From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3B959C54EE9 for ; Tue, 13 Sep 2022 15:22:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236032AbiIMPWg (ORCPT ); Tue, 13 Sep 2022 11:22:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56660 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232199AbiIMPWE (ORCPT ); Tue, 13 Sep 2022 11:22:04 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E57AB7B7A0; Tue, 13 Sep 2022 07:36:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DF807B80FA6; Tue, 13 Sep 2022 14:21:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1A649C433D6; Tue, 13 Sep 2022 14:21:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078911; bh=lUDWtF7U9ywnCODZtv5uQR2taTIVyThCDhb0jCdN7jw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a/1AuThe4f+hx/cVTGdhM/4WETS8H98zrHgseZZhQvvH16attJe4QQkhQF1k84HR7 ePWjdPE7fsGOdT8kW2cyZle4aUJpjh3z9P1mmkH1HZrUHx4HragRafY7lhELjK6VYh K1OLsDZZ0YWBZ8G/UJLJfQUqcS0WWIWSYLmao/4A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Rick Macklem , Chuck Lever , Michael Kochera Subject: [PATCH 5.10 01/79] NFSD: Fix verifier returned in stable WRITEs Date: Tue, 13 Sep 2022 16:04:06 +0200 Message-Id: <20220913140350.359903417@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chuck Lever commit f11ad7aa653130b71e2e89bed207f387718216d5 upstream. RFC 8881 explains the purpose of the write verifier this way: > The final portion of the result is the field writeverf. This field > is the write verifier and is a cookie that the client can use to > determine whether a server has changed instance state (e.g., server > restart) between a call to WRITE and a subsequent call to either > WRITE or COMMIT. But then it says: > This cookie MUST be unchanged during a single instance of the > NFSv4.1 server and MUST be unique between instances of the NFSv4.1 > server. If the cookie changes, then the client MUST assume that > any data written with an UNSTABLE4 value for committed and an old > writeverf in the reply has been lost and will need to be > recovered. RFC 1813 has similar language for NFSv3. NFSv2 does not have a write verifier since it doesn't implement the COMMIT procedure. Since commit 19e0663ff9bc ("nfsd: Ensure sampling of the write verifier is atomic with the write"), the Linux NFS server has returned a boot-time-based verifier for UNSTABLE WRITEs, but a zero verifier for FILE_SYNC and DATA_SYNC WRITEs. FILE_SYNC and DATA_SYNC WRITEs are not followed up with a COMMIT, so there's no need for clients to compare verifiers for stable writes. However, by returning a different verifier for stable and unstable writes, the above commit puts the Linux NFS server a step farther out of compliance with the first MUST above. At least one NFS client (FreeBSD) noticed the difference, making this a potential regression. [Removed down_write to fix the conflict in the cherry-pick. The down_write functionality was no longer needed there. Upstream commit 555dbf1a9aac6d3150c8b52fa35f768a692f4eeb titled nfsd: Replace use of rwsem with errseq_t removed those and replace it with new functionality that was more scalable. This commit is already backported onto 5.10 and so removing down_write ensures consistency with that change. Tested by compiling and booting successfully. - kochera] Reported-by: Rick Macklem Link: https://lore.kernel.org/linux-nfs/YQXPR0101MB096857EEACF04A6DF1FC6D9B= DD749@YQXPR0101MB0968.CANPRD01.PROD.OUTLOOK.COM/T/ Fixes: 19e0663ff9bc ("nfsd: Ensure sampling of the write verifier is atomic= with the write") Signed-off-by: Chuck Lever Signed-off-by: Michael Kochera Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- fs/nfsd/vfs.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1014,6 +1014,10 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s iov_iter_kvec(&iter, WRITE, vec, vlen, *cnt); since =3D READ_ONCE(file->f_wb_err); if (flags & RWF_SYNC) { + if (verf) + nfsd_copy_boot_verifier(verf, + net_generic(SVC_NET(rqstp), + nfsd_net_id)); host_err =3D vfs_iter_write(file, &iter, &pos, flags); if (host_err < 0) nfsd_reset_boot_verifier(net_generic(SVC_NET(rqstp), From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id CFBB7C6FA82 for ; Tue, 13 Sep 2022 14:45:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230470AbiIMOpM (ORCPT ); Tue, 13 Sep 2022 10:45:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59128 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234143AbiIMOmh (ORCPT ); Tue, 13 Sep 2022 10:42:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C3CE42FFD7; Tue, 13 Sep 2022 07:22:39 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DB3C5B80FBC; Tue, 13 Sep 2022 14:22:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3FA0DC433D6; Tue, 13 Sep 2022 14:22:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078940; bh=tVAbAvCjhuEg7A6fhu9ETVqCIukL5QdM6oRk66+FGAE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=BTtIVdpuvWCfWKlsr0dHfyL+CLL+x3T+OHhOxl1gW2Cc8/kkjZ7JJNVx4Eauf6ESA MS9jj4F8Ay2RBM4veKEQPli3RrhgTd+T1gV7sYLm9xih0XrP0DUAG5Uf9CMKgsdio3 KV5RZw0KQGQ2WzxtWv402PixOF0Xtb7JHS/vShEw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Marek=20Marczykowski-G=C3=B3recki?= , SeongJae Park , Juergen Gross Subject: [PATCH 5.10 02/79] xen-blkfront: Cache feature_persistent value before advertisement Date: Tue, 13 Sep 2022 16:04:07 +0200 Message-Id: <20220913140350.404321086@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: SeongJae Park commit fe8f65b018effbf473f53af3538d0c1878b8b329 upstream. Xen blkfront advertises its support of the persistent grants feature when it first setting up and when resuming in 'talk_to_blkback()'. Then, blkback reads the advertised value when it connects with blkfront and decides if it will use the persistent grants feature or not, and advertises its decision to blkfront. Blkfront reads the blkback's decision and it also makes the decision for the use of the feature. Commit 402c43ea6b34 ("xen-blkfront: Apply 'feature_persistent' parameter when connect"), however, made the blkfront's read of the parameter for disabling the advertisement, namely 'feature_persistent', to be done when it negotiate, not when advertise. Therefore blkfront advertises without reading the parameter. As the field for caching the parameter value is zero-initialized, it always advertises as the feature is disabled, so that the persistent grants feature becomes always disabled. This commit fixes the issue by making the blkfront does parmeter caching just before the advertisement. Fixes: 402c43ea6b34 ("xen-blkfront: Apply 'feature_persistent' parameter wh= en connect") Cc: # 5.10.x Reported-by: Marek Marczykowski-G=C3=B3recki Signed-off-by: SeongJae Park Tested-by: Marek Marczykowski-G=C3=B3recki Reviewed-by: Juergen Gross Link: https://lore.kernel.org/r/20220831165824.94815-4-sj@kernel.org Signed-off-by: Juergen Gross Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/block/xen-blkfront.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) --- a/drivers/block/xen-blkfront.c +++ b/drivers/block/xen-blkfront.c @@ -1852,6 +1852,12 @@ static void free_info(struct blkfront_in kfree(info); } =20 +/* Enable the persistent grants feature. */ +static bool feature_persistent =3D true; +module_param(feature_persistent, bool, 0644); +MODULE_PARM_DESC(feature_persistent, + "Enables the persistent grants feature"); + /* Common code used when first setting up, and when resuming. */ static int talk_to_blkback(struct xenbus_device *dev, struct blkfront_info *info) @@ -1943,6 +1949,7 @@ again: message =3D "writing protocol"; goto abort_transaction; } + info->feature_persistent_parm =3D feature_persistent; err =3D xenbus_printf(xbt, dev->nodename, "feature-persistent", "%u", info->feature_persistent_parm); if (err) @@ -2019,12 +2026,6 @@ static int negotiate_mq(struct blkfront_ return 0; } =20 -/* Enable the persistent grants feature. */ -static bool feature_persistent =3D true; -module_param(feature_persistent, bool, 0644); -MODULE_PARM_DESC(feature_persistent, - "Enables the persistent grants feature"); - /** * Entry point to this code when a new device is created. Allocate the ba= sic * structures and the ring buffer for communication with the backend, and @@ -2394,7 +2395,6 @@ static void blkfront_gather_backend_feat if (xenbus_read_unsigned(info->xbdev->otherend, "feature-discard", 0)) blkfront_setup_discard(info); =20 - info->feature_persistent_parm =3D feature_persistent; if (info->feature_persistent_parm) info->feature_persistent =3D !!xenbus_read_unsigned(info->xbdev->otherend, From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 4099FC54EE9 for ; Tue, 13 Sep 2022 14:44:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231258AbiIMOoq (ORCPT ); Tue, 13 Sep 2022 10:44:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40772 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233086AbiIMOmb (ORCPT ); Tue, 13 Sep 2022 10:42:31 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 994A75FF4E; Tue, 13 Sep 2022 07:22:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1D5C4B80F01; Tue, 13 Sep 2022 14:22:37 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7E59BC433C1; Tue, 13 Sep 2022 14:22:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078955; bh=TDPwj3b/S3MexzapRQJ0/V6tRppIAPrvSk1VkTJLtCk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=WrS9bI6gHqFyqfqR3nQKzz3nz/w1djOYlR+qCzBnXYbzlqVTBj0JwqXmUjurg4Fu6 2o+8/EvZfu+CDbtLNoOl2ov6RBypw1BLZVKp4uX02Qp5hLpIn0h4GY3iC613ccnpBS LoT4NwKS8WlWl3CSGhKq+HzvzbhEgjHibSuMbfck= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot , stable , Jiri Slaby , Tetsuo Handa , Fedor Pchelkin Subject: [PATCH 5.10 03/79] tty: n_gsm: initialize more members at gsm_alloc_mux() Date: Tue, 13 Sep 2022 16:04:08 +0200 Message-Id: <20220913140350.450170649@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tetsuo Handa commit 4bb1a53be85fcb1e24c14860e326a00cdd362c28 upstream. syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for commit 32dd59f ("tty: n_gsm: fix race condition in gsmld_write()") allows accessing gsm->tx_lock before gsm_activate_mux() initializes it. Since object initialization should be done right after allocation in order to avoid accessing uninitialized memory, move initialization of timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to gsm_alloc_mux(). Link: https://syzkaller.appspot.com/bug?extid=3Dcf155def4e717db68a12 [1] Fixes: 32dd59f ("tty: n_gsm: fix race condition in gsmld_write()") Reported-by: syzbot Tested-by: syzbot Cc: stable Acked-by: Jiri Slaby Signed-off-by: Tetsuo Handa Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love= .SAKURA.ne.jp Signed-off-by: Fedor Pchelkin Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2200,11 +2200,6 @@ static int gsm_activate_mux(struct gsm_m { struct gsm_dlci *dlci; =20 - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); - init_waitqueue_head(&gsm->event); - spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); - if (gsm->encoding =3D=3D 0) gsm->receive =3D gsm0_receive; else @@ -2306,6 +2301,10 @@ static struct gsm_mux *gsm_alloc_mux(voi mutex_init(&gsm->mutex); kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_list); + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); + init_waitqueue_head(&gsm->event); + spin_lock_init(&gsm->control_lock); + spin_lock_init(&gsm->tx_lock); =20 gsm->t1 =3D T1; gsm->t2 =3D T2; From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D7103C6FA82 for ; Tue, 13 Sep 2022 15:22:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236002AbiIMPW3 (ORCPT ); Tue, 13 Sep 2022 11:22:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39500 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235997AbiIMPVs (ORCPT ); Tue, 13 Sep 2022 11:21:48 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 03B947B790; Tue, 13 Sep 2022 07:36:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 8EC1CB80FA7; Tue, 13 Sep 2022 14:22:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 02CCEC433C1; Tue, 13 Sep 2022 14:22:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078958; bh=va+HJBuGRZoCNsdPQ+63pbbXeFX0jMLuA3EAH7Q+Nc4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D2eDAXf9TTXKNv2zIPFHBkXqa8mGYLtVXq/9pYxXi98DFxrg1tjPekJLaEC90vmyp unke63qk07gmLI7m0stMtBlxGymiO8UKYYAI1U9Qh2pHL0BhK56L8MAS2ulPG5GauE zrIk1lu2pZVwztSCDUlWb/WCHWVHi5U0ZFLXF2Z4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Fedor Pchelkin , Alexey Khoroshilov Subject: [PATCH 5.10 04/79] tty: n_gsm: avoid call of sleeping functions from atomic context Date: Tue, 13 Sep 2022 16:04:09 +0200 Message-Id: <20220913140350.501815100@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Fedor Pchelkin commit 902e02ea9385373ce4b142576eef41c642703955 upstream. Syzkaller reports the following problem: BUG: sleeping function called from invalid context at kernel/printk/printk.= c:2347 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 1105, name: syz-exec= utor423 3 locks held by syz-executor423/1105: #0: ffff8881468b9098 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait= +0x22/0x90 drivers/tty/tty_ldisc.c:266 #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: tty_write_= lock drivers/tty/tty_io.c:952 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: do_tty_wri= te drivers/tty/tty_io.c:975 [inline] #1: ffff8881468b9130 (&tty->atomic_write_lock){+.+.}-{3:3}, at: file_tty_w= rite.constprop.0+0x2a8/0x8e0 drivers/tty/tty_io.c:1118 #2: ffff88801b06c398 (&gsm->tx_lock){....}-{2:2}, at: gsmld_write+0x5e/0x1= 50 drivers/tty/n_gsm.c:2717 irq event stamp: 3482 hardirqs last enabled at (3481): [] __get_reqs_available= +0x143/0x2f0 fs/aio.c:946 hardirqs last disabled at (3482): [] __raw_spin_lock_irqs= ave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (3482): [] _raw_spin_lock_irqsa= ve+0x52/0x60 kernel/locking/spinlock.c:159 softirqs last enabled at (3408): [] asm_call_irq_on_stac= k+0x12/0x20 softirqs last disabled at (3401): [] asm_call_irq_on_stac= k+0x12/0x20 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 2 PID: 1105 Comm: syz-executor423 Not tainted 5.10.137-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/= 2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x167 lib/dump_stack.c:118 ___might_sleep.cold+0x1e8/0x22e kernel/sched/core.c:7304 console_lock+0x19/0x80 kernel/printk/printk.c:2347 do_con_write+0x113/0x1de0 drivers/tty/vt/vt.c:2909 con_write+0x22/0xc0 drivers/tty/vt/vt.c:3296 gsmld_write+0xd0/0x150 drivers/tty/n_gsm.c:2720 do_tty_write drivers/tty/tty_io.c:1028 [inline] file_tty_write.constprop.0+0x502/0x8e0 drivers/tty/tty_io.c:1118 call_write_iter include/linux/fs.h:1903 [inline] aio_write+0x355/0x7b0 fs/aio.c:1580 __io_submit_one fs/aio.c:1952 [inline] io_submit_one+0xf45/0x1a90 fs/aio.c:1999 __do_sys_io_submit fs/aio.c:2058 [inline] __se_sys_io_submit fs/aio.c:2028 [inline] __x64_sys_io_submit+0x18c/0x2f0 fs/aio.c:2028 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x61/0xc6 The problem happens in the following control flow: gsmld_write(...) spin_lock_irqsave(&gsm->tx_lock, flags) // taken a spinlock on TX data con_write(...) do_con_write(...) console_lock() might_sleep() // -> bug As far as console_lock() might sleep it should not be called with spinlock held. The patch replaces tx_lock spinlock with mutex in order to avoid the problem. Found by Linux Verification Center (linuxtesting.org) with Syzkaller. Fixes: 32dd59f ("tty: n_gsm: fix race condition in gsmld_write()") Cc: stable Signed-off-by: Fedor Pchelkin Signed-off-by: Alexey Khoroshilov Link: https://lore.kernel.org/r/20220829131640.69254-3-pchelkin@ispras.ru Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/tty/n_gsm.c | 39 ++++++++++++++++++--------------------- 1 file changed, 18 insertions(+), 21 deletions(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -235,7 +235,7 @@ struct gsm_mux { int old_c_iflag; /* termios c_iflag value before attach */ bool constipated; /* Asked by remote to shut up */ =20 - spinlock_t tx_lock; + struct mutex tx_mutex; unsigned int tx_bytes; /* TX data outstanding */ #define TX_THRESH_HI 8192 #define TX_THRESH_LO 2048 @@ -820,15 +820,14 @@ static void __gsm_data_queue(struct gsm_ * * Add data to the transmit queue and try and get stuff moving * out of the mux tty if not already doing so. Take the - * the gsm tx lock and dlci lock. + * the gsm tx mutex and dlci lock. */ =20 static void gsm_data_queue(struct gsm_dlci *dlci, struct gsm_msg *msg) { - unsigned long flags; - spin_lock_irqsave(&dlci->gsm->tx_lock, flags); + mutex_lock(&dlci->gsm->tx_mutex); __gsm_data_queue(dlci, msg); - spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); + mutex_unlock(&dlci->gsm->tx_mutex); } =20 /** @@ -840,7 +839,7 @@ static void gsm_data_queue(struct gsm_dl * is data. Keep to the MRU of the mux. This path handles the usual tty * interface which is a byte stream with optional modem data. * - * Caller must hold the tx_lock of the mux. + * Caller must hold the tx_mutex of the mux. */ =20 static int gsm_dlci_data_output(struct gsm_mux *gsm, struct gsm_dlci *dlci) @@ -903,7 +902,7 @@ static int gsm_dlci_data_output(struct g * is data. Keep to the MRU of the mux. This path handles framed data * queued as skbuffs to the DLCI. * - * Caller must hold the tx_lock of the mux. + * Caller must hold the tx_mutex of the mux. */ =20 static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, @@ -919,7 +918,7 @@ static int gsm_dlci_data_output_framed(s if (dlci->adaption =3D=3D 4) overhead =3D 1; =20 - /* dlci->skb is locked by tx_lock */ + /* dlci->skb is locked by tx_mutex */ if (dlci->skb =3D=3D NULL) { dlci->skb =3D skb_dequeue_tail(&dlci->skb_list); if (dlci->skb =3D=3D NULL) @@ -1019,13 +1018,12 @@ static void gsm_dlci_data_sweep(struct g =20 static void gsm_dlci_data_kick(struct gsm_dlci *dlci) { - unsigned long flags; int sweep; =20 if (dlci->constipated) return; =20 - spin_lock_irqsave(&dlci->gsm->tx_lock, flags); + mutex_lock(&dlci->gsm->tx_mutex); /* If we have nothing running then we need to fire up */ sweep =3D (dlci->gsm->tx_bytes < TX_THRESH_LO); if (dlci->gsm->tx_bytes =3D=3D 0) { @@ -1036,7 +1034,7 @@ static void gsm_dlci_data_kick(struct gs } if (sweep) gsm_dlci_data_sweep(dlci->gsm); - spin_unlock_irqrestore(&dlci->gsm->tx_lock, flags); + mutex_unlock(&dlci->gsm->tx_mutex); } =20 /* @@ -1258,7 +1256,6 @@ static void gsm_control_message(struct g const u8 *data, int clen) { u8 buf[1]; - unsigned long flags; =20 switch (command) { case CMD_CLD: { @@ -1280,9 +1277,9 @@ static void gsm_control_message(struct g gsm->constipated =3D false; gsm_control_reply(gsm, CMD_FCON, NULL, 0); /* Kick the link in case it is idling */ - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); gsm_data_kick(gsm, NULL); - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); break; case CMD_FCOFF: /* Modem wants us to STFU */ @@ -2228,6 +2225,7 @@ static void gsm_free_mux(struct gsm_mux break; } } + mutex_destroy(&gsm->tx_mutex); mutex_destroy(&gsm->mutex); kfree(gsm->txframe); kfree(gsm->buf); @@ -2299,12 +2297,12 @@ static struct gsm_mux *gsm_alloc_mux(voi } spin_lock_init(&gsm->lock); mutex_init(&gsm->mutex); + mutex_init(&gsm->tx_mutex); kref_init(&gsm->ref); INIT_LIST_HEAD(&gsm->tx_list); timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0); init_waitqueue_head(&gsm->event); spin_lock_init(&gsm->control_lock); - spin_lock_init(&gsm->tx_lock); =20 gsm->t1 =3D T1; gsm->t2 =3D T2; @@ -2329,6 +2327,7 @@ static struct gsm_mux *gsm_alloc_mux(voi } spin_unlock(&gsm_mux_lock); if (i =3D=3D MAX_MUX) { + mutex_destroy(&gsm->tx_mutex); mutex_destroy(&gsm->mutex); kfree(gsm->txframe); kfree(gsm->buf); @@ -2653,16 +2652,15 @@ static int gsmld_open(struct tty_struct static void gsmld_write_wakeup(struct tty_struct *tty) { struct gsm_mux *gsm =3D tty->disc_data; - unsigned long flags; =20 /* Queue poll */ clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); gsm_data_kick(gsm, NULL); if (gsm->tx_bytes < TX_THRESH_LO) { gsm_dlci_data_sweep(gsm); } - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); } =20 /** @@ -2705,7 +2703,6 @@ static ssize_t gsmld_write(struct tty_st const unsigned char *buf, size_t nr) { struct gsm_mux *gsm =3D tty->disc_data; - unsigned long flags; int space; int ret; =20 @@ -2713,13 +2710,13 @@ static ssize_t gsmld_write(struct tty_st return -ENODEV; =20 ret =3D -ENOBUFS; - spin_lock_irqsave(&gsm->tx_lock, flags); + mutex_lock(&gsm->tx_mutex); space =3D tty_write_room(tty); if (space >=3D nr) ret =3D tty->ops->write(tty, buf, nr); else set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); - spin_unlock_irqrestore(&gsm->tx_lock, flags); + mutex_unlock(&gsm->tx_mutex); =20 return ret; } From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B1DBEC6FA82 for ; Tue, 13 Sep 2022 14:45:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232086AbiIMOpt (ORCPT ); Tue, 13 Sep 2022 10:45:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59690 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230195AbiIMOn0 (ORCPT ); Tue, 13 Sep 2022 10:43:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5763C6E2E6; Tue, 13 Sep 2022 07:22:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1FE27B80FB5; Tue, 13 Sep 2022 14:22:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 73081C433D6; Tue, 13 Sep 2022 14:22:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078960; bh=Up5LIPEXCaJUkhECqjxA40RtxLThQNHaLN4RmbE2LX4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Bkfsz6ioLigoFxjy/ImqjCAWwvdjZ1sR/KF5612FzGKR1hVDTP/J5OwWmPPVprqqX 5PlRK/LsYEpg8qSvIUgihC0nt0y2/nmR03ebwZItK5BTZof9v919fgUfsgrco6Qkaf c7QFU4YTLuiqfT9cY/IQ+YrtMD+n6++SyHIYn1iw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Marth , Ard Biesheuvel , Kees Cook Subject: [PATCH 5.10 05/79] efi: libstub: Disable struct randomization Date: Tue, 13 Sep 2022 16:04:10 +0200 Message-Id: <20220913140350.545417134@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ard Biesheuvel commit 1a3887924a7e6edd331be76da7bf4c1e8eab4b1e upstream. The EFI stub is a wrapper around the core kernel that makes it look like a EFI compatible PE/COFF application to the EFI firmware. EFI applications run on top of the EFI runtime, which is heavily based on so-called protocols, which are struct types consisting [mostly] of function pointer members that are instantiated and recorded in a protocol database. These structs look like the ideal randomization candidates to the randstruct plugin (as they only carry function pointers), but of course, these protocols are contracts between the firmware that exposes them, and the EFI applications (including our stubbed kernel) that invoke them. This means that struct randomization for EFI protocols is not a great idea, and given that the stub shares very little data with the core kernel that is represented as a randomizable struct, we're better off just disabling it completely here. Cc: # v4.14+ Reported-by: Daniel Marth Tested-by: Daniel Marth Signed-off-by: Ard Biesheuvel Acked-by: Kees Cook Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/firmware/efi/libstub/Makefile | 7 +++++++ 1 file changed, 7 insertions(+) --- a/drivers/firmware/efi/libstub/Makefile +++ b/drivers/firmware/efi/libstub/Makefile @@ -37,6 +37,13 @@ KBUILD_CFLAGS :=3D $(cflags-y) -Os -DDIS $(call cc-option,-fno-addrsig) \ -D__DISABLE_EXPORTS =20 +# +# struct randomization only makes sense for Linux internal types, which th= e EFI +# stub code never touches, so let's turn off struct randomization for the = stub +# altogether +# +KBUILD_CFLAGS :=3D $(filter-out $(RANDSTRUCT_CFLAGS), $(KBUILD_CFLAGS)) + # remove SCS flags from all objects in this directory KBUILD_CFLAGS :=3D $(filter-out $(CC_FLAGS_SCS), $(KBUILD_CFLAGS)) From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EDF1BC54EE9 for ; Tue, 13 Sep 2022 14:48:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231520AbiIMOsE (ORCPT ); Tue, 13 Sep 2022 10:48:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45968 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231483AbiIMOqo (ORCPT ); Tue, 13 Sep 2022 10:46:44 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 93D8061B02; Tue, 13 Sep 2022 07:24:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id D8911614DC; Tue, 13 Sep 2022 14:22:43 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id EC102C433D6; Tue, 13 Sep 2022 14:22:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078963; bh=U0lw36v5K3lnpJ4xVPpX9D5MtIMf5s6/6zDt1oauxo8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HU/PaHaFt0zAQEdALDVcWLu7rjhiG2SubzysrAZpHZUdYbREyiBGz/IjWsR94PULo 9JlEex4JopZV8xRoKbpSQVk/IT5m+lx2ve/SEg/6jp6IYQFzW5Tsal77jzWQOepZWe O/+uTmYKGM0Rxb22gibVXc7oCe/8SjgagKvY/23I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Hyunwoo Kim , Ard Biesheuvel Subject: [PATCH 5.10 06/79] efi: capsule-loader: Fix use-after-free in efi_capsule_write Date: Tue, 13 Sep 2022 16:04:11 +0200 Message-Id: <20220913140350.600319961@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Hyunwoo Kim commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 upstream. A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: # v4.9+ Signed-off-by: Hyunwoo Kim Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/firmware/efi/capsule-loader.c | 31 +++++++----------------------= -- 1 file changed, 7 insertions(+), 24 deletions(-) --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -243,29 +243,6 @@ failed: } =20 /** - * efi_capsule_flush - called by file close or file flush - * @file: file pointer - * @id: not used - * - * If a capsule is being partially uploaded then calling this function - * will be treated as upload termination and will free those completed - * buffer pages and -ECANCELED will be returned. - **/ -static int efi_capsule_flush(struct file *file, fl_owner_t id) -{ - int ret =3D 0; - struct capsule_info *cap_info =3D file->private_data; - - if (cap_info->index > 0) { - pr_err("capsule upload not complete\n"); - efi_free_all_buff_pages(cap_info); - ret =3D -ECANCELED; - } - - return ret; -} - -/** * efi_capsule_release - called by file close * @inode: not used * @file: file pointer @@ -277,6 +254,13 @@ static int efi_capsule_release(struct in { struct capsule_info *cap_info =3D file->private_data; =20 + if (cap_info->index > 0 && + (cap_info->header.headersize =3D=3D 0 || + cap_info->count < cap_info->total_size)) { + pr_err("capsule upload not complete\n"); + efi_free_all_buff_pages(cap_info); + } + kfree(cap_info->pages); kfree(cap_info->phys); kfree(file->private_data); @@ -324,7 +308,6 @@ static const struct file_operations efi_ .owner =3D THIS_MODULE, .open =3D efi_capsule_open, .write =3D efi_capsule_write, - .flush =3D efi_capsule_flush, .release =3D efi_capsule_release, .llseek =3D no_llseek, }; From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DFF83C6FA8A for ; Tue, 13 Sep 2022 14:45:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230048AbiIMOpF (ORCPT ); Tue, 13 Sep 2022 10:45:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59048 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230273AbiIMOmd (ORCPT ); Tue, 13 Sep 2022 10:42:33 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7AF076E2EC; Tue, 13 Sep 2022 07:22:47 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E4010B80F3B; Tue, 13 Sep 2022 14:22:46 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5FA74C433C1; Tue, 13 Sep 2022 14:22:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078965; bh=31O2RnmTrqwLreTHa69wpotWavAZzHJ+YCcgLoU3qiM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=d3CCZxHcP4QSXbyz3tatWrNCg68rDRJutSVGf6MZyekKyKhY6/MwPfGQW2UmM1WIp Vl60OtlPYl0/KAGUtlGuEY7gSD90DfCA9HHRp/cZ+Jfid5ctl30fLDWQ3LAb1OShIv VvVSyB/rSzzldZNaHY8TNjQ1Bnopdqh+o8hAiObY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Stanislaw Gruszka , Kalle Valo Subject: [PATCH 5.10 07/79] wifi: iwlegacy: 4965: corrected fix for potential off-by-one overflow in il4965_rs_fill_link_cmd() Date: Tue, 13 Sep 2022 16:04:12 +0200 Message-Id: <20220913140350.649369248@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Stanislaw Gruszka commit 6d0ef7241553f3553a0a2764c69b07892705924c upstream. This reverts commit a8eb8e6f7159c7c20c0ddac428bde3d110890aa7 as it can cause invalid link quality command sent to the firmware and address the off-by-one issue by fixing condition of while loop. Cc: stable@vger.kernel.org Fixes: a8eb8e6f7159 ("wifi: iwlegacy: 4965: fix potential off-by-one overfl= ow in il4965_rs_fill_link_cmd()") Signed-off-by: Stanislaw Gruszka Signed-off-by: Kalle Valo Link: https://lore.kernel.org/r/20220815073737.GA999388@wp.pl Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/net/wireless/intel/iwlegacy/4965-rs.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) --- a/drivers/net/wireless/intel/iwlegacy/4965-rs.c +++ b/drivers/net/wireless/intel/iwlegacy/4965-rs.c @@ -2403,7 +2403,7 @@ il4965_rs_fill_link_cmd(struct il_priv * /* Repeat initial/next rate. * For legacy IL_NUMBER_TRY =3D=3D 1, this loop will not execute. * For HT IL_HT_NUMBER_TRY =3D=3D 3, this executes twice. */ - while (repeat_rate > 0) { + while (repeat_rate > 0 && idx < (LINK_QUAL_MAX_RETRY_NUM - 1)) { if (is_legacy(tbl_type.lq_type)) { if (ant_toggle_cnt < NUM_TRY_BEFORE_ANT_TOGGLE) ant_toggle_cnt++; @@ -2422,8 +2422,6 @@ il4965_rs_fill_link_cmd(struct il_priv * cpu_to_le32(new_rate); repeat_rate--; idx++; - if (idx >=3D LINK_QUAL_MAX_RETRY_NUM) - goto out; } =20 il4965_rs_get_tbl_info_from_mcs(new_rate, lq_sta->band, @@ -2468,7 +2466,6 @@ il4965_rs_fill_link_cmd(struct il_priv * repeat_rate--; } =20 -out: lq_cmd->agg_params.agg_frame_cnt_limit =3D LINK_QUAL_AGG_FRAME_LIMIT_DEF; lq_cmd->agg_params.agg_dis_start_th =3D LINK_QUAL_AGG_DISABLE_START_DEF; From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E820EC6FA8A for ; Tue, 13 Sep 2022 14:44:43 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230026AbiIMOol (ORCPT ); Tue, 13 Sep 2022 10:44:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58298 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232186AbiIMOma (ORCPT ); Tue, 13 Sep 2022 10:42:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2277C6E2F8; Tue, 13 Sep 2022 07:22:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 946D1614B4; Tue, 13 Sep 2022 14:22:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F581C433D6; Tue, 13 Sep 2022 14:22:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078968; bh=wgRZma+e4X5kCGxfMKh1BxeU5ur5lm00SFY+zuuMEMI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=S8rvj3AXknWMYQUZC6KaPcz4pTUlOSmBgJHq5GoZQLq6cj93Cxk1j2p6WOO+7aPa8 K6bzKMMJkZBOnv1xzoa4TzDN7oYmyV57+VdmzbJeN3pFWs+icpbxakIOehXVqqoli0 N+RzOXtB/P/co9EUVCeZPh5smLGDPU5a3o/3AyIU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marcin Wojtas , Russell King , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , netdev@vger.kernel.org, stable Subject: [PATCH 5.10 08/79] net: mvpp2: debugfs: fix memory leak when using debugfs_lookup() Date: Tue, 13 Sep 2022 16:04:13 +0200 Message-Id: <20220913140350.695792494@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Kroah-Hartman commit fe2c9c61f668cde28dac2b188028c5299cedcc1e upstream. When calling debugfs_lookup() the result must have dput() called on it, otherwise the memory will leak over time. Fix this up to be much simpler logic and only create the root debugfs directory once when the driver is first accessed. That resolves the memory leak and makes things more obvious as to what the intent is. Cc: Marcin Wojtas Cc: Russell King Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: netdev@vger.kernel.org Cc: stable Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Pa= rser") Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c @@ -700,10 +700,10 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *p =20 void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) { - struct dentry *mvpp2_dir, *mvpp2_root; + static struct dentry *mvpp2_root; + struct dentry *mvpp2_dir; int ret, i; =20 - mvpp2_root =3D debugfs_lookup(MVPP2_DRIVER_NAME, NULL); if (!mvpp2_root) mvpp2_root =3D debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D977C6FA8A for ; Tue, 13 Sep 2022 15:14:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235216AbiIMPOX (ORCPT ); Tue, 13 Sep 2022 11:14:23 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49312 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235534AbiIMPL7 (ORCPT ); Tue, 13 Sep 2022 11:11:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 77EDCA197; Tue, 13 Sep 2022 07:32:41 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id E74AA614D3; Tue, 13 Sep 2022 14:22:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 12B02C433D6; Tue, 13 Sep 2022 14:22:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078970; bh=4q8krE1FsncwNTfSC0uky0pPAGgOhmkWebSZonlFBbA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2LOonye27NuAXi2l+9iG2JiGZ3XdQV0o/1XBdzt3yrb4jlEdlgvmcE0J6G6wCf4JD eER6FrYr/hcWYp9roaj2bqs/OFL8R0/JGF2teFoRH1D3WNyBZ9ieLHI9+WWjCSHnKf rJS0FsfU5i47XWzFwu8XLp4D1FJt4PAsLNFSOXjc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, kernel test robot , Fengwei Yin , Mikulas Patocka , "Matthew Wilcox (Oracle)" , stable@kernel.org, Linus Torvalds Subject: [PATCH 5.10 09/79] fs: only do a memory barrier for the first set_buffer_uptodate() Date: Tue, 13 Sep 2022 16:04:14 +0200 Message-Id: <20220913140350.748373924@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Torvalds commit 2f79cdfe58c13949bbbb65ba5926abfe9561d0ec upstream. Commit d4252071b97d ("add barriers to buffer_uptodate and set_buffer_uptodate") added proper memory barriers to the buffer head BH_Uptodate bit, so that anybody who tests a buffer for being up-to-date will be guaranteed to actually see initialized state. However, that commit didn't _just_ add the memory barrier, it also ended up dropping the "was it already set" logic that the BUFFER_FNS() macro had. That's conceptually the right thing for a generic "this is a memory barrier" operation, but in the case of the buffer contents, we really only care about the memory barrier for the _first_ time we set the bit, in that the only memory ordering protection we need is to avoid anybody seeing uninitialized memory contents. Any other access ordering wouldn't be about the BH_Uptodate bit anyway, and would require some other proper lock (typically BH_Lock or the folio lock). A reader that races with somebody invalidating the buffer head isn't an issue wrt the memory ordering, it's a serialization issue. Now, you'd think that the buffer head operations don't matter in this day and age (and I certainly thought so), but apparently some loads still end up being heavy users of buffer heads. In particular, the kernel test robot reported that not having this bit access optimization in place caused a noticeable direct IO performance regression on ext4: fxmark.ssd_ext4_no_jnl_DWTL_54_directio.works/sec -26.5% regression although you presumably need a fast disk and a lot of cores to actually notice. Link: https://lore.kernel.org/all/Yw8L7HTZ%2FdE2%2Fo9C@xsang-OptiPlex-9020/ Reported-by: kernel test robot Tested-by: Fengwei Yin Cc: Mikulas Patocka Cc: Matthew Wilcox (Oracle) Cc: stable@kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- include/linux/buffer_head.h | 11 +++++++++++ 1 file changed, 11 insertions(+) --- a/include/linux/buffer_head.h +++ b/include/linux/buffer_head.h @@ -137,6 +137,17 @@ BUFFER_FNS(Defer_Completion, defer_compl static __always_inline void set_buffer_uptodate(struct buffer_head *bh) { /* + * If somebody else already set this uptodate, they will + * have done the memory barrier, and a reader will thus + * see *some* valid buffer state. + * + * Any other serialization (with IO errors or whatever that + * might clear the bit) has to come from other state (eg BH_Lock). + */ + if (test_bit(BH_Uptodate, &bh->b_state)) + return; + + /* * make it consistent with folio_mark_uptodate * pairs with smp_load_acquire in buffer_uptodate */ From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 970D7C6FA82 for ; Tue, 13 Sep 2022 14:47:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231202AbiIMOq6 (ORCPT ); Tue, 13 Sep 2022 10:46:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:45712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234566AbiIMOn7 (ORCPT ); Tue, 13 Sep 2022 10:43:59 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 653C965812; Tue, 13 Sep 2022 07:23:31 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AAA10614D1; Tue, 13 Sep 2022 14:21:54 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C36E0C433D7; Tue, 13 Sep 2022 14:21:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078914; bh=mGwilQNMz8rWwIIMssiaTJwKrROZCcdiCFXPZnexT9U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E+vCVeZzL7vUVPMGht32IM/zVcSYtn8wH1MiMYNRcHGOnqb0MEtXp4w9tkAS/CXFb Smh1sihcFBs/uWtjFEnf4w6kOvzZT9gv82NG2aSvHW8rXxGER1SQ23488mHqDqUi0j KcN8crYOGs+XVjt/IRP2qrhcNRWpp5W6TbeSw6QI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yee Lee Subject: [PATCH 5.10 10/79] Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" Date: Tue, 13 Sep 2022 16:04:15 +0200 Message-Id: <20220913140350.799743939@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yee Lee This reverts commit 23c2d497de21f25898fbea70aeb292ab8acc8c94. Commit 23c2d497de21 ("mm: kmemleak: take a full lowmem check in kmemleak_*_phys()") brought false leak alarms on some archs like arm64 that does not init pfn boundary in early booting. The final solution lands on linux-6.0: commit 0c24e061196c ("mm: kmemleak: add rbtree and store physical address for objects allocated with PA"). Revert this commit before linux-6.0. The original issue of invalid PA can be mitigated by additional check in devicetree. The false alarm report is as following: Kmemleak output: (Qemu/arm64) unreferenced object 0xffff0000c0170a00 (size 128): comm "swapper/0", pid 1, jiffies 4294892404 (age 126.208s) hex dump (first 32 bytes): 62 61 73 65 00 00 00 00 00 00 00 00 00 00 00 00 base............ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<(____ptrval____)>] __kmalloc_track_caller+0x1b0/0x2e4 [<(____ptrval____)>] kstrdup_const+0x8c/0xc4 [<(____ptrval____)>] kvasprintf_const+0xbc/0xec [<(____ptrval____)>] kobject_set_name_vargs+0x58/0xe4 [<(____ptrval____)>] kobject_add+0x84/0x100 [<(____ptrval____)>] __of_attach_node_sysfs+0x78/0xec [<(____ptrval____)>] of_core_init+0x68/0x104 [<(____ptrval____)>] driver_init+0x28/0x48 [<(____ptrval____)>] do_basic_setup+0x14/0x28 [<(____ptrval____)>] kernel_init_freeable+0x110/0x178 [<(____ptrval____)>] kernel_init+0x20/0x1a0 [<(____ptrval____)>] ret_from_fork+0x10/0x20 This pacth is also applicable to linux-5.17.y/linux-5.18.y/linux-5.19.y Cc: Signed-off-by: Yee Lee Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- mm/kmemleak.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/mm/kmemleak.c +++ b/mm/kmemleak.c @@ -1123,7 +1123,7 @@ EXPORT_SYMBOL(kmemleak_no_scan); void __ref kmemleak_alloc_phys(phys_addr_t phys, size_t size, int min_coun= t, gfp_t gfp) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_alloc(__va(phys), size, min_count, gfp); } EXPORT_SYMBOL(kmemleak_alloc_phys); @@ -1137,7 +1137,7 @@ EXPORT_SYMBOL(kmemleak_alloc_phys); */ void __ref kmemleak_free_part_phys(phys_addr_t phys, size_t size) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_free_part(__va(phys), size); } EXPORT_SYMBOL(kmemleak_free_part_phys); @@ -1149,7 +1149,7 @@ EXPORT_SYMBOL(kmemleak_free_part_phys); */ void __ref kmemleak_not_leak_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_not_leak(__va(phys)); } EXPORT_SYMBOL(kmemleak_not_leak_phys); @@ -1161,7 +1161,7 @@ EXPORT_SYMBOL(kmemleak_not_leak_phys); */ void __ref kmemleak_ignore_phys(phys_addr_t phys) { - if (PHYS_PFN(phys) >=3D min_low_pfn && PHYS_PFN(phys) < max_low_pfn) + if (!IS_ENABLED(CONFIG_HIGHMEM) || PHYS_PFN(phys) < max_low_pfn) kmemleak_ignore(__va(phys)); } EXPORT_SYMBOL(kmemleak_ignore_phys); From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0EDE1C6FA82 for ; Tue, 13 Sep 2022 14:47:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229822AbiIMOrY (ORCPT ); Tue, 13 Sep 2022 10:47:24 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46602 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234644AbiIMOoJ (ORCPT ); Tue, 13 Sep 2022 10:44:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 902826F250; Tue, 13 Sep 2022 07:23:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 64D3D614B8; Tue, 13 Sep 2022 14:21:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 71E93C433D6; Tue, 13 Sep 2022 14:21:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078916; bh=eDajPw9Ie1LQQuiHq/lytkZaVPZCbjL0hqdGqGCO2kQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0Sg3jcYrlcmIm28vs1uzav+AOTWPVrq5Sd8yFIRfkyFsuqTAHvBmVx2ebhMb1Uosf IVY+z0TQHY29ntHcChrrj9GuCXig9195jz6nQo1c1Bil2GVESDepC/HUvRu6WOQObZ fstnwCCfjd7cla++yqoLPQkOo80+tY7jNNoF3mXk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Himanshu Madhani , Nilesh Javali , Tony Battersby , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 11/79] scsi: qla2xxx: Disable ATIO interrupt coalesce for quad port ISP27XX Date: Tue, 13 Sep 2022 16:04:16 +0200 Message-Id: <20220913140350.843918022@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tony Battersby [ Upstream commit 53661ded2460b414644532de6b99bd87f71987e9 ] This partially reverts commit d2b292c3f6fd ("scsi: qla2xxx: Enable ATIO interrupt handshake for ISP27XX") For some workloads where the host sends a batch of commands and then pauses, ATIO interrupt coalesce can cause some incoming ATIO entries to be ignored for extended periods of time, resulting in slow performance, timeouts, and aborted commands. Disable interrupt coalesce and re-enable the dedicated ATIO MSI-X interrupt. Link: https://lore.kernel.org/r/97dcf365-89ff-014d-a3e5-1404c6af511c@cybern= etics.com Reviewed-by: Himanshu Madhani Reviewed-by: Nilesh Javali Signed-off-by: Tony Battersby Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/scsi/qla2xxx/qla_target.c | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_t= arget.c index ba823e8eb902b..ecb30c2738b8b 100644 --- a/drivers/scsi/qla2xxx/qla_target.c +++ b/drivers/scsi/qla2xxx/qla_target.c @@ -6817,14 +6817,8 @@ qlt_24xx_config_rings(struct scsi_qla_host *vha) =20 if (ha->flags.msix_enabled) { if (IS_QLA83XX(ha) || IS_QLA27XX(ha) || IS_QLA28XX(ha)) { - if (IS_QLA2071(ha)) { - /* 4 ports Baker: Enable Interrupt Handshake */ - icb->msix_atio =3D 0; - icb->firmware_options_2 |=3D cpu_to_le32(BIT_26); - } else { - icb->msix_atio =3D cpu_to_le16(msix->entry); - icb->firmware_options_2 &=3D cpu_to_le32(~BIT_26); - } + icb->msix_atio =3D cpu_to_le16(msix->entry); + icb->firmware_options_2 &=3D cpu_to_le32(~BIT_26); ql_dbg(ql_dbg_init, vha, 0xf072, "Registering ICB vector 0x%x for atio que.\n", msix->entry); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6EF0CC54EE9 for ; Tue, 13 Sep 2022 15:43:52 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232632AbiIMPns (ORCPT ); Tue, 13 Sep 2022 11:43:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51412 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232073AbiIMPnT (ORCPT ); Tue, 13 Sep 2022 11:43:19 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0456785F9A; Tue, 13 Sep 2022 07:47:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CD757B80EFD; Tue, 13 Sep 2022 14:22:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 23015C433C1; Tue, 13 Sep 2022 14:21:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078919; bh=WHrlCYdi1bSrzecsw/MQNXNF2LLpNKQ3Aly2GDKG3Oc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VvmcfMFXK2raODed7VMzEWw19YXQ+x9+XsmLZaiHwnSeOwcf2AHmFYaoe//sdjxqk /ujrjyfxxnVHnvtmo61HIbtHtT5OfTmHgexhg6PxK7Tfte7iwq4ANI4kbEQShdBOc7 jVvv3Tx2H0CfHf6Q2TljcuFt0DMJFewUWInwB2ds= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sumit Saxena , Guixin Liu , "Martin K. Petersen" , Sasha Levin Subject: [PATCH 5.10 12/79] scsi: megaraid_sas: Fix double kfree() Date: Tue, 13 Sep 2022 16:04:17 +0200 Message-Id: <20220913140350.888498249@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Guixin Liu [ Upstream commit 8c499e49240bd93628368c3588975cfb94169b8b ] When allocating log_to_span fails, kfree(instance->ctrl_context) is called twice. Remove redundant call. Link: https://lore.kernel.org/r/1659424729-46502-1-git-send-email-kanie@lin= ux.alibaba.com Acked-by: Sumit Saxena Signed-off-by: Guixin Liu Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/scsi/megaraid/megaraid_sas_fusion.c | 1 - 1 file changed, 1 deletion(-) diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/meg= araid/megaraid_sas_fusion.c index 13022a42fd6f4..7838c7911adde 100644 --- a/drivers/scsi/megaraid/megaraid_sas_fusion.c +++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c @@ -5198,7 +5198,6 @@ megasas_alloc_fusion_context(struct megasas_instance = *instance) if (!fusion->log_to_span) { dev_err(&instance->pdev->dev, "Failed from %s %d\n", __func__, __LINE__); - kfree(instance->ctrl_context); return -ENOMEM; } } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D597CC6FA8B for ; Tue, 13 Sep 2022 14:43:13 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233005AbiIMOnM (ORCPT ); Tue, 13 Sep 2022 10:43:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37700 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232568AbiIMOmF (ORCPT ); Tue, 13 Sep 2022 10:42:05 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D08136E2C0; Tue, 13 Sep 2022 07:22:28 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 008B0614CE; Tue, 13 Sep 2022 14:22:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 05454C433D7; Tue, 13 Sep 2022 14:22:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078922; bh=Wt1k6YYO7A7x5sNg2MQY+ULG/lmKJp3pfkgomSxsC9c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tEEzYzor5yloS75NFKa2vwfnlOJCKOa+1pXF4LX1A47QbWL1RPcWX2qE5CilOjOWg DQVygdrIjMYO88fk9lK0fq/ukSCD7GbDNobrQKLBVbNxujO/5FaH+pcYOIkimJm1r/ RAPnKVMT1r72s1GQQV5yh57IyjVR9/0O7LXz0a00= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeffy Chen , =?UTF-8?q?Christian=20K=C3=B6nig?= , Sasha Levin Subject: [PATCH 5.10 13/79] drm/gem: Fix GEM handle release errors Date: Tue, 13 Sep 2022 16:04:18 +0200 Message-Id: <20220913140350.931273909@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Jeffy Chen [ Upstream commit ea2aa97ca37a9044ade001aef71dbc06318e8d44 ] Currently we are assuming a one to one mapping between dmabuf and GEM handle when releasing GEM handles. But that is not always true, since we would create extra handles for the GEM obj in cases like gem_open() and getfb{,2}(). A similar issue was reported at: https://lore.kernel.org/all/20211105083308.392156-1-jay.xu@rock-chips.com/ Another problem is that the imported dmabuf might not always have gem_obj->dma_buf set, which would cause leaks in drm_gem_remove_prime_handles(). Let's fix these for now by using handle to find the exact map to remove. Signed-off-by: Jeffy Chen Reviewed-by: Christian K=C3=B6nig Signed-off-by: Christian K=C3=B6nig Link: https://patchwork.freedesktop.org/patch/msgid/20220819072834.17888-1-= jeffy.chen@rock-chips.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/gpu/drm/drm_gem.c | 17 +---------------- drivers/gpu/drm/drm_internal.h | 4 ++-- drivers/gpu/drm/drm_prime.c | 20 ++++++++++++-------- 3 files changed, 15 insertions(+), 26 deletions(-) diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 5979af230eda0..8b30e8d83fbcf 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -166,21 +166,6 @@ void drm_gem_private_object_init(struct drm_device *de= v, } EXPORT_SYMBOL(drm_gem_private_object_init); =20 -static void -drm_gem_remove_prime_handles(struct drm_gem_object *obj, struct drm_file *= filp) -{ - /* - * Note: obj->dma_buf can't disappear as long as we still hold a - * handle reference in obj->handle_count. - */ - mutex_lock(&filp->prime.lock); - if (obj->dma_buf) { - drm_prime_remove_buf_handle_locked(&filp->prime, - obj->dma_buf); - } - mutex_unlock(&filp->prime.lock); -} - /** * drm_gem_object_handle_free - release resources bound to userspace handl= es * @obj: GEM object to clean up. @@ -254,7 +239,7 @@ drm_gem_object_release_handle(int id, void *ptr, void *= data) else if (dev->driver->gem_close_object) dev->driver->gem_close_object(obj, file_priv); =20 - drm_gem_remove_prime_handles(obj, file_priv); + drm_prime_remove_buf_handle(&file_priv->prime, id); drm_vma_node_revoke(&obj->vma_node, file_priv); =20 drm_gem_object_handle_put_unlocked(obj); diff --git a/drivers/gpu/drm/drm_internal.h b/drivers/gpu/drm/drm_internal.h index b65865c630b0a..f80e0f28087d1 100644 --- a/drivers/gpu/drm/drm_internal.h +++ b/drivers/gpu/drm/drm_internal.h @@ -86,8 +86,8 @@ int drm_prime_fd_to_handle_ioctl(struct drm_device *dev, = void *data, =20 void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpri= v); void drm_prime_destroy_file_private(struct drm_prime_file_private *prime_f= priv); -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *pri= me_fpriv, - struct dma_buf *dma_buf); +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpri= v, + uint32_t handle); =20 /* drm_drv.c */ struct drm_minor *drm_minor_acquire(unsigned int minor_id); diff --git a/drivers/gpu/drm/drm_prime.c b/drivers/gpu/drm/drm_prime.c index 9f955f2010c25..825499ea3ff59 100644 --- a/drivers/gpu/drm/drm_prime.c +++ b/drivers/gpu/drm/drm_prime.c @@ -187,29 +187,33 @@ static int drm_prime_lookup_buf_handle(struct drm_pri= me_file_private *prime_fpri return -ENOENT; } =20 -void drm_prime_remove_buf_handle_locked(struct drm_prime_file_private *pri= me_fpriv, - struct dma_buf *dma_buf) +void drm_prime_remove_buf_handle(struct drm_prime_file_private *prime_fpri= v, + uint32_t handle) { struct rb_node *rb; =20 - rb =3D prime_fpriv->dmabufs.rb_node; + mutex_lock(&prime_fpriv->lock); + + rb =3D prime_fpriv->handles.rb_node; while (rb) { struct drm_prime_member *member; =20 - member =3D rb_entry(rb, struct drm_prime_member, dmabuf_rb); - if (member->dma_buf =3D=3D dma_buf) { + member =3D rb_entry(rb, struct drm_prime_member, handle_rb); + if (member->handle =3D=3D handle) { rb_erase(&member->handle_rb, &prime_fpriv->handles); rb_erase(&member->dmabuf_rb, &prime_fpriv->dmabufs); =20 - dma_buf_put(dma_buf); + dma_buf_put(member->dma_buf); kfree(member); - return; - } else if (member->dma_buf < dma_buf) { + break; + } else if (member->handle < handle) { rb =3D rb->rb_right; } else { rb =3D rb->rb_left; } } + + mutex_unlock(&prime_fpriv->lock); } =20 void drm_prime_init_file_private(struct drm_prime_file_private *prime_fpri= v) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9F104C6FA8D for ; Tue, 13 Sep 2022 14:44:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230200AbiIMOof (ORCPT ); Tue, 13 Sep 2022 10:44:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59626 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229754AbiIMOm1 (ORCPT ); Tue, 13 Sep 2022 10:42:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DF7BA186F8; Tue, 13 Sep 2022 07:22:30 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B37B461497; Tue, 13 Sep 2022 14:22:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C28DAC433D6; Tue, 13 Sep 2022 14:22:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078925; bh=4KRIZt60OYvPDJXSjhi2ESW3KUFxGrgOB5pvP03ikz4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Uhp0384gcfK39TKcsgPEu4j5fOdmTAD9jD6PJf7OFHM2+O3GbwE5mf192Nt7zt5y5 3Cgco3xUxNuJ6tw94r3n01iXkQUVMW9HFngaKVcYr71VCwAJm/BgYAyz1eIoOLZmCU SuS2FPKJxRzFggLtw6NUsv09VYoK1qeV6UCHgwss= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, YiPeng Chai , Hawking Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 14/79] drm/amdgpu: Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini Date: Tue, 13 Sep 2022 16:04:19 +0200 Message-Id: <20220913140350.982863374@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: YiPeng Chai [ Upstream commit 9d705d7741ae70764f3d6d87e67fad3b5c30ffd0 ] V1: The amdgpu_xgmi_remove_device function will send unload command to psp through psp ring to terminate xgmi, but psp ring has been destroyed in psp_hw_fini. V2: 1. Change the commit title. 2. Restore amdgpu_xgmi_remove_device to its original calling location. Move psp_xgmi_terminate call from amdgpu_xgmi_remove_device to psp_hw_fini. Signed-off-by: YiPeng Chai Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 3 +++ drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/= amdgpu/amdgpu_psp.c index 2f47f81a74a57..ae84d3b582aa5 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -2146,6 +2146,9 @@ static int psp_hw_fini(void *handle) psp_rap_terminate(psp); psp_dtm_terminate(psp); psp_hdcp_terminate(psp); + + if (adev->gmc.xgmi.num_physical_nodes > 1) + psp_xgmi_terminate(psp); } =20 psp_asd_unload(psp); diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c b/drivers/gpu/drm/amd= /amdgpu/amdgpu_xgmi.c index 042c85fc528bb..def0b7092438f 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_xgmi.c @@ -622,7 +622,7 @@ int amdgpu_xgmi_remove_device(struct amdgpu_device *ade= v) amdgpu_put_xgmi_hive(hive); } =20 - return psp_xgmi_terminate(&adev->psp); + return 0; } =20 int amdgpu_xgmi_ras_late_init(struct amdgpu_device *adev) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 22F59C54EE9 for ; Tue, 13 Sep 2022 15:24:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236112AbiIMPYu (ORCPT ); Tue, 13 Sep 2022 11:24:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50510 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235898AbiIMPW4 (ORCPT ); Tue, 13 Sep 2022 11:22:56 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F07BC6B150; Tue, 13 Sep 2022 07:37:05 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E2390B80FB3; Tue, 13 Sep 2022 14:22:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4B2B3C433C1; Tue, 13 Sep 2022 14:22:07 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078927; bh=1wO7DfF498rD4O38iH/xjTcXglbbaRIhBSXhOTVpHoc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=khRU6WdCMu75XtZ+gJTTGNR3gC04mRewe2//wkMPgW03b8k4aVe77QMP6gOCYsY27 hG3YpOL5FsMsAzCOcFJ3iOx/LjPMa7aVkTniOFtjBmPSj8zFN2L/7Z+kkeTTxPUyXU WcQXryOlZ3NBAjXnRVM8o1jDex8U+hKObWTeIIw8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Candice Li , Hawking Zhang , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 15/79] drm/amdgpu: Check num_gfx_rings for gfx v9_0 rb setup. Date: Tue, 13 Sep 2022 16:04:20 +0200 Message-Id: <20220913140351.034170919@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Candice Li [ Upstream commit c351938350ab9b5e978dede2c321da43de7eb70c ] No need to set up rb when no gfx rings. Signed-off-by: Candice Li Reviewed-by: Hawking Zhang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/am= dgpu/gfx_v9_0.c index 405bb3efa2a96..38f4c7474487b 100644 --- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c @@ -2570,7 +2570,8 @@ static void gfx_v9_0_constants_init(struct amdgpu_dev= ice *adev) =20 gfx_v9_0_tiling_mode_table_init(adev); =20 - gfx_v9_0_setup_rb(adev); + if (adev->gfx.num_gfx_rings) + gfx_v9_0_setup_rb(adev); gfx_v9_0_get_cu_info(adev, &adev->gfx.cu_info); adev->gfx.config.db_debug2 =3D RREG32_SOC15(GC, 0, mmDB_DEBUG2); =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7022CC6FA82 for ; Tue, 13 Sep 2022 15:07:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235057AbiIMPG6 (ORCPT ); Tue, 13 Sep 2022 11:06:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54044 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235469AbiIMPEe (ORCPT ); Tue, 13 Sep 2022 11:04:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3C66D74DC5; Tue, 13 Sep 2022 07:30:19 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 77070B80D87; Tue, 13 Sep 2022 14:22:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C9419C433D7; Tue, 13 Sep 2022 14:22:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078930; bh=uMnuKfIJU2kTxieP2bCi1WBOw945m2ux2YOfHbvJ4eg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=GqPgxuPH2hbBuhHEVu8LnwsBmseRKAdqLrEk4OpqHiP43T4PwuToJgg5YKlAKqwi0 dS4DugEQ/v8qrsZxXAqhwILJllQqxU4cSlkkHI+gBu8JelTTANNCAUyA3al8HVgqLb mkt8wkxk0IF38vibdd1mgVlE1D5t0gJpwfUtA9Bw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Christian=20K=C3=B6nig?= , Zhenneng Li , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 16/79] drm/radeon: add a force flush to delay work when radeon Date: Tue, 13 Sep 2022 16:04:21 +0200 Message-Id: <20220913140351.076460262@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Zhenneng Li [ Upstream commit f461950fdc374a3ada5a63c669d997de4600dffe ] Although radeon card fence and wait for gpu to finish processing current ba= tch rings, there is still a corner case that radeon lockup work queue may not be fully= flushed, and meanwhile the radeon_suspend_kms() function has called pci_set_power_st= ate() to put device in D3hot state. Per PCI spec rev 4.0 on 5.3.1.4.1 D3hot State. > Configuration and Message requests are the only TLPs accepted by a Functi= on in > the D3hot state. All other received Requests must be handled as Unsupport= ed Requests, > and all received Completions may optionally be handled as Unexpected Comp= letions. This issue will happen in following logs: Unable to handle kernel paging request at virtual address 00008800e0008010 CPU 0 kworker/0:3(131): Oops 0 pc =3D [] ra =3D [] ps =3D 0000 Taint= ed: G W pc is at si_gpu_check_soft_reset+0x3c/0x240 ra is at si_dma_is_lockup+0x34/0xd0 v0 =3D 0000000000000000 t0 =3D fff08800e0008010 t1 =3D 0000000000010000 t2 =3D 0000000000008010 t3 =3D fff00007e3c00000 t4 =3D fff00007e3c00258 t5 =3D 000000000000ffff t6 =3D 0000000000000001 t7 =3D fff00007ef078000 s0 =3D fff00007e3c016e8 s1 =3D fff00007e3c00000 s2 =3D fff00007e3c00018 s3 =3D fff00007e3c00000 s4 =3D fff00007fff59d80 s5 =3D 0000000000000000 s6 =3D fff00007ef07bd98 a0 =3D fff00007e3c00000 a1 =3D fff00007e3c016e8 a2 =3D 0000000000000008 a3 =3D 0000000000000001 a4 =3D 8f5c28f5c28f5c29 a5 =3D ffffffff810f4338 t8 =3D 0000000000000275 t9 =3D ffffffff809b66f8 t10 =3D ff6769c5d964b800 t11=3D 000000000000b886 pv =3D ffffffff811bea20 at =3D 0000000000000000 gp =3D ffffffff81d89690 sp =3D 00000000aa814126 Disabling lock debugging due to kernel taint Trace: [] si_dma_is_lockup+0x34/0xd0 [] radeon_fence_check_lockup+0xd0/0x290 [] process_one_work+0x280/0x550 [] worker_thread+0x70/0x7c0 [] worker_thread+0x130/0x7c0 [] kthread+0x200/0x210 [] worker_thread+0x0/0x7c0 [] kthread+0x14c/0x210 [] ret_from_kernel_thread+0x18/0x20 [] kthread+0x0/0x210 Code: ad3e0008 43f0074a ad7e0018 ad9e0020 8c3001e8 40230101 <88210000> 4821ed21 So force lockup work queue flush to fix this problem. Acked-by: Christian K=C3=B6nig Signed-off-by: Zhenneng Li Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/gpu/drm/radeon/radeon_device.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeo= n/radeon_device.c index 266e3cbbd09bd..8287410f471fb 100644 --- a/drivers/gpu/drm/radeon/radeon_device.c +++ b/drivers/gpu/drm/radeon/radeon_device.c @@ -1623,6 +1623,9 @@ int radeon_suspend_kms(struct drm_device *dev, bool s= uspend, if (r) { /* delay GPU reset to resume */ radeon_fence_driver_force_completion(rdev, i); + } else { + /* finish executing delayed work */ + flush_delayed_work(&rdev->fence_drv[i].lockup_work); } } =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2A327C54EE9 for ; Tue, 13 Sep 2022 14:47:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231949AbiIMOra (ORCPT ); Tue, 13 Sep 2022 10:47:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231167AbiIMOop (ORCPT ); Tue, 13 Sep 2022 10:44:45 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 553136F26C; Tue, 13 Sep 2022 07:24:02 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 50C746149A; Tue, 13 Sep 2022 14:22:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 676ABC433D7; Tue, 13 Sep 2022 14:22:12 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078932; bh=F4JNBWRRsruom+7qycrtF3bC1w50tyrEdpDUdXtc/3k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CZ/x0Fdel7GhwYi/+F5W1zulaJ8iGUMnpvUPGW7dfkNRTTWRO/kfdlq6ysf3GhvRE Mmn83LOxQZQPR1JhUm0Y9emm6tu08DNH9meOn7igSknm/9U3YsYNX8coSc7c7Jp65W RCZ9QAzcAMSWZO25D8Xi79nED0KJI7LaUIkHtHTc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Li Qiong , Helge Deller , Sasha Levin Subject: [PATCH 5.10 17/79] parisc: ccio-dma: Handle kmalloc failure in ccio_init_resources() Date: Tue, 13 Sep 2022 16:04:22 +0200 Message-Id: <20220913140351.129225955@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Li Qiong [ Upstream commit d46c742f827fa2326ab1f4faa1cccadb56912341 ] As the possible failure of the kmalloc(), it should be better to fix this error path, check and return '-ENOMEM' error code. Signed-off-by: Li Qiong Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/parisc/ccio-dma.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c index b916fab9b1618..ffd5000c23d39 100644 --- a/drivers/parisc/ccio-dma.c +++ b/drivers/parisc/ccio-dma.c @@ -1380,15 +1380,17 @@ ccio_init_resource(struct resource *res, char *name= , void __iomem *ioaddr) } } =20 -static void __init ccio_init_resources(struct ioc *ioc) +static int __init ccio_init_resources(struct ioc *ioc) { struct resource *res =3D ioc->mmio_region; char *name =3D kmalloc(14, GFP_KERNEL); - + if (unlikely(!name)) + return -ENOMEM; snprintf(name, 14, "GSC Bus [%d/]", ioc->hw_path); =20 ccio_init_resource(res, name, &ioc->ioc_regs->io_io_low); ccio_init_resource(res + 1, name, &ioc->ioc_regs->io_io_low_hv); + return 0; } =20 static int new_ioc_area(struct resource *res, unsigned long size, @@ -1543,7 +1545,10 @@ static int __init ccio_probe(struct parisc_device *d= ev) return -ENOMEM; } ccio_ioc_init(ioc); - ccio_init_resources(ioc); + if (ccio_init_resources(ioc)) { + kfree(ioc); + return -ENOMEM; + } hppa_dma_ops =3D &ccio_ops; =20 hba =3D kzalloc(sizeof(*hba), GFP_KERNEL); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0D57AC54EE9 for ; Tue, 13 Sep 2022 14:42:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232063AbiIMOmu (ORCPT ); Tue, 13 Sep 2022 10:42:50 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58982 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231489AbiIMOlv (ORCPT ); Tue, 13 Sep 2022 10:41:51 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2739C6DAF3; Tue, 13 Sep 2022 07:22:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 820B7B80F01; Tue, 13 Sep 2022 14:22:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id DC25CC433C1; Tue, 13 Sep 2022 14:22:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078935; bh=9BUB6F8qHCVRmkkXwqJ9eg/dFaiKKeYVazMEdqCcvko=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kADngI/mnPC5zhHHM4L+B8L4C2+W8g88ggPlEMPGp3p1Y1Ii7BBspwxaTxrIiPM8f 4nfXb0uyWBH0CocZ/dHL/pUJ8Xh0x0gb8sRid+k6yaEHo5dNENynw6UPX5nMLCv0Uk 0up4D2yber+Bnvr6SzyCy3WavQXaIC0xWgeN8dQI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Helge Deller , Sasha Levin Subject: [PATCH 5.10 18/79] parisc: Add runtime check to prevent PA2.0 kernels on PA1.x machines Date: Tue, 13 Sep 2022 16:04:23 +0200 Message-Id: <20220913140351.180424832@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Helge Deller [ Upstream commit 591d2108f3abc4db9f9073cae37cf3591fd250d6 ] If a 32-bit kernel was compiled for PA2.0 CPUs, it won't be able to run on machines with PA1.x CPUs. Add a check and bail out early if a PA1.x machine is detected. Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/parisc/kernel/head.S | 43 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 42 insertions(+), 1 deletion(-) diff --git a/arch/parisc/kernel/head.S b/arch/parisc/kernel/head.S index aa93d775c34db..598d0938449da 100644 --- a/arch/parisc/kernel/head.S +++ b/arch/parisc/kernel/head.S @@ -22,7 +22,7 @@ #include #include =20 - .level PA_ASM_LEVEL + .level 1.1 =20 __INITDATA ENTRY(boot_args) @@ -69,6 +69,47 @@ $bss_loop: stw,ma %arg2,4(%r1) stw,ma %arg3,4(%r1) =20 +#if !defined(CONFIG_64BIT) && defined(CONFIG_PA20) + /* This 32-bit kernel was compiled for PA2.0 CPUs. Check current CPU + * and halt kernel if we detect a PA1.x CPU. */ + ldi 32,%r10 + mtctl %r10,%cr11 + .level 2.0 + mfctl,w %cr11,%r10 + .level 1.1 + comib,<>,n 0,%r10,$cpu_ok + + load32 PA(msg1),%arg0 + ldi msg1_end-msg1,%arg1 +$iodc_panic: + copy %arg0, %r10 + copy %arg1, %r11 + load32 PA(init_stack),%sp +#define MEM_CONS 0x3A0 + ldw MEM_CONS+32(%r0),%arg0 // HPA + ldi ENTRY_IO_COUT,%arg1 + ldw MEM_CONS+36(%r0),%arg2 // SPA + ldw MEM_CONS+8(%r0),%arg3 // layers + load32 PA(__bss_start),%r1 + stw %r1,-52(%sp) // arg4 + stw %r0,-56(%sp) // arg5 + stw %r10,-60(%sp) // arg6 =3D ptr to text + stw %r11,-64(%sp) // arg7 =3D len + stw %r0,-68(%sp) // arg8 + load32 PA(.iodc_panic_ret), %rp + ldw MEM_CONS+40(%r0),%r1 // ENTRY_IODC + bv,n (%r1) +.iodc_panic_ret: + b . /* wait endless with ... */ + or %r10,%r10,%r10 /* qemu idle sleep */ +msg1: .ascii "Can't boot kernel which was built for PA8x00 CPUs on this ma= chine.\r\n" +msg1_end: + +$cpu_ok: +#endif + + .level PA_ASM_LEVEL + /* Initialize startup VM. Just map first 16/32 MB of memory */ load32 PA(swapper_pg_dir),%r4 mtctl %r4,%cr24 /* Initialize kernel root pointer */ --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 350A8C54EE9 for ; Tue, 13 Sep 2022 14:44:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231753AbiIMOna (ORCPT ); Tue, 13 Sep 2022 10:43:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59476 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230129AbiIMOmK (ORCPT ); Tue, 13 Sep 2022 10:42:10 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 627BC52DDA; Tue, 13 Sep 2022 07:22:35 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6EFDFB80E22; Tue, 13 Sep 2022 14:22:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1F39C433D7; Tue, 13 Sep 2022 14:22:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078938; bh=fPid+q0GoEnpfhUVAoMELTMnsoxydhxBhddicCiYKQ8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=wvNaLRHU0b8ut+e+E0/ECtaKYEPZL7BYhw3JKy9wjZ86bUh4Dk6fbVNc7/3fev4XV aEmyylU53Vl7EEYdsiS7vY3Kc0JUNWCTULnpwWIkfS2KMYxkI6vAFt1fE7elLRpUMM YCssvMt25PJfWTg1epasAqj8lrQbB7Z0tafxtUi0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sudeep Holla , Will Deacon , Sasha Levin , Bruno Goncalves Subject: [PATCH 5.10 19/79] arm64: cacheinfo: Fix incorrect assignment of signed error value to unsigned fw_level Date: Tue, 13 Sep 2022 16:04:24 +0200 Message-Id: <20220913140351.230431132@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sudeep Holla [ Upstream commit e75d18cecbb3805895d8ed64da4f78575ec96043 ] Though acpi_find_last_cache_level() always returned signed value and the document states it will return any errors caused by lack of a PPTT table, it never returned negative values before. Commit 0c80f9e165f8 ("ACPI: PPTT: Leave the table mapped for the runtime us= age") however changed it by returning -ENOENT if no PPTT was found. The value returned from acpi_find_last_cache_level() is then assigned to unsigned fw_level. It will result in the number of cache leaves calculated incorrectly as a huge value which will then cause the following warning from __alloc_pages as the order would be great than MAX_ORDER because of incorrect and huge cache leaves value. | WARNING: CPU: 0 PID: 1 at mm/page_alloc.c:5407 __alloc_pages+0x74/0x314 | Modules linked in: | CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.19.0-10393-g7c2a8d3ac4c0 #= 73 | pstate: 20000005 (nzCv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=3D--) | pc : __alloc_pages+0x74/0x314 | lr : alloc_pages+0xe8/0x318 | Call trace: | __alloc_pages+0x74/0x314 | alloc_pages+0xe8/0x318 | kmalloc_order_trace+0x68/0x1dc | __kmalloc+0x240/0x338 | detect_cache_attributes+0xe0/0x56c | update_siblings_masks+0x38/0x284 | store_cpu_topology+0x78/0x84 | smp_prepare_cpus+0x48/0x134 | kernel_init_freeable+0xc4/0x14c | kernel_init+0x2c/0x1b4 | ret_from_fork+0x10/0x20 Fix the same by changing fw_level to be signed integer and return the error from init_cache_level() early in case of error. Reported-and-Tested-by: Bruno Goncalves Signed-off-by: Sudeep Holla Link: https://lore.kernel.org/r/20220808084640.3165368-1-sudeep.holla@arm.c= om Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm64/kernel/cacheinfo.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/cacheinfo.c b/arch/arm64/kernel/cacheinfo.c index 587543c6c51cb..97c42be71338a 100644 --- a/arch/arm64/kernel/cacheinfo.c +++ b/arch/arm64/kernel/cacheinfo.c @@ -45,7 +45,8 @@ static void ci_leaf_init(struct cacheinfo *this_leaf, =20 int init_cache_level(unsigned int cpu) { - unsigned int ctype, level, leaves, fw_level; + unsigned int ctype, level, leaves; + int fw_level; struct cpu_cacheinfo *this_cpu_ci =3D get_cpu_cacheinfo(cpu); =20 for (level =3D 1, leaves =3D 0; level <=3D MAX_CACHE_LEVEL; level++) { @@ -63,6 +64,9 @@ int init_cache_level(unsigned int cpu) else fw_level =3D acpi_find_last_cache_level(cpu); =20 + if (fw_level < 0) + return fw_level; + if (level < fw_level) { /* * some external caches not specified in CLIDR_EL1 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3E5BCECAAD8 for ; Tue, 13 Sep 2022 16:55:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231445AbiIMQza (ORCPT ); Tue, 13 Sep 2022 12:55:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43318 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231175AbiIMQyt (ORCPT ); Tue, 13 Sep 2022 12:54:49 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5EF904E632; Tue, 13 Sep 2022 08:47:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id A41B2614D5; Tue, 13 Sep 2022 14:22:23 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA1F9C433D7; Tue, 13 Sep 2022 14:22:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078943; bh=HXfZo6doQzz9VapJaBP8Fx6rQF3F4A3r+CJnHaVGpWM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mpm+0I9LexFUGOg+rKxT2X4r2+PKoXP7F10aqO7mN0StGb1mpLCWzgvIKGkELG/R6 o/N2ISG05PMKi+l0O9Wf1uCQKnl3nbs95UwCaQlrVFhmjglwYiZidXTMm3fwNNiFKn 5G9ntBg2WqtvwJrxaE1IqmV5Sx0Lwiq8E/6692KA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Brown , Catalin Marinas , Will Deacon , Sasha Levin Subject: [PATCH 5.10 20/79] arm64/signal: Raise limit on stack frames Date: Tue, 13 Sep 2022 16:04:25 +0200 Message-Id: <20220913140351.279129063@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Mark Brown [ Upstream commit 7ddcaf78e93c9282b4d92184f511b4d5bee75355 ] The signal code has a limit of 64K on the size of a stack frame that it will generate, if this limit is exceeded then a process will be killed if it receives a signal. Unfortunately with the advent of SME this limit is too small - the maximum possible size of the ZA register alone is 64K. This is not an issue for practical systems at present but is easily seen using virtual platforms. Raise the limit to 256K, this is substantially more than could be used by any current architecture extension. Signed-off-by: Mark Brown Acked-by: Catalin Marinas Link: https://lore.kernel.org/r/20220817182324.638214-2-broonie@kernel.org Signed-off-by: Will Deacon Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm64/kernel/signal.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c index 0dab5679a97d5..c42089ce089f7 100644 --- a/arch/arm64/kernel/signal.c +++ b/arch/arm64/kernel/signal.c @@ -91,7 +91,7 @@ static size_t sigframe_size(struct rt_sigframe_user_layou= t const *user) * not taken into account. This limit is not a guarantee and is * NOT ABI. */ -#define SIGFRAME_MAXSZ SZ_64K +#define SIGFRAME_MAXSZ SZ_256K =20 static int __sigframe_alloc(struct rt_sigframe_user_layout *user, unsigned long *offset, size_t size, bool extend) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 917A9C6FA8A for ; Tue, 13 Sep 2022 14:43:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231928AbiIMOm6 (ORCPT ); Tue, 13 Sep 2022 10:42:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34834 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230192AbiIMOly (ORCPT ); Tue, 13 Sep 2022 10:41:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6CEDE6DF91; Tue, 13 Sep 2022 07:22:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0F162614AE; Tue, 13 Sep 2022 14:22:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2B798C433D6; Tue, 13 Sep 2022 14:22:25 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078945; bh=GAAakixd9QHCOAzXIK28uqAuuAGFTRr34Ymi7tr2on4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=FX3GFR9Dh4fXll+OOShZhgKLwq6MXaQ8qnR6+Owd1uubjpRgTw3Ol1orA/ZW2xKyx 9u+nm4vv4HR86fm/hfGWR7KWdlipdCtZNP62bpjoc5uy8iYQjZqmuRN/Y/4KsDn+qg cbo9aO8sC/QAr9A5ykV4b+H8jcYB+KFuKx5DOZgg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Li Zhong , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 21/79] net/core/skbuff: Check the return value of skb_copy_bits() Date: Tue, 13 Sep 2022 16:04:26 +0200 Message-Id: <20220913140351.321635587@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: lily [ Upstream commit c624c58e08b15105662b9ab9be23d14a6b945a49 ] skb_copy_bits() could fail, which requires a check on the return value. Signed-off-by: Li Zhong Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/core/skbuff.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 635cabcf8794f..7bdcdad58dc86 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -3986,9 +3986,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, SKB_GSO_CB(nskb)->csum_start =3D skb_headroom(nskb) + doffset; } else { - skb_copy_bits(head_skb, offset, - skb_put(nskb, len), - len); + if (skb_copy_bits(head_skb, offset, skb_put(nskb, len), len)) + goto err; } continue; } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 98C18C6FA89 for ; Tue, 13 Sep 2022 14:47:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230182AbiIMOr2 (ORCPT ); Tue, 13 Sep 2022 10:47:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234664AbiIMOoO (ORCPT ); Tue, 13 Sep 2022 10:44:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3A36659EE; Tue, 13 Sep 2022 07:23:58 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 3FC72B80FA1; Tue, 13 Sep 2022 14:22:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9C344C433C1; Tue, 13 Sep 2022 14:22:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078947; bh=UyC6EuVYNPcXw2t8mig7weYbNDvzVVaZ6wLDTuTmYIk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=kSVvOrInfME9ub4E93OWFLuiE8rYOyFVC6xbc4P9LbWCe4hZMrO9w77b0keOka+bt UhHvUDJ+XpSc5n8Nbgg5qoBtyY8NQQWz05J7pz2nLIERtJHyF8wqKWq+m2yD+u9u/A 5V6R+wt0cLkYK3TlV+3Wb+dej1CXwIoBoqI4KWSA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Yingliang , Helge Deller , Sasha Levin Subject: [PATCH 5.10 22/79] fbdev: chipsfb: Add missing pci_disable_device() in chipsfb_pci_init() Date: Tue, 13 Sep 2022 16:04:27 +0200 Message-Id: <20220913140351.374878543@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang [ Upstream commit 07c55c9803dea748d17a054000cbf1913ce06399 ] Add missing pci_disable_device() in error path in chipsfb_pci_init(). Signed-off-by: Yang Yingliang Signed-off-by: Helge Deller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/video/fbdev/chipsfb.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/video/fbdev/chipsfb.c b/drivers/video/fbdev/chipsfb.c index 393894af26f84..2b00a9d554fc0 100644 --- a/drivers/video/fbdev/chipsfb.c +++ b/drivers/video/fbdev/chipsfb.c @@ -430,6 +430,7 @@ static int chipsfb_pci_init(struct pci_dev *dp, const s= truct pci_device_id *ent) err_release_fb: framebuffer_release(p); err_disable: + pci_disable_device(dp); err_out: return rc; } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 54DB2C6FA82 for ; Tue, 13 Sep 2022 15:23:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S236082AbiIMPXa (ORCPT ); Tue, 13 Sep 2022 11:23:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58398 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235703AbiIMPWo (ORCPT ); Tue, 13 Sep 2022 11:22:44 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2BBEE7C1A9; Tue, 13 Sep 2022 07:36:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id EE118B80FA3; Tue, 13 Sep 2022 14:22:31 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4F967C433D6; Tue, 13 Sep 2022 14:22:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078950; bh=sY5xCSzLfcW8qRatSleU7m0B0Uc1VDr6/daoXJusBTo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2rplr+4i7GdD+bhrRTgWP//ZeIl8LbywQ0GtPD0Fm3Zd0hV3Z3obeozHeF+Xq5iXJ zqK7uUfpIGfIAG/YorQfsFIiIMAYhP9+7sfv4RjokZGJxRQIbIcrDn9qLBAS/4ejPC KXLjkCBaXSMDA12V+da1uJczlWF7tXpN8gB9FA4o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Qu Huang , Alex Deucher , Sasha Levin Subject: [PATCH 5.10 23/79] drm/amdgpu: mmVM_L2_CNTL3 register not initialized correctly Date: Tue, 13 Sep 2022 16:04:28 +0200 Message-Id: <20220913140351.425912152@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Qu Huang [ Upstream commit b8983d42524f10ac6bf35bbce6a7cc8e45f61e04 ] The mmVM_L2_CNTL3 register is not assigned an initial value Signed-off-by: Qu Huang Signed-off-by: Alex Deucher Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c b/drivers/gpu/drm/amd/= amdgpu/mmhub_v1_0.c index f84701c562bf2..97441f373531f 100644 --- a/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c +++ b/drivers/gpu/drm/amd/amdgpu/mmhub_v1_0.c @@ -178,6 +178,7 @@ static void mmhub_v1_0_init_cache_regs(struct amdgpu_de= vice *adev) tmp =3D REG_SET_FIELD(tmp, VM_L2_CNTL2, INVALIDATE_L2_CACHE, 1); WREG32_SOC15(MMHUB, 0, mmVM_L2_CNTL2, tmp); =20 + tmp =3D mmVM_L2_CNTL3_DEFAULT; if (adev->gmc.translate_further) { tmp =3D REG_SET_FIELD(tmp, VM_L2_CNTL3, BANK_SELECT, 12); tmp =3D REG_SET_FIELD(tmp, VM_L2_CNTL3, --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44544C6FA8A for ; Tue, 13 Sep 2022 14:44:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234454AbiIMOng (ORCPT ); Tue, 13 Sep 2022 10:43:36 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59548 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232835AbiIMOmL (ORCPT ); Tue, 13 Sep 2022 10:42:11 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1761B6E2CA; Tue, 13 Sep 2022 07:22:34 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0C545614B4; Tue, 13 Sep 2022 14:22:34 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 26143C433C1; Tue, 13 Sep 2022 14:22:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078953; bh=lpazVn+TDsYK5GKA9iWWyLBDb2pAAjMWK2hSETqYsOs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=hByN9vM8ZtHC69TWedeYEDwJVH+48spxO3BUGCnG1dkLs38ZKTdxzS5iHN3ZmoZPL DHdR3IDWlMH/NMjWV5as0ekOBV5B8RN8zXhajPjBzIB14HS4dngA9GpcxAoUcFBRU+ SIpdyaRmPpcvRdAq+86cCIzsGInzH6SLbrlG444I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tasos Sahanidis , Takashi Iwai Subject: [PATCH 5.10 24/79] ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() Date: Tue, 13 Sep 2022 16:04:29 +0200 Message-Id: <20220913140351.468002012@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tasos Sahanidis commit d29f59051d3a07b81281b2df2b8c9dfe4716067f upstream. The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=3DLive,DEV=3D3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k= 1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 = 07/22/2010 Call Trace: dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd Signed-off-by: Tasos Sahanidis Cc: Link: https://lore.kernel.org/r/3707dcab-320a-62ff-63c0-73fc201ef756@tasoss= ah.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/pci/emu10k1/emupcm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/pci/emu10k1/emupcm.c +++ b/sound/pci/emu10k1/emupcm.c @@ -123,7 +123,7 @@ static int snd_emu10k1_pcm_channel_alloc epcm->voices[0]->epcm =3D epcm; if (voices > 1) { for (i =3D 1; i < voices; i++) { - epcm->voices[i] =3D &epcm->emu->voices[epcm->voices[0]->number + i]; + epcm->voices[i] =3D &epcm->emu->voices[(epcm->voices[0]->number + i) % = NUM_G]; epcm->voices[i]->epcm =3D epcm; } } From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93154C6FA92 for ; Tue, 13 Sep 2022 14:55:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234949AbiIMOyd (ORCPT ); Tue, 13 Sep 2022 10:54:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234491AbiIMOu2 (ORCPT ); Tue, 13 Sep 2022 10:50:28 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5CB38726AD; Tue, 13 Sep 2022 07:26:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C32C0614D0; Tue, 13 Sep 2022 14:24:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D37A7C433D6; Tue, 13 Sep 2022 14:24:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079043; bh=8PuaP/incUVIAeBANDpRL8XFoyJ5zftOBkXkgOQ5REs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dHN2k/4GcygoLHvEATDN/GwOELRwxg0MkccwfEf3FEohNVJ1znnvnEJ7wq3IPU3jp nnFVUa2nosM9UinEsxUjL6TwaWC1NT3AdQGhHQih1mi9e237nY7rZdF2l6mIfwieLH ljU9aGzAbiXfCBzitoXLEtPkJrghNf2osxkb0i9M= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Pattara Teerapong , Takashi Iwai Subject: [PATCH 5.10 25/79] ALSA: aloop: Fix random zeros in capture data when using jiffies timer Date: Tue, 13 Sep 2022 16:04:30 +0200 Message-Id: <20220913140351.513272951@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pattara Teerapong commit 3e48940abee88b8dbbeeaf8a07e7b2b6be1271b3 upstream. In loopback_jiffies_timer_pos_update(), we are getting jiffies twice. First time for playback, second time for capture. Jiffies can be updated between these two calls and if the capture jiffies is larger, extra zeros will be filled in the capture buffer. Change to get jiffies once and use it for both playback and capture. Signed-off-by: Pattara Teerapong Cc: Link: https://lore.kernel.org/r/20220901144036.4049060-1-pteerapong@chromiu= m.org Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/drivers/aloop.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -606,17 +606,18 @@ static unsigned int loopback_jiffies_tim cable->streams[SNDRV_PCM_STREAM_PLAYBACK]; struct loopback_pcm *dpcm_capt =3D cable->streams[SNDRV_PCM_STREAM_CAPTURE]; - unsigned long delta_play =3D 0, delta_capt =3D 0; + unsigned long delta_play =3D 0, delta_capt =3D 0, cur_jiffies; unsigned int running, count1, count2; =20 + cur_jiffies =3D jiffies; running =3D cable->running ^ cable->pause; if (running & (1 << SNDRV_PCM_STREAM_PLAYBACK)) { - delta_play =3D jiffies - dpcm_play->last_jiffies; + delta_play =3D cur_jiffies - dpcm_play->last_jiffies; dpcm_play->last_jiffies +=3D delta_play; } =20 if (running & (1 << SNDRV_PCM_STREAM_CAPTURE)) { - delta_capt =3D jiffies - dpcm_capt->last_jiffies; + delta_capt =3D cur_jiffies - dpcm_capt->last_jiffies; dpcm_capt->last_jiffies +=3D delta_capt; } From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 93573C54EE9 for ; Tue, 13 Sep 2022 14:45:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231292AbiIMOp2 (ORCPT ); Tue, 13 Sep 2022 10:45:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59456 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230380AbiIMOnI (ORCPT ); Tue, 13 Sep 2022 10:43:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id F118B6E2DC; Tue, 13 Sep 2022 07:22:56 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5F501B80F01; Tue, 13 Sep 2022 14:22:56 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C847BC433D6; Tue, 13 Sep 2022 14:22:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078975; bh=PgDM3ajWpuFY3hObR9Y+9AgEDoWVeiUNMjT7ZyVTZBQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dn/D7ujaZ0ReXabIN/HhM/6A/wFVCWinmAPHFXoscYCX4NehwwV7Q30sUXZGTRT3K 1G4tVXBkkHg/lqyagfCOjhzhVzH95vGmFCYcZcugpgblASg+tJJ9Jw7tiH2I1pFnlf aLYtIgFcIZ2KD6f4d+UGLi6XianAsQ/9wjn/2HPk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dongxiang Ke , Takashi Iwai Subject: [PATCH 5.10 26/79] ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() Date: Tue, 13 Sep 2022 16:04:31 +0200 Message-Id: <20220913140351.564581137@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dongxiang Ke commit e53f47f6c1a56d2af728909f1cb894da6b43d9bf upstream. There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Signed-off-by: Dongxiang Ke Link: https://lore.kernel.org/r/20220906024928.10951-1-kdx.glider@gmail.com Signed-off-by: Takashi Iwai Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/usb/stream.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -1106,7 +1106,7 @@ static int __snd_usb_parse_audio_interfa * Dallas DS4201 workaround: It presents 5 altsettings, but the last * one misses syncpipe, and does not produce any sound. */ - if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201)) + if (chip->usb_id =3D=3D USB_ID(0x04fa, 0x4201) && num >=3D 4) num =3D 4; =20 for (i =3D 0; i < num; i++) { From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9DEDEC6FA89 for ; Tue, 13 Sep 2022 14:46:50 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230410AbiIMOqt (ORCPT ); Tue, 13 Sep 2022 10:46:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46618 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234540AbiIMOnz (ORCPT ); Tue, 13 Sep 2022 10:43:55 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 893A56EF3B; Tue, 13 Sep 2022 07:23:24 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 1997DB80F98; Tue, 13 Sep 2022 14:23:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6AFFDC433C1; Tue, 13 Sep 2022 14:23:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079002; bh=m6L+BwhmhJiR7j80zYv8k+2TSA1Vi69dok8uQ0foBNs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=MzvjKuSZ8iIyE42S8etEGx3bHbVbCvjorUXzkMsrIyv9kRGNpiIa0gg1Z0LGNC9hB jRvegHYbB2EnN9QPRWUc6FFjE2//QT5u10kW4PVoY5gwsOTJvPfGvEKuu7dE7rV136 QCYSvPKu9mvprDWuV+E+HcJPoeLfSKR4q0VpZL+o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Naveen N. Rao" , Anil S Keshavamurthy , "David S. Miller" , "Masami Hiramatsu (Google)" , "Christian A. Ehrhardt" , "Steven Rostedt (Google)" Subject: [PATCH 5.10 27/79] kprobes: Prohibit probes in gate area Date: Tue, 13 Sep 2022 16:04:32 +0200 Message-Id: <20220913140351.616293156@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Christian A. Ehrhardt commit 1efda38d6f9ba26ac88b359c6277f1172db03f1e upstream. The system call gate area counts as kernel text but trying to install a kprobe in this area fails with an Oops later on. To fix this explicitly disallow the gate area for kprobes. Found by syzkaller with the following reproducer: perf_event_open$cgroup(&(0x7f00000001c0)=3D{0x6, 0x80, 0x0, 0x0, 0x0, 0x0, = 0x80ffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, = @perf_config_ext=3D{0x0, 0xffffffffff600000}}, 0xffffffffffffffff, 0x0, 0xf= fffffffffffffff, 0x0) Sample report: BUG: unable to handle page fault for address: fffffbfff3ac6000 PGD 6dfcb067 P4D 6dfcb067 PUD 6df8f067 PMD 6de4d067 PTE 0 Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 0 PID: 21978 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c= 3e60b-dirty #6 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/= 2014 RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 = 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 3= 8 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: insn_get_prefixes arch/x86/lib/insn.c:131 [inline] insn_get_opcode arch/x86/lib/insn.c:272 [inline] insn_get_modrm+0x64a/0x7b0 arch/x86/lib/insn.c:343 insn_get_sib+0x29a/0x330 arch/x86/lib/insn.c:421 insn_get_displacement+0x350/0x6b0 arch/x86/lib/insn.c:464 insn_get_immediate arch/x86/lib/insn.c:632 [inline] insn_get_length arch/x86/lib/insn.c:707 [inline] insn_decode+0x43a/0x490 arch/x86/lib/insn.c:747 can_probe+0xfc/0x1d0 arch/x86/kernel/kprobes/core.c:282 arch_prepare_kprobe+0x79/0x1c0 arch/x86/kernel/kprobes/core.c:739 prepare_kprobe kernel/kprobes.c:1160 [inline] register_kprobe kernel/kprobes.c:1641 [inline] register_kprobe+0xb6e/0x1690 kernel/kprobes.c:1603 __register_trace_kprobe kernel/trace/trace_kprobe.c:509 [inline] __register_trace_kprobe+0x26a/0x2d0 kernel/trace/trace_kprobe.c:477 create_local_trace_kprobe+0x1f7/0x350 kernel/trace/trace_kprobe.c:1833 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:271 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9888 perf_try_init_event+0x12d/0x570 kernel/events/core.c:11261 perf_init_event kernel/events/core.c:11325 [inline] perf_event_alloc.part.0+0xf7f/0x36a0 kernel/events/core.c:11619 perf_event_alloc kernel/events/core.c:12059 [inline] __do_sys_perf_event_open+0x4a8/0x2a00 kernel/events/core.c:12157 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f63ef7efaed Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff f= f 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f63eef63028 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f63ef90ff80 RCX: 00007f63ef7efaed RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 00000000200001c0 RBP: 00007f63ef86019c R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000002 R14: 00007f63ef90ff80 R15: 00007f63eef43000 Modules linked in: CR2: fffffbfff3ac6000 Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee ---[ end trace 0000000000000000 ]--- RIP: 0010:__insn_get_emulate_prefix arch/x86/lib/insn.c:91 [inline] RIP: 0010:insn_get_emulate_prefix arch/x86/lib/insn.c:106 [inline] RIP: 0010:insn_get_prefixes.part.0+0xa8/0x1110 arch/x86/lib/insn.c:134 Code: 49 be 00 00 00 00 00 fc ff df 48 8b 40 60 48 89 44 24 08 e9 81 00 00 = 00 e8 e5 4b 39 ff 4c 89 fa 4c 89 f9 48 c1 ea 03 83 e1 07 <42> 0f b6 14 32 3= 8 ca 7f 08 84 d2 0f 85 06 10 00 00 48 89 d8 48 89 RSP: 0018:ffffc900088bf860 EFLAGS: 00010246 RAX: 0000000000040000 RBX: ffffffff9b9bebc0 RCX: 0000000000000000 RDX: 1ffffffff3ac6000 RSI: ffffc90002d82000 RDI: ffffc900088bf9e8 RBP: ffffffff9d630001 R08: 0000000000000000 R09: ffffc900088bf9e8 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001 R13: ffffffff9d630000 R14: dffffc0000000000 R15: ffffffff9d630000 FS: 00007f63eef63640(0000) GS:ffff88806d000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffbfff3ac6000 CR3: 0000000029d90005 CR4: 0000000000770ef0 PKRU: 55555554 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D Link: https://lkml.kernel.org/r/20220907200917.654103-1-lk@c--e.de cc: "Naveen N. Rao" cc: Anil S Keshavamurthy cc: "David S. Miller" Cc: stable@vger.kernel.org Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Christian A. Ehrhardt Signed-off-by: Steven Rostedt (Google) Signed-off-by: Greg Kroah-Hartman --- kernel/kprobes.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/kprobes.c +++ b/kernel/kprobes.c @@ -1642,6 +1642,7 @@ static int check_kprobe_address_safe(str /* Ensure it is not in reserved area nor out of text */ if (!(core_kernel_text((unsigned long) p->addr) || is_module_text_address((unsigned long) p->addr)) || + in_gate_area_no_mm((unsigned long) p->addr) || within_kprobe_blacklist((unsigned long) p->addr) || jump_label_text_reserved(p->addr, p->addr) || static_call_text_reserved(p->addr, p->addr) || From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 343CEC6FA82 for ; Tue, 13 Sep 2022 14:53:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234635AbiIMOxa (ORCPT ); Tue, 13 Sep 2022 10:53:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34730 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234708AbiIMOta (ORCPT ); Tue, 13 Sep 2022 10:49:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 82843719B2; Tue, 13 Sep 2022 07:25:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C7C8E614AE; Tue, 13 Sep 2022 14:23:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D5143C433D6; Tue, 13 Sep 2022 14:23:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079025; bh=ndMUXaa/CfrcR98ZT3Kb76/oTje8cet7B6fRsBH+UAI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=0Q72h0cUZaMcghGdSf5LslbULd33SSY3yUCO7ddXy875puD20h6Onnm9FCnlphtia xm9T0kjGva1NCiNuagnXF11HbbqVOP06IssrT/YP7GHl/F3wJfjanVlJnpypUOq5Ga QDjQWaXFKE38QmWgoMRP6Rj3p7Eeg1G8rRsIZaAM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, stable , Kuyo Chang Subject: [PATCH 5.10 28/79] debugfs: add debugfs_lookup_and_remove() Date: Tue, 13 Sep 2022 16:04:33 +0200 Message-Id: <20220913140351.658560781@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Greg Kroah-Hartman commit dec9b2f1e0455a151a7293c367da22ab973f713e upstream. There is a very common pattern of using debugfs_remove(debufs_lookup(..)) which results in a dentry leak of the dentry that was looked up. Instead of having to open-code the correct pattern of calling dput() on the dentry, create debugfs_lookup_and_remove() to handle this pattern automatically and properly without any memory leaks. Cc: stable Reported-by: Kuyo Chang Tested-by: Kuyo Chang Link: https://lore.kernel.org/r/YxIaQ8cSinDR881k@kroah.com Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- fs/debugfs/inode.c | 22 ++++++++++++++++++++++ include/linux/debugfs.h | 6 ++++++ 2 files changed, 28 insertions(+) --- a/fs/debugfs/inode.c +++ b/fs/debugfs/inode.c @@ -731,6 +731,28 @@ void debugfs_remove(struct dentry *dentr EXPORT_SYMBOL_GPL(debugfs_remove); =20 /** + * debugfs_lookup_and_remove - lookup a directory or file and recursively = remove it + * @name: a pointer to a string containing the name of the item to look up. + * @parent: a pointer to the parent dentry of the item. + * + * This is the equlivant of doing something like + * debugfs_remove(debugfs_lookup(..)) but with the proper reference counti= ng + * handled for the directory being looked up. + */ +void debugfs_lookup_and_remove(const char *name, struct dentry *parent) +{ + struct dentry *dentry; + + dentry =3D debugfs_lookup(name, parent); + if (!dentry) + return; + + debugfs_remove(dentry); + dput(dentry); +} +EXPORT_SYMBOL_GPL(debugfs_lookup_and_remove); + +/** * debugfs_rename - rename a file/directory in the debugfs filesystem * @old_dir: a pointer to the parent dentry for the renamed object. This * should be a directory dentry. --- a/include/linux/debugfs.h +++ b/include/linux/debugfs.h @@ -91,6 +91,8 @@ struct dentry *debugfs_create_automount( void debugfs_remove(struct dentry *dentry); #define debugfs_remove_recursive debugfs_remove =20 +void debugfs_lookup_and_remove(const char *name, struct dentry *parent); + const struct file_operations *debugfs_real_fops(const struct file *filp); =20 int debugfs_file_get(struct dentry *dentry); @@ -220,6 +222,10 @@ static inline void debugfs_remove(struct static inline void debugfs_remove_recursive(struct dentry *dentry) { } =20 +static inline void debugfs_lookup_and_remove(const char *name, + struct dentry *parent) +{ } + const struct file_operations *debugfs_real_fops(const struct file *filp); =20 static inline int debugfs_file_get(struct dentry *dentry) From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 43188C6FA82 for ; Tue, 13 Sep 2022 14:56:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234703AbiIMO4C (ORCPT ); Tue, 13 Sep 2022 10:56:02 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34762 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234520AbiIMOwQ (ORCPT ); Tue, 13 Sep 2022 10:52:16 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CA19672862; Tue, 13 Sep 2022 07:26:36 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id CB9D6B80F63; Tue, 13 Sep 2022 14:23:48 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4688BC433D6; Tue, 13 Sep 2022 14:23:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079027; bh=jQCjhAuq4MYXaN2FV0uEHPja8Iz3wHeP1C5BLT6RLIk=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jPkSwRnueVaL3e1PuZCeKGHHZWjy6yZw2P2hqvO8VHWUbqk+uhxmhdUAEDKvD5xrs 3fcD9gO+95273HUqjqSgNiS2Mx0qXUI9XB//YENa4bQSmtl4Fv06o3A7zh6wFrb6U3 uVI8O7JE+U1ZWY5a3ZZ97ye0vVAmdbDgmxNsjKxM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Bart Van Assche , Christoph Hellwig Subject: [PATCH 5.10 29/79] nvmet: fix a use-after-free Date: Tue, 13 Sep 2022 16:04:34 +0200 Message-Id: <20220913140351.708709951@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Bart Van Assche commit 6a02a61e81c231cc5c680c5dbf8665275147ac52 upstream. Fix the following use-after-free complaint triggered by blktests nvme/004: BUG: KASAN: user-memory-access in blk_mq_complete_request_remote+0xac/0x350 Read of size 4 at addr 0000607bd1835943 by task kworker/13:1/460 Workqueue: nvmet-wq nvme_loop_execute_work [nvme_loop] Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x49/0x5e print_report.cold+0x36/0x1e2 kasan_report+0xb9/0xf0 __asan_load4+0x6b/0x80 blk_mq_complete_request_remote+0xac/0x350 nvme_loop_queue_response+0x1df/0x275 [nvme_loop] __nvmet_req_complete+0x132/0x4f0 [nvmet] nvmet_req_complete+0x15/0x40 [nvmet] nvmet_execute_io_connect+0x18a/0x1f0 [nvmet] nvme_loop_execute_work+0x20/0x30 [nvme_loop] process_one_work+0x56e/0xa70 worker_thread+0x2d1/0x640 kthread+0x183/0x1c0 ret_from_fork+0x1f/0x30 Cc: stable@vger.kernel.org Fixes: a07b4970f464 ("nvmet: add a generic NVMe target") Signed-off-by: Bart Van Assche Signed-off-by: Christoph Hellwig Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/nvme/target/core.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) --- a/drivers/nvme/target/core.c +++ b/drivers/nvme/target/core.c @@ -730,6 +730,8 @@ static void nvmet_set_error(struct nvmet =20 static void __nvmet_req_complete(struct nvmet_req *req, u16 status) { + struct nvmet_ns *ns =3D req->ns; + if (!req->sq->sqhd_disabled) nvmet_update_sq_head(req); req->cqe->sq_id =3D cpu_to_le16(req->sq->qid); @@ -740,9 +742,9 @@ static void __nvmet_req_complete(struct =20 trace_nvmet_req_complete(req); =20 - if (req->ns) - nvmet_put_namespace(req->ns); req->ops->queue_response(req); + if (ns) + nvmet_put_namespace(ns); } =20 void nvmet_req_complete(struct nvmet_req *req, u16 status) From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 0B2C2C54EE9 for ; Tue, 13 Sep 2022 15:07:10 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235176AbiIMPHI (ORCPT ); Tue, 13 Sep 2022 11:07:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235478AbiIMPEg (ORCPT ); Tue, 13 Sep 2022 11:04:36 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 3EB1B74DCE; Tue, 13 Sep 2022 07:30:21 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id BAC3A614B6; Tue, 13 Sep 2022 14:23:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D17D1C433C1; Tue, 13 Sep 2022 14:23:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079030; bh=qw+AuVF2vbBLzKv6kIt8ab6sjz0MEMRHaxZ7VPhNNuY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DstIEtFGNLungn9m7u03YUUy9l7vbu/sM6NYMQ8KOwA9M9JCccssEWa9jh+f16r+l yB5sJwaOGWhGL5ltyz9JssDQfnOmoa0dzn+WxQ14ixySDZxodfqWuiq76dST39qJeu ygTHnW/zjyjxnu8Wn5LPfzbBjugNXG835M8hSrvs= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, "Jason A. Donenfeld" , Ankit Nautiyal , Jani Nikula , =?UTF-8?q?Ville=20Syrj=C3=A4l=C3=A4?= , Aaron Ma , Rodrigo Vivi Subject: [PATCH 5.10 30/79] drm/i915: Implement WaEdpLinkRateDataReload Date: Tue, 13 Sep 2022 16:04:35 +0200 Message-Id: <20220913140351.757713465@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ville Syrj=C3=A4l=C3=A4 commit 672d6ca758651f0ec12cd0d59787067a5bde1c96 upstream. A lot of modern laptops use the Parade PS8461E MUX for eDP switching. The MUX can operate in jitter cleaning mode or redriver mode, the first one resulting in higher link quality. The jitter cleaning mode needs to know the link rate used and the MUX achieves this by snooping the LINK_BW_SET, LINK_RATE_SELECT and SUPPORTED_LINK_RATES DPCD accesses. When the MUX is powered down (seems this can happen whenever the display is turned off) it loses track of the snooped link rates so when we do the LINK_RATE_SELECT write it no longer knowns which link rate we're selecting, and thus it falls back to the lower quality redriver mode. This results in unstable high link rates (eg. usually 8.1Gbps link rate no longer works correctly). In order to avoid all that let's re-snoop SUPPORTED_LINK_RATES from the sink at the start of every link training. Unfortunately we don't have a way to detect the presence of the MUX. It looks like the set of laptops equipped with this MUX is fairly large and contains devices from multiple manufacturers. It may also still be growing with new models. So a quirk doesn't seem like a very easily maintainable option, thus we shall attempt to do this unconditionally on all machines that use LINK_RATE_SELECT. Hopefully this extra DPCD read doesn't cause issues for any unaffected machine. If that turns out to be the case we'll need to convert this into a quirk in the future. Cc: stable@vger.kernel.org Cc: Jason A. Donenfeld Cc: Ankit Nautiyal Cc: Jani Nikula Closes: https://gitlab.freedesktop.org/drm/intel/-/issues/6205 Signed-off-by: Ville Syrj=C3=A4l=C3=A4 Link: https://patchwork.freedesktop.org/patch/msgid/20220902070319.15395-1-= ville.syrjala@linux.intel.com Tested-by: Aaron Ma Tested-by: Jason A. Donenfeld Reviewed-by: Jani Nikula (cherry picked from commit 25899c590cb5ba9b9f284c6ca8e7e9086793d641) Signed-off-by: Rodrigo Vivi Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/gpu/drm/i915/display/intel_dp_link_training.c | 22 +++++++++++++= +++++ 1 file changed, 22 insertions(+) --- a/drivers/gpu/drm/i915/display/intel_dp_link_training.c +++ b/drivers/gpu/drm/i915/display/intel_dp_link_training.c @@ -163,6 +163,28 @@ intel_dp_link_training_clock_recovery(st intel_dp_compute_rate(intel_dp, intel_dp->link_rate, &link_bw, &rate_select); =20 + /* + * WaEdpLinkRateDataReload + * + * Parade PS8461E MUX (used on varius TGL+ laptops) needs + * to snoop the link rates reported by the sink when we + * use LINK_RATE_SET in order to operate in jitter cleaning + * mode (as opposed to redriver mode). Unfortunately it + * loses track of the snooped link rates when powered down, + * so we need to make it re-snoop often. Without this high + * link rates are not stable. + */ + if (!link_bw) { + struct intel_connector *connector =3D intel_dp->attached_connector; + __le16 sink_rates[DP_MAX_SUPPORTED_RATES]; + + drm_dbg_kms(&i915->drm, "[CONNECTOR:%d:%s] Reloading eDP link rates\n", + connector->base.base.id, connector->base.name); + + drm_dp_dpcd_read(&intel_dp->aux, DP_SUPPORTED_LINK_RATES, + sink_rates, sizeof(sink_rates)); + } + if (link_bw) drm_dbg_kms(&i915->drm, "Using LINK_BW_SET value %02x\n", link_bw); From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A724DC6FA8A for ; Tue, 13 Sep 2022 14:51:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233227AbiIMOvF (ORCPT ); Tue, 13 Sep 2022 10:51:05 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57272 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234366AbiIMOsj (ORCPT ); Tue, 13 Sep 2022 10:48:39 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BD12A69F4D; Tue, 13 Sep 2022 07:25:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id B65E0B80F3B; Tue, 13 Sep 2022 14:23:53 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 35C86C433C1; Tue, 13 Sep 2022 14:23:52 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079032; bh=DXF54WQlcK/aA3dHJYwUJ8ZCOz+KS60hmD4fshTAbLY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EI26L6lbjmjejlLkS9UaPiAgXyfIj8dObayfzEBReThHrUQtfP6x+TUSsQQVjzlSI N10+gY54lE5nAAWVho8LWjNxvYUkywcKy00Y8PmY4mpkzEjnOPEyVjalwgpHd7ulBw RpvlYA+w7v4NVCnUWXHe+oS4eaWq5rQlNAkXY1YA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sreekanth Reddy , "Martin K. Petersen" Subject: [PATCH 5.10 31/79] scsi: mpt3sas: Fix use-after-free warning Date: Tue, 13 Sep 2022 16:04:36 +0200 Message-Id: <20220913140351.803187957@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sreekanth Reddy commit 991df3dd5144f2e6b1c38b8d20ed3d4d21e20b34 upstream. Fix the following use-after-free warning which is observed during controller reset: refcount_t: underflow; use-after-free. WARNING: CPU: 23 PID: 5399 at lib/refcount.c:28 refcount_warn_saturate+0xa6= /0xf0 Link: https://lore.kernel.org/r/20220906134908.1039-2-sreekanth.reddy@broad= com.com Signed-off-by: Sreekanth Reddy Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c +++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c @@ -3501,6 +3501,7 @@ static struct fw_event_work *dequeue_nex fw_event =3D list_first_entry(&ioc->fw_event_list, struct fw_event_work, list); list_del_init(&fw_event->list); + fw_event_work_put(fw_event); } spin_unlock_irqrestore(&ioc->fw_event_lock, flags); =20 @@ -3559,7 +3560,6 @@ _scsih_fw_event_cleanup_queue(struct MPT if (cancel_work_sync(&fw_event->work)) fw_event_work_put(fw_event); =20 - fw_event_work_put(fw_event); } ioc->fw_events_cleanup =3D 0; } From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D416DC6FA89 for ; Tue, 13 Sep 2022 14:51:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234652AbiIMOvc (ORCPT ); Tue, 13 Sep 2022 10:51:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46528 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234485AbiIMOsr (ORCPT ); Tue, 13 Sep 2022 10:48:47 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1882B66A7A; Tue, 13 Sep 2022 07:25:17 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 83AE7614C6; Tue, 13 Sep 2022 14:23:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FFB9C433D7; Tue, 13 Sep 2022 14:23:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079035; bh=JtseD01ATePGId3VLyjVyOqQP9WnZXcf8aOBoKLHlgE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CHdk35BXm8Qgnov6e1/p42MJMG5NzAtN1KFbX9U8mw1TgbFcuqGkTUmEJoSlmZ9Dh E2nTtbR6Mg5IffURJkUarnZ6wWQzhWMHJ5/Gs6viyMg8NBxYL7VNchiOfIhebhVJFc 7y10HWri2/ALvN73PQ4LFb2aZduDDmPOxSOpDF/0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, James Smart , Yang Yingliang , "Martin K. Petersen" Subject: [PATCH 5.10 32/79] scsi: lpfc: Add missing destroy_workqueue() in error path Date: Tue, 13 Sep 2022 16:04:37 +0200 Message-Id: <20220913140351.855398260@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Yingliang commit da6d507f5ff328f346b3c50e19e19993027b8ffd upstream. Add the missing destroy_workqueue() before return from lpfc_sli4_driver_resource_setup() in the error path. Link: https://lore.kernel.org/r/20220823044237.285643-1-yangyingliang@huawe= i.com Fixes: 3cee98db2610 ("scsi: lpfc: Fix crash on driver unload in wq free") Reviewed-by: James Smart Signed-off-by: Yang Yingliang Signed-off-by: Martin K. Petersen Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/scsi/lpfc/lpfc_init.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) --- a/drivers/scsi/lpfc/lpfc_init.c +++ b/drivers/scsi/lpfc/lpfc_init.c @@ -6670,7 +6670,7 @@ lpfc_sli4_driver_resource_setup(struct l /* Allocate device driver memory */ rc =3D lpfc_mem_alloc(phba, SGL_ALIGN_SZ); if (rc) - return -ENOMEM; + goto out_destroy_workqueue; =20 /* IF Type 2 ports get initialized now. */ if (bf_get(lpfc_sli_intf_if_type, &phba->sli4_hba.sli_intf) >=3D @@ -7076,6 +7076,9 @@ out_free_bsmbx: lpfc_destroy_bootstrap_mbox(phba); out_free_mem: lpfc_mem_free(phba); +out_destroy_workqueue: + destroy_workqueue(phba->wq); + phba->wq =3D NULL; return rc; } From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 25C57C6FA89 for ; Tue, 13 Sep 2022 14:56:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234662AbiIMOzz (ORCPT ); Tue, 13 Sep 2022 10:55:55 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34734 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234730AbiIMOwP (ORCPT ); Tue, 13 Sep 2022 10:52:15 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1D8757287B; Tue, 13 Sep 2022 07:26:26 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F13EA61497; Tue, 13 Sep 2022 14:23:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0E693C433D6; Tue, 13 Sep 2022 14:23:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079037; bh=icq9GTc4R8Fs/k47xfwnFTdNqezasP2YjH7QSEIkeSA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=umQNMSJB8wJl0AJ4GUgz28+V7AsvPJB4rhRUgBPjcjMd8zmpN2MozCYZYEHEIVk+C wGa8kK7WBSDZjasgQ2AzS6sIhs9P3g9HpcvWxOi4XxJ7LuBPhHb0af8YFKvBhJTiHf 5fzKhPB74BlaXX5xekn5Fi60jDwYczPE8TL0E3Nk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tejun Heo , Christian Brauner , =?UTF-8?q?Michal=20Koutn=C3=BD?= , Sasha Levin Subject: [PATCH 5.10 33/79] cgroup: Elide write-locking threadgroup_rwsem when updating csses on an empty subtree Date: Tue, 13 Sep 2022 16:04:38 +0200 Message-Id: <20220913140351.900985034@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Tejun Heo [ Upstream commit 671c11f0619e5ccb380bcf0f062f69ba95fc974a ] cgroup_update_dfl_csses() write-lock the threadgroup_rwsem as updating the csses can trigger process migrations. However, if the subtree doesn't contain any tasks, there aren't gonna be any cgroup migrations. This condition can be trivially detected by testing whether mgctx.preloaded_src_csets is empty. Elide write-locking threadgroup_rwsem if the subtree is empty. After this optimization, the usage pattern of creating a cgroup, enabling the necessary controllers, and then seeding it with CLONE_INTO_CGROUP and then removing the cgroup after it becomes empty doesn't need to write-lock threadgroup_rwsem at all. Signed-off-by: Tejun Heo Cc: Christian Brauner Cc: Michal Koutn=C3=BD Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- kernel/cgroup/cgroup.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 5046c99deba86..1072843b25709 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2908,12 +2908,11 @@ static int cgroup_update_dfl_csses(struct cgroup *c= grp) struct cgroup_subsys_state *d_css; struct cgroup *dsct; struct css_set *src_cset; + bool has_tasks; int ret; =20 lockdep_assert_held(&cgroup_mutex); =20 - percpu_down_write(&cgroup_threadgroup_rwsem); - /* look up all csses currently attached to @cgrp's subtree */ spin_lock_irq(&css_set_lock); cgroup_for_each_live_descendant_pre(dsct, d_css, cgrp) { @@ -2924,6 +2923,16 @@ static int cgroup_update_dfl_csses(struct cgroup *cg= rp) } spin_unlock_irq(&css_set_lock); =20 + /* + * We need to write-lock threadgroup_rwsem while migrating tasks. + * However, if there are no source csets for @cgrp, changing its + * controllers isn't gonna produce any task migrations and the + * write-locking can be skipped safely. + */ + has_tasks =3D !list_empty(&mgctx.preloaded_src_csets); + if (has_tasks) + percpu_down_write(&cgroup_threadgroup_rwsem); + /* NULL dst indicates self on default hierarchy */ ret =3D cgroup_migrate_prepare_dst(&mgctx); if (ret) @@ -2943,7 +2952,8 @@ static int cgroup_update_dfl_csses(struct cgroup *cgr= p) ret =3D cgroup_migrate_execute(&mgctx); out_finish: cgroup_migrate_finish(&mgctx); - percpu_up_write(&cgroup_threadgroup_rwsem); + if (has_tasks) + percpu_up_write(&cgroup_threadgroup_rwsem); return ret; } =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 61004C6FA82 for ; Tue, 13 Sep 2022 14:51:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234683AbiIMOvx (ORCPT ); Tue, 13 Sep 2022 10:51:53 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56890 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234531AbiIMOsy (ORCPT ); Tue, 13 Sep 2022 10:48:54 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 607BA6F551; Tue, 13 Sep 2022 07:25:22 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C68A2614CE; Tue, 13 Sep 2022 14:24:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CB73DC433D6; Tue, 13 Sep 2022 14:23:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079040; bh=+fk9TLqEpNx7WuHZZ2zSbxmR6htfifbuU340iivay+g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=akl5FqE/8bc4vG/yjmiEzuYhZS088AV9t/F0+ap1fc2TxqMEYAmK2/UMi6vKHVUwN P6GoyS2ldUmbJhoPR85AALlXoRUtGBgzQAjicXMkAn293ErIJtLIa+eKn07RzNTO+K rFsLy0BX1xMVJPB3ZdpjqPtXiHG7dXXcizlWxPCE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Tejun Heo , Sasha Levin , Imran Khan , Xuewen Yan Subject: [PATCH 5.10 34/79] cgroup: Fix threadgroup_rwsem <-> cpus_read_lock() deadlock Date: Tue, 13 Sep 2022 16:04:39 +0200 Message-Id: <20220913140351.945201247@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Tejun Heo [ Upstream commit 4f7e7236435ca0abe005c674ebd6892c6e83aeb3 ] Bringing up a CPU may involve creating and destroying tasks which requires read-locking threadgroup_rwsem, so threadgroup_rwsem nests inside cpus_read_lock(). However, cpuset's ->attach(), which may be called with thredagroup_rwsem write-locked, also wants to disable CPU hotplug and acquires cpus_read_lock(), leading to a deadlock. Fix it by guaranteeing that ->attach() is always called with CPU hotplug disabled and removing cpus_read_lock() call from cpuset_attach(). Signed-off-by: Tejun Heo Reviewed-and-tested-by: Imran Khan Reported-and-tested-by: Xuewen Yan Fixes: 05c7b7a92cc8 ("cgroup/cpuset: Fix a race between cpuset_attach() and= cpu hotplug") Cc: stable@vger.kernel.org # v5.17+ Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- kernel/cgroup/cgroup.c | 77 +++++++++++++++++++++++++++++------------- kernel/cgroup/cpuset.c | 3 +- 2 files changed, 55 insertions(+), 25 deletions(-) diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c index 1072843b25709..684c16849eff3 100644 --- a/kernel/cgroup/cgroup.c +++ b/kernel/cgroup/cgroup.c @@ -2304,6 +2304,47 @@ int task_cgroup_path(struct task_struct *task, char = *buf, size_t buflen) } EXPORT_SYMBOL_GPL(task_cgroup_path); =20 +/** + * cgroup_attach_lock - Lock for ->attach() + * @lock_threadgroup: whether to down_write cgroup_threadgroup_rwsem + * + * cgroup migration sometimes needs to stabilize threadgroups against fork= s and + * exits by write-locking cgroup_threadgroup_rwsem. However, some ->attach= () + * implementations (e.g. cpuset), also need to disable CPU hotplug. + * Unfortunately, letting ->attach() operations acquire cpus_read_lock() c= an + * lead to deadlocks. + * + * Bringing up a CPU may involve creating and destroying tasks which requi= res + * read-locking threadgroup_rwsem, so threadgroup_rwsem nests inside + * cpus_read_lock(). If we call an ->attach() which acquires the cpus lock= while + * write-locking threadgroup_rwsem, the locking order is reversed and we e= nd up + * waiting for an on-going CPU hotplug operation which in turn is waiting = for + * the threadgroup_rwsem to be released to create new tasks. For more deta= ils: + * + * http://lkml.kernel.org/r/20220711174629.uehfmqegcwn2lqzu@wubuntu + * + * Resolve the situation by always acquiring cpus_read_lock() before optio= nally + * write-locking cgroup_threadgroup_rwsem. This allows ->attach() to assum= e that + * CPU hotplug is disabled on entry. + */ +static void cgroup_attach_lock(bool lock_threadgroup) +{ + cpus_read_lock(); + if (lock_threadgroup) + percpu_down_write(&cgroup_threadgroup_rwsem); +} + +/** + * cgroup_attach_unlock - Undo cgroup_attach_lock() + * @lock_threadgroup: whether to up_write cgroup_threadgroup_rwsem + */ +static void cgroup_attach_unlock(bool lock_threadgroup) +{ + if (lock_threadgroup) + percpu_up_write(&cgroup_threadgroup_rwsem); + cpus_read_unlock(); +} + /** * cgroup_migrate_add_task - add a migration target task to a migration co= ntext * @task: target task @@ -2780,8 +2821,7 @@ int cgroup_attach_task(struct cgroup *dst_cgrp, struc= t task_struct *leader, } =20 struct task_struct *cgroup_procs_write_start(char *buf, bool threadgroup, - bool *locked) - __acquires(&cgroup_threadgroup_rwsem) + bool *threadgroup_locked) { struct task_struct *tsk; pid_t pid; @@ -2798,12 +2838,8 @@ struct task_struct *cgroup_procs_write_start(char *b= uf, bool threadgroup, * Therefore, we can skip the global lock. */ lockdep_assert_held(&cgroup_mutex); - if (pid || threadgroup) { - percpu_down_write(&cgroup_threadgroup_rwsem); - *locked =3D true; - } else { - *locked =3D false; - } + *threadgroup_locked =3D pid || threadgroup; + cgroup_attach_lock(*threadgroup_locked); =20 rcu_read_lock(); if (pid) { @@ -2834,17 +2870,14 @@ struct task_struct *cgroup_procs_write_start(char *= buf, bool threadgroup, goto out_unlock_rcu; =20 out_unlock_threadgroup: - if (*locked) { - percpu_up_write(&cgroup_threadgroup_rwsem); - *locked =3D false; - } + cgroup_attach_unlock(*threadgroup_locked); + *threadgroup_locked =3D false; out_unlock_rcu: rcu_read_unlock(); return tsk; } =20 -void cgroup_procs_write_finish(struct task_struct *task, bool locked) - __releases(&cgroup_threadgroup_rwsem) +void cgroup_procs_write_finish(struct task_struct *task, bool threadgroup_= locked) { struct cgroup_subsys *ss; int ssid; @@ -2852,8 +2885,8 @@ void cgroup_procs_write_finish(struct task_struct *ta= sk, bool locked) /* release reference from cgroup_procs_write_start() */ put_task_struct(task); =20 - if (locked) - percpu_up_write(&cgroup_threadgroup_rwsem); + cgroup_attach_unlock(threadgroup_locked); + for_each_subsys(ss, ssid) if (ss->post_attach) ss->post_attach(); @@ -2930,8 +2963,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgr= p) * write-locking can be skipped safely. */ has_tasks =3D !list_empty(&mgctx.preloaded_src_csets); - if (has_tasks) - percpu_down_write(&cgroup_threadgroup_rwsem); + cgroup_attach_lock(has_tasks); =20 /* NULL dst indicates self on default hierarchy */ ret =3D cgroup_migrate_prepare_dst(&mgctx); @@ -2952,8 +2984,7 @@ static int cgroup_update_dfl_csses(struct cgroup *cgr= p) ret =3D cgroup_migrate_execute(&mgctx); out_finish: cgroup_migrate_finish(&mgctx); - if (has_tasks) - percpu_up_write(&cgroup_threadgroup_rwsem); + cgroup_attach_unlock(has_tasks); return ret; } =20 @@ -4809,13 +4840,13 @@ static ssize_t cgroup_procs_write(struct kernfs_ope= n_file *of, struct task_struct *task; const struct cred *saved_cred; ssize_t ret; - bool locked; + bool threadgroup_locked; =20 dst_cgrp =3D cgroup_kn_lock_live(of->kn, false); if (!dst_cgrp) return -ENODEV; =20 - task =3D cgroup_procs_write_start(buf, true, &locked); + task =3D cgroup_procs_write_start(buf, true, &threadgroup_locked); ret =3D PTR_ERR_OR_ZERO(task); if (ret) goto out_unlock; @@ -4841,7 +4872,7 @@ static ssize_t cgroup_procs_write(struct kernfs_open_= file *of, ret =3D cgroup_attach_task(dst_cgrp, task, true); =20 out_finish: - cgroup_procs_write_finish(task, locked); + cgroup_procs_write_finish(task, threadgroup_locked); out_unlock: cgroup_kn_unlock(of->kn); =20 diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c index c51863b63f93a..b7830f1f1f3a5 100644 --- a/kernel/cgroup/cpuset.c +++ b/kernel/cgroup/cpuset.c @@ -2212,7 +2212,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) cgroup_taskset_first(tset, &css); cs =3D css_cs(css); =20 - cpus_read_lock(); + lockdep_assert_cpus_held(); /* see cgroup_attach_lock() */ percpu_down_write(&cpuset_rwsem); =20 /* prepare for attach */ @@ -2268,7 +2268,6 @@ static void cpuset_attach(struct cgroup_taskset *tset) wake_up(&cpuset_attach_wq); =20 percpu_up_write(&cpuset_rwsem); - cpus_read_unlock(); } =20 /* The various types of files and directories in a cpuset file system */ --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 11053C6FA82 for ; Tue, 13 Sep 2022 14:50:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232715AbiIMOuD (ORCPT ); Tue, 13 Sep 2022 10:50:03 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231559AbiIMOsE (ORCPT ); Tue, 13 Sep 2022 10:48:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 434A43C14D; Tue, 13 Sep 2022 07:24:53 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 18C30614B9; Tue, 13 Sep 2022 14:22:58 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2FBE6C433C1; Tue, 13 Sep 2022 14:22:57 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078977; bh=/PpnwnjJVSUV4+cN9sDteDUVvA5ejNPS6gpK+wLPc5c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jfeKfbK0yHA9dK3SPGPWKyasuUYissH5+AuZbcoewOrQtNHjXQg0D7jZuMGAtKx0K PqFUInvwyH4HLn3GTx/Gmd8dUIfdK3rg/9IT9B4+w+Aq4h2mRhUK6VHIlCx7jQvGEW 622GbsIaGzyyoyN2JgDrZkMk5Ct1CkpAk/3yFGuw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Enzo Matsumiya , Tom Talpey , Steve French , Sasha Levin Subject: [PATCH 5.10 35/79] cifs: remove useless parameter is_fsctl from SMB2_ioctl() Date: Tue, 13 Sep 2022 16:04:40 +0200 Message-Id: <20220913140351.991126004@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Enzo Matsumiya [ Upstream commit 400d0ad63b190895e29f43bc75b1260111d3fd34 ] SMB2_ioctl() is always called with is_fsctl =3D true, so doesn't make any sense to have it at all. Thus, always set SMB2_0_IOCTL_IS_FSCTL flag on the request. Also, as per MS-SMB2 3.3.5.15 "Receiving an SMB2 IOCTL Request", servers must fail the request if the request flags is zero anyway. Signed-off-by: Enzo Matsumiya Reviewed-by: Tom Talpey Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- fs/cifs/smb2file.c | 1 - fs/cifs/smb2ops.c | 35 +++++++++++++---------------------- fs/cifs/smb2pdu.c | 20 +++++++++----------- fs/cifs/smb2proto.h | 4 ++-- 4 files changed, 24 insertions(+), 36 deletions(-) diff --git a/fs/cifs/smb2file.c b/fs/cifs/smb2file.c index 2fa3ba354cc96..001c26daacbaa 100644 --- a/fs/cifs/smb2file.c +++ b/fs/cifs/smb2file.c @@ -74,7 +74,6 @@ smb2_open_file(const unsigned int xid, struct cifs_open_p= arms *oparms, nr_ioctl_req.Reserved =3D 0; rc =3D SMB2_ioctl(xid, oparms->tcon, fid->persistent_fid, fid->volatile_fid, FSCTL_LMR_REQUEST_RESILIENCY, - true /* is_fsctl */, (char *)&nr_ioctl_req, sizeof(nr_ioctl_req), CIFSMaxBufSize, NULL, NULL /* no return info */); if (rc =3D=3D -EOPNOTSUPP) { diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index b6d72e3c5ebad..0a20ae96fe243 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -587,7 +587,7 @@ SMB3_request_interfaces(const unsigned int xid, struct = cifs_tcon *tcon) struct cifs_ses *ses =3D tcon->ses; =20 rc =3D SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, - FSCTL_QUERY_NETWORK_INTERFACE_INFO, true /* is_fsctl */, + FSCTL_QUERY_NETWORK_INTERFACE_INFO, NULL /* no data input */, 0 /* no data input */, CIFSMaxBufSize, (char **)&out_buf, &ret_data_len); if (rc =3D=3D -EOPNOTSUPP) { @@ -1470,9 +1470,8 @@ SMB2_request_res_key(const unsigned int xid, struct c= ifs_tcon *tcon, struct resume_key_req *res_key; =20 rc =3D SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, - FSCTL_SRV_REQUEST_RESUME_KEY, true /* is_fsctl */, - NULL, 0 /* no input */, CIFSMaxBufSize, - (char **)&res_key, &ret_data_len); + FSCTL_SRV_REQUEST_RESUME_KEY, NULL, 0 /* no input */, + CIFSMaxBufSize, (char **)&res_key, &ret_data_len); =20 if (rc) { cifs_tcon_dbg(VFS, "refcpy ioctl error %d getting resume key\n", rc); @@ -1611,7 +1610,7 @@ smb2_ioctl_query_info(const unsigned int xid, rqst[1].rq_nvec =3D SMB2_IOCTL_IOV_SIZE; =20 rc =3D SMB2_ioctl_init(tcon, server, &rqst[1], COMPOUND_FID, COMPOUND_FI= D, - qi.info_type, true, buffer, qi.output_buffer_length, + qi.info_type, buffer, qi.output_buffer_length, CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE - MAX_SMB2_CLOSE_RESPONSE_SIZE); free_req1_func =3D SMB2_ioctl_free; @@ -1787,9 +1786,8 @@ smb2_copychunk_range(const unsigned int xid, retbuf =3D NULL; rc =3D SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, trgtfile->fid.volatile_fid, FSCTL_SRV_COPYCHUNK_WRITE, - true /* is_fsctl */, (char *)pcchunk, - sizeof(struct copychunk_ioctl), CIFSMaxBufSize, - (char **)&retbuf, &ret_data_len); + (char *)pcchunk, sizeof(struct copychunk_ioctl), + CIFSMaxBufSize, (char **)&retbuf, &ret_data_len); if (rc =3D=3D 0) { if (ret_data_len !=3D sizeof(struct copychunk_ioctl_rsp)) { @@ -1949,7 +1947,6 @@ static bool smb2_set_sparse(const unsigned int xid, s= truct cifs_tcon *tcon, =20 rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, FSCTL_SET_SPARSE, - true /* is_fctl */, &setsparse, 1, CIFSMaxBufSize, NULL, NULL); if (rc) { tcon->broken_sparse_sup =3D true; @@ -2032,7 +2029,6 @@ smb2_duplicate_extents(const unsigned int xid, rc =3D SMB2_ioctl(xid, tcon, trgtfile->fid.persistent_fid, trgtfile->fid.volatile_fid, FSCTL_DUPLICATE_EXTENTS_TO_FILE, - true /* is_fsctl */, (char *)&dup_ext_buf, sizeof(struct duplicate_extents_to_file), CIFSMaxBufSize, NULL, @@ -2067,7 +2063,6 @@ smb3_set_integrity(const unsigned int xid, struct cif= s_tcon *tcon, return SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, FSCTL_SET_INTEGRITY_INFORMATION, - true /* is_fsctl */, (char *)&integr_info, sizeof(struct fsctl_set_integrity_information_req), CIFSMaxBufSize, NULL, @@ -2120,7 +2115,6 @@ smb3_enum_snapshots(const unsigned int xid, struct ci= fs_tcon *tcon, rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, FSCTL_SRV_ENUMERATE_SNAPSHOTS, - true /* is_fsctl */, NULL, 0 /* no input data */, max_response_size, (char **)&retbuf, &ret_data_len); @@ -2762,7 +2756,6 @@ smb2_get_dfs_refer(const unsigned int xid, struct cif= s_ses *ses, do { rc =3D SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, FSCTL_DFS_GET_REFERRALS, - true /* is_fsctl */, (char *)dfs_req, dfs_req_size, CIFSMaxBufSize, (char **)&dfs_rsp, &dfs_rsp_size); } while (rc =3D=3D -EAGAIN); @@ -2964,8 +2957,7 @@ smb2_query_symlink(const unsigned int xid, struct cif= s_tcon *tcon, =20 rc =3D SMB2_ioctl_init(tcon, server, &rqst[1], fid.persistent_fid, - fid.volatile_fid, FSCTL_GET_REPARSE_POINT, - true /* is_fctl */, NULL, 0, + fid.volatile_fid, FSCTL_GET_REPARSE_POINT, NULL, 0, CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE - MAX_SMB2_CLOSE_RESPONSE_SIZE); @@ -3145,8 +3137,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct= cifs_tcon *tcon, =20 rc =3D SMB2_ioctl_init(tcon, server, &rqst[1], COMPOUND_FID, - COMPOUND_FID, FSCTL_GET_REPARSE_POINT, - true /* is_fctl */, NULL, 0, + COMPOUND_FID, FSCTL_GET_REPARSE_POINT, NULL, 0, CIFSMaxBufSize - MAX_SMB2_CREATE_RESPONSE_SIZE - MAX_SMB2_CLOSE_RESPONSE_SIZE); @@ -3409,7 +3400,7 @@ static long smb3_zero_range(struct file *file, struct= cifs_tcon *tcon, fsctl_buf.BeyondFinalZero =3D cpu_to_le64(offset + len); =20 rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, - cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA, true, + cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA, (char *)&fsctl_buf, sizeof(struct file_zero_data_information), 0, NULL, NULL); @@ -3471,7 +3462,7 @@ static long smb3_punch_hole(struct file *file, struct= cifs_tcon *tcon, =20 rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, FSCTL_SET_ZERO_DATA, - true /* is_fctl */, (char *)&fsctl_buf, + (char *)&fsctl_buf, sizeof(struct file_zero_data_information), CIFSMaxBufSize, NULL, NULL); free_xid(xid); @@ -3530,7 +3521,7 @@ static int smb3_simple_fallocate_range(unsigned int x= id, in_data.length =3D cpu_to_le64(len); rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, - FSCTL_QUERY_ALLOCATED_RANGES, true, + FSCTL_QUERY_ALLOCATED_RANGES, (char *)&in_data, sizeof(in_data), 1024 * sizeof(struct file_allocated_range_buffer), (char **)&out_data, &out_data_len); @@ -3771,7 +3762,7 @@ static loff_t smb3_llseek(struct file *file, struct c= ifs_tcon *tcon, loff_t offs =20 rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, - FSCTL_QUERY_ALLOCATED_RANGES, true, + FSCTL_QUERY_ALLOCATED_RANGES, (char *)&in_data, sizeof(in_data), sizeof(struct file_allocated_range_buffer), (char **)&out_data, &out_data_len); @@ -3831,7 +3822,7 @@ static int smb3_fiemap(struct cifs_tcon *tcon, =20 rc =3D SMB2_ioctl(xid, tcon, cfile->fid.persistent_fid, cfile->fid.volatile_fid, - FSCTL_QUERY_ALLOCATED_RANGES, true, + FSCTL_QUERY_ALLOCATED_RANGES, (char *)&in_data, sizeof(in_data), 1024 * sizeof(struct file_allocated_range_buffer), (char **)&out_data, &out_data_len); diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 24dd711fa9b95..7ee8abd1f79be 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -1081,7 +1081,7 @@ int smb3_validate_negotiate(const unsigned int xid, s= truct cifs_tcon *tcon) } =20 rc =3D SMB2_ioctl(xid, tcon, NO_FILE_ID, NO_FILE_ID, - FSCTL_VALIDATE_NEGOTIATE_INFO, true /* is_fsctl */, + FSCTL_VALIDATE_NEGOTIATE_INFO, (char *)pneg_inbuf, inbuflen, CIFSMaxBufSize, (char **)&pneg_rsp, &rsplen); if (rc =3D=3D -EOPNOTSUPP) { @@ -2922,7 +2922,7 @@ int SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, struct smb_rqst *rqst, u64 persistent_fid, u64 volatile_fid, u32 opcode, - bool is_fsctl, char *in_data, u32 indatalen, + char *in_data, u32 indatalen, __u32 max_response_size) { struct smb2_ioctl_req *req; @@ -2997,10 +2997,8 @@ SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_S= erver_Info *server, req->sync_hdr.CreditCharge =3D cpu_to_le16(DIV_ROUND_UP(max(indatalen, max_response_size), SMB2_MAX_BUFFER_SIZE)); - if (is_fsctl) - req->Flags =3D cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); - else - req->Flags =3D 0; + /* always an FSCTL (for now) */ + req->Flags =3D cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); =20 /* validate negotiate request must be signed - see MS-SMB2 3.2.5.5 */ if (opcode =3D=3D FSCTL_VALIDATE_NEGOTIATE_INFO) @@ -3027,9 +3025,9 @@ SMB2_ioctl_free(struct smb_rqst *rqst) */ int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_= fid, - u64 volatile_fid, u32 opcode, bool is_fsctl, - char *in_data, u32 indatalen, u32 max_out_data_len, - char **out_data, u32 *plen /* returned data len */) + u64 volatile_fid, u32 opcode, char *in_data, u32 indatalen, + u32 max_out_data_len, char **out_data, + u32 *plen /* returned data len */) { struct smb_rqst rqst; struct smb2_ioctl_rsp *rsp =3D NULL; @@ -3071,7 +3069,7 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *= tcon, u64 persistent_fid, =20 rc =3D SMB2_ioctl_init(tcon, server, &rqst, persistent_fid, volatile_fid, opcode, - is_fsctl, in_data, indatalen, max_out_data_len); + in_data, indatalen, max_out_data_len); if (rc) goto ioctl_exit; =20 @@ -3153,7 +3151,7 @@ SMB2_set_compression(const unsigned int xid, struct c= ifs_tcon *tcon, cpu_to_le16(COMPRESSION_FORMAT_DEFAULT); =20 rc =3D SMB2_ioctl(xid, tcon, persistent_fid, volatile_fid, - FSCTL_SET_COMPRESSION, true /* is_fsctl */, + FSCTL_SET_COMPRESSION, (char *)&fsctl_input /* data input */, 2 /* in data len */, CIFSMaxBufSize /* max out data */, &ret_data /* out data */, NULL); diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h index 4eb0ca84355a6..ed2b4fb012a41 100644 --- a/fs/cifs/smb2proto.h +++ b/fs/cifs/smb2proto.h @@ -155,13 +155,13 @@ extern int SMB2_open_init(struct cifs_tcon *tcon, extern void SMB2_open_free(struct smb_rqst *rqst); extern int SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, u64 volatile_fid, u32 opcode, - bool is_fsctl, char *in_data, u32 indatalen, u32 maxoutlen, + char *in_data, u32 indatalen, u32 maxoutlen, char **out_data, u32 *plen /* returned data len */); extern int SMB2_ioctl_init(struct cifs_tcon *tcon, struct TCP_Server_Info *server, struct smb_rqst *rqst, u64 persistent_fid, u64 volatile_fid, u32 opcode, - bool is_fsctl, char *in_data, u32 indatalen, + char *in_data, u32 indatalen, __u32 max_response_size); extern void SMB2_ioctl_free(struct smb_rqst *rqst); extern int SMB2_change_notify(const unsigned int xid, struct cifs_tcon *tc= on, --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7C0A6C6FA82 for ; Tue, 13 Sep 2022 14:45:48 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230260AbiIMOpq (ORCPT ); Tue, 13 Sep 2022 10:45:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:59592 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231367AbiIMOnY (ORCPT ); Tue, 13 Sep 2022 10:43:24 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A69986E8A8; Tue, 13 Sep 2022 07:23:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 527D1B80F97; Tue, 13 Sep 2022 14:23:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADA12C433B5; Tue, 13 Sep 2022 14:22:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078980; bh=DvXpHCfXbZfjG69P89g89P4VBGClGkIQAJFoRQUxUT4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pQNBEuCfanIQ3Z7mKsoLEMGOPikXt0O+3Mi54TpCxr0MTI0XYdQUt4xTXne6UDhlm fGfa0dbfdsQx+BAi+qsmmA/efoOvlo7NZimblBWVhbtpkrcLF298r3B2bo4sNlVRjP v8pZO09LoQXv2hrPgNrCuN8hJnvx86SlWmkZ6tSM= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Howells , Steve French , Sasha Levin Subject: [PATCH 5.10 36/79] smb3: missing inode locks in punch hole Date: Tue, 13 Sep 2022 16:04:41 +0200 Message-Id: <20220913140352.035475762@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Howells [ Upstream commit ba0803050d610d5072666be727bca5e03e55b242 ] smb3 fallocate punch hole was not grabbing the inode or filemap_invalidate locks so could have race with pagemap reinstantiating the page. Cc: stable@vger.kernel.org Signed-off-by: David Howells Signed-off-by: Steve French Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- fs/cifs/smb2ops.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c index 0a20ae96fe243..11efd5289ec43 100644 --- a/fs/cifs/smb2ops.c +++ b/fs/cifs/smb2ops.c @@ -3430,7 +3430,7 @@ static long smb3_zero_range(struct file *file, struct= cifs_tcon *tcon, static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, loff_t offset, loff_t len) { - struct inode *inode; + struct inode *inode =3D file_inode(file); struct cifsFileInfo *cfile =3D file->private_data; struct file_zero_data_information fsctl_buf; long rc; @@ -3439,14 +3439,12 @@ static long smb3_punch_hole(struct file *file, stru= ct cifs_tcon *tcon, =20 xid =3D get_xid(); =20 - inode =3D d_inode(cfile->dentry); - + inode_lock(inode); /* Need to make file sparse, if not already, before freeing range. */ /* Consider adding equivalent for compressed since it could also work */ if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) { rc =3D -EOPNOTSUPP; - free_xid(xid); - return rc; + goto out; } =20 /* @@ -3465,6 +3463,8 @@ static long smb3_punch_hole(struct file *file, struct= cifs_tcon *tcon, (char *)&fsctl_buf, sizeof(struct file_zero_data_information), CIFSMaxBufSize, NULL, NULL); +out: + inode_unlock(inode); free_xid(xid); return rc; } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7948AC6FA82 for ; Tue, 13 Sep 2022 14:52:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231244AbiIMOww (ORCPT ); Tue, 13 Sep 2022 10:52:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46894 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232492AbiIMOra (ORCPT ); Tue, 13 Sep 2022 10:47:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CACC213FA4; Tue, 13 Sep 2022 07:24:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id C6530B80FAF; Tue, 13 Sep 2022 14:23:03 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 301E0C433D6; Tue, 13 Sep 2022 14:23:02 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078982; bh=KF9Q6V5/2B3EEiSElY1fDQT4aPIUCka+ZzrUpzWsB40=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=nuGo0+xSdUbmMt+6A9Zc3H5GfQeAhv1FKCcYgHhTmnBU/BgsMOU5bZnOMO0x4lEEe ihpsrFFiViAet/3QVwIIZR1xkK/78++O60JAo3ilK39BpfoqpWKNAXGXrSAUoiZHyX FQJwgCr4sF2i4rpj+Z1fNddir9UihJ1RLv+7iYXw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marco Felsch , Shawn Guo , Sasha Levin Subject: [PATCH 5.10 37/79] ARM: dts: imx6qdl-kontron-samx6i: remove duplicated node Date: Tue, 13 Sep 2022 16:04:42 +0200 Message-Id: <20220913140352.084415433@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Marco Felsch [ Upstream commit 204f67d86f55dd4fa757ed04757d7273f71a169c ] The regulator node 'regulator-3p3v-s0' was dupplicated. Remove it to clean the DTS. Fixes: 2a51f9dae13d ("ARM: dts: imx6qdl-kontron-samx6i: Add iMX6-based Kont= ron SMARC-sAMX6i module") Signed-off-by: Marco Felsch Signed-off-by: Shawn Guo Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi b/arch/arm/boot/= dts/imx6qdl-kontron-samx6i.dtsi index 92f9977d14822..e9a4115124eb0 100644 --- a/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi +++ b/arch/arm/boot/dts/imx6qdl-kontron-samx6i.dtsi @@ -51,16 +51,6 @@ vin-supply =3D <®_3p3v_s5>; }; =20 - reg_3p3v_s0: regulator-3p3v-s0 { - compatible =3D "regulator-fixed"; - regulator-name =3D "V_3V3_S0"; - regulator-min-microvolt =3D <3300000>; - regulator-max-microvolt =3D <3300000>; - regulator-always-on; - regulator-boot-on; - vin-supply =3D <®_3p3v_s5>; - }; - reg_3p3v_s5: regulator-3p3v-s5 { compatible =3D "regulator-fixed"; regulator-name =3D "V_3V3_S5"; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 44D04C6FA82 for ; Tue, 13 Sep 2022 15:19:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235845AbiIMPTd (ORCPT ); Tue, 13 Sep 2022 11:19:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38612 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235847AbiIMPSE (ORCPT ); Tue, 13 Sep 2022 11:18:04 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6C68513DC2; Tue, 13 Sep 2022 07:34:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 83477614C0; Tue, 13 Sep 2022 14:23:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A06AFC433D6; Tue, 13 Sep 2022 14:23:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078985; bh=xwuyhDcw/xk2nUESBPF8JRjdaJrPRhflfEcwlsjRpW4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=1n+nhJZjZtGJbw2IVfFCCkt5bklZWzVqZ6Cve7Mrr18jgV63xLEIu+/1Wz2Hpt7K5 NZkwif+IlA1rO+Y0TAj4cQ1A1tP/k9NVakST7aWeahbd9q+EVLWKOIKUqzYiz1fZD8 8vBYbQQWAXOY2+eATrL+NwKEg6PtXLrBd1EqRyqk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Andrew Halaney , Douglas Anderson , Brian Masney , Mark Brown , Sasha Levin Subject: [PATCH 5.10 38/79] regulator: core: Clean up on enable failure Date: Tue, 13 Sep 2022 16:04:43 +0200 Message-Id: <20220913140352.137838160@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Andrew Halaney [ Upstream commit c32f1ebfd26bece77141257864ed7b4720da1557 ] If regulator_enable() fails, enable_count is incremented still. A consumer, assuming no matching regulator_disable() is necessary on failure, will then get this error message upon regulator_put() since enable_count is non-zero: [ 1.277418] WARNING: CPU: 3 PID: 1 at drivers/regulator/core.c:2304 = _regulator_put.part.0+0x168/0x170 The consumer could try to fix this in their driver by cleaning up on error from regulator_enable() (i.e. call regulator_disable()), but that results in the following since regulator_enable() failed and didn't increment user_count: [ 1.258112] unbalanced disables for vreg_l17c [ 1.262606] WARNING: CPU: 4 PID: 1 at drivers/regulator/core.c:2899 = _regulator_disable+0xd4/0x190 Fix this by decrementing enable_count upon failure to enable. With this in place, just the reason for failure to enable is printed as expected and developers can focus on the root cause of their issue instead of thinking their usage of the regulator consumer api is incorrect. For example, in my case: [ 1.240426] vreg_l17c: invalid input voltage found Fixes: 5451781dadf8 ("regulator: core: Only count load for enabled consumer= s") Signed-off-by: Andrew Halaney Reviewed-by: Douglas Anderson Reviewed-by: Brian Masney Link: https://lore.kernel.org/r/20220819194336.382740-1-ahalaney@redhat.com Signed-off-by: Mark Brown Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/regulator/core.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c index 6e3f3511e7ddd..317d701487ecd 100644 --- a/drivers/regulator/core.c +++ b/drivers/regulator/core.c @@ -2596,13 +2596,18 @@ static int _regulator_do_enable(struct regulator_de= v *rdev) */ static int _regulator_handle_consumer_enable(struct regulator *regulator) { + int ret; struct regulator_dev *rdev =3D regulator->rdev; =20 lockdep_assert_held_once(&rdev->mutex.base); =20 regulator->enable_count++; - if (regulator->uA_load && regulator->enable_count =3D=3D 1) - return drms_uA_update(rdev); + if (regulator->uA_load && regulator->enable_count =3D=3D 1) { + ret =3D drms_uA_update(rdev); + if (ret) + regulator->enable_count--; + return ret; + } =20 return 0; } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 875D8C54EE9 for ; Tue, 13 Sep 2022 14:46:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232285AbiIMOqR (ORCPT ); Tue, 13 Sep 2022 10:46:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40834 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234448AbiIMOng (ORCPT ); Tue, 13 Sep 2022 10:43:36 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 40B3E6E88D; Tue, 13 Sep 2022 07:23:09 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 9BD55B80F98; Tue, 13 Sep 2022 14:23:08 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1997FC4347C; Tue, 13 Sep 2022 14:23:06 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078987; bh=7tnHMHAvB6M6JQRu1ixEhd0G1OkiuztOMfKoitV/3kQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=JZsB5IjqkuXzAZD5YgAxg1vPlhwMs9npealYFMtZmrk1niDnVUykYU6L+qPDxx8jQ VyfQwFFEZBMHep/ReuGTlk2jmowtlSlTUCNF319i/ssaz3EEeXgP5MBLWHtTCeGMBV hCHWQOGMeppm5GBA73C1SgETlPowstG0DkYrd3Xo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Sumit Garg , kernel test robot , Jens Wiklander , Sasha Levin Subject: [PATCH 5.10 39/79] tee: fix compiler warning in tee_shm_register() Date: Tue, 13 Sep 2022 16:04:44 +0200 Message-Id: <20220913140352.179556183@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Jens Wiklander [ Upstream commit eccd7439709810127563e7e3e49b8b44c7b2791d ] Include to avoid the warning: drivers/tee/tee_shm.c: In function 'tee_shm_register': >> drivers/tee/tee_shm.c:242:14: error: implicit declaration of function 'a= ccess_ok' [-Werror=3Dimplicit-function-declaration] 242 | if (!access_ok((void __user *)addr, length)) | ^~~~~~~~~ cc1: some warnings being treated as errors Fixes: 573ae4f13f63 ("tee: add overflow check in register_shm_helper()") Reviewed-by: Sumit Garg Reported-by: kernel test robot Signed-off-by: Jens Wiklander Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/tee/tee_shm.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c index 499fccba3d74b..6fb4400333fb4 100644 --- a/drivers/tee/tee_shm.c +++ b/drivers/tee/tee_shm.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include "tee_private.h" =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BE388C6FA89 for ; Tue, 13 Sep 2022 14:46:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230253AbiIMOq0 (ORCPT ); Tue, 13 Sep 2022 10:46:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37344 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234485AbiIMOnk (ORCPT ); Tue, 13 Sep 2022 10:43:40 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E0D025FF61; Tue, 13 Sep 2022 07:23:11 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4718EB80F01; Tue, 13 Sep 2022 14:23:11 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 86792C433D6; Tue, 13 Sep 2022 14:23:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078989; bh=MwsHQc3uWoUbyndXOnzRD7slKc7OkYglxxOZJ8zhHts=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=H8pmpOP1fG2wlcA+gFLm3CX/Hnqh1dEhFiKkuco/00xoqdE/INvVrRZmvLGAXBBK2 943BMXciyzcDOMFTqVp25yTed0jIjlokuEi4dB+F+aORwyFsdULjyPDSMlzt1CF5X8 956/yyI950MObuRYU2paYPHg30PL5G5cU3dfC/PI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michael Guralnik , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 40/79] RDMA/cma: Fix arguments order in net device validation Date: Tue, 13 Sep 2022 16:04:45 +0200 Message-Id: <20220913140352.236013769@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michael Guralnik [ Upstream commit 27cfde795a96aef1e859a5480489944b95421e46 ] Fix the order of source and destination addresses when resolving the route between server and client to validate use of correct net device. The reverse order we had so far didn't actually validate the net device as the server would try to resolve the route to itself, thus always getting the server's net device. The issue was discovered when running cm applications on a single host between 2 interfaces with same subnet and source based routing rules. When resolving the reverse route the source based route rules were ignored. Fixes: f887f2ac87c2 ("IB/cma: Validate routing of incoming requests") Link: https://lore.kernel.org/r/1c1ec2277a131d277ebcceec987fd338d35b775f.16= 61251872.git.leonro@nvidia.com Signed-off-by: Michael Guralnik Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/infiniband/core/cma.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c index 3c40aa50cd60c..b5fa19a033c0a 100644 --- a/drivers/infiniband/core/cma.c +++ b/drivers/infiniband/core/cma.c @@ -1722,8 +1722,8 @@ cma_ib_id_from_event(struct ib_cm_id *cm_id, } =20 if (!validate_net_dev(*net_dev, - (struct sockaddr *)&req->listen_addr_storage, - (struct sockaddr *)&req->src_addr_storage)) { + (struct sockaddr *)&req->src_addr_storage, + (struct sockaddr *)&req->listen_addr_storage)) { id_priv =3D ERR_PTR(-EHOSTUNREACH); goto err; } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F4002C6FA82 for ; Tue, 13 Sep 2022 14:46:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231863AbiIMOqB (ORCPT ); Tue, 13 Sep 2022 10:46:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60974 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234366AbiIMOnc (ORCPT ); Tue, 13 Sep 2022 10:43:32 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CDB5D6E8A2; Tue, 13 Sep 2022 07:23:14 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id BCCADB80F99; Tue, 13 Sep 2022 14:23:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2387BC433C1; Tue, 13 Sep 2022 14:23:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078992; bh=/kK+PK1CTeymdSj7Q7fco8uU/odJSlu1OgbFvwydZNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=F7vMJgP6N1fAIYYMKUS4RtBZG5u7nb0viN+6gx8uq+6ToKMh909JujCrpnyH/Q42Z chua2xMGt4riK5hg/1wC5eHgftDetlD3iodeeWO/IaELjShMrs3Cr6dy/gDh5q6SeK pV9ktYhWVrYw70gPSe9sXcaTkVQtQrY/d8bf661c= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Liang He , Florian Fainelli , Sasha Levin Subject: [PATCH 5.10 41/79] soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs Date: Tue, 13 Sep 2022 16:04:46 +0200 Message-Id: <20220913140352.277554990@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Liang He [ Upstream commit 1085f5080647f0c9f357c270a537869191f7f2a1 ] In brcmstb_pm_probe(), there are two kinds of leak bugs: (1) we need to add of_node_put() when for_each__matching_node() breaks (2) we need to add iounmap() for each iomap in fail path Fixes: 0b741b8234c8 ("soc: bcm: brcmstb: Add support for S2/S3/S5 suspend s= tates (ARM)") Signed-off-by: Liang He Link: https://lore.kernel.org/r/20220707015620.306468-1-windhl@126.com Signed-off-by: Florian Fainelli Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/soc/bcm/brcmstb/pm/pm-arm.c | 50 ++++++++++++++++++++++------- 1 file changed, 39 insertions(+), 11 deletions(-) diff --git a/drivers/soc/bcm/brcmstb/pm/pm-arm.c b/drivers/soc/bcm/brcmstb/= pm/pm-arm.c index c6ec7d95bcfcc..722fd54e537cf 100644 --- a/drivers/soc/bcm/brcmstb/pm/pm-arm.c +++ b/drivers/soc/bcm/brcmstb/pm/pm-arm.c @@ -681,13 +681,14 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) const struct of_device_id *of_id =3D NULL; struct device_node *dn; void __iomem *base; - int ret, i; + int ret, i, s; =20 /* AON ctrl registers */ base =3D brcmstb_ioremap_match(aon_ctrl_dt_ids, 0, NULL); if (IS_ERR(base)) { pr_err("error mapping AON_CTRL\n"); - return PTR_ERR(base); + ret =3D PTR_ERR(base); + goto aon_err; } ctrl.aon_ctrl_base =3D base; =20 @@ -697,8 +698,10 @@ static int brcmstb_pm_probe(struct platform_device *pd= ev) /* Assume standard offset */ ctrl.aon_sram =3D ctrl.aon_ctrl_base + AON_CTRL_SYSTEM_DATA_RAM_OFS; + s =3D 0; } else { ctrl.aon_sram =3D base; + s =3D 1; } =20 writel_relaxed(0, ctrl.aon_sram + AON_REG_PANIC); @@ -708,7 +711,8 @@ static int brcmstb_pm_probe(struct platform_device *pde= v) (const void **)&ddr_phy_data); if (IS_ERR(base)) { pr_err("error mapping DDR PHY\n"); - return PTR_ERR(base); + ret =3D PTR_ERR(base); + goto ddr_phy_err; } ctrl.support_warm_boot =3D ddr_phy_data->supports_warm_boot; ctrl.pll_status_offset =3D ddr_phy_data->pll_status_offset; @@ -728,17 +732,20 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) for_each_matching_node(dn, ddr_shimphy_dt_ids) { i =3D ctrl.num_memc; if (i >=3D MAX_NUM_MEMC) { + of_node_put(dn); pr_warn("too many MEMCs (max %d)\n", MAX_NUM_MEMC); break; } =20 base =3D of_io_request_and_map(dn, 0, dn->full_name); if (IS_ERR(base)) { + of_node_put(dn); if (!ctrl.support_warm_boot) break; =20 pr_err("error mapping DDR SHIMPHY %d\n", i); - return PTR_ERR(base); + ret =3D PTR_ERR(base); + goto ddr_shimphy_err; } ctrl.memcs[i].ddr_shimphy_base =3D base; ctrl.num_memc++; @@ -749,14 +756,18 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) for_each_matching_node(dn, brcmstb_memc_of_match) { base =3D of_iomap(dn, 0); if (!base) { + of_node_put(dn); pr_err("error mapping DDR Sequencer %d\n", i); - return -ENOMEM; + ret =3D -ENOMEM; + goto brcmstb_memc_err; } =20 of_id =3D of_match_node(brcmstb_memc_of_match, dn); if (!of_id) { iounmap(base); - return -EINVAL; + of_node_put(dn); + ret =3D -EINVAL; + goto brcmstb_memc_err; } =20 ddr_seq_data =3D of_id->data; @@ -776,21 +787,24 @@ static int brcmstb_pm_probe(struct platform_device *p= dev) dn =3D of_find_matching_node(NULL, sram_dt_ids); if (!dn) { pr_err("SRAM not found\n"); - return -EINVAL; + ret =3D -EINVAL; + goto brcmstb_memc_err; } =20 ret =3D brcmstb_init_sram(dn); of_node_put(dn); if (ret) { pr_err("error setting up SRAM for PM\n"); - return ret; + goto brcmstb_memc_err; } =20 ctrl.pdev =3D pdev; =20 ctrl.s3_params =3D kmalloc(sizeof(*ctrl.s3_params), GFP_KERNEL); - if (!ctrl.s3_params) - return -ENOMEM; + if (!ctrl.s3_params) { + ret =3D -ENOMEM; + goto s3_params_err; + } ctrl.s3_params_pa =3D dma_map_single(&pdev->dev, ctrl.s3_params, sizeof(*ctrl.s3_params), DMA_TO_DEVICE); @@ -810,7 +824,21 @@ static int brcmstb_pm_probe(struct platform_device *pd= ev) =20 out: kfree(ctrl.s3_params); - +s3_params_err: + iounmap(ctrl.boot_sram); +brcmstb_memc_err: + for (i--; i >=3D 0; i--) + iounmap(ctrl.memcs[i].ddr_ctrl); +ddr_shimphy_err: + for (i =3D 0; i < ctrl.num_memc; i++) + iounmap(ctrl.memcs[i].ddr_shimphy_base); + + iounmap(ctrl.memcs[0].ddr_phy_base); +ddr_phy_err: + iounmap(ctrl.aon_ctrl_base); + if (s) + iounmap(ctrl.aon_sram); +aon_err: pr_warn("PM: initialization failed with code %d\n", ret); =20 return ret; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82043C6FA82 for ; Tue, 13 Sep 2022 14:46:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229768AbiIMOqd (ORCPT ); Tue, 13 Sep 2022 10:46:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60100 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234495AbiIMOnl (ORCPT ); Tue, 13 Sep 2022 10:43:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 08CC36EF29; Tue, 13 Sep 2022 07:23:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 70956B80F97; Tue, 13 Sep 2022 14:23:16 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id BF551C433D6; Tue, 13 Sep 2022 14:23:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078995; bh=j90Uc8ZsfXepqIyM6WV/PLdAbU0hv1dUaJEvYkRqv3U=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fi8cKhOIUemtJr0py/VlsBHftQnKxNad83bGELj9nkr/WydT+6LgXbVrkCidGG+RH LxXSPyjUlgF9EWI+yLtL8h91sKVcm/rFbdl58AhtQu14tX9AP+j4YUMT91LpG2gqa0 1EuVEbp69x12Yy16IiCxigs7zWK2RrXeWtcdhd6k= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chengchang Tang , Wenpeng Liang , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 42/79] RDMA/hns: Fix supported page size Date: Tue, 13 Sep 2022 16:04:47 +0200 Message-Id: <20220913140352.328257156@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chengchang Tang [ Upstream commit 55af9d498556f0860eb89ffa7677e8d73f6f643f ] The supported page size for hns is (4K, 128M), not (4K, 2G). Fixes: cfc85f3e4b7f ("RDMA/hns: Add profile support for hip08 driver") Link: https://lore.kernel.org/r/20220829105021.1427804-2-liangwenpeng@huawe= i.com Signed-off-by: Chengchang Tang Signed-off-by: Wenpeng Liang Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniban= d/hw/hns/hns_roce_hw_v2.h index be7f2fe1e8839..8a92faeb3d237 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -92,7 +92,7 @@ =20 #define HNS_ROCE_V2_QPC_TIMER_ENTRY_SZ PAGE_SIZE #define HNS_ROCE_V2_CQC_TIMER_ENTRY_SZ PAGE_SIZE -#define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFFF000 +#define HNS_ROCE_V2_PAGE_SIZE_SUPPORTED 0xFFFF000 #define HNS_ROCE_V2_MAX_INNER_MTPT_NUM 2 #define HNS_ROCE_INVALID_LKEY 0x100 #define HNS_ROCE_CMQ_TX_TIMEOUT 30000 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F358C6FA82 for ; Tue, 13 Sep 2022 15:15:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235740AbiIMPPt (ORCPT ); Tue, 13 Sep 2022 11:15:49 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:49972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235678AbiIMPNa (ORCPT ); Tue, 13 Sep 2022 11:13:30 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1D9CB6A4AA; Tue, 13 Sep 2022 07:32:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 33039614C5; Tue, 13 Sep 2022 14:23:18 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4E581C433D7; Tue, 13 Sep 2022 14:23:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663078997; bh=F4/WLsRyy07YolkegJmcY9GWhvPc3z+yHZ+ideYcFvY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=NJbIIWFG4ojJ2w1clOMrEal8G+tHRvtFBkLHV5kJKdzKNQifD0ZTEh2hkFQKMBq8a cJWFvgoqtzuFnhhRvl3ykf/6jzNQCDnrKssoM1JSh4Ndc9fDHb3n41EOLG0inDAfi9 /yuBnSy8ETaGxmdPL20TbRDbCQUSjeOQETRkHgFg= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Wenpeng Liang , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 43/79] RDMA/hns: Fix wrong fixed value of qp->rq.wqe_shift Date: Tue, 13 Sep 2022 16:04:48 +0200 Message-Id: <20220913140352.369810620@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Wenpeng Liang [ Upstream commit 0c8b5d6268d92d141bfd64d21c870d295a84dee1 ] The value of qp->rq.wqe_shift of HIP08 is always determined by the number of sge. So delete the wrong branch. Fixes: cfc85f3e4b7f ("RDMA/hns: Add profile support for hip08 driver") Fixes: 926a01dc000d ("RDMA/hns: Add QP operations support for hip08 SoC") Link: https://lore.kernel.org/r/20220829105021.1427804-3-liangwenpeng@huawe= i.com Signed-off-by: Wenpeng Liang Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/hns/hns_roce_qp.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/h= w/hns/hns_roce_qp.c index 291e06d631505..6fe98af7741b5 100644 --- a/drivers/infiniband/hw/hns/hns_roce_qp.c +++ b/drivers/infiniband/hw/hns/hns_roce_qp.c @@ -386,11 +386,8 @@ static int set_rq_size(struct hns_roce_dev *hr_dev, st= ruct ib_qp_cap *cap, =20 hr_qp->rq.max_gs =3D roundup_pow_of_two(max(1U, cap->max_recv_sge)); =20 - if (hr_dev->caps.max_rq_sg <=3D HNS_ROCE_SGE_IN_WQE) - hr_qp->rq.wqe_shift =3D ilog2(hr_dev->caps.max_rq_desc_sz); - else - hr_qp->rq.wqe_shift =3D ilog2(hr_dev->caps.max_rq_desc_sz * - hr_qp->rq.max_gs); + hr_qp->rq.wqe_shift =3D ilog2(hr_dev->caps.max_rq_desc_sz * + hr_qp->rq.max_gs); =20 hr_qp->rq.wqe_cnt =3D cnt; if (hr_dev->caps.flags & HNS_ROCE_CAP_FLAG_RQ_INLINE) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C26EAC6FA82 for ; Tue, 13 Sep 2022 14:46:55 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231651AbiIMOqw (ORCPT ); Tue, 13 Sep 2022 10:46:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234550AbiIMOn4 (ORCPT ); Tue, 13 Sep 2022 10:43:56 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0FEEC6EF08; Tue, 13 Sep 2022 07:23:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B626A614AE; Tue, 13 Sep 2022 14:23:20 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C878FC433B5; Tue, 13 Sep 2022 14:23:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079000; bh=GXHCHdpxzsXoM8VvLKFzn6OMvfLVUZPJ9IDWiBJLpbU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xaxIiWGr1kvvshAMX94Sx+c/mrSUqchHe6h6w0LNIpDDxubCrGyLieb8jt79/qAdJ DAYtoLmzVMVt9uMFktlr2SxoK4PduPgEYOS3gTvI8+AiefvAZk+AmrMZHNsMQ3sd+V xC9I/mhhsdFTnQNkqmZr+3g0xIyCdyYgqpnwUYII= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Claudiu Beznea , Sasha Levin Subject: [PATCH 5.10 44/79] ARM: dts: at91: sama5d27_wlsom1: specify proper regulator output ranges Date: Tue, 13 Sep 2022 16:04:49 +0200 Message-Id: <20220913140352.411086410@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Claudiu Beznea [ Upstream commit addf7efec23af2b67547800aa232d551945e7de2 ] Min and max output ranges of regulators need to satisfy board requirements not PMIC requirements. Thus adjust device tree to cope with this. Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 = and wlsom1-ek") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-5-claudiu.beznea@mic= rochip.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi b/arch/arm/boot/dt= s/at91-sama5d27_wlsom1.dtsi index a06700e53e4c3..7f16d62bb1a1a 100644 --- a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi +++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi @@ -62,8 +62,8 @@ regulators { vdd_3v3: VDD_IO { regulator-name =3D "VDD_IO"; - regulator-min-microvolt =3D <1200000>; - regulator-max-microvolt =3D <3700000>; + regulator-min-microvolt =3D <3300000>; + regulator-max-microvolt =3D <3300000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; regulator-always-on; @@ -81,8 +81,8 @@ =20 vddio_ddr: VDD_DDR { regulator-name =3D "VDD_DDR"; - regulator-min-microvolt =3D <600000>; - regulator-max-microvolt =3D <1850000>; + regulator-min-microvolt =3D <1200000>; + regulator-max-microvolt =3D <1200000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; regulator-always-on; @@ -104,8 +104,8 @@ =20 vdd_core: VDD_CORE { regulator-name =3D "VDD_CORE"; - regulator-min-microvolt =3D <600000>; - regulator-max-microvolt =3D <1850000>; + regulator-min-microvolt =3D <1250000>; + regulator-max-microvolt =3D <1250000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; regulator-always-on; @@ -146,8 +146,8 @@ =20 LDO1 { regulator-name =3D "LDO1"; - regulator-min-microvolt =3D <1200000>; - regulator-max-microvolt =3D <3700000>; + regulator-min-microvolt =3D <3300000>; + regulator-max-microvolt =3D <3300000>; regulator-always-on; =20 regulator-state-standby { @@ -161,8 +161,8 @@ =20 LDO2 { regulator-name =3D "LDO2"; - regulator-min-microvolt =3D <1200000>; - regulator-max-microvolt =3D <3700000>; + regulator-min-microvolt =3D <1800000>; + regulator-max-microvolt =3D <3300000>; regulator-always-on; =20 regulator-state-standby { --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 55FB5C6FA82 for ; Tue, 13 Sep 2022 14:52:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232624AbiIMOwk (ORCPT ); Tue, 13 Sep 2022 10:52:40 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56790 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234622AbiIMOtO (ORCPT ); Tue, 13 Sep 2022 10:49:14 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B38F271731; Tue, 13 Sep 2022 07:25:45 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 67A00B80F01; Tue, 13 Sep 2022 14:23:26 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D1660C433D6; Tue, 13 Sep 2022 14:23:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079005; bh=T6QlA8O4wJlQeYmce8jk3//u7lHV+o+C1B+7XNO/ZBs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=j5zxUK5tGMfWM47YshA8H66exvncvr9EFPLi7NEu3WnOXFiHodrG9ragVoHxYkNKT zKduX4Vak6B3eLoGbLau1rx66F/LDimCEZrfkCqn7fS6NBHe1Pq/twkCqB/i+Ytk0I XoDWqM/SlEqIhosiomMs/L9Ut0Qw+AmQwN8t+sUU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Claudiu Beznea , Sasha Levin Subject: [PATCH 5.10 45/79] ARM: dts: at91: sama5d2_icp: specify proper regulator output ranges Date: Tue, 13 Sep 2022 16:04:50 +0200 Message-Id: <20220913140352.453118503@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Claudiu Beznea [ Upstream commit 7737d93666eea282febf95e5fa3b3fde1f2549f3 ] Min and max output ranges of regulators need to satisfy board requirements not PMIC requirements. Thus adjust device tree to cope with this. Fixes: 68a95ef72cef ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-6-claudiu.beznea@mic= rochip.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/at91-sama5d2_icp.dts | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at9= 1-sama5d2_icp.dts index 634411d13b4aa..9fbcd107d1afb 100644 --- a/arch/arm/boot/dts/at91-sama5d2_icp.dts +++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts @@ -195,8 +195,8 @@ regulators { vdd_io_reg: VDD_IO { regulator-name =3D "VDD_IO"; - regulator-min-microvolt =3D <1200000>; - regulator-max-microvolt =3D <3700000>; + regulator-min-microvolt =3D <3300000>; + regulator-max-microvolt =3D <3300000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; regulator-always-on; @@ -214,8 +214,8 @@ =20 VDD_DDR { regulator-name =3D "VDD_DDR"; - regulator-min-microvolt =3D <600000>; - regulator-max-microvolt =3D <1850000>; + regulator-min-microvolt =3D <1350000>; + regulator-max-microvolt =3D <1350000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; regulator-always-on; @@ -233,8 +233,8 @@ =20 VDD_CORE { regulator-name =3D "VDD_CORE"; - regulator-min-microvolt =3D <600000>; - regulator-max-microvolt =3D <1850000>; + regulator-min-microvolt =3D <1250000>; + regulator-max-microvolt =3D <1250000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; regulator-always-on; @@ -271,8 +271,8 @@ =20 LDO1 { regulator-name =3D "LDO1"; - regulator-min-microvolt =3D <1200000>; - regulator-max-microvolt =3D <3700000>; + regulator-min-microvolt =3D <2500000>; + regulator-max-microvolt =3D <2500000>; regulator-always-on; =20 regulator-state-standby { @@ -286,8 +286,8 @@ =20 LDO2 { regulator-name =3D "LDO2"; - regulator-min-microvolt =3D <1200000>; - regulator-max-microvolt =3D <3700000>; + regulator-min-microvolt =3D <3300000>; + regulator-max-microvolt =3D <3300000>; regulator-always-on; =20 regulator-state-standby { --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A46AAC54EE9 for ; Tue, 13 Sep 2022 14:52:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234508AbiIMOw1 (ORCPT ); Tue, 13 Sep 2022 10:52:27 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34712 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234600AbiIMOtL (ORCPT ); Tue, 13 Sep 2022 10:49:11 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A1DEB6FA10; Tue, 13 Sep 2022 07:25:25 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 08827B80F91; Tue, 13 Sep 2022 14:23:29 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6581AC433C1; Tue, 13 Sep 2022 14:23:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079007; bh=+HVORsy337V9mir6s9za8/AEFMn638feo84QoH02W9A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=dM+uXAhAKsF8ZhWfRqGxvUv5r9O4c/yFgetXAZcxGRGg6pPN9vLyER/49QKqfswog YxNZkXTG9i4zKy4eNv4Qb6VAfSO9Uqb9K0W7oL6xJttV76GU426wOd7Wji/RETmnRF bKc404MYuCNT40UEcSn8EBW6IIVzDg4jO48Tk+XQ= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Claudiu Beznea , Sasha Levin Subject: [PATCH 5.10 46/79] ARM: dts: at91: sama5d27_wlsom1: dont keep ldo2 enabled all the time Date: Tue, 13 Sep 2022 16:04:51 +0200 Message-Id: <20220913140352.495071729@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Claudiu Beznea [ Upstream commit 617a0d9fe6867bf5b3b7272629cd780c27c877d9 ] ldo2 is not used by any consumer on sama5d27_wlsom1 board, thus don't keep it enabled all the time. Fixes: 5d4c3cfb63fe ("ARM: dts: at91: sama5d27_wlsom1: add SAMA5D27 wlsom1 = and wlsom1-ek") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-8-claudiu.beznea@mic= rochip.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi b/arch/arm/boot/dt= s/at91-sama5d27_wlsom1.dtsi index 7f16d62bb1a1a..9c8b3eb49ea30 100644 --- a/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi +++ b/arch/arm/boot/dts/at91-sama5d27_wlsom1.dtsi @@ -163,7 +163,6 @@ regulator-name =3D "LDO2"; regulator-min-microvolt =3D <1800000>; regulator-max-microvolt =3D <3300000>; - regulator-always-on; =20 regulator-state-standby { regulator-on-in-suspend; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E972AC6FA82 for ; Tue, 13 Sep 2022 14:49:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230383AbiIMOtl (ORCPT ); Tue, 13 Sep 2022 10:49:41 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46704 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233171AbiIMOr1 (ORCPT ); Tue, 13 Sep 2022 10:47:27 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4ED9D1261A; Tue, 13 Sep 2022 07:24:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id F2BC0614C1; Tue, 13 Sep 2022 14:23:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 076CCC433C1; Tue, 13 Sep 2022 14:23:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079010; bh=wO9RjbU6KDzFYVnAQsZULHB+i/4zxZ8hL2n3irCY6s0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=LE+oYfQ4W5GLdCcR/0TnFa+RI36IRp8k0mY++I3G9rkrunZJpig7NvlSMPG5MuQ7q Mn4u7boV5qByeQdPlsGuhwjWz3xEle0LkOplYnpZpdtoLItJwq7R72TVy1WiChvs/Z HFkss29D4JzBSq2b8+L8bO3qCgRXW9xK8m1IVwo0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Claudiu Beznea , Sasha Levin Subject: [PATCH 5.10 47/79] ARM: dts: at91: sama5d2_icp: dont keep vdd_other enabled all the time Date: Tue, 13 Sep 2022 16:04:52 +0200 Message-Id: <20220913140352.537379319@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Claudiu Beznea [ Upstream commit 3d074b750d2b4c91962f10ea1df1c289ce0d3ce8 ] VDD_OTHER is not connected to any on board consumer thus it is not needed to keep it enabled all the time. Fixes: 68a95ef72cef ("ARM: dts: at91: sama5d2-icp: add SAMA5D2-ICP") Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220826083927.3107272-9-claudiu.beznea@mic= rochip.com Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/arm/boot/dts/at91-sama5d2_icp.dts | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/arm/boot/dts/at91-sama5d2_icp.dts b/arch/arm/boot/dts/at9= 1-sama5d2_icp.dts index 9fbcd107d1afb..00b9e88ff5451 100644 --- a/arch/arm/boot/dts/at91-sama5d2_icp.dts +++ b/arch/arm/boot/dts/at91-sama5d2_icp.dts @@ -256,7 +256,6 @@ regulator-max-microvolt =3D <1850000>; regulator-initial-mode =3D <2>; regulator-allowed-modes =3D <2>, <4>; - regulator-always-on; =20 regulator-state-standby { regulator-on-in-suspend; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 48B34C54EE9 for ; Tue, 13 Sep 2022 14:52:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234734AbiIMOwQ (ORCPT ); Tue, 13 Sep 2022 10:52:16 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34600 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234585AbiIMOtJ (ORCPT ); Tue, 13 Sep 2022 10:49:09 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D708070E5E; Tue, 13 Sep 2022 07:25:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8C5B5614B0; Tue, 13 Sep 2022 14:23:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A341AC433C1; Tue, 13 Sep 2022 14:23:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079013; bh=XfoVHhO2KwoVqCnflZpVxrBPhafIjjfzPTnfE+4PjpE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D9z/j6/MN8qA+dcTH65z+k7ekzeQse0fi+B6kVCCnEKhOEdD8R+fq/9esOs4gEn5I UIBsBN/HLp7sTmgYlBty5YJfA3pQ0fyVsy46/asUwWHnRP/fgT9NRGRYjcSWW7uNAx qnappy6CDeuKHB8QwtbT/d99LFwj85R36tS101so= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Harsh Modi , Florian Westphal , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.10 48/79] netfilter: br_netfilter: Drop dst references before setting. Date: Tue, 13 Sep 2022 16:04:53 +0200 Message-Id: <20220913140352.580765780@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Harsh Modi [ Upstream commit d047283a7034140ea5da759a494fd2274affdd46 ] The IPv6 path already drops dst in the daddr changed case, but the IPv4 path does not. This change makes the two code paths consistent. Further, it is possible that there is already a metadata_dst allocated from ingress that might already be attached to skbuff->dst while following the bridge path. If it is not released before setting a new metadata_dst, it will be leaked. This is similar to what is done in bpf_set_tunnel_key() or ip6_route_input(). It is important to note that the memory being leaked is not the dst being set in the bridge code, but rather memory allocated from some other code path that is not being freed correctly before the skb dst is overwritten. An example of the leakage fixed by this commit found using kmemleak: unreferenced object 0xffff888010112b00 (size 256): comm "softirq", pid 0, jiffies 4294762496 (age 32.012s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 80 16 f1 83 ff ff ff ff ................ e1 4e f6 82 ff ff ff ff 00 00 00 00 00 00 00 00 .N.............. backtrace: [<00000000d79567ea>] metadata_dst_alloc+0x1b/0xe0 [<00000000be113e13>] udp_tun_rx_dst+0x174/0x1f0 [<00000000a36848f4>] geneve_udp_encap_recv+0x350/0x7b0 [<00000000d4afb476>] udp_queue_rcv_one_skb+0x380/0x560 [<00000000ac064aea>] udp_unicast_rcv_skb+0x75/0x90 [<000000009a8ee8c5>] ip_protocol_deliver_rcu+0xd8/0x230 [<00000000ef4980bb>] ip_local_deliver_finish+0x7a/0xa0 [<00000000d7533c8c>] __netif_receive_skb_one_core+0x89/0xa0 [<00000000a879497d>] process_backlog+0x93/0x190 [<00000000e41ade9f>] __napi_poll+0x28/0x170 [<00000000b4c0906b>] net_rx_action+0x14f/0x2a0 [<00000000b20dd5d4>] __do_softirq+0xf4/0x305 [<000000003a7d7e15>] __irq_exit_rcu+0xc3/0x140 [<00000000968d39a2>] sysvec_apic_timer_interrupt+0x9e/0xc0 [<000000009e920794>] asm_sysvec_apic_timer_interrupt+0x16/0x20 [<000000008942add0>] native_safe_halt+0x13/0x20 Florian Westphal says: "Original code was likely fine because nothing ever did set a skb->dst entry earlier than bridge in those days." Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Harsh Modi Acked-by: Florian Westphal Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/bridge/br_netfilter_hooks.c | 2 ++ net/bridge/br_netfilter_ipv6.c | 1 + 2 files changed, 3 insertions(+) diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hook= s.c index 10a2c7bca7199..a718204c4bfdd 100644 --- a/net/bridge/br_netfilter_hooks.c +++ b/net/bridge/br_netfilter_hooks.c @@ -384,6 +384,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ /* - Bridged-and-DNAT'ed traffic doesn't * require ip_forwarding. */ if (rt->dst.dev =3D=3D dev) { + skb_dst_drop(skb); skb_dst_set(skb, &rt->dst); goto bridged_dnat; } @@ -413,6 +414,7 @@ static int br_nf_pre_routing_finish(struct net *net, st= ruct sock *sk, struct sk_ kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 diff --git a/net/bridge/br_netfilter_ipv6.c b/net/bridge/br_netfilter_ipv6.c index e4e0c836c3f51..6b07f30675bb0 100644 --- a/net/bridge/br_netfilter_ipv6.c +++ b/net/bridge/br_netfilter_ipv6.c @@ -197,6 +197,7 @@ static int br_nf_pre_routing_finish_ipv6(struct net *ne= t, struct sock *sk, struc kfree_skb(skb); return 0; } + skb_dst_drop(skb); skb_dst_set_noref(skb, &rt->dst); } =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5781CC6FA82 for ; Tue, 13 Sep 2022 14:47:07 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231530AbiIMOrE (ORCPT ); Tue, 13 Sep 2022 10:47:04 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40530 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234565AbiIMOn7 (ORCPT ); Tue, 13 Sep 2022 10:43:59 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 90C496EF38; Tue, 13 Sep 2022 07:23:37 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DE504B80E22; Tue, 13 Sep 2022 14:23:36 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 482FEC433D6; Tue, 13 Sep 2022 14:23:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079015; bh=UI+gRuv3zcDmPY0ND7q4jXM2pRFR+veYZDyYtkFqn/Y=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pxk4xNudGlRlt5SiVD98GT4DrmEki2HvSHEsDc9j0K/SAvjt5m3P1tbHnQtwzKlCx bszeNT07iJERqyDdXpg7HbyUDtEj9uQXvaDgA/m5PaLnsiFR79c4Uk/lu5E/Ryyv9M SNNTpdodmkEoXoe466uRLApNQmKe39iI5sOZwDG8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, syzbot+5fcdbfab6d6744c57418@syzkaller.appspotmail.com, Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.10 49/79] netfilter: nf_tables: clean up hook list when offload flags check fails Date: Tue, 13 Sep 2022 16:04:54 +0200 Message-Id: <20220913140352.621056306@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Pablo Neira Ayuso [ Upstream commit 77972a36ecc4db7fc7c68f0e80714263c5f03f65 ] splice back the hook list so nft_chain_release_hook() has a chance to release the hooks. BUG: memory leak unreferenced object 0xffff88810180b100 (size 96): comm "syz-executor133", pid 3619, jiffies 4294945714 (age 12.690s) hex dump (first 32 bytes): 28 64 23 02 81 88 ff ff 28 64 23 02 81 88 ff ff (d#.....(d#..... 90 a8 aa 83 ff ff ff ff 00 00 b5 0f 81 88 ff ff ................ backtrace: [] kmalloc include/linux/slab.h:600 [inline] [] nft_netdev_hook_alloc+0x3b/0xc0 net/netfilter/nf_t= ables_api.c:1901 [] nft_chain_parse_netdev net/netfilter/nf_tables_api= .c:1998 [inline] [] nft_chain_parse_hook+0x33a/0x530 net/netfilter/nf_= tables_api.c:2073 [] nf_tables_addchain.constprop.0+0x10b/0x950 net/net= filter/nf_tables_api.c:2218 [] nf_tables_newchain+0xa8b/0xc60 net/netfilter/nf_ta= bles_api.c:2593 [] nfnetlink_rcv_batch+0xa46/0xd20 net/netfilter/nfne= tlink.c:517 [] nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:= 638 [inline] [] nfnetlink_rcv+0x1f9/0x220 net/netfilter/nfnetlink.= c:656 [] netlink_unicast_kernel net/netlink/af_netlink.c:13= 19 [inline] [] netlink_unicast+0x397/0x4c0 net/netlink/af_netlink= .c:1345 [] netlink_sendmsg+0x396/0x710 net/netlink/af_netlink= .c:1921 [] sock_sendmsg_nosec net/socket.c:714 [inline] [] sock_sendmsg+0x56/0x80 net/socket.c:734 [] ____sys_sendmsg+0x36c/0x390 net/socket.c:2482 [] ___sys_sendmsg+0xa8/0x110 net/socket.c:2536 [] __sys_sendmsg+0x88/0x100 net/socket.c:2565 [] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 [] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices pe= r netdev hook") Reported-by: syzbot+5fcdbfab6d6744c57418@syzkaller.appspotmail.com Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 1b039476e4d6a..b8e7e1c5c08a8 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -1971,8 +1971,10 @@ static int nft_basechain_init(struct nft_base_chain = *basechain, u8 family, chain->flags |=3D NFT_CHAIN_BASE | flags; basechain->policy =3D NF_ACCEPT; if (chain->flags & NFT_CHAIN_HW_OFFLOAD && - !nft_chain_offload_support(basechain)) + !nft_chain_offload_support(basechain)) { + list_splice_init(&basechain->hook_list, &hook->list); return -EOPNOTSUPP; + } =20 flow_block_init(&basechain->flow_block); =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id AED87C6FA89 for ; Tue, 13 Sep 2022 14:50:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234475AbiIMOu2 (ORCPT ); Tue, 13 Sep 2022 10:50:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46528 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231308AbiIMOsX (ORCPT ); Tue, 13 Sep 2022 10:48:23 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B50454C625; Tue, 13 Sep 2022 07:24:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 5C35AB80F6F; Tue, 13 Sep 2022 14:23:39 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B6197C433D6; Tue, 13 Sep 2022 14:23:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079018; bh=1jS7lZ4MEjDQmopBnisfmndMJSQPPn+ToR1lJO8xBUA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=pWogglnp+2e4AfNNY0qBL2qhS1X2o1GJCCKEIrluOoWWP5wbAMjlVbyJivcLcgzng aPmzd4bquG9mIr/Llr398+n+ZSzaB9z3sZzvfLuefLfnEYhTRLlq/4egtUHan0OW1m gXMDVNxFyu5bwWOz9lhukjk/HN+Ffp5VTtDWUgHI= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, David Leadbeater , Pablo Neira Ayuso , Sasha Levin Subject: [PATCH 5.10 50/79] netfilter: nf_conntrack_irc: Fix forged IP logic Date: Tue, 13 Sep 2022 16:04:55 +0200 Message-Id: <20220913140352.668535270@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Leadbeater [ Upstream commit 0efe125cfb99e6773a7434f3463f7c2fa28f3a43 ] Ensure the match happens in the right direction, previously the destination used was the server, not the NAT host, as the comment shows the code intended. Additionally nf_nat_irc uses port 0 as a signal and there's no valid way it can appear in a DCC message, so consider port 0 also forged. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port= ") Signed-off-by: David Leadbeater Signed-off-by: Pablo Neira Ayuso Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/netfilter/nf_conntrack_irc.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_= irc.c index e40988a2f22fb..26245419ef4a9 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -185,8 +185,9 @@ static int help(struct sk_buff *skb, unsigned int proto= ff, =20 /* dcc_ip can be the internal OR external (NAT'ed) IP */ tuple =3D &ct->tuplehash[dir].tuple; - if (tuple->src.u3.ip !=3D dcc_ip && - tuple->dst.u3.ip !=3D dcc_ip) { + if ((tuple->src.u3.ip !=3D dcc_ip && + ct->tuplehash[!dir].tuple.dst.u3.ip !=3D dcc_ip) || + dcc_port =3D=3D 0) { net_warn_ratelimited("Forged DCC command from %pI4: %pI4:%u\n", &tuple->src.u3.ip, &dcc_ip, dcc_port); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 312CBC6FA89 for ; Tue, 13 Sep 2022 14:55:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234752AbiIMOx6 (ORCPT ); Tue, 13 Sep 2022 10:53:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32954 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234716AbiIMOtb (ORCPT ); Tue, 13 Sep 2022 10:49:31 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B772671713; Tue, 13 Sep 2022 07:25:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id EBFF0614A1; Tue, 13 Sep 2022 14:23:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 111DFC433D6; Tue, 13 Sep 2022 14:23:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079020; bh=rOFZ/tyfp46rKkFDIEIxYIl8JuoXw4gA+39s6JhWeu4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=rQClm+720mrsm0Jtvnue2C3iToh7CXOPYZmkgGsB1b1QARi+63V/uvm2Fg2GoYbr3 oevF25S1hIevECrbQuDO8X3W6F1oeVuOJMA4iR6BClFHDzQv4Ca/ECbwTpAY28UpNu uzpBdPOgTfPU3EsIkA1Ov4nwkBN0CYVzB7UToZFU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 5.10 51/79] ALSA: usb-audio: Inform the delayed registration more properly Date: Tue, 13 Sep 2022 16:04:56 +0200 Message-Id: <20220913140352.710747355@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 7e1afce5866e02b45bf88c27dd7de1b9dfade1cc ] The info message that was added in the commit a4aad5636c72 ("ALSA: usb-audio: Inform devices that need delayed registration") is actually useful to know the need for the delayed registration. However, it turned out that this doesn't catch the all cases; namely, this warned only when a PCM stream is attached onto the existing PCM instance, but it doesn't count for a newly created PCM instance. This made confusion as if there were no further delayed registration. This patch moves the check to the code path for either adding a stream or creating a PCM instance. Also, make it simpler by checking the card->registered flag instead of querying each snd_device state. Fixes: a4aad5636c72 ("ALSA: usb-audio: Inform devices that need delayed reg= istration") Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216082 Link: https://lore.kernel.org/r/20220831125901.4660-1-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/usb/stream.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/sound/usb/stream.c b/sound/usb/stream.c index 7711184a0d0bf..c4f4585f9b851 100644 --- a/sound/usb/stream.c +++ b/sound/usb/stream.c @@ -496,6 +496,10 @@ static int __snd_usb_add_audio_stream(struct snd_usb_a= udio *chip, return 0; } } + + if (chip->card->registered) + chip->need_delayed_register =3D true; + /* look for an empty stream */ list_for_each_entry(as, &chip->pcm_list, list) { if (as->fmt_type !=3D fp->fmt_type) @@ -503,9 +507,6 @@ static int __snd_usb_add_audio_stream(struct snd_usb_au= dio *chip, subs =3D &as->substream[stream]; if (subs->ep_num) continue; - if (snd_device_get_state(chip->card, as->pcm) !=3D - SNDRV_DEV_BUILD) - chip->need_delayed_register =3D true; err =3D snd_pcm_new_stream(as->pcm, stream, 1); if (err < 0) return err; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01D07C54EE9 for ; Tue, 13 Sep 2022 14:51:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231642AbiIMOvK (ORCPT ); Tue, 13 Sep 2022 10:51:10 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234444AbiIMOsl (ORCPT ); Tue, 13 Sep 2022 10:48:41 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2FA76165A3; Tue, 13 Sep 2022 07:25:10 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 02C3BB80F1A; Tue, 13 Sep 2022 14:23:44 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6E46DC433C1; Tue, 13 Sep 2022 14:23:42 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079022; bh=LME2R6+LL8pgq5QfrvjxXGwzpNd8Zg0JxYGJD2SCv/c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=E7AkJezsSCRCzmu9WiIsCKpc4eoms67sGBm3N4PsGx1zLqEC119zX2R1y4oz3pycE 8+gtDkwNqqmJ30wLl+1lct+2Wvo3ZSX7LyXzdqZottH19oh3PRzLm3EAHHH6aen0r0 Q+aLEu44OgGgz5KjoLE32A5gqIdqusV0NhnoHrIc= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Takashi Iwai , Sasha Levin Subject: [PATCH 5.10 52/79] ALSA: usb-audio: Register card again for iface over delayed_register option Date: Tue, 13 Sep 2022 16:04:57 +0200 Message-Id: <20220913140352.753179190@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Takashi Iwai [ Upstream commit 2027f114686e0f3f1f39971964dfc618637c88c2 ] When the delayed registration is specified via either delayed_register option or the quirk, we delay the invocation of snd_card_register() until the given interface. But if a wrong value has been set there and there are more interfaces over the given interface number, snd_card_register() call would be missing for those interfaces. This patch catches up those missing calls by fixing the comparison of the interface number. Now the call is skipped only if the processed interface is less than the given interface, instead of the exact match. Fixes: b70038ef4fea ("ALSA: usb-audio: Add delayed_register option") Link: https://bugzilla.kernel.org/show_bug.cgi?id=3D216082 Link: https://lore.kernel.org/r/20220831125901.4660-2-tiwai@suse.de Signed-off-by: Takashi Iwai Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/usb/card.c | 2 +- sound/usb/quirks.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/sound/usb/card.c b/sound/usb/card.c index a3e06a71cf356..6b172db58a310 100644 --- a/sound/usb/card.c +++ b/sound/usb/card.c @@ -667,7 +667,7 @@ static bool check_delayed_register_option(struct snd_us= b_audio *chip, int iface) if (delayed_register[i] && sscanf(delayed_register[i], "%x:%x", &id, &inum) =3D=3D 2 && id =3D=3D chip->usb_id) - return inum !=3D iface; + return iface < inum; } =20 return false; diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c index 6333a2ecb848a..41f5d8242478f 100644 --- a/sound/usb/quirks.c +++ b/sound/usb/quirks.c @@ -1911,7 +1911,7 @@ bool snd_usb_registration_quirk(struct snd_usb_audio = *chip, int iface) =20 for (q =3D registration_quirks; q->usb_id; q++) if (chip->usb_id =3D=3D q->usb_id) - return iface !=3D q->interface; + return iface < q->interface; =20 /* Register as normal */ return false; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B18FC6FA82 for ; Tue, 13 Sep 2022 14:51:22 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234638AbiIMOvT (ORCPT ); Tue, 13 Sep 2022 10:51:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46380 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234477AbiIMOsq (ORCPT ); Tue, 13 Sep 2022 10:48:46 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 254574E871; Tue, 13 Sep 2022 07:25:16 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 18B0BB80F9E; Tue, 13 Sep 2022 14:25:13 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5FA9AC433D7; Tue, 13 Sep 2022 14:25:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079111; bh=rM5Kf/cPl4VUdONLEtw/0ycA4Hsu4Dx65GEYKH11jmI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SvQmNctgLld2F5mcy9p809yqVyEGqA7JIhoBAPqukbP7pw9ybp81/zoX5swKjbtJc U4Ozg3x4OWAiIwa7en3lWOvPltrQm6wOwjfCl3Pfh5ssWFgx27kusXjpfLE4MPZ+L6 ccbQEy/snyp5etxddRyAVAZTcmcY5Z7r4CmAVK2U= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Dionne , David Howells , linux-afs@lists.infradead.org, Sasha Levin Subject: [PATCH 5.10 53/79] rxrpc: Fix an insufficiently large sglist in rxkad_verify_packet_2() Date: Tue, 13 Sep 2022 16:04:58 +0200 Message-Id: <20220913140352.798703357@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Howells [ Upstream commit 0d40f728e28393a8817d1fcae923dfa3409e488c ] rxkad_verify_packet_2() has a small stack-allocated sglist of 4 elements, but if that isn't sufficient for the number of fragments in the socket buffer, we try to allocate an sglist large enough to hold all the fragments. However, for large packets with a lot of fragments, this isn't sufficient and we need at least one additional fragment. The problem manifests as skb_to_sgvec() returning -EMSGSIZE and this then getting returned by userspace. Most of the time, this isn't a problem as rxrpc sets a limit of 5692, big enough for 4 jumbo subpackets to be glued together; occasionally, however, the server will ignore the reported limit and give a packet that's a lot bigger - say 19852 bytes with ->nr_frags being 7. skb_to_sgvec() then tries to return a "zeroth" fragment that seems to occur before the fragments counted by ->nr_frags and we hit the end of the sglist too early. Note that __skb_to_sgvec() also has an skb_walk_frags() loop that is recursive up to 24 deep. I'm not sure if I need to take account of that too - or if there's an easy way of counting those frags too. Fix this by counting an extra frag and allocating a larger sglist based on that. Fixes: d0d5c0cd1e71 ("rxrpc: Use skb_unshare() rather than skb_cow_data()") Reported-by: Marc Dionne Signed-off-by: David Howells cc: linux-afs@lists.infradead.org Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/rxrpc/rxkad.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c index f114dc2af5cf3..5345e8eefd33c 100644 --- a/net/rxrpc/rxkad.c +++ b/net/rxrpc/rxkad.c @@ -451,7 +451,7 @@ static int rxkad_verify_packet_2(struct rxrpc_call *cal= l, struct sk_buff *skb, * directly into the target buffer. */ sg =3D _sg; - nsg =3D skb_shinfo(skb)->nr_frags; + nsg =3D skb_shinfo(skb)->nr_frags + 1; if (nsg <=3D 4) { nsg =3D 4; } else { --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2EADBC54EE9 for ; Tue, 13 Sep 2022 14:47:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232526AbiIMOrh (ORCPT ); Tue, 13 Sep 2022 10:47:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46544 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232304AbiIMOqR (ORCPT ); Tue, 13 Sep 2022 10:46:17 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1EDB66F252; Tue, 13 Sep 2022 07:24:20 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AEBC5614D1; Tue, 13 Sep 2022 14:24:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B7B6CC433C1; Tue, 13 Sep 2022 14:24:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079046; bh=y2qWzrFfahicfsBuM+hsEfMX5QUzq/PC38YkE8OGKNs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=thFs74gSQamn+fLx1+nmkD//rUIIGCAh4jwKOOCT8RTDte1KDBoLHJtV9Ycex6tlz qGkHaqxijHbZwL3tRPid8a2B0cEONukPWXYiCNiMLfUBvNvvmjaUnkJmyRoemrvY78 uWTC6M+52K/aKp9gFkJZyz4bshrp968lI9r8u+N4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jeffrey E Altman , David Howells , Sasha Levin Subject: [PATCH 5.10 54/79] afs: Use the operation issue time instead of the reply time for callbacks Date: Tue, 13 Sep 2022 16:04:59 +0200 Message-Id: <20220913140352.841720589@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Howells [ Upstream commit 7903192c4b4a82d792cb0dc5e2779a2efe60d45b ] rxrpc and kafs between them try to use the receive timestamp on the first data packet (ie. the one with sequence number 1) as a base from which to calculate the time at which callback promise and lock expiration occurs. However, we don't know how long it took for the server to send us the reply from it having completed the basic part of the operation - it might then, for instance, have to send a bunch of a callback breaks, depending on the particular operation. Fix this by using the time at which the operation is issued on the client as a base instead. That should never be longer than the server's idea of the expiry time. Fixes: 781070551c26 ("afs: Fix calculation of callback expiry time") Fixes: 2070a3e44962 ("rxrpc: Allow the reply time to be obtained on a clien= t call") Suggested-by: Jeffrey E Altman Signed-off-by: David Howells Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- fs/afs/flock.c | 2 +- fs/afs/fsclient.c | 2 +- fs/afs/internal.h | 3 +-- fs/afs/rxrpc.c | 7 +------ fs/afs/yfsclient.c | 3 +-- 5 files changed, 5 insertions(+), 12 deletions(-) diff --git a/fs/afs/flock.c b/fs/afs/flock.c index cb3054c7843ea..466ad609f2057 100644 --- a/fs/afs/flock.c +++ b/fs/afs/flock.c @@ -76,7 +76,7 @@ void afs_lock_op_done(struct afs_call *call) if (call->error =3D=3D 0) { spin_lock(&vnode->lock); trace_afs_flock_ev(vnode, NULL, afs_flock_timestamp, 0); - vnode->locked_at =3D call->reply_time; + vnode->locked_at =3D call->issue_time; afs_schedule_lock_extension(vnode); spin_unlock(&vnode->lock); } diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c index 1d95ed9dd86e6..0048a32cb040e 100644 --- a/fs/afs/fsclient.c +++ b/fs/afs/fsclient.c @@ -130,7 +130,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_b= p, =20 static time64_t xdr_decode_expiry(struct afs_call *call, u32 expiry) { - return ktime_divns(call->reply_time, NSEC_PER_SEC) + expiry; + return ktime_divns(call->issue_time, NSEC_PER_SEC) + expiry; } =20 static void xdr_decode_AFSCallBack(const __be32 **_bp, diff --git a/fs/afs/internal.h b/fs/afs/internal.h index dc08a3d9b3a8b..637cbe549397c 100644 --- a/fs/afs/internal.h +++ b/fs/afs/internal.h @@ -135,7 +135,6 @@ struct afs_call { bool need_attention; /* T if RxRPC poked us */ bool async; /* T if asynchronous */ bool upgrade; /* T to request service upgrade */ - bool have_reply_time; /* T if have got reply_time */ bool intr; /* T if interruptible */ bool unmarshalling_error; /* T if an unmarshalling error occurred */ u16 service_id; /* Actual service ID (after upgrade) */ @@ -149,7 +148,7 @@ struct afs_call { } __attribute__((packed)); __be64 tmp64; }; - ktime_t reply_time; /* Time of first reply packet */ + ktime_t issue_time; /* Time of issue of operation */ }; =20 struct afs_call_type { diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c index efe0fb3ad8bdc..535d28b44bca3 100644 --- a/fs/afs/rxrpc.c +++ b/fs/afs/rxrpc.c @@ -429,6 +429,7 @@ void afs_make_call(struct afs_addr_cursor *ac, struct a= fs_call *call, gfp_t gfp) if (call->max_lifespan) rxrpc_kernel_set_max_life(call->net->socket, rxcall, call->max_lifespan); + call->issue_time =3D ktime_get_real(); =20 /* send the request */ iov[0].iov_base =3D call->request; @@ -533,12 +534,6 @@ static void afs_deliver_to_call(struct afs_call *call) return; } =20 - if (!call->have_reply_time && - rxrpc_kernel_get_reply_time(call->net->socket, - call->rxcall, - &call->reply_time)) - call->have_reply_time =3D true; - ret =3D call->type->deliver(call); state =3D READ_ONCE(call->state); if (ret =3D=3D 0 && call->unmarshalling_error) diff --git a/fs/afs/yfsclient.c b/fs/afs/yfsclient.c index bd787e71a657f..5b2ef5ffd716f 100644 --- a/fs/afs/yfsclient.c +++ b/fs/afs/yfsclient.c @@ -239,8 +239,7 @@ static void xdr_decode_YFSCallBack(const __be32 **_bp, struct afs_callback *cb =3D &scb->callback; ktime_t cb_expiry; =20 - cb_expiry =3D call->reply_time; - cb_expiry =3D ktime_add(cb_expiry, xdr_to_u64(x->expiration_time) * 100); + cb_expiry =3D ktime_add(call->issue_time, xdr_to_u64(x->expiration_time) = * 100); cb->expires_at =3D ktime_divns(cb_expiry, NSEC_PER_SEC); scb->have_cb =3D true; *_bp +=3D xdr_size(x); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E885CC6FA89 for ; Tue, 13 Sep 2022 14:49:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231424AbiIMOts (ORCPT ); Tue, 13 Sep 2022 10:49:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57022 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233213AbiIMOrk (ORCPT ); Tue, 13 Sep 2022 10:47:40 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9E79315FF7; Tue, 13 Sep 2022 07:24:48 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 11EAD614D1; Tue, 13 Sep 2022 14:24:35 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 27DCCC433D6; Tue, 13 Sep 2022 14:24:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079074; bh=Z1DqO47BFrDbZG++f2rX/wbcetEoP13iZAVe6wxbpqM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cS0sffY+w29GMGkPpduXEgzYtAweGeFP6/bbIYf7zstSGmzt/WmLL18DotLWwcwRj t8vfXXZn4H+55qfzPTNUUgL6vdC2Jrs5JrgfF0//EX0kLYupeAZ3j3Z6J1q88vELCb JGpG1uW5/EDtAqHqSKDLnJ6sq2r0odqi1mDsnIBo= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , "David S. Miller" , Sasha Levin , zdi-disclosures@trendmicro.com Subject: [PATCH 5.10 55/79] sch_sfb: Dont assume the skb is still around after enqueueing to child Date: Tue, 13 Sep 2022 16:05:00 +0200 Message-Id: <20220913140352.882604311@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 9efd23297cca530bb35e1848665805d3fcdd7889 ] The sch_sfb enqueue() routine assumes the skb is still alive after it has been enqueued into a child qdisc, using the data in the skb cb field in the increment_qlen() routine after enqueue. However, the skb may in fact have been freed, causing a use-after-free in this case. In particular, this happens if sch_cake is used as a child of sfb, and the GSO splitting mode of CAKE is enabled (in which case the skb will be split into segments and the original skb freed). Fix this by copying the sfb cb data to the stack before enqueueing the skb, and using this stack copy in increment_qlen() instead of the skb pointer itself. Reported-by: zdi-disclosures@trendmicro.com # ZDI-CAN-18231 Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/sched/sch_sfb.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index da047a37a3bf3..f180cf95cfc97 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -135,15 +135,15 @@ static void increment_one_qlen(u32 sfbhash, u32 slot,= struct sfb_sched_data *q) } } =20 -static void increment_qlen(const struct sk_buff *skb, struct sfb_sched_dat= a *q) +static void increment_qlen(const struct sfb_skb_cb *cb, struct sfb_sched_d= ata *q) { u32 sfbhash; =20 - sfbhash =3D sfb_hash(skb, 0); + sfbhash =3D cb->hashes[0]; if (sfbhash) increment_one_qlen(sfbhash, 0, q); =20 - sfbhash =3D sfb_hash(skb, 1); + sfbhash =3D cb->hashes[1]; if (sfbhash) increment_one_qlen(sfbhash, 1, q); } @@ -283,6 +283,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, struct sfb_sched_data *q =3D qdisc_priv(sch); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; + struct sfb_skb_cb cb; int i; u32 p_min =3D ~0; u32 minqlen =3D ~0; @@ -399,11 +400,12 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qd= isc *sch, } =20 enqueue: + memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { qdisc_qstats_backlog_inc(sch, skb); sch->q.qlen++; - increment_qlen(skb, q); + increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { q->stats.childdrop++; qdisc_qstats_drop(sch); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E7FECC6FA82 for ; Tue, 13 Sep 2022 14:50:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234532AbiIMOuj (ORCPT ); Tue, 13 Sep 2022 10:50:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56898 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233016AbiIMOse (ORCPT ); Tue, 13 Sep 2022 10:48:34 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 9833749B7F; Tue, 13 Sep 2022 07:24:57 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 32232B80FC0; Tue, 13 Sep 2022 14:24:55 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9EA47C433D6; Tue, 13 Sep 2022 14:24:53 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079094; bh=kELTElkb6QA91Xth3ZxyBG0ikSJpwye+EZCDWPlePtc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zt6gCT+kBRtwZ6u6CkIZHFbpMjXviawyHqCDQKhpal9o9BE6qFCgYBZOhM2Knmu7g 9yqyxYbWcQGuOLsB89vZrZ0fcfGxPaasRIDi6vVWe5FUZHpWg2FQKmInZ3GmKOhUyw xSEaqYorYESkiOYTyNXitoHtjsLy964TLuxK0FgY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 56/79] tipc: fix shift wrapping bug in map_get() Date: Tue, 13 Sep 2022 16:05:01 +0200 Message-Id: <20220913140352.924029724@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Dan Carpenter [ Upstream commit e2b224abd9bf45dcb55750479fc35970725a430b ] There is a shift wrapping bug in this code so anything thing above 31 will return false. Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework") Signed-off-by: Dan Carpenter Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/tipc/monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c index a37190da5a504..1d90f39129ca0 100644 --- a/net/tipc/monitor.c +++ b/net/tipc/monitor.c @@ -130,7 +130,7 @@ static void map_set(u64 *up_map, int i, unsigned int v) =20 static int map_get(u64 up_map, int i) { - return (up_map & (1 << i)) >> i; + return (up_map & (1ULL << i)) >> i; } =20 static struct tipc_peer *peer_prev(struct tipc_peer *peer) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 578EBC6FA89 for ; Tue, 13 Sep 2022 14:50:38 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234516AbiIMOuf (ORCPT ); Tue, 13 Sep 2022 10:50:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56886 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233296AbiIMOsh (ORCPT ); Tue, 13 Sep 2022 10:48:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id EC46D2F679; Tue, 13 Sep 2022 07:25:03 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 01785614D8; Tue, 13 Sep 2022 14:24:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17145C433D6; Tue, 13 Sep 2022 14:24:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079096; bh=reJjTtJ6WJoy6G4/ZgN0GOreCPmmm1Rxox/0y284+ZA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=HX/boR2u62Guvx34Im1RnlMu2Y/spAuefaVXANS2OUDTDNaL6mWE/Oj+M557Ms5zY SZFVq+GF9BPiXSdCTr9JS4yN64dBdpSoaXnup3s0MHloVqRJ6rN/97N55hW59WOZqE aIsUgfWJI6WywDLqyEDE/OHmFaanxzOEYE82Z/7I= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Michal Swiatkowski , Tony Nguyen , Sasha Levin , Gurucharan Subject: [PATCH 5.10 57/79] ice: use bitmap_free instead of devm_kfree Date: Tue, 13 Sep 2022 16:05:02 +0200 Message-Id: <20220913140352.974680125@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Michal Swiatkowski [ Upstream commit 59ac325557b6c14f1f793b90d3946bc145ffa085 ] pf->avail_txqs was allocated using bitmap_zalloc, bitmap_free should be used to free this memory. Fixes: 78b5713ac1241 ("ice: Alloc queue management bitmaps and arrays dynam= ically") Signed-off-by: Michal Swiatkowski Tested-by: Gurucharan (A Contingent worker at Int= el) Signed-off-by: Tony Nguyen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/ice/ice_main.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/ice/ice_main.c b/drivers/net/ethern= et/intel/ice/ice_main.c index 810f2bdb91645..f193709c8efc6 100644 --- a/drivers/net/ethernet/intel/ice/ice_main.c +++ b/drivers/net/ethernet/intel/ice/ice_main.c @@ -3404,7 +3404,7 @@ static int ice_init_pf(struct ice_pf *pf) =20 pf->avail_rxqs =3D bitmap_zalloc(pf->max_pf_rxqs, GFP_KERNEL); if (!pf->avail_rxqs) { - devm_kfree(ice_pf_to_dev(pf), pf->avail_txqs); + bitmap_free(pf->avail_txqs); pf->avail_txqs =3D NULL; return -ENOMEM; } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E15B1C54EE9 for ; Tue, 13 Sep 2022 14:52:34 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234506AbiIMOwd (ORCPT ); Tue, 13 Sep 2022 10:52:33 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234607AbiIMOtM (ORCPT ); Tue, 13 Sep 2022 10:49:12 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B3CD6165AD; Tue, 13 Sep 2022 07:25:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 0FA5CB80FBD; Tue, 13 Sep 2022 14:25:00 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 717D7C43470; Tue, 13 Sep 2022 14:24:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079098; bh=I+QK/ESWmL/Wj+hKMs0Inox95iz6LZkRH+Tufc3qPmg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zoEHI7XyEElVtzVXJV9QJU0JDttVYBEaLfFXwjJhvRO5cJPwhzfIHwiKfdmO/gfeS 0RUxeC2HYxz47g/kTtnaUnU49F6YN8GIvCwsCNn7aPcQ8hQfnSKqV0jZASlCEoeScl s9H9tloC6utv+kocRzoEQWyAqXzhagYD7edCLCJ4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ivan Vecera , Helena Anna Dubel , Tony Nguyen , Sasha Levin Subject: [PATCH 5.10 58/79] i40e: Fix kernel crash during module removal Date: Tue, 13 Sep 2022 16:05:03 +0200 Message-Id: <20220913140353.018779173@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ivan Vecera [ Upstream commit fb8396aeda5872369a8ed6d2301e2c86e303c520 ] The driver incorrectly frees client instance and subsequent i40e module removal leads to kernel crash. Reproducer: 1. Do ethtool offline test followed immediately by another one host# ethtool -t eth0 offline; ethtool -t eth0 offline 2. Remove recursively irdma module that also removes i40e module host# modprobe -r irdma Result: [ 8675.035651] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.193774] i40e 0000:3d:00.0 eno1: testing finished [ 8675.201316] i40e 0000:3d:00.0 eno1: offline testing starting [ 8675.358921] i40e 0000:3d:00.0 eno1: testing finished [ 8675.496921] i40e 0000:3d:00.0: IRDMA hardware initialization FAILED init= _state=3D2 status=3D-110 [ 8686.188955] i40e 0000:3d:00.1: i40e_ptp_stop: removed PHC on eno2 [ 8686.943890] i40e 0000:3d:00.1: Deleted LAN device PF1 bus=3D0x3d dev=3D0= x00 func=3D0x01 [ 8686.952669] i40e 0000:3d:00.0: i40e_ptp_stop: removed PHC on eno1 [ 8687.761787] BUG: kernel NULL pointer dereference, address: 0000000000000= 030 [ 8687.768755] #PF: supervisor read access in kernel mode [ 8687.773895] #PF: error_code(0x0000) - not-present page [ 8687.779034] PGD 0 P4D 0 [ 8687.781575] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 8687.785935] CPU: 51 PID: 172891 Comm: rmmod Kdump: loaded Tainted: G = W I 5.19.0+ #2 [ 8687.794800] Hardware name: Intel Corporation S2600WFD/S2600WFD, BIOS SE5= C620.86B.0X.02.0001.051420190324 05/14/2019 [ 8687.805222] RIP: 0010:i40e_lan_del_device+0x13/0xb0 [i40e] [ 8687.810719] Code: d4 84 c0 0f 84 b8 25 01 00 e9 9c 25 01 00 41 bc f4 ff = ff ff eb 91 90 0f 1f 44 00 00 41 54 55 53 48 8b 87 58 08 00 00 48 89 fb <48= > 8b 68 30 48 89 ef e8 21 8a 0f d5 48 89 ef e8 a9 78 0f d5 48 8b [ 8687.829462] RSP: 0018:ffffa604072efce0 EFLAGS: 00010202 [ 8687.834689] RAX: 0000000000000000 RBX: ffff8f43833b2000 RCX: 00000000000= 00000 [ 8687.841821] RDX: 0000000000000000 RSI: ffff8f4b0545b298 RDI: ffff8f43833= b2000 [ 8687.848955] RBP: ffff8f43833b2000 R08: 0000000000000001 R09: 00000000000= 00000 [ 8687.856086] R10: 0000000000000000 R11: 000ffffffffff000 R12: ffff8f43833= b2ef0 [ 8687.863218] R13: ffff8f43833b2ef0 R14: ffff915103966000 R15: ffff8f43833= b2008 [ 8687.870342] FS: 00007f79501c3740(0000) GS:ffff8f4adffc0000(0000) knlGS:= 0000000000000000 [ 8687.878427] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 8687.884174] CR2: 0000000000000030 CR3: 000000014276e004 CR4: 00000000007= 706e0 [ 8687.891306] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 00000000000= 00000 [ 8687.898441] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 00000000000= 00400 [ 8687.905572] PKRU: 55555554 [ 8687.908286] Call Trace: [ 8687.910737] [ 8687.912843] i40e_remove+0x2c0/0x330 [i40e] [ 8687.917040] pci_device_remove+0x33/0xa0 [ 8687.920962] device_release_driver_internal+0x1aa/0x230 [ 8687.926188] driver_detach+0x44/0x90 [ 8687.929770] bus_remove_driver+0x55/0xe0 [ 8687.933693] pci_unregister_driver+0x2a/0xb0 [ 8687.937967] i40e_exit_module+0xc/0xf48 [i40e] Two offline tests cause IRDMA driver failure (ETIMEDOUT) and this failure is indicated back to i40e_client_subtask() that calls i40e_client_del_instance() to free client instance referenced by pf->cinst and sets this pointer to NULL. During the module removal i40e_remove() calls i40e_lan_del_device() that dereferences pf->cinst that is NULL -> crash. Do not remove client instance when client open callbacks fails and just clear __I40E_CLIENT_INSTANCE_OPENED bit. The driver also needs to take care about this situation (when netdev is up and client is NOT opened) in i40e_notify_client_of_netdev_close() and calls client close callback only when __I40E_CLIENT_INSTANCE_OPENED is set. Fixes: 0ef2d5afb12d ("i40e: KISS the client interface") Signed-off-by: Ivan Vecera Tested-by: Helena Anna Dubel Signed-off-by: Tony Nguyen Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/net/ethernet/intel/i40e/i40e_client.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/intel/i40e/i40e_client.c b/drivers/net/et= hernet/intel/i40e/i40e_client.c index 32f3facbed1a5..b3cb5d1033260 100644 --- a/drivers/net/ethernet/intel/i40e/i40e_client.c +++ b/drivers/net/ethernet/intel/i40e/i40e_client.c @@ -178,6 +178,10 @@ void i40e_notify_client_of_netdev_close(struct i40e_vs= i *vsi, bool reset) "Cannot locate client instance close routine\n"); return; } + if (!test_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state)) { + dev_dbg(&pf->pdev->dev, "Client is not open, abort close\n"); + return; + } cdev->client->ops->close(&cdev->lan_info, cdev->client, reset); clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state); i40e_client_release_qvlist(&cdev->lan_info); @@ -374,7 +378,6 @@ void i40e_client_subtask(struct i40e_pf *pf) /* Remove failed client instance */ clear_bit(__I40E_CLIENT_INSTANCE_OPENED, &cdev->state); - i40e_client_del_instance(pf); return; } } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 00943C54EE9 for ; Tue, 13 Sep 2022 14:50:54 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230237AbiIMOuw (ORCPT ); Tue, 13 Sep 2022 10:50:52 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50728 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234279AbiIMOsi (ORCPT ); Tue, 13 Sep 2022 10:48:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7E2D717AAA; Tue, 13 Sep 2022 07:25:04 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C4001614D4; Tue, 13 Sep 2022 14:25:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E02C1C433C1; Tue, 13 Sep 2022 14:25:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079101; bh=9QA8oLkj1XmUYdLVqkdgiweOcE/VgWb06ZXPT0B5lk8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Y4uJc9ZFAzum2JCDyQxdEdIm1moxiBtNeAYy5kLN1Cm5JL4nt2P65ftF4iIcwAN4J PwthUDNGyeFIOUWJKwHsT1823IITyhvBVb/HJAwOjDk8x7okGEm895W2McutdLWS2E d5zL/6SrPK+KFdTqmHBSGVuKloT9BtqAORq89MXA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Marc Kleine-Budde , =?UTF-8?q?Cs=C3=B3k=C3=A1s=20Bence?= , Jakub Kicinski , Sasha Levin , Francesco Dolcini Subject: [PATCH 5.10 59/79] net: fec: Use a spinlock to guard `fep->ptp_clk_on` Date: Tue, 13 Sep 2022 16:05:04 +0200 Message-Id: <20220913140353.063220321@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Cs=C3=B3k=C3=A1s Bence [ Upstream commit b353b241f1eb9b6265358ffbe2632fdcb563354f ] Mutexes cannot be taken in a non-preemptible context, causing a panic in `fec_ptp_save_state()`. Replacing `ptp_clk_mutex` by `tmreg_lock` fixes this. Fixes: 6a4d7234ae9a ("net: fec: ptp: avoid register access when ipg clock i= s disabled") Fixes: f79959220fa5 ("fec: Restart PPS after link state change") Reported-by: Marc Kleine-Budde Link: https://lore.kernel.org/all/20220827160922.642zlcd5foopozru@pengutron= ix.de/ Signed-off-by: Cs=C3=B3k=C3=A1s Bence Tested-by: Francesco Dolcini # Toradex Apal= is iMX6 Link: https://lore.kernel.org/r/20220901140402.64804-1-csokas.bence@prolan.= hu Signed-off-by: Jakub Kicinski Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/net/ethernet/freescale/fec.h | 1 - drivers/net/ethernet/freescale/fec_main.c | 17 +++++++------- drivers/net/ethernet/freescale/fec_ptp.c | 28 ++++++++--------------- 3 files changed, 19 insertions(+), 27 deletions(-) diff --git a/drivers/net/ethernet/freescale/fec.h b/drivers/net/ethernet/fr= eescale/fec.h index 6ea98af63b341..e7b23d4a22d0a 100644 --- a/drivers/net/ethernet/freescale/fec.h +++ b/drivers/net/ethernet/freescale/fec.h @@ -523,7 +523,6 @@ struct fec_enet_private { struct clk *clk_ptp; =20 bool ptp_clk_on; - struct mutex ptp_clk_mutex; unsigned int num_tx_queues; unsigned int num_rx_queues; =20 diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethern= et/freescale/fec_main.c index d8bdaf2e5365c..674591751a676 100644 --- a/drivers/net/ethernet/freescale/fec_main.c +++ b/drivers/net/ethernet/freescale/fec_main.c @@ -1937,6 +1937,7 @@ static void fec_enet_phy_reset_after_clk_enable(struc= t net_device *ndev) static int fec_enet_clk_enable(struct net_device *ndev, bool enable) { struct fec_enet_private *fep =3D netdev_priv(ndev); + unsigned long flags; int ret; =20 if (enable) { @@ -1945,15 +1946,15 @@ static int fec_enet_clk_enable(struct net_device *n= dev, bool enable) return ret; =20 if (fep->clk_ptp) { - mutex_lock(&fep->ptp_clk_mutex); + spin_lock_irqsave(&fep->tmreg_lock, flags); ret =3D clk_prepare_enable(fep->clk_ptp); if (ret) { - mutex_unlock(&fep->ptp_clk_mutex); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); goto failed_clk_ptp; } else { fep->ptp_clk_on =3D true; } - mutex_unlock(&fep->ptp_clk_mutex); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); } =20 ret =3D clk_prepare_enable(fep->clk_ref); @@ -1964,10 +1965,10 @@ static int fec_enet_clk_enable(struct net_device *n= dev, bool enable) } else { clk_disable_unprepare(fep->clk_enet_out); if (fep->clk_ptp) { - mutex_lock(&fep->ptp_clk_mutex); + spin_lock_irqsave(&fep->tmreg_lock, flags); clk_disable_unprepare(fep->clk_ptp); fep->ptp_clk_on =3D false; - mutex_unlock(&fep->ptp_clk_mutex); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); } clk_disable_unprepare(fep->clk_ref); } @@ -1976,10 +1977,10 @@ static int fec_enet_clk_enable(struct net_device *n= dev, bool enable) =20 failed_clk_ref: if (fep->clk_ptp) { - mutex_lock(&fep->ptp_clk_mutex); + spin_lock_irqsave(&fep->tmreg_lock, flags); clk_disable_unprepare(fep->clk_ptp); fep->ptp_clk_on =3D false; - mutex_unlock(&fep->ptp_clk_mutex); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); } failed_clk_ptp: clk_disable_unprepare(fep->clk_enet_out); @@ -3665,7 +3666,7 @@ fec_probe(struct platform_device *pdev) fep->clk_enet_out =3D NULL; =20 fep->ptp_clk_on =3D false; - mutex_init(&fep->ptp_clk_mutex); + spin_lock_init(&fep->tmreg_lock); =20 /* clk_ref is optional, depends on board */ fep->clk_ref =3D devm_clk_get(&pdev->dev, "enet_clk_ref"); diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/etherne= t/freescale/fec_ptp.c index c5ae673005908..99bd67d3befd0 100644 --- a/drivers/net/ethernet/freescale/fec_ptp.c +++ b/drivers/net/ethernet/freescale/fec_ptp.c @@ -366,21 +366,19 @@ static int fec_ptp_adjtime(struct ptp_clock_info *ptp= , s64 delta) */ static int fec_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *= ts) { - struct fec_enet_private *adapter =3D + struct fec_enet_private *fep =3D container_of(ptp, struct fec_enet_private, ptp_caps); u64 ns; unsigned long flags; =20 - mutex_lock(&adapter->ptp_clk_mutex); + spin_lock_irqsave(&fep->tmreg_lock, flags); /* Check the ptp clock */ - if (!adapter->ptp_clk_on) { - mutex_unlock(&adapter->ptp_clk_mutex); + if (!fep->ptp_clk_on) { + spin_unlock_irqrestore(&fep->tmreg_lock, flags); return -EINVAL; } - spin_lock_irqsave(&adapter->tmreg_lock, flags); - ns =3D timecounter_read(&adapter->tc); - spin_unlock_irqrestore(&adapter->tmreg_lock, flags); - mutex_unlock(&adapter->ptp_clk_mutex); + ns =3D timecounter_read(&fep->tc); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); =20 *ts =3D ns_to_timespec64(ns); =20 @@ -405,10 +403,10 @@ static int fec_ptp_settime(struct ptp_clock_info *ptp, unsigned long flags; u32 counter; =20 - mutex_lock(&fep->ptp_clk_mutex); + spin_lock_irqsave(&fep->tmreg_lock, flags); /* Check the ptp clock */ if (!fep->ptp_clk_on) { - mutex_unlock(&fep->ptp_clk_mutex); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); return -EINVAL; } =20 @@ -418,11 +416,9 @@ static int fec_ptp_settime(struct ptp_clock_info *ptp, */ counter =3D ns & fep->cc.mask; =20 - spin_lock_irqsave(&fep->tmreg_lock, flags); writel(counter, fep->hwp + FEC_ATIME); timecounter_init(&fep->tc, &fep->cc, ns); spin_unlock_irqrestore(&fep->tmreg_lock, flags); - mutex_unlock(&fep->ptp_clk_mutex); return 0; } =20 @@ -523,13 +519,11 @@ static void fec_time_keep(struct work_struct *work) struct fec_enet_private *fep =3D container_of(dwork, struct fec_enet_priv= ate, time_keep); unsigned long flags; =20 - mutex_lock(&fep->ptp_clk_mutex); + spin_lock_irqsave(&fep->tmreg_lock, flags); if (fep->ptp_clk_on) { - spin_lock_irqsave(&fep->tmreg_lock, flags); timecounter_read(&fep->tc); - spin_unlock_irqrestore(&fep->tmreg_lock, flags); } - mutex_unlock(&fep->ptp_clk_mutex); + spin_unlock_irqrestore(&fep->tmreg_lock, flags); =20 schedule_delayed_work(&fep->time_keep, HZ); } @@ -604,8 +598,6 @@ void fec_ptp_init(struct platform_device *pdev, int irq= _idx) } fep->ptp_inc =3D NSEC_PER_SEC / fep->cycle_speed; =20 - spin_lock_init(&fep->tmreg_lock); - fec_ptp_start_cyclecounter(ndev); =20 INIT_DELAYED_WORK(&fep->time_keep, fec_time_keep); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 549D6C6FA82 for ; Tue, 13 Sep 2022 14:51:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234279AbiIMOvB (ORCPT ); Tue, 13 Sep 2022 10:51:01 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233788AbiIMOsh (ORCPT ); Tue, 13 Sep 2022 10:48:37 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5E56E61B15; Tue, 13 Sep 2022 07:25:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id E7A6BB80FA1; Tue, 13 Sep 2022 14:25:04 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 43FF8C433C1; Tue, 13 Sep 2022 14:25:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079103; bh=eFF1w39b4W6ZFP4m4PXlHMW5JZxP51WaskoYl5p5TFw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=qRtrKvvZU4il0H2L3O0XI1uYM2AUW6lN2Zfvsb8QE3ciEiIX1cuie7l9O72CH4osA kFKvvF26U4jtJUUtcdFVCG9oiTVHDucL8BHU/Yp/mBAz6Q5JLpfAxltQCUEZ1k2qOC MmLNYBxxYOIXsUlpq+QaPl/I2WXRD1kacP0XekS0= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Paul Durrant , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 60/79] xen-netback: only remove hotplug-status when the vif is actually destroyed Date: Tue, 13 Sep 2022 16:05:05 +0200 Message-Id: <20220913140353.111060203@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Paul Durrant [ Upstream commit c55f34b6aec2a8cb47eadaffea773e83bf85de91 ] Removing 'hotplug-status' in backend_disconnected() means that it will be removed even in the case that the frontend unilaterally disconnects (which it is free to do at any time). The consequence of this is that, when the frontend attempts to re-connect, the backend gets stuck in 'InitWait' rather than moving straight to 'Connected' (which it can do because the hotplug script has already run). Instead, the 'hotplug-status' mode should be removed in netback_remove() i.e. when the vif really is going away. Fixes: 0f4558ae9187 ("Revert "xen-netback: remove 'hotplug-status' once it = has served its purpose"") Signed-off-by: Paul Durrant Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/net/xen-netback/xenbus.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xen= bus.c index ca261e0fc9c9b..9ee9ce0493fe6 100644 --- a/drivers/net/xen-netback/xenbus.c +++ b/drivers/net/xen-netback/xenbus.c @@ -256,7 +256,6 @@ static void backend_disconnect(struct backend_info *be) unsigned int queue_index; =20 xen_unregister_watchers(vif); - xenbus_rm(XBT_NIL, be->dev->nodename, "hotplug-status"); #ifdef CONFIG_DEBUG_FS xenvif_debugfs_delif(vif); #endif /* CONFIG_DEBUG_FS */ @@ -984,6 +983,7 @@ static int netback_remove(struct xenbus_device *dev) struct backend_info *be =3D dev_get_drvdata(&dev->dev); =20 unregister_hotplug_status_watch(be); + xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status"); if (be->vif) { kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE); backend_disconnect(be); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 062A2C54EE9 for ; Tue, 13 Sep 2022 14:50:49 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234544AbiIMOup (ORCPT ); Tue, 13 Sep 2022 10:50:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:50732 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234273AbiIMOsi (ORCPT ); Tue, 13 Sep 2022 10:48:38 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1D4F53FA3F; Tue, 13 Sep 2022 07:25:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id B75BA614B4; Tue, 13 Sep 2022 14:25:06 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id CD11BC433D6; Tue, 13 Sep 2022 14:25:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079106; bh=GMkAOvpeS2Q4DXNwpdWazj8uVwJMqhidTuecDSVaYYM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=mYqJUxN0g6hD+5HtSCZqz+eGIKzBThq+wP7BuTSJtbuttqaaaKNN4XH9ZwOWECv44 gU3ZfEUlFDkMOVwD2RmJbMMLSl8DUqLD5oFSToE+PXsj7nL6MjUh2XTol8CxW/KRMc UpNfCS0p2Oy7BRyo/uyz5rIXMtiDgkik3eg/gTAE= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, linux-rdma@vger.kernel.org, Linus Walleij , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 61/79] RDMA/siw: Pass a pointer to virt_to_page() Date: Tue, 13 Sep 2022 16:05:06 +0200 Message-Id: <20220913140353.160139198@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Linus Walleij [ Upstream commit 0d1b756acf60da5004c1e20ca4462f0c257bf6e1 ] Functions that work on a pointer to virtual memory such as virt_to_pfn() and users of that function such as virt_to_page() are supposed to pass a pointer to virtual memory, ideally a (void *) or other pointer. However since many architectures implement virt_to_pfn() as a macro, this function becomes polymorphic and accepts both a (unsigned long) and a (void *). If we instead implement a proper virt_to_pfn(void *addr) function the following happens (occurred on arch/arm): drivers/infiniband/sw/siw/siw_qp_tx.c:32:23: warning: incompatible integer to pointer conversion passing 'dma_addr_t' (aka 'unsigned int') to parameter of type 'const void *' [-Wint-conversion] drivers/infiniband/sw/siw/siw_qp_tx.c:32:37: warning: passing argument 1 of 'virt_to_pfn' makes pointer from integer without a cast [-Wint-conversion] drivers/infiniband/sw/siw/siw_qp_tx.c:538:36: warning: incompatible integer to pointer conversion passing 'unsigned long long' to parameter of type 'const void *' [-Wint-conversion] Fix this with an explicit cast. In one case where the SIW SGE uses an unaligned u64 we need a double cast modifying the virtual address (va) to a platform-specific uintptr_t before casting to a (void *). Fixes: b9be6f18cf9e ("rdma/siw: transmit path") Cc: linux-rdma@vger.kernel.org Signed-off-by: Linus Walleij Link: https://lore.kernel.org/r/20220902215918.603761-1-linus.walleij@linar= o.org Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/infiniband/sw/siw/siw_qp_tx.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/drivers/infiniband/sw/siw/siw_qp_tx.c b/drivers/infiniband/sw/= siw/siw_qp_tx.c index 7989c4043db4e..3c3ae5ef29428 100644 --- a/drivers/infiniband/sw/siw/siw_qp_tx.c +++ b/drivers/infiniband/sw/siw/siw_qp_tx.c @@ -29,7 +29,7 @@ static struct page *siw_get_pblpage(struct siw_mem *mem, = u64 addr, int *idx) dma_addr_t paddr =3D siw_pbl_get_buffer(pbl, offset, NULL, idx); =20 if (paddr) - return virt_to_page(paddr); + return virt_to_page((void *)paddr); =20 return NULL; } @@ -523,13 +523,23 @@ static int siw_tx_hdt(struct siw_iwarp_tx *c_tx, stru= ct socket *s) kunmap(p); } } else { - u64 va =3D sge->laddr + sge_off; + /* + * Cast to an uintptr_t to preserve all 64 bits + * in sge->laddr. + */ + uintptr_t va =3D (uintptr_t)(sge->laddr + sge_off); =20 - page_array[seg] =3D virt_to_page(va & PAGE_MASK); + /* + * virt_to_page() takes a (void *) pointer + * so cast to a (void *) meaning it will be 64 + * bits on a 64 bit platform and 32 bits on a + * 32 bit platform. + */ + page_array[seg] =3D virt_to_page((void *)(va & PAGE_MASK)); if (do_crc) crypto_shash_update( c_tx->mpa_crc_hd, - (void *)(uintptr_t)va, + (void *)va, plen); } =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2368EC54EE9 for ; Tue, 13 Sep 2022 15:45:51 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231877AbiIMPpn (ORCPT ); Tue, 13 Sep 2022 11:45:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38394 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231886AbiIMPpH (ORCPT ); Tue, 13 Sep 2022 11:45:07 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 146D65F7F6; Tue, 13 Sep 2022 07:48:46 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8CEBF614D1; Tue, 13 Sep 2022 14:25:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8DE03C433C1; Tue, 13 Sep 2022 14:25:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079109; bh=XkQbDJaMEkaRdkohvyKxOTHcsS3Jp20F3IRQadi3+84=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=a8OpAXWXCTLYCZL/LrbnHxDKrdyNjyDPsMio7ggFGrsbxSNElRsCedjniTS9qk15u oaydv2ROX/uN0CsqDzWIhLUJBPa79H2+QaBperm5EWcQxIc2DbAPyo7vcXrNcV5HLM 8lvQfnsCyOadc/Hf/19Kf9RR3DFHV0+t59/xPN7s= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Lucas Leong , David Lebrun , "David S. Miller" , Sasha Levin Subject: [PATCH 5.10 62/79] ipv6: sr: fix out-of-bounds read when setting HMAC data. Date: Tue, 13 Sep 2022 16:05:07 +0200 Message-Id: <20220913140353.206087559@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: David Lebrun [ Upstream commit 84a53580c5d2138c7361c7c3eea5b31827e63b35 ] The SRv6 layer allows defining HMAC data that can later be used to sign IPv6 Segment Routing Headers. This configuration is realised via netlink through four attributes: SEG6_ATTR_HMACKEYID, SEG6_ATTR_SECRET, SEG6_ATTR_SECRETLEN= and SEG6_ATTR_ALGID. Because the SECRETLEN attribute is decoupled from the actu= al length of the SECRET attribute, it is possible to provide invalid combinati= ons (e.g., secret =3D "", secretlen =3D 64). This case is not checked in the co= de and with an appropriately crafted netlink message, an out-of-bounds read of up to 64 bytes (max secret length) can occur past the skb end pointer and into skb_shared_info: Breakpoint 1, seg6_genl_sethmac (skb=3D, info=3D) at net/ipv6/seg6.c:208 208 memcpy(hinfo->secret, secret, slen); (gdb) bt #0 seg6_genl_sethmac (skb=3D, info=3D) at n= et/ipv6/seg6.c:208 #1 0xffffffff81e012e9 in genl_family_rcv_msg_doit (skb=3Dskb@entry=3D0xff= ff88800b1f9f00, nlh=3Dnlh@entry=3D0xffff88800b1b7600, extack=3Dextack@entry=3D0xffffc90000ba7af0, ops=3Dops@entry=3D0xffffc90= 000ba7a80, hdrlen=3D4, net=3D0xffffffff84237580 , family=3D, family=3D) at net/netlink/genetlink.c:731 #2 0xffffffff81e01435 in genl_family_rcv_msg (extack=3D0xffffc90000ba7af0= , nlh=3D0xffff88800b1b7600, skb=3D0xffff88800b1f9f00, family=3D0xffffffff82fef6c0 ) at net/netlink/genetlin= k.c:775 #3 genl_rcv_msg (skb=3D0xffff88800b1f9f00, nlh=3D0xffff88800b1b7600, exta= ck=3D0xffffc90000ba7af0) at net/netlink/genetlink.c:792 #4 0xffffffff81dfffc3 in netlink_rcv_skb (skb=3Dskb@entry=3D0xffff88800b1= f9f00, cb=3Dcb@entry=3D0xffffffff81e01350 ) at net/netlink/af_netlink.c:2501 #5 0xffffffff81e00919 in genl_rcv (skb=3D0xffff88800b1f9f00) at net/netli= nk/genetlink.c:803 #6 0xffffffff81dff6ae in netlink_unicast_kernel (ssk=3D0xffff888010eec800= , skb=3D0xffff88800b1f9f00, sk=3D0xffff888004aed000) at net/netlink/af_netlink.c:1319 #7 netlink_unicast (ssk=3Dssk@entry=3D0xffff888010eec800, skb=3Dskb@entry= =3D0xffff88800b1f9f00, portid=3Dportid@entry=3D0, nonblock=3D) at net/netlink/af_netlink.c:1345 #8 0xffffffff81dff9a4 in netlink_sendmsg (sock=3D, msg=3D0= xffffc90000ba7e48, len=3D) at net/netlink/af_netlink.c:1921 ... (gdb) p/x ((struct sk_buff *)0xffff88800b1f9f00)->head + ((struct sk_buff *= )0xffff88800b1f9f00)->end $1 =3D 0xffff88800b1b76c0 (gdb) p/x secret $2 =3D 0xffff88800b1b76c0 (gdb) p slen $3 =3D 64 '@' The OOB data can then be read back from userspace by dumping HMAC state. Th= is commit fixes this by ensuring SECRETLEN cannot exceed the actual length of SECRET. Reported-by: Lucas Leong Tested: verified that EINVAL is correctly returned when secretlen > len(sec= ret) Fixes: 4f4853dc1c9c1 ("ipv6: sr: implement API to control SR HMAC structure= ") Signed-off-by: David Lebrun Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/ipv6/seg6.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c index d2f8138e5a73a..2278c0234c497 100644 --- a/net/ipv6/seg6.c +++ b/net/ipv6/seg6.c @@ -135,6 +135,11 @@ static int seg6_genl_sethmac(struct sk_buff *skb, stru= ct genl_info *info) goto out_unlock; } =20 + if (slen > nla_len(info->attrs[SEG6_ATTR_SECRET])) { + err =3D -EINVAL; + goto out_unlock; + } + if (hinfo) { err =3D seg6_hmac_info_del(net, hmackeyid); if (err) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83C68C6FA90 for ; Tue, 13 Sep 2022 14:55:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234917AbiIMOy2 (ORCPT ); Tue, 13 Sep 2022 10:54:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53182 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234462AbiIMOu0 (ORCPT ); Tue, 13 Sep 2022 10:50:26 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BDA467269A; Tue, 13 Sep 2022 07:26:07 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id D4706B80F62; Tue, 13 Sep 2022 14:24:09 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4AA4AC433C1; Tue, 13 Sep 2022 14:24:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079048; bh=5/SJ4GartrR0F9VJhARBL3T5rj5VjqOPise/ix6nb2M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=OXW7j2GTQFpGakFZyvSeP5844eSZoCGDPA9vF3PUvxrYivsOF0s4M7AE2ZYbHi1cQ ZVvnTtWc1371MbBwMiSLoghaiTZpsHMg85Nrq9mkj7SUSOoMJ6Pe/QDSPxklvTzdgp 6v7JDE3xH7l4F9x90xiTXpkXZTnOIApHRLl+CmxY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Maor Gottlieb , Yishai Hadas , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 63/79] IB/core: Fix a nested dead lock as part of ODP flow Date: Tue, 13 Sep 2022 16:05:08 +0200 Message-Id: <20220913140353.246916334@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yishai Hadas [ Upstream commit 85eaeb5058f0f04dffb124c97c86b4f18db0b833 ] Fix a nested dead lock as part of ODP flow by using mmput_async(). >From the below call trace [1] can see that calling mmput() once we have the umem_odp->umem_mutex locked as required by ib_umem_odp_map_dma_and_lock() might trigger in the same task the exit_mmap()->__mmu_notifier_release()->mlx5_ib_invalidate_range() which may dead lock when trying to lock the same mutex. Moving to use mmput_async() will solve the problem as the above exit_mmap() flow will be called in other task and will be executed once the lock will be available. [1] [64843.077665] task:kworker/u133:2 state:D stack: 0 pid:80906 ppid: 2 flags:0x00004000 [64843.077672] Workqueue: mlx5_ib_page_fault mlx5_ib_eqe_pf_action [mlx5_ib] [64843.077719] Call Trace: [64843.077722] [64843.077724] __schedule+0x23d/0x590 [64843.077729] schedule+0x4e/0xb0 [64843.077735] schedule_preempt_disabled+0xe/0x10 [64843.077740] __mutex_lock.constprop.0+0x263/0x490 [64843.077747] __mutex_lock_slowpath+0x13/0x20 [64843.077752] mutex_lock+0x34/0x40 [64843.077758] mlx5_ib_invalidate_range+0x48/0x270 [mlx5_ib] [64843.077808] __mmu_notifier_release+0x1a4/0x200 [64843.077816] exit_mmap+0x1bc/0x200 [64843.077822] ? walk_page_range+0x9c/0x120 [64843.077828] ? __cond_resched+0x1a/0x50 [64843.077833] ? mutex_lock+0x13/0x40 [64843.077839] ? uprobe_clear_state+0xac/0x120 [64843.077860] mmput+0x5f/0x140 [64843.077867] ib_umem_odp_map_dma_and_lock+0x21b/0x580 [ib_core] [64843.077931] pagefault_real_mr+0x9a/0x140 [mlx5_ib] [64843.077962] pagefault_mr+0xb4/0x550 [mlx5_ib] [64843.077992] pagefault_single_data_segment.constprop.0+0x2ac/0x560 [mlx5_ib] [64843.078022] mlx5_ib_eqe_pf_action+0x528/0x780 [mlx5_ib] [64843.078051] process_one_work+0x22b/0x3d0 [64843.078059] worker_thread+0x53/0x410 [64843.078065] ? process_one_work+0x3d0/0x3d0 [64843.078073] kthread+0x12a/0x150 [64843.078079] ? set_kthread_struct+0x50/0x50 [64843.078085] ret_from_fork+0x22/0x30 [64843.078093] Fixes: 36f30e486dce ("IB/core: Improve ODP to use hmm_range_fault()") Reviewed-by: Maor Gottlieb Signed-off-by: Yishai Hadas Link: https://lore.kernel.org/r/74d93541ea533ef7daec6f126deb1072500aeb16.16= 61251841.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/infiniband/core/umem_odp.c | 2 +- kernel/fork.c | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/infiniband/core/umem_odp.c b/drivers/infiniband/core/u= mem_odp.c index 323f6cf006824..af4af4789ef27 100644 --- a/drivers/infiniband/core/umem_odp.c +++ b/drivers/infiniband/core/umem_odp.c @@ -466,7 +466,7 @@ int ib_umem_odp_map_dma_and_lock(struct ib_umem_odp *um= em_odp, u64 user_virt, mutex_unlock(&umem_odp->umem_mutex); =20 out_put_mm: - mmput(owning_mm); + mmput_async(owning_mm); out_put_task: if (owning_process) put_task_struct(owning_process); diff --git a/kernel/fork.c b/kernel/fork.c index a78c0b02edd55..b877480c901f0 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1127,6 +1127,7 @@ void mmput_async(struct mm_struct *mm) schedule_work(&mm->async_put_work); } } +EXPORT_SYMBOL_GPL(mmput_async); #endif =20 /** --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 363B3C54EE9 for ; Tue, 13 Sep 2022 14:56:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234849AbiIMO4h (ORCPT ); Tue, 13 Sep 2022 10:56:37 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34340 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234632AbiIMOxa (ORCPT ); Tue, 13 Sep 2022 10:53:30 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 675CE72B67; Tue, 13 Sep 2022 07:26:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 63DB1B80F9B; Tue, 13 Sep 2022 14:24:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C6708C433C1; Tue, 13 Sep 2022 14:24:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079051; bh=KaSwSIgk7nDDYsYLWWwE5uYh50byIm2BzbB5QmW7AQ0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=blC/FieGI/43U538PcmeScjC+K8P5Zl8CVpBPhFSkPUDox+fJCIHS0lg05QVFcgtj HoFRUUAWnEUUjMzaDWRAEvorP7TTK30s3U/rxtjwdblOHiMQFUDb0SHbt1fLnthyWF 3QdCiGfKitI97Ezkfg07aq/Sgw/npQ1ezPGX61T8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mark Bloch , Chris Mi , Leon Romanovsky , Sasha Levin Subject: [PATCH 5.10 64/79] RDMA/mlx5: Set local port to one when accessing counters Date: Tue, 13 Sep 2022 16:05:09 +0200 Message-Id: <20220913140353.293777543@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chris Mi [ Upstream commit 74b30b3ad5cec95d2647e796d10137438a098bc1 ] When accessing Ports Performance Counters Register (PPCNT), local port must be one if it is Function-Per-Port HCA that HCA_CAP.num_ports is 1. The offending patch can change the local port to other values when accessing PPCNT after enabling switchdev mode. The following syndrome will be printed: # cat /sys/class/infiniband/rdmap4s0f0/ports/2/counters/* # dmesg mlx5_core 0000:04:00.0: mlx5_cmd_check:756:(pid 12450): ACCESS_REG(0x805) = op_mod(0x1) failed, status bad parameter(0x3), syndrome (0x1e5585) Fix it by setting local port to one for Function-Per-Port HCA. Fixes: 210b1f78076f ("IB/mlx5: When not in dual port RoCE mode, use provide= d port as native") Reviewed-by: Mark Bloch Signed-off-by: Chris Mi Link: https://lore.kernel.org/r/6c5086c295c76211169e58dbd610fb0402360bab.16= 61763459.git.leonro@nvidia.com Signed-off-by: Leon Romanovsky Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/infiniband/hw/mlx5/mad.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/drivers/infiniband/hw/mlx5/mad.c b/drivers/infiniband/hw/mlx5/= mad.c index 9bb9bb058932f..cca7a4a6bd82d 100644 --- a/drivers/infiniband/hw/mlx5/mad.c +++ b/drivers/infiniband/hw/mlx5/mad.c @@ -166,6 +166,12 @@ static int process_pma_cmd(struct mlx5_ib_dev *dev, u8= port_num, mdev =3D dev->mdev; mdev_port_num =3D 1; } + if (MLX5_CAP_GEN(dev->mdev, num_ports) =3D=3D 1) { + /* set local port to one for Function-Per-Port HCA. */ + mdev =3D dev->mdev; + mdev_port_num =3D 1; + } + /* Declaring support of extended counters */ if (in_mad->mad_hdr.attr_id =3D=3D IB_PMA_CLASS_PORT_INFO) { struct ib_class_port_info cpi =3D {}; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B699EC6FA82 for ; Tue, 13 Sep 2022 14:55:12 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234661AbiIMOxj (ORCPT ); Tue, 13 Sep 2022 10:53:39 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34642 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234694AbiIMOt2 (ORCPT ); Tue, 13 Sep 2022 10:49:28 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 884F771BF8; Tue, 13 Sep 2022 07:26:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 006ECB80FA0; Tue, 13 Sep 2022 14:24:15 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4C3EFC433C1; Tue, 13 Sep 2022 14:24:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079053; bh=CN5DYKDJEa1O2QN/lobli9k8aJdPFx7hCeEN8JpVquE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=DMpnjiNGQ90YzU3/2w/ueYhf3iGOkn3n/uVbiAj0lhJQXWQXAruafx8wphYD/tygV 4XbnKH6fMuNhO1L2U6iutsGbLKTUfGDzh6S74/qSftCpwgjLDgiFOzcVM7RX0V7NTO NZo9MLZCRRpqNCFOhZmEqavhe43YOX8E2uUVXl9o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Daniel Wagner , Sagi Grimberg , Christoph Hellwig , Sasha Levin Subject: [PATCH 5.10 65/79] nvme-tcp: fix UAF when detecting digest errors Date: Tue, 13 Sep 2022 16:05:10 +0200 Message-Id: <20220913140353.336580323@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sagi Grimberg [ Upstream commit 160f3549a907a50e51a8518678ba2dcf2541abea ] We should also bail from the io_work loop when we set rd_enabled to true, so we don't attempt to read data from the socket when the TCP stream is already out-of-sync or corrupted. Fixes: 3f2304f8c6d6 ("nvme-tcp: add NVMe over TCP host driver") Reported-by: Daniel Wagner Signed-off-by: Sagi Grimberg Reviewed-by: Daniel Wagner Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/nvme/host/tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index fe8c27bbc3f20..329aeb5fe9514 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -1196,7 +1196,7 @@ static void nvme_tcp_io_work(struct work_struct *w) else if (unlikely(result < 0)) return; =20 - if (!pending) + if (!pending || !queue->rd_enabled) return; =20 } while (!time_after(jiffies, deadline)); /* quota is exhausted */ --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id ED614C54EE9 for ; Tue, 13 Sep 2022 15:08:27 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235380AbiIMPI0 (ORCPT ); Tue, 13 Sep 2022 11:08:26 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60740 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S235172AbiIMPHI (ORCPT ); Tue, 13 Sep 2022 11:07:08 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 97B1075CC6; Tue, 13 Sep 2022 07:30:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 4DB29B80E22; Tue, 13 Sep 2022 14:24:17 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id B947AC433D6; Tue, 13 Sep 2022 14:24:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079056; bh=byi9J8QRH913dbknLCRBuKtLIvl65NJGbun2gV4idLs=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=VcuaZJ4RUSPNua+rB2lbV8Moazd4z5aL2ndfqUrnGmcSGcN3hzsaNRMLfiftgOard 2A6nz4XjNNipoZVY+65kZVh4D76k1/EOhH1dZESvFR3Rx0P1w1bL4nk+4vlgsIZgVt XeRGAbNT3NeS46nlSKQEIYdDurj79lDM4/sJpfT8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Jonathan Nicklin , Sagi Grimberg , Christoph Hellwig , Sasha Levin Subject: [PATCH 5.10 66/79] nvme-tcp: fix regression that causes sporadic requests to time out Date: Tue, 13 Sep 2022 16:05:11 +0200 Message-Id: <20220913140353.376948325@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Sagi Grimberg [ Upstream commit 3770a42bb8ceb856877699257a43c0585a5d2996 ] When we queue requests, we strive to batch as much as possible and also signal the network stack that more data is about to be sent over a socket with MSG_SENDPAGE_NOTLAST. This flag looks at the pending requests queued as well as queue->more_requests that is derived from the block layer last-in-batch indication. We set more_request=3Dtrue when we flush the request directly from .queue_rq submission context (in nvme_tcp_send_all), however this is wrongly assuming that no other requests may be queued during the execution of nvme_tcp_send_all. Due to this, a race condition may happen where: 1. request X is queued as !last-in-batch 2. request X submission context calls nvme_tcp_send_all directly 3. nvme_tcp_send_all is preempted and schedules to a different cpu 4. request Y is queued as last-in-batch 5. nvme_tcp_send_all context sends request X+Y, however signals for both MSG_SENDPAGE_NOTLAST because queue->more_requests=3Dtrue. =3D=3D> none of the requests is pushed down to the wire as the network stack is waiting for more data, both requests timeout. To fix this, we eliminate queue->more_requests and only rely on the queue req_list and send_list to be not-empty. Fixes: 122e5b9f3d37 ("nvme-tcp: optimize network stack with setting msg fla= gs according to batch size") Reported-by: Jonathan Nicklin Signed-off-by: Sagi Grimberg Tested-by: Jonathan Nicklin Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/nvme/host/tcp.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c index 329aeb5fe9514..57df87def8c33 100644 --- a/drivers/nvme/host/tcp.c +++ b/drivers/nvme/host/tcp.c @@ -118,7 +118,6 @@ struct nvme_tcp_queue { struct mutex send_mutex; struct llist_head req_list; struct list_head send_list; - bool more_requests; =20 /* recv state */ void *pdu; @@ -314,7 +313,7 @@ static inline void nvme_tcp_send_all(struct nvme_tcp_qu= eue *queue) static inline bool nvme_tcp_queue_more(struct nvme_tcp_queue *queue) { return !list_empty(&queue->send_list) || - !llist_empty(&queue->req_list) || queue->more_requests; + !llist_empty(&queue->req_list); } =20 static inline void nvme_tcp_queue_request(struct nvme_tcp_request *req, @@ -333,9 +332,7 @@ static inline void nvme_tcp_queue_request(struct nvme_t= cp_request *req, */ if (queue->io_cpu =3D=3D raw_smp_processor_id() && sync && empty && mutex_trylock(&queue->send_mutex)) { - queue->more_requests =3D !last; nvme_tcp_send_all(queue); - queue->more_requests =3D false; mutex_unlock(&queue->send_mutex); } =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D965EC6FA82 for ; Tue, 13 Sep 2022 14:47:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S230095AbiIMOrp (ORCPT ); Tue, 13 Sep 2022 10:47:45 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56902 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232761AbiIMOqh (ORCPT ); Tue, 13 Sep 2022 10:46:37 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id B82C460ED; Tue, 13 Sep 2022 07:24:32 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 0A930614CA; Tue, 13 Sep 2022 14:24:19 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 212CCC433C1; Tue, 13 Sep 2022 14:24:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079058; bh=QFxcuUOpA9xehk6U9WmXvglORaUuTszDl0vhLdZly6k=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=jrDXMOTe01k8XTlZiLWRoaiwmDRXNwGEc4vdjNiVFdcu92UIifdJ2qo1ucywIjA2k z+mAsCZp8y0XzPjR/DzrH7IB/5fzDeEjH2x+tGfNpN9iLQSxfmG1Vxhie9Nwha/fy1 7j2JcgjsqLxZ0QcjkqG4I8wAbJ60YgH3O7QBCa8g= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nagaraj Arankal , Neal Cardwell , Yuchung Cheng , Eric Dumazet , Paolo Abeni , Sasha Levin Subject: [PATCH 5.10 67/79] tcp: fix early ETIMEDOUT after spurious non-SACK RTO Date: Tue, 13 Sep 2022 16:05:12 +0200 Message-Id: <20220913140353.418536205@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Neal Cardwell [ Upstream commit 686dc2db2a0fdc1d34b424ec2c0a735becd8d62b ] Fix a bug reported and analyzed by Nagaraj Arankal, where the handling of a spurious non-SACK RTO could cause a connection to fail to clear retrans_stamp, causing a later RTO to very prematurely time out the connection with ETIMEDOUT. Here is the buggy scenario, expanding upon Nagaraj Arankal's excellent report: (*1) Send one data packet on a non-SACK connection (*2) Because no ACK packet is received, the packet is retransmitted and we enter CA_Loss; but this retransmission is spurious. (*3) The ACK for the original data is received. The transmitted packet is acknowledged. The TCP timestamp is before the retrans_stamp, so tcp_may_undo() returns true, and tcp_try_undo_loss() returns true without changing state to Open (because tcp_is_sack() is false), and tcp_process_loss() returns without calling tcp_try_undo_recovery(). Normally after undoing a CA_Loss episode, tcp_fastretrans_alert() would see that the connection has returned to CA_Open and fall through and call tcp_try_to_open(), which would set retrans_stamp to 0. However, for non-SACK connections we hold the connection in CA_Loss, so do not fall through to call tcp_try_to_open() and do not set retrans_stamp to 0. So retrans_stamp is (erroneously) still non-zero. At this point the first "retransmission event" has passed and been recovered from. Any future retransmission is a completely new "event". However, retrans_stamp is erroneously still set. (And we are still in CA_Loss, which is correct.) (*4) After 16 minutes (to correspond with tcp_retries2=3D15), a new data packet is sent. Note: No data is transmitted between (*3) and (*4) and we disabled keep alives. The socket's timeout SHOULD be calculated from this point in time, but instead it's calculated from the prior "event" 16 minutes ago (step (*2)). (*5) Because no ACK packet is received, the packet is retransmitted. (*6) At the time of the 2nd retransmission, the socket returns ETIMEDOUT, prematurely, because retrans_stamp is (erroneously) too far in the past (set at the time of (*2)). This commit fixes this bug by ensuring that we reuse in tcp_try_undo_loss() the same careful logic for non-SACK connections that we have in tcp_try_undo_recovery(). To avoid duplicating logic, we factor out that logic into a new tcp_is_non_sack_preventing_reopen() helper and call that helper from both undo functions. Fixes: da34ac7626b5 ("tcp: only undo on partial ACKs in CA_Loss") Reported-by: Nagaraj Arankal Link: https://lore.kernel.org/all/SJ0PR84MB1847BE6C24D274C46A1B9B0EB27A9@SJ= 0PR84MB1847.NAMPRD84.PROD.OUTLOOK.COM/ Signed-off-by: Neal Cardwell Signed-off-by: Yuchung Cheng Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20220903121023.866900-1-ncardwell.kernel@gm= ail.com Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/ipv4/tcp_input.c | 25 ++++++++++++++++++------- 1 file changed, 18 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index e62500d6fe0d0..4ecd85b1e806c 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c @@ -2496,6 +2496,21 @@ static inline bool tcp_may_undo(const struct tcp_soc= k *tp) return tp->undo_marker && (!tp->undo_retrans || tcp_packet_delayed(tp)); } =20 +static bool tcp_is_non_sack_preventing_reopen(struct sock *sk) +{ + struct tcp_sock *tp =3D tcp_sk(sk); + + if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { + /* Hold old state until something *above* high_seq + * is ACKed. For Reno it is MUST to prevent false + * fast retransmits (RFC2582). SACK TCP is safe. */ + if (!tcp_any_retrans_done(sk)) + tp->retrans_stamp =3D 0; + return true; + } + return false; +} + /* People celebrate: "We love our President!" */ static bool tcp_try_undo_recovery(struct sock *sk) { @@ -2518,14 +2533,8 @@ static bool tcp_try_undo_recovery(struct sock *sk) } else if (tp->rack.reo_wnd_persist) { tp->rack.reo_wnd_persist--; } - if (tp->snd_una =3D=3D tp->high_seq && tcp_is_reno(tp)) { - /* Hold old state until something *above* high_seq - * is ACKed. For Reno it is MUST to prevent false - * fast retransmits (RFC2582). SACK TCP is safe. */ - if (!tcp_any_retrans_done(sk)) - tp->retrans_stamp =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) return true; - } tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; return false; @@ -2561,6 +2570,8 @@ static bool tcp_try_undo_loss(struct sock *sk, bool f= rto_undo) NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPSPURIOUSRTOS); inet_csk(sk)->icsk_retransmits =3D 0; + if (tcp_is_non_sack_preventing_reopen(sk)) + return true; if (frto_undo || tcp_is_sack(tp)) { tcp_set_ca_state(sk, TCP_CA_Open); tp->is_sack_reneg =3D 0; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9D532C6FA89 for ; Tue, 13 Sep 2022 14:55:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234515AbiIMOze (ORCPT ); Tue, 13 Sep 2022 10:55:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35196 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234631AbiIMOvS (ORCPT ); Tue, 13 Sep 2022 10:51:18 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0B3C2726A5; Tue, 13 Sep 2022 07:26:23 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 77293614D9; Tue, 13 Sep 2022 14:24:21 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8F25BC433C1; Tue, 13 Sep 2022 14:24:20 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079060; bh=3Mr7JGdFdjtbL+VTIFN142PxDN9qHLoULZFARFGLk5A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=D+VhbXH7079YFSgobn+oUXImiptu66aTK9Dgk+4eqYdSzdMlXI4x2Tk8xhs5wZ/Jw 9drbn0mUA2QnuarWR6YygvhS3wrNik8To3/6brUY/ZS1IfVqcfB/7jYD6shoBiGh+7 5e/YzSit9sL5sU4pU2nZTcgKNIGFyI7VJcRdHER4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, =?UTF-8?q?Toke=20H=C3=B8iland-J=C3=B8rgensen?= , Cong Wang , Paolo Abeni , Sasha Levin Subject: [PATCH 5.10 68/79] sch_sfb: Also store skb len before calling child enqueue Date: Tue, 13 Sep 2022 16:05:13 +0200 Message-Id: <20220913140353.463103044@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Toke H=C3=B8iland-J=C3=B8rgensen [ Upstream commit 2f09707d0c972120bf794cfe0f0c67e2c2ddb252 ] Cong Wang noticed that the previous fix for sch_sfb accessing the queued skb after enqueueing it to a child qdisc was incomplete: the SFB enqueue function was also calling qdisc_qstats_backlog_inc() after enqueue, which reads the pkt len from the skb cb field. Fix this by also storing the skb len, and using the stored value to increment the backlog after enqueueing. Fixes: 9efd23297cca ("sch_sfb: Don't assume the skb is still around after e= nqueueing to child") Signed-off-by: Toke H=C3=B8iland-J=C3=B8rgensen Acked-by: Cong Wang Link: https://lore.kernel.org/r/20220905192137.965549-1-toke@toke.dk Signed-off-by: Paolo Abeni Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- net/sched/sch_sfb.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c index f180cf95cfc97..b2724057629f6 100644 --- a/net/sched/sch_sfb.c +++ b/net/sched/sch_sfb.c @@ -281,6 +281,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, { =20 struct sfb_sched_data *q =3D qdisc_priv(sch); + unsigned int len =3D qdisc_pkt_len(skb); struct Qdisc *child =3D q->qdisc; struct tcf_proto *fl; struct sfb_skb_cb cb; @@ -403,7 +404,7 @@ static int sfb_enqueue(struct sk_buff *skb, struct Qdis= c *sch, memcpy(&cb, sfb_skb_cb(skb), sizeof(cb)); ret =3D qdisc_enqueue(skb, child, to_free); if (likely(ret =3D=3D NET_XMIT_SUCCESS)) { - qdisc_qstats_backlog_inc(sch, skb); + sch->qstats.backlog +=3D len; sch->q.qlen++; increment_qlen(&cb, q); } else if (net_xmit_drop_count(ret)) { --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 95018C6FA82 for ; Tue, 13 Sep 2022 14:57:30 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234669AbiIMO52 (ORCPT ); Tue, 13 Sep 2022 10:57:28 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44118 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234640AbiIMOxe (ORCPT ); Tue, 13 Sep 2022 10:53:34 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 6714567450; Tue, 13 Sep 2022 07:26:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 3ACD86149A; Tue, 13 Sep 2022 14:24:24 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 478E0C433D7; Tue, 13 Sep 2022 14:24:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079063; bh=dqgcicMSD2kRAzU5ZVBwjKEmlRdW45onYHG3fvnKt08=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=cNxTCXXhifo8Cpu183vtHLXNQoiikLtzTdCiudXgCQ5+Qdw3aSffGM2JMUyLd7IiR 9hKMLDeRrSs5f9PurOpWxOsEfyxjS6FFIgaoetyrlmqB8796fhjYjOCSw/Gm0VKlHS Phj50fp4jZk3kystdhS77mxDc/TeFnScWOQLAcsU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Claudiu Beznea , Mark Brown , Nathan Chancellor Subject: [PATCH 5.10 69/79] ASoC: mchp-spdiftx: remove references to mchp_i2s_caps Date: Tue, 13 Sep 2022 16:05:14 +0200 Message-Id: <20220913140353.512651428@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Claudiu Beznea commit 403fcb5118a0f4091001a537e76923031fb45eaf upstream. Remove references to struct mchp_i2s_caps as they are not used. Signed-off-by: Claudiu Beznea Link: https://lore.kernel.org/r/20220727090814.2446111-3-claudiu.beznea@mic= rochip.com Signed-off-by: Mark Brown Cc: Nathan Chancellor Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/soc/atmel/mchp-spdiftx.c | 8 -------- 1 file changed, 8 deletions(-) --- a/sound/soc/atmel/mchp-spdiftx.c +++ b/sound/soc/atmel/mchp-spdiftx.c @@ -196,7 +196,6 @@ struct mchp_spdiftx_dev { struct clk *pclk; struct clk *gclk; unsigned int fmt; - const struct mchp_i2s_caps *caps; int gclk_enabled:1; }; =20 @@ -766,8 +765,6 @@ static const struct of_device_id mchp_sp MODULE_DEVICE_TABLE(of, mchp_spdiftx_dt_ids); static int mchp_spdiftx_probe(struct platform_device *pdev) { - struct device_node *np =3D pdev->dev.of_node; - const struct of_device_id *match; struct mchp_spdiftx_dev *dev; struct resource *mem; struct regmap *regmap; @@ -781,11 +778,6 @@ static int mchp_spdiftx_probe(struct pla if (!dev) return -ENOMEM; =20 - /* Get hardware capabilities. */ - match =3D of_match_node(mchp_spdiftx_dt_ids, np); - if (match) - dev->caps =3D match->data; - /* Map I/O registers. */ base =3D devm_platform_get_and_ioremap_resource(pdev, 0, &mem); if (IS_ERR(base)) From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 39ECBC6FA82 for ; Tue, 13 Sep 2022 14:49:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232456AbiIMOsa (ORCPT ); Tue, 13 Sep 2022 10:48:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56316 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232366AbiIMOr0 (ORCPT ); Tue, 13 Sep 2022 10:47:26 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4E69E12086; Tue, 13 Sep 2022 07:24:42 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C4A0614D8; Tue, 13 Sep 2022 14:24:27 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6A83FC433D6; Tue, 13 Sep 2022 14:24:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079066; bh=r+YlTaX0dY8gX5whwqUha3eiLJLbOHs5xT3YUMBKf/0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gbQKj/Vk7i0Umvq3YinIWbG+NX4fjudn2qu5HokXskiGjhl/4ieQGJdNOQcNYL+Q3 xCdsKOgUKja0OGVnyu+qi2jb9RHhdF7N0Bs2XhIyOR4w9DqWdwH2E8L+hta8D4kIAZ 8eVZZCqOoyFslCoSdqiWvula09uvxfnN0mb99tDY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Mark Brown Subject: [PATCH 5.10 70/79] ASoC: mchp-spdiftx: Fix clang -Wbitfield-constant-conversion Date: Tue, 13 Sep 2022 16:05:15 +0200 Message-Id: <20220913140353.553221170@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Nathan Chancellor commit 5c5c2baad2b55cc0a4b190266889959642298f79 upstream. A recent change in clang strengthened its -Wbitfield-constant-conversion to warn when 1 is assigned to a 1-bit signed integer bitfield, as it can only be 0 or -1, not 1: sound/soc/atmel/mchp-spdiftx.c:505:20: error: implicit truncation from 'i= nt' to bit-field changes value from 1 to -1 [-Werror,-Wbitfield-constant-co= nversion] dev->gclk_enabled =3D 1; ^ ~ 1 error generated. The actual value of the field is never checked, just that it is not zero, so there is not a real bug here. However, it is simple enough to silence the warning by making the bitfield unsigned, which matches the mchp-spdifrx driver. Fixes: 06ca24e98e6b ("ASoC: mchp-spdiftx: add driver for S/PDIF TX Controll= er") Link: https://github.com/ClangBuiltLinux/linux/issues/1686 Link: https://github.com/llvm/llvm-project/commit/82afc9b169a67e8b8a1862fb9= c41a2cd974d6691 Signed-off-by: Nathan Chancellor Reviewed-by: Nick Desaulniers Link: https://lore.kernel.org/r/20220810010809.2024482-1-nathan@kernel.org Signed-off-by: Mark Brown Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- sound/soc/atmel/mchp-spdiftx.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sound/soc/atmel/mchp-spdiftx.c b/sound/soc/atmel/mchp-spdiftx.c index 4850a177803d..ab2d7a791f39 100644 --- a/sound/soc/atmel/mchp-spdiftx.c +++ b/sound/soc/atmel/mchp-spdiftx.c @@ -196,7 +196,7 @@ struct mchp_spdiftx_dev { struct clk *pclk; struct clk *gclk; unsigned int fmt; - int gclk_enabled:1; + unsigned int gclk_enabled:1; }; =20 static inline int mchp_spdiftx_is_running(struct mchp_spdiftx_dev *dev) --=20 2.37.3 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id A8441C6FA82 for ; Tue, 13 Sep 2022 14:48:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231422AbiIMOsM (ORCPT ); Tue, 13 Sep 2022 10:48:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:58164 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232835AbiIMOrI (ORCPT ); Tue, 13 Sep 2022 10:47:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4F66B12D11; Tue, 13 Sep 2022 07:24:43 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 409A8614E0; Tue, 13 Sep 2022 14:24:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4ADAAC433C1; Tue, 13 Sep 2022 14:24:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079069; bh=QguUPaIEEvBzn61sjIX+19HWvFui+vi0iCLd0a5G61A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xMLjpudNmxjufkwEmHNMDS5M1ROvirTdRNjCQlxFPXxIDws1HCE2qY1UpyckY6E86 bXfkx61ftVYUab7GIuzAlW2HwAiJItAZbcMeeeDFdoTNF9H/KKwbJe+x9GF2eJLdws /PKmntOkGJCL4tHPXW2nieeJ0uX9eB9UjYSls718= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Yang Ling , Keguang Zhang , Thomas Bogendoerfer , Sasha Levin Subject: [PATCH 5.10 71/79] MIPS: loongson32: ls1c: Fix hang during startup Date: Tue, 13 Sep 2022 16:05:16 +0200 Message-Id: <20220913140353.601592214@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Yang Ling [ Upstream commit 35508d2424097f9b6a1a17aac94f702767035616 ] The RTCCTRL reg of LS1C is obselete. Writing this reg will cause system hang. Fixes: 60219c563c9b6 ("MIPS: Add RTC support for Loongson1C board") Signed-off-by: Yang Ling Tested-by: Keguang Zhang Acked-by: Keguang Zhang Signed-off-by: Thomas Bogendoerfer Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- arch/mips/loongson32/ls1c/board.c | 1 - 1 file changed, 1 deletion(-) diff --git a/arch/mips/loongson32/ls1c/board.c b/arch/mips/loongson32/ls1c/= board.c index e9de6da0ce51f..9dcfe9de55b0a 100644 --- a/arch/mips/loongson32/ls1c/board.c +++ b/arch/mips/loongson32/ls1c/board.c @@ -15,7 +15,6 @@ static struct platform_device *ls1c_platform_devices[] __= initdata =3D { static int __init ls1c_platform_init(void) { ls1x_serial_set_uartclk(&ls1x_uart_pdev); - ls1x_rtc_set_extclk(&ls1x_rtc_pdev); =20 return platform_add_devices(ls1c_platform_devices, ARRAY_SIZE(ls1c_platform_devices)); --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 82403C6FA89 for ; Tue, 13 Sep 2022 14:56:28 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234831AbiIMO4Z (ORCPT ); Tue, 13 Sep 2022 10:56:25 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:42820 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234586AbiIMOxA (ORCPT ); Tue, 13 Sep 2022 10:53:00 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 67E8672B77; Tue, 13 Sep 2022 07:26:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id ABDFD614CD; Tue, 13 Sep 2022 14:24:32 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C91CAC433D7; Tue, 13 Sep 2022 14:24:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079072; bh=6GQrQaD4Ndg1ownpVmQw1dAi1L9syEgoCYQ/CVGoKu8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=iuvcuEDeUKmDTWNR6RSrfL4Sp2UVZf0YU3MIEx/+8hLe5GP/FkiQRVbtg6f5LQrYH RtMTJsPhz26s6I5oOtwMeWxM/nGtNV0l0gsOWV7zqbcbDg77ErtfrA8iO8pezhc+DC dxrdEtNKKlZ+5mCUCdDGKf6XuPq0wXObxoFPwJ6Q= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Chao Gao , Dongli Zhang , Christoph Hellwig , Sasha Levin Subject: [PATCH 5.10 72/79] swiotlb: avoid potential left shift overflow Date: Tue, 13 Sep 2022 16:05:17 +0200 Message-Id: <20220913140353.642694052@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Chao Gao [ Upstream commit 3f0461613ebcdc8c4073e235053d06d5aa58750f ] The second operand passed to slot_addr() is declared as int or unsigned int in all call sites. The left-shift to get the offset of a slot can overflow if swiotlb size is larger than 4G. Convert the macro to an inline function and declare the second argument as phys_addr_t to avoid the potential overflow. Fixes: 26a7e094783d ("swiotlb: refactor swiotlb_tbl_map_single") Signed-off-by: Chao Gao Reviewed-by: Dongli Zhang Signed-off-by: Christoph Hellwig Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- kernel/dma/swiotlb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/dma/swiotlb.c b/kernel/dma/swiotlb.c index 274587a57717f..4a9831d01f0ea 100644 --- a/kernel/dma/swiotlb.c +++ b/kernel/dma/swiotlb.c @@ -452,7 +452,10 @@ static void swiotlb_bounce(phys_addr_t orig_addr, phys= _addr_t tlb_addr, } } =20 -#define slot_addr(start, idx) ((start) + ((idx) << IO_TLB_SHIFT)) +static inline phys_addr_t slot_addr(phys_addr_t start, phys_addr_t idx) +{ + return start + (idx << IO_TLB_SHIFT); +} =20 /* * Return the offset into a iotlb slot required to keep the device happy. --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id DC7E0C6FA82 for ; Tue, 13 Sep 2022 14:48:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231966AbiIMOsR (ORCPT ); Tue, 13 Sep 2022 10:48:17 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:53324 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232978AbiIMOrN (ORCPT ); Tue, 13 Sep 2022 10:47:13 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 042E0BC17; Tue, 13 Sep 2022 07:24:38 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 6CD63B80F97; Tue, 13 Sep 2022 14:24:38 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D07B4C43145; Tue, 13 Sep 2022 14:24:36 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079077; bh=6Jvr1E/6ttTfM9/mc+Bj09K9kw5iwsUZvKkDvuqgpxM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=U3Nq/rZxednmWE3zj3oVkJye0joDJcpsFrBtSBRusYILY3UR2j/xdKaAtK177TtJN fPAlpGqP2jYVlOnwAs1+P/wMXXsLDR4MXswmv/r7O43t8sFO5MIb/UGegZwFcqQJCd 5J+uMlgS4QQhmDufXuZfRhBQ+oFRq1F5/d2QLsKw= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, John Sperbeck , Joerg Roedel , Sasha Levin Subject: [PATCH 5.10 73/79] iommu/amd: use full 64-bit value in build_completion_wait() Date: Tue, 13 Sep 2022 16:05:18 +0200 Message-Id: <20220913140353.685782583@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: John Sperbeck [ Upstream commit 94a568ce32038d8ff9257004bb4632e60eb43a49 ] We started using a 64 bit completion value. Unfortunately, we only stored the low 32-bits, so a very large completion value would never be matched in iommu_completion_wait(). Fixes: c69d89aff393 ("iommu/amd: Use 4K page for completion wait write-back= semaphore") Signed-off-by: John Sperbeck Link: https://lore.kernel.org/r/20220801192229.3358786-1-jsperbeck@google.c= om Signed-off-by: Joerg Roedel Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/iommu/amd/iommu.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c index 200cf5da5e0ad..f216a86d9c817 100644 --- a/drivers/iommu/amd/iommu.c +++ b/drivers/iommu/amd/iommu.c @@ -923,7 +923,8 @@ static void build_completion_wait(struct iommu_cmd *cmd, memset(cmd, 0, sizeof(*cmd)); cmd->data[0] =3D lower_32_bits(paddr) | CMD_COMPL_WAIT_STORE_MASK; cmd->data[1] =3D upper_32_bits(paddr); - cmd->data[2] =3D data; + cmd->data[2] =3D lower_32_bits(data); + cmd->data[3] =3D upper_32_bits(data); CMD_SET_TYPE(cmd, CMD_COMPL_WAIT); } =20 --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id BD148C6FA82 for ; Tue, 13 Sep 2022 14:56:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234743AbiIMO4O (ORCPT ); Tue, 13 Sep 2022 10:56:14 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:41178 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234567AbiIMOwi (ORCPT ); Tue, 13 Sep 2022 10:52:38 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [145.40.68.75]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C0E9461D55; Tue, 13 Sep 2022 07:26:49 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id DE7ACB80FAC; Tue, 13 Sep 2022 14:24:40 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 47409C433D7; Tue, 13 Sep 2022 14:24:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079079; bh=GmD8OyhS5q9OcZubOKiww01zvgwVnQC/NOAKXwhA8qU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zQWMM+qi3eroPQSsDhm9jDvTgRy6pb4IofK8ZY4bML1IvZuY+bTPQRwhZdvsX0Eb7 tymNEt7PDFbheD1wvX5LFK+8cVNJ5a/D9/wygLL5qaVoeNWaxr8MrUvm7DdwmEgjID 9AQZttz8OU+BRo7Cp7BRLBfQqXRyGvW7T1KNMczU= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eliav Farber , Andy Shevchenko , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 74/79] hwmon: (mr75203) fix VM sensor allocation when "intel,vm-map" not defined Date: Tue, 13 Sep 2022 16:05:19 +0200 Message-Id: <20220913140353.728371935@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eliav Farber [ Upstream commit 81114fc3d27bf5b06b2137d2fd2b63da656a8b90 ] Bug - in case "intel,vm-map" is missing in device-tree ,'num' is set to 0, and no voltage channel infos are allocated. The reason num is set to 0 when "intel,vm-map" is missing is to set the entire pvt->vm_idx[] with incremental channel numbers, but it didn't take into consideration that same num is used later in devm_kcalloc(). If "intel,vm-map" does exist there is no need to set the unspecified channels with incremental numbers, because the unspecified channels can't be accessed in pvt_read_in() which is the only other place besides the probe functions that uses pvt->vm_idx[]. This change fixes the bug by moving the incremental channel numbers setting to be done only if "intel,vm-map" property is defined (starting loop from 0), and removing 'num =3D 0'. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR7= 5203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-3-farbere@amazon.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/hwmon/mr75203.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/drivers/hwmon/mr75203.c b/drivers/hwmon/mr75203.c index 046523d47c29b..81ccb4c6fa5c0 100644 --- a/drivers/hwmon/mr75203.c +++ b/drivers/hwmon/mr75203.c @@ -594,7 +594,12 @@ static int mr75203_probe(struct platform_device *pdev) ret =3D device_property_read_u8_array(dev, "intel,vm-map", pvt->vm_idx, vm_num); if (ret) { - num =3D 0; + /* + * Incase intel,vm-map property is not defined, we + * assume incremental channel numbers. + */ + for (i =3D 0; i < vm_num; i++) + pvt->vm_idx[i] =3D i; } else { for (i =3D 0; i < vm_num; i++) if (pvt->vm_idx[i] >=3D vm_num || @@ -604,13 +609,6 @@ static int mr75203_probe(struct platform_device *pdev) } } =20 - /* - * Incase intel,vm-map property is not defined, we assume - * incremental channel numbers. - */ - for (i =3D num; i < vm_num; i++) - pvt->vm_idx[i] =3D i; - in_config =3D devm_kcalloc(dev, num + 1, sizeof(*in_config), GFP_KERNEL); if (!in_config) --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EE929C54EE9 for ; Tue, 13 Sep 2022 14:50:15 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233086AbiIMOuM (ORCPT ); Tue, 13 Sep 2022 10:50:12 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:46986 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231365AbiIMOsC (ORCPT ); Tue, 13 Sep 2022 10:48:02 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D3F7840555; Tue, 13 Sep 2022 07:24:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 8B729614E3; Tue, 13 Sep 2022 14:24:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3643C433D6; Tue, 13 Sep 2022 14:24:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079082; bh=I7f7aCY9/82WmECQOspPknkZfTXRLzskFh+6+OBXADc=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=zj0nzbVrybSc61hJCGpHpKrcghG0dykR+hvuK4oWaY8/fzfcfUfLu2wTBqWJaeG1j pYcFQBwP56xwjLz62FqQDqr0GsA6w9EJWA+ROgxRYxVq3XbTHnMoikDZM5cAl+4CHL nGyHbBY0OkJdh1U5SBGJw6vLRAmNAs60uhHPcJl4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eliav Farber , Andy Shevchenko , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 75/79] hwmon: (mr75203) update pvt->v_num and vm_num to the actual number of used sensors Date: Tue, 13 Sep 2022 16:05:20 +0200 Message-Id: <20220913140353.770495619@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eliav Farber [ Upstream commit bb9195bd6664d94d71647631593e09f705ff5edd ] This issue is relevant when "intel,vm-map" is set in device-tree, and defines a lower number of VMs than actually supported. This change is needed for all places that use pvt->v_num or vm_num later on in the code. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR7= 5203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-4-farbere@amazon.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/hwmon/mr75203.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/hwmon/mr75203.c b/drivers/hwmon/mr75203.c index 81ccb4c6fa5c0..62df0c9498f38 100644 --- a/drivers/hwmon/mr75203.c +++ b/drivers/hwmon/mr75203.c @@ -605,6 +605,8 @@ static int mr75203_probe(struct platform_device *pdev) if (pvt->vm_idx[i] >=3D vm_num || pvt->vm_idx[i] =3D=3D 0xff) { num =3D i; + pvt->v_num =3D i; + vm_num =3D i; break; } } --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 14B1EC6FA82 for ; Tue, 13 Sep 2022 14:56:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234794AbiIMO4S (ORCPT ); Tue, 13 Sep 2022 10:56:18 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47424 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S234552AbiIMOwx (ORCPT ); Tue, 13 Sep 2022 10:52:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CCDB872877; Tue, 13 Sep 2022 07:26:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A4D02B80F99; Tue, 13 Sep 2022 14:24:45 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1D637C433C1; Tue, 13 Sep 2022 14:24:43 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079084; bh=9yD3p/C9MRnbnCjZeIQzXX2IHfj7lWdvQF7k9r+B4tA=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ow4kpN+TZ7Pei7fpQgUKC7XdxZ3F2nty1nMHYeQw6NDoElZpAQxxu1MFP3a6/KZlm iOaURrf20uVkTxAorwLqrNafDukFgAEPzCKIuwoxuCSpToj5DQJe87UPTcw6/eDFiU r5IOx0jqOBU/m5Eq8tQGUpNiKCaqCQ2ncciJ/ysA= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eliav Farber , Andy Shevchenko , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 76/79] hwmon: (mr75203) fix voltage equation for negative source input Date: Tue, 13 Sep 2022 16:05:21 +0200 Message-Id: <20220913140353.812461695@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eliav Farber [ Upstream commit 227a3a2fc31d8e4bb9c88d4804e19530af245b1b ] According to Moortec Embedded Voltage Monitor (MEVM) series 3 data sheet, the minimum input signal is -100mv and maximum input signal is +1000mv. The equation used to convert the digital word to voltage uses mixed types (*val signed and n unsigned), and on 64 bit machines also has different size, since sizeof(u32) =3D 4 and sizeof(long) =3D 8. So when measuring a negative input, n will be small enough, such that PVT_N_CONST * n < PVT_R_CONST, and the result of (PVT_N_CONST * n - PVT_R_CONST) will overflow to a very big positive 32 bit number. Then when storing the result in *val it will be the same value just in 64 bit (instead of it representing a negative number which will what happen when sizeof(long) =3D 4). When -1023 <=3D (PVT_N_CONST * n - PVT_R_CONST) <=3D -1 dividing the number by 1024 should result of in 0, but because ">> 10" is used, and the sign bit is used to fill the vacated bit positions, it results in -1 (0xf...fffff) which is wrong. This change fixes the sign problem and supports negative values by casting n to long and replacing the shift right with div operation. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR7= 5203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-5-farbere@amazon.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/hwmon/mr75203.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/drivers/hwmon/mr75203.c b/drivers/hwmon/mr75203.c index 62df0c9498f38..8211d463495d0 100644 --- a/drivers/hwmon/mr75203.c +++ b/drivers/hwmon/mr75203.c @@ -201,8 +201,18 @@ static int pvt_read_in(struct device *dev, u32 attr, i= nt channel, long *val) return ret; =20 n &=3D SAMPLE_DATA_MSK; - /* Convert the N bitstream count into voltage */ - *val =3D (PVT_N_CONST * n - PVT_R_CONST) >> PVT_CONV_BITS; + /* + * Convert the N bitstream count into voltage. + * To support negative voltage calculation for 64bit machines + * n must be cast to long, since n and *val differ both in + * signedness and in size. + * Division is used instead of right shift, because for signed + * numbers, the sign bit is used to fill the vacated bit + * positions, and if the number is negative, 1 is used. + * BIT(x) may not be used instead of (1 << x) because it's + * unsigned. + */ + *val =3D (PVT_N_CONST * (long)n - PVT_R_CONST) / (1 << PVT_CONV_BITS); =20 return 0; default: --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 94282C6FA89 for ; Tue, 13 Sep 2022 14:50:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234221AbiIMOuV (ORCPT ); Tue, 13 Sep 2022 10:50:21 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47090 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231722AbiIMOsG (ORCPT ); Tue, 13 Sep 2022 10:48:06 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D400140559; Tue, 13 Sep 2022 07:24:55 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 5C620614E7; Tue, 13 Sep 2022 14:24:47 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 75612C433C1; Tue, 13 Sep 2022 14:24:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079086; bh=q/kijbVduNiIdugxy6na5WAdoKPnDMCDgKhaCKwIfgo=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lt3HiNrP2uYPrDMXuisfVaaE+ujBGOqf+M8MP+LQJph0Qg4e08PYIMEzIl6UHSkXT Yeefs2qzHlqqTDLr1dz6LPUsLcgefPoQLx38+njvH5g2GVbPpqmthEOan9YY7Rg5tK Hgnp+AHH3flptri4WCuqs3fgL98tkPhWa3ZvIH0E= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eliav Farber , Andy Shevchenko , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 77/79] hwmon: (mr75203) fix multi-channel voltage reading Date: Tue, 13 Sep 2022 16:05:22 +0200 Message-Id: <20220913140353.853425620@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eliav Farber [ Upstream commit 91a9e063cdcfca8fe642b078d6fae4ce49187975 ] Fix voltage allocation and reading to support all channels in all VMs. Prior to this change allocation and reading were done only for the first channel in each VM. This change counts the total number of channels for allocation, and takes into account the channel offset when reading the sample data register. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR7= 5203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-6-farbere@amazon.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/hwmon/mr75203.c | 29 +++++++++++++++++------------ 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/drivers/hwmon/mr75203.c b/drivers/hwmon/mr75203.c index 8211d463495d0..87a14713e1249 100644 --- a/drivers/hwmon/mr75203.c +++ b/drivers/hwmon/mr75203.c @@ -68,8 +68,9 @@ =20 /* VM Individual Macro Register */ #define VM_COM_REG_SIZE 0x200 -#define VM_SDIF_DONE(n) (VM_COM_REG_SIZE + 0x34 + 0x200 * (n)) -#define VM_SDIF_DATA(n) (VM_COM_REG_SIZE + 0x40 + 0x200 * (n)) +#define VM_SDIF_DONE(vm) (VM_COM_REG_SIZE + 0x34 + 0x200 * (vm)) +#define VM_SDIF_DATA(vm, ch) \ + (VM_COM_REG_SIZE + 0x40 + 0x200 * (vm) + 0x4 * (ch)) =20 /* SDA Slave Register */ #define IP_CTRL 0x00 @@ -115,6 +116,7 @@ struct pvt_device { u32 t_num; u32 p_num; u32 v_num; + u32 c_num; u32 ip_freq; u8 *vm_idx; }; @@ -178,14 +180,15 @@ static int pvt_read_in(struct device *dev, u32 attr, = int channel, long *val) { struct pvt_device *pvt =3D dev_get_drvdata(dev); struct regmap *v_map =3D pvt->v_map; + u8 vm_idx, ch_idx; u32 n, stat; - u8 vm_idx; int ret; =20 - if (channel >=3D pvt->v_num) + if (channel >=3D pvt->v_num * pvt->c_num) return -EINVAL; =20 - vm_idx =3D pvt->vm_idx[channel]; + vm_idx =3D pvt->vm_idx[channel / pvt->c_num]; + ch_idx =3D channel % pvt->c_num; =20 switch (attr) { case hwmon_in_input: @@ -196,7 +199,7 @@ static int pvt_read_in(struct device *dev, u32 attr, in= t channel, long *val) if (ret) return ret; =20 - ret =3D regmap_read(v_map, VM_SDIF_DATA(vm_idx), &n); + ret =3D regmap_read(v_map, VM_SDIF_DATA(vm_idx, ch_idx), &n); if(ret < 0) return ret; =20 @@ -509,8 +512,8 @@ static int pvt_reset_control_deassert(struct device *de= v, struct pvt_device *pvt =20 static int mr75203_probe(struct platform_device *pdev) { + u32 ts_num, vm_num, pd_num, ch_num, val, index, i; const struct hwmon_channel_info **pvt_info; - u32 ts_num, vm_num, pd_num, val, index, i; struct device *dev =3D &pdev->dev; u32 *temp_config, *in_config; struct device *hwmon_dev; @@ -551,9 +554,11 @@ static int mr75203_probe(struct platform_device *pdev) ts_num =3D (val & TS_NUM_MSK) >> TS_NUM_SFT; pd_num =3D (val & PD_NUM_MSK) >> PD_NUM_SFT; vm_num =3D (val & VM_NUM_MSK) >> VM_NUM_SFT; + ch_num =3D (val & CH_NUM_MSK) >> CH_NUM_SFT; pvt->t_num =3D ts_num; pvt->p_num =3D pd_num; pvt->v_num =3D vm_num; + pvt->c_num =3D ch_num; val =3D 0; if (ts_num) val++; @@ -590,7 +595,7 @@ static int mr75203_probe(struct platform_device *pdev) } =20 if (vm_num) { - u32 num =3D vm_num; + u32 total_ch; =20 ret =3D pvt_get_regmap(pdev, "vm", pvt); if (ret) @@ -614,20 +619,20 @@ static int mr75203_probe(struct platform_device *pdev) for (i =3D 0; i < vm_num; i++) if (pvt->vm_idx[i] >=3D vm_num || pvt->vm_idx[i] =3D=3D 0xff) { - num =3D i; pvt->v_num =3D i; vm_num =3D i; break; } } =20 - in_config =3D devm_kcalloc(dev, num + 1, + total_ch =3D ch_num * vm_num; + in_config =3D devm_kcalloc(dev, total_ch + 1, sizeof(*in_config), GFP_KERNEL); if (!in_config) return -ENOMEM; =20 - memset32(in_config, HWMON_I_INPUT, num); - in_config[num] =3D 0; + memset32(in_config, HWMON_I_INPUT, total_ch); + in_config[total_ch] =3D 0; pvt_in.config =3D in_config; =20 pvt_info[index++] =3D &pvt_in; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3CCFFC6FA89 for ; Tue, 13 Sep 2022 14:49:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231614AbiIMOty (ORCPT ); Tue, 13 Sep 2022 10:49:54 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57076 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230432AbiIMOry (ORCPT ); Tue, 13 Sep 2022 10:47:54 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6B902AD6; Tue, 13 Sep 2022 07:24:50 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id 53754B80F97; Tue, 13 Sep 2022 14:24:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id C0CB1C433D7; Tue, 13 Sep 2022 14:24:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079089; bh=501Rn0OdEMh49HtFQC2VoUifXbIOdKbILGrPLCd773M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=SjXGAdeuucr5f+s4jeRO99gd8t5tRgJcT7VoVHVww2pAUZr05lCCUIOC9/sjhQUAa hEX5ZmnmozuFseVKUOoEFo8jt6JCO/MvUNfPj4db/fSBr/IEOy96juENp7Z8reBqtR AM2j+MbqkRdvu5jipySv93k1iM2FC1i2rgO6at7o= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eliav Farber , Andy Shevchenko , Guenter Roeck , Sasha Levin Subject: [PATCH 5.10 78/79] hwmon: (mr75203) enable polling for all VM channels Date: Tue, 13 Sep 2022 16:05:23 +0200 Message-Id: <20220913140353.894533868@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Eliav Farber [ Upstream commit e43212e0f55dc2d6b15d6c174cc0a64b25fab5e7 ] Configure ip-polling register to enable polling for all voltage monitor channels. This enables reading the voltage values for all inputs other than just input 0. Fixes: 9d823351a337 ("hwmon: Add hardware monitoring driver for Moortec MR7= 5203 PVT controller") Signed-off-by: Eliav Farber Reviewed-by: Andy Shevchenko Link: https://lore.kernel.org/r/20220908152449.35457-7-farbere@amazon.com Signed-off-by: Guenter Roeck Signed-off-by: Sasha Levin Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- drivers/hwmon/mr75203.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/drivers/hwmon/mr75203.c b/drivers/hwmon/mr75203.c index 87a14713e1249..41e3d3b54baff 100644 --- a/drivers/hwmon/mr75203.c +++ b/drivers/hwmon/mr75203.c @@ -398,6 +398,19 @@ static int pvt_init(struct pvt_device *pvt) if (ret) return ret; =20 + val =3D (BIT(pvt->c_num) - 1) | VM_CH_INIT | + IP_POLL << SDIF_ADDR_SFT | SDIF_WRN_W | SDIF_PROG; + ret =3D regmap_write(v_map, SDIF_W, val); + if (ret < 0) + return ret; + + ret =3D regmap_read_poll_timeout(v_map, SDIF_STAT, + val, !(val & SDIF_BUSY), + PVT_POLL_DELAY_US, + PVT_POLL_TIMEOUT_US); + if (ret) + return ret; + val =3D CFG1_VOL_MEAS_MODE | CFG1_PARALLEL_OUT | CFG1_14_BIT | IP_CFG << SDIF_ADDR_SFT | SDIF_WRN_W | SDIF_PROG; --=20 2.35.1 From nobody Sun Apr 5 22:39:42 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C4B2BC6FA8B for ; Tue, 13 Sep 2022 14:50:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232190AbiIMOt6 (ORCPT ); Tue, 13 Sep 2022 10:49:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:47012 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230525AbiIMOsD (ORCPT ); Tue, 13 Sep 2022 10:48:03 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 97E504DB57; Tue, 13 Sep 2022 07:25:00 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 197C5614E2; Tue, 13 Sep 2022 14:24:52 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 34DACC433C1; Tue, 13 Sep 2022 14:24:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1663079091; bh=+RsWGVtIT/5YPLjO/tNcWAjnJMTOMBbs2/rsZxV2re4=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=2PLdt13fDnAn1xRm3ILTtWJd6ISwDPOSVGOPkzNyT0rbqMwWnQ0rgKcIdT+0ZhENi TM1/Bl+D+etMhB8C34lksWV4ZKNCdnc/7qEGM4WTEepaErrHJuhNrUmqWeOp2A/9wt yUgd5bJXdx9kCQng+S/0A0R36x8StZTIsj+L+qM8= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Ionela Voinescu , Catalin Marinas , Will Deacon , James Morse Subject: [PATCH 5.10 79/79] arm64: errata: add detection for AMEVCNTR01 incrementing incorrectly Date: Tue, 13 Sep 2022 16:05:24 +0200 Message-Id: <20220913140353.941149033@linuxfoundation.org> X-Mailer: git-send-email 2.37.3 In-Reply-To: <20220913140350.291927556@linuxfoundation.org> References: <20220913140350.291927556@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Ionela Voinescu commit e89d120c4b720e232cc6a94f0fcbd59c15d41489 upstream. The AMU counter AMEVCNTR01 (constant counter) should increment at the same rate as the system counter. On affected Cortex-A510 cores, AMEVCNTR01 increments incorrectly giving a significantly higher output value. This results in inaccurate task scheduler utilization tracking and incorrect feedback on CPU frequency. Work around this problem by returning 0 when reading the affected counter in key locations that results in disabling all users of this counter from using it either for frequency invariance or as FFH reference counter. This effect is the same to firmware disabling affected counters. Details on how the two features are affected by this erratum: - AMU counters will not be used for frequency invariance for affected CPUs and CPUs in the same cpufreq policy. AMUs can still be used for frequency invariance for unaffected CPUs in the system. Although unlikely, if no alternative method can be found to support frequency invariance for affected CPUs (cpufreq based or solution based on platform counters) frequency invariance will be disabled. Please check the chapter on frequency invariance at Documentation/scheduler/sched-capacity.rst for details of its effect. - Given that FFH can be used to fetch either the core or constant counter values, restrictions are lifted regarding any of these counters returning a valid (!0) value. Therefore FFH is considered supported if there is a least one CPU that support AMUs, independent of any counters being disabled or affected by this erratum. Clarifying comments are now added to the cpc_ffh_supported(), cpu_read_constcnt() and cpu_read_corecnt() functions. The above is achieved through adding a new erratum: ARM64_ERRATUM_2457168. Signed-off-by: Ionela Voinescu Reviewed-by: Catalin Marinas Cc: Catalin Marinas Cc: Will Deacon Cc: James Morse Link: https://lore.kernel.org/r/20220819103050.24211-1-ionela.voinescu@arm.= com Signed-off-by: Will Deacon Signed-off-by: Greg Kroah-Hartman Tested-by: Florian Fainelli Tested-by: Guenter Roeck Tested-by: Hulk Robot Tested-by: Linux Kernel Functional Testing Tested-by: Pavel Machek (CIP) Tested-by: Rudi Heitbaum Tested-by: Sudip Mukherjee --- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 18 ++++++++++++++++++ arch/arm64/include/asm/cpucaps.h | 3 ++- arch/arm64/kernel/cpu_errata.c | 9 +++++++++ arch/arm64/kernel/cpufeature.c | 5 ++++- 5 files changed, 35 insertions(+), 2 deletions(-) --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -92,6 +92,8 @@ stable kernels. +----------------+-----------------+-----------------+--------------------= ---------+ | ARM | Cortex-A77 | #1508412 | ARM64_ERRATUM_15084= 12 | +----------------+-----------------+-----------------+--------------------= ---------+ +| ARM | Cortex-A510 | #2457168 | ARM64_ERRATUM_24571= 68 | ++----------------+-----------------+-----------------+--------------------= ---------+ | ARM | Neoverse-N1 | #1188873,1418040| ARM64_ERRATUM_14180= 40 | +----------------+-----------------+-----------------+--------------------= ---------+ | ARM | Neoverse-N1 | #1349291 | N/A = | --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -657,6 +657,24 @@ config ARM64_ERRATUM_1508412 =20 If unsure, say Y. =20 +config ARM64_ERRATUM_2457168 + bool "Cortex-A510: 2457168: workaround for AMEVCNTR01 incrementing incorr= ectly" + depends on ARM64_AMU_EXTN + default y + help + This option adds the workaround for ARM Cortex-A510 erratum 2457168. + + The AMU counter AMEVCNTR01 (constant counter) should increment at the s= ame rate + as the system counter. On affected Cortex-A510 cores AMEVCNTR01 increme= nts + incorrectly giving a significantly higher output value. + + Work around this problem by keeping the reference values of affected co= unters + to 0 thus signaling an error case. This effect is the same to firmware = disabling + affected counters, in which case 0 will be returned when reading the di= sabled + counters. + + If unsure, say Y. + config CAVIUM_ERRATUM_22375 bool "Cavium erratum 22375, 24313" default y --- a/arch/arm64/include/asm/cpucaps.h +++ b/arch/arm64/include/asm/cpucaps.h @@ -67,7 +67,8 @@ #define ARM64_MTE 57 #define ARM64_WORKAROUND_1508412 58 #define ARM64_SPECTRE_BHB 59 +#define ARM64_WORKAROUND_2457168 60 =20 -#define ARM64_NCAPS 60 +#define ARM64_NCAPS 61 =20 #endif /* __ASM_CPUCAPS_H */ --- a/arch/arm64/kernel/cpu_errata.c +++ b/arch/arm64/kernel/cpu_errata.c @@ -546,6 +546,15 @@ const struct arm64_cpu_capabilities arm6 1, 0), }, #endif +#ifdef CONFIG_ARM64_ERRATUM_2457168 + { + .desc =3D "ARM erratum 2457168", + .capability =3D ARM64_WORKAROUND_2457168, + .type =3D ARM64_CPUCAP_WEAK_LOCAL_CPU_FEATURE, + /* Cortex-A510 r0p0-r1p1 */ + CAP_MIDR_RANGE(MIDR_CORTEX_A510, 0, 0, 1, 1) + }, +#endif { } }; --- a/arch/arm64/kernel/cpufeature.c +++ b/arch/arm64/kernel/cpufeature.c @@ -1559,7 +1559,10 @@ static void cpu_amu_enable(struct arm64_ pr_info("detected CPU%d: Activity Monitors Unit (AMU)\n", smp_processor_id()); cpumask_set_cpu(smp_processor_id(), &amu_cpus); - init_cpu_freq_invariance_counters(); + + /* 0 reference values signal broken/disabled counters */ + if (!this_cpu_has_cap(ARM64_WORKAROUND_2457168)) + init_cpu_freq_invariance_counters(); } }