2022 18:10:20 +0200 Message-Id: <20220727161004.610623579@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit f47d00e077e7d61baf69e46dde3210c886360207 ] While reading sysctl_tcp_mtu_probing, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 5d424d5a674f ("[TCP]: MTU probing") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_output.c | 2 +- net/ipv4/tcp_timer.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 25dbdb27a571..02a7799c4b72 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1523,7 +1523,7 @@ void tcp_mtup_init(struct sock *sk) struct inet_connection_sock *icsk =3D inet_csk(sk); struct net *net =3D sock_net(sk); =20 - icsk->icsk_mtup.enabled =3D net->ipv4.sysctl_tcp_mtu_probing > 1; + icsk->icsk_mtup.enabled =3D READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing) >= 1; icsk->icsk_mtup.search_high =3D tp->rx_opt.mss_clamp + sizeof(struct tcph= dr) + icsk->icsk_af_ops->net_header_len; icsk->icsk_mtup.search_low =3D tcp_mss_to_mtu(sk, net->ipv4.sysctl_tcp_ba= se_mss); diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index d071ed6b8b9a..5d761333ffc4 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -144,7 +144,7 @@ static void tcp_mtu_probing(struct inet_connection_sock= *icsk, struct sock *sk) int mss; =20 /* Black hole detection */ - if (!net->ipv4.sysctl_tcp_mtu_probing) + if (!READ_ONCE(net->ipv4.sysctl_tcp_mtu_probing)) return; =20 if (!icsk->icsk_mtup.enabled) { --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E58D6C04A68 for ; Wed, 27 Jul 2022 16:32:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237619AbiG0QcQ (ORCPT ); Wed, 27 Jul 2022 12:32:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34418 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236924AbiG0Qbu (ORCPT ); Wed, 27 Jul 2022 12:31:50 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B17AD4E638; Wed, 27 Jul 2022 09:25:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5220DB821B8; Wed, 27 Jul 2022 16:24:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A52BAC433C1; Wed, 27 Jul 2022 16:24:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939097; bh=xgPJVu/3HhJjbOwNte/3wNiRR32KJWwmVRAO4GAIEDo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jhSxmsxvAilGTDfoDPTb4bXxC/DFuvwuR70kgBr444E0YgYfupi0hWDj4PqwMFbFx 5o8nVZN8izJP7o2XEEnnxzNGtVZCzwDAoiIUA8pJpDEIwNZL1QSM58CxSgPTbBWeay yOGeSY1vI84xZirkXyRPt/PXe+ShXGMZPaWLAzG4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 12/62] tcp: Fix a data-race around sysctl_tcp_probe_threshold. Date: Wed, 27 Jul 2022 18:10:21 +0200 Message-Id: <20220727161004.661179839@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 92c0aa4175474483d6cf373314343d4e624e882a ] While reading sysctl_tcp_probe_threshold, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 6b58e0a5f32d ("ipv4: Use binary search to choose tcp PMTU probe_size= ") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 02a7799c4b72..0e0f7803cf4e 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2112,7 +2112,7 @@ static int tcp_mtu_probe(struct sock *sk) * probing process by not resetting search range to its orignal. */ if (probe_size > tcp_mtu_to_mss(sk, icsk->icsk_mtup.search_high) || - interval < net->ipv4.sysctl_tcp_probe_threshold) { + interval < READ_ONCE(net->ipv4.sysctl_tcp_probe_threshold)) { /* Check whether enough time has elaplased for * another round of probing. */ --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E2350C04A68 for ; Wed, 27 Jul 2022 16:30:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236809AbiG0Qa5 (ORCPT ); Wed, 27 Jul 2022 12:30:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33870 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236502AbiG0Qac (ORCPT ); Wed, 27 Jul 2022 12:30:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DC22205EC; Wed, 27 Jul 2022 09:25:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 43401B821BB; Wed, 27 Jul 2022 16:25:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 82905C433C1; Wed, 27 Jul 2022 16:24:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939099; bh=bSwEOEpsY25YU1kuF2UzXaIWJQ9XzvhLMp13mR3AYZ4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1p3wN9v3qFDmLx0y9NUH59BKB7AixQlWcOdAIHudzvqPZRGNpr9Qzmxy07jyYIOkr R0XaqrxLBsbb+YcaJMpYQmnMOZZiqVr+UPDMI96qArHEd32ihb+2QOLuSPBCBYLXYk wLxyffn3zCWm50zPmSav2QyRb3t9a7BGcfp4KTgo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 13/62] tcp: Fix a data-race around sysctl_tcp_probe_interval. Date: Wed, 27 Jul 2022 18:10:22 +0200 Message-Id: <20220727161004.701546594@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 2a85388f1d94a9f8b5a529118a2c5eaa0520d85c ] While reading sysctl_tcp_probe_interval, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 05cbc0db03e8 ("ipv4: Create probe timer for tcp PMTU as per RFC4821") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 0e0f7803cf4e..33f9a486661c 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2030,7 +2030,7 @@ static inline void tcp_mtu_check_reprobe(struct sock = *sk) u32 interval; s32 delta; =20 - interval =3D net->ipv4.sysctl_tcp_probe_interval; + interval =3D READ_ONCE(net->ipv4.sysctl_tcp_probe_interval); delta =3D tcp_jiffies32 - icsk->icsk_mtup.probe_timestamp; if (unlikely(delta >=3D interval * HZ)) { int mss =3D tcp_current_mss(sk); --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 88B1FC19F28 for ; Wed, 27 Jul 2022 16:36:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238644AbiG0QgL (ORCPT ); Wed, 27 Jul 2022 12:36:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238512AbiG0Qe2 (ORCPT ); Wed, 27 Jul 2022 12:34:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 337D6558C2; Wed, 27 Jul 2022 09:27:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C050FB821B6; Wed, 27 Jul 2022 16:27:02 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1758AC433D6; Wed, 27 Jul 2022 16:27:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939221; bh=CGwlmVA2bXXqQ4IQKLk5slznzE9EMe0rptGUrvhRg6U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UFwvWT5ETEITHuDZANw9KqfwTNfAswuY7SybKOnCZ43FE0uEskV2QgNtT1FCfo1P4 ahdZRjIOOo1Vv1wyUv+dI/Au1v+VIFlmrz+6i15/kzYsQ+gnrpT477j4nErwKJK8VF pl876ser3eJMLMJ0xXINQBn3xTVEV40upSYY4N7o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Robert Hancock , Shubhrajyoti Datta , Michal Simek , Wolfram Sang , Sasha Levin Subject: [PATCH 4.19 14/62] i2c: cadence: Change large transfer count reset logic to be unconditional Date: Wed, 27 Jul 2022 18:10:23 +0200 Message-Id: <20220727161004.741012512@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Robert Hancock [ Upstream commit 4ca8ca873d454635c20d508261bfc0081af75cf8 ] Problems were observed on the Xilinx ZynqMP platform with large I2C reads. When a read of 277 bytes was performed, the controller NAKed the transfer after only 252 bytes were transferred and returned an ENXIO error on the transfer. There is some code in cdns_i2c_master_isr to handle this case by resetting the transfer count in the controller before it reaches 0, to allow larger transfers to work, but it was conditional on the CDNS_I2C_BROKEN_HOLD_BIT quirk being set on the controller, and ZynqMP uses the r1p14 version of the core where this quirk is not being set. The requirement to do this to support larger reads seems like an inherently required workaround due to the core only having an 8-bit transfer size register, so it does not appear that this should be conditional on the broken HOLD bit quirk which is used elsewhere in the driver. Remove the dependency on the CDNS_I2C_BROKEN_HOLD_BIT for this transfer size reset logic to fix this problem. Fixes: 63cab195bf49 ("i2c: removed work arounds in i2c driver for Zynq Ultr= ascale+ MPSoC") Signed-off-by: Robert Hancock Reviewed-by: Shubhrajyoti Datta Acked-by: Michal Simek Signed-off-by: Wolfram Sang Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/i2c/busses/i2c-cadence.c | 30 +++++------------------------- 1 file changed, 5 insertions(+), 25 deletions(-) diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cade= nce.c index 273f57e277b3..512c61d31fe5 100644 --- a/drivers/i2c/busses/i2c-cadence.c +++ b/drivers/i2c/busses/i2c-cadence.c @@ -203,9 +203,9 @@ static inline bool cdns_is_holdquirk(struct cdns_i2c *i= d, bool hold_wrkaround) */ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) { - unsigned int isr_status, avail_bytes, updatetx; + unsigned int isr_status, avail_bytes; unsigned int bytes_to_send; - bool hold_quirk; + bool updatetx; struct cdns_i2c *id =3D ptr; /* Signal completion only after everything is updated */ int done_flag =3D 0; @@ -224,11 +224,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) * Check if transfer size register needs to be updated again for a * large data receive operation. */ - updatetx =3D 0; - if (id->recv_count > id->curr_recv_count) - updatetx =3D 1; - - hold_quirk =3D (id->quirks & CDNS_I2C_BROKEN_HOLD_BIT) && updatetx; + updatetx =3D id->recv_count > id->curr_recv_count; =20 /* When receiving, handle data interrupt and completion interrupt */ if (id->p_recv_buf && @@ -251,7 +247,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) id->recv_count--; id->curr_recv_count--; =20 - if (cdns_is_holdquirk(id, hold_quirk)) + if (cdns_is_holdquirk(id, updatetx)) break; } =20 @@ -262,7 +258,7 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) * maintain transfer size non-zero while performing a large * receive operation. */ - if (cdns_is_holdquirk(id, hold_quirk)) { + if (cdns_is_holdquirk(id, updatetx)) { /* wait while fifo is full */ while (cdns_i2c_readreg(CDNS_I2C_XFER_SIZE_OFFSET) !=3D (id->curr_recv_count - CDNS_I2C_FIFO_DEPTH)) @@ -284,22 +280,6 @@ static irqreturn_t cdns_i2c_isr(int irq, void *ptr) CDNS_I2C_XFER_SIZE_OFFSET); id->curr_recv_count =3D id->recv_count; } - } else if (id->recv_count && !hold_quirk && - !id->curr_recv_count) { - - /* Set the slave address in address register*/ - cdns_i2c_writereg(id->p_msg->addr & CDNS_I2C_ADDR_MASK, - CDNS_I2C_ADDR_OFFSET); - - if (id->recv_count > CDNS_I2C_TRANSFER_SIZE) { - cdns_i2c_writereg(CDNS_I2C_TRANSFER_SIZE, - CDNS_I2C_XFER_SIZE_OFFSET); - id->curr_recv_count =3D CDNS_I2C_TRANSFER_SIZE; - } else { - cdns_i2c_writereg(id->recv_count, - CDNS_I2C_XFER_SIZE_OFFSET); - id->curr_recv_count =3D id->recv_count; - } } =20 /* Clear hold (if not repeated start) and signal completion */ --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7F250C04A68 for ; Wed, 27 Jul 2022 16:32:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237444AbiG0QcL (ORCPT ); Wed, 27 Jul 2022 12:32:11 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34400 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237046AbiG0Qbu (ORCPT ); Wed, 27 Jul 2022 12:31:50 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DB08B4E843; Wed, 27 Jul 2022 09:25:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 80ECE61A04; Wed, 27 Jul 2022 16:25:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 88093C433D6; Wed, 27 Jul 2022 16:25:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939127; bh=mCL+k2BHQLcMGCNjg/EsTYj9U+O/cmyZuF9rccIQ8sU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ZzzSgwVkoBggXxz/nJ+7w1QolqGPAkS0FjXeoIml+xbBuMh6Q2sfk2UzSKelFZyGP poXeDNyU2k+xX2T4WSQ9jCNyh3RsS02oCXECnxc2mHJsAvlP69plLi0Wg+WdW2EYoi 47ob3ocQqb4yX/ntBW+UDl6sKS2o8tHZy7dZGRzY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Cedric Wassenaar , Junxiao Chang , Florian Fainelli , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 15/62] net: stmmac: fix dma queue left shift overflow issue Date: Wed, 27 Jul 2022 18:10:24 +0200 Message-Id: <20220727161004.781641985@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Junxiao Chang [ Upstream commit 613b065ca32e90209024ec4a6bb5ca887ee70980 ] When queue number is > 4, left shift overflows due to 32 bits integer variable. Mask calculation is wrong for MTL_RXQ_DMA_MAP1. If CONFIG_UBSAN is enabled, kernel dumps below warning: [ 10.363842] =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 10.363882] UBSAN: shift-out-of-bounds in /build/linux-intel-iotg-5.15-8= e6Tf4/ linux-intel-iotg-5.15-5.15.0/drivers/net/ethernet/stmicro/stmmac/dwmac4_cor= e.c:224:12 [ 10.363929] shift exponent 40 is too large for 32-bit type 'unsigned int' [ 10.363953] CPU: 1 PID: 599 Comm: NetworkManager Not tainted 5.15.0-1003= -intel-iotg [ 10.363956] Hardware name: ADLINK Technology Inc. LEC-EL/LEC-EL, BIOS 0.= 15.11 12/22/2021 [ 10.363958] Call Trace: [ 10.363960] [ 10.363963] dump_stack_lvl+0x4a/0x5f [ 10.363971] dump_stack+0x10/0x12 [ 10.363974] ubsan_epilogue+0x9/0x45 [ 10.363976] __ubsan_handle_shift_out_of_bounds.cold+0x61/0x10e [ 10.363979] ? wake_up_klogd+0x4a/0x50 [ 10.363983] ? vprintk_emit+0x8f/0x240 [ 10.363986] dwmac4_map_mtl_dma.cold+0x42/0x91 [stmmac] [ 10.364001] stmmac_mtl_configuration+0x1ce/0x7a0 [stmmac] [ 10.364009] ? dwmac410_dma_init_channel+0x70/0x70 [stmmac] [ 10.364020] stmmac_hw_setup.cold+0xf/0xb14 [stmmac] [ 10.364030] ? page_pool_alloc_pages+0x4d/0x70 [ 10.364034] ? stmmac_clear_tx_descriptors+0x6e/0xe0 [stmmac] [ 10.364042] stmmac_open+0x39e/0x920 [stmmac] [ 10.364050] __dev_open+0xf0/0x1a0 [ 10.364054] __dev_change_flags+0x188/0x1f0 [ 10.364057] dev_change_flags+0x26/0x60 [ 10.364059] do_setlink+0x908/0xc40 [ 10.364062] ? do_setlink+0xb10/0xc40 [ 10.364064] ? __nla_validate_parse+0x4c/0x1a0 [ 10.364068] __rtnl_newlink+0x597/0xa10 [ 10.364072] ? __nla_reserve+0x41/0x50 [ 10.364074] ? __kmalloc_node_track_caller+0x1d0/0x4d0 [ 10.364079] ? pskb_expand_head+0x75/0x310 [ 10.364082] ? nla_reserve_64bit+0x21/0x40 [ 10.364086] ? skb_free_head+0x65/0x80 [ 10.364089] ? security_sock_rcv_skb+0x2c/0x50 [ 10.364094] ? __cond_resched+0x19/0x30 [ 10.364097] ? kmem_cache_alloc_trace+0x15a/0x420 [ 10.364100] rtnl_newlink+0x49/0x70 This change fixes MTL_RXQ_DMA_MAP1 mask issue and channel/queue mapping warning. Fixes: d43042f4da3e ("net: stmmac: mapping mtl rx to dma channel") BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=3D216195 Reported-by: Cedric Wassenaar Signed-off-by: Junxiao Chang Reviewed-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/ne= t/ethernet/stmicro/stmmac/dwmac4_core.c index bc8871e7351f..00b6af0b2f3a 100644 --- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c @@ -222,6 +222,9 @@ static void dwmac4_map_mtl_dma(struct mac_device_info *= hw, u32 queue, u32 chan) if (queue =3D=3D 0 || queue =3D=3D 4) { value &=3D ~MTL_RXQ_DMA_Q04MDMACH_MASK; value |=3D MTL_RXQ_DMA_Q04MDMACH(chan); + } else if (queue > 4) { + value &=3D ~MTL_RXQ_DMA_QXMDMACH_MASK(queue - 4); + value |=3D MTL_RXQ_DMA_QXMDMACH(chan, queue - 4); } else { value &=3D ~MTL_RXQ_DMA_QXMDMACH_MASK(queue); value |=3D MTL_RXQ_DMA_QXMDMACH(chan, queue); --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5DFDC04A68 for ; Wed, 27 Jul 2022 16:32:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237897AbiG0Qch (ORCPT ); Wed, 27 Jul 2022 12:32:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34700 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236667AbiG0QcE (ORCPT ); Wed, 27 Jul 2022 12:32:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08F8F52FD4; Wed, 27 Jul 2022 09:26:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 98DB0B821C1; Wed, 27 Jul 2022 16:26:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 00C31C433C1; Wed, 27 Jul 2022 16:25:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939159; bh=BFe+5I4xOULB9vvt8wktkW2SV/HxHs/G7cPmPTVPfpY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AnbXHEog6+ZLtrFBy3/314pQs/CEcrk0QglXKLafr5i5dLwaiuV4WcT2hzcHS2k71 i8PEkHEa11OZc5ZiGcXJg6yWn0MCYrbZmzcT+/v5MoqTElPuGJ8qB32aBmVW3fd1fE NifkBn9mXDfbFLViP3kjHIjClNfXyIfCJIqDCwTk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maxim Mikityanskiy , Tariq Toukan , Jakub Kicinski , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 16/62] net/tls: Fix race in TLS device down flow Date: Wed, 27 Jul 2022 18:10:25 +0200 Message-Id: <20220727161004.820683348@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tariq Toukan [ Upstream commit f08d8c1bb97c48f24a82afaa2fd8c140f8d3da8b ] Socket destruction flow and tls_device_down function sync against each other using tls_device_lock and the context refcount, to guarantee the device resources are freed via tls_dev_del() by the end of tls_device_down. In the following unfortunate flow, this won't happen: - refcount is decreased to zero in tls_device_sk_destruct. - tls_device_down starts, skips the context as refcount is zero, going all the way until it flushes the gc work, and returns without freeing the device resources. - only then, tls_device_queue_ctx_destruction is called, queues the gc work and frees the context's device resources. Solve it by decreasing the refcount in the socket's destruction flow under the tls_device_lock, for perfect synchronization. This does not slow down the common likely destructor flow, in which both the refcount is decreased and the spinlock is acquired, anyway. Fixes: e8f69799810c ("net/tls: Add generic NIC offload infrastructure") Reviewed-by: Maxim Mikityanskiy Signed-off-by: Tariq Toukan Reviewed-by: Jakub Kicinski Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/tls/tls_device.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c index 228e3ce48d43..b290eb3ae155 100644 --- a/net/tls/tls_device.c +++ b/net/tls/tls_device.c @@ -110,13 +110,16 @@ static void tls_device_queue_ctx_destruction(struct t= ls_context *ctx) unsigned long flags; =20 spin_lock_irqsave(&tls_device_lock, flags); + if (unlikely(!refcount_dec_and_test(&ctx->refcount))) + goto unlock; + list_move_tail(&ctx->list, &tls_device_gc_list); =20 /* schedule_work inside the spinlock * to make sure tls_device_down waits for that work. */ schedule_work(&tls_device_gc_work); - +unlock: spin_unlock_irqrestore(&tls_device_lock, flags); } =20 @@ -214,8 +217,7 @@ void tls_device_sk_destruct(struct sock *sk) clean_acked_data_disable(inet_csk(sk)); } =20 - if (refcount_dec_and_test(&tls_ctx->refcount)) - tls_device_queue_ctx_destruction(tls_ctx); + tls_device_queue_ctx_destruction(tls_ctx); } EXPORT_SYMBOL(tls_device_sk_destruct); =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1FB2BC04A68 for ; Wed, 27 Jul 2022 16:36:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238594AbiG0QgB (ORCPT ); Wed, 27 Jul 2022 12:36:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238367AbiG0QeW (ORCPT ); Wed, 27 Jul 2022 12:34:22 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2DFA654CBE; Wed, 27 Jul 2022 09:27:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AFBC661A1E; Wed, 27 Jul 2022 16:26:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6B35C433D6; Wed, 27 Jul 2022 16:26:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939190; bh=4a07L9FAYE6Hy2yov2eTzQtFHuUk6iOwB8T/ZXIwaEE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YBNyOCag7oJOH4C3PjZgwSP051CEMMSZGYPJxuqyRXGpOO/GGFjxr3I0kZK+A3fKc TCjP8YcdalBoZ+xYMYqjl1kXOiRMo/HR1L8vsg7EhLgxB0fKUq8tmSnN4SQ+vNRuJg Rl6GCtjj4sy4Frr1q4xcEd86jtBqeXnUegBwcSrU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 17/62] igmp: Fix data-races around sysctl_igmp_llm_reports. Date: Wed, 27 Jul 2022 18:10:26 +0200 Message-Id: <20220727161004.870745121@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit f6da2267e71106474fbc0943dc24928b9cb79119 ] While reading sysctl_igmp_llm_reports, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. This test can be packed into a helper, so such changes will be in the follow-up series after net is merged into net-next. if (ipv4_is_local_multicast(pmc->multiaddr) && !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) Fixes: df2cf4a78e48 ("IGMP: Inhibit reports for local multicast groups") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/igmp.c | 21 +++++++++++++-------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index ee179e08dd20..957e1170a8a3 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -471,7 +471,8 @@ static struct sk_buff *add_grec(struct sk_buff *skb, st= ruct ip_mc_list *pmc, =20 if (pmc->multiaddr =3D=3D IGMP_ALL_HOSTS) return skb; - if (ipv4_is_local_multicast(pmc->multiaddr) && !net->ipv4.sysctl_igmp_llm= _reports) + if (ipv4_is_local_multicast(pmc->multiaddr) && + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return skb; =20 mtu =3D READ_ONCE(dev->mtu); @@ -597,7 +598,7 @@ static int igmpv3_send_report(struct in_device *in_dev,= struct ip_mc_list *pmc) if (pmc->multiaddr =3D=3D IGMP_ALL_HOSTS) continue; if (ipv4_is_local_multicast(pmc->multiaddr) && - !net->ipv4.sysctl_igmp_llm_reports) + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) continue; spin_lock_bh(&pmc->lock); if (pmc->sfcount[MCAST_EXCLUDE]) @@ -740,7 +741,8 @@ static int igmp_send_report(struct in_device *in_dev, s= truct ip_mc_list *pmc, if (type =3D=3D IGMPV3_HOST_MEMBERSHIP_REPORT) return igmpv3_send_report(in_dev, pmc); =20 - if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports) + if (ipv4_is_local_multicast(group) && + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return 0; =20 if (type =3D=3D IGMP_HOST_LEAVE_MESSAGE) @@ -924,7 +926,8 @@ static bool igmp_heard_report(struct in_device *in_dev,= __be32 group) =20 if (group =3D=3D IGMP_ALL_HOSTS) return false; - if (ipv4_is_local_multicast(group) && !net->ipv4.sysctl_igmp_llm_reports) + if (ipv4_is_local_multicast(group) && + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return false; =20 rcu_read_lock(); @@ -1049,7 +1052,7 @@ static bool igmp_heard_query(struct in_device *in_dev= , struct sk_buff *skb, if (im->multiaddr =3D=3D IGMP_ALL_HOSTS) continue; if (ipv4_is_local_multicast(im->multiaddr) && - !net->ipv4.sysctl_igmp_llm_reports) + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) continue; spin_lock_bh(&im->lock); if (im->tm_running) @@ -1299,7 +1302,8 @@ static void igmp_group_dropped(struct ip_mc_list *im) #ifdef CONFIG_IP_MULTICAST if (im->multiaddr =3D=3D IGMP_ALL_HOSTS) return; - if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_= reports) + if (ipv4_is_local_multicast(im->multiaddr) && + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return; =20 reporter =3D im->reporter; @@ -1336,7 +1340,8 @@ static void igmp_group_added(struct ip_mc_list *im) #ifdef CONFIG_IP_MULTICAST if (im->multiaddr =3D=3D IGMP_ALL_HOSTS) return; - if (ipv4_is_local_multicast(im->multiaddr) && !net->ipv4.sysctl_igmp_llm_= reports) + if (ipv4_is_local_multicast(im->multiaddr) && + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) return; =20 if (in_dev->dead) @@ -1657,7 +1662,7 @@ static void ip_mc_rejoin_groups(struct in_device *in_= dev) if (im->multiaddr =3D=3D IGMP_ALL_HOSTS) continue; if (ipv4_is_local_multicast(im->multiaddr) && - !net->ipv4.sysctl_igmp_llm_reports) + !READ_ONCE(net->ipv4.sysctl_igmp_llm_reports)) continue; =20 /* a failover is happening and switches --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F2A7DC19F28 for ; Wed, 27 Jul 2022 16:35:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238014AbiG0QfK (ORCPT ); Wed, 27 Jul 2022 12:35:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47320 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237868AbiG0Qdp (ORCPT ); Wed, 27 Jul 2022 12:33:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BE66A474CB; Wed, 27 Jul 2022 09:26:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 92537619F4; Wed, 27 Jul 2022 16:26:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C047C433D6; Wed, 27 Jul 2022 16:26:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939204; bh=W0q27RSXpDQKArdu1Qarm0cHko2rXjDyC3znbuUCfFE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D1/NTL4UUMpSqRBwB6b6Pc2GU/jL9jxLcEQp74oQCU16+wCRTt5V3qxqFicxvCDIj yEAkFlo1ukjIgNVhNjDYTnZAVAEhQ8NXpZO0nB6BbWe8PH3AWtxw7xqio//hf0yVA4 CCpu7MjshLMfgoVVVWM3/KZDpvCGw4p3o2PMstM8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 18/62] igmp: Fix a data-race around sysctl_igmp_max_memberships. Date: Wed, 27 Jul 2022 18:10:27 +0200 Message-Id: <20220727161004.910586609@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 6305d821e3b9b5379d348528e5b5faf316383bc2 ] While reading sysctl_igmp_max_memberships, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/igmp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 957e1170a8a3..b831825f234f 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -2212,7 +2212,7 @@ static int __ip_mc_join_group(struct sock *sk, struct= ip_mreqn *imr, count++; } err =3D -ENOBUFS; - if (count >=3D net->ipv4.sysctl_igmp_max_memberships) + if (count >=3D READ_ONCE(net->ipv4.sysctl_igmp_max_memberships)) goto done; iml =3D sock_kmalloc(sk, sizeof(*iml), GFP_KERNEL); if (!iml) --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B200EC04A68 for ; Wed, 27 Jul 2022 16:35:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238427AbiG0Qf0 (ORCPT ); Wed, 27 Jul 2022 12:35:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46414 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238012AbiG0Qd7 (ORCPT ); Wed, 27 Jul 2022 12:33:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B91354CA0; Wed, 27 Jul 2022 09:26:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 65DFB61A18; Wed, 27 Jul 2022 16:26:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 717FCC433C1; Wed, 27 Jul 2022 16:26:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939206; bh=nlvdTIxtAYCEdBL21ccMnOE+BSAX/2yiE3wFKtIeH2A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Jpn/6Ga1jSLEu/cFyq2DIEP/8Q9JnaNCfZ1ErKwTWFzpyo06+3AI+4hCnJpOJAJVe qwV7jgzzvM/aJK0aVFGoZI9XZAHLF8wMusSfZxpaaXlV0sLtmEC3yUfh9bdHpxjX/H SwiPlgGKg8XElC621exg3s3vbLkESdREoxXTcyeI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 19/62] tcp: Fix data-races around sysctl_tcp_reordering. Date: Wed, 27 Jul 2022 18:10:28 +0200 Message-Id: <20220727161004.958032909@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 46778cd16e6a5ad1b2e3a91f6c057c907379418e ] While reading sysctl_tcp_reordering, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp.c | 2 +- net/ipv4/tcp_input.c | 10 +++++++--- net/ipv4/tcp_metrics.c | 3 ++- 3 files changed, 10 insertions(+), 5 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index f7795488b0ad..b1b121d5076c 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -436,7 +436,7 @@ void tcp_init_sock(struct sock *sk) tp->snd_cwnd_clamp =3D ~0; tp->mss_cache =3D TCP_MSS_DEFAULT; =20 - tp->reordering =3D sock_net(sk)->ipv4.sysctl_tcp_reordering; + tp->reordering =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering); tcp_assign_congestion_control(sk); =20 tp->tsoffset =3D 0; diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 92f5068c7680..afe195e03a95 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1982,6 +1982,7 @@ void tcp_enter_loss(struct sock *sk) struct tcp_sock *tp =3D tcp_sk(sk); struct net *net =3D sock_net(sk); bool new_recovery =3D icsk->icsk_ca_state < TCP_CA_Recovery; + u8 reordering; =20 tcp_timeout_mark_lost(sk); =20 @@ -2002,10 +2003,12 @@ void tcp_enter_loss(struct sock *sk) /* Timeout in disordered state after receiving substantial DUPACKs * suggests that the degree of reordering is over-estimated. */ + reordering =3D READ_ONCE(net->ipv4.sysctl_tcp_reordering); if (icsk->icsk_ca_state <=3D TCP_CA_Disorder && - tp->sacked_out >=3D net->ipv4.sysctl_tcp_reordering) + tp->sacked_out >=3D reordering) tp->reordering =3D min_t(unsigned int, tp->reordering, - net->ipv4.sysctl_tcp_reordering); + reordering); + tcp_set_ca_state(sk, TCP_CA_Loss); tp->high_seq =3D tp->snd_nxt; tcp_ecn_queue_cwr(tp); @@ -3303,7 +3306,8 @@ static inline bool tcp_may_raise_cwnd(const struct so= ck *sk, const int flag) * new SACK or ECE mark may first advance cwnd here and later reduce * cwnd in tcp_fastretrans_alert() based on more states. */ - if (tcp_sk(sk)->reordering > sock_net(sk)->ipv4.sysctl_tcp_reordering) + if (tcp_sk(sk)->reordering > + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reordering)) return flag & FLAG_FORWARD_PROGRESS; =20 return flag & FLAG_DATA_ACKED; diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c index 03b51cdcc731..61843c6d7a47 100644 --- a/net/ipv4/tcp_metrics.c +++ b/net/ipv4/tcp_metrics.c @@ -425,7 +425,8 @@ void tcp_update_metrics(struct sock *sk) if (!tcp_metric_locked(tm, TCP_METRIC_REORDERING)) { val =3D tcp_metric_get(tm, TCP_METRIC_REORDERING); if (val < tp->reordering && - tp->reordering !=3D net->ipv4.sysctl_tcp_reordering) + tp->reordering !=3D + READ_ONCE(net->ipv4.sysctl_tcp_reordering)) tcp_metric_set(tm, TCP_METRIC_REORDERING, tp->reordering); } --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AD122C04A68 for ; Wed, 27 Jul 2022 16:36:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238809AbiG0Qgp (ORCPT ); Wed, 27 Jul 2022 12:36:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47554 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235802AbiG0QfC (ORCPT ); Wed, 27 Jul 2022 12:35:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A2BD4F652; Wed, 27 Jul 2022 09:27:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1FFBE619D6; Wed, 27 Jul 2022 16:26:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 31EF8C433D7; Wed, 27 Jul 2022 16:26:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939209; bh=8CQ8rsKERdiu9+Ig5+Kfcc5GKHqTaAhILdolMlu++n4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=o/uWD2+z2fMKpTXuJzYjwYNHjKsykf+dSSdBCDTXxpx873jGnlaRDzKXeqMEFPFg6 NrPI1HtGAAR3hbSHY+q0D7IwdBzOfyEMgrECwW5lHxd0pDkR6DHKD+pfx1XMEqyaNo ztl3fU3hGkLhMPJUoac+VGjNmMfQO4rsKB2medAg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 20/62] tcp: Fix data-races around some timeout sysctl knobs. Date: Wed, 27 Jul 2022 18:10:29 +0200 Message-Id: <20220727161004.987834230@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 39e24435a776e9de5c6dd188836cf2523547804b ] While reading these sysctl knobs, they can be changed concurrently. Thus, we need to add READ_ONCE() to their readers. - tcp_retries1 - tcp_retries2 - tcp_orphan_retries - tcp_fin_timeout Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/tcp.h | 3 ++- net/ipv4/tcp.c | 2 +- net/ipv4/tcp_output.c | 2 +- net/ipv4/tcp_timer.c | 10 +++++----- 4 files changed, 9 insertions(+), 8 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 5c5807ed66ee..f92b93cf074c 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1430,7 +1430,8 @@ static inline u32 keepalive_time_elapsed(const struct= tcp_sock *tp) =20 static inline int tcp_fin_time(const struct sock *sk) { - int fin_timeout =3D tcp_sk(sk)->linger2 ? : sock_net(sk)->ipv4.sysctl_tcp= _fin_timeout; + int fin_timeout =3D tcp_sk(sk)->linger2 ? : + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fin_timeout); const int rto =3D inet_csk(sk)->icsk_rto; =20 if (fin_timeout < (rto << 2) - (rto >> 1)) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index b1b121d5076c..0f89d0f2c21f 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3386,7 +3386,7 @@ static int do_tcp_getsockopt(struct sock *sk, int lev= el, case TCP_LINGER2: val =3D tp->linger2; if (val >=3D 0) - val =3D (val ? : net->ipv4.sysctl_tcp_fin_timeout) / HZ; + val =3D (val ? : READ_ONCE(net->ipv4.sysctl_tcp_fin_timeout)) / HZ; break; case TCP_DEFER_ACCEPT: val =3D retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept, diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 33f9a486661c..3d5ea169e905 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -3776,7 +3776,7 @@ void tcp_send_probe0(struct sock *sk) } =20 if (err <=3D 0) { - if (icsk->icsk_backoff < net->ipv4.sysctl_tcp_retries2) + if (icsk->icsk_backoff < READ_ONCE(net->ipv4.sysctl_tcp_retries2)) icsk->icsk_backoff++; icsk->icsk_probes_out++; probe_max =3D TCP_RTO_MAX; diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index 5d761333ffc4..e905fff09fea 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -124,7 +124,7 @@ static int tcp_out_of_resources(struct sock *sk, bool d= o_reset) */ static int tcp_orphan_retries(struct sock *sk, bool alive) { - int retries =3D sock_net(sk)->ipv4.sysctl_tcp_orphan_retries; /* May be z= ero. */ + int retries =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_orphan_retries); = /* May be zero. */ =20 /* We know from an ICMP that something is wrong. */ if (sk->sk_err_soft && !alive) @@ -226,7 +226,7 @@ static int tcp_write_timeout(struct sock *sk) retry_until =3D icsk->icsk_syn_retries ? : net->ipv4.sysctl_tcp_syn_retr= ies; expired =3D icsk->icsk_retransmits >=3D retry_until; } else { - if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1, 0)) { + if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1), = 0)) { /* Black hole detection */ tcp_mtu_probing(icsk, sk); =20 @@ -235,7 +235,7 @@ static int tcp_write_timeout(struct sock *sk) sk_rethink_txhash(sk); } =20 - retry_until =3D net->ipv4.sysctl_tcp_retries2; + retry_until =3D READ_ONCE(net->ipv4.sysctl_tcp_retries2); if (sock_flag(sk, SOCK_DEAD)) { const bool alive =3D icsk->icsk_rto < TCP_RTO_MAX; =20 @@ -362,7 +362,7 @@ static void tcp_probe_timer(struct sock *sk) (s32)(tcp_time_stamp(tp) - start_ts) > icsk->icsk_user_timeout) goto abort; =20 - max_probes =3D sock_net(sk)->ipv4.sysctl_tcp_retries2; + max_probes =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retries2); if (sock_flag(sk, SOCK_DEAD)) { const bool alive =3D inet_csk_rto_backoff(icsk, TCP_RTO_MAX) < TCP_RTO_M= AX; =20 @@ -556,7 +556,7 @@ void tcp_retransmit_timer(struct sock *sk) } inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, tcp_clamp_rto_to_user_timeout(sk), TCP_RTO_MAX); - if (retransmits_timed_out(sk, net->ipv4.sysctl_tcp_retries1 + 1, 0)) + if (retransmits_timed_out(sk, READ_ONCE(net->ipv4.sysctl_tcp_retries1) + = 1, 0)) __sk_dst_reset(sk); =20 out:; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D50ADC19F28 for ; Wed, 27 Jul 2022 16:35:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238332AbiG0Qfm (ORCPT ); Wed, 27 Jul 2022 12:35:42 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237598AbiG0QeD (ORCPT ); Wed, 27 Jul 2022 12:34:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2C7B955081; Wed, 27 Jul 2022 09:26:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 073B2619F6; Wed, 27 Jul 2022 16:26:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0B78AC433D6; Wed, 27 Jul 2022 16:26:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939212; bh=litbR69duY36rJVkPTx9ttxUI4b+oSyRTS99K/GfFUk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=q2DT0i7fd4GdqOBo+c3dQ368jgRx/R/ZIujjXUHDAOU2Lx1cj+8Ux1ZNfuZBGQmdv //MZoyiZq5WeG0I4U/BkHndQxHFo+J4brJJvOhX/NbRB3CA2jCwOxrVTEl9bHYZGnE caEWScgGP7avb89K0DK46zhY3edaSvC6ShlpnbVk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 21/62] tcp: Fix a data-race around sysctl_tcp_notsent_lowat. Date: Wed, 27 Jul 2022 18:10:30 +0200 Message-Id: <20220727161005.019894926@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 55be873695ed8912eb77ff46d1d1cadf028bd0f3 ] While reading sysctl_tcp_notsent_lowat, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/tcp.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index f92b93cf074c..9b1bf1567861 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1876,7 +1876,7 @@ void __tcp_v4_send_check(struct sk_buff *skb, __be32 = saddr, __be32 daddr); static inline u32 tcp_notsent_lowat(const struct tcp_sock *tp) { struct net *net =3D sock_net((struct sock *)tp); - return tp->notsent_lowat ?: net->ipv4.sysctl_tcp_notsent_lowat; + return tp->notsent_lowat ?: READ_ONCE(net->ipv4.sysctl_tcp_notsent_lowat); } =20 static inline bool tcp_stream_memory_free(const struct sock *sk) --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5D285C04A68 for ; Wed, 27 Jul 2022 16:35:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238400AbiG0Qfr (ORCPT ); Wed, 27 Jul 2022 12:35:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238132AbiG0QeF (ORCPT ); Wed, 27 Jul 2022 12:34:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2A0AA55097; Wed, 27 Jul 2022 09:26:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D5DDD619FE; Wed, 27 Jul 2022 16:26:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DE72AC433C1; Wed, 27 Jul 2022 16:26:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939215; bh=dMztBhjROoIEkA2hYgIClMgpARqNyyRZ4ceGRDt6saI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Gxqoh2ucWtV/1sM/KWDtA1PN1doslhJAJc1BhCRxwR77MjC2DiM6l2sKUxHLqwjNk yDc7ZIfUVxTqSAQOkYtwX8d4MmXTSw1gxSUqe9Xtta5j76B9OKs548WIAoK3JPXMQm Qya7Zfq+GVgfZYQms2Fo8ADVa+bsHbLjZYvqpdEg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 22/62] tcp: Fix a data-race around sysctl_tcp_tw_reuse. Date: Wed, 27 Jul 2022 18:10:31 +0200 Message-Id: <20220727161005.059321286@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit cbfc6495586a3f09f6f07d9fb3c7cafe807e3c55 ] While reading sysctl_tcp_tw_reuse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_ipv4.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index 2719c60f285b..ddc1af8731e3 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -110,10 +110,10 @@ static u32 tcp_v4_init_ts_off(const struct net *net, = const struct sk_buff *skb) =20 int tcp_twsk_unique(struct sock *sk, struct sock *sktw, void *twp) { + int reuse =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_tw_reuse); const struct inet_timewait_sock *tw =3D inet_twsk(sktw); const struct tcp_timewait_sock *tcptw =3D tcp_twsk(sktw); struct tcp_sock *tp =3D tcp_sk(sk); - int reuse =3D sock_net(sk)->ipv4.sysctl_tcp_tw_reuse; =20 if (reuse =3D=3D 2) { /* Still does not detect *everything* that goes through --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F0A80C04A68 for ; Wed, 27 Jul 2022 16:36:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238759AbiG0Qgh (ORCPT ); Wed, 27 Jul 2022 12:36:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46966 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239108AbiG0Qew (ORCPT ); Wed, 27 Jul 2022 12:34:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 441352BB14; Wed, 27 Jul 2022 09:27:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2F08D61662; Wed, 27 Jul 2022 16:26:59 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BCD50C433D7; Wed, 27 Jul 2022 16:26:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939218; bh=bHWOYzOT2Xrewl7+mdQEPqZaXcMv9WJSN1IRkhw5VDU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=z4JBFjGqQtnd+aol6GhBheIzomySszI73XCwcImk+yX3H5zYCeTDL9WNiO4uTZk7j EV8rqdukFahPpzMunE0cpF1OiwUvDgvw6cp0T7Fk4ZJRVOERY/p1LnGicTZEmP1ikn 7c+dkDD0hD7CY0pmC6QfwXXIf54VdsXqJezMs/CQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , Yuchung Cheng , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 23/62] tcp: Fix data-races around sysctl_tcp_fastopen. Date: Wed, 27 Jul 2022 18:10:32 +0200 Message-Id: <20220727161005.109101571@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 5a54213318c43f4009ae158347aa6016e3b9b55a ] While reading sysctl_tcp_fastopen, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 2100c8d2d9db ("net-tcp: Fast Open base") Signed-off-by: Kuniyuki Iwashima Acked-by: Yuchung Cheng Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/af_inet.c | 2 +- net/ipv4/tcp.c | 6 ++++-- net/ipv4/tcp_fastopen.c | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index dadd42a07c07..229519001cc3 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -218,7 +218,7 @@ int inet_listen(struct socket *sock, int backlog) * because the socket was in TCP_LISTEN state previously but * was shutdown() rather than close(). */ - tcp_fastopen =3D sock_net(sk)->ipv4.sysctl_tcp_fastopen; + tcp_fastopen =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen); if ((tcp_fastopen & TFO_SERVER_WO_SOCKOPT1) && (tcp_fastopen & TFO_SERVER_ENABLE) && !inet_csk(sk)->icsk_accept_queue.fastopenq.max_qlen) { diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 0f89d0f2c21f..7acc0d07f148 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -1160,7 +1160,8 @@ static int tcp_sendmsg_fastopen(struct sock *sk, stru= ct msghdr *msg, struct sockaddr *uaddr =3D msg->msg_name; int err, flags; =20 - if (!(sock_net(sk)->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) || + if (!(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen) & + TFO_CLIENT_ENABLE) || (uaddr && msg->msg_namelen >=3D sizeof(uaddr->sa_family) && uaddr->sa_family =3D=3D AF_UNSPEC)) return -EOPNOTSUPP; @@ -3056,7 +3057,8 @@ static int do_tcp_setsockopt(struct sock *sk, int lev= el, case TCP_FASTOPEN_CONNECT: if (val > 1 || val < 0) { err =3D -EINVAL; - } else if (net->ipv4.sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) { + } else if (READ_ONCE(net->ipv4.sysctl_tcp_fastopen) & + TFO_CLIENT_ENABLE) { if (sk->sk_state =3D=3D TCP_CLOSE) tp->fastopen_connect =3D val; else diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c index 119d2c2f3b04..f726591de7c7 100644 --- a/net/ipv4/tcp_fastopen.c +++ b/net/ipv4/tcp_fastopen.c @@ -313,7 +313,7 @@ static bool tcp_fastopen_no_cookie(const struct sock *s= k, const struct dst_entry *dst, int flag) { - return (sock_net(sk)->ipv4.sysctl_tcp_fastopen & flag) || + return (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen) & flag) || tcp_sk(sk)->fastopen_no_cookie || (dst && dst_metric(dst, RTAX_FASTOPEN_NO_COOKIE)); } @@ -328,7 +328,7 @@ struct sock *tcp_try_fastopen(struct sock *sk, struct s= k_buff *skb, const struct dst_entry *dst) { bool syn_data =3D TCP_SKB_CB(skb)->end_seq !=3D TCP_SKB_CB(skb)->seq + 1; - int tcp_fastopen =3D sock_net(sk)->ipv4.sysctl_tcp_fastopen; + int tcp_fastopen =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_fastopen); struct tcp_fastopen_cookie valid_foc =3D { .len =3D -1 }; struct sock *child; =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7AD5EC04A68 for ; Wed, 27 Jul 2022 16:33:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238075AbiG0QdZ (ORCPT ); Wed, 27 Jul 2022 12:33:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34608 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237598AbiG0Qcv (ORCPT ); Wed, 27 Jul 2022 12:32:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 307775466C; Wed, 27 Jul 2022 09:26:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2199EB821C6; Wed, 27 Jul 2022 16:25:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 746ADC433C1; Wed, 27 Jul 2022 16:25:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939130; bh=BBk1kyASzUYpYQ+fLeaHuVmb7y3xxhjn1vuem2RYH+c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iybAJG7TTS49BdnPcZ1YWLvZN7FhvYSiNEGk7k9RUoiibTLLKgioLHrulUv48pBeo rz1jfxhdfudXuBMxnrALPGabUCo9jdwUDKcFPDiKQXTKV1UDk1aJ5QOLCPhiLinlsZ bHdji69jmPMmjI24UCtJTGhDhaOahzg2b3brWavU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hristo Venev , Paolo Abeni , Sasha Levin Subject: [PATCH 4.19 24/62] be2net: Fix buffer overflow in be_get_module_eeprom Date: Wed, 27 Jul 2022 18:10:33 +0200 Message-Id: <20220727161005.139756517@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hristo Venev [ Upstream commit d7241f679a59cfe27f92cb5c6272cb429fb1f7ec ] be_cmd_read_port_transceiver_data assumes that it is given a buffer that is at least PAGE_DATA_LEN long, or twice that if the module supports SFF 8472. However, this is not always the case. Fix this by passing the desired offset and length to be_cmd_read_port_transceiver_data so that we only copy the bytes once. Fixes: e36edd9d26cf ("be2net: add ethtool "-m" option support") Signed-off-by: Hristo Venev Link: https://lore.kernel.org/r/20220716085134.6095-1-hristo@venev.name Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/ethernet/emulex/benet/be_cmds.c | 10 +++--- drivers/net/ethernet/emulex/benet/be_cmds.h | 2 +- .../net/ethernet/emulex/benet/be_ethtool.c | 31 ++++++++++++------- 3 files changed, 25 insertions(+), 18 deletions(-) diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethe= rnet/emulex/benet/be_cmds.c index 1e9d882c04ef..a4a448d97451 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.c +++ b/drivers/net/ethernet/emulex/benet/be_cmds.c @@ -2291,7 +2291,7 @@ int be_cmd_get_beacon_state(struct be_adapter *adapte= r, u8 port_num, u32 *state) =20 /* Uses sync mcc */ int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data) + u8 page_num, u32 off, u32 len, u8 *data) { struct be_dma_mem cmd; struct be_mcc_wrb *wrb; @@ -2325,10 +2325,10 @@ int be_cmd_read_port_transceiver_data(struct be_ada= pter *adapter, req->port =3D cpu_to_le32(adapter->hba_port_num); req->page_num =3D cpu_to_le32(page_num); status =3D be_mcc_notify_wait(adapter); - if (!status) { + if (!status && len > 0) { struct be_cmd_resp_port_type *resp =3D cmd.va; =20 - memcpy(data, resp->page_data, PAGE_DATA_LEN); + memcpy(data, resp->page_data + off, len); } err: mutex_unlock(&adapter->mcc_lock); @@ -2419,7 +2419,7 @@ int be_cmd_query_cable_type(struct be_adapter *adapte= r) int status; =20 status =3D be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { switch (adapter->phy.interface_type) { case PHY_TYPE_QSFP: @@ -2444,7 +2444,7 @@ int be_cmd_query_sfp_info(struct be_adapter *adapter) int status; =20 status =3D be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { strlcpy(adapter->phy.vendor_name, page_data + SFP_VENDOR_NAME_OFFSET, SFP_VENDOR_NAME_LEN - 1); diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.h b/drivers/net/ethe= rnet/emulex/benet/be_cmds.h index e8b43cf44b6f..f6f9c51a7d47 100644 --- a/drivers/net/ethernet/emulex/benet/be_cmds.h +++ b/drivers/net/ethernet/emulex/benet/be_cmds.h @@ -2431,7 +2431,7 @@ int be_cmd_set_beacon_state(struct be_adapter *adapte= r, u8 port_num, u8 beacon, int be_cmd_get_beacon_state(struct be_adapter *adapter, u8 port_num, u32 *state); int be_cmd_read_port_transceiver_data(struct be_adapter *adapter, - u8 page_num, u8 *data); + u8 page_num, u32 off, u32 len, u8 *data); int be_cmd_query_cable_type(struct be_adapter *adapter); int be_cmd_query_sfp_info(struct be_adapter *adapter); int lancer_cmd_read_object(struct be_adapter *adapter, struct be_dma_mem *= cmd, diff --git a/drivers/net/ethernet/emulex/benet/be_ethtool.c b/drivers/net/e= thernet/emulex/benet/be_ethtool.c index d1905d50c26c..1c1ac3488da2 100644 --- a/drivers/net/ethernet/emulex/benet/be_ethtool.c +++ b/drivers/net/ethernet/emulex/benet/be_ethtool.c @@ -1342,7 +1342,7 @@ static int be_get_module_info(struct net_device *netd= ev, return -EOPNOTSUPP; =20 status =3D be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - page_data); + 0, PAGE_DATA_LEN, page_data); if (!status) { if (!page_data[SFP_PLUS_SFF_8472_COMP]) { modinfo->type =3D ETH_MODULE_SFF_8079; @@ -1360,25 +1360,32 @@ static int be_get_module_eeprom(struct net_device *= netdev, { struct be_adapter *adapter =3D netdev_priv(netdev); int status; + u32 begin, end; =20 if (!check_privilege(adapter, MAX_PRIVILEGES)) return -EOPNOTSUPP; =20 - status =3D be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, - data); - if (status) - goto err; + begin =3D eeprom->offset; + end =3D eeprom->offset + eeprom->len; + + if (begin < PAGE_DATA_LEN) { + status =3D be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A0, begin, + min_t(u32, end, PAGE_DATA_LEN) - begin, + data); + if (status) + goto err; + + data +=3D PAGE_DATA_LEN - begin; + begin =3D PAGE_DATA_LEN; + } =20 - if (eeprom->offset + eeprom->len > PAGE_DATA_LEN) { - status =3D be_cmd_read_port_transceiver_data(adapter, - TR_PAGE_A2, - data + - PAGE_DATA_LEN); + if (end > PAGE_DATA_LEN) { + status =3D be_cmd_read_port_transceiver_data(adapter, TR_PAGE_A2, + begin - PAGE_DATA_LEN, + end - begin, data); if (status) goto err; } - if (eeprom->offset) - memcpy(data, data + eeprom->offset, eeprom->len); err: return be_cmd_status(status); } --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CA9AAC19F28 for ; Wed, 27 Jul 2022 16:33:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237477AbiG0Qdn (ORCPT ); Wed, 27 Jul 2022 12:33:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237737AbiG0QdF (ORCPT ); Wed, 27 Jul 2022 12:33:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F42024E878; Wed, 27 Jul 2022 09:26:29 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6D4D9619FE; Wed, 27 Jul 2022 16:25:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 748DEC433C1; Wed, 27 Jul 2022 16:25:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939133; bh=/f09EqkA8ylK2cgveU08oawcKEHfM+5sXxQirEs8kZ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JW554foM8SxUYOgHSGMKqV4X5nhWYVUBhWItwd0xFmTD1VcU/e30s7jhSbBv70uoW jzux9Ydkj5DFQpkMCF1HbxdZDeQwj47vjSkjGbvGQSQi8laQSwrplFUuWQSyuJmsMm grMufSLQKVkmqxHkiA/FsAS8xRLvu0pxPcuRxfp4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 25/62] tcp: Fix a data-race around sysctl_tcp_early_retrans. Date: Wed, 27 Jul 2022 18:10:34 +0200 Message-Id: <20220727161005.188759957@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 52e65865deb6a36718a463030500f16530eaab74 ] While reading sysctl_tcp_early_retrans, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: eed530b6c676 ("tcp: early retransmit") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 3d5ea169e905..8dcb9484a20c 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2454,7 +2454,7 @@ bool tcp_schedule_loss_probe(struct sock *sk, bool ad= vancing_rto) if (tp->fastopen_rsk) return false; =20 - early_retrans =3D sock_net(sk)->ipv4.sysctl_tcp_early_retrans; + early_retrans =3D READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_early_retrans); /* Schedule a loss probe in 2*RTT for SACK capable connections * not in loss recovery, that are either limited by cwnd or application. */ --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 483D9C04A68 for ; Wed, 27 Jul 2022 16:32:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237846AbiG0Qc2 (ORCPT ); Wed, 27 Jul 2022 12:32:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:33062 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235592AbiG0QcA (ORCPT ); Wed, 27 Jul 2022 12:32:00 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CBD6652FCB; Wed, 27 Jul 2022 09:25:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0007FB821BF; Wed, 27 Jul 2022 16:25:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 58435C43140; Wed, 27 Jul 2022 16:25:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939136; bh=Ah/hhKtg8RhQI3Os/uogsJTfd+tyUxBuQgNvDHm/FgY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zJx3f9KzrxlNlWUdTEz5KF4YsKO9vnmm/5qIDESWgL7TvPaFvCg6oMqPKliLUIF2K Tu8tzwJ2O7pi1ui5JroK/z9ru4m+3jjr0yuiHXQZXGrze4cGSwtD3XwY4YZ98QDgAh npXrqa2PGTB9IILcth6jAywkMj0velmPR/wT/itE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 26/62] tcp: Fix data-races around sysctl_tcp_recovery. Date: Wed, 27 Jul 2022 18:10:35 +0200 Message-Id: <20220727161005.221488139@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit e7d2ef837e14a971a05f60ea08c47f3fed1a36e4 ] While reading sysctl_tcp_recovery, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 4f41b1c58a32 ("tcp: use RACK to detect losses") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 3 ++- net/ipv4/tcp_recovery.c | 6 ++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index afe195e03a95..731c4d220905 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -1938,7 +1938,8 @@ static inline void tcp_init_undo(struct tcp_sock *tp) =20 static bool tcp_is_rack(const struct sock *sk) { - return sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_LOSS_DETECTION; + return READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) & + TCP_RACK_LOSS_DETECTION; } =20 /* If we detect SACK reneging, forget all SACK information diff --git a/net/ipv4/tcp_recovery.c b/net/ipv4/tcp_recovery.c index 0d96decba13d..61969bb9395c 100644 --- a/net/ipv4/tcp_recovery.c +++ b/net/ipv4/tcp_recovery.c @@ -33,7 +33,8 @@ static u32 tcp_rack_reo_wnd(const struct sock *sk) return 0; =20 if (tp->sacked_out >=3D tp->reordering && - !(sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_NO_DUPTHRESH)) + !(READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) & + TCP_RACK_NO_DUPTHRESH)) return 0; } =20 @@ -203,7 +204,8 @@ void tcp_rack_update_reo_wnd(struct sock *sk, struct ra= te_sample *rs) { struct tcp_sock *tp =3D tcp_sk(sk); =20 - if (sock_net(sk)->ipv4.sysctl_tcp_recovery & TCP_RACK_STATIC_REO_WND || + if ((READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_recovery) & + TCP_RACK_STATIC_REO_WND) || !rs->prior_delivered) return; =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6CE36C04A68 for ; Wed, 27 Jul 2022 16:32:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237908AbiG0Qcl (ORCPT ); Wed, 27 Jul 2022 12:32:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35184 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236935AbiG0QcG (ORCPT ); Wed, 27 Jul 2022 12:32:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 34A8552FDF; Wed, 27 Jul 2022 09:26:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 17A21617EF; Wed, 27 Jul 2022 16:25:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1EB66C433D7; Wed, 27 Jul 2022 16:25:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939139; bh=JHKJX3usD8Fg2C/Jq73gl9xKHcWlTsI1XEBlqA5VTpc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wfeQL5W1U3DrYoj6cw6706LWQsZTvTVTIem+5MoJ5JT2eYv0UbP4PexrfL5VpY63t w5gQmUxuhvc+1V4xphKGYJ5h/MsnP0lQStyxCBxtXJ8jjkBEOsTzAqvIOhYk70iG5F JGgAPMQghPTeQCxnSXzYN0CNAO7kyKKSLO7TH080= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 27/62] tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. Date: Wed, 27 Jul 2022 18:10:36 +0200 Message-Id: <20220727161005.271518041@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 7c6f2a86ca590d5187a073d987e9599985fb1c7c ] While reading sysctl_tcp_thin_linear_timeouts, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 36e31b0af587 ("net: TCP thin linear timeouts") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_timer.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c index e905fff09fea..84069db0423a 100644 --- a/net/ipv4/tcp_timer.c +++ b/net/ipv4/tcp_timer.c @@ -545,7 +545,7 @@ void tcp_retransmit_timer(struct sock *sk) * linear-timeout retransmissions into a black hole */ if (sk->sk_state =3D=3D TCP_ESTABLISHED && - (tp->thin_lto || net->ipv4.sysctl_tcp_thin_linear_timeouts) && + (tp->thin_lto || READ_ONCE(net->ipv4.sysctl_tcp_thin_linear_timeouts)= ) && tcp_stream_is_thin(tp) && icsk->icsk_retransmits <=3D TCP_THIN_LINEAR_RETRIES) { icsk->icsk_backoff =3D 0; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CCB2BC04A68 for ; Wed, 27 Jul 2022 16:32:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237627AbiG0Qcv (ORCPT ); Wed, 27 Jul 2022 12:32:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34488 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237137AbiG0QcJ (ORCPT ); Wed, 27 Jul 2022 12:32:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 96FAA4E842; Wed, 27 Jul 2022 09:26:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C8EB5619FF; Wed, 27 Jul 2022 16:25:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D68A8C433C1; Wed, 27 Jul 2022 16:25:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939142; bh=scXYP/FW6QAMrU5amOioIXw6fu+7zQRpdpnHXwy0Fpc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lexCEtf1N5etsv04yP5/fUSE7+Ikq7H8yszVbZzhAdn6P1vrF6x1BkTwF4v+Bs0+H hcU/rTLISs1aA/kbxVqgbTudfTLPWcM5YFoVPrpUwJ581cb/hJsMcffNR9O5+DZE08 cgmA4m9V77k4rNhiKshOHzyoK9noMrnbT03yuDFA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 28/62] tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. Date: Wed, 27 Jul 2022 18:10:37 +0200 Message-Id: <20220727161005.311596158@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 4845b5713ab18a1bb6e31d1fbb4d600240b8b691 ] While reading sysctl_tcp_slow_start_after_idle, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: 35089bb203f4 ("[TCP]: Add tcp_slow_start_after_idle sysctl.") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/tcp.h | 4 ++-- net/ipv4/tcp_output.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/include/net/tcp.h b/include/net/tcp.h index 9b1bf1567861..d28fa78dedb5 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -1339,8 +1339,8 @@ static inline void tcp_slow_start_after_idle_check(st= ruct sock *sk) struct tcp_sock *tp =3D tcp_sk(sk); s32 delta; =20 - if (!sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle || tp->packets_o= ut || - ca_ops->cong_control) + if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle) || + tp->packets_out || ca_ops->cong_control) return; delta =3D tcp_jiffies32 - tp->lsndtime; if (delta > inet_csk(sk)->icsk_rto) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 8dcb9484a20c..3b416dfb8aff 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -1658,7 +1658,7 @@ static void tcp_cwnd_validate(struct sock *sk, bool i= s_cwnd_limited) if (tp->packets_out > tp->snd_cwnd_used) tp->snd_cwnd_used =3D tp->packets_out; =20 - if (sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle && + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_slow_start_after_idle) && (s32)(tcp_jiffies32 - tp->snd_cwnd_stamp) >=3D inet_csk(sk)->icsk_rt= o && !ca_ops->cong_control) tcp_cwnd_application_limited(sk); --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BAB27C04A68 for ; Wed, 27 Jul 2022 16:32:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235313AbiG0Qc4 (ORCPT ); Wed, 27 Jul 2022 12:32:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34556 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237685AbiG0QcY (ORCPT ); Wed, 27 Jul 2022 12:32:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 390004E868; Wed, 27 Jul 2022 09:26:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 359ABB821BC; Wed, 27 Jul 2022 16:25:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 943BFC433C1; Wed, 27 Jul 2022 16:25:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939145; bh=GH8X8H40DZmlNZYLKIumjz4WqGqR3FFDqpyqZxYZORs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=RyhA2VrYkeIvDfsc5SVs4xizTr50k2baTSKCDWOl/p6P3RwHv8LN8GLYPq+E6xYNa 8tnPvFd5pL0q3fKQHKvIDKwfBLGCRPxakWhZqXcHWsgq09LvcwA9gtp3YuLSt0BaS9 nLuOtXmzoLe13zMImDiSVVEw3o99AnNPyhSYKlGU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 29/62] tcp: Fix a data-race around sysctl_tcp_retrans_collapse. Date: Wed, 27 Jul 2022 18:10:38 +0200 Message-Id: <20220727161005.350741940@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 1a63cb91f0c2fcdeced6d6edee8d1d886583d139 ] While reading sysctl_tcp_retrans_collapse, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_output.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c index 3b416dfb8aff..13d9e8570ce5 100644 --- a/net/ipv4/tcp_output.c +++ b/net/ipv4/tcp_output.c @@ -2816,7 +2816,7 @@ static void tcp_retrans_try_collapse(struct sock *sk,= struct sk_buff *to, struct sk_buff *skb =3D to, *tmp; bool first =3D true; =20 - if (!sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse) + if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_retrans_collapse)) return; if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN) return; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 71ABFC04A68 for ; Wed, 27 Jul 2022 16:35:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238456AbiG0Qfb (ORCPT ); Wed, 27 Jul 2022 12:35:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47608 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237948AbiG0Qd7 (ORCPT ); Wed, 27 Jul 2022 12:33:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9AC8E54CA2; Wed, 27 Jul 2022 09:26:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 2B95FB821BE; Wed, 27 Jul 2022 16:25:49 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6058BC433C1; Wed, 27 Jul 2022 16:25:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939147; bh=ZfemfIdXq7/HvQDmRDnhv6Y/L+qAEtaf6wJBBzpCc9o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CFOs0hUjmFaYCRhbHrY5WMfm2lJ5eeYayHzq4C2ElXmekoYWElaXJWVP3pucGfAbI m//8PpSZpQnMhLnjWz5UP0/8yQj1Sa24b+tOLpQNWXG6PI8ij27cwLYHE3INoOuK03 PxwvWI9kGgIaQKZx9LdS5fjWiVU5BKMZpwHRxcq4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 30/62] tcp: Fix a data-race around sysctl_tcp_stdurg. Date: Wed, 27 Jul 2022 18:10:39 +0200 Message-Id: <20220727161005.392552075@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 4e08ed41cb1194009fc1a916a59ce3ed4afd77cd ] While reading sysctl_tcp_stdurg, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 731c4d220905..3b63e05c3486 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -5292,7 +5292,7 @@ static void tcp_check_urg(struct sock *sk, const stru= ct tcphdr *th) struct tcp_sock *tp =3D tcp_sk(sk); u32 ptr =3D ntohs(th->urg_ptr); =20 - if (ptr && !sock_net(sk)->ipv4.sysctl_tcp_stdurg) + if (ptr && !READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_stdurg)) ptr--; ptr +=3D ntohl(th->seq); =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F77DC04A68 for ; Wed, 27 Jul 2022 16:33:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238139AbiG0Qdy (ORCPT ); Wed, 27 Jul 2022 12:33:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238005AbiG0QdL (ORCPT ); Wed, 27 Jul 2022 12:33:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E83D954AD8; Wed, 27 Jul 2022 09:26:33 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4AC9F619F4; Wed, 27 Jul 2022 16:25:51 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5B6C8C433D6; Wed, 27 Jul 2022 16:25:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939150; bh=GVhiRHeFmRLaJSQR+9CUNcGEIJ51CMR122AWgZTvISw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=AV7BCfmX7J8ENsgRmBNKJnRB5eNgQDiJQgZvD6y+lzpmtSiv4ntv387YzblQURDOd cVCM95xPNpAo9VYK95Z6JnLtaDOBCS0fwRPcwzByDGhFW21b4a0nMs9Le8oh20K3dT K1tZeZLN/nxLaWX6ukL9DtcSRShSDcQHqyUipcGQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 31/62] tcp: Fix a data-race around sysctl_tcp_rfc1337. Date: Wed, 27 Jul 2022 18:10:40 +0200 Message-Id: <20220727161005.433650475@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit 0b484c91911e758e53656d570de58c2ed81ec6f2 ] While reading sysctl_tcp_rfc1337, it can be changed concurrently. Thus, we need to add READ_ONCE() to its reader. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_minisocks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index c79cb949da66..0fc238d79b03 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -179,7 +179,7 @@ tcp_timewait_state_process(struct inet_timewait_sock *t= w, struct sk_buff *skb, * Oh well... nobody has a sufficient solution to this * protocol bug yet. */ - if (twsk_net(tw)->ipv4.sysctl_tcp_rfc1337 =3D=3D 0) { + if (!READ_ONCE(twsk_net(tw)->ipv4.sysctl_tcp_rfc1337)) { kill: inet_twsk_deschedule_put(tw); return TCP_TW_SUCCESS; --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82688C19F28 for ; Wed, 27 Jul 2022 16:33:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237954AbiG0QdP (ORCPT ); Wed, 27 Jul 2022 12:33:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34420 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236935AbiG0Qcq (ORCPT ); Wed, 27 Jul 2022 12:32:46 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 21B8453D3F; Wed, 27 Jul 2022 09:26:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 367EECE22FE; Wed, 27 Jul 2022 16:25:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 499D1C433D6; Wed, 27 Jul 2022 16:25:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939153; bh=L7lMBsBoieeJ4Z5Ul1uqgHY3s6Ia9S2f7PSI0ziw88o=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=snMDszp4lj4ALHG0ujvIeg+OWYDnk7Uw/xuOOI6JLDRc3sdXSIlJdB5yMl7T6CmLt kNzF3VWn1DcII7oNFd1AlHN3Hge+PD6zxZQIAjenQppG1Cb8N4WUAIfrlPOhC2K8mu Kzhi8I8x/zQQDnEFia/S5BTiuhmJzR3rfegUzjik= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Kuniyuki Iwashima , "David S. Miller" , Sasha Levin Subject: [PATCH 4.19 32/62] tcp: Fix data-races around sysctl_tcp_max_reordering. Date: Wed, 27 Jul 2022 18:10:41 +0200 Message-Id: <20220727161005.465160454@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Kuniyuki Iwashima [ Upstream commit a11e5b3e7a59fde1a90b0eaeaa82320495cf8cae ] While reading sysctl_tcp_max_reordering, it can be changed concurrently. Thus, we need to add READ_ONCE() to its readers. Fixes: dca145ffaa8d ("tcp: allow for bigger reordering level") Signed-off-by: Kuniyuki Iwashima Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index 3b63e05c3486..26f0994da31b 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -893,7 +893,7 @@ static void tcp_check_sack_reordering(struct sock *sk, = const u32 low_seq, tp->undo_marker ? tp->undo_retrans : 0); #endif tp->reordering =3D min_t(u32, (metric + mss - 1) / mss, - sock_net(sk)->ipv4.sysctl_tcp_max_reordering); + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_max_reordering)); } =20 /* This exciting event is worth to be remembered. 8) */ @@ -1878,7 +1878,7 @@ static void tcp_check_reno_reordering(struct sock *sk= , const int addend) return; =20 tp->reordering =3D min_t(u32, tp->packets_out + addend, - sock_net(sk)->ipv4.sysctl_tcp_max_reordering); + READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_max_reordering)); tp->reord_seen++; NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPRENOREORDER); } --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DA311C19F28 for ; Wed, 27 Jul 2022 16:35:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238159AbiG0QfP (ORCPT ); Wed, 27 Jul 2022 12:35:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237301AbiG0Qds (ORCPT ); Wed, 27 Jul 2022 12:33:48 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BEB7E4D4C2; Wed, 27 Jul 2022 09:26:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1DB26619FD; Wed, 27 Jul 2022 16:25:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EFFDCC433C1; Wed, 27 Jul 2022 16:25:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939156; bh=TaTB8GRVljmqGovaTLx5QRJ/B7bQxZgLx0Nf/yBLeLU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=g+cb1140ZcSUceUi/P42dImNcPFLjT5uehstrdg0VnGYEVsJc4opllTH5fdcARoV2 M5fTibyPNGf3Q0z2lK30ELRj60C5Pb9MhLhHxEcl6Tdg1ADQWl5h/TG4voY4+nelZY 78SGQl0EcT1gnTW6ckPBjBOdvlZMtXTr/TeSRqys= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sergey Senozhatsky , Qian Cai , Lech Perczak , Theodore Tso , Sasha Levin , Petr Mladek , John Ogness , kernel test robot , "Jason A. Donenfeld" Subject: [PATCH 4.19 33/62] Revert "Revert "char/random: silence a lockdep splat with printk()"" Date: Wed, 27 Jul 2022 18:10:42 +0200 Message-Id: <20220727161005.505206431@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: "Jason A. Donenfeld" In 2019, Sergey fixed a lockdep splat with 15341b1dd409 ("char/random: silence a lockdep splat with printk()"), but that got reverted soon after from 4.19 because back then it apparently caused various problems. But the issue it was fixing is still there, and more generally, many patches turning printk() into printk_deferred() have landed since, making me suspect it's okay to try this out again. This should fix the following deadlock found by the kernel test robot: [ 18.287691] WARNING: possible circular locking dependency detected [ 18.287692] 4.19.248-00165-g3d1f971aa81f #1 Not tainted [ 18.287693] ------------------------------------------------------ [ 18.287712] stop/202 is trying to acquire lock: [ 18.287713] (ptrval) (console_owner){..-.}, at: console_unlock (??:?) [ 18.287717] [ 18.287718] but task is already holding lock: [ 18.287718] (ptrval) (&(&port->lock)->rlock){-...}, at: pty_write (pty.c= :?) [ 18.287722] [ 18.287722] which lock already depends on the new lock. [ 18.287723] [ 18.287724] [ 18.287725] the existing dependency chain (in reverse order) is: [ 18.287725] [ 18.287726] -> #2 (&(&port->lock)->rlock){-...}: [ 18.287729] validate_chain+0x84a/0xe00 [ 18.287729] __lock_acquire (lockdep.c:?) [ 18.287730] lock_acquire (??:?) [ 18.287731] _raw_spin_lock_irqsave (??:?) [ 18.287732] tty_port_tty_get (??:?) [ 18.287733] tty_port_default_wakeup (tty_port.c:?) [ 18.287734] tty_port_tty_wakeup (??:?) [ 18.287734] uart_write_wakeup (??:?) [ 18.287735] serial8250_tx_chars (??:?) [ 18.287736] serial8250_handle_irq (??:?) [ 18.287737] serial8250_default_handle_irq (8250_port.c:?) [ 18.287738] serial8250_interrupt (8250_core.c:?) [ 18.287738] __handle_irq_event_percpu (??:?) [ 18.287739] handle_irq_event_percpu (??:?) [ 18.287740] handle_irq_event (??:?) [ 18.287741] handle_edge_irq (??:?) [ 18.287742] handle_irq (??:?) [ 18.287742] do_IRQ (??:?) [ 18.287743] common_interrupt (entry_32.o:?) [ 18.287744] _raw_spin_unlock_irqrestore (??:?) [ 18.287745] uart_write (serial_core.c:?) [ 18.287746] process_output_block (n_tty.c:?) [ 18.287747] n_tty_write (n_tty.c:?) [ 18.287747] tty_write (tty_io.c:?) [ 18.287748] __vfs_write (??:?) [ 18.287749] vfs_write (??:?) [ 18.287750] ksys_write (??:?) [ 18.287750] sys_write (??:?) [ 18.287751] do_fast_syscall_32 (??:?) [ 18.287752] entry_SYSENTER_32 (??:?) [ 18.287752] [ 18.287753] -> #1 (&port_lock_key){-.-.}: [ 18.287756] [ 18.287756] -> #0 (console_owner){..-.}: [ 18.287759] check_prevs_add (lockdep.c:?) [ 18.287760] validate_chain+0x84a/0xe00 [ 18.287761] __lock_acquire (lockdep.c:?) [ 18.287761] lock_acquire (??:?) [ 18.287762] console_unlock (??:?) [ 18.287763] vprintk_emit (??:?) [ 18.287764] vprintk_default (??:?) [ 18.287764] vprintk_func (??:?) [ 18.287765] printk (??:?) [ 18.287766] get_random_u32 (??:?) [ 18.287767] shuffle_freelist (slub.c:?) [ 18.287767] allocate_slab (slub.c:?) [ 18.287768] new_slab (slub.c:?) [ 18.287769] ___slab_alloc+0x6d0/0xb20 [ 18.287770] __slab_alloc+0xd6/0x2e0 [ 18.287770] __kmalloc (??:?) [ 18.287771] tty_buffer_alloc (tty_buffer.c:?) [ 18.287772] __tty_buffer_request_room (tty_buffer.c:?) [ 18.287773] tty_insert_flip_string_fixed_flag (??:?) [ 18.287774] pty_write (pty.c:?) [ 18.287775] process_output_block (n_tty.c:?) [ 18.287776] n_tty_write (n_tty.c:?) [ 18.287777] tty_write (tty_io.c:?) [ 18.287778] __vfs_write (??:?) [ 18.287779] vfs_write (??:?) [ 18.287780] ksys_write (??:?) [ 18.287780] sys_write (??:?) [ 18.287781] do_fast_syscall_32 (??:?) [ 18.287782] entry_SYSENTER_32 (??:?) [ 18.287783] [ 18.287783] other info that might help us debug this: [ 18.287784] [ 18.287785] Chain exists of: [ 18.287785] console_owner --> &port_lock_key --> &(&port->lock)->rlock [ 18.287789] [ 18.287790] Possible unsafe locking scenario: [ 18.287790] [ 18.287791] CPU0 CPU1 [ 18.287792] ---- ---- [ 18.287792] lock(&(&port->lock)->rlock); [ 18.287794] lock(&port_lock_key); [ 18.287814] lock(&(&port->lock)->rlock); [ 18.287815] lock(console_owner); [ 18.287817] [ 18.287818] *** DEADLOCK *** [ 18.287818] [ 18.287819] 6 locks held by stop/202: [ 18.287820] #0: (ptrval) (&tty->ldisc_sem){++++}, at: ldsem_down_read (?= ?:?) [ 18.287823] #1: (ptrval) (&tty->atomic_write_lock){+.+.}, at: tty_write_= lock (tty_io.c:?) [ 18.287826] #2: (ptrval) (&o_tty->termios_rwsem/1){++++}, at: n_tty_writ= e (n_tty.c:?) [ 18.287830] #3: (ptrval) (&ldata->output_lock){+.+.}, at: process_output= _block (n_tty.c:?) [ 18.287834] #4: (ptrval) (&(&port->lock)->rlock){-...}, at: pty_write (p= ty.c:?) [ 18.287838] #5: (ptrval) (console_lock){+.+.}, at: console_trylock_spinn= ing (printk.c:?) [ 18.287841] [ 18.287842] stack backtrace: [ 18.287843] CPU: 0 PID: 202 Comm: stop Not tainted 4.19.248-00165-g3d1f9= 71aa81f #1 [ 18.287843] Call Trace: [ 18.287844] dump_stack (??:?) [ 18.287845] print_circular_bug.cold+0x78/0x8b [ 18.287846] check_prev_add+0x66a/0xd20 [ 18.287847] check_prevs_add (lockdep.c:?) [ 18.287848] validate_chain+0x84a/0xe00 [ 18.287848] __lock_acquire (lockdep.c:?) [ 18.287849] lock_acquire (??:?) [ 18.287850] ? console_unlock (??:?) [ 18.287851] console_unlock (??:?) [ 18.287851] ? console_unlock (??:?) [ 18.287852] ? native_save_fl (??:?) [ 18.287853] vprintk_emit (??:?) [ 18.287854] vprintk_default (??:?) [ 18.287855] vprintk_func (??:?) [ 18.287855] printk (??:?) [ 18.287856] get_random_u32 (??:?) [ 18.287857] ? shuffle_freelist (slub.c:?) [ 18.287858] shuffle_freelist (slub.c:?) [ 18.287858] ? page_address (??:?) [ 18.287859] allocate_slab (slub.c:?) [ 18.287860] new_slab (slub.c:?) [ 18.287861] ? pvclock_clocksource_read (??:?) [ 18.287862] ___slab_alloc+0x6d0/0xb20 [ 18.287862] ? kvm_sched_clock_read (kvmclock.c:?) [ 18.287863] ? __slab_alloc+0xbc/0x2e0 [ 18.287864] ? native_wbinvd (paravirt.c:?) [ 18.287865] __slab_alloc+0xd6/0x2e0 [ 18.287865] __kmalloc (??:?) [ 18.287866] ? __lock_acquire (lockdep.c:?) [ 18.287867] ? tty_buffer_alloc (tty_buffer.c:?) [ 18.287868] tty_buffer_alloc (tty_buffer.c:?) [ 18.287869] __tty_buffer_request_room (tty_buffer.c:?) [ 18.287869] tty_insert_flip_string_fixed_flag (??:?) [ 18.287870] pty_write (pty.c:?) [ 18.287871] process_output_block (n_tty.c:?) [ 18.287872] n_tty_write (n_tty.c:?) [ 18.287873] ? print_dl_stats (??:?) [ 18.287874] ? n_tty_ioctl (n_tty.c:?) [ 18.287874] tty_write (tty_io.c:?) [ 18.287875] ? n_tty_ioctl (n_tty.c:?) [ 18.287876] ? tty_write_unlock (tty_io.c:?) [ 18.287877] __vfs_write (??:?) [ 18.287877] vfs_write (??:?) [ 18.287878] ? __fget_light (file.c:?) [ 18.287879] ksys_write (??:?) Cc: Sergey Senozhatsky Cc: Qian Cai Cc: Lech Perczak Cc: Greg Kroah-Hartman Cc: Theodore Ts'o Cc: Sasha Levin Cc: Petr Mladek Cc: John Ogness Reported-by: kernel test robot Link: https://lore.kernel.org/lkml/Ytz+lo4zRQYG3JUR@xsang-OptiPlex-9020 Signed-off-by: Jason A. Donenfeld Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/char/random.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/char/random.c +++ b/drivers/char/random.c @@ -183,8 +183,8 @@ static void __cold process_random_ready_ =20 #define warn_unseeded_randomness() \ if (IS_ENABLED(CONFIG_WARN_ALL_UNSEEDED_RANDOM) && !crng_ready()) \ - pr_notice("%s called from %pS with crng_init=3D%d\n", \ - __func__, (void *)_RET_IP_, crng_init) + printk_deferred(KERN_NOTICE "random: %s called from %pS with crng_init= =3D%d\n", \ + __func__, (void *)_RET_IP_, crng_init) =20 =20 /********************************************************************* From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6E3D8C04A68 for ; Wed, 27 Jul 2022 16:35:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238465AbiG0Qfg (ORCPT ); Wed, 27 Jul 2022 12:35:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46490 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238039AbiG0QeB (ORCPT ); Wed, 27 Jul 2022 12:34:01 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1D1254CAE; Wed, 27 Jul 2022 09:26:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 692D0B821B8; Wed, 27 Jul 2022 16:26:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B723DC433C1; Wed, 27 Jul 2022 16:26:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939162; bh=Ptp8f9ez5kMPmK7FFCiOYpyQIN2l2mkSWZa8q1gwRqk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EYbXxMT/Pm+iFEYc/kmGFAqeEtfSfo3pXqge73ZtTFcQ0YyNiL1QnLXNZGAOb+uc6 zPovGI0qo00dMOpUvJnhhDpgym1y7u0d1nkHCARZEBqIjUVvBHe5Uc6xHPXDj0eklo Yrd4rLvxr+pH6BbMJezlWRMTynDD+TDIfHp3zGFY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wang Cheng , syzbot+217f792c92599518a2ab@syzkaller.appspotmail.com, David Rientjes , Vlastimil Babka , Andrew Morton Subject: [PATCH 4.19 34/62] mm/mempolicy: fix uninit-value in mpol_rebind_policy() Date: Wed, 27 Jul 2022 18:10:43 +0200 Message-Id: <20220727161005.543855876@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wang Cheng commit 018160ad314d75b1409129b2247b614a9f35894c upstream. mpol_set_nodemask()(mm/mempolicy.c) does not set up nodemask when pol->mode is MPOL_LOCAL. Check pol->mode before access pol->w.cpuset_mems_allowed in mpol_rebind_policy()(mm/mempolicy.c). BUG: KMSAN: uninit-value in mpol_rebind_policy mm/mempolicy.c:352 [inline] BUG: KMSAN: uninit-value in mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 mpol_rebind_policy mm/mempolicy.c:352 [inline] mpol_rebind_task+0x2ac/0x2c0 mm/mempolicy.c:368 cpuset_change_task_nodemask kernel/cgroup/cpuset.c:1711 [inline] cpuset_attach+0x787/0x15e0 kernel/cgroup/cpuset.c:2278 cgroup_migrate_execute+0x1023/0x1d20 kernel/cgroup/cgroup.c:2515 cgroup_migrate kernel/cgroup/cgroup.c:2771 [inline] cgroup_attach_task+0x540/0x8b0 kernel/cgroup/cgroup.c:2804 __cgroup1_procs_write+0x5cc/0x7a0 kernel/cgroup/cgroup-v1.c:520 cgroup1_tasks_write+0x94/0xb0 kernel/cgroup/cgroup-v1.c:539 cgroup_file_write+0x4c2/0x9e0 kernel/cgroup/cgroup.c:3852 kernfs_fop_write_iter+0x66a/0x9f0 fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2162 [inline] new_sync_write fs/read_write.c:503 [inline] vfs_write+0x1318/0x2030 fs/read_write.c:590 ksys_write+0x28b/0x510 fs/read_write.c:643 __do_sys_write fs/read_write.c:655 [inline] __se_sys_write fs/read_write.c:652 [inline] __x64_sys_write+0xdb/0x120 fs/read_write.c:652 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae Uninit was created at: slab_post_alloc_hook mm/slab.h:524 [inline] slab_alloc_node mm/slub.c:3251 [inline] slab_alloc mm/slub.c:3259 [inline] kmem_cache_alloc+0x902/0x11c0 mm/slub.c:3264 mpol_new mm/mempolicy.c:293 [inline] do_set_mempolicy+0x421/0xb70 mm/mempolicy.c:853 kernel_set_mempolicy mm/mempolicy.c:1504 [inline] __do_sys_set_mempolicy mm/mempolicy.c:1510 [inline] __se_sys_set_mempolicy+0x44c/0xb60 mm/mempolicy.c:1507 __x64_sys_set_mempolicy+0xd8/0x110 mm/mempolicy.c:1507 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x44/0xae KMSAN: uninit-value in mpol_rebind_task (2) https://syzkaller.appspot.com/bug?id=3Dd6eb90f952c2a5de9ea718a1b873c55cb13b= 59dc This patch seems to fix below bug too. KMSAN: uninit-value in mpol_rebind_mm (2) https://syzkaller.appspot.com/bug?id=3Df2fecd0d7013f54ec4162f60743a2b28df40= 926b The uninit-value is pol->w.cpuset_mems_allowed in mpol_rebind_policy(). When syzkaller reproducer runs to the beginning of mpol_new(), mpol_new() mm/mempolicy.c do_mbind() mm/mempolicy.c kernel_mbind() mm/mempolicy.c `mode` is 1(MPOL_PREFERRED), nodes_empty(*nodes) is `true` and `flags` is 0. Then mode =3D MPOL_LOCAL; ... policy->mode =3D mode; policy->flags =3D flags; will be executed. So in mpol_set_nodemask(), mpol_set_nodemask() mm/mempolicy.c do_mbind() kernel_mbind() pol->mode is 4 (MPOL_LOCAL), that `nodemask` in `pol` is not initialized, which will be accessed in mpol_rebind_policy(). Link: https://lkml.kernel.org/r/20220512123428.fq3wofedp6oiotd4@ppc.localdo= main Signed-off-by: Wang Cheng Reported-by: Tested-by: Cc: David Rientjes Cc: Vlastimil Babka Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- mm/mempolicy.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -348,7 +348,7 @@ static void mpol_rebind_preferred(struct */ static void mpol_rebind_policy(struct mempolicy *pol, const nodemask_t *ne= wmask) { - if (!pol) + if (!pol || pol->mode =3D=3D MPOL_LOCAL) return; if (!mpol_store_user_nodemask(pol) && !(pol->flags & MPOL_F_LOCAL) && nodes_equal(pol->w.cpuset_mems_allowed, *newmask)) From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3EC31C04A68 for ; Wed, 27 Jul 2022 16:35:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238358AbiG0QfT (ORCPT ); Wed, 27 Jul 2022 12:35:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238156AbiG0Qd4 (ORCPT ); Wed, 27 Jul 2022 12:33:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9A68054AF3; Wed, 27 Jul 2022 09:26:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6FAB861662; Wed, 27 Jul 2022 16:26:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 79E13C433C1; Wed, 27 Jul 2022 16:26:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939164; bh=njurI18qD1t1r66D78QE8tvSsJDqwpTLVeo3OeAw6N4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=e4Jx2vK0Ob8Ej1WoskjpKbtZII8y02zMxMwkOwPssFi59qdIhBgzW+iWQuVFgKNSb xA3+pqPFyhLXu9pT8FjqtXiv17WyqDa4DmU5lrYPpjx87m1typC2dFPJtB9axSDIFM IYBcSSGa1cidEjHRz+cIPnbOQGJdWLCh1p7X9FTQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , Eric Dumazet , Daniel Borkmann Subject: [PATCH 4.19 35/62] bpf: Make sure mac_header was set before using it Date: Wed, 27 Jul 2022 18:10:44 +0200 Message-Id: <20220727161005.574695141@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eric Dumazet commit 0326195f523a549e0a9d7fd44c70b26fd7265090 upstream. Classic BPF has a way to load bytes starting from the mac header. Some skbs do not have a mac header, and skb_mac_header() in this case is returning a pointer that 65535 bytes after skb->head. Existing range check in bpf_internal_load_pointer_neg_helper() was properly kicking and no illegal access was happening. New sanity check in skb_mac_header() is firing, so we need to avoid it. WARNING: CPU: 1 PID: 28990 at include/linux/skbuff.h:2785 skb_mac_header in= clude/linux/skbuff.h:2785 [inline] WARNING: CPU: 1 PID: 28990 at include/linux/skbuff.h:2785 bpf_internal_load= _pointer_neg_helper+0x1b1/0x1c0 kernel/bpf/core.c:74 Modules linked in: CPU: 1 PID: 28990 Comm: syz-executor.0 Not tainted 5.19.0-rc4-syzkaller-008= 65-g4874fb9484be #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Goo= gle 06/29/2022 RIP: 0010:skb_mac_header include/linux/skbuff.h:2785 [inline] RIP: 0010:bpf_internal_load_pointer_neg_helper+0x1b1/0x1c0 kernel/bpf/core.= c:74 Code: ff ff 45 31 f6 e9 5a ff ff ff e8 aa 27 40 00 e9 3b ff ff ff e8 90 27 = 40 00 e9 df fe ff ff e8 86 27 40 00 eb 9e e8 2f 2c f3 ff <0f> 0b eb b1 e8 9= 6 27 40 00 e9 79 fe ff ff 90 41 57 41 56 41 55 41 RSP: 0018:ffffc9000309f668 EFLAGS: 00010216 RAX: 0000000000000118 RBX: ffffffffffeff00c RCX: ffffc9000e417000 RDX: 0000000000040000 RSI: ffffffff81873f21 RDI: 0000000000000003 RBP: ffff8880842878c0 R08: 0000000000000003 R09: 000000000000ffff R10: 000000000000ffff R11: 0000000000000001 R12: 0000000000000004 R13: ffff88803ac56c00 R14: 000000000000ffff R15: dffffc0000000000 FS: 00007f5c88a16700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdaa9f6c058 CR3: 000000003a82c000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ____bpf_skb_load_helper_32 net/core/filter.c:276 [inline] bpf_skb_load_helper_32+0x191/0x220 net/core/filter.c:264 Fixes: f9aefd6b2aa3 ("net: warn if mac header was not set") Reported-by: syzbot Signed-off-by: Eric Dumazet Signed-off-by: Daniel Borkmann Link: https://lore.kernel.org/bpf/20220707123900.945305-1-edumazet@google.c= om Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- kernel/bpf/core.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) --- a/kernel/bpf/core.c +++ b/kernel/bpf/core.c @@ -66,11 +66,13 @@ void *bpf_internal_load_pointer_neg_help { u8 *ptr =3D NULL; =20 - if (k >=3D SKF_NET_OFF) + if (k >=3D SKF_NET_OFF) { ptr =3D skb_network_header(skb) + k - SKF_NET_OFF; - else if (k >=3D SKF_LL_OFF) + } else if (k >=3D SKF_LL_OFF) { + if (unlikely(!skb_mac_header_was_set(skb))) + return NULL; ptr =3D skb_mac_header(skb) + k - SKF_LL_OFF; - + } if (ptr >=3D skb->head && ptr + size <=3D skb_tail_pointer(skb)) return ptr; From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F40C7C19F28 for ; Wed, 27 Jul 2022 16:35:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237344AbiG0Qfx (ORCPT ); Wed, 27 Jul 2022 12:35:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236614AbiG0QeG (ORCPT ); Wed, 27 Jul 2022 12:34:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 10B8C550A2; Wed, 27 Jul 2022 09:26:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 2632E61A04; Wed, 27 Jul 2022 16:26:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 33DB6C433D7; Wed, 27 Jul 2022 16:26:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939167; bh=J9cVx48bRZItwhawxWtii/uswdsf/vCpf5leJwNa2n8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CMEJxb3EZ5W+HPT+ikc0xaupeDR78F6dcVNF6svCO/QS9CL5oiS2jLh6fQdh1pr0d ncB7wlWCEGwD9nk8tEMsig4Tlg7t9ZqVB1nglz/4DuwsqkXJFQDXE81PBRjU/pSMEX ZWRewcOP/xb8twyCxAk7KaYM3lEcqzjeNleOVoso= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jyri Sarha , Laurent Pinchart , Sasha Levin Subject: [PATCH 4.19 36/62] drm/tilcdc: Remove obsolete crtc_mode_valid() hack Date: Wed, 27 Jul 2022 18:10:45 +0200 Message-Id: <20220727161005.612612651@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jyri Sarha [ Upstream commit 57d8396504b3a93f284e51b866740a3e7419a3d9 ] Earlier there were no mode_valid() helper for crtc and tilcdc had a hack to over come this limitation. But now the mode_valid() helper is there (has been since v4.13), so it is about time to get rid of that hack. Signed-off-by: Jyri Sarha Reviewed-by: Laurent Pinchart Link: https://patchwork.freedesktop.org/patch/msgid/ <5c4dcb5b1e7975bd2b7ca= 86f7addf219cd0f9a06.1564750248.git.jsarha@ti.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/tilcdc/tilcdc_crtc.c | 28 +++----- drivers/gpu/drm/tilcdc/tilcdc_drv.c | 1 - drivers/gpu/drm/tilcdc/tilcdc_drv.h | 2 - drivers/gpu/drm/tilcdc/tilcdc_external.c | 88 +++--------------------- drivers/gpu/drm/tilcdc/tilcdc_external.h | 1 - drivers/gpu/drm/tilcdc/tilcdc_panel.c | 9 --- drivers/gpu/drm/tilcdc/tilcdc_tfp410.c | 9 --- 7 files changed, 19 insertions(+), 119 deletions(-) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c b/drivers/gpu/drm/tilcdc/= tilcdc_crtc.c index 1067e702c22c..31a2d1ecce3e 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_crtc.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_crtc.c @@ -657,9 +657,6 @@ static bool tilcdc_crtc_mode_fixup(struct drm_crtc *crt= c, static int tilcdc_crtc_atomic_check(struct drm_crtc *crtc, struct drm_crtc_state *state) { - struct drm_display_mode *mode =3D &state->mode; - int ret; - /* If we are not active we don't care */ if (!state->active) return 0; @@ -671,12 +668,6 @@ static int tilcdc_crtc_atomic_check(struct drm_crtc *c= rtc, return -EINVAL; } =20 - ret =3D tilcdc_crtc_mode_valid(crtc, mode); - if (ret) { - dev_dbg(crtc->dev->dev, "Mode \"%s\" not valid", mode->name); - return -EINVAL; - } - return 0; } =20 @@ -728,13 +719,6 @@ static const struct drm_crtc_funcs tilcdc_crtc_funcs = =3D { .disable_vblank =3D tilcdc_crtc_disable_vblank, }; =20 -static const struct drm_crtc_helper_funcs tilcdc_crtc_helper_funcs =3D { - .mode_fixup =3D tilcdc_crtc_mode_fixup, - .atomic_check =3D tilcdc_crtc_atomic_check, - .atomic_enable =3D tilcdc_crtc_atomic_enable, - .atomic_disable =3D tilcdc_crtc_atomic_disable, -}; - int tilcdc_crtc_max_width(struct drm_crtc *crtc) { struct drm_device *dev =3D crtc->dev; @@ -749,7 +733,9 @@ int tilcdc_crtc_max_width(struct drm_crtc *crtc) return max_width; } =20 -int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, struct drm_display_mode = *mode) +static enum drm_mode_status +tilcdc_crtc_mode_valid(struct drm_crtc *crtc, + const struct drm_display_mode *mode) { struct tilcdc_drm_private *priv =3D crtc->dev->dev_private; unsigned int bandwidth; @@ -837,6 +823,14 @@ int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, stru= ct drm_display_mode *mode) return MODE_OK; } =20 +static const struct drm_crtc_helper_funcs tilcdc_crtc_helper_funcs =3D { + .mode_valid =3D tilcdc_crtc_mode_valid, + .mode_fixup =3D tilcdc_crtc_mode_fixup, + .atomic_check =3D tilcdc_crtc_atomic_check, + .atomic_enable =3D tilcdc_crtc_atomic_enable, + .atomic_disable =3D tilcdc_crtc_atomic_disable, +}; + void tilcdc_crtc_set_panel_info(struct drm_crtc *crtc, const struct tilcdc_panel_info *info) { diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.c b/drivers/gpu/drm/tilcdc/t= ilcdc_drv.c index e1868776da25..96457fe2b8d5 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.c @@ -202,7 +202,6 @@ static void tilcdc_fini(struct drm_device *dev) =20 drm_irq_uninstall(dev); drm_mode_config_cleanup(dev); - tilcdc_remove_external_device(dev); =20 if (priv->clk) clk_put(priv->clk); diff --git a/drivers/gpu/drm/tilcdc/tilcdc_drv.h b/drivers/gpu/drm/tilcdc/t= ilcdc_drv.h index ead512216669..35558bbd5cd8 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_drv.h +++ b/drivers/gpu/drm/tilcdc/tilcdc_drv.h @@ -89,7 +89,6 @@ struct tilcdc_drm_private { =20 struct drm_encoder *external_encoder; struct drm_connector *external_connector; - const struct drm_connector_helper_funcs *connector_funcs; =20 bool is_registered; bool is_componentized; @@ -171,7 +170,6 @@ void tilcdc_crtc_set_panel_info(struct drm_crtc *crtc, const struct tilcdc_panel_info *info); void tilcdc_crtc_set_simulate_vesa_sync(struct drm_crtc *crtc, bool simulate_vesa_sync); -int tilcdc_crtc_mode_valid(struct drm_crtc *crtc, struct drm_display_mode = *mode); int tilcdc_crtc_max_width(struct drm_crtc *crtc); void tilcdc_crtc_shutdown(struct drm_crtc *crtc); int tilcdc_crtc_update_fb(struct drm_crtc *crtc, diff --git a/drivers/gpu/drm/tilcdc/tilcdc_external.c b/drivers/gpu/drm/til= cdc/tilcdc_external.c index b4eaf9bc87f8..a2f623550ce3 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_external.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_external.c @@ -40,64 +40,6 @@ static const struct tilcdc_panel_info panel_info_default= =3D { .raster_order =3D 0, }; =20 -static int tilcdc_external_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) -{ - struct tilcdc_drm_private *priv =3D connector->dev->dev_private; - int ret; - - ret =3D tilcdc_crtc_mode_valid(priv->crtc, mode); - if (ret !=3D MODE_OK) - return ret; - - BUG_ON(priv->external_connector !=3D connector); - BUG_ON(!priv->connector_funcs); - - /* If the connector has its own mode_valid call it. */ - if (!IS_ERR(priv->connector_funcs) && - priv->connector_funcs->mode_valid) - return priv->connector_funcs->mode_valid(connector, mode); - - return MODE_OK; -} - -static int tilcdc_add_external_connector(struct drm_device *dev, - struct drm_connector *connector) -{ - struct tilcdc_drm_private *priv =3D dev->dev_private; - struct drm_connector_helper_funcs *connector_funcs; - - /* There should never be more than one connector */ - if (WARN_ON(priv->external_connector)) - return -EINVAL; - - priv->external_connector =3D connector; - connector_funcs =3D devm_kzalloc(dev->dev, sizeof(*connector_funcs), - GFP_KERNEL); - if (!connector_funcs) - return -ENOMEM; - - /* connector->helper_private contains always struct - * connector_helper_funcs pointer. For tilcdc crtc to have a - * say if a specific mode is Ok, we need to install our own - * helper functions. In our helper functions we copy - * everything else but use our own mode_valid() (above). - */ - if (connector->helper_private) { - priv->connector_funcs =3D connector->helper_private; - *connector_funcs =3D *priv->connector_funcs; - } else { - priv->connector_funcs =3D ERR_PTR(-ENOENT); - } - connector_funcs->mode_valid =3D tilcdc_external_mode_valid; - drm_connector_helper_add(connector, connector_funcs); - - dev_dbg(dev->dev, "External connector '%s' connected\n", - connector->name); - - return 0; -} - static struct drm_connector *tilcdc_encoder_find_connector(struct drm_device *dde= v, struct drm_encoder *encoder) @@ -118,7 +60,6 @@ struct drm_connector *tilcdc_encoder_find_connector(stru= ct drm_device *ddev, int tilcdc_add_component_encoder(struct drm_device *ddev) { struct tilcdc_drm_private *priv =3D ddev->dev_private; - struct drm_connector *connector; struct drm_encoder *encoder; =20 list_for_each_entry(encoder, &ddev->mode_config.encoder_list, head) @@ -130,28 +71,17 @@ int tilcdc_add_component_encoder(struct drm_device *dd= ev) return -ENODEV; } =20 - connector =3D tilcdc_encoder_find_connector(ddev, encoder); + priv->external_connector =3D + tilcdc_encoder_find_connector(ddev, encoder); =20 - if (!connector) + if (!priv->external_connector) return -ENODEV; =20 /* Only tda998x is supported at the moment. */ tilcdc_crtc_set_simulate_vesa_sync(priv->crtc, true); tilcdc_crtc_set_panel_info(priv->crtc, &panel_info_tda998x); =20 - return tilcdc_add_external_connector(ddev, connector); -} - -void tilcdc_remove_external_device(struct drm_device *dev) -{ - struct tilcdc_drm_private *priv =3D dev->dev_private; - - /* Restore the original helper functions, if any. */ - if (IS_ERR(priv->connector_funcs)) - drm_connector_helper_add(priv->external_connector, NULL); - else if (priv->connector_funcs) - drm_connector_helper_add(priv->external_connector, - priv->connector_funcs); + return 0; } =20 static const struct drm_encoder_funcs tilcdc_external_encoder_funcs =3D { @@ -162,7 +92,6 @@ static int tilcdc_attach_bridge(struct drm_device *ddev, struct drm_bridge *bridg= e) { struct tilcdc_drm_private *priv =3D ddev->dev_private; - struct drm_connector *connector; int ret; =20 priv->external_encoder->possible_crtcs =3D BIT(0); @@ -175,13 +104,12 @@ int tilcdc_attach_bridge(struct drm_device *ddev, str= uct drm_bridge *bridge) =20 tilcdc_crtc_set_panel_info(priv->crtc, &panel_info_default); =20 - connector =3D tilcdc_encoder_find_connector(ddev, priv->external_encoder); - if (!connector) + priv->external_connector =3D + tilcdc_encoder_find_connector(ddev, priv->external_encoder); + if (!priv->external_connector) return -ENODEV; =20 - ret =3D tilcdc_add_external_connector(ddev, connector); - - return ret; + return 0; } =20 int tilcdc_attach_external_device(struct drm_device *ddev) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_external.h b/drivers/gpu/drm/til= cdc/tilcdc_external.h index 763d18f006c7..a28b9df68c8f 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_external.h +++ b/drivers/gpu/drm/tilcdc/tilcdc_external.h @@ -19,7 +19,6 @@ #define __TILCDC_EXTERNAL_H__ =20 int tilcdc_add_component_encoder(struct drm_device *dev); -void tilcdc_remove_external_device(struct drm_device *dev); int tilcdc_get_external_components(struct device *dev, struct component_match **match); int tilcdc_attach_external_device(struct drm_device *ddev); diff --git a/drivers/gpu/drm/tilcdc/tilcdc_panel.c b/drivers/gpu/drm/tilcdc= /tilcdc_panel.c index 096a33f12c61..253c555e2997 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_panel.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_panel.c @@ -174,14 +174,6 @@ static int panel_connector_get_modes(struct drm_connec= tor *connector) return i; } =20 -static int panel_connector_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) -{ - struct tilcdc_drm_private *priv =3D connector->dev->dev_private; - /* our only constraints are what the crtc can generate: */ - return tilcdc_crtc_mode_valid(priv->crtc, mode); -} - static struct drm_encoder *panel_connector_best_encoder( struct drm_connector *connector) { @@ -199,7 +191,6 @@ static const struct drm_connector_funcs panel_connector= _funcs =3D { =20 static const struct drm_connector_helper_funcs panel_connector_helper_func= s =3D { .get_modes =3D panel_connector_get_modes, - .mode_valid =3D panel_connector_mode_valid, .best_encoder =3D panel_connector_best_encoder, }; =20 diff --git a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c b/drivers/gpu/drm/tilcd= c/tilcdc_tfp410.c index daebf1aa6b0a..54c6d825b1a0 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_tfp410.c @@ -183,14 +183,6 @@ static int tfp410_connector_get_modes(struct drm_conne= ctor *connector) return ret; } =20 -static int tfp410_connector_mode_valid(struct drm_connector *connector, - struct drm_display_mode *mode) -{ - struct tilcdc_drm_private *priv =3D connector->dev->dev_private; - /* our only constraints are what the crtc can generate: */ - return tilcdc_crtc_mode_valid(priv->crtc, mode); -} - static struct drm_encoder *tfp410_connector_best_encoder( struct drm_connector *connector) { @@ -209,7 +201,6 @@ static const struct drm_connector_funcs tfp410_connecto= r_funcs =3D { =20 static const struct drm_connector_helper_funcs tfp410_connector_helper_fun= cs =3D { .get_modes =3D tfp410_connector_get_modes, - .mode_valid =3D tfp410_connector_mode_valid, .best_encoder =3D tfp410_connector_best_encoder, }; =20 --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1C8FC04A68 for ; Wed, 27 Jul 2022 16:33:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237790AbiG0Qdr (ORCPT ); Wed, 27 Jul 2022 12:33:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47226 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237497AbiG0QdI (ORCPT ); Wed, 27 Jul 2022 12:33:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1AE7C54AC4; Wed, 27 Jul 2022 09:26:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EF36761A15; Wed, 27 Jul 2022 16:26:10 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 057F1C433C1; Wed, 27 Jul 2022 16:26:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939170; bh=SreVxgwI6lBZVdb5SSYKJ3fcMWrE/33Vzt8CofhLAp4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=T/k9Zl93fb6IPvyHCi4hwX26/dxdbTysxky/Ikq0L+NKRNvAm34g92nUkPqhUjFyn EoSh4okYXgvlNStdtIcyPwQ/hjYG78cY8lJ7xKicb0FEFL8JzMggpEhFe12kypo8q5 78YMxAmAr5djyEWH3JuXovNbJZbexIn5n4be2LNQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Xiaomeng Tong , Jyri Sarha , Sasha Levin Subject: [PATCH 4.19 37/62] tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator Date: Wed, 27 Jul 2022 18:10:46 +0200 Message-Id: <20220727161005.641385999@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Xiaomeng Tong [ Upstream commit 8b917cbe38e9b0d002492477a9fc2bfee2412ce4 ] The bug is here: if (!encoder) { The list iterator value 'encoder' will *always* be set and non-NULL by list_for_each_entry(), so it is incorrect to assume that the iterator value will be NULL if the list is empty or no element is found. To fix the bug, use a new variable 'iter' as the list iterator, while use the original variable 'encoder' as a dedicated pointer to point to the found element. Cc: stable@vger.kernel.org Fixes: ec9eab097a500 ("drm/tilcdc: Add drm bridge support for attaching drm= bridge drivers") Signed-off-by: Xiaomeng Tong Reviewed-by: Jyri Sarha Tested-by: Jyri Sarha Signed-off-by: Jyri Sarha Link: https://patchwork.freedesktop.org/patch/msgid/20220327061516.5076-1-x= iam0nd.tong@gmail.com Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/drivers/gpu/drm/tilcdc/tilcdc_external.c b/drivers/gpu/drm/til= cdc/tilcdc_external.c index a2f623550ce3..9c1be0635b53 100644 --- a/drivers/gpu/drm/tilcdc/tilcdc_external.c +++ b/drivers/gpu/drm/tilcdc/tilcdc_external.c @@ -60,11 +60,13 @@ struct drm_connector *tilcdc_encoder_find_connector(str= uct drm_device *ddev, int tilcdc_add_component_encoder(struct drm_device *ddev) { struct tilcdc_drm_private *priv =3D ddev->dev_private; - struct drm_encoder *encoder; + struct drm_encoder *encoder =3D NULL, *iter; =20 - list_for_each_entry(encoder, &ddev->mode_config.encoder_list, head) - if (encoder->possible_crtcs & (1 << priv->crtc->index)) + list_for_each_entry(iter, &ddev->mode_config.encoder_list, head) + if (iter->possible_crtcs & (1 << priv->crtc->index)) { + encoder =3D iter; break; + } =20 if (!encoder) { dev_err(ddev->dev, "%s: No suitable encoder found\n", __func__); --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 36EE3C19F28 for ; Wed, 27 Jul 2022 16:33:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238122AbiG0Qdv (ORCPT ); Wed, 27 Jul 2022 12:33:51 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35274 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237848AbiG0QdJ (ORCPT ); Wed, 27 Jul 2022 12:33:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0418E54ACE; Wed, 27 Jul 2022 09:26:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DA2F9619F6; Wed, 27 Jul 2022 16:26:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E302BC433C1; Wed, 27 Jul 2022 16:26:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939173; bh=J7u/vvB8Zs3W1i9AnlFem8HQrWzcHF81LZifj3tjOak=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OsNYCgOk7O0DLSisfp5DZlFUboRQtTFXBClEDtL+tikR+Y0QgwAQrWvN01jTA88ns B04520Q2/JbD97EtgdAPYkuRZR7c66a9DEwO8LxTHoZBA57TBMX68kWXMWQZSwU0PM h+8hv9ym/NtzQEZGm9a1l/UYbMl9wHqJrUu1WqoI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Tissoires , Jiri Kosina , Sasha Levin Subject: [PATCH 4.19 38/62] HID: multitouch: simplify the application retrieval Date: Wed, 27 Jul 2022 18:10:47 +0200 Message-Id: <20220727161005.678048255@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benjamin Tissoires [ Upstream commit 7ffa13be4945b2f60dfe6c71acbc1fdcfc4629a0 ] Now that the application is simply stored in struct hid_input, we can overwrite it in mt_input_mapping() for the faulty egalax and have a simpler suffix processing in mt_input_configured() Signed-off-by: Benjamin Tissoires Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/hid-multitouch.c | 72 ++++++++++++++++-------------------- 1 file changed, 32 insertions(+), 40 deletions(-) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index e99286258f62..5509b09f8656 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -1332,6 +1332,13 @@ static int mt_input_mapping(struct hid_device *hdev,= struct hid_input *hi, return mt_touch_input_mapping(hdev, hi, field, usage, bit, max, application); =20 + /* + * some egalax touchscreens have "application =3D=3D DG_TOUCHSCREEN" + * for the stylus. Overwrite the hid_input application + */ + if (field->physical =3D=3D HID_DG_STYLUS) + hi->application =3D HID_DG_STYLUS; + /* let hid-core decide for the others */ return 0; } @@ -1520,14 +1527,12 @@ static int mt_input_configured(struct hid_device *h= dev, struct hid_input *hi) struct mt_device *td =3D hid_get_drvdata(hdev); char *name; const char *suffix =3D NULL; - unsigned int application =3D 0; struct mt_report_data *rdata; struct mt_application *mt_application =3D NULL; struct hid_report *report; int ret; =20 list_for_each_entry(report, &hi->reports, hidinput_list) { - application =3D report->application; rdata =3D mt_find_report_data(td, report); if (!rdata) { hid_err(hdev, "failed to allocate data for report\n"); @@ -1542,46 +1547,33 @@ static int mt_input_configured(struct hid_device *h= dev, struct hid_input *hi) if (ret) return ret; } - - /* - * some egalax touchscreens have "application =3D=3D DG_TOUCHSCREEN" - * for the stylus. Check this first, and then rely on - * the application field. - */ - if (report->field[0]->physical =3D=3D HID_DG_STYLUS) { - suffix =3D "Pen"; - /* force BTN_STYLUS to allow tablet matching in udev */ - __set_bit(BTN_STYLUS, hi->input->keybit); - } } =20 - if (!suffix) { - switch (application) { - case HID_GD_KEYBOARD: - case HID_GD_KEYPAD: - case HID_GD_MOUSE: - case HID_DG_TOUCHPAD: - case HID_GD_SYSTEM_CONTROL: - case HID_CP_CONSUMER_CONTROL: - case HID_GD_WIRELESS_RADIO_CTLS: - case HID_GD_SYSTEM_MULTIAXIS: - /* already handled by hid core */ - break; - case HID_DG_TOUCHSCREEN: - /* we do not set suffix =3D "Touchscreen" */ - hi->input->name =3D hdev->name; - break; - case HID_DG_STYLUS: - /* force BTN_STYLUS to allow tablet matching in udev */ - __set_bit(BTN_STYLUS, hi->input->keybit); - break; - case HID_VD_ASUS_CUSTOM_MEDIA_KEYS: - suffix =3D "Custom Media Keys"; - break; - default: - suffix =3D "UNKNOWN"; - break; - } + switch (hi->application) { + case HID_GD_KEYBOARD: + case HID_GD_KEYPAD: + case HID_GD_MOUSE: + case HID_DG_TOUCHPAD: + case HID_GD_SYSTEM_CONTROL: + case HID_CP_CONSUMER_CONTROL: + case HID_GD_WIRELESS_RADIO_CTLS: + case HID_GD_SYSTEM_MULTIAXIS: + /* already handled by hid core */ + break; + case HID_DG_TOUCHSCREEN: + /* we do not set suffix =3D "Touchscreen" */ + hi->input->name =3D hdev->name; + break; + case HID_DG_STYLUS: + /* force BTN_STYLUS to allow tablet matching in udev */ + __set_bit(BTN_STYLUS, hi->input->keybit); + break; + case HID_VD_ASUS_CUSTOM_MEDIA_KEYS: + suffix =3D "Custom Media Keys"; + break; + default: + suffix =3D "UNKNOWN"; + break; } =20 if (suffix) { --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E85B6C04A68 for ; Wed, 27 Jul 2022 16:33:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237838AbiG0QdI (ORCPT ); Wed, 27 Jul 2022 12:33:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237844AbiG0Qc2 (ORCPT ); Wed, 27 Jul 2022 12:32:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 06EB753D2A; Wed, 27 Jul 2022 09:26:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C3832617EF; Wed, 27 Jul 2022 16:26:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9775C433D6; Wed, 27 Jul 2022 16:26:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939176; bh=QF7pyE183J3Q+46NmYFF2shA3xAIisb+KwOnK6MxcHc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=agHXFFMe9Zg8j+SrG1RRDS6a+z1suvfQ/Ip8kqvJ2s2IOzOllZINa+/1msjzwpnb3 osYTEziTsbGwLQWqMLQ4kG9EY1m/pZLO1RDRiD61y0LZRrgrvvM91bzlnRXjkGhd3Z /RzijGqHWWfqlstWl1OZ8JAN4HZwmpW+Fqf0a9u0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Mikael=20Wikstr=C3=B6m?= , Jiri Kosina , Sasha Levin Subject: [PATCH 4.19 39/62] HID: multitouch: Lenovo X1 Tablet Gen3 trackpoint and buttons Date: Wed, 27 Jul 2022 18:10:48 +0200 Message-Id: <20220727161005.716889599@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mikael Wikstr=C3=B6m [ Upstream commit 8d5037dca7c2089f27e5903c2aecfc5bb10d7806 ] Add support for the trackpoint and three mouse buttons on the type cover of the Lenovo X1 Tablet Gen3. This is the same as with the 2nd generation Lenovo X1 Tablet. Signed-off-by: Mikael Wikstr=C3=B6m Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 6 ++++++ 2 files changed, 7 insertions(+) diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h index 8d4153c73f5c..1c1de7e128d6 100644 --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -727,6 +727,7 @@ #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067 #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085 #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 +#define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 =20 #define USB_VENDOR_ID_LG 0x1fd2 #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064 diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index 5509b09f8656..1c4426c60972 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -1797,6 +1797,12 @@ static const struct hid_device_id mt_devices[] =3D { USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_X1_TAB) }, =20 + /* Lenovo X1 TAB Gen 3 */ + { .driver_data =3D MT_CLS_WIN_8_DUAL, + HID_DEVICE(BUS_USB, HID_GROUP_MULTITOUCH_WIN_8, + USB_VENDOR_ID_LENOVO, + USB_DEVICE_ID_LENOVO_X1_TAB3) }, + /* Anton devices */ { .driver_data =3D MT_CLS_EXPORT_ALL_INPUTS, MT_USB_DEVICE(USB_VENDOR_ID_ANTON, --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CAB2FC04A68 for ; Wed, 27 Jul 2022 16:33:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237973AbiG0QdU (ORCPT ); Wed, 27 Jul 2022 12:33:20 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34498 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237778AbiG0Qcs (ORCPT ); Wed, 27 Jul 2022 12:32:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 415E953D04; Wed, 27 Jul 2022 09:26:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5CBC2B821BF; Wed, 27 Jul 2022 16:26:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AC04FC433C1; Wed, 27 Jul 2022 16:26:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939179; bh=ZNOEerogwL3QPkDGQqI5U5SJ+ivJ/Zl/Vr1t0W0P1UI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=G4jXdI5fpZELXJPRlxVcY1Kwm//Nyt1foA6OLCc0vlafc45RlzNHVn7wCahCqz1tP bdYFfm0ZGkwx3DPVBJuP0NHGjsef3I+CHvxsbEJZxYCNWZ61tGWnHdNQeAK1H2Ya+6 Tx6tMwEXN4ocjuGfnKD7Y5sUmc8uWrJEdYciowFY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Benjamin Tissoires , Sasha Levin , Matthias Fend Subject: [PATCH 4.19 40/62] HID: multitouch: add support for the Smart Tech panel Date: Wed, 27 Jul 2022 18:10:49 +0200 Message-Id: <20220727161005.764401878@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Benjamin Tissoires [ Upstream commit 69ecd44d68a7bf4caeda39825af720362db69233 ] This panel is not very friendly to us: it exposes multiple multitouch collections, some of them being of logical application stylus. Usually, a device has only one report per application, and that is what I assumed in commit 8dfe14b3b47f ("HID: multitouch: ditch mt_report_id= ") To avoid breaking all working device, add a new class and a new quirk for that situation. Reported-and-tested-by: Matthias Fend Signed-off-by: Benjamin Tissoires Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/hid-multitouch.c | 34 ++++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c index 1c4426c60972..ce027eda9b17 100644 --- a/drivers/hid/hid-multitouch.c +++ b/drivers/hid/hid-multitouch.c @@ -72,6 +72,7 @@ MODULE_LICENSE("GPL"); #define MT_QUIRK_STICKY_FINGERS BIT(16) #define MT_QUIRK_ASUS_CUSTOM_UP BIT(17) #define MT_QUIRK_WIN8_PTP_BUTTONS BIT(18) +#define MT_QUIRK_SEPARATE_APP_REPORT BIT(19) =20 #define MT_INPUTMODE_TOUCHSCREEN 0x02 #define MT_INPUTMODE_TOUCHPAD 0x03 @@ -107,6 +108,7 @@ struct mt_usages { struct mt_application { struct list_head list; unsigned int application; + unsigned int report_id; struct list_head mt_usages; /* mt usages list */ =20 __s32 quirks; @@ -207,6 +209,7 @@ static void mt_post_parse(struct mt_device *td, struct = mt_application *app); #define MT_CLS_VTL 0x0110 #define MT_CLS_GOOGLE 0x0111 #define MT_CLS_RAZER_BLADE_STEALTH 0x0112 +#define MT_CLS_SMART_TECH 0x0113 =20 #define MT_DEFAULT_MAXCONTACT 10 #define MT_MAX_MAXCONTACT 250 @@ -357,6 +360,12 @@ static const struct mt_class mt_classes[] =3D { MT_QUIRK_CONTACT_CNT_ACCURATE | MT_QUIRK_WIN8_PTP_BUTTONS, }, + { .name =3D MT_CLS_SMART_TECH, + .quirks =3D MT_QUIRK_ALWAYS_VALID | + MT_QUIRK_IGNORE_DUPLICATES | + MT_QUIRK_CONTACT_CNT_ACCURATE | + MT_QUIRK_SEPARATE_APP_REPORT, + }, { } }; =20 @@ -513,8 +522,9 @@ static struct mt_usages *mt_allocate_usage(struct hid_d= evice *hdev, } =20 static struct mt_application *mt_allocate_application(struct mt_device *td, - unsigned int application) + struct hid_report *report) { + unsigned int application =3D report->application; struct mt_application *mt_application; =20 mt_application =3D devm_kzalloc(&td->hdev->dev, sizeof(*mt_application), @@ -539,6 +549,7 @@ static struct mt_application *mt_allocate_application(s= truct mt_device *td, mt_application->scantime =3D DEFAULT_ZERO; mt_application->raw_cc =3D DEFAULT_ZERO; mt_application->quirks =3D td->mtclass.quirks; + mt_application->report_id =3D report->id; =20 list_add_tail(&mt_application->list, &td->applications); =20 @@ -546,19 +557,23 @@ static struct mt_application *mt_allocate_application= (struct mt_device *td, } =20 static struct mt_application *mt_find_application(struct mt_device *td, - unsigned int application) + struct hid_report *report) { + unsigned int application =3D report->application; struct mt_application *tmp, *mt_application =3D NULL; =20 list_for_each_entry(tmp, &td->applications, list) { if (application =3D=3D tmp->application) { - mt_application =3D tmp; - break; + if (!(td->mtclass.quirks & MT_QUIRK_SEPARATE_APP_REPORT) || + tmp->report_id =3D=3D report->id) { + mt_application =3D tmp; + break; + } } } =20 if (!mt_application) - mt_application =3D mt_allocate_application(td, application); + mt_application =3D mt_allocate_application(td, report); =20 return mt_application; } @@ -575,7 +590,7 @@ static struct mt_report_data *mt_allocate_report_data(s= truct mt_device *td, return NULL; =20 rdata->report =3D report; - rdata->application =3D mt_find_application(td, report->application); + rdata->application =3D mt_find_application(td, report); =20 if (!rdata->application) { devm_kfree(&td->hdev->dev, rdata); @@ -1571,6 +1586,9 @@ static int mt_input_configured(struct hid_device *hde= v, struct hid_input *hi) case HID_VD_ASUS_CUSTOM_MEDIA_KEYS: suffix =3D "Custom Media Keys"; break; + case HID_DG_PEN: + suffix =3D "Stylus"; + break; default: suffix =3D "UNKNOWN"; break; @@ -2038,6 +2056,10 @@ static const struct hid_device_id mt_devices[] =3D { HID_DEVICE(BUS_I2C, HID_GROUP_MULTITOUCH_WIN_8, USB_VENDOR_ID_SYNAPTICS, 0x8323) }, =20 + /* Smart Tech panels */ + { .driver_data =3D MT_CLS_SMART_TECH, + MT_USB_DEVICE(0x0b8c, 0x0092)}, + /* Stantum panels */ { .driver_data =3D MT_CLS_CONFIDENCE, MT_USB_DEVICE(USB_VENDOR_ID_STANTUM_STM, --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AABD8C04A68 for ; Wed, 27 Jul 2022 16:36:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238697AbiG0QgY (ORCPT ); Wed, 27 Jul 2022 12:36:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46942 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238079AbiG0QeE (ORCPT ); Wed, 27 Jul 2022 12:34:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B51AD55088; Wed, 27 Jul 2022 09:26:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C96861A09; Wed, 27 Jul 2022 16:26:22 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A26FC433C1; Wed, 27 Jul 2022 16:26:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939181; bh=Zu8qtbygSgh2+lzN3ZHdXU7oyiNrr/YxjoGng1rL5lY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XlNAnNgLbEgUUZLLcimPK1nuAwT6S62KXGQn97QiXK33ybomwZoFg9xqLu8Co1CtD D3PGO2GiDRZJfWTLSanW+XIHpj+krhU5zHbwKcFzHhqWDGACvhnFQq3eB3Imnco1/C eK1NIUxKnrpSLbA5dT/1X4r8L9FGLyHA0Psc0D4M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tony Fischetti , Jiri Kosina , Sasha Levin Subject: [PATCH 4.19 41/62] HID: add ALWAYS_POLL quirk to lenovo pixart mouse Date: Wed, 27 Jul 2022 18:10:50 +0200 Message-Id: <20220727161005.792257842@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tony Fischetti [ Upstream commit 819d578d51d0ce73f06e35d69395ef55cd683a74 ] A lenovo pixart mouse (17ef:608d) is afflicted common the the malfunction where it disconnects and reconnects every minute--each time incrementing the device number. This patch adds the device id of the device and specifies that it needs the HID_QUIRK_ALWAYS_POLL quirk in order to work properly. Signed-off-by: Tony Fischetti Signed-off-by: Jiri Kosina Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-quirks.c | 1 + 2 files changed, 2 insertions(+) diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h index 1c1de7e128d6..70079d29822b 100644 --- a/drivers/hid/hid-ids.h +++ b/drivers/hid/hid-ids.h @@ -728,6 +728,7 @@ #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085 #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 #define USB_DEVICE_ID_LENOVO_X1_TAB3 0x60b5 +#define USB_DEVICE_ID_LENOVO_PIXART_USB_MOUSE_608D 0x608d =20 #define USB_VENDOR_ID_LG 0x1fd2 #define USB_DEVICE_ID_LG_MULTITOUCH 0x0064 diff --git a/drivers/hid/hid-quirks.c b/drivers/hid/hid-quirks.c index 48e9761d4ace..c1b76ba85fb4 100644 --- a/drivers/hid/hid-quirks.c +++ b/drivers/hid/hid-quirks.c @@ -111,6 +111,7 @@ static const struct hid_device_id hid_quirks[] =3D { { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X_V2),= HID_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912), HI= D_QUIRK_MULTI_INPUT }, { HID_USB_DEVICE(USB_VENDOR_ID_KYE, USB_DEVICE_ID_PIXART_USB_OPTICAL_MOUS= E_ID2), HID_QUIRK_ALWAYS_POLL }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_PIXART_USB_MO= USE_608D), HID_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C007), HI= D_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077), HI= D_QUIRK_ALWAYS_POLL }, { HID_USB_DEVICE(USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_KEYBOARD_= G710_PLUS), HID_QUIRK_NOGET }, --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 66BEDC04A68 for ; Wed, 27 Jul 2022 16:35:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238387AbiG0Qfu (ORCPT ); Wed, 27 Jul 2022 12:35:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47210 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235592AbiG0QeH (ORCPT ); Wed, 27 Jul 2022 12:34:07 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9EAA550A6; Wed, 27 Jul 2022 09:26:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C7601B821BC; Wed, 27 Jul 2022 16:26:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2CD06C433D6; Wed, 27 Jul 2022 16:26:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939184; bh=ha1Tvj/TwkZrbyOljA7y31mT43yEh3Mf6mEIHFW84/4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xmn7M5kb635d1FiVj7V6zNBj23ZJwYW/BmDzTJUgMMwImpoDfJkYDGR/NPASK06iy afF83amQ6Zw4ImvBo5cRyc/p97ElokprUc+ksPE+YIguB4XLBanVxBtoj8qztv3tyM TxJX79MYgp0R8rny/L5TbZ6M6sLC5dayfD512PAc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Alexander Aring , David Teigland , Sasha Levin Subject: [PATCH 4.19 42/62] dlm: fix pending remove if msg allocation fails Date: Wed, 27 Jul 2022 18:10:51 +0200 Message-Id: <20220727161005.821253678@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Alexander Aring [ Upstream commit ba58995909b5098ca4003af65b0ccd5a8d13dd25 ] This patch unsets ls_remove_len and ls_remove_name if a message allocation of a remove messages fails. In this case we never send a remove message out but set the per ls ls_remove_len ls_remove_name variable for a pending remove. Unset those variable should indicate possible waiters in wait_pending_remove() that no pending remove is going on at this moment. Cc: stable@vger.kernel.org Signed-off-by: Alexander Aring Signed-off-by: David Teigland Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- fs/dlm/lock.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/dlm/lock.c b/fs/dlm/lock.c index ac53403e9edb..35bfb681bf13 100644 --- a/fs/dlm/lock.c +++ b/fs/dlm/lock.c @@ -4069,13 +4069,14 @@ static void send_repeat_remove(struct dlm_ls *ls, c= har *ms_name, int len) rv =3D _create_message(ls, sizeof(struct dlm_message) + len, dir_nodeid, DLM_MSG_REMOVE, &ms, &mh); if (rv) - return; + goto out; =20 memcpy(ms->m_extra, name, len); ms->m_hash =3D hash; =20 send_message(mh, ms); =20 +out: spin_lock(&ls->ls_remove_spin); ls->ls_remove_len =3D 0; memset(ls->ls_remove_name, 0, DLM_RESNAME_MAXLEN); --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8436CC19F28 for ; Wed, 27 Jul 2022 16:35:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237988AbiG0Qf4 (ORCPT ); Wed, 27 Jul 2022 12:35:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47320 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238246AbiG0QeN (ORCPT ); Wed, 27 Jul 2022 12:34:13 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CFD394F194; Wed, 27 Jul 2022 09:26:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id DD03D619C0; Wed, 27 Jul 2022 16:26:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7DA4C433D7; Wed, 27 Jul 2022 16:26:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939187; bh=sKEh1h1g2EloXlRno4EC8xmmU1FOwVQwFsLKDWV/Ugg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CnegrMT+n6sIhcq5izHJH4bpeixzCkzyMZX8Tzn8Yve1c1uqWWAEoLeJ2c7Q/V7qx blYMar44WQFfmq9py4j+HUR7SHAFYsJ95omuv44hsx4Oz9rbd1fLP+ixJmW6/fZnjI EyawGpUg6/GguYOMCcGu3XHVEXCEfrBDFHqMIY3g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, GUO Zihua , Stable@vger.kernel.org, Mimi Zohar , Sasha Levin Subject: [PATCH 4.19 43/62] ima: remove the IMA_TEMPLATE Kconfig option Date: Wed, 27 Jul 2022 18:10:52 +0200 Message-Id: <20220727161005.855488592@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: GUO Zihua [ Upstream commit 891163adf180bc369b2f11c9dfce6d2758d2a5bd ] The original 'ima' measurement list template contains a hash, defined as 20 bytes, and a null terminated pathname, limited to 255 characters. Other measurement list templates permit both larger hashes and longer pathnames. When the "ima" template is configured as the default, a new measurement list template (ima_template=3D) must be specified before specifying a larger hash algorithm (ima_hash=3D) on the boot command line. To avoid this boot command line ordering issue, remove the legacy "ima" template configuration option, allowing it to still be specified on the boot command line. The root cause of this issue is that during the processing of ima_hash, we would try to check whether the hash algorithm is compatible with the template. If the template is not set at the moment we do the check, we check the algorithm against the configured default template. If the default template is "ima", then we reject any hash algorithm other than sha1 and md5. For example, if the compiled default template is "ima", and the default algorithm is sha1 (which is the current default). In the cmdline, we put in "ima_hash=3Dsha256 ima_template=3Dima-ng". The expected behavior would be that ima starts with ima-ng as the template and sha256 as the hash algorithm. However, during the processing of "ima_hash=3D", "ima_template=3D" has not been processed yet, and hash_setup would check the configured hash algorithm against the compiled default: ima, and reject sha256. So at the end, the hash algorithm that is actually used will be sha1. With template "ima" removed from the configured default, we ensure that the default tempalte would at least be "ima-ng" which allows for basically any hash algorithm. This change would not break the algorithm compatibility checks for IMA. Fixes: 4286587dccd43 ("ima: add Kconfig default measurement list template") Signed-off-by: GUO Zihua Cc: Signed-off-by: Mimi Zohar Signed-off-by: Sasha Levin Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- security/integrity/ima/Kconfig | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig index 5095b2e8fcee..3ec45028a8c5 100644 --- a/security/integrity/ima/Kconfig +++ b/security/integrity/ima/Kconfig @@ -68,10 +68,9 @@ choice hash, defined as 20 bytes, and a null terminated pathname, limited to 255 characters. The 'ima-ng' measurement list template permits both larger hash digests and longer - pathnames. + pathnames. The configured default template can be replaced + by specifying "ima_template=3D" on the boot command line. =20 - config IMA_TEMPLATE - bool "ima" config IMA_NG_TEMPLATE bool "ima-ng (default)" config IMA_SIG_TEMPLATE @@ -81,7 +80,6 @@ endchoice config IMA_DEFAULT_TEMPLATE string depends on IMA - default "ima" if IMA_TEMPLATE default "ima-ng" if IMA_NG_TEMPLATE default "ima-sig" if IMA_SIG_TEMPLATE =20 @@ -101,15 +99,15 @@ choice =20 config IMA_DEFAULT_HASH_SHA256 bool "SHA256" - depends on CRYPTO_SHA256=3Dy && !IMA_TEMPLATE + depends on CRYPTO_SHA256=3Dy =20 config IMA_DEFAULT_HASH_SHA512 bool "SHA512" - depends on CRYPTO_SHA512=3Dy && !IMA_TEMPLATE + depends on CRYPTO_SHA512=3Dy =20 config IMA_DEFAULT_HASH_WP512 bool "WP512" - depends on CRYPTO_WP512=3Dy && !IMA_TEMPLATE + depends on CRYPTO_WP512=3Dy endchoice =20 config IMA_DEFAULT_HASH --=20 2.35.1 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 67165C04A68 for ; Wed, 27 Jul 2022 16:34:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237117AbiG0QeF (ORCPT ); Wed, 27 Jul 2022 12:34:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46914 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237994AbiG0Qd1 (ORCPT ); Wed, 27 Jul 2022 12:33:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 393FA4C63A; Wed, 27 Jul 2022 09:26:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E9ED61A08; Wed, 27 Jul 2022 16:26:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7957AC433D7; Wed, 27 Jul 2022 16:26:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939192; bh=IEo2m9o6KKrcSAAzgwAsEjTKgLNYFDTVee/FfJ2LAD4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=oqyhqkrhUMvJNIDITcjUhLbfYVnMUMuqxyed8HlSeO0R+9alOdsijCvnZrJRzmmnv /uxbxVuSMUHZ0ZHdv+gI2eDXfP9oDnk27PFbKvQT65/KF4pHgfSeNbliFiht37/iGz ZQ28VPU8P7jbNkBxx8gqXeMJrefRUxk3M04uztow= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lars-Peter Clausen , Takashi Iwai Subject: [PATCH 4.19 44/62] ALSA: memalloc: Align buffer allocations in page size Date: Wed, 27 Jul 2022 18:10:53 +0200 Message-Id: <20220727161005.890833787@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai commit 5c1733e33c888a3cb7f576564d8ad543d5ad4a9e upstream. Currently the standard memory allocator (snd_dma_malloc_pages*()) passes the byte size to allocate as is. Most of the backends allocates real pages, hence the actual allocations are aligned in page size. However, the genalloc doesn't seem assuring the size alignment, hence it may result in the access outside the buffer when the whole memory pages are exposed via mmap. For avoiding such inconsistencies, this patch makes the allocation size always to be aligned in page size. Note that, after this change, snd_dma_buffer.bytes field contains the aligned size, not the originally requested size. This value is also used for releasing the pages in return. Reviewed-by: Lars-Peter Clausen Link: https://lore.kernel.org/r/20201218145625.2045-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- sound/core/memalloc.c | 1 + 1 file changed, 1 insertion(+) --- a/sound/core/memalloc.c +++ b/sound/core/memalloc.c @@ -179,6 +179,7 @@ int snd_dma_alloc_pages(int type, struct if (WARN_ON(!dmab)) return -ENXIO; =20 + size =3D PAGE_ALIGN(size); dmab->dev.type =3D type; dmab->dev.dev =3D device; dmab->bytes =3D 0; From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 17FE1C19F2B for ; Wed, 27 Jul 2022 16:35:02 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238193AbiG0QeI (ORCPT ); Wed, 27 Jul 2022 12:34:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46978 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S236541AbiG0Qda (ORCPT ); Wed, 27 Jul 2022 12:33:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 592DF54C8A; Wed, 27 Jul 2022 09:26:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E93CDB821B6; Wed, 27 Jul 2022 16:26:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4FC1EC433D6; Wed, 27 Jul 2022 16:26:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939195; bh=MOCVpztG29Nt42exOx0JADtWROu433VsUJTiTZsPNxc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=vb5R2psmwryUXw5cP1vl6c547/psvO84IXh+lo/g5WWB92Fp908Y2C/i1E3GnmobK jRkyz9uBHQNTZokoOa0cHtLupuAJxtysyJvEgqjlw2JZ2t5eH337IijVs6S9vOrByY mxO88aGvM2EjtPG2YapM0Ha0wE1LMiYoba+M3++E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 45/62] Bluetooth: Add bt_skb_sendmsg helper Date: Wed, 27 Jul 2022 18:10:54 +0200 Message-Id: <20220727161005.918771230@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 38f64f650dc0e44c146ff88d15a7339efa325918 upstream. bt_skb_sendmsg helps takes care of allocation the skb and copying the the contents of msg over to the skb while checking for possible errors so it should be safe to call it without holding lock_sock. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/bluetooth/bluetooth.h | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -370,6 +370,34 @@ out: return NULL; } =20 +/* Shall not be called with lock_sock held */ +static inline struct sk_buff *bt_skb_sendmsg(struct sock *sk, + struct msghdr *msg, + size_t len, size_t mtu, + size_t headroom, size_t tailroom) +{ + struct sk_buff *skb; + size_t size =3D min_t(size_t, len, mtu); + int err; + + skb =3D bt_skb_send_alloc(sk, size + headroom + tailroom, + msg->msg_flags & MSG_DONTWAIT, &err); + if (!skb) + return ERR_PTR(err); + + skb_reserve(skb, headroom); + skb_tailroom_reserve(skb, mtu, tailroom); + + if (!copy_from_iter_full(skb_put(skb, size), size, &msg->msg_iter)) { + kfree_skb(skb); + return ERR_PTR(-EFAULT); + } + + skb->priority =3D sk->sk_priority; + + return skb; +} + int bt_to_errno(u16 code); =20 void hci_sock_set_flag(struct sock *sk, int nr); From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82E23C04A68 for ; Wed, 27 Jul 2022 16:35:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S237254AbiG0QfF (ORCPT ); Wed, 27 Jul 2022 12:35:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47226 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237662AbiG0Qdn (ORCPT ); Wed, 27 Jul 2022 12:33:43 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0E34254C94; Wed, 27 Jul 2022 09:26:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 1A1FACE2303; Wed, 27 Jul 2022 16:26:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0F8C7C433D6; Wed, 27 Jul 2022 16:26:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939198; bh=Wvw7I+nGSwocAWbyQDmTKOy9jcP8+ZoXNRue2rb7Ycg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=eJP6p22CqlgMJJUYIT/quJRm5z17w17kmRFb06mMBP1eU5b3XwYuuhx2Dgs0jHWa5 ldE+rWjsYBcTMFUPyU1wOWIHk6hGF4XoCxIckxP1r4Ox+M252wG27OI4PqXr7251zt Dxjmazeu6LOW9qZJSehWh2F+Hn68oI3FrkhmzqCU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 46/62] Bluetooth: Add bt_skb_sendmmsg helper Date: Wed, 27 Jul 2022 18:10:55 +0200 Message-Id: <20220727161005.947877005@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 97e4e80299844bb5f6ce5a7540742ffbffae3d97 upstream. This works similarly to bt_skb_sendmsg but can split the msg into multiple skb fragments which is useful for stream sockets. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/bluetooth/bluetooth.h | 38 +++++++++++++++++++++++++++++++++= +++++ 1 file changed, 38 insertions(+) --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -398,6 +398,44 @@ static inline struct sk_buff *bt_skb_sen return skb; } =20 +/* Similar to bt_skb_sendmsg but can split the msg into multiple fragments + * accourding to the MTU. + */ +static inline struct sk_buff *bt_skb_sendmmsg(struct sock *sk, + struct msghdr *msg, + size_t len, size_t mtu, + size_t headroom, size_t tailroom) +{ + struct sk_buff *skb, **frag; + + skb =3D bt_skb_sendmsg(sk, msg, len, mtu, headroom, tailroom); + if (IS_ERR_OR_NULL(skb)) + return skb; + + len -=3D skb->len; + if (!len) + return skb; + + /* Add remaining data over MTU as continuation fragments */ + frag =3D &skb_shinfo(skb)->frag_list; + while (len) { + struct sk_buff *tmp; + + tmp =3D bt_skb_sendmsg(sk, msg, len, mtu, headroom, tailroom); + if (IS_ERR_OR_NULL(tmp)) { + kfree_skb(skb); + return tmp; + } + + len -=3D tmp->len; + + *frag =3D tmp; + frag =3D &(*frag)->next; + } + + return skb; +} + int bt_to_errno(u16 code); =20 void hci_sock_set_flag(struct sock *sk, int nr); From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 090D4C04A68 for ; Wed, 27 Jul 2022 16:36:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238714AbiG0Qg2 (ORCPT ); Wed, 27 Jul 2022 12:36:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46922 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239079AbiG0Qew (ORCPT ); Wed, 27 Jul 2022 12:34:52 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A947F4F659; Wed, 27 Jul 2022 09:27:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 77B9EB821BF; Wed, 27 Jul 2022 16:26:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D23C7C433D6; Wed, 27 Jul 2022 16:26:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939201; bh=tS+ar2byvGXQkV54OvZ4Jwy6/JT/BUmN8BRsenhz6fA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tRQQp57W4DJp6oDKK+2WINwBFizrCB9DuEcxuwk1HHnm+ijMp6SN/X3iaMncEGers Um5LrRqFFwHeEkLLqjOw6VLePDW59Gq6yT9v7tX6zub78V/pa3aP0pCKObQxo3zOnZ HGnb9Kjj9a0kKk9aIxRiB+NHtsYo5RjdRxVPu4cc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 47/62] Bluetooth: SCO: Replace use of memcpy_from_msg with bt_skb_sendmsg Date: Wed, 27 Jul 2022 18:10:56 +0200 Message-Id: <20220727161005.976577904@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 0771cbb3b97d3c1d68eecd7f00055f599954c34e upstream. This makes use of bt_skb_sendmsg instead of allocating a different buffer to be used with memcpy_from_msg which cause one extra copy. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bluetooth/sco.c | 34 +++++++++++----------------------- 1 file changed, 11 insertions(+), 23 deletions(-) --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -279,27 +279,19 @@ static int sco_connect(struct hci_dev *h return err; } =20 -static int sco_send_frame(struct sock *sk, void *buf, int len, - unsigned int msg_flags) +static int sco_send_frame(struct sock *sk, struct sk_buff *skb) { struct sco_conn *conn =3D sco_pi(sk)->conn; - struct sk_buff *skb; - int err; =20 /* Check outgoing MTU */ - if (len > conn->mtu) + if (skb->len > conn->mtu) return -EINVAL; =20 - BT_DBG("sk %p len %d", sk, len); - - skb =3D bt_skb_send_alloc(sk, len, msg_flags & MSG_DONTWAIT, &err); - if (!skb) - return err; + BT_DBG("sk %p len %d", sk, skb->len); =20 - memcpy(skb_put(skb, len), buf, len); hci_send_sco(conn->hcon, skb); =20 - return len; + return skb->len; } =20 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) @@ -715,7 +707,7 @@ static int sco_sock_sendmsg(struct socke size_t len) { struct sock *sk =3D sock->sk; - void *buf; + struct sk_buff *skb; int err; =20 BT_DBG("sock %p, sk %p", sock, sk); @@ -727,24 +719,20 @@ static int sco_sock_sendmsg(struct socke if (msg->msg_flags & MSG_OOB) return -EOPNOTSUPP; =20 - buf =3D kmalloc(len, GFP_KERNEL); - if (!buf) - return -ENOMEM; - - if (memcpy_from_msg(buf, msg, len)) { - kfree(buf); - return -EFAULT; - } + skb =3D bt_skb_sendmsg(sk, msg, len, len, 0, 0); + if (IS_ERR_OR_NULL(skb)) + return PTR_ERR(skb); =20 lock_sock(sk); =20 if (sk->sk_state =3D=3D BT_CONNECTED) - err =3D sco_send_frame(sk, buf, len, msg->msg_flags); + err =3D sco_send_frame(sk, skb); else err =3D -ENOTCONN; =20 release_sock(sk); - kfree(buf); + if (err) + kfree_skb(skb); return err; } From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 69AE4C04A68 for ; Wed, 27 Jul 2022 16:37:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238915AbiG0QhF (ORCPT ); Wed, 27 Jul 2022 12:37:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238207AbiG0QfR (ORCPT ); Wed, 27 Jul 2022 12:35:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3842556B99; Wed, 27 Jul 2022 09:27:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C1179B821BE; Wed, 27 Jul 2022 16:27:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 14F1EC433C1; Wed, 27 Jul 2022 16:27:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939263; bh=jNEKLf54zl2KwmjY+c4vxV4Lcye4TS306qtU0o1laFk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=b51HcySbvWj4PA5WKXhPblyTNTajcLVbuanfkP5bnIHtm1NcEDayQnLBhrhDb0Nxd /G+Iq7rsqsC3IhYVrG2c1wM7KwJNV08Ogz7zpz6YmY3FvD7z2rJK79SBY79YWe2Qm1 1/ZIg63cZsVKktACpTFai1wwdSyB8/SXIOMZGbJQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 48/62] Bluetooth: RFCOMM: Replace use of memcpy_from_msg with bt_skb_sendmmsg Date: Wed, 27 Jul 2022 18:10:57 +0200 Message-Id: <20220727161006.013557150@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 81be03e026dc0c16dc1c64e088b2a53b73caa895 upstream. This makes use of bt_skb_sendmmsg instead using memcpy_from_msg which is not considered safe to be used when lock_sock is held. Also make rfcomm_dlc_send handle skb with fragments and queue them all atomically. Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bluetooth/rfcomm/core.c | 50 +++++++++++++++++++++++++++++++++++++--= ----- net/bluetooth/rfcomm/sock.c | 50 ++++++++++-----------------------------= ----- 2 files changed, 55 insertions(+), 45 deletions(-) --- a/net/bluetooth/rfcomm/core.c +++ b/net/bluetooth/rfcomm/core.c @@ -552,22 +552,58 @@ struct rfcomm_dlc *rfcomm_dlc_exists(bda return dlc; } =20 +static int rfcomm_dlc_send_frag(struct rfcomm_dlc *d, struct sk_buff *frag) +{ + int len =3D frag->len; + + BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); + + if (len > d->mtu) + return -EINVAL; + + rfcomm_make_uih(frag, d->addr); + __skb_queue_tail(&d->tx_queue, frag); + + return len; +} + int rfcomm_dlc_send(struct rfcomm_dlc *d, struct sk_buff *skb) { - int len =3D skb->len; + unsigned long flags; + struct sk_buff *frag, *next; + int len; =20 if (d->state !=3D BT_CONNECTED) return -ENOTCONN; =20 - BT_DBG("dlc %p mtu %d len %d", d, d->mtu, len); + frag =3D skb_shinfo(skb)->frag_list; + skb_shinfo(skb)->frag_list =3D NULL; =20 - if (len > d->mtu) - return -EINVAL; + /* Queue all fragments atomically. */ + spin_lock_irqsave(&d->tx_queue.lock, flags); + + len =3D rfcomm_dlc_send_frag(d, skb); + if (len < 0 || !frag) + goto unlock; + + for (; frag; frag =3D next) { + int ret; + + next =3D frag->next; + + ret =3D rfcomm_dlc_send_frag(d, frag); + if (ret < 0) { + kfree_skb(frag); + goto unlock; + } + + len +=3D ret; + } =20 - rfcomm_make_uih(skb, d->addr); - skb_queue_tail(&d->tx_queue, skb); +unlock: + spin_unlock_irqrestore(&d->tx_queue.lock, flags); =20 - if (!test_bit(RFCOMM_TX_THROTTLED, &d->flags)) + if (len > 0 && !test_bit(RFCOMM_TX_THROTTLED, &d->flags)) rfcomm_schedule(); return len; } --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -578,47 +578,21 @@ static int rfcomm_sock_sendmsg(struct so lock_sock(sk); =20 sent =3D bt_sock_wait_ready(sk, msg->msg_flags); - if (sent) - goto done; - - while (len) { - size_t size =3D min_t(size_t, len, d->mtu); - int err; - - skb =3D sock_alloc_send_skb(sk, size + RFCOMM_SKB_RESERVE, - msg->msg_flags & MSG_DONTWAIT, &err); - if (!skb) { - if (sent =3D=3D 0) - sent =3D err; - break; - } - skb_reserve(skb, RFCOMM_SKB_HEAD_RESERVE); - - err =3D memcpy_from_msg(skb_put(skb, size), msg, size); - if (err) { - kfree_skb(skb); - if (sent =3D=3D 0) - sent =3D err; - break; - } - - skb->priority =3D sk->sk_priority; - - err =3D rfcomm_dlc_send(d, skb); - if (err < 0) { - kfree_skb(skb); - if (sent =3D=3D 0) - sent =3D err; - break; - } - - sent +=3D size; - len -=3D size; - } =20 -done: release_sock(sk); =20 + if (sent) + return sent; + + skb =3D bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, + RFCOMM_SKB_TAIL_RESERVE); + if (IS_ERR_OR_NULL(skb)) + return PTR_ERR(skb); + + sent =3D rfcomm_dlc_send(d, skb); + if (sent < 0) + kfree_skb(skb); + return sent; } From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 52C2FC04A68 for ; Wed, 27 Jul 2022 16:36:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238613AbiG0QgF (ORCPT ); Wed, 27 Jul 2022 12:36:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238452AbiG0Qe0 (ORCPT ); Wed, 27 Jul 2022 12:34:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1CCC64E86D; Wed, 27 Jul 2022 09:27:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id CED9361A09; Wed, 27 Jul 2022 16:27:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DA484C433C1; Wed, 27 Jul 2022 16:27:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939224; bh=u7bKTBJfAOMOZ9/sDoWY4Vi6VndC+6DTovQ/pdYctDU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=I4a9rwj1fqIUzDbOzsdhFciJQewh1MdWq34GyQVMnziuM8BLWK0wSqlvu1t61EDWZ q2GeESQBSkDY5Ocjlek8uSN2BE6WaRVTUJzMDzkde0jkNPi0suTop8Kud3S/+r+eDv et4P3vxnuUA60x5Qv8ojg9EtwlG5CdW8vzyYnDSw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Tedd Ho-Jeong An , Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 49/62] Bluetooth: Fix passing NULL to PTR_ERR Date: Wed, 27 Jul 2022 18:10:58 +0200 Message-Id: <20220727161006.045213779@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 266191aa8d14b84958aaeb5e96ee4e97839e3d87 upstream. Passing NULL to PTR_ERR will result in 0 (success), also since the likes of bt_skb_sendmsg does never return NULL it is safe to replace the instances of IS_ERR_OR_NULL with IS_ERR when checking its return. Reported-by: Dan Carpenter Tested-by: Tedd Ho-Jeong An Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/bluetooth/bluetooth.h | 2 +- net/bluetooth/rfcomm/sock.c | 2 +- net/bluetooth/sco.c | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -422,7 +422,7 @@ static inline struct sk_buff *bt_skb_sen struct sk_buff *tmp; =20 tmp =3D bt_skb_sendmsg(sk, msg, len, mtu, headroom, tailroom); - if (IS_ERR_OR_NULL(tmp)) { + if (IS_ERR(tmp)) { kfree_skb(skb); return tmp; } --- a/net/bluetooth/rfcomm/sock.c +++ b/net/bluetooth/rfcomm/sock.c @@ -586,7 +586,7 @@ static int rfcomm_sock_sendmsg(struct so =20 skb =3D bt_skb_sendmmsg(sk, msg, len, d->mtu, RFCOMM_SKB_HEAD_RESERVE, RFCOMM_SKB_TAIL_RESERVE); - if (IS_ERR_OR_NULL(skb)) + if (IS_ERR(skb)) return PTR_ERR(skb); =20 sent =3D rfcomm_dlc_send(d, skb); --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -720,7 +720,7 @@ static int sco_sock_sendmsg(struct socke return -EOPNOTSUPP; =20 skb =3D bt_skb_sendmsg(sk, msg, len, len, 0, 0); - if (IS_ERR_OR_NULL(skb)) + if (IS_ERR(skb)) return PTR_ERR(skb); =20 lock_sock(sk); From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ADBAFC3F6B0 for ; Wed, 27 Jul 2022 16:48:59 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240005AbiG0Qs6 (ORCPT ); Wed, 27 Jul 2022 12:48:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44752 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240478AbiG0QsS (ORCPT ); Wed, 27 Jul 2022 12:48:18 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6A3CD61101; Wed, 27 Jul 2022 09:32:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D671061A04; Wed, 27 Jul 2022 16:27:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E36A5C433D6; Wed, 27 Jul 2022 16:27:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939241; bh=UOpROHzo/X7Rd+9/tzUGSTkx8KnfLTdzuVsBE7Rw9Vs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=YkDQOf/AoF2Tcf+FRzzcKMwnrAiSjMNkrRGA+woMMkLOTSMO7WOkebQpSR3DD+oj1 yCGmjzwGDUxZtnaYTJD3P5sNvTUxZ49Wez149gN+kr9jiNmcJf3RO9Q9TwSZwoeun8 CFqZYDHzlH2Gl/lBq67A/I9LNIDf62dCW3ueb69o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tedd Ho-Jeong An , Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 50/62] Bluetooth: SCO: Fix sco_send_frame returning skb->len Date: Wed, 27 Jul 2022 18:10:59 +0200 Message-Id: <20220727161006.082825060@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 037ce005af6b8a3e40ee07c6e9266c8997e6a4d6 upstream. The skb in modified by hci_send_sco which pushes SCO headers thus changing skb->len causing sco_sock_sendmsg to fail. Fixes: 0771cbb3b97d ("Bluetooth: SCO: Replace use of memcpy_from_msg with b= t_skb_sendmsg") Tested-by: Tedd Ho-Jeong An Signed-off-by: Luiz Augusto von Dentz Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- net/bluetooth/sco.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) --- a/net/bluetooth/sco.c +++ b/net/bluetooth/sco.c @@ -282,16 +282,17 @@ static int sco_connect(struct hci_dev *h static int sco_send_frame(struct sock *sk, struct sk_buff *skb) { struct sco_conn *conn =3D sco_pi(sk)->conn; + int len =3D skb->len; =20 /* Check outgoing MTU */ - if (skb->len > conn->mtu) + if (len > conn->mtu) return -EINVAL; =20 - BT_DBG("sk %p len %d", sk, skb->len); + BT_DBG("sk %p len %d", sk, len); =20 hci_send_sco(conn->hcon, skb); =20 - return skb->len; + return len; } =20 static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb) @@ -731,7 +732,8 @@ static int sco_sock_sendmsg(struct socke err =3D -ENOTCONN; =20 release_sock(sk); - if (err) + + if (err < 0) kfree_skb(skb); return err; } From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 40357C04A68 for ; Wed, 27 Jul 2022 16:37:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238343AbiG0QhT (ORCPT ); Wed, 27 Jul 2022 12:37:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47290 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238468AbiG0Qfg (ORCPT ); Wed, 27 Jul 2022 12:35:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 132844F1A7; Wed, 27 Jul 2022 09:27:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4B7FAB821C5; Wed, 27 Jul 2022 16:27:25 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id AF883C433C1; Wed, 27 Jul 2022 16:27:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939244; bh=TX+Sdx7vNb92kNhrkYvV7Qs/pncP26B1lxcQyV/riF4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xKghRvpYgb/r7Hp5zuZmfCeVoYaEZ61wcFHqH/Bn5uxF7EAuv+GtvKzNerMsZwqjc 2UOSLiXLhuynHvd6T6/9mF+QTq6M9W3migTW2kw+6XCoZDGRS4nUc9f9Mbvv0thjC9 pBE7adO2Jp1vdaitrfWgPIM65lCJkVG7jrmHXWzo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Menzel , Luiz Augusto von Dentz , Marcel Holtmann , Harshit Mogalapalli Subject: [PATCH 4.19 51/62] Bluetooth: Fix bt_skb_sendmmsg not allocating partial chunks Date: Wed, 27 Jul 2022 18:11:00 +0200 Message-Id: <20220727161006.132537825@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Luiz Augusto von Dentz commit 29fb608396d6a62c1b85acc421ad7a4399085b9f upstream. Since bt_skb_sendmmsg can be used with the likes of SOCK_STREAM it shall return the partial chunks it could allocate instead of freeing everything as otherwise it can cause problems like bellow. Fixes: 81be03e026dc ("Bluetooth: RFCOMM: Replace use of memcpy_from_msg wit= h bt_skb_sendmmsg") Reported-by: Paul Menzel Link: https://lore.kernel.org/r/d7206e12-1b99-c3be-84f4-df22af427ef5@molgen= .mpg.de BugLink: https://bugzilla.kernel.org/show_bug.cgi?id=3D215594 Signed-off-by: Luiz Augusto von Dentz Tested-by: Paul Menzel (Nokia N9 (MeeGo/Harmattan) Signed-off-by: Marcel Holtmann Cc: Harshit Mogalapalli Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- include/net/bluetooth/bluetooth.h | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --- a/include/net/bluetooth/bluetooth.h +++ b/include/net/bluetooth/bluetooth.h @@ -423,8 +423,7 @@ static inline struct sk_buff *bt_skb_sen =20 tmp =3D bt_skb_sendmsg(sk, msg, len, mtu, headroom, tailroom); if (IS_ERR(tmp)) { - kfree_skb(skb); - return tmp; + return skb; } =20 len -=3D tmp->len; From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E5EE1C19F2B for ; Wed, 27 Jul 2022 16:36:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238737AbiG0Qgb (ORCPT ); Wed, 27 Jul 2022 12:36:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46930 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239085AbiG0Qew (ORCPT ); Wed, 27 Jul 2022 12:34:52 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 161C04D4D9; Wed, 27 Jul 2022 09:27:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 947F861A1B; Wed, 27 Jul 2022 16:27:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A0018C433D7; Wed, 27 Jul 2022 16:27:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939247; bh=zL31rUaogdM0Oz7SjUjidmnhf6c2vEMJMOe9tCOLlxc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E6NQpjE+qg/NytPHDFy4k45CvthsAk+7Pis+OGPtTY6132jfb9XcVYTnvcluaTfua rdpUbWidfUOPBWOwk66GCKQIaLvQipL1bpRXpTpJo8AUZxagWYovNoGeTaVhdLfLHD m+iRyLhI6GYpJuLGbRuPP30Cvw8G3aJxFBMPBqrA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , =?UTF-8?q?Ilpo=20J=C3=A4rvinen?= , =?UTF-8?q?Pali=20Roh=C3=A1r?= Subject: [PATCH 4.19 52/62] serial: mvebu-uart: correctly report configured baudrate value Date: Wed, 27 Jul 2022 18:11:01 +0200 Message-Id: <20220727161006.174737118@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Pali Roh=C3=A1r commit 4f532c1e25319e42996ec18a1f473fd50c8e575d upstream. Functions tty_termios_encode_baud_rate() and uart_update_timeout() should be called with the baudrate value which was set to hardware. Linux then report exact values via ioctl(TCGETS2) to userspace. Change mvebu_uart_baud_rate_set() function to return baudrate value which was set to hardware and propagate this value to above mentioned functions. With this change userspace would see precise value in termios c_ospeed field. Fixes: 68a0db1d7da2 ("serial: mvebu-uart: add function to change baudrate") Cc: stable Reviewed-by: Ilpo J=C3=A4rvinen Signed-off-by: Pali Roh=C3=A1r Link: https://lore.kernel.org/r/20220628100922.10717-1-pali@kernel.org Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/serial/mvebu-uart.c | 25 +++++++++++++------------ 1 file changed, 13 insertions(+), 12 deletions(-) --- a/drivers/tty/serial/mvebu-uart.c +++ b/drivers/tty/serial/mvebu-uart.c @@ -442,14 +442,14 @@ static void mvebu_uart_shutdown(struct u } } =20 -static int mvebu_uart_baud_rate_set(struct uart_port *port, unsigned int b= aud) +static unsigned int mvebu_uart_baud_rate_set(struct uart_port *port, unsig= ned int baud) { struct mvebu_uart *mvuart =3D to_mvuart(port); unsigned int d_divisor, m_divisor; u32 brdv; =20 if (IS_ERR(mvuart->clk)) - return -PTR_ERR(mvuart->clk); + return 0; =20 /* * The baudrate is derived from the UART clock thanks to two divisors: @@ -469,7 +469,7 @@ static int mvebu_uart_baud_rate_set(stru brdv |=3D d_divisor; writel(brdv, port->membase + UART_BRDV); =20 - return 0; + return DIV_ROUND_CLOSEST(port->uartclk, d_divisor * m_divisor); } =20 static void mvebu_uart_set_termios(struct uart_port *port, @@ -506,15 +506,11 @@ static void mvebu_uart_set_termios(struc max_baud =3D 230400; =20 baud =3D uart_get_baud_rate(port, termios, old, min_baud, max_baud); - if (mvebu_uart_baud_rate_set(port, baud)) { - /* No clock available, baudrate cannot be changed */ - if (old) - baud =3D uart_get_baud_rate(port, old, NULL, - min_baud, max_baud); - } else { - tty_termios_encode_baud_rate(termios, baud, baud); - uart_update_timeout(port, termios->c_cflag, baud); - } + baud =3D mvebu_uart_baud_rate_set(port, baud); + + /* In case baudrate cannot be changed, report previous old value */ + if (baud =3D=3D 0 && old) + baud =3D tty_termios_baud_rate(old); =20 /* Only the following flag changes are supported */ if (old) { @@ -525,6 +521,11 @@ static void mvebu_uart_set_termios(struc termios->c_cflag |=3D CS8; } =20 + if (baud !=3D 0) { + tty_termios_encode_baud_rate(termios, baud, baud); + uart_update_timeout(port, termios->c_cflag, baud); + } + spin_unlock_irqrestore(&port->lock, flags); } =20 From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 96996C04A68 for ; Wed, 27 Jul 2022 16:36:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238802AbiG0Qgk (ORCPT ); Wed, 27 Jul 2022 12:36:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47138 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S239200AbiG0Qe7 (ORCPT ); Wed, 27 Jul 2022 12:34:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 197564D4FD; Wed, 27 Jul 2022 09:27:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 4886D619FF; Wed, 27 Jul 2022 16:27:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 588F9C433C1; Wed, 27 Jul 2022 16:27:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939249; bh=tXwLX7d9DTRh3m3uL6UzHNSTBXNtjhjwwsi0+G9K12c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2ZJfdP4SBxSUad03glmVZvtnOyYp4Gjm/9bJp3IcYdBrfSfDRImPoV+B2KR0KlVQh 7qT+bQbeZD2R54GXhPaTkWV3I0L2yithQrNvDY3/X664bD/NMY0NI2YZWYKDuCplfH t50F5j5BYVvNhOl/g8BjM/BHRYjVdxecsuVeh59g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Vladimir Zapolskiy , Johan Hovold , Jiri Slaby Subject: [PATCH 4.19 53/62] tty: drivers/tty/, stop using tty_schedule_flip() Date: Wed, 27 Jul 2022 18:11:02 +0200 Message-Id: <20220727161006.223109342@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiri Slaby commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/. Cc: Vladimir Zapolskiy Reviewed-by: Johan Hovold Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20211122111648.30379-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) --- a/drivers/tty/cyclades.c +++ b/drivers/tty/cyclades.c @@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_ } info->idle_stats.recv_idle =3D jiffies; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); =20 /* end of service */ cyy_writeb(info, CyRIR, save_xir & 0x3f); @@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclade mod_timer(&info->rx_full_timer, jiffies + 1); #endif info->idle_stats.recv_idle =3D jiffies; - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); =20 /* Update rx_get */ cy_writel(&buf_ctrl->rx_get, new_rx_get); @@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclad if (delta_count) wake_up_interruptible(&info->port.delta_msr_wait); if (special_count) - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); } } =20 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrup address =3D (unsigned long)(void *)buf; goldfish_tty_rw(qtty, address, count, 0); =20 - tty_schedule_flip(&qtty->port); + tty_flip_buffer_push(&qtty->port); return IRQ_HANDLED; } =20 --- a/drivers/tty/moxa.c +++ b/drivers/tty/moxa.c @@ -1393,7 +1393,7 @@ static int moxa_poll_port(struct moxa_po if (inited && !tty_throttled(tty) && MoxaPortRxQueue(p) > 0) { /* RX */ MoxaPortReadData(p); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } } else { clear_bit(EMPTYWAIT, &p->statusflags); @@ -1418,7 +1418,7 @@ static int moxa_poll_port(struct moxa_po =20 if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ tty_insert_flip_char(&p->port, 0, TTY_BREAK); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } =20 if (intr & IntrLine) --- a/drivers/tty/serial/lpc32xx_hs.c +++ b/drivers/tty/serial/lpc32xx_hs.c @@ -341,7 +341,7 @@ static irqreturn_t serial_lpc32xx_interr LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++; tty_insert_flip_char(tport, 0, TTY_OVERRUN); - tty_schedule_flip(tport); + tty_flip_buffer_push(tport); } =20 /* Data received? */ --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -310,7 +310,7 @@ int kbd_rate(struct kbd_repeat *rpt) static void put_queue(struct vc_data *vc, int ch) { tty_insert_flip_char(&vc->port, ch, 0); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } =20 static void puts_queue(struct vc_data *vc, char *cp) @@ -319,7 +319,7 @@ static void puts_queue(struct vc_data *v tty_insert_flip_char(&vc->port, *cp, 0); cp++; } - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } =20 static void applkey(struct vc_data *vc, int key, char mode) @@ -564,7 +564,7 @@ static void fn_inc_console(struct vc_dat static void fn_send_intr(struct vc_data *vc) { tty_insert_flip_char(&vc->port, 0, TTY_BREAK); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } =20 static void fn_scroll_forw(struct vc_data *vc) --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1838,7 +1838,7 @@ static void respond_string(const char *p tty_insert_flip_char(port, *p, 0); p++; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); } =20 static void cursor_report(struct vc_data *vc, struct tty_struct *tty) From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 24142C04A68 for ; Wed, 27 Jul 2022 16:37:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238798AbiG0Qhr (ORCPT ); Wed, 27 Jul 2022 12:37:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47064 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238672AbiG0QgN (ORCPT ); Wed, 27 Jul 2022 12:36:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B64356BB6; Wed, 27 Jul 2022 09:28:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C2313B821C6; Wed, 27 Jul 2022 16:27:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E5DF1C433D6; Wed, 27 Jul 2022 16:27:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939252; bh=mOFED5k46BSdcCPPiEfgP6QcLJrPfdghTqkdp+JAGMc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NakBvEVCwcvPxmgphK6YLXgKgmVQE1GtdJfqjCFPLxG+/rULjZm01ySjlXSf5Cuc1 a6wBADKYr0fjKlN6TWbhEuWdeIl443Co9QP0ZL+ArjmY2mo8i6vXk+X4v0nlhWl66v D5go/k57ktCGtN1SFyUKzEeMxjVi5iRTd8aqmqM8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Richard Henderson , Ivan Kokshaysky , Matt Turner , William Hubbs , Chris Brannon , Kirk Reiser , Samuel Thibault , Heiko Carstens , Vasily Gorbik , Christian Borntraeger , Alexander Gordeev , Johan Hovold , Jiri Slaby Subject: [PATCH 4.19 54/62] tty: the rest, stop using tty_schedule_flip() Date: Wed, 27 Jul 2022 18:11:03 +0200 Message-Id: <20220727161006.261681396@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiri Slaby commit b68b914494df4f79b4e9b58953110574af1cb7a2 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in the rest of the users. Cc: Richard Henderson Cc: Ivan Kokshaysky Cc: Matt Turner Cc: William Hubbs Cc: Chris Brannon Cc: Kirk Reiser Cc: Samuel Thibault Cc: Heiko Carstens Cc: Vasily Gorbik Cc: Christian Borntraeger Cc: Alexander Gordeev Reviewed-by: Johan Hovold Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20211122111648.30379-3-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- arch/alpha/kernel/srmcons.c | 2 +- drivers/s390/char/keyboard.h | 4 ++-- drivers/staging/speakup/spk_ttyio.c | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) --- a/arch/alpha/kernel/srmcons.c +++ b/arch/alpha/kernel/srmcons.c @@ -59,7 +59,7 @@ srmcons_do_receive_chars(struct tty_port } while((result.bits.status & 1) && (++loops < 10)); =20 if (count) - tty_schedule_flip(port); + tty_flip_buffer_push(port); =20 return count; } --- a/drivers/s390/char/keyboard.h +++ b/drivers/s390/char/keyboard.h @@ -56,7 +56,7 @@ static inline void kbd_put_queue(struct tty_port *port, int ch) { tty_insert_flip_char(port, ch, 0); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } =20 static inline void @@ -64,5 +64,5 @@ kbd_puts_queue(struct tty_port *port, ch { while (*cp) tty_insert_flip_char(port, *cp++, 0); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } --- a/drivers/staging/speakup/spk_ttyio.c +++ b/drivers/staging/speakup/spk_ttyio.c @@ -88,7 +88,7 @@ static int spk_ttyio_receive_buf2(struct } =20 if (!ldisc_data->buf_free) - /* ttyio_in will tty_schedule_flip */ + /* ttyio_in will tty_flip_buffer_push */ return 0; =20 /* Make sure the consumer has read buf before we have seen @@ -321,7 +321,7 @@ static unsigned char ttyio_in(int timeou mb(); ldisc_data->buf_free =3D true; /* Let TTY push more characters */ - tty_schedule_flip(speakup_tty->port); + tty_flip_buffer_push(speakup_tty->port); =20 return rv; } From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DF5EC04A68 for ; Wed, 27 Jul 2022 16:36:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238821AbiG0Qgs (ORCPT ); Wed, 27 Jul 2022 12:36:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237771AbiG0QfG (ORCPT ); Wed, 27 Jul 2022 12:35:06 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8A4804F667; Wed, 27 Jul 2022 09:27:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 7126DB821C3; Wed, 27 Jul 2022 16:27:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D21BFC433C1; Wed, 27 Jul 2022 16:27:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939255; bh=WmCeooSfx1oYC7pgLZp0XLUVDmyYNFktrIvPo2aqTME=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1j6vlNAu4gu/XU+n7S4lIXLxXe/a0vR9jOlju/kVoLrhuzqWu/hR6uXtE1cOlDfvA Rpl7Gl9LYVgIK6S2AVec30/oPj0Zub4jM9tkfZ0UAX/aiuujm+SEHIo+9s0mlkLzvW SJeW18TwWhUT16ojtQ52+itTjnk/m5lz6BJsRUak= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Johan Hovold , Jiri Slaby Subject: [PATCH 4.19 55/62] tty: drop tty_schedule_flip() Date: Wed, 27 Jul 2022 18:11:04 +0200 Message-Id: <20220727161006.293132187@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jiri Slaby commit 5db96ef23bda6c2a61a51693c85b78b52d03f654 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). All users were converted in the previous patches, so remove tty_schedule_flip() completely while inlining its body into tty_flip_buffer_push(). One less exported function. Reviewed-by: Johan Hovold Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20211122111648.30379-4-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/tty_buffer.c | 30 ++++++++---------------------- include/linux/tty_flip.h | 1 - 2 files changed, 8 insertions(+), 23 deletions(-) --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -390,27 +390,6 @@ int __tty_insert_flip_char(struct tty_po EXPORT_SYMBOL(__tty_insert_flip_char); =20 /** - * tty_schedule_flip - push characters to ldisc - * @port: tty port to push from - * - * Takes any pending buffers and transfers their ownership to the - * ldisc side of the queue. It then schedules those characters for - * processing by the line discipline. - */ - -void tty_schedule_flip(struct tty_port *port) -{ - struct tty_bufhead *buf =3D &port->buf; - - /* paired w/ acquire in flush_to_ldisc(); ensures - * flush_to_ldisc() sees buffer data. - */ - smp_store_release(&buf->tail->commit, buf->tail->used); - queue_work(system_unbound_wq, &buf->work); -} -EXPORT_SYMBOL(tty_schedule_flip); - -/** * tty_prepare_flip_string - make room for characters * @port: tty port * @chars: return pointer for character write area @@ -552,7 +531,14 @@ static void flush_to_ldisc(struct work_s =20 void tty_flip_buffer_push(struct tty_port *port) { - tty_schedule_flip(port); + struct tty_bufhead *buf =3D &port->buf; + + /* + * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees + * buffer data. + */ + smp_store_release(&buf->tail->commit, buf->tail->used); + queue_work(system_unbound_wq, &buf->work); } EXPORT_SYMBOL(tty_flip_buffer_push); =20 --- a/include/linux/tty_flip.h +++ b/include/linux/tty_flip.h @@ -12,7 +12,6 @@ extern int tty_insert_flip_string_fixed_ extern int tty_prepare_flip_string(struct tty_port *port, unsigned char **chars, size_t size); extern void tty_flip_buffer_push(struct tty_port *port); -void tty_schedule_flip(struct tty_port *port); int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char f= lag); =20 static inline int tty_insert_flip_char(struct tty_port *port, From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1A3EC04A68 for ; Wed, 27 Jul 2022 16:49:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238929AbiG0Qt4 (ORCPT ); Wed, 27 Jul 2022 12:49:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44952 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240640AbiG0QtJ (ORCPT ); Wed, 27 Jul 2022 12:49:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id ADDD56172E; Wed, 27 Jul 2022 09:32:40 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8393B619C0; Wed, 27 Jul 2022 16:27:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 93EB5C433C1; Wed, 27 Jul 2022 16:27:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939257; bh=vKTOit1j4oqPUe/wwvhNKAYzkOLY6aMMJK7gUc90wME=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kKNj9NqnVgOzdkTk724bs/PkD7mCyhvmFYzWCUEQJjupnjHhxKjux84pAyiEHhO3i 1VCfLAwELtnNNyHwlGCrckrI4/nEGUd8PEnLtQdIOR5y6/Fm979+W70ObwC0pZdxXp 0KW6xfgrHJ6m+pAoLUUGLl2hcXXvU0JkgNMQ1GNk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hillf Danton , =?UTF-8?q?=E4=B8=80=E5=8F=AA=E7=8B=97?= , Dan Carpenter , Jiri Slaby Subject: [PATCH 4.19 56/62] tty: extract tty_flip_buffer_commit() from tty_flip_buffer_push() Date: Wed, 27 Jul 2022 18:11:05 +0200 Message-Id: <20220727161006.333043974@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jiri Slaby commit 716b10580283fda66f2b88140e3964f8a7f9da89 upstream. We will need this new helper in the next patch. Cc: Hillf Danton Cc: =E4=B8=80=E5=8F=AA=E7=8B=97 Cc: Dan Carpenter Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220707082558.9250-1-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/tty_buffer.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -518,6 +518,15 @@ static void flush_to_ldisc(struct work_s =20 } =20 +static inline void tty_flip_buffer_commit(struct tty_buffer *tail) +{ + /* + * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees + * buffer data. + */ + smp_store_release(&tail->commit, tail->used); +} + /** * tty_flip_buffer_push - terminal * @port: tty port to push @@ -533,11 +542,7 @@ void tty_flip_buffer_push(struct tty_por { struct tty_bufhead *buf =3D &port->buf; =20 - /* - * Paired w/ acquire in flush_to_ldisc(); ensures flush_to_ldisc() sees - * buffer data. - */ - smp_store_release(&buf->tail->commit, buf->tail->used); + tty_flip_buffer_commit(buf->tail); queue_work(system_unbound_wq, &buf->work); } EXPORT_SYMBOL(tty_flip_buffer_push); From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8A813C04A68 for ; Wed, 27 Jul 2022 16:36:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238865AbiG0Qgx (ORCPT ); Wed, 27 Jul 2022 12:36:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47664 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237965AbiG0QfI (ORCPT ); Wed, 27 Jul 2022 12:35:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DFA8F56B93; Wed, 27 Jul 2022 09:27:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 228A9B821CB; Wed, 27 Jul 2022 16:27:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5DF34C433D6; Wed, 27 Jul 2022 16:27:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939260; bh=lybdaq6uKudUqfYXxUSkTfKxk/xAIs80HzWNT+hwtq0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=XMYem/mLFbTz+dWaKIfrFjH2hjzJRgATqTbML/5yR9FLvDON5fpbBAVKjePrbnDzj wJYtRCYQfu3y/ww32yviEl7PuvSfhHwihoLgvQPJH/8eMgCqst2j59HaHMHilW6HK/ hNPV+JpfLlewCMrWa3+u37sf779aygzAxbEbPGWQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?=E4=B8=80=E5=8F=AA=E7=8B=97?= , Dan Carpenter , Hillf Danton , Jiri Slaby Subject: [PATCH 4.19 57/62] tty: use new tty_insert_flip_string_and_push_buffer() in pty_write() Date: Wed, 27 Jul 2022 18:11:06 +0200 Message-Id: <20220727161006.374175944@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jiri Slaby commit a501ab75e7624d133a5a3c7ec010687c8b961d23 upstream. There is a race in pty_write(). pty_write() can be called in parallel with e.g. ioctl(TIOCSTI) or ioctl(TCXONC) which also inserts chars to the buffer. Provided, tty_flip_buffer_push() in pty_write() is called outside the lock, it can commit inconsistent tail. This can lead to out of bounds writes and other issues. See the Link below. To fix this, we have to introduce a new helper called tty_insert_flip_string_and_push_buffer(). It does both tty_insert_flip_string() and tty_flip_buffer_commit() under the port lock. It also calls queue_work(), but outside the lock. See 71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in pty_write) for the reasons. Keep the helper internal-only (in drivers' tty.h). It is not intended to be used widely. Link: https://seclists.org/oss-sec/2022/q2/155 Fixes: 71a174b39f10 (pty: do tty_flip_buffer_push without port->lock in pty= _write) Cc: =E4=B8=80=E5=8F=AA=E7=8B=97 Cc: Dan Carpenter Suggested-by: Hillf Danton Signed-off-by: Jiri Slaby Link: https://lore.kernel.org/r/20220707082558.9250-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/tty/pty.c | 14 ++------------ drivers/tty/tty_buffer.c | 31 +++++++++++++++++++++++++++++++ include/linux/tty_flip.h | 3 +++ 3 files changed, 36 insertions(+), 12 deletions(-) --- a/drivers/tty/pty.c +++ b/drivers/tty/pty.c @@ -111,21 +111,11 @@ static void pty_unthrottle(struct tty_st static int pty_write(struct tty_struct *tty, const unsigned char *buf, int= c) { struct tty_struct *to =3D tty->link; - unsigned long flags; =20 - if (tty->stopped) + if (tty->stopped || !c) return 0; =20 - if (c > 0) { - spin_lock_irqsave(&to->port->lock, flags); - /* Stuff the data into the input queue of the other end */ - c =3D tty_insert_flip_string(to->port, buf, c); - spin_unlock_irqrestore(&to->port->lock, flags); - /* And shovel */ - if (c) - tty_flip_buffer_push(to->port); - } - return c; + return tty_insert_flip_string_and_push_buffer(to->port, buf, c); } =20 /** --- a/drivers/tty/tty_buffer.c +++ b/drivers/tty/tty_buffer.c @@ -548,6 +548,37 @@ void tty_flip_buffer_push(struct tty_por EXPORT_SYMBOL(tty_flip_buffer_push); =20 /** + * tty_insert_flip_string_and_push_buffer - add characters to the tty buff= er and + * push + * @port: tty port + * @chars: characters + * @size: size + * + * The function combines tty_insert_flip_string() and tty_flip_buffer_push= () + * with the exception of properly holding the @port->lock. + * + * To be used only internally (by pty currently). + * + * Returns: the number added. + */ +int tty_insert_flip_string_and_push_buffer(struct tty_port *port, + const unsigned char *chars, size_t size) +{ + struct tty_bufhead *buf =3D &port->buf; + unsigned long flags; + + spin_lock_irqsave(&port->lock, flags); + size =3D tty_insert_flip_string(port, chars, size); + if (size) + tty_flip_buffer_commit(buf->tail); + spin_unlock_irqrestore(&port->lock, flags); + + queue_work(system_unbound_wq, &buf->work); + + return size; +} + +/** * tty_buffer_init - prepare a tty buffer structure * @tty: tty to initialise * --- a/include/linux/tty_flip.h +++ b/include/linux/tty_flip.h @@ -39,4 +39,7 @@ static inline int tty_insert_flip_string extern void tty_buffer_lock_exclusive(struct tty_port *port); extern void tty_buffer_unlock_exclusive(struct tty_port *port); =20 +int tty_insert_flip_string_and_push_buffer(struct tty_port *port, + const unsigned char *chars, size_t cnt); + #endif /* _LINUX_TTY_FLIP_H */ From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 50CDDC19F2B for ; Wed, 27 Jul 2022 16:36:17 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238257AbiG0QgP (ORCPT ); Wed, 27 Jul 2022 12:36:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47060 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238538AbiG0Qe3 (ORCPT ); Wed, 27 Jul 2022 12:34:29 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 133424F1AF; Wed, 27 Jul 2022 09:27:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B065461A08; Wed, 27 Jul 2022 16:27:07 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BC871C433C1; Wed, 27 Jul 2022 16:27:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939227; bh=J33//SefDHkK5Xw+LHLVsbe0xhaMJJGR2xNiQs91V50=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FB8ion0sCWVPEfJILDY8768tV15X5AiVuDK10wswYbyHMEfhV9ea6UlVnV+2JXVK6 asB08c6EcLHfHUHa/JQQzZl4vLheGO9NKwhwGqhHJ0sz0Zduz3nv3vrEjJyfzeNSjY VINjRpQGgiNfAWWgj1ap0MQtycYjyQrSBl7REoCI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jose Alonso , "David S. Miller" Subject: [PATCH 4.19 58/62] net: usb: ax88179_178a needs FLAG_SEND_ZLP Date: Wed, 27 Jul 2022 18:11:07 +0200 Message-Id: <20220727161006.413503984@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jose Alonso commit 36a15e1cb134c0395261ba1940762703f778438c upstream. The extra byte inserted by usbnet.c when (length % dev->maxpacket =3D=3D 0) is causing problems to device. This patch sets FLAG_SEND_ZLP to avoid this. Tested with: 0b95:1790 ASIX Electronics Corp. AX88179 Gigabit Ethernet Problems observed: =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D 1) Using ssh/sshfs. The remote sshd daemon can abort with the message: "message authentication code incorrect" This happens because the tcp message sent is corrupted during the USB "Bulk out". The device calculate the tcp checksum and send a valid tcp message to the remote sshd. Then the encryption detects the error and aborts. 2) NETDEV WATCHDOG: ... (ax88179_178a): transmit queue 0 timed out 3) Stop normal work without any log message. The "Bulk in" continue receiving packets normally. The host sends "Bulk out" and the device responds with -ECONNRESET. (The netusb.c code tx_complete ignore -ECONNRESET) Under normal conditions these errors take days to happen and in intense usage take hours. A test with ping gives packet loss, showing that something is wrong: ping -4 -s 462 {destination} # 462 =3D 512 - 42 - 8 Not all packets fail. My guess is that the device tries to find another packet starting at the extra byte and will fail or not depending on the next bytes (old buffer content). =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Signed-off-by: Jose Alonso Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/net/usb/ax88179_178a.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) --- a/drivers/net/usb/ax88179_178a.c +++ b/drivers/net/usb/ax88179_178a.c @@ -1706,7 +1706,7 @@ static const struct driver_info ax88179_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1719,7 +1719,7 @@ static const struct driver_info ax88178a .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1732,7 +1732,7 @@ static const struct driver_info cypress_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1745,7 +1745,7 @@ static const struct driver_info dlink_du .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1758,7 +1758,7 @@ static const struct driver_info sitecom_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1771,7 +1771,7 @@ static const struct driver_info samsung_ .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1784,7 +1784,7 @@ static const struct driver_info lenovo_i .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; @@ -1797,7 +1797,7 @@ static const struct driver_info belkin_i .link_reset =3D ax88179_link_reset, .reset =3D ax88179_reset, .stop =3D ax88179_stop, - .flags =3D FLAG_ETHER | FLAG_FRAMING_AX, + .flags =3D FLAG_ETHER | FLAG_FRAMING_AX | FLAG_SEND_ZLP, .rx_fixup =3D ax88179_rx_fixup, .tx_fixup =3D ax88179_tx_fixup, }; From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 665ACC04A68 for ; Wed, 27 Jul 2022 16:37:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238551AbiG0Qg5 (ORCPT ); Wed, 27 Jul 2022 12:36:57 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45370 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237994AbiG0QfJ (ORCPT ); Wed, 27 Jul 2022 12:35:09 -0400 Received: from sin.source.kernel.org (sin.source.kernel.org [IPv6:2604:1380:40e1:4800::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3504E56B98; Wed, 27 Jul 2022 09:27:44 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sin.source.kernel.org (Postfix) with ESMTPS id 98B5FCE22FE; Wed, 27 Jul 2022 16:27:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A5DFDC43470; Wed, 27 Jul 2022 16:27:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939230; bh=Z4lk6ktUBHjRvZGmo2nriJhEHvGNUYbhpQvob/fyIIc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bBQn15pzPtRUD03fi96plEisfMp8W/qiRARSuedqxwt/KBX5u8R1wl9PY0Ekyc4CW LRCNmaASpctPOB0Za6TU3ez0XxHAtvjizoPgSlE325BfRHAh7SsrcsI9nw+jYQNiUA Akp/Uk1F9n/JpfRRop8uTyUY6xuijR2VgcGHpOC8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Jeffrey Hugo , Dexuan Cui , Wei Liu , Carl Vanderlip Subject: [PATCH 4.19 59/62] PCI: hv: Fix multi-MSI to allow more than one MSI vector Date: Wed, 27 Jul 2022 18:11:08 +0200 Message-Id: <20220727161006.444801026@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jeffrey Hugo commit 08e61e861a0e47e5e1a3fb78406afd6b0cea6b6d upstream. If the allocation of multiple MSI vectors for multi-MSI fails in the core PCI framework, the framework will retry the allocation as a single MSI vector, assuming that meets the min_vecs specified by the requesting driver. Hyper-V advertises that multi-MSI is supported, but reuses the VECTOR domain to implement that for x86. The VECTOR domain does not support multi-MSI, so the alloc will always fail and fallback to a single MSI allocation. In short, Hyper-V advertises a capability it does not implement. Hyper-V can support multi-MSI because it coordinates with the hypervisor to map the MSIs in the IOMMU's interrupt remapper, which is something the VECTOR domain does not have. Therefore the fix is simple - copy what the x86 IOMMU drivers (AMD/Intel-IR) do by removing X86_IRQ_ALLOC_CONTIGUOUS_VECTORS after calling the VECTOR domain's pci_msi_prepare(). 4.19 backport - adds the hv_msi_prepare wrapper function. X86_IRQ_ALLOC_TYPE_PCI_MSI changed to X86_IRQ_ALLOC_TYPE_MSI (same value). Fixes: 4daace0d8ce8 ("PCI: hv: Add paravirtual PCI front-end for Microsoft = Hyper-V VMs") Signed-off-by: Jeffrey Hugo Reviewed-by: Dexuan Cui Link: https://lore.kernel.org/r/1649856981-14649-1-git-send-email-quic_jhug= o@quicinc.com Signed-off-by: Wei Liu Signed-off-by: Carl Vanderlip Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-hyperv.c | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) --- a/drivers/pci/controller/pci-hyperv.c +++ b/drivers/pci/controller/pci-hyperv.c @@ -893,6 +893,21 @@ static void hv_irq_mask(struct irq_data pci_msi_mask_irq(data); } =20 +static int hv_msi_prepare(struct irq_domain *domain, struct device *dev, + int nvec, msi_alloc_info_t *info) +{ + int ret =3D pci_msi_prepare(domain, dev, nvec, info); + + /* + * By using the interrupt remapper in the hypervisor IOMMU, contiguous + * CPU vectors is not needed for multi-MSI + */ + if (info->type =3D=3D X86_IRQ_ALLOC_TYPE_MSI) + info->flags &=3D ~X86_IRQ_ALLOC_CONTIGUOUS_VECTORS; + + return ret; +} + /** * hv_irq_unmask() - "Unmask" the IRQ by setting its current * affinity. @@ -1240,7 +1255,7 @@ static irq_hw_number_t hv_msi_domain_ops =20 static struct msi_domain_ops hv_msi_ops =3D { .get_hwirq =3D hv_msi_domain_ops_get_hwirq, - .msi_prepare =3D pci_msi_prepare, + .msi_prepare =3D hv_msi_prepare, .set_desc =3D pci_msi_set_desc, .msi_free =3D hv_msi_free, }; From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 21643C04A68 for ; Wed, 27 Jul 2022 16:36:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238676AbiG0QgT (ORCPT ); Wed, 27 Jul 2022 12:36:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44926 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238670AbiG0Qee (ORCPT ); Wed, 27 Jul 2022 12:34:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B41C4558F4; Wed, 27 Jul 2022 09:27:13 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 71076617EF; Wed, 27 Jul 2022 16:27:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7FA5BC433D6; Wed, 27 Jul 2022 16:27:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939232; bh=YZ7zYuglbJZv2KjAVhigP6ic7xbN35pVa9r4sHEmF9Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lbJvGp0Mwf8+5ReTOOQnWCNPeXfQhY9VLWyAGF3HDYf7QxQh5WsJ56UhoMvFvdfju pdg8KUPBtBlL4NOe7dqbCfQ0INuVFjIYIahOxtvhvPfptRuP9zP+BlPx93UUZYSkMM NkR2/MJ5sHmqDMLwcVtkijZNUgIyNNAh/X85RPz8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Jeffrey Hugo , Michael Kelley , Wei Liu , Carl Vanderlip Subject: [PATCH 4.19 60/62] PCI: hv: Fix hv_arch_irq_unmask() for multi-MSI Date: Wed, 27 Jul 2022 18:11:09 +0200 Message-Id: <20220727161006.486102474@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jeffrey Hugo commit 455880dfe292a2bdd3b4ad6a107299fce610e64b upstream. In the multi-MSI case, hv_arch_irq_unmask() will only operate on the first MSI of the N allocated. This is because only the first msi_desc is cached and it is shared by all the MSIs of the multi-MSI block. This means that hv_arch_irq_unmask() gets the correct address, but the wrong data (always 0). This can break MSIs. Lets assume MSI0 is vector 34 on CPU0, and MSI1 is vector 33 on CPU0. hv_arch_irq_unmask() is called on MSI0. It uses a hypercall to configure the MSI address and data (0) to vector 34 of CPU0. This is correct. Then hv_arch_irq_unmask is called on MSI1. It uses another hypercall to configure the MSI address and data (0) to vector 33 of CPU0. This is wrong, and results in both MSI0 and MSI1 being routed to vector 33. Linux will observe extra instances of MSI1 and no instances of MSI0 despite the endpoint device behaving correctly. For the multi-MSI case, we need unique address and data info for each MSI, but the cached msi_desc does not provide that. However, that information can be gotten from the int_desc cached in the chip_data by compose_msi_msg(). Fix the multi-MSI case to use that cached information instead. Since hv_set_msi_entry_from_desc() is no longer applicable, remove it. 4.19 backport - hv_set_msi_entry_from_desc doesn't exist to be removed. int_entry replaces msi_entry for location int_desc is written to. Signed-off-by: Jeffrey Hugo Reviewed-by: Michael Kelley Link: https://lore.kernel.org/r/1651068453-29588-1-git-send-email-quic_jhug= o@quicinc.com Signed-off-by: Wei Liu Signed-off-by: Carl Vanderlip Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-hyperv.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/pci/controller/pci-hyperv.c +++ b/drivers/pci/controller/pci-hyperv.c @@ -923,6 +923,7 @@ static void hv_irq_unmask(struct irq_dat struct msi_desc *msi_desc =3D irq_data_get_msi_desc(data); struct irq_cfg *cfg =3D irqd_cfg(data); struct retarget_msi_interrupt *params; + struct tran_int_desc *int_desc; struct hv_pcibus_device *hbus; struct cpumask *dest; struct pci_bus *pbus; @@ -937,6 +938,7 @@ static void hv_irq_unmask(struct irq_dat pdev =3D msi_desc_to_pci_dev(msi_desc); pbus =3D pdev->bus; hbus =3D container_of(pbus->sysdata, struct hv_pcibus_device, sysdata); + int_desc =3D data->chip_data; =20 spin_lock_irqsave(&hbus->retarget_msi_interrupt_lock, flags); =20 @@ -944,8 +946,8 @@ static void hv_irq_unmask(struct irq_dat memset(params, 0, sizeof(*params)); params->partition_id =3D HV_PARTITION_ID_SELF; params->int_entry.source =3D 1; /* MSI(-X) */ - params->int_entry.address =3D msi_desc->msg.address_lo; - params->int_entry.data =3D msi_desc->msg.data; + params->int_entry.address =3D int_desc->address & 0xffffffff; + params->int_entry.data =3D int_desc->data; params->device_id =3D (hbus->hdev->dev_instance.b[5] << 24) | (hbus->hdev->dev_instance.b[4] << 16) | (hbus->hdev->dev_instance.b[7] << 8) | From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BEDDEC04A68 for ; Wed, 27 Jul 2022 16:37:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238907AbiG0QhI (ORCPT ); Wed, 27 Jul 2022 12:37:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48586 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238394AbiG0QfT (ORCPT ); Wed, 27 Jul 2022 12:35:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CFEB56BB8; Wed, 27 Jul 2022 09:27:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0494DB821BC; Wed, 27 Jul 2022 16:27:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 536C8C43140; Wed, 27 Jul 2022 16:27:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939235; bh=vUKJwHwLGw596+/yixKmcE8tD832L7JBjKGObLJdvwM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=02fB/PrsyqNI8XR0eBxuWKhnTb3SSEL+ruZreI26Npv+Hjxg6NHFZbxzCYeA06tR0 dwLkq2y30ejzSYWd6QiGUfSU43MDaY7xhIk0frFxNLo+dYW65H+gGCiVIM2tYhxaU7 ow66T97LiA6hsLDTtvj+LeCWrYivVGxNMmlgGQAs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Jeffrey Hugo , Dexuan Cui , Michael Kelley , Wei Liu , Carl Vanderlip Subject: [PATCH 4.19 61/62] PCI: hv: Reuse existing IRTE allocation in compose_msi_msg() Date: Wed, 27 Jul 2022 18:11:10 +0200 Message-Id: <20220727161006.525330926@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jeffrey Hugo commit b4b77778ecc5bfbd4e77de1b2fd5c1dd3c655f1f upstream. Currently if compose_msi_msg() is called multiple times, it will free any previous IRTE allocation, and generate a new allocation. While nothing prevents this from occurring, it is extraneous when Linux could just reuse the existing allocation and avoid a bunch of overhead. However, when future IRTE allocations operate on blocks of MSIs instead of a single line, freeing the allocation will impact all of the lines. This could cause an issue where an allocation of N MSIs occurs, then some of the lines are retargeted, and finally the allocation is freed/reallocated. The freeing of the allocation removes all of the configuration for the entire block, which requires all the lines to be retargeted, which might not happen since some lines might already be unmasked/active. Signed-off-by: Jeffrey Hugo Reviewed-by: Dexuan Cui Tested-by: Dexuan Cui Tested-by: Michael Kelley Link: https://lore.kernel.org/r/1652282582-21595-1-git-send-email-quic_jhug= o@quicinc.com Signed-off-by: Wei Liu Signed-off-by: Carl Vanderlip Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-hyperv.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) --- a/drivers/pci/controller/pci-hyperv.c +++ b/drivers/pci/controller/pci-hyperv.c @@ -1109,6 +1109,15 @@ static void hv_compose_msi_msg(struct ir u32 size; int ret; =20 + /* Reuse the previous allocation */ + if (data->chip_data) { + int_desc =3D data->chip_data; + msg->address_hi =3D int_desc->address >> 32; + msg->address_lo =3D int_desc->address & 0xffffffff; + msg->data =3D int_desc->data; + return; + } + pdev =3D msi_desc_to_pci_dev(irq_data_get_msi_desc(data)); dest =3D irq_data_get_effective_affinity_mask(data); pbus =3D pdev->bus; @@ -1117,13 +1126,6 @@ static void hv_compose_msi_msg(struct ir if (!hpdev) goto return_null_message; =20 - /* Free any previous message that might have already been composed. */ - if (data->chip_data) { - int_desc =3D data->chip_data; - data->chip_data =3D NULL; - hv_int_desc_free(hpdev, int_desc); - } - int_desc =3D kzalloc(sizeof(*int_desc), GFP_ATOMIC); if (!int_desc) goto drop_reference; From nobody Wed Apr 15 02:54:33 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFE86C04A68 for ; Wed, 27 Jul 2022 16:48:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S240590AbiG0Qsr (ORCPT ); Wed, 27 Jul 2022 12:48:47 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55424 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S240165AbiG0QsR (ORCPT ); Wed, 27 Jul 2022 12:48:17 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 49D07606B7; Wed, 27 Jul 2022 09:32:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BEE99B821B6; Wed, 27 Jul 2022 16:27:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 25C2FC433B5; Wed, 27 Jul 2022 16:27:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1658939238; bh=479H/WC34/j9bzML+WwgbpDWqcwcVPd/wV4cSm3tBaU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fGeKxUoNiUZMBCs4TUAugZjJsh4UGfTBm8YrHfUXGqwoOAtrZfx32v/jx0KlMcVpB 8wwLR0UDVotcfGMnSBZMG4S6KMmHbAOpz+ef91np4AhTQjclqOOhDONke6AI3FWVdY B57iZ+G7t+uQ1MmfC874WoQqjmu175K/x1dRhN4E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Greg Kroah-Hartman , Dexuan Cui , Jeffrey Hugo , Michael Kelley , Wei Liu , Carl Vanderlip Subject: [PATCH 4.19 62/62] PCI: hv: Fix interrupt mapping for multi-MSI Date: Wed, 27 Jul 2022 18:11:11 +0200 Message-Id: <20220727161006.565676300@linuxfoundation.org> X-Mailer: git-send-email 2.37.1 In-Reply-To: <20220727161004.175638564@linuxfoundation.org> References: <20220727161004.175638564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jeffrey Hugo commit a2bad844a67b1c7740bda63e87453baf63c3a7f7 upstream. According to Dexuan, the hypervisor folks beleive that multi-msi allocations are not correct. compose_msi_msg() will allocate multi-msi one by one. However, multi-msi is a block of related MSIs, with alignment requirements. In order for the hypervisor to allocate properly aligned and consecutive entries in the IOMMU Interrupt Remapping Table, there should be a single mapping request that requests all of the multi-msi vectors in one shot. Dexuan suggests detecting the multi-msi case and composing a single request related to the first MSI. Then for the other MSIs in the same block, use the cached information. This appears to be viable, so do it. 4.19 backport - add hv_msi_get_int_vector helper function. Fixed merge conflict due to delivery_mode name change (APIC_DELIVERY_MODE_FIXED is the value given to dest_Fixed). Removed unused variable in hv_compose_msi_msg. Fixed reference to msi_desc->pci to point to the same is_msix variable. Removed changes to compose_msi_req_v3 since it doesn't exist yet. Suggested-by: Dexuan Cui Signed-off-by: Jeffrey Hugo Reviewed-by: Dexuan Cui Tested-by: Michael Kelley Link: https://lore.kernel.org/r/1652282599-21643-1-git-send-email-quic_jhug= o@quicinc.com Signed-off-by: Wei Liu Signed-off-by: Carl Vanderlip Signed-off-by: Greg Kroah-Hartman Tested-by: Guenter Roeck Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Shuah Khan Tested-by: Sudip Mukherjee --- drivers/pci/controller/pci-hyperv.c | 61 +++++++++++++++++++++++++++++++= ----- 1 file changed, 53 insertions(+), 8 deletions(-) --- a/drivers/pci/controller/pci-hyperv.c +++ b/drivers/pci/controller/pci-hyperv.c @@ -831,6 +831,10 @@ static void hv_int_desc_free(struct hv_p u8 buffer[sizeof(struct pci_delete_interrupt)]; } ctxt; =20 + if (!int_desc->vector_count) { + kfree(int_desc); + return; + } memset(&ctxt, 0, sizeof(ctxt)); int_pkt =3D (struct pci_delete_interrupt *)&ctxt.pkt.message; int_pkt->message_type.type =3D @@ -893,6 +897,13 @@ static void hv_irq_mask(struct irq_data pci_msi_mask_irq(data); } =20 +static unsigned int hv_msi_get_int_vector(struct irq_data *data) +{ + struct irq_cfg *cfg =3D irqd_cfg(data); + + return cfg->vector; +} + static int hv_msi_prepare(struct irq_domain *domain, struct device *dev, int nvec, msi_alloc_info_t *info) { @@ -1035,12 +1046,12 @@ static void hv_pci_compose_compl(void *c =20 static u32 hv_compose_msi_req_v1( struct pci_create_interrupt *int_pkt, struct cpumask *affinity, - u32 slot, u8 vector) + u32 slot, u8 vector, u8 vector_count) { int_pkt->message_type.type =3D PCI_CREATE_INTERRUPT_MESSAGE; int_pkt->wslot.slot =3D slot; int_pkt->int_desc.vector =3D vector; - int_pkt->int_desc.vector_count =3D 1; + int_pkt->int_desc.vector_count =3D vector_count; int_pkt->int_desc.delivery_mode =3D dest_Fixed; =20 /* @@ -1054,14 +1065,14 @@ static u32 hv_compose_msi_req_v1( =20 static u32 hv_compose_msi_req_v2( struct pci_create_interrupt2 *int_pkt, struct cpumask *affinity, - u32 slot, u8 vector) + u32 slot, u8 vector, u8 vector_count) { int cpu; =20 int_pkt->message_type.type =3D PCI_CREATE_INTERRUPT_MESSAGE2; int_pkt->wslot.slot =3D slot; int_pkt->int_desc.vector =3D vector; - int_pkt->int_desc.vector_count =3D 1; + int_pkt->int_desc.vector_count =3D vector_count; int_pkt->int_desc.delivery_mode =3D dest_Fixed; =20 /* @@ -1089,7 +1100,6 @@ static u32 hv_compose_msi_req_v2( */ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) { - struct irq_cfg *cfg =3D irqd_cfg(data); struct hv_pcibus_device *hbus; struct hv_pci_dev *hpdev; struct pci_bus *pbus; @@ -1098,6 +1108,8 @@ static void hv_compose_msi_msg(struct ir unsigned long flags; struct compose_comp_ctxt comp; struct tran_int_desc *int_desc; + struct msi_desc *msi_desc; + u8 vector, vector_count; struct { struct pci_packet pci_pkt; union { @@ -1118,7 +1130,8 @@ static void hv_compose_msi_msg(struct ir return; } =20 - pdev =3D msi_desc_to_pci_dev(irq_data_get_msi_desc(data)); + msi_desc =3D irq_data_get_msi_desc(data); + pdev =3D msi_desc_to_pci_dev(msi_desc); dest =3D irq_data_get_effective_affinity_mask(data); pbus =3D pdev->bus; hbus =3D container_of(pbus->sysdata, struct hv_pcibus_device, sysdata); @@ -1130,6 +1143,36 @@ static void hv_compose_msi_msg(struct ir if (!int_desc) goto drop_reference; =20 + if (!msi_desc->msi_attrib.is_msix && msi_desc->nvec_used > 1) { + /* + * If this is not the first MSI of Multi MSI, we already have + * a mapping. Can exit early. + */ + if (msi_desc->irq !=3D data->irq) { + data->chip_data =3D int_desc; + int_desc->address =3D msi_desc->msg.address_lo | + (u64)msi_desc->msg.address_hi << 32; + int_desc->data =3D msi_desc->msg.data + + (data->irq - msi_desc->irq); + msg->address_hi =3D msi_desc->msg.address_hi; + msg->address_lo =3D msi_desc->msg.address_lo; + msg->data =3D int_desc->data; + put_pcichild(hpdev); + return; + } + /* + * The vector we select here is a dummy value. The correct + * value gets sent to the hypervisor in unmask(). This needs + * to be aligned with the count, and also not zero. Multi-msi + * is powers of 2 up to 32, so 32 will always work here. + */ + vector =3D 32; + vector_count =3D msi_desc->nvec_used; + } else { + vector =3D hv_msi_get_int_vector(data); + vector_count =3D 1; + } + memset(&ctxt, 0, sizeof(ctxt)); init_completion(&comp.comp_pkt.host_event); ctxt.pci_pkt.completion_func =3D hv_pci_compose_compl; @@ -1140,14 +1183,16 @@ static void hv_compose_msi_msg(struct ir size =3D hv_compose_msi_req_v1(&ctxt.int_pkts.v1, dest, hpdev->desc.win_slot.slot, - cfg->vector); + vector, + vector_count); break; =20 case PCI_PROTOCOL_VERSION_1_2: size =3D hv_compose_msi_req_v2(&ctxt.int_pkts.v2, dest, hpdev->desc.win_slot.slot, - cfg->vector); + vector, + vector_count); break; =20 default: